skysight-inc/HackerNews huggingface dataset:
> Short of rewriting the whole of iOS in a memory safe language I'm not sure how they could even solve this problem. Assigning a researcher to search for 6 months only to find one bug is financially prohibitive.

Note that memory safe languages won't solve security. They only eliminate a class of security bugs, which would be amazing progress, but not all of them.
I can't help but feel that given the requirements laid out in the article Nim would be a more suitable fit for their goals over Rust. I do think Nim really nails great performance with a very clean and straightforward syntax, certainly easier for someone who only works in Python to pick up over Rust.
>Decentralization is a design choice, that's it. Unfortunately, we have to come to terms with the fact that outside the sphere of hackerdom and a select few privacy-conscious individuals, decentralization is completely and utterly irrelevant.

I'd posit that decentralization is a business model choice that has design implications.

A decentralized model means that one entity can't control access to users, their data or their eyeballs.

As far as privacy is concerned, that's not really an issue WRT centralization vs. decentralization since the whole point of social networking is to share information with others.

Rather, what folks present as "privacy issues" are really more about control, monetization and engagement.

I want control over the information I share. If I want to keep it private, I wouldn't share it.

What's more, I despise advertising and contact from individuals and corporations whose only interest in me is to extract value (whether that be money, attention or access to my social graph) from me. I'd say that most people, if given the choice not to have that in their social interactions[0] would choose control/lack of advertising/marketing overwhelmingly.

So no. It's not irrelevant at all. Rather it's a matter of having a viable alternative.

Unless, of course, your paycheck is contingent on such centralized platforms. Is yours?

[0] Let's say you're at the pub having a pint with your friends and a group of strangers stood nearby listening to your conversation, and every 30 seconds or so, one of them started pitching some product or service to you? How long would you continue to frequent that pub?
And you can revive it on NeoCities [1]

[1] - https://neocities.org/
> It has the highest dapp compatibility

Mmh thanks, well security is more relevant to me, but I nevertheless went to their website.

Apparently it's a browser plugin. That's a big security no-no from my side, too much attack surface - sorry.
You took the author's quote out of context despite pasting/typing in the entire quote, which means you either did that on purpose or you copy-paste/type things without reading them. Twice.
I agree, a memory managed language will always beat the borrow checker in expressiveness, ergonomics, simplicity, maintainability. Unless you're writing system-level or low-latency apps I don't see the benefit to Rust. If you need better-than-python performance there are many good memory-managed LLVM or JVM/.Net options available.
Yup, makes sense! And you may want to take a fresh look at them, because now it's a lot more than steps (rem measurements, heart rate, blood oxygen level, perspiration, temperature, etc).
I suppose I can ping it upon page visit (for web apps). That never occurred to me until now.
I don’t think that “sound economic policy” would, for example, have major banks offering flash loans. There are many things that can only be achieved through decentralization. Policymakers and banks alike have a serious interest in remaining gatekeepers, and would never enable many of the DeFi functions.
That's so awesome! Thanks for sharing!
> Then, if you require P2P protocol compatibility, I would say this issue shows that nobody really cares about alternate implementations

Does that? What I see here is bitcoind adding a new feature that isn't yet implemented in btcd. The new feature uses a different extension mechanism in the p2p protocol (a new message to signal knowledge of a new feature vs using the existing version message bits in the main p2p handshake). That new version of bitcoind also hasn't yet been released, but I'd imagine that btcd will land a fix sooner to permit unknown message types being sent from its PoV.

> Check this vulnerability, which was caused by LND relying on the btcd project's library

Incorrect. The btcsuite libraries we use weren't related to the bug at all. Instead, the bug was introduced by _new_ code which attempted to convert between the fixed 64-byte signature encoding used in the LN Protocol, and the variable sized encoding used in the base Bitcoin protocol. The resulting signatures _were_ valid ECDSA signatures, but didn't adhere to an additional constraint that the Bitcoin system places on this signatures from a mempool policy standpoint. The signatures themselves were still valid from the PoV of Bitcoin consensus, in that they would be included in blocks.
It would be pretty bad. Right now even relatively recent 3D games run fine under Rosetta. I don’t think that would be the case with a single thread limit.
>I find it hard to believe that scientists who have specialized very narrowly in their domain will also want to be full-time software engineers too and choose one of the most complex languages on top of that.

I think it's really field-dependent. I know academics/profs in the computational biology space that accumulate a looot of software over time from their colleagues/students. Also, it's not the scientists/PIs writing the software :P
I think the big seller/on-ramp is Azure Active Directory. Once you’re all set up to permission your shared documents in Office, and log into your corporate machines with the same accounts, those permissions are automatically available to cloud services. Authentication/authorization is built in automatically to any app you want to spin up, much more easily than syncing your ldap accounts to AWS or creating them manually, and/or manually building auth for your internal app. So internal apps and resources end up on azure, and other usages follow.
Maybe Rust is the true Perl 6 :O
> Why does every business have to be a $100G business?

Because the VC model relies on big returns for early investors and founders, both have no reason to change anything about it.
Bag Handler Aids Police During Terrorist Attack at Glasgow Airport
Having previously performed an extensive TCO calculation (2010) it was substantially cheaper for on-prem vs AWS. We had <10000 machines, mostly cheap/supermicro. We had our own parts inventory and staff dedicated to maintaining equipment. I also ran facility operations for things like the generator, fuel testing, UPS PMs, air filters, professional cleaning, etc.

You have to know your business and you need people with facilities skills. Investing in cold aisle containment reduced our PUE quite a bit. You also have to become an expert in logistics to run your own facility, where just almost anyone can click away in AWS and spend money.
You’d be surprised by how much can be achieved with no code tools on SFDC. The biggest problem Salesforce has is that most customers are barely scratching the surface — or worse, still using the classic version that’s 10 years outdated.

I’ve fixed 2 year headaches of billion dollar enterprises in a few hours.

Why couldn’t they do that themselves?

1. Because Salesforce is so effortless to keep running, that billion dollar companies can get by with a couple of admins, and never put any investment into building on its functionality.

2. The people who know Salesforce well enough to do that are gobbled up and paid boatloads of money by Salesforce and Consultancies.
After 6 months: Zoom dumps Oracle cloud services in favor of AWS
Location: Vienna, Austria

Remote: yes

Willing to relocate: yes

Technologies: HTML5, CSS (Sass/Less), JavaScript (ES6+), TypeScript, Vue.js, React, Next.js, Angular, jQuery, Node.js, Express, MongoDB, Git & SVN, Jest

Résumé/CV: available upon request

Github: https://github.com/slymax

Email: contact@slymax.com

Web: https://slymax.com
> Python is just good enough at what it does

Perhaps?

> and will only become better.

Very unlikely
Eventually. But Amazon has the headspace to drop prices for as long as they need to kill the new competition. Only someone like Google or MS will be able to keep up as long as they can automate a lot and use money from ads or software licenses to prop up their cloud business.
Oh please, no, never socks.

I own 100+ copies of exactly one type of sock so I never have to hunt for matching pairs, and when one sock goes bad, it doesn't automatically cause another paired sock to be wasted. I abolished sock pairing a long time ago in college.
The computationalists I know are maintain large sets of fortran code. When they’re not doing that, they’re porting fortran codes to julia or python or writing new codes in julia or python.
Scientists didn't have a problem writing Fortran, back in its day. I doubt they'd have a problem with Rust or even C++ if they needed to.
I do most of my reading via ebook these days. Physical books are reserved for either things that either can't be read as well in ebook form (House of Leaves, S.), comics (someday we'll get color eink), things picked up third hand for a dollar, or books I'd like to be able to lend. My family rejoiced when we no one longer packed a suitcase of just books for the beach.

But there's still something about bookstores, and the ability to browse that is wholely unique. The experience on Amazon, or where ever else just isn't the same. It's too overwhelming, and the tiny pictures and titles aren't as good for quick browsing. If I know what I want the experience of a book store is much worse.
Slack uses Chime under-the-hood for meetings. So, people are still using Chime. This was announced at re:invent today.
Ethereum is also built on the assumption that:

- people aren't assholes

- all involved parties can audit blockchain transactions

- all involved parties are programmers and can audit a contract written in an esoteric programming language

- all involved parties voluntarily agree to be bound by these contracts despite the fact there's no way they can be enforced
HN Twitter bot locked due to “distribution of hacked material”?
Hello, I run the bot https://twitter.com/hn_frontpage which, as the name suggests, any story that makes it to the homepage gets tweeted out.

Just now got this email from twitter: https://i.imgur.com/YYOZ8Vu.png

No link to the tweet so no idea which story caused it. Tried to log in to see if there is anymore information and all I know is the account is locked for 12 hours.

I've been busy today so haven't been paying attention to HN. Any idea which story could have kicked this off?
Nim would be a nice option if the ecosystem were even half as developed as the Rust package ecosystem.
It may help to remember that the previous go-to language for scientists was Fortran. Of course, not all scientists, but a very much alive subset that still use it today.

I'm a data scientist and I know Rust. Though, to be fair, I'm probably not the type the article is describing.
Being unable to fix something you’re able to build isn’t unusual to anyone who has built a large and complicated structure. They had two different engineering firms look at it, and neither of them saw a safe path forward. It’s possible that repairing it was physically possible, but would have put people in harms way while they were, for example, detaching cables on an already unstable structure.
Why more developers should start content businesses
Yeah, I'm saying that you can use this cost effectively at smaller places too.

When I think of my core Terraform infrastructure that I can spin up for any project, the only resource with a recurring AWS/Google/Azure cost is NAT Gateways. You can get very cost-competitive with the instances themselves with reservations and/or spot, depending on your architecture. The costs of the big clouds and the small ones is basically the same here.

The way the cost balloons out of control for most companies is for things like S3 access (applications that HEAD the bucket every 60 seconds and hit the API request cash register), or managed services like EKS, Amazon ElasticSearch, etc. It's in the "oh I don't have to learn how to manage X application" where cloud gets expensive.

Smaller providers solve that problem by not even giving you that option. It's not that AWS is expensive, it's that they give you rope to hang yourself with.
Slack's sales execution sucked. They had a great product but didn't know how to sell in the middle of a pandemic. Salesforce will treat Slack like Microsoft treats LinkedIn or Github. I wish I could invest in the 'acquired' company.
There's a bookstore near me with a cafe (that has alcohol), and runs a pub trivia night. I had to fight myself not to pick up something every time I went in for that.
Not true. In the article remote hands refers to actual hours of maintenance performed ($640 for 4 hours). The cost of having a human on call to solve hardware problems is far higher than that.
Well, that too, but the antipathy over SQL Server licensing, in particular, seems to have preceded the JEDI award.
And in the mid-2000s YBCO tapes were stuck in development hell where they couldn't live up to their theoretical promises, and one of the projects I knew about at my local university had got a whole bunch of promising results and then just been dropped because none of it could be replicated. Patented work too.

Not to mention, this was purely for power transmission - no one had any idea if they could hold up to mechanical forces of high power magnets, hell, they had a serious problem which was that high temperature superconductors actually would very suddenly stop superconducting if the impinging magnetic field exceeded a critical threshold.

All this was true right up to 2010 - is still somewhat true today because again, there is no scaled up artifact proving it's actually possible to use.

Everyone who wanted to work on high temperature superconductivity was - it wasn't like this was a field which was struggling. And the story at the time - and in fact still, today - was that it wasn't reliable enough and for ITER definitely would be the wrong technology choice for it's goals - which was to build a facility handling large volumes of plasma in a plausible fusion generator environment.

The 5 year timelines being thrown around like gospel here sound utterly absurd on the face of that. A damn CRUD web app takes a year to build, but an experimental fusion plant using essentially nothing but bespoke parts will be done in 5? Cheaply? No.
One of my better gift requests was a bunch of exotic fruit. Only problem was that the gift givers didn't know where to find that. Still got to try some new tasty fruits.
Attention K-Mart Shoppers: Piped Music Collection on the Internet Archive
What Wikipedia doesn't cover is this guy kicked the terrorist so hard he literally broke his foot! He later received a medal from the British government.

https://www.dailyrecord.co.uk/entertainment/celebrity/jeremy...
Either you need to raise enough money to buy the competitor, or you need to convince the competitor of what constitutes a fair merger.

Tesla is overvalued, but either we start producing our fuel with electricity or ICE vehicles are doomed - once the price is right.

Other vehicle makers will at very least be interested in diversifying - if not going full electric.

Tesla has done lesser deals with other manufacturers before - as stated by the article - so a full on merger cannot be assumed to be the only thing on the table.

Other desirable agreements might be for things like access to technology (e.g.: batteries) or licenses for Tesla technology - although the former will be dictated largely by the relative production rates (and ramp rates) for the different pieces of all the Tesla pies.

Does anyone know how invasive the hardware for Tesla's self driving is?
Scaling Datastores at Slack with Vitess
I don't think scientists should worry themselves with the cognitive burden of Rust.

It's hard enough to figure out how to do things in any language as a full-time software developer, never mind someone that just needs a program for their research, etc.
Thanks for this comment Autarch. On reflection, I wrote that paragraph way too harsh. I've redrafted it now to reflect the reality of yours and other comments like it.
Hi, I love the concept and think it's really cool! How did you do the console printing with the Cat command. Did you intercept it, print the "meow", then call Cat on the file?
The description of "I built this to try something cool, but maybe someone could find a use for it!" is just fine. But it would be great to know. Likewise: "We built at company Y this for use case x and intend to support it" also tells me what is going on.
oh no, LD_PRELOAD= hax won't work! LGPL is d00med!

Beyond that dynamic linking seems like a great solution to a problem posed by hardware constraints from 30 years ago. Like a lot of CS. Eg most uses of linked lists. (Can't wait for the abuse I'll cop for that).
Yes. And a lot of that software collects dust after the paper it produced is published :/

Academia needs to recognize and incentivize software (including maintenance) as a research output, and make funding available for more research software engineers.
That's an interesting experiment, but that's all it is. The project relies on ASM/C/C++ to boot into a microkernel and to interpret and run the C#. But I suppose it would greatly reduce the attack surface of C/C++/ASM code.

I just wonder, for example, how a capable hardware abstraction layer would work in C#, interrupt handling, CPU and IO scheduling, etc.
They are helpful to me: these reviews tell me when a free app might be hiding payments behind IAP (Android's store does not list every possible IAP + their cost and description, iOS does, so on Android almost every app just has a $0.99-$99.99 listing), they tell me when an app is trying to potentially steal data, contacts, or similar, they tell me that there might be a similar product that is cheaper or actually free in the same niche.
Along with their co-workers wondering the same thing.
> Why would anybody take the risk of trusting that an alternate implementation when it doesn't decide what bitcoin is, in the end?

bitcoind doesn't decide what Bitcoin is either: a recent consensus issue introduced for a period of times in _newer_ versions caused it to potentially fork off the "actual" chain. In this instance, btcd was unaffected along with many other implementations and earlier versions of bitcoind.
Protein Folding, 2020
I'm also highly sceptical. In my experience scientific software is mostly restricted to:

C, C++, Fortran, Python, R, Matlab/Simulink, Mathematica, Julia, and Excel.

I would think VERY few doing numerical computing or statistical or other engineering computations would have the bandwidth to really dive into Rust. I also wouldn't consider it stable enough for many projects (although I'm sure it's fine for some).
It’s intensely frustrating, because for some reason Apple thinks it’s a good idea to strip out security code from the source that they do release (months late), and they tend to strip (and until recently, encrypt) kernel code. This is what a company from the last decade might do to hide security issues, except it’s coming from the world’s largest company with a highly skilled security team. Is there some old-school manager with so much influence that they’re able to override any calls from internal and external sources? It’s gotten to the point where Apple engineers privately brag about their new proprietary security mitigations after researchers who scrounge for accidentally symbolicated kernels (thank you, iOS 14 beta) do the work to find them. Why does this situation exist?
Anyone read the press release? Salesforce wants to use Slack as an input device driver. Imagine
slacking with your customers, colleagues etc... need to create a DB entry? Slack command. Need to schedule some follow up, slack command. Need to track a bunch of tasks? Slack-Force integrations. I see an AI bot here to help get that data into Salesforce.

To quote: "Together, Salesforce and Slack will shape the future of enterprise software and transform the way everyone works in the all-digital, work-from-anywhere world"

I work day to day in Slack. It's better than email and the need for workflow and knowledge integrations is clear. Asana needs to get a chat layer going ASAP.

The knowledge workflow integration sector is the next big thing.
I could not find much of a difference between the heart rate monitor on my apple watch vs a blood pressure monitor.
I guess I shouldn't have put the "human" in parentheses. I did give an example of how the EF is spending their money on development of the ecosystem though, hoping that'd make it clear what I meant. I even chose a grant to a wallet as the example.

I personally prefer the role of the EF as a facilitator more than monolithic employer. And they can (and do) do facilitate in more ways than just handing out grants. It's just they experience has shown that helping out this way for wallet development (or even more generically software development) works better.

To add, they did start out providing the software as you say. After a certain point though, their efforts were outpaced by community effort or business opportunities arising in the Ethereum ecosystem. At this point it took a while for them to figure out what new role to take on with their ("our") funds, eventually settling on what they're doing now.
Have any ethereum "hacks" ever been prosecuted?

It seems like there would be a reasonable argument that taking value from a contract as defined by code (even if not the intention of the programmer) is not theft.

But would be very interesting to see how a court interprets this.
Thank you for this comment. have changed the tone of that paragraph which was way too harsh.
Location: Seattle, WA

Remote: yes

Willing to relocate: yes

Technologies: Ruby, Golang, JS, HTML, CSS, Linux, Git, AWS, Docker
Resume/CV: Contact me here for that - https://quinqu.github.io/ or https://www.linkedin.com/in/quinq/

Email: quinruby0@gmail.com

About:

I am a systems engineer intern and a student at Ada Developers Academy, I was taught full stack web development (will be graduated and finished with my internship on January 8th 2021).
I am looking for an entry/junior level role if there happens to be one! Thanks!
I have a Garmin Forerunner, it’s basically the watch you’re describing from Pebble but better. Longer battery etc.
Funnily enough the much bigger danger is magnet quenches. Thousands of amps boiling off a couple dozen tons of liquid whatever is going to be a hell of a danger, but it's still "violent industrial accident" and not "fireworks factory" - and definitely nothing which people think of when you say "nuclear".
Has anyone considered/calculated how much environmental waste these unwanted gifts incur? I tell everyone I either want a nice meal together with them or to donate something in my name to charity. 99% of the time my wish is ignored and I get an ugly shirt or socks that don’t fit.
Right! It would solve so many issues! Put them on an unlisted page of your online store, charge a 50% markup over a normal iPhone, make the boot screen bright red, and do something ugly and obvious with the phone's exterior.

Sure, some crazy people who aren't security researchers will probably buy them too and use them as daily drivers (I'd probably be one of them). So what? I don't understand why Apple feels the need to hold this stuff so close to their chest. Everyone in this scenario knows exactly what they're buying.
>When ("if" is more often the case) that client starts to see the kinds of traffic that necessitates a full-scale AWS

Bang on. The capex costs of BYO IT setup was the bugbear(real one FWIW) that AWS and other cloud providers were trying to avoid. But if a lot of folks are paying lots of money upfront preparing for "scale" that might never happen, they aren't really saving capex are they?