skysight-inc/HackerNews huggingface dataset:
> They just proved that OSS is not military-grade , but nobody thought so anyway

...and yet FOSS and especially Linux is very widely used in military devices including weapons.

Because it's known to be less insecure than most alternatives.
The statement is true, IMO. The problem is that ORMs don't ever solve the problem (and I don't believe they CAN).

We should only have to care about data and not SQL. But the reality is that we very much do have to care about SQL.
Where's the line? Is my point. How do you build an operating system when you're starting from "What specific task does my end user want to complete for this bit of software?" You never build general capabilities; only specific point solutions.

In other words: this article was written on a computer built in our universe. In their universe they'd be stuck on electric typewriters.
Why not just go all in and back react native? looks like they use it extensively already
https://appfigures.com/resources/insights/microsoft-goes-all...
Sometimes the discrete unit I am looking to listen to is the album, not just a song.
Launch costs are only a fraction of the total cost of orbital telescopes, so don't get your hopes up.

For reference, the WFIRST telescope came with satellite bus and 2.4m mirror for free yet already has a 3.2 billion dollar price tag attached to it. Even the most expensive launch provider would be less than 10% of that cost.

It only weighs about 4 metric tons by the way, so there's that.

Just a quick reality check on the unrealistic assumptions some people have.
Or scope it as "less restrictive for most users" or something along those lines.
That's weird. I just tried the minimal example on alpine, and it works right out of the box.

Installing .NET 5 should be easy on macOS as they even provide an installer.

# Start fresh alpine
docker run -it alpine

# install tools and .NET 5.0
apk update && apk add wget bash vim icu-libs krb5-libs libgcc libintl libssl1.1 libstdc++ zlib
wget https://download.visualstudio.microsoft.com/download/pr/21fdb75c-4eb5-476d-a8b8-1d096e4b7b14/c1f853410a58713cf5a56518ceeb87e8/dotnet-sdk-5.0.202-linux-musl-x64.tar.gz
mkdir -p $HOME/dotnet && tar zxf dotnet-sdk-5.0.202-linux-musl-x64.tar.gz -C $HOME/dotnet
export DOTNET_ROOT=$HOME/dotnet
export PATH=$PATH:$HOME/dotnet

# create f# project
mkdir my-fsharp-demo && cd my-fsharp-demo
dotnet new console -lang f#

# run project, it will show "Hello world from F#"
dotnet run

Or did you have issues with the IDE?
Does Rust compile code that can be used/called from other languages with an FFI? That to me is always one of the persistent advantages of C, I don't have to fully understand how compile machine code works on a technical level, but there are lots of different languages that let me use C libraries in their own language runtimes.

It would be great to have things like high-performance unicode handling with consistent semantics across multiple languages!
I really, really want to like Blazor.

I like the shared code. I like that it borrows ideas from VueJS. I like that the recent hot reload efforts have put plugins on the table. I like the VSCode support and debugging experience once I got it working.

I don't like the thought of all the js interopt I will need to do. I don't like thinking about how shimming jointjs is going to go. I don't like the lack of pipeline for working alongside an npm/typescript project for the inevitable js bits that need to be written. I don't like the lack of a preprocessor, bundling, and asset pipeline..

P.S. I hope the culmination of the hot reload work in asp.net will result in official guidance for creating proper plugins (controllers, services, models, assets, Blazor, etc) ala Grails. It feels close with the low level infra gaps being closed.
> The accidents are quoted per 'traveller mile' so an increase in capacity won't increase accidents.

More capacity => More journeys => More fatalities. Dead people aren't dead "per traveller mile" they're just dead.

The government set out knowing they'd kill more people, but rationalising this as acceptable, unsurprisingly it takes a coroner to point out the problem here.

> alcohol, phones and other distractions, tiredness, driving recklessly are probably more of an issue than smart motorways.

Legislation exists to prohibit or mitigate the causes you list. Whereas astonishingly legislation was written to authorize, and indeed fund smart motorways.
> I think all patches have come from people currently being advised by Kangjie Liu[3] or Liu himself dating back to Dec 2018

New plan: Show up at Liu's house with a lock picking kit while he's away at work, pick the front door and open it, but don't enter. Send him a photo, "hey, just testing, bro! Legitimate security research!"
Pricing an externality based on an economic forecast is farcical.
Even so, preliminary numbers where available seem to show the suicide rate to be falling. So in the loss-of-years calculation, all is quite fine actually...
The next link is one hyperlink buried in the middle of the wall of text, and simply appends the new message to the existing one. It also differentiates between prev and parent?

It's super unclear.
People hate Robinhood after they blocked users from trading. Decentralized exchanges like Uniswap are impossible to shut down.
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7076378/

Look at the section 4.1. Molecular Stabilization. Yes, it is a challenge, but a challenge that has been overcome.
> A lot of people claim that there's a lot of eyes on the code.

Eric Raymond claimed so, and a lot of people repeated his claim, but I don't think this is the same thing as "a lot of people claim" -- and even if a lot of people claim something that is obviously stupid, it doesn't make the thing less obviously stupid, it just means it's less obvious to some people for some reasons.
Curious, how does "Google support China?"
Interesting. Sounds like I should find some people to play a game of Monopoly with!

The game seems to have earned a bad reputation, the prototype for the sort of game you shouldn't play anymore because everything from the last 25 years is better. I'm not sure this is deserved, but realistically my copy will probably end up collecting dust. After reading your comment, I hope not!
Yes, it’s a different problem that’s way less likely to happen and potentially more impactful, hence not comparable. And entities with enough resources can do the same to open source, except with more risk; how much more is very hard to say.
Sure. I think that (especially modern) art, can have as much meaning as the observer wants it to have. The artist may have some initial thought about what idea they want to express, but once their work is out there, they lose the control over the meaning of it.

Ryoji Ikeda arguably uses "information" in his art pieces, but it's not like it is presented in a useful manner.
That gives me goose bumps.
You might need to clear or trim the cookies for the site. I've had this happen with web.archive.org which set so many or long cookies that they actually reject further requests because the headers have become too long.
Nah. They aren't experimenting on people, they are experimenting on organizational processes. A very different thing.
A simple interview script to learn more from your ideal customer
Well, it's something I guess.

I dunno. I mean:

* artificial intelligence -> genuine image search and speech recognition

* self-driving -> Waymo, Tesla

These other hyped technologies have produced real results that I interact with. I'm not really convinced the blockchain has... except decentralized finance. Maybe that's fine.
Yes, and a bank branch for example could be very interested in some social engineering to test physical security.

It is very varied. There are a lot of good and enjoyable stories out there on youtube and podcasts for anyone interested.
I'll give you one guess nation states do.
A telescope kilometers wide could image extrasolar planets.

Wouldn’t it be fun if our discovery of ETI were an image of its city lights.
I think your comparison is not fair. Maybe your vision of beginner C# is just much much higher than on F#?

Like, dependency injection, mocking and the like are not at all beginner concepts, and are not made particularly easier with more modern languages.
See https://news.ycombinator.com/item?id=26888427
This is are very good question. I really don't know why the mainstream ignored this project so far. Compared to some other projects, there is no single person in the center of the project, so there is no one to be hyped. This is sad but it seems to be a disadvantage. The loudest are getting attention and with so many projects out there, the tezos community was a long time pretty silent.
The smart contract language is completely different from solidity. Its a functional language which allows formal verification. This is one reason which makes it harder for developers to migrate to tezos. It's easeier to migrate to an ethereum clone.
Sapling came with the edo upgrade this year, this allows privacy preserving smart contracts. Gas price is extremly low. A part of the nft hype has already migrated to tezos because of PoS and low gas prices. See the stats here https://better-call.dev/stats/mainnet/general
The next upgrade is currently in the voting phase. When you're technically interested in it see here http://doc.tzalpha.net/protocols/009_florence.html

Last week a marketing campaign started, maybe you will see an add somewhere in the near future.
A lot is going on in adoption atm, here a few recent news:

banking https://xtz.news/adoption/french-banking-giant-societe-gener...

gaming https://xtz.news/adoption/ubisoft-become-a-tezos-corporate-b...

stablecoin https://xtz.news/adoption/groupe-casino-with-11000-stores-to...

digital identity https://xtz.news/adoption/spruce-systems-makes-it-into-y-com...
Less sleep in middle age raises dementia risk later in life
Barca and real Madrid are two of the richest sports franchises in the world. Look at all uefa champions. They are all the big spenders. It's already a system of the haves and have nots.
Unifi Protect does object detection locally
We tried converting from Sequelize to Prisma and learned transactions were not fully supported... Can't build an app without transactions
State-level actors / Nation wide actors (fancy terms lately, heh) will not ask anyone for consent
Such as? Should we assume that every patch was submitted in bad faith and tries to sneakily introduce bugs?

The whole idea of the mailing list based submission process is that it allows others on the list to review your patch sets and point out obvious problems with your changes and discuss them, before the maintainer picks the patches up from the list (if they don't see any problem either).

As I pointed out elsewhere, there are already test farms and static analysis tools in place. On some MLs you might occasionally see auto generated mails that your patch set does not compile under configuration such-and-such, or that the static analysis bot found an issue. This is already a thing.

What happened here is basically a con in the patch review process. IRL con men can scam their marks, because most people assume, when they leave the house that the majority of the others outside aren't out there to get them. Except when they run into one where the assumption doesn't hold and end up parted from their money.

For the paper, bypassing the review step worked in some instances of the many patches they submitted because a) humans aren't perfect, b) have a mindset that most of the time, most people submitting bug fixes do so in good faith.

Do you maintain a software project? On GitHub perhaps? What do you do if somebody opens a pull request and says "I tried such and such and then found that the program crashes here, this pull request fixes that"? When reviewing the changes, do you immediately, by default jump to the assumption that they are evil, lying and trying to sneak a subtle bug into your code?

Yes, I know that this review process isn't perfect, that there are problems and I'm not trying to dismiss any concerns.

But what technical measure would you propose that can effectively stop con men?
Fellow anxiety sufferer here.

Certain foods can make you more anxious than others. High sugar, caffeine, etc. To me, it's green veggies (paranoia) and any plant based carb (depression). Others react to dairy or eggs, others to pork. It's worth researching oxolates.

Instead of noticing anxiety, try "I feel threatened by..." not knowing expectations, the environment, coworkers habits, etc...

Check out Byron katie's work, "loving what is". And she has a lot on youtube. Transformation of fear, pain, envy, self loathing, etc.. into something else.

Find a therapist or chiropractic who works with anxiety or trauma, or a coach who can help you fit in faster.

May you find kindness, Stranger
I'm confused as to how this got posted. I posted exactly the same link yesterday. If I try to post a link and someone has already posted it - even a few days prior - the link doesn't get posted and I get redirected to comments on the existing link.
How to Write File-Based JavaScript Tests with Real Files
I prefer having the database as a single source of truth and use something like [Hasura](https://nhost.io) to generate the GraphQL API.
A mRNA vaccine basically sics our immune systems on something. Our immune systems are fairly adaptable and will kill even cancer cells if they can tell them apart from healthy tissue.
Forking the kernel should be sufficient for research.
It is great to see this getting more traction!

To the larger discussion brewing: I honestly don't understand all the pushback on here. Why should I have any type of moral imperative to support revenue streams I find bad for the industry/society/brains? Simply because the creator decided it was the right choice? People decide things I disagree with all the time, if I have I the power to choose differently, I do. Not liking that I reversed a video creator's choice is one thing, but the accusations of theft (or general moral failings) are another.

Truthfully, if I had the power to make baked-in adverts unprofitable for all Youtube/podcasts/whatever, I would. If anything, I feel some obligation to keep ads out of as many spaces as I can. There are lots of way to make money, selling viewer's eyeballs/ears to the ad industry doesn't have to be the default one and shouldn't be protected like some deep creative choice.

Of course, I want my favorite creator to make money; people have to eat. Alternative sources, such as asking for patroonships or donations, I'm amenable to. I even support a couple smaller channels I think make special content. Unlike baked-in ads, donations are non-compulsory and in my control.

At a more base level, you don't get my eyeballs without my computer, internet, etc. I have a stake in viewership and I choose to modulate what is in my control. If that modulation offends the creator, they do not have to allow it and I will stop watching, but that (currently) means taking their content off mainstream (vs premium) YouTube and lowering viewership. I generally pay for content, but even if I didn't, I can't imagine going out of my way to pirate videos of people fixing old C64s (something I genuinely enjoy).

Morality is complicated.
Flash loans themselves are not an application, it's a primitive that other applications can build on top of.

There's many applications like DeFiSaver that use flash loans to allow users to migrate debt between lending protocols without needing additional capital.
Actually they were testing out hiding the number of dislikes. Not quite the same as removing the dislike button. That said, I wouldn't be surprised if they did end up choosing to completely remove the button.
Ascribing a salutary motive to sabotage is just as dangerous as assuming a pernicious motive. Suggesting that people "would" likely follow one course of action or another is also dangerous: it is the oldest form of sophistry, the eikos argument of Corax and Tisias. After all, if publishing research rules out pernicious motives, academia suddenly becomes the best possible cover for espionage and state-sanctioned sabotage designed to undermine security.

The important thing is not to hunt for motives but to identify and quarantine the saboteurs to prevent further sabotage. Complaining to the University's research ethics board might help, because, regardless of intent, sabotage is still sabotage, and that is unethical.
If you think the point of decentralized systems are to ONLY replicate Google / Apple / Spotify services but in a decentralized manner, then you're mistaken.

When the internet came along, it wasn't to only replicate the Post-office or to just make mails faster. The internet enabled a lot of things you couldn't even predict at that time (or perhaps some could, if they truly understood the tech).

There are lots of things that the blockchain enables that you just cannot do in the traditional world even today. Couple of examples:

- You can use your tokens as collateral, borrow stablecoins and pay off your mortgage while the loan pays itself off from the interest being generated by the collateral - you do not have to pay back the loan => https://alchemix.fi/

- (Borrowed from another user in this thread) Flash loans provide the ability to atomicly borrow infinite money for the duration of a transaction, with no collateral or credit. This money can be used for arbitraging or just to provide working capital for a complex operation. If the loan isn't repaid by the end of the transaction, the whole transaction is cancelled. => https://www.youtube.com/watch?v=mCJUhnXQ76s

There's clearly going to be a lot more use-cases in the future. Finance is only the first field which is getting explored at the moment.
> Very, very few other mammals are monogamous.

Very, very few other mammals have flown to the moon, or surf the internet, or eat BBQ. I’m not sure we should really base our expectations or behavior in what other mammals do, especially given how much animal behavior is unique to a single species.
I feel somewhat similar. Since I am using Linux, they ultimately were trying to break the security of my computers. If I do that with any company without their consent, I can easily end up in jail.
Or DOSBox. You could run the binary as if it was a bootable floppy.

boot tetris.bin -l a

Or, if you have the source, change the org loading
address to 100h, then compile it as usual, as DOS will
see it as a COM file and thus you could run it under DOS.
Agree. Since these researchers did not even ask him, they did not fulfill even the most basic requirement. If, and only if, he approves, then we can talk about who else needs to be in the know, etc.
> A spokesperson for Nvidia said: "We do not believe that this transaction poses any material national security issues.

Seems like everyone involved is confused, then.
I find it hard to believe this research passed IRB.
> What does it matter whether the contributor knew ahead of time that they were submitting insecure code?

It's a specific threat model they were exploring: a malicious actor introducing vulnerability on purpose.

> Couldn't they just look at the history of security vulnerabilities in the kernel, and analyze how long it took for them to be detected?

Perhaps they could. I guess it'd involve much more work, and could've yielded zero results - after all, I don't think there are any documented examples when a vulnerability was proven to have been introduced on purpose.

> what's the point of all this subterfuge in the first place?

Control over the experimental setup, which is important for validity of research. Notice how most research involves gathering up fresh subjects and controls - scientists don't chase around the world looking for people or objects that, by chance, already did the things they're testing for. They want fresh subjects to better account for possible confounders, and hopefully make the experiment reproducible.

(Similarly, when chasing software bugs, you could analyze old crash dumps all day to try and identify a bug - and you may start with that - but you always want to eventually reproduce the bug yourself. Ultimately, "I can and did that" is always better than "looking at past data, I guess it could happen".)

> It's seems equivalent to vandalising Wikipedia to see how long it takes for someone to repair the damage you caused.

Honestly, I wouldn't object to that experiment either. It wouldn't do much harm (little additional vandalism doesn't matter on the margin, the base rate is already absurd), and could yield some social good. Part of the reason to have public research institutions is to allow researchers to do things that would be considered bad if done by random individual.

Also note that both Wikipedia and Linux kernel are essentially infrastructure now. Running research like this against them makes sense, where running the same research against a random small site / OSS project wouldn't.
well then, didn't you hear about the policeman bludgeoned to death with an extinctor by armed revolutionaries in the US?

Disinformation is everywhere, always.

We as a Civilisation have to be able somehow to start accepting that "idiots" and "deplorables" from any side are just like us, humans....
If the model assumes benevolence how can it possibly be viable long-term?
If they wanted to do security research, they could have done so in the form of asking the reviewers to help; send them a patch and ask 'Is this something you would accept?', instead of intentionally sending malicious commits and causing static on the commit tree and mailing lists.
Test Post
Why am I not able to submit a website URL?
What about Poland, the Baltic States, Czechia and Slovakia, Hungary? Also devastated? I’m sure we’d do much better with our friends in Moscow calling the shots.
I very much see this very problem with NATO.

It's exactly because of this NATO's best move is to commit to one defence line.

Even if depleted, and under invested. The power of EU NATO members combined will be more than enough in this scenario to hold a line with a few choke points in between plains, and impassable forests.
I love being surprised by new uses of exotic materials. Never thought I would read about quantum hard drives outside of science fiction.
> multi-year bond instrument that would pay coin dividends well into the future

That's a great idea. I'm not aware of any blockchain that does this, although some projects with seed funding do have long lockup periods
The difference between:

"Dear GK-H: I would like to have my students test the security of the kernel development process. Here is my first stab at a protocol, can we work on this?"

and

"We're going to see if we can introduce bugs into the Linux kernel, and probably tell them afterwards"

is the difference between white-hat and black-hat.
The idea is just that. Create a Nasdaq for early private tech startups - fixed valuations - funded with crypto.

For the Investors I think there is no problem with SEC, but for the fundable startups what could be a workaround?
Ask HN: Publishing a book about my time at a prominent startup
Looking for advice, throwaway account for obvious reasons.

Early employee at a startup for ~6 years from seed stage.
Startup has successfully raised multiple rounds of funding.
Profitable but pre-exit.

I've kept detailed notes and have numerous interesting -> to me at least, stories to tell.
Stories from founder histories. Growing Pains. Customer problems. Raising. Finding fit and coming out the other side.

Legal issues aside -> I'll take advice obviously, what advice do you all have for me in relation to turning my notes into a book.

Self publish/publisher?
Anonymous/open?
Name the company/change names?
Wait until exit or do it now?
Something else?
Leave it alone?

Leaning towards keeping it anonymous.
Don't judge my writing.
Purposefully writing this in a different way to my common style if I do decide to keep it anonymous.
Why Secrecy Haunts China’s Solar Factories in Xinjiang
> Despite the positive underlying reasons

I think that is thinking too kind of them. Sociopaths are often very well-versed to give "reasons" about what they do, but at the core it is powerplay.