skysight-inc/HackerNews huggingface dataset:
I can't believe that system security is dependent on such a loose chain of correctness. Any number of things could have stopped this.

+ # A compile check is done here because some systems have
+ # linux/landlock.h, but do not have the syscalls defined
+ # in order to actually use Linux Landlock.

Fix those headers on those systems to explicitly opt-out. What's the point of headers if they don't declare their capabilities?

Also why isn't there a single test after a binary blob (even when compiled from open source) is made to ensure security is in-tact?

I wouldn't even ship a website checkout without end-to-end tests for core capabilities. There must be a priority misalignment of adding features > stability.

Edit: I hope the 'fix' isn't to remove the '.'--I just saw the other post on HN that shows removing the '.'
Yes, there is evidence of sabotage on the CMake configs too.

https://git.tukaani.org/?p=xz.git;a=commit;h=f9cf4c05edd14de...
the product is sold as such but there are support contracts to cover everything else
Oh, I know how to find porn on the internet just fine.

I (and I expect, the OP) just never see it on X.
There just wasn’t an appreciation for version control - and a lot of practices - at most companies until the mid to late 2000s. And I remember a lot of dev effort was spent dealing with internal SVN servers sitting in a closet. And other infra to do nightly builds etc.

Management and IT didn’t understand why they would want these things. Very few companies internalized these practices and usually learned the hard way to adopt them.

So back then these were somewhat new and radical ideas. But along comes GitHub, focusing on massive ease of use, and outsource an annoying hassle of most dev teams.

At the same time it was becoming more common to use open source libraries at work. But only sporadically and cautiously. I remember the work to get Boost (C++ lib) approved by legal. And that’s an extremely mainstream library. Often you would have to purchase or just write a lot of foundational code yourself.

So making a hosting solution with all these bells and whistles, but easy to learn, while also making it possible to discover code was fundamentally life altering for software engineering.
Unless I'm mistaken, 1.0 is 3x bigger than 0.9 for minified version? 647 Kb.
1. Even if there is an opt-out (I don't see it in the shop pay account section), the payment processor shouldn't be transmitting my PII to anybody without my explicit permission. Otherwise any shady site could add a Shop Pay integration and do drive-by scraping of user data without their consent or knowledge.

2. Of course you have to share that when you checkout, but it's different if they're passively scraping it from a third-party without your knowledge & consent.
That's... not how it works for any human being. The whole point of a conversation is that you can engage in it while it's happening. You make a point in the middle when it's relevant, and someone replies with something else they feel is relevant. When you've already had a 30+-minute conversation over lunch, no human is going to remember it and copy to Slack, no remote worker is going to go through and respond point-by-point as if they'd been there in person, and no human who has already invested that time and energy in the conversation is going to re-start the conversation at every juncture just to explore alternative directions it could've gone in person.

What actually happens in the best case is you give a few sentences of summary if you believe it might impact your coworkers' work, and then schedule a meeting if there's more to discuss. Which (ignoring the fact that even the best people don't always do this) is great, except you could be entirely wrong about whether there was anything beneficial for any coworker to hear. That junior engineer on the team might've been able to overhear how you fixed a problem that was second-nature to you, but now they don't. That dude who just returned to work might've been able to tell you they were interested in picking up the work you were overloaded with, but now they don't. That team lead on the adjacent team you would've grabbed during lunch with might've told you they were planning to handle the larger problem next quarter, but now they don't. etc...
I fully agree with a lot of that. It's the modern Deluxe Paint in a lot of ways.

I've had web developers hear "paint.net" and think Microsoft Paint (maybe the ".net" makes them think Microsoft), and why am I using something so basic?

> insane amount of people who buy an expensive DSLR

I'm not with you at all on that one. DSLR sales have plummeted every year for the last decade. "Normies", as you put it, think their smartphone camera is a high-end camera and all they could possibly ever need for taking top-quality photographs. The appalling noise their tiny sensors produce seems to have become so normalised, they don't even notice.
Crane Linked to CIA Soviet Sub Mission Now on Station at Key Bridge Collapse
Good that no person was shot. Bad that this will bolster US police use of robots. Who knows what will happen down that road.
Easy-to-use make-me-root exploit lands for recent Linux kernels. Get patching
Lots of discussion here: https://news.ycombinator.com/item?id=33987578
The pre condition seems to be getting bought out by a patron Billionaire (Laurene Powell Jobs).
The only problem that WebGPU itself (as a desktop API) is outright horrible. For someone coming from OpenGL - with all its warts - the sheer bloat and confusion coming from there is a downgrade. Just see the whole fiasco around WGSL - a shading language which is kind of like SPIR-V but also not really because it's theoretically human-writable, the syntax is worse than anything the C++ committee could dream up, etc....

I don't think there is any good replacement for OpenGL as of now (2024). I hoped there would be higher-level Vulkan wrappers coming out to bridge the gap but even AMD's attempt (V-EZ) got abandoned fairly soon.
Nvidia's newborn ChatRTX bot patched for security bugs
If you do want to add evaluation of mathematical expressions you should check out Math.js since they provide a parser among other utilities. Please make it optional though, it would be a nightmare to debug if everything was written in strings.

https://mathjs.org/docs/expressions/parsing.html
One of my favorite short stories plays on the natural horror of this realization: https://www.teamten.com/lawrence/writings/coding-machines/
Decentralized version control systems were popular before Github and even Git. Github didn't create a market, it captured it.
Well, yes. And I chose to exercise that right.

The point of the anecdote is to supplement the parent poster by stating that their hypothetical scenarios are already happening.

We should have better testing and more eyes on incoming code for projects we depend on. But my point I guess is that vetting maintainers is not an option.
> you do need to explicitly make effort outside of work to fill that gap

On the one hand, I don’t disagree. On the other, I think this is something that is easy to say, and really hard to implement in practice.

The workplace has been a critical part of the social fabric for a very long time. And the opportunities for finding social connection outside of work are very unevenly distributed, and for the tech industry in particular, we tend to be less likely to have the personalities/skills to create a healthy social life on our own.

Does this need to change? Yeah, probably. I know I’ve personally had to work hard to cultivate social connections. But we should not underestimate the impact of just removing one of the largest social building blocks wholesale. Even if people can adjust, that doesn’t happen magically/automatically.

> There's nothing stopping you from doing that outside of work

There are many things that stop people. If you work a stressful job and/or have kids, your energy may be gone. If you’re a socially anxious person, your anxiety tells you it’s better to stay home. If you live in an area that doesn’t provide many social opportunities, you have that to contend with.

The reality is that society has been trending towards more and more isolation, and while I agree that we can each individually try to do something about that, I don’t think we should underestimate the challenge or assume that it’s just as easy as being “more mindful”.

Some of these issues are systemic, and in the same way you can’t tell a depressed person to just “look on the bright side”, we need to be discussing the deeper issues that are exacerbated by fully remote environments. I’m not saying blind RTO mandates are the solution either, but neither should we discount the challenge people face as the social fabric goes through these massive changes.
Oh, I thought you were going for an Alabama joke with people marrying their in-laws and becoming their own grandfather, not time travel.
True, and all of their MSRPs are easily comparable to Apple’s similarly-specked hardware.
Federated Identity and SSI – YMMV
Arrgggh. The story is about how the data took too much to uncover with the redesign. Then the very first recommendation is "first, reduce data volume." No! No! No! And stop reducing data density, too! Just because something has a higher learning curve doesn't make it bad.

Dense data lets a skilled user understand more in a glance. Data density is GOOD if you are building something that is meant to be used more than an hour every single day.

Now, if you are building a consumer app where nobody wants to do the chore and you're making it easier, THEN data density is bad.
That's an "interesting" thought.

One of my complaints about so many SciFi stories is the use of seemingly conventional weapons. I always thought that with so much advanced technology that weapons would be much more sophisticated. However if the next "great war" is won not by the side with the most destructive weapons but by the side with the best kill switch, subsequent conflicts might be fought with weapons that did not rely on any kind of computer assistance.

This is eerily similar to Einstein's (purported) statement that if World War III was fought with nuclear weapons, World War IV would be fought with sticks and stones. Similar, but for entirely different reasons.

I'm trying to understand why the characters in Dune fought with swords, pikes and knives.
Metalhead
Nope, there are no goroutines without go something, other than runtime stuff like the GC.
Recently I’ve been using Photopea and it has been excellent. Web based and very full featured
There's also the quick filter as a third method.
Do you have any pointers for learning more about this space? I've personally been pretty skeptical of sponsored products on YouTube, though I find myself getting tempted to / actually trying them out anyway, but haven't thought too hard about small Redditors or Tiktokers getting paid to shill products.

Curious what companies do this / how companies are going about conducting these unpublicized marketing campaigns?
Interresting, but that analogy implies that there is a force that limits the exxpansion and a force that causes it to contract. I'm not sure that's what happens to this universe, and I'm not sure we can know.
It's not just manage Postgres, it's manage a Citus cluster - (unmanaged Postgres + postgres experts + time for them to implement their stuff) just gets us to parity with RDS but doesn't solve our sharding problem. We asked our Postgres consultants & networks to see if we could find Citus experts we could bring on full-time but didn't have great success. Most of the experts we talked to suggested application level sharding, and it seems like it worked out okay.
We haven't had a good president in my lifetime. (40+ years)

My original post isn't a condemnation of a party, it's a condemnation of both parties working together to line their pockets while the ship sinks.
Smalltalk and coffee breaks can be exhausting for introverts. Some people prefer to concentrate for long on a single task, too.

And for what concerns the time spent working, well, being in an office means nothing as there are plenty of ways to lose time and screw around.

What about we stop treating workers as children that need constant supervision and size them by the quality of their work.

As you grow up, it becomes clear that no size fits all.
When all this is over and Collin is in the right state of mind, I'd appreciate if they could shed some light on the social engineering side of this exploit. i.e. the process by which the intruder introduced themselves, gained and exploited their trust, any warning signs or red flags, etc.

Their experience could make for a valuable lesson and prevent future occurrences.
Yeah that’s equally short.
Rocky Mountain Power Looking at Carbon Capture at Gillette, Glenrock Coal Plants
> OpenAI is mostly concerned with developing proofs of the untrustability of every digital medium, creating a convincing case either for doing everything in person again, or necessitating cryptographic signatures on absolutely everything.

Am I alone in thinking that this would not be a bad thing?
Wouldn't this incentivize companies to just hide emissions like this, then cry "it is not new" when eventually found out?
Work remotely in a city for which the cost of living is low.
First, Understand the Company Goals (2020)
If committing configure is objectionable, perhaps there could be "service" repositories that are not directly writable and are guaranteed to be nothing more than the base repo + autoconf cruft used to generate the releases.
> So I learned that hard work and long hours does not guarantee success. Raw energy and great ideas spark the public interest better than attention to “quality.”

This defnly resonates for software as well.
Impressive work and truly necessary! Thanks for sharing.
Fully countering trusting trust through diverse double-compiling (2005)
In hub motors might be another automotive example of this. They were used by Ferdinand Porsche and invented in 1896. Ever since engineers keep trying them out as a simple elegant solution. Eventually they will break through I think, but there’s the same allure in the simplicity of it all.
Yes obviously, but the NYT has also 1700 employees, The Atlantic less than 500.
I think it acquired that icky film around the time it started bundling malware with official downloads, there's another comment going more into that.

But prior to that, I don't remember it feeling scammy at all, it was just the place to go for software. After that, the very same look and feel had been tainted, and now felt like a trap. Still does.
That's why you write some position papers and then get people on a zoom call with that specific topic when you need to talk it out. No ambling daily standups or weekly standing "progress update" meetings - use focused meetings with a specific topic.

This is how many successful engineering and knowledge organizations through the years have functioned (s/zoom call/meeting/).
My theory is that having loads of money gives companies the leeway to simply not care about losing top performers. After all their bank account allows them to get other top performers.

Obviously there are more nuances to this topic.
I fear it's not long until police use deadly force to protect a robot dog from a criminal.

In theory, police shouldn't be able to use deadly force to protect the life of a (biological) police dog, but they regularly do, and the courts accept it. The argument given and accepted in court is like this; whilst a dog is not entitled to the same protections as a human, the suspect attacking the dog caused me to fear for my life and that of others.

You could give the same argument about a robot dog.
This is so vile that even if caught red-handed during PR one could shrug off "oh, my IDE's auto formatting did this".
DeWitt and Stonebraker's "MapReduce: A major step backwards" (2009)
Yea, that aspect is kinda scary. But hey, at least it's not in the hands of Google.
Because most SPAs that I interact with (like ESPN) have no business being SPAs (in the sense of hijacking navigation). The main motivation behind constructing them that way seems to be to circumvent UX safeguards.
Yes, Optane isn't produced anymore
I am not sure how it compares to recent versions of Paint.NET, but on my Apple desktop computer, I like to use Aseprite [0] (which is also not free). At the very least, Aseprite seems to have more features compared to the Paint.NET version that came with my Windows 10 installation (I think).

It's more of a graphic program for game design, but still very good in my opinion. And multiplatform, so usable on Windows and Linux as well.

---

[0]: https://www.aseprite.org/
The New England Journal of Medicine Illustrated Glossary
Certainly not what any of the involved parties are doing
…and:

> A core part of Thompson’s strategy was to figure out how much readers would be willing to pay for a subscription. He ended up raising subscription prices by more than 50%, and made it harder for people to read stories without paying
How did you learn to be a mechanic?

As an industry, it’s important to teach new generations.

A senior engineer with good self discipline can work from home.

A great engineer will elevate their team and thus be more valuable than working alone. And this process helps juniors grow.

You could learn to be a mechanic from books and then have a service that matches people with car problems with mechanics at home. Why do you need a work site?
I’m not quite following what the diff here is suggesting - was this some cmake magic to detect if a feature was enabled, but the file had an intentional syntax error?
> systemd's call to dlopen() liblzma library (CVE-2024-3094)

That's technically wrong, but no surprise. Anti-systemd trolls usually don't understand technical details after all.
How do we know this is real Lasse Collin and not the same person behind Jia Tan persona, who now tries to deescalate and make it look like original maintainer is back in charge?
1 in every 13 bridges in America is in 'poor' condition
Interesting. Focus on the quality of the product and more people will want it and pay more for it. Someone should put this case study into a four sentence LinkedIn post so more startup CEOs will want to do it.
That's a really good point. I think in our current iteration of the system, if we applied it to subreddits focused specifically on a particular brand, it would not be able to account for the bias there, even if it knows which subreddit the content is from. That's probably too much to ask of the LLM.

We'll have to think about good ways to handle this. Curious about your or others thoughts on these subreddits, how do you process content on these subreddits differently?
Engaging with Developers on Hacker News with Dan Moore [video]
The gist of it is: The "good" one is the auto generated "Source code" releases made by github. The "bad" one is a manually generated and uploaded source code release, which can have whatever you want.
Send a HEAD request. If the file size is over the threshold, don't load it without user consent.
I'd agree with Gimp - it's UI makes several departures from other similar software.

But Inkscape's UI seems pretty intuitive?
IIRC when Google Code was announced to be closing, the Microsoft equivalent (CodePlex) was the next location a lot of projects moved to. It had a decent UI and supported Mercurial in addition to Git.

When MS also announced they were closing that and offering a tool to migrate to GitHub, was when GitHub (and Git) truly became the biggest remaining option.

The other aspect of SourceForge's decline was that they doubled down on the sketchy site feeling right as acceptance of such sites was on the decline, the likes of mediafire, zippyshare etc were being replaced with cloud storage providers and download aggregators were losing popularity (in part due to also becoming very sketchy and prone to pushing malware). They might've been able to get away with it a few years earlier. I remember that back then it wasn't a huge deal to follow a mediafire download link from somewhere that seemed reliable enough, whereas nowadays it'd be an immediate red flag due to the abundance of more legitimate seeming file sharing options.
Few years ago I used this script and the r.pi is still running fine. https://gitlab.com/larsfp/rpi-readonly
Yeah, if anything, python worsens the situation.
I had a friend DOS our server because he accidentally inserted a tab, causing the illusion that one statement was inside a block but was actually outside it.
He swore off python at that point.
I personally avoid the language, but I understand due to issues like that these days mixing tabs and spaces is an error (or is it just a warning?) by default. Regardless, still pretty silly to me to have whitespace play such a major significant role, besides the fact that I find it visually harder to read, like text without punctuation or capitalisation.
Postgres is an open-source platform with a thriving ecosystem. People have written a vector plugin to follow the AI boom, and will likely have whatever people have an interest for.
> Oversize your card so that the card can properly perform wear-levelling

I think this is half of the problem: SDHC does not require wear-leveling at all, I am unsure of SDXC. But regardless, the wear-levelling algorithm the SD card firmware does is completely invisible, from some vendors it might do a decent job, from some it might be a no-op, we have no way to tell.

The only way to know you're getting wear-levelling is to do it at an OS level, e.g. UBIFS stacked on MTD emulation - but there's a bunch of assumptions there which make it unsuitable for SD cards.
Its always amazing to me how, even on a site inhabited almost exclusively by people that make a living writing software, people get so offended by the idea of paying for software. As long as software does not have lock-in and is offered for a reasonable price, I'm very happy to pay someone for their time and ingenuity.
I don't object to removal itself, and I don't find it too appropriate, I just have problems with post-hoc rationalization that comes attached to it. "Images of attractive woman offends other women" shouldn't even be a politically safe statement to make. That'll be one hell of a hallucination if an LLM said it.
And if you must make it less data dense because you're selling to a dense-headed exec and not the actual user (the usual with enterprise software), then just provide an easy to access user-preference toggle (and let the preference be saved). You can demo the "sleek" interface to the exec and the user can actually get their job done efficiently. You'll make the initial sale AND the resale when it comes time to renew.