skysight-inc/HackerNews huggingface dataset:
The researchers already lied when they conducted the study. What you are proposing is that we now should trust them to tell us the extent of their previous duplicitousness.

The most recent patch, which triggered the bad, has not been explained in good faith and it seems likely there were mistruths involved in that exchange as well.

So while it is absolutely a waste of time to have to go back through those 190 commits, the responsibility for that falls squarely on the researchers who broke that trust, not on the Greg fro refusing to re-extend that trust in the face of continued sketchy behaviors.
I find it fascinating and frustrating that this is part of why I became a vegan 25 years ago, yet almost nothing has changed for the animals in that timeframe. I guess we have a long way to go to become a compassionate species.
English is my third language. And I didn't explicitly belittle anyone, sorry if you feel that.

It's just that such mistakes are not warranted on a journal/newssite. Having flawless grammar in the language you're writing is an essential prerequisite for any journalist.
Default Docker configs are atrocious. Most devs/devops don't even know that when it creates a network, it takes a /16 ip range out of 172.[17-31].0.0/16 or 192.168.[0-240].20/20 by default. It is just a matter of time before a restart makes it collide with an existing network range. It does skip networks defined on local interfaces at least, but this only means that devs don't learn about this landmine on their own machines, nuking production instead.

The default should reserve a single ip range and simply fail (with a nice message) if more are needed.
What does that Xerox paper doing in that office room?
This paint on canvas got sold and therefore it is Art.
In addition, database accesses aren't free either.

Both in terms of latency (to be fair, probably pretty small in comparison), and in terms of knowing that all the data you fetched is consistent (because you fetched it in the same transaction).
Sort of, but larger scope: https://web-platform-tests.org/
Why would I do this manually using some fiddly UI instead of automating it using the programming language I already have at my fingertips?

Using the programming language itself, I can extract exactly the information I need to see, transform it into exactly the shape that's easiest for me to inspect and combine output from different places in the code to create a compact list of state changes that's easy for my eyes to scan.

What I have found is that my debugging problems are either too simple to require anything more than thinking or too data dependent for a debugger to be the best tool for the job.
I'm gonna bet they're intentionally going lightweight on the driver checks because all the ticktocks are free advertisement for their 8k$ "autopilot" option
Vitalik Buterin Donates 100 ETH (218K USD) for Covid Relief in India
Wuxi, at 5.03 million people (6.6 million in the prefecture it governs) has about three times the population of Birmingham, England (1.1 million inhabitants, 3.7 million in the metropolitan era). The Wuxi prefecture covers 4600 km², the Birmingham area 600 km², a ratio of about 8:1; the cities proper are 1640 km² (the five districts of Wuxi with the 5 million population, excluding Jiangyin and Yixin) and 268 km² (Birmingham), a ratio of about 6:1. Your 20:1 is kind of in the ballpark.

However, Wuxi's central Liangxi Qu (72 km²) had a density of 13000/km² in 02010, when Wuxi had a population of only 3.5 million. This was 944k people, 83% of the population of Birmingham proper in 02019. If that had increased proportionally, which seems unlikely, it would be almost 19000/km² today. Birmingham proper averages 4300/km².

I conclude that there is no plausible sense in which Wuxi is less "necessarily a big population center" than Birmingham.

See my longer comment at https://news.ycombinator.com/item?id=26930408
Reminds me of this diagram http://i.imgur.com/ZOuf9hg.png (which I don't necessarily agree with)
And, of course, some sports, like football, are arguably worse for your health than simply not participating in sports at all.
It should be "$3 per whom", obviously.
It is largely true. One has to start out with a clear definition of the problem they are trying to solve, regardless of whether they are laying the foundations of a software architecture or implementing an incremental change. The more you understand the problem at hand and its inherent complexity, the more you can avoid any accidental complexity along the way. Good architecture is about picking a set of interdependent, multi-layered abstractions that provide a reasonable blend of efficiency and brevity of expression, for tackling a problem domain. Universal solutions to a wide class of problems almost invariably end up as a mess.
> But the idea that A/B testing the color of your CTA button on a landing page requires informed consent is absurd.

A/B testing on major platforms is much more sophisticated than that[1].

It's a crucial practice for advertisers and marketing teams that dives deep into researching the psychological response towards images, text and dozens of other variables. Human subjects are acting as lab rats in order to extract some data points to drive the next test and campaign.

So, yes, it should definitely require informed consent and opting in.

[1]: https://www.bbc.com/news/technology-28051930
> May have

> Could

> Possible

I fucking love science.
Linus doesn't say it isn't a big deal, he says the technical impact of the incident is not high. The reason this is a big deal is the violations of ethics and the breach of trust, not the technical damge to the source code, all of which Linus acknowledges.
I don't look at it as a place to answer "What is the best way to do X" type questions but more "What else is out there that can X".
As far as I know lithium extraction from brine is both in development and an area of active research which would allow to tap a lot more lithium resources than previously expected.
I remember reading something about a test plant in Cornwall and some similar stuff from Germany as well. Maybe that would help you in France as well?
I would go with "We apologize for the harm [that] we caused" which seems the most natural choice while explicitly acknowledging that some harm was caused. "All the harm" does indeed come across as a bit inflated, as other commenters have mentioned.
Don't we already to this on Earth?
He told you: Dynamic rates and appliances that let you adjust their behavior based on rates. Have people pay based on the demand and the most able to alter their usage will do so.

I'm skeptical-- but probably for different reasons that you.

W/ PG&E and MCE the utility can't even manage to tell me my current rate-- determining from my bills requires solving a linear system in three unknowns, requiring three bills. And the rates change quarterly, so I can only determine the rates at the moment they no longer apply. The rate scheme also has various non-linearities such that my total rate depends on my overall usage over the year and as a result my true marginal rate is unknowable at any given time. I dunno how rates are supposed to incentivize behavior when they're so opaque.

So I like to imagine a future with smart electrical panels and appliances where their behavior can be rate shaped in realtime, ... but then I encounter the actual behavior of the PUC and utilities and a future with demand shaped by economics seems distant indeed.
> And if there won't be repercussions -- maybe the product is short-lived

Unfortunately the API's I work with are long-lived; decades. Many (but not close to most luckily) integrations are SOAP for instance. With API versioning and 'hidden' APIs (API's which are not in their normal Swagger or docs, but do exist to fix), issues like returning too much or too little is resolved, and it's fast & easy.
I am in a similar situation (17+ years as developer) and I recently found joy in ethical hacking. I feel like a young kid again discovering new things on a daily basis after work.
I'm this way with side projects, but I can only put in the time because I'm young without the responsibility of running a family.

If you're in a position to, maybe just take some time off and find something you're particularly passionate about. For me, it's making video games (with an educational slant to be more meaningful and put less pressure on a hobby becoming a second programming job).
Not applicable in this case. Modi did win and that too by a thumping majority over the Hindutva doctrine.
Aerial photos of China's failed share-cycle scheme show mountains of bikes
What could an increase in the IP address space do to be compatible? I can think of a couple things to be partially compatible but IPv6 already does those.

And by "stupid addressing scheme" do you mean it's too big, or what? You can ignore all that stuff with mac addresses and make all your addresses go like prefix:subnet::1 prefix:subnet::2 prefix:subnet::3 if you want to.
Where I work roughly 80% of people have taken a similar deal to that you described and have the two phones option. It may be because I work in infosec but two phones is nothing unusual amongst my coworkers and the industry at large.
What is that supposed to mean? Conference publications are for research.

I pulled this from the website of Oakland 2021

Since 1980 in Oakland, the IEEE Symposium on Security and Privacy has been the premier forum for computer security research, presenting the latest developments and bringing together researchers and practitioners. We solicit previously unpublished papers offering novel research contributions in any aspect of security or privacy. Papers may present advances in the theory, design, implementation, analysis, verification, or empirical evaluation and measurement of secure systems.

https://www.ieee-security.org/TC/SP2021/cfpapers.html
Those comments really do not to be as bad as people are making it out to be.
Ipv6 is like python3. A worthy upgrade, but tried to do too much in a single coup and broke backwards compatibility. If they simply added two top octets, saying that 0.0.... was the old ipv4, everyone would have used it ages ago. Instead they made other improvements which led to complex standard and worse adoption.
>an expensive area

This is a bit of an understatement. If Mayfair is not the most expensive neighborhood in the world, it's close. A large number of the residents of Mayfair are former soviet state security who became oligarchs with the money to live there by pillaging their country then funneling that cash to the west with the aid of western banks including British banks.
No doubt, gaming support has been a serious business for a while. Far beyond the gold farming, item trade, and "pay me for voice chat" underground.
I'd take a bet that almost everybody reading this who cares about cloud providers has come into contact with companies who started out by providing servers and administration services for Counter Strike or Minecraft.
I guess, because the way things are going C is going to have generics first, given it already has a bit of it since C11. :)
I have it at 125% for one of my 4k screens, and I have no lag. Then again I have an AMD card.
Exactly my feeling too when I read this apology.

For me, it reads like this "With the best intentions, we were helping you. Unfortunately, you are too stupid to not realise this. We are sorry that we hurt your feelings, but please let us continue in helping you."

When you get such an apology, best thing is to avoid such people. Because it's clear they do not understand where they went wrong.

They should have either apologized with "we made a very big mistake that had a negative impact, it did more harm than good". Or they should have argued with real evidence on how they improve the Linux kernel, like refer to real exploits that they fixed.

This is just a "we're sorry that you don't realize we are helping you"
My worry about doing this is that I'll be put on some "answers the phone" list that subjects me to further robocalls down the line, whereas if I don't pick up my number may be seen as less valuable.
Two sides of the same coin, I'd say.
Agreed. Password managers are an awesome thing, and yet, thus they present an extremely juicy attack target. Too many eggs in one basket.

It's an area where the right answer is to give up some convenience for better OpSec. Use a local-only password manager that can't communicate anything to anywhere.
Other than the whole UNIX ecosystem never going to anything else, the embedded vendors and game consoles SDKs, or the SDKs from all major desktop and mobile OSes.
> If you wanted to study this risk, how would you go about doing it?

The main factor in doing this ethically is obtaining consent from your research subjects. I believe that some Red Teams test precisely these sorts of security mechanisms in commercial software projects and there are solid comments else discussing procedures they use.
counterpoint:
The LF Technical Advisory Board is taking a look at the history of UMN's contributions and their associated research projects. At present, it seems the vast majority of patches have been in good faith, but we're continuing to review the work. Several public conversations have already started around our expectations of contributors.

https://lwn.net/Articles/854064/

What the authors did is wrong, so did GKH actions. Let's be honest in calling BS out.
This is really good. Much more understandable explanation than anything I have read, or seen, about DP before.
It appears that against the scientists' expectations, the mosquitos failed to read the manual
Partially. There are local (L2) and fast re-transmit with ARQ [1] and HARQ [2] (at least in cellular, which I know, but I guess Wifi likely has both too), and it can help hide some packet loss to the upper layers. But this still creates added delay, which is seen by TCP as more RTT jitter, with a bad impact on performance. Also, if the link degrades really badly TCP will definitely see more congestion and loss.

So yes, the L2 will do all it can do hides wireless issues to the upper layers. But it cannot make miracles and wireless is still a challenging medium for end-to-end congestion control. There's still work at the TCP (or let's say end-to-end congestion control layer, with QUIC) to improve things, see BBRv2 for example. It's an active area, and any new generation tends to push the current state of the art.

[1] https://en.wikipedia.org/wiki/Automatic_repeat_request
[2] https://en.wikipedia.org/wiki/Hybrid_automatic_repeat_reques...
Hi. Same here.

I can recommend some book or just write down some pep talk here which is gonna feel good for both of us but perhaps not useful.

The thing I want to ask is about your mental health. Maybe these things you mentioned are part of some mental health crisis you're experiencing that needs caring. Not enjoying the past enjoyable activities is not a simple thing to ignore it.
Oh man, I'm in the exact same spot right now. I'm 35, sold first website when I was 17. And I don't even have "regular" job now, just working on my own projects and I still completely dread starting to work every single day. Sometimes it takes around 6 hours for me to just get started and write a line of code. Only to stop an hour later because I'm exhausted from doing nothing.

The only time I am able to regain that "in the zone" feeling from 15 years ago is when I try some completely new stack/framework/language on a fresh project. The problem is I can't do that all the time because I've started dozens of projects and wasted years without finishing anything.

I will be monitoring this thread for any help. This is a serious problem for me.
Not only that, do not miss out on his other photo essays:

https://www.podniesinski.pl/portal/?lg=en
"Recursion" is part of the "how" of the "why" of "divide and conquer" :P
A fast drop-in replacement for lodash.set
Our best and brightest open source software engineers are having unproductive fun instead of creating more software for me to use! How dare they!
While that's a practical complication, it's one that has a huge number of holes in it—thus my mention of racing in particular, which is often overlooked as a "sport" despite the physical demands it can put on drivers.

More broadly, it points out just how incoherent the demand that some athletes remain "amateur" is, when "amateur" is just used as a proxy for "unpaid": there's nothing noteworthy about a teenage driver winning a cash prize for a small-time race, and nobody in the pro racing world is going to say that they're not an "amateur" driver just because they got money for racing once.
Whenever someone expresses this, I think about Feynman talking about burnout. There was actually a post about it on HN! https://news.ycombinator.com/item?id=3874875

Beyond that, I’ll offer as a 40 year old who’s been there...find people to help. Finding people who need help is always the way to working on things that feel interesting.
But who's to say they're descending rather than ascending?

A person can ascend stairs, or descend.

A drummer could play an ascending pattern on their toms, or a descending pattern.

But neither the toms or stairs have an inherent upward or downward direction.
I have one hypothesis why Aliens are hiding. It's just they are simply afraid of humans torturing them for their color and appearance.
The EU didn’t place a ban on exports, if it had - it wouldn’t have mattered what deals we had in place - if you can’t export the vaccines you’ve made, you might as well sell them all to the EU.

But yeah, the US is starting to go down on the vaccination rate, they’ll open up soon and it’ll be the same as the notion that they almost singlehandedly won WW2.
Two questions:

1. Are you mentoring anyone?

2. Are you growing your knowledge? Languages, algorithms, protocols, domains all beckon.
One of the things I've learned over 30 years developing is that the application building technology skillset required changes every 5 or 10 years (except from a few niches), make sure you are learning about new (and old) technologies around the things you use at work.

It can also be the place where you work - the type of applications (working on something you believe in or is fun is a real motivator), or just the style of the company and management. As you can enjoy coding something on your own, perhaps a new start is called for?

Finally perhaps you've exhausted your love for coding and its time to try something else - project management, design, or something new entirely.
If you're optimizing for UX you're not optimizing for security. It's just how it is.

My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste.

Less convenient, sure. Also far more secure.
> this repo definitely needs more work before being shared with the world

No, don't say that :( I see way too many people that don't want to share their code because they don't think it's tidy enough or complete enough and that they just need to clean it up or adding some more features. But the thing is that they never get around to cleaning it up or adding those features and therefore they never share it. And often times I have seen this happen with stuff that is really good and usable.

"Perfect is the enemy of good" applies 100% in such cases.
I am also a fan of Gareth Loy's Musimathics Books, should add them to the list
Good question, thanks. I'll think about it.

Also: do you have any suggestions?

Edit: add second paragraph
Another “I’m sorry you feel that way” letter.
Thanks for the reply & all info :- )

Actually, this: `USER=my_name make psql` and this: `make psql USER=my_name` I don't like that much: No command line completion of `USER=my_name`.

Makefile targets like `mycluster-kubie` are nice, although they can result in a combinatorial explosion (if one needs two or more parameters).

It seems to me that after all, it'll be Deno or maybe Rust "scripts" that I'll want to use, combined with Make — Make for building, and Deno for running things.

(Running = often, nice with command line completion. Building = less often.)

Thanks for the extra pieces of software :- ) Direnv looks nice, makes me nervous about security exploits though (seems it automatically parses a file in the current directory, sometimes provided by strangers, via a Git repo that maybe I just wanted to look at). Hmm, https://github.com/direnv/direnv/issues/23 "security considerations"

Git-crypt seems like a nice way to maybe distribute secrets for accessing one's CI environment :- )

Didn't know about entr. Currently I use inotifywait (from package inotify-tools in Debian)
I have not done much MIR stuff in the past, but I recently found https://musicinformationretrieval.com/ and that does seem like a great resource
I Don’t Want Xcode on the iPad
Article of Articles for Kotlin Coroutine
Reminds me of my particle physics professor lamenting that we played Skat or Doppelkopf (trick taking card games) during coffee breaks..

What he didn't see is that those who engaged in a few card games would also collaborate much better back at the desks and I would say the friendship formed over the games gave a real boost to the productivity of the whole research group.

I think when I spent a day at a conference listening to talks etc. I am not in a state of mind for productive hacking. Forming relationships on the other hand may be able to advance a community much more (the hacking can be done at home).
> That said, I do like the idea of reducing abstraction layers, getting closer to the hardware,

Abstraction is THE tool to curb complexity. It's a feature that allows us to design, reason about, build, debug, maintain and extend systems with the complexity of todays computers. Reducing abstraction is in itself not a desirable goal.

What could be useful is to reduce the overhead introduced by abstraction. Doing that by removing the abstraction itself is only one such way and a quite costly alternative.
> I think there is still latency to consider, especially if you have users around the world.

you speak like there's anything that exists outside of a 70km-long band in California
That's why I like RSS. Strip out everything but the content and use whatever UI I prefer. Newsbeuter is a good RSS readers for the terminal. Several services and open source programs like TT-RSS allow you to get the full-text instead of just a blurb. And for sites without RSS feeds, there are services that make it easy to scrape HTML pages and output an RSS feed.
Cynical take, is this mail genuine/sincere or is also part of some kind of new experiment? How can we trust them not to running some kind of new trolling?
I don't use it only because people at other companies demand REST.
Non-academics get fired for doing unethical things entirely unrelated to their jobs all the time, just to avoid bad publicity.

Determining how to conduct your research ethically is a core part of being a researcher. Basic research into pen testing and security research would have revealed how unethical this study was.

I see firing as completely justifiable given that was a failure in a core part of thier job, that not only caused a public relations mess, but has directly negatively affected other members of the research institute because they have been banned from Kernel contribution.

What further incompetence do you think is required to justify firing this academic?
If we do find life on other planets, I hope that it unites us more and we stop thinking in tribes of US, Russia and China and just work together as inhabitants of Earth.
Of course all existing systems are analog, I know everything digital is just a pretension. But that does not help us in this discussion.

So...I am sure you know what I mean, can you please help me to express it better?