skysight-inc/HackerNews huggingface dataset:
> Linux does this to prevent people from learning that the vulnerability exists

No, not at all, just to leave time to users to deploy the fix before everyone jumps on exploits. This is important because every single backported patch is a candidate for an exploit already, and it's only a matter of time before any of them is exploited. Reason why embargoes have to stay short. It takes some time to figure whether a bug may have security impacts. It takes much less time once this is figured, to develop an exploit.

By the way it could have really happened that the fix for data corruption would have been merged first, and only later the author figured there was a security impact. And the patch wouldn't have been any different. That's why leaving 1-2 weeks for the fix to flow via distros to users, and having the author post a complete article is by far the best solution for everyone.
Still No Consensus on Testing Private Methods
I’ve been using Mimestream as my main Gmail app on macOS for a few weeks, as Mailplane (my Gmail desktop app of choice for the past decade or so is being deprecated). Only thing missing is its inability to snooze messages, which slows down my daily workflow. Hopefully they will add it soon, for it is a well-built Gmail app. I don’t know whether I’d pay a hundred bucks for it, but it would be tempting.
I came across an interesting theory on why the gov’t is being more open about UAV observations in a HN comment a while back - paraphrasing:

Pilots may be under-reporting UAV sitings due to the fear of being labeled as crackpots and or dismissed. By speaking more openly about the subject the gov’t is signaling that it’s okay to talk about and shouldn’t be ridiculed.
“…treat the absence of one as a lack of consent. ” - do you have a source for this?

Their documentation states otherwise https://developers.google.com/search/docs/advanced/robots/ro...
Then please just consider that every single stable kernel contains 1 or 2 fixes for similar vulnerabilities that nobody took the effort to try to exploit. THIS is the reality.
Tens of thousands for solar doesn't include the cost of the factory producing the panels though, which has to come from similar, though not nearly as large, capital investments.
Sorry, but if anything in your paragraph is a pipe dream - its fusion energy.

Also, wind and solar may indeed be insufficient to meet the current energy footprint of first-worlders. However we know that most first-world energy consumers are ridiculously profligate. Basic lifestyle changes can significantly reduce consumer energy footprint. I know this because my family has done it without going full hippy-dippy.

Passive cooling where possible (e.g. opening windows at night, using window awnings during the day). Home insulation. Using LED lighting. Drive a hybrid or more efficient ICE vehicle that's sized for your actual needs not your emotional needs. Don't buy a new car every 3 years. Change your driving style (gentle acceleration and braking). If it's a 5 minute drive - walk. Buy as local as possible. Don't use disposable everything e.g. wash dishes rather than churning through plastic plates, cups and cutlery. If solar is viable for your home and you can afford it, do it. If public transport is viable where you live, then use it.

We are a family of 3 adults, living in a 4 bedroom home with 3 living areas. A/C heating and cooling. 2.3KW solar (which we've had for over 12 years). We've got 2 TV's, 2 computers, 3 phones, an Xbox, an iPad, a Wii (og), a dishwasher etc. Our electricity provider gives a comparison with "typical" families in the area. Our footprint is less than a "typical" 1 person household (which includes quite a few 1 and 2 br apartments). Not bad for not much effort.

But even this is just too radical for most people. Which is why we are collectively screwed. Everyone wants someone else to do the dirty work/experience the pain/make the sacrifice/produce the magic, or at best we want someone else to make the first move. And yes, industry has a big part to play. But I am doing my bit because I am a physicist by training and accept the science (though as an average physicist, made a career in IT). I also do it because, though I am not individually responsible for the outcome, I am individually responsible for my actions - and I want to be able to one day look my grandkids in the eye and honestly say "I tried."
The layout of a bit field in C is implementation defined. That makes them not a great choice for interfacing with hardware registers/descriptors or interoperating with binary file formats. (unless you are fine welding yourself to a specific set of compilers)

In applications like this where you really don't care about the layout of bits, they are just fine.

However… there is a violation in this library. As nrdvana points out in another comment, the "uint8_t ssolen:4" and the "uint8_t type : 2" fields are assumed to layout on top of each other using the same bits of the same byte, but this isn't really guaranteed by the C standard, though I think any sane compiler will do it.
Wow, no kidding! That's fascinating (tangentially I was wondering why they never targeted web, my
guess was it would weaken vendor lock-in and this seems to confirm
that mindset. Though it could also be that web wasn't a very good target in the era when they still cared about Flash.)

I never heard of AS4 before! That's so cool. I found a specification and whitepaper here https://github.com/adobe-research/ActionScript4

>HTML5/JavaScript is here to stay. One cannot not serve the Web! Here it is our task to provide a superior alternative where HTML5/JavaScript is bound to lack.

It was supposed to be a compiled language, in order to solve performance and battery issues on mobile devices.

Being able to say "we fixed one of your biggest complaints / reasons for trying to kill us" sounds like it would have been pretty good marketing, and Adobe with their budget seems like they could have afforded that easily. (I don't know how much it costs to develop a new programming language, but I know it has often been done by a single person in their spare time!)

It sounds like they also had plans to eventually bring AS to the server-side (made largely practical by the same advancements benefiting the client). (Perhaps they could have learned a thing or two from Haxe, with its "compile
everywhere" and CPP transpilation.)

Alas! Now to see if any curious bystanders have bothered to implement it... seems not. (I guess that's not too surprising, we're only halfway* done with AS2/3 implementations as it is!)

* https://github.com/ruffle-rs/ruffle/wiki/Roadmap#milestones
Pretty much every person on earth has to start living like the Amish.
Noted with apology. But then the comment got flagged. Is that done by admins or by users? Not sure if it's just a super downvote, or if it is reserved for what I accused the account of.
Yeah while I don't personally like the extreme over reliance on just secondary sources to the point where it leads to driving out actual experts, I can't imagine how bad it would be with just even less strict sourcing rules in general. Actually I can, that was pretty much wikipedia until the big clean ups that happened at the end of the last decade and I'm glad we are past that... interesting early stage.
>But the overwhelming majority of owners think it's great.

I don't care at all what the overwhelming majority of owners think. Maybe 95% of customers are happy to have saved a few hours in a dealership, but when the 5% are without a car for six months that's pretty cold comfort.

The problems I am discussing are very serious. It is not enough for them to be uncommon; they must be unheard of.
> What I think happened is that they breached the control infrastructure which gives them access to an "internal" VLAN that the satellite terminals use to communicate with the mothership for ...

> ... whatever is the TR-069 equivalent for BGAN terminals ...

These VSAT terminals support TR-069 [0] and my first thought when I heard about this was a compromised ACS. It wouldn't be the first time.

---

[0]: https://en.m.wikipedia.org/wiki/TR-069
I get 240 with Firefox nightly (no addons) on a Mac Air M1.
> True for the England wikipedia, but the mods for the wikipedias in other languages enforce the rules differently.

To sometimes very very mixed results (at best).
>An NVMe device can have multiple queues and each queue can contain many requests at a time.

To put this into perspective, whereas AHCI/SATA (NCQ and TCQ) has one command queue with a depth of 32 commands (SAS has a queue depth of 254 commands), NVMe is designed to have up to 65,535 queues with as many as 65,536 commands per queue.
Seems like an unlikely driver in it's own, especially considering those didn't show up until near the end of this time period. Meanwhile Chrome has been needing to run more power efficiently at similar refresh rates and pixel counts on Android devices all the same. Of course ARM Android devices don't have Safari to compare to nor are they a new platform ripe with as many low hanging fruit optimizations so it's not going to be the lead topic here.

The truth is this is the same kind of stuff Chrome (and any browser) has been working on since the software launched. Regardless of which devices come out nobody has ever said "I like that this browser is slower and less efficient than the other".
Great idea, but might want to change the name to avoid confusion with libc. Unless that was some sort of play on words, idk
Omniplan looks excellent - anyone aware of a good open source alternative?
> The people writing the commit already know it's a security issue.

For this special case, yes. But for the vast majority of bugs it's the opposite and existing bugs get exploited later, thanks to some people who think that some patches are not security-related and do not apply the fixes.
A few countries had an outsized role in deciding these terms like much of the other WTOs rules...through the use of pressure, coercion, and other carrot/stick approaches.

If it's not voluntary, I don't consider it global consensus.

Joseph Stiglitz makes a similar point...

"TRIPs imposed on the entire world the dominant intellectual property regime in the United States and Europe, as it is today. I believe that the way that intellectual property regime has evolved is not good for the United States and the EU; but even more, I believe it is not in the interest of the developing countries."
> Remember when the first COVID shutdowns happened and air quality around the world rebounded in astonishing ways?

Yes, we're definitely not beyond the point of no return.. yet. Natures engine can still drive restoration.

But what I also remember from covid is the plethora of sterilization and depopulation conspiracies. If we put 2 and 2 together..
I made one a few days ago.

https://news.ycombinator.com/item?id=30509847

I just filled in both the url and text fields and it just worked for me.
If you made it a web component it could work in Vue, Svelte, Angular, etc. too.
Not a hero, but a fool.

Imagine what would the repercussions for the field be if the surgery went a little worse since it seems so badly planned from the outset? More restrictive regulation against the practice? All major funding either pulled outright or forever tainted with the stigma arising from this endeavor ?

I don't know what it is about HN that this forum praises seemingly stupid pursuits such as a neurosurgeon choosing to operate on himself without (a) Validating the approach better and (b) Having a backup plan in case things went bad (No person in the US to come and care for him etc) and (c) Using antiquated electronics in the eyes of the very experts he was entrusting with the operation.
Infrared Grills: Otto Wilde, Northfire Inferno, Beefer Review
There are obvious incentives to present Russia as a lawless criminal wasteland and the US as a good global citizen.
The headline is quite a bit of clickbait. And the frame of the article is aimed at clicks and keeping the reader hooked by creating the impression he had made some monumental mistake.

He had some brain swelling shortly after the surgery. Thats it.

Still great to have posted it, amazing guy
are you living under a rock? Do you remember the recent oil pipeline and meat packing facilities that got ransomwared? Ton's of government sites and corporations get hacked. It's way more than what's publicly available too. Most of the time entities just pay up and keep it secret. Lots of the attacks come from russia. They pump out a shit load of malware.
Aside from the torture and human experimentation on unwitting subjects, at some point in the practical field work of how to surreptitiously administer it, they started testing their techniques on each other. Nearly everyone involved in MKUltra acid research took a lot of acid early on. (I'm a little surprised how little this gets mentioned given the bizarre saga that followed.) Dosing each other became something of a game:

> They approached the problem systematically, taking one step at a time, until they reached a point where outsiders were zapped with no explanation whatsoever. First everyone in Technical Services tried LSD. They tripped alone and in groups. A typical experiment involved two people pairing off in a closed room where they observed each other for hours at a time, took notes, and analyzed their experiences. As Gottlieb later explained, "There was an extensive amount of self-experimentation for the reason that we felt that a first hand knowledge of the subjective effects of these drugs (was] important to those of us who were involved in the program."

> When they finally learned the hallucinogenic ropes, so to speak, they agreed among themselves to slip LSD into each other's drinks. The target never knew when his turn would come, but as soon as the drug was ingested a TSS colleague would tell him so
he could make the necessary preparations—which usually meant taking the rest of the day off. Initially the leaders of MK-ULTRA restricted the surprise acid tests to TSS members, but when this phase had run its course they started dosing other Agency
personnel who had never tripped before. Nearly everyone was fair game, and surprise acid trips became something of an occupational hazard among CIA operatives.

-- Acid Dreams: The Complete Social History of LSD
Which is a big mistake. There is a reason why Germany is the export powerhouse it is.
I'm writing a book that focuses on the practical aspects of mathematics for software engineers. You might enjoy it, check it out: https://buttondown.email/j2kun/archive/a-week-of-book-writin...
It's not a vaccine, but there are existing nasal sprays [0] with iota-carrageenan, which has anti-viral properties and has been shown in-vitro [1] to be effective against covid:

[0] https://www.betadine.ca/nasal-spray/

[1] https://journals.plos.org/plosone/article?id=10.1371/journal...
Ukrainian Women Will Suffer
Both of those ways are what I said, done in different ways. PCI-in-USB3 is not a standard protocol. No matter what you do, there is no way to make it work within standard class protocols only.

> There's two other ways. One is to use a USB 3 to PCI express bridge and then functional pcie USB controller chipsets. I'm not aware of any such bridge silicon existing.

Not USB3, but this is what Thunderbolt docks/hubs do, use embedded PCI USB host controllers for the downstream ports. Which is great! But not for long: the USB-IF took over Thunderbolt and surprise surprise! USB4 includes a new USB3 tunneling mechanism but still not USB2. Yes, really. USB4 docks are expected to still have a ridiculous sidecar USB2 hub just handling USB2 duties and squeezing all that traffic into the USB2 lane all the way to the host. Because that makes sense. Of course, since PCI tunneling is still a thing and standard in USB4, at least you can ignore that nonsense and keep doing it the Thunderbolt way, but I think we're going to see fewer and fewer solutions that do it this way, and USB4 docks which do USB3 tunneling and USB2 passthrough will be a regression over TB3 docks that include full host controllers. You can thank the USB-IF for this.

> The second way is what you said, to skip the bridge and create a USB host controller that connects though via USB. Again, I'm not aware of the existence of any such silicon.

Such silicon exists, I just can't find it right now. It's another very niche thing in a similar vein to the VL67x from another manufacturer.
Economics is not physics. It has no laws. And the field could not exist if it were zero-sum.

Edit: I should clarify that economics does not have laws in the same way physics does. The ‘law of diminishing returns’, for example, is more of a trend or generalization than an absolute, and is frequently violated in a way that gravity is not.

Economics is also still not a well understood field. There may be government policies with unexpected effects due to that incomplete understanding. We have seen this many times.
How I Use My Computer
From the start it was done for show. He paraded himself around at least one neuroscience conference while still healing from getting the implant.
I got Chrome v99: 290, Safari v15.3: 279 on M1Max MPB I suspect it might go faster if I turn off scaling.
Bitmark: the code that makes education accessible
Symphonies of the Planets, perhaps?

https://rateyourmusic.com/release/album/various-artists/symp...
It's not a law of nature. There are many hypothetical scenarios where deficit spending does not lead to inflation (usually variations of the theme that deficit spending's wealth creation outpaces the spending amount and the deficit spending can eventually be scaled back while wealth creation continues).

Whether those hypothetical scenarios are realistic and likely to happen is an entirely separate topic, but it's not an ironclad law of nature in the same way that gravity is. It is a much more contingent and circumstantial observation.
Saw about the same impact of 1p and uBO in Firefox.
If poverty is going down, how are we paying the bill? Our people are getting wealthier.
[citation needed]

Everything I've ever read said it was developed by Synaptics.

The only reference I can find to Apple paying Creative royalties for patents is for some B.S. "hierarchical tree of music" UI patent
I just bought an after market 12v lithium battery: https://www.ohmmu.com/

Shouldn't have to replace it for a long time (if ever) and seems to work fine. More expensive than lead acid but more convenient than service appointment for a 12v battery.
https://github.com/zserge/q, an experimental minimalistic clone of Vue, uses object.defineProperty. (There has been an attempt to use Proxy instead, but there's a problem with it: https://github.com/zserge/q/issues/1) I don't think I could make it any lighter if I wanted to.
Maybe you're right, feel free to ignore the "free" if it makes it make more sense, the "free" part wasn't the point so much as letting the market decide where carbon is worth a steep price and where it isn't.
Exactly right. And usually there are multiple causes, some are temporary, some are permanent.

For example there are currently chip shortages. Supply and demand says that when there are shortages prices go up. Chips are in everything, so the knock on effect is huge. Which in turn drives up prices, but also results in some other shortages (like cars) which in turn has ripple effects.

It's possible, perhaps even probable, that these shortages are short-term, and prices will stabilise, meaning that they'll find a new "fixed" level. Corrections in supply may lead to over-supply and prices coming down, or demand may drop and prices come down.

There was a shortage of lumber, coupled with high demand, during the first year of the pandemic due to low staffing at Mills, combined with people at home with time on their hands. Back to work means not just supply being restored, but lower demand, and prices have fallen (although not necessarily to pre-pandemic levels.)

These are just two examples, with very different supply/demand curves. Literally everything will have its own curve.

Pandemics do not imply inflation, but a massive stay-at-home is going to affect supply, at every possible level (production, distribution, retail) so inflation is certainly likely. In sectors where demand increases from people staying at home the effect is more pronounced.
> Is it not worrying that this kind of response is left to Google?

What do you mean “left to” (or “response” for that matter)? Google chooses to do report this information (which is a mix of info gathered from other sources and it's own work to protect it's own critical infrastructure), no one leaves it to them.

The government does it's own publication of extensive cybersecurity information of this type, too; see, generally:

https://www.cisa.gov/uscert/ncas
So you update your kernel for every single commit as soon as it's merged in? If not, you already obviously understand how ridiculous your argument is.

I've already explained that most people have some sort of cadence for updating.

Based on your other comments you're just going to ignorantly parrot Greg's talking points. I don't think you have much insight into this.
You never know if it was already being exploited, but once thing is sure, once the patch gets merged, it's a race and only a matter of time before an exploit is written. Two weeks is already long and may leave distro users exposed, which is why it's important that it doesn't stay too long in the fridge. Ideally we should have a "patch day" every week that distros would align on. That would allow users to adapt to this and get prepared to applying fixes everywhere without having to wonder about what fix addresses what, and more importantly it would remove the surprise effect. The distros process doesn't make this possible at the moment.
Or maybe parts of google are sending emails that look too much like phishing. It wouldn’t be the first time my personal phishing meter triggered on some corporate emails.
It's a crime not to mention Gödel, Escher, Bach.
> but that is over now

What gives you this impression? What happens to the tens of millions of people who live in suburbia? What happens for those who enjoy living in suburbia?
> I have various ideas, not especially "high tech" more assembling of off the shelf components to create novel products that I think may be useful (I have a need for these myself). So I could build a prototype myself (despite being a software person). After that what?

I'm exactly on the same boat for Butt Mover[1], A butt triggered productivity-health game.

So I'm taking a novel approach; I'm not going to build the input hardware i.e. Butt Trigger, instead going to rope-in individual builders across the world to build and sell the Butt Triggers based on my design(without any commission to me) for their region while I provide the SAAS for Butt Mover.

This in theory should address the manufacturing, shipping, support woes in selling a hardware product which even on normal times was ludicrous to do from India(Shipping fee over ocean is at least 6X that of product). But commercial success of this process depends upon several variables, Guess we'd find out soon as I'm planning an early access for the game next week.

[1] https://buttmover.com
There's no such thing as "the laws of economics". There are goods and services and constraints, and there are economic models.