skysight-inc/HackerNews huggingface dataset:
Huh? Environmental variables are only available to a process, any children the process has, any other process running as the same user ID, and the root user on a given POSIX compliant system.

E.g if I do this:

export FOO=bar

processes running as other user IDs (unless root) will not know FOO is “bar”. Actually, even other processes running as me/root won’t know FOO’s value until I spawn a child process after that “export” command—environment only becomes visible outside a process when it runs execve() and passes its environment on.

An environmental variable is about as safe as a file with 600 or 700 perms (i.e. make a file be set up with POSIX ACLs to be read only by the owner of the file): If user separation is done so insecure processes run with a different user/group ID (and modern *NIX system gives each user its own default group), the cracker still has work to do before getting important secrets in our environment.

Also, FOO being bar in the environment (i.e. we can see it with getenv() ) will only be visible to the current any child process after “export FOO=bar”.

If you’re able to run getenv() to get at the environment, or able to read (in Linux) /proc/$PID/environ to see the environment of other processes running as you, you will generally also be able to run open() to get at files.

Environment leaking is a serious bug in a *NIX/POSIX system; If I can, as “Alice”, view anything in the environment belonging to “Bob”, that’s a serious security bug which needs to have a CVE number.
Honest question, why not just use tmux? It does everything that splits can do.. and more :D
The "demographic contagion" is explained in the article as a spread of cultural mores towards smaller families.

There could also be an economic explanation. Traditionally large families were favored because they provided old-age security to parents. If an immigrant from a developing country is able to support their parents with remittances from a developed country, then there is less of a need for large families in the developing country.
i think we need to calm down with demographic determinism
That it's anonymous.
> I don't think this argument makes much sense, beyond completely legalistic.

The downstream users chose to use Log4j, chose to upgrade to the version where the exploit was introduced, chose not to audit the code. It's their responsibility and theirs alone.

A maintainer can release a new version of their software. No-one is under any obligation to use it. They certainly don't reach down into your repos and push their changes.

So I agree that the maintainers shipped a release. I certainly don't agree that the shipped it into anyone else's codebase.
AtoB (YC S20) is building Stripe for Transportation and hiring early team members
Some young people see immigration as a barrier to them having children as they have less career prospects and housing costs more.
That once you understand the underlying maths, the implementation will be easy, whereas in fact (almost) all the cases of crypto getting broken are people finding flaws in the implementation, or in the parameter choices.

That's why they say: "Never roll your own crypto".
both will
> unless real estate prices plummet to levels affordable to young couples without rich parents, you won't see birthrates in the west go up without heavy immigration from developing nations.

Ironically heavy immigration itself pushes up housing prices by increasing demand, and lowers wages by increasing supply:

https://www.independent.ie/business/jobs/not-enough-migrants...
Said Hollywood quiet is in excess of 80 dB still, though it sounds like someone having a carburator engine pop and not a gunshot.
Crypto is like casino tokens. Worth a lot inside the casino. Very limited value outside.
"Ironically Sinterklass and his cringe-worthy blackfaced Zwarte Piet servants would have sided with the racist pro-slavery Confederacy, not the Union."

No, just no. They are freed slaves, freed by St. Nicolas.

The discussion in the Netherlands is just something from the last 10 years. Many people have a very moderate opinion about it, but on both sides there are extremists, which is what the media focuses on.
> productivity of individual workers increases over time

So do house prices and taxes. Actually house prices have gone up way more than wages, eg https://www.newstatesman.com/politics/2021/05/how-uk-house-p...
Coming from a ML domain, I feel there is so much terminology and its duplication floating around which could be better explained, maybe with an example or a picture (or even a simple howto). The technical debt is just too high.

For example, hundreds of papers talking about 'inductive bias' or 'SE(3) operators' and what not. There isn't even a general boundary between unsupervised and self supervised learning (Remember Yann Lecun stepping in one such debate but without a conclusively clear demarcation). Very few actually try to explain a view that general practitioner can connect (with some basic exposure). Google maintains a ML glossary but that sorely needs some updation beyond the very basic stuff.
Since the original tweet is deleted, here is an archived copy: https://archive.md/NvaFR
When I see posts like this I try to keep an open mind.

Trying so hard…
So there's some thought that the Santa Claus myth is highly involved with the mushroom Amanita Muscaria.

https://www.npr.org/2010/12/24/132260025/did-shrooms-send-sa...
I think I’m too senior to believe in non-shit software.

I work in non tech enterprise. You’d think that things like the ransomware scandals, GDPR, the increased risk-awareness would have improved the business processes or management awareness or all the things are “corporate digital maturity” but the pressure to get things done fast with minimal resources has frankly never been higher.

In that environment we’re always going to have shit-software. If anything I agree with you, which is why I said that I thought that the current status quo was the best ever.
> In both cases, you'll want to have your terminal to be responsive again as soon as possible.

My terminal emulator doesn't become unresponsive just because the renderer cannot keep up. It still processes input, so if I accidentially

cat some-linux-distro-1of4.iso

...I can still Ctrl-C it and stop the process.

> it doesn't interrupt other applications.

It can't do that anyway in an environment that does preemptive multitasking.
Why not make it attractive for young couples in the west to start families instead of increasing immigration from developing countries?

Believe it or not, the lack of babies in the west is not some fancy fashion choice started by the Millennials, but a consequence of the broken housing market formed by government economic and banking policies of the last couple of decades that turned real estate into an investment vehicle for the haves in the detriment of the have-nots who also suffered wage stagnation, effectively pricing out young couples out of decent homes, so instead of hanging a heavy bank loan around their necks for a shoebox for the next 30 years, they choose not to bother with kids or stay debt free and single.

So how about we solve the housing market first, instead of throwing more gasoline on the fire via uncontrolled immigration in an already broken housing and jobs market?
The author thinks that Git is so obiquitous that they just use “Git” as a stand-in for “VCS” throughout after the first paragraph. So the author definitely thought that Git would be suitable for this.
That sounds like a Dockerfile
I wonder if there is a more sustainable way of dissuading rodents from ever entering a building.

I once had a terrible ant problem, they would always find their way into the kitchen. I tried a variety of products either intended to kill off the actual ant nests directly or trap the invaders, but there was always some quantity of ants remaining that would persist. Then I tried one product that was to simply be sprayed around the entrances like an invisible barrier, the ants would encounter it and just turn around. This turned out to be far more effective, and I felt like less of a jerk by not carpet bombing all the local ant nests.

I guess it might be harder to induce such behaviour in a rodent, I think the spray exploits the fact that ants leave chemical trails, so even if one of them figures out a path the rest wont follow. But the constant game of killing and collecting invaders must be exhausting.
As the other commenter replied p4 doesn't download the entire history locally, so storage is only a concern on the server. Depending on what you're storing in p4, you can use p4 archive and/or p4 obliterate to manage the actual storage used on the server. E.g. you might use p4 obliterate to only keep the latest version of your node modules folder in p4 if you're trying to optimize for CI performance, or if you're using p4 for build artifacts, you might use p4 archive and store the older revsions on slower bulk storage.
In what way has the US refused to use public funds to subsidize large corporations?
My original comment is a joke to security minded people, because if pentesters/crooks see you're handling your inputs in that manner, they know to keep looking.

Nobody in their right mind will sanitize (and specifically not encode), on receipt, something like a name to be safe for every logging library, query language, or output in HTML/terminal/etc their backend may use. Such an undertaking is even provably impossible for combinations where one component requires escape sequences that again would need to be escaped for something else - in a circular manner. And that's just one thing that's objectively wrong about the idea.

Beyond the rules applicable to the specific type of input (for example: it should be a correctly UTF-8 encoded string with a maximum length), you treat all user inputs as opaque binary/character/whatever blobs within your system. That means your system certainly never parses such a blob looking for 'magic characters'. And only once you're going to do absolutely anything with it you apply sanitation as required for the target - and you make sure it always happens automatically as a matter of process. For example: your SQL client library will automatically build queries in a safe manner, your HTML template library will escape all provided strings by default, and your logging library will not look for magic characters in format string arguments - that's what the damn format string itself is for!

By all means use whitelists of characters for user-provided inputs (if you know what you're doing and are not going to prevent 2 billion people from using your software because you just deleted their alphabets). But don't even try to accommodate your random assortment of current and future backend technology at that point.
The article does mention economic factors - e.g. the desire for families to educate their children, which for a family with many children is prohibitively expensive.
KJo is a slam-dunk open OTB, but I get your point!
Because valuation is easy only near equilibria; in old stale markets where the profit rates have dried up, innovation is over and an oligopoly has been established.
The vagaries of 1990s 32-bit Windows networking
Right, but how do you really feel about crypto?
There's a difference between utility and value. Plastic forks, knives, and spoons have high utility (in that they help us to eat). They have very little value, and can be purchased at any dollar store.

So the blockchain doesn't have intrinsic value because the crypto currency doesn't have intrinsic value.

Utility, for many use cases, it does have.
I find it hard to read manuals and documentation. I learn much better from seeing real code, and then trying and playing with it myself.

I’ve had an idea for a while that it would be interesting to document a computer language with a complete set of example code. This example code would exhibit all the language’s functionality. It would be written with best practices in mind.

The code wouldn’t necessarily need to do anything useful, The goal would be the code itself.
> If you know what you're doing, each one individually should take under an hour.

In other words - the second or third time you do it, it should take under an hour.
Yes, I think most friends would say “don’t worry you weren’t that clever to begin with” or some other friendly jokey thing. I’m not sure offering up their version of the “truth” is helpful at all, they are unlikely to be brain specialists!
Unfortunately we don't know who the majority owner of this casino is.
Sure, but there's no reason we can't do both.

but a consequence of the broken housing market

You sure about that? Birth rate is inversely correlated with income. Why are people who can't afford houses still having more children?

https://www.statista.com/statistics/241530/birth-rate-by-fam...
> The downstream users chose to use Log4j, chose to upgrade to the version where the exploit was introduced, chose not to audit the code. It's their responsibility and theirs alone.

No. It is manipulative framing where responsibility for backdoor is pushed onto users.

It is especially ridiculous in the context of industry where not upgrading is seen as irresponsible. And especially ridiculous when the same industry pushes for open source and when companies eventually start to listen and use open source, acts like there was something wrong with using open source.
It's morally right. Not everything in the world is a business transaction.
Gotcha. The difference is important, since a good log framework won't simply delegate, but will first check that the log level is enabled. This often matters, if there are any log statements in high-cardinality loops, since the memory pressure of creating all the strings adds up, but the trivial stack frames can often be optimized away / trivialized, depending on the language, runtime, etc.

I used to be a big believer in doing manual log-enabled checks, but man, does that make the code noisy. I still do that when I want to log something non-trivial to compute, but that's the exception, not the rule.
This kind of demographic transitions is not new, something similar happened among the elite in big cities during antiquity (Rome and Greece)

Scholars and rulers were not happy with the situation.

It forced them to offer citizenship to immigrants and slaves on as large scale.

It also probably inspired religions that were created at the time to put a strong emphasis on family values and large families.

I think we should both rejoice and try to better understand this self-regulating phenomenon.
That's a bold claim, can you unpack? Also, important for who?
Everything is worthless in itself. We give value to things subjectively and mediate this valuation through intersubjective consensus mechanisms. I'm glad that now we are in a position where a personal decision and valuation really counts, this is why I'm only taking web3 related jobs from now on.
That proof-of-work cryptocurrencies are backed by energy.
in the UK, I would say (based on my limited view point) that most people call him Father Christmas , but Santa Clause is sometimes used interchangeably
>Birth rate is inversely correlated with income.

That's a useless metric on its own if the rise in housing costs, education and childcare far exceed the rise in wages.

Also, more immigration means more demand for housing that's already expensive and scarce for the local population. How does adding more immigration help with the housing crisis?

Not saying we shouldn't have immigration, I'm saying it should be regulated to highly skilled professions that suffer demonstrated shortages (doctors, nurses, engineers, etc).

We have enough food delivery bicycle couriers and wage slaves that juggle between the unemployment office and seasonal gigs that pay piss poor and are open to exploitation by crappy business owners who thrive on exploiting desperate immigrants who can't defend themselves and bring down the wages for everyone because we keep pushing for more uncontrolled immigration.
I've seen this form of argument a lot lately. It's epistemologically unsound.

Both the claim "Spartans did this" and "Spartans did not do this" are affirmative claims that require evidence. Insufficient evidence leads solely to the conclusion "We do not know with any confidence whether Spartans did this or not." You cannot just assume that one of the affirmative positions is true because the other one lacks sufficient evidence.
Can somebody rephrase this comment? I don't understand it.
SpaceX is titering on bankruptcy so I don't know if your really want to be the "SpaceX of living for ever".

Also asking your employees to work over the holidays (SpaceX Company email) because of your management failures is not a good company culture.
There is something dystopian, childish, naive, desperate, arrogant, sad and tragic about billionaires founding and funding longevity companies and projects. They think that they've got it all, but deep down there's still this gaping hole of meaninglessness. They can control evertything. Everything but death. If only they can find a way to live longer, maybe even a way to never die of natural causes, everything will be better.

I'm not against research to better understand aging and diseases that are a consequence of aging such as dementia and various cancers. But when I read this announcement I feel an air of arrogance that fucking annoys me.
This is actually exactly what Molecule.dev is all about. All of the documentation, guides, and tutorials are written with both teams and individuals in mind.

It includes detailed step-by-step guides for every little thing you need to know to develop, release (and rerelease) your app on every platform you've selected, using the tools you've selected. It also covers many edge cases and obscure issues which we know that you will probably run into.

It's written for developers of varying levels of experience so that any member of the team (present or future) can quickly jump on board and get started building and deploying.

It also includes a (very meta) guide which explains how to update the guide itself and regenerate new documentation as you (and your team) add to it for your own purposes.
Orange/Blue Contrast
Something I've seen multiple times from junior developers is an expectation that the technology will tell them how to fix their errors/exceptions/unit tests/problems.

The technology in IDEs, the things you Google, the bugs you get, stack trace messages, none of these things TELL YOU WHAT TO DO OR FIX. They are clues or evidence. You have to bring the understanding and intention.

I expect that some people disagree about this being a problem, but I've seen it enough times to recognize it. Senior developers need to remember that they were not always senior.
Yes, and I think that both your example of expansion and the milder `log.debug("Added {} records. Build: ${buildId}")` (in which the logging infra evaluates "${buildId}") are bad, and mis-features in a logging infrastructure.
Thanks! I’m the author and I started out on my own so ported the article to my new website :)
ok but what is its value?
This reminds of a passage from Dune (context: the planet the book is set on is a desert with a very limited amount of water):

> "There were water riots when it was learned how many people the Duke was adding to the population," she said. "They stopped only when the people learned we were installing new windtraps and condensers to take care of the load."

> "There is only so much water to support human life here," he said. "The people know if more come to drink a limited amount of water, the price goes up and the very poor die. But the Duke has solved this. It doesn’t follow that the riots mean permanent hostility toward him."
If you publish something, you have responsibility over it.
> This person's spare time passion project is responsible for half of the internet working the way it should.

Not contradicting the article's core point, but I doubt that log4j is making "half of the internet" work.
The formally educated have always feared that the poor, unwashed and educated would get access to information. How would they be able to interpret it? After all, they might only have 0–5 years of vegetating at a desk in front of a scolding teacher whereas I have 13+ years of experience with that.

I think those fears are overblown and mostly class-motivated in any case.
because it's worth 0? just a wild guess.
Things can have high utility without any actual value. Toothpicks, eating utensils, screwdrivers, etc.

The problem comes when people mistake one for another.

IOW, buying a bunch of screwdrivers isn't a great retirement strategy.
And when do I want to `cat` 1GiB of text?

I cannot process it with my human eyes, so what does it matter if the CPU rendering can keep up or not?

cat 1_gb_of.txt | less

Is what I want to do, and this is easily rendered even on older hardware.
Wow, that’s a scary read…

No consideration, no discussion, no security analysis, just “JDNI is cool, can I hav plz? Ofc!”

Did none of these people consider what JDNI is designed to do?

Did none of these people consider what side-effects are appropriate within a logging library?
I managed to control my serious ant problem by feeding them. I would set up plates of sugar or sugary food outside, away from the house. Over time I got fewer and fewer scouts coming in to the house to snoop around.
crypto is like the spork
Hi, excuse the question, just genuinely curious, did the bike helmet help prevent worse damage in any way?
I actually went alacratty => wezterm => kitty. I tried and liked wezterm for a while after alacratty, but after some version, it did something that caused all heavy GPU-using programs(like firefox) to slow down severely, or seize up or something, on multiple computers, after running for more than 24-48 hrs. I had been using the default config, except for my preferred font (the VGA font from https://int10h.org/oldschool-pc-fonts/fontlist/). I unfortunately did not have the time to bisect the options or figure out what exactly was going on, but switching to kitty, cleared up the issue.

I tried looking for a bug reports that matched my symptoms, but found none, and I really did not have the the know-how to diagnose GPU issues, but I'd love to try to help isolate the bug.

It honestly felt like a GPU infinite loop, or GPU OOM issue, because the main CPU was idle, but input and redraws on FF would eventually seize up.
I'm genuinely impressed that you seem to have come up with a pro-immigration spin on the Great Replacement conspiracy theory[1].

Culture changes constantly with or without immigration. Do you really think everything we have now is good enough that it should be encased in amber for the next 100+ years? Personally I'm more interested in what evolves out of it.

[1]: https://en.wikipedia.org/wiki/Great_Replacement
The list is a personal selection - some critical of and some positive towards aspects of British culture. I'm not sure why it's upset you so, unless you either believe that there are no unattractive aspects of British culture, or that nobody should ever comment on the unattractive aspects.