skysight-inc/HackerNews huggingface dataset:
Running a Unix-like OS on a home-built CPU with a home-built C compiler (2020)
Can you give a real life (not related to math) example?
Big events gets posted on PRC social media faster than censors can censor. Much of Chinese with mobile will see this, the biggest problem is people in west thinking they know better, overindexing on a bunch of students stuck in shitty dorms protesting because lockdown in these facilities are genuinely terrible, while the protestors use some dead Uyghurs and libral values as pretense (yes many are genuine too) for international attention to pressure gov response.

This is just one of the thousands of "small" scale protests that happen every year in PRC, except young students are better coordinated and tech savvy (i.e. Shanghai protest organized on Telegram with western reporters in group), same with Henan bank who got some money back. Or Urumqi finally relaxing lockdown because 1000s of commoners got on the streets - imagine that CCP even listens to Uyghur pressure. I expect there's going to be some concessions for campus lockdowns (and organizers getting fucked), but until their parents get on the street enmass, this is western media who got kicked out or left PRC during covid getting overzealous on breadcrumbs of access they occasionally get through oblique channels from mainland.

E: over limit, @powerapple

Yeah, it's coordinated. Cabin fever lockdown students learned from HK protestors / Henan. I was peeping at @actionshanghai on telegram leading up. I think campus concessions will get attention or some priority. And should - lock down in Chinese dorms would suck. I'm sure organizers are going to get crushed, especially for inviting / appealing to foreign jouralists and rags like RFA or epochetimes is going to ruin some lives accordign to how HK NSL prosecutions are going.
Like:

- Simple concise syntax
- Great std lib
- Most of the times it's easy to do the right thing

Dislike:

- No concept of NULL values and what it means especially when dealing with JSON
- Limited handling of TCP connections life-cycle

I'll add something which is not a language issue per se but I had to deal with a lot: often new devs to Go will try to force certain mental models acquired with other languages/frameworks onto Go and that makes for some terrible Go code.
You're vastly overestimating the reach and impact of the ROTC program though
WordPress Version 6.1
Written in C.

Uses LLVM for execution.

Parsers are Lex and Yacc.
I was under the impression that money for such projects was an all encompassing line item on the budget.
It means exactly what it says it means. It's a percentage of the operating budget of the city. You don't in fact need the percentage across all taxing bodies in order to think that this percentage is too high. This is the number that the governing body of the city is in control of. They can't do anything about expenditures on other things by outside taxing agencies. Why are you so desperate to overcomplicate a city budget? This doesn't require arcane knowledge or special mastery. It's an operating budget, and when people bitch about police funding they're talking about operations expense. Nobody gives a crap if the percentage changes when you include estuary maintenance or school district vehicle maintenance. That stuff is not in the purview of the city governing body, and it's not going to affect the percent of the municipal budget that goes to police operations. What is with the insistance that this be buried in pedantic bureaucracy?
If anyone has to be the ‘father’ of ‘liberalism’ it’s Roosevelt who lost the election to Wilson.
Try the Roc Lang
Are there any officially supported Google products?
> Rate limiting

You don't need fail2ban to rate-limit SSH.

RFTM ... MaxStartups, PerSourceMaxStartups, PerSourceNetBlockSize.

> trying to brute force

AuthenticationMethods publickey
PasswordAuthentication no
ChallengeResponseAuthentication no
PermitRootLogin no
I follow Dan Luu and he often writes very well, but my perspective as a user is that search is rubbish. I know they're solving a complex problem and indexing is x seconds but I genuinely just use Google with Twitter added as a keyword.

For my own tweets and those of my closest friends, I have them all posted to a group Slack we have and I just use Slack search. It's absurd but instantaneous results.

Ultimately, I'm sure they did lots of kernel hacking and ingestion and ETL stuff but Slack search of Twitter mirror is better than Twitter search for my follow list.
Salary expectations may not be in the same category though.
This is much more useful than RGB for telling which colors are overrepresented imo. Thanks for making/sharing this!
$500B/year to fuel how many, and what non-essential jobs? They could just as well exist in infrastructure instead of defense if that were the case.
Where Is the AI Music?
After seeing those TRON images this morning I've been playing with Midjourney all day. Version 4 really is amazing and I can see how fast and how much this tech will change the world.

Anybody know if there are AI music generators I can play with?

Would be cool to prompt with composer names, instruments, bands, moods, and feelings.
Gang of Four book predates Java and has zero lines of code about it, since the language did not exist.

All the examples are about Smalltalk and C++.
Seriously confounded by this?
Slightly off topic...

Back before my Phoenix/Elixir days, we used to have to cache almost everything. Now we don't cache anything -- even with more traffic and less servers. Now, the projects I work on are not getting millions of views every day. But they are still important for many customers.

We don't really design anything that needs to be cached anymore. Just better access patterns and table design as we get wiser.

Take Wordpress as an example. There really should not be a need to cache a Wordpress site. But some of the most popular plugins are those that cache. To be fair, I suppose, their legacy non-optimal database design access pattern and code is responsible for this.

Just getting something up and aiming for product-market fit is priority #1 and then struggling with caching if it gets popular, at which point, more resources can be thrown at it.
I don't see the difference so much in the methodology as in the kind of reality one wants to observe.

The sciences have the experimental part, which is a method made possible by the kind of phenomena you observe. As far as religion is concerned, I don't want to oversimplify, as I think we run the risk of lumping everything together, as there are different interpretations as to what a religion is.
There already exists Rune programming language and that one was earlier: https://rune-rs.github.io/

They should be more careful picking the name.
Would Google Guice count?

https://github.com/google/guice
Chinese do see them. It is very interesting actually. I saw the pretext in DouYin, some people was saying something big was going to happen "tonight" on DouYin, so apparently there are organizations. Today, some friends in China shared with me some video clips. I am only connecting the dots now. It would be interesting to learn the full picture.
_without any business commitments_ - not to sound trite, but when is the last time Google stood by its commitments?
And a disgusting convenience, that as long as it is "otherworldly" humans at the other end of the barrel, it suffices
I think that every group of people substantially bigger than a pack develops a dominating belly of mediocrity. You can say the same about any big corp, even FAANG are big and settled enough now. The percentage of really brilliant people is just too low. And if more of them flock together, Theo often don't necessarily firm a brilliant team.

Today also on FP: https://news.ycombinator.com/item?id=33756219
Can someone explain the timing security vulnerability mentioned in the article, I'm not sure I understand.
Keep in mind the potential to create false accusations by fabricating similar looking accounts.
Only anecdata but I have been homeless, ten years ago for around 4 months, and I would agree that the vast majority of other homeless people in the same area fell into this category.

In the case of those pretending to be homeless for the purpose of begging, I'd say it was 100%.
Some of the thinking about getting back to real startup dynamics sounds good, but this part didn't:

> Labor market is in your favor: renegotiate compensations, starting with the B players. Whoever leaves will not be hard to replace. [...] Layoffs are disgusting for everybody. Multiple waves are not OK. Be courageous and sensible: any additional wave further depresses your team and worries your customers. And, at least a few thousands of the 175,000 laid off are surely better and cheaper than your bottom 20% performers. Probably more hungry too.

> Founders who managed to be relatively less diluted thanks to recent sky-high valuations: carve-out a portion of your own equity to compensate your pivotal talents or new hires

If you just listened to the savage management consultant type, and laid off everyone you possibly could, and then hope to take advantage of the misery of others, to hire more desperate replacement workers...

Those "pivotal" people with experience are going to see there's no loyalty nor trust in the company. Which doesn't bode well for a startup.

Uh, yeah, rather than more equity, cash is good. And, uh, let's switch to weekly payroll, given slippery slopes and the foot-dragging that the management consultant advised about payables to vendors.
Guilty as charged! Turning 30 soon, just shed the last remnants of my prior organically grown social circle, having judged so many people for their emotional callousness, sloppy thinking, and lazy ethics. Most of these days I don't even have anyone to talk to, which is why I've taken once again to that most inadvisable endeavour of writing my thoughts on the Internet!

I literally know one or two people who treat others with essential kindness and strive to make their lives meaningful. I wish I had more ways of giving back, because if it wasn't for being able to talk with them once in a while, I'd seriously be doubting my sanity right now. At the same time, it's just not right to lean too much on them - there's only so much anyone can do for your existential problems. So once in a while we share a moment of "yeah bro, I see it too, things are going downhill in a profound and horrifying way, but it's OK, we know we won't let it get to us and we'll figure it out eventually". And that's about as much relating to people that I do these days.

Could I choose to "unjudge" the people who I've held to what apparently these days is an unrealistically high standard? Easy, I've had many opportunities to try it! People can be quite forgiving of past misunderstandings, the problem is that they don't seem to learn from their mistakes a whole lot. I'm like, "okay, this person might not really be so great, but they're not a horrible person either, so let's give myself a chance to share some sort of meaningful experience with them!". It goes alright for a while, then I end up having to unilaterally struggle to maintain a basic mutual comfort zone while trying to dissuade poor attempts at gaslighting. (Apparently, it's considered "toxic" to tell others when their behavior is causing harm or distress?)

Somehow it's becoming very difficult these days to be a decent person - as defined by the bare minimum of not engaging in violence or manipulative behavior because you treat others like human beings - and be social at the same time. I remember when the Internet used to provide opportunities for just that. Right now it's doing the opposite; who would've thought that a marriage of mass media and the Cold War military-industrial complex would naturally act to set people apart. People are bombarded with so much emotionally charged but otherwise completely nonsensical information which has nothing to do with real life, that if you somehow fall through the cracks of that whole shared hallucination, you're effectively a pariah.
I can't help but think that this is going to result in some confusion.

"Have you tested this API?"

"Yes, I used Katt"

"Cat? You mean netcat or curl"
This may not result in anything, but these are synchronised acts, I watched the clip predicted it, and a few guys announced this before it happened on DouYin (Chinese TikTok).
If the CCP backs down it will be a historic event. If the CCP doesn't back down, it'll be just as significant.
mlterm. it has no bells and whistles a part from full unicode support including bidi
Currently it looks like many like being in it, but don't like to foster it and vote themselves into poverty.
Can someone explain how this works:

"Assume the attacker can tell how long it takes for mac == computedMac to run. If the first byte of an attacker-chosen mac is wrong for the attacker-chosen message, the loop terminates after just one comparison. With 256 attempts, the attacker can find the first byte of the expected MAC for the attacker-controlled message. Repeating this process, the attacker can forge an entire MAC."

How precisely should an attacker guess how long the comparison runs?
Most countries tend to look out for their people first. I can’t really see a realistic alternative.
I think this perspective has a lot of value but it's also important recognize that it has limits.

Imagine you were kidnapped and kept locked in a cage-- you could still make the best of the situation-- but it's not a good one and you still should endeavor to get out of it, and not only try to discover what happiness you can find there.

'God, grant me the serenity to accept the things I cannot change, the courage to change the things I can, and the wisdom to know the difference.'
All the current processors are shipping with known bugs, including all Intel and AMD CPUs and all CPUs with ARM cores, also including even all the microcontrollers with which I have ever worked, regardless of manufacturer.

The many bugs (usually from 20 to 100) of each CPU model are enumerated in errata documents with euphemistic names like "Specification Update" of Intel and "Revision Guide" of AMD. Some processor vendors have the stupid policy of providing the errata list only under NDA.

Many of the known bugs have workarounds provided by microcode updates, a few are scheduled to be fixed in a later CPU revision, some affect only privileged code and it is expected that the operating system kernels will include workarounds that are described in the errata document, and many bugs have the resolution "Won't fix", because it is considered that they either affect things that are not essential for the correct execution of a program, e.g. the values of the performance counters or the speed of execution, or because it is considered that those bugs happen only in very peculiar circumstances that are unlikely to occur in any normal program.

I recommend the reading of some of the "Specification Update" documents of Intel, to understand the difficulties of designing a bug-free CPU, even if much of the important information about the specific circumstances that cause the bugs is usually omitted.
Musk has never created anything, so this also probably means "acquires a mobile phone company and squeezes a product from the blood of its employees".

Ok, well, that's some sort of creation, but probably not the kind people think about the word generally.
A 100% Electric Flying Ferry with Zero Emissions
There already was a GO programming language before Google decided to use the name, too.
Joe Haldeman's The Forever War and Forever Peace series of novels chronicle this with pretty decent speculation.

He goes from war, to loneliness, to very low birth rates in society to rising same sex unions, to interesting alternative unions -- all designed by the governments of the time to support the martial future society.

A fascinating pair of books to read that speculate on the future.

(Please don't downvote me for talking about the damn books)
It doesn't stops there: their allies are communist: China, Venezuela, Cuba, etc.

Also the communist parties everywhere support them in their war against Ukraine.

I guess it all depends on you considering communism an ideology or just a faction.
In-Depth: Is Safe That Bad?
This is unfair as it is not what GP said. It was simply pointed out that infosec professionals do not say that, which is true. There a wide difference between what one can read on the web and the security professionals position on this. You focus on the public perception, GP the professional one. And it's worth pointing this out IMHO particularly because there is such a large mismatch.

If one reads the Common Criteria specifications [1], they actually require obscurity at some level (didn't check which one, for sure EAL4 and above do). Specifically, all the design must be kept secret so obscured to attackers. This is serious stuff, requiring secure design facilities for example. The goal is to force an attacker into a complex (so costly) reverse engineering.

There is a too common vision of security as an absolute thing, it's either secure or not. This is already a simplification for algorithms, but there why not. But for secure systems it's definitely not sufficient, and you agree with this like GP does it seems. Professionals must balance the cost of security vs. the cost of an exploit. And obscurity do raise the cost of an attack, so it makes perfect sense to consider it. And it is considered (see CC).

So GP summary that obscurity is justly considered by professional, and makes sense as long as it's not the only defense, seems correct to me and worth mentioning. You have taken it as a criticism but you shouldn't: it essentially also says what you said, that obscurity has its proper place in security.

[1] https://www.commoncriteriaportal.org/cc/
> If Russia is bargaining with Iran trading "hundreds" of captured anti-tank weapons and guided artillery munitions... it doesn't take a genius to come to conclusions as to what other non-state affiliated actors are doing...

Im not seeing any sources saying that Russia is giving Iran hundreds of anti tank weapons? or guided artillery munitions?.
I'd argue the other way around. Judges have are humans and have opinions. But they must be principled, if anything. Lady justice has a blindfold after all.

The Supreme Court is just that, 'Supreme'. So personally I'd expect supremely capable judges at such a complex and important post.

The fact that that is considered 'quaint', is a testament to the current state of American democracy, and the self confidence of the Americans in it. I hope it's just a phase, and that you guys can work it out.
Chinese olders refuse to have vaccines, they don't like anything to be injected into their body. They use herbs when they are sick. My dad refused my mom to take a MRI scan. Now you want them to have boosters every 6 months, no way.
I'd rather not. Never rode one, but I heard bullets are really impractical vehicles. My bike seems much more comfortable.
I don't think I have understood Peanuts. Granted, my parents never subscribed to a newspaper where it was published, so I only intermittently got in touch with it. I understand it may be something you grow to love as you develop a relationship to the characters?
Ask HN: What is your routine to monitor for viruses and secure boot integrity?
I recently saw a script to confirm if several points of ones' secure boot process were secure, or had settings that were considered safe. I didn't get a screenshot of this tool or script, and I cannot find it on Github with my poor searching.

I wanted to ask HN:

1) What is your routine to monitor for viruses/malware on your (desktop) Linux machines?
2) How do you stay aware of major CVEs and supply chain attacks?
3) I'm used to ClamAV, are there any polished GUIs for some of these antivirus scanners to make monitoring more informative/user friendly?
4) Know of any distro or package-manager specific tools for identifying malware? I recently got back into nodejs and I'm happy to see npm warning of insecurities.
5) Anyone know the Secure Boot "checker" I'm talking about above?
6) Anyone using several antivirus solutions together in a way that is efficient/smartly configured? (the thought of 2 daemons scanning all my files circularly doesn't seem fantastic)
7) Bonus points for mentioning Little Snitch-like daemons to block telemetry. I'm curious if anyone is using machine learning to identify patterns from software trying to phone-home vs normal operation. I understand the argument: If you can't trust what you're running locally, all is lost.

Thank you
They wouldn't be guessing, they'd be measuring. I'm not qualified to really explain more but if you want to learn more, "timing attack" is what you're looking for

https://en.wikipedia.org/wiki/Timing_attack
Of course it’s well within Heroku’s domain to structure their services however they choose. The tragedy is that if everyone uses the platform’s free tier to maximum utility in a self beneficial way, it exhausts the resources available and the common utility ceases to exist. So it’s not ethically wrong as was my response to the GGP. But it’s functionally “wrong” because it exhausts the common resource.
Haskell is also a 30 year old language and I think it has a lot more to say about the future of programming than Python
WordPress by itself isn’t so bad. It’s the plugin/theme developers who likely have no idea what they’re doing or why what they’re doing is bad.
I hope not. The alternative is going to be rubbish. It is like every single worker in a company think their CEO is shit, and they can take his job with comfort. In reality, it is only going to be worse. Xi's not great, also alternative is not great either. I just hope they can find a solution to current problem, and move on.
It makes predictions and they have some degree of accuracy
That's the part that got me. It's like stealing 1000 iPhones with a retail price of $999 each and then arguing in court that had I legally purchased 1000 iPhones I would have gotten a volume discount from a wholesale distributor and should only be responsible for the wholesale value of what I stole versus the retail value.
I don’t think so. The site died when everyone moved to using Facebook events and groups, which is still where all the parties get posted today.

Events/groups is the only thing keeping me from deleting my Facebook account.
I'm happily employed but I still want to keep an eye out for interesting developments in the tech coop space for AI. The field being what it is these days, N people sharing knowledge, code, and (as permitted) data could handle N similar applied AI projects much more easily than 1 person could handle 1. Are there successful examples of this model anywhere?
By how fast the function returns.

This is white-box security, a hypothetical setting where we assume the attacker has access to the entire knowledge of the system and to every oracle they want (like an oracle telling them how much time each function takes), but don't know any secret, like private or symmetrical keys. If you can prove that your function is secure in that setting, then it's secure in real-case situations where the attacker knows even less.
"I’m pretty sure inhabitants will drink their own [processed] urine" this is a totally normal thing across world regions and a sign of civilization, why such funky immature stance?
I agree with all of this. I spent some time living cheaply in Spain a few years ago, in high density housing, and I would describe it best as a living hell. Slamming doors, multiple barking dogs on every balcony, conversations held at such high volume as to sound like people were murdering each other, etc.

On the positive side, everyone would smile at me and wish me a good day if our paths ever crossed leaving or entering the building.

As a kid I lived in a middle class suburb where everyone knew each other and, at the time, I was fairly happy with this. As an adult though, I would find it uncomfortable.

I guess there is an ideal balance between loneliness and being suffocated that isn't easy to get right.