skysight-inc/HackerNews huggingface dataset:
Unscathed? We just had the warmest summer on record in North America and a record-breaking wildfire season that blanketed huge swaths of the US and Canada in smoke, just to name two effects that come to mind. Clearly we'll just sail through the coming years, as well.
Right? And even if they did score a virtual monopoly in the US through assiduous lobbying, they can't keep a global lid on development forever. Especially that if they do crack it, they prove that it both can be done and it's "just" the software. Even without the Asian manufacturers, the German ones wouldn't just roll over and die either.
Is there any real point to further RAG work given extremely large contexts are clearly on the way with 1M token contexts already proven?
> I upgraded the RAM to 8GB and the HD to an SSD

And you still meet the specs of the current Macbook 16 years later.
You can chat with the models directly in the same way you can chat with GPT 3.5.

Many of the opensource tools that run these models let you also edit the system prompt, which lets you tweak their personality.

The more advanced tools let you train them, but most of the time, people are downloading pre-existing models and using them directly.

If you are training models, it depends what you are doing. Finetuning an existing pre-trained model requires lots of examples but you can often do a lot with, say, 1000 examples in a dataset.

If you are training a large model completely from scratch, then, yes, you need tons of data and very few people are doing that on their local machines.
Bridge of No Return
Funnily, before the "aphantasia" was a thing, I always thought that "not seeing things in my mind" and instead having just "vague geometrical images" was my superpower and maybe explained why it looks like I could think faster and more effortlessly than many of my peers during college and phd years. I thought maybe my brain didn't spend cycles on pictures and used them elsewhere. That idea was maybe influenced by vaguely recollecting (perhaps wrongly) an Einstein interview where he mentioned also having only vague geometrical images in his mind. When the term "aphantasia" was coined, I was really surprised that people with aphantasia started writing as if it was a handicap they had, as if they were diminished by lacked something that others have. Nowadays, it still trips me up a little to see it described as a 'condition', though I understand it and feel that it is probably a give and take - it is probably an enabler in some domains and a drag in others.
>Not that it really matters, but if you asked people in philosophy departments, they would say the same.

https://survey2020.philpeople.org/survey/results/4866

The majority of the surveyed subscribe to moral realism (though there are no doubt biases in the demographic of those surveyed, and of course, the language used in descriptions of meta-ethical theories is more technical than "objectively true" or not). But as you said, that's neither here nor there.

>Since it's a value, it's either right or wrong. You've decided that "reproduction is necessary and sufficient for a meaningful life" is wrong.

But what this means for you is, apparently, just that you have positive feelings towards reproduction, and for me to disagree with you is not to reject some clear, objective indication of my purpose as if I've rejected a claim like "the earth is round"---it's actually more like you've told me "spinach is yucky" and I've said "No, I quite like spinach".

>It is in the same category as the former; it is a statement of value.

I don't think so and I don't think you treat such statements like the statements of the former either---

>but I have no problem forcing people who have committed heinous crimes to work for nothing

Sure, fine, I'm talking about holding people who are innocent as slaves, a practice which has been seen as morally permissible at various times and places. Those who thought that it was morally permissible were, in fact, wrong to think so---just as those who thought "the sun revolves around the earth" was a true statement were wrong to think so.

You see my point even if you disagree, right? The point is that there are times, places, cultures where people have done immoral things. That they are a product of evolution or tradition or whatever is besides the point to the immorality of what they've done. I am happy to be born in a society that values not holding (innocent) slaves. Just like I'm happy to be born in a society that understands the earth revolves around the sun. But it would be nonsensical for me to say that I'm happy to be born thinking "Spinach is yucky" because being born otherwise would lead me to believe in the "false" claim "Spinach is not yucky"---that doesn't make any sense, because the yuckiness of spinach isn't some objective property of spinach, and if I liked spinach, then spinach wouldn't be yucky, because a claim like "Spinach is yucky" is no more than an expression of my personal distaste for it. That I have a strong intuition that "slavery is wrong" is more like "the earth revolves around the sun" as opposed to "spinach is yucky" is evidence that moral claims aren't in fact just matters of personal taste. The immorality of holding innocent slaves isn't, prima facie, like the yuckiness of spinach---we certainly don't have the same attitudes towards them.
What does a "more favorable jurisdiction" look like? Federal tax code is the same throughout the US.
This attack used the fact that several distros patch OpenSSH to link to libsystemd for notifications. Libsystemd links liblzma, and the backdoor checks if it's been linked into OpenSSH's sshd process to run. Without distro maintainers linking libsystemd, xz wouldn't have been a useful target for attacking OpenSSH.
I think UNIX will be secure; next generation of AI will be able to scan directly the image of a compiled kernel and will be able to detect -- if not all -- harmful things.
Sure, but I don't think this is "too many cooks in the kitchen," I think it's the opposite: hardware companies tend to be structurally incapable of spending as much as they should on software because everyone in the hardware space has the same bias. The economics of the space select for it in the short term and against it in the long term, creating the neverending foot-gun party we observe.
A video posted by another commenter shows someone using a 3D scan of a gemstone to work out how to get the most out of the gemstone he is cutting

https://www.youtube.com/@hedronrockworks/videos
Well we can't blame Electron for this, as much as I'd like to, since there are Electron apps in the app store.

Discord asks for the accessibility option to read system wide keystrokes for push to talk. Can sandboxed apps do that?

Also, no matter how secure the app store is, i'd very much like to be able to install applications without -ing Apple's permission. So having something available in the app store doesn't give me a warm fuzzy feeling.
The ram is not on the cpu on a mac. It's in the same can but it's still regular ddr dimms.
+1 on these questions.
Can I run a local llm that will, for example
- visit specified URLs and collect tabular data into csv format?
- ingest a series of documents on a topic and answer questions about it
- ingest all my PDF/MD/Word docs and answer questions about them?
> It's naive to believe that any form of physical presence means someone isn't going to do something nefarious in the eyes of the project.

It's not the only thing, but it is something.

There's a lot of social engineering that went into the xz backdoor[0]. This started years ago; Jia Tan was posting in projects and suddenly someone appeared to pressure projects to accept their code. Who's Jia Tan? Who's Jigar Kumar, the person who is pressuring others to accept patches from Jia Tan? We don't know. Probably some person or group sponsored by a state APT, but we don't know for sure, because they're currently just text on a screen.

Having this person or group of people have to continually commit to the bit of publicly-known open-source maintainer who attends conferences, has an actual face, and is on security camera footage at multiple hotels and airports is far, far harder than just talking a vulnerable person into allowing maintainer access on a repository. Making them show up to different places a few times adds a layer of identity. Otherwise these "skilled eyes" could be anyone with a wide variety of motivations.

[0]https://boehs.org/node/everything-i-know-about-the-xz-backdo...
Seeking Insights on Optimizing Model Deployment and Integration Processes
Hello Everyone,

As a seasoned Data Scientist and recently appointed manager overseeing a team of ten Data Scientists, I'm transitioning my focus towards addressing challenges at the team level, aiming to foster smoother operations within our mid-sized company. I'm eager to engage with individuals who have encountered similar obstacles and successfully navigated them.

Here's a breakdown of the specific pain points we're grappling with:

Fragmented Deployment Procedures: Our current deployment and integration processes across different business units lack cohesion, leading to delays in deploying models to production. We often find ourselves relying on only a couple of individuals proficient in deployment in each business unit, which limits scalability and efficiency.

Lengthy Model Updates: Implementing changes to models in production is proving to be a time-consuming endeavor. Due to complex integration with other existing software, we're experiencing bottlenecks in the update process, hindering our ability to swiftly adapt to evolving requirements and insights.

Lack of Standardization: The absence of standardized practices for integrating models exacerbates the learning curve for Software Engineers across various business units. Each team adopts disparate approaches, further complicating cross-unit collaboration and knowledge transfer.

Data Fragmentation: The ad-hoc design of our models has resulted in fragmented data storage practices. As a consequence, new team members often struggle to locate relevant data or understand the integration process, impeding their onboarding and productivity.

Perception Challenges: There's a prevailing perception among teams is they want to use off-the-shelf tools but sometimes those tools provides inaccurate insights, casting doubt on the reliability of our analyses. This skepticism undermines efforts to foster collaboration and establish trust with other departments, hindering our collective progress.

Please share which issue you have faced/facing it and how you are addressing it ?
> Do Apple definitely not retain a key?

If this is the threat vector you’re worried about, you shouldn’t have had anything in iCloud (or any cloud for that matter) to begin with, rendering this debate completely moot.
Correct. And the extrapolation region for the MRI is reasonable, I reckon, versus extrapolation into pulling enhanced blurry photos!
The Graph of Wikipedia [video]
I "played" the tutorial (after trying a game without knowing anything, during which I appreciated the error messages as guidance, and was confused when I'd attack and lose, and my inner game designer was tickled by the ability to play nonsense words- lowers the barrier to play) and it didn't feel overlong or too sucky, though the "that's all the rules!" message at the end was welcome.
Still, a page of rules would be welcome, yes.
> actually distinguish between real life and fantasy

Are LLMs unable to distinguish between real life and fantasy? What prompts have you thrown at them to make this determination? Sending a small fairy tale and asking the LLM if it thinks it's a real story or fake one?
>I’m not in OSS but I hire technical people remotely, [...] interviews on Zoom.

Different situations with different incentives and psychology:

- potential to receive money : job candidates are willing to get on Zoom calls or meet in person because they want a paycheck.

- no money involved & volunteer for free : potential open source contributors are not interested in getting on Zoom calls for $0 pay.
Not sure we're talking about the same thing. By validation I mean of identity. On proprietary software , before an attacker get inside access to the code, they would have to interview, get hired, submit (presumably, fake) document id, provide (again, presumably, fake) bank details, etc. This attacker just had a GitHub account and email, as far as understood it.

But, as I said, maybe tricking a sub contracting company into hiring you is not as hard. I remember working with contractors whose faces I've never seem on video, let alone in person.
bsnes' creator...

I still can't get over the tragedy of what happened to them. That shouldn't have happened under any circumstance.
What can be learned here and improve?

- systemd and libsystemd is an absolute mess. What are the alternatives at this point?

- what processes can be improved for Linux distributions to catch malicious actors trying to push back doors into the ecosystem?

- is there a dependency graph that would show how many programs use a specific utility library? Might aid in finding other possible attempts to backdoor
This sounds interesting. The code examples reminded me of Qt signals but all the answers to my post suggest that JS signals would be much more powerful. Honestly, I'd need to take a closer look.
Open-sourcing my Universal Constructor AI coding tool
I found the black hat!
I guess George's 5 hour poking and googling around session, fruitless in terms of the actual results(making compute on AMD's consumer rdna3 chips stable), is newsworthy on HN as of now.
I totally agree, and also unsolicited calls. Right now the only options that I'm aware of are:

1) Blocking numbers (which is pointless because they rotate them and spoof residential numbers).

2) Whitelisting numbers and blocking everyone else (this would cause me to miss legitimate calls).

3) Blocking entire ranges (this doesn't work because of the spoofing).

4) Using one of those spam screening services (currently looking into this). Still a bit concerned about missing valid calls and the privacy issue with this.
There is an implication here that the Fortran implementation of `SGEMM` is somehow inadequate. But any modern Fortran compiler will quite easily apply the AVX and FMA optimizations presented here without any additional changes. Both GNU and Intel make these substitutions with the correct flags.

The unrolling optimization is also just another flag away (`-funroll-all-loops`). The Intel Compiler will even do this without prompting. In fact, it appears to only do a modest 2x unroll on my machine, suggesting that the extreme unroll in this article would have been overkill.

Parallelization certainly a lot to ask of Fortran 77 source, but there there is little stopping you from adding OpenMP statements to the `SGEMM` function. In fact, modern Fortran even offers its own parallelization constructs if you're willing to go there.

Which is to say: Let's not belittle this old Fortran 77 function. Yes it is old, and does not even resemble modern Fortran. But the whole point of Fortran is to free the developer from these platform-specific details, and hand the job off to the compiler. If you don't like that approach, then you're welcome to go to C or C++. But this little block of Fortran code is already capable of doing just about everything in this article.
Like it? My brother I was trying to hide my enthusiasm to look cool in front of people on YC.

I use UpScayl pretty much every day and doing so feels like magic every time. Your user interface tweaks here and there are always appreciated and UpScayl is a joy to use.

Feel proud, UpScayl is witchcraft and I love it
It would be good if zstd had a standardised a static web dictionary, like Brotli's https://www.rfc-editor.org/rfc/rfc7932#appendix-A. This would mean that the overhead for small files would be smaller, for boilerplate like <!DOCTYPE html>.
Yea, I get that, from what I see in the details of this case the contributor was very competent. What I'm questioning here is whether in OSS projects there is enough face-to-face communication, probing about values, etc.
I lived all over Kyushu, in Tokyo, in Nagoya, and in Hiroshima. I lived there off and on between 2005 and 2020.

Most of the vending machines I saw had both types next to them, and I never had an issue with accessing a trash can in a konbini.

I suppose we just had very different experiences.
I do want to offer a limited defense of the medical community's "lack of open-mindedness". By the nature of their job, their work is inherently life risking. Most of us working in IT can afford to make experiments that doctor's cannot afford. I may be willing to try some unconventional approaches if the cost of error is an application crash and nuisance to the end user. If the cost of error is death of the user, I'm going to be far more conservative.

When a patient dies, society will treat a doctor very differently if it's perceived that the doctor was being unorthodox compared to too cautious. This doesn't mean that too cautious doesn't also cost lives. It's just really difficult to balance when the stakes are so high.

Anyway, good on you for taking ownership of your own health, and thank you for sharing your experience. I hope you continue to get better.
Hugging Face's Llama 2 page says, "You need to share contact information with Meta to access this model":

https://huggingface.co/meta-llama/Llama-2-7b

Ollama's installer didn't ask me for any contact info.
I don't know, my first (and main) impression of them was actually in the context of the llama.cpp mmap story, as I was somewhat involved in the project back then, and there I thought their impact on the project was predominantly negative. While they introduced a mildly beneficial change (mmap-based model loading), the way in which this was done was not healthy for the project - the changes were rammed through with little regard for concerns that existed at the time about backwards compatibility and edge cases that might be broken by the half-baked patch, Justine came across as self-aggrandizing (in the sense of "acting as if they ran the place", presenting their proposals as a plan that others must follow rather than suggestions) and overly eager to claim credit (epitomized by the injection of their own initials into the magic number file format identifier next to those of the project originator's, and the story of the hapless other author of the mmap changeset who was at first given a token acknowledgement but then quickly sidelined). Arguments for the inclusion of the patch seemed to be won by a combination of half- and untruths like those about memory savings and the sudden participation of a large number of previously uninvolved sycophants. It is fortunate that Georgi handled the fallout as well as he did, and that he in fact had amassed the social capital necessary to survive his heavy-handed solution (soft-banning both JT and their most prominent detractor). A less-successful project would probably have found itself captured or torn apart by the drama.

There is nothing wrong with holding people in esteem for their achievements, but in this case the degree of esteem really seems to be excessive. This is not a matter of simply being annoyed that people like "the wrong thing" - the mmap situation was significantly exacerbated by the presence of irrational/excessive supporters of Justine's as well as the irrational/excessive detractors that emerge wherever the former exist.
> a low parameter model

> on an old raspberry pi

I bet the LLM responses will be great... You're better off just opening up a raw text dump of Wikipedia markup files in vim.
No they did not. The dependency is still there, it's just being lazy loaded.

This would be prevented this particular exploit, which would have needed to take another approach, but at the price of making dependencies invisible and hard to debug. You could no longer have found vulnerable systems by way of ldd.

The only solution for the attack surface of systemd is to make the individual components more loosely coupled. There is no reason the same library is responsible for readiness reporting and reading logs.

One could even argue that none of those functions have anything to do with the job of init. Readiness can break in a number of ways, robustness is built on health checks.
The fact that the protocol has changed over time is itself a problem.

It isn't reasonable to expect everyone maintaining a daemon to keep track of additions.
People have moved into houses built on the "Love Canal" toxic dump in Niagara unaware of its history as probably the worst toxic waste catastrophe in the US:

https://en.wikipedia.org/wiki/Love_Canal

https://www.nytimes.com/2023/06/12/nyregion/love-canal-toxic...
(archive: https://archive.ph/UFJ96)
It might be because a lot of people use chatbot arena leaderboard for that purpose now, check it out here and look for local models:

https://huggingface.co/spaces/lmsys/chatbot-arena-leaderboar...
Chess.com April Fools "New app for Gen-Z"
Why is this article here? It doesn't have any substance.
I think we overstate how interesting people are in general. Maybe those people would've just been boring and consumed media in ways you don't seem to approve of sober otherwise?
StabilityAI chief resigns, raising doubts about AI startup's future
> Having this person or group of people have to continually commit to the bit of publicly-known open-source maintainer who attends conferences,

This is assuming maintainers even care/want to go.

> has an actual face, and is on security camera footage at multiple hotels and airports

The same footage that'll get wiped a few weeks after the conference ends, and quickly becomes not useful.

This is wonderful posturing in the name of security theater but doesn't solve anything.
Companies and in fact everyone has the choice to NOT use software that comes without warranty. But, of course, the cost difference will be astronomical. Alternatively companies and everyone have the choice to inspect open source software for security problems BEFORE use. Of course, astronomical cost.

This is an attempt to shift costs onto open source developers. Which, aside from being totally unjust, won't work. There's a legal expression "you can't squeeze blood out of a stone". Shifting costs onto people that can't carry those costs doesn't work for the same reason supporting a skyscraper with a toothpick doesn't work. The toothpick breaks, and when the skyscraper lies collapsed on the floor, nobody blames the toothpick. Hell, they might say the toothpick was heroic: trying to save the situation, sacrificing itself, screaming, and when nobody helped, not the government, not the owners, not ... the building collapsed and all the damage was done.

But it's even more stupid than just that. As soon as this gets introduced, and some company makes a security fix. They of course, for GPL or AGPL software, have to release their fixes. This will then make them liable for any other security problems in that same software. After all, they'll be the last ones releasing that software after the government implemented this law.

So how will you even do this, without making software fixes effectively illegal? Achieving the exact opposite of what such a law tries to achieve ... But of course, you can't have this discussion with people just looking to keep "their" free stuff but trying to shift the rest of the costs.
Show HN: Pg_paper_dump – Data Preservation Service