skysight-inc/HackerNews huggingface dataset:
I had a very easy time selling this. We moved away from an OpenVPN setup, and Tailscale made it so much easier to onboard new employees and to do a lot more things “the right way”. We’re a fully remote company, so it’s even more important.

Although I admit that in my role I have quite a lot of weight in convincing management on these topics, price was not a concern.

We’ve been a happy customer since April last year, everyone on the premium / “expensive” tier. I’m also very impressed with their development speed: some features that were said “May take a few years to be delivered” actually were delivered last year already.

Cloudflare One could have been an alternative, but that would have been even more expensive.
What's crazy is just how terrible the globalist neoliberal political agenda and the mindless cookie cutter politicians they produce everywhere have been, that people are thoroughly fed up and are looking for alternatives, no matter how bad.
I've loved books that have won lots of awards and recognition that I only read cause it was part of a curriculum, but it's perfectly reasonable to also not connect with some of them.

I read almost exclusively fantasy and have always loved reading since I was young. Fantasy series are often trilogies or more with some being over 10 books long.

You go on adventures, read about relationships, interpersonal problems, power, team work, individualism, religion, and so much more. While it's mostly what I read, it's not all, but it keeps me reading.
my dear guy, you really need to spend some time this year and learn economics and i dont say this in a vile or mocking way but you will understand why a burger flipper cannot making 1000$ per hour unless everyone else is making 2000$ per hour after you finish an economics course
Amusing segfault in 10 lines of Modern C++ with RAII:

#include <iostream>
#include <memory>

int main(int argc, char* argv[]) {
auto s = std::make_unique<std::string>("hello");
std::unique_ptr<std::string> s2 = std::move(s);

std::cout << *s << std::endl;
return 0;
}
this is a good article, but this part near the end is a bit off:

> ...as a market matures, solutions become specialized and modular. We've already seen this begin to happen in a few areas of "social coding." Jira and Linear offer modular issue tracking, while Jenkins and Buildkite offer modular CI solutions.

Those modules existed a long time before GitHub. Bugzilla was an issue tracker in the 1990s. Popular CI tools like Jenkins and Travis launched around 2010 while GitHub Actions didn't exist until 2018.
I was biased to have negative opinions of many books simply because I was 'forced to read them in school'.

It was only many years later when I chose to read them that I could appreciate their quality.
Can confirm. I may work at Meta, but I was nearly banned from contributing to an open source project because my commits kept introducing bugs.
I strongly disliked Morrison's books when I read them, though I'll happily concede they're expertly written.

Some fiction books I've read as an adult and appreciate:

Gone with the Wind, Fields of Fire, American Psycho, The Turn of the Screw, Anna Karenina

Some from school:

To Kill a Mockingbird, The Great Gatsby, Frienheit 451, Moby Dick, Brave New World

Some of the more pop fictiony:

American Gods, The Stand, His Dark Materials, A Song of Ice and Fire, Imajica
Reminds me of Andrej Karpathy. When he was developing AI for Tesla. Car-Path-y
Perhaps this is not unlike how many of my friends and colleagues questioned why I chose to visit places like Auschwitz while I was on vacation in Eastern Europe. I try not to limit the books I read, films I watch and places that I visit to those that aren’t intellectually and/or emotionally challenging and difficult. Or maybe I’m just weird.
Disclosure: I've got zero C/C++ on my resume. I was asked to diagnose a kernel panic and backport kernel security patches once, but it was very uncomfortable. ("Hey, Terr knows the build system, that's close enough, right?")

That said, perhaps something like disabling the default -fextended-identifiers [0], and enabling the -Wbidi-chars [1] warning.

[0] https://gcc.gnu.org/onlinedocs/gcc/Preprocessor-Options.html...

[1] https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#inde...
"On the other is a rejection from Morrison, sometimes brusque yet typically offering something more than an expression of disinterest—notes on craft, character development, the need for more (or less) drama. But also: Autopsies of a changing, and in many ways diminishing, publishing industry; frustrations with the tastes of a reading public; and sympathies for poets, short story writers, and other authors drawn to commercially hopeless genres."

This is a beautiful way to soften the blow of rejection and turn it into an opportunity for growth. I wish the modern tech equivalent of a rejection letter could include the same kindness ("Thank you for your interest ... We regret to inform you ... After careful consideration, we are not moving forward"). I've managed/founded, so I fully understand how much liability this opens the company up to, but I still mourn the loss of this small kindness.
Every school library in the US has 120 copies of this book. I'm just wondering how many non-school / library buyers there were. If her success is government-mandated, it can easily be discounted.
More like and error Buzz McAlister would make when describing how boring the street he lives on is.
In addition… if your build system has things like this as OK:

> xz -dc $top_srcdir/tests/files/$p | eval $i | LC_ALL=C sed "s/\(.\)/\1\n/g" | LC_ALL=C awk 'BEGIN{FS="\n";RS="\n";ORS="";m=256;for(i=0;i<m;i++){t[sprintf("x%c",i)]=i;c[i]=((i*7)+5)%m;}i=0;j=0;for(l=0;l<8192;l++){i=(i+1)%m;a=c[i];j=(j+a)%m;c[i]=c[j];c[j]=a;}}{v=t["x" (NF<1?RS:$1)];i=(i+1)%m;a=c[i];j=

You should probably expect the potential for abuse?

We’re moving towards complexity that is outpacing human ability for any one person to understand, explain, and thus check an entire object.

And for what? Build efficiency? Making a “trick” thing? When was the project ever going to go back and make things simpler? (Never)
With a desktop environment and everything?! I had no clue, I'd love to see a demo or at least feature chart
The author overestimates the public’s willingness to go to humboldt. It’s a far-too-long drive from absolutely everywhere.
For reference, is it safe now to drive yourself from Antigua to Guatemala City at night? That used to be a dicey proposition.
I didn't remember what the IrfanView license was/is but IrfanView is not cross-platform which is what I was responding to with an alternative.
I would love to hear your thoughts on it.

I personally just finished Knausgaard (in English, my Norwegian is lacking) and am currently reading Pussy, King of the Pirates by Kathy Acker as a light follow up.
You can set reasonable price benchmarks to define "shortage" by.

Your definition of shortage is too narrow. Price is always able to select a buyer. People will skip eating if you give them enough money. But if that only supplies a couple percent of buyers, that's not going to disprove a shortage.
GraphQL seems like a great idea if you're a massive social media company looking for ways to empower devs to stamp out flavor of the week social media widgets without being tied to existing APIs. I'd bet most companies doing GraphQL are just doing uncacheable things that REST APIs could do fine.
You don’t get paid to write code. That’s a means to an end. You get paid for adding value to the business, solving problems, and multiplying the overall effectiveness of your team and the organization.

Taking a narrow view of what you can or should be doing — “that’s not my job” syndrome — is a sure way to get stuck in the lower rungs and feel like you don’t make a difference.

The programmers who mainly think their “productivity” depends on removing “trivial” things so they can focus on themselves and “DX” are hunting for jobs right now. Employers are getting wise to that nonsense. Productivity is not the goal, adding business value is.
If you want to hop into a rabbit hole, try taking look in Steam's login send the user and pass))

If TLS break then all is untrusted anyway! If you read hash as MITM you can replay it as pass equivalent and log in with hash, do not need knowledge of the original pass. You can just inject the script to exfilatrate original pass before hashing. CSP is broken, since you can edit header to give your own script a inline nonce. I think everything is reliant on TLS in end.

I think 10yr ago before TLS was 99%+ standard on all sites many people would come up with schemes, forums would md5 pass client side and send md5, all sorts were common. But now trust is in TLS.
The short version is “Large fast-food chains” – (the definition in the law restricts this to large chains) – “are plagued by a bunch of common pervasive issues, including wage and hour violations, and are structured in a way that is an effective hack around the normal method of accountability for violations, so industry-wide regulation of wages, working conditions, etc., with representation of the industry, franchisees, workers, and worker advocates, and the non-industry-affiliated public has been deemed necessary, with an initial industry-specific boost in minimum wages attached to that.”

The longer answer is…well, research the history of the California FAST Act, which this updates/replaces, and AB 1228/2023 (the law here), and the negotiations by which the industry referendum against the former was withdrawn in exchange for the rewrite of the latter that was then adopted.
It's not defeatist to admit and accept that some things are ultimately out of our control. And more importantly, that any attempt to increase control over them comes with downsides.

An open source project that imposes all kinds of restrictions and complex bureaucratic checks before anything can get merged, is a project I wouldn't want to participate in. I imagine many others might feel the same. So perhaps the loss from such measures would be greater than the gain. Without people willing to contribute their time, open source cannot function.
> That arrangement is deemed a “misconfiguration” by that provider, and we’ve been receiving alerts about it since rolling it out

So 90 days of alerts about certs, and then certs fail?
Runtime syscall number detection is very common in practice, since the kernel returns ENOSYS to enable that exact ability for glibc and other shim libraries
This appears to be the entire program:

https://americanarchive.org/catalog/cpb-aacip_394-65h9wd4r
Honestly this is why I think we should pay people for open source projects. It is a tragedy of the commons issues. All of us benefit a lot from these free software, and done for free. Pay doesn't exactly fix the problems directly, but they do decrease the risk. Pay means people can work on these full time instead of on the side. Pay means it is harder to bribe someone. Pay also makes the people contributing feel better and more like their work is meaningful. Importantly, pay signals to these people that we care about them. I think the big tech should pay. We know the truth is that they'll pass on the costs to us anyways. I'd also be happy to pay taxes but that's probably harder. I'm not sure what the best solution is and this is clearly only a part of a much larger problem, but I think it is very important that we actually talk about how much value OSS has. If we're going to talk about how money represents value of work, we can't just ignore how much value is generated from OSS and only talk about what's popular and well know. There are tons of critical infrastructure in every system you could think of (traditional engineering, politics, anything) that is unknown. We shouldn't just pay things that are popular. We should definitely pay things that are important. Maybe the conversation can be different when AI takes all the jobs (lol)
Commits had a UTC +8 timestamp, so most likely China or possibly Russia unless Australia or Taiwan decided to do something really weird. Probably not DPRK.
This was the backdoor we found. We found the backdoor with performance issues.

Whats more likely - that this is the only backdoor like this in linux, or that there are more out there and this is the one we happened to find?

I really hope someone is out there testing for all of this stuff in linux:

- Look for system() calls in compiled binaries and check all of them

- Look for uses of IFUNC - specifically when a library uses IFUNC to replace other functions in the resulting executable

- Make a list of all the binaries / libraries which don't landlock. Grep the sourcecode of all those projects and make sure none of them expect to be using landlock.
Yeah because the internet didn't exist.
> There need to be tighter policies around what dependencies are included, ensuring that they meet some kind of standard.

This is why it's a good practice to minimize the amount of dependencies, and add dependencies only when absolutely required. Taking this a step further, doing a cursory review of each dependency, seeing the transitive dependencies it introduces, are also beneficial. Of course, it's impractical to do this for the entire dependency tree, and at some point we have to trust that the projects we depend on follow this same methodology, but having a lax attitude about dependency management is part of the problem that caused the xz situation.

One thing that I think would improve this are "maintenance scores". A service that would scan projects on GitHub and elsewhere, and assign a score to each project that indicates how well maintained it is. It would take into account the number of contributors in the past N months, development activity, community size and interaction, etc. Projects could showcase this in a badge in their READMEs, and it could be integrated in package managers and IDEs that could warn users if adding a dependency that has a low maintenance score. Hopefully this would disuade people to use poorly maintained projects, and encourage them to use better maintained ones, or avoid the dependency altogether. It would also encourage maintainers to improve their score, and there would be higher visibility of projects that are struggling, but have a high user base, as potentially more vulnerable to this type of attack. And then we can work towards figuring out how to provide the help and resources they need to improve.

Does such a service/concept exist already? I think GitHub should introduce something like this, since they have all the data to power it.
Tailscale remains useful when deploying with GitHub actions. Currently, I have my cloud VM open on an unconventional SSH port so that GHA workers can SSH into it and initiate the deployment. I plan to utilize their action [0] so that any GHA worker can access the deployment machine without exposing any ports.

[0] https://github.com/tailscale/github-action
They should be required to pitch into a state monitoring insurance fund as long as the social security number of person who's information leaked, hasnt rotated yet.

Seriously, what good does announcing 2 years of monitoring do, all it does is set a countdown to when somebody with the information knows to start using it.
Hubris is allowed in marketing
Saying the Nintendo Switch is BSD based is a bit of a stretch, Horizon (the Nintendo Switch operating system) runs a proprietary, fully custom microkernel and has some utilities from both FreeBSD and Android.

> Despite popular misconceptions to the contrary, Horizon is not largely derived from FreeBSD code, nor from Android, although the software licence[14] and reverse engineering efforts[15][16] have revealed that Nintendo does use some code from both in some system services and drivers. For example, the networking stack in the Switch OS is derived at least in part from FreeBSD code.[15] Nintendo's use of FreeBSD networking code is legal as it is made available under the permissive BSD licence, and not even particularly unusual – for instance, the Microsoft Windows XP TCP/IP stack was originally derived from BSD code in a similar fashion.

https://en.wikipedia.org/wiki/Nintendo_Switch_system_softwar...
> how they were giving farmers tax breaks to plant forests.

An interesting choice.

It's pretty clear that Ontario's housing problem is directly related to its farmland problem. Southern Ontario farmland values have risen 900% since the United States changed its farm subsidy policies in the 2000s, which allowed farming in Canada to be much more viable.

Farmland being 900% more expensive means that urban areas can't sprawl cheaply like they once were able to, placing much more pressure on existing urban boundaries, thereby seeing the cost of urban housing rise.

If this successfully takes even more farmland out of the equitation, farmers will just pay even more[1] for the remaining farmland, and then urban areas will have to pay even more to sprawl, putting even more pressure on existing urban boundaries, making urban housing even more expensive.

[1] Supply managed diary and poultry producers are effectively given a blank cheque from the government. There is no end to how much they can spend.
No-name phones end up using chipsets/radios from varios manufacturers: unisoc, broadcom, mediatek, rockchip, ...

They can just grab a reference schematic and pcb and tune it a bit and get it manufactured. They all use mostly the same interfaces and protocols, like mipi dsi for lcds, so they can have many almost drop-in alternatives to choose depending on availability.

For printheads, it's likely that there are no common standards, each manufacturer has it's own head-cartridge interface, so it's probably more expensive to remain open to changes, reducing the potential profits
My father used to work for Western Electric which was a part of AT&T each phone had a ringer in it that they counted in your bill and you leased the phones. My father brought back the extra stuff he worked with for me to tinker with. He worked on Bell Labs 1ESS and up minicomputers as switches. He would remove the ringer from a few of our phones so we wouldn't get charged for them.

Remember that the Princess phone had a rotary dial and not a touch-tone, which came later on. I am Generation-X I grew up with the rotary phones and when I was a teenager the touch tones we used.
Code review coverage of popular open source packages
Can we rely on malware checkers from third-party vendors to safeguard against sophisticated backdoors like the one in xz? A rogue maintainer working for years to gain hold over a popular package and then compromising it with backdoors is an underrated threat model. The best prevention for this may be a crowd-sourced code review system.
The paper talks about the lack of code review in popular open source packages and discusses the merits and challenges of introducing a code review coverage metric as a quality control check.
> yo dawg curl this shit and pipe it to sh so you can RCE while you bike shed someone’s unsafe block

Ahhh this takes me back to... a month ago...[0]

At least rust wraps function in main so you won't run a partial command, but still doesn't there aren't other dangers. I'm more surprised by how adamant people are about that there's no problem. You can see elsewhere in the thread that piping man still could (who knows!) pose a risk. Extra especially when you consider how trivial the fix is, especially when people are just copy pasting the command anyways...

It never ceases to amaze me how resistant people are to very easily solvable problems.

[0] https://news.ycombinator.com/item?id=39556047
"enforce political control and nationalistic tendencies of ethnic groups"?

This literally means stop nationalist secession movements. Literally no country on earth basically lets their citizens secede dude. Russians were ALSO the target of such programs.

It's like saying state atheism is uniquely Islamophobic or uniquely anti christian or uniquely antisemitic.

I'm not saying it's not repression. It totally is, but it's not racist.
I used it most when you did. I found it acceptable, but not stellar. I never heard of it losing data. Most of the issues were with people not adapting to it and trying to make it work like the in-house tool it replaced (which was buggy, slow, and did lose data regularly).

But yes, a lot of people didn't like it and just updated it from their separate spreadsheets or whatever on a weekly or monthly basis depending on when reports were generated.
> The US housing market crashed back in 2006 because tech started showing promise ("Web 2.0", mobile shortly thereafter) and the money left housing to buy into the newfangled tech.

This is definitely the first time I’ve read this. Do you have more info on that?
Here: https://assets-global.website-files.com/65ca33870401867f9de4...
> In the most pedantic sense no. Inflation can technically only be created by increasing the money supply artificially.

This is the definition of “monetary inflation” rather than the more common “consumer price inflation” that everyone who isn’t a particular kind of crank means when they use “inflation” unmodified in general use (rather than internally in a very specific academic/research community.)

> However this has a similar effect venue it applies unneeded artificial pressure to a free market.

“Free markets” do not, and cannot, exist in the real world; they are not merely an idealized concept, but actually one that requires assuming contradictory things.

> This is also happens to be easy way to buy votes, using none of your own money, and has been a tried and true political play for many decades.

The long series of advocacy from multiple sides, early legislation, referenda against that legislation, and labor, industry, and government negotiations to reach a mutually tolerable resolution that resulted in this law can be described as many things, but “an easy way” to do anything is not one of them.

(The initial minimum wage increase is a tiny part of the law, whose main function is setting up a new industry regulatory authority with labor, franchisee/restaurant owner, and franchisor/chain owner representation, with general statewide regulatory authority over industry working conditions in the state.)
Well that was cool!
Yeah, I have rerere turned on However, it's not directly beneficial for the process outlined. With what I wrote about you only solve a given conflict at the end of a complete bisect run, not at each bisection point inside a run. The bisect/cherry-pick process is only used to determine whether conflicts do or don't happen at a given upstream commit. Usually you will solve a specific conflict only once, regardless of whether rerere is enabled.
The whole Chinese name and UTC+8 were a cover, as the person apparently was from EET
Make absolutely sure to include `-a` so it doesn't nuke your env file, and generally speaking, one should upgrade to a version without the malicious code and restart, of course.
AI Agent for code quality pipelines automation
> I had noticed UTC+0300 commits in the repository under his name but I believed they might have been simply committed by the main Finnish maintainer who is in the UTC+0300 timezone.

There was this one though where they are the author and committer... one in +0300, the other in +0800:

commit 3d1fdddf92321b516d55651888b9c669e254634e
Author: Jia Tan <jiat0218@gmail.com>
AuthorDate: Tue Jun 27 17:27:09 2023 +0300
Commit: Jia Tan <jiat0218@gmail.com>
CommitDate: Tue Jun 27 23:56:06 2023 +0800

The time between writing the file and the commit is 89 minutes.
Odd Structural Similarities Between the Human Brain and the Universe
I agree with pretty much everything you’ve said. However, do you think that within most organizations there are workflows that could be made more efficient? That’s where I find some disagreement with your last point. By removing what’s seen as trivial, the focus shifts more towards the overarching goal of adding value, which, for most programmers, is often about shipping or refactoring code.