skysight-inc/HackerNews huggingface dataset:
> Honest question, what can be done to address this type of issue?

It is hard.

* Minimize dependencies. This is a problem for small organizations that really don't want to rewrite the world.

* Encourage dependencies on organizations that you have trust relationships or contractual relationships with. It is way less likely (though not impossible) that some malicious code will end up in an apache package than some random npm package owned by an individual person.

* Audit dependency changes. At the very least, have systems that detect various known-dangerous APIs showing up in OSS dependencies.

* Make it somebody's job to keep 3rd party code in check. This means pulling updates, auditing updates, and retiring unnecessary dependencies. People at your company should be able to get promoted by saying "we reduced the number of warranty-free dependencies in our codebase by 50%."
In the hypothetical case all versions but the newest are vulnerable and the zero-day is also a problem in your specific deployment: manual tool validation is what should happen. Usually after a quick check if the package can be replaced easily.
How is this Silicon Valley’s fault?

You have a bunch of puritanical politicians and voters who attempt to aggressively punish anyone that goes against their idea of a perfect puritan society. The result is laws that by design force corporations into over censoring to avoid liability.

Turning around and blaming SV for this is nonsense, especially when the same puritans are blaming SV for all of the non-puritanically pure parts of society.
> Limit your number of (transitive) dependencies, to lower the risk.

This is not really a viable solution in the JS ecosystem if you're using any popular framework like Vue or React. Note Vue pulled in node-ipc.

This "malicious actor" problem can be solved by NPM if they allowed better options when deciding which dependency version to pull. Right now it will pull any semver compatible version the moment it is published - there is no way to say "wait until all versions are at least a week or two old", which would basically eliminate most of the effects of nefarious versions.
Yeah. I would be interested in using Sublime Merge as a Merge tool for projects based in Perforce and Mercurial. But last I checked it wasn't really capable of that.

It should have been called Sublime Git. Alas.
I think you're confusing server certificates and client certificates - I'm specifically referring to client certificates here, aka TLS mutual authentication.

Also, isn't Charles OSX only?
Well OPs point is that these essays save you time because you filter out applicants that aren’t serious.

Anyone who has interviewed recently will know the amount of time wasted by organising interviews people don’t even turn up for, or show up and are completely winging it. This is designed to weed these people out, because it’s a way of demonstrating that the person applying actually wants the job and haven’t just sent their CV out to everyone who is hiring.
It is the politicians that pass laws to punitively punish companies like google is they ever allow any kid to see anything that isn’t ideologically pure.
Apple has both a 48 core & 64 core GPU variant of the M1 Ultra. Since the GPU is the largest single element of the M1 Max / Ultra, that's how they are handling yields. And it's then +$1000 for the 64 core variant over the 48 core, suggesting probably "normal" TSMC yields and then a very healthy profit margin. Apple does have the luxury of just charging whatever they want for this SoC since they are a market unto themselves. So even if yields are bad, they can just pass that cost along to the consumer.

Not entirely unlike what Intel used to do with Xeons before AMD re-entered the picture and what Nvidia kinda does with the likes of the A100.
The attractive option of atheism bit.

Plenty of other reasons why someone would turn to atheism. Eg the massive occurrence/support/obfuscation of sex abuse in the Catholic Church.
A quick websearch uncovered the following, which might be of interest to those who want to know more about such data.

* Wang, Ying-Chih, Richard W. Bohannon, Xiaoyan Li, Bhagwant Sindhu, and Jay Kapellusch. “Hand-Grip Strength: Normative Reference Values and Equations for Individuals 18 to 85 Years of Age Residing in the United States.” Journal of Orthopaedic & Sports Physical Therapy 48, no. 9 (September 2018): 685–93. https://doi.org/10.2519/jospt.2018.7851.
Can you provide a link or author name? I can’t seem to find that.
I remember reading an interesting article that asserted that Genghis Khan, the conqueror, considered Europe as a backward, shitty place not worthy of his attention. Since he and other foreign conquerors largely ignored them, Europe didn't face much external strife and conflict and it was also able to get access to science and knowledge from the more developed countries of the period (Genghis Khan cared about science, and ensured that all knowledge was collated and shared from all conquered regions, in his empire). This helped Europe develop unnoticed, at a much faster pace than other countries.
could google interfere w/ the API's that are used to make this work?
"First one must invent the universe".

That being said, I'm interested to see the range of answers to OP's question, partially as I'm curious what HN considers "from scratch" and partially because I've thought about doing the same thing.

Edit: Same thing making-gui-from-scratch, not the audio stuff.
Crostini's (crosvm) virgl is fast enough for gaming? Neat.
>money supply had the big upward adjustment in 1H2020 and inflation kicked in in 2H21

Inflation is not an instant phenomenon, it takes time from the point of money generation, to money distribution, to inflation. Money don't travel at the speed of light, and that delay you see is exactly what you would expect.
> Therefore, quite literally, doing absolutely nothing about CSAM itself would result in no harm to any child, as the harm has already occurred.

By this "moral" reasoning you're also fully supportive of revenge porn.
That's a stretch. If it's 3 strikes, then they're in for life (if they shoplift about $1k) and no longer committing the crime. Also, just because it didn't work for those repeat offenders, doesn't mean that the threat of punishment isn't a deterrent to a potential offender.

For example, as a kid you likely listened to your parents based on their threat of punishment. In reality, they have very little power and relatively minor punishments (with CPS getting involved).
> We are freezing our dependencies and aiming at almost never upgrading or updating things when possible.

I think this is an equally bad idea. The supply-chain attacks make the news, but getting pwned because of a known vuln in some dependency is a regular occurrence. That 10 year old OpenSSL binary is bad news.
It is across the country at this point. IIRC Gascón, the former DA in SF is now the DA in LA and pursuing similar policies, while there are similar policies implemented or being implemented in other cities like Chicago and New York.

People will blame the police, but I think this is a symptom of far greater issues in society, whose costs have been offloaded leaving the police to (poorly) manage it because that's probably the best they can do and everyone else is too busy avoiding culpability.
I've never encountered middle managers who think this way. They'd be overjoyed if the engineers want to write documentation. Getting engineers to write docs on the other hand... sigh. Most engineers I've worked with don't even want to comment their code beyond the bare minimum and throw a temper tantrum when having to write more than a few sentences on a service they've written. Heck I know engineers who see another non-updated comment in the codebase and use that as justification to not write docs themselves.
Nope, I'd still hire them and this tells me the ecosystem is dealing with a threat in an appropriate way. Russia citizens have given up their right to play with the rest of the tech world. The fact that this is a silly way to do it doesn't change that In 2022 I'm having to explain that if your citizens are cheering you on as you invade a sovereign nation while indiscriminately killing civilian you will face some reprocussians from those of us who have said enough is enough.

Anything short of literally killing Russians, including a embargo is fair game.

Disagree? Go explain it to the Ukrainian father burying his daughter. I don't want to hear it.
To me it’s just a reminder that you can’t just rely on trust and good faith when building systems including the internet itself. You have to design for bad actors or the honest people suffer.
I’m the opposite. I love emacs and have been using it since the previous millennium, but no matter how often I try, I just can’t get comfortable with org-mode. I spend far more time looking up how to do stuff than I do writing, and I never seem to be able to remember anything.
You need to recode your audio files with ffmpeg for example to the desired bitrate you want to stream.
Should we be concerned about ETOPS (colloquially "Engines Turn Or Passengers Swim") being extended to 300 minutes? That's up to 5 hours of hand-flying a jet with a failed engine.
This is a misunderstanding. The goal here is not to identify new child pornography, based on ML trained models. This is to identify known child pornography, according to a hashed value. The hashed value is generated by an ML model.
Not according to the market. What makes you think you can make such a claim in stark contrast (even if you believe a large portion is frivolous speculation) to the market?
A Generalised Method for Empirical Game Theoretic Analysis (2018)
how would this work for custom applications? Say I have a C program which does openssl handshakes inside. How can we implement the same SSLKEYLOGFILE functionality in it
See the Linux documentation's "How the development process works" [0].

The way a changeset goes from a developer's machine to the root is reasonably similar (it usually gets pulled through a number a intermediate trees, from a development tree to a sub-subsystem tree to a major subsystem tree to Linus's tree), riding the train from the bottom to the top, with an additional time constraint on it (the merge window being open).

The kernel also has a "next" tree that is a snapshot of what the kernel would look like with incoming changes merged right now, surfacing early the exact long-distance coordination issues described in the article. Plus, of course, everything is in the open, so maintainers of different subsystem can then coordinate directly on things that impact both sides, even if the required patches will if possible make their way up separately.

[0]: https://www.kernel.org/doc/html/latest/process/2.Process.htm...
I find this reaction, well, odd. It is basically arguing that we want giant multinational corporations to have more power than democratically elected governments.

I see diatribes all the time on HN bashing companies like AirBnB and Uber for "blatantly ignoring the law" to get what they want, and here are a bunch of people wishing for Google to blatantly ignore the law to get what they want.
At this stage, native Linux releases are becoming less and less likely because of Value's efforts to improve gaming on Linux, as paradoxical as that seems. Proton is getting better and better with each release, and in many cases, is providing better performance than running native code on Windows.

Why bother with official Linux support when you can just check that your game runs via Proton and push the burden of support onto Valve and the Proton community?
Plain text sucks. It’s so hard to represent context, time, location and state.

I have got to the point I just use the reminders app in apple ecosystem. Notes go in the notes app. Things get deleted when done or disinterest kicks in. Shortcuts fills up regular tasks for me.
I see, so you can never really get a match_failure due to type level mismatch with GADT because it would be caught by the compiler.

Makes sense to me.
That's why I'm of the opinion that, just as with the Oxford Comma, only godless heretics eschew the metric system. I can't tell you how many feet are in a mile, or at what temperature water boils in farenheit, or what the fuck a quart is, and I gleefully don't care!
If this kind of nonsense doesn't wake people up to the fact that cancel culture has just gone too far and is completely out of control, nothing will.
> The best info we have is that it was a bio lab release

Did you perchance mean wasn't a bio lab release?
The examples you list are all ones that have resulted in punishments and compensation to the victims. Why would people be outraged with the system working as it should?

Of course the news blows almost everything out of proportion, but the general public is more worried about thefts going unpunished with seemingly no recourse.
I already ran into apache issues back then, that's why there is a line in the script to stop apache to do chucking or buffering for example:

header("Content-Length: ".$settings["max_listen_time"] * $settings["bitrate"] * 128); //suppreses chuncked transfer-encoding
Other projects adopted non-malicious approach, where they publish anti war manifests: https://github.com/medikoo/es5-ext/blob/edf9fbac6c0d72a6192d...
Just FYI: it has context menus. So, if you have tmux to autostart when you open your fish shell, you will get a special tmux context menu on right-click instead of the Cool-Retro-Term menu that lets you edit your settings.
Whatever your thoughts are about the Ukraine invasion - and I suspect most, including me are against wars of aggression - the idea that we should take this situation as an excuse to re-write history deeply saddens me.

Maybe we should re-define the term first person in space to mean, the first person in space who isn't from a country we don't like? I believe we still recognized Yuri Gagarin as the first person in space during the cold war. What changed now?
This is really awesome, in all seriousness you could maybe sell this to Nerf
> Your comment, like many others in this thread, seems to be of the form "what if the police do this other, unrelated, illegal thing?"

It is not ( yet ) illegal to stand in front of a camera, to block something behind you.
Agree that politicians are to blame here, but SESTA / FOSTA laws have bipartisan support, not just from the religious right.
Every single one, as I understand from Amazon people I’ve met, can be interpreted as a weapon against someone to justify a PIP/termination.
Unless it's a carefully framed slow motion sequence of someone getting their brains blown out. Or hacked to death with a large sharp blade.

But at least our kids are safe from nipples.
SESTA and FOSTA are certainly DC's doing, but I think it's fair to say there is a serious aversion to sexuality and eroticism among incumbent platforms, that did not require any prodding from US lawmakers. For example, AFAIK, Instagram has never allowed "adult" content, since long before FOSTA; Steam has never allowed "pornography" on its platform, resulting in hundreds of games requiring patches [1] to play in the form the publisher intended.

Eroticism being a core component of art going all the way back to literal cave paintings, I am sometimes frustrated at the prudishness of the platforms we use in the contemporary age.

[1] https://store.steampowered.com/curator/34059662-Uncensor-Pat...
> I wonder if they would have the same opinion if the country in question is a non-Anglo non-West but democratic country like India or Brazil

I for one would have the same opinion. India and Brazil may have lots of corruption but they are still functioning democracies.

If it were Russia or China I would have a different opinion.
Yeah yeah, widespread human suffering, homelessness, blah blah blah whatever — won't somebody get their priorities straight and please think of the Property Crime instead??
If someone was running around your neighborhood trying to take your belongings, would you feel bad if someone called SWAT on them? I don't see how intentionally deleting people's files is much different.
The next step will be Google forcing their shiny new logistics customers to bid for the best route.
> This is not really a viable solution in the JS ecosystem if you're using any popular framework like Vue or React. Note Vue pulled in node-ipc.

Then you may need to reconsider using this kind of framework. If enough people do it, they may have to be more careful about what dependencies they have themselves.
That's excellent! Thanks for that.

I wasn't able to find that exact reference in the docs of the current release (using a mobile device at the moment). However, there is a very useful forum thread for anyone interested. It's not a straightforward install, but it's definitely possible to install/use Mathematica on FreeBSD.

https://forums.freebsd.org/threads/freebsd-13-0-runs-mathema...
sure, absolutely. ultimately though their clients generally are pretty reversible & we can keep doing whatever they do, but better and improved.

which is what makes humanity & society great- iteration & refinement & self-determinism. try as the sad pathetic squalid soulless ghouls might, the attempts to suppress soul & dignity are themselves usually temporary & brief regainings of control/destructions of human will.
Yes, I read the article. They recorded sounds they were making, such as walking, stepping on sand with Rice Krispies, and thumping the ground, but as far as I can tell, they did not record the sand singing, drumming, or droning on its own naturally, which it does.

Herbert was fascinated by desert and dune ecology. He would have loved this if he knew about it (maybe he did).
I recently interviewed at Amazon, and failed.

It was quite memorable in a bad way, it felt very unwelcoming and mechanical. I even wondered during the interview if I was actually talking to a human being or to a very elaborate AI + deep fake.

Nonetheless, their leadership principles are bookmarked for later reuse. They're very good general purpose guidance.
Which makes sense. They've found the best locations to sell gas from, and also the best places to receive large gas shipments and store enough gas to sell safely
Bitmovin Improves Support AV1 Video Encoding for VoD
Volatus secures production slot for large remotely piloted cargo aircraft
Example:

> If we can find a legitimate user client that provides an implementation of getTargetAndTrapForIndex() that returns a pointer to an IOExternalTrap residing in writable memory, then all we have to do is replace trap->func with a PACIZA'd function pointer (that is, a pointer signed under APIAKey with context 0). That means only a partial PAC bypass, such as the ability to forge just PACIZA pointers, would be sufficient.

https://googleprojectzero.blogspot.com/2019/02/examining-poi...

How are you going to overwrite memory with CHERI? It cuts off a key primitive for bypassing PAC.
Honestly, the way I wish we could fix this is to go back to people paying for software they rely on.

It would be (in my opinion) a fascinating court case to sue a company which got hacked which used lots of OSS, which all had a warranty that says "may not be fit for purpose".

If you built a house out of wood labelled "no warranty, may not be fit for purpose", and it fell down, I imagine you would be held responsible.
Majority of OSS has clear disclaimer that project is provided as is. It is right there, in the license.

Take it or leave it. Which works for the other side complainers too. The worm is available to be used for free by companies, because license said so.
There are several services which allow video uploads for "free" not really for free.

People have to understand that those companies are burning VC money to bait and switch people.

It is basically "dumping" and starving any competition until they find way to extract money from users ... or just sell BS to investors that they will get money from users.
Maybe it would be even more inclusive if they just asked about school, not high school or college specifically.
No law prevents google from placing ads almost wherever they like. Late night TV shows always had advertising on them, yet even remotely referencing sex on the net is unmonetizable
Very dumb question: when you say backed by Akka, what exactly do you mean? That you’ve configured a “binding” between Flint/Spark and Akka, which spins up actor instances (Java/Scala classes?) whenever some events occur? Or that Flint/Spark use Akka behind the scenes?
> Leadership is rich with experience in security and engineering

I think this is so important.

Thank you
A 2014 Google study reckoned 4% of the Internet is porn.

https://www.statista.com/chart/16959/share-of-the-internet-t...
im interested in the opposute, in not just teaching via technology, but in trying to create an empowered enriched relationship with technology.

in my fantasy world classes are setting up & adminhing their own clusters, are playing with userscripts & social web protocols, are creating nodebots.

im not really sure where to look, where the vanguard forces might be. huge respect to projects like the first robotics competiton but that still feels like a narrow course, one where the digital has some co-incident, but feels extra-curricular & dominated by other mechatronics concerns.
Uhm... I've rejected numerous applicants because they simply couldn't code, despite what was written in their CV, and this through whiteboard or side by side.

And I'm not talking complicated stuff, but simple things like reverse a string or implement the hashCode/equals-methods.

I'm all for giving people a chance, but requiring at least some basic knowledge for a coding position is fair IMHO.