skysight-inc/HackerNews huggingface dataset:
so I have an old MacBook Air at my office and the new M1 Air at home. Last night I was trying to run something from our internal "ruby cli" and that meant the dreaded "bundle install" command. I'll be honest, I was nervous. But I thought back to that line in Godfather "i want you to use all your powers, and all your skills" and I got into a headspace of, I was going to get this to run or die trying. There was issues with many gems h3, openssl, pg, etc. I finally got past them but then running the cli still had openssl issue. I tried to switch to using rvm and then rbenv but both failed with zlib issues. So then I tried VirtualBox but oh yeah, on M1 you need https://mac.getutm.app/ and I got a few linux distros running. But all had different issues with ruby. Long story short, i failed, but omg any complex ruby project with a big gemfile and a new processor == issues. +1 vote for this cli being writen in go or rust and a binary distributed vs. making each consumer of this cli have to "compile" the entire project.
The current top end M1 Mac Mini tops out at 16GB of unified memory (meaning, it's shared with the GPU). That's OK but I'd prefer 32GB. More annoyingly, the store only stocks (up to) 8GB/512GB.

Part of the appeal of a Macbook Air (which IMHO is the best M1 form factor thus far) is it's not a lot of money (compared to a Macbook Pro 16" anyway) and you can just walk into a store and get another one if you need it.

This applies to accessories too. I know it's easy to get a Macbook charger. But a Dell or Lenovo charger? I'd probably have to wait days for that.

Also the upgrade prices are kinda unjustifiable. Upgrading to 16GB/1TB is $1299. That's a lot for the specs ($200 for each of 16GB->32GB and 512GB->1TB). I'm really hoping the next version gets better.

I do think the M1 has been received incredibly well and Apple has done a great job here it seems.
Wow this "researcher" is a complete disaster. Who nurtures such a toxic attitude of entitlement and disregard for others time and resources? Not to mention the possible real world consequences of introducing bugs into this OS. He and his group need to be brought before an IRB.
This is super cool! One thing I’m curious about is whether using CO2 noticeably increases the brightness of the shot.
As soon as you need a lot of complex data all displayed in one place plus high performance, you're gonna find you need a list, not a hierarchy. You need to be able to treat the data coming in like a stream, not to traverse anything. Read the row, maybe do some state-machine stuff to decide how to treat it, then drop all that on the floor and move to the next row.

This is more-true the less efficient the language is that you're using. I see people screw this up when writing e.g. dashboards that source their data from SQL, while leaning on an ORM, all the time, and it always kills performance (talking tens of seconds to minutes for things that should take a single-digit count of seconds, at worst).

What's good at turning complex relational data into a list, and fast? Yep, SQL.
It's libraries like these which remind me that even today most of the web front-end consists of static pages with JS sprinkled on top.

Yes, there's Facebook with React and whatnot, but for every shared news article there you'll find an URL which leads to a WP site with jQuery added for interactivity.
Most of the comment was intended to say, I would replace everything if I could.

But the biggest benefit by far has been groupwork. As far as I see, pretty much all of the big synchronous players (Zoom, Collaborate, etc) and asynchronous (all the LMS's) work atrociously if you're dealing with anyone who isn't a toddler -- which is to say, they are all too centralized and top-down.

E.g. - In real-life groupwork, I would tell them with words to go to their rooms or to sit in groups, and they would take themselves there.

In most of these goofy systems, I am personally responsible to "physically" place people in rooms, even if they disconnect or whatever. It's ridiculous.

Now, I do all my group work in Discord. I make however many text and voice rooms, and tell them to go there. I don't even worry about the "roles" part, because, again, my students aren't toddlers.

Bonus, of course -- these sub rooms plus a main room, available at all hours, facilitates interaction between students as well as with me. Contrast to most of the LMS which are both clunky AND frequently have policies against non-school chatter (which, in the age of online teaching is asinine.)
> since all it does is get you the user's contact list.

It’s not even that - all it gets is the phone number associated with your personal contact card.
(I posted this on another entry that dropped out of the first page of HN? sorry for the dupe)

I fail to see how this does not amount to vandalism of public property.
https://www.shouselaw.com/ca/defense/penal-code/594/
It isn't even bullying. It is just dumb?

Fortunately, the episode also suggests that the kernel-development immune-system is fully-operational.
Decent odds their paper gets pulled by the conference organizers now.
I should have written a direct link. Sorry for confusing Hack News. After that, please be careful.
Semi-related to this is that payroll is a risky area for external auditors. Payments are generalyl made to people who the auditors will never meet (thousands of them for big companies, or more) so there's always a risk that those people don't exist and that someone has fraudulently created an employee (as in, someone who is responsible for hiring people creates John Doe, registers him as an employee, paycheques go to the person responsible). As an auditor, couple of techniques to deal with this risk, such as examining employee files, googling person's name, but my favourite, and probably the most effective, is asking non-management if they know who that person is. If Steve in Shipping doesn't know who John Doe is, when he is apparently also in Shipping, is a sign that something fishy is going on.
> "Kids Cut Another Kid's Hair" just sounds like juvenile hijinks and isn't doing justice to the story.

The alternative take is that story pretty much is just juvenile hijinks, and the NYT is pretty much ginning up a story. A lot of the kids I knew in school were horrible to each other and nobody wrote an article about them.

Most print journalism has gone to the gutter these days, the NYT isn't a respectable institution. There is a bunch of stuff on the internet that is more reliable.
Relevant Duke Ellington - Toot Toot Tootie Toot

https://www.youtube.com/watch?v=wazevw-uIDA

I also cannot get around the fart connotation.
My Amiga came with fold out schematics in the manual. Arguably, manufacturers should be required for to provide them for every device sold.
Minnesota being Minnesota.
Being a Linux Kernel maintainer is a thankless job. Being a Washington Post journalist is nothing more than doing Bezos' bidding and dividing the country in the name of profit.
"To appear" has a technical meaning in academia, though—it doesn't mean "I hope"; it means "it's been formally accepted but hasn't actually been put in 'print' yet."

That doesn't stop someone from lying about it, but it's not a casual claim, and doing so would probably bring community censure (as well as being easily falsifiable after time).
I had a professor in college who gave out references to students and made his assignments so easy a middle school kid could do the homework. He never said why but I'm 100% positive he was gaming the reviews sent back so that he'd stay hired on as an instructor while he built up his lesson plans. I think he figured out how to game it pretty quick seeing as the position had like 3 instructors before him whom students universally hated for either being ridiculously strict or lying through their teeth about even knowing what the difference between public and private meant.
Also discussed at https://news.ycombinator.com/item?id=26889677.
Linux kernel developers do not like being experimented on
In my experience, bubbles are made from greed not ignorance.

In 2007-8 there was a lot of acknowledgment of the real estate bubble but there was always somebody to say well real estate isn’t really a national market so it won’t all pop at once. Ha.

Similarly everybody knew it was a bubble in 1999. That’s why you had companies rushing to ipo like lemmings off a cliff.

Personally I don’t think we are in a bubble right now and all the early bubble callers (since 2013 or so) have no credibility left.
Thanks for getting back to me!

Most of these are pretty important to us. I did try to put lower priority items near the bottom of the list. However, I did omit several nice-to-haves already. e.g. ActiveRecord's ability to diff changes after an update (ActiveModel::Dirty)

I wouldn't say any of them are complete full blockers by themselves but cumulatively yes they prevent us from considering Prisma for most projects.
> It is wasting a lot of peoples' time.

If you run a test on your codebase and it passes, do you find that writing the test was a waste of time?

> I'm skeptical that a research paper by some nobodies from a state university will accomplish this.

It did for me.
Ask HN: Google suspended apps without warning or valid reasons
Google suspended one of my android apps which had been previously checked and approved many times. It was on the store for just over 4 years.

It had about 12K active users, with 1-2 IAP sales per day. So people WERE using the app as it was intended to be used.

Then one day Google decided to suspended the app without warning because of 'deceptive behaviour'. Saying the app does not work as the title says.

The only changed made was we copied and older (previously approved) title and short description to the current one and submitted it. The title was still accurate and true to the app. This title and metadata had been used in the past in experiments too.

So that app has gone bust overnight and appealing makes no difference. They just say the same standard response to every email. Sorry we cant help you read this policy page".

They never actually tell you actual reason it was suspended. If their was a policy breach they just give it a broad heading without clarifying what the actual issue is.

This would not be an issue if you were just having fun, trying your luck or a sccammer / spammer. but if youre running it like a business spending thousands of dollars / pounds on marketing the app its a really big serious issue. All that effort and marketing spend is lost.

Independent developers are a key part of Google Play without whom there would be like a few dozen apps and games which users get bored of and most likely stop using the platform. Yet the indie and small developer has little voice. Appeals are like playing the lottery from what I have read online. If the real issue your app was suspended was due to a policy breach then its most important to make the developer understand without any doubt what that breach was. For one it saves a lot time for everyone, it gives a professional level of developer support and also means that the developer can focus on fixing the issue and is less likely to make it again.

So what can be done about this?
That is a lot of boilerplate and reliance on external tooling that could probably be a single bash or PowerShell script.

My preferred approach is to let thy primary modules be thy commands. That way everything is tidy, documented, and clear for your users. Example:

// module commandName is a module to parse a command, exclusion list, and options apart from other arguments of process.argv
import commandName from "./lib/terminal/utilities/commandName.js";
// module commandList is the list of modules that serve as commands for your application
import commandList from "./lib/terminal/utilities/commandList.js";
// module command_documentation provides documentation to the terminal about your commands and each of their options
import commands_documentation from "./lib/terminal/utilities/commands_documentation.js";
// module vars is a generic configuration store available across the application
import vars from "./lib/terminal/utilities/vars.js";

(function terminal_init_execute():void {
// command documentation
vars.commands = commands_documentation;

// supported command name
vars.command = commandName() as commands;

commandList[vars.command]();
}());

What it looks like on the terminal:

node myApplication myCommand
A shame today, a godsent another day.
That's without taking into account other factors such as comorbidities.

Sebastian Rushworth did an interesting article on this, pointing out that it is likely wrong.

https://sebastianrushworth.com/2020/11/29/how-many-years-of-...
Yep, it's being known about for a while.

https://github.com/hexway/apple_bleee/tree/master/hash2phone
I doubt not being able to contribute to the Linux kernel will affect their CS department's rankings. Maybe it'll affect their reputation in the short term.

The teaching hasn't changed, and the CS field is a very large space, and the Linux kernel is a prominent but small part. That's not to say the Linux kernel is insignificant, just that the CS field is very big.

Personally, I see this as a group of researchers going about it outside well-understood ethical patterns for pentesting and getting punished for it. I think it's necessary for the university to be made an example of, but I don't think it necessarily reflects badly on the whole CS department. Hopefully the IRB does a postmortem of this and concludes that ethical review also needs to field-specialist input in general.
Section IV.A:

> We send the minor patches to the Linux community through email to seek their feedback. Fortunately, there is a time window between the confirmation of a patch and the merging of the patch. Once a maintainer confirmed our patches, e.g., an email reply indicating “looks good”, we immediately notify the maintainers of the introduced UAF and request them to not go ahead to apply the patch. At the same time, we point out the correct fixing of the bug and provide our correct patch. In all the three cases, maintainers explicitly acknowledged and confirmed to not move forward with the incorrect patches. All the UAF-introducing patches stayed only in the email exchanges, without even becoming a Git commit in Linux branches. Therefore, we ensured that none of our introduced UAF bugs was ever merged into any branch of the Linux kernel, and none of the Linux users would be affected.

It seems that the research in this paper has been done properly.

EDIT: since several comments come to the same point, I paste here an observation.

They answer to these objections as well. Same section:

> Honoring maintainer efforts. The OSS communities are understaffed, and maintainers are mainly volunteers. We respect OSS volunteers and honor their efforts. Unfortunately, this experiment will take certain time of maintainers in reviewing the patches. To minimize the efforts, (1) we make the minor patches as simple as possible (all of the three patches are less than 5 lines of code changes); (2) we find three real minor issues (i.e., missing an error message, a memory leak, and a refcount bug), and our patches will ultimately contribute to fixing them.

And, coming to ethics:

> The IRB of University of Minnesota reviewed the procedures of the experiment and determined that this is not human research. We obtained a formal IRB-exempt letter.
What are you trying to suggest? It's an accepted paper, the event just hasn't happened yet.
> The similarities are that reviewers can

Most people in the outgroup who know about the Sokal Affair but who know nothing about the journal they submitted to aren't aware of this, but Social Text was known to be not peer reviewed at the time. It's not that reviewers failed some test; there explicitly and publicly wasn't a review process. Everyone reading Social Text at the time would have known that and interpreted contents accordingly, so Sokal didn't demonstrate anything of value and was just being a jackass.
They seem to be teaching social engineering. Using a young, possibly foreign student as a front is a classy touch.
Burnout Is Unique. Your Recovery Will Be, Too
I wish Prisma had built-in Opentelemetry support for tracing and metrics.

They have a whole blog article about why monitoring is important but don't seem come with it: https://www.prisma.io/blog/monitoring-best-practices-monitor...
How about undocumented instructions? Sandsifter[1] is an interesting project and the video from BlackHat[2] is a good watch. There's also a previous discussion of it on HN[3].

[1] https://github.com/Battelle/sandsifter

[2] https://www.youtube.com/watch?v=KrksBdWcZgQ

[3] https://news.ycombinator.com/item?id=18179212
I would like to improve the security hole for PHP scripts as well. Thank you for giving us a very detailed point.
It is worth noting that Pakki is one of the paper’s writer’s (Lu) assistants.

https://adityapakki.github.io/experience/
The last few years C# has had a massive adoption of functional paradigms. This is great for programmers as you can use OO or functional styles where they fit best. This definitely sucks for newer developers as functional concepts are often harder to grasp or less commonly taught, but are now necessary to understand in modern C#.
That commit is from Aditya Pakki who I don't believe is affiliated with the paper in question, whose only authors are Qiushi Wu, and Kangjie Lu.
Used by whom? A handful of marketroids? We're a technical community, ostensibly we favor precise language. We should push back against this sort of humpty-dumptyism, especially the new "descriptive language means you are forbidden to call out linguistic idiocy" kind.

If this is "serverless" then a taxi ride is "carless" and a restaurant meal is "stoveless". There is a distinct semantic difference between "you don't have to deal with X directly" and "X does not exist". Imagine the U.S. having a proxy war by supporting insurgents who bled and died for their cause, and then having the audacity to call it "bloodless" because the insurgents weren't Americans!
Some areas in the country experience major population growth because that’s where the jobs are. In those areas not enough older people leave their homes to compensate for the influx of new residents. It’s not even close.

The housing supply argument is completely accurate.
>instead of being equated to learning C when you know Java, or something :)

I agree, I tried looking into some QC stuff that was presented that way, my impression after was that it's more akin to learning to solder together PCB boards to make a computer from scratch when all you know is basic HTML.
>In practice I've always been asked for a email or SMS.

I suspect it depends on your IP reputation. A VPN or tor exit code would definitely get hit with those measures, given how much abuse emanate from them. The IP reputation of a local library would be relatively clean.
At some point, you get so good at reverse engineering, you no longer need to try to engineer an original from scratch. Why bother? Just wait for the new thing, reverse it, then make it yourself a year later. Hell, the "new" is being sent to you anyways to manufacture, so it's easier to just "request" the plans from the company making rather than doing the reversing.
We Found a Pre-Released WhatsApp Feature
As a graduate of the UMN, other departments have had their share of issues as well. When I was there they were trying to figure out how to deal with a professor selling medical drugs without FDA permission (the permission did exist in the past, and the drug probably was helpful, but FDA approval was not obtained).

I suspect that all of the issues I'm aware of are within normal bounds for any university of that size. That is if kill the UMN you also need to kill Berkley, MIT, and Harvard for their issues of similar magnitude that we just by chance haven't heard about. This is a guess though, I don't know how bad things are.
the problem is noticeably worse and more pervasive in the government

The hard limit on it in a private company is it going bust but there is no such constraint in the public sector
And this was caught, albeit after some delay, so that impression won't change.
There are ways to reach the Kernel Security team that doesn't notify all the reviewers. It is upto the Kernel team to decide if they want to authorize such a test, and what kind of testing is permissible.
Genetics of psychic ability – A pilot case-control exome sequencing study
Lol the whole concept of externalities is an economic one. It is the idea that a transaction you engage in has effects on people outside the transaction. And when this will occur in the future by definition forecasts (not of economics, of the effects) must be used to estimate it
An article about housing on hacker news, let's see, let me put on my Carnac hat and guess this article is about zoning. Anyways, I think the pandemic has shown that the monomaniacal focus on zoning reform isn't actually well suited to what people want out of their housing. Hasn't this pandemic pretty well proved that when people aren't at the office they want a little more space? And not just inside but outside too. Yards are nice, people like yards, the single family lot in the suburbs is the American dream. I think the focus on zoning always takes the same rhetorical trick, "Build where people want to live" and abuses the hell out of it. Do people actually want to live in highrises in megacities? Or do they just do it so they can land a decent job? Maybe the problem isn't moving more housing into cities, it's moving more jobs out of them. The zoning reform people only ever look at one side of that equation.
The symbol-light, kind-of-English-looking syntax initially reminded me of Common Lisp's LOOP DSL[1] before I made the connection to HyperTalk/HyperCard.

[1] http://www.gigamonkeys.com/book/loop-for-black-belts.html
Algolia hosts their first Coding Contest. It's lasting 2 weeks. There are several categories; pick one and submit your project, which will be reviewed by the Algolia team. Also there are nifty prizes to incentivize your creativity.

Developers, developers, developers!
More cash because everyone with half a brain knows this money printing won't hold the market up forever, and they're terrified of runaway inflation.

The insane market speculation going on is also a symptom of this. It's reasonable to assume USD is losing 8-10% of its value every year from 2020 onwards, thanks to Fed policies. I know about their bullshit CPI numbers, and anyone who is gullible enough to believe "there is no inflation" deserves what's coming.
literally spot 1 on the front page already: https://news.ycombinator.com/item?id=26889677
and even that is already a dupe https://news.ycombinator.com/item?id=26887670
I would expect the impact to be small -- Apple releases new hardware on a very predictable schedule, and this kind of news is a bit esoteric to influence the casual buyer.
I'm not holding my breath. I don't think they will pull that paper.

Security research is not always the most ethical branch of computer science, to say it mildly. Those are the people selling exploits to oppressive regimes, allowing companies to sit on "responsibly reported" bugs for years while hand-wringing about "that wasn't in the attacker model, sorry our 'secure whatever' we sold is practically useless". Of course the overall community isn't like that, but the bad apples spoil the bunch. And the aforementioned unethical behaviour even seems widely accepted.
I think the root of the problem can be traced back to the researcher's erroneous claim that "This was not human research".
In theory wouldn't it be possible to introduce bugs that are seemingly innocuous when reviewed independently but when combined form and exploit?

Could a number of seemingly unrelated individuals introduce a number of bugs over time to form and exploit without being detected?
Yeah - no question this should be fixed and it is a bit annoying that it hasn't been.
That alone would cause me to believe these to be suspect. Apple has never relented on removing of ports.