skysight-inc/HackerNews huggingface dataset:
Completely agree.

I recently had to work on an unfamiliar JS codebase. After initially pulling my hair out trying to understand what objects were being passed where, I decided to define some types and parameters using JSDoc . VsCode picked them up instantly and it was like coding with a language server after that.
In general, I think they should go for Rust. See [1].

Now, embedded is a special case. You need platform support, and possibly certification, none of which are a given in Rust today. Arguably, not in C23 either at the moment, though.

[1]: http://cliffle.com/blog/prefer-rust/
According to the OP tweet though, `foo()` is now a function that takes no arguments.
I think it's misinterpreting

>(e) No Use With Non-Google Maps.
It's high time governments and mega corps fund projects that rewrite all media decoding libraries in pure Rust (or some managed language is performance is not a concern).

People keep saying RIR is some how pointless but the reality is that its impossible to keep ahead of those vulnerabilities that aren't found yet.
Grsecurity for iOS/Android would stop them.
The proof may be valid but the implementation may have a mistake, or the compiler, or the operating system, or the hardware.
One can be fundamentally mistaken about what "it says on the box"
See WPA2/KRACK for example.

It becomes an infinite recursion of "how do we know the proof of the proof of the..." is what we actually want?
I refuse to use Terraform, and Pulumi, and many other things :)

One-off, poorly specified DSLs with no tool support, no debuggability, bad error reporting etc. are a good thing only in theory.

In practice, yes, we often have to use them because there's no other choice. It doesn't mean "oh just get over it, and reap the benefits" is a good argument.
> All I hope is that creating this image virus doesn't become common knowledge

All I hope is that devs start replacing parsers with ones written in a safe language.
Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files.

I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/.
>People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe.

This can be avoided if you have a cross platform high level language like say C# with a big standard library like .Net , the field needs then to make sure the language and core library are safe, most programs use existing libraries and put some business logic on top, I remember that memory safety was a thing before Rust was born, the issue was that either the languages were too slow, were not cross platform or had weird license or were "garbage".

If this gaints like Apple, Google, Facebook would contribute on rewriting or prove that the core libraries they use are correct then things would improve, but how would they continue to increase their obscene profits ?
Or if it dynamically loads anything that isn't formally proved.
Understand Wi-Fi 4/5/6/6E (802.11 n/AC/ax)
You could get productive in Rust in 3 months max, and then the productivity gains would quickly outweigh the initial investment
The preview feature, in particular, is exceptionally important. I cannot overstate what a difference it makes when reading deeply cross-referenced material.
They may not be moving around to explore so much as to keep their solar system safe.

Galactic orbits are far more chaotic than the sedate stable orbits within the solar system - stars closely approach each other on a somewhat regular basis.
So frustrated with the slow adoption/transition to memory-safe languages.
but does the hardware? Formally proven code does not prevent you from hardware bugs like rowhammer.
> Incentivises Amazon to hasten roboticisation and automation

That incentive already exists.

> Increases delivery costs, which are passed on to consumers

Good

> Consequently consumers buy less

Good

> Disincentivises driver productivity (since they get the same either way)

Fine

> Removes price signal to underperforming drivers to try another profession, thus misconfiguring the labour market (not in a massive way, but still inefficient)

Nonsense.
it is indeed that.
Some of the LWN comments suggest this is similar to previous/existing gating of features being fused off for example or only some cores being enabled. I think this looks very significantly worse for multiple reasons though. While clearly much of it is pure segmentation for pricing, fusing features/cores can have genuine yield justification too. If some silicon is simply off for good then it doesn't need to work let alone be stable, so if testing reveals defects that can be a reasonable way to salvage a chip. That the lower probability and thus lower count defect free chips would cost more made sense. And fusing also at least requires commitment: once done, the chip is permanently less valuable, which is at least some check on overly aggressive artificial monetization.

The perverse incentives here seem a ton worse. There is direct incentive to be very aggressive with it, because even if they get the balance wrong they can adjust it later and employ all the marketing stuff done with software (50% off sale on vector math acceleration 2 days only!). It'll by definition always be used with features that the chips are fully capable of and thus even further pushes towards tiering capabilities without any connection to yield. The centralized control requirements moving further into underlying hardware are concerning as well from a redundancy and security perspective. I'm a big believer in businesses following the incentive tracks they create long term, for better and for worse. With this development, Intel's are diverging further from their customers'.

About the best that can be said is that at least the market now is a lot more competitive. Between Intel's fab woes, TSMC, AMD and both Arm and burgeoning RISC-V efforts, Intel is more on than I think they've been in a very long time. Maybe ever? Which does make it all the more curious to me why they're trying this now of all times. Seems like 5-7 years ago they'd have really has us. Now though it's just another thing in strong competitors favor. The end of a lot of core x86-64 patents is starting to kick off too. Or maybe Intel thinks this will let them do sticker prices that are drastically lower and thus look better vs AMD et al even as they can still extract more money in the end? It's worrying. In fact now that I think more on it, Intel weakening but using this brings its own extra worries. If they feel the need (or are forced) to juice returns for shareholders and themselves down the road if their competitiveness falters, or even if they regain dominance, they will have an installed base with a capability to squeeze it.
Out of curiosity: why do you consider Casey's viewpoint incorrect?
Plaid is an evil nightmare product from Security Hell
You mean, when you look at your code, or someone else does, they think it's ok?

I guess that's why security issues, even in massively peer reviewed code, are a thing of the past, right?

Do your best, code as safely and securely as you know how, peer review and test and fuzz...

Then when you deploy your code, treat it as vulnerable, because history days it likely is.

Treat your phone as compromised. Anything network connected as compromised.

Because history says it can be, and easily.

Monitoring is one of the most important security measures for a reason.
How to Remove the Frustration of Reading in Games
Apparently, formal proof of algorithms being safe and sound has been repeatedly demonstrated, just not so toward Apple’s closed (proprietary) software specifically their large 14-format image decoders running outside a sandbox.
"Reading the Hackernews comments makes me lose a bit of faith in humanity."

— someone I forgot to warn about HN comments

https://twitter.com/paulg/status/1389891571718443010
> the maturity of the libraries in that area,

While true for C++ which is not very interoperable, C being very interoperable means that there is no advantage into using a C API from C rather than from Rust.

> how security critical your application is.

Rust also has productivity and general "correctness" advantages that go beyond security (although yes that alone is a factor)
I’m rather a fan of this sort of stuff but only with my middle finger firmly raised at the vendor. Electronic test equipment has been doing this for a long time. You can buy a base model item for $1000 and crack it to the $5000 part in thirty seconds.
> And those apps, probably upwards of 99.999999% of them will be unsafe.

Apps are sandboxed, so the damage should be limited to only the exploited app.

Pegasus exploits exploited iMessage et al, which are Apple's own apps with special permissions.
I've briefly used both so don't expect my comparison to be exhaustive:

- nix uses a centralized non-free repo (Github) ; guix relies on mailing lists for patches

- nix invents an entire language ecosystem that's based on JSON + functions ; guix reuses an existing (and complete) programming language (GNU/Guile, a dialect of Scheme lisp)

- nix packages proprietary software as long as they can provide a checksum for their executables/packages ; guix has a dedicated repo (non-guix) for that ; in both cases it's opt-in

- nix has differences in behavior when run as a distro (nixos) or on a foreign system ; guix has unified naming conventions for both cases (although some details of setting up on a foreign distro for eg. GUI applications can be a bit tricky)

- nix CLI is... confusing, to say the least ; guix CLI UX could be improved but is rather easy

- nix packages tend to be updated more quickly compared to guix packages

- guix maintainers are very picky about package descriptions: i tried to package a rust program along with ~20 dependencies, and the maintainer said i should come up with different short summaries vs long descriptions for those 20 dependencies... which are software i've never used so i'm not the good person to do just that

- guix has a strong emphasis on security R&D: bootstrappability is making huge progress alongside the guix project (see blog posts), which to my knowledge isn't researched on nix side ; "guix challenge" and "guix git-authenticate" are very important/cool things to read about if you're curious

- guix may introduce major syntactic changes to ease contribution, as was recently the case with "G-expressions" https://guix.gnu.org/en/blog/2021/the-big-change/

- nix uses mainline Linux + systemd ; guix uses Linux-libre + GNU/shepherd

Probably many other differences other people will point out, but that's the ones that struck me so far attempting to use both.
I’ll simply boycott Intel if they follow through with this. AMDs offerings have been far better value for some time now but Intel was always an option at a lower price point. Now it’s AMD or nothing, and so I think in fact this strategy gives AMD too much power.
Huh, how interesting. My reaction to reading the definition of network science was that this didn't sound like a genuine thing you could study at all. No surprise that it turned out you couldn't.

It's also quite intriguing that the originators of this claim came from physics. It seems like quite a few bad ideas in recent years trace back to people who left physics. Neil Ferguson studied physics before switching to epidemiology. Perhaps the general level of rigor required in modern physics pushes out the wooly thinkers and they end up undermining other fields instead.
That prompt has started to pop up much more in these days. Even just by opening the link.

Well, I guess Twitter people are about to start growing in their own bubble.
There is no safe way to code anything, ever.

(Yes people, and Apple should try, but...)
Social media: Altered images cause filtered mindset – campaigner
The files you posted hold no information about their type in the headers. So it's impossible to figure out.

BEATLES and MARLEY and simple lists of songs.
LINEN.IMG contains information in Slovenian about methods of solving a graphical algebraic table.
KASETA is more obscure, doesn't contain readable information I can extract.
A bunch of things in newer generations reduced the costs for operators (higher terminal density meant less need to buy up new sites for base stations, etc).

Another part is gross simplification of many protocol aspects and moving of "central office" to data center. 5G for example AFAIK makes mandatory what has been slowly been introduced since UMTS, that is a full IP telephony stack. It was already pushed hard on LTE but was optional (and later sold to users as VoLTE).

Among other things it allows all phones to easily use "WiFi calling" or connecting anything to the network so long as you can route an IPsec connection to provider edge. (anyone remembers ugly special SMS Sending cards full of sim carriers, used by paid text suppliers?)
> it doesn't show non-ASCI symbols in window titles in dom0:

Seems like one of the least interesting aspects of qubes. Was there a zero day in the font renderer? I would assume such a thing would be more about homograph attacks.
You are probably right, but this attack only became visible because it had a bug. How many others are invisible currently? Well that's what I'm asking myself :)
"It is okay to pay sub-living national wages to foreigners in other countries because their cost of living is lower"

And I suppose you should also add they must stay there and never come to your country because then your job is at risk?
C isn’t that small, compare it to a Zig hello world. Fast is relative — due to C not having good expressive/abstracting powers, it will leave you to inferior solutions, eg. counting string length multiple times at call sites, vs C++’s small string optimization, which is simply not possible in a user-ergonomic way in C. Regarding obviousness, I would add UB here, so Zig for example would beat it.

C is not any closer to the metal than other system level programming languages, this myth should just die. Your code at -O3 gets mangled to oblivion, unless you are a compiler writer of the respective compiler, you will have no idea on the generated code. This is the exact same as with C++, Rust, etc, hell, C doesn’t have proper simd support, so in a way the former two is closer to the metal.

But I do agree on portability and integrations - so C will not die, but I really have a hard time seeing why should I choose C over any of the listed languages, unless I target some obscure CPU architecture.
Ah I think I misunderstood what you meant by 'local'.
Why we need oil to build batteries
> Perl is very much an unreadable code soup.

It has been said that perl is the only language which looks the same both before and after RSA encryption.
I have an IDE with clang-lint and I find that it can spot pretty much every mistake. It can even detect some lifetime issues. Other than that my programming style is very much pass-by-value, trust the compiler to inline it, so the typical memory safety issues are simply not relevant to me.
Peer to peer LTE/5G at local scales is quite interesting in fact.

Though I LOL'd hard finding out some of the deployments are tactical comms in us military
This isn’t the free service though? It’s for the Google Maps API which does have a cost?

I remember trying to find some sort of point of interest API and having to quickly rule out Google after reading their terms. Stuff like “no caching” is somewhat painful.

Other platforms allow caching from a few weeks to a few months, they don’t have the reach of Google but at least have fairer terms (I’m not trying to build a competing Maps product here!).
This is off topic, but I don't think the problem is just that the Twitter is terrible.

If you want to link to a thread, you should click on the first tweet of that thread and copy its url. It's easy to see the rest of the thread: just scroll down.

If you want to link to one tweet in a thread you should click on that tweet and copy its url.

The person who posted the link to HN did the latter, while they should have done the former.

Twitter could make it easier to see that a tweet is part of a thread though.
URL preview is a pretty big attack surface, you have to fetch over network using complex protocols, parse the result for a variety of formats, and then render it.
That's not quite true, cython supports parallel for loops either by directly calling openmp or via cython.parallel.prange etc. (which wraps openmp AFAIK) you can also get simd speed ups via directly calling simd intrinsics or compiling with simd support and relying on the compiler (which is admittedly is not as sophisticated as numbas simd support). For GPU support I would likely go and use cupy or arrayfire.
Artificial intelligence may already be ‘slightly conscious’, AI scientists warn
0. it is a noticeable delay and impinges my momentum

1. A flash download is not involved

2. I hardly debug. I seem to be in a minority here, but my linter really does catch pretty much everything. I don't blindly write code, I always ponder my approach first.

So basically, the compile times pull me out of the flow.
The goals of state-sponsored cyber warfare are:

* Intelligence gathering

* Foreign military disruption

* Infrastructure disruption

* Civilian misinformation campaigns

* Civilian commerce disruption

* Trade disruption

The goals of cyber warfare campaigns are typically limited by the proxy relationships between national powers. For example China has sophisticated cyber capabilities but do not want to do anything that will damage economic relationships which includes any form of political interference thereby largely limiting their threat to the US to military and intelligence operations.

When you consider there are many players each of whose goals are a combination of national priorities and political relationships this gets complicated.
I have a 970/390 Mbps link (France, Orange) that I took more for the fun than anything else. Despite having a lot of self hosted environnements I will never even come close to that with current equipment and technology.

It would take a huge leap in a service requirements to change that, and would mean that I have to change my server and probably switch
No, we have some of the highest home ownerships in the world.

1/3rd of salary is more than enough to buy you a home. That's enough to get a 200k loan for 30 years while making average salary (1700 net euros).
There have been many exploits related to Unicode text rendering.
Isn’t vi already in POSIX? What’s the advantage over what OpenBSD should include already?
Is there a way to rescind said permissions?
Sure they are. They approved it 2011. Germany just now, halfways.

https://www.tunnel-online.info/en/artikel/tunnel__3596417.ht...

But apparently it's again stopped: https://www.dredgingtoday.com/2022/01/19/leipzig-court-tempo...

Overview: https://en.wikipedia.org/wiki/Fehmarn_Belt_Fixed_Link

There should be better articles about the cost overruns.
Wouldn't int foo(void) be a function that takes no arguments and int foo() a function that takes an unknown number of arguments?
I don’t see my SIMD instructions anywhere.
Personal Information Management
That's a different thing. That's implied `foo(void)`.
I don’t know. If I was going to bust a move on, say, Taiwan, it might be handy to have root access to as many computing devices as possible so that I could wreak havoc on my enemy’s communication and banking systems.
If you declare loop holes some how illegal you introduce arbitrary judgement.
> When studied experimentally, the tendency to prioritise rewards in the future rather than the present diminishes among those who feel low in power or perceive instability or uncertainty in their environment. The apparent failure of self-regulation – a trait admired in those who have it, and taught to those who don’t – is not a psychological impairment, but an adaptive response to having little actual control over one’s future.

When I was poor, I never thought I didn't have control over my future, this is likely luck on my part. I think this feeling of lack of control is way more a product of your parents and upbringing than anything else. Everyone knows stories of emigrants that made it from nothing, meanwhile others in similar conditions don't. I know plenty of rich people that don't do anything with themselves and live depressed completely absorbed in a feeling of lack of control over future, "nothing matters" nihilist bullshit too. They just started at a higher absolute value in their bank account so they don't count for the statistics but they're an even bigger drag on society because not only they don't generate anything new, they deprive others of the assets they just have lying around.

The article goes on to say that material help is way stronger than "just feel better" mindset coaching, and well, yeah - you can buy food with one and not with the other. But there's plenty of examples and literature as to why also just donating money doesn't solve the problem.

I think what solves the problem is creating conditions for good stable parenting of children. The problem is there's plenty of fucked up rich parents, so unfortunately I don't think I have a solution, but I don't think it's either just mindset changes or free money, and there's aspects missing of having a loving family who also focuses on building your character through positive role models and safety to fail. These are easier if you're not struggling to pay the bills, but surely this isn't as easy as airdropping money on everyone. I'm still positive about testing UBI though, I think it could help over several generations.
Yeah but anyone could tell LastPass were extremely lax as a business, their software has always seemed poor quality and their communication is terrible as well. 1Password nails both of these things.
I'd also like to read about people's experiences with Cue.

> In a language like Nix there isn't really a distinction between compile time and runtime anyways

This is very true, but exactly for this reason Cue's unified approach of having types be values seems like a good thing.

Perhaps Cue is missing the ability to create new abstractions? I guess Turing-completeness may be necessary for this after all.
>Why would somebody want to use this over nvi

This basically is nvi, unless I'm very wrong.
Control over the code that actually runs.

We already lose quite a bit of control with C (e.g. it reorders your code as it pleases) to gain portability across CPUs, otherwise we'd have to rewrite the code in several assembly languages.

If you consciously choose to give up even more control over the code that runs (because a compiler that targets C necessarily adds another layer of autogenerated code that you don't control) then it better be a wise tradeoff.
I think he does. NYC is very dependent on property taxes, and if people stay away, the city budget will be affected.
There is where you went off rails, with greetings from ACM.

https://queue.acm.org/detail.cfm?id=3212479