skysight-inc/HackerNews huggingface dataset:
Not to mention storage. The model is estimated to be 500-600GB. That's a lot of storage to tie up on a phone.
>I often struggle with large classroom learning: the pace is either too slow and I get distracted or too fast and I can't keep up.

Yes, this is my biggest gripe with learning as well. It's so individual that you almost need one teacher per student.
At the same time, most newbie programmers just remove the old key and 'git push' again without checking the authenticity of the new key. IMHO those users will never benefit from host keys.
Reposting here -
A picture is worth a thousand words – my layman spin on it :)

Our brains build models to interpret (translate) everything.

We use languages to communicate and share things.

When brains share the same models communication is simple. It’s simple to talk about day, night and light with anyone and, similarly, well formed teams (or couples) need few words to communicate even complex ideas because they have shared models.

When models differ the language needs to be adjusted or learned. Identical problem/solutions may sound different in different domains.

However when the model doesn’t exist in someone elses brain to communicate, the model needs to be built. Building models (learning) takes time.

Natural language evolved for natural things. Hence, it’s not very efficient for abstract things that require accuracy. Math (and code) is an accurate language, and (often) effective to communicate models that require accurate replication.

For example. It takes time to build the intuition for some things (e.g. fluid dynamics). Once you build the intuition, the easiest way to explain it is through the formulas. Someone can read the formulas, understand what the model communicates and then build intuition accurately.

You watch and learn to build a mental model, you download the mental model, someone uploads it and builds the model.

This is my mental model for communicating models
Related:

Will You Help Me Repair My Door [video] - https://news.ycombinator.com/item?id=34293904 - Jan 2023 (124 comments)

Also:

Rap artist Afroman sued by officers who raided his home - https://news.ycombinator.com/item?id=35283145 - March 2023 (6 comments)

US Police raids home; sues homeowner over CCTV footage of raid - https://news.ycombinator.com/item?id=35281258 - March 2023 (43 comments)
I am well aware how ssh works. I have written ssh servers and design secure enclave key management solutions for a living.

Even if they wanted the most quick and dirty lazy option with no policy management, they could stick the key in a PKCS#11 supporting enclave every cloud provider supports these days. OpenSSH natively supports them today.

At a minimum they could have placed their whole ssh connection termination engine in a immutable read only and remotely attestable system like a Nitro enclave or other TEE. You do not need to invent anything new for this.

There are just no excuses here for a company with their size and resources, because I do this stuff all the time as just one guy.
If this happened to a smaller company they would be dead.

Edit: where can I get good Mercurial hosting? F this.
Definitionally, if we're in the future, we have more tools to solve the problems that exist.
Not really weird, no. The host key needs to be used every time someone establishes a SSH connection to Github. HSMs can't handle that volume of requests.

Given that the key is extremely long lived, this has unfortunate implications: If any of these servers is compromised, or decides to go randomly spewing memory content because of a bitflip, or screws up the nonce on a DSA/ECDSA operation, the key can be compromised. This is hard to exploit if you're a random person, but for a global adversary that collects internet traffic at scale (e.g. NSA), it's feasible and I would be surprised if they weren't exploiting such issues. They were collecting HTTPS handshakes for a reason.
They're defending "polite open secrets" — things that are only spread by word-of-mouth among friends, because as soon as a centralized broadcast source reports them, they become so over-exploited that they cease to usefully exist.
> compressed size 69913, time taken: 0.054055

Converting the same image with bpgenc yields 19092 bytes. Probably not transmission errors tolerant though.
The point is not to frame the comments as a mistake and give the author a fair chance.
Interesting that you consider the few avenues citizens have to hold police accountable as a path toward anarchy and “black thug culture”.

I’m curious if you have the same energy for the reasons police are being watched in the first place.
Related (I assume?):

The drama in trying to convert election PDFs to Spreadsheets - https://news.ycombinator.com/item?id=35272227 - March 2023 (137 comments)
Classroom experience is so rarely useful, the ONLY time you benefit is when either a) you already studied the subject and the professor is good and mentions something tangential/extra credit, or b) the classroom size is small, so when you don't understand something you can say so without fear of class disruption and the teacher can spend more time tailoring their curriculum to their class.

Otherwise yes, you are often better off with the book and homework and actually completing both.

And this is where I usually go off on my rant how college is useless for education - you can 'learn' peer interaction but even this way nothing forces you to make friends or connections, so the inherent use is close to nill.
Oh wow thanks, this is definitely sending me down a Wikipedia rabbit hole; the Ellipsoid method was improved upon via Karmarkar’s algorithm in 1984. Also nicely illustrates that a problem which moves from NP to P can still be moved even further into P-territory

_also_ Karmarkar’s algo appears to be an important law case on whether math can be copyrighted for people interested in that angle

https://en.wikipedia.org/wiki/Karmarkar%27s_algorithm
> Why would they want to give out their trusty LLMs

OpenAI won’t want to; open source competitors already are, and they will keep getting better. The more of a lead OpenAI has over commercial competitors, the more incentive those commercial competitors will have to back open source options.
Could you recommend one of his books? I’d like to read some Feynman this year but I have no idea where to start.
We announced today that we’re opening preorders for our new products this summer in Belgium (and Italy, Spain, and Taiwan).
Of course a recording would be stronger evidence than written notes. It just wouldn’t be legal evidence unless it was obtained legally.

One could potentially collect lots of very good evidence if permitted to ignore laws in the process.
I spend a signifiant amount of time imagining other people's arguments and questions rather than sharpening my arguments.

Eventually, the amount of knowledge is the same but I am glad I discovered I iterate over 2 stages of work: 1/ proactive, meaning I lay down a proposal based on a situation and then 2/ simulated reactive, meaning I do my best to discover what the audience will want, answer, contradict.

Once I am done iterating on that, I usually deliver my work to an intended test audience. Then after that, to the target audience.

So yes, imagining conversations that have no happened is really helpful and a skill to build. Just don't rely on that solely, because people are weird and unpredictable and you might very well be off :)
IMHO, It should break the CI systems.

If you don't pre-bake the known-hosts, then you'd allow each new ephemeral run to use whatever github tells you it's key is.

It did briefly break ours, as we pre-bake the known_hosts file into our CI image for convenience and security.

Convenience due to CI not having TTY's, so various tools would get stuck on prompt Y when connecting to github for the first time. (Which is every run, if you are ephemeral CI)

And security, as now everything broke due to github's key changing, which is the desired outcome actually.

We bumped the known_host key entry, merged and all is well again...
Given their secrets scanning functionality, I’m mildly curious if they discovered the leak by a notification from that system.
It's not about the certs. To execute a man-in-the-middle attack the attacker has to literally put themselves in the middle of the route your packet takes to get to github's servers and intercept it.
> I’d prefer if we’d start by censoring violence and religion. Religion is just a big lie

you are in favor of censoring violence from video games? you're not lying? and you said "start by", so you'd be on board censoring pornography too so long as it started with censoring violence and religion?

I have a sense you didn't mean any of that.
Perfect! I was just today thinking about how I need to build up my own data set and should be logging all of my transcripts. This is exactly what I wanted.

I want to gather up my chat transcripts, then identify poor experiences in the chat, and then use that to guide fine-tuning. I don't believe that OpenAI actually provides anything to enable this as part of their platform, right?
> for the most popular OS

Android doesn't really do dot files. Or config files that the user can see at all.

(And if you'd like to amend to "the most used desktop OS", this is obviously aimed at unix-likes, but actually Windows does have an equivalent standard and programs targeting that platform really should be following it just like programs targeting unix-likes really should follow this)
Most people do not clone using SSH.
This actually doesn’t seem that silly to me. Isn’t this a bog standard Pigouvian tax? And I think it should be fairly uncontroversial that there are definite negative externalities to handles of liquor…
People will use this to create their perfect self. AI will give them witty, charismatic answers to help them get a job, find a mate, entertain others. Eventually they will become AI zombie husks.
Here are the expected fingerprints (since they don't publish those via SSHFP RRs): https://docs.github.com/en/authentication/keeping-your-accou...

SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s (RSA)
SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ (DSA - deprecated)
SHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM (ECDSA)
SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU (Ed25519)
Direct link to the source website:

https://hindenburgresearch.com/block/
PRIMES, checking whether a number is a prime number or not.

It's important to note that this happens literally all the time in research. There are hundreds of problems that are easily seen to be _in NP_, that we simply don't know whether or not is in P. Many of these problems aren't that interesting, though.
The hype is a bunch of people acting like this AI is the messiah and is going to somehow cure cancer. Once you take that away, you have a pretty useful tool that usually helps you do what Google does with a few less clicks. One caveat is you should be willing to verify the results which you should always be doing with Google anyway.
> “Germany has denied its colonial past for 120 years,” Lars Kraume said, in advance of the film’s domestic release on Thursday. “Most people are unaware Germany even had a colonial past, let alone anything about the brutality of it – it is not even taught in schools.”

It's most likely an important film (haven't seen it yet), but I must take issue with this statement. When I went to school in Germany 25 years ago, we covered the topic of German colonization quite extensively. Admittedly, I just checked the current curriculum for history classes in Lower Saxony (https://cuvo.nibis.de/index.php?p=download&upload=22) and this topic is not mentioned specifically - so it seems to have changed. Imperialism in all its facets is one topic mentioned in the curriculum, where the specific examples would probably depend on the teacher.
what an insane take. police has existed in every form of society and it is necessary for a civilized society to function. its like being against roads, or hospitals, or public transportation.

the dichotomy of LA crime being out of control and LA people being so anti-cop will never fail to amuse me.
You don't need a larger mutex for fairness. For recursive locking, maybe. But most mutexes aren't recursive.

That's one of the big problems with pthread mutexes: they try to pack too much functionality into a single type. A pthread mutex can be recursive, so every mutex needs space to store a recursion count, even though most mutexes aren't recursive. A pthread mutex can have an arbitrary priority ceiling (pthread_mutexattr_setprioceiling), so every mutex needs space to store the priority ceiling, even though most mutexes don't set that attribute. A pthread mutex can be "robust" (pthread_mutexattr_setrobust), which at least under glibc means that every mutex needs previous/next pointers in it so it can be stored in a per-thread linked list, even though most mutexes are not robust. That's an excessive level of generality, when different kinds of mutexes could have just been different types!

The other big problem with pthread mutexes is just that they are old. I could be wrong, but my impression is that much of the interest in smaller mutexes has come about relatively recently, at least compared to the age of these APIs. It might be possible to shrink pthread_mutex_t to some extent despite the aforementioned issues, but it's impossible to do so on any existing operating system (at least on existing architectures) because changing the size of pthread_mutex_t would break ABI.
End users do not pay attention but their clients pin the key after first use. Also everyone is using gitops these days and almost no one is using dns-over-tls.

Imagine you control the right router on a company wifi, or any home wifi a production engineer works from and suddenly you can cause them to clone the wrong git submodule, the wrong go package, or the wrong terraform config.

If you knew a CI/CD system blindly clones and deploys git repos to prod without signature checks, and that prod is a top 10 crypto exchange with 1b of liquidity in hot wallets, then suddenly a BGP attack to redirect DNS is a good investment. Myetherwallet got taken over for 15 minutes with a BGP so this is not hypothetical.

Should that be the case? Of course not. But the reality is I find this in almost all of the security audits I do for fintech companies. Blind trust in Github host keys is industry standard all the way to prod.
Man this is exactly what I needed a year ago. We had to twiddle all kinds of knobs in jpeg compression to make images from an onboard camera fit into our very limited uplink budget. We still couldn't guarantee anything, because of the nature of jpeg. The compression target size feature is very important for actually handling images as scientific data in a constrained environment.
It seems like a pretty wild time to be on the offensive against American fintech companies. No real comment on the merits of their research (yet), just a little shocked at the timing.
No, you cannot keep using an exposed key. You must replace it. There is no cost/benefit analysis needed in this situation.
This is incorrect. For example, this happens all the time to celebrities. Someone takes their photo in public and sells it to magazines who publish the photo on the cover. They receive no money and have signed no release.
The whole point of a HSM is to never reveal the private key, but instead to have the HSM perform the necessary crypto operation for each request. This wouldn't scale to the amount of ssh traffic I would imagine github sees.

I think it's completely reasonable that they have the ssh private key in some sort of configuration management repository, because they need to be able to deploy that key to all their public facing ssh servers. You would hope they would have more than 1 ssh server instance world wide for availability and resiliency.
The black and white idea of censoring is beyond my want. We can talk about those things for sure,

- Alcohol displays the % alcohol content on the bottle and has age-verification for purchase in some countries/retailers. An equivalent for porn would in theory, be a plausible discussion.

- Hard contact sports are battling CTE brain trauma as we speak. It's worth trying to save our men from injuries that permanently degrade their ability to contribute to society. We are working on preventing the damage to our youth from the whole concept of sports. Broadly speaking, similar preventative idea could be plausible for teenagers-home-alone and in low-income neighbourhoods who need a help up (and off porn).

- Fast food has changed. Coke moved to Diet-Coke and then widespread acceptance of No-Sugar varieties. That is a huge change that could find a metaphorical analogy in porn. Moving the majority of teenage porn consumption from hard-core down to soft-core, would be a theoretically plausible conversation.

- Being overweight is less clear as the causes-and-effects are so numerous and can combine unhealthily, it is not easy to my mind, to make measurable and agreeable claims towards limiting it's downsides. You got me on this one.

Yeah it brings me to low to watch factual debate fly out the window. The freedom to say whatever you want, I love, but a government or official somewhere shouldn't be allowed to have no grain-of-truth at all, in his interpretative rhetoric. There should be a fact at the bottom somewhere.
Our latest beta BIOS updates improve the power consumption while using USB-A Expansion Cards on 11th and 12th Gen. We have some additional improvements we’re working on around this on HDMI and DP cards as well. For the brightness key/ALS conflict, this is pending additional driver work.
https://aip.scitation.org/doi/10.1063/1.5121155

A vibrational theory of smell...

Is olfaction a quantum thing?
You should be worried if this does NOT break your automation pipeline.
Host-key rotation would enable the attacker to continue, but the attacker could be detected simply by diligent people monitoring the github key they use.

The current rotation allows anyone to try to fish the lazy users (like me probably) who will just trust on first use. Probably a bigger risk than key compromise, since they have logs.

It could be a better idea to use Host-key rotation, despite it making the life of a key-thief a bit easier. Just because it exposes people less against opportunistic impersonators.
I don’t understand how this is possible - do they not pre-scan commits for secrets? Our Azure devops repos reject any push with anything that looks like a credential.
Sure, there are many ways an attacker can do that. Not trusting your IP transit is kind of the whole reason for encryption in the first place.

1. Various DNS hijacking and cache poisoning attacks
2. three letter agencies in meet me rooms
3. Exploited/hacked routers
4. Wifi hot spots
A number of games are in the 60-150GB range...
It's wrong. A decoder only transformer performs a (possibly random) operation on a state from the state space {tokens}^CtxWindow, where the distribution of the new state depends entirely on the previous state. It is a Markov Chain with a special structure: The new state is deterministically equal to the old state shifted by one, with only the last token being newly generated.
This is correct. We shared the draft pinout in this repository.
Yes, related.
It is a Markov Chain on the state space {Tokens}^CtxWindow.
My office at home will quickly go over 2000 and then 3000ppm if I keep the door and window closed. It sucks in winter because I basically have to keep the window open(and be cold) if I want to have the privacy of a closed door.

It did make me realize why I was feeling sleepy and not quite so focused after long period of time in that room, so getting a CO2 sensor was great in that sense. I also stopped closing the door to our bedroom - CO2 levels would easily go over 2500ppm overnight if you left the door closed.
Usual reminder that fruit of the poisonous tree is a US special
> GPT-3 was said to require something like 150gb of VRAM.

By all accounts GPT-3 is wildly inefficient in resource use; OpenAI runs like a company that’s concerned with the functionality it can achieve by calendar date, and has an almost infinite bankroll to do it. But, other actors in the field have different priorities, and the various open source or, at least, available-to-use models seem to be far more efficient than the OpenAI models of similar function (though they are behind the newest OpenAI models in function.)
FYI: Hindenburg Research on Block (Square) has been going on for last 2 years. Not saying the release of the report is strangely coinciding with all the bad news we are having about Finance/Banking industries but wanted to add this info.
The version might be better but your audience may not have improved enough to justify remaking it.
> That way we begin to promote the people who are demonstrating the most efficacy in shipping working code that gets the job done, rather than those people who are maxed out on talking a lot but don't ship any code at all. Or worse, the silent coasters who do nothing and say nothing lol. We see you now

I don't understand the glee that software developers feel when they get to police their peers performance.

I honestly never see this in any other type of professionals. There's lots of other things that other professionals don't do that we promote, like micromanagement.

Given the joy you are expressing over being able to police others performance, I get why code reviews can sometimes be so despised: when you have people taking joy in pointing out others performance, like you appear to do, the code review is just another tool of passive aggressive bullies.
Somebody should tell that to the Rust people. They have a .cargo and a .rustup folder in ~, plus an extra heavy target folder for every project. Would be much nicer if they put the cache one .cache

But they don't seem to care
https://github.com/rust-lang/cargo/issues/1734
https://github.com/rust-lang/rfcs/pull/1615
https://github.com/rust-lang/cargo/pull/9178
Without knowing any context, I would recommend getting a textbook. I have The Musician's Guide to Theory and Analysis (by Clendinning, Marvin). The book is well-structured, reasonably clear, and comprehensive. The main risks when you go self-taught are that you have gaps in your knowledge or that you learn things in an order which makes it harder to learn. Textbooks are great—they give you an order to learn things in, where each piece builds on previous pieces.

That said, it’s hard to give more specific advice without understanding your goals more. Are you trying to understand songs? Are you trying to write songs? Are you interested in specific genres?

I will give a few other tips:

- Don’t think too hard about the rules.

- Don’t get too distracted by modes and scales. Major and minor will carry you far.

- Many books cover counterpoint. You can skip it. Think of counterpoint as a learning exercise that gives you a set of techniques for dealing with multiple voices when composing music. The rules are there to teach you those techniques.
Microsoft Edge social media team trolling Google Bard AI
Is there a way a comma would have helped in the clause of the constitution?
> double check it is the expected value

Not all of us are familiar enough with the SSH protocol to understand how to "double check the expected value"? Where can I determine what the expected value should be?
“You’d shoot a man in the back?”

“Well, it’s the safest way, isn’t it?”
The problem with rotating this particular private key is that it's incredibly disruptive. Everyone who uses GH will see a big scary message from ssh saying the host key changed and something malicious might be going on. A majority of those people probably won't have seen a blog post announcing the change beforehand.

Anyone who's baked the host key in the known_hosts file that gets shipped on their CI systems would start to see jobs failing, and have to manually fix it up with the new host key.

These things are just annoying enough that I think it's perfectly understandable that GH doesn't want to regularly rotate this private key.
https://duckduckgo.com/?t=ffab&q=chinas+100+year+plan&ia=new...

You're mis-informed.