skysight-inc/HackerNews huggingface dataset:
That seems like a strategy that would cause significant slowdowns and hassles in development.

High-level (i.e. consuming a lot of dependencies at a lot of levels) tools would simply apply a "allow everything" dependency policy rather than deal with tons of issue reports from people who wanted to import the high-level library in a less-than-root-permissioned project.

Additionally, lots of upgrades do increase the dependency surface. Resolving local usernames is a pretty fundamental thing a lot of dependencies would need. Now consider the libc switch from resolving names via /etc/passwd to resolving from multiple sources (including nslcd, a network/local-network service). If every dependency up the tree adopted a "lowest possible needed IO surface" permission model and then that change happened, it would be hell to pay: maintainers would take the shortest path and open up too many permissions; maintainers wouldn't upgrade and leave some packages trapped in a no-man's-land; or maintainers would give up on pulling in prone-to-changing-permissions dependencies, leading to even more fragmentation.
The kernel of the conceptual problem with this web-of-trust feature is in another Filippo post[1]: when I sign someone's else's key, it is difficult (in practice: impossible) to really know the provenance of that key. The signer could have gotten the key from a keyserver (in which case you now transitively trust the keyserver). Or they could have gotten it from a random email saying "this is my new key". You don't know; the basis for trust isn't there, or rather, to the extent it is, it's only there across strong, short paths in the graph of key signatures; it doesn't scale out to the whole "web".

https://blog.filippo.io/giving-up-on-long-term-pgp/
And who can forget that Professor Hubert J. Farnsworth wished he'd invented the Fing-Longer?

https://futurama.fandom.com/wiki/Fing-Longer
The parent said hot and humid. Dry heat is much more tolerable, and your body handles it pretty well. No doubt it still bothers some people more than others, but at least IME, even 110F, while it feels plenty warm, especially in the sun, is tolerable, especially in shade. A good breeze can even make it comfortable. You just need to drink a lot of water (to me it's dangerous in that you don't see how much water you're losing), and you will tire more quickly.

Humidity makes evaporation much less effective. While you obviously sweat in 110F dry heat, it's not really noticeable. Go outside in 85F 100% humidity, and you will be absolutely miserable, and drenched in sweat. This is mainly what makes humidity so awful: the sweat. That said, at least it's very obvious how much water you're losing.

Additionally, the water in the air "holds" heat, so generally daytime highs and nighttime lows are not that far apart, whereas in drier climates its usually (but not always, going by your post), the case that the nighttime sees a solid temperature drop.

You can become heat adapted, so you sweat much less, but it only works up to a point and spending time in AC resets you if you're not staying out in the heat day after day after day.
True, and the benchmarks told a very different story for Ryzen 3700 and 3900, that for most of these workloads, the gains from the extra cores far outweigh anything else including tiny RAM timing differences. The tests I saw ran with 3600 speed RAM though, for both.
Isn't keybase.io trying to solve this?
My immediate thought was better bird feeders => birds don't need to eat insects => more insects. You're probably right though given that insect populations are indeed in decline.
In my youth I spent thousands of hours I will never get back arguing about the merits of various social policies and I have never made a positive impact with my contributions.
Why? Human civilization didn’t exist at the time that the ice caps weren’t there. The contemporaneous sea levels and temperatures wouldn’t have suited us, especially our current civilizations in the tropics.
It defaults to X, because it works very poorly with Wayland. Until very recently, it was impossible to run Gnome with Wayland at all (even though it theoretically supported Eglstreams), as there were many kernel errors generated by gnome-shell, etc. Now it sort of works, however, lags and freezes make it completely unusable in most cases. I am testing it every Fedora release. It _is_ possible to use Gnome with Wayland, I managed to get it working with Arch Linux once. However, it took me 4 days, manual patches (literally editing the WM code myself to fix some issues as suggested by the community) to get the configuration right, and the next rolling Arch update broke it beyond repair.

Again, I am not against Wayland. Wayland API is beautiful and I want it adapted more and sooner. It is just sad that me and many other users are not getting it. Developers blame Nvidia, because they do not open source their driver (which is a valid concern), however, there are many other binary blob drivers in mainstream Linux kernel, and everybody except hardcore open source apologists are OK with that. Why Nvidia is different, I don't understand.
Although NAND gates are universal gates (any combinatorial boolean logic function can be built from nothing but NAND gates), in practice it's usually more space efficient to use a mixture of different gates.
I feel like these sort of articles are somewhat doomed on social media sites, HN included. The general agreement is that these sorts of things should be deplored. There's not much to disagree on. This lack of back and fourth is going to make it hard to keep engagement on the issues of sexual harassment at the front of people's minds. They are, sadly, uninteresting, even though we know they represent bad behaviour.

There are two other related discussions to be had: 1) Corporate Culture and 2) Government inaction. Sadly, both of these are reactionary, and require enough mindspace of the population to do anything about. Unfortunately there has been more competition for mindspace, in the past decade.

Now that I think about it, it explains why Feminism is essentially run by those with greater personality extremes. That drama may be all that is keeping it alive. As frustrating as it is, maybe I shouldn't be so quick to ridicule the more outlandish assertions.

Because maybe that needs to be there so we can keep seeing these more insidious occurrences.
> The more wheels you reinvent, the slower your velocity for solving the core business problems that pay your bills.

And the more mistakes you make, pissing off your users (or worse, compromising their data because you thought you could roll-your-own of some security critical dependency you ditched).
I really want one, but they are so expensive... I'm having trouble considering pouring more than half of my monthly salary into such a device.

I honestly wouldn't mind if there was a second option, bulkier (maybe even with an of-the-shelf raspberry as a motherboard), maybe with a smaller screen, and less polish (no custom-made injection molds, maybe a case I 3D-print myself).

Actually, I went to the website again, and it is €500, down from what I remembered was €750 (though it looks like it was "only" €600).
I might consider buying one, but for a fraction of the price I could have a nice android tablet with a stylus, support for external displays, etc.

I would appreciate the opportunity to try it first, but I don't think it's being sold in any retail stores, and I don't know anyone with one.
Robin Sloan's "Year of the Meteor" is quite a good weekly read. https://desert.glass/
even better if the insecure code takes advantage of absolutely plausible coding mistakes/language quirks. see e.g. underhanded C contest for very subtle and deniable ways to provide nefarious functionality.

http://underhanded-c.org/_page_id_22.html
Just as an experiment, I want everyone on this thread to think back to the last time you connected over SSH to a new computer on a company network. Did you check to make sure that the key that popped up was correct, or did you just hit accept?

This is why signing packages will not be a silver bullet that significantly reduces these kinds of attacks. Devs will still have their keys compromised, users will still ignore warnings that keys have changed. It's worth doing, but I am skeptical that it will eliminate these attacks.

In the Javascript world, we got malware recently that was the result of a dev voluntarily giving control of a package to another person. Signing isn't going to help with that.

My vote is on permissions and sandboxing. I think that sandboxing scales reasonably well since it can be applied to dependencies of dependencies all the way down your entire chain. I think that (unlike with phones) most dependencies don't require stuff like File I/O or Networking, which would eliminate a large number of attacks.

And importantly, I think that sandboxing acknowledges that trust is not binary. The big problem with signing packages is that it's following this outdated model of, "well, you'll either trust a package completely or you won't." The reality is that there are packages and package authors that you trust to different degrees and in different contexts. Many buildings have locks inside of them as well as outside, because trusting someone enough to come into your office is not the same as trusting them to root through all of your filing cabinets.

I don't think efforts around verifying authors/updates are useless, but they do often fail to take this principle into account.
Now you can check in on Bill Nye’s solar sail as it orbits Earth
I mean, I had nothing done with me, and it was great. By that I mean my parents did nothing to help me and I grew up entirely unfocused and unparented.

The devil is in the details now isn't it? I didn't mean to portray absolutes, I'm referring to parents who are either too uncaring or too uneducated to actually parent their children.

I'm sad that my desire for parents to parent was downvoted. I'm sure people (like your post) took my comment as a desire to push kids none stop, but I (as a person who grew up poor) am very frustrated by seeing, repeatedly, children (my friends and I mostly) who grew up without parents. It is not ideal.
https://jamesclear.com/newsletter , author of atomic habits
Just because I am in public doesn't mean that I want to be tracked by government all the time. The idea that FBI constantly knows where I am sounds Orwellian and unconstitutional to me.
&& time cat
Windows supports core APIs for longer than Linux, or in fact, X11 exists.

It's actually possible (and was demonstrated) to upgrade from 1985 Windows 1.01 all the way up to 32bit Windows 10 and run windows 1.01 application without changes.

Arguably backward compatibility is the true reason how MS got to dominate OS market - you had good chance your software was just going to work on new OS version.
You have a good point but many people do not realize the implications of things. To be fair to them, things are purposefully framed so that they seem to be in the public's best interest. I understand the anger and resentment, but if people are now worried then we can use that momentum to fix the issue. You're right, it didn't have to be an issue in the first place, but let's do what we can to fix it instead of spreading the frustration.
Off-topic Peeve: Titles ending with “Here’s how”, “This is why”, “Click to find out”

Why? Has some ““study”” decided that this gets more reads?

And that isn’t the article’s actual heading either.
Internet psychiatric diagnosis is not ok on HN.

https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...

If anyone sees that happening and we haven't moderated it, the likeliest explanation is that we didn't see it. Users can help in a case like that by flagging the comment (https://news.ycombinator.com/newsfaq.html) or by emailing hn@ycombinator.com in egregious cases, which guarantees we'll see it.
"When you drive on public roads, you have no reasonable expectation of privacy."

I think in the age of automated large scale image recognition we need to revise the concept of privacy. I don't think we should lose our privacy completely as soon as we leave our home. And with devices like the Echo we don't even have privacy at home. There need to be restrictions on mass processing of this kind of data. Otherwise we'll create a version of the world of "1984" where nobody can escape surveillance.
https://www.oreilly.com/emails/newsletters/ , has various topics to read from.
As George Carlin famously quipped, it's not about saving the Earth. The Earth will be fine. We on the other hand may be fucked.
"You can call that censorship if you like; that word is used in so many different ways that at this point it just expresses a feeling."

Censorship is not a feeling. You are not even correcting me. It's seems that you are marking my comment because you are told so, not because you can show any failure in my logic. Shame on you.
Imagine a company offering a great relocation package doing exactly what you want for 40% more money, but you have to sweat inside a 95 degree, humid office in the summer.

Would you take it?
The fact that the climate has gone through major warming events in the past is the reason we're so concerned about climate change.

If the planet had been stable for a couple hundred million years, we'd know there are strong negative feedbacks that keep it stable. Instead we see instability and positive feedbacks.

For example, we see minor amounts of warming caused by orbital variations, followed by massive releases of greenhouse gases bringing several degrees of additional warming. So we know that we only have to warm the planet a little, e.g. by our own greenhouse releases, to tip the planet into a warming cycle that does much more damage than we directly did ourselves.

That's why people keep talking about thresholds and carbon budgets and deadlines. If we take things too far, it will be out of our hands; the planet will keep warming even if we stop our own emissions entirely.

A great introductory source on the geological history of climate, and the evidence for it, is Hansen's Storms of My Grandchildren.
Check out the benchmarks. I'm pretty sure normal usage (aka actual HTTP server, not specialized use cases just for benchmarks) is quite a bit slower than node.js
It seems to do that too (comparing against a list of the top 500 passwords):

https://github.com/bdmac/strong_password/blob/master/lib/str...
Cartography: https://www.getrevue.co/profile/maps I'm not sure if https://www.mapbox.com/devrel-newsletter/ is still active
FWIW, I think Haskell does an excellent job of facilitating composition without parentheses, and thus I'm going to contradict what I said earlier about parens always being necessary. But Haskell also does automatic currying, which even Lisp doesn't do. Without automatic currying, I'm pretty sure my original point still stands.
I’m guessing that people in the city are effectively subsidizing access for Canada’s many far flung remote areas. Unless the carriers offer separate plans that only work in the city, this is what’s going on.
one more I follow https://seths.blog/
If it's the free version, yes. As far as I'm aware the pro version is clean.
> RX5700 isn't winning because it has new node and stuffing in more transistor

Sure, I guess, but it is probably still winning because it is manufactured on a new node - transistor count isn't the only thing that matters.

Performance is frequently power-limited, so because 7nm is more efficient it can achieve higher performance.

If you took the same design from 16nm (or 28, ...) and simply shrunk it to 7nm, you could achieve higher performance with the 7nm version - even though the number of transistors hasn't changed.
Where do you think they'll go? Canonical? Or will their man-hours be lost to the FOSS community?
If I were inserting vulns as backdoors, i'd want several in case some of them got discovered.
A lot of that is due to lack of those features.

It's really not worth it when you are facing huge downside in usability on things that should have been accounted for in core protocol(-set), but a decade later you need to face aloha-quality, unstable warring incompatible proposals.
I'm not saying that it is evidence that it is a backdoor. I'm saying that it is indistinguishable, because that's how you would do things if it were a backdoor as well.

The correct way to try to discriminate is to look at how frequent they are, and maybe how they're patched.
Accuracy depends on the dataset like you point out. It's a hard task to find a person among all driver license photos in the US.
X.org is more horrible and also impossible to maintain. It would have been given the boot over a decade ago except for the fact that AMD/then ATI and Nvidia only supported X and video drivers were incorporated into X directly. There was a big push starting in ~2008 where AMD started open sourcing their drivers. Infrastructure started developing in the kernel where it makes sense instead of in X.

Now we've reached the point where there are almost two parallel stacks - linux's graphics infrastructure; and Nvidia's. The developers don't have any patience for the one holdout against the new system. It is unfortunate for the people buying Nvidia cards because they are now starting to be labeled as 'using the legacy systems'. Presumably there is some reason why they have no choice in their purchases, but the cost of maintaining systems to work with closed source drivers appears to be too high. My views here aren't exactly current - I've stayed a long way away from Nvidia since ~2009 - but they are probably sill somewhat on target.

It is likely that a better designed alternative to Wayland will crop up. It is much easier to compete with than X - there are no drivers that only support Wayland.
Exactly right, just like stacking filters in a signal path.

With a 10Hz 3dB point, the bandwidth is 20Hz. Your typical engine exhaust has an acoustic spectrum bandwidth of about 150Hz so a stack of 15 of these would allow you to overlap your filters by 5Hz on either side and notch the entire spectrum out. Depending on how much back pressure it put into the system that could pretty effectively quiet a generator or a turbine.
> If you want to have reliable dependencies then you eithery have to choose only dependencies with buraucratic and pedantic release governance, or manage/audit each dependency yourself

That's a false dichotomy. There are middle grounds which can and do work at scale:

Upgrade knowingly and deliberately (don't just spray greenkeeper everywhere).

Carefully monitor changed application/network behavior after upgrades.

Devote a manageable, non-zero amount of time to reading/finding security bulletins or security incidents on your most-heavily-used dependencies.

Pay attention to issue reports and prioritize any with possible security implications.

...and (at a slightly larger scale) hire, empower, and compensate people to do those kinds of things in a systematic, regular way.

Seriously, security engineering isn't served well by "ZOMG NPM is garbage we must switch to $megaframework and pray that their release engineers get everything right" hysteria and absolutism. There are effective, moderate strategies that help with these issues every day.
20% is still higher than I expected for Norway’s system, but I suppose there’s tons of factors contributing to recidivism.

There’s so many possible avenues a person could take to commit crimes that send them to jail. I think it’s worth using prison as a way to psychologically investigate what lead people to crime or recidivism, and try to understand crime from micro and macro levels more. Like some kind of criminal science retrospective that goes beyond solving a crime, and also provides a meta post-crime analysis. Of course, this isn’t perfect either and probably will receive privacy and medical qualms, but I also don’t know of a definitive answer about what a realistic hope is to reach for concerning criminal justice. As far as human history goes back, there has always been crime and it has always sucked.
Generating a VGA signal is trivial for this powerful chip. Entire retro game consoles have been built with similar ATmega chips alone

For comparison, a slightly less powerful microcontroller can do this:

https://www.linusakesson.net/scene/craft/
This is such a beautifully written, concise, and easy to understand explanation of transcendental numbers. Before reading this, my "definition" of transcendental numbers was just a hazy understanding based on one example number, pi.
That's right, but I think the article is asserting that:

a) The vulnerability density is much higher in Huawei's code.

b) When vulns were reported to them, they simply moved them to another location, rather than actually patch them.

Those are the things that I consider to be (weak) evidence that they are backdoors.
Dupe of https://news.ycombinator.com/item?id=20377496 . In particular see the comment: https://news.ycombinator.com/item?id=20377683
The rise of Big Sperm: does the tech world have the answer to our semen crisis?
He's right, if your definition of "fine" includes things like the Permian mass extinction.
As a side note: Pascal was not a failure. Currently it is incarnated as Go, that has a clear succession line to Oberon, Modula-2, and Pascal.

(Free Pascal is also alive and kicking.)
I come from an environment where we have a reasonable number of Linux workstations; approaching 2000 in the company I work for, and more in the wider field.

> Being a UNIX replacement with a full X11 server and all the rest was what made it compelling and practical in the first place.

Yes, here as well. We have big apps, small apps, legacy apps, remote apps, all doing real work.

For the enthusiast user base, who mainly live within the distribution's ecosystem, this sort of churn in the platform is exciting and interesting, or feels like progress. The platform is the end result.

For us, the platform is just that -- a platform on which sits a lot of vendor applications and custom tooling assembled over decades with its idiosyncrasies carefully accommodated.

This churn isn't good. Anything short of 100% compatibility is going to prompt a risky re-evaluation of what's out there on the market -- risky because Windows is in the strongest position, not Linux.

Linux is already in a weakened position than it once was as a workstation OS. My colleagues will be enticed by a Windows platform which has an emerging Linux compatibility; and a tried-and-tested build of most of the vendor-driven GUI applications and GPU drivers, too.
Nothing prevented X11 frkm adapting with hardware. In fact, commercial implementations did just that. It's XFree86 that was running pretty much on original framebuffer-oriented code dump.

Also, if you actually run on server that was more directed towards modern hardware, like Xsgi, GTK3 will simply flip out because it has heavy assumptions that pretty much break.
RTMP, proven, reliable and well supported. Probably a lot more open source code around for RTMP on Android than WebRTC. Various open source servers for RTMP. If latency is not an issue then you should look into DASH or HLS instead.
It’s interesting that your first language is Russian. It happens to be mine, too. And I would eagerly — without a moment’s hesitation — throw it away for English as a common language. And this despite having studied Russian linguistics and literature at university level and having translated a handful of books into Russian.
The conversation is about STM32 v Arduino.

Linux doesn't run on Arduino, except that guy who wrote an arm emulator, but I'll let you watch the video of it booting before you decide whether that's a valid exception.
Desperate entrepreneurs: no opportunities, no skills
I’m pretty sure SQLite doesn’t implement transactions that way anyway. That’s a pretty bad misunderstanding of how it works. I suppose it’s easy to think you can do better than SQLite if you think SQLite is really bad.