skysight-inc/HackerNews huggingface dataset:
You're still missing the point: diff of diffs. When GitHub compares two commits, it diffs the whole repo as of one commit against the other (like `git diff commitA commitB); what is requested is diffing the change contained in one commit against the other (like `diff <(git show commitA) <(git show commitB)`).

PS: I checked out your demo. I can't see how to diff arbitrary commits, only revisions of a PR.
> the response of some corporations when security vulnerabilities are disclosed

There's a big ethical difference between trying to exploit a piece of commercially produced software, and trying to exploit the time and actions of humans who are producing software which is given away for free.
Who is the employer so I can avoid working for, or doing business, with them?
Post author here — just wanted to say I emphatically agree with this and have found your work on rr and Pernosco very inspiring! Anyone who hasn’t seen this work should check it out.
> Nobody wants any person to be accountable for past sins of any state.

You'd be surprised.
Caring about privacy requires hosting a server. Or they can just give up on remote viewing.

They don't need to self-host really anyway. There are lots of one-click Docker image hosting options in various clouds.
heh, it's been less than 20 years away for the last 75 years.
you think I'm the one gatekeeping, here? holy cow. look in a mirror.

it is not the crap out there that I was complaining about. read my comment again. it is the crap (read: non-useful stuff) claiming to be useful.

please publish all the stuff you want. useful or not. I don't care. nor does anyone else.

don't publish anything crappy (again, I mean non-useful) and claim it is useful. that is my beef.

reading comprehension is important.
do you mean edge? otherwise i wouldn't see why it's strange. does edge not use the same JIT for javascript? (assuming you do mean that)
We've only had much technology for a few hundred years. There's an argument that we should give it another few hundred to prepare a bit better. If we rush it, we might destroy valuable information or even forclose some opportunities.

But ultimately you're right. We will blunder our way onto Mars at some point.
Show HN: Baldur's Gate 2 demo in WebAssembly
nice thanks. does the more rigid larger structure get in the way for you? I rock climb so flexibility is key.

Yeah I totally would have bought one of these just to try it out if it was still available!
Because HTML elements are forever while js modal libraries change yearly. It’s best for browsers to wait a few years and if there is one thing that has consistently been used and will be forever, then add it. The details element is a good example.

And even when we have an element, most devs end up replacing it with a JS version anyway. The HTML select element is a good example. The built in one almost always gets replaced with something that looks nicer and has more features like icon support and themeability
> before running this study; we did that because we knew we could not
ask the maintainers of Linux for permission, or they
would be on the lookout for the hypocrite patches.

I'll take BS for 100, Alex.
Big pharma, always the heroes
Cool. I'd kill for a Pinephone with a Fxtec[1] form factor, though.

[1] https://www.fxtec.com/pro1x
Maybe the Government will make it illegal to mine new bitcoins and my bitcoins will go to the moon?
No, I think the joke is that it’s always 30 or 50 years away, can’t remember which.

20 would be a bit more optimism
I'm not sure where this is going. Doesn't the computational cost to mine ether bitcoin or ether change over time?

And also, we already have units for quantifying computation. We can talk about millions/trillions of floating-point operations and also millions/trillions of instructions executed. The problem is that it's very hard to reach the peak theoretical capacity of a system, and also, when you're talking about trillions of instructions, the time taken depends on your instruction makeup.

You'd get a similar problem if you talked about ether as a computational unit, because a machine can be designed to mine ether really fast, but not be suitable/optimized for other types of computation, meaning that the compute power it takes your system to compute an ether might not be a good way to quantify the time it would take said system to compute something else.
You went into a lot of detail, but I just wanted to redirect attention to your initial suggestion that higher arrest rates of minorities is indicative of higher crime rates among those folks. You were just posing a question, I know. But the rhetorical device you used (whose name escapes me) prejudices the reader by presuming that the question has a knowable answer, which it does not. And citing arrest records is a red herring, for many of the reasons you elicit.

> it's often more a reflection of individual neighborhoods and communities and their tolerance or lack of tolerance for various things

Combining this with the larger discussion, are you suggesting that predominantly white communities have a higher tolerance for lawless behavior like drug use, and thus are comfortable being policed at lower rates? (Or the converse, that communities of color are less tolerant of lawbreaking and demand more policing.) I admit that I haven't heard that before. And it makes me uncomfortable, because on balance people I have known across ethnic groups are pretty much the same. It would be a little odd to discover that white communities are generally more tolerant of criminal behavior.

> Busting people at an airbnb in a quite retirement neighborhood as opposed to a college campus, drug complaints blocks from an elem school in a low income area as opposed to breckenridge, co - (which told it's police to leave weed alone many moons ago)

Intentionally unequal application of the laws starts with this kind of thinking, and leads to downstream problems that spring from the resulting distrust of the justice system.

Your Breck (95% white) example is telling. Communities shouldn't be able to exempt themselves from state & federal laws just because most of the residents are white and they have decided they don't like those laws. Even writing it sounds absurd. And it's definitely not a privilege that is afforded to communities of color.
It’s a 96MB zip file. You mean it only compressed to 2/4 of its original size?
Maybe your network operator doesn't want you to read about techniques for reading things that network operators don't want you to read.
I am pretty sure that's what sourcegraph is trying to do.
What does "store of value" mean when the only value you can extract from it, is value that other people put in? Otherwise it wouldn't be any different than holding onto a $20 bill (and having inflation destroy it's purchasing power)
Just because you can't do something ethically doesn't mean you should do it unethically, it means you shouldn't do it. Nobody here seems to have learned anything.
I love this! would love to see this used in a introduction to hardware course.
Pry with Ruby allows you to drop in to a repl anywhere with binding.pry

You can edit the state and keep running after altering the program.

But usually I just end up printing a few things from the repl and figuring out what is fouled up.
The universe is extremely young. We might just be tied for first, if it takes 3rd generation stars for example.
on the whoop?

my experience is it's slow to pickup changes & consistently 5-10 bps lower than other bands / pulse ox.

But my biggest gripes are the auto-sleep detection is horrible for me, and my sport isn't really conducive to the whole value add of measuring 'strain' in the way they do. Doesn't really catch short but very high intensity bouts of work.

So like if I can't get good sleep recommendations or measure my strain/recovery I don't want to pay $30 a month just to see a heart rate pulse on my phone when working out. It hasn't improved my training in a meaningful way.
or Apache 2. If you want your project to be widely adopted, these two are the best.
They could have done it ethically. Say that the study will run for undetermined amount of time. Even if they can be vigilant, they can't be vigilant for long time.

Or hell, do a longitudinal study.
O.k. before I comment I have to disclose that I sometimes work on blocking domain fronting abuse (here's a blog post from me - https://aws.amazon.com/blogs/security/enhanced-domain-protec...) so I have a bit of an interest here.

This is an interesting technique because it starts with the user and not the domain owner. The user creates a single-use domain to mask their own access to some website. Clever! but I'd be really wary about recommending this to someone who is trying to hide access from an oppressive regime. Websites often load all sorts of out of domain resources, and unless you're rewriting all of the HTML (and somehow all dynamically generated HTML) there's still going to be a lot of it. That Facebook example probably went and loaded a bunch of fbcdn.com resources. Seems worth a mention in the privacy section, especially for a post on the Tor project.
Where is this code ever claimed to be useful?
Also this won't cost $300-500 like all of those others do, which of course means you get a slower phone but since this is probably more of a Linux tinker toy so far, not too bad.
I am skeptical if they are sincere, because they did not retracted IEEE paper.
Sure thing, Amazon.

Take my software, don't pay me, then extend it to build an expensive platform I get locked into. Really loving those fancy new proprietary time sharing systems you've built, portable stuff like lambdas, and the new serfdom you've created for us all.

Looks like you own computing now. Good job.

Crazy how we went from being a locked down, proprietary industry in the 70's and 80's, to a free and open paradise in the 90's and 00's, and then went right back to thin clients and SaaS/PaaS.
Dupe: https://news.ycombinator.com/item?id=26929470 (87 points | 2 hours ago | 76 comments)
A later message claims (outraged at being accused of submitting intentionally broken code to the kernel, despite having previously done exactly that) that the patch was generated by a static analysis tool. Ok, what tool? How did you run it? The message where he claims this has since been deleted (by who? Edit: probably never sent to the list, see below) but here is a message from Greg KH which quotes it:

https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah...

You can see that Greg KH is skeptical that the patch was generated by a tool. It’s also unclear to me if the patch is actually harmless or not. It would be good to get some definitive clarity on that but the lkml discussion of it seems inconclusive.

I would add that the student’s tone in this message feels really familiar as an open source maintainer: this is the tone of someone doing something they know is bad being called out on it and trying to deflect with outrage. The last time I got that tone, it was someone who had created multiple sock puppet accounts to try to discredit my project and force moderators to reverse or apologize for a (completely justified and mild) moderation action. So I can’t help but feel that something fishy is going on here and the UMN research group still isn’t being honest about it.
What would change since? Not surprised Linux wipes the floor with windows on total throughput as the system is heavily optimized for that. Would be interested to see tail latency stats as the avg isn’t very useful.
> Uh, did I say something offensive?

No that I see. It's just really easy to read your comments in a haughty tone, which naturally selects for downvotes. The content of your posts, on the other hand, seems to encourage deeper investigation, so that's probably on point.

Communication is hard.
That only tells me, that there's more garbage than just one individual.

If they lack knowledge of why it was bad, what will prevent them from doing another garbage study next time.
I understood your comment just fine. Yes you are the one gatekeeping. No, people still don't owe you high quality code.

If a repo claims to be something that it isn't, you can complain (to the extent that it's polite and that your complaint might well be ignored regardless). Better yet would be to contribute.

The last repository whose quality-to-claimed-usefulness ratio was bad enough that it got me to complain, I now maintain. Be the change you want to see, instead of muttering about man-hours.
Every browser used to, given you can look at porn on them.
For anyone curious of the exact page content, it's:

<!-- JavaScript is cursed
CREDIT: https://bugs.chromium.org/p/chromium/issues/detail?id=1195650&q=component%3ABlink%3EJavaScript%3ECompiler&can=1 -->
<script>z=(a)=>{let y = Math.min(Infinity ? [] : Infinity, -0) / 0; if (a) y = -0; return y ? 1 : 0}; z(false); for (let i = 0; i < 0x10000; ++i) z(false);</script>
<!-- another day, another JIT bug -->
I'm posting what I find here: https://news.ycombinator.com/item?id=26929926
Bad software sent postal workers to jail; no one admited it could be wrong
thank you ParanoidRobot for the important recommendation

-signed,

Arthur Collé
GPLv3 doesn't have that compatibility issue either.
That is awesome. I've just been using my old film photography experience of trying to "see" in black and white, but this is so much better.
Additionally, would be right thing to do with there's apology email to also state that they retracted "hypocrite commit” paper from IEEE ?

After all before a ban, there where complaint(s) made regarding this paper, by other researchers and community members.
> Because HTML elements are forever while js modal libraries change yearly. It’s best for browsers to wait a few years and if there is one thing that has consistently been used and will be forever, then add it. The details element is a good example.

While I agree all these API need to be carefully crafted, this one is very much a no brainer. Mozilla (and Apple) should be at the forefront of these native UI improvements, because it allows the developer to rely on standard behavior rather than rolling out one's own broken UX.

> And even when we have an element, most devs end up replacing it with a JS version anyway.

No they don't.

> The HTML select element is a good example

Yes, because it's almost impossible to style it or make it display some custom content that isn't a line of text. The problem isn't its existence, it's its shortcomings because it was basically speced 25 years ago. I'll take a standard widget that I know will work in an expected fashion across many devices rather than someone's personal library in GitHub that is broken in subtle ways. That's the idea behind standards.

I was on a site not long ago, which displayed a modal pop up, well the page was going up and down frenetically every half second because the developer probably used a library that wasn't tested on the browser I used. the UX was completely broken. With standards, if a polyfill is broken then you have a good argument to confront its developer with (if I can put it that way).
Is this really the spat causing issues?

I see the standard Chinesium lathes (like the Seig's or HiTorque) seem to be just as available as usual at the same price as usual.

I suspect that the Precision Matthews issues are that they drained inventory and now that orders are picking up, lead times are going nuts. Those lathe beds probably require a decent amount of hand scraping after coming from China and if they quit doing that during the Covid shutdown, it will take a while to get the pipeline back up to speed.

Given that Precision Matthews is in Pittsburgh, probably the only thing that couldn't readily be built domestically fairly quickly is the outer casting. And I suspect even that could be built in Pittsburgh or Cleveland.
wow, this is pretty cool!
There is a tree which produces a biodiesel substance at a rate of 40 litres/tree/year.

https://www.smh.com.au/national/farmer-planning-diesel-tree-...
> We sincerely apologize for any harm our research group did to the Linux kernel community.

This doesn't admit to harm done, and sounds like an apology that doesn't admit guilt.
This incident, time, and reflection.
I don’t get this argument. Can you please explain?

> Each version will be given a distinguishing version number.

This means if I am using MPLv2, if they modify it then it will be MPLv3 or something similar. My existing software should be unaffected

Sure, I can’t refer to v3 and claim the protection of v2. All they are trying to do is to prevent someone from making a fake MPLv3
This is the most reasonable response in this chain. The number of unintended consequences this "research" could have caused is not quantifiable. This entire episode is shocking, disgusting, and should not be forgiven easily. Actions speak louder than words; this is especially true of apologies. Their words are empty and their actions are nonexistent.
Each time the mourning band comes up, a post like this shows up. This should spark a design improvement for hn: first thought is a clickable black bar that goes to the wiki entry for the recently diseased.
They only sought approval from the ethics board after the fact IIRC
Each time the mourning band comes up, a post like this shows up. This should spark a design improvement for hn: first thought is a clickable black bar that goes to the wiki entry for the recently diseased or the relevant submitted post.
> the University of Minnesota should shoulder a degree of responsibility.

In fact the argument could be made that there is an ethical duty for every software project, and possibly every individual, to economically boycott the University of Minnesota until they put in place independently-verified changes to their IRB process such that research like this will not be approved again.

If the only "cost" to the university is that one of its researchers has to write a two-faced apology message, then there is nothing stopping future abuses of non-consenting humans. Moreover, with no real punishment meted out, it creates an incentive for other universities to similarly weaken their IRB process to the same level so that they can approve more research projects and remain competitive.
You're being too coy. What do you think was revealed?
> 2) Actively avoid using AGPL and GPLv3 licenses if you can - don't encourage software socialism

Giving away everything, then not having it returned, is worse than "socialism". It's unilateral and asymmetric exploitation of our limited resources.
> but what does the resulting factory look like? Is it just a bunch of wires and combinators?

It seems like... yes?

https://user-images.githubusercontent.com/35386456/115978429...
OIC... you were triggered by me dreaming about an expensive, professional, software/hardware platform because it’s too expensive to meet YOUR qualifications for someone else’s list?
And still, Newark is not a very nice place to live.
you could also use the checkbox trick to make this work without javascript before <details> (and in e.g. ie11). Although <details> is amazingly widely supported, weirdly I had never heard of it until very recently.
I agree. There are weasel-words throughout, starting with apologizing for "any harm". When you've been told what the harm was, don't apologize for "any harm" you might have caused. You should start an apology by demonstrating that you have listened and understood exactly what harm you caused.

Listing the harm you caused is also an important part of the public record, so that anyone else considering a similar scheme in the future can see what consequences were agreed to have happened the last time.
> we did that because we knew we could not
ask the maintainers of Linux for permission, or they would be on the
lookout for the hypocrite patches.

For you security people out there, how do red teams handle this issue?
This paper had multiple issues that they where aware of before the ban, original ban email indicates that complaint was made before to there's university, on twitter feed one of the researchers stated that IEEE received also complaint regarding ethics of the paper, way before ban.
Tricks to Build a Personal Portfolio and Get Your Dream Job
>but it seems to involve a bit of DNS work from the censored website

Could you explain? I didn't see anything like that in the article.
You would think they already have enough of the regular currencies.
> Bringing up why you did something in an apology is very shaky. Like in this case, it can sound more like justifying / excusing.

Why is that a problem?
Why aren't people making touch interfaces for dragging together shell scripts? Mobile Linux should make use of the modularity of the Unix Environment, along with today's smartphone technology.

A big part of NextStep's design was an OO environment in a Unix OS. Those ideas later helped create the most successful Unix consumer operating system, macOS.

Command line on a smartphone is uninspiring. There needs to be something that reflects on today's technology. Like how NextStep reflected on GUI and OOP.
I hate empty cells for another reason - it busts your moving shortcuts. I rely on Ctrl clicking on arrows to get up and down a spreadsheet fast. Blanks slow your moving to crawl.
Goals of Dark v2
GPL, then make something so amazing that everyone needs to use it. Then cackle maniacally.
This apology fails from the 5th word:

"We sincerely apologize for any harm..."

While there are other requirements, a sincere apology cannot in any way entertain doubt about the fact that there WAS harm.

Truly acknowledging the harm done is foundational to a real apology, and most of us (myself included) end up sneaking in weasel words or phrases like this.

Psychologically, its nice for the apologizer, since it allows one to think "i'm being good by apologizing, but maybe I didn't do anything bad after all?".

But from the apologizee standpoint, these phrases are often devastating and can make it clear that the apologizer has no real recognition or care of what happened.

Personally I've worked pretty hard to try to remove these sorts of phrases from my apologies. It's not easy. It makes you feel much more vulnerable and you really have to let whatever you did sit with you in a very uncomfortable way. But it's worth it.
I understand how car pricing works. Nitpicking about the threshold isn't the point. Cheap new cars are a real, but small part of the total market. EVs don't compete there well now, but that says basically nothing about the ability of EVs to penetrate the broader market.
Sciter Uses JavaScript from Now and On
BSD 0 clause or GPLv2
> Almost all the reasons people use print debugging can be overcome by improving debuggers

speed and simplicity

https://www.youtube.com/watch?v=JXQZhyPK3Zw&t=1410s
However, when a vulnerability is found, you would expect that the path by which that vulnerability was introduced would be shut off, right? In this case, what they’ve done is to revert all patches from this group, pending further review, just in case something else slipped through.

They’re not sweeping issues under the carpet. They are actively addressing those issues.
> how many man-millennia have been wasted because of the armies of people who have posted something they're proud of, but is complete rubbish, on npmjs.org?

None. If someone is proud of something they worked hard on, why shouldn't they post it? What is the harm their hard work being public causes? It hurts literally no one.
"If anything, they should have learned something about not treating human beings as persons and not as involuntary guinea pigs."

Perhaps the entire "tech" industry needs to learn that lesson. Non-technical end users should be entitled to that same level of trust as nerds. I can download free open source code, extract a tarball and build the software without worrying too much about scanning through all the files first for phone home/telemetry/OriginTrials nonsense.^1 However non-technical end users who use programs compiled for them by "tech" companies with ads and surveillance as their "business model" are not entitled to the same trust. I cannot think of any justification for the difference.