skysight-inc/HackerNews huggingface dataset:
No, because when you're so deep, you can't be saved. I'm sorry. I wish you all the best.
The move to PoS will probably bring the gas price down a bit, sharding will bring gas price down and add speed to the network
Not that I approve of the methods, but why would an IRB be involved in a computer security study? IRBs are for human subjects research. If we have to run everything that looks like any kind of research through IRBs, the Western gambit on technical advantage is going to run into some very hard times.
I am wondering if UMN will now get a bad name in Open Source and any contribution with their email will require extra care.

And if this escalate to MSM Media it might also damage future employment status from UMN CS students.

Edit: Looks like they made a statement. https://cse.umn.edu/cs/statement-cse-linux-kernel-research-a...
That question has been obvious for quite some time. It is always possible to introduce subtle vulnerabilities. Research has tried for decades to come up with a solution, to no real avail.
Based on over a year's worth of global data, it is reasonable to highly correlate confirmed positive infections with death counts, with only the degree varying from 2% to 6%.

Using "official" numbers alone, and the exponential growth they have exhibited in the past week, it is impossible to deny that an unmitigated disaster is unfolding before our eyes in India.

Speculate and blame all you want, the situation is deadlier and more real than we have seen globally thus far.

It seems to me the most appropriate reaction is to be aghast, and ask "How can I help?"
Perhaps I am naive but I think the apology should come after the internal investigation.

It is more likely that you just have an administrator that became aware of the issue, they won't make an apology until they understand what happened.
The client code is open source, so it should be pretty easy to tell if they actually do it.
I'm just stating the experience I had, and the observations I encountered in that job that formed that opinion. To clarify I'm talking about a beginner that needs to be productive quite quickly to earn their paycheck so their code has to somewhat scale to a medium sized solution and get accepted by a senior dev in a PR process. If they aren't beginner concepts as you state why are they in most "Getting Started" templates and their use is mandatory? As an example many of the common app types use a DI framework straight away following its own standard (e.g. ASP.NET, Spectre.Console, etc) and while an experienced person picks this up quickly someone new to the language from what I've seen struggles. These are concepts I had to explain to a beginner I had to mentor at the time pretty quickly.

Most F# code bases I've seen that make it to prod don't use frameworks for those concepts even as they scale; basic functional patterns seem to scale up to reasonable sized solutions. If they do use mocking/di/etc its only to make the code more C# consumable at the edge for some other C# framework they are required to use. I'm not talking about toy projects here. My point was more that at some point with C# you will need to learn these things quite quickly even for basic use cases or find yourself writing clunky boilerplate (which most new developers will default to - the you don't know what you don't know problem). However with some other languages you may never need to until much later in the learning cycle - I was working for a very successful large business that built the whole stack without ever using some of these things. If you want to encourage people onto your platform these are some of the people you need to win.

IMO It just seemed the standard to get nice code that was prod ready in F#, even JS or Go, doesn't require as much learning's as a C# app. It's not just a C# problem mind you but from what I've experienced first hand it has scared developers away.
> The limits of code review are quite well known

That's factually incorrect. The arguments over what constitutes proper code reviews continues to this day with few comprehensive studies about syntax, much less code reviews - not "do you have them" or "how many people" but methodology.

> it appears very questionable what scientific knowledge is actually gained here

The knowledge isn't from the study existing, but the analysis of the data collected.

I'm not even sure why people are upset at this, since it's a very modern approach to investigating how many projects are structured to this day. This was a daring and practical effort.
They could investigate and determine that they did nothing wrong, but they aren't the final arbiter of justice. This is not like the police investigating themselves. The OSS community can come to a different conclusion and still punish them.

The job of UMN is to get the facts first, and then determine actions. If the OSS community (and others) feel like the actions don't match the facts (or if they feel the facts don't match what actually happened) they can apply their own set of actions.
First of all, when did $12 trillion did allocated?

You can either choose to count spending or liquidity injection. Otherwise, you are double counting. If the government spends $3 trillion in stimulus financed entirely by debt, that dries up the liquidity for businesses, which creates a liquidity trap that sends us into another Great Depression. To think of it another way, the treasury could have just printed $3 trillion to pay for the stimulus without issuing bonds, which would have a similar effect.
I have a question for this community:

Insofar as this specific method of injecting flaws matches a foreign country's work done on U.S. soil - as many people in this thread have speculated - do people here think that U.S. three letter agencies (in particular NSA/CIA) should have the ability to look at whether the researchers are foreign agents/spies, even though the researchers are operating from the United States? For example, should the three letter agencies have the ability to review these researchers' private correspondence and social graphs?

Insofar as those agencies should have this ability, then, when should they use it? If they do use it, and find that someone is a foreign agent, in what way and with whom should they share their conclusions?
He spent 21 months in federal prison.
It does use SIMD (when enabled). But also, the encoding_rs crate is doing more. It isn't just checking for validity. It's also doing transcoding and error detection.
it's much more likely that it doesn't appear in results because people don't click on it when it does
If the data is off on another server, it seems unlikely that past cases can be compromised.

There are a whole set of rules about challenging evidence, including electronic evidence. Keep in mind that the other side gets a crack at it also. It is unlikely that the whole case would be thrown out because of a corrupted file. Reasonable doubt is not part of the forensic process--this is what a jury needs to consider to render a verdict.

As pointed out elsewhere, many uses of this tool are extrajudicial.
"Now available" is a bit misleading. It's only available on the latest version of Windows Insiders.
Looking at https://coronadashboard.government.nl/landelijk/positief-get... i'd say the first wave didn't really happen in the Netherlands,
there was a wave peaking on Oct 30th, next one Dec 19th and the current one is still growing after going through a low on Feb 9th 2021.
Also keep in mind that most East/South East Asian countries had been preparing for a COVID-like event since SARS in 2003.

Sixteen years of preparation, and everything that goes into it, paid off.
If the any of the "independent media" does this, they get censored for spreading "false covid information". It's painted as a conspiracy theory almost immediately.
> this paper is still a net-positive contribution to society

There's claims that one vulnerability got committed and was not reverted by the research group. In fact the research group didn't even notice that it got committed. So I'd argue that this was a net negative to society because it introduced a live security vulnerability into linux.
What a bizarre saga.
> My most recent favorite is Brad & Will Made a Tech Pod, which perfectly encapsulates that feeling I used to get when I sat down with a good friend and we started talking about/ranting about some interesting thing one of us did a deep dive on recently.

You might enjoy Grumpy Old Geeks. I’ve been listening to the show for a couple of years. I recommend checking them out.
This kind of research is interesting and important but should not be done by a computer science department, any more than the social science department should try to develop a process control system.
Not too much to ask at all. Every American should be outraged.
Apple uses Cellebrite devices in its own stores.
Pretty sure it's worse than that. The number that dictates how accurate the "100% effective against hospitalizations and death" stat from the trials can be isn't the total number of people in the trial, it's the much smaller number of people in it who were hospitalized and died. In reality, I don't think that's enough to differentiate between 90% and 100%, and honestly it'd probably be pretty hard to rule out 80% either.
This is varying a lot by state according to doctors I am connected to. UP and Gujarat are definitely fudging deaths by 5-10x, Karnataka seems to be more or less in line with reported deaths.
Thanks these are both very helpful and good bits of historical perspective as well. Cheers.
two weeks, max... it is duable, but for a government that has contempt against small businesses, it will never make it happen.

Also, health inspections are recurring, and something that is done routinely
Damn, a chain of custody where the thing in evidence is also part of not only its own chain but also those of other evidence acquired afterwards? I can't imagine what kind of case law exists around that, but I'm sure it's hilarious!
Risk reward ratios are skewed for the realtor. It might make sense for the owners but it's easier to forgo the extra $150 you get as the realtor and just close the deal right now as is.
As in https://www.securityweek.com/forensics-tool-flaw-allows-hack...., yet it is used in cases large and small, civil, criminal, federal state.
As someone who used to do X11 forwarding over SSH for working on remote Linux servers, this just seems like an incredible value-add for WSL
Top-Left Lighting
While I would guess that you are right for most trees, the Giant Sequoia redwood trees in California actually do bury themselves in their own pine needles. They can also grow roots out at a higher level, if needed. Of course they can live for thousands of years.
There was one thing that I found to be lacking from their statement. They never said that what they had done was wrong. The university already knows what the researchers did and are aware of the paper that was written about the subject by those same researchers. [1]

[1] On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits -- https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...
You are responding to the same person who wrote that comment, with their own comment :)
> I think for most people that's the harder thing to address: How do you just stop being yourself and develop entirely new interests?

But why? There's countless people that enjoy the same things you do. Unless you're into very niche activities, it should dilute in the noise. Maybe drop the least popular activities/subscriptions/toys?
That whole twitter thread is really interesting, starting from https://twitter.com/lorenterveen/status/1384954220705722369
Without starting a point-by-point rebuttal, I think we're talking a bit past each other. Here, there are a couple perspectives to consider:

You're a landowner and need to decide how to use your land (ed: which has already been cleared of native bush). Practically, the usual choices are something like:

* Dairy farming
* Subdivide and build residential sprawl
* Crop farming
* Forestry (introduced tree species)

Note that all of those can provide wood that's suitable for heating, however only two do it in a way that aren't clearly bad from a greenhouse gas standpoint. A lot of land here isn't suitable for crop farming, and generally crop farms don't have many wind breaks either.

Or, you're a homeowner and need to decide how to heat your existing, likely built to a low/nonexistent efficiency standard, house. Your choices are:

* Heat pump, usually poorly located/installed
* Electrical resistance heaters where needed
* Burn wood
* Burn coal

In the balance, I think wood heat is a pretty good compromise. Currently, our electricity is relatively "clean", but only because previous generations installed a bunch of hydro. At some stage, we'll hopefully have a better mix with wind and PV, and of course those do have costs too, but we're not there yet.
The title here should probably be "UMN CSE Department Statement..." rather than merely "UMN Statement ..." since it's coming from the department head and associate department head, not from the university as a whole.

cc/ dang
"We discovered some folks have been urinating into the campus coffee urns, in order research whether people will object to the flavor. We have told them to stop."
We're talking about two different things... work itself is supposed to be mutually beneficial but using corporate assets for personal ends when you could just as easily use your own is silly and makes everybody's life more difficult. As I said, stuff like

> Light personal use via the browser is one thing

but using work e-mail with any expectation of privacy when you have an e-mail client in your pocket is ridiculous.
Typically, they put in a clause where they rent out the house until they can find other housing. This may go on for 1-2 months.
My google-fu is failing me because all I'm getting is blogspam, but I could have swore that some higher-end washing machines had a feature where when they broke down, they would emit some kind of diagnostic noise. Not just the standard series of beeps, but complex digital data. When you called in for warranty support or repair, they would guide you though pushing some buttons on the machine, the machine makes the noise, it goes through the phone, and the call center person on the other end could decode it. Or a repair tech on-prem could presumably decode it with an app on their phone.

Also, ham radio operators are doing some amazing things with audio-encoded data. You can send a message halfway around the world with just a few watts and a person with a computer on the other end can received and decode it, even if the signal itself is _below the noise floor_. Of course, the tradeoff is time: it takes a few minutes to transmit the small amount of data required to make a contact.
Great idea and looks like very nice design at first glance -- I'll sign up and check out the customizations!

Thanks!
That sounds like someone's academic career has just landed in the toilet ...
I completely disagree. I work on a system with multiple servers communicating with each other and billions of events per day. Watching the meters wiggle on all the servers simultaneously is a really important debugging tool. If something slows down or goes down, and you know what it's connected to, it's pretty easy to troubleshoot what the cause is at an incredibly specific level just by looking at the meters.

I think it's likely one's take on whether these tools are useful is very dependent on the system architecture.
I doubt an apology would increase liability in this case, since the actions already occurred and are forensically visible.
I have been a Mac user for many years, and typically used Macs for development and a Windows PC for gaming. I recently setup WSL2 on my new Ryzen desktop, and it has been great for web development. Works pretty seamlessly, and not being able to run GUI apps was one of my few complaints (mostly because I wanted to run a graphical git difftool). Glad to see they have addressed this.
They are worse recently, but some good things were done in the 20th century. Fisheries have been overfished for much of human civilization and we have recovered some of those. We are better at enforcing regulations and willing to enact new ones, though doubtless there are still problems.

Whaling protections have been put in place and despite several offenders the situation is better than it was 100-200 years ago.
I think ideally we’d want to maintain the foreign born population at something like 10% (it was under 5% in 1970 and is close to 15% today).

I think a big part of the problem is that we simply don’t enforce the law, which creates a lot of resentment. If we don’t have the stomach to deport undocumented immigrants except for criminal offenses, we should just admit that coming here illegally is a de facto path to citizenship and count those immigrants against the overall quota. That would in practice lead to a decrease in overall immigration, which would be fine.

The Canada style points system has advantages, but note that Canada has virtually no illegal immigration. In the US; by contrast, legal immigration as a practical matter is on top of the folks who come here illegally (but also as a practical matter will eventually receive legal status).
Many species of trees live for hundreds of years, not decades.
You're not listening to what I'm saying. I'm not talking about carbon sequestration, I'm refuting the argument that "once trees have grown tall enough, they tend to slow down". Here, I pulled a source for you: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.45...

> Wood production of the entire main trunk and whole crown both increased with size and age up to and including the largest and oldest trees we measured.

This is even supported by your own link:

> In the past, some researchers have suggested that converting old forests to young, fast-growing plantations, whose harvested wood products could store carbon for several decades, would create a net increase in long-term carbon stocks. This approach was based on the idea that old forests are slow growing and thus carbon sequestration slows down as forests age. More recent research generally does not support this idea, as a global survey of old forests found that many continue to sequester carbon and have stocks that far exceed young, managed forests.
I would argue that first requires investigation.

They probably just have a bunch of angry emails to go on at this point and haven’t looked in detail at anything else.
Greg Kroah-Hartman bans University from Linux development for deliberate bugs
Greg KH is "someone high-up in the chain." I remember submitting patches to him over 20 years ago. He is one of Linus's trusted few.
Ironically, one of their attempts were submitting changes that were allegedly recommended by a static analysis tool.
Yes Twitter is "weird" about with sub-thread it picks as the "main" one (well, it choses one and didn't pick the interesting one here), so I had to explicitly link the latter point.
I'm suprised, I know you are the mod, but do you read all comments posted on HN? :D
I've always wanted to do something similar at scale. Generate all possible random mobile numbers 11^10, check if they have a WhatsApp profile pic and run it through AWS' rekognition celebrity model (https://docs.aws.amazon.com/rekognition/latest/dg/celebritie...). You could identify the personal numbers for a _lot_ of VIPs, politicians, etc.
> I just never made a separate “work self”, and it’s been a deliberate decision

This is amazing self-awareness. I wish I had it earlier in my career.

>And in my opinion is why white men are so overrepresented in senior levels of companies: the psychological safety is there for them in the rest of their lives

This is interesting, but I don't entirely agree. I have seen both sides as an Indian male who has worked both in India (privilege) and SV (no privilege). It's not a matter of "fighting back" or "being open", it's just in-group mechanics at work. There is a tacit understanding among people in positions of power about who is the "in-group" that doesn't need to be expressed or acknowledged even. For example, in India, even as a junior engineer I would be invited to important meetings whereas more experienced female engineers wouldn't. If I'd simply shown up and done the bare minimum, I would have quickly risen up the ranks, IMO. I had the exact opposite experience in SV, being seen as the "out-group" of the "worker bee" class by default.
I'm up for "wait and see". From an administrative perspective, removed from what is happening, I can see investigating first before admitting fault. I'd much rather people understanding why they were wrong, even if it takes some time.
The changes that improve privacy don't depend on FLoC.
Can't really agree with this article, human hearts break a lot because of how unfair love is sometimes. The only thing that really helps is going to https://seniordatingxp.com/naughty-dating-sites/ to get some flirty online dates going. They allow you to take the pain off your mind and have a good time with beautiful women, so it's good that we have them.
Big discussion, currently on front page: https://news.ycombinator.com/item?id=26887670
Debugging a popular library is not at all equivalent to those layers of abstraction. This argument is so flawed it almost feels malicious.
> Banks are conditional and have 30 days

Depends. The new timeline is ~20 days to close in this market. Banks are getting huge pressure to up the tempo. Interest rates are so low that an extra 0.5% is worth it for the faster close.
Only when accessing WSL-owned files though right? Like, if you're wanted to work on the same repo with some Linux tools and some Windows tools you'd still have a ton of pain points?
> Doesn't Linux need better protection against someone intentionally introducing security vulnerabilities?

Yes, it does.

Now, how do you do that other than having fallible people review things?
I like how the CEO bashes other countries and deliberately doesn't mention USA as a customer of Cellebrite
Perhaps the Linux kernel team should actively support a Red Team to do this with a notification when it would be merged into the stable branch.
They shouldn't have. This appears to be a pretty clear cut case, but made up outrage-bait has made it to the top of HN before. Investigating claims is the correct thing to do.
Does your VPN have to block all internet access due to security reasons, or it just blocks just because it can?
I was talking about the names on the original paper.
My interactions with Gradle have been with Android, and... oh boy do I hate it.

It's a noticeably-more-concise-and-flexible option than what came before it, and the net result has probably been good. But it's next to impossible to understand and troubleshoot when things don't go perfectly. And similarly difficult to figure out what you need to do to achieve X, because who knows, it could be in any of thousands of locations, called anything, and there's not enough structure to let you infer what's reasonable and what isn't.
... and by virtue of the contribution being a gas, it expands to fill the entire containing volume - in this case, the discussion we’re having.

That makes total sense.