skysight-inc/HackerNews huggingface dataset:
It's important to understand that this issue was specifically caused by a deficiency in Python's packaging system: dependencies are specified by name and version, and if the user configures multiple package repositories, there's no way to control which repository they get the package from. So if a package is normally only available on PyTorch's nightly package index, someone can upload the same package name and version on PyPI and it will take precedence.

It would be better if packages could specify a cryptographic hashes of the packages they depend on and/or specify the package repo that a package should come from. There is some prior art for this in e.g. the Javascript and Rust ecosystems.

This problem did not occur simply because pytorch has many dependencies and one of them got compromised. If pip allowed you to specify dependencies in a more secure way, this would not have happened.
I covet Ada’s feature where you just specify if a parameter is in, out, or inout; the compiler’s figures out whether to copy or pass a pointer.
In my last job I completed a project that had been backlogged for months within about two months of starting. It was still about 6 before I really felt like I had my feet under me, and definitely closer to the year mark before I really had a grasp of the full ecosystem and was operating at the level I'd expect to be. Admittedly this was a larger organization with around 10-15 engineering teams all managing services that had to interact. The numbers I mentioned weren't a hard-fast universal rule, more a rough guideline from the environments I've been both an IC and manager in.

I 100% agree lack of fit can absolutely be a reason to leave in < 6 months. One or two of these wouldn't be a concern, however I've seen resumes of people who have been in the industry 8 years, with the average stint being between 6-8 months and none over 2-years. I'll probably pass on this candidate, even if they otherwise look better than my next choice. Sure they might make "significant changes" in the 6 months they are here, but I'll almost certainly be better off in the long run with the person who sticks around long enough to have something resembling deep knowledge of our environment. If they have had a "lack of fit" with that many previous managers, I have no reason to believe I'll be the one they finally click with.
But when do you refresh the materialized views?
Your entire post goes against the data which shows this generation was coddled (probably too much) and that they statistically have it better than any generation in the history of mankind.

If anything, it appears the problem is that they have had it too easy. They are in need of nothing, which leaves them to create their own problems, in need of solving of course.
>However, the public at large involved in inventing that label, including you, are trash for categorizing a huge group of people that way without checking if it was true

I watched the whole thing happen, on social media - what do you mean "without checking"? I didn't come into this late like you say you did.

If you're implying the ethics violations was the centre focus, then that's not true at all once the focus shifted. Everything related to Brianna Wu and related parties was completely out of pocket from the gamergaters.

>Luckily, i checked.

How? You're asserting I'm stating a falsehood and that you confirmed its a falsehood, but you provide no citations or links. That's shoddy journalism. ;)
Founder Sean Melis is a bloody legend. The story of Bot Hello and how he got there is nuts.

Have a read.
Punch a Nazi isn’t just a meme, it’s a rule to live by
The time based badges are a great help here. If you try to get one, you have to restart all the time. It's at least a great perfectionism unlearning tool.

Maybe I should apply the lesson on some of my personal projects. Say at the start "this project should take X days", and if it's obvious it won't, restart or redesign.
I wonder this also.

As someone who manages a team off highly talented offshore developers, who are working for a fraction of the pay that US developers get, it makes me concerned that this is all going to average out.

And if it averages out, US-based tech. employees will be in for quite the shock.
> Ranked choice voting is, to my knowledge, the most representative process to elect.

It is not. “Ranked Choice Voting”, as a commonly used name for the specific ranked ballots method also known as “Alternative Vote”, “Instant Runoff Vote”, and a couple other names, is not “the most representative process” by any measure. It’s not even part of the best class of ranked-ballots single-winner methods (Condorcet methods), and single-winner elections of any kind are less representative than systems which provide proportional representation through the use of multimember constituencies (whether candidate-centered systems like Single Transferrable Vote in multimember districts, or whole-legislative-body systems like Party List PR.)

The name is even chosen to avoid consideration of competing ranked-ballots systems by creating the impression that it is the system for elections with ranked ballots.

> No vote is wasted.

Plenty of wasted votes in RCV/IRV/AV.
My question when people implement a generic feature like this, is why doesn’t the database do it? And many tunes, as is the case with soft delete, it does. For example, Redshift tombstones records and you can choose when to “vacuum” them up (actually delete them).

Usually if you’re changing the way a primary function of the database works, like delete, it’s probably not a good move.
Those same people exist in larger companies. The difference is they either fail up, or there are more people for them to spread their shit on.

The outsized impact of a bad employee is definitely a potential of a small team / company. Maybe I've just been lucky, but for the most part the closeness of a small team also invites more visibility and accountability from owners. Bad managers and employees, in my experience, tend to have shorter careers in small companies.

On the other hand, I've seen "staff" engineers at large companies who clearly have "leaves feedback on PRs" as a performance metric, because they would add trite, useless requests for changes that would conflict with feedback they left on other PRs, and would be exceptionally petty when confronted. These same people would be lauded because they lived up to artificial expectations, despite probably having a negative impact on the teams ability to deliver if anyone really looked at what they were doing.

On a small team, you can't get away with that for very long before it becomes apparent that something isn't working.
But even then the price wouldn’t make sense right? I mean - regardless of unit confusion, didn’t they have to at some point calculate a price per unit themselves ? At that point the error would be pretty clear no? I can’t think of a combination of unit confusion that results in a normal price
The major git repo hosts need to support it, and given their backing, have no excuse not to. So gitlab, github, bitbucket, aws codecommit et al need to be forced by corporates rejecting their use on security audit ISO27K/SOC2 grounds and they'll move.
> The Boeing 737 max crashes certainly demonstrate that the industry does not universally prioritize safety above all

There is regulation and there are consequences of not following the spirit of the regulation (most focus seems to be on compliance to the letter of the law and avoiding to do anything beyond that ignoring the spirit of the law). Consequences don't seem to be particularly deterring in much cases; the offending company pays a penalty, no executive goes to jail and people forget about it soon. Unless these executives get jail time, there won't be any fear of consequences.
Seems better we keep pretending it's ok. Let big stupid business build big stupid generally pointless stuff and hope they contribute back to the foundational open source stuff before they go out of business.
YDNUC (You Do Not Understand Correctly).
Someone did, now.
Before writing this post, I asked chatgpt for examples of positive transfer from auxiliary losses in the literature. It pointed me to this paper:

https://arxiv.org/abs/1705.07115
The problem is the automation (PyPI accepts packages from basically anybody automatically). Fedora and Debian/Ubuntu package a large fraction of the python ecosystem (everything required by any package!) and are far less susceptible to these attacks, due to a maintainer doing the update. That's not to say that there is probably perfect vetting of every update, but something like this would be harder.

PyPI probably needs a vetting system for new contributors of some kind.
Yep and it's dreadful as a mobile app.
If you think you think you need therapy for every little thing, how exactly would you function as an adult? Adults develop coping skills. If you can't cope with anything, you can't function as an adult.
Blockchain consensus only works when there are many more “verifiers” than there are items (blocks) to verify. Good luck with the amount of software updates being published and manual reviews.

Regarding manually reviewing software, it would be very easy to create a malicious majority of verifiers who certify malware, because malicious “verification“ takes much less resources than truthful verification. Rather than verifiers being payed, verifiers would need to themselves pay for the right to verify, in order to throttle malicious “verification”.

But realistically, you need verifiers that you trust in the first place, and if those exist, digital signatures are sufficient.
>Public opinion is a schizophrenic cultural phenomenon that most people understand in a hyperlocal sense.

I asked someone with schizophrenia and they thought this pretentious comment was hilarious in the midst of a thread on ableism.
>With modern CPU's having so many cores and threads being so cheap, couldn't NASA use these for redundancy?

Nasa needs redundancy. Say we ran a program in triplicate, one on each core, and compared the outputs. We still don't have redundancy here because the chip can still fail in a way that will cause problems for all three cores.

>My second question, how much more resilient are older processes with larger feature size compared to modern 6/7nm ? Compare modern with older (14nm/22nm finfet, 28nm/32 soi) and ancient (65nm or larger).

Larger gates tend to be more resilient to radiation. I don't know exactly why. The fabrication tech is also important. Some types of chip manufacturing processes results in more resilient chips. I'm sorry but I don't know enough about it to elaborate further.
Ah, thank you very much for the explanation!
Ireland is another option outside of Schengen but inside the EU.
When you ask someone a question, their answer isn't a rebuttal and you don't give them hints, come on. Really needlessly obnoxious. He replied to you in good faith.
Warranty on software? I’m trying to say something profound but I keep uncontrollably laughing.
Is there a legitimate reason so few people have been charged in the case of Epstein?
Google will pay $9.5M to settle DC AG's location-tracking lawsuit
Depends on which multiverse timeline.

In mine, he died "in obscurity" in Russia in 1976.

Unless of course the sources that say so are disinformation from the ruling class.
You don't see it as disrespectful to pretend Gen Z has no agency, no ability to actually solve their own self-induced problems?

Everything is someone else's fault? Is there anything they have brought about upon themselves that they can solve themselves, or are they helpless?
Does it really respond to touch events?

Looks like you're only binding mousedown.

https://github.com/geobde/use-click-away/blob/master/src/use...
From the article:

“Google leads consumers to believe that consumers are in control of whether Google collects and retains information about their location and how that information is used,” the complaint, which Racine filed in January, read. “In reality, consumers who use Google products cannot prevent Google from collecting, storing and profiting from their location.”
There is not a conflict here. PyTorch depends on many packages and none of them were compromised. Instead, a limitation with the way pip installs dependencies allowed someone to create a package on PyPI with the same name and version as the one on PyTorch's nightly package index, which took precedence over the real package. This could be fixed by supporting better ways to specify Python dependencies in pip, without any dampening effect on the package ecosystem.
And the maintainer may change what the functions do randomly for any reason including they found it funny.
We already have illegal speech, and this slippery slope you’re so afraid of hasn’t appeared. The boundaries seems pretty well contained by social convention and contract. Stopping people from saying the n word online isn’t going to lead to the fall of democracy. In the upside down hypothetical future where we decide as a society that “akshually racism is good”, nobody will be getting arrested for saying the n word by then. Don’t worry so much about far future hypotheticals, worry more about concrete harms being caused today.
First New Year Resolution: Degoogle
> Maven doesn't have this problem because maven central is too obtuse for hackers to use

I have many gripes with Sonatype but Maven Central isn't really one of them. The fact you can publish a packages to the likes of PyPI, npm Registry, or Docker Hub with 0 friction makes those places very attractive to spammers and bad actors. Maven Central having a higher barrier of entry is a feature.

IIRC Brian Fox, the CTO of Sonatype, was actively involved with Maven in the early days and was part of the decision for Maven packages to use domains for namespaces. Namespaces are another valuable feature of Maven that makes supply-chain attacks like typo-squatting harder to pull off.
After US invasion of Iraq, I couldn't agree more.
Never thought I would shrill for Java, but that vulnerability could exist in any language. That it was such a widespread issue only goes to show how widely deployed Java is for server software.
application of law is politicized and protects status quo power
> Only using privileged containers, or else you don’t have visibility into signal from other containers.

The suspect application doesn't need the privileges, so I'm not sure how much of a problem that is?

> there’s an important distinction between “you captured a log showing the smoking gun evidence of the supply chain attack”, and “you successfully picked that log out of all of the log data you generated and classified it with high confidence as an attack”.

Assuming that you're talking about the signal:noise problem, that's hard in the general case but I feel like you could easily pick off really obvious cases like trying to access private SSH/GPG keys and still get a lot of value.
I did something similar to this many years ago but didn’t limit to deleted records and instead created an audit log with a very similar approach. It worked nicely and provided a view into how data was changing by our users.
This is a double edge sword. She should be allowed to use the service, without question, but Airbnb is right to be concerned properties might be used for prostitution. Airbnb does not trust sex workers.
To take a stab at it:

This is one of those things where business requirements trump the technical implementation details. Prevailing theory is that actual deletes are bad because you can’t do historical analysis, recovery etc on the data. Say a customer stops using a service for a year but comes back: it’s a big win if you can (at least optionally) restore their data, so the theory goes.

That’s why tricks like this exist.

The alternative is to write the data to a separate database and/or table that’s meant for archive purposes. I think it’s better than these soft delete tricks but it’s got complexity too. More resilient IMO and let’s production systems run leaner over time IMO
Hm, I think a counterargument to that is that there is always work, so not sure where that leaves you…
Dirty USB-C Tricks: One Port for the Price of Two
Presumably when underlying data are updated.
Serious question: why would I want to purchase this as a poster?

Asking as a nerd, but maybe not a very specific data oriented nerd.
Encrypting keys with a passphrase would also help.
Yep. Just try to cURL the page, and you get 403 Forbidden. That is completely unacceptable.
Someone who isn’t me is well versed in small, stiff pieces of paper, but admittedly not schizophrenia.

They claim there is a lack of voices talking to them, but the effects on their serotonin system does lead to a euphoric and psychotic state.
In the case of Prince Andrew [1], there was a private settlement with the victim with the strongest case. He did not (directly) admit guilt and got his case closed.

https://www.nytimes.com/2022/02/15/nyregion/prince-andrew-vi...

[1] edited from Prince Albert
> Is there a legitimate reason so few people have been charged in the case of Epstein?

Given the probably reluctance of most victims to come forward, active concealment by (apparently) multiple large banks (Deutsche Bank was sued and settled with New York, and now JP Morgan by USVI), investigators getting proof beyond a reasonable doubt even if there aren’t powerful people with law enforcement connections with an interest in derailing investigations and accountability (there’s at least some reason to suspect something like that was involve in his wrist-slap the first time he was arrested, if not also beyond that, and certainly his rumored clients suggest that if there was, it might have been more about protecting them – and thus extend beyond his death – than about protecting him.)
By the next time I bother to go to McDonalds, I'm sure the robots will at least not fuck my order up like the stoners always do. Not sure what the Marxist burger flippers will do now, but since they don't care, I guess I won't either.
Determined by the mathematics, i.e. how the momentum operator is defined in quantum mechanics.

https://en.wikipedia.org/wiki/Momentum_operator

As GP said, position and momentum for a given system are the same thing represented using different basis vectors.

Let's use an more intuitive example, outside of quantum mechanics, in regular linear algebra in R3. If you have a something in 3D space, you can come up with multiple different coordinate systems to describe things in that space. Once you specify the position of an object in one coordinate system, the position of that object in all other coordinate systems is also determined.

In quantum mechanics, position and momentum have this sort of relationship. If you specify the position distribution of a something, you can transform it to its corresponding distribution in momentum space.

Another comparison is with frequency/time of a signal. Once you specify how a signal looks over time, its frequency spectrum is determined and vice versa; the two are Fourier transforms of each other.
As the sibling noted, Python has a built-in AST parser [1] which I believe (not 100% sure) is used in libraries like Numba to JIT Python functions [2].

But fundamentally, the difference between built-in and provided as a library is not really as wide as it once was. Rust libraries use a third-party library for parsing code for procedural macros [3] which is pretty pervasive, and as I noted libclang for C++ is a thing (though definitely less common).

So at least in my mind, the key difference in Lisp (for languages today) is not so much having this be a capability at all, it's more having it be expressed in terms of data structures lightweight enough that regular Joe programmer can pick them up and use them with relative ease. (Whereas, using Python's AST module and figuring out how to do code generation is definitely more than the average programmer is going to figure out.)

Even the reader can be customized in some syntax-ful languages. Terra is not mainstream but it provides this [4]. There are probably others.

[1]: https://docs.python.org/3/library/ast.html

[2]: https://numba.pydata.org/

[3]: https://crates.io/crates/syn

[4]: https://terralang.org/api.html#embedding-new-languages-insid...
Desalination will likely be required long term for SoCal no matter what, but currently California is not capable of supporting the energy requirements of desalination to replace the water it gets from out of state. The vast majority of California water comes from out of state, less than 30% comes from sources in-state.
I re-read my post and I can see that it is unclear. I meant the Russians lack trained PILOTS, not that they lack decent IADS. I agree that Russian/Soviet SAMs are overall pretty damn good, and deserve to be respected. I think Soviet doctrine of robust air defenses at all ranges/capability levels is proving prescient. The US in particular finally realized they need to play catch-up when it comes to SHORAD.
>over organic content created by TikTok users about workers‘ rights?

the algorithm can be easily influenced to push propaganda and sway opinions. From the Twitter Files (and even prior) we know the old Twitter regime, for example, existed to push woke leftists agendas, including working with the whitehouse and various govt agencies to push propaganda.
"Everyone" is doing a lot of work in that sentence, but I think the fact the gap lessens significantly for unmarried, childless women speaks to that.

When given a choice, many women do chose to work more hours.
Astronomers Discover Micronovae
Lucas is my favorite tech author and I plagiarize him every time a text editor discussion breaks out:

"Let me be perfectly clear: ed is the standard Unix text editor. If you don't know ed, you're not a real sysadmin."

https://shop.aer.io/mwl/p/Ed_Mastery_The_Standard_Unix_Text_...
That's not helpful. You said you wanted to help :)
Definitely happening much faster than middle age. My friends and I have realized this and we're <25.

One of my friends busted his ass the first year he started working, got an average performance review. 2nd year he chilled out a lot and got a better performance review. Performance reviews at most companies are useless and it doesn't take long to figure it out.

Another friend told me that it's not possible to get the top performance rating in his company. They just don't give that rating out.

My take is that a lot of Gen Z are entering the workforce and thinking "you expect me to do all this work for an ok salary I will never be able to afford a house on? that's a bad deal".
Prince Albert is a totally different thing.
> it's ok to have to click to find out what something is about

Imagine the front page was actually like that. Unless you know the random keyword, you'd have to literally click every link to find out whether you're interested in it.

I cannot find the claimed rule in the guidelines anyhow (https://news.ycombinator.com/newsguidelines.html).
I guess the question is: would package maintainers have caught this? (I don't know the answer; I suspect that it would slip by some but probably not all.)
Likewise. I tense up before I print anything, and usually end up shouting every time I try to print something at home. Horrible things!
> In the case of Prince Albert

Prince Andrew; to my knowledge, no Prince Albert has been connected with Epstein.

> there was a private settlement with the victim with the strongest case.

In theory, a private settlement of civil charges does not protect against criminal charges arising from the same conduct.
yep, just for now but easily can pass the event as parameter
>I'm perplexed by your comment. Prolog is not a functional language. It's a logic programming language.

It's my impression from its use of recursion for execution flow alongside its assign-once variables, which feel a lot like haskell's lazy evaluation.
It sounds more like she was working and getting paid for overtime, not that working extra got her raises.

She realized instead of working overtime to make more money, she should ask for a raise.