skysight-inc/HackerNews huggingface dataset:
Tons of malware infested apps get through both app stores.

https://www.pcmag.com/news/study-reveals-googles-play-store-...

https://www.zdnet.com/article/over-half-a-million-users-been...

https://www.tripwire.com/state-of-security/more-malware-infe...

https://www.darkreading.com/attacks-breaches/malicious-apps-...

https://lifehacker.com/great-now-the-apple-app-store-has-mal...

Etc..there were some studies posted about this too
Firefox does incidentally error if it sees duplicate serial numbers from the same issuer, though it wouldn't detect this case since the browser won't see precertificates in a TLS handshake.

https://support.mozilla.org/en-US/kb/Certificate-contains-th...

I don't think this is intended to be a security feature, but simply an error from the depths of NSS where some code uses (issuer, serial) as a unique index.
You've constructed a very elegant frame here that says basically nothing at all.
Coming to an android and iphone near you voice authentication. Audio streams have inaudible data produced by encrypting a mutually known but changeable token like the current time with your private key embedded in the stream for example in frequencies you can't hear. Your phone app queries the service with the time of call and the data received and if they are also a subscriber it is able to discern their identity with certainty.

If this feature is standardized and built in it could be paired with a token like a yubikey which is on users keychain and authenticated even if they were using someone else's phone.

All these details can be completely opaque to the user who just needs to see a blue check by calls made with a device verifiably logged in as name@provider and a red exclamation beside calls made with no info at all.

Think fake kidnapping scams, industrial espionage, recent attacks involved in pretending to be in HR to redirect corp transfers to attacker.

Just a little doubt is liable to blow up such scams.
However, it's already the case that if a postgres process crashes, the whole cluster gets restarted. I've occasionally seen this message:

WARNING: terminating connection because of crash of another server process
DETAIL: The postmaster has commanded this server process to roll back the current transaction and exit, because another server process exited abnormally and possibly corrupted shared memory.
HINT: In a moment you should be able to reconnect to the database and repeat your command.
LOG: all server processes terminated; reinitializing
> With your favoured ISA style you can't just put 4 or 8 checked overflow add instructions in a row and run them all in parallel because they all write to the same condition code flag.

This can be implemented using traps, without flags. And RISC-V supports delayed exceptions, which makes the implementation easier.

> In this example you can't write back the updated r0 value until you know whether the instruction traps of not.

RISC-V supports delayed exceptions, so you actually can.
This isn't just the internet. I've used this at work several times to break stalemates. I've come into many stalled projects where people are arguing over trivial details or blue skying on requirements. 1-2 hours and a 7 page design doc later I'll have everyone review what I know is an 80% answer. Pretty much every time they'll all start attacking my design, pointing out minor issues and then I have them. They've agreed to my overall design and are into details.

Same if someone is calling out all of the general problems with solving a problem but not providing answers where you can't get them to bite.
Because global variables can be confined to individual cpp files, exclusively visible in that compilation unit. It makes them far easier to reason with than hoisting them to the "global and globally visible" option if you just use a gargantuan struct. Which is why a more invasive refactor might be required.
It was rice or Elon for me lol
There’s also a different possible take on this.

Voice acting seems to be really bad career, so eliminating that job is desired, if you can deliver same quality/better product for cheaper to customers, without requiring employees to be underpaid.

I know it sucks for people in that industry, but technical progress always eliminates jobs. Calculator used to be a job, now it’s a device.
There's something ironic to me about the fact that building AI experiences still requires the first computing paradigm: batch processing. At least, my experience building a retrieval-augmented generation system requires a lot of batch processing.

Well, I shouldn't say "requires". I'm sure you can build them without batch processing. But batch processing definitely felt like the most natural and straightforward way to do it in my experience.
I'd have multi-touch be a sidebar in the textbook, but not a new section. Gestural interaction is not fundamentally different than a pointer device: it doesn't allow meaningful new behavior. It is sometimes a more intuitive way to afford the same behavior, though. I would agree that portable devices amount to a new paradigm in something—maybe UX—but not UI per se.
Devil’s advocate here. Nobody else should have the option to prefer Apple devices as they are today because… you’d prefer them differently?

If Apple stays the same as it is today, there is nobody making you buy an Apple device.

Don’t get me wrong, I’d like to be able to sideload apps, and I think more competition in the App Store space would be beneficial for consumers. But a lot of the “freedom” type advocates act as if someone held a gun to their head and forced them to use an Apple device for the remainder of their life, and now they can’t sideload apps. If that’s an important feature to someone, there’s a platform that allows that.
Don't a ton of people get paid to work on the GPL'd Linux kernel?
I cannot force apps to open in a browser vs their in-app browser (which is Safari). This in-app browser has a separate cookie jar and history. It also allows draconius tracking, as demonstrated by TikTok [1].

I cannot set the default maps handler, every address opens up in Maps, unless the app has built-in provisions for Waze / Google Maps.

I can not set another application as the iCal handler. My work forces me to use Outlook, yet when I tap an iCal link it opens up in Calendar.

I can't uninstall Photos. I am forced to use THEIR application which only supports iCloud as their backup system which is incompatible with my 'don't store shit in the cloud'. I cannot integrate it with Synology Photos or with whatever I choose.

I cannot change the Control center's links / buttons. The Home buttons point to their walled-garden HomeKit. The notes button only works with their notes. I cannot make it open OneNote.

As a developer I need to request Apple to enable certain entitlements to use in my application for them to consider me 'worthy'.

[1] https://www.nytimes.com/2022/08/19/technology/tiktok-browser...
All I want is a podcast player that automatically cleans up the crappy audio.
Yeah, and you will run headlong into other unforseen real world issues. You may never reach the performance goals.
What’s up with the capitalisations? It reminds me of reading conspiracy geocities.
Exactly like my iPhone, my PlayStation plays games, has a web browser, runs Netflix, gets updates, can message or call my friends, has only one real kind of competing product (PS and Xbox, iOS and Android), and is even significantly more powerful than the iPhone. So far I haven't heard a single objective reason why selling a console as an appliance is okay but selling a phone as an appliance should not be.
Follow the thread back to the preceding comments.

The topic ain't what's in the article, it's what the user says they experienced...

Right?
> but because he directly insults and threatens other individuals when he doesn't get his way.

Why do you spread this nonsensical rumors?

The link you posted doesn't even reference whatever behavior your vilely imply - instead is all about "technical and administrative disagreements".

If the FSF has a bad reputation, it's because of people like you spreading FUD about Richard Stallman's behavior and person.

Why don't you stop with this crap and just take RMS as the kind and flawed human being he is?
As one who has driven product development, I would say my personal investment has been to adopt a mindset of “taking ownership.”

This can mean many things, though generally for me it has meant thinking things through past requirements. Is what has been requested feature complete? Has configuration, admin, access, and intuitive user experience all been accounted for?

In development, like in building a house, fixtures and finishing touches often take as much time as core design. Having foresight reduces back and fourth, and guides the process before stakeholders are aware of what they will need next.
If you just bought a massive oak board (the were nowhere cheaper and better that at IKEA around 2005) with two solid trestles, you should easily be able to move them 13 more times.
> Extreme terseness, even when done very elegantly, makes programs very hard to read and sometimes also hard to maintain.

The advantage to something like call/cc is not that you can make code extremely terse but rather that there is one code path for analyzing control flow and each variant of control flow isn't a special case. It's also not more terse at all, but rather more explicit.

You don't need to force users to use it, but it is useful to define more useful mechanisms like if/else if, match/switch, throw/catch/finally, coroutines, etc in terms of an abstraction that doesn't break type checking or codegeneration.

All that said "call/cc considered harmful" is an old take
New Zealand isn’t much better - last time I tried to book a doctor, they said they had n appointment free at the end of the month.

Meanwhile, if you actually need to go to the doctor for anything urgent, it is often best to go direct to A&E.
Cunningham is cunning!!!
You could've just said that directly instead of being snarky.
The compressibility of water is fairly negligible - the density increase is only 1% for every 2 kilometers of depth. And obviously the cable also compresses at depth - probably by a similar percentage,
Almost all office drama can be blamed on posting written notes for co-workers
"intent-based outcome specification"... so, a declarative language such as SQL?
I also have this all the time. I think it stores the metadata in iCloud (if you configure it) so it does not rescan your media, but it does need to redownload the iCloud data. No other app suffers from this, so I think it’s a bug.
> This is only an option for people who want additional functionality.

The common concern is that critical software that users depend on will only be released in a way that circumvents the safety mechanisms that Apple employs to prevent the execution of malicious code. Is that fear unfounded?

Even setting aside the malicious code concern, many users don’t want to have to track several different app stores to find functional software. What prevents this from becoming the case?
In your view, then, is AI best described as an incremental improvement over (say) SQL in terms of the tasks it enables users to complete?
The site you linked does not work and the GitHub repository is disabled.
Except rip offs happen regularly still with little intervention, and giant corps use trademarks frivolously even when they know it's wrong, because they have deeper pockets and can litigate small companies out of business regardless of the merit of claims.

How anyone can own the likeness of a fruit that has existed for millions of years is beyond my understanding.

"Google" -- an invented word that did not exist prior to its conception forma company -- makes sense to protect. "Apple" does not. When you make a company name after a FRUIT, you should take on the risk associated with a public domain likeness and an inability to own it. Anything else is absurd.
No, but actual liability does.
It might be protected if you are doing it yourself, for personal (non-commercial) use. Just like you can build any patent you want for fun, but the second you try to sell it, you need permission.
This reminds me of this poster: "You must be this tall..."

https://bholley.net/blog/2015/must-be-this-tall-to-write-mul...

Back about a decade ago I was "auditing" someone else's threaded code. And couldn't figure it out. But he was the company's "golden child" so by default it must be working code because he wrote it.

And then it started causing deadlocks in prod.

"What do you want me to do about it? It's the golden child's code. He's not even gonna show up til 2pm today."
Yeah there must be a reason why „nobody“ is using Cutter, interested in that as well.
I am not really sure why would you tell me about the Prague Metro, which I have taken for approximately 26 years by now. I can tell you every single station on every line by heart.
This should have "investment" in the title, or something to that effect.
No that is what a static in a .c file is for.

A plain global can be accessed from other compiled units - agreed with no .h entry it is my=uch more error prone e.g. you don't know the type but the variables name is exposed to other objects
you define Transition over T comparable, but there is no guarantee that comparable implements json.Marshaler, so FSM's MarshalJSON and UnmarshalJSON don't really work
What harm is there to you if sideloading is enabled?
> Last week I went through and deleted every single post and comment associated with my account. And, while the data disappeared for a few days, everything has since been reinstated.

I used power delete tools to edit and delete all data. Then I deleted my account. It still shows as deleted, so I cannot confirm this. Anyone else?

If Reddit is re-instating content that was deleted they are crossing a hard moral line for me. That is not only deceptive way beyond plausible deniability and the usual dark patterns. It’s the ultimate “you are an adversary and we don’t care about you, like at all”. I can’t even imagine the consequences for people who are doxxed, stalked or worse.
Show HN: Timerdoro productivity timer (new version)
I launched Timerdoro.com in 2009 as a side project, and I've rebuilt it a few times over the years. I just released a new version that fixes some bugs. If you need a productivity timer, take a look!
As 35 and a parent of two young children, I strongly agree. It's a message I'd send back to my 23 year old self, even though I also know that at 23, I wouldn't believe it: if you feel you'd like to have kids, have them now. Those extra years didn't change me that much, but having kids at 23 would mean regaining most of the autonomy by the time I'm 40, instead of 50. In terms of energy and prospects of doing anything interesting with it, the difference between 40 and 50 seems much bigger than that between 23 and 33.

Alas, parenthood experience is both rewarding and challenging in ways that are near-impossible to properly communicate to non-parents. Perhaps that's for the better, as otherwise humanity would've gone extinct long ago.
> use more specific language like, "copy-left."

But copyleft already means something different from open source. It's more like what people unfamiliar with open source software think that open source software is.
I've been the internal poc for a soc2 before. The external auditors were all lawyers. As such what mattered was strict compliance with the wording of the standards. With them what we didn't say was nearly as important as what we di
Why? What about it is suspect?
Nice work!

Is there some JavaScript/Typescript alternatives to Langchain?
Exactly. This claims are unfounded rumors spread by people that don't like RMS and want to see him gone. Not because there's actually any objectionable behavior from his side.

Yes, I get it - he's weird. So what?!
It looks to be a fairly long ways from major cities, is that why?
Isn't Matthew Garrett always defending Treacherous Computing technology?
I have put all my media on a WebDAV reachable machine and pointed Infuse towards it. For me it’s the most convenient option as I have to manage nothing, don’t need to run a server etc. and Incan stream directly on my Apple TV.
When i see a project uses Nix, i think, oh fuck me, they don't care about anybody using their stuff.
It's a perfectly sensible practice. It is, perhaps, an unfortunate name, since as a term of art it makes sense but the plain English implies an awful lot of value judgments for what is really just a "a recognized and intentional mismatch resulting in a fudge factor".
Yeah I would agree with this, the article struggles really classifying the different paradigms, and due to this the conclusion winds up not holding true. We're still relying on "batch processing".
I wonder if ELO makes sense for something like this that is so inherently unstable/not-normally distributed? I.e., in chess, if you're playing an opponent whose rating is +800, you have less than 1% chance of beating them. But in this case, we have Peppa Pig currently at 1875, vs. the BMW 3 series at 1072. Can we really say with any confidence that Peppa would beat the BMW 99 times out of 100? It seems unlikely that increasing the number of matches will change the instability of this rating.
I think this might be one of very few circumstances that can be said to be both at once, sadly.
What is "the previous thread of discussion?"

My response was all of 5 lines, saying that if dthul's comment were true, then it implies that Rust has a rather small code base.

And indeed, Crater does not test all publicly available Rust code. ("Not all code is on crates.io! There is a lot of code in repos on GitHub and elsewhere", and only for "Linux builds on x86_64", not Windows, says https://rustc-dev-guide.rust-lang.org/tests/crater.html).

Rust is much bigger than dthul's comment implies.

You may well be correct when adding the qualifier "meaningful", but that's a different thread of discussion.

> Why do you think a 12 year old needs to publish their "hello world" programs because of Crater?

I mentioned that because you changed the thread of discussion to discuss centralized vs. decentralized code distribution.

> because a very very wide swath of code was tested.

And C++ language developers also analyze a 'wide swath of code' - millions of lines or more - for changes.
> I don't see any "debunking" there

You somehow missed the many instances of claims by Huffman contradicted by evidence given in the article?

Huffman:

> [Developers] are mad because they used to get something for free, and now it’s going to be not free.

Article:

> I expressed this willingness to pay many times throughout phone calls and emails, for instance here's one on literally the very first phone call:

>> "I'm honestly looking forward to the pricing and the stuff you're rolling out provided it's enough to keep me with a job. You guys seem nothing but reasonable, so I'm looking to finding out more."

Huffman:

> Reddit is Fun, he never wanted to talk to us

Article:

> The Reddit is Fun developer shared emails with The Verge showing how he outlined many suggestions to Reddit, none of which were listened to

Huffman:

> Apollo threatened us, said they’ll “make it easy” if Reddit gave them $10 million. This guy behind the scenes is coercing us. He's threatening us.

Article:

> I recorded the phone call and can show this to be false, to the extent that Reddit even apologized four times for misinterpreting it:

>> Reddit [during the same call] : "That's a complete misinterpretation on my end. I apologize. I apologize immediately."

AFAICS this is exactly what "debunking" looks like.
I'm not sure. Well, I mean, there are weird folks out there who may start doing large-scale things without understanding what they're building upon (Kubernetes is not exactly an OS, but is a notorious example), but they could make the same mess with any technology. They're just unlikely to pick Nix, NixOS or NixOps (or any alternative to it), because mainstream tutorials won't cover it [yet].

The deployment and learning process is not that different from, say, Arch Linux, or even Debian. You still learn the higher-level interactions (pacman/apt/nixos-rebuild), divert to individual programs, then dive in (.ebuild/dpkg-buildpackage/nix), then learn even finer details as you get hit with nuances. NixOS is absolutely not LFS, where you really go bottom-up. And nixpkgs is covering more and more every day.

Just an anecdote example: I've started with run-of-the-mill tutorial approach on setting up NixOS on single machine, and ran than for a while. Then I've realized my configs are a non-DRY mess and I want to manage my systems in organized fashion, so I've spent a significant amount of time unifying the configurations so I could manage and deploy it with deploy-rs (thinking of switching to colmena now, but that's not relevant). And only at that point I've realized that I'm missing some fundamental bits like signing (aka why nix-copy may fail, and how to deal with this without the trusted-users "see-no-evil" hack), or exact operation of substituters (aka, essentially, binary caches). Because with local nixos-rebuild it's all sort of hidden and I never had any issues.

What makes Nix/NixOS different are its fundamental principles, not how one approaches it. Starting somewhat more low-level than with "just works" tools is just a popularity issue: more rough edges, so one needs to learn how to polish them.
> TLB misses? They are just a detail of particular CPU implementation, and the architectures change.

TLBs are "just a detail" of roughly 100% of server, desktop, and mobile CPUs.

> Also, aren't they per core and not per process? What would that solve then to switch to MT?

TLB entries are per address space. Threads share an address space, processes do not.
I’m thinking of doing it for a desktop game, so yes?
That seems like a claims and marketing issue, which is entirely separate from merely producing a drug and selling it when asked. I think it's fine that the FDA regulates advertising, I don't think it's fine that they act as gatekeepers to pharmaceutical products.
It sounds like the package is implemented improperly. If the input from your repo to the package is not targetting a specific commit, it should be.

Building from "latest" is really not how nix is ever meant to operate. In that case, when you update your requirements.txt, it is now out of sync with the package definition; the inputs _have_ changed and your guarantees are gone.

When your project repo is updated, that should never result in a change to what gets installed by nixpkgs until you also update the package to point at that commit and do any work necessary to fix breaking changes. Once you do that work, that version of your package picks up a guarantee to always be producable.

Like another comment mentioned, this is all much easier to accomplish with flakes as they have a lockfile that sits next to the flake, both of which reside in your repo and can be updated atomically with your releases instead of also needing to make a PR for nixpkgs.

I've actually been working on learning how to better package python with nix and found the historical information on python packaging infrastructure in this talk incredibly enlightening (I think this landed on HN a few days back): https://www.youtube.com/watch?v=ADSM4vR2EQ0
Look at the graveyards of social networks. I remember Peach, for example. And there are many more that just had to shut down because they didnt reach critical mass. Why would people use this service? Same question always…
Of course yours could just be the one that takes off ultimately, but chances are its a wasted effort. Maybe use your energy to build something else…?

https://en.wikipedia.org/wiki/Peach_(social_network)
We will add a lint to Boulder for precertificate and certificate correspondence to ensure this class of problem never happens again.

It would be nice to add this to Zlint, but we'd need a new interface that could be given both a precertificate and certificate to co-lint. Other than this one correspondence check, I'm not sure if there's any other lints that would fit that pattern.