skysight-inc/HackerNews huggingface dataset:
In the neon-lit, digitized colosseum of the 21st century, two titans lock horns, casting long shadows over the earth. Google and Microsoft, behemoths of the digital age, engaged in an eternal chess match played with human pawns and privacy as the stakes. This isn’t just business; it’s an odyssey through the looking glass of corporate megalomania, where every move they make reverberates through society’s fabric, weaving a web of control tighter than any Orwellian nightmare.

Google, with its ‘Don’t Be Evil’ mantra now a quaint echo from a bygone era, morphs the internet into its own playground. Each search, a breadcrumb trail, lures you deeper into its labyrinth, where your data is the prize – packaged, sold, and repackaged in an endless cycle of surveillance capitalism. The search engine that once promised to organize the world’s information now gatekeeps it, turning knowledge into a commodity, and in its wake, leaving a trail of monopolized markets, squashed innovation, and an eerie echo chamber where all roads lead back to Google.

Meanwhile, Microsoft, the once-dethroned king of the digital empire, reinvents itself under the guise of cloud computing and productivity, its tentacles stretching into every facet of our digital lives. From the operating systems that power our machines to the software that runs our day, Microsoft's empire is built on the sands of forced obsolescence and relentless upgrades, a Sisyphean cycle of consumption that drains wallets and wills alike. Beneath its benevolent surface of helping the world achieve more lies a strategy of dependence, locking society into a perpetual embrace with its ecosystem, stifling alternatives with the weight of its colossal footprint.

Together, Google and Microsoft architect a digital Panopticon, an invisible prison of convenience from which there seems no escape. Their decisions, cloaked in the doublespeak of innovation and progress, push society ever closer to a precipice where freedom is the currency, and autonomy a relic of the past. They peddle visions of a technocratic utopia, all the while drawing the noose of control tighter around the neck of democracy, commodifying our digital souls in the altar of the algorithm.

The moral is clear: in the shadow of giants, the quest for power blurs the line between benefactor and tyrant. As Google and Microsoft carve their names into the annals of history, the question remains – will society awaken from its digital stupor, or will we remain pawns in their grand game, a footnote in the epic saga of the corporate conquest of the digital frontier?
One of those things you had to install on a new windows system.
And don’t forget the sensors they are usually packed with. Reasonably good camera, gps, accelerometers and more, it is not just a generic server. And with such amount of RAM, it could even run some small enough AI to give not so predefined sense to what the sensors may be getting.
Fisker had big dreams to compete with Tesla. What went wrong?
Sometimes you'll read something and think "I'm not taking the bait".
Why does the proxy need to terminate TLS? If it were just a TCP proxy, then at least the monitoring wouldn't have been fooled into thinking the certificate wasn't about to expire.

Heck, a TCP proxy might even allow automatic renewal to work if the domain validation is being done using a TLS-ALPN challenge.
https://kidneybone.com/c2/wiki/TheKenThompsonHack
Can't wait for this to finish. The inability to screenshare with java.awt.robot is what's preventing ScreenConnect and thus my desktop from dropping X11 compatibility.
Javascript-less link:

https://kidneybone.com/c2/wiki/TheKenThompsonHack
SourceForge also had the annoying UX where you couldn’t just create or upload a repo, they had to allow it to be uploaded.

GitHub not having anything like that made it way more useful.
> Usually there is a better way to do it in almost all cases where people feel the need to reach for "eval"

unfortunately thats just standard in configure scripts, for example from python:

```
grep eval Python-3.12.2/configure | wc -l
165
```

and its 32,958 lines of code, plenty of binary fixtures as well in the tarball to hide stuff.

who knows, but I have feeling us finding the backdoor in this case was more of a happy accident.
Yes, but its performance on GPU leaves much to be desired, and 20 times as much research comes out on PyTorch. Would you rather just build on that or laboriously port and debug the models and their weights, losses, dataset readers, training regimes etc etc?
Supply Chain Intrigue, or the Spy Who Shagged My Repo
Necessity is the mother of invention. MapReduce-based systems were developed because the state-of-the-art RDBMS systems of that age could not scale to the
needs of the Googles/Yahoos/Facebooks during the phenomenal growth spurt of the early Web. The novelty here was the tradeoffs they made to scale out and up using the compute and storage footprints available at the time.

"We thought of that" vs "we built it and made it work".
I simply enjoyed coding more. The engineering job had its upsides too, especially the hardware we used, made for some good stories I could never have as a programmer again;-)

Still, I don't regret the switch, CS is just more my thing.

I was already a my mid-thirties and had a child when I finished my computer science degree.
The Atlantic has always been a rag. So much so it was lampooned in the montage sequence in 1984's Ghostbusters. Even back then, 40 years ago, people knew what a nosy-Nancy sponge it was. So much so that Aykroyd, Ramis, and Moranis thought it would be funny to poke fun in a brief shot mushed into the movie, complete with a caricature cover.

https://www.youtube.com/watch?v=EwKR_y93izs&t=115s
I'm not starting a harmful rumor. People are asking legitimate questions in order to paint the whole picture. Being gaslit is very weird.

> I don't stalk your socials

I mentioned it because you called my intent into question.

Why are people running cover for the maintainer of a repo that just tried to backdoor sshd when others are asking legitimate questions?
The MR linked to would actually prevent the backdoor from working, but that doesn't stop some people from claiming it enables the backdoor.

But as already said: no surprise given where the comment comes from.
He replied that he is in holiday and will check in after Easter. And that he and Jia's GH accounts are inaccessible. More details too, but that's the crux as I understand it.
Why are most comments referring to having used this in the past tense? I was under the impression that it was still the best image viewer in town, on Windows at least
A perfect idea for the people who almost certainly aren’t using “cheaper hardware devices”.
It's not even factual.

> In Rust and Haskell you have to at least annotate the parameter types and return type of functions. Type inference is only for variable bindings inside the function body.

This is false for Haskell. Can't speak for Rust.
>Nobody knew about the mining. People trusted Google.

It was the era of Don't be evil. And people blindly trusted them.
Had wacky ideas for sure but calling him a quack after the Manhattan Project isn’t fair. Besides his foresight on the hydrogen bomb, he also was one of the first major names in science to raise the alarm about climate change:

https://amp.theguardian.com/environment/climate-consensus-97...
IMDB's Top Movies of All Time
> In Rust and Haskell you have to at least annotate the parameter types and return type of functions.

In Rust you do, but in Haskell you don't.
you're absolutely right! just wanted to check what hackers recommended as well :)
>> Sometimes you'll read something and think "I'm not taking the bait".

Like when I read about "auto" in C++. It still bugs me when I see it...
Completely agree that this kind of collaboration can (and probably should) be done in new ways.

I do think this kind of focused work is distinct from the kind of hallway catchups that happen organically that just don’t in a remote environment, but even just having a standing “we all meet at <place> at <interval>” would go a long way.
How high of traffic is your website? And are you writing log files (like nginx or apache, plus application if applicable)?
exactly. IMO it's the per-user structure that won over the per-project one.
guthub and bitbucket won over srcforge, ggl.code and launchpad etc of the project-only side.

And as bonus, it well matched the timing of social-networking rising..

(Apart of srcforge doing shit itself..)
Isn't it ironic how the article mentions

> Git was custom-built for distributed democratized development

and doesn't mention how github and gitlab too severely lacks in this aspect?

Drupal, like a decade before git already, allowed multiple people to work on the same issue. This was reviewed by the community and then the committers and then it got merged. You still can't do this on Github and only through some drupal.org magic does it work on the Gitlab instance the Drupal Association has.

Some democracy.
On the contrary, this is a good example for why 'vulnerable' OSS projects that have become critical components, for which the original developer has abandoned or lost interest, should be turned over to an entity like RedHat who can assign a paid developer. It's important to do this before some cloak and dagger rando steps out of the shadows to offer friendly help, who oh by the way happens to be a cryptography and compression expert.

A lot of comments in this thread seem to be missing the forest for the trees: this was a multiyear long operation that targeted a vulnerable developer of a heavily-used project.

This was not the work of some lone wolf. The amount of expertise needed and the amount of research and coordination needed to execute this required hundreds of man-hours. The culprits likely had a project manager....

Someone had to stalk out OSS developers to find out who was vulnerable (the xz maintainer had publicly disclosed burnout/mental health issues); then the elaborate trap was set.

The few usernames visible on GitHub are like pulling a stubborn weed that pops up in the yard... until you start pulling on it you don't realize the extensive reality lying beneath the surface.

The implied goal here was to add a backdoor into production Debian and Red Hat EL. Something that would take years to execute. This was NOT the work of one person.
Perhaps there were legal, compliance, or contractual constraints that made moving out of RDS impossible within their acceptable business risk levels?
I wonder whether they pulled their article because they changed their mind. Maybe over time they got to understand the difference in use-cases and tradeoffs. Though it's definitely true that plain MapReduce can be shockingly inefficient, systems like Spark which add rich data structures and in-memory caching make a big improvement towards closing that gap. But it's still not a panacea, and I've definitely seen usecases where SQLite could replace and far outperform Spark, but the general programming model behind Spark is still a powerful and widely applicable abstraction.

My main complaint with Spark is that it's pretty hard for non-experts to debug crashes and failures. While the programming model beautifully abstracts away all the complexities of parallel and distributed programming with its headaches of managing clusters and dealing with synchronization and communication, the entire abstraction bursts instantly when debugging is needed. Suddenly you need to understand the entire Spark programming model from top-to-bottom, from DataFrames to RDDs and partitions, along with implementation details like shuffle files, DAGScheduler, block caching, Python-JVM interop, OOM killer, and on and on.

And there's absolutely no incentive for the commercial vendors to improve this situation in the open source project. (This isn't specific to Spark though, the entire Hadoop ecosystem seems to operate on hidden complexity in the open source version with vendors who make money by providing support and more usable distributions.)
Must be why midjourney is making so much money
Cool idea, thank you so much!
When you said goroutine, you are talking about different thing.
Build HNSW 80% Faster with Parallel Index Build in Pgvector
I believe the $25K to the UK falls under this program (https://th.usembassy.gov/u-s-embassy-julia-taft-fund/)
HTMX powers the UI for my AI transcription product TurboScribe (https://turboscribe.ai). Dynamic UIs that change without a page refresh, lazy loading, multi-step forms/flows, etc. It's working GREAT.

My general take on HTMX is:

1) You need to have your act together on your server. Because HTMX pushes more onto your backend, you need to know what you're doing back there (with whatever tech stack you happen to be using).

I have a friend who teaches at a coding boot camp and they do not teach students about server-rendered HTML at all. Folks coming from this world are going to have a tougher time ramping up on something like HTMX.

2) HTMX is great for the 90%+ of common UI paradigms shared by most apps (form submissions, validation, error messages, partial page reloads, lazy loading, CRUD UIs, etc).

If you have a key, critical experience that demands highly dynamic or novel interactivity, you're going to find yourself reaching to either (a) extend HTMX, or (b) create an island powered by raw JS, React, etc.

--

I love HTMX. It's a fantastic tool for delivering quality product (often with much lower engineering cost).
Sometimes there is space for white space and sometimes there isn't. Excel (actually Libre Office for me) doesn't have padding inside cells and its good as it is. I want to fill my screen with data of I want to and I don't want to be able to see only a 15 by 10 grid. Some other program might be better with a more white padded UI. I wish the GNOME tools didn't get that way.
In a movie, he was killed by foreign state actors, and his identity assumed by the foreign state hacker. Actually, someone should check on him.
that doesn't really solve the issue because Google can close all of the accounts associated with you in one fell swoop.
Because the cars are heavy and with have high torque. They need the extra grip to have those insanely low 0-60 times.
The Insane Engineering of the Gameboy [video]
Hashing is more or less pointless with such a small input space. Salts wouldn't help much.
And greenshot for snipping!
> [...] A "release" should allow to build the project without installing dependencies that are only there for compilation.

Built artifacts shouldn't require build-time dependencies to be installed, yes, but we're talking about source distributions. Including `./configure` is just a way of reducing the configuration-/build-time dependencies for the user.

> Autotools are not guaranteed to be installed on any system. [...]

Which is why this is common practice.

> It's common but it's plain wrong.

Strong word. I'm not sure it's "plain wrong". We could just require that users have autoconf installed in order to build from sources, or we could commit `./configure` whenever we make a release, or we could continue this approach. (For some royal we.)

But stopping this practice won't prevent backdoors. I think a lot of people in this thread are focusing on this as if it was the source of all evils, but it's really not.
A simple collision resolution algorithm for 2D action games
The type is an overlay away. When you need it you can read it. When you know it you can hide it to leave more space for the code. What's the matter??
I did use a template (Carrd) and got it done in 1h:07 mins. I agree that even coding something with react + ai would have taken me longer. Thanks for the advice!
The main problem with this is that a polarizing filter blocks overall light by about a half, so wouldn't be usable in the dark.
Rust does require explicitly writing out the signature of top-level functions.

I believe it was a conscious decision to limit de cascading of type errors from global type inference, the base algorithm was capable of it.
This SOUNDS like “types are bad”. The author’s message (towards the end of the article) is “I don’t want to infer types from my code. I’d rather infer the code from the types. Types are the spec…”

Yes. Always annotate types. Keep inference, it tells you when your annotations are inconsistent with tour code.
I mean your employer wasn’t wrong. Yubikeys ARE way too confusing for the average user, way too easy to lose, etc. maybe have it as an option for power users, but they were right it would be a disastrous default.
in this case the backdoor was hidden in a nesting doll of compressed data manipulated with head/tail and tr, even replacing byte ranges inbetween. Would've been impossible to find if you were just looking at the test fixtures.
> Any other notable examples besides those 2?

Lazarus, I think.
Why can't people just admit they got super lucky and stay retired
To make it quantum resistant you should rotate at least 26 times
The article says nothing about children lacking the calories required for brain development. It says 23% of black households self-reported "not having enough food in the past week". Which is weird, because when I go looking for objective data that might support the assertion that a significant percentage of the population isn't getting enough calories, I don't find anything. I did find an article that obtained weight data on both whites and blacks nationwide, and broke them down in Underweight, Normal, Overweight, and Obese categories... but the number of underweight individuals was so low that it rolled them into the 'Normal' category, and didn't even report the Underweight category. It's almost like everyone is getting more than enough to eat!

Neither your anecdata on "visible poverty" nor the US Gini index contradict the obvious fact that the USA is, by any serious measure, a rich country.
Having used webrtc in offline environments (host device broadcast a local wifi), I can say it's a royal pain to use without ice/stun/turn servers. I had to manually mangle the sdp packets to make it work because browsers would randomly decide they needed ip privacy (from the device they connected to by ip...) where they'd translate ips to some_hash.local and try to find a turn server. I tried hosting a coturn server too, but browsers would sometimes ignore it since it was a local address. Mangling the sdp handshake is reliable but feels pretty jank.
Yep, I got the same error.
I am still a novice in this world of graphics programming. Not exactly only graphics, but VFX and digital sculpting.

Is not OpenGL a good starting point if you want to transition to Metal or Vulkan later on?

If not, should I seek out the "new flavor" to learn graphics?
Well, for example in jq we do commit bison/flex outputs because for users ensuring that they have the right version of those can be tricky. We could do the same w.r.t. autoconf and its outputs, though again, that won't preclude backdoors.
Asking this here too: why isn't there an automated A/B or diff match for the tarball contents to match the repo, auto-flag with a warning if that happens? Am I missing something here?
When the geese come in, you can buy these little concrete coyotes that keep them from colonizing everything and crapping everywhere. In general, it takes just a year or two until they completely avoid the area, and it lasts for about a (goose) generation.

I'm sure there's a parallel in there about beating back the rentseekers and vulture capitalists.
What about when writing a function with polymorphic recursion, rank-N types, or the monomorphism restriction?

There are plenty of examples where a type declaration is required to get functionality, especially when we consider what GHC offers as being "Haskell".

I agree the author could be more clear about this—that Haskell and GHC only sometimes require type annotations in certain circumstances.
What do you want me to say? That is the work that you must do and that is routinely done. It is annoying, but it is not hard or special. Hardly a nightmarish problem if it gets solved routinely at scale across a entire industry.
Explicit typing is great until your code is littered with shared_ptr<vector<shared_ptr<map<string,T>>>> everywhere.
Interesting. I assumed a lot of client software for small banks was vendored - I know that's the case for brokerages. Makes it all the weirder that they all imitate each other.

Here's the thing about SMS: your great aunt who doesn't know what a JPEG is, knows what a text is. Ok, she might not fully "get it" but she knows where to find a text message in her phone. My tech-literate fiancée struggles to get her YubiKey to work with her phone, and I've tried it with no more luck than she's had. YubiKeys should be supported but they're miles away from being usable enough to totally supplant other 2FA flows.
"We wanted to make sure all the work our team had done with the (city’s) privacy commission aligned with what Gov. Newsom and Attorney General Rob Bonta were planning — and they were receptive,” Hanson said."

That's a bit odd, given that Flock specifically markets its nationwide network to LEO agencies - ie you can be in East Nowhere, Iowa and query a plate and see data from the entire network.
I will not reply again. Yes you know something, and your knowledge is right. You saw my question and saw some keyword matched you knowledge, and you spoke out your knowledge. I'm not saying your wrong, but we are talking about different thing.
Well, as you wrote NASA I'm sure that the space shuttle cockpit could have been made simpler than it was but how much simpler? To a point that one could fly it with a joystick and no instruments? I don't believe so and I think that one really needs a degree from NASA. I u715e9
JFK at least was reputed to be an extremely proficient reader. His reported speed reading is probably somewhat exaggerated but conservative estimates would have him reading the script of one of those CIA brief videos in a small fraction of the time it took for Reagan to watch them. Being good at reading obviously isn't a sufficient qualification to make somebody a good president, but I think it's a necessary prerequisite.
Because of a few things:

1. Windows 11 now ships with quite a decent and powerful image viewer/editor that covers most average users' use cases, therefore lowering the demand from people to go out of their way to find alternatives, like in the Windows XP days, which is a good thing (less likely to go download malware from the first Google result of "image viewer for Windows XP").

2. PC usage behavior has changed a lot since then. Many people don't even have PCs at home anymore, and people now have most of their pics in the cloud or on their phone or some external NAS that comes with it's own browser viewer app, instead of hoarding them all on their home PC hard drive, further lowering the need to seek out dedicated image viewers to manage giant offline collections of digital camera pics(I mean I still do, but I'm a minority nowadays).

These two factors combined meant the death of the third party PC image viewer app. Yeah, Irfan might be "the best", but the need for the best in this sector has declined significantly, and most users are now fine with "good enough".
Nothings says “committed to free speech” like “seeking names and addresses of all Media Matters donors who live in Missouri”

lol at these culture warrior hacks
> It makes code harder to read

One could argue it's better for type inference to not just be part of the language but also part of the IDE. E.g. you type

auto x = ...

And then the IDE offers to replace the auto with vector<SomeClass>

That way you can both write code with type inference, but read code with fully annotated types!
The google doc option is really thinking out of the box. Hadn't thought of that, and it might get the job done super quickly and cheaply. Thanks!
More evidence that the OSS community needs to drop the “many eyes” theory of security