skysight-inc/HackerNews huggingface dataset:
oh that's a good idea. I'll do that.

I was really bummed going from a site where anyone could easily see how it was made and read the source code via view source, to Gatsby/React where its unintelligible. But to have animations persist across "pages" it was necessary to switch. This is what index.html and layout.css used to look like:

https://github.com/simonsarris/site-simonsarris/blob/faf3eb7...

https://github.com/simonsarris/site-simonsarris/blob/faf3eb7...
That was scarier than many horror movies.
Maybe he should enter that in a short movie competition.
>CacheOut violates the operating system's privacy by extracting information from it that facilitates other attacks, such as buffer overflow attacks.

>More specifically, modern operating systems employ Kernel Address Space Layout Randomization (KASLR) and stack canaries. KASLR randomizes the location of the data structures and code used by the operating system, such that the location is unknown to an attacker. Stack canaries put secret values on the stack to detect whether an attacker has tampered with the stack. CacheOut extracts this information from the operating system, essentially enabling full exploitation via other software attacks, such such as buffer overflow attacks.

Can anyone explain this scenario? Is this really a realistic scenario? Do they mean if you have code execution on a system, and want to escalate privileges, you would find another network/socket service that is running on the same system, find an exploit in this service, and then leak the stack canary to allow corrupting the stack? There's often easier ways to defeat the stack canary.
These sound incredible. Can I ask you to start a blog / podcast / Youtube channel to distill your thoughts? It seems like you have a theme of exploring economic history from an alternate explanation (energy) than what is commonly thought (technological progress is an inevitable ratchet towards improvement).
I'd love to see the citation?

Also I wonder if it's highly dependent on whether the domain is largely algorithmic (e.g. video codecs) or business logic (e.g. supply chain).

And how much is simply the language being "misused", e.g. writing "<= n - 1" rather than "< n".
Really kind of you, thanks. Now my challenge is to make an app that lives up to the landing page - some of the things are definitely challenging!
Since you admit that you’re not an expert, you shouldn’t really assume that attribution is that simple, or that they aren’t fully aware of these things you mention.
> estimating hacker provenance consists purely of modifiable and/or spoofable circumstantial evidence, including IP addresses, malware signature, and possibly timestamps/localizations within the binaries.

There's more to it than that, and often attribution is the result of the "bigger picture" of multiple clues, rather than a single smoking gun. Group operations develop patterns over time that are much greater than just a timestamp somewhere. Also, identifying a 0-day exploit somewhere often allows you to discover previous deployments of the same exploit, which have their own blast radius of evidence, contributing to these patterns that are identified over time.

>but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any nation/state who's modus operandi are known in hacking circles, no?

>Deliberately engineering your attack to mimic one from another group is an excellent way to keep people off your trail...

Yes, misdirection is the name of the game here, all bets are off and nothing is off limits. But covering your tracks leaves tracks of its own, and again, even when an attacker thinks all their bases are covered, they will never be sure there wasn't something somewhere they left behind that points back to them.

> and these are hackers we're talking about, after all.

Who do you think "hacker-hunters" are, if not hackers themselves?
"All the functions" - I guarantee you that almost any function you want in Excel is in Sheets. Just because you don't know how to use it or find it doesn't mean it doesn't exist. The only reason you know how to use Excel better is that you have past experience with it. That's, effectively, the sunken cost fallacy.

"size" - what?

"some of the external tools" - duh? But what on earth are using using "external tools" integrated to Excel for?
Save yourself from wasting a click; you're required to provide your email address and join their mailing list in order to get the reference card.

If you want to see a C++20 new features list try: https://www.reddit.com/r/cpp/comments/cfk9de/201907_cologne_...
The Do's and Don'ts of Technical Interviews
Sure, mail me at davedx@gmail.com and I’ll keep you updated.

Which response was that? :)
Going Beyond Automatic SVG Compression with the “Use” Element
Sure, let the ranking #1 control has everyone else's precious stuff then.
There's some pretty compelling evidence that open offices diminish communication.
Oh wow, I remember reading this back in the day.
Oops, I was wrong. A count is a quantity.

This is numbering being talked about. Guy finishes a marathon in first place, he would be the zeroth runner and one runner has finished. Most people would intuitively like those numbers to line up.

Of course, when you build the natural numbers on a computer and use those as indices to arrays, it makes sense that the first index is zero. So the first (common usage) element would then naturally be called the zeroth element. This, of course, gives you the problem that array.size == x means that array.last_index == x - 1 and all the off by one errors that entails.
I have a nagging feeling THIS comment won't age well.
Mm-ADT: A Virtual Machine/an Economic Machine
Ah, I should fix that, thanks for pointing it out! :)
I use Joplin, and make my own awesome lists. Sometimes I'll just use their webclipper app to clip parts of pages for my own 'doc' system for things I want to remember.
Terry Jones was a member of Monty Python, which gave us the word "spam" for unwanted email, and the Python programming language.

I would call that sufficiently on-topic, personally.
Same here: I'm taking a lot of notes and find SimpleNote/Notepad++/NV work for me for note taking but not for note management. And I also build several tools to manage it. For now I use very simple full-text search (qgrep) and fzf (with my own modifications) to perform search-as-you-type to find notes/source code.
qgrep is good for really quick index and it has incremental indexing that works for my byt i'm hitting some problems as it works good for code search but not so good for notes. However i don't feel like using anything that start a server. I just don't think I have that many notes.
I would expect that this is because the rest of the network needs to agree with your version of history. And they will only accept your vote if you stake the currency they already recognize, not the currency you made up in your version. So to make the network accept a history version where you have a lot of money you need a lot of money.
Nice quote at the end...

"In corporate religions as in others, the heretic must be cast out not because of the probability that he is wrong but because of the possibility that he is right." Antony Jay
I worked on AI-via-predicate-calculus, as a successor to Cyc, and I think the main thing I learned is that people are incredibly bad at predicate calculus. Even when we behave "logically", it's an after-the-fact rationalization for a conclusion we arrived at much faster with heuristics.

When we think-about-thinking, or talk-about-thinking, we do so in the language of language, which quickly leads to logic. And that leads us to think that the logic is the thinking. But in fact it's a rare, specialized mode of thought. The primary mode of thought -- the one that keeps us from making big mistakes for a half-minute at a time -- is that irrational one that's very easy to fool if you put effort into it, but which actually gets it right for most of reality (which isn't, generally, trying to trick you).
Massage credits. I'm surprised they didn't mention these in a silicon valley episode. :)
The question now is: was hiring the cloud mining services cheaper than the reward of $72,000?
You conflate "narrative" and "GM-controlled narrative". These are not the same thing.

The current trend enables player agency because the table as a group decides the narrative, not just the GM. It's about the table as a whole deciding what it most narratively interesting to happen right now.
Microsoft didn't see a disconnect between "VB Classic" and "VB.NET" like so many users did. They continued the version numbers straight across (the first VB.NET was version 7; it's currently at 16). They didn't feel they outright "ended" future progress, they felt they evolved the platform organically and at least to some extent were confused when users didn't follow along. Microsoft followed the confusion by providing increasingly more migration tools and assists (many of which you can still find online, even if some of the worst mistakes of their WinForms 1.0 era code is uncorrected).

(I don't know if a similar reasoning exists behind encouraged migrations from FoxPro to Access, but I'd imagine that given how very long Access supported FoxPro imports and databases, there's probably a similar sentiment inside those parts of Microsoft.)

Those kind of compatibility break/evolutionary steps are always hard, and Microsoft could always have handled them better, but seeing as how even open source continues to have the exact same problems (say the Python 2/3 debate or the Perl 5/6 stuff) it's hard to say that anyone in software has a good handle on this stuff. Microsoft at least seems to try every time to offer migration paths and assistance/help.
>It is known since... forever?, that one should not speculate across security boundaries.

... if you value security over raw performance. Clearly Intel has decided at some point that it was worth playing with fire in order to get ahead in benchmarks. In their defence it seems to have worked reasonably well for them for quite a while.

>The people most annoyed are the users.

I wish, but I wonder how much of that is true. Are most users even aware of these problems? They get patched automatically by OS vendors and then most of the time they won't hear about them anymore. I think the "nobody gets fired for choosing Intel" will probably still prevail for quite some time.
IIRC, that's because computers finally became capable of achieving 100% depth inspection of the possibilities; of finding the answer to the game itself. If you can answer the game, you don't need humans to lead your seeking of a partial answer to the game.

For games like Go, where computers are not yet capable of viewing the full depth of the possibility tree, I imagine that human+computer is still a viable strategy.
It feels that way because it has been exactly as you describe. I can only assume it's youngsters who have been doing the undeserved downvoting. If you look at the timeline, you can get a feel for why, and who:

1988/9 First ISPs and connections outside academia

1993 Eternal September, AOL let the great unwashed out on to the net. Damn annoying for six months or so, but the net recovered.

1994 First spam, and colossal in scale. Two bottom feeding US lawyers filling every usenet group with US Green Card spam.

1995 NSF end their ban on online commercial activity.

First e-commerce kicks off, and it's all a bit hobby-esque, and even large businesses are adopting netiquette habits. Like linking out, providing chatty informative pages for no other reason than "because", etc. Putting an e-commerce order somewhere might get you a lovely long chatty thank you email direct from the owner, or a hand written note in the box. The internet still feels like something remarkably different to meatspace.

By the millennium, the year AdWords was born, as the first dot com boom turned into a full on idiocy fuelled bubble, it was the birth of bait and switch. There's a whole ballooning category of "internet marketers" with gloriously scummy SEO, fraudulent sales tactics, learn to spam better courses and worse. Like all easy way to riches sales, the only way to get rich is with the easy way to riches book, subscription or course parting fools from money.

Now everyone commercial, from the largest 5 world companies down, are internet marketers of the worst possible interpretation of the term. Commerce, scam and affiliate slice forced into everything. Bait and switch all the way down.
I agree. Right now it is pretty obvious China has potentially the best view of space than anyone trying. As far as I know, they haven't built a large telescope up there yet, but if they did, they wouldn't be bound to the same limitations an artificial satellite deals with. For example, size and weight.
You said the simplest explanation is usually true, then peddled a nonsense conspiracy theory. I don’t think you understand what NCC does at all.
TensorFlow 2 and Keras tutorials (fork of nlintz/TensorFlow-Tutorials)
> duck tape

That's a fascinatingly apt mixed metaphor: duct taping meets duck typing.
Next Generation ArXiv and the Economics of Open Access Publishing
Some background on Python's choice for 0-based indexing:

http://python-history.blogspot.com/2013/10/why-python-uses-0...

See Guido's comment on calendar :)
The question should not be "can hacks be attributed by digital evidence alone" of course they can. The question should be, in this specific case:

1. How much evidence do we have?

2. How hard would it be for the hackers fake this evidence?

3. Are there any signs of forgeries? For instance logs that don't agree, file system artifacts, etc...

4. What were the capabilities of the attacker?

The longer a hack goes on and the larger its scale the harder it gets to forge 100% of the evidence.

>All of this makes a convincing story for media and laymen, but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any nation/state who's modus operandi are known in hacking circles, no?

I would say no, doing that is very difficult and is not trivial to do. All cases I've read up on, such as stuxnet, flame, APT-1 etc..., had clues as to the origin of the malware and such clues were left in the malware accidentally.
gVisor is pretty amazing and has enabled a lot internally. For a long time it wasn't clear we were ever going to open source it as opposed to keeping it as secret sauce for ourselves. I'm happy we did release it.

I'm very curious what happens to Fuchsia. It's very ambitious and might be amazing, but in a weird state right now where it's open source but they don't talk about it (or document it) much.
It doesn't help that it wasn't available for the tier 1 $6/mo GSuite orgs; companies paying for business/enterprise likely already had better software that did what app maker did.
Okay, I see your point.

To weasel out slightly, I did say:

" ... beef cattle are fed on grains for most or all of their lives."

AIUI, CAFO-destined cattle are moved into feeding lots as soon as they're weaned -- say at a couple of months old. They're mostly on milk, with some grass, up to that point. But from that point on they're on grain-only.

You said:

> I’m not aware of farms using an “exclusively grain-based diet”

and subsequently

> My understanding is that these feedlots are where cattle are housed for the last few months to gain weight before slaughter.

This doesn't align with my understanding.

Once within a CAFO, the cattle stay there until slaughter -- say at age 18 months or less. During that time they're fed exclusively grain, as this ensures maximum growth / minimum time / best ratio of input cost to sale price / etc.

Some may be finished on pasture, as this is an increasingly profitable market, plus it drastically reduces pathogens within the animal, and improves the flavour (so I'm told).
>Of course, people still exist that believe the moonlanding videos were faked, but their hypothesis hinges on the government spending extraordinary amounts of money to produce the fake.

Are you truly suggesting here that the government would never make a fake video about a moon landing because it would cost too much to make this video?? So instead they sent humans to the moon and brought them back safely to earth because that's all their budget would allow?
> "This tells me more about the person trying to cash the check than the bank here."

That he's someone willing to fight racial discrimination in a court of law?

That's someone better than I, because I don't think I could go through the emotional process of a lawsuit unless it was very extreme.

> "and the bank was unable to verify that these were actually legitimate"

You know that banks have existing processes in place for this, right? And that "call the police within a few minutes" isn't part of the standard process?

As an example, https://firstquarterfinance.com/how-to-cash-a-large-check-wi... says: "Bank deposits and check cashing activities are governed by Regulation CC, a Federal Reserve banking regulation that governs the availability of funds and collection of checks ... Regulation CC rules state ... "For large checks over $5,000, banks can delay the availability for a “reasonable period of time.” The time period considered “reasonable” is two business days for large checks drawn from one of the bank’s own accounts (“on-us” checks), and up to seven business days for all other checks."

So the bank could have said, "this is a large check, it will take a couple of days to clear", and left it at that.

I mean, they've got his contact details, so he really was engaged in check fraud then they know how to get him.

> "More proof that this wasn't racial"

Really? Why? Black-on-black discrimination exists too. Eg, Turner v. The Hershey Co, https://www.leagle.com/decision/infdco20141015b00 where "Each of the other witnesses cited by plaintiff testified that Williams [an African-American] regularly stated that he had too many blacks on his sales team.".

Or, https://theblackfactor.blogspot.com/2007/02/black-on-black-d... for another example "The President/CEO is a Black woman, but, apparently, she refuses to put Black people into the highest level positions."

> "and being unable to verify"

That should be "unable to verify after a few minutes."

Remember, the police were there "within 10 minutes".

If a few minutes are all that's needed, why are banks allowed to place a hold for two to seven days?
@bradfitz congratulations on a long, productive tenure at Google! Looking forward to what you do next!
Yeah, any time someone complains about how many FEATURES JIRA has, it's actually an issue with how their company's management team uses JIRA to micromanage the shit out of them and aggressively optimize metrics that don't matter. But that would be an issue with the organization instead of the tool. And those are much harder to fix.
brick + pencil is not a bad metaphor for a screen keyboard
> I think it's fair to say that any of Google's individual technologies can be replicated in fairly short order, but the problem is that the combined effect of Google's collective suite of tools is powerful.

What? That makes no sense to me. There have been thousands of some of the smartest/highly skilled people (payed some of the highest salaries) in the industry building systems for decades, that's Google infrastructure today. How do you expect to replicate that quickly without similar investment in time and money?

The hard to surmount "moat" is inherent to the tech and its demands. Just take the amount of dark fiber they have or the highly customized datacenter hardware and software stack and the sheer amount of them. Sure, you can replace all that with a smaller set of VMs using someone's "cloud services" but your margins, power use efficiency and scale will be much worse.

That reminds me of a discussion with a Linux filesystem engineer: building a POSIX filesystem is easy, building a thread-safe highly scalable fast and efficient POSIX filesystem is hard. You can have a single operating systems student build a simple POSIX filesystem in one day but it takes year-hours of multiple highly experienced system engineers to get a production level filesystem.
In the 19th century, in order to prove that "dirtyness" causes cholera, a man named Pettenkofer drank a vial of clear water contaminated with cholera. Fortunately he attempted to control the experiment by neutralizing his stomach acids beforehand, which prevented the cholera from becoming pathogenic. The colony passed through his digestive tract without incident.
Running any resilient storage system without ECC RAM is warned against, people just really make a big deal about it with ZFS. If your data in RAM is corrupted before it makes it to the hard drive, pretty much any file system is going to write corrupted data to the drive.
> An operating system (OS) is system software responsible for managing your computer hardware by abstracting it through a common interface

So uh... that's a reference to the IME right? Not the user's installed OS.
"We hoped for a bicycle for the mind; we got a Laz-y-Boy recliner for the mind."

Best line I've heard this month.
I met her in Munich 5 years ago while I was en route from San Francisco to Brussels for FOSDEM. (I stopped in the Munich Google office for a bit on that trip.)
I am aware with XY Problem. You are right about binary compilation for easy deployment (Though I believe Java is faster than Go, so the speed is not reason).

But static typed provide a plethora of other advantages. Erlang is one of the languages I had always in my checklist but never got into.
At least in scientific computing, that would not be the case, quite the opposite in fact.
Practical AI 74: Testing ML Systems
This is awesome! I wish there was a video showing the results. This might be my next project!
*duct, ironically.
Great article. I have thought a lot about personal websites and the lack of any built-in "social" aspect. Comments, forums, guestbooks, webrings, topsites, etc. all used to be commonplace, and these have all but disappeared as social networks have risen.

I am not sure that any of these ideas themselves will make a comeback, but a remix of them might fill some gaps that exist today, especially with discovery.

My attempt at a social discovery network of sorts, for content websites: https://cruton.app

It's a Reddit-style presentation, but instead of votes, it ranks URLs purely on traffic and qualitative metrics. Add it to your site if you want to help me test it out and improve it :)
That’s tenuous at best.

The reason it was “relevant” is simply because there’s more Monty Python fans on here than basketball fans. Which is fine if we’re talking purely about +votes but it doesn’t justify flagging a submission.
Someone shared this on HN yesterday - https://labs.tomasino.org/gnu-recutils/

It's a set of unix-style tools that let you treat text files as databases.
(1) For note taking I stumbled across anno[1] via[2] two weeks ago. It's a python flask application which you run on your localhost. You write markdown which gets stored locally as file and is rendered as html using pandoc[3]. It's really basic but I love it.

(2) For physical documents I use a Fujitsu ScanSnap iX500[4] for scanning. A runtime-licencse of ABBYY FineReader for OCR is included. The resulting PDF has embedded text which I extract using pdftotext[5]. I wrote a python application to search and tag this documents. It loads all the text in-memory which is perfecty fine as I have < 10,000 documents. I use it since 5 years and it works OK.

[1] https://github.com/gwgundersen/anno

[2] https://news.ycombinator.com/item?id=22033792

[3] https://pandoc.org/

[4] https://www.fujitsu.com/global/products/computing/peripheral...

[5] https://en.wikipedia.org/wiki/Pdftotext
I'm certainly going to trust an authentication service with a bad certificate.
When we think-about-thinking, or talk-about-thinking, we do so in the language of language, which quickly leads to logic. And that leads us to think that the logic is the thinking. But in fact it's a rare, specialized mode of thought.

Yes. Language is not thinking. Language is I/O.