skysight-inc/HackerNews huggingface dataset:
The issue isn't that Lua can't nominally provide a sandboxed environment--it can, better than almost any other language. The central issue is whether LuaJIT, PUC Lua, or any other particular piece of software can be made sufficiently free of bugs that you can trust such a sandbox to run potentially malicious code.

The answer in the case of LuaJIT is definitely no, because the JIT engine is sufficiently complex that exploits are inevitable. Note that this is also the case with JavaScript. Many browser exploits start with some codegen bug in V8 or SpiderMonkey. And there are many more eyeballs looking to fix bugs in V8 and SpiderMonkey than LuaJIT, so in the case of LuaJIT the prudent answer is that you should never trust it to run potentially malicious code.

The case for PUC Lua is more nuanced. Lua used to have a bytecode verifier, but it was removed for 5.2 because too many bugs were found in the verifier, and because the VM relied heavily on the verifier to filter bad opcode patterns, that led to sandbox breakouts. This made the PUC developers believe that the verifier made Lua worse off as compared to a more wholistic emphasis on correctness and robustness, so they dropped the verifier. They also dropped any pretense that you could safely sandbox bytecode (i.e. precompiled scripts); if you want a sandbox in Lua you should only load untrusted code as plain Lua scripts into the sandboxed environment. To that end Lua 5.2 added a parameter to all APIs for loading code that specified whether to accept text scripts or binary bytecode. In other words, the bytecode verifier was considered a third wheel, so they removed it and redirected attention to the compiler and the rest of the VM.

So for PUC Lua the issue really comes down to how prudent it is to draw a trust boundary around a pure Lua sandbox; or rather, what your adversarial model is, precisely. PUC Lua is committed to Lua's sandboxing features, but many developers are fairly of the opinion that the only way to run untrusted code, if you're to run untrusted code at all, is using either a hardware VM or a very strict seccomp jail. If you're of the latter opinion, the language is irrelevant--you shouldn't trust Lua, JavaScript, Java, or any other language environment, period. In practice, however, even people of the latter opinion generally apply the principle of defense in depth. That's why browser JavaScript APIs and capabilities are still relatively limited, even though browsers execute JavaScript in OS-based sandboxes. In most practical contexts Lua's sandboxing features still provide great value; it just needs to be understood that they're a complement to rather than substitute for process sandboxing.

The same analysis applies to WebAssembly, FWIW, especially JIT'ing WASM environments. Anybody who thinks WASM is a magic cureall for running untrusted code is mistaken.
That’s why I put “cheating” in quotes — it’s pragmatic, but it complicates the comparison into something that can’t be measured in a single number. I grant you that typical bechmarks ignore the static dictionary in comparing Brotli to other compressors, but they also ignore the size of the binary itself. This is because both are assumed to be small and highly general, and GPT2 violates both assumptions. Brotli’s dictionary is 122 KB and covers many natural and programming languages, whereas GPT2 weights are 5 GB and only cover English. No real-world static dictionary is even a thousandth of that size.

Large static dictionaries exploit a loophole that would make comparisons meaningless if carried to the extreme — you could trivially include the entire benchmark corpus in the decompressor itself and claim your compressed file size is 0 bytes. That’s why the Hutter Prize rules are what they are.
We call that the WinRAR model.
1) You can turn off windows animation, and it seems strange that it is a performance bottleneck.

2) macOS is not a cloud OS. It certainly can be a portal to the cloud quite easily, via terminal, iterm2, ssh/mosh, VNC etc. But you know that already.

You can also run VMs, KVM, docker et al on it as well.
> Deals done into {Germany,LA,SV,SF} from funds anywhere in world.

That's not the same as the available venture capital. If there are no good investments to be made, the potential venture capital simply isn't (all) invested. So the point that lack of VC is a problem is wrong, it's the attractive startups that are missing. It's the same in Austria - I invested in 2 startups, got a little burned and have since not invested for lack of good opportunities. I've also been asked a few times by a larger German company for my opinion on potential investments, so I know they're looking and can't find anything worthwhile. Funding is not the problem! And the "market size" is only indicative of the (too few) good startups, not of the potentially available capital.
Is there any sign that summer in the northern hemisphere will help us out? UV, heat, outdoors, or other factors?
As does chrome and edge.
> Why should we tolerate the tyranny of restricting the free speech rights of a conspiracy theorist teacher?

We shouldn't. They're welcome to say whatever they want.

We're not obligated, however, to pay them to say it. Free speech never obligates anyone to do anything. It merely obligates us to not do one thing: prevent others from saying things.

> > Can we agree there are difference between allowing someone to spread conspiracy theories in public, and paying them to spread conspiracy theories in our schools?

> Yes we can, and I was indirectly alluding to that. Free speech means people are allowed to spread conspiracy theories in public, but that doesn't mean the government cannot change laws and practices that make that too easy.

No, that's not the difference, and no, you weren't alluding to anything I said.

In one case you're passively allowing them to say what they want. In the other case you're actively paying the to say what they want. You're in favor of not passively allowing people to say things, I'm for passively allowing people to say things.

But you're pretending that free speech advocates should be for actively paying people to teach conspiracy theories, so you can make their view look stupid, when in fact that's never what free speech advocates were for.
Because it gets very scary once the handful of truly unhinged people start doxxing and posting graphic and detailed threats and showing up at your house.

Just look at the death threats someone like Fauci is getting for doing his job and informing the public. Not that many people want to deal with being a public target to the worst actors in society.
Because the virus is racist.
> How does such a small number spark this level of fear and protest?

Because it's on the news, while the 51 unarmed whites killed by police in 2019 [1] aren't.

[1] https://mappingpoliceviolence.org/nationaltrends
Here's someone playing with the concept even earlier though. It did the rounds on reddit at the time, so I'd assumed it was the inspiration.

https://twitter.com/watawatabou/status/1197194111171940352

(in aother tweet, @watawatabou attributes the style to Dyson, though the idea of doing it programatically).
It can be enabled per instruction.

Atomic instructions (and ARMv8.1 added a bunch of new atomic read-modify-write instructions that line up nicely with x86) use the new cache coherency protocol, while the older non-atomic instructions keep the relaxed memory model.

Though, I'm not sure if it's worth it to keep two concurrency protocols around. I wouldn't be surprised if the non-atomic instructions get an undocumented improvement to their memory model.
which is what /usr/local/bin is for, right?
I think it's a mix between 1 and 2. Eradication is unrealistic. But the optimum is _not_ the point where every last hospital bed is used. It's where the balance between lockdown and infections is the most societally acceptable.

That is, we want to minimize infections, just not at all costs (to society/economy/...). And similarly, we want to minimize impact on society/economy/..., just not at all cost (to health).

Keep in mind that every infection bears a risk for long time health impact or short term (death), no matter if a hospital bed is available or not.

Finding this compromise is a matter of opinion and therefore a political question. It's not as easy and black-and-white to formulate as it would be to say whether we do 1 or 2.
Good to have a counaussseur around here. Fuck these other dogs dog. Dog shit up. Upvoted. Mr Fucking Reality. Fuck these 'literary' critics. It's all a scam anyway. Vote shit up. Vote this fucker up cocksucers!!!!!!!!!!!!!!!!!!!!1
Yes, it's possible to be a capitalist and an environmentalist.
> moving to a major Canadian city from a major American as a way to save money is a foolish idea.

Please read my entire comment again. I did write "I'm not saying you'll end up with more money if you live in Canada."

But people hear "Canada has higher taxes" and assume it's like 20+ percentage points higher, not 5 percentage points higher.

> Gas is more expensive.

Not really. It's the equivalent of USD 2.81/gal at a Toronto Costco[1]. It's $2.75 at the Sunnyvale Costco (cheapest gasoline) right now.[2]

> What cities and neighbourhoods were you comparing?

2 bedroom in Downtown Vancouver - $3250 (presumably CAD, which is ~USD 2400)[3]

2 bedroom in Mountain View - $3600 [4]

Same thing for Toronto.

> Alcohol and cigarettes are more expensive

Uh...don't smoke? It's expensive for your health too :-P. Yeah Ontario and BC liquor laws seem to be stuck in the 1940s sadly. But alcohol isn't usually a major component of most folks' household spending, so it's hardly a budget-killer.

1. https://www.gasbuddy.com/Station/130688

2. https://www.costco.com/warehouse-locations/sunnyvale-ca-423....

3. https://www.padmapper.com/apartments/vancouver-bc/downtown-v...

4. https://www.padmapper.com/apartments/mountain-view-ca
"NSO Group Technologies (NSO standing for Niv, Shalev and Omri, names of company's founders) is an Israeli technology firm whose spyware called Pegasus enables the remote surveillance of smartphones. It was founded in 2010 by Niv Carmi, Omri Lavie, and Shalev Hulio. It employed almost 500 people as of 2017, and is based in Herzliya, near Tel Aviv."
--Wikipedia

https://en.m.wikipedia.org/wiki/NSO_Group
> Actually it is only one order of magnitude.

My mistake - this does not change the nature of my argument at all. That's still a massive difference in risk.

Why do you think it makes sense to ignore the majority of homicides (which don't fit a popular political narrative)? That's like saying "Most car crashes happen near home, so on that basis people have good reason to be more concerned about plane crashes."
Thanks! didn't see this somehow
Think this is accurate. Any modern x86 virtualization software depends on hypervisor assistance from Intel/AMD to run at reasonable speeds, and that's just virtualizing x86 on x86--more like a context shift between sandboxes. Full virtualization through a CPU emulator to boot isn't very likely to be practical anytime soon.

I suspect they'll treat it as a policy restriction, though, so they wouldn't have to deal with emulator compatibility going forward. Any solution that would be even minimally able to support virtualizing x86 would probably be ugly to keep running. If VMW or Parallels gets something going, my guess is they'll have to work through Apple to get an exception.
But that is then again just sweeping bugs under the rug. The fact that you haven't detected an invalid state doesn't mean you haven't corrupted data. You need tooling that helps to avoid the corruption, not tooling that sweeps it under the rug. Erlang's crash-on-trouble style is ok if 1) your design only loses "one phone call" on a crash (and not anything more persistent or valuable) and 2) you're willing to lose that "phone call" every now and then.
I'm not a fan of the repo being center contained, but the navigation being full width. Things don't line up like they should and it just looks weird. Otherwise no real complaints about it.
I bet there are a large number of people who have felt sick because of 3DOF "VR", as well, and have since written off VR because they don't want to feel sick again. Having a system that ignores most of your movements but not all of them is a recipe for motion sickness, even if it _is_ running at 90 frames per second. Developers at Oculus and elsewhere have poured tons of energy into solving that with stuff like Asynchronous Spacewarp, where the goal is to respond to every little movement your body makes as soon as possible. As it turns out, this is really important. And I think we've all learned here that simply having hands is huge. (It doesn't even matter if they do anything: being able to see your hands is immediately reassuring). So it's really sad to me that the product people went on to ignore (might even say sabotage) that effort with the Go.
With S-corps you do have to actually pay yourself wages, thus incurring some FICA taxes. Rule of thumb I believe is 50% of net income, up to ~$100k. Given that, you can then also contribute (and deduct) as the company up to 25% of salary towards 401k

Another gem many people don't know about is "Increasing Research Activities", for certain industries this essentially translates to 5-10% of your total payroll becoming a credit. That's huge.
These are interesting questions. Would you like to detail them?

GT is a development environment. It currently has full support for Pharo code. However, it is already possible to analyze systems written in other languages. Is this the direction of your questions?
markets are organisms, and nature knows nothing of 'morality'- everyone who tries to trade on righteousness vastly underperforms the market
It just draws things.

This one generates dungeons:

https://watabou.itch.io/one-page-dungeon
Covid-19 Lock-down brought ROCKSTARS.MEDIA to life
Haskell for a New Decade [pdf]
How easy is it to ship exemplar apps to Quest? Can I just pick up Unity XR, riff a little on the FPS example, and compile it straight to something I can load on a Quest?
> In a theoretical world where transparency got added to JPEG

It's not theoretical. It's the JPEG XT spec. It adds alpha channel and HDR to standard JPEG in a backwards-compatible manner.
It's owned by a British holding firm.
> If the solution doesn't represent "real code", then is there any real value?

When "idiomatic" performs so poorly that the software is unfit for purpose, does that represent "real code" ?

> … solutions to the same problem from many different programmers at different skill levels…

How could we know programs weren't written to make some language look bad?
Pretty sure you can just use Firefox and then check in Safari and Chrome. It's pretty hard to make a website for firefox that will be broken in any modern browser...
If they are close enough to legal that he needs a test to establish that they might be over the line maybe his enforcement action is without merit in the first place.

What is the point?
Indeed, GT comes with an extensive support for various analyses.
I just have to re-affirm I do appreciate the lower quality render path of hevc (blurry) more than the default for jpeg and others (blocky mess). I really don't visually notice the lower quality reductions at much lower quality levels/file sizes than comparable blocky formats.

That's not to say it isn't lower quality, when looking in detail you see it... but for a lot of use cases (and in video) much better experience in general.
I'm not sure why they're making a big deal about this

Because they're trying to get the message across to regular people (not HN types) that their software will continue working with the new chips, and they don't have to flee the Apple ecosystem.
I think laying out interfaces for android is pretty slick. Maybe just copy what android does.
Pop!_OS is far more polished than Ubuntu nowadays, scaling is better on Hi-DPI displays and theming is far more consistent (largely due to the fact that their vastly superior store defaults to either DEB or flatpak.)

I will concede that the fingerprint reader doesn't work, and I haven't spent any time trying to make it work, I don't have much patience for tinkering with stuff like that these days.
All journalism these days has a baity headline since that's the business model. In the past we used to pay newspapers on a subscription model.
>but now you have to pay $99/year.

to maintain an apple developer account you also need a mac or iDevice with secure enclave, so even if these were actually compatible with webextensions, you couldn't publish your webextension for safari unless you were an apple user.
In general I don't believe in simply abandoning a conversation someone clearly spent time participating in. On the other hand, I'm not going to continue with someone who ultimately isn't able to have the discussion at hand, for various reasons.

My reasons in this case are your 1) purposeful misinterpretations, 2) unequal demands in needed evidence for claims, 3) insults about my person and 4) misunderstanding of the topic at hand.

Don't expect me to reply further.
Supposedly if it's outside it's not as bad: https://www.youtube.com/watch?v=n6QwnzbRUyA
That doesn't sound like "fearless concurrency", though.
>NSO Group is owned by Novalpina Capital, a British company. Wy do you call it "Israeli?"

I assume because it was founded by three Israeli citizens, in Israel, and the HQ and staff almost all work near Tel Aviv.

And while Novalpina Capital provided funding, that was only in a partnership with two of the original founders, as a buy-out.
Because it is an Israeli company? that's what the parent comment showed.
What if that interface is garbage?
> Which is closer to violent insurrection: responding to police violence by attacking symbols of the police, or bringing an armed group into a statehouse with the express intent of intimidating lawmakers?

By “attacking symbols of the state”, you’re referring to burning down police stations and stealing police rifles from patrol vehicles. Those aren’t “symbols”, they are actual facilities and equipment. In the Seattle incident with the rifles, one of the rioters even opened fire on an abandoned patrol vehicle.

So yes, I would say stealing weapons from a public agency and opening fire with those weapons is much closer to “insurrection” than peacefully carrying your own weapons. For that matter, so do the killings of David Dorn and especially Dave Patrick Underwood.

> Keep in mind when answering that in most cases, escalations to violence by protests were in response to unnecessary escalating by police forces.

It’s clear that your biases are leading you to a very specific judgment of what happened and who is to blame, to the point that you’re bending over backwards to make excuses for arson and murder. To name a more recent incident, the police were not in any way responsible for the act of burning down a Wendy’s in Atlanta; certainly not to the same degree as the extremists who actually burned it down.

But that all distracts from the point. I find your views absurd and morally disgusting, but I would never dream of trying to stop you from expressing them. If you were an elected official who represented the interests and attitudes of some broad group of constituents, I would find value in hearing what you had to say even if I found it reprehensible.
Yes, I understand. But base64 is the bog standard solution for encoding arbitrary binary data as printable characters.

So I'm just wondering why you would use something more obscure, less space efficient, and not ascii compatible.
I'm not sure that Yann was trying to split hairs there. He was reasoning about the issue from first principles (e.g. the problem-domain vs. architecture vs. data distinction) and then failing to carry his reasoning thru to the reasonable conclusion that you mention re: the inherent flaws of any data-based modeling. Criticizing his take wrt. these issues is constructive; being careless about what his actual views are is not.
I don't see why would you not include the 8channers who do the exact same thing to prominent women in games or anti-vaxxers trying to destroy the lives of doctors/researchers. There's no difference in tactics or goals.
Sure, here's a handful:

https://komonews.com/news/local/police-union-president-defen...

https://mynorthwest.com/70234/police-union-head-vehemently-d...

https://www.usatoday.com/story/news/nation-now/2016/07/13/se...

https://www.seattletimes.com/seattle-news/crime/memo-seattle...

http://www.courts.wa.gov/content/publicupload/eclips/2015%20...

https://www.thenewstribune.com/news/local/article64596437.ht...

https://www.cbsnews.com/news/seattle-cop-punches-teen-in-fac...
> and unlike most people here I am not afraid of change

Hear, hear!

I like the new design too. It overwhelmed me at first (somehow it felt really 'big' to me), and I'm still getting used to it on a visual level, but I appreciate all the new bits of information that I can much more easily access now (mostly in the repo sidebar).

I also appreciate that the new design doesn't actually change that much. Overall, it still feels like... GitHub.
Applying Neural Networks to Sparse Data with Graph Coloring
Agreed!

Related: I was updating a bunch of dependencies yesterday, and so was going through looking at what's new in a handful where I was behind a major version or more. "Releases" is even harder to find now (it's in the sidebar). I've never understood why it's relegated to a being a sub-item of "code" when it seems to me it should be on the same as information hierarchy level as "issues" "wiki" etc.

I'd really like to see Releases on the top nav bar, and possibly even Readme should be the first item, Code second.
> It is like this in most western countries.

This is not the case in the USA. There is no general federal legal requirement to register a business or obtain a business license in order to sell things. However, there are specific industries for which business licenses are required (at any of the federal, state and local levels) and forming an LLC might help personal assets if you are sued.
Is it you Elon? DId you return from a few years trip to Mars? ;)
Actually, I think I'll just do everything from the terminal from now on. Anyone familiar with a great CLI? (that is not by GitHub)
One component was Safari using unofficial APIs. But some of these unofficial APIs have since been used by both Chrome and Firefox as well.
I'm not allowed to have liked it? Damn.
edit: Jokes aside. The hardware did what I expected from it - and for a rather nice price.
I cannot stand the smug "we're objective academics that base our beliefs on nuanced logic and facts" of, to add insult to injury, self-declared "rationalists". That most are seemingly demographically and politically homogeneous are just the weirdest coincidence.

Dogwhistling doesn't stop being so just because you wrap it in an overly verbose academic sounding language. I think it's time for some introspection if this is all it takes for mainly young privileged [white] men to start considering race science and the likes as unfortunate but actually true. Exactly the same thing can be seen with figures like Jordan B Peterson.
I suppose something along the lines of Chrome debugging for programmers who aren't javascript developers...undoubtedly there are some fundamentals you would have to become knowledgeable in, as with any technology.
How many upgrade their personal laptops every 3 years?

Work one, sure. But I haven’t upgraded my Mac in years.
Because 3 lines of nodejs can make a cool web demo for HN, but making that same demo https (in a way which isn't going to require manual action every 3 months) involves many more lines of code.
> it would be a legal absurdity

There are many countries in the world. You're making an assumption that in exactly none of them could something crazy like this be enforced. That's a big bet you're making, and a tiny one for GS to include this language.
Or the PET emulator from 38 years ago that Commodore released because it wasn't sure that the C-64 would have any software.

Ditto for the C-64 CP/M cartridge of the same vintage.