skysight-inc/HackerNews huggingface dataset:
No CEO is going to be strong in all areas, and it seems different but incredibly successful CEOs can come from a variety of backgrounds and management styles.

>"Ok, so then evaluating whether Thomas Kurian is doing a good job, discussing and pressure testing the rationale behind his proposed targets and strategies, figuring out how they fit in with the broader company strategy and communicating this vision effectively, having a contingency plan if Thomas Kurian leaves or a better candidate for Cloud CEO appears on the radar."

You could say the same thing about CEOs who are good at that sort of thing as well: Does Sunadr or Satya understand the technical decisions of going all in on Spanner opposed to NoSql type systems or backing the Go language over Carbon, these are all things that will have huge second order effects 10+ years down the road.
A work friend of mine is suffering from Tinnitus which started after his Covid infection, so much he cannot cope with normal conversations when speaking over Teams or in face to face interactions.

He's a senior engineer and one of the best I know, and is considering wood working / joinery. From my research, it's not exactly well paid but he says it's something he's always wanted to do and will keep his mind busy and loud enough to distract away.
Oh my God, if Tesla sold a range extender gas generator that sat in the frunk, and could add an extra 150 miles.. take my money.
(society’s laws are not immutable physics).

This is a great way to put it.
I expect the wider-marketplace to be dominated by parents who don't want to spend $1k-3k. :P

Also, it seems like the wrong fusion of functionalities. If there were a bunch of passable robo-friends for your kids on the market, wouldn't you want one that a child can hold during a car-ride and bring into the waiting room at the doctor's office? Something that isn't such a big battery-fire hazard to keep indoors while sleeping?

There's a reason teddy bears and tricycles are separate toys.
Wow, that's one slightly complex sentence. I did a double-take at first, then had to scan the sentence a second time, to figure out what it meant, because of the consecutive, multiple clauses in it.

Such a number of puns not intended originally, but noticed and italicized ;)

Okay, will confess, I added one or two puns after the fact, to enhance the result, like the "one" and "complex" at the top, and the words in this sentence.
Makes one wonder how many instances of this goes unnoticed. Maybe this attacker got sloppy, but how many of them don't? We were lucky that one person noticed suspicious behavior and had the technical skills and patience to investigate, but how many of us don't?
Yeah if I wasn't planning on a big career shift anyway in the next 2-3 years, I'd be out the door at Google. Pay is great, I'm able to be fully remote, and it isn't too stressful to do my day job - but the company feels nothing like it did 10 years ago.

You know how there are top down and bottom up companies? My experience at Google now is that it is neither. VPs expect bottom up work and then smash it down whenever they don't like it - but they also cannot articulate what they actually want. I'm constantly being asked to go through prioritization processes that take a ton of time and end with "eh, every project stays at the funding level it is already at."
Making long-term memories requires DNA damage
Obviously he’s aware; it would be too hard for it not to come up given how often it’s posted on social media. The mistake you make is belief Google is in the same business as our little web apps; making money to live.

No. Google’s goal is preserve and grow the wealth and power its investors have over society. That means bleeding edge not bothering with 20 year old pop culture obsessions.
Sometimes the most hyped research is not the most important.

Demis Hassabis was doing good research applying ML to important scientific problems. Then Google became jealous about ChatGPT and they pulled Hassabis to work with that.
Security is hard.

In this case, it seems like there's a lot that could be done to reduce the chance of being exploited.

Why are obscure binaries in the repository at all in the first place, even if in the test dir? Surely those binaries can be generated as a setup step prior to the tests actually running.

Furthermore, why are there scripts present in the release package that have not been added to the source code?

Also, if I understood it correctly, the compromised binaries are also present in the release tarball. Why are they part of the release if they are supposedly test fixtures rather than part of the application code?
Had that at Wind River years ago. They'd both give you RSUs as a kind of bonus but you could also invest a part of your salary in RSUs. Don't know if they're still a thing.
I may have misread ECS as EC2 and I apologise for that.

But the argument you make should certainly be applied to other managed services. AWS generally has opaque pricing, and significant hidden complexity - are you really going to just subscribe to ecs and fargate? Or are you subscribing to a bunch of other complexities like CloudWatch, IAM, EBS, etc etc? If I want to control costs then do I also need some third party service? How many IOPS does my database need, anyway?

I’m not an AWS user, because every time I’ve looked at it I’ve come away shaking my head at how complex everything is, and how much vendor specific technology I need to learn just to do something simple.

And, having run organisations with more than a handful of employees, if there’s anything I’ve learned it’s that simplicity is a virtue.

In fact, the last company I was involved with went all-in on AWS which involved formal training for everyone, very high costs, and multiple dedicated administrators. My part of the business pre dated that decision, and we did well over 10x the throughput with a single dedicated ops expert, using our own gear, orchestrated with docker-swarm. Our costs were literally 10% of the cost of AWS for the other part of the business, including amortisation of the hardware, and that’s before all the extra training and operational costs of AWS.

Today, it’s far easier to run K8s than it was to run swarm back then. So quite honestly, if you’re an Indy developer like me, K8s is almost a no brainer, and if you’re a mid sized SaaS shop, AWS is just a really great example of spending tens of thousands of dollars a month to say you’re running in AWS.
> The commonly-used technology is by far the best choice for long term archiving, because something that has a billion users will go obsolete/unreadable a long time after a fancy compressor written by a phd student in your lab.

Did you read the article? `xz` is far more complex than the alternatives. Your analogy doesn't make sense in this scenario.

> If I were running an archive today, I would be keeping everything in .zip files

So...not xz. Okay.
That would be because that demo (SwingSet2) is probably that old! https://docs.oracle.com/javase%2Ftutorial%2Fuiswing%2F%2F/lo...

Edit: close enough, 2007
You can only do this so much before you hit the pay ceiling of your role more or less. Then there is also the age factor, which whether it's justified or not the older you get the more expectations there are and the harder it becomes to jump ship.

Personally my biggest gripe is how technical careers evolve into non-technical roles because of how companies underestimate the engineering and overestimate people skills. The pay gap would be easier to bridge if yearly reviews were based mostly on technical skill growth instead of other corporate jargon like "impact" or "leadership".
And, Joey Hess has counted at least 750 commits to xz from that handle.

https://hachyderm.io/@joeyh/112180715824680521

This does not look trust-inspiring. If the code is complex, there could be many more exploits hiding.
Must vary widely, because I went in August and there was 0 line at all. A lot of places are on Spring Break in the US right now, so that may contribute to your experience.
All the magic in the universe will not allow you to find anything about a human from looking solely at the neural structure of its brain, however sophisticated. The brain is a representation (genome) of lived experience (phenome). The transformer has only ever experienced alphanumeric data input. Second hand experience.
I remember back in the 90's in auto shop we calculated that you'd only need 15-25hp continuous to essentially power all of a car's needs if you could smooth demand for power from the peaks over the length of the trip. It stuck with me as a surprisingly small number, but it mathed out, even including heating and AC. Cars are both larger and more aerodynamic nowadays; I wonder if the amount would still be the same?
Arguably the problem really isn't the cats so much as it is removing all the things that would eat feral cats.
https://en.wikipedia.org/wiki/Decline_in_insect_populations

> Birds and larger mammals that eat insects can be directly affected by the decline.

Yeah yeah Wikipedia is not a source or evidence but it's a good enough starting point.

Pollution, global warming, ecosystem destruction, etc is causing bug population collapse which is at the basis of the food chain, including birds.

Cats may be part of the problem, but they are not /the/ problem. Compare also with the claims that windmills cause bird deaths (https://climate.mit.edu/ask-mit/do-wind-turbines-kill-birds).

See also https://theconversation.com/dont-blame-cats-for-destroying-w...
Don’t know all the details and rust isn’t immune to a build attack, but stuff like that tends to stand out a lot more I think in a build.rs than it would in some m4 automake soup.
Our farm cats certainly did hunt rats, and rodents were a far larger part of their diet than birds. Rabbits, too. Never a chicken (in the article) - I can’t imagine a cat hunting a chicken unless the cat was exceptionally large and healthy.

We’ve also owned a couple “suburban” Chartreaux cats specifically bred to hunt rats. Fearsome beasts that hunted nothing but kibble in reality.
Powerful X-class solar flare slams Earth, triggering radio blackout over Pacific
It's unfortunate that the anti-systemd party lost the war... years ago. But I don't blame systemd, Lennart Pottering or the fanboys (though it would have been so much better if the guy never worked in open source or wasn't such a prolific programmer). I blame Debian and its community for succumbing to this assault on Unix philosophy (again, years ago).
Being in a similar boat, I heartily agree.

But I don't want anyone else to get notified immediately because the odds that somebody will start exploiting people before a patch is available is pretty high. Since I can't have both, I will choose the 90 days for the project to get patches done and all the packagers to include them and make them available, so that by the time it's public knowledge I'm already patched.

I think this is a Tragedy of the Commons type of problem.

Caveat: This assume the vuln is found by a white hat. If it's being exploited already or is known to others, then I fully agree the disclosure time should be eliminated and it's BS for the big companies to get more time than us.
I would love to hear from some folks who have worked with him. The quote is interesting, that his prof would say he's "not a magician at any one thing".

Does that mean he's not all that technical or struggles with math? Not sure how to read that.
Counterpoint: Cats yell at you when it rains, because they have observed you make the rain (in the shower) start, therefore, you are a God that can control the weather.
"All bureaucracies always fail" is not politically neutral and also not true!
Yes, exactly. Neither GPUs nor CPUs are setup for 1 bit math. Pulling 1 or 2 bits out of a word isn't all that straightforward on CPU or GPU - lots of shifting and masking. I wonder how long it's going to be before we see custom hardware for bitnets? I suspect we'll see it on FPGAs first.
Ah I see, I wondered where the heck is a reply e-mail, I didn't see any reply email spelled out anywhere and didn't notice the button, I thought maybe the archive site deliberately wanted to hide the email adderesses.

Kinda looks like everyone in the thread might be sock puppet? ...except for the xz maintainer. Oof.

Now I'm just even more sad. Dammit Internet.
Around 5 years ago, peer negotiation got massively simplified with new additions to the spec (see Perfect Negotiation). If you’re on a browser released since then, your life will be far easier.
I don't think people are running 1B+ models on the Neural Engine these days. The high-performance models I've seen all rely on Metal Performance Shaders, which scales with how powerful your GPU is. It's not terribly slow on iPhone, but I think some people get the wrong idea and correlate an ambient processor like the Neural Engine with LLMs.

The bigger bottleneck seems like memory, to me. iPhones have traditionally skimped on RAM moreso than even cheap and midrange Android counterparts. I can imagine running an LLM in the background on my S10 - it's a bit harder to envision iOS swapping everything smoothly on a similarly-aged iPhone.
They would vote in favor of Prop 13, which is bad.

And you know this how, because it hasn't been repealed? Come on.

And by the way, students violate each other's privacy then all the time. They aren't reporters, but they also go and tell the secrets she didn't, so are you going to say those students are the antagonists?

Students don't generally broadcast each others' secrets through a citywide daily newspaper. And while you could argue that the advent of social media gives them equivalent publishing power and some students abuse it, such usage is generally condemned.

You have a weird fixation on the people in this story, maybe it's a good time to go for a walk.
There's probably no way to move it by hand on a ship of sufficient size, only hydraulically, but emergency steering would be a completely separate hydraulic system (separate pump, rams, and mechanical controls) powered by a separate generator or engine. The mode of operation is a person goes down into the steering gear room (as parent mentioned) and responds to instructions telephoned, shouted in person, radioed, or some other way communicated. E.g. "starboard 15°". So your "fly-by-wire" controls can be all kinds of messed up, so long as you can disconnect them and operate the backup system by hand you maintain control.

On a small boat we just have a small cover in the cockpit over the rudder pin where we can insert an emergency tiller and steer "by hand" (realistically need to quickly rig some lines for mechanical assistance but that's okay because the secondaries are right there).
I am very concerned about Rust.

Rust’s “decision” to have a very slim standard library has advantages, but it severely amplifies some other issues. In Go, I have to pull in zero dependencies to make an HTTP request. In Rust, pulling reqwest pulls in at least 30 distinct packages (https://lib.rs/crates/reqwest). Date/time, “basic” base64, common hashing or checksums, etc, they all become supply chain vectors.

The Rust ecosystem’s collective refusal to land stable major versions is one of the amplifying issues. “Upgrade fatigue” hits me, at least. “Sure, upgrade ring to 0.17” (which is effectively the 16th major version). And because v0.X versions are usually incompatible, it’s not really possible to opt not to upgrade, because it only takes a short while before some other transitive dependency breaks because you are slow to upgrade. I recently spent a while writing my code to support running multiple versions of the `http` library, for example (which, to be fair, did just land version 1.0). My NATS library (https://lib.rs/crates/async-nats) is at version 34. My transitive base64 dependency is at version 22 (https://lib.rs/crates/base64).

This makes it nearly impossible for me to review these libraries and pin them, because if I pin foo@0.41.7, and bar needs foo@0.42.1, I just get both. bar can’t do =>0.41, because the point of the 0.X series is that it is not backwards compatible. It makes this process so time consuming that I expect people will either just stop (as if they did) reviewing their dependencies, or accept that they might have to reinvent everything from URL parsing to constructing http headers or doing CRC checks.

Combine this with a build- and compile-time system that allows completely arbitrary code execution, which is routinely just a wrapper for stuff like in the zx attack (look at a lot of the low-level libs you inevitably pull in). Sure, the build scripts and the macro system enables stuff like the amazing sqlx library, but said build and macro code is already so hard to read, it really takes proper wizardry to properly understand.
> I do think that the Prius (and Prius Prime) have surpassed the Volt's design, and the proof is in the pudding. Prius Prime has 52mpg, a figure far more efficient than the Volt ever had.

This is partly because the Prius is optimized as a hybrid-first design, while the Volt is optimized as a BEV-first design. The difference is in the gear ratios of the planetary CVTs: Prius is optimized to minimize the amount of energy transmitted electrically, which maximizes overall efficiency.

However, that design is sub-optimal for a car that you want to act like an EV. As your link shows, the Prius must have the ICE spinning at speeds greater than 42 mph. Not a problem for a hybrid, but that doesn't work for a "range-extender EV" like the Volt. Additionally, (before the current model year) Toyota's plug-in hybrids can't provide full acceleration in EV mode--they always kick in the ICE when you floor it. That's again a consequence of how the transmission is optimized for hybrid operation.

By making compromises to the gasoline efficiency, GM was able to create a car which acts like a real EV most of the time: A 1st gen Volt will go at least 80 mph in EV mode, and won't turn on the ICE (come hell or high water) until the battery is below 5%. And, it will do that for an honest 35 miles of freeway driving.

The second generation Volt uses GM's "2 mode" hybrid transmission, which closes some of the MPG gap by adding one fixed ratio (100% mechanical transmission) as well as high and low speed eCVT ratios (to minimize electrical power in those two speed ranges).

https://www.gm-volt.com/threads/gen-2-volt-transmission-oper...
> pipeing into this shell script which now uses "eval"

I don’t actually see an issue with that `eval`.
Why would one consider running `xz` followed by `eval`-ing its output more insecure than just running `xz`? If `xz` wants to do shenanigans with the privileges it already has, then it wouldn’t need `eval`’s help for that.
This magazine contains ridiculous amount of ads - more than actual content on a single screen span. Wonder whether we really need to get news this way and especially on a renowned aggregator like HN.

Note: ad blockers don’t work on iOS.
Exactly. And at least Cargo will refuse to download a crate which has been yanked. So any crate which has been discovered to be compromised can be yanked, preventing further damage even when someone has already downloaded something which depends on it.

Building packages with up-to-date dependencies is also vastly preferable to building against ancient copies of libraries vendored into a codebase at some point in the past, a situation I see far too often in C/C++ codebases.
What's wrong with CLONE being a MySQL plugin? I mean a good chunk of this page is people praising Postgres for its plugins.

As for support in hosted cloud providers, that's a question for the cloud providers, no one else can answer this. But my best guess would be because they want you to use their in-house data management offerings, snapshot functionality, etc instead of porting MySQL's solution into the security restrictions of their managed environment.

Yes, xtrabackup and mydumper are third-party tools, as I noted. If you needed something out-of-the-box prior to CLONE, the paid MySQL Enterprise Edition has always included a first-party solution (MySQL Enterprise Backup, often abbreviated as MEB). Meanwhile Community Edition users often gravitated to Percona's xtrabackup instead as a similar FOSS equivalent, despite not being a first-party / out-of-the-box tool.
It’s a challenging economic cycle to enter software development. There are tons of skilled software engineers on the market right now. I see bootcamp/entry-level devs being least desirable currently. I work at a company that isn’t considered to be a top-tier tech company, but even we are getting some great, experienced candidates applying to open positions.

AI is making it easier for candidates to spray-apply to jobs with customized resumes and CVs. Recruitment teams have to filter out the noise. I’d have to imagine filtering for verifiable computer science degrees is one way to remove some noise.
And what a car it is!
The 80s kids are building the movies.
Yeah I worked in FAANG when we got the advance notice of a number of CVEs. Personally I think it's shady, I don't care how big Amazon or Google is, they shouldn't get special privileges because they are a large corporation.
Surely this is happening right now.

A lot of eyes are on the code. From all sides. Folks trying to find old unpatched backdoors to exploit or patch.
"near" is a relative term that isn't specific enough to get an idea of how dangerous something is.

It's dangerous to be near hydrogen sulfide. It's dangerous to be near a primed hand grenade. It's dangerous to be near an artillery shell impact. It's dangerous to be near a drunk driver. It's dangerous to be near an active battlefield or even near a war.

But they are all different nears.

When you say its dangerous to be near the plane of the collision, are we talking 1m, 10m, 100m, 1000m, etc? Are there dangerous byproducts created that might kill you even after the event itself? That's useful information. A general "don't be near" isn't really helpful.
> subpar search results

This isn't as innocuous as you make it. Add up wasted minutes for millions of users and you're looking at thousands of lifetimes.

I don't think it's an exaggeration to say that access to information is a force multiplier. Google doesn't have a monopoly on that, but it's hardly worthless or trivial.
> "our findings suggest that inflammation in certain neurons in the brain's hippocampal region is essential for making long-lasting memories"

This is a summary of paper in Nature [1].

[1] Formation of memory assemblies through the DNA-sensing TLR9 pathway
https://www.nature.com/articles/s41586-024-07220-7
Unless evidence to the contrary presents itself, it seems appropriate to assume that all books written by the conman known to present fiction as fact share similar relationships with the truth.
Yeah, I saw that as well, met some professors in grad school that started talking about physics in terms of axioms and proofs instead of experimental results and models. At that point I lost interest and just went with math instead, if it is going to be math anyway why not go with the real thing.
I don't think that a problem with lzip invalidates all of the article's criticisms of xz.
The link should load up with a sample I wrote, I think? It does for me anyway! Let me know if you don't see it. But I'll also paste it here:

model Foo {
/** this is a description */
x: Bar;
}

/** this is also a description */
model Bar {}
Good luck finding him/her.

GitHub probably already gave feds all logs and IPs, but I would bet 100:1 that it's all going to be a VPN or something like that.