skysight-inc/HackerNews huggingface dataset:
>> Open source code is much more likely to already have been audited better.

> It just happens to not be true.

I think it's true, free and open source code, on average, is more likely to have been audited to a greater extent. I think most people confuse "audited to a greater extent", "coverage" and "security". The paradox here is: Merely increasing the chance of fixing bugs do not automatically guarantee security by itself, nor guarantee a sufficient code coverage.

For example, if the codebase has 10 serious RCE exploits, if it's a binary-only program, the pentester may be able to find 3, but if it's FOSS, the community might be able to find 5. Yet, the remaining RCE exploits are still exploits. And paradoxically, a project can have fewer exploits than a binary-only alternative in a numerical measurement, yet, the mere discovery of a new exploit can create a huge storm and lead to the perception of the software being less secure, even if it's objectively false in a numerical measurement.

My opinion is, free and open source code, in general, often objectively reduces the number of exploits comparing to its binary-only alternative. It doesn't eliminate exploits. The important question here is code coverage - A group of random hackers browsing code can never replace a systematic review (organized by the community or otherwise). Nor it makes the software inherently secure, a program that uses suboptimal programming techniques is more prone to exploits and more reviews cannot change the fact. However, the exploits discovered and fixed by a group of random hackers are still real security improvements.

For example, OpenSSL, even before Heartbleed, were attacked by researchers around the world, some exploits involved advanced side-channel and timing attacks. The bugs they discovered and fixed are real. Now imagine a binary-only OpenSSL in a parallel universe, called CloseSSL (while other conditions - such as an underfunded development team, remain the same), in this universe, fewer exploits are discovered and fixed, and it may be more vulnerable to timing attacks than the OpenSSL in our universe, so objectively it's more "secure". But both are vulnerable to Heartbleed, in other words, being more "secure" in a numerical measurement does not translate to real world security, on the other hand, the numerical measurement showing the superiority of FOSS by itself, is nevertheless real. Of course, real-world programs do not behave like an ideal model, being FOSS or not also correlates to other variables such as the the size of funding or audit coverage. My argument is only an ideal model treating all variables as independent variables.

I call it the anti-Linus's law: Given more eyeballs, not all bugs are shallow, unless there's enough eyeballs. But it's always better than fewer eyeballs.

> Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

Having the source code available allows pentesters and auditors to use compiler-based instrumentation for fuzzing, which is more efficient than binary fuzzing.
Thanks for the link.

I am not good with Haskell but I meant in general mathematical / algebraic introduction, explanation or a lecture.
The original I was responding to:

"Desktop environments on Linux is really the most asinine dick swinging contest I have ever witnessed in my life."
Kindle customer support phone number
> That seems to suggest we'll have more crowded roads with reduced capacity (due to the added cycleways);

The goal of course is to have people actually use the cycleways, which should increase capacity: you can fit multiple cyclists in the space used by a single car driver.
> People just aren't auditing random code on github for fun

Yes, they do: https://www.fsf.org/blogs/community/who-actually-reads-the-c...
I push, therefore I am: two days at Etsy (2013)
Idk, since 10.04 I've appreciated that Ubuntu is as far as a mainstream Linux desktop distro as it gets and just works (I used to run various distros including RH/CentOS, Debian, Suse, Gentoo, and also FreeBSD). But I'm on the brink to leave (maybe towards Void Linux, Debian/Devuan, or back-to-Slackware) because the things I care about have atrophied (lightweight DE, real Unix environment) while crap (snap, systemd, gnome-shell, invasive command-line suggestions) has taken over. On 19.10 gnome-shell really gets in the way for me. And Unix command line utilities I'm using all the time stopped working for me (for example, even vim on Ubuntu 19.04 comes with broken syntax highlighting OOTB, and annoingly and incompetently inserts tabs and spaces where there must be none, something I haven't seen any vi implementation doing for over 30 years; also, awk rejects complex regexpes all of a sudden on 19.04). I know there are other 'buntus shipping with alternatives for gnome-shell but for me the point is/was that there is a large installed base eliminating glitches, which however isn't the case for alternate 'buntus any more than it is for non-'buntus. I also don't see the benefit of yet another packaging format; the point of a desktop distro should be to deliver a consolidated set of shared libs rather than going nuclear and ship everything in fscking containers, especially when there are exactly zero new desktop apps coming out these days (with the exception of Chrome which I'd rather install containerized, and which I only use for website testing, my main browser being FF anyway).
Zenkit Todo – A Simple Task Management for You and Your Team
Unfair. Equating the feminine with sensitivity is a subtle form of bigotry in its own right.

I object to the logo because it looks like it's drawn by a five-year-old, it's garish and ugly, it's on the homepage of the docs twice and one is very large, and why a butterfly exactly? Ruby has a ruby, Python a snake, Raku a butterfly, Wikipedia says Raku is a type of Japanese pottery. For some reason it reminds me of the artwork in Dora the Explorer I used to watch with my kid (which I'm _okay_ with in that context I feel I have to stress).

Take a look at:

https://www.ruby-lang.org/en/ and https://ruby-doc.org/

https://julialang.org/ and https://docs.julialang.org/en/v1/

https://www.r-project.org/about.html and https://www.r-project.org/other-docs.html

https://www.python.org/ and https://docs.python.org/3/

Versus:

https://docs.raku.org/

Even Scratch, which is aimed at kids learning programming, is more subdued and less childish:

https://scratch.mit.edu/
That doesn't change the fact the loans are useful. In fact it re-enforces it. Finance is so important the federal government underwrites it at huge cost. But it's also not useful or productive apparently!?
Scientific Machine Learning Paves Way for Rapid Rocket Engine Design
You can bet I'm salty. I do Windows research and I am a owner of the Chromium Windows sandbox code so I have a vested interest in this.

The problem with dealing with Windows and by extension Microsoft is there's no way of inspecting what they've changed from version to version other than by RE or having test cases. However, we try and avoid writing unit tests for behaviors Microsoft's responsible for, but of course in many cases MS don't have those tests either so these things fall through the cracks.
6502/6510 educational emulator project
Number is completely wrong. Most of them work. Just go through the release list and look at their protondb entry. Doom Eternal, Wolcen, Resident Evil 3 - the three newest games on Steam Computerbase looked at and they all work.
Superintelligent, Amoral, and Out of Control
Where are you getting those numbers from? They're much higher than suggested by this graph:

https://en.wikipedia.org/wiki/2020_coronavirus_pandemic_in_S...
Try using mixed DPI displays. My main display is 27 inch 4K display, and on the sides I have old 19 inch 1280x1024 displays, used for IRC, music player, process monitor, email etc. Stuff I glance at from time to time.

_NOTHING_ supports this setup properly. Even Windows has bugs galore as soon as you mix high and low DPI displays. I don't believe anyone ever tests this scenario. I've learned to tolerate and work around the Windows bugs, but I've never gotten it to work at all in any Linux desktop environment I've tried.
Automated wikipeda page is funny:

At recent market prices ($-37 a barrel as of April 2020),[5] the SPR holds over $-9.26 billion in sweet crude and approximately $-20.4 billion in sour crude (assuming a $15/barrel discount for sulfur content).

This would be only true if the cost of storing would be free.
I'm using Lubuntu 18.04 as a desktop OS without any problem whatsoever, works like a charm.
Yeah excel, outlook, etc, and their db-app, access, word, and photoshop, adobe, etc, will be tough beasts to either man handle or convince, I guess.

Looking forward to handle being a terminal app to install all of those things. Throw us some games too.

No manual entry for handle
Tectonic plates started shifting earlier than previously thought
https://0x0.st
It is possible, flatpak exports shell wrappers for binaries at /var/lib/flatpak/exports/bin and ~/.local/share/flatpak/exports/bin. It uses application ID for security reasons though.
Interesting, is this feasible in everyday life?

I do not use Linux on my desktop or notebook but I would like to do so in the near future. This means I should strive to keep all my user created data within the home directory at all times?
How about program preferences and configs that get saved elsewhere by default?

I imagine having ZFS snapshots of / would be useful for updates going forward.
You say it won't come down, but that's because the US is in it's own ballgame. In most other advanced western country healthcare "only" accounts for 7~11% of GDP.

The chart on [0] is incredible. I also shows how much that percentage has grown over the last 45 years.

[0] https://en.wikipedia.org/wiki/List_of_countries_by_total_hea...
[1] Source data OECD: https://stats.oecd.org/Index.aspx?DataSetCode=SHA
Can you share an example or tutorial?
>Knowing that if you take longer, he can bill you more is actually a net good, IMO.

You can easily flip that around too. The healthcare system would become less efficient because time spend gets valued instead of results.
> So you agree that there's an alternative solution to page numbers, but you want to go back to page numbers?
Yes, and I never had any reason to go away from them so I never did.
> Font sizes can change, changing the number of pages.
Fonts don't do it themselves, though.
Qubes on a solid state usb is my go-to, but this brings the functionality of trustedpdf from qubes to anything that can run a docker container. It appeals to a much wider audience, as disposable Linux boot drives have a significant barrier of entry to the not-so-technical folk.

My only concern here is vm escape and Libre office are two VERY big targets for nation state actors. (libreoffice had an exploit exposed in the vault7 leaks) It's a tradeoff for being able to safely open "totallynotphishingexe.pdf" on windows or osx.
The option is not to drink.
I didn't run into any issues myself, however I'm not running a GUI or anything on this machine so I didn't have as many dependencies to upgrade. The whole process took maybe 20 minutes.
FHS may be a mess but I don't understand how that can be translated into a justification for making it even worse.
Analog Devices provides a C/C++ compiler and a RTOS for SHARC, so I wouldn't be surprised if nethack could be compiled for the SHARC VLIW architecture (and its two branch delay slots).
That web site is horribly out of date, and thus, their "activity rating" of projects is hilariously wrong. I was very happy to see that it claimed that my old pal fluxbox is highly active, but the last three news items on the fluxbox site are from 2015, 2008, and 2006, respectively.

But I fully agree with your general sentiment that the best way to use Ubuntu is to go with the Server install and then adding only what you actually want on top of it. I've never had anything but a good and responsive system with that approach.
How Coronavirus Spreads Through a Population
The justification is linked prominently in TFA http://www.legislation.gov.uk/ukdsi/2020/9780111195499/pdfs/...
I'm in the US. If the lockdown where I live were lifted, I'd go out much less too:

1) There's a difference in risk between when people ought to be forced to stay home, and when people ought to stay home whenever possible. I don't think I'll be in a movie theater for a long, long time.

2) I've adapted. A lot of things I do now, I prefer, and I'm not going back to my old ways. When you switch to WFH, food delivery, homeschooling, etc. and reorganize your life and your home to do that, some things turn out to be worse, and some to be better.

I would be surprised if life anywhere goes back to 100% traffic.
RISCs still largely operate on the architected instructions in the pipelines.

It's also a thing to fuse smaller operations into macro-ops in many microarchitectures.

All high performance chips avoid running microcode, it's reserved for eg emulating seldom used legacy instructions. Microcoded CPUs (where all instuctions are implemented with microcode) were a 80s/90s thing.
I didn't understand how he eliminated the feedback by ensuring the mic and monitor were at the same phase...

So he placed the mics one half phase from the monitors so that the high frequency feedback cancels out? But so would the other sounds....?

Other than placing high filter on the monitors, I can't see why his way worked
No worries. Yep, that's an exciting change they've gone and made.
> It looks like deb files only can be installed via the terminal.

Oh, I did not even notice that during 4+ weeks on the unreleased Xubuntu Focal because I never use anything else but the command line to install software. But the target audience Ubuntu is wider, so I think that is a very bad change. One might think they have learned from https://bugs.launchpad.net/ubuntu/+bug/1 , but obviously not. Well, formally they declared bug #1 solved, but few would agree that the Linux desktop has won.

How does the snap "repo" compare to the Ubuntu repos in terms of count? I would have guessed it's orders of magnitude. Even if many of the packages might not be useful for those requiring an installation GUI.
Phrase-Highlighting Technique – Read Faster Immediately
Upp – Senior Full Stack Engineer (Node/React) £75-100k
Upp are a Series A startup hiring for a Senior Full Stack Engineer - TypeScript, React, Node, GraphQL.
You'll join their second squad "Margin Hub", this product gives retailers macro level insights into their cost wastage and provides instant recommendations to improve their margins. The product will be going into production over the next few months and the focus is new feature development.
Upp value engineers that think product first; engineers that want to build products that brings business value to the user/customer. You'll get to work closely with the product and design team as well as users.
£75-100k + 10% bonus and normal perks. Based in Fitzrovia. 3 stage interview process completed within 7-10 days.
craig@confidotalent.com for more info please :)
“Bombing L.A.”
One of the things that use wgpu-rs is Iced[1], a cross-platform GUI Library inspired by the Elm Architecture.

Although the project started around May 2019 and is still highly experimental, it looks like they got a lot of progress made and things look promising! The interest seems incredible: they have 5.4K stars on GitHub (amazing for such a young project) and there are lots of impressive examples[2].

As someone who just learned about the project: hope this takes off!!! A lightweight, simple to use GUI toolkit that can run on the browser and desktop is really something developers desperately want.

[1] https://github.com/hecrj/iced
[2] https://github.com/hecrj/iced/tree/master/examples
Hard to not read that code name as "fecal fossil". Sorry if you can't get that out of your head now. I know I can't.
Don't you even get me started on xls from 2002. That pathetic standard was poorly supported even my MS itself, files were opening with great difficulties and differences even on same version of Excel on different PCs, and sometimes newer versions could not open them properly at all. Once I have discovered that one .XLS file could internally have different types of encoding within one same document.

Anyway. It is clear that MS Office will not leave the field, like FORTRAN, but the key principle is the same: if you want to get out of the pit, you should stop digging. DO NOT create new spreadsheets in XLSX format. DO NOT ever send out MS Office documents. That's it, simple rules. Follow them for 5 years and you'll wonder, how little you depend on MSOffice.
AWS launches Amazon AppFlow, its new SaaS integration service
I share the same doubts…
"more or less", on Mac it will sometimes use dummy OS controls for the sake of rendering, e.g. like here :
https://code.woboq.org/qt5/qtbase/src/plugins/styles/mac/qma...

But it cannot just use native controls all the time as it generally supports more features than what is available on a given platform, so there has to be a kind of emulation.
At first I thought heat will force the CPU to throttle clock speed, which would then increase the percentage of kernel_task slices. But… CPU temperature does not actually rise in the graphs?

Is kernel_task really forcible scheduled as an idle task as a method for heat reduction?
how well do ppa's work on Debian?

I don't like my system constantly updating (and occasionally breaking) - esp secretly behind my back like snap/flatpak

but occasionally I do need the latest version of some package and i don't want to manage manually installations tucked away in some folder with random bashrc tweaks
> The only 'con' is the pushing of Snap packages. It looks like deb files only can be installed via the terminal.

Another solution to this (aside from synaptic, command line, other clients) is to use Kubuntu (which has an apt based package manager called Discover, much improved in this release over prior versions). KDE still doesn't work great on tablets, but in all other respects it's a lot nicer than Gnome. Spend 30 minutes tweaking it to your preferences after install (apt install kubuntu-desktop) and you'll have a desktop that does exactly what you need it to. (You could also install KDE Neon, which packages latest stable KDE with a LTS Ubuntu core.)
Well, as AudioGridder is using JUCE, many parts of the code are cross platform already. But there is some parts of the network code as well as the screen capturing and keyboard/mouse code in the server, that is OSX specific. I would expect the efforts to add support for other platforms to be reasonable. So I hope there will be interested developers, that could have a look at this.
I haven't had extensive front-end experience writing React code but I've been around the block with JS. I'm pretty familiar with the event model of "hey guys, I want to do something on click, so let me wire up this handler which executes X when Y happens".

The struggle is mainly around the nuisances of how certain things work with LV and what the implications are of using X vs Y with practical examples. I wrote a forum post asking for help about this the other day at https://elixirforum.com/t/concrete-examples-of-when-to-use-l....

Then there's other things like wanting to do authentication. I know in theory you'll need to create a controller action to create / delete the session and there's phx-trigger-action to submit a LV form to a controller but there's no code examples anywhere on how to pull this off and get a "current_user" like you normally would with a non-LV set up. But authentication is one of the most important things in any app.
Well, thanks for not publishing a full working POC.

About the critical missing part, I was thinking about this :

> Let’s focus on escaping the GPU process sandbox. As I don’t have a GPU RCE to hand I’ll just inject a DLL into the process to run the escape.

From what I understand, a GPU RCE would allow escaping the sandbox from remote while injecting the DLL requires a good control on the machine. But your post was not about a GPU RCE so it totally makes sense to not do it. I may be very wrong because I am not a security expert, I only read MISC (a French magazine about security) on the beach.
That sounds like a huge "1 issue", then, if Snaps are supposed to be the way forward for installing packages in Ubuntu as other threads make it seem.
well I stand corrected, it looks like there's even a fopen and fprintf in there so that would make a lot of things possible. I wonder about the performance for branch-heavy, non-vector-math computations on these CPUs.
That was in response to "Furthermore, Sweden can keep things going as they are for a long time. How long do you think Australia could keep its lockdown going?"

I was giving evidence to show the impact on the Australian economy isn't obviously higher than the impact on Sweden, but with 1/10th of the number of deaths.
> There’s huge lie (by omission) about renewables

I live in Scotland. We now get around 90% of our electricity from renewables. We closed our last coal power station in 2016.

Perhaps you should consider checking your theories against reality before accusing others of lying?
that hides a lot of detail.

Like just chopping off a leg instead of spending a 12 hour operation and months of physiotherapy to save it.

Letting people die from chronic conditions instead of managing them.

Letting old people die, because the cost of medical treatment was too high.

Not performing operations for heart disease, so people got one heart attack and then died a year later.

Which we could totally go back to, it really is a lot cheaper.
There is sandboxing to protect the security of your computer.

An application that runs as a snap does not see the system-wide "/tmp". They get their own /tmp. If the snap is chromium, it has /tmp/snap.chromium/

The chromium snap would not be able to view files outside your $HOME. Also, it would not be able to read any dot files in your $HOME. Any configuration it makes, is separated into $HOME/snap/chromium/

There are a few rough edges, but the end of the discussion is that you get better security if something goes wrong, and it makes it cheaper for maintainers to created updated packages, and distribute them.
> both relational schemas and statically typed programming languages provide assurances about basic structure.

Yes I get that but I was trying to make the point that there's more to the relational model than just assurances. It offers a richly entwined semantic structure and an elegant route to reducing duplication and the risk on inconsistency that comes with it. None of this is in tension with dynamic typing.

(Also - dynamic languages aren't just for sloppy thinkers and cowboy coders. There's actual value that is lost in moving to static typing even if you think the trade-off is well worth it)
Nobody you've responded to said that though.

They explicitly said that if you wanted to get a loan, private Banks should be there to enable you.

The only thing that they wanted was a public bank, so you're not forced to support them if all you need is an online account for transfers.
Glossary of Graffiti
That illustrates the parent poster's point pretty well. If you set out to build a killer heads-up display for navigation, it wouldn't look like Glass did. Better to focus on the "killer app" to establish the beachhead. Generality will follow.
The Relevance of Shakespeare
Since I know nothing about your machine, that response doesn't really tell me anything. My laptop has 2 cores and 5GB ram.

But bigger picture my point was: Lubuntu's focus has changed, so it's not for me any more.