skysight-inc/HackerNews huggingface dataset:
This is highly misleading.

fTPM is more secure against _this_ kind of attack, with physical access to the bus wires. However, since fTPM is a Firmware-TPM, it is vulnerable to all kinds of attacks on the system's firmware, even remotely, even via the network, even maybe if the computer is switched off. Remember all those (even unauthenticated, remote) XML-parser exploits in the Intel ME? fTPM is just one more ME module, and of course vulnerable to those exploits.

So overall, I consider fTPM a huge step back, because you might even get access without physical presence. For an fTPM, attack surface is far larger (because all of the ME software), minimum attack complexity may be smaller (because there will one day be a metasploit module for all those software problems, whereas HW hacking is always a certain hurdle), required attacker privileges are less (prolonged unobserved physical presence vs. network). Thus objectively worse in all aspects.

What would be better would be a dTPM that is integrated e.g. into a SoC, such that there are no exposed wires anywhere without decapping the SoC. Some systems such as phones work like that, but this is hard to tell even from the technical specs.
> Why should the world bend to your desires?

Because I'm the one spending the money. If you make it harder for me to spend money with you, I'm going to spend less money with you.

> Cell phone penetration in the US - 97$

> Credit card pentration in the US - 70%

Sure. But most credit cards don't have batteries that die.
Can There Be a Theory of the Email Job?
FIPS certification doesn't make something more secure. Just more certified.

It's incredibly slow to adapt to new technology.

fTPM has a different attack surface, and protects against this specific attack.
It's most likely better than dTPM for hardware based attacks, but there's known attacks as well
The future is now, old man.
T-mobile: (data breach noises)

Also T-mobile: Give us your bank account info.

Yeah, no.
We have three options, IMO:

1. As a species decide to never build another LLM, ever.

2. Change the path of society from the unequal, capitalist one it’s taken the last 2-300 years.

3. Give up

I know which I believe in :). Do you disagree?
> With a male I'll stand ground and argue back (but not physically), with a female I'll walk away.

Could we continue digging into this in good faith?

If they're so aggressive that it's unprofessional, then neither men nor women should be doing it to you! You should not rise to their level, remain professional and calm, defend your position intellectually without aggression. Try to settle the dispute, or escalate to management if need be. But after, you can give feedback to either them, to their manager, or to HR to determine how you two can have a similar disagreement in the future without unprofessional aggression.

If it's just a tense disagreement of opinion and involves someone coming off aggressive, but remains professional, then why would you argue differently if it's a man or a woman?

I'm sure there is more nuance to your point, but to me this seems fairly binary: Each of these scenarios is gender-agnostic.
I always find it exhausting and disappointing when I'm confronted with the reality that so few people understand anything about radiation. The dose here is so phenomenally small, the half life so brief, the rate of dilution so high that this is a non-issue. Recently there was an article about a fish that was caught in the region with a dose of Cesium in the area of 18,000 Becquerels per kg. The media and social media take on that was essentially, "OMG that number is so big! How quickly would you die if you ate it?"

If you ate a whole kilogram of that fish it would be the equivalent of eating between 4-5 bananas.
I think the opposite may be true. If you control the training and hosting, surely that means you have to be more involved in many industries to make the product useful? Whereas with offloading training/tuning to the user, you kinda just become PaaS, in that you provide a platform which enables others.
You can order from the Taco Bell mobile website.
Actually, once your painting gets to any amount of recognizability at all for someone's image/likeness, it is a violation. This is exactly what I'm talking about when I say the internet has made us forget that these laws already exist because nobody has been enforcing them.
They didn’t change the morality or legality of hurling a blunt object at one’s head resulting in their death. Using a slingshot in that manner was just ad illegal and morally reprehensible as pulling the trigger on a machine gun pointed at someone’s head.

I’m focusing on the notion of legality and ethics.
The issue isn’t the format. Class loading includes bytecode verification (verifying the type soundness of whatever code the class files contain), and then executing the initialization code defined by each class (static code blocks etc.).

The optimizations in JDK 9 are for reducing the file size of the JDK (in terms of number of classes) when distributed with a standalone application, but that by itself doesn’t significantly affect startup time I believe, because classes are lazy-loaded only as required in any case.
except that it is literally named for a friendly and non-offensive chat signal.
...or f#, which is actually the "better ocaml"
Electrify America, EVgo Ban the Use of Non-OEM Adapters
Love this! I don't think you could be more right about the practical challenges of implementing something like this. In my experience, this same problem is what makes it so challenging to onboard new data scientists/analysts.

It takes a lot of training to get a team member up to speed - with the same amount of training, do you think an LLM can compete?
I could see artists voluntarily mentioning AI art in their captions. And on the forums I frequent, that's the current solution to keep the controversy down.
I don’t eat Taco Bell. I’m talking about the app deluge in general and I guess I chose a bad example.
That thing seems kinda scammy. Never been able to find a real human who has received one.
It’s US English that pronounces it that way.

I’d say, two thousand-three hundred. UK English.
This feels really anti-right-to-repair to me.
> When your code is under 200 LOC and not expected to be maintained for the next 10 years.. then a lot of the things you just mentioned don’t matter as much. This is not for running in an enterprise but for exercising the brain.

The things I mentioned do matter in any situation. If you don’t take good habits when you exercise your brain, you won’t take them when you code "for real". In addition to that, this repository is not just to exercise the brain of the author, but to serve as example code for others to read it; it has a README and most functions have a docstring.
There are more options than "write perfect code" and "not even attempt to learn how to write idiomatic code".
Banned by China. Probably more of a political/economic move than a real safety concern.
If I choose not to sell a product or service in a method that some subset of customers don't find acceptable, I'm losing some amount of revenue. I must think that tradeoff is worth it. If you choose not to use a phone -- but you are obviously capable of using technology if you are posting here -- you are choosing not to do business with me.
Customer service is meh but the mobile service is great (even works on the Playa at burning man). I’m paying $150/month for 10 lines, and have been with them for 23 years. Of course, due to their data breaches, my email address with them is an alias and my physical address is my mail processor. Money goes in (I prepay a year at a time with a credit card), mobile service comes out. Prepaid service would mean they collect and retain less data, but you get lower priority on towers.

If you need service occasionally where TMO doesn’t provide, I recommend a Visible (Verizon MVNO subsidiary) eSIM.
> So getting rid of 5,000 (out of 70,000) employees will help deliver on customer expectations?

I'm a T-Mobile customer via Sprint acquisition. My experience post merger is that they simple view customers as monthly payments that T-Mobile is entitled to, service delivered, or not. They do not back the equipment they sell, they make it nearly impossible to bring your own phone (if you are on a former Sprint contract), and their people have zero discretion to do the right thing. It's a dystopian hellscape.
> Negative log is the only decreasing function which satisfies f(x * y) = f(x) + f(y)

Times a constant!
>Look at highly paid surgeons: the ones making the most money are the ones filling every single one of their slots. They know - bedside manners matter.

If you are picking a surgeons based on this criteria, you are paying way too much for a 10 minutes conversation aka bedside manners. I personally will go with the rudest mf-er that will fix me right the first time.
Do they really? As far as I can tell, diffusers/transformer are open sourced wrappers around torch implementations, there are a bunch of companies that are offering inference (just like they are), and there is some value in offering S3 storage to allow for model search.

If they reach a point where they actively become community-hostile, someone will just fork their codebase and release a web app called "FaceHugger"
This is also something to keep in mind when resale of SSDs is discussed and people recommend using the secure erase function of the SSD!
While they seem to be "git commit && exit", there are sibling repos that are interesting, too:

https://github.com/platypusguy/jacobin-dart (A JVM written in Dart)

https://github.com/platypusguy/jacobin-swift (Jacobin JVM written in Swift)
They use Haskell in any case [0]

[0] https://jacobin.com/2022/05/jacobin-is-looking-for-a-program...
I've said this on HN before, but Nvidia is the one selling shovels IMO.
Maybe a MacBook Pro. The Apple silicon chops can offload a special AI inference engine, and all ram is accessible by all parts of the chip.
Pluggable Type Inference for Free
Can't even park some places around here. Scan something on a post and voila! If you have a smart phone, if it scans, if you have internet connectivity, if you have the app.

Some of us don't install apps willy-nilly. Some of us have phones with no app other than what it came with.
> Such ss?

Network access. Accelerometer access (which, remember, can be used as a rudimentary microphone among other things).
Modular Raises $100M
Moved from Verizon last spring because it seemed like T-Mobile was investing more in their network in our area and Verizon's account management was a mess. Never received any of the new account credits we were supposed to receive and it was like a light switch that places in our area that had solid T-Mobile coverage suddenly didn't. Planning to go back to Verizon for the better coverage but not looking forward to it. Not clear how a staffing reduction is supposed to help.
Totally agree that function locality is important, especially if latency reduction is your biggest opportunity. Edge compute feels like a niche problem for most businesses, and it comes with high overhead costs in setup and maintenance.

You mentioned Liveview and Livewire. Both are great and they would work equally well in any context, not exclusively a server less front-end.

I would propose that switching to a more efficient programming language (i.e. not using Elixir or PHP) and investing in better data structure optimization would result in equal if not better performance improvements than investing the same amount of time wrangling data replication issues and infrastructure maintenance caused by edge compute.

To the point of the original article, modern web development remains the same: start with a single server, server-side render your content, and expand when the need arises. What we're talking about in the comments is performance web development for geographically distributed audiences (for instance, if you're building a global social network).
We’ve been able to just call up the local Starbucks’ and usually at least one is happy to give theirs, last time we went 4/4 and got more than we knew what to do with.
What I found interesting in Meta's paper is the mention of HumanEval[1] and MBPP[2] as benchmarks for code quality. (Admittedly maybe they're well-known to those working in the field.)

I haven't yet read the whole paper (nor have I looked at the benchmark docs which might very well cover this) but curious how these are designed to avoid issues with overfitting. My thinking here is that canned algorithm type problems common in software engineering interviews are probably over represented in the training data used for these models. Which might point to artificially better performance by LLMs versus their performance on more domain-specific type tasks they might be used for in day-to-day work.

[1] https://github.com/openai/human-eval

[2] https://github.com/google-research/google-research/tree/mast...
It seems like the Rust team isn't saying that compatibility is broken, just that there is no testing or effort to ensure compatibility. In the end it's similar, but like any project, it comes down to allocation of time and resources. For something like Windows XP, I'd guess the pool of folks interested in targeting it is extremely small.
When I was diagnosed with sleep apnea, it wasn't the breaths per hour that was the concern, it wasn't waking up during the night, it was my blood oxygen would dip to the 60s.

So the researcher measured heart rate, breathing rate and not blood oxygen? Or maybe they did, and the headline of, "People hold their breath sometimes, blood oxygen remains in normal ranges", doesn't inspire me to learn how to breath.
I have better things to do with my life than manage a zoo of shitty apps, so to hell with that. Just because I'm technically capable of spending time on doing something doesn't mean I want to.
Yeah sarcasm generally fails. Sometimes I put <sarcasm>...</sarcasm> :)
Someone correct me if I'm mistaken but I don't think the implication is that time passed more slowly in some kind of absolute sense but that due to time-dilation effects we observe these rapidly receding quasars in slower time. And that if they in turn looked back at us, they would also see our portion of the universe in slower time. Of course whenever you look at anything you are looking at its past, so the effect is that the distant past everywhere appears to be moving slower.

But imagine the following: That 12 billion years ago some scientist built a briefcase-sized machine with a laser array with trillions of mirrors in a complex pattern. The laser is inside the machine and fires a regular one-second pattern into the bank of mirrors. From there the light just bounces around and around in the machine until it emerges out of an aperture. Because there are so many mirrors constructed in a complex pathway, it ends up taking 12 billion years for the light to emerge from the device. We come across the briefcase sitting in one of the craters on the Moon's south pole just as the pattern of light is emerging for the first time. (Let's pretend that whoever built the device included tech that would prevent the signal from attenuating.)
The question is, would the pattern still be at a one-second interval, or will it be slowed down? If I'm understanding this news item correctly, the pattern would be still at the original speed because it will not have experienced time-dilation effects relative to us on Earth like we see in distant quasars.
Good question. We've taken a somewhat unique approach of integrating tightly with PostgreSQL in order to leverage its strengths. In the short term, we plan to continue with this focus on PostgreSQL, but we are considering supporting other DBs in the long term. Thanks for your comment though! Knowing that you have an interest in using Mathesar with MySQL is a useful data point for us!
Musk unhappy with Cybertruck’s poor quality, calls for Lego-like precision
>Bitlocker is the Windows one, that's essentially known to be compromised, right?

It's not compromised if you set a PIN/passkey, aka use it correctly.

Technically, the lock on your house door is also compromised since any pro locksmith can open it within a few minutes, but that doesn't mean it's now useless to keep locking your door since most casual thieves aren't pro locksmiths and laptop thieves aren't gonna be black-hat hackers/security researchers.

Such security solutions are there to discourage low hanging fruits of amateur bad actors(99,99% of them) and make them give up and use their time somewhere else.
Copilot has been working great for me thus far, but it's limited by its interface. It seems like it only knows how to make predictions for the next bit of text.

Is anyone working on a code AI that can suggest refactorings?

"You should pull these lines into a function, it's repetitive"

"You should change this structure so it is easier to use"

Etc
Scientists found more than 1k AI spam bots and regulators can't keep up
Try googling "bossware"

also, no employees want this level of intrusion, you should learn to trust or fire
A single weekly bout of exercise may reduce cardiovascular mortality (2006)
You seem to be mixing two things there, or it's unclear what you mean. It's possible to mention someone by name and arrange for the image to be found under their name without claiming that the image is really of that person. For example, something that people have been doing for a long time, I think, is finding a porn actress who looks like Famous Person, adjusting their hairstyle and make-up to enhance the resemblance (in extreme cases including cosmetic surgery), and then advertising the pictures as "Famous Person Lookalike does XYZ". The client knows exactly what they're getting and there is no libel of the famous person. Would you want to make that illegal, or just the cases that are perhaps already covered by libel law and the Trade Descriptions Act?
It is very enterprise and high end but see the universe around

http://www.omg.org/bpmplus/

In particularly see this implementation

https://www.jbpm.org/
Unquestionably. They play the same manipulative games with Taiwan. They banned pineapple imports two years ago because Taiwan's independence party gained control.
Sounds like you’re looking for T-digests[1] - most production systems I’ve worked on that do this are using them under the hood.

1: https://github.com/tdunning/t-digest
Yes, but collectively we understand that SO or Reddit are unreliable, plus it's usually one-way and we don't see people posting bad advice defending it just for us. LLMs, on the other hand, are extremely convincing, while being even less trustworthy than SO/Reddit.

Just make a mental experiment and imagine that every comment here praising LLM coding skills is actually about copypasting stuff from SO. Does it not seem alarming to you?
Looks like they left out another model though. In the paper they mention a "Unnatural Code Llama" which wipes the floor with every other model/finetune on every benchmark except for slightly losing to Code Llama Python on MBPP pass@100 and slightly losing to GPT-4 on HumanEval pass@1 which is insane.

Meta says later on that they aren't releasing it and give no explanation. I wonder why given how incredible it seems to be.
There are a lot of services that require their own apps as well as restaurants/museums/shops with no public wifi either. There's a lot of really badly-coded websites that demand safari or chrome.
For large symmetric operations like disk encryption, the MVK is still in memory.

TPMs are slow and have rather restricted memory.
They are fine for PCRs and some asymmetric operations.

But here they only unseal a key that is then used in software for speed.
It's worse than something protected by a high entropy password. Which is still better than 90% of users would be otherwise
I'm not aware of any proven compromise of Bitlocker. There are some bugs (Bitlocker disabling itself during certain updates and not re-enabling it after a BSOD during the update process) but I haven't heard of any way for an attacker who doesn't have full code execution already to bypass encryption. If you set a PIN you should be safe, otherwise the attacker can try to use various exploits or other methods to access the drives.

For fTPM based encryption, the entire system should be safer because the keys don't traverse an accessible bus like this.

The vulnerability also applies to other encryption systems using the TPM, like LUKS disk encryption.
That’s just one perspective… Another perspective is that LLMs enable programmers to skip a lot of the routine and boring aspects of coding - looking up stuff, essentially - so they can focus on the fun parts that engage creativity.
But cost of cooling is passed on to the cloud customer. Different zones/DCs/regions have different hourly cost which is a function of, among other things, the local price of electricity and cooling.
The problem with sensor fusion is what do you do when the sensors disagree? You have to decide which sensor to trust. But LiDAR is subject to interference, and it can’t see lane markings, traffic lights, speed limit signs, or emergency vehicle lights. If you ignored camera data and just relied on LiDAR, you wouldn’t be able to drive safely for very long. If you choose to ignore the LiDAR, then the sensor fusion is just adding noise to your camera vision model of the world.

If you somehow do sensor fusion perfectly and the models never disagree, then why even have the LiDAR? At that point you’ve solved vision using cameras.
Thanks for this. I agree they do nothing to support the idea that GPT4 isn’t getting worse. They simply criticize a paper that makes the affirmative claim, and explains why it’s difficult to test.
What does "GPT-4 connected to a VM or SQL engine" mean?
DOJ sues SpaceX for discriminating against asylees and refugees in hiring
> a) a hardware vendor nvidia whose products are needed by anyone in the game

FTFY.... I don't think AMD will be competitive in AI until at least 2025, though given their broken roadmap promises, not sure if anyone will be willing to invest in them
I do see some logic to the idea that current AI is very similar to artists' brains: Trained by seeing mountains of images, including many of actual living persons. Nothing wrong with that for the artist. Most do pay attention and don't go out of their way to reproduce a specific person, except sometimes that's the entire idea and they do. - which sometimes results in a lawsuit. Same in music: currently you have to be extremely cautious and even then you will run afoul of several copyright claims.
Up until "non-code-writing time, and idle time", I was assuming you to be an engineering manager who is pursuing this idea out of either malice or ineptitude. But after "realtime check-in of the display", I am now convinced that you must be trolling.

Not bad. If you're genuinely looking for this kind of… software product, I'd be interested which sort of company is being "enhanced" by your presence.
I see it more as an niche opportunity to integrate bits of Java code in Go applications. The start-up costs can be "paid" when the app starts. Performance will be bad, but it might save some rewrites (provided they can get things like db connections going).
Does he not make sure he has enough gas in his car before he drives somewhere? Enough money in his account before he orders at a restaurant? There are certain things that modern society can expect from people. If he decides to go against that, that's on him. If he is posting to HN, obviously he isn't opposed to technology,
And "Free Will" is the observation of one's inability to predict one's own actions.

As an aside, the claims that people are willing to make about language models are quite astounding considering that they never seem to realize that most of those claims apply to humans also...
All good, was just curious.
It does change the morality and legality of providing the tool, though. Give a slingshot to a kid and no one will blink an eye; give them a machine gun and you're likely to meet a bit more resistance... even if they never shoot it at someone.