skysight-inc/HackerNews huggingface dataset:
What about it blew your mind?

Are you implying it's because a rewrite took less time than the first version?
I do that and while the shaking is unpredictable and often requires doing it from multiple sides, I find it a strong but strangely pleasant exercise for my shoulders.
And yet, the reason tracing GCs are chosen by virtually all high-performance languages that heavily rely on GC is that they've been found to be faster in practice for the common workloads.

One of the reasons why your intuition is not so straightforward is that a tracing GC needs to do no work whatsoever when the number of references is zero. One of the common ways to teach the basics of GC is by starting out as looking at tracing and refcounting as duals: refcounting needs to work to free objects, while tracing works to keep them alive. If you thinking in terms of what work needs to be done to promptly determine when an object becomes garbage, then you're already not thinking in terms of tracing, because tracing never actually needs to learn about when an object becomes garbage (this isn't actually true when they do reference processing, but that's another story).

Or, if you want to think about it another way, in a tracing collector there are already only two cases no matter how many pointers there are to an object: reachable or not, i.e. the same one and zero as in your case, only there isn't even a need to ever set the counter to zero.

However, in principle tracing and refcounting can be quite similar (https://www.cs.cornell.edu/courses/cs6120/2019fa/blog/unifie...) in their behaviour, but in practice most refcounting GCs in industry use are crude, and don't match the performance of tracing GCs in common use, which are quite sophisticated.
The type inference in F# is somewhat limited in a pleasing way. It prevents getting too far lost without doing yourself the favor of adding types here and there. My understanding was that it was a deliberate choice to simplify/speed up compilation.
So what's going on there if it's not a secret? Yes... I do know the name.
Smoke Signal
Don't do that. good data design and architecture is always needed.
A TCP proxy discards the user's IP address, unless you use something like the PROXY protocol[1], which then needs to be supported by the target HTTPS server. You would also need a way to prevent unauthorized users from injecting their own PROXY header.

This isn't a problem if you don't need the user's IP address at all, but it's often useful for logging and abuse detection.

[1] https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
Why do you consider it a waste of time?
Except had we been doing that they would have put guards in place to detect it - as they already had guards to avoid the code path when a debugger is attached, to avoid building the payload in when it's not one of the target systems, and so on. Their evasion was fairly extensive, so we'd need many novel dynamic systems to stand a chance, and we'd have to guard those systems extremely tightly - the author got patches into oss-fuzz as well to "squash false positives". All in all, adding more arms to the arms race does raise the bar, but the bar they surpassed already demonstrated tenacity, long term thinking, and significant defense and detection evasion efforts.
Hooray! I've been running successive release candidates in a VM for a couple of weeks now, just upgraded to 10.0-RC6 this week. Guess I'll do another upgrade soon.
I love(d) infan view, but just got used to (a portable version of) Xnview. I keep going back to irfan, but again - as much as it is an amazing piece of software, Xn for me.
Which strongly suggests that they planned and/or executed more backdoors via Jia Tan’s access.
As I am approaching the retirement age, I don't see this happening. I actually can't even imagine education expiring somehow or marketable skills needing "retooling". But even if these scenarios all happened, you are basically advocating that somebody still have to provide highly paying job for you even though you don't have an education or skill and there are plenty of people who are higher skilled than you? Would you hire somebody like that to do work on your house or, perhaps, you'd like to receive medical treatment from a doctor like that? If not, why others should hire you?
Doesn’t work with “live” photos.
It does for me. Firefox on Android.
Sadly the NDP have lost their way and will not be winning an election for a long time. Jagmeet needs to be replaced. Move away from liberal policies and create their own political agenda that defines them.
It's also the case that song structures have shifted as recording and songwriting has become more often sampling and copy/paste than capturing an entire live performance. A lot of top 40 songs now couldn't even exist without the digital tools that enabled them. The use of sampled repeated vocals as background lines might skew the results a bit.
The book “Algorithms to live by” comes close
The real problem was doing expensive math for every connection. If it had relied on a cookie or some simpler-to-compute pre-filter, no one would have been the wiser.
Do you have a citation? I didn’t know the idea went back that far.
Yeah, it bothers me so much. They really seem to think that "law is code".
I specifically opened this diff to search for a sneaky dot, knowing it’s there, and wasn’t able to find it until I checked the revert patch
Really interesting trends. I was surprised to see that graphic design jobs not only got more in demand but also paid more. Also interesting to see that people seem to be more interested in integration than developing new ml tech. Kind of makes me think the right time to get into ml was 5 years ago.
Yes it does, but I've not dug into the more sophisticated parts of the API at all yet. I'm using it in the most basic way possible right now:

const {data: {text}} = await worker.recognize(imageUrl);
Oh! Is this a bit like Cube World?
I loved that game before the developer dropped of the face of the planet, then came back and changed everything...
AFU – Archives for the Unexplained
The are a lot of sources of error in the system other than long duty hours for residents and alternatives e.g. shorter duty hours introduce error at other points and individuals in healthcare. Should something be done? Sure, reducing error is obviously good but its simplistic to attribute it to this or think alternatives aren't worse. I personally also think the trend shorter duty hours in medical school and residency when you have that support is it's own problem of not learning enough to be as competent (and at the expense of career longevity for practicing physicians as inevitably all that gets dumped on the attending).
"crazytan" is the LinkedIn profile of a security software engineer named Jia Tan in Sunnyvale working at Snowflake, who attended Shanghai Jiao Tong University from 2011 to 2015 and Georgia Institute of Technology from 2015 to 2017. However, this Jia Tan on LinkedIn might not be the same Jia Tan who worked on XZ Utils. Also, the person who inserted the malicious code might be someone else who hijacked the account of the Jia Tan who worked on XZ Utils.
Andy Guitar
He is teaching me how to play the ukulele.
https://youtube.com/@MikeBoyd

Easily Mike Boyd!

The beauty of his channel is he doesn’t allow himself to use the internet or look anything up. It’s all trial and error, (and the editing is really well done)
I take it you're in a warmer climate, a regular blanket is insufficient for many months of a year here. Like growing up, I had multiple blankets and a duvet, and had similar in some less well insulated houses I've lived in. My current house is better insulated, so a duvet on its own is generally sufficient.
the call to system is obfuscated, static analysis wouldn't see it
Pet peeve: out of context release announcements.

From the README.md: Veloren is a multiplayer voxel RPG written in Rust. It is inspired by games such as Cube World, The Legend of Zelda: Breath of the Wild, Dwarf Fortress and Minecraft. The game is in active development and enjoys a flourishing player community.
There's some articles that discuss this switch. It may be a generational preference.

https://www.yahoo.com/lifestyle/why-millennials-aren-apos-t-...
A sheet covering the mattress, then we lying on top, then the duvet covering us to varying degrees of area and precision depending on temperature and activity while asleep. My son snakes over and under the duvet several times along his body.
> Frankly the US pays for the cost of the research while the rest of the world just pays for the cost of production.

Top 10 pharma companies, 5/10 are US (2 UK, 2 Swiss, 1 French).

4 of the top 6 for profit margins (from 43%(!) to 19%) are US (Merck is the only outlier, 9th, at 10%).

4 of the top 5 for Sales and Marketing Spend (both on raw dollars and as a percentage of revenue) are US.

3 of the bottom 5 for R&D spend (as a percentage of revenue) are US.

Source: http://www.bbc.com/news/business-28212223
I'd not heard of refinement culture until now. I Googled it and it appears to be to do with how sports strategies and advertisements are finely tuned to squeeze out the maximum probability of success. Which sounds like "heavily optimizing for a certain metric" is a better description than "high quality", and applies also to pop music.
Making things better is forcing website owners to go back to server-side rendered applications. I just blocked the JS files on my self-hosted instance of Gitea to load, and the resulting total size is close to 900kb, with my profile picture file at 250kb. It is still usable. With JS files, the whole thing is 2.2mb and took two seconds to render (0.7 seconds for file transfers). Caching was disabled. Most websites shouldn't be SPA. And the actual instantaneous navigation argument is often negated by slow data loading. Instead of the browser showing a loading bar, it's the application doing it.

As you can't control other people's choices, you can only control your environment. Which often means Firefox+Ublock/NoScript. I use Safari, but only visit a handful of these kinds of sites and never for long, often immediately closing tabs that show popups and annoying animations. And I have a pihole on my network.
I am responsible for a MapReduce-based system built about 13 years ago and it is the bane of my team’s existence right now. It was the hotness in its day, but did not age well at all. We are working on a replacement using ClickHouse.
as a 6y js/ts dev i never really bothered, i just end up coming back to mdn docs whenever im about to use those.

especially the internals of array sort method.
Most people don't know _the names_ of all 8 grandparents, but those people are the root culture of the family you grew up in.
If your goal is to learn Metal, then just start with Metal. It's a significantly better-designed API. On top of that, if you're developing on an Apple device then you'll have a decent debugging experience with Metal, as opposed to OpenGL where you'll get... nothing last I checked (but it's been a while).
Purely as a piece of photography that second photo is very cool with the sharp focus and the snow in the air.
There's still several orders of magnitude of difference between powering thousands of landline phones (which, by design, use very close to zero energy while on-hook), and powering thousands of homes and businesses.

No amount of handwaving or goalpost moving is going to ever change that. It is simply fact.
How easy was it to sideload apps on Windows Phone?
the hell is that last line, lol. thank you for your work sir!
yes, it’s a pigeonhole principle argument. A bit tricky to actually enumerate everything. Imagine KC had a limit k. Then there’s a fixed number of strings that can be compressed to k characters. so considering how there’s an infinite number of strings of length greater than k, they can’t all be compressed to be at most k. Therefore KC has no limit
Linux Zero Trust
It's possible to spawn a sshd as an unprivileged or partially-capabilitized process. Such as sandbox isn't the default deployment, but it's done often enough and would work as designed to prevent privilege elevation above the sshd process.
> to try to overwrite symbols in other modules, to add LD audit hooks on startup, to try to resolve things manually by walking ELF structures

I want to name one thing: when Windows failed to load a DLL because a dependency was missing, it doesn't tell you what was missed. To get the information, you have to interact with the DLL loader with low level Windows APIs. In some circumstances Linux apps may also have the need. Like for printing a user friendly error message or recovery from a non-fatal error. For example, the patchelf tool that is used for building portable python packages.

> No one wants a Linux antivirus

It is not true. Actually these software are very popular in enterprise settings.
There was a Planet Money story[0] about how legal growers are struggling because there is too much competition from not enough buyers. Maybe black market competition is to blame, but I would love to see some hard numbers on where the majority of purchases are made. My knee jerk reaction is to believe that most people are lazy and will pay for the convenience of a brightly lit store front instead of locating their local dealer.

Choice quote from the article:

There are just over four million people in Oregon, and so far this year, farmers have grown 8.8 million pounds of weed. Which means there's nearly a pound of dried, smokable weed for every single person in the state of Oregon. As a result, the sales price for legal marijuana in the last couple of years has plummeted.

[0] https://www.npr.org/2023/11/29/1197955821/marijuana-state-fe...
“My husband and I were going to a Halloween party and somebody was playing with her iPhone,” she said. Siri spoke and Jacobsen recognized herself.

She remains astounded that her voice has been heard by so many.

...

Whatever she was paid, the gig therefore brought riches of other sorts because when she is recognized, people want to share stories of their GPS-assisted travels, and the names they chose for their navigation aids.

Not all are kind: some feel the need to tell tales of occasions on which their machines led them astray.

“I make a lot of apologies.”
Think whatever you shall about systemd of course, but please stop with the blind belief mud slinging:

- systemd didn't create the patch to include libsystemd, distros did
- current systemd versions already remove liblzma from their dependencies, the affected distros are behind on systemd updates though
- you can implement notify in standalone code in about the same effort as it takes to use the dependency, there wasn't really a good reason for distro's to be adding this dependency to such a critical binary. systemd documents the protocol independently to make this easy. distros having sketchy patches to sshd has a long history, remember the debian weak key fiasco?
A pretty information free article. I would note that looking at the first singles from the Beatles, they were simple repetitive songs (three chords? too complex, let’s do two instead!) Add in that their baseline of the 70s also would be the apex of the popularity of progressive rock.
Kinahan Cartel: Wanted Narco Boss Exposes Whereabouts by Posting Google Reviews
One idea may be to create a patched version of ld-linux itself with added sanity checks while the process loads.

For something much more heavy-handed, force the pages in sensitive sections to fault, either in the kernel or in a hypervisor. Then look at where the access is coming from in the page fault handler.

I don't think you can reliably differentiate a backdoor executing a command, and a legitimate user logged in with ssh running a command once the backdoor is already installed. But the way backdoors install themselves is where they really break the rules.
Everything. Rails, Haskell, Rust… I care about speed/performance above all and Helix is just faster than everything else. Zero config is icing on the cake.
I read a statistic years ago that said that taking care of grandkids had a u-shaped mortality response. If you took care of them 2 days a weeks, it was optimal for mortality. More than that and you died younger. Less than that and you died younger.

Yes, correlation is not causation, but that correlation is interesting.
And for those using Magit in Emacs, you can do this by selecting a region of lines and hitting `C-c M-g l`.

https://magit.vc/manual/magit/Commands-for-Buffers-Visiting-...
I'm a bit tired here so maybe it is there and I'm not seeing it but of course it doesn't say anything that the Graphic Design jobs increased by 8% unless we know what the rate was of jobs on offer was between the various periods was, probably to compare with graphic design job growth during previous years.

Same applies to other categories of course.
Of the top 10 pharma companies, 5 are American, and three of them rank 8th, 9th and 10th for R&D investment.

So the whole "American big pharma needs to make a billion dollars a week in profit to recoup their R&D" is nothing but marketing fluff.
You're right, thanks - just made it public!
Ah yeah that one is nice! I did photo journalism in college and always appreciate good journalism photos.
Ed448 is orders of magnitude better NOBUS than hoping that nobody else stumbles over the zero-day you found.
Just to extend the sibling comment with an excerpt of the Arch announce mail regarding the backdoor:

>From the upstream report [1]:

&gt; openssh does not directly use liblzma. However debian and several other
distributions patch openssh to support systemd notification, and libsystemd
does depend on lzma.

Arch does not directly link openssh to liblzma, and thus this attack vector is not possible. You can confirm this by issuing the following command:

```
ldd &quot;$(command -v sshd)&quot;
```

However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist.
She had formerly been very proud of it. I think that over the past few years she was badgered into asking folks to stop using it.
Well the op did state the problem being the middle class though.

Stating this because supposedly, the middle class is not homeless or starving
I was always impressed by people who could articulate their thoughts in writing.
Our duvet covers all have two fabric loops in the corners. You push a bit of the duvet through those and then just pull it over. Works very nicely.
There is one possible time pressure involved, which is that libsystemd dropped the liblzma dependency
So is this backdoor active in Ubuntu distributions?
What I said isn't a pure criticism. A meander can be quite pleasant, but it needs at least to visit somewhere interesting, preferably though not necessarily outside its author's head.
A man after my own heart!
Thanks for explaining this. I'm looking for the same thing. We may quibble over details but the philosophy is spot on.
> people seem to be more interested in integration than developing new ml tech

Isn't this true for every tech, though? And a natural fact of life?

Think of databases. There's many times more jobs for "integrating" a DB into a project than developing new DB tech. Same for infra, frontend, backend, mobile, embedded, etc...
Decent street lighting has never stopped Australians with retina burners, stock or aftermarket. It also wasn't a problem before LEDs. People who had spotlights fitted to their cars never used them on the road (when others were around) and now that's apparently the only reason people get them (even if they already have retina burners for headlights)
It happens every now and then. Could be as simple as nostalgia.
GLP-1 medications have been hypothesized to possibly result in the loss of muscle mass and bone density. There will probably be better data in a few years.
One of them who left only one comment does, the rest are sock puppets.
Video editing, number and price going up?

Any ideas why? Since you would think these are also being replaced like writers.

My gut idea, is that a ton more people that would only do a podcast, or still slides, are taking the AI video tools and adding video.

That a ton of people that would not have even attempted video, are able to get over the hurdle and produce some pretty good video using AI tools. Maybe there is thus an uptick in jobs because the barrier to entry is reduced, so more people want video. And now that more people 'want' video, they start, but need help.
If they seemingly almost succeeded how many others have already done similar backdoor? Or was this actually just poking on things seeing if it was possible to inject this sort of behaviour?
I'm not saying political forces won't try legislating the problem away, but that won't even help here.

A supply chain attack can happen in hardware or software. Hardware has firmware, which is software.

What makes this XZ attack so scary is that it was directly from a "trusted" source. A similar attack could come from any trusted source.

At least with software it is much easier to patch.
Doubling the child tax credit a second time could go a long way. Also making single detached family homes cheaper around good paying jobs will help a lot too.

What do you think are the chief obstacles that make it difficult to build a family?
spyro memory hacker pro

cheat engine

sysinternals suite especially procexp (process explorer)

xyplorer (for viewing tree directories)
The Roman Empire was a communication network
For people like me whose C knowledge is poor, can you explain why this dot is significant? What does it do in actuality?
I think that it's a great opportunity to try D&D but it may not replace the full dynamics of playing with a human dungeon master and fellow players.
How can sshd spawn interactive sessions for other users if it's sandboxed?
> The OP makes it sound like an attacker can send a malicious payload in the pre-auth phase of an SSH session - but why does he say that an exploit might never be available?

The exploit as shipped is a binary (cleverly hidden in the test data), not source. And it validates the payload vs. a private key that isn't known to the public. Only the attacker can exercise the exploit currently, making it impossible to scan for (well, absent second order effects like performance, which is how it was discovered).
I mean, it's possible to write bad code in C++. But at least it's possible to write good code too. C++ makes a careful sequence that's hard to get wrong and easily compiler enforced:

* if a given subobject (field or base class)'s constructor runs, its destructor is guaranteed to run.

* in particular, in low-level ownership classes, you can arrange for field initializers to be `noexcept`, so you get to run their dtor, regardless of subsequent manipulation of the fields - just be sure to not assume invariants from the fully-constructed main object case. In most classes, deferring all ownership logic to the fields is simpler - rule of zero beats rule of 5. And if you do add manual try-catch during construction it will actually work.

Languages other than C++ generally fail in several ways:

* Allow exceptions to be thrown by the runtime for reasons unrelated to the code being executed

* No support for subobjects, forcing all objects to be allocated separately and thus the runtime not knowing it needs to poke them since finalizers are only applied to objects not pointers. In particular, Python's `contextlib.ExitStack` can narrow the window in which case leaks are possible, but not eliminate it.

Rust does slightly better than C++ by enforcing trivial moves, at the cost of making many useful programs impossible to write.
Why would "embed software in chips" be a solution?

If anything, I'd expect it to be an even bigger risk, because when (not if) a security issue is found in the hardware, you now have no way to fix it, other than throwing out this server/fridge/toothbrush or whatever is running it.
> So, it's not like pharma companies are making insane profits.

Huh.

> Gilead Sciences gross profit for the twelve months ending December 31, 2023 was $20.618B

Not insane profits, indeed.