skysight-inc/HackerNews huggingface dataset:
Somewhat related question, do you think there is a market for vetted/audited/curated mirrors of the major language package registries such as PyPI and NPM?

These "uncurated" package managers will always be vulnerable to someone uploading compromised builds. Would people pay for a mirror of these that contain a curated list of vetted builds? It would probably only have a small subset of the origin registry.

The vetting or auditing could be at a couple of different levels, automatic based on on "trusted" authors and signed packages, automatic code analysis, and higher level manual vatting. Customers could request packages that are on the open list be included in the curated and vetted version.

Obviously there will be some time lag between packages being uploaded to the origin before they have been vetted and places on the curated mirror. Some sort of expedited process would be needed to security releases.

/random thought for the day
I've never used Qubes. Rather I heavily segment with manually configured VMs. The ones that run proprietary software (eg webbrowsing, MSWin, etc) generally run on a different machine than my main desktop. It's quite convenient as I can go from my office to the couch, and I just open up the same VMs there and continue doing what I was doing.

I define the network access for each VM in a spreasheet (local services and Internet horizon), which then gets translated into firewall rules. I can simultaneously display multiple web browsers, each with a different network nym (casual browsing, commercial VPN'd, TOR, etc).

The downsides include needing an ethernet cable on my laptop (latency), and that this setup isn't great at going mobile. Eventually I'll get around to setting up a medium-trust laptop that runs a web browser and whatnot directly (while not having access to any keys to the kingdom), one of these days real soon now.

Which brings me to the real downside is the work required to administer it - you already have to be in the self-hosting game. This is where an out-of-the-box solution could excel. Having recently become a NixOS convert, SpectrumOS looks very interesting!
Yu cn’t rmve vwls (or any lttr) frm bgnnng or end of wrd bcse it’ll be too hrd to rd. Fr exmple, “mttng” ws a tgh one to dcpher.

You can eevn scrbmle the wrods, but as lnog as you lavee the frist and lsat ltteres, it’ll stlil be reabadle.
How to improve Python packaging
tragically, we will get more articles in this genre, as 'security' attracts government funding, and faux security acts are enabled via budgets and megaphones.
> As I've mentioned, I broke links by not implementing redirects.

Didnt implement redirects for what? The prior part of the article doesnt even mention you changed any page URLs.

But if you did, that is most definitely going to have caused problems.

Think about it - the pages are no longer there, so they will get dropped from the search index, so wont appear in search results, resulting in less impressions/opportunities for click-through, and you will receive less visitors as a consequence.

You effectively delisted your sites content. The existing inbound links will now point to non-existent pages, so they carry no "authority" to your site. The content that is on the new URLs has no inherent "authority" so its not being ranked as well as it was on the old URLs. The search engines will rank it lower (e.g. page 10 instead of page 2), so less impressions and therefore less visitors.

You will likely be able to (partially) fix this with redirects - as sites that still link will still bring authority. But you will possibly have lost any history-based authority (that which comes from being a reliable and consistent URL), which may not be able to be retrieved.

I would recommend going through old access logs to find what your old URLs were, and redirect them to the new URLs for that same content (not a wildcard redirect to homepage!)
My personal machine?

I use Linux with lots of distributed sync and backups with e.g. Syncthing (plus copies of stuff NOT on sync thing)

Now, I'm aware many reading this are going to nerd out hard (like how the top comment now is "Android/Chromium" which I'm skeptical of but haven't done much homework on? Maybe?)

But because you said "personal machine"-- I'm thinking about my own threat model and my years of experience.

Thus, not going to much worry about, say, some obscure Linux-Stuxnet-thing, which not only is overwhelmingly unlikely, but also something I can't much do anything about beyond the solutions I mentioned above.

More likely, I can avoid stupid Windows and stupid Mac,and often stupid Web mess by what I'm doing now.
This is why it’s rare as good Carolina barbecue to find a person self-educated in these topics who also truly understands the material. At least in my experience.
Unfortunately this is almost never true because of the endless supply for desperate, gullible or just arrogant people who are ready to work for top tech companies.
RISC-V (+embedded Rust) is my tech-skill resolution for the year. I like the openness and the modularity. I've massively ignored everything close to the metal over the last couple of years so it's kind of fun to dive into an ISA. A Sparkfun Red-V arrived at my doorstep on Friday and I'll stick to embedded and rv32imac for now but plan to dive into rv64g eventually (and possibly down the whole osdev for fun rabbit hole).

For anyone interested, John's Basement videos on youtube were pretty good so far (and so is his ebbok on Risc-V: https://github.com/johnwinans/rvalp/releases).
First, take a deep breath.

Second, unless you're in a situation where you've pissed off/threatened some rather large actors, you should be fine assuming you follow best practices for backup, software, update and password management and you avoid using things like cheap IoT devices to connect to your cloud services.

Third, when disaster strikes, keep calm, rely on backups, change affected passwords and notify others who might get affected.
Let’s not forget how it all started: “Birdflight As The Basis Of Aviation” (Lilienthal, 1889).
All these comments about the tech but not the political stability and outlook of the country.

Philippines has always been adapting new technology, but suffers failures on general governance that prevents them from really changing the country.

Has there been recent success that solved the energy issue within the country? (I really don't know.)

https://en.wikipedia.org/wiki/Bataan_Nuclear_Power_Plant - Didn't work, built by a fault line, fully constructed, never powered the country. Much more political fallout - fun read. You can get tours of the place if you call the right number, which always changes and there is no voicemail or whatsapp/viber/facebook option available.

https://en.wikipedia.org/wiki/Wind_power_in_the_Philippines

Currently all deployments provides 1.6% of energy within the Philippines, but was built and foretasted to provide much more - https://www.doe.gov.ph/sites/default/files/pdf/energy_statis... (from wikipedia)

There are also much more studies and reports that contain fully documented news articles and government press releases, that overestimated capacity during bid/build and actual provided energy. This is another example - https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3907028.

I have nothing against the Philippines, nor am I filipino, but it is interesting to see a country continually promise, promote and market solutions that are somewhat forgotten when they come into fruition. Nonetheless, it will be interesting to see what happens with this solution.

Some background information on the Philippines - it is the most expensive country in South East Asia, for electricity cost - https://ieefa.org/resources/philippine-energy-transition-bui...

And I also find it quite humorous that the beer company, san miguel corp controls 30% energy transmission https://www.sanmiguel.com.ph/page/power-energy and continues to build coal power plants, which are mostly dependent on coal exports from China.

I'm interested, because it seems like a comedy sketch when you put it all together. I'm not saying any other country is perfect, flawless with execution or never has problems but when I look at Philippines performance for South East Asia - they always appear dead last, by a huge margin - while Indonesia and Thailand seem to have proper governance and expands infrastructure services and more to help their population.
Perhaps it's because I have a cold right now, but I interpreted "personal machine" to mean my body. And what is meant by "trust?" The word is really synonymous with "faith". That's why the correct phrase is "trust and verify".

I understand that my "personal machine" - my body - is always compromised. I also have faith that no heinous actors are likely to try to compromise my body. But that is only because I am a nobody and have the good fortune to live in a safe place.

As for computers, I think the same logic applies. I have faith that no nefarious actors are striving to compromise my own machine specifically. But for many high-value targets, this would be a bad assumption. Witness the crypto thefts that have occurred by hacking individual's computers.

I am no expert in counter ciber espionage, but my understanding is that it boils down to a) reducing attach surface, b) using trusted hardware, and c) using ephemeral "machines".
More like tracking monopoly
https://www.macrumors.com/2022/11/15/apple-employees-unhappy...
Shadow banning is when they are doing extra steps to prevent you from realizing that you are banned. Usually giving you the impression of a working service, while everybody else will not be able to see your contributions.

Banning is just stopping the service for you, wether they tell you actively or not depends ob the service. No search service is actively informing you about the usage of your data, neigther are they telling you they stopped servicing you.
Improving the Elo rating system to account for game results
> you apply a voltage to a capacitor

Applying voltage to a capacitor is an incorrect mental model -- the voltage across a capacitor is a function of its charge [1]; it can't be both that and the voltage you apply to it.

In reality, when you apply voltage "to" a capacitor, it's to the series circuit comprising the capacitor and a (hidden or explicit) series resistance, thus causing a current to flow determined by the resistance and the net voltage across it.

The correct mental model is that you inject current into a capacitor. So long as you inject current, the voltage across the capacitor rises. viz. a flywheel -- so long as you apply a force, the flywheel speeds up.

> A flywheel speeds up as long as you apply a force to it; an inductor's current increases as long as you apply a voltage to it.

Likewise, a spring gains tension so long as you keep elongating it.

Inductors and capacitors are dual to each other, so -- ignoring the mechanical linkages themselves -- there's no inherent advantage for one mechanical analog or its dual. We are thus free to choose either to make a sound analogy of the physics of linkages:

> And, current and velocity are both motions, while force and voltage are both pressures.

This grammatical correspondence is not relevant to the mathematics. Kirchoff's laws [2] only hold for mechanical linkages when current is held analogous to force, and voltage is held analogous to velocity.

A more grammatically satisfying analogy can be found in hydraulic systems, with current : flow :: voltage : pressure. Flow, unlike motion, sums at nodes; pressure, unlike force, is equal at nodes.

If one is insistent on treating springs like capacitors and flywheels like inductors, you can do so, but only if you also take the dual of the full circuit, as seen here [3]. This is then a mathematically correct analogy, but personally I find it much less straightforward than simply swapping springs and flywheels.

[1] https://en.wikipedia.org/wiki/Capacitor#Current%E2%80%93volt...

[2] https://en.wikipedia.org/wiki/Kirchhoff%27s_circuit_laws

[3] https://www.ams.org/publicoutreach/feature-column/fc-2019-05
If you're disorganized, you'll search in random places until you find it. Joke applies.

But if you are organized, you'll start with the most likely place and progress to increasingly less likely places. When you find it, there's no surprise, and no one gets much of a chuckle over your efforts.

If you don't understand the problem space, then saying "That's the last place I would have looked!" is an expression of exasperation about your lack of knowledge.
> that have a 20% inflation at the time, but currently around 50%

Official interannual inflation rate was 94,8% in December 2022.

https://www.indec.gob.ar/uploads/informesdeprensa/ipc_01_238...
At one point I set up my wired and wireless interfaces as a bond with wired as the primary, and I could do a file transfer and watch the speed go up or down as I plugged and unplugged the wired interface. That was pretty slick.
something to consider is that you can really do most beginner drawing exercises & rudiments with only a fraction of your attention so it is pretty easy to draw while doing other things. if you watch tv/commute/cook meals/go out to eat/listen to books & podcasts/use a laundromat/ etc,etc you can use that as supplemental drawing time as well. you can start with basic coordination exercises (drawing lines, circles & ellipses) and work your way up to observational drawing and dynamic sketching practice.

>https://www.youtube.com/watch?v=eaif0PpNMas&list=PLQ9CsVTcIG...

i did some of my most productive studying on the bus or in hospital waiting rooms. even with a fulltime job i would say that 5-6 hours of drawing in a day is very achievable without much sacrifice. you don't need to be that serious about it, but you probably have more time than you think.
I think you're looking for a factorial number system [1] and/or Lehmer code [2].

[1] https://en.wikipedia.org/wiki/Factorial_number_system
[2] https://en.wikipedia.org/wiki/Lehmer_code
That sounds interesting. I might search for that python explanation, have an eureka moment, then forget most of it in 24 hours. It's happened a couple of times with monads.
Did you miss the first sentence in the post?

> If, like me, you struggled to understand the Fourier Transformation when you first learned about it

No where does the author imply that he is teaching the Fourier Transform to someone who has never heard of it.

I agree with your overall point. Blog posts are not going to teach you difficult mathematics unless they are the length of college textbooks. But a blog post like this is great for reinforcement. If, like me, you are an ECE (Electrical and Computer Engineer) who has written software for the last 15 years, an explanation like the one in the post makes a lot of neurons reconnect.
I think you're mixing up allocation with a data structure. There are lots of implementations of lock free lists and stacks in C++ out there. One simple implementation is an array where every index holds the next index. A current variable holds the next index to deal with and a version number.

When you want to allocate an index you check the current index and version, and replace it with the index points to if the version is the same. Freeing is the reverse since you have an index to give the list.

These indices are used to coordinate to a second array where you can store whatever data you want.

Here are some other techniques.

https://people.csail.mit.edu/shanir/publications/Lock_Free.p...
https://www.boost.org/doc/libs/1_55_0/boost/lockfree/stack.h...
https://lumian2015.github.io/lockFreeProgramming/lock-free-s...

Still, I'm not sure what garbage collection changes about these techniques. Lock free lists have been studied for a long time, they have nothing to do with memory allocation.
Right, the claim was that "Neural networks give probability estimates. Bayesian methods give us probability estimates AND uncertainty" which presents a false dichotomy. I think we agree.
Honestly, the thing about other sites using your GA tag seems like the biggest red flag/potential for some Google algorithm to have actively started penalizing you. The timing doesn’t quite track, but maybe some interaction between that and the spam update?
I’m not sure that’s right.

The abstract and text say the nth digit of \pi^n, and the worked example on page 2 uses the same n=1000 to find the thousandth digit of \pi^{1000}.
> I am a Lisp, April, APL/J/BQE, and Forth[2] aficionado.

Same taste here, although I have the quirk that I also like types & proofs.

Because of Lips, APL(ish) & Forth are so nice and terse, I feel the need, every so many years, to try to combine them. Usually I quickly build something (I build a lot of Forth-likes for embedded and other compiled languages to speed up work without having to compile) that combines these 3. Usually I find that Arthur already did that kind of with Shakti and before with k. For my, however, APL chars are better. Since recently, I use the BQN keymappings to create new things.

So then I go into struggling how to add types to something like the above (outside Lisp/Scheme as that has been done). Most people think it's nonsense anyway [0], so i'm not quite looking to have the user add actual types (mostly), but more-so with global static analysis.

Anyway, bit offtopic, but nice to see there are more people (outside Arthur [1]) who like some of these combinations of languages.

[0] https://www.youtube.com/watch?v=z8MVKianh54
[1] https://kparc.com/lisp.txt
> Doing so without their knowledge isn’t inherently bad.

Appears to carry more weight than "sanity checks". IME, the latter are often just advisory to catch cases that would be 'insane'.
There’a no comms because Twitter no longer has a comms department.
They can definitely inadvertently be part of someone's supply line. The official repository takes precedence over any locally configured repositories (say, an in-house package named libhttps).

When that package suddenly gets published onto the official repo, it may replace the intended package without the devs noticing until it's too late.

I think this is a flawed design for a package management tool but it's the tool we've got.

These packages could be random typosquats but they might also be targeted supply chain attacks against a specific company. With the CircleCI leak, the names of internal packages may just have leaked.
Marc Andreessen on business plans (2009) [video]
> Peak denialism.

That's a bit condescending.

ChatGPT isn't remotely close to "general creative intelligence, problem-solving skills and ability to manipulate abstract thoughts daily". It only pretends, in a pretty impressive way. A bit like you can train your dog to play dead when you point your finger at them and say "bang", but you should not conclude from it that your dog understands the concept of death.

> Since humans use this test to select people with good reasoning skills, why do you think it is an inappropriate test for a robot?

Well it is already not a perfect solution for humans. When you use a metric to rate people, then they start optimizing for this metric. Typical example is academic rankings: if you are ranked based on how many papers you publish, you will publish a lot. Doesn't mean you will do good research.

Now even if SAT was a good way to rank humans, that does not say at all it would be a good way for robots. If you test whether a cat is stupid or not by asking it to drive a car, then obviously it will be stupid. Asking ChatGPT to pas the SAT tests is probably like asking a student to pass it with infinite time and an internet connection. I guess that's not how SAT exams are usually done, right? (I am not in the US).
Gangster PTO: "take off all the time you need, but be careful or that nice job of yours might have an accident"
After three years of covering Covid, I built my own air filter
Recreating classic games with a bare MCU
Three fun little projects to build hand-held computer games 1980s-style.
at the point of the observed drop I hadn't changed any page URLs, no. Apologies for lack of clarity.

I had changed image URLs when they migrated from being PNGs to WebPs. Following that there was the SEO drop off (within 6 weeks or so)
Linux is a security shit show but it is at least publicly auditable, which is a prerequisite to form reasonably confidence in the security of software, or to rapidly correct mistakes found.

OpenBSD by contrast has dual auditing and a stellar security reputation, but development is much slower and compatibility is very low.

seL4 as an extreme is a micro-kernel with mathematically provable security by design, but no workstation software runs on it yet.

MacOS, iOS, and Windows are proprietary so they are dramatically worse off than Linux in security out of the gate. No one should use these that desires to maximize freedom, security and privacy.
Ask HN: Is Tesla using OpenStreetMap data in FSD?
I heard some rumors in a recent Openstreetmap meetup that is probably incorporating some OSM data into FSD. Are you aware of this? Do you know something about it?
Abseil / SWE Book Freely Available
https://archive.ph/z8ZTp
I have exactly this problem. Beej's Guide to Network Programming is indexed just fine. Beej's Guide to C won't index.

The automated tool says it's in violation of some unnamed rule, but I can't figure out which. There's zero SEO, tracking, or ads, and the content is educational and G-rated.

All the other guides index just fine.

I asked for a review and they came back with the same ambiguous message. Eventually I just gave up.

Recently I split the C guide in two. I'll have to check to see if that made any difference.

But it left a bad taste, and now I don't trust Bing or DDG to provide complete results. Google's overrun with spam, but at least my stuff actually shows up on Startpage.
Yep. It bums me out as a contributor to both package indices and someone working on “supply chain” tooling; there’s serious and interesting work to be done here, but it’s general work (universal codesigning, automatic typosquat restrictions in indexes) rather than this kind of lazy blogspam “exploit” whac-a-mole.
“Isn’t inherently bad” together with “just” are pretty minimizing
Musk reveals Daimler invested in Tesla 14 years ago
Exactly, the only possible "last digit" it could have (in keeping with the silly premise that it has one), is zero.
Nor any other non-FAANG company I've ever worked for. In my experience, 401k matches are immediate.
You would think differently if you were one of these 35 people.
Probably it’s gotten a lot better over time. One of the first preservatives added to milk was formaldehyde. Reportedly, it made it last longer and sweeter tasting.
I’m not sure your statement and the parent comment are in conflict. What percentage of “ desperate, gullible or just arrogant people” are top talent?
Windows AppGuard is close to this, although it’s a hyper-v silo not a full VM. Edge can open links in AppGuard (which is what this technology is called) right from the context menu, super convenient.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-...
These won't be "defined benefit" schemes but defined contribution schemes much more akin to your 401(k)
I'm not a lawyer, but my understanding of LGPL is that it wouldn't prevent people from doing what they're doing in this scenario.
There is indeed a market for it; at least, Google thinks so: https://cloud.google.com/assured-open-source-software
https://news.ycombinator.com/item?id=34109507
331 points by fortran77 22 days ago

https://apnews.com/article/1240a8a42edf4a86aff72a0246525a95
Well, most people in math and science majors can pass an arts and humanities major. The opposite is not necessarily true.

Anecdotally, I can easily engage in talks about literature, politics and art with my friends coming from a biology or physics background. I can hardly do so with my friends with a major in French or Sociology. When we mix them together, the debate is always animated when we talk about philosophy, a specific author or book, and even painting. If we speak about GPT3 or the CERN, suddenly the table is divided in two.