skysight-inc/HackerNews huggingface dataset:
At Pivotal (now part of VMware, but it's easier to explain this way) we have an increasing number of teams that track "vulnerability budgets" and "legacy budgets", by way of analogy to "error budgets" from SRE approaches.[0]

Essentially, a vulnerability budget tracks days since last release for a dependency or system; a legacy budget tracks time left until a dependency or system falls out of support. Our CloudOps team and telemetry teams now plot these for their own systems and customer systems, producing a characteristic sawtooth pattern.

I think these are good steps forward, but I see some possible evolutions.

One evolution is to combine these into a more general risk framework like FAIR, so that we're able to use a single budget for all these categories of risk.

Another is to consider risk exposure as a volume. At any given instant I have a wide range of risks in play, distributed over a wide range of systems. As time evolves these risks come and go. A single score (like the one sketched on the far side of the link) only gives me one axis of risk. I also need to know what systems are currently expressing that risk by the presence or absence of software, giving me a second axis. Finally, these evolve over time, giving a third axis.

The sum of volume for any time slice is what ought to be budgeted.

Another thing is to make these problems behave less like "big-bang control", where we switch modes drastically when crossing a threshold value. What would be preferred is a greater degree of smoothness.

And finally, to make all of this tractable: automation. All the metrics and scorecards and reports and graphs in the world won't make this problem easier. They can at best make it visible and demoralising.

[0] This presentation by David Laing and Jim Thomson is a good introduction: https://www.youtube.com/watch?v=lXPmh9Ap114

David & Tim are responsible for an ongoing multi-year systematic investigation of upgrades as a technical and organisational behaviour.
Personal opinion: Beating Beat Saber as a workout program (as much of “not a workout program” as it is) is going to be really tough - Beat Saber is fun. Most workout programs, be they games or with a trainer... aren’t.
graphql-tools-fork can now merge types
Oh, yes in that case you are right! I totally agree that the BBC shouldn't be allowed to post some of their content only on Facebook. Especially given how Facebook is probably the most walled off social media around.
The Napoleon of the Neuroses
Reason to switch?

Trust.

Mozilla cf Google.
You misunderstood. I'm not saying the Soviet system was better or anything like that.

I'm saying it's interesting to realize that everyone on all sides are fed propaganda. As 'siracusa23' points out, he is very aware that both Americans and Soviets continue to be fed propaganda.

What I said was that today, the vast majority of Americans have no idea they are constantly being fed propaganda, and they openly take offence if you say as much.
Anyway it is a pet peeve of mine about talking about economic growth and ending. Growth isn't just more stuff but also better stuff and how it is used.

If there is no growth even in such hypothetical extremes as a fixed population sustainable everything model then society is fundamentally doing things very wrong. Because you have global workforces working at things and nobody is learning to do anything better. A newbie having the exact same productivity as a veteran. In every field. That is deeply contrary to the state of being of everything and implies truly epic levels of mismanagement.
Unrelated but I really love the CSS and design of the site!
> je ne marche _pas_ (I not not walk _any step_)

It merely means I do not walk. There's no particular connotation. It has absolutely nothing to do with pas as in a step.

> - je ne me bat _guerre_ (I do not fight _any war_)

Je ne me bat guère means "I hardly fight". No relation to war.

> - je ne coud _point_ (I do not sew _any point_)

Je ne couds point means "I don't sew". Again, no particular connotation. Point means the same as pas in this case and has nothing to do whatsoever with stitches.
I think this dev machine vs CI?
What do the English equivalents look like? I do the same in Vietnam but I'd rather hear the proper pronounciation rather than a butchered one.
The drip machine is also about $20, and lasts for about a year of daily use.

I'm suspicious of the espresso machines, though, as they reportedly leech cadmium into the coffee. Not something I want to drink all day.
19th Century Vatican palace turned into homeless shelter at Pope Francis' behest
The RVO chapter, and that concept I general is an amazing one because they really created a method for 2 autonomous characters avoiding collisions on a natural way - with code that is easy to understand
If anything the solution is more low-level education, not the exact opposite. People who understand these essential basics, e.g. by starting with Asm, are going to be far less likely to make these sorts of mistakes and write less buggy code in general. I mean, a buffer overflow is a very simple concept and it's not hard to understand. How many bytes could be written, and how much storage is reserved? It's really just arithmetic.

The amount of anti-education authoritarian fearmongering in these discussions is disturbing. Then again, given how much everything seems to be rapidly moving in the direction of dystopian corporatocracy, perhaps that's not so surprising.

There's already a few comments about how "safer" languages don't really solve anything. They just push the problems up higher in the stack of abstractions... and when that time comes, what are the chances the "security" fearmongerers will just start blaming something else? It's fundamentally a problem of competence, and doing everything you can to make the world a prison in pursuit of that "perfect security" is really not a good idea. There's no replacement for intelligence.
i watched the video game trailer and failed to see the connection
I'd love a motorcycle mode aka "ignore traffic", in states/jurisdictions where lane filtering/splitting is allowed. I don't want to have to go offline to avoid it taking into account current traffic.
This isn't "evolution in action" in any inevitable sense. This only happens if the consumer values up-front price over TCO. Admittedly, with emphasis on quarterly earnings, this is the path many companies have chosen, but it's not universal.
> Google’s map service has fundamentally changed our understanding of what a map is ... and how they look aesthetically.

Paper maps used to look like a diagrammatic network of streets, with pale background and yellow for main roads, and our fundamental understanding of what a map is, was that it was a tool for navigation.

Now with Google Maps, maps look like ??? and our fundamental understanding of what a map is, is ???.
One thing I can't shake, and it appears already in the second sentence of the quoted letters by Seneca:

"Life is long enough, and it has been given in sufficiently generous measure to allow the accomplishment of the very greatest things if the whole of it is well invested."

What are "great things" and what is the definition of a "well-invested life"? Most of us will live rather unremarkable lives, most likely forgotten in a hundred years or so (at best!). Who says a "good life" means being remembered as long as possible by future humans? Who says the point of living is not to live in luxury and carelessness?

It just seems to me that Seneca assumes the stoic world-view to be the norm. Can anyone help me understand?
Which happens to be today (aujourd'hui) ;-)
Why are they so expensive?
As an alternative to Apollo Federation, requiring no annotations (or control) of subschemas.

Can be combined with schema transforms to rename types prior to merging!

Supports subscriptions.

New transforms also allow for hoisting and wrapping of fields.

Contributions/suggestions welcome.
Germany would probably not have to buy uranium at first. There is still uranium in the Ore mountains. The USSR and GDR were mining it.
I'd like to learn Morse, but I'm concerned that my skills would quickly atrophy if I stopped practicing.
The revenge of Pablo living life at large. I bet he would have a big smile on his face if someone from the future told him this in 80's.
> Marvin Minsky

Can we still cite Marvin Minsky in the AI field given the allegations that have arisen regarding his relationship with Epstein and sex trafficking?

We should find better luminaries.

I'm all for redemption and I hope Stallman comes around and apologizes, but Minsky went to the grave with whatever happened.
Years ago Apple maps got me really good. It told me to drive down a road, and then exit on what turned out to be an overpass. Which forced me into a very long round trip that went through a toll gate twice.
Well I do have played Doom as a kid when it was released and while I totally get that half of the experience with it was being a kid/teenager, I can still remember as if I'm still there the fear, the dread felt and my heart beating in my chest when playing it at night with the headphones on. And it was just a bunch of pixels (and sounds).
Currently there is not much reason to store electricity in large amounts, since there is not that much surplus electricity in Germany. Storage will become relevant after 2030 or later. Means we are still in the stages of R&D and planning.
Regarding point 2: The developed world birthrates are well below replacement rate and likely staying that way, but that's not new. (Also, East Asia has the lowest birthrates in the world, not the US/Europe).

The world news story is the rest of the world rapidly approaching that, even in many not so rich places.

Within developed countries, I'm only particularly familiar with US data, but what's happening in the US is that the big minority + immigrant groups are what's showing the biggest drops, moving them towards the white birthrate.
You're getting knee-jerk downvotes, but I think your reply is more thoughtful than some are giving you credit for. My original comment more or less agrees with you. However, I'd also temper it by saying that one of the downsides of a highly central government is that it falls prey to the negatives of the "Eye of Sauron". This means that where the relatively few people at the top can focus, and for however long they can focus, incredible things can be accomplished -- sometimes far in excess of what might otherwise be expected.

But due to the lack of a distributed or delegated authority, it greatly limits how many important topics can be focused on at once as the apparatus of government is designed around pleasing the core power holders, who can only focus on a few things at a time. This results in massive efforts like raising armies or building spaceships or whatnot being possible, but efforts that aren't worth the time of the central power keepers (e.g. minding hobbits) fall entirely off the radar.

If the Chinese government can ever arrive at a good solution to local, delegated authority (and I'm not hopeful it will), these smaller issues can be attended to. But as a practical matter they simply get ignored until they become national problems with national priorities.
One of the issues around amateur radio operators is their age. I have a friend who, at 55, was the youngest member of his local ham radio club. It's just not a hobby many people pick up any more.
Good guess, but my date was wrong. It wasn't 1974 it was in the early 90's apparently (8596E btw). I suspect there is a decoder ring for the serial number which would tell me exactly. I've updated the date in my original comment.
Interestingly, sometimes our solutions end up being part of the problem. I've read that reusable teabags, which are cloth-like and require simple rinsing to clean, also shed microfibres. But when you add napkins and just about everything else into the mix, one begins to realize that just about everything you do is polluting the environment with micro fibres and beads nowadays.

Eventually we have to look into making things out of natural ingredients again.
Inspired by the Colorful Koi Fishes of Japan
You misunderstand.

I love California, and would like housing there.
There's a line to be walked between his decently extreme opinion and your decently extreme opinion on left turns (yes, I know this is a potential middle ground fallacy). No you shouldn't barrel on into them but they're not as dangerous as your comment implies. As like most things driving as long as you have decent situational awareness they're fine.
I thought NAT was widespread with mobile providers making that difficult?
I would ammend the last two points and say Chemistry is Physics applied to physical primitives and Biology is Chemistry applied to organic phenomena or something like that.
> I'd love it if there were more "intermediate" level documentation sets on SMT - aimed not at people who have just started using SMT, but also not aimed at people who are going to start doing SMT research.

Agreed. I've been doing some research to create an SAT Solver and found surprisingly low amount of learning material. I'd love some recommendations from HN crowd.
"Prices of houses may be high but affordability is not because of cheap financing."

A 7 fig house still costs 7 figures. In many countries you can not lock in the interest rates for 30 years but they get re-adjusted after 10 or 15 years. Could be a bad awakening for some.

"Asset prices are bounded by the cost of producing new houses"

1. "asset prices" are not only houses. But also Stocks for example

2. The most expensive thing is most of the time not the house but the land. "Buy land, they stopped making it! - Mark Twain"

Read a few books about economics dude.
I've tried various apps, including this. Other apps like this too, both on Linux and Windows.

On Linux, OpenSnitch and Douane. OpenSnitch is not optimized and results in high CPU usage when you move a lot of traffic. With Douane I had trouble using it for longer than a day since it resulted in my PC crashing caused by the kernel module that it installs. There seemed to be a bug in the C code somewhere, and it didn't go away when I checked back a couple months later.

Coming to Windows, most apps were really old. Only some actually worked with Windows 10 where NDIS 6.x came in and broke some things. Those that did work were so basic you could just use the Windows Firewall app. I tried everything I could get my hands on (in a VM) in search of the nice features that LittleSnitch provided. GlassWire was so far ahead in the features and control it provided, I made an exception in buying a subscription based software (which I almost never do)
Fwiw, my "argh" was a "been there" argh. Not a judgey one. Unintended consequences suck.
HN actually discussed neutering hippos seven years ago in "Why It's Nearly Impossible to Castrate a Hippo": https://news.ycombinator.com/item?id=6990822

And there's a post from 5 years ago called Pablo Escobar’s hippos: A growing problem. https://news.ycombinator.com/item?id=8949017

And finally there's the infamous plan to raise hippos in Louisiana: https://news.ycombinator.com/item?id=11321495

I guess we like our hippos.
> evolved to pick berries and avoid tigers

Yeah, that's the thing - the brain and body evolved for a much different environment than the one we find ourselves in today.

So some aspects which used to be advantages are now disadvantages that we have to actively manage with things like exercise, healthy diet, meditation. Which the brain fights against.
Sure, it is a good idea to be upfront about the current state of the project. Still I think I am not mistaken in my impression that you don't wish for rust-analyzer to become popular too early as that would put some unwanted constraints on experimentation.

BTW, thanks the project and good luck! I use it daily and it is awesome.
Yeah, "don't inconvenience anyone else" is a pretty good as far as simple driving strategies go.
Which brings to mind this classic XKCD: https://xkcd.com/435/
> Only in cases of high-treason, such as Assange from WikiLeaks, you would get "imprisonment or worse".

So, "high-treason" must have included religious offenses, attempting to leave the USSR, independent journalism, cultural and literary nonconformism, activism of any almost any kind, and any other sort of activity deemed undesirable to the state. Is that right?

> And no, people did not learn through state-approved knowledge, we had conspiracy theories, we had friends, uncles and friends having friends working inside the government.

Conspiracy theories and rumors are not comparable to the robust freedom of expression we enjoy in the West -- a freedom that we take advantage of on this very forum, where we are free to share information and criticize our Western governments however we please, anonymously or not.

If you're interested in learning about the USSR's treatment of people who spoke against the state, the accounts of the dissidents themselves makes excellent reading. There are entire libraries dedicated to preserving the experience of people imprisoned and killed for crimes of expression in the USSR and its satellites, written in their own words.

I don't know if you really intended to compare the imprisonment and murder of people for crimes of expression, religion, or ethnicity under authoritarian states to the PC movement in the West, but if you are, I have to question whether you actually experienced the former.
Can you cite a 1993 game that you think aged better than Doom? When Quake came out, the full 3D enemies and environments blew everyone away, but the kinetic gameplay was lost. You don't really get this in the first few levels of Doom, but as you progress on the harder skill levels you start to face an obscene quantity of enemies, which combined with the raw player speed and mostly-2D aim create an intensity that was lost in 3D FPS genre.
Weight Loss Is Harder Than Rocket Science
If you only played the vanilla version, try playing it in gzdoom. It's an updated engine that improves the graphics and adds some QoL updates, like preventing your mouse from moving your character forwards and backwards. It's still no Doom 2016, but it makes it feel less like an outdated game and more like an indie game that could have been released in the past few years.

https://www.zdoom.org/downloads
Wow.

I was doing Web development in 1999 for a year or too

I never got that deep.

But I recall clearly adopting a left/right column for static content and center column for the CGI output custom stuff.

Choose that format because IIRC it was easy to implement in straight HTML

I looked at CSS then, but it did not make sense business wise when we could make vanilla HTML work.

It was a different world
Enrollment is up but it's not clear how many actually engage with local clubs.

Age and gatekeeping is definitely an issue. It would be nice to see more focus on SDRs, GNURadio and things that connect more with a wider crowd.
Maybe because they've figured out they're "one and done"?
When you prototype. But once it reaches production, you should hopefuly have managed to reduce the complexity to its bare minimum
Trezor's security features list [0] mentions firmware verification, JTAG, and welding - strongly implying that intends on at least some resistance to physical attack. This is not uncommon for hardware cryptography modules. Since 2001, the federal government has had a certification program, FIPS 140-2 [1], recognizing four different levels of physical attack resistance.

The security engineering industry is very interested in the capability to physically ship secrets to potentially hostile actors inside devices that limit their use or duplication. There are many many applications:

- Payment cards: EMV credit/debit, transit, laundry, parking, prepaid electric meters, etc.

- DRM: Widevine for Netflix, DCP for your local movie theater, anti-piracy and anti-cheat in your Xbox.

- Privacy: the iPhone's Secure Element only decrypts user data given the right PIN, rate limits or caps attempts, resists extraction of private key, much to FBI's disappointment.

- Root of trust: enterprise HSMs for PKI will only enable signing operations with their internal private keys after the presentation of a quorum of operator credentials [2].

Ross Anderson's Security Engineering has a great chapter on this [3].

[0] https://trezor.io/security/
[1] https://en.wikipedia.org/wiki/FIPS_140-2
[2] https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/
[3] https://www.cl.cam.ac.uk/~rja14/Papers/SEv3-ch18-dec18.pdf
Because they're incredibly complex, need to be long-term reliable and are made in small-ish numbers, sold to a small professional customer base.
Unintuitively, informal speaking often skips the ne but the pas is mandatory.

Je mange pas ça - I don’t eat this.

Also the second part can add nuance to the negation, fe.

Je ne mange plus ça - I don’t eat this anymore.

*Not a native speaker so there’s definitely more to it than I know.
In French it is a state of being "sois attentif" i.e. "be attentive"
Hardly, there are other commutative slangs that preceded verlan and African immigration, like louchébem (the slang of butchers).

And that's just in France, it's a common trope in many languages. It just happens to be much better documented in France.
I believe 2.5D graphics is a term and it means not the type of graphics in Doom. Rather the one in Ultima, or SimCity.
8.) They're in the beginning stage of a huge demographic bomb. China's birth rate is plunging rapidly, consequence of the (now defunct) one child policy and better standards of living. China's population is aging rapidly, and there is no immigration to sustain the labor pool, like in Western countries.
That's not how it works. You have capital in the account or you don't. That's what the regulations stipulate and brokers can't break them just because you have more assets, nor have they ever run a background check on me.
As far as I can tell, the prefix/postfix thing here is irrelevant and mostly done for style reasons? It’s on its own line and the value of the expression isn’t used, unless I’m missing something obvious.
“What is Magic but applied philosophy?” I’m sure I’ve seen that as a quote, but I can’t find where from. Possibly Dune?
> The post explicitly talks about out of order execution...

I understand that. But there's no time in the post that demonstrates that prefetching was useful or not.

> It's a hash-table insertion. That's usually poorly predictable.

If he is always inserting 8 elements, the CPU (might) be able to figure out that it needs to insert 8-elements in that loop.

The hash-table insertion itself will fail to be predicted. But there's nothing the programmer can really do about that. However, by having a constant 8-buffer sized "insertion batch", you provide an easily predicted loop to the CPU. There will almost always be 8-elements inserted into the hash table, and CPUs can accurately predict constant-sized loops under 20-iterations or so... maybe 30-iterations depending on how recent your CPU is.

These 8x insertions WILL be predicted. That means your CPU will be OoO executing these 8x insertions. Each insertion may be unpredictable from a branch-prediction perspective (rehash 0x, 1x, or 2x? Depends on the hash table, probably unpredictable), but that doesn't change the dependency graph, so I expect the CPU to OoO the next iteration anyway.

--------------

In any case, I think prefetching is an open question still. I think this is a good blog post, but I'm curious if the author did any prefetching experiments.
"Internet Explorer on Windows was"... 90% plus of the market
Well, I wouldn't go it as far as saying "a big disaster", but I can say with confidence that a lot infections (and possibly deaths) could have been spared if the Party had chosen not to put its head in the sand.

(Disclaimer: hindsight is 20/20, of course)