skysight-inc/HackerNews huggingface dataset:
It is generally harder to introduce vulnerabilities in readable language even more when it is memory safe. Sure life is not perfect and bad actors would have found a ways to inject vulnerabilities also in Rust, Go codebase. The benefit of modern languages is that there is one way to build things and the source code is the only thing that needs to be auditted.
Ross Anderson, professor and famed author of 'Security Engineering,' passes away
Disclosed backdoor in xz releases – FreeBSD not affected
Porting the GCLC to the Web
Reminds me of the "Exact Instructions Challenge" videos where kids write instructions for some everyday task - like making a PB&J sandwich - and parents, hilariously, follow the instructions verbatim.

https://www.youtube.com/watch?v=cDA3_5982h8&list=PL2tgThFV6O...
> This is an area where MySQL is so significantly better than Postgres (because so many large Internet companies use MySQL) that it surprises me people aren't more unhappy with the state of things.

I’m not sure precisely what you mean by “HA”, but, in my experience, out-of-the-box support for the most basic replication setup in MySQL is pretty bad. Just to rattle off a few examples:

Adding a replica involves using mysqldump, which is, to put it charitably, not a very good program. And the tools that consume its output are even worse!

There is nothing that shops with MySQL that can help verify that a replica is in sync with its primary.

Want to use GTID (which is the recommended mode and is more or less mandatory for a reasonable HA setup)? Prepare for poor docs. Also prepare for the complete inability of anyone’s managed offering to sync to an existing replica set via mysqldump’s output. RDS will reject the output due to rather fundamental permission issue, and the recommended (documented!) workaround is simply incorrect. It’s not clear that RDS can do it right. At least Azure sort of documents that one can manually real and modify the mysqldump output and then issue a manual API call (involving the directives that you manually removed from the dump) to set the GTID state.

Want point-in-time recovery? While the replication protocol supports it, there is no first-party tooling. Even just archiving the replication logs is barely supported. Postgres makes it a bit awkward, but at least the mechanisms are supported out of the box.

But maybe the new-ish cluster support actually works well one it’s set up as long as you don’t try to add managed RDS-style nodes?
What law do you think is being broken here?
Off topic from the solver, which is neat to read through - I’m still a big fan of this game. Looks like I’ve played 33 days of the past ~40 days. My only critique is that the UI design of the end state could be improved. Lots of very small fonts.
This is what I did for a daemon I'm maintaining. Type=notify support was requested but I'm really allergic to adding new libs to a project until they really do some heavy lifting and add enough value. I was pleasantly surprised the protocol was that simple and implemented it myself. I think systemd should just provide a simple standalone reference implementation and encourage people to copy it into their project directly. (But maybe they already do, I did that almost a decade ago IIRC when the feature was relatively new.)
To add to that: Because leaving for vacation one day before school ends and returning one day after school resumes is often not even half as expensive as lining them up.
Xiaomi releases electric car $4K cheaper than Tesla's Model 3
Yes! I was overjoyed when they delivered The Car That Doesn’t Depreciate But Actually Appreciates With Time Instead
You should probably not be running your own publicly-accessible ssh servers if this email is not sufficient to at least start figuring out what your next actions are.

The email itself comes with an evaluation script to figure out if anything is currently vulnerable to specifically this discovery. For affected distributions, openssh servers may have been backdoored for at least the past month.
Wild, in development incremental linker
Google Allows Wallet Balance Searches on Bitcoin, Avalanche, Polygon and Others
Has anyone done a comparison of how much California collects per capita in tax revenue from property tax versus other states like New York and Texas?
For example, in NY they used assessed value which is an often a small fraction of actual value- sometimes around 10%. In Texas, assessed value is often frozen/ lagged from market values as real estate transactions are not reported to the tax bureau.
It might be worth considering just how much other physics could be done with these resources. Improve education and experimentation for many other investigations instead. There is still much to learn about fluid dynamics, the chemistry of water, alternative plastics, and many other open questions. The vast amounts of resources poured into exotic reactors could educate many more physicists, launch many more satellites, and operate many more laboratories. Moving forward with very large projects may effectively starve out other investigations that might ultimately have far more practical applications. In some ways this proposal seems more like a lack of imagination than a positive surplus of imagination.
Actually I prefer no comment if you have no arguments:

"While I'm on the topic of concurrency I should mention my far too brief chat with Doug Lea. He commented that multi-threaded Java these days far outperforms C, due to the memory management and a garbage collector. If I recall correctly he said "only 12 times faster than C means you haven't started optimizing"." - Martin Fowler

https://martinfowler.com/bliki/OOPSLA2005.html
Banner blindness
There's some consolidation here. Podcast support in YouTube music is a real thing.

There is SO much overlap between YouTube Music videos and listening to music.
There is also overlap between YouTube podcasts and listening to podcasts.

Trying to align here makes a lot of sense.
Tricky to pull off, sure, but it's not a dropped ball.
if someone is underutilizing an asset like land, to the point that they wouldn't be able to flow enough cash to pay fairly assessed taxes on it, maybe there should be an incentive to sell, rent out, or refinance the property. Lot of empty nesters knocking around 4br homes in the Bay, maybe it's ok to stop subsidizing them. If all else fails, they're sitting on a million+ dollar asset that should keep them living quite well for the rest of their lives, even if they take that cash and grab a nearby condo.
I have a periodic thought exercise of a counterfactual where our culture had developed in a way that paid early career people relatively more than now and vice versa for late career. The concept behind it is that interest compounds and beyond basic competence it can be difficult to tell the relative value of experience versus eagerness and top performers with/without the supportive environment in which they operate.
It's just physicists and their quarky humor.
Germany's solution for everything is more regulation. It works wonderfully so far, so this will definitely contribute to further economic growth. Wir schaffen das!

Has the term "privacy washing" been coined already?
Show HN: SHH (Systemd Hardening Helper) – Automatic systemd service hardening
Dalton and Michael talk about folks pivoting too much and not fully learning/validating from each pivot in this recent video. Obviously I don't know anything about what you've been doing but perhaps there's some wisdom here: https://www.ycombinator.com/blog/when-to-pivot-and-when-to-s...
or the speed of causality
Honestly, at this point I hope the shut down most of the company. They tried to do everything, but ultimately they just showed that their corporate structure couldn't scale to that many employees.
> please have at least three kids.

I'm very happy to do so - on exacally one condition, daycare becomes free.
Exactly. They did learn from it -- and it is by far the best way to optimize around short term gains.

Just like people who join a company, grow the company to unsustainable bounds, then leave for the next company while the previous company struggles to maintain or fulfill previous obligations.
> Why do we distribute tarballs at all? A git hash should be all thats needed...

A git hash means nothing without the repository it came from, so you'd need to distribute both. A tarball is a self-contained artifact. If I store a tarball in a CD-ROM, and look at it twenty years later, it will still have the same complete code; if I store a git hash in a CD-ROM, without storing a copy of the repository together with it, twenty years later there's a good chance that the repository is no longer available.

We could distribute the git hash together with a shallow copy of the repository (we don't actually need the history as long as the commit with its trees and blobs is there), but that's just reinventing a tarball with more steps.

(Setting aside that currently git hashes use SHA-1, which is not considered strong enough.)
If only there were lots of people from not-the-US who wanted to live in the US...
50,000 units sold in 24 hours. Xiaomi fans buying into the Lei Jun's vision
What should I look for? The evil bit set?
How computers work, from the atom up (2011)
That exported food is also feeding people.
How isn't that third party just reinventing journals ?
The land can sustain them fine, that's just what it's like to live near bears. Tons of places are like that - you get used to it lol don't worry. There was a Tom Scott video on work folks are doing to develop bear resistant trash cans and the like: https://youtu.be/Xn_O2li_jpk?si=BUPxDOxXaOJdxC_v

It's funny (and sad) that wildlife has been so thoroughly decimated in parts of the world that people are so shocked by such thoroughly mundane things but it's an important reminder that ecological restoration work must involve working with locals and understanding the cultural forces at play to make these projects a success. Including making sure that externalities are accounted for and that the people in the area share in the benefits (economic like tourism, cultural like restoration of culturally significant animals and ecosystems, environmental depending on the intrinsic value people give to preserving the environment, etc). I'm seeing it in the replies to this thread - it's easy for folks in places like the American West to be dismissive of concerns like these but the idea that the wild is worth preserving is frankly a relatively recent one. If you just assume that obviously everyone values bears being alive while the other person just assumes that everyone values eliminating or at least suppressing bear populations to never have to deal with them everyone is just going to walk away assuming the other person is crazy
If you look at children as some utility-investment ... yeah, you probably shouldn't have kids.

But, you are incorrect even then. Eventually, you will get old. Your siblings and parents will be long gone. Then your spouse. You'll have nobody to pass your knowledge on to, at least, nobody to pass it on to that actually cares in a way only a child can about a parent. No grandchildren to spend time with that you simply didn't have the time to as a parent.

I don't know man. I had some cancer, and recently got a tumor in my fucking face. I can tell you right now, when faced with death: careers and money means shit.
AntennaPod is better than Google Podcasts.

I was upset until I switched, and then glad I got pushed to switch.
Retrotechtacular: The IBM 7070
>we need the next generation of people

Who is "we"?
Are you a business owner in need of an ever-increasing pool of cheap labor, or a business owner in need of an ever-increasing customer base, or a land owner/real estate developer/landlord in need of an ever-increasing population requiring housing?

(I won't even get into the massive environmental impact of having a child, let alone three!)

>if you have a partner and are financially stable, please have at least three kids.

For what purpose?
This is getting addressed here: https://github.com/google/oss-fuzz/issues/11760
I had the Travel Mug 2, same exact experience, with the added benefit of it turning on all by itself overnight while it was empty, and then hitting some sort of temperature limit and refusing to work without a factory reset. The factory reset itself was also buggy, and it would sometimes take 5+ attempts to get it to actually reset.

Hot garbage, which is a shame because the idea is good.

Nowadays I just use a good thermos, and pour my hot drink into a standard cup when I want a refill. Problem solved, zero electronics required.
> they could produce enough neutrinos to be dangerous

Dangerous in the sense of "ionizing radiation" or in the sense of "this will overturn careers"? Getting killed by neutrinos sounds like a freak accident from a sci-fi story.
I am disappointed they didn't plan to drill for geysers. Geothermal activity is the first thing that comes to mind when I hear "Yellowstone".
Deferring the load of the library often just makes things harder to analyze, not necessarily more secure. I imagine many of the comments quoting `ldd` are wrongly forgetting about `dlopen`.

(I really wish there were a way to link such that the library isn't actually loaded but it still shows in the metadata, so you can get the performance benefits of doing less work but can still analyze the dependency DAG easily)
https://webcache.googleusercontent.com/search?q=cache:https:...

n.b. not worth your time. tl;dr: lets replace the comma with the poop emoji because commas occur in data.

There's already a solution to that (obviously). Best argument a contrarian could make is you "learn about unicode", by which they'd mean, the words "basic multilingual plane" are included at one point.
90 day dark window for maintainers is SOP though. Then after 90 days, it’s free game for public disclosure
From what I'm gathering.

Alice measures at angle X, gets value V1

Calls Bob on the phone, okay I measured angle X.

Bob measures at angle X, also gets value V1

Bob measures at angle Y, gets value V2.

Bob calls Alice back says, okay I measured angle Y.

Alice measures angle Y, also gets V2.

The correlation here is nobody can do other measurements while the other party is in the process of measuring. Each party can't know the other party is done until traditional communication has happened.

If each party acted independently they would randomly change the state on the other side and each party would get what appears to be random values.
not all physics is particle physics! gravitational-wave physics, for just one example, is not the least bit stagnant! and soft matter physics is amazingly fertile ground right now...
> Still no clear way to have a civilised discussion around this kind of subject I guess.

You don't seem to understand that civilized public discussion begins with identifying a forum where the material is topical; that is part of the civility. Not only being civil in tone and choice of words.

An issue being important to everyone doesn't overrule topicality.

Look, here you are, under a story about the origin of "pencil lead", going on about something entirely different, using the commenting system for private messaging.

If this were Usenet, you'd be plonked into my killfile.
Can’t imagine that much less unwanted children is anything but net positive though..
This just tells me you’re not well versed in sales and marketing. Learn those first (specially direct response) and the other pieces will glide into place with less effort.
Note that Fedora 40 isn't even released yet, it's in beta, Fedora 41 / rawhide is basically a development branch used only by a small number of people.
Calling bison ‘buffalo’ is a North American thing, generally. It’s part of a huge pattern of naming confusions between British and American English for ungulates. An elk in Eurasia traditionally means what is a called a moose in North America, but in North America what they call an elk is more similar to a European red deer. America also calls its pronghorn (which is not an antelope) an antelope, and its reindeer caribou, unless they’re pulling Santa’s sleigh. Muskoxen also aren’t oxen.

But the bighorn sheep is really a sheep and it does have big horns, so they have that going for them.
Microsoft, OpenAI plan $100B data-center project, media report says
What are you talking about? I am not noticing it at all.
https://blot.im/ is the one that finally made it possible for me to use one without configuration of both a web server and a site generator (neither of which I can do) and keep my files "local" in a synced Dropbox folder.
This is a surprisingly common way that spies get caught, and the FBI even includes "buying things they can't afford" in their list of ways to "spot a possible insider threat".

https://www.fbi.gov/news/stories/how-to-spot-a-possible-insi...
I'm breaking up with google next year. Can't wait to be free of their crap.
My experience with FireFox and YouTube has very much not been this. YouTube works perfectly for me on FireFox. I would check your config/addons and see if there is some setting that is causing errors on YouTube.
So what happened to Veliotis?

Articles as late as 1987 just list him as "a fugitive hiding in Athens", then nothing.

Did he get away with it?
The marketplace of good and bad ideas
People are complaining that it's too big, labyrinthine, and arcane to audit, not that it doesn't work. They would prefer other things that work, but don't share those characteristics.

Also, the more extensive the remit (of this init), the more complexly interconnected the interactions between the components; the fewer people understand the architecture, the fewer people understand the code, the fewer people read the code. This creates a situation where the codebase is getting larger and larger at a rate faster than the growth of the number of man-hours being put into reading it.

This has to make it easier for people who are systemd specialists to put in (intentionally or unintentionally) backdoors and exploitable bugs that will last for years.

People keep defending systemd by talking about its UI and its features, but that completely misses the point. If systemd were replaced by something comprehensible and less internally codependent, even if the systemd UI and features were preserved, most systemd complainers would be over the moon with happiness. Red Hat invests too much into completely replacing linux subsystems, they should take a break. Maybe fix the bugs in MATE.
Emojis are disabled on HN (although in exceptional circumstances, staff have been known to edit them in)
How is the service manager different from PID1/init?
The parachute dutifully deployed after the plane crashed.
It would mean rebuilding more packages. I don't think that's meaningfully "much worse", package mangers are perfectly capable of rebuilding the world and the end-user fix is the same "pacman -Syu"/"apt-get update && apt-get upgrade"/...

On the flip side the elegant/readable build system means that the place this exploit was hidden wouldn't exist. Though I wouldn't confidently say that 'no hiding places exist' (especially with the parts of the ecosystem that wrap dependencies in other languages).
That article will be very meta next time Jimmy Wales' face is plastered over the page asking for wikipedia donations.
> running around salsa.debian.org pushing for more updates in other projects as well

This is quite common in most (all?) distributions. People are going through lists of outdated packages, updating them, testing them, and pushing them.
I mean, it's a technical piece of code (ETH, that is), and every new piece gets a new name. It's not a more complicated terminology than you'd get for compilers or protocols - TCP wikipedia has "TCP provides reliable, ordered, and error-checked delivery of a stream of octets " which has 6 (or 5, depending how you'd count it), technical terms. They're not very abstract, sure, but it's just TCP, and we think that's completely normal.

A logic class will suddenly try to teach you "eqvuilance relations", "Equivalence class", "Quotient set", "Projection", "Kernel" (Specifically in the Eqvuilance relation meaning), "partition", and that's only the terms I found in wikipedia. The class I help along has one more under this subject, and this is a first semester topic that is taught in a few weeks. All of those are technical, and all of those build on some other technical terms such as relations, functions, sets...

I concede that crypto has a bad naming scheme. It all sounds silly.
What line of work is that?
Can me point me to the Golang implementation? Is it a standard package?
In finance this is called price discovery. In the labor market it’s called waiting until someone is one foot out the door. It’s much more expensive to correct the situation once someone has already decided to leave.
> One might say that if SQL was so great there would be no ORMs

It's not like the ORMs exist without SQL. Their primary purpose is to provide a consistent interface between different flavors of SQL so the application developer doesn't need to care what database they're using.

For example, delimiting object names in Mysql uses ` and in Postgres uses ". The ORM will ostensibly have different adapters which take care of these differences without changing the application code.
Pocketcast is my fav
- A one-off payment makes life infinitely simpler for accounting purposes. In my jurisdiction, a software license owned by the business is an asset and shows as that in the balance sheet, and can be subject to a depreciation schedule just as any other asset.

- Mental peace: if product X does what I need right now and I can count that I will be able to use product X five years from now to do the same thing, then I'm happy to pay a lump sum that I see as an investment. Even better, I feel confident that I can integrate product X in my workflows. I don't get that with a subscription product on the hands of a startup seeking product-market fit.
Constraint programming is awesome. I learned prolog in college which can accomplish similar stuff. One of thw things thats cool is you are badically just describing the problem and the rules. As soon as you are done with that the problem is already solved.
I wish someone would ask Sundar Pichai in an interview or something if he is aware of the damage that these constant shutdowns do to his company's reputation.

Not because I am interested in interrogating him. But because I'm honestly curious about his thinking process. Does he know and not care? Does he not know? Either way the answer would be interesting to me.
I did a Master's in Condensed Matter Physics and I still agree with you. (edit: obviously I'm not including myself there)
You're entitled to your opinion on that, I suppose. As someone who actually does understand most of the jargon (because it's what I do for a living), data availability sampling feels to me just as inherent to good blockchain design as fast fourier transforms are to good digital signal processing.

> consensus algorithms are complicated but they solve a hard problem

Ironically, this article is about an algorithm that comes to consensus on and distributes data. Yes it's a hard problem, thus the article.

This is not really an article about cryptocurrency or monkey jpegs, it's a nitty-gritty article about the design of a computer protocol, written for the benefit of protocol researchers and implementers. If it's nonsensical to you, perhaps consider that you're not the target audience.
Plus there's a good chance they didn't know exactly what they needed to build when starting out.
This is easily fixed by giving management attrition targets. Some companies (Amazon) say "you need to let go of ~6% of your headcount every year."

Others will flip this and say: "you need to retain 94% of your headcount every year."

The effect on salaries is more or less the same. If you know you need to keep employees, you give salary increases to the one's most at risk of leaving. If you know you need to let go of employees, you don't provide salary increases to the one's you want to get rid of.

Many companies don't have an attrition target at all, though.