skysight-inc/HackerNews huggingface dataset:
Optimal play includes bluffing. It's "optimal" according to game theory.

For example, game theory may tell you that in a particular situation, you can't be exploited if you bluff 10% of the time. If the opponent bluffs less than that, you can come out ahead by more often folding when he bets. If the opponent bluffs more than 10%, you can call or reraise when he bets. But if he bluffs the optimal amount, it doesn't matter either way, you can't take advantage of him.

So this bot would bluff at 10% to avoid getting exploited, but wouldn't try to detect whether the opponent is exploitable. (The latter is risky since a crafty opponent can switch up strategies, manipulating you into playing an exploitable strategy.)
Yet the Bay area has a mediocre public transit system that does not provide convenient service to major employers like Facebook, Google, or Apple. Transit service in the Bay Area is so bad that the major tech companies run private commuter buses to make up the gap. Somehow that has not stopped tech companies from building new offices around the Bay.
You probably mean this as a joke, but we often underestimate our ancestors who were as smart and curious as we are (and surely as dopey and uncurious as well).
There's a pretty big difference between the local town and the entire nation. If a municipal gas company provides poor service in your town, a mayor who doesn't address it is going to have trouble in the next election. If a nationalized gas company provides poor service in your town, good luck making that the issue a US presidential election turns on.

And socialized isn't really right either. There is a significant difference between e.g. "socialized medicine" meaning taxpayer-funded healthcare vs. municipal utilities that you pay for as a customer thereby covering the service cost, and may not even require you to patronize them if you don't want service, even if they happen to be operated by the government.

I wish they would actually formalize the latter arrangement as something that anyone could set up on their own, i.e. something similar to a 501(c)(3) nonprofit which is established to provide a subscription service and whose directors are required to be elected by the long-term subscribers. Then you might operate an ISP that way, but also potentially things like news reporting and software development.
The thing about a 5,000 line Java file is that it's Java, so it's probably also 5,000 columns.
Do you guys specifically alert the user that the password has been exposed publicly? If I got that sort of message, I would be grateful to the website rather than annoyed I couldn't use my favorite password.
> I was a little disappointed at the write up too. They're cutting the cream with milk (typical in modern recipes) without explanation beyond what sounds like "I tossed the recipe and adopted a modern one".

Also adding a churning step which, it is explicitly mentioned, wasn't present in and dramatically changes the original recipe.
Isolation is always key. Remember, sudo can also be used to de-escalate priviledges to a different user account where it's harm is more limited.

Or better, if you wanna run malware for fun, run a VM with an isolated network connection that only routes out to the world via a separate VM that pipes all traffic over a crappy commercial VPN service or Tor. That way if you piss off any script kiddies they can't DDoS you.
> Do you mean this https://github.com/tmux/tmux? That is the source for the portable version of tmux, wrapping the native kqueue version developed for OpenBSD with libevent.

Tmux is part of the OpenBSD base system.

Tmux is not an officially developed program by the OpenBSD community.

It was imported June 1 2009.

Here is Theo de Raadt's post:

> By Theo de Raadt () on 2009-07-07 04:37

> The most impressive thing about tmux, in my view, is how frustrating the code audit was. In 2 hours, I found only one or two nits that had very minor security consequences.

> It was not accepted into the tree based on license alone. It is high quality code.

[1] https://en.wikipedia.org/wiki/OpenBSD#Subprojects

[2] https://undeadly.org/cgi?action=article&sid=20090707041154
1/2) These are web apps. Big web apps but web apps none the less. We know what can go wrong theres nothing really new here. How would you quantify "too many pieces to make work". Is 1000 too many , 10000 ???? There are millions pieces of data on your harddrive and they work fine. In general the idea of variance can be solved with redundancy. Maybe there are not enough backups at twitter.

5/4) Incompetent people lead by incompetent people surrounded by yes men and a drug culture. Also having a company that demonizes conservatives which are some of the best engineers (scientist are squares naturally)

Human error is bound to happen and software is complex but so are rockets and supply chains. Things can go right and things can go wrong. Usually when they do go wrong there is a human error reason.

Does twitter foster a place where human error can occur more frequently that other places? I dont know. I have my bias about the company and any sjw company but thats very anecdotal.

Twitter worked yesterday and it doesnt work today. Doesnt really have to mean anything really important except for the fact that there is a blind spot in their process which they need to harden.

I guess the first person to ask is the dev op , then the developer. Something wasnt tested enough. That happens in commercial software, deadlines cant wait.

3)Russia / China / Iran ... stop watching CNN. You are parroting talking points. If twitter is crushed America could care less and would probably turn up sanctions, not lift them. Taking down twitter wont cripple anything in America except for certain marketers budgets.
Isn’t this survivorship bias, or do you know which player repeatedly will place 1st beforehand? Granted that poker is pretty popular, there must be quite a few people who always become first place.

Or to turn this around: given enough bots, some bots will place 1st a lot more than others. It’s just unclear which one.
Wayland fixes that and is rapidly phasing out Xorg. It is long understood that X is not secure in this kind of scenario, it is NOT long understood that tmux isn’t (Or at least, I certainly have never heard this.)
I just found and read that article yesterday. The writing is on another level.
I understood the problem, but I found the page's explanation a little confusing at first. In particular, "lexical differential highlighting" misled me, because the word "differential" made me think that his algorithm was comparing lines or tokens in some way, and it doesn't do that.

Basically, this algorithm tokenizes the source code, and tries to color each token so that identical tokens have the same color, but similar-looking tokens have very different colors. When tokenizing it specially handles comments and quoted text.

That's an interesting approach to countering errors from "it's almost the same but I didn't notice they were different". I wonder - if I were trying to review source code that were malicious, maybe I could vary the color algorithm using a random source so that the source code writer couldn't make different tokens look similar in color. That might be an interesting countermeasure to some kinds of underhanded code.
Ask HN: How to indefinitely prevent your startup from selling user data?
Currently working on a side-project that aims to be a competitor to Facebook Events for personal celebrations [0]. We’d like to claim that we’ll never sell personally identifiable information to third parties, but are at a loss how to (contractually) enforce this claim so our users can trust their data is safe.

Is there some way to strictly forbid this today as well as in the future?
Ideally, if Facebook buys the entire company they still wouldn’t be able to sell your data.

[0] wherat.com its goal is to simplify throwing a birthday party to such a degree, that you'll never consider skipping organizing one again.
Not currently but I'm sure there will be at some point.
Actually, why are we (mostly) ignoring Charlie Gordon? Every second comment here seems to be ready with praise for Bellard (who no doubt deserves it), but Gordon seems like the right hand man, a significant part of the dynamic duo here and very much a unsung hero barely noted.
Discord Down?
Hence, user experience!
Training was super cheap. It would cost under $150 on cloud computing services.

The training aspect has some improvements but is at its core similar to Libratus. The search algorithm is the biggest difference.

There aren't that many great resources out there for helping new people get caught up to speed on this area. That's something we hope to fix in the future. Maybe this would be a good place to start? http://modelai.gettysburg.edu/2013/cfr/cfr.pdf
Is it actually really true? The second part, too? I thought this can't be true and must be a (good) story just to amuse the readers - I guess I was wrong.
I worked there at the time and ending up running the software infrastructure teams that fixed all these problems. The beer wasn't a reward, it was because people were stressed and morale was low. Nobody brought the site down on purpose.

What really made me mad was when we hired consultants and the contract would end, usually without much success because Twitter's problems were not normal problems, and then they would send us a fancy gift basket with our own wasted money.

Maciej, we are still waiting for you to ship the executive dashboard.
If racket is an acceptable python and python is an acceptable lisp, then racket must be an acceptable lisp?
Obligatory to watch with this comment:

"Let's deploy to production"
https://youtu.be/5p8wTOr8AbU
It's a social media troll conference. Let's call it what it is.
”generalizing them into something like this takes tons of work”

It sure does. I was really impressed when I saw the level of polish in the README. Mad props!
Captchas are easier than the game
Why can't I see who is attending a public Facebook event?
They do a decent job at explaining (at a high level) the function of the protocols involved.
No big decisions have a 100% confidence level, that's an absurd criteria. Catastrophic events are also a bad thing to look at because researchers tend to just stop the detailed simulations beyond a certain horizon (specifically 100 years) because so much changes in the human world on those time frames that people don't take it seriously. The vast majority of truly terrible things that will happen as global warming continues will happen past that time frame. At some point, the metabolism of the plant will draw down the CO2 concentration (if we stop emitting), and this is >1,000 year frame. 100 years tends to not be enough for terrible (and I mean like really truly truly terrible) things to happen due to thermal inertia.

We're going to have to engineer the climate directly if we still want to have an industrial society in 200 years. We will probably do it much sooner. The effects of the combination of more CO2 + artificially decreased sunlight are going to be bad, but are not well understood.

It is true, it's not a question of whether we have consequences or not, just a question of "how bad". That is extremely strongly a function of how much emissions we emit until, say 2050. It's hard for me to even imagine how we can continue using fossil fuels for energy much beyond then, so not reducing emissions also strikes me as kind of... needless self-inflicted harm.
I hope you're right. What Amazon is today is a grossly dysfunctional "marketplace", and I hope to see the end of it.
whats wrong with all giant companies and their 'internal configuration change' these days?
To bring some balance to the universe - as a vim user, I tend to prefer doing the same.
Bad programs can and are are written using any programming language.
How fast is it compared to V8?
When human players donk bet it's almost always a weak player employing an extremely exploitable strategy, whereas pros almost never do it because the metagame has evolved around the presumption that nobody ever donk bets. I'd love to see what the bot's balanced GTO donking strategy looks like.
Instead of coming up with easy radical solutions that won't ever see the light of day in places where people's ability to lead a normal life depends on having a car (which is heavy majority of places in the US outside of NYC and, to a less degree, maaaaybe a couple of other major cities), it might be more productive and efficient to work on solutions that are more difficult and less sexy, but actually have a possibility of being implemented and improve the situation. I am aware that this horse has been beaten to death and some more, but just off the top of my head:

* Physically separated bike lanes and independent bike routes that are efficient in getting people places they need to be. A somewhat successful example of the latter (that keeps expanding and improving): Atlanta Beltline. Doubly impressive, considering that Atlanta is one of the most car-centric major cities in the US with absolutely horrific public transportation and no central "core" area (it is very sprawled, similar to LA).

* Hard push for expansion of public transportation, which, most of the time, is blocked by NIMBYs and other busybodies that always use the argument of not wanting to have more "undesirables"

* More creative and complicated ways that I cannot list off the top of my head

tl;dr: complex problems require complex solutions. If you expect to solve those problems with radical "slash-it-all" solutions, then I would not hold much hope for those problems to be solved at all. It's like someone looking at an existing complicated piece of code for a complex problem, calling that code dumb and difficult to read, and then coming up with a simple solution in a few lines of code, without thinking through all the edge cases and possibilities.
Keep your mitts off our water. You don't need water-intensive agriculture in the desert.
Good, hope they stay like that. They blocked me twice because of political reasons and I had to contest it in order for them to remove the block. This company think they are the are some culture commissar in communist Russia, I hope one day they will end like those people in goulag due to some wrong thinking or something.
I don't think the poker world would be happy with us if we did that. Heads-up limit hold'em isn't really played professionally anymore, but six-player no-limit hold'em is very popular.
Their solution has been connectivity.

What now?
Knowing when to bluff often depends on the psychology of the opponent, but since it trained playing itself it doesn't seem that knowing when to bluff would be learned. Did it bluff very often?
> So, how would one be productive about it?

One might start by observing that there are reasons these things aren't air-gapped. A person could go on to note which of these reasons continue to apply and are considered compelling by those who make the relevant decisions, and thus that air-gapping is likely to persist.
This attack presents a way to reuse a sudo ticket over tmux. If you aren’t in the same TTY as your malicious code there should be no way to reuse a sudo ticket.

The memory modification one sounds truly not possible. In Windows it is possible via OpenProcess and WriteProcessMemory to modify other process memory under some circumstances, but I do not think the same thing is generally possible under Linux (because in most distros ptrace has been mostly locked down for a few years now)
https://www.nature.com/articles/s41586-019-1335-8

https://doi.org/10.1038/s41586-019-1335-8

No access to the paper myself, but the above should get you what you need through other means.
It was for ~2 Minutes.

https://imgur.com/a/4Rh6Vxf
> There's nothing holding them to this promise.

There may be, the exact terms aren't clear yet. Of course the terms might just say "you have no rights whatsoever". The market will price those terms in.

> It may well be the same situation as tether (or worse).

I don't think that's a good argument against Libra. Tether is still trading around 1.00$, despite its reserves being at best 74%. The market is pricing the risk of ending up as bagholder as next to nothing.

Nobody is arguing that holding large amounts of Libra as a "store of value" is a wise thing to do. Neither is storing large amounts of cash under your bed.
I also have a hard time saying gaaaa nome or matey like all aboard matey with a straight face or hey you should use the gimp.
CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-10966
While logs and metrics have common parts, they are quite different beasts. It is quite expensive producing and storing logs for frequently changing metrics such as requests rate or response latency on highly loaded system with millions of rps.

I'd recommend:

- Storing logs in high-performance systems such as cLoki [1], which give enough flexibility to generate arbitrary metrics from high log volumes in real time.

- Storing metrics in high-performance time series database optimized for high volumes of data points (trillions) and high number of time series (aka high cardinality). An example of such a TSDB is VictoriaMetrics [2].

Implementing dashboards with time-based correlation between metrics and logs based on shared attributes (labels) such as datacenter, cluster, instance, job, subsystem, etc [3].

[1] https://github.com/lmangani/cLoki

[2] https://github.com/VictoriaMetrics/VictoriaMetrics/

[3] https://grafana.com/blog/2019/05/06/how-loki-correlates-metr...
How do you think these same pros would do in a follow-up match? As described in the article, the bot put players off their game with much more varied betting and with donks. Do you think the margin would decrease as players are exposed to these strategies?

Players face mental fatigue and have so over-learned their existing strategies that it takes time to adapt new strategies and even more time for those new strategies to become second-nature.

It reminds me of sports in a way. Teams start running a new wrinkle of offense in the NFL like the wildcat and it takes a few seasons for teams to instinctively know how to play defense correctly against that option.
Eh, in my experience "time spent in the debugger" correlates positively with how good someone is at programming, because the weakest programmers I have worked with have no idea how to drive a debugger and never use one. In single-threaded environments (like most unit tests) I think a debugger is an enormous productivity enhancer.

I think "time spent quickly making minor changes, re-compiling, and re-running the code" is a better indicator of weak debugging skills, but that still doesn't mean they are a "bad programmer". Often all they need is someone with stronger debugging skills to walk through an example debugging session with them, and teach them what techniques and tools they would use to approach the problem.
The humor must be lost in translation then, I don't see anything resembling a joke.
https://news.ycombinator.com/item?id=20413062
At varying degrees of "success", I know a couple sellers who make a great living by combining multiple platforms; Selling on Amazon, eBay, Etsy and their own custom site (on Shopify and other customizable platforms).
eh, it's a boring story

source: work there
Dupe from yesterday: https://news.ycombinator.com/item?id=20402588

It's also offering up a strawman argument: "The Left" does this or that bad thing, in this case the author imagines some "politics of civility" enforced by "The Left". I'm pretty sure no such politics exists, just as no such unified "Left" exists. I've noticed political commentary tends toward strawman arguments a lot.
Curious, why was 100BB used for six max? If I recall right, the head ups experiment was 200BB?
That threat model essentially prohibits "tmux attach", which allows an attacker running as your user to connect to your terminal session, so I don't think it's a particularly useful threat model here. That's basically exactly what we signed up for by using tmux.
Email me personally for now. I do plan to publish broadly later.
And? All of the companies listed in the article are expanding in Manhattan, including Amazon.

"Many of these companies are willing to spend big dollars renting high-end Manhattan real estate, rather than the older office stock in Queens that Amazon was prepared to lease."
In France businesses do not pay VAT, only consumers do. Business do collect it (on behalf of the state), but they never have to pay it themselves (technically: they get a refund when they do)
European and Chinese Software Patents Won't Hurt U.S. Businesses
It's an advertisement for a book. Cilium is on there and that's a name I associate with blogverts.

There are eleven exclamation marks on that page.

BPF is the new paradigm for synergistic application of strategic opportunities in the use of acronyms.
Former employees and current employees talk via unofficial online and offline backchannels at many companies.
California’s Senate Judiciary Committee Blocks Efforts to Weaken Privacy Law
Releasing things usually comes with overhead - you have to verify that everything you're releasing doesn't have anything proprietary, that all other code is following a license that allows for release, etc.

Or you could spend $0 and let the bits just rot if they're not in use - no lawyers reviewing licenses, no code reviews, nothing. Or you could send it through engineering to make sure there's no secret sauce, then through corporate legal (at $250/hour), then through business development...

It's almost always better to just smother the code with a pillow than it is to give it away, because giving it away actually costs money, and will bring you no profit. Screw that, if it's important enough, let someone else spend the time and money writing it.
The Ball-Bearing Electric Motor (2003)
Life in tech is like a Quentin Tarantino movie.
Golf:

strong :: (Integral i) => [i] -> [i]
strong λ@(_:b:c) = view _2 <$> filter p (zip3 λ (b:c) c)
where p (x, y, z) = 2 * y > x + z

Also, it hangs with scanr (scanl works) and includes 2 which isn't strong.
> is precisely what the Rust compiler checks for.

Mutable shared state is required in many real-life cases. CPUs suffer heavy penalty for random RAM reads, random writes are free (especially when using MOVNT* instructions to bypass caches). When working on computational code you want to optimize for read access. This often means write patterns are random, i.e. you can’t slice arrays per compute thread.

> because these places are explicitly marked in the code, it's easier to audit them for bugs

C# has very good OOP support. All class members are private by default. Wrap that mutable shared state into a class with thread safe public API, will be equally easy to audit.
We played 10,000 hands of poker over the course of 12 days in the 5 humans + 1 AI experiment, and 5,000 hands per player in the 1 human + 5 AI's experiment. That's a good amount of time for a player to find a weakness in the system. There's no indication that any of the players found any weaknesses.

In fact, the methods we use are designed from the ground up to minimize exploitability. That's a really important property to have for an AI system that is actually deployed in the real world.
I actually like the summer vacation hypothesis. Makes the most sense to me - backup devs handling some things they are not used to.
Do you have any ideas for Shopify apps you'd like to share?
> Why does Microsoft think passwords and consumer choice are going out of style?

Because the prevailing wisdom of the current tech industry is that users are cattle to be farmed?
They are talking about physical shops. Which are also competitors of Amazon.
And where does your assessment comes from? Just guess?
There Is No Dominant Paradigm
> On secure systems this causes devs a lot of annoyance since they cant attach a debugger.

You can still attach a debugger on a newly created process, but if you want to attach to an already running process, you just need sudo. It's not really annoying.