skysight-inc/HackerNews huggingface dataset:
It's the long tail of free speech. You can't stop someone from publishing information about how to defeat such a device. It would become common knowledge very quickly and would be used easily by criminals with specialized toolsets available on several different levels of marketplace.

In the UK, you can much more easily wrap all that up, and deny existence to those markets and even to import of that equipment.

And it's beyond culture. The UK holds an active monarchy and a hereditary house of parliament. The citizen simply does not have the same status and is unavoidably a "subject."
I disagree across the board with your assessment of this.

>reality has a left leaning bias

If not political leaning, what other "left leaning" bias might it have? I believe that you are simply wrong in your interpretation and even more wrong calling me out. If you think otherwise, I am willing to be educated on how this can be explained without a political bend.

>Navigating life expecting to understand everything without first having to learn the things is... unreasonable.

Not if you are being preached to or someone is implying that you don't understand something but they have "secret" knowledge, typically using an appeal to authority. If you call someone wrong, is it not better to explain to them what is "correct" in a way that they can understand and pass it on to others to make the world better and more "correct"?

>That's directionally better, but it's definitely not what I mean and is not how I would put it. This is why you need to look at multiple sources. Not just for this, but in life in general.

I mean this in a academic sense, not as a personal attack, but this is just a pretentious and arrogant way to interact with people.

I notice from your bio that you have a graduate degree, which is an odd flex to put in your HN bio, but you earned it so whatever, I guess. I also have a graduate degree (undergrad organic chem. with double minors in math and comp. sci., MBA with area of concentration in finance). It seems though that the difference is that if I speak to someone that I (perhaps erroneously) believe is not as educated as I am, I would never belittle them, insinuate that they are stupid, imply that they have not thought it through, or appeal to authority. And of course I check sources, although in this case it appears to me that you may not have. (I was having a bit of fun with you regarding the Reddit thing, sorry about that.)

Additionally in my academic experience and especially in social sciences, saying "all experts agree" on anything is about the dumbest thing you can say 99% of the time and usually is not even true. This can many times be true in hard sciences (sorry soft science folks, no offense intended) but isn't even always true there.

So, while I appreciate your life advice, I would offer some to you as well -- maybe don't assume things about people and if you know some useful knowledge, share it! It can and will make the world a better place! Also there is a very tiny chance, that you might be wrong and learn something new, which is always nice as well! This happens to me all the time ... but so far not in this case.
Imagine a world where ‘no legal duty’ was the default mindset for everyone.
Internet detectives at work in this thread!
Disabling government technology is a crime. Interfering with third party data collection efforts is my absolute right. These are not the same things.
and then you just ask for leetcode interviews and dismiss their experience haha haha
Suddenly anything like that becomes super suspicious.

I wonder how this will affect the OS community in general.
Wow, I remember reading that PID != 1 line years ago. Had no idea they changed it. I stand corrected then. Given the existence of user service managers as well as flags like --system and --user, I inferred that they were all entirely separate processes.

Makes no sense to me why the service manager part would require running as PID 1. The maintainer just says this:

> PID 1 is very different from other processes, and we rely on that.

He doesn't really elaborate on the matter though.

Every time this topic comes up I end up searching for those so called PID 1 differences. I come up short every time aside from the two things I mentioned above. Is this information buried deep somewhere?

Just asked ChatGPT about PID 1 differences. It gave me the aforementioned two differences, completely dismissed Linux's prctl child subreaper feature "because PID 1 often assumes this role in practice" as well as some total bullshit about process group leaders and regular processes not being special enough to interact with the kernel which is just absolute nonsense.

So I really have no idea what it is about PID 1 that systemd is supposedly relying on that makes it impossible to split off the service manager from it. Everything I have read up until now suggests that it is not required, especially on Linux where you have even more control and it's not like systemd is shy about using Linux exclusive features.
Our preprint does exactly that :). https://arxiv.org/abs/2403.05583
"Assume that 3% of the people you encounter will act maliciously."
> Using a Mistral-7B FT trained on GPT-4 outputs allowed us to parse through hundreds of thousands of Reddit threads in a simple way with just hundreds of dollars of compute.

Great idea. These sort of clever approaches are needed to be able to build these sort of products that benefit from scale. When the cost of inference goes down, it enables new experiences. And clever ways to reduce cost before the big providers do, is a massive competitive advantage that makes it tough for those who wait to compete with you.

Anyone building AI products should take note.
That is also chemical energy! And we make more than enough food already right?
Is the Malta-based company vehemently against giving archivists access to the newspaper's archives? I can't imagine they would have any good use for it.
I don't think that answers why.

It's the cause, but the logic is missing.
Oh yes you need all the metadata, but because it's 2 numbers the scale and zero_point, I think the movement of singular digits are super fast to the GPU registers - cannot confirm though.

It's like in cuBLAS you do alphaAB + beta*C, and alpha and beta are both scalars which can be on the CPU, and moved to the GPU in nanaseconds.

I'm unsure though since I haven't tested it
I really don't understand why claims like this are legal.

There have been some civil lawsuits. IIRC Tesla settled in some cases (though not sure the amounts were substantial), others (including a potential class action) got snagged by the arbitration clause most customers don't bother to opt out of. The statute of limitations had expired in one instance. I'm surprised a group of purchasers didn't go after the company more aggressively, but I think most Tesla owners love their cars despite them not living up to the hype.
Yes, as someone who shipped embedded systems running off of SD cards, it's a real problem.

It's not the flash endurance you hit typically, but bugs in the card firmware that cause the FTL to completely lose it's mind. Yes, even with supposedly quality brands.

About the only way I found to deal with the problem is to use "industrial" SD cards that are a little slower and pretty expensive, but the firmware takes less liberties in the name of specious benchmarks.
> How would you counter this?

"I asked for a promotion, not for a complete career switch".
For the same reason why insider trading and price fixing is illegal: It's a scam to siphon money from others, and in doing so destabilizes the whole system.

If you don't protect against this sort of behavior, public confidence erodes and eventually the system collapses because nobody's actually producing anything; they're just scamming each other.

Once the rich own everything, your country's productivity and competitiveness falls through the floor (banana republic) because nobody doing the actual work has anything left to strive for other than subsistence.
I thought the hidden variable idea was proven not to hold, though? Like, I thought that was the point? That the behavior observed can only be explained using the state of the remote measure as part of the explanation?

I have not looked back at the book I read. I definitely remember it had examples that were not paired off. I'm assumingy memory is simply off.
Now to be fair, such an archive could have been created with a “store” level of compression that doesn’t actually perform any compression.
The article says it is a precursor for other chemicals so yes. If you just let it out as is it is probably pollution of a different kind, since CO can kill in high enough concentration.
To summarize the article, the back door is introduced through build scripts and binaries distributed as “test” data. Very little to do with the complexity or simplicity of xz; more that it was a dependency of critical system binaries (systemd) and ripe for hostile takeover of the maintainer role.
proprietary app, proprietary format (pdn), which coincidentally is the only supported one that works with layers. save yourself the trouble of locking yourself into this format and app.
Similar thing, but for electronic gadgets - https://shoppalui.vercel.app/
> openssh does not directly use liblzma. However debian and several other
distributions patch openssh to support systemd notification, and libsystemd
does depend on lzma.[0]

A quick glance at nixpkgs[1] does not show a direct dependency.

0: https://www.openwall.com/lists/oss-security/2024/03/29/4

1: https://github.com/NixOS/nixpkgs/tree/master/pkgs/tools/netw...
they might not have been playing the long con. maybe approached by actors willing to pay them a lot of money to try and slip in a back door. I'm sure a deep dive into code contributions would clear that up for anyone familiar with the code base and some free time.
That works if you have multiple mirrors configured for each package.

Just adding variety reduces the chance of having all the important repos up at the same time.
I love rhymezone, I use it all the time! Thanks!
Maybe GH expects a force push of older, trusted xv versions has/will happen.

Makes this repo untrustworthy.
a user offered 5.6.0 and 5.4.5 in an issue to microsoft/vcpkg

5.4.5 can be compromised

https://github.com/microsoft/vcpkg/issues/37197
Introducing a back door is not the same thing as a badly designed file format.
You are right, it's very much a culture thing.

On the US side its very "individual good" focus, whereas in the UK (and Europe in general) its more "community good" focused.

This may be partly a function of density- with higher density comes more human interaction in a smaller space.

The US also had a long period of no, or minimal govt, over very wide areas. This lead to a culture of personal security etc (think Westerns with people carrying guns).

Most Americans see govt at best as a necessary evil, who is actively working "against my interest." Whereas most Europeans see govt as an effective way to "promote community interest". (I'm referencing govt as a concept here, not as a political or party construct. In other words you might be against the people currently in govt, but still appreciate that there should be a govt.)
Looking forward to the time when Meta will make https://github.com/facebookincubator/zstrong.git public

found it mentioned in https://github.com/facebook/proxygen/blob/main/build/fbcode_..., looks like it's going to be cousin of zstd, but maybe for the stronger compression use cases
For retirement communities, it's called "upstreaming".
Residents of the Hyatt Residences near Stanford litigated that and, after eight years, settled.[1]

[1] https://en.wikipedia.org/wiki/Vi_Senior_Living#Litigation

[2] https://www.mercurynews.com/2014/02/19/residents-sue-palo-al...
I’m from the U.S. and have never heard it either, and don’t understand what it means.
True, but irrelevant -- _some packages_, _somewhere_, do depend on xz, which, if built, requires pulling the source from GitHub (see the default.nix: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/to...)

It's not the vulnerability that's a problem right now (NixOS was protected by a couple of factors) but rather GitHub's hamfisted response.

That is the problem.
Correct. I think the idea of this article is to raise awareness so the local residents can pony up the cash to save the website.
Why is this particular tower not surrounded by a taller fence with something along the top to discourage climbing?
No offense, but you took amphetamine salts once or twice and are now suggesting someone take it as medication? I urge you and your partner to double check how worth-it the long term effects may be to you. In other words, make sure you really suffer an acute ADHD, and be weary of suggesting the drug to others so easily.
Maybe because you can keep your coal fired base load (and associated sunk cost/asset value) and then have renewable powered CO removal. If you are going to do this why put up with a puny 400ppm when you just go to a rich source
of CO2, cut out the middle man (the atmosphere and entropy!). You can also make a different thing out of the captured CO2, maybe a building material instead of a fuel.
Oh sorry - did not expect to restate what you said whoops - all train of thought!

You can see from https://huggingface.co/mobiuslabsgmbh/Llama-2-7b-chat-hf_1bi... that the model disk space is 3GB + 100MB of LoRA weights. I also uploaded a 4bit one to https://huggingface.co/unsloth/llama-2-7b-bnb-4bit/tree/main which uses 3.87GB.

So because of the offloading trick, the GPU VRAM is less, but in actuality, still 3GB is needed.

Unsure on latency sadly
“Force”
LLMs Shouldn't Write SQL
In Belarusian it's indeed "амерыканскі бізон" and "еўрапейскі зубр" (American bison and European zubr). In everyday speech these are shortened to "bison" and "zubr".

And buffalo (like African and water) is "буйвал".

I had no idea American English used "buffalo" and "bison" interchangeably.

Learn something every day. :)
Is disabling the compromised repo the typical GitHub policy? My concern is there are monorepos used by package managers, like brew, that are a collection of thousands of projects [1]. These monorepos seem like a prime target for attack and if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem.

[1] https://github.com/Homebrew/homebrew-core
I wonder if there is a correspondence to Sony's 1-bit DSD audio stream? Could hardware developed for this purpose be used for some part of the processing?
I don't understand the significance of this link. It's some random people saying the title. Why not link to the github repo?
I guess it’s only temporary u until they find a new owner, but they should have made it read only to avoid breaking whatever depends on xz code to be there.
"NOVA: A.I. Revolution" – benefits and drawbacks of artificial intelligence
Skincare is an interesting beachhead. How do you test if your results are good? What's the baseline?

I feel like something like movies or video games would be a great way to validate the approach since there's generally agreed upon sentiments regarding these products.

Skin care I'd imagine is fairly complicated. Goal, lifestyle, budget, habit and individual based needs and preferences can lead to different sentiments. How do you calculate say, your loss function?
It depends on PAM which might pull it in though.
HN really doesn't like editorialized titles.

And the repo title wouldn't mention the news.

Maybe it would be allowed in this case, but a tweet or similar is safer.
The CEO's forward looking vision statements are not the same as spec sheets or a product user manual.

The website never said robotaxi.
The manual never said robotaxi.
The app never said robotaxi.

The CEO thinks it can be a robotaxi at some point in the future pending regulatory approval. (he has said it many times)

How is it illegal for the CEO to have a vision for the future of the product?
This is the way. Run from ram and an excellent selection of packages to boot! I have a number of pi zero and pi 2 zero running alpine.
It's not a problem, never has been. Nix mirrors all source bundles it pulls from third parties and caches them. cache.nixos.org has a copy of all the sources needed to build not just current HEAD, but also past commits (although deep history might start getting pruned for cost control soon, iiuc).

The Software Heritage archive also has an up to date mirror of xz's repo: https://archive.softwareheritage.org/browse/origin/directory...
Hahaha, I remember our favorite, plucky EE presenter opining about this. Solar freak'n roadways and friends must be zombies because these dumb ideas just won't die.
Well, at least I can thank you for being clear about your understanding of the world.
Would a filing like this grant any actual control of the fund?
I find it amusing that you choose to blame GitHub and not nix's brittle design. (can you imagine any other OS breaking because a repository goes down?)
or possibly just one person acting as two, or a group of people?
Under One Roof: How the Covered Walkway Conquered Singapore
Sure, but 'my updates are broken' is a happier (and more familiar to nixos-unstable users) place to be in than 'my ssh access has been compromised for days'.

Confirming no lzma linking on my recent x86_64 system: https://pastebin.com/hgN0LTxd
Agreed, This link is a little bit better since it includes other discussion, but I believe it already had an HN thread

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b...
I think this attitude really underrates the network effects of GitHub.

I personally am okay making an account on another forge to submit a bug report or patch, but most people aren't. And so I keep my repos on GitHub.

I do plan to soon set up mirroring to another service though. I haven't found a great zero-effort solution to mirror repos from an entire organization though, including ones that are created after mirroring was initially set up. Do you know of any tools which have that functionality? (If not I might write my own at some point.)
It wouldn't need to share any data with anyone, just have dynamic speed control depending on the road someone is driving. Storing data for all 6 million km of road locally and refreshing them regularly should be doable.
Show HN: I build a design kit for indie hackers to launch fast
Qualified immunity and the George Floyd protests have done a lot to make policing worse in the US.
> if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem.

Maybe that should be an opportunity for introspection into the house of card we've collectively built as software engineers.
SF native. Brother of defense attorney Tony Serra who defended Shrimp Boy and the Ghost Ship guy.

Agree with comment below that his works are best appreciated by walking in their shadow.
I use Paint.Net on my Windows machines. It's a great piece of software—and free. I bought the Microsoft Store version to support the author, although I continue to install the free download.

I also run https://github.com/viliusle/miniPaint using Cloudflare Pages so it's hosted in one of my sub-domains as minipaint.[mydomainhere] and it's great for quick jobs.
In this instance then, it sounds like it has cached the source with a backdoor in it, and anyone using it is potentially exposing themselves to a very public problem right now.
NPM called...

Anyway, it's called unstable for a reason. Despite debian trying to change the meaning of the term :)
I've been using paint.net for years now and it does have some pros.

- Sufficient even for mid-complexity art tasks

- Nice, simple interface

- Plenty of plugins

I don't mind the proprietary format -- since I'm usually just doing quick tasks in it, I'm either saving as jpg or png, or don't expect to need to open the pdn file at some later time or in other software.

However for anyone looking to start with something new, I'd really recommend using Krita or some other more recent program. Paint.net's available plugins are wildly disorganized, spread across at least one forum and hundreds of threads, often out of date or not working as intended, etc.

Great community and they deserve all the praise for maintaining free software for many years, but much like Gimp, it's just not the best free option available anymore.
this app is almost as old as dotNet and always felt like a showcase. it works, but understand your concerns. especially as the format is exclusive to their app (and the only way to have layers)
The Mitsubishi Outlander plug-in hybrid can do up to 60mph on a flat road in serial hybrid mode.
Turns out you're right and my knowledge was outdated. I seriously believed the systemd service manager was separate from its PID 1 but at some point they even changed the manuals to say that's not supported.

I was also corrected further down in the thread, with citations from the maintainers even:

https://news.ycombinator.com/item?id=39871735

As it stands I really have no idea why the service manager has not been split off from PID 1. Maintainer said that PID 1 was "different" but didn't really elaborate. Can't find much reliable information about said differences either. Do you know?
At least in my group, the backports are hand picked to solve specific problems, not just random wholesale backports.
Or perhaps when times are tough, people are forced to use fantasies as a way to handle discontent which would be socially or politically dangerous to show too overtly.
"Supervised Full Self-Driving" sounds to me like someone really wanted to leave the word "Full" in a name where it doesn't belong.

That's not the kind of decision-making I want for a product like this on public roads, where innocent bystanders are at risk.
https://www.reddit.com/r/BuyItForLife/comments/15b4iks/best_...
This one seems to be a good thread. Hopefully we'll have it on Lumona soon.
> Just adding variety reduces the chance of having all the important repos up at the same time.

this, sadly, is correct, and the solution you propose is also correct.

The only other option would be for the NixOS Foundation to mirror the git repo of _every single important package_, and I know they're already struggling with the prohibitive cloud costs of hosting just the build objects. :/
> Please submit the original source. If a post reports on something found on another site, submit the latter.

So: submit the GitHub link

> Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.

So: use what the link says, which in this case might perhaps be "xz repository has been disabled by GitHub"
I think what's going to make life difficult for the folks at Redis Labs is if all the major cloud providers standardize on Valkey for their cache offering then that alone will drive the market and mindshare away from Redis. I'd be willing to bet most people don't care one way or another but just want to use the managed service. Redis has to be truly noticeably better to compete with the offering that doesn't require purchasing be involved.
When Donald Trump asked people to stop using a particular image of his, it got used more than ever before and photoshopped to be even worse: <https://www.thewrap.com/donald-trump-chin-mocked-in-hilariou...> and <https://www.demilked.com/donald-trump-big-chin-photo-photosh...>. Why are so many people okay with that happening but also insistent on not using the Lenna image anymore?
People have always been weird and obsessive with fake tech "relationships" I dont see how AI assistants would be any different than any previous iteration of technological interaction
Why do you think having a vision and working towards it is fraud?
I just bought a car with a CVT and now I’m upset.
we should take this diagram and change "random person in nebraska" to "possibly a state-level attacker"

https://xkcd.com/2347/

nice
Could this "fake person" be... an AI? Hmm.
You shouldn't need to make an account to report a bug, honestly.
Why do you prefer the standalone installer to the Store version?