skysight-inc/HackerNews huggingface dataset:
> All asset classes (houses, stocks, cryptocurrency) only ever increasing in value? That’s too good to be true.

Not if the supply of money is increasing. Also, different regions of the US are experiencing very different levels of changes in price.
I think they're right (kind of).

I think we're in a bit of a bubble.

But I think the main driver is severe asset inflation, so when the bubble pops we'll find it only unwinds a year or two, at most, of the insane price-growth we've seen... well, ever since the recovery from '08, actually.
How is it related to ML?

Closed form implicit surfaces are actually one of the most difficult way to model the real world. They are neat because they are very compact and the creation process is close to modeling with (mathematical) clay. But they are hard to use if you want to model the real world with all its complexity, resulting of a variety of chemical and physical processes happening over time. There is a reason why they are so popular in the demoscene, for which technical achievement and art is more important than realism, and not much elsewhere.

The paper is about making rendering of these primitives more efficient, which may prove to be a great addition to an artist toolbox, and maybe for scientific imagery. However, I don't really see applications for ML anytime soon.
> The housing supply argument doesn’t hold up to me

Strongly disagree with you , I'm in Europe. I'm in the 25% richest of my state , I can't manage to rent a home because every time I contact a landowner for a property to rent there is 30+ person who applied before me within 4 hours...

Covid-19 has created a "remote economy" boom as well as accelerated household project to move to another state and acquire a property or just to invest in real estate.

Thus real estate market is performing just as expected... As long as the supply does not meet the demand the price goes up.

For crypto it's different , 99% of crypto transactions are speculation base. It's by design.
I agree that it's bad behavior, but if you have billions of dollars resting on open-source infrastructure, you better know the liabilities involved.
Mostly agree. For me, it was even easier: implementing comments without JS is something I don't have the time or inclination to do, and I didn't want to put JS on my blog unless I absolutely had to.
The article says that single family zoning rules are causing the shortage that drives up the price we're seeing right now. So they argue that the solution is to open up those restrictions so that more multi-unit buildings can be built and that this will "break the restrictions on homeownership in America." Multi-unit buildings are overwhelmingly more common to be rentals than occupant-owned condos, so how is this a solution that actually increases people's ability to own their homes?

Seems like its just a bait-and-switch in favor of landlords.
Again, that's not the same, because then they will look for problems. What you want to test is that they're looking for problems all the time, on every patch, without you telling them to do so.

If they don't, then that's the vulnerability in the process.
This is the sort of situation where the best you could do is likely to be slightly misleading about the purpose of the experiment. So you'd lead off with "we're interested in conducting a study on the effectiveness of the Linux code review processes", and then use patches that have a mix of no issues, issues only with the Linux coding style (things go in the wrong place, etc.), only security issues, and both.

But at the end of the day, sometimes there's just no way to do ethically do the experiment you want to do, and the right solution to that is to just live with being unable to do certain experiments.
> I would still want this test to be performed, because I value kernel security above petty ideological concerns.

The biggest issue around this is consent. You can totally send an email saying "we're doing research on the security implications of the pull request process, can we send you a set of pull requests and you can give up approve/deny on each one?"

> If you remember the dire state of computer security in the early 2000s, remember that the solution was not throw all the hacker kids in jail.

You weren't there when Mirai caused havok due to thousands of insecure IoT devices getting pwned and turned into a botnet... and introducing more vulnerabilities is never the answer.
Without looking deep at the technology part I was wondering if this could be used as an alternative for avalanche transceivers in backcountry skiing. Avalanche transceivers use radio signals to find each other in case of an avalanche. They are very high priced and unfortunately a lot of people then decide to not use one. Having a cheap and reliable version using a phone could save lifes. I'm very curious to see if this is feasible
> It's reasonable to assume USD is losing 8-10% of its value every year from 2020 onwards, thanks to Fed policies

Are you willing to bet money on this claim? Because I will happily take the other side of that wager. It is absurd.
I agree but the criticism of Tim Cook has never been about execution - he is clearly world class on that - but about quantum leap innovation.

We will need a new product category to put that to rest.
> Maybe not being nice is part of the immune system of open source.

Someone for whom being a bad actor is a day job will not get deterred by being told to fuck off.

Being nasty might deter some low key negative contributors - maybe someone who overestimates their ability or someone "too smart to follow the rules". But it might also deter someone who could become a good contributor.
That's fair but I was more replying to the OP that said "but it shouldn't be called an Open Source license". The point is we don't call our license Open Source.

Comparisons to Open Source and discussions of the pros and cons of both approaches are, of course, fair.
> it would be a good idea to let your university know what you think of this.

Unless there's something particularly different about University of Minnesota compared to other universities, something tells me that they won't give a crap unless you're a donor.
Bitcoin is more likely going to be the Lycos to Google or MySpace to Facebook.
> because then they will look for problems. What you want to test is that they're looking for problems all the time, on every patch, without you telling them to do so.

That's what they do every time.
I get the sense identifying a bubble is similar to identifying alcoholism.

If you find yourself having to spend time explain to people why you’re not an alcoholic there is a good chance you are one.
I have started looking at this for Svelte projects from a post yesterday on non-javascript build tools. Very promising indeed,
Not necessarily. And the conflation of IRB-exemption and not human subjects research is not exactly correct.[0]

Each institution, and each IRB is made up of people and a set of policies. One does not have to meaningfully misrepresent things to IRBs for them to be misunderstood. Further, exempt from IRB review and 'not human subjects research' are not actually the same thing. I've run into this problem personally - IRB declines to review the research plan because it does not meet their definition of human subjects research, however the journal will not accept the article without IRB review. Catch-22.

Further, research that involves deception is also considered a perfectly valid form of research in certain fields (e.g., Psychology). The IRB may not have responded simply because they see the complaint as invalid. Their mandate is protecting human beings from harm, not random individuals who email them from annoyance. They don't have in their framework protecting the linux kernel from harm any more than they have protecting a jet engine from harm (Sorry if that sounds callous). Someone not liking a study is not research misconduct and if the IRB determined within their processes that it isn't even human subjects research, there isn't a lot they can do here.

I suspect that this is just one of those disconnects that happens when people talk across disciplines. no misrepresentation was needed, all that was needed was for someone reviewing this, who's background is medicine and not CS, to not understand the organizational and human processes behind submitting a software 'patch'.

The follow up behavior...not great...but the start of this could be a serious of individually rational actions that combine into something problematic because they were not holistically evaluated in context.

[0] https://oprs.usc.edu/irb-review/types-of-irb-review/
I like it, curious to see what kind of options come up over the next few years. I don't have an answer for you though, asking around.
> Could they have submitted patches to fix the problems based on same tooling or was that not possible (I am not close to kernel development flow)?

Depends on what you mean: they knew exactly what they were patching, so they could easily have submitted inverse patches. On the other hand, the obverse research problem (patching existing UAFs rather than inserting new ones) is currently unsolved in the general case.
I think O'Keefe is scummy, too.
One thing I find odd about the current housing market is how many people aren't paying rent right now.[0] Once evictions are allowed again surely that is going to have some impact on prices. Especially if, as many people suspect, many of these homes are investments rather than owner occupied. Maybe it won't affect the housing market much though because the problems are mainly in low-income housing? That seems like a sketchy assumption.

[0]: I couldn't find a good number for this in my quick search for it, but I remember seeing something about how a fairly high percentage of renters aren't paying rent currently.
That was the same thing said of the SMU punishment. They were not the only school doing it. They were just the ones that got caught.
They do if the patch "looks good" to the right people.

In late January I submitted a patch with no prior contributions, and it was pushed to drm-misc-next within an hour. It's now filtered it's way through drm-next and will likely land in 5.13.
>There are ways to do research like this (involve top-level maintainers, prevent patches going further upstream etc.)

This is what I can't grok. Why would you not contact GKH and work together to put a process in place to do this in an ethical and safe manner? If nothing else, it is just basic courtesy.

There is perhaps some merit to better understanding and avoiding the introduction of security flaws but this was not the way to do it. Boggles the mind that this group felt that this was appropriate behavior. Disappointing.

As far as banning the University, that is precisely the right action. This will force the institution to respond. UMN will have to make changes to address the issue and then the ban can be lifted. It is really the only effective response the maintainers have available to them.
> Ukraine democratically decides to prefer EU over Russia, maybe all parties need to live with that.

Russia has been opposing the expansion of NATO for decades, and Ukrainian politicians at different moments were aiming to join NATO (rather than signing memorandums not to join NATO). I suppose, we Ukrainians can be upset at how unfair it is that our sovereignty is not respected, but that won't earn us any more agency. Russians are the ones with the nukes, overwhelmingly stronger military and with opinions on the matter, so maybe we've got to be smarter about how we navigate through challenges ahead of us.
Reclaim.ai is staying free through 2021
> as the stimulus packages have been targeted towards basic infrastructure and assistance programs for lower income groups.

This made me chuckle. If anyone is curious, this is where the money went [0]. To say that the money was focused on lower income groups is laughable. 2.9 out of 12 trillion allocated went to asset purchases, basically buying treasuries and mortgage backed securities. How many lower income groups hold treasuries?

[EDIT] If anyone is curious about an alternative view, I've been kind of obsessed on this topic over the last few weeks are wrote about it extensively [1] and tried documenting the ridiculous rise in asset price levels to levels much higher than even that of pre-covid [2]. To say that there's nothing going on when nearly all asset prices are 30+% past their pre-covid peaks is ridiculous.

[0] https://www.covidmoneytracker.org/

[1] https://mleverything.substack.com/p/where-did-the-12-trillio...

[2] https://mleverything.substack.com/p/where-did-the-12-trillio...
Is there any chance that the client needs the online status for some internal optimization, e.g. in order to deliver messages for online contacts to a different server than those destined for offline contacts? I could imagine delivery paths to be quite different (one would be immediately passed through in-memory while the other would be stored in some database and potentially trigger mobile push notifications).

In that case, it is nice to at least visually expose that this information is available to bad actors using custom clients too.

However, this fails as a possible excuse ever since Facebook acquired WhatsApp, given that they have essentially unlimited resources available and could easily implement a privacy proxy to hide this information from clients.
It seems they lied to the ethics committee. But I'm not holding my breath for the University to sanction them or withdraw/EoC their papers, because Universities prefer to have these things swept under the carpet.
But we have always known that someone with sufficient cleverness may be able to slip vulnerabilities past reviewers of whatever project.

Exactly how clever? That varies from reviewer to reviewer.

There will be large projects, with many people that review the code, which will not catch sufficiently clever vulnerabilities. There will be small projects with a single maintainer that will catch just about anything.

There is a spectrum. Without conducting a wide-scale (and unethical) survey with a carefully calibrated scale of cleverness for vulnerabilities, I don't see how this is useful research.
tsconfig's noUnusedLocals can help you with the last one.
Victim mentality is being cultivated on campuses all over the US. This will not be the last incident like this.
Reading the paper, it seems to attempt to address concerns about ethics (none of the patches got past the email stage, they never got into git) and timewasting (although reviewing the emails will have taken community time, they point out that they did also fix some real code issues). See section "VI - A - Ethical considerations"
I'm a PhD student myself. What he did is not okay! We study computer science to do good not to harm.
I got 4 links for you (satire but still true):

https://motherfuckingwebsite.com/

http://bettermotherfuckingwebsite.com/

https://thebestmotherfucking.website/

https://perfectmotherfuckingwebsite.com/

Enjoy :)
> To not leave you hanging: Intel has an official x86 encoder/decoder library called XED. According to Intel’s XED, as of this writing, there are 1503 defined x86 instructions (“iclasses” in XED lingo), from AAA to XTEST (this includes AMD-specific extensions too, by the way). Straightforward, right?

Hopefully this will have either saved you a click or validated your time in reading the article.
see my other comment to the GP. pulling the wool suggests agency and intentionality that isn't necessarily present when you have disciplinary differences like you describe. Simple miscommunication, e.g., using totally normal field terminology that does not translate well, is different.
> We believe that an effective an immediate action would be to update the code of conduct of OSS, such as adding a term like, "by submitting the patch, I agree to not intend to introduce bugs."

Do the authors of this study honestly believe that the reason malicious actors intentionally introduce security vulnerabilities in software is because the "code of conduct of OSS" doesn't prohibit it? Do the malicious actors read the code of conduct and think, "Oops, I can't be malicious here, I'll try somewhere else".
It's unclear what's the pros are of Prisma compared to TypeORM. I do find it confusing I always thought Prisma was GraphQL related.
Thank you very much for your comment. Can I get free SSL! We would like to thank you for your valuable information.
> from a hacker ethos perspective, none of this was unethical.

It totally is if your goal as a hacker is generating a better outcome for security. Read the paper, see what they actually did, they just jerked themselves off over how they were better than the open source community, and generated a sum total of zero helpful recommendations.

So they subverted a process, introduced a Use After vulnerability and didn't do jack shit to improve it.
> It took me all of 1 hour to learn how to use prisma. It’s not as hard as you make it seem.

That's because the ORM cannot do a lot. Unless you're doing extremely simple SQL queries it will not handle what you want it to do. Now what? Drop into RAW sql and lose all type safety and you are on your own.

No thanks, I started using Prisma for https://listifi.app and switched it over to knex.js because the second I hit a query that Prisma couldn't handle I was on my own. Knex on the other hand could handle everything because it's a simple query builder.
There is no doubt that Kangjie is involved in Aditya's research work, which leads to bogus patches sent to Linux devs. However, based on my understanding of how CS research groups usually function, I do not think Kangjie knew the exact patches that Aditya sent out. In this specific case, I feel Aditya is more likely the one to blame: He should have examined these automatically generated patches more carefully before sending them in for reviewing.
Show HN: Instant Vitals – Easily track your Web Vitals metrics
Could someone comment why the response times are faster? Is it entirely a question of which CPU is used or does it have to do with something else?
That extra layer gives them flexibility to combine queries and cache
It is. The OP was likely confused with a tool or had a specialized use case tied to Windows that they're not communicating. All the official guides for getting started work. Using specialized tools or components meant for Windows development (e.g., Type Providers not ported to support .NET Core)on a different OS may not work so well.
Not being nice is always to protect self. Not always effective though, and not always necessary.
If it would be my univ, I'd send a personal email to the dean. https://cse.umn.edu/college/office-dean#:~:text=Dean%20Mosta....

If enough grads do that, I would expect the university will do something about it, and that would send a message. It's about where the money comes from in the end; (tuition, grants, research partnerships etc) IMO none of these sources would be very happy about what might amount to defacement of public property and waste of the time of people that are working for the good of mankind by providing free tools(bicycle of the mind) to future generations.

There is no novelty in this research; bad actors have been trying to introduce bad patches for as long as open source has been open.
“Any man who must say 'I am king' is no true king at all.”

-GRRM
You haven't seen a question closed as a duplicate when it was clear that time or details had made the linked question not an actual duplicate?
But it is juvenile hijinks, and did turn out to be patently false.

> The NY Times headline includes relevant details to inform the reader.

Lets see which details were no longer relevant once the story turned out to be false, and the Times (to their credit, unlike the Mail) changed the headline to reflect that:

Update: Virginia Girl Recants Story of Assault, and Family Apologizes - https://web.archive.org/web/20191001003852/https://www.nytim...
Is browsing HN a professional setting?
Clubhouse's Monthly Downloads Plunge 72%
Hi everyone, my colleagues and I have recently been tackling Core Web Vitals [0] and we came up with an effective approach for identifying problems and improving our scores. Basically, we listen for web vitals metrics events in Chrome, convert any HTML elements to actionable XPath queries, and store the metrics in BigQuery.

We thought the community would benefit from a tool that does this so we spun the work out as an open source tool called Instant Vitals [1]. I hope others find this work helpful and we’re happy to receive feedback and contributions!

[0] https://web.dev/vitals/

[1] https://github.com/InstantDomainSearch/instant-vitals
MBP 2019 with a sub-100 cycles battery burns almost half the battery over one hour Zoom call.
It's just a silly way of showcasing capability. No one thinks this is a useful project. It's just impressive that it's possible.
Attacking those critical of your questionable behavior and then refusing to participate further is a common response people have when caught red handed.

This is just a form of "well I'll just take my business elsewhere!". Chances are he'll try again under a pseudonym.
As a side note to all of the discussion here, it would be really nice if we could find ways to take all of the incredible linux infrastructure, and repurpose it for SeL4. It is pretty scary that we've got ~30M lines of code in the kernel and the primary process we have to catch major security bugs is to rely on the experienced eyes of Greg KH or similar. They're awesome, but they're also human. It would be much better to rely on capabilities and process isolation.
My parents got an M1 mba a few days ago. When they asked my advice about getting a new laptop they got an earful, and then the favour was returned when I listened to my flabbergasted dad explain to me how his bank website now renders instantly compared to 15 seconds on his old mba.

It’s hard to quantify what portion of the so called tech-illiterate have a tech literate person in their lives who they go to for purchasing advice, but anecdotally I must provide decisive “wait until September” or “nows a good time to buy and here’s why!” advice to at least a dozen or relatives and friends.

It’s also why the butterfly keyboards or the mdns debacle can end up being a drag on sales. I’m very bullish on Mac market share in the next couple of years due to pent up demand from family members being advised to hold on to older machines.
There are always the BSDs if something happens. Not quite as popular, but the major ones are good enough that to take over completely. (as in if you thought someone would kill you for using Linux you can replace all your linux with some BSD by the end of the day and in a month forget about it) Don't take that as better - that is a different discussion, but they are good enough to substitute and move on for the most part.
Archaeologists Solve a Decades-Old Harriet Tubman Mystery
Sure. And we are well past the time in which we need to develop real legal action and/or policy -- with consequences against this sort of thing.

We have an established legal framework to do this. It's called "tort law," and we need to learn how to point it at people who negligently or maliciously create and or mess with software.

What makes it difficult, of course, is that not only should it be pointed at jerk researchers, but anyone who works on software, provably knows the harm their actions can or do cause, and does it anyway. This describes "black hat hackers," but also quite a few "establishment" sources of software production.
Whether you support City or United has been a cultural thing going back 100 years. It kind of defines you and where you fit in. I know some people that have had season passes for City for 50+ years, passed down from father to son. It is totally part of their identity.

Geography only plays a small part of this.
Not sure. From what I read they've successfully introduced a vulnerability in their first attempt. Would anyone have noticed if they didn't call more attention to their activities?