skysight-inc/HackerNews huggingface dataset:
"It's the best way for NATO to put Russia on defensive. A solid wall of steel from Baltic to Azov to seal it shut from Europe."

Can you see the problem with NATO?

European countries are unlikely to finance the effort, our armies are for the most part underinvested and their deployment capacity very limited.

France has some capabilities, but it is also bogged down elsewhere (Sahara), because the Islamist threat is more acute for Paris than whatever Russia does.

USA and UK have two decades of nation building behind them and whatever fighting spirit is left, is reserved for a possible confrontation with China. Also, both of them are naval powers, while Belarus is a landlocked country. Not to say that they are unable to fight on land, but it is a disadvantage for them.

If you like The Lord of the Rings, we are sort-of similar to Gondor just prior to the war. Not enough power and will to hold Mordor in a siege.

The good news is that Russia is fairly strained and it is not a full Mordor either. More like a group of orc chieftains from the Misty Mountains.
There’s no research going on here. Everyone knows buggy patches can get into a project. Submitting intentionally bad patches adds nothing beyond grandstanding. They could perform analysis of review/acceptance by looking at past patches that introduced bugs without being the bad actors that they apparently are.

From FOSDEM 2014, NSA operation ORCHESTRA annual status report. It’s pretty entertaining and illustrates that this is nothing new.

https://archive.fosdem.org/2014/schedule/event/nsa_operation...
https://www.youtube.com/watch?v=3jQoAYRKqhg
No. The first line of the article makes the rationale clear and its national security not competition.

> The UK government is to examine the sale of computer chip designer Arm Holdings to a US company on national security grounds.

Also see extensive earlier discussion.

https://news.ycombinator.com/item?id=26861843
> This statement is incorrect. Gemini clients can absolutely display inline images.

"clients" and "can" - it's not mandated by the spec, therefore, "Gemini" does not do it.

> The difference is that default behavior is to require a user action to load a resource.

Extremely non-conductive to thought. Again, take the example of a research paper - the difference between having every figure and formula appear by default and having to click-to-load is massive, with the latter being un-ergonomic and inhibiting comprehension and flow.

> These are all client-side features. Half the point of Gemini is for the user agent to determine presentation and leave semantic markup to authors. I don't want weird fonts or multi-column views, but you do; Gemini lets us both get what we want instead of having everyone see a one-size-fits-all presentation. Clients like Kristall even give you a TOC in the sidebar.

You can do exactly this same thing with the modern web with CSS styling and userscripts - the difference being that the web gives you saner defaults that are more conducive to thought, and Gemini clients seem to give you less-sane defaults that are less conducive to thought.

> blind, deaf

This is a limitation of being blind or deaf - someone who's blind wouldn't be able to view a sunset in real life. Obviously, though, while text can be read/listened to by someone who's blind or deaf, that doesn't make text a replacement for images, formulas, or interactive animations - those with those disabilities simply can't perceive the native forms of those things. Several hundred or thousand words describing a layout for a PCB is not equivalent with an image of the layout.

...and, modern webtech has accessibility properties that allow for annotation of non-text media with text. Gemini? Does not.

> machine (translation, etc)

False. Machines cannot understand plain text - it must be parsed. English (and other natural languages) are not machine-parseable, and machine-readable plain text had no reason to not exist as structured data in the first place.

> while being stored and transmitted without information loss.

All of the other kinds of electronic data that exist in the modern web can also be stored and transmitted without information loss, so this is not a special property.

> Text is good at knowledge dissemination.

Relative to text+formulas+images+interactive visualizations? Absolutely false.

Show me how to write out all of the variants of the Schrödinger Equation[1] in plain text, while still making it as readable, understandable, and useful as the mathematical formulas.

Show me how to phrase, in words, a 3D circuit layout, such that it's easier to understand and manipulate than an interactive model.

Show me how to describe the sound of a violin.

Webtech gives you text and images and sound and formulas and interactivity. Gemini gives you text, and that's it. Having to click a separate link to go to a separate object makes it not "part of Gemini" and the user experience is clearly, massively worse.

[1] https://en.wikipedia.org/wiki/Schr%C3%B6dinger_equation
This is the Pavlovian-style trained response every time the popular tabloid, the Daily Mail is mentioned here. It's what it is. Get over it. Of course it's pleasant to feel a cut above the six million who buy the print copy and the thirty million plus who read it online but please bear in mind it's not aimed at your level of readership. Good however that you manage to scan it most days so that you can be assured it's a work of fiction. Personally I'd give it a miss and keep to the more subtle works of fiction in the upmarket section of the press.
Smart Contract Security for Pentesters
Maybe they should conduct a meta-experiment where they submit unethical experiments for IRB review. Immediately when the IRB approves the proposal, they withdraw, pointing out the ways in which it would be unethical.

Meta-meta-experiment: submit the proposal above for IRB review and see what happens.
Is Imgur Hacked?
When I visit the site it gets redirected to a loooong url which repeats like this:

http://imgur.com/(null)://imgur.com/(null)://imgur.com

The body text is a plaintext “header overflow.
It reacts quickly when you interact with it. (No latency, stuttering, that kind of thing)

Web dev version being that it resizes & reacts to the size of your screen.
This is an arbitrary definition of inside vs outside. You are implying that employees are trusted and benign and other contributors are high-risk, ignoring than an "outside" contributor might be improving security with bug reports and patches.

For the end user, the threat model is about the presence of a malicious function in some binary.

Regardless if the developers are an informal community, a company, a group of companies, an NGO. They are all "outside" to the end user.

Closed source software (e.g. phone apps) breach user's trust constantly, e.g. with privacy breaching telemetries, weak security and so on.

If Microsoft weakens encryption under pressure from NSA is it "inside" or "outside"? What matters to end users is the end result.
Easy to miss in the long blog post:

> Prisma currently supports PostgreSQL, MySQL, SQLite, SQL Server (Preview). A connector for MongoDB is in the works, sign up for the Early Access program here (https://prisma103696.typeform.com/to/FriDuIeM).
What Does It Mean If a Big Prize for Student Success Has No Winner?
> A Russian first strike on NATO block will take down 40M-50M

I'm glad you agree with me on the obliteration.
> it is still a derived work as it was progressively changed.

I think that depends. If it was progressively changed to something completely different, then, no.

Let's say in 10 days you replaced 10% of the code, with the same amount of code from a different program by another author. During those 10 days there'd be compilation errors, and thereafter the original work and copyright would be all gone (except for in old revisions in the repo), and the copyright holder of the new program could license it however s/he wanted.
Do IRBs typically have a process by which you can file a complaint from outside the university? Maybe they never thought they would need to even check up on computer science faculty...
Wrong!

If you read the research paper linked in the lkml post, the authors at UMN state that they submitted their research plan to the University of Minnesota Institutional Research Board and received a human subjects exempt waiver.
Thanks. I didn’t think this through. Indeed all binaries not just Windows but also games running in Windows simply are not compiled to execute on this new chip.

It’s not just drivers then afaik? It’s the entire win10, not to mention all third party drivers i guess like Razer and whatnot.
Ask about this upfront, get consent, wait rand()*365 days and do the same thing they did. Inform people immediately after it got accepted.
I feel like q lot of people here did not interpret this correctly.

As far as it's known, garbage code was not introduced into kernel.It was caught in the review process literally on the same day.

However, there has been merged code from the same people, which is not necessarily vulnerable. As a precaution the older commits are also being reverted, as these people have been identified as bad actors
Don’t necessarily agree with the article, but I’m a little curious about this. If you don’t have anything to show that you are a 10x DevOps sorcerer, are you actually one?

The thought is that it would show through your past experience, no?
That seems to directly contradict gkh and others (including the researchers) in the email exchange in the original post - these vulnerable patches reached stable trees and maintainers had to revert them.

They may not have been included in a release, but should gkh not have intervened *this would have reached users*, especially if the researchers weren't apparently aware their commits were reaching stable.
The emails suggest this work has been reported in the past. A review by the ethics committee after the fact seems appropriate, and it should’ve stopped a repeat offence.
I want a browser extension that changes the size of the window a bit for every reload/refresh when in dev mode, so that devs no longer get the "works on my machine full screen" size by default.

I work around using responsive dev tools, with a few predefined sizes, but that's less automatic.
Memberstack (YC S20) Is Hiring a Technical Recruiter (Contract Position)
Courts are integral to a free market. Without them all sorts of markets evaporate completely.

More generally, having a market does not mean having a government that supplies no public goods -- that is, having a government, since supplying public goods is all a government does.
Oh, we are to get an order of magnitude of cost reduction per kg on an orbit. There are attempts to measure it: https://everydayastronaut.com/raptor-engine/
They did go to the UMN IRB per their paper and received a human subjects exempt waiver.

Edit: I am not defending the researchers who may have misled the IRB, or the IRB who likely have little understanding of what is actually happening
https://www.youtube.com/watch?v=I7Umw70Yulw
How to Build a Clock with JavaScript and SVG
I think it's pretty much the same throughout Europe.

A massive component of football's success is the illusion that "anyone can make it" and win everything, being just 11 vs. 11.

I say illusion, because it's true in theory, but in reality small budget teams can't really hold on to great players.
Plus, it sets a precedent: if your university condones this kind of "research", you will have to face the consequences too...
> how many people really want to start a long discussion with a stranger about the merits of different languages?

Plenty of programmers, actually. Just see the comments on HN or reddit on posts about programming languages for example.
> The problem here is really that they’re wasting time of the maintainers without their approval.

Not only that, but they are also doing experiments on a community of people which is against their interest and also could be harmful by creating mistrust. Trust is a big issue, without it it is almost impossible for people to work meaningfully together.
The reward for implanting a rogue employee is orders of magnitude higher, with the ability to plant backdoors or weaken security for decades.

And that's why nation-state attackers do it routinely.
Starting a TypeScript Project in 2021
Discourse supports commenting (not only) by email, but that's about it. I don't think there is anything like that suitable for static blog.
With that logic you can conduct research on how easy it is to rob elderly people in the street, inject poison in supermarket yogurts, etc.
> I do not know what went wrong in web land that we can not have great smooth user interfaces and smooth animations.

Design by committee, design by monopoly, and trying to shoehorn an application platform feature set into a document platform.
usually the discussion is around the end goals, rather than the means. But both are game for discussion.
In a fairer country, they would be hanged.
https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah...

This message contradicted that.
Lisp is Forth where "(" pushes next word onto separate execution stack and ")" executes it. Hence (+ 1 2) is equal to 1 2 +. I made this discovery maybe 1975, but Forth was not yet invented, or rather Internet was not yet invented, so I did not know about Forth. So it was a property of my very own Symbolic Stack Machine on Nova 1200.
Who don't want to compete with who? This is between a news publisher and a search engine; they're not exactly in the same business.
Chinese banks are even more thirsty for US Treasuries. They can't risk being denied access to USD because that's how the only way you have to buy Treasuries and receive interest and principal back if you are already invested (they all are)
I'm pointing out you're not really adding anything to the discussion. Saying you morally disapprove of the Daily Mail without substantiating it with facts isn't for HN.
It depends on the organization. Most that I've worked with have said everything is fine except for social engineering, but some want to know every tool you'll be running, and every type of vulnerability you'll try to exploit.
Yes the premiership doesn't share its wealth with the lower leagues, there's already a huge element of segregation and exclusivity there. But it's still a huge difference that promotion is possible. Smaller clubs can work their way up. Even within the premiership, these 6 teams are not consistently the best 6. They are trying to use their wealth to exclude in some cases better performing clubs.

Not watching is one option, directly pressuring your club not to join is another. Government regulations are yet another. Thankfully we don't yet live in a world where corporations can do whatever they like and your only recourse is not to watch
It will actually not be going to the Ethereum staker, the "base-fee" is going to be burned (removed from supply) and no one gets it, that's what EIP-1559 does (expected to arrive in the July London hard-fork)

To add to this, the overall issuance of ETH yearly is going to reduce from about ~ 4+ Million ETH in the PoW model to about ~ 1.x Million ETH in the PoS model, because the PoS security does not require as much issuance.
https://jawj.github.io/zapatos/ (no built-in migration support, though)
Why is that objectionable, do actual bad actors typically stop trying after being told to do so?
"I was testing how the bank processes having a ton of cash taken out by someone without an account, I wasn't testing the staff or police response, geez!"
Because I think we're using two different definitions of obselete. Just because people will buy a thing years down the road, doesn't mean it wasn't already obselete then or when it was brand new or that those second purchasers can't make some use of it, however strained. I disagree about ram, at least at the minimum threshold, evidenced by numerous naive customers I've witnessed being incredulous as to why a few chrome tabs and some temp files are bringing their $1k+ computer to a halt.

Would you have bought a MacBook air or pro in 2017 with 4gb of non-replaceable ram for $1000? No, because it's obselete and you know that. What if they told you it was a great computer, and you didn't know anything about computers? Probably.
Just wanted to say thank you for posting this. I have three small children and had no idea of the dangers these batteries pose. We seem to be changing button batteries every couple of weeks or so, they are in a number of sound books and toys we have around the house. I will be sure to take extra care with them after reading that article. It’s every parent’s worst nightmare.
To be fair, Sequelize makes itself look like a joke. I normally wouldn't call out an individual library to shit on, because I understand that a lot of work has gone into it.

But I used it for years and it was always buggy. Sometimes options wouldn't work correctly because the authors liked to do that clever JavaScript thing where they write `foo = optional_thing || default_value` even for BOOLEAN options. I always had issues with it not being able to truncate/drop tables correctly that had foreign keys (it didn't attempt to order them intelligently), some of the options weren't compatible with each other even though they were orthogonal (I'm thinking about the snake_casing options and the created_at/updated_at column features), etc, etc.

It just... didn't actually work. Over many versions. I think I used it from late 3.x somewhere through 5.x.

Maybe it's awesome now, but I doubt it.
I see a lot people bashing on how iPadOS is holding back the hardware of the iPad Pro. I totally understand where this train of thoughts is coming from. But how many of these people actually tried to use the iPad Pro to its fullest extent as the main computer? I suspect most of the people here are accustomed to MacOS and never really dug iPadOS for productivity for extended periods of time.

Besides, the iPad Pro is really not designed nor advertised as replacement for MacBook. They have very different audiences in mind. Of course it sucks for the desktop tasks that MacOS was built for. But the iPad Pro beats the Mac for artists, students, and researchers in most tasks.

I’ve been using an iPad Pro for all of my work as a mathematical physicist for many years. I think the iPadOS is absolutely fantastic for what I do on a daily basis: editing and reading PDFs (LiquidText), writing with LaTeX (TeX Writer), opening a ton of Safari tabs. It can even do an okay job on editing videos (LumaFusion), photos (Darkroom), writing codes (Textastic, Working Copy). Of course it’s not the best for all of these things, but it excels on where the MacOS sucks, and vice versa.

As for the new iPad Pro announcement, I absolutely don’t think the M1 is a waste. I can totally see myself utilising the extra RAM to stop Safari tabs from unloading, to working on larger workspace in LiquidText, to editing more tracks in LumaFusion, and etc.
Welcome to the YOLO Economy
Proposal for a Regulation on a European Approach for Artificial Intelligence
From the link, not sure if accurate:

> Those commits are part of the following research:

> https://github.com/QiushiWu/QiushiWu.github.io/blob/main/pap...

> They introduce kernel bugs on purpose. Yesterday, I took a look on 4 accepted patches from Aditya and 3 of them added various severity security
"holes".
You can find numerous quotes by British and American politicians of the time approving Hitler or Stalin. E.g. Churchill praises Hitler in his 1935 book (after the purge of up to 1000 people in 1934). Roosevelt and his wife's enchantment with Stalin is another example.
I've found this a very helpful summary of TypeScript SQL libraries: https://phiresky.github.io/blog/2020/sql-libs-for-typescript...
>That only makes sense if you agree with the open source foundation definition of restrictive.

I think Timescale employees should remember to preface "This is our belief on the definition of restrictive" when describing the license as more open than open source licenses, given much of the community might disagree (sometimes vehemently) about that take.
SliceGAN: Synthesize high-fidelity 3D datasets using a single 2D micrograph
I don't know, you are throwing away the length of the invalid sequence that way. Maybe useful in certain situations, but probably not in most.
I'm not sure what we learned. Were we under the impression that it's impossible to introduce new (security) bugs in Linux?
The NYT and most other mainstream news outlets go out of their way to avoid making people angry -- often too much so, IMO.

Many truths are infuriating. Reporting them does not in itself imply a lack of ethics.
I don't have the name of the professor.

[Edited: it seems like they do love OSS and contribute a lot. See child comments.]

I had based my consideration on the way they are testing the open-source development model.

These professors actually love OSS... but they need to respect kernel maintainers request to stop these "experiments".
The insiders are the maintainers. The outsiders are everyone else. If this is an arbitrary definition to you I... don't know what to tell you.

There's absolutely no reason everyone's threat model has to equate insiders with outsiders. If a stranger on the street gives you candy, you'll probably check it twice or toss it away out of caution. If a friend or family member does the same thing, you'll probably trust them and eat it. Obviously at the end of the day, your concern is the same: you not getting poisoned. That doesn't mean you can (or should...) treat your loved ones like they're strangers. It's outright insane for most people to live in that manner.

Same thing applies to other things in life, including computers. Most people have some root of trust, and that usually includes their vendors. There's no reason they have to trust you and (say) Microsoft employees/Apple employees/Linux maintainers equally. Most people, in fact, should not do so. (And this should not be a controversial position...)
FYI the name MongoDB comes from "humongous". Thanks for the wiki links, though.
Yes. You have agreements about what is fair game and what is off limits. It can be that nothing can be physically altered, what times of day or office locations are OK, if it should only be a test against web services or anything in between.
Sadly, that only consolidates my view of that organization.
1) You can't run tests in parallel.

2) It is at least an order of magnitude slower than not using a database at all.

Combined this makes for very slow tests. Certainly for larger applications with thousands of tests.

Having said that, I don't think there is a single right answer to the problem of testing applications that use a database and your suggestion still can be a valid solution.
There's the law, and there's the principle.

Your platform may be legally allowed to censor everything, but it's clear it doesn't take freedom of expression seriously.

If we add some more mental gymnastics, we can say the Chinese government supports all legal freedom of speech as well. If this sounds ridiculous
but the former does not, we should evaluate why one type of censorship means freedom but another means oppression.
To be fair, one suggested etymology I've seen for for 'mongo' is a simplification of 'humongous'.

Whether you believe this claim or not, it's entirely down to whether you want to take a charitable or negative guess at the original intention.
Ethics in research matters. You don't see vaccine researchers shooting up random unconsenting people from the street with latest vaccine prototypes. Researchers have to come up with a reasonable research protocol. Just because the ethical way to do what UMN folks intended to do isn't immediately obvious to you - doesn't mean that it doesn't exist.
What boom would you suggest for a physics based approach to QC? Other than a solid understanding of quantum theory of course
European Commission proposes new rules and actions for trust in AI