skysight-inc/HackerNews huggingface dataset:
Graduate educational background in math here and working in software engineering and machine learning. Like your coworker said, I do my work in Python and libraries like Sympy/pandas/numpy, not Sage. Sage never made more sense than Python since Python covers everything I need to do, including what Sage does that I need.

I've never met anyone who uses Sage and work at large research center. If your college background is math, you used Matlab in school. If your background is in computer science, you go with Python or another programming language. Sage seems like the middle ground between those two, but who is that?

The cases posted here seem to be like yours where there is occasional need for workers or students whose employer or school doesn't or won't supply a Matlab license. Matlab is in most college math departments and offers keys directly to students for like $50-100, so there are few of those cases. An employer with math researchers isn't going blink at the $2k for a perpetual license, so anyone doing the work regularly gets Matlab who wants it.

I do think Sage is good software and it is important to have a free alternative to Matlab. The audience is pretty limited, though.
> Lots of unsafe code is safe

I mean this with the greatest possible respect, but you replied by simply restating verbatim the quote that I originally responded to, so I'll just point you to my previous post.
This exists, and is called static analysis. There are tools that can analyze code paths and build a theoretical model of lifetimes throughout a problem.

Mind you, I don't know the formal theory enough to say whether you can build a static analysis tool that is actually capable of doing what Rust's lifetimes accomplish in a provably complete manner. Maybe someone else can chime in here.

However, there are other disadvantages to this approach. Not having it in the language means everyone working on the program has to be using the exact same static analysis tools, and they have to be using it on the entire program, including libraries. Rust ensures that the lifetimes are enforced consistently, since there's only one possible engine enforcing them.

There are some very impressive code analysis tools used in the industry (with C and C++, in particular), but far as I know, they are all commercial and fairly expensive. As far as I know, open source tools like Valgrind are not powerful enough.
The article shows one query generator which generates SQL which are logically equivalent to the hand written SQL, and compares it to another tool which generate inefficient queries. So it is not an inherent problem with generated SQL, just with some particular tool. So...use the right tool?

GraphQL allows you to specify what data you need. Obviously, if you use some middleware which throws this information away and just fetches everything from the database, then you have an inefficient system. But this is not a problem inherent to GraphQL or generated SQL in general.
GNUstep being LGPL has as much adverse impact on developers as Apple's implementation being proprietary. (I.e., none.) It's the _LGPL_ after all, not the GPL.

GNUstep has also moved to GitHub and seems to favor the the MIT license nowadays where possible (e.g., libobjc2)[1][2].

1. https://github.com/gnustep/libobjc2

2. http://etoileos.com/dev/licensing/
There's a very high chance this is monetization of botnets, which adds even more to the overall shadyness.
> is it just the compile-time checks about Ownership?

Sometimes. There's a lot more to safety than memory safety, but that's the easiest to define.

Other aspects might be safety against null values, safety against poor error handling, etc. Those are much harder to define.

> Could not the C compiler be given the same thing, with a flag like "strict mode"?

Not really, no. There's a lot of research into proving C code safe, and automation of it, and it's not really feasible for general C codebases. There are tons of static analysis tools that try to get part of the way there, but they can be slow, miss things, and have many false positives.

It would require, at minimum, some seriously ugly annotations. There are papers that demonstrate such annotation based approaches with C. One that I read ended up looking quite a lot like Rust, at which point, you wonder why you wouldn't just write rust.

Not a stupid question at all, by the way.

> Couldn't this be added to the C compiler?

Rust is able to insert those frees because it has lots of information about memory usage at compile time. C doesn't, therefor C can't insert those frees in the general case.

Other issues, cultural ones that is, like "people just disable it" are fair but not the biggest issue imo. But to further emphasize that point there are many runtime mitigation techniques (ASLR, stack cookies), and they get disabled all the time because, and this is the extra sad part, they legitimately find bugs and crash a program that otherwise may have appeared to work, and the fastest "fix" is disabling it.

Re: Effort, totally, yes. But the effort isn't really split. There are tons of people working on safer C/C++ through tools like fuzzing, static analysis, and runtime mitigations.
No, not at all. Transmeta got a lot closer to nailing a much bigger market. They had actual products for a start. The problem was the underlying architecture was VLIW. Lots of people including Intel and Nvidia have tried to make it work and have been squarely bitten in the arse.
Watched it, but all I'm seeing is queries that require arbitrary access in the first place. If you're using sqlite with prepared statements via another programming language, I'm failing to see how these attacks can be used.

Most of these attacks rely on creation of virtual table. Can that be done using a simple select statement with prepared statements?
These fonts are tiny. Like hundreds of kilobytes per variant, at most. Nothing like the voices, at hundreds of megabytes per variant. (I'm sure there's also a licensing cost tied to each download there.)
Regex is one of those crates.
You state that you care about costs but you end up using some of the most expensive cloud offerings out there?
Ask HN: DevOps folks, how much time do you spend on security vs. compliance?
I keep hearing from some DevOps leaders that compliance is a pain in the behind and they spend an inordinate amount of time on compliance certifications. Would like to hear more viewpoints.
Clearly? That's quite a big logical leap you took there. I don't think it's clear at all.
It looks like that's basically what they are (https://smartproxy.com/blog/what-is-a-residential-proxies-ne...).

A residential proxy is listed as an "IP address provided by an Internet Service Provider", but I still don't really understand how they get access to them. ISPs have to be selling them access, right?
Sorry if I misunderstood your post then.
Ultimately I think the switch would pay off for most companies in the medium to long term. There are valid reason C is still the primary embedded development language but many are going away. One is that Rust only uses clang/llvm which doesn't support many targets. Still there are so many low level data races and challenges with embedded development that having a Rust environment would be a huge improvement, IMHO. The C / FreeRTOS project I’ve been using lately has random data races in the LwIP library which reset the device. It’s almost impossible for me to debug so I workaround by adding some delays here and there. C++ wouldn’t help resolve data races so it's just an extra cost. Also C++ exceptions on embedded are tricky, so the Rust error handling has closer semantics to C error handling.

A complete Rust system would likely help solve most of these issues and drastically reduce these bugs, increasing development speed. Unfortunately the lack of native SDK in Rust is annoying, but some groups are making progress on STM and no-lib Rust. It’d be great if STM makers adopted their sdk and made an official one!

Currently since Rust doesn’t support my chip, I’m using Nim to generate C. It doesn’t solve all the data races noted above but having generics and easy data structures like tables and vectors is fantastic and I'm not second guessing the code all the time. A deterministic GC covers my memory usages fine.
Firefox didn't choose the C++ regex implementation because rewriting pieces of code with well defined interfaces is hard. It was for a few reasons: 1) at the time they made the decision, there was no existing rust regex library that matched the way that JavaScript worked, 2) they didn't want to write their own/rewrite existing code because regex libraries are complicated beasts, 3) the C++ code is mature and well tested, so the primary benefit of a rust implementation would be more speed (because it's easier to safetly reason about shared data) they didn't think that optimizing the regex engine was a priority.
> Systems programming in any language would benefit immensely from better hardware accelerated bounds checking.

[Mostly discussed deeper in the thread already but felt it was worth bringing up directly as a reply to this]

This is an active area of development though still plenty of work to do. The Cambridge University Computer Lab have been doing research in this area in the form of CHERI: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ this gives you hardware capabilities which are effectively pointers with bounds given out by the OS. Want to access something? You need the appropriate capability to do so.

ARM announced MTE last year, which whilst far less capable than CHERI begins to give you something (though it's targeted for bug hunting effectively rather than providing any actual security/safety properties): https://community.arm.com/developer/ip-products/processors/b...

ARM are also building a hardware CHERI implementation, Morello: https://developer.arm.com/architectures/cpu-architecture/a-p.... There's already CHERI implementations running BSD on FPGAs, this will take it to the next level with real silicon using modern ARM processors (maybe you could run android on it for instance?).

I think Intel have been looking along similar lines but I'm far less in touch with what they're up to so I don't have links.
Check out Luminati for example. They have a huge network of true residential IPs to exit traffic from, and you have to pay a hefty premium per GB of traffic to do so ($12.50 per GB for rotating residential IPs, but requires a minimum $500 commitment per month). The reason they can offer this is because they're exiting traffic through the users of the free Hola VPN Chrome extension.
Whatever you do, don't get lowballed. Plan ahead so you can retire at 30. If you aren't able to get offers from multiple companies so you can negotiate properly, start your own company (unless you have dependents already, in which case you are fucked).
This is exactly what I was talking about. You make a bunch of assumptions about peoples' political opinions that are incorrectly portraying them as centrists and supporters of nazis if they don't adopt your world view. "Us or them" is killing America. Lack of nuance and intelligent discourse is destroying us.

There's more to the extreme left than "Everyone deserves to be treated equally and with dignity."

Politics in the US lacks nuance. You can be politically moderate and lean towards the left. It isn't simply conservative wolves in centrist clothing.

I can vehemently disagree about many things that extreme leftists do and still vote for one over Donald Trump. But that doesn't mean voting for Donald Trump automatically makes someone a Nazi either.
I'm still in New Orleans for grad school through December at least, but many places have been done for by the pandemic. Not all yet though.
Yeah this appears to apply more to things like websql. But not in situations where sqlite is used behind a web service that uses prepared statements and best practices and such. If I'm wrong I'd like to know though.
And? You'd probably walk away with at least 6 digits in your bank account. 7 or maybe 8 if you're lucky.

This is the kind of money I wouldn't say no except for a very good reason.
This seems way more likely than the disk usage cost.
Over remote X too, please. Doesn't have to be very remote (but you know, bonus points if it is)
No results. The story is very likely flagged or dead, I'm trying to find out of there is a query string to showdead in the search results.
This seems very interesting, could you point at some sources for this? Thanks!
There is a lot of work being done on a translator now [0]. However, the goal is to translate C to equivalent Rust and then allow developers to intervene to migrate to safe Rust.

[0]: https://c2rust.com

EDIT: Oops, read the parent comment backwards.
DevOps, MSS, and MongoDB Are Making HSBC Simpler, Better, and Faster
When Silicon Valley Goes Dark This Time, There Will Be No Refuge
That's like a python notebook, right? Given the quick feedback loop, and that you're seeing just what you need to see, that seems like an efficient way to debug that sort of thing.
And that exactly is the problem. The game is rigged in favor of folks who already have access to information (or can afford to buy it), not available to regular folks. That is how billionaires double their billions faster than me essentially playing lottery/roulette with my $1000 on Robinhood.
> So they've implemented a full HTML/CSS/JS browser

The JS is SpiderMonkey, the rest indeed is written from scratch: https://twitter.com/flowbrowser/status/1200098712816631809
For a single file, I thought that write operations were committed when e.g. closing the file or doing fsync, but now I'm not sure. I wonder if the system is free to commit immediately after a write() ends.

Based on your scenario, if an application-level "change" involves updating 2 files, interpreting the update of only one file and not the other as a corruption, you're right that filesystem journaling wouldn't suffice. However, in that case it wouldn't be that a single file was corrupted.

Still, I wonder about the other case, about when the filesystem decides to commit.
Irony is even deeper when you look on the other side, which is Google who made most their money off scraping data from people in different forms.

It's data scraping/middlemen all the way down... I wonder if Google indexes their scrape results to throw some loops in the mix.
Is there an easy way to embed a sage notebook viewer / editor inside a webpage without installing a sagecell server?
PM here: I agree completely. A lot of PMs aren't great with phrasing requests, and they come off sounding way more urgent than they are. I used to be guilty of this, and I thought it was great how responsive the engineers were until a manager told me I was disrupting their schedules with all of my urgent requests. We solved that one pretty quickly by agreeing I'd specify the timeline for eng requests, and for things that were big and urgent, I'd check with team lead/manager before asking. If any of those engineers had asked me how urgent things were, we wouldn't have run into that problem (which is not to say it's their fault - it was my job to give that context - just to say that an inexperienced PM won't mind you asking about timing/urgency at all and you may save him issues down the line).
Ask HN: Feeling lost, any advice for a aspiring entrepreneur and student?
Dear HN,

I'm feeling lost. I have lost my motivation to try and learn new things. In my mind I always wanted to be a entrepreneur. I am currently studying computer science after a long road all the way from the lowest educational level in my country. From the beginning of my 'academic' career I always had interest in building software and was enjoying building side projects. In the last few month however I have stopped enjoying trying out new things/learning new things. I also don't enjoy working on my side projects anymore. But when I try to start something new I feel guilty for not finishing the other projects. Everything not related to school feels extremely tedious and the last few weeks the only thing I enjoy is playing games. I feel so useless but can't seems to reignite my 'entrepreneurial' self. How can I spark myself in these times? I really want to build something with a future but can't come up with ideas.
All of them? No. But will a modern language, where many more properties are mathematically proven through the type system, massively improve the situation? Yes.

If you don’t believe me, do the converse and write your next big project completely in assembly (which is effectively untyped), and see what happens.
> , so I attach exactly zero importance to it as far as C/C++ are concerned.

He's repeating statistics that members of the C++ committee will agree with, so I'm not sure what's controversial.

> Valgrind was not developed by Google and probably accounts for the main reduction. Asan has seen a way more recent takeup in OSS.

You miss the point. Despite these things, and despite aggressive compiler flags and everything else, the majority of bugs are memory safety issues. Whether you look at windows, chrome, or the Linux Kernal itself (KASAN). That seems fairly conclusive.

And yet here you are arguing, what exactly? That the person making the statement isn't technical enough for you, so it's all lies?

As a bit of an aside,

> Valgrind was not developed by Google and probably accounts for the main reduction

I never said it was. However one of the most active maintainers works at Mozilla, who's opinion on the safety of C++ is also probably in line with Google and Microsoft here, given their relationship with Rust.
Zoom really is taking the "any publicity is good publicity" saying quite literally huh?
Pope was a QA engineer - that means he worked on systems that weren't qualified for shipping. Actual CMS bugs in a shipped device was extremely rare, but the big promise of Transmeta was that would _could_ ship fixes (and did, in at least one case). The perf impact of a CMS fix was typically trivial as it was fixing a translator, unlike an interpreter like the microcode in an Intel core.
Regarding scopolamine, Vice magazine made a documentary about the way it's used in Columbia. It's rather unsettling, but worth watching if you're interested in this kind of stuff.

https://video.vice.com/en_us/video/worlds-scariest-drug-colo...
Why on Earth should this be a surprise to anybody?

Social media news is really a polite way of saying unsubstantiated rumors, gossip, and bullshit. Tabloids are higher quality stories. The new FB News is journalism, which is about as similar as TikTok videos to Harvard Law textbooks.
It makes sense, I am still a bit disappointed (so is a subjective thing) hopefully the RIR crowd gets more rational and reads your explanation and see that is not so easy.
Romania, judging by the profile.
It opens up so many possibilities. Nice write-up!
Do modern Linux kernels still support the architecture, or are you just planning on running it in a configuration "that works" forever?
Sage is primarily written and developed to support pure mathematics research, and you're describing applied/numerical mathematics. They are completely different things. Look at the chapters and sections in the Sage reference manual to begin to get a sense of what Sage is about: https://doc.sagemath.org/html/en/reference/index.html
Sage has basically no overlap at all with Matlab in terms of new interesting code, but does have around a million lines of new code written by over 600 people: https://trac.sagemath.org/#AccountNamesMappedtoRealNames That code is mostly about the world of pure mathematics research, which has almost nothing to do with Matlab.
There are real numbers that can't be represented in an "infinite" computer either.
That's pretty clever! A good writing surface other than a wood table can also improve the comfort of writing as well.
It definitely whooshed over my head.
I didn't have real structure inside me. It sounds perhaps weird to you, but that was how it felt. Like I was some sort of chameleon, just going with whatever came upon my path. Life felt as a fast paced river with shit loads of debris in it and I had to try to not drown by grabbing things around me.

That was because I had a relative safe and warm childhood and suddenly when my parents died, I still had my brother. But when my brother went suddenly bad, that was gone too. There was no base to stand on. I just had a child, no papers, no parents and no family I could stand one. Desolated, nobody to lean against and with that the inner structure was gone.

I am grateful I can give my kids a safe childhood now and can restore what I have broken. Now story time is over, I have been far to honest with strangers on the internet. A bad habit :)
Maybe it’s chrome? I got a red squiggly line under tiananmen and presumed it was iOS. That’s my bad
Yep, they just cracked and broke. Maybe more of an issue with the TWSBI because the reservoir is part of the pen. Maybe environmental, but I don't live in a particularly extreme area. I never had an issue while I was using them regularly, and I believe they're reasonably maintainable in that you can strip them down to lubricate. Most of the internal mechanics are also plastic though.
That's kind of unfair since operating systems ship with large libraries that C can dynamically link to, but rust has no such advantage.
"All bets are off" is not an engineering way to look at the problem imho. You alter your risk tolerance with the benefit gained. It's just trade-offs and the ability to do that is good.

I'm not going to argue you should use rust or not use rust but I think the state space is not binary and people reading will benefit from that.
They are using residential proxies to evade rate-limiting by google. I don’t know if it’s enough to trigger CFAA, but it shows at a minimum that they know that what they are doing is not what google considers fair use.
Lockpicking if anything shows how robust you can make locks. That there is a complete difference in ease of attack. But physical locks aren't related to mathematical guarantees. The concept may be similar but their implimentations are entirely different.