skysight-inc/HackerNews huggingface dataset:
So, I just got this url from this HN comment:

https://news.ycombinator.com/item?id=19825921

I'm not clear if they rehosted the XPI or if that's the original mozilla url.

I'm not too worried about it either. The only reason anyone is clicking on this fine link is because firefox only lets you install addons signed by Mozilla. And since the typical signing process gives addons signed by the broken intermediary we can be pretty confident that this wasn't just signed by mozilla, but is the original study.

In general caution about installing software from random links is definitely a good idea though.

Edit: Looks to me like it's an original mozilla url (judging by github comments on mozilla/normandy - I haven't found an official source saying it is official due to lack of continuing to search: https://github.com/mozilla/normandy/pull/1697)
"Apparently, there was some sort of agreement that OP would not be disclosing his own related work independently of Kenneth."

Where's that? I'm unable to find anything close to that in the post.
Successful application of this approach can also in some cases significantly alter your reality as well.
Considering the number of people in this thread defending pollution and blaming the dead girl or her parents, I wouldn't count on it.

Some days HN goes from its usual baseline mechanical callousness to outright horror film.
This type of reply is ludicrous. An obscure feature (Normandy modifying default settings as part of studies) that requires you to actively opt out (and even then it’s still not clear if you _also_ have to go to about:config to _really_ disable it) and which can make such large scale errors as evicting all extensions is in absolutely no way comparable to the case of a user agreeing to auto-updates and fairly easily being able to disable them.

It is astoundingly disingenuous to act like these things are comparable.
That's sadly not the first time Mozilla fails to communicate appropriately about issues/changes that are pushed down to the end users. They should reshuffle some of their Marketing Resources to work on proper non-promotional communication instead, so that current users at least know what to deal with.
This is one of the things about this whole episode that I find baffling. Stuff like adjusting bug priorities and arranging for someone to tweet an announcement is the work of a good engineering manager. This is the right person to run interference and handle comms and deal with things outside of the critical path, like bugzilla updates.
Discovering Runtime Function References in Clojure
type inference and "any" types are completely different. e.g. in C++,

auto var = 123;

is inference, but

std::any var2 = 123;

is dynamic typing, because you can do `var2 = "foo bar";` unlike the first case.
The Last of the Arctic's Old Sea Ice Is on the Verge of Vanishing
I think that was the point they were making.
It's not just performance that was the issue. XPCOM gives you access to basically the entirety of the browser internals. There's no designed API, the implementation is the API. Which means that you can't change the browser internals, unless you're willing to break addons, or you perform an audit to figure out which plugins will be broken and you get them to update first.

Basically all refactors took months and months and months because of this. There was no way to address the accumulating technical debt.
As of 2019 do we have practical mitigations against RowHammer? Or do we still pretend that it isn’t something to be worried about, and keep producing DRAM that’s fundamentally broken?
We Just Got a Step Closer to Solving the Bizarre Physics of Glass
I'm in a similar boat.

The reason I visit hn is because it's typically technical news. Other news stories do make it to the front page occasionally, but they're normally big stories or tangentially related to tech. That's a trade-off I'm willing to make.
Would you prefer stable only getting crucial security updates and never release updates to speed things up? Eventually Nightly would be completely different from stable, especially with the switch to Rust. So then Mozilla would have to maintain 2 completely different versions of FF - that's a lot more work!

A better middle-ground is to let things get tested by those who opt-in to it (using Nightly and Beta versions), and slowly trickle changes down. That way none of the published versions are so different that Mozilla needs more staff to handle the different versions. And of course, stable users have far fewer issues than nightly/beta users. Certificate expirations throw a wrench in the whole system, but even if you made FF stable never update, you'd still have a problem because the cert expired.
Do you mean with Excelsior JET? I tried to compile an application totaling 157MB in jars to native with it just now. After compiling for 2 hours it was still only 15% done. I had aggressive optimizations disabled.
It’s your right to try and act as a counselor to them, but it’s also your right not to. If you are emotionally invested in their welfare for personal reasons, that will absolutely skew your priorities away from shunning. So will the sunk cost fallacy.

The hardest thing to do is to protect yourself when those circumstances are combined, and someone is this close to getting over the hump, and it’s infinitely worse when they’re family/friend. I’m sorry you had to live through that, no matter what you chose.
F# does not have higher kinded types, because of CLR. So no, they don't manage "work around" generics.

Regarding measurements:
https://www.techempower.com/benchmarks/

Also, I am very interested to see new benchmark results once AOT SubstrateVM will be more widely adopted in JVM community. Demo: https://youtu.be/MN6jNIwl2FQ?t=1136

RedHat already working on a framework which takes full benefit of that: https://quarkus.io/

All in all, with upcoming value types, SubstrateVM adoption, fibers and nice languages improvements like records, future is brighter than ever for Java.

Edit. Regarding JVM vs CLR https://news.ycombinator.com/item?id=15955685
Not this shit again.

It was a private email service. The complaint was that the private email service also happens to be used by Antifa members. Which is unsurprising.

This is like complaining that they shouldn't give money to the Tor project because it gets used by unsavory people, too.
This is true. However it is signed by moz and looking at the source it seems safe enough (the cert is legit). It's just a normal wrapper with the following code added:

// first inject the new cert
try {
let intermediate = "MIIHLTCCBRWgAwIBAgIDEAAIMA0GCSqGSIb3DQEBDAUAMH0xCzAJBgNVBAYTAlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3ppbGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTEfMB0GA1UEAxMWcm9vdC1jYS1wcm9kdWN0aW9uLWFtbzAeFw0xNTA0MDQwMDAwMDBaFw0yNTA0MDQwMDAwMDBaMIGnMQswCQYDVQQGEwJVUzEcMBoGA1UEChMTTW96aWxsYSBDb3Jwb3JhdGlvbjEvMC0GA1UECxMmTW96aWxsYSBBTU8gUHJvZHVjdGlvbiBTaWduaW5nIFNlcnZpY2UxJjAkBgNVBAMTHXNpZ25pbmdjYTEuYWRkb25zLm1vemlsbGEub3JnMSEwHwYJKoZIhvcNAQkBFhJmb3hzZWNAbW96aWxsYS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/qluiiI+wO6qGA4vH7cHvWvXpdju9JnvbwnrbYmxhtUpfS68LbdjGGtv7RP6F1XhHT4MU3v4GuMulH0E4Wfalm8evsb3tBJRMJPICJX5UCLi6VJ6J2vipXSWBf8xbcOB+PY5Kk6L+EZiWaepiM23CdaZjNOJCAB6wFHlGe+zUk87whpLa7GrtrHjTb8u9TSS+mwjhvgfP8ILZrWhzb5H/ybgmD7jYaJGIDY/WDmq1gVe03fShxD09Ml1P7H38o5kbFLnbbqpqC6n8SfUI31MiJAXAN2e6rAOM8EmocAY0EC5KUooXKRsYvHzhwwHkwIbbe6QpTUlIqvw1MPlQPs7Zu/MBnVmyGTSqJxtYoklr0MaEXnJNY3g3FDf1R0Opp2/BEY9Vh3Fc9Pq6qWIhGoMyWdueoSYa+GURqDbsuYnk7ZkysxK+yRoFJu4x3TUBmMKM14jQKLgxvuIzWVn6qg6cw7ye/DYNufc+DSPSTSakSsWJ9IPxiAU7xJ+GCMzaZ10Y3VGOybGLuPxDlSd6KALAoMcl9ghB2mvfB0N3wv6uWnbKuxihq/qDps+FjliNvr7C66mIVH+9rkyHIy6GgIUlwr7E88Qqw+SQeNeph6NIY85PL4p0Y8KivKP4J928tpp18wLuHNbIG+YaUk5WUDZ6/2621pi19UZQ8iiHxN/XKQIDAQABo4IBiTCCAYUwDAYDVR0TBAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwMwHQYDVR0OBBYEFBY++xz/DCuT+JsV1y2jwuZ4YdztMIGoBgNVHSMEgaAwgZ2AFLO86lh0q+FueCqyq5wjHqhjLJe3oYGBpH8wfTELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24xLzAtBgNVBAsTJk1vemlsbGEgQU1PIFByb2R1Y3Rpb24gU2lnbmluZyBTZXJ2aWNlMR8wHQYDVQQDExZyb290LWNhLXByb2R1Y3Rpb24tYW1vggEBMDMGCWCGSAGG+EIBBAQmFiRodHRwOi8vYWRkb25zLm1vemlsbGEub3JnL2NhL2NybC5wZW0wTgYDVR0eBEcwRaFDMCCCHi5jb250ZW50LXNpZ25hdHVyZS5tb3ppbGxhLm9yZzAfgh1jb250ZW50LXNpZ25hdHVyZS5tb3ppbGxhLm9yZzANBgkqhkiG9w0BAQwFAAOCAgEAX1PNli/zErw3tK3S9Bv803RV4tHkrMa5xztxzlWja0VAUJKEQx7f1yM8vmcQJ9g5RE8WFc43IePwzbAoum5F4BTM7tqM//+e476F1YUgB7SnkDTVpBOnV5vRLz1Si4iJ/U0HUvMUvNJEweXvKg/DNbXuCreSvTEAawmRIxqNYoaigQD8x4hCzGcVtIi5Xk2aMCJW2K/6JqkN50pnLBNkPx6FeiYMJCP8z0FIz3fv53FHgu3oeDhi2u3VdONjK3aaFWTlKNiGeDU0/lr0suWfQLsNyphTMbYKyTqQYHxXYJno9PuNi7e1903PvM47fKB5bFmSLyzB1hB1YIVLj0/YqD4nz3lADDB91gMBB7vR2h5bRjFqLOxuOutNNcNRnv7UPqtVCtLF2jVb4/AmdJU78jpfDs+BgY/t2bnGBVFBuwqS2Kult/2kth4YMrL5DrURIM8oXWVQRBKxzr843yDmHo8+2rqxLnZcmWoe8yQ41srZ4IB+V3w2TIAd4gxZAB0Xa6KfnR4D8RgE5sgmgQoK7Y/hdvd9Ahu0WEZI8Eg+mDeCeojWcyjF+dt6c2oERiTmFTIFUoojEjJwLyIqHKt+eApEYpF7imaWcumFN1jR+iUjE4ZSUoVxGtZ/Jdnkf8VVQMhiBA+i7r5PsfrHq+lqTTGOg+GzYx7OmoeJAT0zo4c=";
let certDB = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB);
certDB.addCertFromBase64(intermediate, ",,");
console.log("new intermediate certificate added");
} catch (e) {
console.error("failed to add new intermediate certificate:", e);
}

// Second, force a re-verify of signatures
try {
XPIDatabase.verifySignatures();
console.log("signatures re-verified");
} catch (e) {
console.error("failed to re-verify signatures:", e);
}
Raycasting engine in Factorio (vanilla 0.17)
I think it’s a lot easier to describe what happiness isn’t than what it is – it’s much less difficult (although still not trivial) to instead identify what suffering is. In that sense a good goal would be to minimize the amount of suffering in the world. But do you minimize the maximum suffering experienced by any single individual, or do you minimize the mean suffering, or something else? The particular form of the cost function is a bit difficult to reify.
They are a tool to be used where suitable and not the answer to everything. They are significantly better for detection and classification than what came before but improvement has plateaued. When they fail, how and why is not characterizable. They're good for some things but you have to be careful about how you build the whole system and not just throw a CNN at it unless you really don't mind undefined behavior.
> Peddled by Venture Capitalists

I laughed out aloud when this reminded me of what pg wrote https://twitter.com/paulg/status/1099648817601921024?lang=en
Requiring https is a different situation and much more defensible in my mind. It's way too easy to rewrite the web pages of everyone using library or coffeeshop wifi and thereby hack/phish a lot of people's browsers.
The way I see it, people might have gotten used to software break from time to time. Once software breaks it is reasonable to expect it to get fix in a couple days when it is updated. At least this was probably the experience for the majority of users, those that noticed the issue.
His company is named after his last name (as many companies are) and the product names start with the company name.

This has nothing to do with "The Evans Field Equation"
Would have disabling automatic updates have prevented this entire issue?
What do you think the median size of a Firefox release is, what do you think the resources (let’s call it US dollars FMV) are to audit that, and what do you think the resources Debian has to devote to it?

Clearly more eyes are good, but... In between “Wild West WebExtensions” and “Mozilla backdoors my Firefox and it gets used for nefarious purposes” and “delays in browser updates increase exploitation windows”, I know which threat models I’m buying.
I once tried running jupyter inside docker...the downside i saw was conda install of jupyter is around 1.2 gb, making the container pretty heavy...if you are fine with this then all thats left is to expose the port to the container on which you want your jupyter server to run and changing some config after generating jupyter_config file for remote access.
If there was a time when news was a public service ( at least in the US or even anywhere in the world ), I'd be interested to find out. My take on news has been that it's always been about influence, power and control. Public service ( like the weather ) are secondary considerations. And profit isn't a real consideration for major news companies.

It why the guardian can exist for 20 years without a profit.

https://news.ycombinator.com/item?id=19799893

It's why WashingtonPost is bailed out by Bezos. Do you really think Bezos bought the WashingonPost to make money?

The first newspapers in the US and during colonial times were created by wealthy landowners and business elites to push their views and ideology. Fundamentally, I don't think much has changed, but I'm open to having my mind changed.
Poor communication with zero accountability. A few hours could be 2, it could be 12.

“I (name the individual accountable) will give you an update at 12:00 PT (name a time) as an update to this post (name the communication channel) with the current status and latest information on this issue (don’t promise time to resolution, just time to info).”

Simple, clear, concrete, and unambiguous. I had hoped that Firefox had better communication procedures in the event of global-impact P1 issues.
How do I uninstall this? It doesn't show up anywhere after installation.
You would think they could have linked to that in their blog post, since people who have disabled "studies" have probably done so for a reason. Telemetry is bad enough; even without the "Mr. Robot" thing, there's no way I would let Mozilla randomly push changes to my browser just to see what happens.
You are just hacking the leaves. Once the secret is posted. It is public, it has multiple copy elsewhere on the internet. Even if you delete there is a copy kept somewhere on the internet -- and that's not an assumption. For example, iirc, Github copy is dumped to google every some-x-time.
Don't you ever think ubiquitous lowers the quality as much as it raises the possibility ?
It might help if filtering were better in more places.

On YouTube, I mostly see accordion videos and that's the way I like it. On Twitter, even if I follow people who don't talk about politics, they will "like" other people's tweets that then show up in my feed.

On Facebook, there should be a way to turn off reshares for someone you're friends with.
There are no “wonderful” cross platform GUIs and that been true for over two decades.
Duolingo works for languages that have grammar the same or nearly the same as English (or possibly whatever language you're learning it in), but when you try to learn something like Japanese it is almost entirely useless.
Because an extreme (and obviously un-physical) version of the Church-Turing thesis is a sort of religious belief of people who work with computers.
Yes, net worth and cash flow are two very importantly different things.

Negative net worth just means you can declare bankruptcy when necessary. Positive cash flow is what keeps you out. The risk is that an interruption to that cash flow can mean that you have to take the bankruptcy option.
Out of interest, what's special about this add-on that allows it to install intermediate certificates like this vs. an add-on that any random dev could write?
Food is just not about taste, but health and nutrition as well. Have you actually critically looked into the health and nutritional impact of plant-based burgers?
When I say "balanced news", I don't mind if the media has a clear bias on a topic which shines through. It's fine if there is a right side, and they come down firmly on that side.

The issue comes when it feels like they're leaving out information or a perspective which would be harmful to their case. Basically if I read something in the news and after reading it I felt like the story made it look like one side was obviously correct, but then I go and look up more sources or more information and I will feel like there's a lot more nuance to it or my opinion even reverses, then I feel like there's been a huge failure in the media and I call that "not balanced".

It feels like they strawman the opinions they disagree with while pulling in the best representatives and sources for the positions they agree with.
Yeah I agree, and I'm not sure why you are being downvoted. The burden of proof is on people who claim that minds are like Turing machines, or that minds can be simulated by Turing machines. Too often I see that assumption simply being taken for granted.

Gary Marcus has brought up Moravec's paradox and I think that is pretty strong evidence against it. Maybe not in a precise mathematical sense, but there is no argument on the other side that's precise either. Again, the burden of proof is on the other side.

https://en.wikipedia.org/wiki/Moravec%27s_paradox

In other words, it may be that to achieve general human-like AI, we would need to invent a fundamentally different kind of machine. I don't see that idea being taken very seriously.

It could still be that lots of specialized AIs have a huge impact on the world. Although I do think that deep learning has bad engineering properties for things like self-driving cars, as Marcus points out. It could still have a lot of impact for less critical tasks.
Not available on all clients, notably mobile.
Here is a great short video by Ray Dalio https://youtu.be/PHe0bXAIuk0
> Mobile's still broken.

The hotfix xpi link mentioned elsewhere in this thread works on mobile.
There are major differences in the ethical standards of people who sell mailing lists.

I've seen mailing lists that get crazy-high response rates (send 10,000 emails and a few hours later you have $6000 worth of orders for plants).

I have also seen mailing lists that have some addresses that don't even have an @ sign.

Empirically what will get you in trouble is having a list with a high bounce rate. Bounces are a better signal of a bad list because the rate of spam complaints is not very high (compared to the number of people who get spammed) -- many people don't unsubscribe or send complaints because they are afraid it will prove their email is valid and will get them more spam. Other people send spam complaints because they hate you for other reasons.
Debates about which sim is more accurate bring up a philosophical question about sim design. My take is that designing a realistic simulation is like solving a physics problem, in that it's impossible to capture all of reality with a mathematical model, so the challenge is to first decide what you want to model accurately and what you can ignore. Doing that well requires insight. Case in point - although Rowan got overwhelmed by 1C in the flight sim marketplace, I would argue that Mig Alley is better than the IL2 product that covers the same material because MA is more accurate where it matters. IL2 has more realistic cockpits but Mig Alley does a much better job of modeling the physics of the Mig/Sabre asymmetry. That asymmetry is what makes MA dogfighting so unique. And once you've mastered that one-on-one duel, you find that the many vs many contest is completely different and involves little extended dogfighting- also true-to-life according to the history books I've read.
> You can't revoke a GPL license unless the licensee violated the GPL

Probably true for GPLv3, because GPLv3 actually says that it is irrevocable. OpenJDK is under GPLv2, which does not say anything about revocation. It is an open question whether or not GPLv2 can be revoked.

> Additionally, the GPL has this nifty "Automatic Licensing of Downstream Recipients" clause. In other words, if you put some code out there under the GPL, there is no way for you to un-GPL that particular code

That clause actually makes it more likely that GPLv2 could be at least partly revoked, because the full text is:

> Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor [...]

It's that "original licensor" part that makes partial revocation a possibility.

What if the original licensor simply says that they are no longer granting new licenses? Everyone who already has a license can continue to use the software, but new recipients no longer can get a license? (That's what I meant by "partly revoked" earlier--existing copies remain OK, but the spread of them, or derivative works of them, is stopped).

What happens then is a mess. Even figuring out who has standing to sue to try to make license issuing continue is a mess, getting into such questions as whether the unspecified future downstream recipients of copies are intentional beneficiaries or incidental beneficiaries of the contract. (And then there is the whole "is this a license or a contract?" issue which is very murky).

BTW, even licenses that do say they are irrevocable might suffer from this partial revocation danger if downstream recipients must get their license from the original licensor.

The fix to this is to allow sublicensing in your license. Make your license irrevocable (so that once someone gets a licensed copy it cannot be taken back), and allow sublicensing so that when someone distributes a copy the license for that copy comes from them rather than you. Then if you stop issuing new licenses there is no problem, because people get their licenses from their distributor.

If you don't want distributors to be able to give their downstream less rights than you gave them by only sublicensing a subset of those rights, you can put in the license a clause that requires distributors to sublicense all the rights.

A nice side effect of the sublicensing approach is distributors have standing to sue for license violations. Under the GPL-type approach, where all licenses are directly from the original licensor, only the original licensor can sue to enforce the license. Under the sublicensing approach, both the original licensor can sue (alleging copyright infringement) and the distributor can sue (alleging violation of the license).
Yeh, I'm one of those boomers. It was our generation who cooked up the whole "taxation is theft" trope. That has made a terrible mess.

We were born before the invention (1959-1960) of pharma birth control, and were teenagers when it took hold in society. It was the biggest change in human history (I'm not exaggerating). We, generalizing, did an awful job of starting to sort out the moral / ethical / social changes birth control brought.

We lived through the Summer of Love (see the previous paragraph) and some of us didn't get it. To misquote Spiderman, "with great freedom comes great responsibility." Some of us missed that. Hence DJT 45, hence the abuses of celibate clergy, among other notorious members of my generation.

And, fossil carbon release.

We did make the US stop the Vietnam war. That was good.

We made the US get rid of the military draft. That, in hindsight, was bad. Politicians think twice if they have to raise taxes and conscript young women and men before they go to war.

What's going for us? What do we have to offer?

We think in decades, not years.

We made it to the moon.

We invented the internet.

We helped cure the world of sanctimonious horsest like the poem Lewis Carroll parodied: https://en.wikisource.org/wiki/The_Old_Man%27s_Comforts_and_...

Maybe it's self-delusion, but I hope we're not finished doing some good.
At TransferWise we recently migrated to TimescaleDB for all our FX rates data.

So, there's two use cases for us:

1. We use it to ingest tick-by-tick FX rates

2. We use it to query historical rates e.g. whenever a users opens our homepage we query it directly from TimescaleDB

We've battled tested it pretty hard now & haven't run into any scaling issues - been very much plug & play.
You can tell ACM your CT preference!

(But seriously, sure you’re right but for my audience (which is essentially Latacora’s and HN’s), CT is fine.)
If you go down this line of questioning, then there's another reason "white" probably doesn't fit as an answer. The sun doesn't emit "white photons", we simply perceive the combination of photons of the visible light spectrums as white.