skysight-inc/HackerNews huggingface dataset:
Yeah is too slow, but is not only that, is that it makes senses for it to exist years on user-land as a library (or multiple ones) before being implemented on any standard.
Sounds awesome and exciting. I can't wait either.

The personal ML bots will be a big things. Next step in total automation.
The same people you get your 401k matching money from when a company goes bankrupt and sells its assets. The money assigned to pensions, like the money assigned to 401ks, should not be something the company can ever take money out of or under-fund.
That's a promising project, but it's currently Windows-only. My main point was that Mercurial is very much "not dead yet!"
Yes, the most recent example I can think of is http://cliffle.com/p/dangerust/ in which the author translates heavily optimized C to Rust in a quite mechanical way. It comes out being slightly faster. In the last part they rewrite it in idomatic Rust and it ends up even faster again without any of the bespoke optimizations that the C code used or any unsafe Rust.

In many instances the Rust type system should allow the compiler to emit faster code because it has more data to use for reasoning about valid and invalid states of the program. Depending on how good c2rust is the Rust version should be roughly as fast, refactored to idomatic Rust it could be meaningfully faster than C.
I use this addon to get rid of the cookie banners: https://www.i-dont-care-about-cookies.eu

Firefox addon: https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
What are the best O'Reilly books you read? I've read some excellent books from them and some meh.
The "I don't care about cookies" extension is a nice solution for now.

https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
They're working on a new one that seems pretty cool, although you currently have to install it as an Add-on to use it: https://profiler.firefox.com/
I'm generally unclear about the utility here - goSLP which generates the training data seems to be significantly better at ~1.04. Is it because the NN might be faster?

It would be illuminating to see approximate compile times. The 1.015 number comes from 10 rollouts. Speedups are < 1 for 1 rollout. How long does goSLP take vs. LLVM?
Have you looked at Qri? (https://github.com/qri-io) - free & open source dataset versioning. Also: https://qri.io
Hardly; the first version of this patch series was from August 2019 (which is before the brouhaha caused by ext4 getting optimized and causing boot-time hangs for some combinations of hardware plus some versions of systemd/udev), and the second version was from September 2019. In the second version, Andy mentioned he wanted to make further changes, and so I waited for it to be complete. I had also discussed making this change with Linus in Lisbon at the Kernel Summit last year. So this was a very well considered change that had been pending for a while, and it predates the whole getrandom boot hang issue last September. I don't like making changes like this without careful consideration.

The strongest argument in favor of not making this change was there are some (misguided) PCI compliance labs which had interpreted the PCI spec as requiring /dev/random, and changing /dev/random to work like getrandom(2) might cause problems for some enterprise companies that need PCI compliance. However, the counter-argument is that it wasn't clear that the PCI compliance labs somehow thought that /dev/random was better than getrandom(2); it was just as likely they were so clueless that they hadn't even heard about getrandom(2). And if they were that clueless, they probably wouldn't notice that /dev/random had changed.

If they really did want TrueRandom (whatever the hell that means; can you guarantee your equipment wasn't intercepted by the NSA while it was in-transit to the data center?) then the companies probably really should be using some real hardware random number generator, since on some VM's with virtio-rng, /dev/random on the guest was simply getting information piped from /dev/urandom on the host system --- and apparently that was Okey-Dokey with the PCI labs. Derp derp derpity derp....
...he writes, conveniently overlooking the human rights abuses and threats against neighbors which induce the sanctions. Hanging gays for being gay, beating/jailing women for not wearing scarves, frequently declaring intent to bomb Israel for merely existing, obviously building nukes for that purpose, funding & operating terrorism worldwide (hence Soleimani hit), normalizing "Death to America" chants nationwide, etc. Stop bullying others and others will stop sanctions.
> Open new windows more quickly. Firefox feels sluggish (on Mac)

I assume you mean new tabs?

That's very quick on Windows using FF 72. Interestingly that's been a long-time annoyance of mine when using Chrome on Mac - when compared to Safari which shines here.
The fact that this attack is chosen prefix does weaken the first argument though, you may now find a collision even accounting for any prefixed git "header". The rest is still completely valid though.

I still feel like they really should've taken this problem more seriously and earlier. The more we wait the more painful the migration will be when the day comes to move to a different hash function, because everybody knows that'll happen sooner or later. Two years ago we had a collision, now we have chosen prefix, how much longer until somebody actually manages to make a git object collision?

And keep in mind that public research is probably several years behind top secret state agency capabilities. Let's stop looking for excuses every time SHA-1 takes a hit and rip the bandaid already. It's going to be messy and painful but it has to be done.
BMW Launches Gaze Detection
I did not read brigandish's comment as advocacy of 'blat and reclone', I took it to be a comment on git's awkwardness.

I have considerable sympathy for the RTFM reply, but I do not think it is the last word that shuts down any question of usability. What seems clear to me is that there are a lot of people using git who probably should not be. In many cases, they do not have a choice, but I also suspect that many of the organizations that have chosen git do not have the issues that it is optimized for.
I finally switched to FF two months ago after the uBlock fiasco, and I find it ok. Is it as fast as Chrome? No. Does it never freeze? No.

But is it good enough? Hell yes.
That's not why next-generation codecs keep being made.

I remember back in 90s / 00s when a CPU would stutter doing MPEG2 decode with XVID or DIVX codecs. Eventually, CPUs got faster, and guess what?

Faster CPUs mean you can "afford" better compression / decompression routines. No one uses XVID or DIVX anymore, because CPUs are so fast that we want better compression (not faster compression).

H264 was then popularized, and I remember in the late 00s / early 10s when "Netbooks" would stutter decoding H264. ASIC chips were invented to better decode H264. But guess what? Today, CPUs / GPUs are so much faster that H264 is now too easy, and we desire even better compression.

Repeat the story again for H265 and VP9, the next generation (with VP9 patent-free becoming more popular).

AV1 is designed to be the next step. Its still too slow for most people, but ASICs are being developed so that cell-phones can run the AV1 decoder algorithm. Eventually, computers will overall get much faster, and everyone can then move to AV1.

-----------

Eventually, computers will be so fast that even AV1 is "too quick", and a new, slower, better form of compression will be invented.

We move to newer codecs because our technology continues to change. Now maybe AV1 will be the "end all, be all" of codecs, but it will be a sad day if that is true. Because for codec-progress to end implies that CPUs have stopped improving.

Moore's law seems to be dying, and later nodes (5nm, 3nm, etc. etc.) are taking longer and longer to research-and-develop. Maybe our computers will stop improving soon...
Thanks for thoughtful conversation!

As an atheist with Jewish background who is thinking more about Jewish traditions these days, some thoughts are: The act of figuring out as a community the details of the rules (or 'exceptions' of they seem so) in the face of changing social conditions can itself be meaningful. It can produce meaning related to bringing people into a community of discussion and debate in which decisions are made, or of authoritarian following the orders of a designated leader who decides how you are to interpret the rules, or some combination thereof.

It's all full of meaning, very meaning-producing. It may be intentional or unintentional, the kind of meaning we'd want or not want. Once you are an atheist -- or otherwise don't believe that there is a God who speaks to us in human language giving commands -- it actually frees you (singular or plural) up to alter the practices to produce the meaning you want.
This is exactly why I stay away from things like buzzfeed.
Your personal name is not unique. Also, there's no law that forbids to register domain with someone else's personal name. Do you really need this domain? Then buy it. Otherwise, simply don't care about it.
I never said it is only expanding outside. Also moving relative to space is not nonsense. Motion is not just relative to other objects in space. This what Newton's bucket thought experiment showed.

Edit: the pearl is made from around bound by electric forces, so you can repeat the same argument for inside the pearl. You can repeat it all the way down until you have to admit that the approximations inherent in the concepts useful to describe the world at distances from nano meters to mega parsec eventually break down.
Why Johnny Cant Encrypt [pdf]
Unless you're just doing the passive index fund thing, which there is obviously nothing wrong with, I don't think many understand the stress levels that come from trading. Insane highs. Insane lows. Lows you will eat at you for years.
am slightly dismayed that to this day on macOS I can't use back and forward buttons even if I redefine them in karabiner. it works with other browsers, seems that autoscroll feature is no degrading gracefully when you disable it.
Pattern Matching in Ruby 2.7 (2019)
> you have to be able to also edit the size field in the header.”

As I read the OP [1] a chosen-prefix collision attack such as this allows you to “edit the size field in the header”. Or am I missing something?

1. “A chosen-prefix collision is a more constrained (and much more difficult to obtain) type of collision, where two message prefixes P and P’ are first given as challenge to the adversary, and his goal is then to compute two messages M and M’ such that H(P || M) = H(P’ || M’), where || denotes concatenation.”

EDIT: On second thought I was missing something: the adversary is further constrained in the git case because it must find M and M’ of correct length (specified in P and P’). Linus is right (as usual), this probably makes it much harder.
Meant to imply "just as a" for the right click and add to the standard video controls. For now I have media.videocontrols.picture-in-picture.video-toggle.enabled false which does half of this.
No, Tucker Carlson is not news. He's a pundit/commentator who has a talk show. Neither is John Oliver. I'd almost say they're flip sides of the same coin, except Carlson trends WAY right (often right into conspiracy theory land) and Oliver is more center-left.
This is a web standard thing (though I believe FF's implementation may be proprietary.) Safari, Chrome, etc. have it, why would you not expect Firefox to? It's very useful for browsing while you watch a video open in another tab.
This topic is really tricky, and there's a lot of different ways to slice it. In the most general sense, if you take a C expert, and a Rust expert, and ask them to do something, they should be able to get the exact same results.

But that leaves out other interesting questions that inform this comparison. For example:

* What about the average Rust programmer vs the average C programmer? Maybe two experts can produce identical results, but does one language vs the other make it so that a non-expert tends to produce faster code?

* What about "no unsafe Rust other than what's in the implementation of the standard library"? Most Rust code doesn't use unsafe, so is it fair to let the Rust use it? How much?

* What about "no code other than the standard libraries." I may not be an expert, but Rust's package ecosystem makes it easier to use code that's developed by them. This is sort of a slightly different take on the two previous questions at the same time.

* Should there be a time limit on development? If so, should the C have the same requirements of demonstrating safety as the Rust, that is, sketching out an informal proof of correctness?

* What about some sort of "how maintainable is this" metric. Mozilla tried to implement parallel CSS in C++ twice, and couldn't do it, because the concurrency bugs were just too many. Their Rust attempt succeeded, thanks to the safety guidelines. Is this comparison valid? Or could some sort of person who was better at C++ have implemented it in theory with no bugs? (this is sort of question 1, but slightly different.)

Lots and lots of ways to do this.
Firefox keeps getting better. I really want to switch. The only thing that’s holding me back is the design. It just doesn’t look as modern as Chrome or Brave. The back button is a different height than the search bar; the tab container doesn’t line up with the search from the left side of the window. And it has a weird mix of slightly-square and rounded buttons, which makes it feel like a second-class browser.

I know that the average person isn’t concerned with these things, but I spend almost all of my day in a browser, and I want it to look as good (or better) than the competition.
Endless OS, a Kid-Friendly Linux, Is Coming to Raspberry Pi
The money is supposed to be invested in part by the employee and the employer at the time of payroll. This money is then moved to a fund, impossible to be touched by the company forever and ever. The fund invests the money, it grows, and then you can get an income in retirement after many years. The same could be done by the employee itself by just saving part of his paycheck and investing in a mutual fund, but most people don't have the discipline to do that so a defined-benefit pension protect the employee from itself.

That's how it works in other countries like Canada. It's relatively easy and failsafe if well implemented, I really don't understand how it can be legal for a company to access the fund like in the story.

It's a shame so many of them are so badly managed/corrupted though. As usual, most stories about pension failing are about gross mismanagement (not paying into the plan as required) or corruption (drawing into the plan innapropriatly).
The shattered prefix was chosen as well, see my other comment in the thread: https://news.ycombinator.com/item?id=21980759

The only thing that prefixing the length makes difficult is using the same prefix multiple times: you basically have to make up your mind about the type and length before mounting the shattered attack. Also, the prefix means you have to do your own shattered attack and can't use the PDFs that google provided as proof of their project's success. Price tag for that seems to be 11k.

[1]: https://github.com/cr-marcstevens/sha1collisiondetection
If you're looking for a reddit alternative in the fediverse, I can't miss the opportunity to toot my own horn: I'm working on a federated link aggregator that you can try at https://littr.me.

Currently it's missing exactly the federation component, so people on Mastodon can't interact with it yet, but it's getting there. :)
The problem with paying it is that even if it works, and all the machines decrypt in a timely fashion, you have no idea if the attackers have left anything else in the network that they could use to enter again.

You might not even find out the original entry point, and stop others following. Also it will be expensive.
It provides vastly more visual sense of the mountainous texture involved, as well as direct height comparison.

Our eyes are not great at detecting the difference between 80% and 82% grayscale, but they easily see the difference between adjacent shapes 80px and 82px tall.

Similarly, it's incredibly difficult for us to compare the difference between 80% and 82%, against 82% and 86%. Whereas with a line, it's trivial to see that the angle increased dramatically on the second one.

Grayscale and color maps are well-known for only being able to provide a "big-picture" overview because our eyes can only vaguely distinguish subtle differences in color/intensity. This type of plot addresses that partly.
I currently go to about:profiles and click "open this profile in a new window", but this is very klutzy compared to Chrome's profile switcher next to the URL bar.

Of course you can also create launchers/shortcuts for Firefox with "firefox -P profilename" but again that's work you have to do on each machine you use.
I'm self-employed and this is a personal server. I'm looking more for advice on how to check for infection.
Could you say that these layers are systems that make up a larger system? So, when you want to view a certain system, you see all its components as nodes. And if you click on a node, you can see its components.
Never Split the Difference was really useful. I don't apply the exact methodology, but the general principles are useful in many different situations.
> What is the realistic best-case scenario?

Finding latent logic and memory errors, gaining greater confidence, security and velocity.

> Has anyone demonstrated that well-written Rust code should run faster than C

Should? No. Can? Yes. See Brian Cantrill’s http://dtrace.org/blogs/bmc/2018/09/28/the-relative-performa... or Cliff Biffle’s http://cliffle.com/p/dangerust/
+1 to japanoise's suggestion to write your own static blog script. Here's mine, which I initially wrote several years ago after evaluating & having issues with many other options: https://github.com/Sequoia/sequoia.github.com/blob/rewrite/s...

I recently evaluated migrating to Hugo to ditch my hastily written script & use a 'robust, mature' tool. I wanted to add an RSS feed and figured "why work more on my one off script, I could use a pre-built solution!" But migrating was indeed a pain in the butt, and it quickly became clear that writing a function to output an RSS feed was much faster than doing everything I needed to migrate.

Static blogs are very simple, and performance doesn't matter that much for all but the most prolific authors, and you can improve performance if needed. Write your own script!
Off-medium: https://outline.com/4RYJ8T
I found out my mom died while I was at work, age 37, after a short illness (I was going to see her the next week), and although I generally kept it together that day, at one point, while talking to one of my staff on the phone, I just completely lost it. I think I cried in a way I hadn't ever before (maybe I've had a fortunate life). What was oddest to me was that I couldn't control it at all, but I was still able to think and even had a conversation with them over Slack while this was happening.
Ubuntu runs a little behind in the PHP versions...I think it is mainly for compatibility sake (which is good if you are looking long-term without much breakage)

I switched to Linux Mint recently (which is a offshoot of Ubuntu) to have more recent PHP/MySQL versions. There are many guides out there for getting LAMP up and running with Mate as well as Ubuntu. Just include the version with it (i.e. search install php mysql ubuntu 19.10 )
> the harder it is to find a collision that’s valid in the given application context

In the double-digit thousands of dollars, an attack that gets 10x or 100x harder is still cheap for state actors.

Assuming the NSA is at least a year or two ahead of the field, git should now accelerate its migration process.
I absolutely loved it. When I switched to Firefox from Chrome not long ago I thought that's a new Youtube feature. It's fantastic.
> - Give me a setting to autoconfirm all cookie consent requests and lobby for a legally binding do-not-track header. Cookie consent was well meaning, but it has turned out to make things worse. Let's move on.

This can be done with uBlock Origin and an "annoyances" filter list such as EasyList Cookie. It doesn't actually give websites consent to use of cookies, only hides the consent form.
It isn't a spam filter. It is a violation of a contractual agreement regarding PII that happened to manifest as spam.
What about ThinLTO? The idea of having a overnight full build that creates some kind of cache which incremental builds throughout the day can use to do fast whole-binary LTO seems like the best of both worlds.

Basically just wondering if anyone has first hand experience using this kind of thing on a large project.
This is especially good. Thank you.

Accelerando is a wild ride.
I feel somewhat sorry for the author. He ends the post with the realization that the search for success has not turned out like he was led to believe, and then questions how he should proceed with life.

My advice would be to go make pasta and share it with a beautiful woman (or man in his case).
Amazon stopped featuring its own brands in search results
These are what I would consider high-effort, low-reward marketing strategies.

It takes a lot of time and manual effort to identify communities and pages where this activity should take place, and then to initiate the activity in a way that doesn't get flagged as automated/spammy. For your troubles, you may luck out and get some new followers who are mildly interested in your product, or some clicks that probably won't have high conversion rates.

They may be "powerful" in terms of getting views or initial interest, but they likely won't be powerful enough to get people further down the funnel.
People buy Mac Pros to specifically run Mac Video Editing Software. This is the only reason to own a Mac Pro. IE if you work for Marvel editing films.
Maybe entrepreneurs are in part driven by ego. Taking on huge risk takes motivation.
>The lion doesn't concern himself with the opinions of the mouse.

This is from game of thrones. Also, former FL Sheriff Scott Israel used that quote in a courtroom after a judge had called him negligent.
One of my favorite touches from LongNow.org is that all the dates on their website render in 5 digits:

> The Long Now Foundation was established in 01996 to foster long-term thinking and responsibility in the framework of the next 10,000 years.
I don't think you can do anything about the domain itself, but if he's using the domain to spread slander you can do something about that.
I never accept any notification from anywhere on desktop or mobile (except some calls) and am all the happier. Don't let others control your agenda.
"Omnishambles" has a fun etymology - it comes from the political satire "The Thick of It": https://en.wikipedia.org/wiki/Omnishambles
The cost is very high but it's only getting higher with time. People have known that SHA-1 was weak and deprecated for much of git's existence. Doing the switch in 2010 would've been painful, doing it now would be orders of magnitude more so and I doubt it'll get any easier in 2030 unless some other SCM manages to overtake git in popularity which seems unlikely at this point.

Unless Linus really believes that git will be fine using SHA-1 for decades to come I don't think it's very responsible to keep kicking the ball down the road waiting for the inevitable day when a viable proof of concept attack on git will be published and people will have to emergency-patch everything.
Training GPT-2 to Play Chess
I absolutely love this feature and the fact that I don't have to use a 3rd party extension is even better. It's also practical for websites that autopause videos as soon as you switch to another tab which I find ridiculous.

I'd love for them to add a progress bar and subtitle (think youtube, netflix or prime video) in the PIP window.