skysight-inc/HackerNews huggingface dataset:
I'm under no illusions that this is a totally new thought, but for me first with cryptocurrencies, then "AI", and now this, the fundamental issue that the biggest problems come back to is one of trust. Cryptocurrencies try to code around it, LLM boosters try to dazzle you into it, and the attacker here half-succeeded in laundering it. The most consequential (rightly or wrongly) technologists of our time are failing to properly think about trust. In this case, the failure was 100% understandable – I have all the sympathy for burnt-out and (almost always) unpaid open source developers. In each case, capital either lures people away from thinking about trust, or neglects and exploits people to the point that they're broken down.
For GPUs where Nvidia has turned off P2P, can RAM or NVMe drives be used for emulating P2P? Let’s assume you have a RAID AIC with 4 or 8 high speed SSDs. Could you make 3 3090s work as well as 3 A5000 RTX for training a model?
Your comment suggests lots of ways the target can be achieved:

> Either it's used by agriculture to export food all around the world

Simple. Produce and export less food. People will clear mature forest elsewhere to meet make up for that food, but that is someone else's problem as far as this scheme is concerned.

> And logging companies that chop down trees were already obligated to replant the forest

Take that obligation away from them, and plant the trees on the freed up land under this scheme instead.

This is what happens with most tree planting and carbon offset schemes. As others have said the most important thing is to preserve existing ecosystems, but there is no money in not doing things.
That does not sound like the type of machine that I want to work on. I still require a general purpose computer.
This is a very good article, written well for an audience that might not understand the details of memory layouts.

Also, in the 0x0x11223344556677889900aabbccddeeff sample value they're using, what is this 0x0x format? Is this some some low level asm thing, or is it just a formatting typo?
> for TLS traffic you need to also install onavo.

I'd be interested to know if it shipped as part of the Facebook SDK, as well.
IMO PRs are supposed to do one thing. But they might end up doing a few more things like refactor, clean up whitespace, or even add a new function in order to facilitate the change. And all of these can be put into their own commits.

Now you can make like five PRs for each of those commits. But that seems similar to making five <issue tracker> issues for those commits. You’re already there in the PR. You might not need the overhead of N external items for N commits.
You're not talking about forests, you're talking about tree farms. Man-made "forests" are monocultures that are extremely susceptible to environmental hazards and the trees are usually intentionally short-lived. In Europe for example there are barely any natural forests left because most so-called forests were planted for pre-modern industrial uses.

Forests are good at carbon capture but forests are intricate biotopes with different plants serving different functions and debris from dead trees fulfilling an integral role.

Building more homes is definitely important but suburbia is probably one of the worst ways to do this as sustainable housing must be walkable and integrated, not car-centric like American suburbia always is. It also assumes those homes will last for centuries when most American houses are torn down and rebuilt on much shorter cycles than that. And that doesn't even get into how building more homes generates emmissions first.
It's standard autoconf stuff, BUT... the right thing to do for a security option should be to throw an error at the configure stage If the Option is requested but can't be supported, And not to silently turn it off.

That is because a human should have to Look at the build and manually make the decision to switch off a security feature from the build.
Classic example of this being Stuxnet, a worm that exploited four(!) different 0-days and infected hundreds of thousands of computers with the ultimate goal of destroying centrifuges associated with Iran’s nuclear program.
> Even writing it down here I'm worried I sound like I'm trying to curate a closed community of ego-boosting yes men.

There's this weird trend that's been happening for some time now that tries to make non-fully-open groups look wrong, but honestly, has anything ever actually been done by such open groups? As far as I can tell, "closed community" is a necessary (but not sufficient) condition for any kind of quality creative output (this includes individual projects as single-person closed group). Having a core of creators surrounded by distinct group of fans and secondary contributors is a natural organization that forms spontaneously.
And what is the purpose of that ownership?

To coerce otherwise nonprofitable behavior from Intel instead of paying for desired changes?

Shareholders and talent will flee.
It'll vary by service. For food, most people simply want to eat, and food is relatively cheap. Restaurants don't mind giving away free food when they mess up and customers may not mind getting free food. The CS bar is very low and it's way better than having a refund on record.

Something like clothes retail may not be able to do this. The customer wants specific clothes, and any ol' accessory won't suffice for a frustrated customer. A tailor may be much more efficient for a much longer time as AI overlords take over.

>For better or for worse it's the end of customer service as we know it.

in all fairness, CS has fallen off a cliff for the exact reasons you highlight. Companies have wanted to automate/cheaify CS for decades at this point, so I'm not surprised this is one of the first industries AI is gaining mass adoption in.
To be clear, I'm not at all against compensating developers for their work. I am not trying to argue that people do not need to be supported financially, or that you shouldn't donate, or that no one should be able to make a living working on free software, and so on.

What I'm saying is that paying people (or having a trusted security team) to work on software necessarily makes it less free. Note that "less free" doesn't mean worthless and absolutely free isn't the ideal.

Sorry, I used "everybody" to mean a subset of everybody -- the "we" that you referred to, or people generally involved in open source software development.

> it's a shame that so many people know, and yet are unwilling to financially support developers to change that.

Regardless of which set of everyone, this is undoubtedly the case. However, I'm not sure that paying (some of) the developers a wage is the best way to improve the software, particularly as free software.

> initiatives like DigitalOcean's Hacktoberfest, are designed to do just this.

You've got this backwards.
Hacktoberfest is a scheme to pay (more) people to contribute (more) to open source projects.
This is an example of why paying people to work on open source doesn't necessarily improve the software.
It also doesn't lower any barriers, it just increases the incentive to overcome them.

So while this might increase the number of people contributing[0] to open source projects,
it doesn't directly increase the number of people who understand and care about the specific project they're contributing to, let alone the broader free software movement.

In short, you can't pay people to care.

[0] according to their pretty weak metric for what contributing is
You can build multiple pseudonymous identities in parallel. If one is burned, it doesn't matter, you still have 9 other.
So far I’ve gotten to the end for a few colors. Quite fun, took my about 20-30 guesses!
Then the cardinality of the marketable featureset is inversely proportional to the feature diversity of market preferences, yeah?
I mean, I agree that the punctuation mishap is a better cover story, but why would any particular language have “zero chance” of being mapped to the programmer’s keyboard?
Really, world backup day should've been on Good Friday so that world restore day could be on Easter Monday.

Jesus Saves! (and takes daily snapshots which he uploads to a secure offsite location)
> As a reviewer, —amend means I need to reread the whole commit to see what changed. A tiny commit means it takes me seconds.

A `git commit --fixup` commit can be made which does that. Then when the review is done `git rebase -i --autosquash`. Like squashing but with fine-grained control.
This is some dry humor.
The new growth also needs to account for the emissions of cutting down and processing the old trees (even with solar, machines don't run on sunshine alone) and planting/nurturing the new growth itself. The prof was likely just trying to be provocative, not speaking based on thorough modelling.
First thing I install on linux / macos. Life without two panels is not a way to live.
We also sell wood to the US.
Here is a quote from Facebook/Meta's legal council to the Judge.
In this document "Advertisers" refers to Snapchat, YouTube and Amazon.

"... the Wiretap Act provides that an interception is not unlawful if a party to the
communication “has given prior consent to such interception.” 18 U.S.C. § 2511(2)(d). Advertisers
conspicuously fail to mention—and apparently do not contest—that Meta obtained participants’
prior consent to participate in the Facebook Research App, and with good reason: Participants
affirmatively consented to “Facebook … collecting data about [their] Internet browsing activity
and app usage” to enable Facebook to “understand how [they] browse the Internet, how [they] use
the features in the apps [they’ve] installed, and how people interact with the content [they] send
and receive."

So users consented?
Fun! This takes me back to coding up websites in plain HTML in Notepad. Coming up with the right hex codes for colors was an essential skill!
>but most readers feel cheated when reading it.

To be fair, a lot of the SEO optimized crap on the internet makes the reader feel cheated these days. I'm not too surprised if some sites have already started deploying such services as they gut out the remainder of their labor.
> ... but obviously creates predators as more people are exposed.

If we look at more traditional porn; the uptick in availability seems to have correlated with less sex. And the advent of violent video-games is associated with no uptick in violence as far as I have been told, although it is getting harder for armies to recruit.

I reckon the default position here is if you give people a dopamine hit when they are staring at a screen, they stare at a screen more. Not that they start harming others. The idea that we don't want marginal cases to wake up a sexual love for children makes sense to me, but I don't think more "predators" will be created; we'd probably just see a collapse in the economic incentives currently in place to harm children.
Windows applications can easily install TLS root certificates, which essentially all „anti virus“ tools (i.e. snake oil) do. On Linux, it’s obvious; if you’re installing something as root, you can add certificates. In that context, apple is doing something right and makes it rather tedious to install root certs
AskHK: What are good photo edition tools for macOS? (between GIMP and Preview)
I'm currently using Preview, which is the default but VERY limited to edit images.
Online we have Photopea which works great, but its online with ads.
I wanted to know if some where using something simple (no need for something as advanced as GIMP or PhotoShop), but with more features than Preview. Ideally something like Photopea.
Thank you
also allowed in commercial settings (BSD style license):

Phoenix Slides https://blyt.net/phxslides/

open-source, ignore the simple web page, software is awesome.
The obvious, but not yet pointed out part here -- not everything we call "EE" here is actually using EET/EEST.
> The point of squash is that the "history" is nonsense like "fix" etc. […]

Using squash when appropriate is good. But then it should be generalized to “rebase” since that doesn’t ever imply a certain strategy like “squash everything”.

> Blindly squashing every branch down into one commit is stupid, though.

Yep, which is what OP is complaining about (mandatory squash).
I personally like "FSViewer" way more. It's customizable, portable and free. It was my favorite software, which was replaced by "XYPlorer", which is a fileExplorer alternative.

FSViewer link: https://www.faststone.org/FSViewerDetail.htm
XYPlorer link: https://www.xyplorer.com/
Noooooooo you can’t ask them to pay! You’re supposed to do this for the good of the community only! They ought to be able to take whatever you do and resell at their leisure, after all you made it open source!
Yes, the US and Europe have their domestic car industries to protect. Most of the other continents/countries don't, so they typically have few qualms substituting their traditional American/European/Japanese/Korean imports with Chinese imports.
I’ve always wondered why they don’t do this already, it seems like a natural design feature to build around. Pandora had the same problem, if not worse. YouTube has it too, perhaps not as badly, but they’re kind of also their own SSP. If I had to guess, they don’t want to go making a lot of bad recommendations so they stay in a safe lane, and they probably also (more importantly?) have some contractual quotas to hit with big publishing partners.
This ignores the very fact that peer pressure works and puts the entire blame on the victim. No, people react differently when pressured vs when not pressured. That's the entire reason why peer pressure works.
My question is just why? They are perfectly good in a ball form.
I like this tool for Restic: https://github.com/emuell/restic-browser
I had visions of robot dogs breaking down picket lines.
Honestly because at bigger corporations customers usually pay to solve specific problems. They literally don’t care if you use x y z technology. Can you solve their problem? The technology, even for a tech company, is usually never the primary concern for the end user unless your end user is technical.

Why take a risk in this case when you’re running a business that’s already printing dollar bills?

I would personally never use any niche technology to build UIs. I stick to what is easiest and cheapest to develop, deploy, and maintain. It’s 2024 and most people who pay have high speed internet. It’s not 2008 anymore. 20kb vs 8kb vs spending millions of dollars on refactor or learning. I mean it’s a business not a hackathon right?

I am all for people trying out new things. But unless those things add significant ROI to the business they’re not worth using. If it happens to align then yeah the business should do it, or pull a Meta with react. Just my opinion.
Some random thoughts:

- every Fortune 500 company tracks exactly which FOSS code it includes in its ecosystem (usually code scanning and fingerprinting - can’t remember the usual
Provider of such)

- this is essentially the software BOM that Biden signed a while back.

- this (made public) would give a real time map of the dependancies of all organisations - and linking that to things like the above thread (“cry for help”) would be an interesting place for “intervention” - anything from plain old cash to “here are three interns doing two years in gov.uk. They will help for the next 2 years

(It’s not a great idea that last one but we need to start somewhere- no way can government “pick winners” but also no way can society just sit back and hope. And commercial incentives break this horribly.

Essentially we are going to find at some point we treat some developers like lawyers - this stuff is our societies laws, rules, processes
How to you know they don't?

When a state actor says "We found this exploit", people will get paranoid and wondering if the fix is actually an exploit.

Not saying it happened in this case, but it's really easy for a state actor to hide an extensive audit behind some parallel construction. Just create a cover story pretending to be a random user who randomly noticed ssh logins being slow, and use that story to point maintainers to the problem, without triggering anyone's paranoia, or giving other state actors evidence of your auditing capabilities.
We just vote with our wallets... sadly, social media is "free" and your wallet is simply your views instead of actual money. Transactions that frictionless naturally means the endgame for social media is the lowest common denominator.

Now for premium media I'm sure this is going to be "outsourcing 2.0" as companies try to overcorrect on minimizing labor and then rehiring back some/most of it when inevitably the consumer notices the quality of their products taking a nosedive. But it'll be a rough few years as that happens.
Tesla scraps Elon Musk's no-advertising mantra as stock nosedives nearly 30%
You've got it mostly right but in this case there would be no racoon dog in the chain. It would be a lab leak. I'm about 30% on that, but what I say is a worker from the lab infecting people at the wet market (or infecting someone who goes to the market, etc) takes up most of that probability.
"I don't feel like it, if it's important to you then feel free to fork".

That's really all that's needed.

that's much harder than it sounds.

having someone fork your project can give you the feeling of loosing control over the project as potentially all your users might go with the fork. that fear is often strong enough to push yourself to do things that will avoid a fork.

it's a desire for harmony and a fear of conflict
What could be done, I think, is patch the exploit into logging the payload (and perhaps some network state?) instead of executing it to be able to analyse it. Analyse it, in the unlikely case that the owner of the key would still try their luck using it after discovery, on a patched system.

What it does: it's full RCE, remote code execution, it does whatever the attacker decides to upload. No mystery there.
I think there are huge factors that push things both for and against open source here.

Yes, you get more eyes and people like Andres Freund.

However, if this had been a mole in a company, he wouldn't be able to hide behind a possibly anonymous fake persona and (likely) be immune from any consequences/fallout from this attack. It would be harder to gain entry in the first place, he would have needed a real identity. Background checks may not be a big hurdle, but they're at least something more than signing up for a GitHub account. He also wouldn't have had his posse of anonymous sock puppet accounts to add pressure to the original maintainer.

I also think that just being able to ramp up on liblzma and its dependencies to undertake this effort in the first place is a huge head start vs. trying to execute the same attack on a closed source corporate product.

At the same time, there are probably lower hanging fruits to attack if you really do get a mole inside a company, in addition to there being fewer eyes/opportunities for the attacks to be discovered as you pointed out.

I honestly don't know how all of these factors add up. I expect the argument opposite to yours to be raised (again) in the wake of this incident. I'd personally be hesitant to raise this argument (not that it matters here on HN).
Articles of Interest podcast did an episode on Paisley if anyone wants to know more
Show HN: Truncate, a word-based strategy game
Truncate is a chess flavoured word game that blends spatial reasoning and wordplay. In puzzle mode, you beat back your NPC opponent's words and take over their territory.

Truncate started as a pen and paper game between a friend and I, evolved into a handmade board game, and finally arrived at an online puzzle game. Like any good word game, there is of course a daily mode, shareable with the tried and true grid of emojis

We've been playtesting it with friends and family for a few months, which has helped iron out the tutorials and gameplay, and we're finally happy with an MVP worth sharing!

Technical deets: The client and server are written in Rust, with the visuals built using egui (as an experiment in Rust's GUI ecosystem).

We'd love any feedback!
There was a link in this thread pointing to commit times analysis and it kinda checks out. Adding some cultural and outside world context, I can guess which alphabet this three-four-six-letter agency uses to spell it's name at least.
The dialog about this in Ireland is "you can't tax HOUSES that's your gran's HOME you MONSTER!" (gran lives in dun laoghaire, poor thing) but 4 people renting a flat commuting to Dublin from Athlone with a few euro in trading212 or whatever are robber barons who should be taxed to the hilt. Not to mention the health service is appallingly bad and getting anything done takes an eternity.

And I failed to mention, it's not just the lack of capital gains tax, it's the lack of meaningful property tax. My own prop taxes were €103 a year (for a dump in Offaly admittedly) but they're close to zero for the most part.

So local renters work hard and pay mountains of tax to provide infrastructure (though most of it is crap stroads admittedly) making your own house worth more, so making you richer, and that value is never captured at any point or allowed to help the people who made it possible.
you are are answering your own questions with chatgpt to advertise your own app that isnt a PWA.
I am a CMake novice. Is that true for CMake in this example?
I see people saying "this almost succeeded". It didn't almost succeed, it succeeded entirely. It made it to production, for a long time (? I'm not sure how long it was in repos).

Success is making it to some machine, and then it's "how long it's successful for". Who knows how many other such vulnerabilities there are, and the openness of the source didn't protect us as quickly as we thought it would.
cool story bro/chatgpt.
I actually avoided installing Rust originally because I thought that install page was hijacked by an attacker or something.

Most languages don't have the prettiest install flows, but a random `curl | sh` is just lunacy if you're at all security conscious
It's not corporate level it was/is religious group level (of which this particular org I'm guessing largely employed staff from that religion). They are well known within our country to be quite insular.

It certainly seemed for all intents and purposes if you were a member of _____ group (wider than the company) you had the vpn on your device, and it was filtering content. I've found other reports in other countries of that happening with the same group.

So it's not corporate content filtering, it's personal content filtering and our app got caught up in it (and approved).

It certainly made my skin crawl for anyone in that religion. That means the central filtering service could be reading messages. Not sure if they're that sophisticated but certainly they didn't want people to see random images/videos.
> but now it's a big software, and it has just as many problems as any Linux distribution

Could you elaborate? The TCB did not increase since almost the beginning of Qubes. Moreover, the hardware-assisted virtualization by default improved the security a lot. Also, Qubes is not a Linux distribution: https://www.qubes-os.org/faq/#is-qubes-just-another-linux-di...