skysight-inc/HackerNews huggingface dataset:
Wow, this is promising. I tried on a few poorly scanned papers I've lying about. A few observations:

1. Pre-process PDF images to detect letters better?

2. Use LLMs to spell/grammar check and perhaps even auto-complete missing pieces?

3. Employ rich text to capture style (ex: lexical.dev)?

Unsure if it is feasible to bundle it all up for web.

See also: https://github.com/RajSolai/TextSnatcher / https://github.com/VikParuchuri/surya
Thanks the simplified explanation and noisy image comparison is quite appreciated. It gives me a good grasp of what people mean by the sophistication involved.

I also saw a comment on reddit mentioning that the "sandboxing" method was sabotaged with a dot. It's on the line just after "#include <sys/prctl.h>" you can see a dot all the way on the left.

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2...

https://old.reddit.com/r/linux/comments/1brhlur/xz_utils_bac...
No, and there is a (piloted) drone attack in the first book -- Paul is attacked by a hunter-seeker.

The reason nobody tries to use the lasgun-shield interaction as a weapon is because the resulting explosion is indistinguishable from a nuclear weapon, and the Great Convention prohibits the use of nukes on human targets.

Just the perception of having used a nuclear device would result in the House which did so becoming public enemy #1 and being eradicated by the Landsraad and Sardaukar combined.
> Frankly the US pays for the cost of the research while the rest of the world just pays for the cost of production.

Oh come the fuck on, this has been the talking point since the early 2000's. Surely nobody still believes this horse shit. Phizer by itself raked in 50 billion last year alone.
> ... the practicalities of the rental process itself (picking up and delivering the car becomes its own full trip on its own, not to mention all the paperwork involved).

Check out Getaround or Turo. In major cities there's zero paperwork, the keys are in the car, and the car is parked in a parking lot a short walk from where you already are. They're very cheap and you can rent by the hour. There's a getaround parked in the white zone in front of my apartment building that's $53 per day.
congratulations, the RCs were quite stable so it should work well for all!
No such law here in the states, just a political atmosphere where some people adore the idea of socialism and others see it as the coming of the end of times. Combine that with a highly complex industry structure that’s been entrenched for decades, and you end up in a situation where it’s near impossible to pass laws that actually structurally change our system.

(It’s almost the opposite, in fact, where our courts have expanded the Commerce Clause over time to allow the federal government the ability to regulate close to any economic activity.)
See, this is why I retired early from software engineering
From TFA's profile:

https://bsky.app/profile/filippo.abyssdomain.expert/post/3ko...

This is a profound realization, isn't it? How much more paranoid should/will maintainers be going forward?
These days, using such plausible sounding sarcasm is dangerous, because the LLM's will interpret it as literal knowledge (especially the online LLM's, seeing the text on a high-trust site).
That is far too shortsighted - its a perfect propelant for in space propulsion - the best we know of right now:

https://en.wikipedia.org/wiki/Project_Orion_(nuclear_propuls...

Also there are much more eficient ways to use a fusion bomb, than destroying cities:

https://en.wikipedia.org/wiki/Nuclear_shaped_charge
Yeah, IMO, sourceforge and github never competed. Sourceforge was a place to host installers for windows shareware. Github basically created its own market. It was really competing with the millions of private SVN servers. When git became the new hotness, anyone who researched it realized they could just use github instead of having to stand up their own git server. It was a zero cost trial of git, and basically everyone chose git over svn and just stuck with github.
Mom is on fixed income. Landline is minimum 105 US a month around here.
Many airports in the states already employ full time dogs to clear birds.
We wouldn't have to change the structure of the project to ensure that everyone is trustworthy.

As for applications beyond the core system, that would fall on the individual organizations to weigh the risks. Most places already have a fairly limited stack and do not let you install whatever you want. But given that the core system isn't optional in most cases, it needs extra care. That's putting aside the fact that most projects are worked on by big corps that do go after rogue employees. Still, I would prefer if some of the bigger projects were more secure as well.

Your "mindset" is basically allowing bad code into the Kernel and hoping that it gets caught.
> Apple M1 SoC support, e.g. the M1 Mac Mini.

AsahiBSD soon?
It’s even riskier than VC, because the capital requirements in pharma per venture are _significantly_ higher.
You need to in order to get it re-sold if the exec listens to their people at all, even if they buy into the sales pitch for the initial sale.
Might depend on how much you sweat and the climate where you live. I personally change every week during summer but fortnightly during winter.
Yep, this was why as a kid we kept our landline even after we all got cellphones: Old-fashioned landlines were more likely to still work during a power outage.
And Novo Nordisk contributed back to society. By a lot. Large part of earnings goes to Novo Foundation, which is used to help people in Denmark and make it to a nicer country for people (even though its already amazing country).
What other business exist to "serve their community"?
My Ideal Libre Computer+Phone
> lEEt/OS combines the good things from DOS and UNIX into one.

What are the "good things from DOS"?
(a) I spent many years on the Mozilla bugzilla, and it's far too complicated

(b) you still have to create an account there
For any fixed compression scheme, there is an input string that is actually lengthened by it rather than shortened.

However Huffman isn’t a fixed compression scheme since it makes a different frequency tree for different corpora.
IrfanView is great, but I'm curious, why is it on top of HN today of all days? Was there something significant happening?
Apples to oranges comparison. Revenue to GDP is better.

Novo Nordisk $35 billion in revenue.

GDP of Denmark:$400 billion.

Their revenue is roughly 9% of GDP.
Agreed- I come from a Java/C++ shop where we tried to tackle this dichotomy with interop but it ended up causing more problems than it solved. A lot of the work that Java has done with modern garbage collectors is impressive, but even they admit (indirectly, via Valhalla) that no/low-alloc code has it's place.
Terminal app to create optimized videos for the web [not mine]
So now we moved the goal post from preserving the communities memory to beating other companies at SEO?
I'll bite.

Real-time tracking of a person or their ground transport: not ok.

Real-time tracking of a person's plane: ok.

And the reason for such a distinction is that planes can only land on specific ground slots. That also means that real-time tracking of a person's helicopter falls under "not ok". And by extension, the same will hold for flying taxis, once they take off[tm].

We don't (yet?) live in a world where shoulder mounted surface-to-air missiles, outside of war zones, are a realistic threat.
That is discussed extensively in the linked article.
MIT Launches Working Group on Generative AI
This sounds intuitively true. So...what if GC languages could introduce an optional annotation for an object to say that only one reference to it can exist, and use that as a hint to the GC?

I don't see how this could be implemented in a safe and performant way - either you check for existing references at runtime, or you risk some use-after-free bug. But perhaps your project is already in a GC language and you're happy with that, but just want to optimise GC for this critical component. And we already have the concept of "unsafe" code blocks in many languages.

Does anything like this exist? I Googled "smart pointers in Java" but just got a bunch of mid-quality answers where people explained that I'm stupid for even asking this and they're unnecessary because Java manages its own memory. But hasn't someone smarter thought of this?
One have question on this is, if the backdoor would not been discovered due to performance issue (which was as I understood it purely an oversight/fixable deficiency in the code), what are the chances of discovering this backdoor later, or are there tools that would have picked it up? Those questions are IMO relevant to understand if this kind of backdoor is the first one of the kind, or the first one that was uncovered.
The history of insulin shows a great deal of involvement and progress made by researchers in several countries, and the US would probably not even rank as first among them.
This is a fantastic lay person explanation of how it works. https://jsomers.net/e-coli-chemotaxis/
If it's the same, then some people here posted really bad videos of it ;)

FWIW, my wife is tiny (160cm) and still does the reverse grip method
Is the person Jia who did this PR a malicious actor?
It's called keeping integrity on not disclosing private info any users from your network, regardless whether they are bad actors.

I respect them for that.

Violating that code is just as bad as the bad actor slipping backdoors.
intel drivers: https://sourceforge.net/projects/e1000/
I guess I’ve been lucky in which duvets and liners I have met in my life. Only time I’ve met opposition is with flannel covers, but those are just horrible in all other ways except for starting fires.
free() gives back memory to your local POSIX. :)
It's faster to load images
Why give anyone any permission you can deny? Why build wind turbines that "ruin the view" either?

That kind of extreme NIMBY attitude would have us living in caves if it wasn't for the other side. The worst of it is that it just attacks what is honest and visible the first, encouraging dishonesty and secrecy because stuff like this would never actually come to hurt you in any tangible way. I hope you come to realize that.
Didn't intend to be aggressive. I was just wondering what you were getting at.
Wish they could plant some random crops like potatoes and corn to the mix. And a healthy barrier to prevent wildfire from destroying all their work.
p99.9 referring to latency. However, we also do a weekly test of how quickly we recover from a catastrophic crash, which is roughly about 6 minutes (which is the amount of time it takes for the autoscaling group to spin up a new host, Litestream to restore the database from s3, and the server to start up again).

Honestly, 99.9% uptime is pretty generous - we can fit in quite a few catastrophes per year and still have 99.9% uptime. In the 2 years this service has been running, we've had 100% uptime via zero-downtime deployments, anyway.

In terms of monitoring, traces and error logs are shipped to our observability solution, yes.
easy there. calling the cops on the NSA might be treason or something
Someone should write a book called Household Chores for Hackers: The algorithms your mother took for granted and forgot to teach you.
I've been interested to try out (Net|Open|Free)BSD for a while. I mostly code and compile C code. What should one expect when going from Linux to either of these BSD systems?
>This is a diabetes drug.

It was developed as a drug that increases insulin response, but it also appears to have a substantial impact on CNS processes controlling food cravings and other types of desire.

Given that, it’s possible we’ve stumbled upon the mechanism responsible for genetic differences in how we put on weight, whether that’s appetite, metabolic differences or both.
Why Are Older Americans Drinking So Much?
It's definitely doable. I was at Google circa 2006, pre Spanner, with sharded MySQL. Ads ran on top of it. It was a pain.

And yes, there are many tricks like having more logical shards than physical ones, collocating tables by the same shard_id, etc. It's still difficult. You need tooling for everything from shard splitting (even if that is just loving a logical shard), to schema migrations, not to mention if you end up needing cross-shard transactions or cross-shard joins.

Generally, you'd need a team of very strong infrastructure engineers. Most companies don't have the resources for that. There are definitely some engineers out there that could whip this all together.
And once you do connect with a peer, peers can maintain DHTs of other peers and you can have a true mesh network where you signal over WebRTC itself.
> Doesn't everybody know that developing/maintaining free software is largely thankless work, with little to no direct recompense?

No I don't think that is a universally acknowledged feeling. Numerous maintainers have detailed recieving entitled demands from users, as if they were paying customers to the open source software projects. Georges Stavracas' interview on the Tech over Tea podcast^1 describes many such experiences. Similarly, when Aseprite transitioned its license^2 to secure financial stability, it faced backlash from users accusing the developer of betraying and oppressing the community.

On the flipside, if everyone truly does know this is the case, then it's a shame that so many people know, and yet are unwilling to financially support developers to change that. See all of the developers for large open source projects who have day jobs, or take huge pay cuts to work on open source projects. I get that not everyone can support a project financially, but I've personally tried to break that habit of expecting everything I use to be free, and go out of my way to look for donation buttons for project maintainers, and raise awareness during fundraisers. Now if only I could donate directly to Emacs development... I'd encourage other people to do the same.

> What you want is more people that understand and care about free software and low barriers to getting involved.

This is tough. For example, the intention behind initiatives like DigitalOcean's Hacktoberfest, are designed to do just this. It is a good idea in theory, submit 4 pull requests and win a tshirt, but not in practice. The event has been criticized for inadvertently encouraging superficial contributions, such as minor text edits or trivial commits, which burden maintainers^3, causing many maintainers to just archive their repos for the month of October.

So, while there's a recognition of the need for more people who understand and value free software, along with lower barriers to entry, the current state of affairs often falls short. The path forward should involve not just increasing awareness and participation but also providing meaningful support and compensation to maintainers. By doing so, we can foster a more sustainable, secure, and vibrant open source community. Or at least that is how I feel...

1. https://www.youtube.com/watch?v=kO0V7BE1bEo
2. https://github.com/aseprite/aseprite/issues/1242
3. https://twitter.com/shitoberfest?lang=en
Well, the worst that could happen is that you get banned. But then you can make new accounts and so it goes.

Basically the same approach as that of any crypto scam promoter. Except, the content is different.

The content justifies the approach, right? So whatever.

No content is ever inappropriate for any site no matter what the feedback from the community; as the saying goes, "if you just throw enough shit at a wall, some of it will stick".
It doesn’t work on my Intel Macs unless it’s really slow.
The aid does not get where it was intended, is not distributed evenly, or is distributed to people who intend to resell it.

Same reason that hoarders are a problem in a disaster and rate limits often need to be placed on consumption.
Excellent point. I believe that's coming from corporate supply chain attack "response" and their insistence on making hard rules about "currency" and "activity" and "is maintained" pushes this kind of crap.

Attackers know this as well. It doesn't take much to hang around various mailing lists and look for stuff like this: https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...

> (Random user or sock puppet) Is XZ for Java still maintained?

> (Lasse) I haven't lost interest but my ability to care has been fairly limited mostly due to ...

> (Lasse) Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. It's also good to keep in mind that this is an unpaid hobby project

With a few years worth of work by a team of 2-3 people: one writes and understand the code, one communicates, a few others pretend to be random users submitting ifunc patches, etc., you can end up controlling the project and signing releases.
That sounds bad. Is it on any old shareware sites ?
Wait, open source maintenance is a matter of national security? Always has been.
No mention of Coober Pedy.
Related question: what method do you use to keep the duvet in place inside the cover?

I have some animal themed safety pins that my parents used on my duvet since I was a child. I put four of them in a square shape around the middle of the cover when the duvet is inside.
First of, I think that health-care prices in the US are horrible and have terrible consequences for patients

However, the blame doesn't lie with pharmaceutical companies. They're not selling their products cheaper elsewhere because they hate the US and love other countries

They're doing it because the US has created a system that benefits corporations more than its citizens. If blame needs to be distributed it lies with the people in power who built these systems and those who gave them that power

Healthcare in Europe is cheaper because the population fought for it, sometimes literally
Yea babyyyy I've been waiting for this release. I've been eager to fire it up on my Thinkpad.
IMO, the Gitlab interface is better than github for most of the actual code features. Github still doesn't have a graphical tree view of the commit history. Hell, even the git CLI has that.

The only thing I like better about Github is the dashboard for managing MR's/issues/notifications. Gitlab still hasn't managed to figure that out. Gitlab CI was also miles ahead of Github CI for a long time. Github is better now, but CI is one of the few things that really locks you into a vendor. Plus, Gitlab had much better enterprise pricing options for a long time. I'm not sure what it's like now. I don't have any numbers, but I suspect that Gitlab has more market share when it comes to locally hosted deployments.
lovely answer, thanks so much! hope others learn too.
It comes up here in NZ every few years, as there is frustration that we aren’t paying as much as the drug companies would like. The US leaned on us hard to scrap our single payer system.

This sympathy for these massive companies in this thread depressing. Big Agg and Big Tech don’t get this free pass.
This ancient text is tiring, it is almost word for word what has been posted over the past 20 years. You did not even bother to update the numbers or change the wording.

You have the honor of getting my 2nd down vote.
Curious why you needed to shard at 7TB? I can imagine for some workloads, especially if it's write-heavy, you might start hitting constraints around vacuuming and things like that? But 7TB should be manageable on a (somewhat large and beefy) single machine.
Push their expiry date as a UNIX timestamp to whatever TSDB you use and hook up an alert for when it gets close.
I expect a lot of people will be doing a whole lot of thinking along these lines over the next months.

Code review? Some kind of behavioral analysis?

IMO the call to system() was kind of sloppy, and a binary capabilities scanner could have potentially identified a path to that.
That's against US law. The US has innovated the laws that make NN profits possible and helped other countries to adopt them.

EU created anti trust laws that makes fining Apple and Google possible.
To be fair to them though, they’re the only browser where you can transfer RTCDataChannels to workers and get that off the main thread. All others are still lagging behind there.
Joy.
While this meme is not traditionally HN worthy, the realization is.

For example, how much more paranoid should maintainers like Lasse Collin be going forward?[0] Would paranoia have even helped in this case?

What are the other self-regulation implications of the xz backdoor? Is autotools done for?

[0] https://news.ycombinator.com/item?id=39874942

https://news.ycombinator.com/item?id=39877267

https://news.ycombinator.com/item?id=39865810
I agree it wasn't obvious FTX would just take all the money, but it was obvious that you could lose all your money.

"The very first Bitcoin exchange, Mt. Gox, collapsed in 2014". Different reason, similar outcome.

And Bitcoin was down 2/3 from peak when FTX collapsed. Close to losing it all. And enough doomsayers to know any gambler was running that risk.

And countless prior examples in lots of markets showing that speculation in risky assets is very risky!

You often don't know the specifics of why something is risky, so even if a particular outcome was unlikely, that doesn't mean an investment was "savings".
Thanks for the clarification! :)
Could you explain how SELinux could ever sandbox against RCE in sshd? Its purpose is to grant login shells to arbitrary users, after all.
> cool since it allows verifying the signature without out of the band key delivery

hope you do key selection sanitization instead of the default (nobody does). otherwise you're accepting random keys you have laying around (like github) when logging to secret.example.com
Containers don't really increase attack surface, it's all stuff provided by the OS anyway. Docker just ties it all together and makes things convenient.
(noun Explicit) (verb is) (adjective better) (conjunction than) (noun implicit).
Consequences are natural, punishments aren't.
Landlines also have greatly better sound quality. Having a conversation is so much nicer when both ends are on a landline.
My impression from Rust/LLVM bugs is that LLVM is only a C++ compiler, except where people complained long and loud enough.

Rust had to add patches to support optimization of Rust allocators (not just malloc and new). Ran into several bugs in mutable aliasing that doesn’t exist in C++ and is very rudimentary in C. Spent seven years fighting with miscompilations due to a C++ rule that infinite loops are UB. Had to implement custom float to int casts to avoid C UB, and so on.
Expect to configure your drivers manually and poor support for sleep on more recent devices. Otherwise, it’s pretty great!
Poor driver support, poor performance, lots of manual editing of config files to accomplish routine tasks, but BSD is "more cohesive" according to most of its proponents.
> It's not like we're hitting a wall with quadratic attention. It's absurdly more expensive than SSMs, but GPUs certainly aren't getting slower.

We are not hitting a wall, but a slope. Hardware improvements will not make up for it indefinitely. Software will have to make up for it, but the problem is that it costs millions of dollars to hit compile.
And ranger rolling your t-shirts:

https://www.youtube.com/watch?v=fuD-ZZydsVg
> I do wonder how much of this taboo has been cultivated by corporations that benefit from workers feeling like they shouldn't talk about salary.

I don't know if corporations originated the taboo, but they absolutely cultivate it so that they can retain the upper hand in salary negotiation, enabling them to pay below-market wages to everyone except for new hires with multiple offers.

There is an unfortunate cultural problem where people are morally valued by how much money they make. Pay is often very disconnected from economic benefit (consider the enormous economic value produced by underpaid teachers, or grad student researchers) and nothing to do with moral value.