skysight-inc/HackerNews huggingface dataset:
Neither does https://salsa.debian.org/debian/xz-utils/-/tree/v5.6.0/m4

The script was not present in the git tree, only in the released archives.

I'm also suggesting that there could be more than one exploit present. All of their commits should be rolled back, none of it can be trusted.
90s Programming Nuggets
There are situations where its hard to understand how even the non-verbal warnings didn't latch though.

There's "no unauthorized personnel", and then there's "Fire door, alarm will sound".

In college, i worked at a university recreation center, and the desk I worked at was about 15 feet from a fire door. It sat somewhat between the weight room and the men's locker room, so virtually all male customers walked past this specific, well marked, fire door during their visit. And about 2-3 times a week, while I was working, somebody would finish up their workout and just push that door open and walk out. And every time, they'd look thunderstruck that the alarm did in fact sound.

I eventually dropped all pretense of understanding that they were on autopilot, and began commenting as I deactivated and reactivated the alarm AGAIN "I thought universities required students be able to read". Only one person ever got short with me over that, and all I had to do was point at the letters that were bigger than their head, directly at eye level, 18 inches from their face, while they pushed the door open.
Previously [0][1](15 points 10 days ago 9 comments)

[0]: https://news.ycombinator.com/item?id=39762060
[1]: https://news.ycombinator.com/item?id=39762208
Have you considered fixing support via Cloudflare instead of offering free diamond tier support to the lucky users whose complaints you read?

My company recently started to offer premium support for more money, how about that?

"Pay 100$ to receive a response within 12 hours!"

"Pay 500$ to receive a response within an hour!"

More money for you, less frustrating and potentially business-ruining outages for customers.

Last example was comically quick to find by the way.

https://news.ycombinator.com/context?id=39317352
It’s funny that for an exactly same workload on AWS on raw Ec2 it ends up cheaper than the same cluster size on EKS…
“It is more efficient to turn gas into electricity”

I don’t think that’s correct. It may be true for highly variable/low loads where the pumping losses in the pistons dominates. However the majority of fuel consumption in a car happens at traveling speed (highway miles). That is the area that needs to be optimized for.

My 2015 Honda Accord Hybrid takes this approach. At below-freeway speeds the gas motor runs in series to drive an electric motor. At highway speeds, it engages a clutch and directly connects the engine to a low-loss 1-speed transmission.
> A backslash is the way things are escaped in most places.

Sure … but not by CSV. Backslash is hardly the only way, nor is the doubled-quote escape mechanism particularly obscure, given its presence in popular formats like CSV, SQL, or YAML.

> why would you "highly prefer you just emit standard CSV"?

Why would you prefer a baroque format?

So that it goes through a standard parser without needing extra, additional configuration. It's just CSV, and moreso, it's CSV without hoops or surprises that need to be transmitted out of band somehow.

> What is the benefit to insisting adherence to the original standard, especially if the modification fixes something that is broken?

That's not the case here, though: using backslash doesn't fix something that's broken.
Surprisingly hard to find information about this via Google. Seems related to Demis' game company Elixir and their game Republic: The Revolution [0] for which he made some claim that it supported an infinite level of detail/polygons.

Just a cursory glance at the information though. Happy to be corrected or have more detail added.

[0] https://en.wikipedia.org/wiki/Republic:_The_Revolution
Dionysian mysteries were popular in large portions of the Mediterranean at the time. Very little of what you mentioned was unique to dionysian practices and beliefs, so you'd need to have more than the immediate likeness as evidence.

What do you mean by "the Church would actively integrate local cultural iconography into the bible to make it's spread more palpable", can you give some examples of such iconography?
I don't understand why GM never put the Voltec drivetrain into a compact SUV. It would have sold much better than an odd looking hatchback with little interior space.
If we are willing to throw away the comma, use the ASCII RS, record separator symbol. It's exactly what you want, even has a visual ␞ these days.

It's a problem solved decades ago with solutions we've failed to adopt. Weird, buggy, poorly parsable CSV is still somehow the norm.

Not saying you should, but if you want to change, the answer is already there. Change has to start somewhere...
My favorite part was the analysis of "I'm not really a security researcher or reverse engineer but here's a complete breakdown of exactly how the behavior changes."

You only get this kind of humility when you're working with absolute wizards on a consistent basis.
Cloud is an abstraction over hardware. lLike any good abstraction, it makes certain tradeoffs.

Sometimes it makes sense to move to a lower level of abstraction, for performance, cost, or compatibility reasons. In this case, diving under the cloud and running your own servers could save 30% of your server costs.

Cloud adoption has shown that many (most?) companies prefer the convenience over cost savings. Maybe optimizing hardware spend is not the best way to optimize a business.
The entire reason is popularity/marketshare, and that's a really valid reason to choose tech like this.
I thought that's what the article was going to be about tbh.
The Linux kernel is complaining about a lack of funding for CI-one of the highest visibility projects out there. Where will the money come from for this?

Corps? Aside from Intel most of them barely pay to upstream their drivers.

The govt? The US federal government cut so much of it's support since the 70s and 80s.
> Not having hardware is someone else's profit.

But it's also someone else's economies of scale. The chances of me getting datacenter space, hardware, bandwidth, and expert 24/7 staffing at the same volume discounts they do is... slim. Particularly for the small amounts I'd need.
If people believe it threatens the integrity of the election then it already is a problem, whether it actually causes fraud or not.

Holding fair elections has no meaning unless people actually believe they are fair.

Also “abuse” doesn’t necessarily mean voter fraud. It can be as simple as being pressured by a family member to vote a certain way if you do it without privacy. If you vote alone in a booth that’s not an issue (and again - it’s an issue as soon as someone thinks it’s an issue).

Setting up mini polling places where people can cast early votes using the same procedure as on Election Day solves many problems without causing any new concerns. Other solutions have concerns however small.
Byju’s is downsizing, it doesn’t mean they’re “fake”. Is Meta fake by that metric? Adani is already back to where they were stock wise since Hindenburg. Flipkart literally has tens of millions of customers.
CLONE is indeed nifty. But why is it a plugin? And who don’t any of the major hosted services support it? (Or do they? The ones I checked don’t document any support.)

I wouldn’t call xtrabackup or
mydumper an out-of-the-box solution.
Nine writers on their Adderall use and experiences
Paid / unpaid?
> feigning ignorance

We have our hourly rate printed on a sign in our conference room. The walls are very clean, with almost no other signage. Despite communicating my rate to a client (via email) and having two meetings in this room, this particular client was shocked when they received my final bill which (again) stated our rate. I believe in this case they were just unhappy and looking for an "emotional plea" way out of payment.
Honestly, you only get this kind of humility when you're working with absolute wizards on a consistent basis. That's how I read that whole analysis. Absolutely fascinating.
probably the most likely and feasible way to detect such consciousness would be if it were to try to contact us. the bandwidth is obviously there. now this of course would be somewhat analogous to the likelihood of us trying to contact microbes on the moon, but you never know. has anyone tried to decode sunlight?
It is important to encourage a balanced approach to technology use. It's like with diets if you limit completely it is not good and can be ended by overuse
Related "Dilbert on Kubernetes"
Intent. It's a big part of law and prosecution.
If you need servers for the majority of your application, don't use AWS or any other mahor cloud provider. Their benefits come from economy of scale, so if you cannot be part of that economy, do something else.

And you can be part of it really only by doing cloud native stuff like Lambda, DynamoDB et al.
https://news.stanford.edu/2019/09/25/precision-physics-table...

https://phys.org/news/2014-12-world-compact-tabletop-particl...
I'd love to be at Microsoft right now and have the power to review this user's connection history to Github, even though VPN exists, many things can be learned from connection habits, links to ISPs, maybe even guess if VPNs were used, roundtrip time on connections can give hints.

I really don't think some random guy wants to weaken ssh just to extract some petty ransomware cash from a couple targets.
Yep. Plenty of people on the market with experience, and your employees know it’s a skill with market value, so they won’t resent your choice and start eyeing the door.
Learn to write cachable, scalable apps.

I'm expected to write a service like s3?
yeah the funny thing about these comments you have a bunch of people conflating a lot of stuff.

For people who think the USSR was "more corrupt" they're often talking about a narrow conception of corruption that is defined by the US on technical terms.
Or they're simply talking about the behavioral differences between rich vs poor countries.

Boeing's quality issues are a great example because it's very obviously corruption, but not in the US technical sense. But the reality is that Boeing and the US government basically said yeah fuck it, do your own QA for the 737 Max and then after the fuckups turned around and said okay we won't charge you the full fine. And that would have just gone away if the 787 fuckups didn't happen. Now suddnely people look really bad giving Boeing sweetheart enforcement deals.

Americans think corruption is a cop pocketing $ on the side of the highway, but it's not corruption when the cop confiscates $ on the side of the highway without trial, gives it to his police department, which pays out the confiscated funds as bonuses, new equipment, and other various frivolities.

At least the Soviets spit in your face when and how they wanted to and were limited by physicality. Americans make a Rube Golberg machine where saliva of their oligarchs is collected throughout the day in massive quantities and piped out of the building where it happens to land on your face 80% of the time. Then they will tell you it's your fault for being in the way of the spit pipes.

We cannot recognize corruption in the US because our corruption is mechanical, and we've precluded that mechanical things cannot be a form of corruption.

USSR corruption was more visceral and obvious, that's pretty much it. This makes a lot more sense if you understand that all measures of "corruption" don't define corruption but use the perception of corruption.

Another example. Ukraine is a corrupt country, no doubt about it. But the "anti-corruption" NGO complex in Ukraine essentially prevents certain laws from passing like sourcing laws which exist in all major developed countries. They see these laws as a form of corruption, which in and of themselves they're not. The other reality is that a lot of the anti-corruption NGO's are corrupt. The reason they argue against sourcing laws is because foreign entities stand to lose money if Ukraine has to buy a certain percentage of goods from Ukrainian factories. Foreign money buys NGO's easily there, so NGO's don't' want their funding to dry up. So everything is in stasis.

But by Western standards none of the above is "corruption" because while the people making these deals can likely speak freely, by Western standards it's really easy to hide this corruption as coincidental and unrelated business decisions.

In reality corruption itself is an industry because it's a way to make money and a tool to make money with. Corruption is not a really simple thing to adjudicate
I found that just using CloudRun and similar technologies is simpler and easier to manage than kubernetes. You need auto scaling, fast startup, limit number of concurrent connections to each instance, and scale to zero functionality.
Some contracts specify liquidated damages if deadlines are not met. The contracts I’ve been a party to have daily cash penalties that will quickly erode any margin away.
I'm a semi-recent convert back to iPhone from Pixel. One thing I deeply miss is spam filtering of text messages.

This is a huge lacking feature in iPhone. You don't get these kind of low-interest texts on Pixel. Truly spammy texts get filtered to a spam folder. Political texts like this still exist, but they don't generate notifications.

Note that political messages are specifically exempt from anti-spam legislation in the US.
You also have to keep in mind that the average consumer is…quite stupid, or more charitably quite sensitive. There are lots of cars on the market today with CVTs (continuously variable transmissions) that enable the motor to always be driven in the most optimal RPM. However in software, the engines are intentionally driven at less efficient rpm’s so that the driver can feel steps and lurches as the car accelerates which is somehow more “correct” to the average car buyer.
Maybe it's good for GitHub, GitLab, etc. to be as open and liberal as possible with its definition of open source, but I think there is definitely an argument to be made that businesses making source available without actually open-sourcing it should pay to have it hosted. GitHub didn't become proactive about asking users to add licenses to repos until far into its existence, and there's plenty of code there that doesn't have an explicit license, but I think participating in the open source community should actually require that your source is open. License proliferation is already an issue, but adding non-open source to GitHub seems especially dangerous to me. The license should be highlighted in bright red with a big note saying that users are not allowed to do what they will with the source code.
> What if a vendor just decides they don't like me

Why would that happen? Vendor lockin is a real concern, but worrying that AWS will decide they don't like you is not rational.

No vendor wants to earn a reputation of being that hostile to its own customer base, and so unless you are doing something that is likely going to raise eyebrows you'll be fine.
Are you familiar with the writings of Paul Feyerabend?
It's not their number so much as their energy. The cross section for energetic neutrinos interacting with matter scales as energy squared, if I recall correctly. These neutrinos have cross sections too low to shield, but too high to ignore.
There was also a bug report in Debian which requested updating xz-utils to 5.6.1: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708
HOW is it compare to phi-2?
I'm using Rider with this. There's a Nix flake in the Wayland testing issue in the jbr repo for those interested. It's looking really good so far, I'm very much enjoying the reduction in latency.
yes and I block them all. T-Mobile has been hacked so many times I don't trust any of it anymore.
> I haven't lost interest but my ability to care has been fairly limited
mostly due to longterm mental health issues but also due to some other
things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and
perhaps he will have a bigger role in the future, we'll see.

https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...
Polanski spent decades in Switzerland (small luxury ski resort Gstaad), not so much France.

I dont claim to know the details of his case, but setup above is generally not uncommon, swiss even have special residency permit for folks bringing millions+ into the country, no need for pesky jobs like us peasants.
This thread and study seem to disagree with your assessment: https://x.com/captgouda24/status/1773031323604488342?s=20
It doesn't need to be TS for open source(but for closed, I'm leaning yes). But all code for these core technologies need to be tied to a real person that can be charged in western nations. Yes, it will make it harder to get people, but with how important these technologies are, we really should not be using some random guys code in the kernel.
I made a political donation a few elections ago. I now get 5+ new political text messages a day.
Let’s not get started on how large the kernel is. Large code bases increase attack surface, period. The only sensible solution is to micro service out the pieces and only install the bare essentials. Why does the an x86 server come with Bluetooth drivers baked in?

The kernel devs are wasting time writing one offs for every vendor known to man, and it ships to desktops too.
Some more discussion: https://news.ycombinator.com/item?id=39857680
Do you get a lot in Romania? I would suspect there's about 15 other more popular countries in Europe for Americans to visit... The UK, Ireland, Spain, France, Italy, Portugal, Germany, Austria, Switzerland, Czechia, Greece, Turkey, Netherlands, etc are all more popular to go to as an American than Romania.
No. We chose ECS instead :-)

That said, we are planning on doing a cloud exit in the future. I don't feel we need Kubernetes, but we do need to orchestrate containers. In our case, it's less scale, and more isolation.
Yes! Also that many attempts to centralize podcasts have failed. At least in my experience it’s been very easy to avoid Spotify or Audible’s locked down podcast offerings.
Sometimes I like to fantasize that i'm in the Sims 4 game and controlled by someone and have no will. It gives me chills
I think they just underestimate how much people investigate and think about strange things that doesn't add up.
Agreed, this feels like someone put an argument about tabs vs spaces at the top of the description for an editor. Like yes, you will have to choose whether to use systemd, but the argument for or against systemd doesn't feel like it belongs here in a list of 'minimalist user space programs/services'. From my perspective the only lens you can view this through that's even closely related is that systemd doesn't follow the Unix philosophy of 'do one thing and do it well', but that's not exactly an argument for or against minimalism. I'd argue that almost everything systemd brings to the table in a default setup are all things you'd need anyway, minimalist or otherwise. They're just all handled by one overarching service, which I think is the real argument against systemd.
In Greece right now, there is a scandal from an MP of the ruling party, grabbing electoral data right from the Ministry of Interior and using it for the EU Parliament elections. She had to withdraw her candidacy.

Call me paranoid, but I have a hunch that Cambridge Analytica never went away and the whole thing was used as a demo to show that their techniques can be used for other campaigns.
> had all sorts of issues with Safari

Tangential rant, but this appears to be intentional. As far as I can tell, Apple is intentionally lagging behind supporting various web technologies, to make the web as unattractive as possible (within their ecosystem), and by extension, to make native app development as attractive as possible, so they can take a cut of the profits.

If their reasoning is correct, then they would actually lose money by not investing into their own browser engine, which is somewhat amusing, because the worse of a job they do, the more money they make.

(I find this idea particularly painful in the context of "we at Apple love web technology so much, we're going to use our love of web as our main excuse for killing Flash"...)
I've see this happen to a number of friends. Most of them have enough saving that they can 'retire', but none of them wanted to retire yet. It often means moving away from friends to implement a lower cost-of-living. Once you are >40, it can be hard to find a job. You are too experienced for mid-level roles, but your core skillset may no longer be relevant. e.g. There are far fewer Win32 developers than 10 years ago, but retraining to be a web developer can be a big challenge. I've also seen people get promoted to a managment level, based on a targetted skillset, where it can be hard to find find a new role.
Show HN: Understand your existing healthcare benefits cost and coverage
I made an app because my friends kept asking me to help them understand their healthcare benefits so I thought this might be useful. People have no idea what is covered and what it costs. Thanks
No. There's no good reason HTTP response decoding would ever be implemented in terms of libarchive; using libz directly is simpler and supports some use cases (like streaming reads) which libarchive doesn't.
Wandb/openui: describe UI using your imagination
Ha ha, clever :)
Paid. Looks like they changed it to "take whatever time you need", and most people are taking 4-8 months.

https://jobs.netflix.com/work-life-philosophy
I can't compare to the past as I was a post-Borders-closure resident of Davis, but we do still have the Logos books that's connected to the library, plus the monthly book sales at the library itself. There's also Avid Reader for new books. I wouldn't really call it a "book desert". Time Tested Books over in Sac's midtown is also a great stop.
Curious - what is your bearish case for profitability of affiliate marketing?
Wikipedia has had a banner for 20 of the last 20 years, claiming not to be able to pay hosting and management bills, while hosting and management represent about 1% of their global finances, while they have various endeavours like hiring paid rewriters to rewrite Wikipedia in various political ways.
I bet that a fair quote of them were hunting bears
Making cat not do something is really difficult
Your first full-time sysadmin is an expensive hire. So is your first DBA. And even if your database backups are working now, there's a good chance they'll silently break in the next several years.

The simplest thing you could do is to build a single-container application, and deploy it a Heroku-like system with a fully managed database. If this actually works for your use case, then definitely avoid Kubernetes.

But eventually you'll reach a point where you need to run a dozen different things, spread out across a bunch of servers. You'll need cron jobs and Grafana and maybe some centralized way to manage secrets. You'll need a bunch of other things. At this point, a managed Kuberentes cluster is no worse than any other option. It's lighter weight than 50 pages of Terraform. You won't need to worry about how to get customized init scripts into an autoscaling group.

The price is that you'll need to read an O'Reily book, you'll need to write a moderate amount of YAML, and you'll need to pay attention to the signs reading Here There Be Dragons.

Kuberentes isn't the only way to tackle problems at this scale. But I've used Terraform and ECS and Chef and even a custom RPM package repo. And none of these approaches were signficantly simpler than Kubernetes once you deployed a full, working system for a medium-sized organization.
Does this site return something different if it detects a Google/Facebook/Amazon corporate IP visiting?