skysight-inc/HackerNews huggingface dataset:
Even the linked article blurs the two. I tried to read it to find out why smartphones were bad, and it only talked about why social media is bad. I know social media is bad, everyone does by now!
I think I might understand how you feel. You need a human connection and someway to make an impact in this ephemeral world.

Have you considered some form of mentoring of young people who are willing to learn? It could be in the course of your work or could be related to some hobby.

I believe it could be a rewarding experience to share your experiences with someone who could benefit from it and see them thrive.
Sounds like a standard soft money research unit at a university, sadly. At least there isn’t the pressure to salami slice publications.
It looks like Lzip only has a single maintainer and there's no public repository to track commits or contributors (at least I couldn't find any). I don't think it's a viable option.
Let me put it bluntly then:

The only people discriminating are those supposedly complaining about discrimination.

The more someone says <X> needs more or less <Y> representation, the more they are ironically being discriminatory.
Amazon scrambles for its place in the AI race
on a similar note- I am looking for a better alternative to Google my watchlist. Such a highly underrated feature. But it deserves some love from Google. A better categories, ability to see watched movies, and leave some personal review will be awesome. I even thought about building it myself but I am afraid there is no official APIs for that.
Hmm yes "It seems like you're blocking our ads" is exactly the kind of popup I want from an image editor, lol.
Interesting!

As some of the Tweet replies mentioned, they shipped releases that contained the backdoor, and committed other questionable changes at the "usual" times. For sure we're almost certainly not dealing with a compromised workstation, so I don't think that would explain the different times for the worst offending changes.

Maybe he has some technical experts/handlers/managers that had to oversee when they introduced the actual malicious changes, and thus this reflects when he got the go-ahead signal from these other people (and thus that reflects their working hours?)

Or maybe they were just travelling at that time? (maybe travelling to visit the aforementioned handlers? Or travel to visit family... even criminals have a mom and dad)

Also, keep in mind that my Clickhouse query includes all of the Github interactions (for example, timestamp of issue comments)... and unlike a Git commit timestamp, it's hard to fake those (because you'd need to schedule the posting of such comments, probably via the API. Not impossible, but easier to think that JiaT75 just used the Gitub UI to write comments), the Tweet mentions just "commit history"

Usually the simpler explanation has less chance of being wrong... thinking of some possibilities:

- Chinese/Taiwanese state actor, who employs people 9-5 (but somehow, their guy worked 20.00 - 02.00 local time)

- Chinese/Taiwanese rogue group/lone wolf... moonlighting on this exploit after their day job (given that to interact with Lasse they'd be forced to work late, this is not outside of the realm of possibilities)

- Non-Chinese state actor, employing someone 9-5 (consistent with most of the Github interactions), wanting to pin responsibility on China/Taiwan (+0800 timezone for commits), which for some unexplained reason pushed the worst offending changes at really weird times.

- Chinese/Taiwanese state actor, that wanted to pin the blame on western state actors (by making all of the changes at times compatible with someone working in Europe), and somehow they slipped up when pushing the worst offending changes.

- Chinese/Taiwanese state actor, employing someone in Europe (if they need to get approval of changes/gain the trust of the previous maintainer Lasse, it might make sense to have better/more timezone overlap)... which for some weird (yet "innocent") reason, kept the device that they worked on, configured with a +0800 timezone

- Non-Chinese state actor, pretending to be a Chinese entity that wanted to pin the blame on a western entity and slip up by making the worst offending changes at 3am (i.e. it was not a slip up, but it's part of the misdirection efforts.)

Some of these hypotheses are a bit farfetched, but reality is stranger than fiction
You will never be able to match the weight of a Wankel with a regular reciprocating piston engine, all other parameters being equal.
If you're referring to Liquid Piston's "X-engine," as they call it, it's doing well. It landed a substantial military contract and will likely be used to make super compact, lightweight diesel generators.
Cynically you can see that as bragging, but it's just common sense if you dig into it.

The ones that are not fit are intimidated and look away, because they stand no chance (I know because I was like that too).
The 'beautiful' ones are the ones that do the hard work to stay in shape, so they know and are interested in people who do the same.

The term 'midlife crisis' is ridiculous tbh, forget it, there's no crisis, it's called growing up and becoming a man.
The format is fine, and zstd would be a downgrade in terms of compression ratio (which is the main reason xz is chosen for its current use cases). The lesson to learn here is not about making technical improvements, it’s to do something about improving the way we manage and maintain core open source infrastructure.

Ref XKCD 2347.
scamalytics has nothing to do with a report to the tech-c or abuse-c email address in the WHOIS information.
> Bailey's lawsuit claims that "Media Matters has used fraud to solicit donations from Missourians in order to trick advertisers into removing their advertisements from X, formerly Twitter, one of the last platforms dedicated to free speech in America."

The last sentence really says it all. They don't even try to hide their agenda.
On Hetzner, you receive an abuse email with the directive to respond appropriately if your root server or VPS is involved in some kind of abuse related issue. In larger companies this happens quite frequently. I'm not sure what would happen if you ignore such email.
It's also Windows only and one of the few things still holding me back from going full KDE. Krita is frankly overcomplicated for basic everyday stuff and Pinta is a decent clone with the same workflow and shortcuts, but still falls short in most aspects and is not very performant.
Genuine question: how do we know that Jia Tan is a bad actor and not simply an inept coder that introduced a bug?
App scans your pile of Lego and uses ML to suggest projects
It doesn't even have a git/mercurial/CVS repo; just .tar.gz on some random website. And installation instructions are:

tar -xf lzip[version].tar.gz
cd lzip[version] && ./configure && make check

The entire thing seems entirely the work by one person.

Yeah, this is going to massively improve things. I foresee no plausible way we can gave a repeat if we switch to this lzip thing. Absolutely watertight. We learned from past events. Problem solved.
Saying the Antebellum South had too many slaves is discriminatory?

Poor Rhett Butler.
How do you optimize memory for floating point?
The universe is not split, though. You just perceive it that way. Think of it as a wave function, where some of the time, some waves cancel each other out, and are not observed, and some of the time they are amplified and easily observable.
Please, take a look at how the exploit is crafted. It is not a bug in a piece of code.
The VM/container distinction is less relevant to this discussion than you might think; both Amazon ECS and fly.io run customer workloads in VMs (“microVMs” in their lingo).
No evidence social media use causes mental illness
Never seen that before but that would certainly do it.
Regarding its native file format, IIRC it's a dump (aka serialization) of the internal structures used in the program. More or less like the old Office did for its native doc and xls files.
Wow man HN is so brutal sometimes.

Brutal and spot on tho. (especially after reading their reply to yours)
Yes, but this doesn’t prevent issues like the xz issue, where the code looks fine, but the build scripts alter it.
Sounds to me like google translate gibberish
So, I expected this to actually query the DB using prolog (using the correspondence between relational algebra and logic programming).

I mean, can those prolog stored procedures use the db as a source of facts for prolog, or otherwise write queries?
I always thought there is a room for mini web games in 2024. Currently no decent site to simply play some little games is a bummer. I would appreciate games like this to play between my coding sessions. And I am obviously not interested in downloading games, I am interested in web native games.
FYI: Most decent Wordpress hosters these days have cache, SSL, minification out of the box.

My favourite WP hosters:

- kinsta.com (for scaling & multi-sites)

- raidboxes.io (amazing customer support, usually within 15min, even on a Sunday)
You're telling me GPUs aren't designed for additions and subtractions? Where did you hear that?
I am not sure I agree that every low quality post needs a detailed rebuttal? HN couldn't function under such rules.

as to the specific comment:

> Seems like the complexity of XZ has backfired severely, as expected.

to summarise: someone found a project with a vulnerable maintenance situation, spent years getting involved in a project, then got commit rights, and then commited a backdoor in some binaries and the build system, then got sock puppets to agitate for OSes to adopt the backdoored code.

the comment I replied to made a "shallow" claim of complexity without any details, so let's look at some possible interpretations:

- code complexity - doesn't seem super relevant - the attacker hide a highly obfuscated backdoor in a binary test file and committed it - approximately no one is ever going to catch such things without a process step of requiring binaries be generatable in a reasonable-looking and hopefully-hard-to-backdoor kind of way. cryptographers are good at this: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number

- build complexity - sure, but it's auto*, that's very common.

- organisational complexity - the opposite is the case. it had one guy maintaining it, who asked for help.

- data/file format complexity - doesn't seem relevant unless it turns out the obfuscation method used was particularly easy for this format, but even in that case, you'd think others would be vulnerable to something equivalent

perhaps OP had some other thing in mind, but then they could have said that, instead of making a crappy comment.
It's grotesque that this is not even the direct effect of the advertising industry, it is the side effect of Google's algo to sort results.

Being ranked higher in the Goog results is sadly worth more than a town's historical records.

I wonder if things were different if Google wasn't allowed to monopolize search.
This title grossly misreps the content.

The content's own title is: "The great rewiring: is social media really behind an epidemic of teenage mental illness?"
There need to be more strict settings for autoplay, not only for video and audio, but for huge GIF files too. I'd put them under "energy saving" settings, as reduced network activity would benefit for server too, not to mention all CPU cycles saved for not decoding all media on client side. Autoplay activation triggers should be reviewed as well, as some sites will happily start autoplaying all media after scrolling down using main scrollbar. That's probably only me, but I still consider scrollbar a part of browsers chrome, not part of website. So interacting with it should not give any hints to website, at least where media autoplay is concerned.
Do they do attestation by default? I thought for Apple at least that was only a feature for enterprise managed devices (MDM). Attestation is also a registration-time check, so doesn’t necessarily constrain where the passkey is synced to later on.
In what I understand: we don't know for sure, but the suspicions are so high that it more important to act quickly and revert the changes.
The community will analyse later what the changes are exactly doing ( less urgent than reverting the changes )
Newgrounds still exists.

But AFAICT there is basically 0 money in browser games now, which is why only romantics and masochists still work on them.
"But Management made us do it!"
That's not a noteworthy "attack"; that could be a single runaway bash script on someone's machine. 50MM requests per month "from the UK" averages out to under 20 requests per second. I would expect a single Go server to handle 250 times that request volume before optimizing much.

Their advice isn't bad per se, but their numbers are not a testament to it. I expect for my Go HTTP API services to handle 5k requests per second on a small to medium VPS when there is some DB activity and some JSON formatting without doing any optimizations. This is based on deploying dozens of similar services while working at a place that got multiple billions of requests per day, spiking to over 500k rps.
Epic product.
I've been recently working on Glory Morning (https://glorymorning.email/).

Vibrant community of like-minded people, meeting someone new every single morning. Connect through passions, hobbies, and professions, all from your inbox.

It it still pretty fresh, launching only 2 weeks ago.
> beliefs is of very good quality

Maybe they are, but until they can be scrutinised by someone else, there’s no way to be sure.

There’s a root of naivety here because you’re taking the position of “my ideas are great” in a vacuum.

Usually it’s for others to judge without your own biases in play.

And if they really were so great, you’d probably have the self awareness to know this.
Your hardware already supports addition and subtraction and the tensor cores of NVIDIA GPUs are already fast enough to keep up. The only benefit is reducing memory capacity and bandwidth requirements.
...or Anguilla
>When associations over time are found, they suggest not that social-media use predicts or causes depression, but that young people who already have mental-health problems use such platforms more often or in different ways from their healthy peers.

Teenage years are one big mental health problem. Thus this contradicts the whole point the article is trying to make.

This is a similar situation to how tobacco companies knew about the problems they were creating, and at the same time spent lots of resources to try to disprove those facts.

Here's Haidt's book: https://www.amazon.com/Anxious-Generation-Rewiring-Childhood...
What does a tool have to do when I'm purely searching for a certain MySQL/SQL syntax? TablePlus has done an awesome job of writing brief articles about different SQL syntax and its usage in TablePlus.
I find the title inaccurate and clickbaity. It was not the gravitational waves that made life on earth possible, but the heavy elements as a result of star collision and star collapse. But we've already known that for a long time.

The referred paper just makes the case that most of the iodine and bromine on Earth must be created by neutron stars collisions and not by supernovae as previously thought.
I have found Firefox is the only browser to correctly block Autoplay.

I block all then manual whitelist for domains like Youtube.

Edge, Brave, Chrome seems to work sometimes, or worse, only lets me block audio and not video.
Just reply what you are sorry and you are fixing/fixed the issue. Till the next report.
This attack was so sophisticated that I don't understand half of it after a first read. It's plainly obvious that it is not a simple typo or a blunder but very carefully crafted.
The cookie popup happens to every European every time they visit practically any site for the first time. It is required by EU law, and it usually pops up on US site if your source IP is identified as being from Europe. The IP databases used by sites can be outdated... Or perhaps the site asks everyone anyway.

That's actually not a bad cookie dialog. It has the "Deny" button right there, instead of requiring you to scroll through a list of options and uncheck every "non-essential" cookie (which is much too common...). It even has the check boxes available at the first level instead of requiring you to enter a second dialog box.
Very good clarification.
When is Google, Amazon, Facebook, the DARPA, the EU - ANYONE going to step up to the plate and fund developer time for such obviously critical infrastructure? Why could a single Chinese guy undermine the entire system with so little effort?
OpenAI says it can clone a voice from just 15 seconds of audio
You have no moat. That's something stability learned the hard way.
> Do you have any idea how much of the earth's land surface (to say nothing of its enormous oceanic heat sink) was covered by temperature observation before 1979?

Let's apply your rigorous scientific standard and see if we can figure out how much of earth's surface was covered by ocean in 1979... hmm... well we have no satellite observations. We have a decent amount of maps, but, those are just from scattered naval mapmaking activities, really only engaged in by a handful of countries across the entire globe.

I'm not convinced the ocean was all that vast before 1979. Do you have better evidence? How do you even know how deep it may have been? What, from a couple depth readings here and there over a few centuries? Sorry, it's going to take more than that to convince me.
On a related note, have there ever been extensions for PosgreSQL/SQLite/any other FOSS DBMS that would allow using Tutorial D[1] (the Third-Manifesto one, not to be confused with Walter Bright's D language) to define and query data? In particular, I feel like PostgreSQL's CREATE TYPE[2] feature would allow for easier bridging between SQL and Tutorial D.

Unfortunately, searches for “PostgreSQL Tutorial D” don't issue useful results for obvious reasons.

[1]: https://www.dcs.warwick.ac.uk/~hugh/TTM/index.html

[2]: https://www.postgresql.org/docs/current/sql-createtype.html
"In theory" the equation is something like [time+energy spent] * [value for work not being doable without specialized knowledge/experience] * [demand for the work], with the goal being to maximize the second and third to absurd values, so you can decrease the amount of actual energy you expend.

In theory.
Hello, I am the main author, would love to clarify a couple of things:

All the linear-quantization methods have meta-data, including the 1.58bit paper. You can control the quality vs. memory usage by reducing the group-size. However, the meta-data is the not the same thing as the quantized weights for many reasons:

> The meta-data size doesn't change the fact that you can do binary/ternary matmul, which the most important thing in this story.

> The meta-data size doesn't increase the actual compute: these are point-wise operations and even if you have 1 scalar you still need to multiply the same amount of weights.

> Meta-data is offloaded to the CPU with pinned-memory, which allows non-blocking transfers. Technically, you can trigger the copy in the layer before and synchronize and will make it almost seamless. I did some experiments with cuda streams that worked very well on an older machine, but then I tried a better machine and the transfer was much faster. Obviously if you are trying it on Google colab it's very slow for this reason.

> Smaller models like Llama2-7B are very hard to directly quantize at very low bits, so they need a lower group-size to function well. Larger models (like what we showed for Mixtral), can be quantized to 2-bit on the fly, without any data, and still work very well. So basically larger models are less sensitive to extreme quantization and you could use a much larger group-size. I still think that the meta-data size is really not a big deal for the reasons I have explained above.

> There are many other ways to increase the group-size or even get rid of it all together, many ideas available but needs lots of experimentation.

> Binary/ternary CUDA matmul kernels don't exist yet. The current code is implementing the dequantization step in CUDA but then uses torch.matmul as fp16. I tried doing matmul at low-bits with CUDA but it is very difficult to even beat cuBLAS with fp16, especially for a novice CUDA coder like me :)

Please note: this is early experimental work. Since it showed promising results, we wanted to share it with the community first as we progress. There's still a lot of things to be done and we are actively working on it, despite the very limited resources we have.

Happy to answer any questions here!
> but to the users of the software to finish updating their systems to a new fixed release,

Is there "a new fixed release" ?
How do you know it is a guy, and it is Chinese?
I wish gif’s adhered to prefers-reduced-motion and preferably only played on interaction. I use Toggle Animated Gifs [0], but it’s a global on/off switch, requires a reload, and doesn’t show a hint that something could be animated.

[0]: https://github.com/M-Reimer/toggleanigif
Yes! Your business accepts speech input. So you pay me - your average shady security vendor - a good wad of cash to use my universal watermark detector. It's guaranteed to detect AI stegotech, or your money back!

We achieve a whopping 30 coverage over known voice clone services. It's better than nothing!
You can just delete whole layers, because the point of residual layers is to make the model learn the hyperparameter "layer count" automatically. Compare this to the absence of residual layers where the model must use all layers. Then you will have to get the layer count perfect, but this isn't possible, since each data point might benefit from a different layer count. The extra layers therefore exist primarily so the model becomes robust to poorly chosen hyper parameters. You still need a minimum amount of layers, but that isn't the problem.

https://arxiv.org/abs/2403.17887
> Maybe some distributions that don't use systemd strip the libxz code from the upstream OpenSSH release, but I wouldn't bet on it if a fix is available.

OpenSSH is developed by the OpenBSD project, and systemd is not compatible with OpenBSD. The upstream project has no systemd or liblzma code to strip. If your sshd binary links to liblzma, it's because the package maintainers for your distro have gone out of their way to add systemd's patch to your sshd binary.

> From the article: "Initially starting sshd outside of systemd did not show the slowdown, despite the backdoor briefly getting invoked." If I understand correctly the whole section, the behavior of OpenSSH may have differed when launched from systemd, but the backdoor was there in both cases.

From what I understand, the backdoor detects if it's in any of a handful of different debug environments. If it's in a debug environment or not launched by systemd, it won't hook itself up. ("nothing to see here folks...") But if sshd isn't linked to liblzma to begin with, none of the backdoor's code even exists in the processes' page maps.

I'm still downgrading to an unaffected version, of course, but it's nice to know I was never vulnerable just by typing 'ldd `which sshd`' and not seeing liblzma.so.
Don't worry, MWLL, which runs on Crysis Wars engine, still can make a modern PC crawl.
I would have liked actual examples of what it can do. With a simple table, and a few requests and their outputs.
They unironically are, gaming is no longer a small nerd niche, but rather a mainstream activity.
How does it deal with the undocumented system dependencies Python libraries often have?