skysight-inc/HackerNews huggingface dataset:
Obviously the intent was never to introduce security vulnerabilities, no matter how naive and badly thought-out their methodology was. The intent was to show it could be done. None of the proposed vulnerabilities ever got in the kernel, whenever they were at risk of being accepted, the maintainer was warned and the process was aborted.
Nope, if a mob surrounds you, that law lets you drive over them.

Watch some of last summer's riots to understand what they're talking about. Police cars had to run over people to escape the rioters after being surrounded.

There is nothing cute or admirable about the BLM and antifa riots.

The Florida law just clarifies that you can affirmatively defend yourself.
RCB is gonna win but in Photoshop IPL
It's not just the algorithm, but the frame of mind to consider an optimisation. I guess it's a rare sight in the age of electron apps and cloud startups.
POSIX is a standard that Windows complies with natively and has done for decades - it's a requirement for DoD contracts IIRC.
The only role surface tension plays in the Feynman problem is to ensure that the cross section of the stream is a circle. The rest you can work out based on classical mechanics and the fact that the amount of water is conserved.

You actually get exactly the same "thinning" behavior if somehow the stream is square shaped or anything else in cross-section.
Yes, but turning the tape in a supermagnet that is reliable and doesn't burn itself to pieces on every quench event is non-trivial.
Not as much as one might think:

https://john-tromp.medium.com/a-case-for-using-soft-total-su...
Maybe I'm a bit stupid but I don't understand this premise of this article.

For example,

> Invoices don't need payment status, or an array of order items, so we don't need to worry about trimming down the
response at the field level, they can just be their own
related resources, discoverable with hypermedia controls.

To me, this misses the mark in two ways.

First, invoices might need payment status, if that's what your UI is trying to render. So, you can certainly have a payment status endpoint, but that's going to add some milliseconds to your UI response times, and if you also have separate API calls for invoice line items, fulfilment status, associated data... well you do have a lot of duplicate I/O going on, even with HTTP/2 and compression, and the API is not really ergonomic from the perspective of the user of the service. There's a lot of client-side LOC in play to make all these calls, and a lot of server-side dependencies end up being exposed by the structure of the APIs.

Second, including the payment status for an invoice is useful and almost (but not always) something that an API consumer is going to request alongside the invoice data. So for the consumer's convenience, you'd typically want to include it in the invoice representation. The API is going to be better off for having it.

In this case, however, we have the problem that obtaining the payment status (or other seemingly simple data) may in fact be expensive. Depending on the architecture of the system, at a minimum it's probably another database query, but the payment status might even be in a completely separate service.

Ultimately, the cost of excess round trips is really paid for by the end-user, but the cost of loading unnecessary/unwanted data is paid for by the service provider. GraphQL, and presumably other sparse fieldset APIs, provide a way to optimise both sides of the API.

This is where GraphQL makes perfect sense to me. It lets you build a discoverable data model that considers the logical structure of the API and the consumer's ergonomics, but because the caller only requests the fields they need, and because GraphQL fields are fetched independently, you don't have to compute those fields unless you need to. The result is super fast APIs that are easy to discover, consume and debug, and that use the optimal level of resources at both ends of the connection, a solution which IMO is infeasible with pure REST APIs distributed over many servers.
Your cognitive workload is too high.

There are three forms of cognitive workload: Intrinsic, External and Germane.

Intrinsic is things you just *know*. How to write a class in java, how to write a query in SQL, ...

External is stuff you only need occasionally, and need to look up every time: How to deploy to X, how to set up CI/CD, ...

Germane is context knowledge. Usually referred to as business knowledge.

You want to keep external cognitive load a minimal as possible. You can really dig deployment and stuff, and then this becomes your intrinsic cognitive workload and coding becomes more or less external, but for somebody who just likes to code, it's best to once do a deep dive to deployment logics, write a scaffold and stick with an automated version forever.
I understood a problem that energy providers are investing some minimum (perhaps only the legal minimum) into green provision, an amount that they would have anyway.

And, selling this onwards as a premium to the end user without actually changing their behaviour.

Since you get the same service (your power ultimately comes from the same grid), it's a pure price discrimination strategy.

[This is maybe a general restatement of pjerem's sibling comment]

I do pay this premium, but I mostly feel cheated by it.
Most projects have virtually no accountability at all.

Hundreds of people have blind push access to brew. Almost no one signs code. One bad commit and you backdoor every company in silicon valley that blindly executes the unsigned code from the brew repo. Pick a favorite Linux distro. All but a handful work the same way.

Right now an low skill level malicious party just needs to phish one of the ~90% of maintainers that don't have strong (or any) 2FA enabled anywhere in a dependency graph while they are on vacation or are not paying attention to a project and sneak in a commit or two into history while notifications are turned off. Attacks just like this have happened in the wild and not gone noticed for months. How many have we still not noticed?

It is insane we let it get to this point. I feel like we are in early 1900s medicine where only like 1/10000 doctors see the value in washing hands and tools.

Dual cryptographic signatures on all code from author/maintainer plus signatures by security-only reviewers from a pool not known in advance before new releases would be a very high bar for an adversary to defeat and a high risk of exposure.

I have helped deploy variations of this approach with clients/employers in the past, and will publishing more detailed recommendations along these lines publicly soon.

If the remaining weaknesses in this threat model and posture became our worst attack surface, we are in dramatically better shape.
i applaud the optimism for humankind's longevity. what could go wrong with these dates?

1. interpreted as octal in various contexts

2. leading zero stripped off when dealing with it as a number and not a string.

handling dates is already hard as it is, I'll leave the solution to y10k to much more able hands in ~7-8 thousand years :)
While the battery of an EV is heavy, there is not 500kg of lithium inside it. For example a Tesla S with 100kWh, one of the biggest battery on the market, has about 7kg of lithium.
Yeah, but we're talking about 0.1% of the population. For mass adoption, prices have to be much, much lower.
I constantly criticize Google, Apple and Co. here and I (almost) do not get downvoted. Perhaps you should try to make a more balanced and justified criticism.
> When I was in high school, I'd see water running out of a faucet growing narrower, and wonder if I could figure out what determines that curve. I found it was rather easy to do.

Wait, is this caused merely by the water being accelerated by gravity?

I bet most people would be able to figure out the equations for that if they got interested.

Edit: there's a separate thread https://news.ycombinator.com/item?id=26931645
I really want to like Rust, I like the intention of what the language is trying to do. But in a universe where languages like Smalltalk, Eiffel and Lisp exist, it just feels like a step backwards. Surely the computer should be doing the heavy lifting? What happened to my bicycle for the mind? Just my opinion. I admire the work going on in Rust but the complexity makes me sad.
To win a nobel prize yes, but anyone can benefit from the general attitude in many domains of life.
Dan Kaminsky Has Died
Definitely would not hire these three guys to do vulnerability assessment of ANY network.
Your work is predicated on:

- consent by selected few

- buy-in on all major parties

- documentation trail, ongoing

I’m sure there’s more but ...
You probably want GNU-centric social spaces. Any other type of programming-focused board will inevitably become dominated by people who work at the biggest companies that employ software devs.
Boba Shortage Could Stretch into Summer, Leave Businesses in a Bind
Author of lmgrep here. Could you create an issue for Finnish text analysis? https://github.com/dainiusjocas/lucene-grep/issues

I'd take look.
pi.r².v.dt
Buying electric buses from China is a good way to get yourself un-elected as a US politician. Especially as there are vehicles made here which also generate jobs.

Heck, in Chicago there was a big stink when the city started putting in “foreign made” decorative street lights and bus stops a few years back when there were locally-manufactured alternatives.
I grew up on fish sticks, along with the frozen clam nuggets, but never knew how they were made:

> In a process that has remained essentially unchanged, factories run the frozen fish blocks through an X-ray machine to ensure they’re bone-free, then use band saws to cut them into slices. These “fingers” are dumped into a batter of egg, flour, salt, and spices, and then breaded. Afterward, they’re briefly tossed into hot oil to set the coating. The whole process takes about 20 minutes, during which the fish remains frozen, even when dunked in the deep fryer.

And if anyone has trouble loading the page: https://archive.is/5NIzA
I do enjoy reading history, and I'm not even turned off by knowing that he did and enjoyed those things. I just got tired of listening about it for what seemed like about half of the book when I was expecting a memoir of a Nobel prize winning scientist.
"You also need tenure, more than anything else."

Sadly yes. An argument that the current uni system should be changed to make this not so.
The question always is, could you have learned the same thing with less "invasive" methods? And I think there's a good argument here that that's the case: I.e. the researchers first looked at bugs in the kernel and how their history, finding that such scenarios happened by accident. They could likely have gotten bugs past reviewers they had told that they were trying something like this. lots of options, so going for the most extreme option to "find" something that's not exactly a new or widely disagreed idea is quite unnecessary.
https://news.ycombinator.com/item?id=26925044
Wait. 'Any' can mean 'none at all' in this context?
A historic funding boom might transform the US National Science Foundation
Mmh valid point.

OTOH, one is confronted by corporate interests all day long merely by existing, they're everywhere.

I'm really not sure if I need to see any more of that to get their point.
>"if there's a double spend just trust whatever the majority of the trusted nodes say"

Yes but also no. There is no trust needed because what the other nodes say does not define whats correct its arbitrary. Its only relevant if 2 or more equal good AND correct ways exist.
You aren't listing to others to find out the "right" way you solely listen to other so everyone choose the same.

>still quite centralized compared to other consensus mechanisms.

Not at all. If there is a double spend attempt your validator node picks one at "random" (the one it revived first) it then tells every node to include this one an discard the other. All other do that too completely on their own (decentral). Only if this does not lead to 80% agreement everyone is tasked to adjust and vote again. So your node looks what the nodes around them voted and switches if needed to the majority. There is no central anything that tells your node to switch. Your node does so solely because your node doesn't care which way to go but it wants to go the same way ass all others.

All this does it it breaks ties. If there would be a near 50/50 split or 33/33/33 for 3 conflicting transaction, this is guaranteed to shift to something near 100% after some re-voting. Because the existing "majority" grows faster with every re-vote if everyone adjust by these rules. And that's the sole goal. We want the network go agree.
Nuclear power has its issues, but I think burdening future generations with old nuclear plants is better than burdening them with a catastrophic climate change. I would much rather see developing countries building nuclear than building coal.

Reducing emissions of energy production as fast as possible should be the first priority now, and nuclear can be helpful there. After this problem has been dealt with, then we have plenty of time to switch completely to better alternatives, like renewables.

Even a worst-case scenario like Chernobyl is still way, way less bad for nature than the consequences of climate change. Thanks to lack of humans, the area around Chernobyl is actually doing better biodiversity-wise than before the disaster.
Oh, boy! You probably don't want to read about peak oil extraction :-D

Oil was supposed to run out in 1865, 1880, 1900, 1920, 1940, 1985, 2005, ...

If there's a demand for a specific resource, prices go up and people find a way to extract more of it, if it's present on this planet. And lithium is the 25th most abundant element, so there's a ton more of it than there's oil in the crust.
What I find more surprising is how popular it is for daily use despite being expensive (double markup effectively).

Especially with cooking a meal being quite trivial these days thanks to everything in supermarkets being damn near prepared already (washed, cut, portioned etc).
People end up getting ridiculed, punished or even have mobs of people harassing them for having dissenting viewpoints online. Why bother exposing yourself to different viewpoints when all it does is bring you vitriol and sometimes real world consequences? There isn't any upside.

This place is no exception except it is done under the veneer of being objective (when it rarely is). You can be polite as you like, but if you have an actual dissenting opinion you will be downvoted or even be flagged over nothing.
holy moving the goalpost batman, slow down.

> We are going to need unpaid volunteers, and a lot of them.

that's absolutely orthogonal to the question at hand, it's not a matter of paid or unpaid, neither being volunteer or not: it's a matter of consent.

if you don't sought consent beforehand either via a contract relationship or a sponsored bug hunt program or the likes, you're a racketeer, not a white hat, and you should (and will) be treated as such.
Fossil Fuel Power Plant That Mines Bitcoin Is About to Massively Expand
Show HN: Vineyard v0.2.0: big-data applications optimization on Kubernetes
Vineyard, an open-source in-memory data manager, was previously announced at three months ago[1]. After three-months iteration vineyard release v2.0.2 finally comes out, with a more tight integration with kubernetes and enables orchestration of both "data" and "tasks" for data-intensive applications in cloud-native environment. Refer to our presentation and live demo for more details:

Presentation: https://www.youtube.com/watch?v=p-falphSJq8&list=PLj6h78yzYM...

Live demo: https://www.youtube.com/watch?v=vPbF1l5nwwQ&list=PLj6h78yzYM...

Features and improvements included in v0.2.0 are highlighted as follows:

+ Vineyard has been integration with Helm for easier deployment on kubernetes clusters by simply typing `helm install vineyard vineyard/vineyard`

+ Vineyard objects are now represented using CRDs on kubernetes and are observable to tools built upon kubernetes.

+ A vineyard operator has been included in release v0.2.0, where a scheduler plugin could works in a way where
pods are aligned with vineyard server where its required data is placed when possible, which reduce the data migration overhead for big-data analytical pipelines a lot.

+ A malloc-like allocator enables applications to allocate memory chunks directly on vineyard's shared memory arenas, implemented using jemalloc, avoiding the cost of copy and the cost of refactoring the source code to ease the integration with vineyard.

[1]: https://news.ycombinator.com/item?id=25832831
Stanford's 'explainable AI' surpassed doctors at chest x-ray interpretation
You mean this thing?

https://news.ycombinator.com/item?id=26912977

Probably wasn't downvoted because of some roaming downvote squad of FAANG-employed users. Lots of more straightforward reasons you can see here

https://news.ycombinator.com/newsguidelines.html
As an European I never understood this one blanket thing and I am always annoyed when I encounter it in hotels.

I enjoy my own blanket, my own pillow and at least 90cm of room where I can turn and move as much as I want!
Machine Learning, Ethics, and Open Source Licensing
I too bristled at the word “any” for an apology.

I would have listed the specific harms in a concise manner instead.

Maybe save that word “any” for the end, maybe and only as a future tense of profusely avoidance of future harm.
I literally got downvoted immediately. Thus proving my point. :D
Academic freedom’s most determined adversaries are inside academia
I work in electronics. Nowadays there are chips which simply don't get documentation in English because chipmakers simply don't have a single client needing it, because all design, and engineering has moved to China.

People have no idea how little their electronics industries mean on the world stage.

I believe it would be no big stretch to say that PV cells research in the West is nearly inconsequential to the industry, when all what matters happens within 100m of the silicon furnace without much pomp, and published papers.

I believe it's similar to how semi industry turned to be. Process engineering is a giant research discipline, but everything below the "tip of the iceberg," which is academic research, happens on the fab floor, and stays a factory secret. That's why importing Taiwanese engineers is a prerequisite to setting up any serious high volume fab on 300mm.
Thank you. (I'd come across the first but not the second). It looks like there is nothing blocking me apart from the need to find a clear morning to which to devote myself to the task of doing error handling properly in my project.
Yeah, well, I would be willing to review what I wrote, however it got downvoted to the point where even I cannot read it anymore, it only says "[flagged]".

That's also a large incentive to consider something else, if people here can censor my content to the point where I even myself cannot read it anymore that's rather...google-esque?

*EDIT*: It somehow is visible again now. Will read it again.
When you apply for jobs do you simply look for "engineering" positions? Why am I always applying for software engineering and not electrical engineering? It's all engineering, and theory can be referenced, right? In fact, why doesn't everyone just buy a book and become a top engineer?

The point is not (or shouldn't be) to recite a textbook. The point is you can navigate your way around the textbooks. I've got both The Art of Computer Programming and The Art of Electronics on my shelf. I could find the sections to help sorting a list in seconds. As for the latter, I have no idea why the majority of that book even exists. I can't call myself an electrical engineer, even though all the theory I need is within arm's reach.

I assume you're arguing against the "recite the textbook" approach. I would agree that this is not the way to do things. But equally, "throw the textbooks out" is not the right way either. We need to evaluate a high-level grasp of the literature/theory but don't punish for forgetting minutiae. I might ask a candidate to talk about choice of sorting algorithms. There is, of course, no perfect answer, but what I'll be expecting is general evaluation of algorithms: time/memory tradeoffs, probing for more domain knowledge (e.g. does the data often come in sorted or random), platform constraints etc. I won't even expect a name drop of an actual sorting algorithm as that's not really the point. What they're telling me is they know why Knuth has a whole chapter on sorting. That's the important thing.
> At 20 mg lithium per kg of Earth's crust,[45] lithium is the 25th most abundant element.

https://en.wikipedia.org/wiki/Lithium

I'm too lazy to do the math, but that's probably enough lithium to plate the entire planet with it if we want to :-)
How about "we apologize for the harm"?
Smalltalk is still a thing?
I like this way of looking at the problem, I wouldn't have thought of this! I think this relies implicitly, too, on incompressibility of the fluid, no? As well as surface tension? Otherwise, we might imagine the fluid having less density at the bottom, while occupying a circular cross-section of the same area.
> it's best to ...

What are you basing this opinion on? :)

---

As an aside, the blog in your profile link ( https://teraku.me) has an invalid HTTPS cert. Seems to be for a different domain.
> The big thing here is that you seem to only work with your own code, where you can arbitrary refactor it and keep the entire thing in your head, as well as quickly find which module does what.

Not at all. Due to lack of documentation I look at code of foreign libraries and applications all the time to check what really happens inside and what are the guaranties. The latter being often the case when it comes to concurrency problems.
I honestly don’t agree, I’ve posted comments that have been critical of Google, Facebook, Apple and Amazon, and those seems to get plenty of upvotes. So maybe you was just wrong, poorly worded, off topic or something else entirely?

The comment I write that get the most downvotes are comments where I honestly did not explain my position all that well and others misunderstand my comment.

In general try not to worry to much about up- or downvotes. They don’t really matter and can just as much reflect the current mood and situation of the person voting.

Still also try to reflect on your downvoted posts. Where you perhaps wrong? If not, use the opportunity to refine and clarify you position and arguments in the future. If you can’t formulate your critisism, then perhaps don’t comment until you can, if upvotes matter that much to you.
With 11 people on space station, astronauts get crafty with sleeping spots
Pretty much all European cities are small bar Paris and London so no need to qualify them. Same in the US. NYC and Chicago are the only big cities by Asian standards (LA isn’t really a city IMO but population wise would also qualify).
Different types of vulnerabilities, not that much comparable
Tuning is not just about pitch, it's about timbre, too. On top of that, the feel under the stick changes at different tensions. Most drums have a handful of pitches where they resonate the best (or to the player's taste). It's a lot of effort for many drummers to get the balance they like, and this is often harder on less-expensive kits.
Not at all. My company is computing on the edge now - we have a data center in Sacramento.
One of the things a debugger can do is print things once it hits a breakpoint and continue execution automatically.
You need to see the context. Wuxi is between Shuzhou (10m) and Nanjing (8.8m), next to Shanghai (26m) and Hangzhou (21m). All much much bigger than Wuxi. Wuxi was once pretty important, but it lost its importance when the tin production ran out. It literally means "No tin anymore". People see it is neat small garden city. Wuxi itself is very small, but has two bigger satellite cities outside, Yixing (>1mil) and Jiangyin (>1mil).

Compared to Shuzhou and its other neighbors it's tiny. Small city is ok.