skysight-inc/HackerNews huggingface dataset:
> If you're, say, Austin Matthews making $13MM per year in Toronto, you can still buy a lot of houses.

If you look at the statistics, the houses in Canada aren't being bought up by rich people, they are being bought by middle and upper-middle class Canadians. Even the "investors" tend to be individuals buying one housing unit as an "investment".

> The US housing market crashed back in 2006 because tech started showing promise

That's wildly revisionist and doesn't really make sense. "Tech started to show promise" so you're saying that people stopped by homes? How many middle class Americans (who make the majority of home owners) shifted their investments from housing to speculative tech stocks? I think you overestimate the penetration of tech into the middle class - most people I knew hadn't even heard of AirBnB until 5+ years after they become "hot" in Silicon Valley.
This was so bizarre I had to check twice that it isn't actually April 1 (I'm in Asia so I get a lot of off-by-one-day stories from the US)
No, the problem is that someone had access to backdoor code that runs in a privileged process.
It depends on that random reseller's pricing, no? I got mine for $30.
Is this a European thing? I've never even heard of a duvet.
Their record suggests it will be achieved.
Even if you mandated two code reviewers per merge, the attacker can just have three fake personas backed by the same single human and use them to author and approve malware.
Wow. Given the otherwise extreme sophistication this is such a blunder. I imagine the adversary is tearing their hair out over this. 2-3 years of full time infiltration work down the drain, for probably more than a single person.

As for the rest of us, we got lucky. In fact, it’s quite hilarious that some grump who’s thanklessly perf testing other people’s code is like “no like, exploit makes my system slower”.
Extortion was the main crime in El Salvador. Asking people for a share of their income.

The cure to mass extortion is carrying weapons, or making the extortionist believe there is a good chance you have a.weapon. There is no other mitigation.
"Moving money around" is how anything gets done. Cap and trade is exactly intended to move money around, specifically to move money from carbon polluters to fund sustainable and renewable development that didn't have market advantage.
Is the high migration popular given housing price effects?
It’s pretty common in the UK. Maybe to do with the colder climate.
Interesting use of ergodic. What is ergodic literature?
Cmake actually but yes
The purpose would presumably be to use this about an hour before the amphibious assault on $WHEREVER begins
That's exactly the case with HTTP credentials and most authentication frameworks...
It sounds more like "90 days of alerts about DNS, and then certs fail". The fact that the presence of IPv6/AAAA DNS records causes Vercel to decline to auto-renew certificates seems to not have been known to the Tailscale team prior to the incident. (I haven't seen the alerts in question, so I don't know whether they made this fact clear.)
How many services are you running?
Wait, what? People travel to see things all the time. The original Star Wars sets in Tunisia, hobbiton in New Zealand, the evil dead house in Tennessee, or even Petra because of Indiana Jones. I guarantee you it would be a tourist attraction today if it still existed.

Also, Humboldt is not really that far from anywhere and is a lovely journey through some incredible forests.
It looks like the exploit path calls system() on attacker supplied input, if the check passes. I don't think we need to go into more detail than "it does whatever the attacker wants to on your computer, as root".
For sure. That drive (or bike) on 101 is priceless. Good attractions, that I remember, are the glass beach and Samoa cookhouse.
Met someone a few weeks ago and found out today he went to Humboldt for college - came up while exchanging phone numbers and I have a 707

Edit: way better driving north from the Bay Area on hwy 101 than south towards SoCal on 5
I understand your point that planting trees doesn't 1:1 compensate the ecosystems destroyed. I just have a nitpick on the delivery:

The overall theme of your comment was criticizing planting trees and how it's "problematic" but spreading this message isn't constructive, it just paralyzes the ones trying to help, leading to a net negative.
Funny if the only downtime is when you swap hardware.
We witnessed Juniper generating their VPN keys with Dual EC DRGB, and then the generator constants subverted with Juniper claiming of now knowing how did it happen.

I don’t think it affected Juniper firewall business in any significant way.
Agree! I'm deep into dungeon synth these days, I love how people find new art expressions in the sea of mediocrity that is this industry.
Spending two years actually maintaining an open source project that you will later backdoor is a very expensive way to perform such research.
Anything even remotely security adjacent that TailScale as an institution even remotely fumbles even once is too dangerous for the merely mildly paranoid (like me for example).

We need a better story on this.
> Honestly this attempt makes me think that the entire c/c++ language stack and ecosystem is the problem. All these software shenanigans should not be needed in a piece of software like openssh but it's possible because it's written in c/c++.

Nothing about this relies on a memory safety exploit. It's hard to figure out because it's a prebuilt binary and it's clever. Unless you meant "all compiled languages" and not C/C++ specifically, it's irrelevant.

The right thing to argue against based on your instinct (no one can figure out what is going on) is: it should be unacceptable for there to be prebuilt binaries committed to the source code.
You take a ferry. https://www.fodors.com/world/mexico-and-central-america/pana...
Democratic power puts it in the hands of people. Now, if you’re saying that your democracy doesn’t serve its people — I wouldn’t blame the politicians. You might want to take a look at why politicians don’t act in the interests of the population
Your viewpoint is 100% understandable and agreeable. I also don’t consider the tasks you mentioned as trivial. However, for the sake of discussion and my own learning, do you view these tasks as directly critical to adding value as a programmer? Or do you see them as essential for establishing alignment, which, in turn, facilitates more efficient value creation? Personally, I believe the examples you mentioned are important but it’s hard for me to value the plan over the execution in such a rapidly adapting ecosystem. Not to tangent but I believe in the words of Mike Tyson everyone has a plan until you get punched in the mouth. We can plan, research and document but if the insight is found in the execution shouldn’t bottom line by trying to ship and iterate. My main point is objectives can often be succinctly summarized,and while the task you mentioned are important I think the weight we put to them discounts the value of just shipping. Our differing views might also stem from our backgrounds—I’m assuming (please correct me if I’m wrong) that you have more experience with larger development teams.
What a waste, turning a forest into decks!
I looked up the definition, and I'm still a bit confused. I'm familiar with word in the context of traversing system states, specifically graph traversal.

The term "ergodic literature" doesn't seem to relate to the word in a math context which seems strange. Usually the same word used in different domains has analogous definitions.
This behavior really freaks me out. It raises the potential that hostile urls will be introduced.
That’s not an effective idea for the same reason that lines of code is not a good measure of productivity. It’s an easy measure to automate but it’s purely performative as it doesn’t score the qualitative value of any of the maintenance work. At best it encourages you to use only popular projects which is its own danger (software monoculture is cheaper to attack) without actually resolving the danger - this attack is reasonably sophisticated and underhanded that could be slipped through almost any code review.

One real issue is that xz’s build system is so complicated that it’s possible to slip things in which is an indication that the traditional autoconf Linux build mechanism needs to be retired and banned from distros.

But even that’s not enough because an attack only needs to succeed once. The advice to minimize your dependencies is an impractical one in a lot of cases (clearly) and not in your full control as you may acquire a surprising dependency due to transitiveness. And updating your dependencies is a best practice which in this case actually introduces the problem.

We need to focus on real ways to improve the supply chain. eg having repeatable idempotent builds with signed chain of trusts that are backed by real identities that can be prosecuted and burned. For example, it would be pretty effective counter incentive for talent if we could permanently ban this person from ever working on lots of projects. That’s typically how humans deal with members of a community who misbehave and we don’t have a good digital equivalent for software development. Of course that’s also dangerous as blackball environments tend to become weaponized.
That seems very unhealthy advice to give to young men.
> it has a nice URL today

`curl -fsSL https://install.tailscale.com | sh` wouldn't be any less nice. Append /sh if having something human-friendly at the root is desirable (SEO, etc.), and you're still at the same overall length as today.
This is an arms race that is largely won by attackers, actually. Sophisticated attacks are caught by them sometimes but usually the author has far more knowledge or cleverer tricks than the person implementing the checks, who is limited by their imagination of what they think an attacker might do.
CodeQL Gains Copilot Autofix
Pretty sure that is the monthly cost per user, not a flat monthly fee.
Can't use docker ecosystem.
configure would print that it's not enabled, so it seems like the kind of thing people would eventually notice.
It’s worse than that. Build.rs is in no way sandboxed which means you can inject all sorts of badness into downstream dependencies not to mention do things like steal crypto keys from developers. It’s really a sore spot for the Rust community (to be fair they’re not uniquely worse but that’s a fact poor standard to shoot for).
He can say it again, but it'll be doubly stupid the 2nd time.

The discussion was about PARC in the 70's. Not Intel now.
Do you think there can only be shortages if there's price fixing?

If not, please give an example that doesn't involve price fixing.

I'll give an example for my argument: If there's only enough food for 90 people out of 100 today, it's easy for anyone with enough money to get fed, but it is also a shortage of food.
Can you share any more info on this?
> I'm guessing Williams probably just didn't have the budget to build one and didn't know any better so they used Excel.

Ironic, because they've probably wasted a lot more time hammering Excel (or their heads on the keyboard) to get it to do what they want than if they had done some real programming.
The classic rant on this subject by McSherry, et al.

Scalability! But at what COST?

https://www.usenix.org/system/files/conference/hotos15/hotos...

We offer a new metric for big data platforms, COST,
or the Configuration that Outperforms a Single Thread.
The COST of a given platform for a given problem
is the hardware configuration required before the platform
outperforms a competent single-threaded implementation.
It's a brand new chip with the first boards (SiPeed's own Lichee Pi 4A) delivered to the first customers in around July (8 months ago). So new that support is not yet fully upstreamed to the Linux kernel and other things.

GCC 14 which will be released in May, I think, is just now adding support for that "pre ratification" Vector extension, under the name "XTheadVector". As well as binutils supporting assembly language for it (in parallel with 1.0) you can also write code using the C vector intrinsics and GCC will produce code for either XTheadVector or RVV 1.0 based only on changing compiler flags (no code changes are needed).

In short, it's not old, it's too new to be fully-supported yet. But will be in the near future.

And RVV 1.0, being even newer, is basically not available at all -- only on one board with a single core SoC and 0.5 GB of RAM. There is nothing comparable to this quad core 1.8 GHz 16 GB machine with RVV 1.0 In a year, maybe.
> There are simple usages like shifts to divide/multiply by 2.

Clean code should not do that as the compiler will do that.

Clean code should just say what it wants to do, not replace that with low-level performance optimizations. (Also wasn't performance to be obtained from newer hardware?)
If it was a commercially-managed forest, it's a bit dramatic to say it was "obliterated" any more than a cornfield gets "obliterated" when the corn is harvested in the fall. Tree seedlings would have been planted in the field soon after the wood was harvested.

The days of lumberjacks going into virgin forests to harvest wood in that area are over - it's all either national parks or other protected forests which might get thinned for fire management reasons but never clear-cut, or managed forests that periodically get harvested and replanted, just like corn and wheat. (Source: I grew up in Humboldt County and still have family there.)
What an amazing letter and message. Very helpful POV.
I don't think it fails the build. It's part of a test, trying to compile a bit of code. If it compiles the test is true and a certain feature is enabled. If the compilation fails the the feature is disabled.

This is quite common in build systems. I had such a test produce incorrect results in the kernel build system recently. The problem is that the tests should really look carefully for an expected error message. If the compilation fails with the expected message the test result is false. If the compilation fails for some other reason the build should fail so the developer is forced to investigate.

Disclaimer: I have not studied the xz build system in detail, just what I saw from the diff plus a bit of extrapolation.
International audience loved simpler English

just market-based natural evolution at work
True but irrelevant. I left out a lot of irrelevant details, because I was aiming for a simple explanation (if not quite one truly suited for a five–year–old).
Ya so we could have paid this dude to put the exploits in our programs good IDEA y
Sorry, I'm unfamiliar with PLT what does stand for?
Awards are a racket that perpetuate themselves by making money for a constellation of editors, magazines, and talk shows. They have little to do with talent and even less to do with readability. How many of the Academy Awards Best Picture nominees over the last five years has the average person watched and enjoyed? Book awards are even more out of touch. Also do you honestly think that winning the Presidential Medal of Freedom is an unbiased recommendation? It's a propaganda award.
Japanese gang figures got new livers at UCLA (2008)
There is an off the shelf product for what is described in the article - it’s an ERP that includes a WMS (or even possibly just a WMS plus some ordering/forecasting software).
The "deep state" organizations skew 90%+ Democrat.
I have no question about the downvotes, bud. You're very verbose. Still not sure why you revived an account you haven't commented with in 6 years just to run cover. I find you to be a highly suspicious individual and I really have nothing more to say to you.
> the houses in Canada aren't being bought up by rich people, they are being bought by middle and upper-middle class Canadians.

Sales don't happen in a vacuum. The middle and upper-middle have to pay that much because second in line is willing to pay almost as much. Matthews could make an offer of $999,999 on every house for sale in Toronto. He may not get any of them in the end, but in doing so he forces you to pay at least $1,000,000 if you want one.

After all, if you were the only interested party you could just throw a couple of bucks out there and eventually some seller will have to give in. Landowners will not hold a property only worth a couple of bucks in perpetuity. If nothing else, property taxes will eventually compel them to unload it. It's other interested buyers that push you to pay more.

> "Tech started to show promise" so you're saying that people stopped by homes?

Sure. Again, not a vacuum. To stick with the hypothetical for the sake of illustration, let's say Matthews was making such offers but now is enthralled by some AI startup in Montreal instead. By removing those $999,999 offers from the equation, that gives more room for you to come in at a lower price.
It is possible to prevent libraries from patching functions in other libraries; make those VM regions unwritable, don't let anyone make them writable, and adopt PAC or similar hardware protection so the kernel can't overwrite them either.
GPT4 Could Have Spotted the Xz Backdoor
Rootclaim $100k Lab Leak Debate
This appears to be the gist copy of https://news.ycombinator.com/item?id=39881044
Many years ago, I was sent in to, incidentally, a major car-parts reseller - almost all car parts in the EU and UK pass through this firm. This was a family business, dad had built the business, retired, and the kids were running the place. Pretty much the first order of business for the kids was the modernisation of the IT systems.

My initial task was to do an assessment of who was using what, and what for, which all went really smooth, until we got to the “accounting floor”. I couldn’t get in, as the accounting team had locked the doors, and locked themselves in. Part of the modernisation was replacing the 100% Excel-based parts/accounts/supplier/customer ERP system with something that wasn’t Excel, and they simply weren’t having any of it.

We walked away from that project, a competitor gleefully took it over, got caught in a swamp of technical and legal complications, and lost a lot of time, money, and people.
Parts tracking is an unsolved problem in general. Everyone in manufacturing is winging it in Excel or runs into enough chaos-complexity that violates the bounds of whatever software they’re using (homegrown or bought) that they port a part of the problem to Excel.

This is a billion dollar problem.
I'm reasonably sure it's a joke.
The difference between this and a cornfield is that from the looks of the pictures these trees weren't planted by people.

These trees took far longer to grow than a corn crop, far longer than a human lives. It's sad that they're gone.
Exactly I don't understand the obsession with Russia

Literally just a country with people like you and me.

"Jia Tan" does not sound Russian

https://boehs.org/node/everything-i-know-about-the-xz-backdo...
Australia, ancient precious rain forests turned into bark chips
Wonder how many of these folks are on big pharma’s payroll and feel a need to defend those profiting in the billions from patented blockbuster drugs. Thankfully Biosimilars are eating away at patented drug molecules/biologics to reduce prices.
This comment made me nauseous.
A stern letter to your parents if you don't might count as force.
$7k is a year worth of wages for your median Chinese, equivalent to roughly $25k in the US.

Also good luck leaving any country if proceedings have been started against you because of unpaid debt.
You say all this after recent documents were revealed about Facebook intercepting and analyzing Snapchat encrypted traffic via a man-in-the-middle conspiracy.
> LLMs for writing also suck. It might just be that the people using them don't value writing thst much.

That may be true for the use-case of "write me a good story", as the viral "Wonka Experience in Glasgow" scripts showed. But for what I assume is the usual use case for UpWork copywriting jobs, I'm not so sure. A ton of these jobs are essentially low-value marketing copy for things like banner ads, social media marketing, SEO-targeted blog posts, etc. You may say LLMs suck at writing, but it's not exactly like the human-authored writing for these kind of tasks was on par with Hamlet. My guess is there isn't a huge quality delta between the types of writing ChatGPT replaced and the ChatGPT version, which would explain why people are so willing to use AI for this kind of writing in the first place.

I contrast that with image generation. Pretty much all AI-generated imagery still has a "feel" of being AI (I've complained elsewhere of a trend where I see every blog post these days having a gratuitous and usually dumb AI header image), so for the most part I've seen "pure AI" images in places that previously would have had no images at all, but places that require quality still have humans creating images (though I have no doubt they are now using AI tools).
Has anyone ever done an architectural comparison between Redox and Fuschia? That would be quite interesting.
Why not use usearch instead of hnswlib similar to the official Clockhouse vector implementation?
Your "properly set up system" is apparently doing nothing other than running your single job. The vast majority of real-world systems have to deal with antagonists.

All of the characteristics you mention are true on production systems used in large scale fleets...and yet "bumps" happen...because there's never one thing happening. It's all the things, and it's always changing.

I'm gonna guess you do finance. A six microsecond fiber oneway is a thing of beauty. There are certain technical luxuries associated with that domain, and rarely any requirement to exhibit high utilization rates...or deal with antagonists running on the same hardware.
Not only are there different types of insulin, but there are different types of delivery mechanisms. "Convenience" is continually being "innovated."

Approval of biosimilars, state laws capping price, and manufacturer out of pocket max are driving down the price over the last 4 years.

https://www.goodrx.com/healthcare-access/research/how-much-d...
> because if that is the case, you're probably not using C/C++

The point is that this claim is more wrong than it should be, eg. that C/C++ is still used more than it should be partly because these GC myths persist, hence the article.
Also... The shot length of movies is getting shorter.
> Yorro Yorro: Everything Standing Up Alive by David Mowaljarlai

This looks incredible. Going to add it to my (always expanding) list.
What a weird comment. Yes, the article is mostly talking about how this is a trend that's been building over the last 25 years or so. Most of the specific research it cites is from pre 2020. It's like you are arguing against some imaginary article that claims to be talking about things specific to the last few years when the main point of the article is completely not that.

I mean even the subtitle describes that: "The pandemic played a role in increased consumption, but alcohol use among people 65 and older was climbing even before 2020"
> Parts tracking is an unsolved problem in general.

As somebody not at all familiar with the space -- why?
Very true, but don’t forget that Autoconf checks for “interesting” compiler choices as well as library and OS features. And then there is libtool, which abstracts out the differences between how compilers generate shared libraries so that you only have to understand one way of doing it and it will work on all of them.
Well, that's on me for saying "smartphone components" when I really wanted to emphasize the screens. Can smartphone screens be made in a significantly less expensive factory than print heads? Why or why not?
It needs to be raised by the opposing party in US courts, then the judge will consider flight risk and confiscate their passport if deemed necessary.
I used to do the shove it in and frantically thrash until it take shape. Then I learnt this system and it is much easier. For a king size: maybe just get someone to help.