skysight-inc/HackerNews huggingface dataset:
We've banned this account for posting abusive and flamebait comments. Please don't create accounts to break HN's rules with.

If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. They're here: https://news.ycombinator.com/newsguidelines.html.
And not just that, but rewarding outsized effect sizes so that you reward folks who create the biggest lies with fraudulent stats.
it's only gotten a lot of adoption by hobbyists
> C is one of the languages being discussed on the context

Well, it's not, but okay.
Wow! You can't make this up.

It's like one side of the "legacy elite" came around and smacked down a whole different side of the "legacy elite."
Science didn't self-correct here.
The checks and balance in the scientific systems failed so badly, a student journalist uncovered the fraud.
The problem is that Science has become in your words "Daddy" Business.
Bingo.

Comic Sans has its time and place. A note on your soda machine that you're out of CO2 is not the place. A professional e-mail isn't it, either.

The only place Comic Sans belongs is in material aimed at or about children. It's fine for an invite to a child's birthday party. It's fine for the cover of a children's book.
My daughter went into an entirely different career path than me but she's still the one to fix her employer's Wifi when it goes down.
It was time to reform the system several decades ago. But Americans are terrible at understanding "not every dollar spent on research will have a big outcome", or even understanding how research works in general.
hahaha if you can figure out how to farm Kangaroos, let us Aussies know please!
They all ought to band together and block EU countries from downloading their software until the regulation is changed. Let's see what happens.
Run Llama 2 locally using xet mount, from 0 to generating text in < 10M
We were excited to see Meta release Llama 2 yesterday, but found it a little annoying to download the 6 models (331GB, took us ~4 hours from an EC2 instance with 10GB network) to start playing with them. So we brought them into XetHub and now have them available for use here: https://xethub.com/XetHub/Llama2.

By using xet mount you can get started in seconds, and within a few minutes have the model generating text, without needing to download everything or make an inference API call.

# From a g4dn.8xlarge instance in us-west-2:

Mount complete in 8.629213s

# install model requirements, and then ...

(venv-test) ubuntu@ip-10-0-30-1:~/Llama2/code$ torchrun --nproc_per_node 1 example_chat_completion.py \
--ckpt_dir ../models/llama-2-7b-chat/ \
--tokenizer_path ../models/tokenizer.model \
--max_seq_len 512 --max_batch_size 4
> initializing model parallel with size 1
> initializing ddp with size 1
> initializing pipeline with size 1

Loaded in 306.17 seconds

User: what is the recipe of mayonnaise?

> Assistant: Thank you for asking! Mayonnaise is a popular condiment made from a mixture of egg yolks, oil, vinegar or lemon juice, and seasonings. Here is a basic recipe for homemade mayonnaise:

...

Check out the repo README for detailed instructions, and remember to register with Meta to accept the license and acceptable use policy for these models.

Xet mount performance is pretty decent now, but it’s still WIP and we are making significant optimizations. Our storage architecture is massively scalable. See this blog post for more details: https://about.xethub.com/blog/mount-part-1.

Happy Llama 2-ing! We’ll be adding the -GGML variants for those using llama.cpp next, hopefully later today.
Say you're driving down the road and get into an accident. A choice in front of you is that you either hit a squirrel or a child.

Would you feel better or worse?
Even with EMV transactions, they are apparently able to get the card # which is transmitted in clear text by the chip. And the PIN from the keyboard overlay for debit transactions. Later they can clone the card # onto a fake mag stripe card and use the fake card for card-present purchases.

They probably cannot make card-not-present (online) purchases since I don't think they can get the CVV.

https://krebsonsecurity.com/2021/02/checkout-skimmers-powere...

https://security.stackexchange.com/questions/151081/shimmers...

> In addition to the track-two data on the magnetic stripe, EMV cards generally have identical data encoded on the chip, which is read as part of the normal EMV transaction process. If an EMV reader is compromised to the extent that the conversation between the card and the terminal is intercepted, then the attacker may be able to recover both the track-two data and the PIN, allowing construction of a magnetic stripe card, which, while not usable in a Chip and PIN terminal, can be used, for example, in terminal devices that permit fallback to magstripe processing for foreign customers without chip cards, and defective cards.

https://en.wikipedia.org/wiki/EMV#Opportunities_to_harvest_P...
Irregular verbs (go/went, and so on) congugate (change according to tense and subject) using rules just like regular verbs, except that they have different rules. The irregular verbs use Germanic conjugations (cf. man/men, child/children) whereas the regular verbs use grammatical constructions from other source languages.
You often share with people who want to play with the inputs or the code, while at the same time you want them to share what your choice of inputs outputted.
> I believe the whole concept of “meritocracy” for purpose of admissions is a lie— choosing the criteria to measure against is itself a subjective act.

Let me ask you. Do you also believe that requiring a display of proficiency in mathematics to get into the best schools is inherently discriminatory? What about requiring a demonstration of the capability to understand and complete basic subject matter material in the fields or reading, writing, or scientific literacy?
It’s probably more a way of enticing steam deck users to play their content.
This isn't Reddit. If you have something to say, say it, but drive-by content-free comments like this aren't appropriate here.
I would expect that the corporations will be asked to sign an indemnity agreement before they get the design. Target doesn't want to be held liable in case a skimmer is built that defeats this detection and the recipient needs to understand there are no guarantees.

It's nice that someone got this through the default corporate deny policies.
Llama 2: Full Breakdown [video]
As a aside, the phrase "a few bad apples" is actually originally "a few bad apples spoil the barrel" referencing the fact that a bad/overripe apple causes nearby apples to quickly ripen and go bad which is now known to be due to ripe apples producing ethylene gas which accelerates the ripening of other nearby apples. The phrase originally meant that one bad thing corrupts and destroys all associated. The discovery of a bad apple actually means everything is already irrevocably destroyed and thus reason for not tolerating even a single bad apple.

A modern metaphor with a somewhat similar meaning to the original is: "A fish rots from the head down." Pointing out that organizational failures are usually the result of bad leadership. A rotten leadership will quickly result in a rotten organization. Therefore, it is important to make sure the leadership is not rotten in a organization. It also points out that low-level failures indicate there are deeper high-level failures. If the line-level is screwed up, the leadership is almost certainly just as screwed up. The fix being replacing the rotten leadership with a new one as lower-level fixes will not fix the rotten head.

Another, more direct equivalent metaphor is a Chinese saying translated as: "One piece of rat poop spoils the pot of soup." That is hopefully self-explanatory. We should probably use it instead of "a few bad apples" as nobody will reverse the meaning of that one.
Nope, I used an actual exploit, a type confusion bug somewhere within the RMI that allowed to escape the applet's ClassLoader. It then allowed it to access COM objects and basically do everything it needed.

The result was a "zero-touch" installation, with seamless login experience. It was a really crazy time.
I think you're underrating what Arduino was in its time. They weren't selling an undifferentiated dev kit. The defining feature of the Arduino was that it:

* Plugged into USB (The Decimila, Duelmilnova, and the Uno)

* Had a software stack that worked on Mac, Windows, and Linux

* Had a software library that allowed people to drop in features to accomplish goals.

Arduino was a bad fit for an electrical engineer making a product, but it was an amazing fit for hobbyists and artists trying make a one-off project or presentation. This is the thing that the EE evangelists and gatekeepers could never seem to grok: No one* cares if it's taking 4 cycles or 120 cycles to blink the LED, or turn the servo. Sure it starts to matter if you're doing a dozen other things simultaneously, but most people just wanted the LED to blink.

Arduino was a miracle when it showed up. No toolchain to figure out because it was all just in the package. No bitmask decoding. No being rejected because you're not running Windows. The C Superset was surprisingly readable code for people who didn't have a programming background.

It is shameful the way that Arduino was pulled out of Wiring, without real credit and acknowledgement.

*Yes, there's the subset of people who were chasing efficiency, or who were interested in doing things "The right way™", but this was never the target audience for Arduino.
I've used that font under several names, initially Bitstream's licensed version, for almost 20 years - until earlier this year, when I switched to Iosevka.

It really is significantly more legible, especially in parens/braces/brackets and punctuation. Before, it was easy and common to mistype , for . or vice versa, and not notice until it failed to parse. Since, I've done that maybe twice.
I majored in journalism. I learned how to write clearly and concisely, and do it on short notice, too. I learned a process for writing, which is something most people don't have. I also learned how to ask good questions, and be skeptical about what organizations and people say when their job or profits depend on it.
Ouch, that’s horrible.

Time to prompt everyone at $WORK to upgrade…
Increased variability (both spatial and temporal) is a documented effect of climate change. Your comment is like that senator that though a snowball was a valid argument against climate change.
Real talk though.

How do you manage ssh chaining then? Unique set of keys per user per machine?

Short of scp'ing your private key over from your starting box, I can't really think of another way. Then again, if it's not your box, (you don't own the hardware have sole monopoly of root), you probably shouldn't be ssh'ing from it anyway. I've always held there are no true secrets on a computer... Until multi-billion dollar companies decide to collude anyway.

Anywho, honest question. I'm a big fan of ssh roaming, never realized that ssh-agent was a thing, but after reading this, if I were to use it, I'd most certainly be doing it witout pkcs11 built in. Shotgunning shared libs for side-effects is absolutely mad. Need to slot that into my source code reading list.
Launch HN: Twenty.com (YC S23) – Open-source CRM
Hello HN,

Seven years ago, I complained about Salesforce on HN. Somebody said: "one day, someone will do better". That stuck and today we're trying to be that “someone” with my co-founders Thomas (design) and Charles (eng like me). Our company is called Twenty and our repo is here: https://github.com/twentyhq/twenty

We want to fix two issues: most CRMs aren't enjoyable to use and they often clash with engineering teams.

YC encouraged us to launch early. What you see now is about two months' worth of feature development. Our tool only does a small part of what big CRM players offer, but we focused on providing a great user experience on the basics, instead of spreading ourselves thin across a vast range of features and delivering them half-heartedly. Plus, we've found that many small companies like the product as it is because they don't need all the complex stuff.

Once we have covered the basics, we’ll soon be working on three big features: - Moving to a robust metadata-driven architecture; - Providing innovating ways to extend the CRM with Typescript; - Making it easy to connect data sources, and fetch data in real-time like in BI tools.

The startup world is littered with ghosts of so-called "Salesforce killers", so we know it sounds naive to pitch ourselves in a similar way. But we think that if someone ends up changing this market, it will most likely be through a community-led effort. And there hasn’t really been any serious attempt to start a great new open source CRM in the last decade.

Twenty is built with Typescript, React, and NestJS with GraphQL, and licensed under AGPL. We plan to make money by offering a hosted version. Our docs are here: https://docs.twenty.com. Try on cloud: https://app.twenty.com.

Dev setup and demo: https://www.loom.com/share/7b20b44d8d5146fea8923183511bb818 (Loom said they couldn’t provide a transcript because they don’t support “language other than english” haha... apologies in advance!)

We’re very eager to get your feedback as we haven’t launched anywhere before this post. What's your CRM story? What should we prioritize next?
So why don't we focus on socioeconomically disadvantaged individuals instead of focusing on racial metrics?
Clancy and your text editor don't scale though. LLMs can crank out wide and varied convincing hate speech rapidly all day without taking a break.

Additionally context matters. Clancy's books are books, they don't parade themselves as factual accounts on reddit or other social networks. Your notepad text isn't terrifying because you understand the source of the text, and its true intent.
> saying that code commenting is an outdated practice and code should be self commenting

Commenting is in no way outdated; it's an essential part of "self-documenting code"; of course the comments shall not duplicate what a sufficiently skilled developer can read directly from the code, but give information about why the code is there. It also depends on the programming language in use; C can be very cryptic at times, so comments are useful; also assembler requires a lot of comments to be human comprehensible. Higher level languages need less code comments. Even Brooks himself states in "The Mythical Man Month": "I find myself being briefer in comments to an APL program, which will live on a disk, than on a PL/I one that I will store as cards.".
Though if you speak Spanish and English you'll probably be able to guess most of the words, so you may find it easier to read initially than Toki Pona.
It didn’t seem particularly mean to me.
I remember this article! And of course, nothing has improved. It's ironic that in 1992, software publishers proclaimed that piracy would be the end of the computer age in the classic "Don't Copy That Floppy!" campaign. To me, it seems like nearly the opposite thing is going to end the computer age: integrity checking. Most computers are toys that we lease from companies that are bigger and more influential than governments, and using it in ways they don't like is against the law.
This sounds way worse than it is.

To be clear, the "remote" part of the code execution is that an attacker controlling your destination server can cause your client to run an attacker-controlled payload, if the client is forwarding their credentials (`ssh -A`). Most people don't tend to make connections to arbitrary SSH hosts, and certainly they don't do it while forwarding their credentials along.

It's a neat attack, and I applaud the Qualys team on their find, but this is not any sort of emergency situation for 99.99% of systems.
It may, but it doesn't provide the motivation to bother, especially if you only ever get caught at the end of your career.
Completely understand this take! 2FA is by far not the only differentiator we can make between enterprise/free users. We're definitely trying to make sure that the maximum security is available for every (free) user.
Related: https://www.destroyallsoftware.com/talks/boundaries

Also related: https://www.manning.com/books/grokking-simplicity
BMJ: Time to assume fraud?
https://blogs.bmj.com/bmj/2021/07/05/time-to-assume-that-hea...

Study claims 1 in 4 cancer research papers contains faked data
https://arstechnica.com/science/2015/06/study-claims-1-in-4-...
Did I read this wrong? They are using the card chip slot to house the skimmer protection, so chip and pin will not work ?
Saw this in a comment below - https://firecamp.dev/
> Both SEO and search result ads on Google are dead

And then

> Google's visibility of all transactions on every e-commerce website on the internet is insane.

Ah, so they have all of the information and yet their ad products don't work. They don't know this?
Re: monitoring: I am wondering what a monitoring platform (from an ops perspective) would look like for an infrastructure like this, and what are the challenges?
Thank you :)

It's just a combination of tailwind and Next.js
Not sure if that counts as a success or a failure. More like a failure because you learn after wasting a whole month. And then everybody has to learn the same lesson.
Ah, a skillful execution of Cunningham's Law
Nice. Good stuff.
Workshop Recap: Running Linkerd in Production
Just this minute, I lost the kernel image after upgrading to Debian 12 Bookworm.

Stuck at Lilo.

"Not found".

Standard Dell Optiplex 790.

Time to breakout the Debian Rescue DVD.

(sigh)
Why do you have to insult '90s software like that? Software back then was fast and functional.
IMO, Linux is unusually complicated to configure for unattended use cases, despite being a server OS. Arduino just goes into user code shortly after powerup, a la AUTOEXEC.BAT, no systemd-jumpscared shenanigans. There's just too much of those.
Tnx! These may help me understand the giant pock marks and other oddities observed from the air in the New Mexico/Arizona region!
> Ideally, high quality education would be democratized and made accessible to anyone who want it regardless of their means to pay.

We already have that for the most part, I can find courses from half a dozen of the worlds best universities online for free right now.
Underplayed here is the role of Elisabeth Bik (@microbiomdigest on Twitter). She’s spent years doggedly finding photoshopped images in published research papers, including these ones.
It's a common ingredient in human food here in Australia.

https://www.coles.com.au/search?q=kangaroo

It's pretty gamey, I don't find it unpleasant, but I wouldn't eat it in favour of a good beef steak.
Both of my parents are journalists and I'm a big tech ML engineer... so there are alternative paths available :)
> Introverts, extroverts... ambiverts??

I consider myself an ambivert, swinging between introvert and extrovert all the time. The thing is: you are going to have to attend social events often against your will if you're introvert-leaning (weddings, funerals, christenings, bar mitzvahs, etc).

What I've learned over the years is the more you know how the world works, the less you want to be engaged in it (Big Pharma, Big Tech, Big Military, Big Anything). It's all so tiresome.

One of the things all mature adults need to learn ASAP is how to retain good friendships over time. It's a whole art-form. Anyone that can give me a 'belly laugh' and I can retain friendship over more than five years is worth keeping.
The kernel is ultimately the thing that preempts your process and allows it to be killed, restarted, etc. It's also what handles things like "the connection was dropped", or "the thing timed out", etc. Userland facilitates management of those actions in a user oriented way through helpers like systemd or your container orchestrator or whatever.

It doesn't make much difference though, you can say it's systemd, the kernel, dockerd, or whatever. The point is that operating systems have tons of facilities built in for the management of processes.

> Sorry if I was unclear, I meant it as "I don't want to worry if the kernel will properly schedule N clones of my single-threaded program so I prefer to write a fully async one in a single OS process and work on it to make it efficient instead; failing that, I'll just bump my hosting so my program has the throughput I require".

Why not "I don't want to worry about if my kernel will properly schedule N clones of my single threaded program so I'll just bump my hosting so my program has the throughput I require" ?

Also I didn't suggest single threading, I generally build things as 'async/await' on the inside and 'service oriented' on the outside. So when there's some new domain I don't spawn a new task, I just spawn a separate process.
Full-text search engine with PostgreSQL (part 2): Postgres vs. Elasticsearch
Good, this kind of thing in academia is far too common. Cherry picking results all the way to outright falsifying data. It’s a problem at Auckland university here in NZ too, my friends who are studying there say that their results are ignored if they are inconvenient. It’s disgusting, and they should make an example of them (they are I guess)
The internet as you know it would not exist without ads.
[deleted]

Sorry, I think what I said was misunderstood and was not very accurate, so I made the decision to delete it.
> In Erlang you must compose them, in operating systems the kernel does that for you

Erlang's supervisor trees are much more powerful than anything the kernel will do for you.
Agreed, the cost should have been borne by those who did not take sufficient measures to reduce transmission. Similar to how, when you do something dumb in the ocean and need a rescue, you pay the coast guard back if they determine negligence.

It was negligent to live as if there weren’t a huge pandemic.
I'm goin to guess that the recent Commit Mono post started it, it fizzled out a tad, and the Sweden font post yesterday kicked off some additional interest
However, not all IDEs, text editors, and terminal emulators support disabling the use of ligatures, so it's often easiest to just switch to a font that doesn't include them if you don't want them.
The information superhighway won’t stand for that.
I'm reminded that Maker Media was making a Magazine and a faire, and then took a pile of VC money and crashed and burned. It was a mess. The Magazine is back, the faire is back but the whole debacle is a lesson learned that none of that was necessary.
This is interesting and I'm curious how is this being solved in the wild?

I'm on an ARM (m1 mac) machine and looks like char type is a signed type.
EOF on this machine is -1

1. How can you distinguish between the char in the file and EOF (-1)?

2. Is EOF reserved for all files on macOS?
Depending on your usecase, ProxyJump may suffice https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump
Understanding who should be promoted to where is a cornerstone of good management. Getting that wrong is literally one of the markers of bad management.

There are a variety of mechanisms that can be deployed to ensure the person is right for the position. Throwing up your hands and going “well figuring this out is just too hard” is another marker of bad management, lol
Any human organization?

I don't expect 1-5% fraud in airline pilots, bank tellers, grocery store clerks, judges, structural engineers, restaurant chefs, or even cops (they can be assholes but you don't have to bribe them in functional countries).

I think academics can do better than 1-5% fraudulent.
To be clear, agent-forwarding to a (potentially) malicious ssh server has always been a bad idea. Yes TFA's bug makes it a worse idea and it's absolutely worth it to patch it, but you should not be agent-forwarding to (potentially) malicious ssh servers in the first place.
Congrats on the launch! JFYI, app. and docs.twenty.com are both showing cloudflare origin errors at present.

The signup from the main site asked me to message on WhatsApp, which I don't use, so I backed out from signing up.