skysight-inc/HackerNews huggingface dataset:
I mean I don't think they're wrong here. When all persistent state is hidden from your code by the runtime you're as close to stateless as you can really get. Sure you can argue that there is state somewhere in the stack but that's always true so it's not very useful to point that out.
Honest questions getting downvoted, closed for being too broad, duplicates or just "Wrong" in the eyes of overzealous long time members
If kentonv or someone else at Cloudflare is paying attention, I think Doom would make a good demo for Cloudflare's new edge containers (currently in private preview) [1].

Edit: Or maybe Doom would be a good demo of Workers Unbound and Durable Objects. After all, Fastly just demonstrated that Doom can be ported to wasm, so it clearly doesn't need a whole Linux container.

[1]: https://blog.cloudflare.com/containers-on-the-edge/
Tips for Text-Based Interviews
It goes for almost anything. I think a good way sum it up would be: Don't pretend it's something it's not. For whatever reason.
There is nothing about enforcing high standards that requires hostility or meanness. In this case the complaint that greg is being intimidating is being made entirely in bad faith. I don't think anyone else has a problem with greg's reply. So this doesn't really come across as an example that demonstrates your "not being nice is necessary" view.
I enjoy Linus's wit in insulting people. He's good.
It is by design, not having these mechanism is one of the goals of free software: free for everyone, no exceptions.

See JSON.org License which says it "shall be used for Good, not Evil" and is not considered free software.
This time it is different

FTA : While the market looks a lot like 2005–2008 on the surface, the underlying fundamentals today are very different from back then.
It seems that Aditya Pakki was the one introducing shady code to the kernel and was caught. He is listed as an author on several other very similar papers (https://scholar.google.com/citations?user=O9WEZuoAAAAJ&hl=en) with authors Wu and Lu about automatically detecting "missing-check bugs" and other security issues which they purport to want to fix but this research paper explicitly discusses submitting "fixes" that have latent security bugs in them.
I'm trying to figure out how to do that. How can I get my degree changed? Will the university of (anyplace) look at my transcript and let me say I have a degree from them without much effort? I learned a lot, and I generally think my degree is about as good as any other university. (though who knows what has changed since then)

I'm glad I never contributed again as an alumni...
Anything you do regularly or daily, it’s worth spending a few minutes to work on your form, sooner is better before the inconvenience becomes the norm.

I do this with shoe laces, more recently with my new bike lock. Was kind of weird and slow and clumsy for me to open and close, so I spent 5 minutes figuring out the feel of the key and the rotating mechanism and now I can do it quickly and easily with one hand (45s->10s).

It amazes me how people don’t slow down to figure out the little things. One of my ex-girlfriends would always struggle to unlock the door to our old apartment. It was a janky lock. Coming home late, drunk, in the cold, in the rain, and she’d sit there for 2-3 minutes getting frustrated trying to get it open. The first time I unlocked it I was like “oh, this lock sucks, let’s see how it opens”. You insert the key, but it goes too far - the cylinder won’t rotate unless the key is backed out about 1mm from where it bottoms out. So, just insert the key, and press on the lock with your pointer finger as you apply gentle torque and it’ll open easily. Takes less than 5s, every time. I tried to show her this and explain the process, but she didn’t have the patience - “I know how to open a lock!” So I let it rest.

Baffles me though, some people would rather spend 30m/week fiddling with something that 5 minutes of deliberate attention would solve once and for all.
I watch youtube before I sleep (I know, bad habit :P) and sometimes I forget to put it on charge before I start watching, and when I fall asleep, youtube autoplay continues to play random crap over and over (usually ends up with https://www.youtube.com/watch?v=YKAblynZYhI somewhere in the chain)

OK the point is, more often than not I've woken up in the morning with youtube still playing. Absolutely insane.
Nobody is an expert on every subject. You could have PhD level knowledge of the theory behind a specific filesystem or allocator but know next to nothing about the underlying hardware.
esbuild sounds promising as one friction point was that the TS compiler would compile all your TS files into JS files but there was no way to bundle them together into one JS file you could include in your HTML and webpack takes a bit to setup.

It looks like esbuild doesn’t have websocket auto-reload magic so will need to refresh the web browser to see the recompiled changes.
A lot of people are talking about the ethical aspects, but could you talk about the security implications of this attack?

From a different thread: https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3N...
> A lot of these have already reached the stable trees.

Apologies in advance if my questions are off the mark, but what does this mean in practice?

1. If UNM hadn't brought any attention to these, would they have been caught, or would they have eventually wound up in distros? 'stable' is the "production" branch?

2. What are the implications of this? Is it possible that other malicious actors have done things like this without being caught?

3. Will there be a post-mortem for this attack/attempted attack?
It did include sea levels and it doesn’t use any arbitrary cutoff, it uses discounting. Incidentally, standard macro discounting rates mean that things a century from now are worth very little compared to the same things today, so if you were to cut off at 2100 it wouldn’t change too much.
"Not a bubble" is exactly what people think, when there's a bubble. Otherwise there would be no bubble. People find ways to rationalize why 'this time it's different'. Sometimes it is, sometimes it's not.
On the plus side, I guess they get a hell of a result for that research paper they were working on.

"We sought to probe vulnerabilities of the open-source public-development process, and our results include a methodology for getting an entire university's email domain banned from contributing."
There's some comparisons here[0]

As far as I can tell, where it falls somewhat short is in template dynamism, e.g. keyed arrays in React (which entails that drag/drop might also potentially be tricky), fractal structures like generating HN comment trees from JSON (vue, for example, used to have perf issues in the early days in this area due to recursive-descent rendering instead of batching), etc.

It seems to dabble a bit into normal control flow structures[1] but once you're at that level of language complexity, I'd probably prefer using a more established framework over this natural language DSL. The HN comment tree use case, for example, doesn't seem very easy to optimize if it turns out to be implemented in terms of reading the DOM to trigger subtemplate creation.

I think it's certainly interesting that there's now interest in alternatives to compiled stacks (e.g. React, due to JSX, anything using Typescript, etc) that are mindful of compile time creep and aim to bring development speed back into the limelight, but I fear that projects like this might be making the original "mistake" of shoving the perf pitfalls back to the runtime (where the users care). Personally, I think the future is going to be better compiler infrastructure e.g. esbuild, swc and the projects built on top of them (vite, etc).

[0] https://hyperscript.org/comparison/

[1] https://hyperscript.org/commands/repeat/
Thought this was neat. Couple of ideas:
1 - A grid style image would be quite cool to explore similarities and general spaces.
2 - You may like to share it with the folks here who might like to collab with on a feature for it: https://www.itsnicethat.com/contact
https://ello.co/wtf/artists/contact/
Why blockchains won't revolutionize publishing
"cash" implies physical currency. my guess is that he doesn't want to get the notes from an ATM because those serial numbers can be traced to him (not sure whether banks actually do that). That said, doing a bunch of odd jobs to get $1000 seems excessive. You'd probably have better luck getting change from random shops. something like a farmers market would be ideal because they deal in cash, probably don't have facilities to record serial numbers, and probably don't have cameras around.
> What's the harm exactly?

It is wasting a lot of peoples' time.

> What's the benefit? You raise trust in the process behind one of the most critical pieces of software.

I'm skeptical that a research paper by some nobodies from a state university will accomplish this.
Presumably they could just talk to the maintainers at that time and have a reasonable discussion.
Yeah, of course, now try to build a real world application with it.

Aliases: https://docs.microsoft.com/en-us/dotnet/csharp/language-refe.... Support for those was only added in the last year or so to the dotnet/nuget/roslyn/whatever it is needed things to make it work. Microsoft's own documentation only documents how to use it for Visual Studio: too bad if you're using another IDE or the command line like you did above.
Yes, however...

The problem space is much smaller and with each big shift in hardware and software, we've missed the opportunity to do this well.

A rough timeline: Desktops, the Internet, Laptops, and - for probably the last decade - Mobile. Is "Ambient" next?, I'm not sure, that seems like it carries other baggage along with it.

It may look like an appliance, but it certainly doesn't work like one, and if users had just a bit more knowledge about it, I wouldn't feel like we're going back to square one with each step forward in technology.
I was trying to exclude obvious attacks, but you’re certainly right for the average person. I’d worry more about, say, shoulder surfing a credit card or
ID card more than this.
This article did little to convince me we’re not in a bubble. The housing supply argument doesn’t hold up to me, as older people leave their homes newer people should be able to take there place. Base asset prices increasing because interest rates are down? Sure that’s finance 101. All asset classes (houses, stocks, cryptocurrency) only ever increasing in value? That’s too good to be true.
When James O' Keefe tries to run a fake witness scam on the Washington Post, and the newspaper successfully detects it, the community responds with "Well played!"

When a university submits intentionally buggy patches to the Linux Kernel, and the maintainers successfully detect it, the community responds with "That was an incredibly scummy thing to do."

I sense a teachable moment, here.
Being rude isn't going to discourage malicious actors, who are motivated by fame or wealth.

If you ran a bank and had a bunch of rude bank tellers, you are only going to dissuade customers, not bank robbers.
I fail to see how this does not amount to vandalism of public property.
https://www.shouselaw.com/ca/defense/penal-code/594/
The decade of hand wringing about Tim Cook’s deficiencies as CEO compared to Steve Jobs have got to be put to rest by even the biggest skeptics. The timing, execution, and scale of this transition has been so well done.
"We're banning you for deliberately submitting buggy patches as an experiment."

"Well if you're gonna be a jerk about it, I won't be sending any more patches."
It isn't hard to get a gmail type address and submit from there.
Researchers Explore Psychic Ability and Whether It May ‘Run in Family’
Is that necessary though. There are plenty of stories of people setting their AirDrop policies to 'Everyone' instead of 'Contacts Only' or 'None' where people are receiving unsolicited files (usually NSFW images). From my memory, they did not need to have their sharing pane open for this to happen to them.
I don’t think that’s what’s happening here. The research paper you’re talking about was already published, and supposedly only consisted of 3 patches, not the 200 or so being reverted here.

So it’s possible that this situation has nothing to do with that research, and is just another unethical thing that coincidentally comes from the same university. Or it really is a new study by the same people.

Either way, I think we should get the facts straight before the wrong people are attacked.
I'd say a sample of 5000 random phone numbers is more representative than individual comments from a community obsessed (in a positive way) with privacy.
Agree, and it seems like at least this patch, despite the researcher’s protestations, actually landed sufficiently that it could have caused harm? https://lore.kernel.org/patchwork/patch/1062098/
DISH Network will construct its 5G network on AWS
I like your ideal policy, but I don't see a way we can move closer to it on our own, unlike the everything-is-AGPL end state.
Not wanting to play the devil's advocate here but though scummy, they still successfully introduced vulnerabilities to the kernel. Suppose the paper hadn't been released or an adversary had done it. How long they'll be lingering around if they're ever removed? The paper makes a case that FOSS projects shouldn't merely trust authority for security (neither the ones submitting or the ones reviewing) but utilize tools to find potential vulnerabilities for every commit.
When you test in production...
My point is that "we're newbies on the topic of the Linux Kernel, so be friendly to us when sending Linux Kernel patches" is the worst argument I've heard about anything in years.
Same. I'm not a fully qualified sys admin but I do have access to a number of our servers (I'm more of a full stack generalist than an expert at anything) and I immediately go to netdata when one of my services isn't acting right. For me its a nice 'system at a glance' where I can check on the host and then alert someone more knowledgeable than myself if there's something that looks off
Thank you for this feedback. I am the founder of Netdata.

Netdata is about making our lives easier. If you need to tweak Netdata, please open a github issue to let us know. It is a bug. Netdata should provide the best possible dashboards and alerts out of the box. If it does not for you, we missed something and we need your help to fix it, so please open a github issue to let us know of your use case. We want Netdata to be installed and effectively used with zero configuration, even mid-crisis, so although tweaking is possible and we support plenty of it, it should not be required.

An "incident" is a way to organize people, an issue management tool for monitoring, a collaboration feature. Netdata's primary goal however, is about exploring and understanding our infrastructure. We are trying to be amazingly effective in this by providing unlimited high resolution metrics, real-time dashboards and battle tested alarms. In our roadmap we have many features that we believe will change the way we understand monitoring. We are changing even the most fundamental features of a chart.

Of course at the same time we are trying to improve collaboration. This is why Netdata.Cloud, our free-forever SaaS offering that complements the open-source agent to provide out of the box infrastructure-level monitoring along side several convenience features, organizes our infra in war-rooms. In these war-rooms we have added metrics correlation tools that can help us find the most relevant metrics for something that got our attention, an alarm, a spike or a dive on a chart.

For Netdata, the high level incident panel you are looking for, will be based on a mix of charts and alarms. And we hope it is going to be also fully automated, autodetected and provided with zero configuration and tweaking. Stay tuned. We are baking it...
asdfasdfdasfasd
I have a small marketing webpage I am working on and I could see this being useful for that. Most of what I want to use JS on for that is relatively straightforward and this seems like a simpler approach than using a full framework or writing everything from scratch in normal Javascript.
asdfasffdf
There's nothing wrong with duplicates

If they weren't doing it, then quality of SO would decrease for all of us.

It's in our interest to have strict mods on SO
No way to tell. How many people at UMN do usually submit kernel patches that aren't malicious? In any case, it did hit the right people, and it potentially causes collateral damage.

Since it's an institutional issue (otherwise it would've stopped after they were reported the first time), it doesn't seem wrong to also deal with the institution.
> What I don't like about changes like this is that it makes it impossible to reuse any Grafana/Loki/Tempo pieces or libraries in any more permissively-licensed code

They're not making everything AGPL and seem to be aware of the kind of thing you're talking about. From TFA (emphasis mine):

> Going forward, we will be relicensing our core open source projects (Grafana, Grafana Loki, and Grafana Tempo) from the Apache License 2.0 to the Affero General Public License (AGPL) v3. Plugins, agents, and certain libraries will remain Apache-licensed. You can find information in GitHub about what is being relicensed for Grafana, Loki, and Tempo.
I actually have been using the Store since Windows 8. There have been apps I've tried that I never would have installed from an EXE or an MSI. Relatedly, I've also got less tech savvy family that I've been able to recommend stick to "S Mode", install everything from the Store, and I don't worry about them calling me in a few months that something is mysteriously broken or that the system is full of junk they can't uninstall.

It's a huge difference if the Store is just another distribution point for random EXE/MSI installers that can do whatever they want, install where ever they want, and may or may not clean up after themselves on uninstall.
I would prefer to see research on the known incidents where things like this have happened in the wild. AFAICT the most common route for maliciously introducing vulnerabilities is through dependencies. Old npm libraries getting taken over by people who introduce cryptocurrency miners, that sort of thing. Pull requests that fix a real bug and also update the version number of some dependency, how often does the reviewer really analyze the new version of the dependency to see if it contains anything malicious?
This already exists with FaaS -- function as a service. But then the common usage of "serverless" is FaaS plus all the additional services you need to actually make a real app.
You exactly understand and confirm my point - outside of the bubble Windows/VS bubble, it's not a super nice developer experience. If you want to work hard to make it work: you can, but... why go out of your way?

And I haven't said anything about building GUIs here yet, which is another world of pain on .NET.
That's the thing, you just told the person to review the request for security... in a true double blind, you submit 10 PRs and see how many get rejected / approved.

If all 10 are rejected but only one had a security concern, then the process is faulty in another way.

Edit: There is this theory that penetration testing is adversarial but in the real world people want the best outcome for all. The kernel maintainers are professionals so I would expect the same level of caring for a "special PR" versus a "normal PR"
Angry Linus would risk a stroke responding in that email thread.
BS, there is no reality where the M1 failed with a company like Apple. They have too much loyalty for people to even consider other options. So much in fact that no one can be convinced of its flaws it’s all “Apple knocked it out of the park, most things work!”

We all know “most things” is subjective to how you use your PC.

Tell me a world where that wouldn’t ever happen and I’ll consider your Intel leading model scenario.
Algolia is hosting a Coding Contest
Study explores inner life of AI with robot that ‘thinks’ out loud
Multi-Tenant vs. Single-Tenant IDaaS Solutions (2019)
As anyone recently or currently going through the house shopping process this is nothing like 2007. Buyers are competing against other buyers with seemingly unlimited cash offers. Which is nothing like the subprime, stated income loans prior to the financial crash. You have to be in great financial shape to even qualify to buy a home. And then you have to do it timely enough to beat other offers. There is more cash moving around these days and not a lot of places to put it. Conservative banks, investors, and pensions are placing them in the few sure things left on the market, bonds and property.

Also, inventory is drying up because construction has been heavily affected by the pandemic. Now that the warehouses have been exhausted it's just starting to ripple through supply chains. While the millions of lives lost were felt immediately the long tail of JIT supply chains means we'll be feeling the effects a hell of a lot longer.
First of all, whether something is ethical is an opinion, and in my opinion, it is not unethical.

Even if I considered it unethical, I would still want this test to be performed, because I value kernel security above petty ideological concerns.

If this is illegal, then I don't think it should be illegal. There's always debates about the legality of hacking, but there's no doubt that many illegal (and arguably unethical) acts of hacking have improved computer security. If you remember the dire state of computer security in the early 2000s, remember that the solution was not throw all the hacker kids in jail.
this is classic national origin discrimination. racists are coming out.
Fabulous work. The video presentation is only 18 minutes long, well organized, and very accessible -- the author does a great job of explaining how and why the rendering works so efficiently using a simple example in 2D:

https://www.youtube.com/watch?v=_6CnaugAcCc

Highly recommended.
Classic cost center vs. profit center.

Also would like to add, that esp. in a cost center org where legacy/manual/inefficient processes can be endemic, people (esp. the "stars") simply might not want to change how they work no matter how much better or faster or easier the new, digital way is.

Personally, I feel almost any SWE is better served working for a tech-as-a-profit-center company. Of course that's easier said than done and not always practical depending on circumstances.
>[...] but instead opt for a free Protonmail account

Protonmail faces a lot of spammer signups for their free plan and require a reCaptcha, Email, or SMS to create a free account[0]. In practice I've always been asked for a email or SMS.

They do clarify:

>We don’t save reCaptcha results. If you are presented with Email or SMS verification, we only save a cryptographic hash of your email or phone number which is not permanently associated with the account that you create.

so it seems okay, but there is a temporary trail (I remember reading that they delete these after some time) to your original email/mobile to maintain rate-limits.

Something to keep in mind.

[0]: https://protonmail.com/support/knowledge-base/human-verifica...