skysight-inc/HackerNews huggingface dataset:
I'm curious what your thoughts are on potential solutions to writing 'secure' (enough to resist non APTs, assuming the human does not fall for phishing, just hardware/software vulns) software as an industry?

Slower releases? Formal verification everywhere? Demanding more than 3 days notice and vague requirements before we start implementing features? Unionization/licensure so devs can pushback when bosses of various stripes want to cut corners like they have gotten to their entire careers?

It is clear that the industry of popular commercial computing devices at large does not have the incentives to write 'secure' code and hardware as defined above.

What would it take to make the default state be secure instead of insecure?

My attempt at fixing incentives leads me over to UNIX and C which was a massive paradigm shift from the mainframes before and arguably is the foundation for modern computing at large today.

Trying to kill our old 80s insecure-unless-you-really-work-at-it UNIX & C-dynasty might be a good step but seems almost impossibly painful for us to do.

Like how medical best practices in some areas can only move forward one death of an old guard doctor at a time. We all (me included) are used to this von neumann architecture on one of several popular ISAs and doing imperative code pretending to be a PDP-7, plus or minus lots of abstraction, depending on where we go from embedded to Blazor WASM web programming.

Let's say someone does do that, a new OS from first principles, new programming language(s), an entire stack built on, IDK, ARM or x86 ISA on up. VC money demands they lock out making the device general purpose computing. Few would buy it because of their sunk cost investments in the cloud / SAP / activedirectory corporate networks / X gen enterprise offerings of the past that this would not be as easily integrated with.

Yikes. What will it take to make us as an industry write 'secure enough' software by default?
> switched from Windows to Linux this year, and the biggest issue has been drivers and hardware compatibility

It's not 1999, this hasn't been an issue for me on any Dell, HP or Lenovo system in 2 decades.
He states that one should fear machine intelligence. Then his actions are exactly opposite and against that fear.

He obviously has no fear and thus he is inconsistent. But this is normal. Everyone is inconsistent.

The main thing this article illustrates is that Sam is not some really logical person with a heart of gold that he often tries (and succeeds) to portray himself as. He's just a typical sv tech bro out to make a name for himself and himself only.

The hero worship is what is completely off character here. People are so viciously against his firing as if someone fired Mother Theresa or some other moral paragon. For much of the time no one even knew why he was fired and they already assume the worst. No different then cancel culture.
Reporter of #15526 here. I've still only ever seen this corruption in files being built, which seems to be a situation that the race can be won repeatably by some packages. I reviewed all my user data and I've found no corruption to it, but my workloads don't involve block clones.
Oh lord, spare me with the "links to China" idiocy. I once ate a fortune cookie, does that mean I have "links to China" too?

Toner got her board seat because she was basically Holden Karnofsky's designated replacement:

> Holden Karnofsky resigns from the Board, citing a potential conflict because his wife, Daniela Amodei, is helping start Anthropic, a major OpenAI competitor, with her brother Dario Amodei. (They all live(d) together.) The exact date of Holden’s resignation is unknown; there was no contemporaneous press release.

> Between October and November 2021, Holden was quietly removed from the list of Board Directors on the OpenAI website, and Helen was added (Discussion Source). Given their connection via Open Philanthropy and the fact that Holden’s Board seat appeared to be permanent, it seems that Helen was picked by Holden to take his seat.

https://loeber.substack.com/p/a-timeline-of-the-openai-board
Talk about a pitch right across home base…

https://forum.effectivealtruism.org/posts/xJhtrAxd5QpXi2CdA/...

Here is the Google query that came from

https://www.google.com/search?q=effective+altruism+climate+c...
>The world is rougher

On the contrary, it's less violent than previous decades. The difference is you get to hear about EVERYTHING due to nearly ever human on earth has a smart phone and access to the web.

This is a blessing and a curse. Given your handle, I'm surprised you haven't figured that out.
Adobe is not the only problem. Hardware support, codecs, media support. It all just does not work that well, and I think will not work well for a long period of time.

Video editing for years have not been an option for Linux.

Sure there are programs, but they often crash, often encode x times slower than corporate paid crapware.
Yeah I run my rust apps with in google cloud run so the containers are always restarting anyways so I dont care
So dangerous on so many levels. Just let him start his own AI group, competition is good!

Instead he will come away with this untouchable. He’ll get to stack the board like he wanted to. Part of being on a board of directors is sticking to your decisions. They are weak and weren’t prepared for the backlash of one person.
Those aren't the kind of roads that suburbs are made of. Tell them to stay away from those roads. Kids in high density urban areas need to worry about those roads, but this discussion is about the viability of suburbia for children.
"condescending conclusions" - ask anyone outside of tech how they feel when we talk to them...
The first line of the article is

> AutoZone revealed that cybercriminals have stolen information, including social security numbers

So it’s more than just information about purchases.
How would EU be different? It is not a country but as an economy it has similar population as the US, geographical proximity to asia and africa and many well established economic powerhouses. If the US should feel threatned it would be by the EU.

The reason the US does not like China is not because of their economy but their politics and military ambitions. Both China and India have nukes so they can defend their territory against the US just fine. China wants to expand into taiwan, the south china see and even some west china territory India controls and who knows what else.

If you think about it, being wealtheir than the US does not affect the US much so long as the US is still a competing consumer economy and the dollar is the global currency (kind of like english being lingua franca, unless the world trusts China more than the US to pay its bills, RMB will never displace the dollar ) what changes for the US? So long as GDP is the same and the US does not rely on exports for survival it can still maintain the most powerful military. The problem is with China using their wealth to compete with the US military similar to USSR which might lead to a world war 3 situation.

India on the other hand, no doubt will improve its military but I don't see India spending 100B+ a year on military or foreign bases and multiple aircraft carrier strike force groups and all that. The only real conflict opportunity for India are pakistan and China but if India is allied with the US then the US and NATO countries will be a deterrent. Much of why India is neutral on ukraine and won't publicly be closer to the US is a result of economic dependencies such as oil and trade routes. A prosperous india might be able to break free from those shackles and equally compete with EU and the US as well as with China.
> Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN"

Why is USA like this? The SSN thing has felt ridiculous ever since I moved here. “This is your SSN! It is super top secret important information, do not share with anyone ever” … “Oh also please give this number in plaintext to every company under the sun”
Django was actually fine. They had the same codebase running on Python 2 and three, so you could update whenever. Since Django includes so many batteries, I didn’t have any trouble porting that over.

However, early versions of Python 3 were slower than Python 2, and also some breaking changes were getting rolled back (e.g. PEP-414, which was targeting Python 3.3), which contributed to a lot of library authors dragging their feet in upgrading their support.

So, yes, it was libraries causing the most headaches, but there was a sense at the time of wondering when the upgrade would become “real”. Depreciating py2 took 11 years after the release of 3.0.
You may have a good specific point, but I think people will always say "once X is fixed people will switch to Linux".

When windows users try Linux for the first time, they'll (rightfully) point out problems, while their Linux friend will just say "oh that's normal, you just have to do Y" and the exact same thing would be true in the reverse situation.

Some people are just more tolerant to being in an unpredictable environment than others. I find myself highly tolerant to noise, unpredictability and things breaking. Of course I have my limits, but when comparing myself to my best friend, he will literally have none of it (he's a macos user)
Yea I’m fortunate to have worked in more good companies than pathological ones, so maybe whatever my strategy is has worked so far.
You could have a button that triggers a captcha that then authenticated a request for the plaintext email.

Or you could just use a spam filter.
Depending on what you mean by "production" you'll probably want to look at "real" serving implementations like HF TGI, vLLM, lmdeploy, Triton Inference Server (tensorrt-llm), etc. There are also more bespoke implementations for things like serving large numbers of LoRA adapters[0].

These are heavily optimized for more efficient memory usage, performance, and responsiveness when serving large numbers of concurrent requests/users in addition to things like model versioning/hot load/reload/etc, Prometheus metrics, things like that.

One major difference is at this level a lot of the more aggressive memory optimization techniques and support for CPU aren't even considered. Generally speaking you get GPTQ and possibly AWQ quantization + their optimizations + CUDA only. Their target users and their use cases are often using A100/H100 and just trying to need fewer of them. Support for lower VRAM cards, older CUDA compute architectures, etc come secondary to that (for the most part).

[0] - https://github.com/S-LoRA/S-LoRA
If it gets to that point, yes. There are multiple places where the lawsuit can end before a jury enters the picture (dismissal and summary judgement being more prominent examples), and in those cases it's the judge making the ruling.

The insinuation here is that the venue was chosen to get a judge that is less likely to rule against X/Twitter in those earlier stages and make it more likely that later stages of the trial will be reached.
> India and the Soviet Union signed a treaty only after the US sent its seventh fleet towards India during the 1971 India-Pakistan conflict

New Delhi and Moscow were transferring technology in “steel, defense, railways, construction equipment, metal & mining [and] petrochemicals” by the time “Khrushchev announced that the Soviet Union supported India's stance on the Kashmir conflict against Pakistan and over Portuguese coastal enclaves such as Goa” in 1955 [1]. The MiG-21 was co-produced in India in the 1960s.

[1] https://en.m.wikipedia.org/wiki/India–Soviet_Union_relations...
Looks like they unintentionally (or intentionally for some reason I can't parse ATM?) triggered code formatting. If you have a line preceeded by two or more blank lines that is indented with two or more spaces then it'll <pre> formatting.

Like This
Nah, I agree with GP. Who didn't suggest making 3D scenes by hand, but the opposite: create those 3D scenes using the generative method, use ray-tracing or the like to render the image. Maybe have another pass through a model to apply any touch-ups to make it more gritty and less artificial. This way things can stay consistent and sane, avoiding all those flaws which are so easy to spot today.
I wish for graph reduction hardware, we could build amazing things with that.
The board is the charity though, which is why the person you're replying to made the remark about MSFT employees being appointed to the board
I am very concerned about climate change, and I am somewhat EA adjacent.

But it is not accidental because isolation is one of the most important techniques of cult mind control. The point of Sequences is the same point as Dianetics it is supposed to rewrite the way you communicate so you just can’t relate to “wogs” (the rest of us) and can only talk to true believers.

Wow. This is just weird.
> Tesla autopilot should be outright illegal.

Is the problem lane keeping, traffic adaptive cruise control, and automatic emergency braking? Or is it the marketing around it and how people use it? Maybe it's the lack of a controlled stop when the driver attention check fails?

Plenty of other cars have driver assistance features, but we don't hear about people not paying attention to their well equiped Pacifica and it crashing into things. Maybe because there's no videos from Chyrsler saying the car is driving itself, driver there for legal purposes only. Maybe because the driver assistance equipped unit sales are lower. Maybe the collisions are happening, but don't make the news.

Driver assistance features seem like a good idea if used properly. Drive normally, but the computer is always supervising and will help if it sees a problem you don't. They don't work well when the easily distractable human driver is supposed to be supervising the computer.
Sounds like you should commit more often inside you topic branches.

In case you are talking about merge conflicts: That's the nature of distributed development other people might trump on places you are currently working on.

I guess there are more intelligent merge strategies. But GIT gives you a list of files that need a manual merge and you have to look into them one by one. GIT even tells you what to do in this case.
I used the briefcase with my first 32MB flash drive to keep school files synced between home and the computer lab (and with tons of space left over!).
I wouldn't look at Linux for security-critical productivity work. Most cybersecurity experts run Windows, with Linux in a VM. Or they run Macbooks because of battery life, etc. In this case, it comes down to the tooling that they can use to exploit vulns and so on.

Linux would be more private, but privacy != security and it all comes down to what your threat model is. The three major OSes have their own security mitigations that you can use to reduce the attack surface.

In general, in a multi-user networked environment Windows is going to be more secure than running Linux -- Linux works great as a server because it can be be run barebones thus reducing the attack surface on the OS.
Surely better tools to analyse stuff is a better answer.

Think ASM disassemblers - arguably a harder task and people do fine with it
Show HN: Blending Go and WebAssembly to Build Authorization Playground
Hi folks,

I’m one of the maintainers and co-founder of the Go OSS project Permify (https://github.com/Permify/permify), an open-source authorization infrastructure inspired by Google Zanzibar.

I would like to share a post where we aimed to provide a brief overview of how we integrated WASM with Golang to provide a richer user experience in our open-source playground. You can use the playground to create and test any authorization logic in a browser.

The playground has three main sections:

Schema: to model your authorization logic through our domanin specific language we built.

Data: to create sample authorization data according to the model for use in tests.

Enforcement: to test your authorization structure bt access check scenarios.

Here's the post if you're interested: https://www.permify.co/post/wasm-go/

And here's the playground: https://play.permify.co/

Appreciate your time!
Zoomers will overtake boomers at work next year
This is the most cogent argument against AI I've seen so far.

https://youtu.be/iGJcF4bLKd4?si=Q_JGEZnV-tpFa1Tb
also recently updated to v0.5 - https://github.com/rust-lang/www.rust-lang.org
After using Rocket in production for a year now. I'd really recommend Actix Web. Don't get me wrong, Rocket has some really nice features and good UI, but a couple things have proved to be real pain points:

- Middleware ("fairings" in rocket parlance) can't respond to requests. This means your access control has to be replicated on every route as a guard.

- Guards can result in errors (for example, if the request doesn't have a valid Auhorization header), but you can't set the response body without a nasty workaround that causes other issues [1]

- Guards also have tricky performance gotchas. When multiple handlers match the same route, rocket will try them all in priority order. Often these variants have the same or similar sets of guards, but guards don't cache by default. Doing your own caching gets tricky especially in the presence of workaround [1].

All this to say, Rocket works well, but it has some unique problems that come from its early design decisions (e.g. the guard error messages which has an open issue) and some from ongoing decisions (i.e. the project seems to committed to the fairing model over standard middleware).

Many of these problems are fixable by community members like you, but actix avoids several of these and has a larger developer base. I've heard good things about axum and the docs look great but I haven't had much experience so I can't offer a strong recommendation.

[1]: https://github.com/rwf2/Rocket/issues/749#issuecomment-91629...
what evidence do you have that it's not "true, and if it really happened" except to spread FUD? FT is a very reputable paper.
Do people actually care about costs this low for business use? Thats just a minor cost.

Certainly there is a line to when it makes sense to compare costs but we are talking about sub $10k costs for a tool that lets say has a 3 year life for a business, so $3300 per year or $275 per month. I would think most of the individuals on this forum are generating more than $275 of value per month on their laptop.

Its less about justifying and more that the cost is meaningless compared to the value. There is some intersection of objective and subjective analysis here, I don't care if you want a $10k laptop that runs linux.
Had arch Linux 3 times. Each time was ended with some update problem. This is not definition of stable.

This has not happened on debian yet.
2-3 generations ago, parents weren't terrified of letting their children play outside in suburbia. Or if they were, it was because of previous moral panics like satanism and kidnappers, not cars.
I have to agree.

If you are passive-aggressively tagging your CTOs ADRs then you could be part of the problem.

As an outsider, it would be hard to judge if this is just normal power-level/management bureaucracy stuff or unique to the CTO.

Everything your saying sounds fairly common TBH.
so when grandma's windows box is rooted by a 0-day 'sploit from javascript served by visiting Gardening Today's website (grandma lives in Phoenix, GT is based in (let's say) New Hampshire), she can file a small claims case against Gardening Today to get her computer repaired? $125 initial estimate fee, $200 in "labor" to scan and remove the malware, treble damages, so $1000 sounds about right. I'm sure "quality journalists" would be happy to right these wrongs, wouldn't they?
I'm not sure what there is to learn, if you have a good working knowledge of Linux servers. This is exactly why I prefer the terminal to any of the GUI components that may exist. Much more stable interface. As far as programs that I use daily, other than a few obscure VPN clients, I've rarely, if ever, needed anything that I couldn't find on AUR. For that reason and for reasons of having up-to-date software available, I like something in the Arch family for Desktop use. On the other hand, .deb packages are often available for more obscure software like those VPN clients...
But they're the rich children with the shiniest toys!
Oh yes, the "all or nothing" fallacy. Let's ignore nuance in an effort to win internet points.

I know you're better than that.
The image of Muhammad Ali taunting Sonny Liston to get back up is one of the most famous images in sports. I can’t imagine how much it cost to license.
He's been sending out the occasional tweet - to be honest I get the impression that like the rest of us, he's just been watching with a big tub of popcorn...
Micropayments would improve the incentives. Click a button, pay a penny, see the article. You'd only be willing to do that if you trust the publication to provide quality articles.
Committing to Rust for Kernel Code
I think Nvidia might have an incentive for this not to exist.

edit: but you are right for the AI companies not open sourcing their models it's an advantage to have it when others don't
No.

Why do we spend all this time avoiding the truth? We have antitrust laws to dismantle monopolies. This is because monopolies can be dismantled by two things:

1. The coercive power of the state.

2. A sudden realization among those who run and benefit from the monopoly that selfless love for their fellow human beings is enough reason to stop predatory rent-seeking.

In other words, only love or power. We spend a lot of time not talking about the two main forces that guide human life. Not reason. Not reformed open source software development. Love and power.

I often suspect this reluctance to involve the coercive power of the state comes from a libertarian streak in the tech world. But I am a weird anarchist kind of guy so maybe I am mistaken on this.
Not sure I'd call that "insane quality", more like neat prototypes. I'm excited where things will be in the future, but clearly it has a long way to go.
What got me interested in Rocket was from this talk (a great talk btw):
https://youtu.be/lBQHrj6vwAo?feature=shared&t=1934 (A Case for Oxidation)

The main selling point for me was that Rocket made security threats (XSS, SQL injection etc) impossible by guarantees which was a bit mind blowing imo. It is a bit like database guarantees which is insanely useful as an application grows. Is this still the case with Rocket and if so, how come it's not all over their web page as the unique selling point? I mean, security is getting more and more important and if we can solve many preventable security threats permanently by a technical choice this seems like the obvious way to go for the future.

I mean, Rust is fast and secure and makes my software "unhackable" for the price of a bit slower development? Seems like an obvious choice then.

When I browse their website, I don't understand if this is still the case and coming from a php/node background this would be the main driver for me since the language performance is very rarely a concern of mine and coding rust is.. slow and requires a lot of learning because of the weird syntax that makes me think about memory when I don't really care.

What I also really, really like about Rust, Go and other similar languages is that the deployment option that becomes available. Just deploy a single binary file. That is super simple and awesome. But the one thing that made me look away from Rust is the foundations weird rules and new draft that you cannot use the word Rust in urls, courses etc and if you like guns?

I don't know how it's been developing so far but the Rust foundation seems to do some crazy stuff that makes it hard to trust.
The issue is that this statement of Panun will be used against innocent Sikhs and will cause undue burden on them, in the worst case leading to human rights violations. India has no qualms with using draconian laws like UAPA, NSA, and sedition and ruin the livelihoods of people and their families.