skysight-inc/HackerNews huggingface dataset:
When I was a kid, to me no book was subjectively better than the Star Wars Expanded Universe (now "Legends") novels. I've never read anything from Toni Morrison but my life is richer for having been made to read outside the niche I chose for myself.

You can discount awards and the opinions of professionals but there is still value in being exposed to things you wouldn't have picked on your own during your formative years. Maybe most of it leaves you cold, but sometimes you find something you would not have picked that speaks to you. That's how I was introduced to my favorite author. You never know what will land a little differently than you would have expected. Sometimes the classics are classics for a reason.
> Typical garbage argument based on the notion that open source developers are only doing it for the chance of employment.

There is nothing in the article that supports you making this statement. It's not clear to be that you understood the arguments the author was making.

The core of the argument is this:

> But, in light of the recent xz Utils / SSH backdoor scandal, it is clear that while the bargain may not be entirely one-sided, it is not symmetrical, and significant bad consequences may result, both for the maintainers themselves and for society.

Specifically the potential impact to society via scenarios similar to the above.

The link from the article covers it well:

https://boehs.org/node/everything-i-know-about-the-xz-backdo...
This feature is built into Emacs, no Magit needed. It's the vc-region-history command, bound to `C-x v h` by default. It works across all version control systems Emacs supports, not just git.
If by "redwood forest" you only mean old-growth forests, sure. The trees being harvested commercially today are only a few decades old. Second-growth and managed forests won't have the occasional ancient giants the old-growth ones have but they are still clearly forests to the humans and other animals living among them.
Private keys are also “secrets” here in the security world.

“Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing”

Your distinction is not shared by the industry so it’s not something helpful to correct people on.
mmm.page seems like it would help in a pinch
You could use TDictionary. It has been around since 15 years.
We see you over there pretending one of them isn't going to end up in command of the largest nuclear arsenal on the planet. Pull your head out.
Then the question becomes "should we require ID for open source contributions?" and the answer is most likely no, not a good idea.
We are desperate for any truths at all about our origins, our purpose in the universe, our collective destiny or goal as humanity, and how we should shape our morality.
This is surprisingly obvious. I mean it's a clever technique to disable the feature and a really plausible commit. But then why did they go with an obvious syntax error instead of just misspelling something. E.g. would you have spotted it if the mistake was `PR_SET_NO_NEW_PRIV`?

More plausibly deniable too.
Its a sure sign a technology is USED.

Think about the relation of Forths to things written in Forth...
If you're going to criticize me, at least read what I wrote first
Indeed, in the US we too have a history of creating “states of exception” to the same effect, e.g.:
https://en.wikipedia.org/wiki/San_Francisco_Committee_of_Vig...
Probably the FBI for the public part of it, but if this wasn't a US owned operation you can be sure the CIA/NSA/military will do their own investigation.
Great software but it isn’t color correct and has issues with embedded color profiles and conversion between color spaces.
They suck at writing something valuable. Sure, it can write the same blogspan as copywriters for a fraction of the cost, but most readers feel cheated when reading it. It has the same effect as AI generate images.

Now Google is specifically targeting this sort of content with its algorithm changes.
We do know what it does. If it decrypts it just passes to system().
Just like a stock C or C++ compiler won't complain about the endless possibility of getting things wrong.

Or to pick on IDisposable, you can repeat exactly everything you said regarding actually providing a destructor, properly implemented, taking into account class hierarchies, multiple inheritance, heap allocation, and being exception safe.

Someone has to write those destructors.
Why should VCs back oss infrastructure directly? It doesn't help the VCs and only creates perverse incentives for the oss projects.

The SaaS/cloud/etc. companies themselves should fund the projects they depend on. They actually know what those are and don't have to force their own monetization/growth models onto the projects.
"I object to this obvious communism attacking defenseless megacorporations. Also, cheap insulin is killing us." - what Martin Shkreli would say
Forms plus a ton of waiting and unpredictability. The filling isn't such a big deal. The delays are.
There's a snap image of Foobar2000 for Linux which works very well :) My #1 music player.
I would say about 60% of the repos I use still use `master`. I think Git will be replaced before we have 100% `main`.
Dude is a developer just like the rest of us. We all try to write clever code from time to time, but at other times write sloppy crap. Especially if there's a boss insisting on a tight deadline.
It has, but you forgot to mention that the main API that actually exposes everything, is NVN.
I found ACDSee to be better than IrfanView.
If this is a good faith argument, it doesn’t feel like one, then it’s predicated on the idea that if the majority of the world used the same resources as the wealthy then we’re done. It also ignores that the wealthy have the resources to address their living standards being ecologically sound and therefore those improving their lives will have access to clean solutions. Or you can blame liberals blaming the poor.
> Nitpick, but the password is submitted as-is by most client applications, and the server hashes the submitted password and compares it with the hash it has (of course, with salting).

I never understood why clients are coded this way. It's trivially easy to send the salt to the client and have it do the hashing. Though I guess it doesn't really improve security in a lot of cases, because if you successfully MITM a web app you can just serve a compromised client.
Maybe, but the chatbot that I bitched to about Chipotle telling me that they were out of chips after I went to pickup my online order, gave me 2x large guac and chips for free as compensation, so I'm not complaining. At least not in this case.
> if they fail for something like a syntax error, flag it as a broken check.

A syntax error might be exactly what they’re looking for e.g. they’re feature testing a new bit of syntax or a compiler extension.

> so perhaps filtering based on the type of error would be best done as part of the build system functionality for doing the feature checking.

Which would require every compiler to have detailed, consistent, and machine-readable failure reporting.
Just like middleware engines, with much better tooling.
Again, you miss the point, there will be a paradigm shift. Yes, symbolic maths still exists, but nobody is looking up a special function to solve an equation. They just plug the numbers (and the state machine approximation of the numerical operations) in the computer and numerically, the result comes out.

Symbolic/numeric is just analogy of the paradigm shift that will come to all (applied) math. Another example is in statistics, shift from parametric to non-parametric.

Cryptography.. relies on unproven belief in ETH or P/=NP or some such (in fact, cryptography has, since Caesar, relied on unproven beliefs about cryptosystems). But that's just a belief, we don't really understand how hard any of these specific problems are. Which is actually a great example of the new paradigm I am talking about, because it shows we don't need proofs (of statements about infinitely many things). We can just quantize things directly (into a state machine that actually does the crypto stuff) and be happy.

We haven't even scratched the surface of what is possible in P vs NP. In particular, CNF representation of SAT instances might be a really crappy one.
They all have value in the environmental sense, but in terms of hiking and camping and sightseeing, it's pretty hard to tell one forest from another once you're among the trees. (Maybe there's an idiom along those lines.)
NVidia just announced an AI-simulated nurse, to give healthcare advice. Really.[1]

[1] https://www.youtube.com/watch?v=yg0m8eR7k24
Never allow complexity in code or so-called engineers who ask to merge tons of shitty code. Get rid of that shit and don't trust committers blindly. Anyone who enables this crap is also a liability.
> Why does it have to be russian? Could be any country, even USA, China.

Are you sure you are replying to right comment? Because they did not implied it was not other country or actor. It even directly starts with 'IF'.
Metagame
I am often disappointed by the lack of shortcuts and features in VLC compared to Potplayer.

Just some of the few keyboard shortcuts in Potplayer I use regularly:

"<" and ">" to shift the subtitle sync by half a secondd
"shift-<" and "shift->" to adjust the audio sync by half a second
"[" and "]" to set an A-B repeat of that awesome scene or soundtrack
"D" and "F" to move by a single frame forward and backward
there's also shortcut to decrease and increase things like saturation and brightness by 1% or shortcuts for 0.5x, 1x, 2x size.

I have to make do with SMplayer in Linux which is awesome but you have to setup the keyboard shortcuts manually yourself.
Previous generations what they grew up learning to interact with was also tools of creation. Even computers allowed you to create, so 90s kids grew up learning how to create the next thing. But today? Smartphones doesn't let you create anything except tiktok shorts.
This is the problem of projects that allow direct access and lack code review.
Yeah agreed, there was quite a lot of layoffs during the same period too, would have liked to see it normalised or compared against the overall labour market which still wouldn't be perfect because so industry and skill levels might've been hotter and colder but it makes the argument for causality stronger
I think at the end we're debating if the glass is half full or half empty.

I claim that people are not ignorant and if they use C/C++, they are aware of what a GC implies, and cannot afford it.

The article claims that people are somehow wrongly mislead to think they _need_ C/C++ while a GC'ed language would be alright.

I don't think people are dumb. I think given the choice, any sane person would pick Python or similar to write an application, and that thinking they don't because they don't know more is pedantic.
I worry about his home/personal system, this guy seems to have befriended Lasse in order to get the position, is it possible Lasse himself has been compromised?

I'd be nuking everything, possibly even disposing of hardware and setting up a new verifiable online identity on a clean system/hardware.
Perhaps, but given how most build systems work, that would complicate things in other ways (since build systems often try to compile all .c files).
I wonder how good automated LLM-based code reviews would be at picking up suspicious patterns in pull requests.
If it were using Cargo as its build system, it might make such manipulations more obvious / understandable?
Yes, I'll never understand the "fix typo" commits when `git commit --amend` is so straightforward.
Hackers these days communicate using X (Twitter), Mastodon, and Discord. The days of IRC, USENET, and listservs are long past; let them die.
I am sure companies selling Postgres support to Fortune 100, can think out of something to please corporate sales team.
My conclusion is that LAION is built using model upon model upon model; so each error propagates and the resulting dataset is kinda shitty.

But "we" made amazing stuff out of LAION.

So: the next person who can curate a high-quality big dataset is gonna make a fortune
The self-motivated were likely a hindrance during the building of the pyramids. Scientists are still investigating what time the pyramid builders logged off.
Rust specifically chose a minimal standard library to not get stuck with the Python "dead batteries" problem. There's a strong culture as well of minimizing a project's dependencies in Rust.
By this logic Monty Python is also American. And St. Patrick's Day. And magna. And sushi. And many other foreign things that's also popular in the US.
What about X Æ A-12?
If you didn't happen to see it, this is from knighthack's comment above:

"To top it off, IrfanView works beautifully on my Linux via Wine, and also on my Mac M1/M2 machines (and as a tool quicker than even Mac's own Preview). It's a primary install for me, whichever any platform I'm working on; and a software that's truly a gift to the world."
Not affected by the latest CVE, but the author had unrestricted access to xz for 2 years, so I would say it is affected until the other contributions are proven safe (never gonna happen) or it reverts to pre-adversarial actor version.
I have not found a faster image viewer on Linux than 'feh'. And I've tried a lot.
Apparently the lack of reading comprehension made you skip my second paragraph, and I failed to find any counter example on how then happen to innovate in GUI development, instead of copying existing stuff.

If you need help, I guess rotating cubes for changing virtual desktops could be an example, which is a kill feature in GUI design space.
Am I crazy thinking libraries shouldn't be able to provide _other libraries'_ symbols without the other libraries' "permission"? What am I missing?
Seems like a small price to pay for the ongoing effort to prevent the Internet being owned by a small number of [American] mega corps.
To be clear: the build system did not use the code fragment you quoted. This complex awk code is a later stage of the backdoor.
I still remember an undergrad group project at Cambridge where we were in the Computing Lab discussing how we were going to build an online voting system - I said "We can worry about security later...." only to hear a deep Glaswegian brogue behind us "Oh Really?! Tell me more...." as we all turned around in horror. LOL
Better make a torrent out of them.
>Our no-longer-reasonable requestor also offers a suggestions. Notice there is no offer to actually help.

Help in maintainship how? Patches had already been made and were awaiting to be reviewed and merged. This was up to the maintainer to do and requestor couldn't help with it.
No, these schemes use the pub/private keys to setup symmetric crypto, so just passing it along does you no good because what follows is a bunch of stuff encrypted by a session key only the endpoints know.

If I am a server and have your public key in an authorized_keys file, I can just encrypt a random session key using that and only you will be able to decrypt it to finish setting up the session.

This is why passwords and asymmetric crypto are worlds apart in security guarantees.
You could also say the fact that it is illegal causes the problems, not people using it.
Keeping it closed is not the problem.

The problem is that the duvet bunches up inside the cover if you move around a lot during sleep.
I get that they're ginning up excitement with "Caravaggio's last painting was a murder scene!", but it's a bit of a schtick. As pointed out in TFA it was a commission, and so not exactly a "personal" painting. Furthermore, at the time of his death, Caravaggio was headed back towards Rome, with a pardon all but assured. He wouldn't have been painting Saint Ursula under a premonition of death.

If you want to see what was on his mind a few years earlier, when he really was in fear for his life, look at some of what he painted then: a Judith Beheading Holofernes; two Salomes With the Head of John the Baptist; a Beheading of John the Baptist (the only painting he ever signed - in the blood dripping from the evangelist's neck!); and, most memorably, David Holding the Head of Goliath, in which Caravaggio gives the severed head his own features. How metal is that?
Free SAM (Surface to Air Missile) Simulator (2009)
Free healthcare is not really free. And it is good until you hit the point where the next available appointment date is 12+ months ahead.
If all the forests near you look the same perhaps it's time to try a Queensland rainforest, a Tasmanian horizontal forest, Western Australian jarrah or karri forest (each visibly distinct), or the many other types about the globe.

Horizontal: https://www.youtube.com/watch?v=XJLp5dgpSjQ

Karri: https://www.youtube.com/watch?v=cFlmkFBC9tg

Jarrah: https://www.youtube.com/watch?v=bDCP4ZABpqM

Daintree: https://www.youtube.com/watch?v=0pCXYHdjxyg
What are you talking about? Both ChatGPT and Gemini are available in the EU.

"EU is just mad" is such a bad faith reductionist take. If you want to live in a corporate dystopia without antitrust & privacy enforcement then go ahead, but don't expect us to follow you.
That's so strange. This reeks of nation state actors, wanting ways to protect their own systems.
If ChatGPT is blocked it's because of country-laws, not EU. It's perfectly usable inside Germany
Surprised to see this downvoted as it is just a simple statement of fact, to the best of my understanding.

My understanding of minimum wage is on the (US) federal level, where in addition to the standard exceptions that folks know (servers, farmworkers, etc), small enough companies or companies that don't engage in interstate commerce are also exempt from paying the minimum wage.

I wonder if people just don't like what I wrote and downvoted ab irato, if this came across as contrarían and was downvoted for vibes, or if state minimum wage laws change the fact pattern and I'm wrong in my understanding. If I'm wrong I'd like to be corrected.

P.S. since I hate to leave something incorrect: servers actually ARE supposed to get federal minimum wage from their employer if their tips don't cover the difference between the $2.xx they get paid and the federal minimum wage.
I hope the NetBSD devs included the latest version 5.6.1 of "xz" as it has some new interesting features.
True. 15 years ago when I was working at a large digital storage vendor, the joke was that Friday afternoon was for discussing each others' weekend plans; and Monday morning was for discussing the outcomes of those plans.
Or you know, they just reacted with a ban hammer on all accounts related to xz and to heck with innocence.
It doesn’t actually do anything because if SSL is compromised then all of the junk you think you are telling the client to do to the password is via JavaScript that is also compromised.

If you’re worried about passive listeners with ssl private keys, perfect forward secrecy at the crypto layer solved that a long time ago.

For browsers at least, sending passwords plainly over a tls session is as good as it gets.
I agree with everything you say, however cap and trade is not working as designed. Instead, we have gotten a system of questionable carbon offsets where neither the buyer nor the seller is interested in investigating the quality of the product closely, nor are the regulators. The money is moving without achieving the goal of reducing global warming. Some of these policies have been in place for 20 years, and has hardly gotten any movement of the needle. ESG investing has done more, for crying out loud.

We need to be acting like this is an emergency, because it is, and not rely on the market to produce a quality offset where no one cares about the quality. Tax emissions over the cap to pay for the externalities. Put a hard cap, like we do on vehicles, and the market will adjust. Stop tax benefits to oil production -- I know we still need petrochemicals for plastics, but not this much.
adding mine

TreeSize (to easily find out what is consuming disk space)

picpick/ shareX (screenshotting with annotationsand autosave)

pdftk (pdf merge, split, crop, interleave(

ffmpeg (video trim, split, re-encode, etc.)

Lossless cut (GUI for ffmpeg trim and extract/add tracks)

OpenShot video editor (when DaVinci Resolve is too much for the job and you need simple edits and effects)

OBS Studio (screen record, stream to youtube)
Iirc it is blocked in Italy
Ha yes. I rely on cloud-provided security groups for that. So I blindly have to believe my provider is immune to supply chain attacks.
Just ask the penetration testers and offensive researchers if there is any company they and everybody they know can not breach. Anybody who can not protect against even commercial attacks like that is hopeless against state actors. You are correct that you will find all the standard cybersecurity companies in that hopeless pile.

As for how you can evaluate on your own, look for positive evidence of security, not the absence of negative evidence. The standard belief is that everything is easy to hack, just ask literally any programmer, any claim of security is a extraordinary claim. It is a mystery why everybody then gets amnesia when a company claims to protect you and not only fails to present extraordinary evidence for such a extraordinary claim, but no evidence at all beyond marketing fluff.

Demand positive evidence of protection from state, or at the very least moderately funded commercial, attackers. Serious penetration tests by teams of professionals with months to work on it that consistently fail to find any entry. That is a good starting point. Any proof less than that fails to even meet the standards of ordinary evidence, let alone extraordinary.

If you want to go further you can look for design audits, formal specifications, and formal proofs as demanded by certification standards like the SKPP.

In contrast, certainly ignore any certification or certification level that consistently certifies known garbage like the aforementioned cybersecurity companies. A bar that consistently passes garbage is not a certification worth a damn.

Anybody presenting a option that does not meet those requirements should be soundly ignored until evidence is provided. And yes, that applies even if nobody reaches the minimum bar. You do not claim somebody has cured cancer just because they are the best so far. You do it when they cure cancer.
This is something that should have unit/integration tests inside the tooling itself, yeah. If your assertion is that X function is called / in the environment X then the function should return Y then that should be a test especially when it’s load-bearing for security.

And tooling is no exception either. You should have tests that your tooling does the things it says on the tin and that things happen when flags are set and things don’t happen when they’re not set, and that the tooling sets the flags in the way you expect.

These aren’t even controversial statements in the JVM world etc. Just C tooling is largely still living in the 70s apart from abortive attempts to build the jenga tower even taller like autotools/autoconf/cmake/etc (incomprehensible, may god have mercy on your build). At least hand written make files are comprehensible tbh.
Link provided by OP gives a 404. Corrected link:
https://www.dw.com/en/eu-romania-and-bulgaria-join-schengen-...
For those who don't know, Quanta Magazine is financed by Jim Simons (from Chern-Simons theory) who became known as a very successful hedge fund manager. I just love the idea that he's using a portion of his billions to fund a little non-profit math magazine.
For now, I'm still using OCRmyPDF as it maybe slow but incredible usefull.

The files become big but it just works.

If an alternative is quicker / lighter I will use it but it must just works.
math, science, and engineering research is state supported

As to not paying a fair share: I, for one, would be perfectly happy if the open source world retreated back into geekiness; needing to RTFM constitutes a proof-of-work, a non-monetary cost that I'd guess many potential exploiters would not be willing to pay.