skysight-inc/HackerNews huggingface dataset:
once again I am glad I am not a Python programmer.

What is this: "math.isclose()"???

In computing floating point numbers cannot be compared for equality. It is obvious why.

So "math.isclose()" is for people who cannot use "<" or ">" operators?

Golly. Do any programmers need it explained to them why floating point numbers are not precise and equality does not apply?

Decimal types are an abomination. The Fraction type blows my mind. Why? It is the sort of nonsense C++ programmers loved to do in the twentieth century, and we all (?) learnt from that and do not do such opaque things any more.

This is all very elementary mathematics, and a language is wasting its time making easy things easy. Programmers must learn the easy things
I am still deeply skeptical that this exploit really exists, or if it does, it is extremely exaggerated. I can’t really articulate the reasons why. Part of it is the fact that a lot of the people reporting on it self-admit that they are unfamiliar with Java and Spring. One “PoC” repo I’ve seen is just simple API misuse. API misuse is a CVE in the application that does the misusing, NOT the library that is misused (in this case spring).

Something else is that very soon after there was a /hint/ of a log4j exploit, we saw rapid and evolving exploitation in the wild. We have nothing like that happening now, since this news first broke, what, 12 hours ago?

Then there’s also the suspicion where I feel the LunaSec people, one of the first groups to report on this, are desperately trying to re-catch the fire they caught when they first reported log4j. I’m sure that was amazing for marketing their company. Problem is, I think reporting on this before there is really indication of a real issue reduces the credibility of them as competent security researchers.

Of course, I may come back to eat my words.
FEC fines DNC and Clinton for Trump dossier hoax
Energy is their #1 cost so they bargain heavily for large subsidies.
They lied. They also passed on the documents that were signed by borrowers, who were also lying.
I'm guessing that the bureaucracy of such a system would be a significant burden. To avoid having the system badly gamed, you'd need a second evaluation, yes? By a _neutral_ party, (not a doctor working in the same practice, e.g.) At added cost and time. Not to mention I've heard more than one surgeon say "That was more difficult than I expected based on the imaging ... once we got in there we found <>".

I'm also arguing that it's not just a psychological resistance to a data-based evaluation system. That people understand the system would be subject to being gamed, and the overall quality of the work would actually suffer. (A bit analogous to how peer-review and the tenure game has interfered with good science practices.)
Probably. But Facebook doesn't care. They have Instagram, WhatsApp and soon the metaverse. They have enough pans on the fire to keep cooking. I left it long ago too. But WhatsApp is harder to do without. I think their company is doing fine and they seem to diversify very well.

The only boat that they really seem to have missed is the community that tiktok serves. But it seems to offer the lowest standard of viral memes and stupid joke videos.. I'm not on tiktok but every time someone sends me a video I really hate, it has their logo on it. I've literally never seen anything that came across my WhatsApp with that logo that was worth watching. So I'm definitely not tempted to try. For some reason it really rubs me the wrong way. It seems to embody everything I hated about what Facebook became. If I were leading Facebook I'd not want to double down on that direction either.

For what it's worth, when I was on Facebook I also hated people (re)sharing memes and videos. I used it to see what my friends were up to in their lives but the amount of crap became too high. Too many people sharing memes, 'funny' videos, petitions or trying to sell/promote stuff. I think it's the algorithms egging them on. Trying to get as many likes and followers as they can. Eventually people got disillusioned with that rat race on Facebook, and I think the same will happen to the tiktok crowd.

But maybe social media is just not for me. The more algorithms involved, the worse it seems to get at showing me what I want to see. I have very little patience for wading through a timeline of stuff I'm not interested in trying to find the one bit of worthwhile information. WhatsApp has pretty much taken over that function for me. Because it doesn't do any prioritising or inserting ads or content it thinks I will like, it just passes messages like it should do. Just like Facebook used to do before it went down the toilet. Most of my real friends I now have in WhatsApp groups.

But of course that's also owned by Facebook.. So yes I think Facebook the company (now meta) will be fine. Facebook the service not. I think the metaverse is a risky bet but potentially very rewarding.
Yes the Netherlands is dense, but a vast majority of it is still open space. You can see by just looking at a satellite view of Zeewolde. It's almost entirely farmland.
> The problem is: how do you run a business that has offices and physical assets in Russia, without being at least partially beholden to the Russian government?

The same could be said for businesses that have offices and physical assets in the US.
The missing word is 'efficiency'.

To TRANSMIT a radio signal (and here we don't differentiate between AM, FM, PM or any of the other ways of modulating a radio wave) most efficiently and most cheaply the antenna must be tuned to the signal's frequency/wavelength.

To RECEIVE a radio signal, while it's most efficient to have the antenna tuned to the signal's frequency/wavelength, it's mostly not as convenient to do so. If the antenna only picks up 20% of the possible signal, so what? As long as enough signal is received for you to listen to, that's all that matters.

(In some cases, where we're not needing portability, like permanent radio-receiving stations we usually do see tuned antennas in use.)
I'm not sure why my comment is so objectionable, when all I did was offer a formula and principle as per the parent comment's request. I suspect that people with more than $100 MM in wealth have better things to do with their time than downvote suggestions on HN that they should pay more tax, so, in the absence of any more substantive criticism, I'll assume the objectors were people who consider themselves temporarily embarrassed millionaires.

http://www.temporarilyembarrassedmillionaires.org/
It's hard to evaluate whether stuff is really more or less secure.

I think it's definitely safer than 20 years ago, when all the exploits seemed to be trivial script kiddy stuff and nobody even used encryption, but we also have a lot more hackers, and a lot more attack surface, because we do more with tech.

In terms of CVEs per feature I'd think we are a bit safer, but the dominating factor is just the fact everything is online and black hats unfortunately are everywhere.

It would be interesting to sketch out how the modern world could exist without all these billions of layers though. How could we get everything online, do contactless payments with phones, make passwords sync, have web apps with all the current features, track our keys with tile, etc, without all the billions of lines.

Is is possible/economical in real world conditions?

To me, the extra risk of getting hacked is fairly low in terms of expected value. Someone could get hacked 5 times and still be ahead if a smart device stopped their neighbors from burning down the neighborhood, or prevented some wacky chain of events that made them get fired.
>Ideology? There is no ideology behind trying to save lives and protect society.

Of course there is.

Ideology: a system of ideas and ideals, especially one which forms the basis of economic or political theory and policy.

You just stated that we should try to save lives and protect society, and implicitly, that it is worth the cost is. The fact that you hold this view doesn't mean it isn't an ideology.
As someone who has spent a lot of time reading the science of these chemicals, as well as their cultural impact and the experiences of people that I know and have talked to, as well as many experiences I have read about online. I can say that this is such a bad take that it's almost funny.

It's like saying that a helicopter and a blender are the same device because they both have spinning blades. These two substances are completely different in just about every way that they affect people, aside from producing a mood boost (which is an effect also caused by things like morphine, cocaine, a few different psychedelics, alcohol, caffeine, nitrous oxide, and many many more substances which don't act via serotonin).

One of the main theories on the action of MDMA involves the sudden serotonin release inhibiting the amygdala and thus reducing fear response. Prozac certainly does not do this. MDMA's effects are not even all shared with other serotonin releasers such as fenfluoramine or MDAI. And Prozac's effects differ somewhat from other SSRIs too.

The neurotransmitters and receptors in the brain are not a set of dials where you can ratchet one and always expect a given psychological effect independent of the other receptors, or even independent of the way it's ratcheted, or even the timing of it. Also the effect of these drugs is highly dependent on context too. Believe it or not, MDMA can sometimes produce dysphoria and or unpleasant/unhappy mental state. It is uncommon, but I have seen it happen.

Sorry for the rant, it's just this type of oversimplification really strikes a nerve with me.
Ferrite antennas are remarkably efficient considering their size. If one were to examine the magnetic flux around a ferrite antenna one would find that the flux is channeled from the surrounding area into the ferrite rod (the rod effectively concentrating the field).

In effect this makes the antenna's effective size (its aperture) much bigger than its actual physical size.

Also, remember broadcast services are designed to put sufficient field (signal) strength into a 'notional' receiver that's operating within the rated service area of the broadcast. Both the transmitter field strength and the receiver sensitivity are designed in combination to provide a worthwhile listening signal. The designed signal-to-noise ratio is dependent on the type of service and for the AM B/C band it is in the order of 40dB or so for the primary service area (the secondary service area typically 10dB less).
I assume if the jenkins-step failed, you'd click a link to the dagger UI to see which dagger-step failed. Alternatively, never open jenkins at all and instead keep a tab open with the dagger UI.
Creative advertising like the Burger King ad from the post above are ads people want to interact with because they are fun or if you are really good get people to think. Stuff you would share on your own instead of getting it artificially pushed into your feed. The kind of ads you describe are called "prokbelly ads" because you would find them on the flyers of your favorite supermarket. No creative wants to touch them with a poking stick.
I run my own mail server and host all my websites on a cheap Linode instance ($5/mo) - it can be a pain in the ass to setup, but once it's up and running, there isn't much you need to do. Been running for 15 years now.
You're arguing "is", I'm arguing "ought". They're unrelated.
Interesting question then:

For what characteristics of problem is pair programming more useful, when such problems arise? Is there a pattern to plan for?
What suggestions does anyone have for phone providers? I've long wanted to move off of Google Fi
When I worked at a place that did 100% pair programming with rotation every day, a new developer could hit the ground flying.

Right -- because they're not the ones actually doing the work of course. Aside form the typing "work".

A team with one expert and pairing is now a team full of experts.

Minus the ones who quit (or never joined) because they just can't get behind the insanity and teeth pulling that is (involuntary) PP.
What type of work do you do? I run a small consulting company that builds web apps for biotech, and we’re always looking for help. I suffer from similar problems so I’m sympathetic to the situation you described.
I'm 29 and I only use my Facebook as a log-in tool for one or two sites. I left a message on my FB page saying that I'm no longer going to be active there. This was two years ago. My older sister has moved to Instagram. I myself prefer Discord.

If I'm representative of younger people—and I have no idea if that's the case—Facebook proper is in deep trouble.
Do you have an aggressive ad blocker or something... An outdated mobile app? Or you have very few friends who rarely post?
https://pcisig.com/sites/default/files/files/PCI_Express_Ele... It doesn’t say QAM explicitly but it has all the QAM terminology like 128 codes. Inter symbol interference etc. I’m not an RF guy by any stretch but it sounds like QAM to me.

This is an old spec. I think it’s like equivalent to QAM-512 for PCIe 6
Downvotes aren't a punishment. Marking wrong-ish things in gray is useful for discourse!
Before you can even do the statistical analysis you suggest, you need large amounts of high quality data—which we don't have. One place where the US (and the world?) gets data privacy right is in healthcare, but unfortunately that also means it's nearly impossible to create the data sets we need to do the statistical analysis you want.

Institutions face severe penalties for wrongfully sharing patient data, so most opt to just not share any data. Any research that is performed is done internally on local populations with de-identified data sets. A few brave institutions go well out of their way to create and share de-identified data sets publically, but these data sets still undersample the general population. This is a critical problem because certain diseases are highly prevalent in certain regions (e.g., Lyme disease in New England) but unheard of in other regions (e.g., Lyme disease in Colorado). If your ML model is trained on data largely from New England, it's going to diagnose a patient with the classic "target-shaped" rash with Lyme disease even if the patient is from Colorado (high false positive rate). If the model is trained on data from Colorado, it will underdiagnose Lyme disease in patients from New England (high false negative rate). The only way I know to overcome this problem is to create even larger data sets, but this just isn't possible with data privacy laws.
To quote the alt text from https://xkcd.com/971/

> Telling someone who trusts you that you're giving them medicine, when you know you’re not, because you want their money, isn’t just lying--it’s like an example you’d make up if you had to illustrate for a child why lying is wrong.
> Big data is coming

Big _bad_ data... Let's see how we fare in 5y, then. My prediction as a clinician with a special interest in stats: close to zero medical progress. But insurance priced by a ML algorithm, and much greater efficiency in coverage and claim denials.
They definitely care!
Metaverse is.. highly speculative
Selling electricity is never good business. Governments are at most going to recover costs of transmission and some ongoing operation, never the huge up-front investments they need to make in the sector.
I think I toggled with the GC for less than a week in my eight years experience including some systems stuff - maybe this is true at FANG scale but not for me!
You still need to manage the size of your cache, since in theory it can grow infinitely. But it’s a different problem than managing regular Docker images, because there are no named references to worry about: just blobs that may or may not be reused in the future. The penalty for removing the “wrong” blob is a possible cache miss, not a broken image.

Dagger currently doesn’t help you remove blobs from your cache, but if/when it does, it will work the same way regardless of where the blobs are stored (except for the blob storage driver).
> The latter is an inherently digital problem, easy to parse and not played in “real time”

So people should have been able to correctly predict how easy it would be for a computer to master go, right?
Agreed. Fastmail is a great example. They are cheap, but their product is excellent and so is their support. I never have to worry about losing my account unless I stop paying. I got burned on that when I went to jail, but they offer a pre-pay option so you can now pay a decade worth of fees in advance :)
If Meta were to build enough new, carbon neutral, and green energy facilities to supply triple the energy costs of their facility and sell the remainder to the grid, I don't think anyone would have much of a problem with the facility.

As it stands, the data centre will use up much of the green energy that NL has created over the past few years, purely for Facebook to... sell more ads. That's not palatable.
Despite the UX, nothing worth the usability and efficiency of Redmine...
Webcamtaxi – Live HD Streaming Webcams from Around the Globe
Are you looking for HN anecdotal sampling or larger data sets? How would you go about getting actual statistically significant data sets?
I'm also a programmer with ADHD.

IMO, pair programming is most useful for short design discussions and mentoring, like explaining a better way to architect a feature to a junior engineer. I look back on these experiences fondly, and this type of collaboration helped me grow a lot as a developer.

I don't feel like I get the concentration and focus required to "put the whole code implementation in my head" when I'm pairing, so I don't really see how it can be used 100% of the time to build systems efficiently.

And regardless of whether it's a good way to work or not, many engineers just won't want to have someone looking over their shoulder 24/7. That kind of environment would drive me mad. I need to be able to drown out the world and bury my head in the code, and most of us don't work on code the entire day. I like having the freedom to read an article or browse the web for a bit whenever I want to fuck off.

Pair programming and mob programming are definitely not for me, and there's no way I would take a job that requires doing either most of the time.
Been using them for, I think, 16 years.
my friends that have one MS/Outlook account at their jobs, which have enterprise support reps for their big enterprise accounts sometimes have multi-day lockout for unknown reason, 2FA failure for days, absurd issues with timezones being inconsistent across MS services, etc.
PCI-E isn't QAM. It's NRZ (a type of pulse amplitude modulation with just two amplitude levels), with 8/10b, 64/66b, or 128/130b encoding, and then scrambled to reduce long runs of 0s or 1s. I think PCI-E 6.0 uses PAM-4 with 4 amplitude levels.
What’s the point of developing green energy if not to use it?
Mankind needs a top predator - who walks among them, predation occurs, and population density declines...
Republicans want you to hate paying taxes and tax providers are greedy.
I work in a team that leans heavily on pair programming and it's a night and day difference for productivity.

Besides the domain and system knowledge sharing, besides exchanging productivity tricks or new ways to solve problems, it is much less distracting. I strongly believe that on any non-trivial task pair programming accomplishes much more business value (more tasks done) and growth than having the two developers working solo.

I don't think it should be the only way to work, definitely not most of the time and it should be encouraged rather than mandated.
(Author that named "Log4Shell" here)

FYI, this is confusing because there are 2 different RCEs that have been published within the last 24 hours. One has a CVE and the other doesn't.

OP's post by Praetorian is discussing the RCE dubbed "Spring4Shell".

It's the RCE without a CVE yet, hence the name, and it affects Spring Core. It's likely fairly widespread/severe, but the "mitigating details" are still unknown.

That said, it's very similar to the Apache Struts vuln that popped EquiFax a few years ago. (a Class Loader Manipulation exploit) So there is already some tooling available to weaponize it.

The other RCE affects Spring Cloud Function and has been given CVE-2022-22963.

We wrote a post[0] with info on both CVEs that references this Praetorian post under the "Remediation" section. We also added more information about the exploit scenarios to help push the ball forward for determining how widely exploitable this is going to be.

(There is a 3rd possible one too, but it's still unconfirmed.)

Basically, the authors of Spring Core tweeted[1] that there wasn't a vuln and that has added to the chaos of this. There is a vuln here. It's not as bad as Log4Shell, but it's still bad and likely widely exploitable given how popular Spring Core is and how some Java devs[2] have confirmed that the exploitable configuration is a "common pattern" in real-world usage.

With the vuln there are more steps required for exploitation. That means kids on Minecraft won't be griefing each other with it, but that won't stop the blackhats from weaponizing this quickly. After all, this is a very similar attack to previous ones in Struts[3].

So if you're using Spring Core or Spring Cloud Function, it's a good idea to stay up-to-date on this stuff because it's moving pretty quick. If you already looked earlier this morning, a lot has changed (like this Praetorian post).

It'll be a fun weekend for security teams everywhere!

0: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/

1: https://twitter.com/hacksilon/status/1509117953064812547

2: https://twitter.com/pwntester/status/1509298152691671046

3: https://www.exploit-db.com/exploits/33142
Still, I bet Laplace's demon could get by just fine without them, and maybe even spot clever optimizations that a human never would. After all, there's no such thing as a free lunch.
I thought the bot was built by github
Was expecting at one point patronization or moralization but the author restrained themselves - a feat not easy in this day - without lacking content.
Most normal people and junior devs would get a red head when reading it, techies and seniors would nod along and sometimes say "uh... so that's how it really works". It's in between but a good primer on the essentials.
The point is to use it for existing energy consumption, and only then start increasing energy consumption. If you add X GW of green energy to your Y GW of non-green energy, and then increase your usage by X, then the impact on the planet is the same as the status quo, i.e. not good.
> and soon the metaverse

That assumes Meta's plans for the metaverse ever pay off, and in my humble opinion, that's less than certain.
Here in Mexico everyone is on Facebook. But they don't use it in the classic way, posting vacation photos and family updates. Instead it's a way to find out the hours and location of a restaurant, what night your favorite band is playing, what barrio is having a fiesta this weekend, etc. Most businesses have a Facebook page but no web site.
I always experienced them 'back-to-front' as well, and I believe it is what happens if your eyes are focusing on a point in front of the picture ('cross-eyed') instead of a point behind it.

With a lot of effort, I can see it the right way by putting the image very close to my face, and relaxing my eyes to focus on an imaginary point beyond the page/screen. Then I slowly back away so that the image fits more comfortably in my field of view. However, I still find it very hard to bring the image into sharp focus, and at any moment the illusion can suddenly disappear and I have to start again.

I have excellent vision but after trying to look at these stereograms for a few minutes I am suddenly having difficulty focusing on normal objects around me. Quite unnerving.
It seems like myspace and digg died pretty fast, so it's definitely possible.