skysight-inc/HackerNews huggingface dataset:
It's important to note that they used temporary emails for the patches in this research. It's detailed in the paper.

The main problem is that they have (so far) refused to explain in detail how the patches where reviewed and how. I have not gotten any links to any lkml post even after Kangjie Lu personally emailed me to address any concerns.
The professor gets exactly what they want here, no?

"We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time".

That'll be a fun paper to write, no doubt.

Additional context:

* One of the committers of these faulty patches, Aditya Pakki, writes a reply taking offense at the 'slander' and indicating that the commit was in good faith[1].

Greg KH then immediately calls bullshit on this, and then proceeds to ban the entire university from making commits [2].

The thread then gets down to business and starts coordinating revert patches for everything committed by University of Minnesota email addresses.

As was noted, this obviously has a bunch of collateral damage, but such drastic measures seem like a balanced response, considering that this university decided to _experiment_ on the kernel team and then lie about it when confronted (presumably, that lie is simply continuing their experiment of 'what would someone intentionally trying to add malicious code to the kernel do')?

* Abhi Shelat also chimes in with links to UMN's Institutional Review Board along with documentation on the UMN policies for ethical review. [3]

[1]: Message has since been deleted, so I'm going by the content of it as quoted in Greg KH's followup, see footnote 2

[2]: https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah...

[3]: https://lore.kernel.org/linux-nfs/3B9A54F7-6A61-4A34-9EAC-95...
> You need to compare what happens with vulnerabilities in OSS vs in proprietary.

Yes, you do need to make that comparison. Taking it as a given without analysis is the same as trusting the proprietary software vendors who claim to have robust QA on everything.

Security is hard work and different from normal review. The number of people who hypothetically could do it is much greater than the number who actually do, especially if there isn’t an active effort to support that type of analysis.

I’m not a huge fan of this professor’s research tactic but I would ask what the odds are that, say, an intelligence agency isn’t doing the same thing but with better concealment. Thinking about how to catch that without shutting down open-source contributions seems like an important problem.
> For something where extremely small size is an essential feature (unlike a laptop computer)

Say that to someone traveling for work.
I will not adress everything but only this point:

Before a patch is accepted, "auditability" is the same in OSS vs in proprietary, because both pools of engineers in the review groups have similar qualifications and approximatively the same number of people are involved.

So, the real advantage of OSS is on the auditability after the patch is integrated.
>they ultimately were trying to break the security of my computers.

No they weren't. They made sure the bad code never made it in. They are only guilty of wasting peoples time.
It's just a prank bro!
Same - I'm in IT, and like our nobble compatriots mushroom & shrubery growers [1], I'm not entitled to Overtime in Ontario :)

1: https://www.ontario.ca/laws/regulation/010285#BK20
using `new PrismaClient({ log: ["query"] });` it'll log all the actual sql queries it's running, so you'll be able to see if queries are being combined
I agree.

That statement is so wrong. All ORMs suffer from leaky abstraction. And good ORMs would never hide that fact, nor would they try to deny native access to the database and force a all-or-nothing principle onto the developer.

If "application developers" care about data that is stored in a relational database, they have to care about the database itself and the access patterns (SQL).

ORMs _only_ provide convenience! They cannot substitute knowledge about the underlying technologies. And they cannot hide complexity, but shift it to the ORM.
If you actually read the PDF linked in this thread:

* Is this human research? This is not considered human research. This project studies some issues with the patching process instead of individual behaviors, and we did not collect any personal information. We send the emails to the Linux community and seek community feedback. The study does not blame any maintainers but reveals issues in the process. The IRB of UMN reviewed the study and determined that this is not human research (a formal IRB exempt letter was obtained).
The paper indicates that the goal is to prove that OSS in particular is vulnerable to this attack, but it seems that any software development ecosystem shares the same weaknesses. The choice of an OSS target seems to be one of convenience as the results can be publicly reviewed and this approach probably avoids serious consequences like arrests or lawsuits. In that light, their conclusions are misleading, even if the attack is technically feasible. They might get more credibility if they back off the OSS angle.
even if they didn't, they waste the community's time.

I think they are saying that it's possible that some code was branched and used elsewhere, or simply compiled into a running system by a user or developer.
The Spanish club Real Madrid is mentioned:

> But Kroenke, Henry and the Glazers, believed to be the ringleaders of the Super League fiasco along with Real Madrid’s Florentino Perez, badly miscalculated.
So FOSS is insecure if maintainers are lazy? This would hold true for any piece of software, wouldn't it?
The difference here is that even though the "hypocrite commits" /were/ accepted, they were spotted soon after. Something that might not have happened quite as quickly in a closed source project.
Exactly, they are just seem mad and blame other for "wrong doings" instead of acknowledging that they need to improve.
> They could perform analysis of review/acceptance by looking at past patches that introduced bugs without being the bad actors that they apparently are.

Very good point.
There are pretty extensive docs on how Prisma optimises n+1 queries: https://www.prisma.io/docs/guides/performance-and-optimizati...
> More capacity => More journeys => More fatalities. Dead people aren't dead "per traveller mile" they're just dead.

This is overly simplistic - it’s not useful to quote “number dead” without considering the quantity.

By just the “number dead” metric, bull fighting or skydiving would be safer than a game of football. It only really makes sense when you consider (deaths from football / games of football played) vs (deaths from bull fights / number of bull fights) which is when we find that bull fights are actually more dangerous!

We could also say the same with surgeries: the more surgeries that are carried out the more deaths by surgery there are, but it doesn’t follow that this means that we should stop doing surgeries.
Are you suggesting that Google would censor Google Search search results relating to Google's censorship of Google Search search results? If so, could you provide a source?

A quick search I imagined doing (I even imagined that I used a VPN) turned up 10,000,000 results, 49 of which were news articles from the last 15 years detailing what, but not how, Google Search search results were censored. When I imagined clicking "Next" to see the rest of these results, I imagined that I was presented with a No CAPTCHA, asking me to identify which colored block of visual noise most closely resembled hell itself.

Edit: Oh, and then I did the search for real, and got 4.95m results of similar composition.
Maybe for employees, but usually it is a contractor of a contractor in some outsourced department replacing your employees. I'd argue that in such common situations, you are worse off than with randos on the internet sending patches, because no-one will ever review what those contractors commit.

Or you have a closed-source component you bought from someone who pinky-swears to be following secure coding practices and that their code is of course bug-free...
Trust is currency. Trust is an asset.
I’m not too familiar with LISPs, but that would only be the case with greedy evaluation, wouldn’t it?
An appropriate place to make a report: https://compliance.umn.edu/
I’ve used one for a couple years, and it’s been fantastic. I only wear it at night as a sleep tracker.

After the first ~year and a half of use the battery would no longer hold a charge for more than one day, but I got in touch with their support team and they sent me a brand new ring for free, no questions asked. Now the battery lasts about a week.

In terms of its accuracy as a sleep tracker, obviously no consumer-grade wearable is going to be as good as a sleep study in a lab with full EEG, but I’ve seen anecdotal reports on Reddit of people comparing the Oura ring to the Dreem (an EEG headband), and saying that the two report surprisingly similar sleep phases and durations. It has seemed pretty accurate to me.

The real kicker for me was when I experienced an episode of De Quervain’s Thyroiditis earlier this year and it induced symptoms of hyperthyroidism. Over the course of a few weeks, I watched my resting heart rate overnight rise 60% above my baseline, I watched my HRV and sleep quality overnight plummet, I watched my body temperature increase - this correlated perfectly with frequent blood work that showed extremely elevated levels of thyroid hormones (free T3 and T4). My doctor started me on a beta blocker to control some of the worst symptoms. Gradually as my thyroid recovered, I could watch my overnight heart rate come down, and my HRV and body temperature return to baseline, and use the very accurate data from my ring to help taper off of the beta blocker (with my doctor’s approval).

That specific example aside, in normal daily use I find that the Oura helps me stay in better touch with my body - quantitatively measuring little differences in the status of my body in response to behaviors (food, exercise, alcohol, etc.) that I might otherwise not have even noticed. I highly recommend giving it a try.
I think it's easier than this. The Blockchain should be able to calculate the velocity of money just by the amount of currency flowing in the last x blocks. That alone should do it.

There's also some potential for a bond-market whereby miners BID for bonds, and thus the Blockchain can determine the community expected future inflation rate, and factor that into its calculation of money supply growth.
“Odds are, you ARE behind.“

The rank for strongest person goes in one direction, the rank for weakest person goes the other. To say your behind suggests a preferred and ranked ordering, that’s reasonably true of checkout lines at the grocery store. However it’s not so for total body weight as neither 50lbs nor 500lbs is the ideal adult body weight.
> > Should we assume that every patch was submitted in bad faith and tries to sneakily introduce bugs?

>

> Yes, especially for critical projects?

People don't act that way I described intentionally, or because they are dumb.

Even if you go in with the greatest paranoia and the best of intentions, most of the time, most of the other people don't act maliciously and your paranoia eventually returns to a reasonable level (i.e. assuming that most people might not be malicious, but also not infallible).

It's a kind of fatigue. It's simply human. No matter how often you say "DUH of course they should".

In my entire life, I have only met a single guy who managed to keep that "everybody else is potentially evil" attitude up over time. IIRC he was eventually prescribed something with Lithium salts in it.
How do you type graphql with typescript?
I've tried Prisma, TypeORM and MikroORM and I'm certainly the most impressed with MikroORM.

It's simple and the use of identity map within a unit of work, tied to a request context (for example), is just brilliant.

The handling of relations (with configurable loading strategies) and other features such as Embeddables and Filters make it a real joy to use.

And if at any point I can't achieve something with MikroORM itself (which generally in my case is calling a PostgreSQL function), I can easily grab the underlying Query Builder from Knex.

It also has the tooling to generate a schema from your Entities, or generate Entities from an existing schema - so it's easy to get started on something new or existing.
Under the Boardwalk: The Monopoly Story is a fun documentary that talks about origin of the game, including The Landlord’s Game, and also includes a fair amount of coverage of a national and international tournament.

https://www.imdb.com/title/tt1250861/

I would have liked it to dwell more on the roots and the meta-level of what the game is trying to say, and how that seems to be missed by most people who play it. But was still a fun watch on a lazy weekend day.

Streaming free on Amazon Prime right now: https://watch.amazon.com/detail?gti=amzn1.dv.gti.1cad6f64-66...
Awesome, thanks!

Turns out Prisma wasn’t optimizing my queries, I think it has to do with me not using the sub query API and instead querying tables seperately (e.g posts.findMany({ where: { owner: user } }))
Yes. I removed a lot of my ranting accordingly. Thanks, and sorry.
Show HN: An Alternative RSA SecurID 2FA Client for iOS and Apple Watch
I’m sorry, you have a child and didn’t know button batteries (or batteries in general) were dangerous? Is there not a clear choking hazard and the knowledge it’s filled with toxic/hazardous chemicals? This should be common sense.
My take- Photoshop was relatively novel at the time, and motion blur was one of the earliest filters. Do this at varying levels for a few frames and you’ve got yourself an eye-catching animated gif with minimal effort.
“They’re trying to commercialise the sacred game of football that I already pay £1200 a year to watch on television”

Said in a muppet voice.

Edit: I guess ultimately it’s the weakness of being a fanatic about anything that isn’t yourself or your loved ones. Some smart business people realised thirty years ago that there was a massive consumer surplus in football fandom and set about capturing it.

Judging by the way fans vote with their hard earned money I’d say there’s still more to be captured. But the idea that the current FIFA governed world of football is some sort of pristine old-growth forest threatened by commerce is just ludicrous.
I am a former PHP developer, absolutely loved Laravel and adored Eloquent as the ideal ORM. I switched to Node/JavaScript in 2015 and have been chasing a good ORM since, nothing could ever compare with Eloquent in Nodeland, I all but gave up and started building my own, in TypeScript to match Eloquent as much as possible.

Then Nikolas Burk reached out to me and did his absolute best to convert me, but I was stuck in my ways, it HAD to behave like Eloquent, or it was not good enough and that DSL layer? No thanks, I don't like it.

Started writing code for my own ORM when I was like "What the heck am I doing? this gets me nowhere" And messaged Nikolas back saying I was dropping everything and planned to give Prisma a real solid try.

I'm so glad I did. I LOVE it now. I consider it a part of my GOAT stack.
So how does this differ from the Sokal hoax thing?
Thanks for your insight that gives me a good idea of what it's like. It does seem that to make more you have to be more client facing and less of a developer which is not what I'm looking for. Specializing is something I also think it should have better payoff.
> It shows there is a problem with the review process if it is not catching 100% of this garbage.

Does that add anything new to what we know since the creation of the "obfuscated C contest" in 1984?
> We should ban A/B testing then. Google didn’t tell me they were using me to understand which link color is more profitable for them.

Yes please.
Scalability is probably a concern for a lot of people, but it still doesn't make it the point of the demo. They want to show that their service is capable of even running a workload so classically local and native as a full game with half-decent latency only using edge functions. And it's a mystery why you bring up streaming and CDNs. If you think that a 4K stream poses the same challenges as stateless, real-time, non-cacheable game engine processing targeting 60 req/s, then I don't know where to start.
It is great, I have claimed my VMs running Netdata to the Netdata Cloud and I am very happy with it! Took me only a few minutes to claim them all (11 VMs) and boom the dashboards were ready out of the box.
Europe proposes strict regulation of artificial intelligence
> You know where ...if you don't answer police questions, you must be guilty? China.

Are they our role-model now? Should we destroy our own principles in this case because that's what they would do?
Apparently, they were and did not care.
> Were we under the impression that it's impossible to introduce new (security) bugs in Linux?

I've heard it many times that they're thoroughly reviewed and back doors are very unlikely. So yes, some people were under the impression.
This runs super well for me.
Looking at chrome developer tools it's sending out a new frame request about every 38ms.
Runs much nicer than the top two google results for "play doom online".
It's more than that, if there is no consequences for this kind of action, we are going to get a wave of "security researcher" wannabes trying to pull similar bullshit.

Ps: I have put security researcher in quotes because this kind of thing is not security research, it's a publicity stunt.
University students could be naive and could be rapped by community if they unintentionally commit harmful patches, but if they send intentionally harmful patches, maintainers can report them to university and they risk getting expelled.
In this particular case the research was approved and encouraged by university and hence, and in this process they broke trust placed on university.
Yes it does -- one of the great parts about Rust. There are lots of projects out there slotting rust into other languages and getting crazy speedups.

- https://doc.rust-lang.org/reference/linkage.html

- https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#call...
This research is specifically about getting patches accepted into open source projects, so that wouldn't work at all.
I'm pretty confident the NSA has been doing this for at least two decades, it's not a crazy enough conspiracy theory.

Inserting backdoors in the form of bugs is not difficult. Just hijack the machine of a maintainer, insert a well placed semicolon, done!

Do you remember the quote of Linus Torvalds ? "Given enough eye balls, all bugs are shallow." ? Do you really believe the Linux source code is being reviewed for bugs?

By the way, how do you write tests for a kernel?

I like open source, but security implies a lot of different problems and open source is not always better for security.
Yes, and people generally don't seem upset by viral Youtube social experiments. The Nuremberg code may be the status quo and nothing more. No one here is trying to justify the code on its merits, just blindly quoting it as an authority.

Here's another idea: If it's ethical to do it in a non-experimental context, it's also ethical to do it in an experimental context. So if it's OK to walk up to a stranger and ask them a weird question, it's also OK to do it in the context of a Youtube social experiment. Anything other than this is blatantly anti-scientific IMO.

It is IRBs that need reform. They're self-justifying bureaucratic cruft: https://slatestarcodex.com/2017/08/29/my-irb-nightmare/
> Such as? Should we assume that every patch was submitted in bad faith and tries to sneakily introduce bugs?

Do the game theory. If you do assume that, you'll always be wrong. But if you don't assume it, you won't always be right.
That's fair, although it's also possible that the way business is done could change (in fact, I think it has already been changing for at least a few decades, thanks to videoconferencing and telecommunications).

Having sales teams available to receive inquiries and to chat, and having marketing materials (that, at least in the case of software, closely resemble documentation) accessible openly shifts more of the relationship-building responsibility (and opportunity) towards the client.

And sure, latency and interruptions can be annoying. As can noises and distractions during in-person meetings. Good humour and offering ideas and suggestions for improvements are part of relationship building. Let's hope that connectivity and reliability continues to advance at the same time as well.
And what was? I cannot find constructive criticism in the related paper or any of your comments.
Which just demonstrates that these guys are actual bad actors, so blocking everyone at the university seems like a reasonable attempt at stopping them.
Equally I could say that football is, and should remain, a private activity, which governments should leave well alone.

If fans want to buy or create and run football clubs they are free to do so. If private investors want to invest in football and buy or create and run football clubs they are free to do so.

I don't think there should a way football 'should' be run, again I think this is a private activity that may be organised and run however people like within the law.

The same goes for corporations in general.
Toilet flushing can create infectious aerosols even when lid is closed
this is a dangerous understanding of Rust. Rust helps to avoid certain kinds of bugs in certain situations. Bugs are very much possible in Rust and the scope of bugs usually depends more on the system than the language used to write it.
Would be interesting to make a bootloader and “OS” that you could wrap any game with, including GPU driven games like Crysis. I wonder how much more performance we could eek out of our hardware by removing extra overhead.
The AGPL is a free software license. This implies that guarantees the well-known freedoms. Among them, there is the freedom to modify software for your own use.

As long as you don't exposed this modified version of a hypothetical AGPL-ed Postgres to the end users, it is considered your own use, where you are free to do anything you want, including using it as the data store for a web application.

If you would however expose this modified AGPL-ed Postgres as a DBaaS, in this case you will need to offer as AGPL your changes to the users. But this was not your case.

So the answer is clearly NO to both questions.
Oh don’t get me wrong - ORMs have their place and do enable higher agility. They do seem magical the first time you encounter them.

What I object to is the blanket “shouldn’t care about sql” statement because that’s what empowers people to use the ORM indiscriminately without understanding what’s under it (an understanding for which SQL is relevant) and then it’s the non-value-adding developers’ job to come in and untangle the mess, usually could have been avoided by dropping down one level, looking at the SQL that was generated (or maybe analyzing the query plan - again kind of hard if you don’t understand SQL) and realizing the ORM is doing something crazy.
> The resulting expansion of trade leads to increased productivity, which creates opportunities for further expansion of trade. Economic progress, therefore, is a self‐ perpetuating process.

I'd love to hear a right leaning libertarian's perspective on why climate change doesn't change the narrative that economic progress is the only worthy goal of our social structures. Also, why are technology and corporate control above the critical evaluation that government is exposed to.

I'm always a little confused why libertarians usually have a stance that isn't consistently applied to coercive private forces as well as government control. Surely it's not a consistent philosophy if it has such strong uncritical biases.