skysight-inc/HackerNews huggingface dataset:
I did a `dx build --release --platform web` of their default client-only web template and the resulting `du -sh dist/` is 2.1M. The .wasm file is 1.9M.

I'm guessing there is no way that's getting smaller?

I have some projects in the 1kb to 100kb territory I wouldn't mind rewriting, but not to that size.
A $100,000 robot arm that runs 24/7/365 for 10 years is still about $0.60 per hour to operate before you even consider maintenance. That's about 3 times what entry level Chinese factory workers make on a per-hour basis.
> That's fair in isolation, but one can justifiably argue that a repeated pattern of behavior is clearly predatory.

Yes, but there’s another explanation. Repeating the same mistake countless times and expecting a different outcome is naivety.
There are roughly speaking two possibilities here:

1. His machine was compromised, he wasn't at fault past having less than ideal security (a sin we are all guilty of). His country or origin/residence is of no importance and doxing him isn't fair to him.

2. This account was malicious. There's no reason we should believe that the identity behind wasn't fabricated. The country of origin/residence is likely falsified.

In neither case is trying to investigate who he is on a public forum likely to be productive. In both cases there's risk of aiming an internet mob at some innocent person who was 'set up'.
The only case that gets close to it was resolved (in part) by the perpetrator taking a plea deal that included the guarantee that they would NOT petition for redress.
This is why i wish projects like TBL's Solid [https://en.wikipedia.org/wiki/Solid_(web_decentralization_pr...] would take off some more. I happily pay providers for an application (or at least the service/utility that an app. provides) because that is often the value they is brought to bear for my benefit...but the data, ah the data is something I don't want anyone to control but me. Projects like Solid pave a possible path forward that *could possibly* enable an ecosystem where we still can legitimately pay a provider for value they provide a la an app or service, but still we as users would exert maximum control over our data sovereignty. I hope this author and others continue to keep thinking of data in this way.
I went through a couple of these and found them more frustrating than not. In the end I ended up with a Yeti 14 oz mug. If you don't mind drinking from stainless steel, it (like all thermoses) does a really good job of keeping warm things warm and cold things cold.

https://www.yeti.com/drinkware/mugs/mug-14oz.html
ifunc memcpy also makes short copies suck ass on those platforms, since the dispatch cost dominates regardless of the vectorization. It's an open question whether ifunc helps or harms the performance of general use cases.

By "open question" I meant that there is compelling research indicating that GNU memcpy/memcmp is counterproductive, but the general Linux-using public did not get the memo.

https://storage.googleapis.com/gweb-research2023-media/pubto...

"AsmDB: Understanding and Mitigating Front-End Stalls in Warehouse-Scale Computers" Section 4.4 "Memcmp and the perils of micro-optimization"
> We recognize that generating speech that resembles people's voices has serious risks, which are especially top of mind in an election year. We are engaging with U.S. and international partners from across government, media, entertainment, education, civil society and beyond to ensure we are incorporating their feedback as we build.

People had been theorizing the slowdown in releases was because of this, I didn't expect they would come out and admit it.

I've found the quality of Elevenlabs' voice generation is at least twice as good as this, which is surprising since OpenAI has had more time and money to work on this. There seemed to be an issue with inconsistent accents in the multilingual samples.
s/can do/have done/
A well made thermos (like my zojirushi) will keep stuff cool for more than one day. And coffee hot from dawn till dusk. No batteries or cables required.

I'll never understand these things.
The use of "eval" stands out, or at least it should stand out – but there are two more instances of it in the same script, which presumably are not used maliciously.

A while back there was a discussion[0] of an arbitrary code execution vulnerability in exiftool which was also the result of "eval".

Avoiding casual use of this overpowered footgun might make it easier to spot malicious backdoors. Usually there is a better way to do it in almost all cases where people feel the need to reach for "eval", unless the feature you're implementing really is "take a piece of arbitrary code from the user and execute it".

[0] https://news.ycombinator.com/item?id=39154825
Selective reading strikes me once again.
Yes.

I've never had to do it myself but I believe that's common practice with embargos on security vulnerabilities.
This was really sad news; his Security Engineering probably did more than any other single textbook to influence my career and making me a better engineer in the process.

All the examples of bright people having made systems which turned out to be more brittle than the designers assumed really drove home the point that even 'simple' tasks are HARD.
Except for consumption, waste heat generated, size.
When the AI has QA/QC as part of the over all requirements...

Well, Modern neural networks and LLMs aren't constructed using any requirements, specifications or hard constraint at all - they just heuristically give a context-aware approximation of their massive input data set.

So getting to X being part of "requirements" is a bigger step than the layman imagines. Especially, 'cause an LLM outputs approximated recipes for action when asked, LLMs struggle to consistently achieve goals since goal-seeking requires constant little adjustments.

But even more, if an AI somehow reached the level where you could inject goals into it, it seems very likely it's goal would be maximize investor profits and this wouldn't solve the problem of the system discarding human experts but rather compound it.
The ability to use my own voice in other languages so I can do localization on my own youtube videos would be huge.

With game development as well, being able to be my own voice actor would save me an immense amount of money that I do not have and give me even more creative freedom and direction of exactly what I want.

It's not ready yet, but I do believe that it will come.
Occam’s razor. I’d imagine the gap between organization level negligence and contract killing is wider than you think. Don’t get me wrong, they might have a big responsibility in the death but we won’t know that for a while, if ever. Don’t spread these wild rumours though unless you have something to base them on.
Back of the napkin math, 63,000 gallons of gasoline per day. 33kWh of energy in each gallon of gasoline. Internal combustion approximately 33% efficient at turning that energy into propulsion while batteries and electric motors are ~90% efficient. A Tesla megapack stores 3,854 kWh and weighs 84,000 lbs.

63000*33*.33/(3854*0.9)*84000 = 16,782,563 lbs or ~7,600 metric tons worth of batteries for 1 day's worth of "electric fuel"
I thought the idea is that the battery acts as a buffer and the engine is always either off or at constant rpms in its ideal power band.
XNOR-Net was the "first" in that generation, as I recall.
It's not a new idea at all though.

Check out the dates on these papers -

https://ieeexplore.ieee.org/abstract/document/286901 < 1994

https://ieeexplore.ieee.org/abstract/document/344783 < 1993

https://link.springer.com/article/10.1007/BF00337115 < 1986
> In my opinion, the best thing for us to do is to rapidly get to a
place where everybody knows that you cannot trust the voice on the
other end anymore,

Strongly agree with this. Sadly I don't think that transition to
default distrust of voice will be rapid. We are wired at quite a low
level to respond to voice emotionally. which bypasses our rational
scepticism and vigilance. That's why this is a rather big win for the
tricksters.
You can see a somewhat similar concept to this today in the test and measurement field with the PXI standard. It's an open standard of plug-in instrument or computer modules that slot into a chassis. The only real sore spot is the drivers, often being proprietary Windows DLLs.
My 2 cents, nothing works quite as well as the Fellow Carter wide mug. It’s ceramic lined, super pleasant to drink out of, and with the lid just resting on top (not even screwed on) the coffee stays drinkably warm for 2+ hours. No need for any of the warming nonsense.
Having used HM-10 modules for personal projects and not facing the kinds of weird issues I have with many commercial Bluetooth devices, I really don't understand why said devices are so shitty in the majority of cases. Staying paired and sending tiny amounts of data to request status or change settings shouldn't be that hard.

Of course it certainly doesn't help that most mobile apps are extremely crummy.
Sipeed's new handheld RISC-V Cyberdeck
If your normal DB can handle documents like a doc focused DB but better, than it might no longer be worth it to have it as a category but as a feature
Chile Wants to Double Its Lithium Output
Inflationary Effects in Language and Elsewhere (2001) [pdf]
Worth mentioning that the concept is how Fast Times at Ridgemont High was written by Cameron Crowe.

Take a look at the prices for a used copy.

Not many books pull it off.
So many "smart devices" in general are solving non-existent problems, and my wallet has suffered from it.
Ideating a Startup to Improve Integrations Development
Are you rewarding diligent students or successful students? It usually ends up being the latter and the slower but diligent ones end up discouraged.
If I understood correctly, businesses are merely obligated to offer E2EE, where technically possible, and certain user data can still be given to law enforcement (while encrypted?).
Do you have a writeup or any details as to what it does? The logical thing based on this post is that it hooks the SSH key verification mechanism to silently allow some attacker-controlled keys but I wonder if there's more to it?
Stellantis (Dodge) has an upcoming version of the RAM 1500 that does this. It's an electric truck with a 145 mile range on electric battery; once that is expended the gas engine kicks on to run a 130 kilowatt generator.

https://www.cnbc.com/2023/11/07/new-ram-pickup-ev-has-gas-po...
> The user ... was unable to access their account until they accepted the new ToS

This kind of behavior should be illegal. They're holding your property (data) hostage.

Just a few weeks ago, one of my clients had their Vultr account suddenly suspended, within minutes of receiving multiple unexpected and mutually contradictory invoices that seemed to indicate some sort of billing error on Vultr's part. The client tried to resolve the issue with customer support, but that went nowhere because from Vultr's point of view, they no longer had an account with Vultr. Catch-22.

Luckily, the client had heeded my recommendation to keep backups with a different provider in a different location. So after a brief consultation we decided, "fuck Vultr," and proceeded to restore our cluster elsewhere. Now I'm making sure that none of my other clients have any part of their infrastructure dependent on this joke of a VPS company.
A couple of years ago I wrote a Go library that wraps the xz C code and allows you to do xz compression in Go: https://github.com/jamespfennell/xz

About a week ago I received the first PR on that repo, to upgrade to 5.6.1. I thought it was odd to get such a random PR...it's not the same GitHub account as upstream though.
Name and shame this author. They should never be allowed anywhere near any open projects ever again.
Tauri and Dioxus both share a webview and all of Tauri's extensions/plugins work with dioxus, so the only real difference is where your code lives. Since Dioxus and Tauri share a good deal of architecture similarities, it's not really an "either/or" case and I'm sure whatever the Tauri folks try to monetize will work with Dioxus apps automatically.
have a look at the new Mitsubishi outlander EV, it kinda works like the volt
That is not the point. This is about mass surveillance so what matters is what most people do.

> I imagine the main reason to do it was to make it harder to use fake stamps

it was never put forward as a reason IIRC. How common are forged stamps in the first place, to make it worthwhile
Except paying lawyers $400+/h rarely results in "understandable contracts".

The legal industry is self-creating this issue because that makes their services more necessary.
Lighter and mechanically simpler were the selling points. Poor fuel efficiency and trouble with the seals were the downsides.

My uncle had an RX-7 back in the 80s when I was a kid. I remember when it was idling I could see the exhaust puffing, in pulses. It only had a single combustion chamber after all.
Terry Davis on Simplicity [video]
Firmware updates on a coffee mug.

I totally understand why but still. Firmware updates on a coffee mug.
Is there a benchmark for compute needed? Curious to see if anyone is building / has built a Zoom filter, or Mobile app, whereby I can speak English, and out comes Chinese to the listener.
I think Yellowstone is too big for that compared to places like Zion and Yosemite which have relatively small valleys where people concentrate. I'm not sure shuttles to see Tioga Pass would make sense in the same way they do in the valley.
Yes but that simplified write complexity means you are pushing a ton of read complexity out to your application.
'to me' makes it much clearer.
No one is being “required by law” to add vulnerabilities, it’s more likely they are foreign agents to begin with.
You can check https://freeweb.me, when the editing part is completed, you download your website in zip archive, to upload anywhere.

It's free.

(disclaimer: it's one of my side projects)
Ask HN: How do you serve static files in a Docker container?
I usually use thttpd in an alpine container. I think I remember seeing a similar server that read files at startup to load them in memory and pre-compress them while running in a from-scratch container, but I can't seem to find it on the internet. What do you guys use ?
Was just in Yosemite: the mountains look just as pretty with snow and you can snowshoe from Badger Pass.
risc-v moving forward... but I am a dvorak ortholinear keyboard user.

:P
There are already tons of national parks in Europe, it's not like this is the first one.
I am curious why the term "fiber optic" seems to have declined in popularity, as least when it comes to big companies' annual reports: see https://searchsecdata.com/search?stockindex=S%26P+500&search...
It doesn't help that traditional news sources have (understandably) lost trust over the decades, but the solution is to improve that. Not to abandon institutions with a history of legitimacy for those that never even tried to be about anything but profit and grift.
> But that's weird because they're a completely different genre. They're closer to Star Wars (the one dumb people liked, cuz that's where the $$$ is) than Star Trek.

The Kelvin timeline films have this problem, especially the first two; the third, while definitely not the classic trek series feel, felt more like a Trek movie.

The newer series (excl. prodigy, which I simply haven’t watched) have variable quality (SNW, IMO, is the strongest Trek series since DS9 and the most classic Trek feel since TNG, Discovery was up and down but overall no worse than Enterprise, Picard was good, but more like 3 long Trek movies than classic series Trek), but I wouldn't describe any of them feeling more like Star Wars.
cmd+tab is not bad on mac ...
Tauri and Dioxus both share a webview and all of Tauri's extensions/plugins work with dioxus, so the only real difference is where your code lives. Since Dioxus and Tauri share a good deal of architecture similarities, it's not really an "either/or" case and I'm sure whatever the Tauri folks try to monetize will work with Dioxus apps automatically.

IMO if you're building an app in Rust, you probably want to avoid the wasm build step and shim out to the little bit of JS here-and-there for interactions you can't quite get in Dioxus.
I've been across the both. They are not the same!
> If you are able to take home leftovers, there is less incentive not to end up with leftovers

I feel that having leftovers is never desiderable, with or without the ability to take them home. In France the restaurants are obligated to allow you to take leftovers home, and in my experience this has not changed anything on the behavior of people eating in restaurants. The only thing that changes is that in the rare case in which you have leftovers, you can take them home.
The article explains numerous concurrent conditions that have to be met for the backdoor to even be activated (at build time, not runtime), which combined make it extremely unlikely this will affect SSH on macOS:

- linux

- x86-64

- building with gcc & the GNU linker

- part of a .deb or .rpm build

Add to that, as the article explains: openssh does not directly use liblzma, the only reason SSH is affected at all, is because some Linux Distros patch openssh to link it against systemd, which does depend on liblzma.

Could it affect things other than SSH on a Mac? Unlikely. The compromise was introduced in 5.6.0, but macOS Sonoma has 5.4.4 (from August last year).
Distributions were notified under embargo.
A good article.

It barely addresses the elephant in the room however: The Toyota Prius and its Atkinson engine.

The Atkinson engine is 99% the same as a regular engine (aka: Otto cycle), except the timing is different. Instead of closing the valves when the piston+cylinder is full of gasoline+air mix... the Atkinson engine waits a bit and "leaks" some gasoline+air back out before closing the intake valve, effectively burning only 70% of the fuel, but getting maybe 85%+ of the power of a regular Otto-cycle engine. Its a simple and cheap tweak to a traditional engine that grossly improves efficiency (but at huge costs to low-end torque).

Basically, any regular ol' carmaker who is mass producing Otto cycle / regular ICE engines can easily tune their piston timing to be an Atkinson engine instead. I believe Toyota even has computerized controls today that switches between efficient Atkinson (lower-power but higher efficiency) modes and powerful Otto cycle (higher power but lower efficiency) modes, though this control isn't really used too often in practice.

---------

This article makes a good point that Mazda has a culture of this... rotary engine. It does compare it (somewhat unfairly) to the Atkinson engine though (inside the Prius and RAV4), I don't think anyone expects any traditional engine (Otto or Rotary) to keep up with Atkinson Engine efficiency.

Its a good try however. But it does raise the question of what benefits can this rotary engine give over other engine types.
In medieval Christianity there were stylites dwelling up their pillars and (some thousand years later) anchorites sealed in their cells, and all this stuff about life-denying rings true except that Catholics, in the modern era at least, are mostly pro-life and anti-contraception and breed like rabbits.

MacIntyre wrote a book called "After Virtue" which is mostly posing Nietzsche against Aristotle, and his late-life conversion to Catholicism was because of Thomas Aquinas, who was an Aristotle fanboy. I don't know how he squared this with the supposed virtues of asceticism and living for the next world.

Religion gets into philosophy far too much, and kind of makes a big mess, since it doesn't have to make sense.
> Not necessarily motivation in the sense of "why is this important", but motivation in the sense of "we are beginning a three page proof. Let me give you a paragraph to give you the outline so that you can fill in the details yourself, rather than having to read all of the details just to reconstruct the outline."

In graduate school this was the most frustrating aspect of paper reading (and writing). It makes sense why it exists however. Papers on mathematics in particular are laser targeted to a particular niche. As the science progresses you need more and more bespoke knowledge of previous work to even start the paper you're reading. There's an implicit assumption you've done your homework, so to speak, and authors likely feel there is no need to provide such a summary. Since, of course, if you don't have the pre-requisite knowledge the paper isn't targeted at you anyway.

Some of it of course is simply a pride thing. There have been many times I've felt the lack of exposition was a way to say "I'm better than you". I have no evidence this is the case but it would not surprise me.
It turns out MX uses a package called systemd-shim that seems to be the Debian one:

$aptitude show systemd-shim
Package: systemd-shim
Version: 10-6
State: installed
Automatically installed: no
Priority: extra
Section: admin
Maintainer: Debian QA Group <packages@qa.debian.org>
Architecture: amd64
Uncompressed Size: 82.9 k
Depends: libc6 (>= 2.34), libglib2.0-0 (>= 2.39.4), cgmanager (>= 0.32)
Suggests: pm-utils
Conflicts: systemd-shim:i386
Breaks: systemd (< 209), systemd:i386 (< 209)
Description: shim for systemd
This package emulates the systemd function that are required to run the systemd helpers without using the init service
Another good article on this subject:
https://bigthink.com/starts-with-a-bang/quantum-entanglement...
The latter two don't really have the internet to complain about their country though
> Over billions of years, every single species alive displaced some other species, multiple times over.

I can mostly agree with the rest of your points. But how many species are killing off thousands of other species in such a short time frame?
The connection worked reliably for me, and it kept my drinks hot for a while as promised, but ultimately it was left catching dust as it always needed special treatment so - being a lazy ass - I just went with the normal mugs and re-heating when necessary.

If it could be thrown in a dishwasher with the rest of the utensils, I suppose I would've used it more.
Urgent security alert for Fedora 41 and Rawhide users
Looking over it, I don't see why you'd use a managed sqlite service. Unless you started with sqlite & now you're stuck with its quirks

Don't know, I lean pretty minimalist on things, like I'm using `hyper` directly on another website I work on, rather than picking axum or warp
Is the solution against such attacks in the future only to scrutinize more, or are there other reasonable options in terms of hardening?
Peakatic - my new SaaS to make employee communucation easier
it all started from my personal experience at my current company. i guess the same feeling that we're all about making work feel less like, well, work, and more like a place where everyone thrives. With Peakatic, you get a whole toolbox of awesome features to supercharge your company's vibe and productivity.

imagine effortlessly keeping track of how everyone's doing, celebrating wins big and small, and making sure everyone's growing and learning along the way. That's what Peakatic does best – it's like having a secret sauce for building an amazing workplace culture.

And the best part? It's super easy to use and totally customizable to fit your company's unique style. Plus, our friendly team is here to help you get the most out of it.
You can write logging for both drivers dumping results.

Then checking which query doesn't return the same result set.
I've had a similar head canon that Planck lengths are the simulation's floating point epsilon.
Especially after you swat the bee
Step 1 is to log off of HN.
systemd subsumed udev. Eudev is what folks who don't have systemd use.
So many malicious actors have been caught because they accidentally created a mild annoyance for someone that went on to bird-dog the problem.