skysight-inc/HackerNews huggingface dataset:
Though I disagree with the research in general, if you did want to research "hypocrite commits" in an actual OSS setting, there isn't really any other way to do it other than actually introducing bugs per their proposal.

That being said, I think it would've made more sense for them to have created some dummy complex project for a class and have say 80% of the class introduce "good code", 10% of the class review all code and 10% of the class introduce these "hypocrite" commits. That way you could do similar research without having to potentially break legit code in use.

I say this since the crux of what they're trying to discover is:

1. In OSS anyone can commit.

2. Though people are incentivized to reject bad code, complexities of modern projects make 100% rejection of bad code unlikely, if not impossible.

3. Malicious actors can take advantage of (1) and (2) to introduce code that does both good and bad things such that an objective of theirs is met (presumably putting in a back-door).
You totally can... contact the kernel maintainers, tell them you want them to review a merge for security and they can give you a go/no go. If they approve your merge, then it's the same effect as purposely compromising millions without compromising millions.
yes but what about startups which are typically c corps with zero income or loss ? I was essentially forced to incorporate by advice on Indiegogo page for unsupported countries (slovakia) just to get access to crowdfunding. where GoFundMe or Indiegogo will support us business entity I create. Mine head is still spinning from the possible fines I am now threatened with if I miss some IRS tax filling deadline. 25000$ for not filling 5472 in time and up to 45000$ for not filling be13 in time. while i now have c corp . But Mine US bank account was denied by SVB with "slovakia unsuported" argument again. And all I wanted is to find funding for mine reusable covid test that I will always publish for free since goal is to save as many people as possible and not make money.It did passed to semifinals of XPrize but not finals https://www.protocols.io/view/covid-19-indirect-detection-th... but without funding I simply cant continue . I cant afford bulk PC or nylon filter and 120nm testing nanoparticles prices on my own anymore. All mine savings gone to all prototypes during XPrize months and I am now broke.https://ladislavnevery.medium.com/how-i-tried-to-save-a-worl... That's why I am so sensitive now to fees. And why I see being forced to pay 109$ just to e-file zero income loss report to IRS as immoral when IRS clearly states taxpayers with income less than 72k should not be charged. And filing internationally by snail mail there is no return receipt and risk of fine if mail is lost.
I wonder how hard their CS Departments rankings are going to drop, and how much funding they're going to end up losing over this.

Getting banned from committing to the most important and critical open source project out there cannot be good for a university.
Well his career is over. He's now unemployable in academia.
Fix camera, so it is always centered on character. It's annoying when camera cannot keep up with you.
You're going to have to do better than that. Please provide articles from The Guardian that were stating incorrect facts (not reporting allegations or personal opinions) that weren't recanted later when new evidence came to light.

Edit to clarify: you're making a statement, you should be able to provide direct proof.

Most sources claim the Guardian is mostly factually correct:

https://mediabiasfactcheck.com/the-guardian/ ( which is American-centric, so ignore the bullshit liberal and conservative arguments) says they're mostly factual with the `Failed Fact Checks` section including opinion pieces and reporting as per X (e.g. https://fullfact.org/education/barnardos-foster-care-coronav...) , and the fact check saying X's report is wrong, not that the Guardian are misrepresenting facts.

https://www.adfontesmedia.com/the-guardian-bias-and-reliabil... says they're very reliable.
Styled Components Best Practices for React Developers
I came here with the same question.

Hasura is really awesome, so far as I have used it.

Now I gotta look into prisma

I almost wonder if they aren't mutually exclusive. With hasura, you need to run your own server anyways, for auth or special cases. Maybe that server could run prisma? Let hasura do the migrations, and prisma track it?
Grad students have invested years of their life, for no reward, in research on a niche topic. Any ding to their reputation will adversely effect their entire career. I doubt this guy would get a post doc fellowship anywhere after this.
DevSecOps Introduction:Instructions on How to Build a Pipeline in AWS [Part 2]
"Are you conflating eSIMs (which are just equivalent to physical SIMs) with "burner phone" apps? I guess it's possible that the MVNO uses voip numbers rather than mobile numbers"

I am thinking specifically of eSIM providers like truphone who do all kinds of nice and interesting things, but the numbers are voip numbers. Yes, you do get a physical SIM from truphone but the numbers terminate to (non-mobile) numbers. You can't get SMS from shortcodes with truphone.

"jmp.chat is a voip service and supports short codes just fine."

I'm not so sure ... the issue here is receiving SMS from shortcodes (which is how gmail, for instance, sends 2FA auth to you) and I don't see that jmp.chat can receive SMS from shortcodes ... see[1] which says:

"Unfortunately it did not. I was not consistently able to receive short code SMS. I've since fallen back to using cellphone service from Telus which allows me to receive shortcodes."

[1] https://www.reddit.com/r/VOIP/comments/8z44iu/mobile_voip_ca...
"It's just a prank, bro!"

Incredible that the university researches decided this was a good idea. Has noone in the university voiced concern that perhaps this is a bad idea?
So they can tell companies "I am a contributor to the Linux kernel"..there are charlatans are in every field. Assuming this wasn't malicious and "I'm a newbie" isn't just a cover.
Heh, if that isn't the most hypocritical award given in a hot minute. That's the only thing I can say about this in good conscience.

Susan: un-ban every political dissenter you've removed in the last 2 years and then we can talk.
I suppose that's true for some countries, but in most countries you can do something about it, even if it takes a lot of work. You can vote different, join transparency organizations and so on.

Small stock owners have not more power than voters, even less in some cases.
The choice of `set` taking a function is a questionable one. I know this is fairly common for JS libraries but IMHO it should only be used when you know that the value can't naturally be a function. Otherwise it is a footgun.

let someval = () => 1234;
state.set(someval) // Oops.

You need to remember to write the following if the value might be a function.

state.set(() => someval);

I would have just made this a separate function and call it `.update()`.
rather than arguing about the technical details of the law, let me just clarify: IRBs would actively reject a request to review this. It's not in their (perceived) purview.

It's not worth arguing about this; if you care, you can try to change the law. In the meantime, IRBs will do what IRBs do.
> I don't have data to back this up, but I've been around a while and I can tell you papers are rejected from conferences for ethics violations.

IEEE seems to have no problem with this paper though.

>>> On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits Qiushi Wu, and Kangjie Lu. To appear in Proceedings of the 42nd IEEE Symposium on Security and Privacy (Oakland'21). Virtual conference, May 2021.

from https://www-users.cs.umn.edu/~kjlu/
"It's just software"

IRBs are typically more equipped for biological/psychological research and likely wouldn't have the technical chops to see past the software to the real world, especially if it was presented to them inadequately.
I think Greg KH would have been wise to add a time limit on this ban. Make it a 10-year block, for example, rather than one with no specific end-date.

Imagine what happens 25 years from now as some ground-breaking security research is being done at Minnesota, and they all groan: "Right, shoot, back in 2021 some dumb prof got us banned forever from submitting patches".

Is there a mechanism for University of Minnesota to appeal, someday? Even murders have parole hearings, eventually.
Arguably shouldn't judges follow their judgement on the cases they work on ? Throwing out baseless cases happen every day, a company abusing the system having their ridiculous complaints thrown out would be reasonable.

To me that is the basic reason for having humans in the process.
I disagree, I think it's important to be nice and welcoming to contributors but the immune system should be a robust code of conduct which explicitly lists things like this that will result in a temporary or permanent ban
What authorities whould that be? The Department of Justice? The same DoJ that is constantly pushing for backdoors to encryption? Good luck with that! The "researchers" just might receive junior agent badges instead.
> He would probably feel the same way about a new Dell or Lenovo.

Not sure if this was ever true for someone who used a Mac before. Going to a Dell or Lenovo feels like a huge downgrade. Everything about these laptops feels cheap in comparison to a Mac. They are bigger, thicker, heavier, more plastic, hotter, and less elegant. Also the track pad and other screen on the Mac is so much better. Even if some Windows laptops come with a crazy high resolution, the OS looks shit on it and the user has to go into the Windows menu and play around with all the UX controls until the proportions of the start bar, windows and other UI elements somehow make sense on the high resolution again. Of course there is a million Windows apps still out there which don't scale at all. I cannot imagine that a user who was on Mac for more than a year could go back to Dell or Lenovo and feel excited about it. Now with the M1 the contrast is even worse. I have an M1 and Intel MBP and even going back to the Intel MBP feels really crappy because I need to charge my device when working for a full day. I got so used to the M1 not needed a single charge during the day that it's really odd to think about how other laptops still do. I treat my M1 like my iPhone. I plug it in over night, that's all it needs.
Aditya's story about the new patches is that he was writing a static analysis tool and was testing it by... submitting PRs to the Linux kernel? He's either exploiting the Linux maintainers to test his new tool, or that story's bullshit. Even taking his story at face value is justification to at least ban him personally IMO.
The original referenced paper is also very good: http://elucidation.free.fr/parachuteBMJ.pdf (can't find a better formatted link, sorry)

Conclusions: As with many interventions intended to prevent ill health, the effectiveness of parachutes has not been subjected to rigorous evaluation by using randomised controlled trials.Advocates of evidence based medicine have criticised the adoption of interventions evaluated by using only observational data. We think that everyone might benefit if the most radical protagonists of evidence based medicine organised and participated in a double blind, randomised, placebo controlled, crossover trial of the parachute.

With the footnote: Contributors: GCSS had the original idea. JPP tried to talk him out of it. JPP did the first literature search but GCSS lost it. GCSS drafted the manuscript but JPP deleted all the best jokes. GCSS is the guarantor, and JPP says it serves him right
> I wonder if some of the people having fevers and other flu-like side effects are people who were asymptomatic Covid carriers at one point!

I saw a similar claim about a week ago, that the correlation is high between people who were actually sick and then also got side-effects from a vaccine. They didn't include a reference, but if I see it again I'll definitely be poking them for one.
The only additional obligation that the AGPL requires is that you not restrict to others the freedoms that it grants to you.
@denvercoder9 had a good comment that might assuage your concern:

> It's not a ban on people, it's a ban on the institution that has demonstrated they can't be trusted to act in good faith.
If people affilated with the UMN want to contribute to the Linux kernel, they can still do that on a personal title. They just can't do it as part of UMN research, but given that UMN has demonstrated they don't have safeguards to prevent bad faith research, that seems reasonable.
I was ruminating on this on a long walk recently and it occurred to me that I'm probably not "only inside my brain", as you put it.

"You" aren't only inside your brain at all. Imagine that at every timestep, there's a single consciousness that experiences qualia all at once, across all matter - and the feeling of being "inside your brain" is just that the qualia happening there have a large number of causal relationships to your recent brain activity, your working memory, longer-term memories, inputs from your senses, etc - but at that same instant, "you" are also the person sitting across from you - there just isn't the same level of cross-chatter and so "you" can't experience both brains simultaneously.

Kind of like context switching in an OS or something. This would enable a panpsychic view where consciousness was field-like, taking on large values where matter is densely causally connected, such as in the brain, and low values where it isn't, such as in the empty space between two people.

Anyway, as Hicks said, "we are all one consciousness experiencing itself subjectively ... here's Tom with the weather."
As odyslam wrote, opt-out is unethical.
He's right about assembly vs inline assembly (gcc asm). But something well done like Intel Intrinsics [1] specializes an intrinsic for target platforms. It's (a lot) more work on the intrinsic writer's part but then provides something of a cross platform abstraction for the programmer.

[1] https://software.intel.com/sites/landingpage/IntrinsicsGuide...

I think intrinsics are like C++ templates. Maybe you shouldn't be writing them unless you really know what you're doing.
> preallocating an exactly correct size result buffer

Looks like it just uses the size of the original slice. If the average broken chunk is less than three bytes (maybe quite common?) then it'll have to grow the buffer, at least doubling it.

>> let bytestring = b"foobar\xcc";
>> bytestring.len()
7
>> let cleaned = String::from_utf8_lossy(bytestring).into_owned();
>> cleaned.len()
9
>> cleaned.capacity()
14
It should be reported anyways. This might be only some small part of the malfeasance they're getting up to.
Reminds me of the Tuskegee Symphilis Study.

Sure we infected you with Syphilis without asking for permission first, but we did it for science!
I can’t imagine it will stay that way forever. As more and more critical tools and infrastructure go digital, allowing people to just whack away at them or introduce malicious/bad code in the name of research is just going to be way too big of a liability.
You can still write code in a different language like C that will compile into Smalltalk VM bytecode. You will never be able to run any arbitrary code, just the one compiled for your machine. And in this case, the machine is virtual (but does not need to be). Symbolics Lisp machines were able to run Pascal as well, for example.
It's not that they didn't do it well or anything, and they've clearly scaled up to this insane load but they aren't afaik using crazy algorithms or something special like that. They just did the obvious "we'll have a hosted app that does this AND this"
We didn't have Earthlink, we would dial the other person's modem directly and play Doom 1v1.
Aditya's advisor [1] is one of the co-authors of the paper. He at least knew about this work and was very likely involved with it.

[1] https://adityapakki.github.io/assets/files/aditya_cv.pdf
We did. Often we wish they could have got more decimal points in a measurement, or had known how to check for some factor. Despite all the gains and potential breakthroughs lost nobody is willing to repeat them or anything like them. I know just enough medically people given 2 weeks to live who were still around 10 years latter that I can't think of any situation where I'd make an exception.

Though what a lot is is also open to question. Much of what we learned isn't that useful to real world problems. However some has been important.
Looking at latest Firefox Developer Edition, where new tabs and menus has landed, sadly the megabar is still the same. Sorry, if I misunderstood initial message and gave false hope. But hey, at least context menu is back to text back/forward actions instead of icons. Everything keeps going in circle.
The first, and non trivial, step, is noticing that you aren't doing it easy.

I've been working in very tight spaces where I twist myself into pretzels trying to get at a particular spot, all while wrapped up in a homemade hazmat suit, to the point where I can hardly breath or see. It has gotten better after I established one rule: No Stress Positions. Meaning, do whatever it takes to get comfortable before proceeding.

Before, if my back would start to hurt from a difficult stance, I wouldn't really notice, I'd just speed up to try to get it done before my back gave out, frequently botching the job and cutting or scraping myself in the process. Now, I notice that I'm breaking The Rule, think about the topology, reposition myself, maybe add cushions, maybe spend some time to move things out of the way. Fixup my mask and goggles, and then take my time.

Before I'd only take notice of my discomfort on failure, when I just couldn't do it anymore. And that resulted in a strong desire to quit. Now I spend the effort to get myself in an "I could do this all day position", and I can do it all day. I think the same thing applies to washing dishes or making breakfast. First step, just notice that you aren't doing it in easy mode.

It's summed up by the old Two Bulls on a Hill joke.
None of the vaccines are 100% effective. A 74% effective (at preventing symptoms) vaccine (like Oxford/AstraZeneca) means 26% of people can still get the disease (and likely some more can get infected, without getting disease symptoms). A 95% effective (at preventing symptoms) vaccine like the Pfizer/BioNTech one means 5% of people can still get symptoms (and likely some more can get infected, without getting disease symptoms).

The vaccines effectiveness is (mostly) a factor of how well they prevent the disease COVID-19. It's NOT a direct indication of how well they prevent infection with SARS-CoV-2, since not all infections cause COVID-19 (some are asymptomatic) but it seems to be a reasonably close bound.
how do I deserve -4 for this?
I think that all people have a right to their opinion. But the minute your opinion becomes an order and starts scratching my turf, I got a problem with that!
> It's a valid point, and seems to have historical support via evidence of many egalitarian / welcoming communities collapsing due to the accumulation of bad faith participants.

Could you provide references to some of this historical support?
I felt like I've read this vulnerability described before. Found this from 2 years ago: https://arstechnica.com/information-technology/2019/08/apple...

Research links:

https://hexway.io/research/apple-bleee/

https://arxiv.org/pdf/1904.10600.pdf

https://www.usenix.org/system/files/sec19fall_stute_prepub.p...
the threat model is that many someones knowingly or unknowingly have a stinger-like phone/device constantly collecting these hashes and cracking them. i know of at least one device in my building that was (likely unknowingly) attempting bluetooth-based hacking in a similar manner.
Shakti (k): Update and Demos
The Future of Private and Consent-Based Marketing
If that cost is high, why are they accepting and rejecting code based on email addresses?

https://twitter.com/FiloSottile/status/1384883910039986179

(Clearly the academic behavior is also a problem, there's no good justification for asking for reviews of known bad patches)
But Kanjie Lu, Pakki’s advisor, was one of the authors. The claim that “ You, and your group, have publicly admitted to sending known-buggy patches” may not be totally accurate (or it might be—Pakki could be on other papers I’m not aware of), but it’s not totally inaccurate either. Most academic work is variations on a theme, so it’s reasonable to be suspect of things from Lu’s group.
Per Wikipedia, 70% of the Daily Mail's web traffic is from outside the UK, mostly from the US.
"To appear"
Permutation City by Greg Egan - it's fiction, but honestly it will do as good a job as any textbook on the subject to force you to really think about your beliefs about the nature of consciousness.
It sounds like a metadata situation where collecting AirDrop IDs is another piece of the puzzle that helps build a complete data profile of individuals. It may not be a huge issue, but it’s certainly not a small one.
Inside Presto Optimizer
This is categorically unethical behaviour. Attempting to get malicious code into an open source project that powers a large set of the worlds infrastructure — or even a small project — should be punished in my view. Actors are known, its been stated by the actors as intentional.

I think the Linux Foundation should make an example of this.
I'm not sure why you think you have to be mean to avoid bad code. Being nice doesn't mean accepting any and all contributions. It just means not being a jerk or _overly_ harsh when rejecting.
"Read the rest of this story with a free account." - extremely amusing.
Podcast providers are also killing the open podcast without Spotify's help.

France culture and France Inter recently removed their audio files older than 2 months (give or take) from their servers and they are only accessible through the official smartphone app.

Old links now points to a generic 20 seconds jingle that says the file is not available anymore but you may download the official application to listen to it. Of course there are missing podcasts in the official app. And now I have holes in podcast series that weren't completely downloaded.

Yesterday the official app prompted me for advertising and tracking cookies.
This x100

Will currently rock my 2017 MBP until it shits the bed. While there have been huge strides in getting tools compatible with apple's ARM, I am not a fan of spending huge amounts of efforts to get a tool(s) to work on something that was already working sufficiently enough on x86.

Plus, I imagine in most corporate environments M1 will break many internal tools making it nearly impossible to access protected resources.
AI-based animation software uses video for motion capture
I enjoyed (and now miss) angry Linus.
Looks useful for a lot of the mini sites or landing pages we need to do, would make it much easier to add some basic interactivity with potentially less debug time
I agree, that's very cool. It's funny how some people see the utopia and others see the dystopia.
Agreed. It is sort of helping users to make the move though.

It's almost like a reverse transition: instead of getting a new cpu and making it work with the old ecosystem and software you take an old cpu and software and and get it to work with the new hardware (I know the analogy isn't perfect!)
Organizing an effort, with a written mandate, to knowingly introduce kernel vulnerabilities, through deception, that will spread downstream into other Linux distributions, likely including firmware images, which may not be patched or reverted for months or years - does not warrant a criminal investigation?

The foundation should use recourse to the law to signal they are handling it, if only to prevent these profs from being mobbed.
The Banned Instagram Hashtags to Avoid
Developing markets are suffering a mobile malware pandemic