skysight-inc/HackerNews huggingface dataset:
> When you hit memory limits, .NETs GC implementation would perform much more frequent, invasive and aggressive collections, including LOH compaction to reduce memory watermark which leads to greater GC pauses, though this is rarely seen in such a bad way on modern versions with e.g. SRV GC.

The trouble with server GC mode is that then there is no natural back pressure. If the processing is not CPU bound, then memory allocation can grow unbounded. This is not something that happens with RC as, again, the GC performance hit is inlined with task processing. The service may not be capable of as much throughput, but it doesn’t take out the entire server either.

> The most scaling way to address this is usually to just allocate less and use valuetasks with pooling where applicable (frequent asynchronous yields), I'm certain if you built a .NET 8 based solution you would see user-written code dominate heap allocations profile, as most hot internal paths of async utilize said state machine box pooling+ValueTask<T>[0] and may be entirely allocation-free.

Absolutely; I think it’s relatively simple to write servers that scale using modern .net; the memory allocation foot-guns when dealing with asynchronous code are now well understood, and tooling is good. I am compressing ~15 years of experiences in that previous post.

It’s probably the case that a tracing GC is the better choice for most modern applications, excepting memory constrained devices (like phones), and so long as you design with memory in mind.
This is amazing! Thank you for sharing it.
I see, a true bias against the gambler, along with the odds.
Tan is a common Chinese surname that's the Hokkien/Teochew transliteration of Chen. It's more commonly seen in overseas Chinese but I wouldn't jump to any conclusions
Funnily enough, even if they don't call it explicitly, some of the highest paying professions in the world - consulting, finance, law, medicine - all have pseudo-unionized structures in place. The only difference being uniformity in pay, which is a feature I've mostly seen only in US unions.
From a userspace/user perspective, honestly not that much will be different.

The package management is different from apt/rpm but there are plenty of distros with pkgsrc type systems.

Most FOSS software is available and provided, for some Linux only stuff there is linux emulation.

Less support for drivers and new features.

Really IMO it comes down to kernel features and development, and given Linux kernel security attitudes *BSD can be pretty tempting sometimes.
IQ as commonly indicated includes an age adjustment, so in this case their IQs would be similar before adjustment. They would be cooperating with each other usually, not competing.
Did anyone search github yet for similar head | tail tricks ? I doubt it was invented just for this.
Presumably they wash though, probably after getting out of bed.
Horrifyingly clever.
I am not a supplier (2022)
It seems a lot of vocal older folks will use this as evidence of an inferior future. I believe instead that this is probably moreso evidence that the systems in power that spread music have only grown more efficient both in creating profit as well putting out homogeneous simple music.
The implication here is that this is a bad thing (although OP doesn't say that). I'm not sure I think the same. If AI can be used to automate the more tedious parts of writing, that's fine with me.

For me, as long as the paper has been confirmed by the authors as being correct, what is the matter house those words were formed?
Surely this is something the FBI should be involved with? Or some authority?
Nope it's not. They can get paid a wage from gov and charge nothing. Private Healthcare in its entirety is unethical. Shouldnt exist. Full stop.
Interesting to think of this as an analog to refinement culture, where instead of endless elaboration and adding complexity, they are stripping away all unnecessary elements to discover the platonic ideal of marketable music.
Christ I am old
If you’re building the scenery to custom specifications, why not just put the scenery in front of the thing you’re trying to hide?

It also doesn’t work off angle, won’t look good when dirty, will weather poorly, and so on.

It’s not a realistic solution for hiding things outdoors long term. It’s a party trick.
I can understand the thrust of this, but the problem in xz backdoor was not a product of move fast and break things.. it was a product of the implied web of trust in OSS, wasn't it?

https://xkcd.com/2347/

https://news.ycombinator.com/item?id=39874942
Its been all of 24 hours, these things take time. Presumably someone doing an attack this audacious took steps to cover their tracks and is using a fake name.
This is what I do. I take a corner of the inner and stuff it into the outer until I find the corner of the outer. Then I try to keep those two corners in place while I do the same with the other corner. Then I grab both corners from the outside and do a lot of vigourous shaking until everything lines up. It takes ages and doesn't always work. I think I will try starting inside out from now on.
Wikipedia readers see broken pages due to disabled graph extension
do it. you can use them all for basic synth building too. sequencers and square waves are stupidly easy to build
I think you are applying Goodhearts law both too broadly and not broadly enough at the same time. IMO there is no way being away from the law with it without money being involved. It equally applies in any bureaucratic system where goals get set and achieving them gives you power or any other benefit. If humans are to take action together over a prolonged time the law is gonna get in your way. The best way to mitigate this is to avoid proxy-metrics and measure accomplishing the actual goal.

Another issue is that as someone smarter than me said who was quoted by Russ Roberts on econtalk: You are not allowed to ask for better people. The right system must make the wrong people do the right thing.

To come back to our concrete subject at hand: Don't penalize the penal institution for reoffense, but reward them if former inmates stay out of jail. I'd make the ongoing pay for inmates being in jail just low enough to not be profitable with performance bonuses set at several intervals after the inmates were released and didn't mess up again. This somewhat opens the door for releasing inmates early. I'd need to contemplate and discuss with experts on how early released currently gets decided on to come up with a good way to address this, but it seems like there are several good-sounding options. This even might be a non-issue if the increased likelihood of a future bonus outweighs the cost of the inmate staying longer in prison.
The OS only knows it can free memory when your process exits (same as file handles and other resources.) If your process is designed to exit once it's done its job, you can use the OS as a garbage collector.

Having an operating system know when memory is unused within your running program is not something that has ever existed though (except for perhaps some esoteric research OS's.) I wouldn't say we're missing an opportunity, because the thing we're missing doesn't exist in any meaningful sense. On the other hand, a programming methodology that uses very simple, short-lived programs is a totally legitimate way to do things... it's how CLI tools and the scripting languages that script them work, it's how web servers used to work (with CGI/etc), and it's a perfectly reasonable approach even today.
A lot of classic popular songs also had low information content:

https://happyhollyproject.com/2014/04/27/flowcharts-and-song...
I do not know why I read Golang issue threads. I always get angry at the we-know-better attitude. With just a dash of, "Well, that's not how Google does it. Why don't you just do better internally?"
Yes, R600 even more so, there are some very expensive exotic refrigerants that are not, but they literally didn’t exist pre 90s.
Which was sneakily introduced here: https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2...
It's a tradeoff to be managed depending on the application rather than a problem.
> Wouldn't be better for people to simply eat better?

Has a half-century of telling people to "simply eat better" worked?
Hardware and software is licensed under CC BY-SA 4.0 Attribution-ShareAlike 4.0 International.

It's mentioned in our build instructions but we can probably make it more clear in the terms and conditions.

So yes you can take our existing design and launch a competing product as long as you keep it under the same license.
Essential Craftsman

He teaches you how to build entire houses... and in general how to be a great Father/man.

I was an electrician for a few decades or so, and this fella'is legit.
GenAI Detection Tools, Adversarial Techniques and Implications in Higher Ed
That's pretty interesting. Do you have any more info about how you did that or how you found it or how much something like that costs? Was it just a sustainability donation kind of thing, or do you intend to (or can you) live there or visit?

We donate to a Shirley Heinz Land Trust which buys up decrepit lots around where we live in Gary, IN and around there, and restores them into preserves. But it's nothing on the scale of what you bought, it sounds like.
Ah, but we've just begun stacking transistors in the third dimension.
I think behavioral analysis could be promising. There's a lot of weird stuff this code does on startup that any reasonable Debian package on the average install should not be doing in a million years.

Games and proprietary software will sometimes ship with DRM protection layers that do insane things in the name of obfuscation, making it hard to distinguish from malware.

But (with only a couple exceptions) there's no reason for a binary or library in a Debian package to ever try to write the PLT outside of the normal mechanism, to try to overwrite symbols in other modules, to add LD audit hooks on startup, to try to resolve things manually by walking ELF structures, to do anti-debug tricks, or just to have any kind of obfuscation or packing that free software packaged for a distro is not supposed to have.

Some of these may be (much) more difficult to detect than others, some might not be realistic. But there are several plausible different ways a scanner could have detected something weird going on in memory during ssh startup.

No one wants a Linux antivirus. But I think everyone would benefit from throwing all the behavioral analysis we can come up with at new Debian package uploads. We're very lucky someone noticed this one, we may not have the same luck next time.
Wait… you don’t use a sheet under a duvet? What do you wrap under yourself? Not the duvet, that’d be too thick, surely.
Why Does Interstate 70 End in Cove Fort, Utah?
I've been trying out alternative versions of this that pass images through to e.g. the Claude 3 vision models, but they're harder to share with people because they need an API key!
Textbook Regulatory Capture – FTC's Rules on Lab-Grown Diamonds
Would that help? sshd, by design, opens shells. the backdoor payload was basically to open a shell. that is, the very thing that sshd has to do.

The pledge/unvail system is pretty great, but my understanding is that it do not do anything that the linux equivalent interfaces(seccomp i think) cannot do. It is just a simplified/saner interface to the same problem of "how can a program notify the kernel what it's scope is?" The main advantage to pledge/unveil bring to the table is that they are easy to use and cannot be turned off, optional security isn't.
I am a former MS employee, I used to read the compatibility patches when I was bored at the office.

Anyway, liblzma does not "need" to outperform any "competition". If someone wants to work on some performance optimization, it's completely fair to fork. Look at how many performance oriented forks there are of libjpeg. The vanilla libjpeg still works.
Yes, here they ignore gambling wins/losses = no tax or writeoff aspects. They do treat foreign sports books etc differently, US/Canada has a tax treaty where sports wins are share-taxed = Canada gets part and US a part, not sure of how it ramifies = never won any of them. They might also share these big US ones?
This one is interesting -

> Devon: Fred made a whole set of structs containing raw untyped pointers so he could reinvent polymorphism in C, because he "doesn't like C++".

The refrain is "Autotools.Must.Die", but somehow the complexities of C++ don't come into focus. That is, I pause when I think about a large project written in C++. Yes, it's a bad idea to reinvent polymorphism in C, but C++...
In case you wanted to add a pre-processing step, I found this ImageMagick script useful: https://www.fmwconcepts.com/imagemagick/textcleaner/index.ph...

Not sure how difficult it is to run it in the browser, though.
Toward AI-Driven Discovery of Electroceuticals – Dr. Michael Levin [video]
>> My opinions might be less sour if I had more experience with compacting GCs

I have quite a bit of experience with the GC in .NET. For projects that deal with large data structures, the GC is something that you are always thinking about though it's behavior is conceptually transparent. I think I would ultimately prefer a more explicit approach.
Did your use case violate 1,2,3,4?
It is as apparently almost everything else a choice between 2 options.

The current Western approach to science is strictly that subjective measure is fully informative of objective reality, and (equally if not more importantly) that perception is a mechanism operating within objective reality, an object within reality, and that object is subject to natural laws.

The other possibility -- there is really no way to refute or prove either definitively as in all of these dual ontological choices -- is that consciousness is peering into a construct of a universal conscious intellect (something like logos or tao) and the nature of conscious intellect is entirely unlike the nature of the construct, which is an image. This flavor of paradigm offers the possibility for "consciousness" (aka God) to claim omniscient powers, including time dilation (alpha omega) and other matter.

What helps these models to persist are entirely distinct. The former maps well to shared experiences (modulo group psi phenomena) and is reassuringly direct and simple. The latter persists since it maps well to non-rational content of our minds which the former simply must dismiss as garbage collection or (LLM like) ramblings, void of meaning.

Physics can't be incorrect but it can be misinterpreted. Last century witnessed a wonderful case in point where Quantum physics provided analytical tools to "perfectly predict" outcomes of experiments but until eventually settled allowed physicists to have preferences (read: belief systems) regarding which interpretation of the quantum phenomena (Einstein or Bohr) was correct.

That Bohr's interpretation proved to be the correct interpretation has bearing on this discussion in more than one sense.
sure. what makes you think they aren't?
I've done this before where we ran a schema per customer and it was fabulous. Once the customer was large enough we could justify allocating a separate DB for them. The application was written in such a way that it knew which data store to query based on the user.
Vicious Circle
New York Will Test Gun-Detecting Technology in Subway System, Mayor Says
You can imagine a door that opens if you knock on it just right. For anyone without the secret knock, it appears and functions as a wall. Without the secret knock, there might not even be a way to prove it opens at all.

This is sort of the situation here. xz tries to decode some data before it does anything shady; since it is asymmetric; it can do the decryption without providing the secret encryption key (it has the public counterpart).

The exploit code may never be available, because it is not practical to find the secret key, and it doesn't do anything obviously different if the payload doesn't decrypt successfully. The only way to produce the exploit code would be if the secret key is found somehow; and the only real way for that to happen would be for the people who developed the backdoor to leak it.
https://archive.ph/xwCuk
Welcome to Internet and Technology Addicts Anonymous
The recent photo viewer is great. I never felt the need to install Irfan anymore just to view photos since .. a long time now.

I mean why would I? If all I need is viewing a couple of photos every now and then, cropping and rotating one or two and drawing some circles on them to highlight something in a screenshot and Windows already does that then why bother with Irfan other than habit and nostalgia.
Its possible the adversary was behind or at least encouraged the dog piling who berated him. Probably a normal basic tactic from a funded evil team playbook.

Might be worth reviewing those who berated him to see if they resolve to real people, to see how deep this operation goes.
There's some pattern of creating those sorts of environments.

Maybe it's the opposite, a community like reddit if You're banned or maybe shamed or even down voted for an ignorant take, not even a bad faith argument, maybe that user stays on Reddit but joins a different subreddit that new subreddit may be more likely to indulge in that viewpoint, maybe even sarcastically.

While on small websites I think a user in that case might just be dissuaded from engaging in the community outright.

I don't believe gamergate to be a special thing, just oxygen, fuel, and a spark.
So what’s the risk of spa rooms?
git.tukaani.org runs sshd. If that sshd was upgraded with the xz backdoor, we cannot exclude that the host was compromised as it could be have been a obvious target for the backdoor author.
Paisley pattern. Oh, somebody beat me to it.
TIL Aztecs used no fat in their cooking [video]
Reddit scholars agree

https://www.reddit.com/r/AskHistorians/comments/mielqr/aztec...
https://archive.is/id95X
A handy trick I've developed is using`git bisect` to solve otherwise intractable rebase conflicts:

https://codeconstruct.com.au/docs/bisect-intractable-rebase-...
Why did they decide to create a backdoor, instead of using a zeroday like everyone else?

Why did they implement a fully-featured backdoor and attempted to hide the way it is deployed, instead of deploying something innocent-looking that might as well be a bug if detected?

These must have been conscious decisions. The reasons might provide a hint what the goals might have been.
That's the most interesting part. No, we don't know it yet. The backdoor is so sophisticated that none of us can fully understand it. It is not a “usual” security bug.
If "more efficient" means fewer, tighter oligopolies, then you and the "vocal older folks" may both be right.
Hawaii is not covered by the NATO treaty. Some experts say that needs to change
This is a skill that is passed down to us through "inheritance"
I do that with my kid. For funsies. Also high in the list: snake bites foot (to put on his tights).
> according to an analysis of more than 350,000 top 40 hits

Wow, that's a lot of "top 40 hits". More than 134 new "hits" per week for the last 50 years! Are these really all "popular" songs? Because that number seems like the analysis must cut well into the long tail too.
This is what I do. I don't actually roll the duvet up, just do a rough concertina fold
Exact same video where I first saw this. I love the audio.
I would invest in it
No. But this will provide more data that it won’t.
I can think of lots of reasons. My double bed is in the corner of a small room so I only have access to one side of it. Lifting the mattress to put on a fitted sheet is very awkward and pretty strenuous. This also means that there isn't much room for laying out both a duvet and duvet cover. Typically I lay them both on the bed at the same time because I don't want either to touch the floor which makes inserting the duvet into the cover even more awkward. Next is the fact that a double sized duvet is almost but not quite square. It's quite easy to grab a corner of the duvet and match it with the wrong corner of the cover. Lastly, I only do this about once a week not 10 times a day so I haven't had a need to find a better method so far.
> I still haven't heard anyone say what not having containers could win you. What types of code can you only write without containers?

Code with one less layer of abstraction. If that layer is buying you something you need, it's great. But abstraction isn't a positive in & of itself, it's why we get upset about GenericAbstractFactoryBeanSingleton(s).
> I have them in my 2020 Audi and don't use them because other drivers flash at me and I understand precisely why.

That's too bad, because smart lights are being touted as the solution to this blinding LED light disaster in the US.

The US also has a problem of SUVs and pickup trucks that aim their blinding LED headlights right at your head or rear-view mirror if you are unlucky enough to be in a lower vehicle.
I mean that is still social engineering, it is just really long-game social engineering.

And IDK that we've entirely ruled out that Jia Tan didn't wind up being blackmailed or coerced or something -- although if they were really running sockpuppets to get themselves added to the project up front that is probably less likely.
SpaceX's Gwynne Shotwell on the future of space travel [video]
I'm curious what you think the latencies of 50,000 distributed transactions becoming a consistent chain add up to?
IPv6 is important but step one is to remove the AAAA records.
My point though is that by moving memory management into "don't care" territory while still, obviously, requiring explicit handling of other resources, it's easier to forget or miss when you need to explicitly handle something.

When instantiating objects in C# say I need to check the documentation or the source code to see if it implements IDisposable to know if I need to handle it. Lets say that for a given class X in library Y, it does not. So I don't worry, I just instantiate and don't do anything about the cleanup because GC will handle it.

Later, the implementation of X changes and IDisposable is added to it. I now have to change my code, and not doing so could lead to serious production issues. Yet the compiler happily compiles my code without any warning.

Sure some static analyzers might catch it, but they're not perfect, and you need to run them. A stock Visual Studio 2022 will not complain about the above scenario for example.

In my experience it's much less error prone to unify memory and external resource management. If instead I had been using a different language which has a more uniform resource handling, the above change in class X would likely not have been a big deal.

Also, my code will already be written with resource handling in mind. It can be non-trivial having to change a hierarchy of classes just because a dependency deep down suddenly had IDisposable added to it.

I guess what I'm trying to say is that I think just focusing on memory management, that is to GC or not to GC, is having a myopic view things. I feel it's like arguing what kind of pickle to have on your burger without considering the other ingredients. Sure, the pickle is a crucial ingredient, but there's a lot more to it.
Yes we know, you can gleefully brag about the mass layoffs of fast food workers soon. Please post here when it happens.
The argument is that various steps in the backdoor relied on hacks and tech debt in autotools that are taken as arcane but normal, like detecting whether certain dependencies exist by trying to compile snippets of code. Instead of, you know, just having build systems, dependency management, and such.
That one! Thank you. Nostalgia hit hard.