skysight-inc/HackerNews huggingface dataset:
Won’t that make reproducing results difficult? I mean it seems like a result won’t be worth much if it’s only reproducable with a specific version of say glibc from five years ago.

Over the cause of one experiment sure, I can see why you’d like to know the calculation are done identically. I just question the validity/usefulness of a calculation that can only be repeated on one version of some library. Surely the overall result should remain the same.
This sounds very cool!

I'm curious what kind of business you're in?
These matches suffer from a very common problem in recommendation engines, which is a tendency toward matching with the long tail of randomness.

The problem is that your matching engine assumes perfect accuracy in vectorization, but actually, the vectorization is a sample from a distribution.

The distribution of the vectorization comes from the idea that it is trained on a mix of information and randomness, and this model is just one instance of the randomness. There are some sources of randomness in the model that you control, and others in the data.

To get better recommendations, you first need to get the distributions for each element of the vectorization. The simplest approximation would be a variance around the model output. Each item should have a variance determined by the amount of information available for that sample.

Now you have another problem, which is finding the closest vector. A p-test will fail you because that is telling you the probability that you came from the same distribution, which is going to be the random distribution for almost all pairs. You might ask something like, the probability that the two points come from a distribution that is distinct from the random distribution. You’d have to form that distribution, asses probability of membership, and then probability of rejection from randomness. You could also consider doing this for each vector element and returning a negative sum of log probability to represent the amount of information shared between vectors.

But ultimately, you need a truth set to test these methods against. This is easy. You just split each person into N people by randomly assigning their comments to one of N identities. This could also be used as an element of the variance.

An easy way to start is by bootstrapping the randomness. In this case, there is probably a random initialization vector in the model. You can bootstrap the distribution of each vector element w.r.t. the IV by running the model many times with random initialization vectors. You are still using a fixed point for the training data noise, but this is a start. To bootstrap the training noise variance, you can train many models using random selection of the data, and the same IV. A good heuristic split is to decide how many times you will run the model, x, and then do random selection by 1/sqrt(x). Ex. Run 100 times with 1/10th of the data in each run. Then you have two distributions for each vector element, one for the data randomness, and one for the model randomness, but the mean from the model randomness is the most informative. Now add the data variance / sqrt(x) to get a rough approximation of the true variance.

These are all hacky ways to get a decent improvement, and the formal methods will also give great improvement on top of that, but are easy to mess up and often quite expensive to bootstrap.
This worked relatively well for my account.

A major reason for my first match seems to have been both accounts talking about licensing issues and specifically GPL. Other matches seem to have shared some superficially similar political perspectives on HN.
A slightly more detailed answer than the other two you got:

It's likely a well-designed password (or similar) validation endpoint will both limit attempts per IP and per user, to avoid exactly the attack you describe.

This limit probably isn't permanent (though I think the design of Apple's HSM may be different here; too many attempts may lock or delete user data entirely?). Rather, it would be something like "allow 5 attempts per hour per user."

So, first, even if the attacker only exploits concurrency to speed things up--which implies the limits are only per IP--they can conduct attacks which are otherwise infeasible. (E.g. with 10k IPs at 5 attempts per hour per IP, they can brute force a six digit PIN in an average of an hour, as opposed to over a year.)

But second, what I think the attacker is describing is actually worse: he's saying that the quota "counter" is updated with a "read-modify-write pattern that's not safe for concurrent HTTP requests, so that you might have something like:

[request 0] read counter value = 0
[request 1] read counter value = 0
[request 0] set counter value = 1
[request 1] set counter value = 1

In this error, the counter is never incremented at all.

It's easy to imagine people making this mistake when they store the counter in something that does not support transactional updates.
This is an awesome comment.
As I said in a comment below su caggiu (or callu, it depends from where you are, we sardinians have a dialect for each village) is my preferred cheese, now I know more than before about it, thanks.
In many cases systems run out-of-tree drivers like Lustre, MOFED, NVIDIA etc. that tend to break due to kernel internal API changes. Yes, also for changes incorporated into minor RHEL releases like X.Y -> X.(Y+1), though not for kernel security updates within a minor X.Y release. At the same time they might need to keep up to date wrt security updates. So if CentOS stream implies that the kernel will randomly get an API-breaking update, with no security support for the previous version, that is not workable.
Isn't Chaozhou mostly Teochew-speaking? Wikipedia claims there are 10 million Teochew speakers in Chaozhou while listing the total population as 2.7 million, which obviously doesn't add up. https://en.wikipedia.org/wiki/Chaozhou#Language (My guess is metropolitan area vs. city boundaries.) But given that Teochew is named after Chaozhou (modulo romanization) I would've expected it to be locally dominant over Cantonese.

But what I was actually talking about were Huizhou, Heyuan, Meizhou etc. Basically, Cantonese extends as far east as Hong Kong and further east of that is marked as Hakka territory in the Language Atlas of China https://upload.wikimedia.org/wikipedia/commons/a/a9/Map_of_s... Meixian Hakka from Meizhou in particular has a prominent position within Hakka culture. https://en.wikipedia.org/wiki/Meixian_dialect
>It's healthy for everyone to have a competition

Recompile src-files and exchange a branding is not really what i call "competition"

>I want successful Debian

Debian IS successful.

>But really, it doesn't look like you're in the market for it. Some solutions welcome slow releases

That's not what is said nor meant, if for example RHEL 8.2 was released it took CentOS sometimes up to 6 month to release their 8.2 counterpart, in the meantime the newest patch (let's say for OracleDB) is just compatible/certified for 8.2, but you sit for 6 month on a centos 8.1.

But maybe your not in the market of having the latest patch for 3rd party software.
Reminds me of that time when I discovered encrypted spreadsheets on the network file system at my previous employer (a small company then) one late afternoon. I still remember vividly our CTO walking in 10 minutes later, saying he thinks our newest backups are three months old. I went home that day thinking if the company will even exist tomorrow.

The tendency for more regulation in the cyber is definitely there. I just have to wonder how it will play out between the poles of the process of security and convenience. We do have proactive measures against phishing and spam in-house, but as long as there is layer 8 of the OSI model involved, it will stay challenging, I guess ;)
Borsalino?
Factorio FFF Controversy
Thank you, I really appreaciate your comment, and I'll read up on Rich Dad, Poor Dad, index funds, etc.

> Then you need only worry about what you are entirely responsible for and not on other people which seems to be a motif in what you're saying.

You read me pretty well. I think I would be OK with relying on others though, but not necessarily with having faith in some made up economic scheme that I don't understand.
Really, compared to Python? I'm genuinely curious why you think so, it's the exact opposite for me.

Can't tell you the amount of times I've been able to just put pseudocode down in Ruby and have it work somehow, the language is beautiful
Back around 2000, I was writing software patches for a large telecom company. These patches had to be applied to live, inservice telephone switches and equipment that were powering public phone services - restarts and downtimes were not an option. Needless to say, careful consideration had to be given with regard to how a patch was developed and applied.

I don't recall the specifics, but one fateful patch had a very large compound boolean expression that included an invalid condition. For whatever reason, that expression didn't or couldn't receive 100% test coverage.

When applied, this patch took down the entire phone service (including emergency 911) for the island of Newfoundland Canada and all its residents (maybe 300-500k people).

The immediate fix was simply a new patch that reverted the bad patch. Unfortunately, it took several hours from the point we learned of the issue to writing, delivering and applying the fix.

I've heard that Newfoundlanders have a reputation for being very friendly, so I like to believe that all has been forgiven and forgotten and that I may one day visit the island in peace.
It’s tricky.

Taking things to an obviously absurd extreme, being unemployed is clearly not worth $400k/year: people work for far, far less.

As you say, longer blocks of vacation time definitely open up new possibilities, but perhaps there’s an inflection point: an 11-week trip seems like it’d be very nearly the same as a 10 week one.

Things get weird when much of the total comp is in benefits. For example, if your cash salary is $50k, that limits what you can do with your $100k “worth” of vacation.
$100k is the maximum reward, not the reward.
Functional integrated forksheet FETs for 2nm and 1nm chip designs
I would love for my vendors to support Debian but they won’t. Hell, it was hard enough to get them to update their systems to RHEL7 much less move to a totally different distro.
I think the newer version even opens Live projects with varying results. You'll obviously have to swap out any stuff that came with Live since even the samples only open with the right license.
Yes, although this is revealing in itself as to which languages are suited to which problem domains. Also shows up which platforms are suited to what; if I were building a C++ GUI I'd fire up Visual Studio, unless you told me it had to be cross-platform or not-Windows at which point I'd go back to "cry a lot". (Yes, Xamarin, QT, it's still a lot of work)

I think building non-web GUIs may have become harder since 2006, depending on platform/language.
It's healthy to acknowledge when something has made you angry and/or sad. It's healthy to spend some time grappling with the reasons for your feelings, but I get the sense that the author has probably spent too long in a negative state. This is not healthy. You can argue it's justified, and, depending on your angle, it is. But, you can justify a lot of things that aren't good for you.

Trust your anger is dubious advice. If you apply the necessary disclaimers, it's fine, but, again, I don't get the sense that the author is balanced in this area.

It doesn't matter how right you are when you're hurting yourself. You're the only one who lives your life, the only one experiencing your feelings. The worse you feel, the worse you feel, and that's it. It can be helpful to let negative emotions drive you, but if you don't walk a razor's edge, those negative emotions will consume the things that make the effort worthwhile.

Life is a gift. Hardships are interference. At times, you have to deal with interference to get back to enjoying the gift. Maybe you're dealing with the interference on behalf of someone else so that they can better enjoy life - noble, for sure. But, the interference can be so ubiquitous that we center our lives around the interference, and here is where we lose the plot. Perspective allows you to see which interferences you need to deal with and which you can look through. Imo we're not really evolved to deal with the world we've built for ourselves, so it takes a good deal of reflection to gain a working perspective. Without that reflection, life can seem like a train of tragedies.

More of a rant than I meant, but take care of yourself. Take care of how you feel and see the world. No one can do it for you, and you're the one who has to feel the way you feel.
Build something that solves a problem you have right now. Even if it's a trivial problem and nobody else will be able to use the solution except you.

That forces you to think real world usability etc
I recently started looking into the most mature SQL database for the browser. My goal was similar, to be able take data as json or HTTP responses or csv or whatever and be able to pass them through a SQL engine with the user providing custom code/data the whole way.

Turns out the most mature JavaScript database is SQLite ported to webassembly: https://github.com/sql-js/sql.js.

Based on that research, I wrote a bit about running SQL and other languages entirely in the browser here: https://datastation.multiprocess.io/blog/2021-06-16-language...
Same. I don't really recognize anything in the top four for me.

Edit: I lied, top match 'asark' tends to share in my proclivity for the run-on sentence. Topically we're not really into the same things, so it has to be something along those lines.
The American Renaissance Has Begun
Regarding Idiocracy, I think it gets more than enough attention. It's a funny movie, and a lot of its satirical barbs land, but its basic premise is a eugenicist lie that would cause a lot of damage if people took it too seriously. Moreover, even as social critique, it is rapidly becoming dated; broad-brush anti-intellectualism is certainly a problem, but it's not the problem - the political events of the past half-decade have reaffirmed that it's just one of a variety of types of toxic irrationality.
Thanks.

> Longterm investment yields 7% against all economic crises over two centuries.

I wonder what that percentage would look like in comparison to people who spent all their money on a cheap mortgage free house, and bought 1 or 2 houses to let afterwards. Could be more than 7%? I know far too little about this stuff to express it in a number/percentage.
While it feels HN to hate any companies that didn't do security "right", I think what Apple says makes total sense here. At least, the author claims that under his assumptions, his exploit would have worked and affected a majority of iCloud accounts, but it won't. You can't claim that you found a vulnerability without actually demonstrating it.

Key takeaway from Apple:

> They concluded that the only way to brute force the passcode is through brute forcing the Apple device which is not possible due to the local system rate limits.

The author did not understand that sentence accurately:

> There is very bleak chance for this endpoint to be not vulnerable to race hazard before my report because all the other endpoints I tested was vulnerable – SMS code validation, email code validation, two factor authentication, password validation was all vulnerable.

How I interpret that sentence is that, while other forms of verification are done on the server and thus subject to the vulnerability, the passcode verification is done on the device. When you send a passcode from another device, it is sent to the server and then routed to the device storing the passcode to perform the verification. Apple's servers do not store the hash throughout the process, and no form of brute force would have worked against the server. Instead, they are routed to the device storing the passcode, say iPhone, and the iPhone's HSM performs the verification. It's the HSM doing the rate limit here, and thus it's not subject to the vulnerability.
Here's a counter-example, you moron... Maybe the disabled person knows how to build a fucking boat. Or maybe they know what plants are safe to eat and which ones aren't.

I certainly wouldn't save a dimwit like you.
Ha, I've had this experience recently. I was working on a private pototype of automated dependency updates in GitHub repos before it was a thing that was widely available. Ended up abandoning it. Of course, a few years later....
In 2014, american corporations paid apx $600B in income taxes and $600B in wage taxes (the company's portion of social security). In addition, they pay another $100B in excise taxes and $400B in sales tax to state governments.
My friend asked for a complete list for an essay.
As an extreme case re: your point, OP mentions students who were actually setting stuff on fire at their school. Why the heck is police not getting involved at that point? We're talking actual, serious criminal behavior that can also be predictive of further crimes later in life if unaddressed, so some very real consequences are definitely called for, to try and set these kids straight. An ounce of prevention can save a pound of cure.
The biggest one I remember is telling everyone that I was logging off for the day, typing "sudo poweroff" and then wondering why my laptop hadn't shut down… turns out I was ssh-ed into our main production server which was not redundant and the whole system went down.

Thankfully my boss was understanding. I intercepted the on-call notice and took care of it before filing a report about how it happened which was probably helpful. I had pushed back previously against passwordless sudo as well and been overridden, so maybe they took that into account too. Still, I thought I was going to be fired for the mistake either way and am very thankful they didn't.
I find this report very funny because it ultimately places responsability upon administration. As if the curriculum and pedagogy weren't flawed to the bones, and as if the body of teachers knew any better. Your students are trying to burn the school, literally. Your classes and your method of evaluation suck. They contain the genesis of both the idiocracy and also the cleptocracy. Your debates are repetetive, meaningless and repetetively meaningless. I hope you never even get even one more inch of power. Eventually the rebellion of the slaves will succeed.
Yes, but that's a totally different category of problem from what proof assistants do.
Asshole Astrology: Week of 21 June 2021
Mass mask-wearing notably reduces Covid-19 transmission [pdf]
thanks for the suggestion, I am adding a feature to expand the comment in the view itself and user will be able to read the full comment without leaving the site.
Ideally, yes, but in my experience it's more often due to software management processes being, well, non-existent, and whatever exact version that is 'required' is the version that the original developer used and no attention whatsoever has been given to portability or even testing on other versions.

Luckily containers have become quite popular in the HPC world, to isolate such 'tricky' applications from the host OS.
Does your employer offer its people the 10-20% annual salary increase so they do not have to look elsewhere for what the market is willing to provide? I ask this seriously.
IMHO education is about giving everyone the u same opportunity, regardless of social circumstances. Evey study I know of shows, that the later you start to separate children the better of they are globally. That means that a school system faced with tremendous social imbalances has to ready to cope, and cover, those.

Higher educated parents have it easier helping their children with homework. They have the money and time for extra tutoring. Lower education equals less capabilities to support with homework, most often less time and certainly less money for extra tutoring. If a system is such you only succeed when you fall in the first group, it sucks. Supporting such a system, wholeheartedly as some on here seem to, is just cold hearted.
Going downwind faster than the wind speed
What an over-generalized and incredibly strange comment.
My daughter finished her CS degree about a year ago. I was glad to see that one required class had her build a very simple computer from gates as her final project. I don’t know the details, but I think the computer had perhaps 10 different instructions. She didn’t like that project very much, but I thought it was valuable; someone has got to understand the principles of operation at that level.

I started programming in the 60’s and at times had to load instructions into machines using binary on front panel switches. That’s the reasons that machines of that time had the lights and rows of switches on the front so that one could debug programs by looking at the lights to see the program counter, data value, or instruction. See [1] for a photo of a large front panel on an iconic machine of the time.

I even recall pulling plug panels out of card processing equipment to reprogram the sorting and selecting of input data being run through machine as huge stacks of punch cards, see [2] for a picture of a mid-20th century plug panel for data-processing.

The layers of abstraction are important. They enable us to construct some of the most useful, complex, and intricate artifacts ever made on our planet. Today I program in high level languages, and I get to use powerful frameworks, database systems, and amazing hardware right on my desk. Yet, I do miss some of the fun of invention and hacking on systems that I really understood in depth.

[1] https://en.m.wikipedia.org/wiki/Front_panel#/media/File%3A36...

[2] https://www.ebay.com/itm/133017817600?hash=item1ef87ad200:g:...
Just to add on, the license is for the current and past versions of the program. Distributing a program as FOSS is not a promise that the author will continue to improve the software, or that future versions will also be FOSS.

So, I think it's reasonable to suggest that "hey I can't maintain this software if you include it in your distribution because of the added workload".
Well, to meet your doppelgänger is an ill omen after all.
Doreen, your posts are too intelligent for this place... you're disturbing the wannabe fascists here clinging to whatever notions of superiority make them feel better about being FAANG parasites and incels.

EDIT: Wow, they've even grayed out your comment by now. @Dang, I hope you know what type of culture that you've perpetuated here.
I agree with your first point and disagree with the second. :)

I think it's highly likely that Apple was being honest and that the HSM service was not vulnerable to this attack. That's consistent (as you say) with this being a separate, highly-audited implementation, and frankly consistent with what Apple said--and to save, what, $200k, they have no real reason to lie to a researcher here.

To your second point, while this is indeed a big change in attack surface, I am not sure it's as problematic as you say. Doesn't the iCloud backup basically contain (for most users) all of the device contents--photos, messages, etc--that an attacker would want? Conversely, users want to be able to restore their iCloud backups from a new i-device if they lose their existing one, ideally without having to know more than the lockscreen PIN.

Given that, the two systems--the cloud system and the i-device--are storing mostly-identical data, offering mostly the same security guarantees (hardware-backed key derivation from a weak PIN, rate limiting), and the only issue is that this is just a second hardware security module that's separate from the one in the i-device.

For users who have turned off cloud backup, this might be a bad tradeoff. (Maybe turning off cloud backup turns off the HSM/PIN syncing?) But for most users, the gain in usability seems likely to far outweigh the hypothetical additional risk.