skysight-inc/HackerNews huggingface dataset:
> That each of the versions dannymi listed had at least one potentially exploitable

Can you please point me to each one of those?

I can only see a few of them.

> memory safe language would have mitigated

potentially, assuming there are no bugs anywhere in the toolchain.

> but either your dismissal of dannymi's point

I wasn't dismissing no one's point.

I simply scrolled through the list of issues and found out that the majority of them were things like (picked them randomly)

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges.

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges

I am genuinely asking if memory safe languages could prevent this kind of issues, which represent the overwhelming majority of the issues reported on that specific page, and how.
If that is the case, then you shouldn't be using Apple, Google, Intel, Nvidia, Stripe, Shopify, Meta, Git, etc etc.

Companies raise money now to generate cash flows in the future from a wildly risky innovation. Assuming the thesis is correct, the company will then to pay it back to investors (VCs and their investors including Endowment Funds), but also employee and taxes.

As companies grow, they pay more taxes, and this will let government spend in things like education, infrastructure, social security.

It's either this or socialism.

"Capitalism: The worst economic system, except for all the others"
The linked article has a section about IDE that this one does not touch. I was surprised they are locking them selves in to one tool with their workflow.

I'm a bit worried about the dominance of VS Code. I can't stand the editor and it's popularity just grows and grows.
Yeah no I have to agree with you on this one. Every company is going to raise prices at one point or another - it might be inflation, it might be profit-chasing, padding for an IPO - whatever.

Just because a startup might raise prices in the future shouldn't stop you from using their products - with a caveat, that is, how easy it is to shift to another operator. I haven't used fly.io personally, so I don't know about that - could you elaborate on shifting to another provider just in case?
On the flip side, languages like C,C++ and Rust have the major benefit of having next to no runtime component to it, allowing trace-driven fuzz testing to achieve a much higher level of confidence in its test coverage. For a tool like sudo, this can matter a lot.
Sorry for the off-topic question: what is the editor used to create these type of sketches? I see it everywhere recently and I've even used it myself but can't remember the name.

https://blocksuite.affine.pro/assets/block-based-editing.57b...
You would recommend working at a AAA game dev company? I've heard the work-life balance is terrible... Not sure you would even have time for a side project.
A database that just got developed could be called a TardyBMS…

I’m sorry I’ve drank too much coffee this morning.
Space suits are actually made from teflon coated glass fibers[0]. It's one reason why space suits are distinctively white and used because it's fire resistant.

[0] https://en.wikipedia.org/wiki/Beta_cloth
Gnome includes many of the OSX menus in its right hand panel. Also, it’s not really Gnome’s fault that linux doesn’t have as great metadata from apps to be able to display the apps’ menubars (unity could do it).

> No, it is hidden by default, that is the point here. I do not want my UI to hide stuff from me. It is there to tell me stuff. If it doesn't tell me it is not doing its job. Tell me, or don't do it

With all due respect, that is bullshit reasoning. Selectively displaying useful things is the whole point of UIs. Otherwise why would you roll up your window? Why do you have menus in the first place that hide their content until clicked?

> > (Fitt’s law: the corner is basically infinite sized)
> Which is why macOS puts the menus there. GNOME wastes this vital functionality

That is no longer the corner, so it doesn’t benefit from this law at all.

The super key is the same as the windows, or the mac command key. Also often called Meta. You can achieve the same through the UI. Keyboard is often said to be for power users because they are not self-documenting. What’s the problem here exactly? Is alt+f4 written over the screen? Or ctrl+c? Especially that the same behavior is expected from the windows start menu.

> Is this a community project or an autocracy?

It’s a community for its users. You clearly don’t use it nor contribute to it either by work or financially, so it is not really fair to ask someone else to work for you specifically..

> GNOME sucks at multiscreen

Literally every OS and distro suck at it.

Nonetheless, I feel you are reasoning from a very biased point, so I don’t think it is as fruitful a discussion.
Really? Where do I sign up for this crown land?
Marvel was aimed at teenagers and twentysomethings of the '60s, actually, facing fairly complex moral challenges. Their practical motto was "superheroes with superproblems". And most of the cinematic material actually leverages storyarcs published in the '80s, when the industry chased grown-ups (at that time Batman gets called a "fascist" and actually kills the Joker, SpiderMan is involved in dark assassinations and then gets married, Ant-Man abuses his wife, etc etc).
Man made (hint hint) climate change was first described more than 50 years ago and while the window of cheap opportunity arguably has closed by now, it could easily have been addressed without too much cost up until about the year 2000 or so and somewhat cheaply until about 2010. Most countries are now making concerted efforts to address it but now it costs a huge amount of money and we will experience some severe consequences nonetheless. Still better than doing nothing, which could render huge swathes of the globe uninhabitable for humans.

I'm not really worried about "the earth." The planet and nature will continue to exist and even if we fuck up the ecosystem we are dependent on and billions will die as a consequence, "nature" will simply continue to exist. Pretty insects and rainforests don't have an intrinsic value to me but I care about them deeply as the basis for human existence and prosperity.
Well, I did. But not everyone can. And long term it would be nice, if the cities would have breathable air again.

Also where there is good air, there ain't so many people.
really? you think that when extraditing an alleged criminal, we should ask the alleged criminal if they want to be extradited? That can't be right...
Jobs in US energy grew 3.8% in 2022, led by work in clean energy
I don't understand why someone comes to a startup incubator and VC forum when they hate venture funded startups. You know what YC does, right?

There are so many forums you could go to, but you specifically select this one when you fundamentally dislike the premise? Why? It's just baffling behavior.
Spying is not “secret services”. Just like a “police force” is a fairly modern matter even though armed guards, etc. have been around for a long time.

You also said feudal governments were responsible for caring for the poor. No one is putting words in your mouth - just correcting your fictional “history”.
There are plenty of series and movies that use more-contemporary cultural values to mask bad-storytelling. I really don't see how Pixar is at fault for this, however. How is this relevant to the failures of The Good Dinosaur and Elemental, for example?
That's fair, just be aware that it's not just a salary drop, it's likely higher income taxes (depending where you're from) and expenses too. Canada has some of the highest telecom prices in the world for instance.

There's still a lot to like about Canada. I grew up here and didn't leave, so I'm not saying don't come here.

Just making sure you don't get here and are shocked that not only do you make way less, what you do make doesn't buy as much either.
Awkward timing, considering GM's commitment to switching to NACS in under 2 years in full -- will they have proper V2H available on NACS-and-Ultium equipped GMs out of the box?
This is one argument for universal basic income: that it will lead to an explosive output in the arts. (I don't know enough about the debate than to comment on it further than that.)
This is the cold truth. The entire process of raising money in the modern software world has nothing to do with creating a better product and business specifically. It's simply the de facto step-by-step playbook process one follows if one is an entrepreneur with the eventual become very rich. There is nothing novel, innovative, or remotely surprising about this process. It is well defined, well established, and simply how business is done. Every single person looking to build a company for the purposes of becoming rich should adhere religiously to this playbook. It's a cold, hard, transactional fact of life. Whether or not the product is good and fair and honest is largely an independent variable to this basic playbook process.
https://excalidraw.com/
I was 7 years at Rhythm & Hues, leaving the industry during the production of Life of PI. It gets this bad for several reasons, including: each VFX studio has between 3-5 feature films moving through it, at different stages of production, at a time, and often a few commercials as well; that equals between 1200 and 2800 digital artists and their support staff all working on the same corporate campus; by necessity, these technical artists have a range of experience, so there is also an education department, a constant flow of new software, and software freezes for a given production that may last 18+ months; so by necessity the staff is managed en mass with cafeteria food, around the clock render completions and hence 3-5 "dailies" per 24 hour period. One production's compute going over expectations, or production changes, or staff changes easily ripple in impact through the entire studio - all productions.
A number of those entries reference multiple overflows.

And a memory safe language will protect against some overflows on the stack (overflows within frames corrupting other values, rather than errant loops that blow the stack by creating too many frames and/or too large frames).
Nu is using a data frame abstraction to drive this and it’s really quite powerful and fast.

I was rather skeptical on the value of having this stuff as a shell built in, but it won me over. Very convenient!
Stateless compute is relatively simple to be region-less, but even fly’s homepage has a map of regions.

When state is introduced, then CAP/PACELC distributed systems issues arise, and figuring out approaches to deal with them are a must. Read fly’s Postgres docs, and regions come right back in.
Don't be afraid to use formal methods. Queues, retries, event sourcing, payment state handling -- there are "global" properties we desire from these systems: certain things we want to make sure are always true and others that we want to make sure eventually happen. For the single process case, which nearly every developer thinks about, it can seem like a solved problem but we live in a concurrent world with network failures and vendors with errors in their own systems: it's nearly impossible for you to think really hard in your head and be sure that your queue retry strategy will maintain those properties that are important to your business. It's nearly impossible to do this with lightweight, informal testing strategies employed by busy software teams.

By modelling your systems you will learn what the important failure modes are and you will get better at designing systems that are resilient and efficient.

Card payment systems are fairly unreliable peer-to-peer messaging systems. Be prepared for a lot of complexity. Using an event-sourcing architecture is really useful here for that "auditing" requirement and for debugging transaction state when the network sends you messages in error, out of order, or they forget to retry themselves when they promised to, when merchants send bad data, when POS systems do weird things, etc.
Let me ask you something: would you value a set of ~5 games that are an imagining of VCS-era console games as envisioned to exist in an alternate timeline where the Soviet Union was the predominant exporter of culture rather than the US?

Because that's the kind of thing I come up with and would be making if I had a life situation where I didn't have to sell entirely too much of my time for food, shelter, and health care.

So I guess what I'm asking (genuinely) is, is that the kind of art you really want to see a lot more of[0], and filter through, and one way or another pay for? Or is it perhaps better the production of such things is the domain of people who do not require such support?

[0] I do, but I'm clearly biased. Count me among the people who want shorter games with worse graphics made by people who are paid more to work less.
Thank you for your perspective. I was also considering consulting. Re Europe, incidentally I am going there in August for a family wedding, and I plan to stretch the trip out for at least a month.
Proton Pass: The Comprehensive Guide to Your Online Privacy and Security
you draw some blobs in a 2 or 3 dimensional space and label them and tell the AI to animate a scene with e.g. a pirate talking to his parrot. It sticks the things in the indicated spaces.
What version control system do you consider to have solved it?
I've gotten the most enjoyment out of side projects when I know that I'm making them for close friends first, and any extra popularity is just a bonus.
Indeed, my children love Toy Story 3.
Regenerative agriculture is a great carbon sink. It's more hands on and management intensive, something hard to scale, though, so big Ag isn't interested.
Isn't he a heavy anti-vaxxer? Or am I confusing him with someone else?
Good example of using flame graphs to speed up Java code (50x improvement)
Who sells reliable and accurate sensors for PM1 and smaller? Do they even exist?
Unfortunately, the motto is "I byde my time". Seems like he could have still made a joke without making it up.
Of all mammalian biomass on Earth, 34% is human and 61% is livestock. Only 5% of mammalian biomass is wild animals.

Admittedly we are vastly outweighed by sea life, plants and bacteria - but our sheer mass dominates Mammalia.
I’m surprised that people find this surprising. It’s not like you can have something new every day, at some point your menu is going to repeat so why not pick some favourites and stick to them?
The XML specification does contain a schema: the DTD. This is why it is 37 pages; without the DTD part it would be at most a half of that.

Other schemas are not merely popular, they are more powerful. In DTD the type of the element depends only on its own name. In XSD the type depends potentially on the context: the type of 'xxx' in 'aaa/xxx' and 'bbb/xxx' may be different. And in Relax NG we can define different types, for example, for the first 'xxx' and for the subsequent 'xxx's. These extensions make the validation somewhat more elaborate, but still linear, as it we remain within the complexity of a regular expression. These are formal validators; then there is Schematron which seems to be more like a business-rule kind of a validator that also has its uses.
The term has been around for a while.

I think there's a subtle distinction between "collaborative editing" and "multi-player". With the latter normally implying that there are real-time visual cues as to where the other users are, what they are doing, distinguishing styles, etc. More like what you get from a game. Within front-end it seems to be well understood.
I've thought a lot about this too. Their blog posts are consistently interesting and well written. I wonder how much of their success is related to the product marketing as well?
Yeah this is pretty funny - if you speak to PR before posting something, it's 'PR-riddled bull** written by some executive', or 'corporate talk'. If you don't speak to PR before posting something, it's 'Did you speak to PR before posting this?' There's no winning.
Many governments are really trying, in the "freest" part of the world.
Ask HN: How to create a service based on crowd sourced data from scratch?
I am trying to create an alternative to a very annoying website that I used to love in past, but now is filled with anti-patterns. It provides crowd sourced data to the public and to see that data you have to signup and contribute to their database first. Even after signing up, it keeps asking for premium membership after a few clicks of mouse.

I want to create a more open, more accessible and least annoying alternative for that website.

My concern is how do I get over the chicken and an egg situation.
The website I mentioned above gets traffic because it has some data, and users are also contributors to the data source.

If I create similar service, I won't have any data (I don't know if web scrapping is legal to populate initial data), I won't have any users to contribute to the data source.

If all goes according to planned, I am also willing to provide paid tier with better services.

Please help me with your suggestions.
I'd dispute that MOST of the revenue is from Postgres, though it is likely a very large double digit percentage of revenue.

Their managed Postgres got an unfair advantage early on by being the default. With a new rails app you were just given a Heroku Postgres database. Heroku's Postgres offering was over 5 years ahead of RDS Postgres and a large part of the reason Amazon added support for Postgres for years they fought it, but eventually had to give into the constant customer request. Unfortunately that innovation of Postgres has stalled out a bit over time due to Salesforce starvation.

I do admit for what people think of as PaaS the Postgres revenue is significant, the part people would probably be surprised about is how much revenue the add-ons marketplace constitutes.

Interestingly New Relic got the same privileged experience in the early days and it resulted in the same type of revenue and mass adoption for New Relic.
CSAM has nothing to do with encryption and it predates the internet.

https://youtu.be/aAeUeG-PTD0
Hmm it works surprisingly well, but it would be practical to have some kind of background area selector to help guide it and a threshold to adjust the removal, since the default setup sometimes messes up ever so slightly in some areas.
Genuine question - what does being a hacker have to do with being an author?
phabricator & scuba are far better than anything i've used anywhere else.
Honest question: why are you on a site whose community is literally created and run by a startup accelerator?

It's a given you realize how antagonistic you're being here, so I guess my only other question is why seek attention like this?
Maybe because the prevailing wind delivers constant fresh air to the western part of the cities. The industrial sites in the east part of the city are hence not smelled by the wealthy homes in the west.
How Easy Is It to Fool A.I.-Detection Tools?
It couldn’t happen to a more deserving company.

https://twitter.com/josephazam/status/1673743222395510784
The premise may be flawed, if you want to go deeper you need subject matter experts. For instance, in the case of the submarine implosion; very few groups of will be able to contribute; mostly submersible engineers and people who had direct contact with the firm. Isn't everything else going to be noise?
You could get rid of "in Hollywood" and this sentence is still accurate.
> And hardware-accelerated inferencing.

:eyes emoji: fly ppl please do this
I think you’re saying that decades of r&d by the largest tech companies in the world can eventually produce a browser runtime that renders text about as fast as a couple people working in python and C.
Everything is fine apart from its quirks, if you know its limitations. The problem is when a tool's quirks and limitations are neither exhaustively documented nor can they be inferred from having reasonable knowledge about the base principles of the tool, but are rather learnt by experience (to be read as "through bad experiences").
Hard to say but good devrel drives grassroots adoption. Ultimately, though, VCs no longer will fund without revenue growth in addition to user growth.
Was cool to see that @davePL contributed to this effort. If you dont know he was a MS dev during silver age of MS during the Windows 95->NT-2000-XP era. Its worth following him on twitter and youtube.
If Apple is somehow dumb enough to leave an unscrubbed/unfuzzed backdoor in their shipping version of iOS, I'd almost be inclined to call it a red herring.

It stands a reasonably safe assumption that Apple has been compelled to add obfuscated adversarial code to iOS, just as you can assume BitLocker is about as secure as a Masterlock made out of Swiss Cheese.
I don't want to sound flippant, because this is hard as fuck, but the profitability path for us is reasonably simple: have good unit margins, attract customers, help them grow.

We have good unit economics. The riskiest, most terrifying thing we've done is start with our own hardware.

For dev focused infrastructure, what we need to do is attract a lot of devs, get them to take us to work, and then help their employers build better stuff over a long period of time. This takes _forever_ because companies-with-procurement-processes are designed to not buy critical infrastructure from startups.

It's working for us so far, even if it's not for you yet.
Sometimes funding is necessary to grow income enough to sustain the business or hire more engineers or whatever you want to do.

If it costs $40 to acquire a new customer, and you expect a customer to stick around for long enough to spend $90 then it's totally worth doing that, but you need $40 now to make 90$ over some period of time.
Intelligence in childhood – illegal drug use in adulthood: 1970 British Study
VS Code does not feel slow to me , how are they getting such good performance ?
That looks awesome, thanks! I already have some ESP32 devices acting as weather sensors that log to a Raspberry Pi over MQTT. I might have to add this too.
Thank you for your response and support! Your comment about video games makes me think about the areas of tech I‘m interested in but thought were inaccessible to me (e.g. video and art). So you inspire me to consider those as real possibilities to pursue.
I (and someone else too) already mentioned the Kröller-Müller elsewhere, but if you're in the Netherlands anyway, I'd recommend the Mauritshuis as well, and close to it is also the Escher museum if you're into that. I assume the Rijksmuseum is already crossed off :)