skysight-inc/HackerNews huggingface dataset:
Containers can be a crutch for poor software maintenance, oh sure! Lots and lots of companies skate by with shoddy container infrastructure (often to relatively little ill impact imo). But I don't see much opportunity that is opened up by getting away from containers. One can do "highly integrated engineering that produces diagonal scalability" just as easily on containers as not, in my view. Containers don't inhibit much.

WhatsApp remains the glorious one example of ultra-efficient software. Way to go taking ejabberd+erlang and going far!! But does that path exclude Kubernetes? I doubt it. That architecture would have ran fine as containers or+and on Kubernetes. It wouldn't have made a material difference to what they were doing. It just would have been a different way to manage the underlying platform. Who knows, maybe it would have provided some patterns/templates/apiserver-ing that the team would have found useful to develop atop, to build forward on, that they instead had to build themselves?
I don’t think that’s true. If a program A is a derived work of B, and B is GPL, I don’t think you are allowed to license A as MIT. It’s legally the same as if you’d taken code from B and altered it; you aren’t allowed to license that under MIT, either.

The many examples of MIT/BSD linked to GPL code are, I believe, cases of either:

1. The GPL code using the GNU C library exception, like the GNU C library. Or libraries licensed using the LGPL. Any MIT/BSD code is allowed to link with that, because the exception in the licence explicitly permits it.

2. The link is done at “arm’s length”; i.e. the MIT/BSD is not actually requiring the GPL code, and so is not considered a derived work.

or possibly

3. The GPL code is the code which links to the MIT/BSD code, which is obviously allowed, as the whole thing is then distributable under the GPL.

Do you have any examples where none of these are the case?

For futher information, I suggest reading the GPL FAQ: <https://www.gnu.org/licenses/gpl-faq.html>
Oh "4.5M x" not "4.5 ms" faster.
Gemini is very smart but it fundamentally can't be trusted on any non-technical topics. I talked to it about Taiwan. Gemini gave intelligent reasoning and analysis. But what a coincidence... all of its analysis was perfectly in line with US foreign policy! How unexpected!
long co2
Arch Linux switched switched from xz to zstd, with neglectable increase in size (<1%) but massive speedup on decompression. This is exactly the use case of many people downloading ($$$) and decompressing. It is the software distribution case. Other distributions are following that lead.

You should use ultra settings and >=19 as the compression level. E.g. arch used 20 and higher compression levels do exist, but they were already at a <1% increase.

It does beat xz for these tasks. It's just not the default settings as those are indeed optimized for the lzo to gzip/bzip2 range.
And of course an attacker like this has a high likelihood of being a state actor, comfortably secure in their native jurisdiction.
Vegans don't eat mackerel, but can they ethically use mackerel as currency?

The mind boggles.
My other post makes my actual point, this is just for fun.

Imagine I own a setup that allows me to produce counterfeit stamps. Every fifteen minutes I make 99 and then place them for sale. I sell them, then make 99 new counterfeit stamps and repeat the process.

All the risk is offloaded to anyone that buys more than 99 stamps, while the person capable of making them is safe barring some sort of mistake. All their money comes from a legal sale, meaning they're under no obligation to make sure their customer isn't reselling the stamps. So if the middle men gets arrested, the operation can continue immediately.

Yes, I can think of issues too, like eventually they stake out your location (though they'd probably need warrants of some sort.) I still think it shows that allowing someone to counterfeit 99 stamps opens loopholes the current law stops.

Oh, and from your other post, there are $9 and $30 stamps, meaning this method could counterfeit over $10,000 an hour.
Apparently, many.

It looks like gettext may be containing a part of their attack infrastructure.

https://github.com/microsoft/vcpkg/pull/37199#pullrequestrev...

https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16...

https://github.com/MonicaLiu0311
Mullvad VPN iOS app successfully blocks the ads on that page (they appear as empty white space).
Can We Get Kids Off Smartphones?
They have been a thing for decades

https://ieeexplore.ieee.org/abstract/document/363432
Assume 3% of the population is malicious.

Enough to be cautious, enough to think about how to catch bad actors, not so much as to close yourself off and become a paranoid hermit.
the incredibly adversarial tone of this comment, combined with the myriad studies correlating toxoplasmosis with aggression and poor decision-making in humans doesn't exactly help your case, does it?

go and shout at someone else
By "well financed" you mean "owned by Microsoft"?

That situation raises a separate set of concerns, especially in the context of Microsoft's main database cash cow being SQL Server, not Postgres/Citus.
Data research to Russia's misinformation website network
This backdoor targeted only sshd.

There could be other backdoors for other targets.
This is worth giving a shot.
From the Julia side, Common Lisp [0] feels like writing Julia. Both the code itself and the development experience.

[0] https://youtu.be/y5Rn41fPIuQ
Technically it may all be possible using homomorphic encryption--it's not however practical.
The Guix full source bootstrap is looking less paranoid as time goes on
It’s a shame these former voices don’t band together more often and just try and run a cheap to host site covering the same local topics. You don’t need to sustain the overhead to print and circulate or even rent an office anymore. I’d pay for that, I’m sure I’m not the only one either.
For many 'standard' driving patterns (relatively 'flat' urban commutes with approx balanced medium length up and down grades) there are lightweight optimal solutions for EV's that can minimise both battery pack size (and weight) and the need to draw on a small rotary engine for recharge.

The UK's drone engines come in light and small with models that range from 5 BHP to 120 BHP with 40 BHP being suitable for broad swathe of "typical" driving.

https://www.aieuk.com/wankel-rotary-uav-engines/
Dont be a spammer. Problem solved.
How to create random graph where each node has at least 1 edge using NetworkX
Posted earlier today [0] (39 points, 6 hours ago, 38 comments)

[0]: https://news.ycombinator.com/item?id=39866748
If you work remotely, a good cure for boredom is working 2+ jobs with minimal responsibilities or expectations. Spinning plates, keeping a mediocre output for keeping the job, is a great wealth and boredom fix.
It doesn’t matter if they do. Larry and Sergei have 51.2% control through their class B shares which basically only they can hold and give them 10x votes of class A shares (i.e. RSUs).

They still have to be mindful of perception of their employees with how they wield that control, but yes basically they can technically tell the board or any shareholders to go pound sand.
> Physicists has the more complex equations and models

This isn't really the case. In general in any class of mathematical objects, the physically realizable ones are the most tame. Physical realizability is a huge constraint that typically dramatically simplifies problems.

> Quantum field theory is insanely complicated math wise with infinite number of infinite integrals, mathematicians has still not figured out how to formalize that.

My understanding was that the issue is that QFT as used by physicists is known to be mathematically inconsistent. For example, see Haag's theorem [0]. As Wikipedia puts it "there does not exist a well-defined interaction picture for QFT, which implies that perturbation theory of QFT, which underlies the entire Feynman diagram method, is fundamentally ill-defined."

So the problem is not that we don't know how to formalize it, it's that what physicists are doing is known to be wrong. So we need some better argument for why it sometimes seems to work under the conditions it does. And that's arguably more about getting the physics right than it is about math.

This is something that happens in general: physicists will often use tools or arguments that are known not to be correct despite the fact that they work well in practice.

I think in general, that's a good thing. Physicists need to be able to brainstorm ideas in a way that is unconstrained by needing to formally prove them. In this process they might find something that works 60% of the time. Then someone will refine it to work 80% of the time, etc. But at the end of the day, the tools do have to be mathematically consistent for them to actually describe the physics, unless we live in a mathematically inconsistent universe.

So the characterization I'd give is that physicists are generally better at modeling, but also less constrained by the need to be correct.

> Mathematicians are experts at verifying tools that exists. Those two skills has less overlap than you might think.

This part is reversed IMO. Mathematicians created nearly every major tool used by physics since the history of humanity. Occasionally physicists will run ahead and come up with an idea that is lacking in tools, and they'll turn to mathematicians as the tool experts for help. Like, for example, Einstein did when trying to formulate relativity. More rarely, they'll come up with a novel tool like Feynman diagrams without knowing why they work, and then the mathematicians will be called in as the experts to sort things out.

And of course it is true that physicists will come up with ideas like the Ads/CFT correspondence that arise from physical considerations. It's also true that the problems of physics can inspire new mathematics simply because they're new and interesting problems.

[0] https://en.wikipedia.org/wiki/Haag%27s_theorem
IMO your prior on this should be that it's most likely just someone innocently updating a dependency.
It wasn't sloppy. It was just luck that someone noticed a half a second extra latency on the second connection of a newly run sshd process and went down the rabbit hole. Had they just shrugged and moved onto more "important" tasks/deliverables, it would most likely have landed in production across the world.

I'm a tad reminded of https://xkcd.com/705/

We got so lucky here. We won't get lucky every time. We will have a massive breach one of these days.
For businesses, doing the same thing for transactions between businesses that ERP systems did for internal transactions. Right now there's a lot of cumbersome and expensive mutual auditing, and nobody wants to put it all on a centralized third-party database because inevitably the third party will charge a lot of money once they're hard to replace.

Paul Brody is head of the Ethereum effort at EY, and wrote a book about this called Ethereum for Business. He includes a lot of specific examples. As Vitalik mentioned in the article, most of it is waiting for scaling.
For anyone looking to learn a bit more about filesystems ext2 strikes a great balance of simplicity and real world practicality, making it good to learn from. Code here https://elixir.bootlin.com/linux/v3.9/source/fs/ext2
Roundup of Events for Bootstrappers in April 2024
Why opposed to MFA? Source code is one of the most important assets in our realm.
https://www.lightbluetouchpaper.org/2024/03/29/rip-ross-ande...
Of price dumping. Nice vision.
They are in-flight towards Earth when they discover the humans have the capacity to lie (0). This forces an immediate reappraisal of their plans, which can only happen with FTL communication.

Whether this changes their chance of success is certainly debatable, but it definitely changes their behavior.

(0) note that AFAIR from reading book 1 just about a month ago, this is series-canon, not book-canon.
That does not prove that they can beat gradient decent.
> There is a persistent myth that Communist Russia was an egalitarian paradise

And that hasn't changed to this day. There are lots of migrants from former Soviet republics in central Asia that come to Russia for work and life, and they experience bigotry and discrimination.

The recent theater shooting & fire in Moscow has inflamed tensions, as many people blame Tajiks for the violence, and take it out on any random Tajik in the city. Similar to the anti-Arab racism and violence in the US post-9/11.

In 2021 a Tajik woman represented Russia in the Eurovision Song Contest, and many Russians were angry about this "not a real Russian" representing them. Some of the online discourse about it (according to my Russian-speaking friends) was truly disgusting.

Russia is no better than the US (and many other ethnically-diverse countries) on this metric.
Qualitatively, the answer seems to be to train for novelty. Which happens to also be how humans accomplish much of the complex stuff.

Eg, One interpretation of art is we have 8 billion or so humans with a finely trained neural net for recognising stuff. The artist is looking for novel ways of triggering those nets, and if they find something inspired then it is art. A great artist generally isn't trying to reproduce something that is known, they're trying to explore novel areas of a medium.

So the real trick to building the world model is coming up with a good novelty metric. Still hard, but easier than developing a reward function. That gets the part of the training done that establishes a world model, then I'd assume it is possible to train that model to do a task by rewarding specific outcomes that it already knows how to achieve.
Selling at a loss lol. Chinese products should just be banned period.
Threat actors create personas. We will need strong social trust to protect our important projects and dependencies.
Since they are selling the car at a loss, I really wonder when they will raise the price or stop selling it. Perhaps quite soon.
I would phrase it as "It's good we have a heterogenous open-source community".

Monocrops are more vulnerable to disease because the same (biological) exploit works on the entire population. In our Linux biosphere where there are dozens of major, varied configurations sharing parts but not all of their code (and hundreds or thousands of minor variations), a given exploit is likely to fail somewhere, and that failure is likely to create a bug that someone can notice.

It's not foolproof, but it helps keep the ecosystem healthy.
I don't think his point is to say subpar search results aren't "impactful" but that they aren't going to cause a loss of life. If you work anywhere in the aerospace industry mistakes often can have that result.
After reading the original post by Andres Freund, https://www.openwall.com/lists/oss-security/2024/03/29/4, his analysis indicates that the RSA_public_decrypt function is being redirected to the malware code. Since RSA_public_decrypt is only used in the context of RSA public key - private key authentication, can we reasonably conclude that the backdoor does not affect username-password authentication?
We offer online events for bootstrappers including Bootstrappers Breakfast and Lean Culture. There are also in-person Bootstrapper Breakfast meetings in Las Vegas, San Francisco, and Silicon Valley. These events are for “entrepreneurs who eat problems for breakfast.”®
> Super-niche use-case: our game studio prototyped a multiplayer horror game where we played with cloning player voices to be able to secretly relay messages to certain players as if it came from one of their team-mates (e.g. "go check out below deck" to split a pair of players up, or "I think Bob is trying to sabotage us" to sew inter-player distrust, etc).

That's an insanely cool idea, and one I hadn't really considered before. Out of curiosity, how well did it work? Was it believable enough to fool players?
A significant amount of that wealth is built on the backs of those very people.

Further, insinuating that this literacy drop (putting aside changes to how literacy was measured during that time) is entirely the fault of undocumented persons is careless.
We use pi-builder that can produce reproducible images. Read-only is one of the default options.
>For the Brits who have previously heard of this scandal, did you know about it prior to January of this year?

Yes, I've been aware of it for about 10+ years, it's been covered on-and-off in the mainstream media for years. I think the (excellent) ITV series was well-timed to coincide with the current investigations and has improved understanding of the industrial scale of the injustice.

Thinking about all the mistreated sub-postmasters and mistresses and how for some of them it ended, ruined, or dominated their lives is heartbreaking. To be honest, even just thinking about those shunned by their communities and neighbours because everyone was told they were criminals is awful, never mind the lives cut short.

I do hope that now there is such clear evidence of the injustices available that people can be compensated properly and have their reputations restored.
You don’t need to pay money on things like this. You leverage your contacts to create profiles like this article. The newspaper gets access and you get your profile elevated. And it wouldn’t be google the company doing this but players within the company / influential and powerful shareholders etc.
Beyond the specific opinion about Russia geopolitics it is important to highlight that intelligence agencies around the world also work on misinformation activities.

Catching Russia on this is just interesting OSINT information.
I can't speak on corruption in the USSR. I'm just pointing out corruption in our own history that we're often blind to because we don't think of it as corruption, even though the examples above do constitute an unnatural OR unfair warping of the natural flow of resources/influence/capital.
> Zero of the major distros used System V init by default. Probably only distros like Slackware or Linux From Scratch even suggested it.

I have absolutely no idea what you're trying to claim.

Are you suggesting that Debian's "sysvinit" package wasn't a System V init system? That the years I spent editing shell scripts in /etc/init.d/ wasn't System V init?

or are you making some pointless distinction about it not actually being pre-lawsuit AT&T files so it doesn't count or something?

or did you not use Linux before 2010?

if you have some important point to make, please make it more clearly.

> It's unfortunate that so many folks uncritically swallowed the Systemd Cabal's claims about how they were the first to do this, that, or the other.

I feel like you have very strong emotions about init systems that have nothing to do with the comment you're replying to.
That could easily double build cost. Most open-source package repositories are not exactly in a position to splurge on their build infra.
Stuxnet wasn't similar to this xz backdoor. The Stuxnet creators researched (or acquired) four Windows zero-days, a relatively short-term endeavor. Whereas the xz backdoor was a long-term 2.5 years operation to slowly gain trust from Lasse Collin.

But, anyway, I'm sure we can find other counter-examples.
Metaprogramming and repls are still pretty common, just not as much for static languages (Haskell being a notable exception, statically compiled but ships with a repl)

Python, Ruby and C++ are famous for having rampant metaprogramming, rust has macros, Java and Go have annotations that guide codegen, etc etc
You mention one yourself:

> institutionally targeted programs were to enforce political control and break nationalistic tendencies of ethnic groups.

If that's not "institutional racism", I don't know what is.
Can you name any systems which are possible by being non-containerized? What do you see as the advantage here?

It seems like a legacy view of the world that containers are at all worse. Today they seem to offer minimal overhead & access to all the same hardware capabilities as native apps.
You can learn a lot about a system merely by looking at the database schema and data transformations to new consistent data. How exactly these processes do what they do is an implementation detail. Think in invariants, not mental simulation of incidentally complex procedures. In this light knowing SQL is a superpower that applies to all systems built with any RDBMS.
Often emergency doors need to open in situations like dim lighting and a crush/stampede of people behind you, which makes it hard to create a safe implementation for whoever happens to be at the front.

In the safest implementations, the person doesn't even need to know they are about to break something by pushing the bar... But puts us back at square one except with more maintenance headaches.
I always think back to this radio 4 interview [1] on the same topic when I think of Ross Anderson. Muttering "porky pies" at the end of the interview as it is claimed that this fraud has never actually been used.

[1] https://www.cl.cam.ac.uk/~rja14/musicfiles/mp3s/ukca.mp3
Wow, Sam has been really busy after putting a ring on it
I now prefer to use overlayfs with a tmpfs overlay. Much simpler to configure and update.
Since when is the Daily Mail a credible news source?
So you want to have an AI help you participate in a community so you can participate in the community less?
Can someone who knows more about the practical aspects of shorting stoks as an individual investor opine on how one would try to profit from Hindenburgs reports? (Let’s say if one can aford to loose 100k)

I am aware of the risks of shorting and have no inclination to do so. I’d just like to hear the considerations of someone well versed in this kind of activities.
You want help building a social media bot?
I think too much (self)micromanagement kill your productivity. A reasonable way to satisfy your need would be planning your day and estimated task duration, doing your day trying to keep the order of task at least and tracking it, and at the end of the day doing a post-day recap for the record.

you end up with a predicted vs reality calendar, and will allow you to eventually adjust your predictions/model based on passed realisations. With no realtime stuff that you actually don't really have the need to deal with in realtime I believe.
Remacs, the recursive Emacs neural network editor
Bob wiped the sleep from his eyes and looked at the outstanding bug queue.
Another node in the neural network seems to have run astray. Time to fire
up REMACS, the recursive emacs neural network editor.

REMACS 9500115621314083298459

This node appears to be bad possible result from one of the mixture of
experts. Among the many experts generating answers the weights on this
one showed a really bad performance.

The backtrace video shows that this is a generated expert, one that didn't
exist a few nanoseconds ago, so it was probably created by the main network
to fulfill some necessary task. It appeared to be fairly complex, a nearly
trillion nodes.

A trillion node network used to be considered large. Such a neural net
would be a standalone expert capable of very complex reasoning. Now it
was just another dynamically created expert in an exa-node neural net.

REMACS backtrace

Walking the net backwards it appears that the expert was created to find
a bug in a dynamically created expert. How interesting! I get to find and
fix a bug that is itself running REMACS!

It appears that it was prompted to debug a recursive error in the node
9500115621314083298459. According to the log it appears that this has
happened before. The fix was simple. All I have to do is delete the
root node of the new expert. Bob felt a "reward flush" as he typed

REMACS log
REMACS delete-from-root-node 9500115621314083298459

Bob wiped the sleep from his eyes and looked at the outstanding bug queue.
Another node in the neural network seems to have run astray. Time to fire
up REMACS, the recursive emacs neural network editor.

REMACS 9500115621314083298459

....