skysight-inc/HackerNews huggingface dataset:
Is there a more readable version of this available somewhere? I really struggle to follow the unformatted mailing list format.
Are you not worried that a Chinese company will take the designs and flood Aliexpress with new espresso machines?
Probably ask the maintainers to consent and add some blinding so that the patches look otherwise legitimate.
Interesting story, but I'm a little unsympathetic. The "victim" is as contract-ey/legal-ey as the aggressor.
> Would it be okay to try and prove the vulnerability of a country's water supply by intentionally introducing a "harmless" chemical into the treatment works, without the consent of the works owners?

The question should also be due to who's neglect they gained access to the "water supply". If you also truly want to make this comparison.
Dominion is a great example of this. For most games (depending on which cards are played there may be differing victory conditions) the way you win the game is by obtaining Province cards and adding them to your deck. These are worth a lot of points, but have no actual utility in the game (where most of the cards you are adding to your deck let you do things like draw more cards or gain resources). So as you get closer to winning, the composition of your deck becomes worse and worse, and you become less and less likely to be able to purchase more Provinces.
uest11
Top Services to Use for Serverless Cloud Development
> You do not experiment on people without their consent.

Applied strictly, wouldn’t every single A/B test done by a product team be considered unethical?

From a common sense standpoint, it seems to me this is more about medical experiments. Yesterday I put some of my kids toys away without telling them to see if they’d notice and still play with them. I don’t think I need IRB approval.
Perhaps I'm missing something obvious, but what's the point of all this subterfuge in the first place? Couldn't they just look at the history of security vulnerabilities in the kernel, and analyze how long it took for them to be detected? What does it matter whether the contributor knew ahead of time that they were submitting insecure code?

It's seems equivalent to vandalising Wikipedia to see how long it takes for someone to repair the damage you caused. There's no point doing this, you can just search Wikipedia's edits for corrections, and start your analysis from there.
> You do not experiment on people without their consent.

By this logic eg. resume callback studies aiming to study bias in the workforce would be impossible.
Hello! PhD student on quantum computing here. While it's cool that the field of QC raises excitement and there are efforts to promote QC to a more general public, it's always a little frustrating to see these approaches that, in a sense (and in my opinion), seriously underplay the difficulty and distance of the field from computer engineering. While it's true that it's an incredibly interdisciplinary field, which can be studied from a Physics, CompSci, EE, etc., perspective, it's definitely its own field, and not a new framework or programming language. I think this reflects heavily on the fact that a lot of QC programming languages peddled by the main industry players hide a lot of stuff behind opaque API calls.

The thing is (again, imho!) it wouldn't have made sense to talk about frameworks when the first classical computers appeared --- and you'd better have knowledge about the hardware and theory. (These are still a good idea to know but not really a requirement anymore.)

Likewise, I think that for the next decades, anyone who wants to meaningfully contribute to QC (rather than call a few API functions) will have to read some technical stuff (my recommendations are [1] as a semi-informal approach, [2] for a CS approach, [3] for an algorithm overview, and [4] as the reference book).

Sorry for the minor rant :)

[1] https://www.cambridge.org/catalogue/catalogue.asp?isbn=97811...

[2] Ethan Bernstein, & Umesh Vazirani (1997). Quantum Complexity TheorySIAM Journal on Computing, 26(5), 1411–1473.

[3] https://www.springer.com/gp/book/9783030190651

[4] https://www.cambridge.org/pt/academic/subjects/physics/quant...
It's not like Google or Twitter ("tweeting" something) is any more serious. They just established themselves in the public consciousness earlier.
Someone should track the dislikes on this over time, eg: https://81m.org

(Note clicking a vid shows more detail, eg:
https://81m.org/videos/juH2Mfre_oM/ )
Yeah I guess it’s time for dogs to have their own iPhones.
> And it actually seems implausible that a genetic mutation would produce a language "organ" as it would confer no advantage to an individual in a society where your peers had no language skills.

It could evolve primarily for internal thought first, or have some other benefit for enhancing existing systems of vocalized mimicry (for hunting, and maybe other uses).
> There are pointers without pointer arithmetic, I really don't know why they are there.

Because you need some way to distinguish between having a sequence of bytes in the middle of another sequence of bytes and having the former sequence of bytes somewhere else, at least in languages that allows both for any data type. For example, Java doesn't suffer from this since everything is pointers implicitly. And C# doesn't either because every type belongs to one of two kinds, the first kind corresponding to the former of the two cases above and the second kind corresponding to the latter. But Go doesn't have this luxury (intentionally, for the same reason as C does it).
They've actually done that in a psychology study. As in real life, the people with the advantage start inventing reasons why they deserved that advantage, and that it's really fair.

My memory might be inaccurate.
They sound better. "DuckDuckGo" sucks. It's even annoying to write.
It is worrying to consider that in all likelihood, some people with actually malicious motives, rather than clinical academic curiosity, have probably introduced introduced serious security bugs into popular FOSS projects such as the Linux kernel.

Before this study came out, I'm pretty sure there were already known examples of this happening, and it would have been reasonable to assume that some such vulnerabilities existed. But now we have even more reason to worry, given that they succeeded doing this multiple times as a two person team without real institutional backing. Imagine what a state-level actor could do.
Yeah, Apple is definitely the best company name ever invented. /s
Not sure why you think they proved that. Human review was done on the same day the patch was submitted and pointed out that it's wrong: https://lore.kernel.org/linux-nfs/20210407153458.GA28924@fie...
Nothing is perfect, but is it better than not having any eyes? If anything, this shows that more eyes is needed.
>Prisma is not a community-project but built by a VC-funded company

Thanks for clarifying this. I know there tend to be a kneejerk reaction towards VC-funded software projects. How do you guys plan to make money on this?
I LOVE Prisma. I’ve used Django, SQLAlchemy, Sequelize, Knex, and TypeORM in the past. all had rough edges that continually frustrated me or didn’t provide the functionality i needed.

Prisma is different. It’s absolutely got rough edges, but the extremely strong type safety makes Sequelize look like a joke. The query engine itself, written in rust, combines and optimizes queries inside every tick of the event loop so GraphQL N+1 issues are a thing of the past.

Also, the team and community behind it are amazing! I never thought having an active dev community behind an ORM would be important, but as the author of Sequelize-Typescript was forced to abandon it late last year and the author of TypeORM was also pretty much absent, Prisma was a breath of fresh air. I REALLY hope they can find a way to build a sustainable business out of it. Support packages, feature development contracts, something to keep them financially incentivized to keep making it better.

Happy to answer any questions about my experience using it if anyone has any.
that's pretty hyperbolic. it's not "starting a civil war" it's leveling the playing field against those who are already brutalizing the population.
Someone does voluntary work and people think that gives them some ethical privilege to be asked before someone puts their work to the test?
Sure it would be nice to ask but at the same time it renders the testing useless. They wanted to see how the review goes if they aren't aware that someone is testing them.
You cant do this with consent.

The wasting time argument is nonsense too its not like they did this thousands of times and beside that, reviewing a intentional bad code is not wasting time is just as productive as reviewing "good" code and together with the patch-patch it should be even more valuable work. It not only or adds a patch it also make the reviewer better.

Yeah it aint fun if people trick you or point out you did not succeed in what you tried to do. But instead of playing the victim an play the unethical human experiment card maybe focus on improving.
You're not going to get anywhere with the truth in this environment (HN or similar). They're all amoral and they can't comprehend what morality is... Everything is about their communistic utopian future. That's why SF, the most progressive & rich part of the USSA, has the most degeneracy & homelessness. US doesn't have real elections but complaining about places far from home allows them to yelp loudly with their fingers in their ears. As someone who has been to the places in question, the east is idyllic in comparison with the western cities. Actually, the main problems in the east are mostly left over trauma from last time they had communist rule. Exit USSR, enter USSA ;)
You don't protect civilians by letting a mad genocidal regime mow down unarmed people with machineguns.

The civil war is already de-facto going. People who tell to do nothing make peoples' of Belarus suffer in agony for longer.

Look at Yugoslavia. You would've been still seeing Milosevic's smiling face from TV if not NATO, and EU not only arming Bosnians, but forcing the conflict, and bringing it to a boiling point.

Only then the crazed genocidal generals started to actually feel... fear. And it was it what allowed for a relatively bloodless ouster of Milosevic in 97.
> There doesn't have to be a way.

Given the importance of the Linux kernel, there has to be a way to make contributions safer. Some people even compare it to the "water supply" and others bring in "national security".

> they are justified to be annoyed at having their time wasted, and taking measures to discourage and prevent such malicious behaviour in the future.

"Oh no, think of the effort we have to spend at defending a critical piece of software!"
Can you tell me more about how you can borrow money in minutes? This I want to hear.
1. Don't rename your columns, but if you have to

2. project search and replace on $COLUMN_NAME

If your column name is a common keyword, variable name, etc. in your code base and it's difficult to find using project search, that's unfortunate, but we organize our backend code and tests in a logical enough way that it's never taken longer than an hour to create a PR to create a migration to rename a column and update all places in code that reference it.
Pulumi also allows storing state yourself in different backends [1]. The SaaS is a convenience.

[1] https://www.pulumi.com/docs/intro/concepts/state/
The past form would be tweeted, no?
https://github.com/gajus/slonik
For a typed language completion like Intellisense is a very important tool for any developer. There is limited completion support available in VS Code. If you want a proper IDE for .NET on Linux, try out JetBrains Rider. It is not free, but great.

I don't understand what you dislike about the API documentation Microsoft provides with .NET, it's not always perfect, but I would say it has nearly 100% coverage: https://docs.microsoft.com/en-us/dotnet/api/

And because .NET used to be Windows only there are a lot of Windows tutorials. But you can anyway skip them, as they mostly describe the old .NET 4.x. Find newer .NET Core tutorials. Even if they provide you screenshots of Visual Studio on Windows, you can do all of it with any text editor. Some scaffolding you maybe need to do on the command line.
Why not?
The poor thief is just trying to support his 20 orphan kids.
People should feel honored when they are robbed and left for dead.
Or it could be a realization by founders that design skills have commoditized enough that specialist designers do not provide enough incremental value.

It could be, yes. Another possibility is that most founders have so little knowledge of good design and what it can do that most of them don't even consider whether it can be used to their advantage. I suspect there is some truth in both of these theories.

Some examples that come to mind immediately are Apple, Tesla and Ubiquiti, all of which have been successful despite entering established markets where huge incumbents had vast resources available to compete. That success came after the newcomers introduced more "designer" hardware products that offered slick user experiences, making the competition look old and clunky by comparison, and giving the newcomers enough of an edge to disrupt the market. Something else that is noticeable about all of those companies is that they have built extremely loyal customer bases, which have endured even when they've had problems with products and despite their relatively high prices.

It seems to be accepted wisdom among much of the startup community that a business like Apple is unique and there is no point trying to follow the same strategy because we can't all be Steve Jobs or Jony Ive. Maybe a few more founders should be asking, why not?
Absolutely not true. The UK Government paid for the AZ vaccine to be developed and then stipulated as part of the contract that it must be made available at cost to developing countries.

The EU on the other hand keeps seizing vaccines produced for other countries.
It was bought by Stripe four years ago[1]. No idea if or how that’s related with what you’re observing.

[1]: https://www.indiehackers.com/blog/acquired-by-stripe
Which shows that IEEE also has a problem with research ethics if they accepted such a paper.
It more shows up a very serious problem with the incentives present in scientific research and a poisonous culture which obviously seems to reward malicious behavior. Science enjoys a lot of freedom and trust from citizens but this trust must not be misused.
If some children playing throw fireworks under your car, or mix sugar into the gas tank, just to see how you react, this would have negative community effects, too. Adult scientists should be totally aware of that.

This will lead in effect to that even valuable contributions from universities will be seen with more suspicion and will be very damaging in the long run.
“Hurrah for the Blackshirts”. Not a headline that aged well, even in the relatively short term.
But this is all a lie. If you read the linked thread you till see that they refused to admit to their experiment and even sent a new, differently broken patch.
I'm wondering at the moment whether Knex (solid query builder and migration) and Objection.js would not do this trick. That combo seems to give me json validation which is nice and seemingly both a way to handle entities and graphs in an efficient way.
> Have things improved since this article was written?

Yes.

> Are intrinsics best avoided?

No.

---

If you are writing assembly code by hand, you probably care about the quality of the generated code.

Intrinsics are lower effort, portable, and can and often do generate much better code than using inline assembly.

I disagree with the claim that verifying the assembly output of an intrinsics is more work than writing assembly code by hand. In my experience, it is significantly less work.

I also disagree with the post about what to do if an intrinsic doesn't generate good code.

"Tweak the intrinsic until you get a reasonable result" is probably the worst thing you can do, because once the intrinsic is fixed, your tweaks might prevent it from generating good code.

The two things you can and should do are:

- report the bug, so that it gets fixed (1-2 days for clang.. fixing an intrinsic is just adding a new "case" in a pattern matching table, writing down what instructions it should lower too... worst case you can fix this yourself if you know what it should lower to...),

- if you can't live with worse code till the next compiler release, use inline assembly.

This second point is super rare. Its just not worth it. Intrinsics are usually fixed in a couple of days if you report the bug, and the fixed intrinsic will be in the next compiler release in a couple of months if you can't use the nightlies. So unless you really need this now, this is often not worth doing.
We should ban A/B testing then. Google didn’t tell me they were using me to understand which link color is more profitable for them.

There are experiments and experiments. Apart from the fact that they provided the fix right away, they didn’t do anyone harm.

And, by the way, it’s their job. Maintainers must approve patches after they ensured that the patch is fine. It’s okay to do mistakes, but don’t tell me “you’re wasting my time” after I showed you that maybe there’s something wrong with the process. If anything, you should thank me and review the process.

If your excuse is “you knew the patch was vulnerable”, then how are you going to defend the project from bad actors?
Loved the Thelma and Louise connection!
Just keep hitting the "next" link to follow the thread.
How Do I Get a Phone Number List for SMS Marketing?
I would have never clicked on an affiliate link. So no harm done by that logic.
Compute cuter: a guide to cute-ifying your computer
The concept of the research is quite good. The way this research was carried out, is downright unethical.

By submitting their bad code to the actual Linux mailing list, they have made Linux kernel developers part of their research without their knowledge or consent.

Some of this vandalism has made it down into the Linux kernel already. These researchers have sabotaged other people's software for their personal gain, another paper to boast about.

Had this been done with the developers' consent and with a way to pull out the patches before they actually hit the stable branches, then this could have been a valuable research. It's the way that the research was carried out that's the problem, and that's why everybody is hating on the researches (rather than the research matter itself).
Regardless of the discussion here, the biographical part of "don't sleep, there are snakes" is a rather good read.

I was only 19 then, but I remember liking it a lot.
How is Prisma's support (if any) of Mongo? I use it in combination of Postgres for prototyping and I'm wondering if they play well together.
Isn't a/b testing usually things like changing layout or two things that....work as opposed to bugs?
That's kind of the rub. They used a university email to exploit the trust afforded to them as academics and then violated that trust. As a result that trust was revoked. If they want to submit future patches they'll need to do it with random email addresses and will be subject to the scrutiny afforded random email addresses.
On the cusp of the transition, I attended a music festival with a couple of friends. They both had modern smartphones, I had something closer to an old-school feature phone. At some point on what was probably the first day, we all went to the phone charging tent. They stayed there for an hour or two with their phones plugged in. I walked in and walked back out again immediately, with a fresh battery for my phone handed over to me for free.

I do like having a thin phone, but the utility of a replaceable battery has been sorely downplayed over the years.
> There are a lot of performance benefits with writing everything yourself instead of using 3rd-party libraries.

In my production experience correctness always trumps speed.

And language parsing is not a trivial task. Not every programmer can write a program to do it well (and fast). I know that so far I am not one of the programmers who can, for example.

I prefer to defer to the expertise of those who do it for a living and/or their academic pursuits (as long as they write clean and maintainable code).

So while the general point you quoted can absolutely be viable in many situations -- I've wrote stuff from scratch no small amount of times so I definitely can relate -- the original point here was language parsing where I believe your (and Evan's) take is prioritizing idealism to reality. And the reality is, most programmers aren't good with this stuff, and that's okay.

As for him and esbuild, I only have huge respect to show. But he's one of the few, not one of the many. He should be doing that and he did it very well (I use esbuild and adore it).
I have adopted Prisma in my latest project and I have mixed feelings about it.

- The generated client is top-tier. Fully specified in TypeScript with intelligent types that can be extended by the user.

- The schema language is great. It provides a cohesive experience that can fully express your database structure, and it also provides a migration framework to manage that structure's evolution.

- There's no hook for implementing access control at the model level, so you end up needing to create a higher-level API around the base queries to implement these yourself, which is a fairly large investment. I'd love to see a pair of functions that can modify the query before it gets sent to the Prisma engine to add extra query values, and a second function that can filter models before they are returned to the caller.

Where Prisma falls short is in testing. The testing story in Prisma is that you can either use a live database, or you can completely stub out all calls to Prisma in your application. The latter means you end up writing a bunch of tests for implementation rather than for behavior, or you end up manually writing an in-memory database that fits the Prisma API. The former means that you need to completely recreate your database after every test case.

The discussions on the Github seem to indicate that the old "wrap the test in a transaction" trick is forbidden, and Prisma seems architecturally set up to ensure that you can't even hack this behavior in.

All in all, we probably won't switch away from it, but I will continue to look for a better way to test my endpoints.
It's valid, just clunky to get going the first time. F# dev team is only ~7 people at MS, the rest is community supported projects and github issues. So while F# devs measure in the 10,000s, C# devs measure in the 100,000s
I didn't tell my company back then when I was working at the office that due to our open space offices, I was wasting around 3h/day due to difficulties to focus (and, well, mainly because I can't actually get 8h straight of focused time).

So, no, I haven't changed my mind: I'm still not telling my company that I don't get 8h/day of focused work.

Regarding appearing online: I couldn't care less (so no, I don't appear to be online).
> Someone does voluntary work and people think that gives them some ethical privilege to be asked before someone puts their work to the test?

Yes. Someone sees the work provided to the community for free and thinks that gives them some ethical privilege to put that work to the test?