skysight-inc/HackerNews huggingface dataset:
The Linux kernel has the best security you can get with a C based monolithic kernel in production. Vulnerabilities often get patched hours to at worst a few days after they become disclosed; Which is faster than NT & XNU which often
can take from weeks to months, and even a year or more in some past cases; which makes sense because they have limited dev power while Linux is the largest collaborative project on the planet.

The new kernels simply aren't production ready except for some niche areas, while Linux is used anywhere from PC, Servers, Embedded Devices, Supercomputers, The National Space Station, to even NASA's Mars Helicopter.

The largest security problem the Linux kernel faces to date is memory unsafety mistakes, and is where Rust comes in.
Rust's approach to memory safety is from what I can tell a match made in heaven for Linux kernel development and is very likely going to greatly reduce the amount of memory unsafety bugs introduced into the production code, but time will tell.

On the flip Rust in Android has had a great impact on reducing memory unsafety bugs; which is very good news and gives us measurable data on the potential impact of Rust in Linux.
Sounds like a fancy name for a hiring freeze
The announcement post for gomod2nix has some additional info on the problems with buildGoModule's approach to vendorization:

> The buildGoModule package is designed around fixed-output derivations, which means that a single derivation is created where all the dependencies of the package you want to build are wrapped, and only a single hash of the derivation is specified. It fetches all dependencies in the fixed output, creating a vendor directory which is used for the build.

> This has several issues, most notably there is no sharing of dependencies between packages that depend on the same Go module.

> The other notable issue is that it forces developers to remember editing the vendorSha256 attribute separately from the already existing hash/sha256 attribute on the derivation. Forgetting to do so can not only lead to incorrect builds but also be frustrating when working with larger packages that takes a long time to build, and only very late in the build notice that something was broken so you have to start over from scratch.

> Because of the lack of hash granularity the build needs to clone every dependency every time the vendorSha256 is invalidated, and cannot use the cache from previous builds.

https://www.tweag.io/blog/2021-03-04-gomod2nix/

So you get greater granularity here, and thus also greater cache reuse between builds.
> I think many people, myself included, assumed Musk's course was always "just do what's best for me." So he's really just holding to that.

As far as I can tell Musk is currently self-destructing for no apparent reason -- how is that best for him?

Some of the questionable stuff he's been doing for a while has obvious upsides for him. Lying about the capabilities of your products and market manipulation are both obviously nice if you can get away with it. So is demonstratively skirting laws and regulations. Similarly, building a reputation for going after people who did something that contravened your personal interests, even if doing so was their professional or legal duty, has its benefits. It encourages careful consideration of whether dereliction of duty would not be preferable over getting in your way. All these are demonstrations of strength.

But streisanding elonjet just looks weak and pathetic. As does trying to stiff your suppliers.

If you build up a reputation for being completely unprincipled and erratic, and try to wheedle out of both your word and your legal obligations even in cases when you probably can't get away with it and there is not even a particularly compelling reason to try to do so in the first place; well -- surely that can only hurt your brand and also mean that people who would otherwise have done business with you won't or will now only do so on much less favorable terms? Or am I missing something here?
Something interesting to me, as someone with a 2020 base-level Forester, is that you describe my experience completely. It works great on most highways, but needs me when lanes split or merge.

Of course it's not 1:1. AP has other features, such as a much nicer UI that better reports what it thinks it sees, and I think has sexy lane changing features and such.

But it makes me feel that FSD was more business necessary to keep a competitive advantage against cheap cars. Soon many cheap cars will have AP-like features at comparable fidelities.
I actually think this is reasonable. The account was broadcasting his live location at any given point in time and there's a strong argument it presented a legitimate safety risk given so many people's hatred towards him.

It's also hard to say he's banning free speech against himself when it feels like half of twitter is anti-Elon sentiment these days.
> but flame graphs and throughput aren't always a one-to-one mapping

I wanted to give a concrete example of this. Crypto or such code using SIMD can drop some Intel CPUs into lower frequencies, and this effect can also apply to all cores. It takes a short moment for the CPU to "speed up" again. Then there's icache pressure etc.

The usual rule is, microbenchmarks are microuseful. Systems mixing micro-workloads just can't reach the same throughput, and trying to guess the final performance is very tricky.

https://stackoverflow.com/questions/19722950/do-sse-instruct...
What is that supposed to mean? I haven't had a Twitter account for the last decade.
No, and even GPT-3 requires an app approval which will be very difficult for a chatbot that accepts open-ended user input.
I would not be surprised at all.

The biggest problem with FSD is bounding box detection as from previous videos it routinely fails to identify objects in the road correctly.

A problem that LiDAR (which Cruise uses) is especially good at.
The brain isn't good at finding the average of a graph like that. However, there is one thing you can eyeball: Look at the peaks, compare them to the 20C line. The peaks are clearly higher as time goes on.
Perhaps legally this is how it would work (IANAL), but given what's played out during elections I think that subjecting a candidate to the criteria of a public official in this regard has merit.
I drive 150+ mile trips all the time. Autopilot is a game changer.

FSD is far less impactful on city streets as I enjoy city driving, but it gets mind numbing on long highway drives.
The problem with using strict UTF-8 for paths is that paths aren't guaranteed to be valid UTF-8. How do you want to write a program that opens a path who's name is invalid UTF-8?
I'm wading through a sea of third party projects right now that variously use uint8_t, u8, byte, tchar, BYTE, and endless variations that prepend one or two underscores for no apparent reason other than simple paranoia. Now, on to other types: Care to guess how many bits WORD is? (Trick question: It depends on the project you're in. You can imagine the adaptation layers when someone thinks that a bool is 32 bits).

It's even more fun when they #define these types, rather than use typedef or "using". ("Remember, children, every time you use #define, God kills a startup").

These types don't make things safer, or in any way better. They are long-term damage.

For the love of Schmoo, use the standards, I'm losing my hair.
How does flight data encourage stalking and harassment? The account is run by the same person who tracks the flights of other wealthy and notable people as well. Why weren’t those taken down?
Same guy fueling proof-of-work cryptocurrency mania? It is not entirely clear to me which direction his contribution to the carbon levels is going to end up at.
> Because you don't offer something for free if you have the expectation of being paid for it.

Actually, lots of companies offer services for free with the expectation that, at some point in the future, they will paid for it.

Likewise, many open-source projects offer the core software for free and make money by selling themes/plugins, offering paid support, building other services on top of the open-source software, etc.

Whether you can pull it off depends a lot, of course, on what kind of software it is and who the target users are. Maybe this is feasible only for a small subset of open-source projects. But it's doable. It's been done. Heck, I'm doing it myself. So please don't dismiss this kind of business model too quickly.
Elon's communication style is also good for forming "parasocial" relationships

tbh I find the widespread habit of referring to him by his first name like he's a personal acquaintance to be part of this mechanism. This is something tabloid newspapers do with sport and entertainment celebrities to milk money from fans who gravitate toward others who seem to be part of 'the family.' It's a PR strategy designed to exploit human social circuitry and convert it into cash money.
I was USMC infantry, and I have PTSD. I've been working on it for it for years and I'm still having a hard time. Remote work is a huge blessing. I can sit and think about my responses and temper them. That doesn't work as well face-to-face.
what makes this so concerning is, elon clearly understands that posts can amplify danger—even if the posted data is public information already, and there aren’t any clear threats, he understands this when it’s about him.

if it even slightly puts him in danger, he takes steps at mitigation.

when it’s other people, and the situation is even more dangerous, it almost seems like he revels in the danger those people or groups are put in.

even more concerning to me, when those groups ask for mitigation efforts, he goes out of his way to make their concerns appear unreasonable or hysterical. again, even when those threats are more immediate/widespread.

this is not something to be brushed away, this has very real implications.
Comments like these disincentivize people from sharing honestly. I have full confidence that OP was telling the truth when saying they it was a relatively safe / low traffic environment, and I fully imagine they were paying attention and ready to intervene when FSD made mistakes.
It's what Adam Curtis covers in HyperNormalization. I think it's less that the noises actually have any specific effect and more that they just create chaos bubbles of what is true or not.

> It's not hypocrisy

I disagree there though unless one agrees that Musk has no morality. However, in the absence of morals, which is likely, it would still be perceived hypocrisy.
Or they will hit a wall with no further progress.
I meant more that the strategies used by companies to interact with say, Kpop or Marvel fans, have bled into other environments. Also, the way that those kind of fandoms act, or the things they do in order to provide marketing for their parent hobby, have affected how other things continue to exist by proxy.
Crame gave to the world the Inverse Cramer ETF, which actually makes a lot of money.
> but these companies very explicitly build to scale to be a sort of "town hall" and in doing so start having very large social influence the likes of which no one in history has ever had.

I think a bazaar or carnival is a better metaphor, since a town hall is a brick and mortar thing that lasts into posterity, whereas a social network is more temporary

> When they get to this scale there has to be extra responsibility here for the good of society as a whole.

Or people could just not use the service and move onto a different one? There's nothing permanent about the current social networks that are popular right now
State Attorneys General tell Twitter to preserve censorship evidence
I have a feeling your comment is going to get a lot of pushback, but I agree with you.

I'm reminded of the plotline from The Newsroom where Sloan Sabbith roasts the ACNgage developer: https://www.youtube.com/watch?v=F86ojBeLbxQ
The beauty of not being paid for your time and releasing something as an unwarranted open source project, is that you can choose of your own volition without obligation how much time to dedicate to it and how you wish to respond to ungrateful people.

You cannot, however, change human nature. There are many people that wish you could change human nature, and that money was sufficiently powerful to do so, but it is not. In fact, when people pay for something, they become even more entitled while still remaining ungrateful. I would like to dissuade you from the notion that customer service is somehow easier and more reasonable than dealing with non-paying randos on the Internet.
SvelteKit is nothing new. It's been kicking around for 2+ years with tons of user satisfaction (and 3 years prior to that under another name), but this is the first major/stable release.

- https://insights.stackoverflow.com/survey/2021#section-most-loved-dreaded-and-wanted-web-frameworks
- https://2021.stateofjs.com/en-US/libraries/front-end-frameworks/
- https://twitter.com/Rich_Harris/status/1589675637195042817
A great number of apologists and hand-wringers, that's who. Now we're here.
Talking about "lane assist" on a German Autobahn - I had a bad, if not worse anecdote with a French (the model) rental car one or two years ago. I did not know that assistant was on, but had I known I would have thought nothing of it.

Because what happened really surprised me: Entering a construction zone the assistant took the wheel away from me(!!!). I was steering manually, normally, but the assistant insisted I follow the previous line in the road, that lead right into the construction zone. Which was behind a concrete divider.

I actually had to fight the "assistant", with not insignificant use of force on the wheel, to not crash sideways into that divider wall.
As an outsider, this description resembles that of Trump, except with less "tiny hands", and more "tech". Has Elon Musk considered doing politics?
The manner in which those taxes are distributed is a choice made by a person. Convince your countrymen to vote for people who will direct taxes towards those things. While not an easy feat, the way things are today are not the way they must be tomorrow.
> Just add a db and you are good to go

What about validation, CORS, cookies, encrypted sessions, etc? A backend (or full stack) framework should at the very minimum include those kind of things.

It's a major gripe I have with all the new full stack frameworks. The focus is on rendering and dealing with requests but they are quite sparse in bread and butter backend features. Other than routing you're basically on your own.

The community will probably start making third party plugins but I would rather have official plugins I can 100% trust like Fastify does.
It's not an oversight, it's a deliberate removal. I guess they don't want their customers to be able to receive safety broadcasts.
I believe this is exactly how Comma trains OpenPilot.
I had this feeling when Shazam came out. It blew me away that it could so consistently figure out a song in seconds.
"Talent Lock": the new MBA euphemism for H1-Bs
Yes, I was thinking of Kim Jong-un's sister.

Agreed that spies do not have "power" in that sense; I was just echoing the words of TFA and showing counterexamples.

Most armies of the world are sexist in any case, why single out the current adversaries of the West? Western armies are traditionally sexist as well. Yes, now there are some high ranking officers and even generals in some of the most modern Western armies -- meaning the general rule is still that sexism is rampant.

> yet the assumption most people have when they meet a woman is definitely not that she is someone powerful or to be wary of

Yes, but this seems to be the rule in many countries which are traditionally aligned with the West.
Well, the key here would be “raised with them.”

How that was handled. Had they seen human review and wrongly rejected? Was it thrown up the chain and a VP said “fuck then skinnies!”? Was it just lost in a message queue?

All in all, this reminds me a bit of the old joke “The mail man is my drug dealer, and he doesn’t even know it.”

Well, if I mail a letter to the Post Master telling him my neighbor buys fentanyl via the post and he doesn’t read it in time, I can’t blame him for not getting to it… barring dereliction.

So, no, blanket hating FB here is just smooth-brain outrage culture.
One by one, the rumours indicate that Apple will be complying with each and every requirement under the EU Digital Markets Act. These include:

* Install any software

* Install any App Store and choose to make it default

* Use third party payment providers and choose to make them default

* Use any voice assistant and choose to make it default

* Use any browser and browser engine and choose to make it default

* Use any messaging app and choose to make it default

* Make core messaging functionality interoperable. They lay out concrete examples like file transfer

* Use existing hardware and software features without competitive prejudice. E.g. NFC

* Not preference their services. This includes CTAs in settings to encourage users to subscribe to Gatekeeper services, and ranking their own services above others in selection and advertising portals
Does HN have any recommendations for offline voice assistants?

I just want a voice assistant which can do basic things for me locally without connecting to the internet for simple tasks such as adding things to my calendar or a note, playing a song, opening an app and alike.

I'm using Android, but I'm sure others using iOS would also appreciate some suggestions.
That's the point, right? You obviously can't fall back on "anything legal is allowed." That's a stupid policy and nobody actually wants it, as the actions this thread is discussing proves. So someone has to draw the boundaries. I'd much rather have a group of experts debating & making the hard decisions than a single sociopathic billionaire. Yes, they'll get it wrong sometimes, and that sucks, but it's the least-bad possible arrangement.
congrats team! absolutely necessary for good security these days. filling out more and more of the PaaS role!
Okay, "I love Apple Products" then.

I certainly don't love any corporations.
"This app requires modern web platform features. Please use a browser other than Safari." Looks cool but not production ready.
Are you kidding? 40k km with no disengagement? This is nuts. I don't think we have reached that level yet. And if we did, I can't believe Tesla engineers would be so oblivious to that that they wouldn't update their technology. The likeliest explanation is that the article's chart is using some weird metric that is not comparable between automakers.
Q-Ship
Identify Targets: access to intel + exploitability

Then build a relationship with them.
Pretty much the same list at my home.

I also use Siri on my apple watch for more personal things: todos, reminders, other me-specific interactions.

One issue I find to be huge but haven't seen mentioned in this thread is household assistants require shared accounts. So I can tell my watch "Remind me in 30 mins to buy that present for my partner" but if I did it on my Alexa they'd also see it. And thus we only use Alexa for truly household-wide things.

IMO a killer app would be voiceprint detection and an ability to funnel the speaker to their own account for things.
> People are super dangerous in cars

That is a very subjective description. One fatality per 100,000,000 miles actually seems pretty good, given how complex driving can be. And even then, that number includes the shitty drivers that account for most wrecks. The median driver is quite good, objectively.
He has the best security detail in the world, but yeah, seems like an unnecessary security risk. I'm sure if a federal agency requested this bot be taken down as a security concern it would be a reasonable request. More reasonable that many other requests made under the veil of "security"
My hope was for a more transparent Twitter. I guess that's out the window too.
I trust Apple to do a decent job at protecting me (and more importantly, my less tech minded friends) more than a 3rd party app store. I dont mind using webkit, but I do recognize that its a shit move by Apple to not allow other rendering engines in the store. Just not a shitty enough for me to go F-Droid and micromanage my phone.

I will not install a 3rd party app store if Apple allowed it

I would sideload a browser from an official repository.

But if apple loosened the webkit restriction, I could get my preferred browser without sideloading or using 3rd party appstore.

Does that clear up any confusion?
This policy change is actually just a direct consequence of the upcoming 2024 EU law that forces Apple to allow third party app stores for iOS devices.
Because Apple can't control what applications get uploaded to the third party stores, like browsers that use a different web engine, then they try to lax the rules in their own store to desperately keep developers from jumping the ship.
Is the per-packet processing in Wireguard stateless? As in, no sequential packet numbering in the crypto, etc?

If yes, then you should be able to get the kernel to spread your incoming traffic across cores with minimal contention and coordination, with multiqueue tuntap:

https://www.kernel.org/doc/html/latest/networking/tuntap.htm...

https://lwn.net/Articles/459270/
Pax's Android chassis isn't built yet — but a Pax `<Button>` will render an actual native Android button to a layer on top of a separate canvas layer where vector drawing occurs.

That native Android button will be affine-transformed, clipped, and occluded so that the two layers together act as a single coherent screen, and the developer can simply position / transform / layout that `<Button>` alongside, on top of, or underneath virtual / drawn elements as if they were on the same canvas.

This "dual layer" approach is already implemented for Pax's `<Text>` element on macOS (native SwiftUI `Text`) and Web (native `<div>` + HTML text) — see: https://docs.pax-lang.org/intro-example.html
Why give such a company even more of your money though?
Does https://pypi.org/project/pypi2nix/ work?

Now that pip supports pinning with a sha (I say “now that”, this was added years ago but it wasn’t always thus), it seems it should be trivial to map onto the Nix model.

I have been working with poetry and playing with poetry2nix so haven’t tried raw pip requirements files with Nix.
The Semiconductor Photomask
> kramer and everyone around him is under the radar for taking opposite trades to what he's pitching

Unless disclosed, this is illegal. (EDIT: Never mind, idioms.)
Dumb question from someone who hasn’t been keeping up with this particular subsphere of app dev…

What’s the ideal use case for Supabase? It seems oriented towards “serverless” apps given the mentions of edge functions, but does it fit in as a component of an app with a more traditional back end?
Hey @dang can you update this to "Tailnet Lock"? This is about a feature named "tailnet lock", not a hiring freeze :)
Yes.

And pretty much anyone can run a personal DoH stub resolver for ~$0: https://github.com/serverless-dns/zero
What about any music player? I want Spotify to be the default, dammit.
Github, proudly paving the way for the "open source" to open source.

If there was funding, people wouldn't attend a marketing seminar. This is just a microsoft acquisition with extra steps. Big Tech has been looking to exploit free software for a while now. Microshit's VSCode was a starting point. They'll gatekeep competent devs into mundane tasks for $$$$, and they'll pay "open source" devs pittances to lock them into something they intend on controlling the direction of.

The way out is pretty clear: stop using Github.