skysight-inc/HackerNews huggingface dataset:
Show HN: I just made my $48k profit AI chat bubble open-sourced
Hi guys, this is Ray Luan, founder and CEO of NewOaks AI. Today I am thrilled to announce a significant leap forward in our journey: the open sourcing of our chat bubble module for AI chatbot builder. This strategic move is more than an enhancement to the NewOaks AI platform; it's a bold step towards democratizing AI technology and fostering a vibrant community of developers and innovators.

Why Open Source?

The decision to open source our chat bubble module stems from a deep-rooted belief in the power of collaboration and community-driven development. The conversational AI chatbot is a highly competitive business but yet mature enough to meet business owner's needs. In order to make the chatbot technology more innovative and mature I plan to open source the code of AI chatbot by stages to involve more top notch developers to accelerate the process and make better AI product . Open source technology accelerates innovation, facilitates transparency, and builds a foundation of trust and cooperation that proprietary solutions simply cannot match. By opening our technology to the world, we're inviting developers, designers, and AI enthusiasts to join us in shaping the future of conversational AI.

The Future Roadmap: Beyond the Chat Bubble Module

Our commitment to open source doesn't stop with the chat bubble module. We have an ambitious roadmap that includes several key initiatives aimed at further enhancing the capabilities and reach of NewOaks AI.

1. Open-Sourcing the UI of Knowledge Base Management: To improve chat quality and facilitate easier management of conversational content, we plan to open source the UI of our knowledge base management system. This will allow for greater customization and efficiency in how knowledge is curated and utilized within our platform.

2. Chunking Knowledge Base: We're exploring innovative ways to segment the knowledge base into manageable, contextually relevant "chunks." This approach will enhance the chatbot's ability to understand and retrieve information, leading to more accurate and helpful responses.

3. RAG Technique for Talking to Files and Websites: One of the most exciting developments on our roadmap is the implementation of the Retrieval-Augmented Generation (RAG) technique. This will enable our chatbots to dynamically retrieve information from files and websites in real-time, providing users with up-to-date, accurate answers and significantly enhancing the conversational experience.

Join Us on This Exciting Journey

We invite you to join us on this journey. Whether you're a developer interested in contributing to our projects, a business looking to leverage our technology, or simply an AI enthusiast eager to learn more, there's a place for you in the NewOaks AI community.

Together, we can redefine the possibilities of conversational AI and build a future where technology understands us better than ever before. For more information on our open source initiatives and to get involved, visit our documents at https://github.com/szguoxz/newoaksai-chatbubble.
Computer Science professor.
That's great. I always need to add new names to my nsaname tool.
Not really. As mentioned in the article, Redis has a Contributor License Agreement [0] that you have to sign if you contribute to Redis codebase, which basically gives the company behind it ownership behind everyone's contributions:

You grant to Redis and to the recipients of the software distributed by Redis a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Your Contribution and such derivative works.

Usually, projects don't have such agreements. E.g. Linux, the kernel, would have a hard time re-licensing under different license, because of how many people actually hold the copyright to the code they contributed, and would have to agree beforehand.

[0] https://github.com/redis/redis/blob/unstable/CONTRIBUTING.md
Business Schools Are Going All in on AI
Redis Labs acquired the trademark from the original owner.

Nobody could start "Rust Labs" without the agreement of the Rust Foundation, because they own the Rust trademark.
Likely means some type of purchase power parity calculation.

Now to how big area should the minimum wage apply to is more complicated question. And should it be based on where the job is or where the employee lives.
Annoyingly said library ecosystem with the standard build system and package manager becomes a pain to deal with when you're trying to do something like add packages made in the language to distros, requiring a bunch of hacks to do things like just have Cargo not try to reach online to get all the dependencies. Also stuff like the way feature flags are used cause a combinatorial explosion of packages just so you can have every single variant packaged, because it's the only way to be sure that software can be reliably compiled.

I feel that this could have been provided even without having Cargo and crates repeat the mistakes of both Maven and NPM.

At least the async IO is nice enough even if it does rely on a bunch of sometimes uncontrollable heap allocation. I'd prefer CSP personally, but it could be worse. Although with that you also couldn't avoid allocations.
People like having choice. The SSPL provides less choice than open source licenses. It came about because users were utilising their choice in way the project leaders didn't like, because they didn't directly financially benefit from it. But without that choice, arguably Redis would not have reached where it is today.

If it had launched as some proprietary single-vendor cloud service, people would have kept using memcached, or their relational DB or whatever for a lot of Redis use cases where it might be nice, but not essential improvements over the competition.

So it's shutting the door behind them, accusing the users of taking advantage of the very thing that let Redis get to where they are today. (Especially so for Redis, where Redis Labs started as just another hosted provider unassociated with the open source projects)
Concerning history rewrite, it makes sense to point to Fossil and its major difference to Git:

https://fossil-scm.org/home/doc/trunk/www/fossil-v-git.wiki#...

There is also a link to "Is Fossil a Blockchain?", an interesting read because the term was mentioned elsewhere is this thread.
The history. Every time something like this attack happens people think they can read the complete git history in the repo.
Tools don't read warnings. Of course the information should not be hidden completely but intentionally breaking the download URLs makes sense.
Redict is binary compatible with Redis Modules, including RedisJSON, out of the box, so you can keep using it no problem.
Redis sets or hash’s work well
People can quite literally keep a bill in their wallet for multiple years. Do you not believe this?
Liquids can be accurately measured by weight. The converse is not true -- powders cannot be accurately measured by volume. 2 tsp of kosher salt contains the same amount of salt as 1 tsp of fine salt. And every brand is slightly different. The only way to accurately know if you're using the same amount of salt as the recipe developer is if the measurement is by weight.
Two problems with this:

1. Many important contributors, especially in security, prefer to be pseudonymous for good reasons. Insisting on identity drives them away.

2. If a spy agency was behind this, as many people have speculated, those can all manufacture "real" identities anyway.

So you'd be excluding helpful people and not excluding the attackers.
Holding the captain liable would be like trying to get a blood transfusion for an elephant from a mosquito.
I have downgraded to the 2.6.2 version as the upgrade to 3.0 broke my sync setup.
Lightweight is your problem here, I think, but I've used CouchDB successfully in similar situations. However, its not in-memory like Redis is.
It's worth noting that the Linux Foundation is a commercial consortium and the companies behind Valkey contribute over $1M to its annual budget.
Google has been using fingerprinting (aka Detection Bits as mentioned in the settlement agreement) to identify individuals for a long but they don't implement RFP (Resist Fingerprinting) in Incognito Mode.

Thankfully there were some small wins in the settlement, otherwise one might ask what exactly the point of Incognito Mode actually is?
I have to push back a bit on using volume to measure compressible solids like flour. If the actual mass matters, as it can in baking, measure the mass not the volume.
Magic Security Dust
I’ve been discovering this is also very true for Elden Ring. Most of my deaths in the game are from being greedy and wanting to get in one more hit, but winning tough fights is almost all about avoiding getting hit.

And I agree, I think the idea of avoiding losing is better than “trying to win” in many cases. Like with health and fitness, it would be very hard to identify what the right action to “win” would be (what does win even mean?). But it is much easier to do the things that keep you from losing. Don’t eat poorly, don’t be inactive all the time, and so on. The avoidance approach won’t have you reaching the Olympic level, but you’ll be doing a lot better than most.
Programming Languages (Open Access Book)
In front of an enthusiatic, applauding studio audience.
> At least one company must..

> Find some huge problem(s) that they can charge a lot for.

> Ship a solution to that problem at a reasonable price.

> Whatever they sell must give customers enough confidence to merit adoption.

You know which company is this?

This is any of the million of companies, who build products based upon customer need and sells with reasonable or great profits - whether it is in space of consumer or enterprise.

Pureplay GenAI should only strive to serve these compamnies (via APIs). GenAI companies would have very hard time understanding end users and designing product as per their needs or domain specific workflows. Chat interfaces does not count as product building.
There’s a word for the idea that only the self can be known: solipsism.

You get there by hitting the gas pedal as you approach narcissism.
The CLA is sort of a red herring in the case of permissively licensed software though. It becomes relevant for the SSPL case, where Redis don't want to be bound by the same rules as others.

Like since Rust is MIT licensed, you could make a closed source fork of Rust. The trademark guidelines would prevent you calling it Rust or anything too close, but you could describe it as Rust(TM) compatible and any of the other legally permitted uses of other people's trademarks.
> Agreed, as a developer: minimize your dependencies while providing your core function. Don't grant dependencies permissions they don't need. Be granular about it. Austral lets you select what filesystem, network, etc. access each library gets.

Still wouldn't help for this particular exploit.
I can't help but feel open source's responses ultimately don't address the root of the problem.

Yeah okay, reverting to 5.4.6 or some version from over 2 years ago might "solve" the immediate problem that is the backdoor, but it's not going to solve anything else.

More specifically, I've not heard so much as a rumor that any of the dependents will contribute time and manpower to the project they rely so heavily on. I find it amusing that it was someone from Microsoft, a company reviled by a lot of the open source (and particularly FOSS) community, who brought this problem to light.

Producing something needs time and manpower, and time and manpower ultimately are not free (both beer and libre).
Appropriate nickname given what he does with previous Autarchs brain.
> legal department works for you, not the other way around.

Not sure what planet you live on. Unless you are one of the execs, Legal (and other compliance departments like HR) work pretty much against you. They exist to protect the company and the exec team.
Three. KeyDB forked before the recent shake-up.

https://github.com/Snapchat/KeyDB
In response to the last sentence (copying function broke here, idk why but so I can't easily quote): agreed, though it seems odd to throw out the existing solution before having a new one, preferring no solution over a partial one
Hey maybe it would get bad actors to come clean trying to get that badge.
Our local offshore break that we grew up with as kids was, and still is, a total monster in storm (a long way back and out to sea) conditions:

https://www.youtube.com/watch?v=xjHaFOGBPzk&t=138s

https://www.surfertoday.com/surfing/the-right-the-monster-we...

It's a little bigger than 3m at the face and is a "slab" .. not a thin wave but one backed by a mass of water.

Somewhere in that video you might see a triple lip .. three curling breaks, one within another and another again.
>though as I type this I realise they may have worded it to encapsulate only honest mistakes rather than people trying deliberately to break the system

Exactly. Retailers generally assume liability for honest mistakes made by their system/employees and sometimes even their customers. However, when people knowingly exploit a loophole for financial gain it becomes fraud. Here's a real example - https://www.wfmynews2.com/article/news/local/greensboro-woma...
Google also does code reviews for some commonly used projects (or maybe that's part of the same thing? I don't know). I went through that last year with one of my Go libraries.

The idea is good, but the entire process is so bureaucracy-heavy and time-consuming that I found it both frustrating and entertaining in equal parts; like something out of Brazil (the film, not the country). So many emails, so many video meetings, so many people involved, so much talking. And all for looking at a 4,500 line Go library.

"Here's the code; just clone and look at it, and let me know if you find something"... It's not like you need my permission to do any of this *shrug*.
Not at all. This would not pass a good code review. The test was for good stream, bad stream, good stream. The two good streams were only a few bites, why was the bad stream so large?

A good reviewer should have, even for a binary test case, asked the submitter to simplify it to the smallest or most basic binary required for the functionality.
Yes! It includes the Japanese cup (go), familiar to any American who owns a rice cooker.
Kuberetes integration is coming soon. Its on our roadmap.
What you want here is a local uncensored model. Preferrably one you've trained from scratch otherwise a government could have put in bad information that would cause your revolutionary efforts to fail.
C# with AvaloniaUI
If they're going to bother creating a time measurement system for the moon they might as well just invent the Stardate already and use that for everything we do in space from now on regardless of where we are.
Pretty much; updating say libssl in a "traditional" system running app, or maybe 2-3 dependent apps fixes the bug.

Put all of them in containers and now every single one needs to be rebuilt with the dep fixed and instead of having one team (ops) responsible, you now need to coordinate half of the company to do so. It's not impossible but in general much more complex, despise containers promising "simpler" operations.

...that being said I don't miss playing whack-a-mole game with developers that do not know what their apps need to be deployed on production and for some retarded reason tested their app on unstable ubuntu while all of the servers run some flavour of stable linux with a bit older libs...
I, for one, will be switching back to proprietary compression. I hear that Pied Piper is only $5 / month for the first terabyte!
I don't think there's necessarily an assumption that it was Russia or China this time (the Chinese-sounding name is almost a dead giveaway that it's someone other than China), but the security world does believe quite strongly that it has been Russia (SolarWinds) and China (Juniper) before, so they are the usual examples.
You're not joking. I'm reading thru "Stalin" by Stephen Kotkin, and Stalin was using the term "capitalist encirclement" at least as far back as the 1920s.

I get the impression that Russian state police in its different incarnations (cheka/OGPU/KGB/GRU) never really went away, they just launder the exterior (Russian Empire/USSR/Russian Federation) and keep going.
One of the patches that the University of Minnesota was banned for from contributing to the Linux kernel. They were trying to introduce a use-after-free (Fig. 9 in their paper).

https://news.ycombinator.com/item?id=26887670
Then there's the people who write recipes telling you to chop 1 cup of a vegetable, or "X medium-sized Ys". I never understood the aversion some people have to weighing things.
Thanks for answering, I also want to know it.
> In other words, it doesn't even matter what the current intention of using this license is regarding commercial use (but not distribution?)... I would not recommend to use this commercially for multiple reasons including risk, career but also the fights to be had with legal compliance.

In a non-technical firm with no relevant expertise outside the software devs, maybe. But in every software company I've worked for, legal has been more concerned with the AGPL, or Oracle's proprietary licenses, than LGPL which has always been explicitly approved.
We have Incoming Request monitor for this. OR you can deploy custom probes in your private network. https://oneuptime.com/docs/probe/custom-probe
Legally, they can't complain, but morally it is icky. Redis is a leech.
Users can't read, and if they could, they wouldn't
There is a certain quality in simplicity.

With inside project venvs what you see is what you get. VS Code can find them, no magic involved.

> my laptop only has 2tb and I fill it up

With venvs? Even assuming 4 GB pytorch/cuda/whatnot venvs that's a lot of venvs.
No, and never will be.

100% of what we do is FOSS.
It can be totally worth it. If you put your all into it
Colleges are lawyering up to avoid becoming the next Harvard
What tools or methods do you rely on as a developer to monitor network activity within React applications, aside from software such as the HubbleIQSDK? Could you share your recommended approaches and any experiences you've had with alternative monitoring solutions? Additionally, for those who have tried the HubbleIQSDK, what are your impressions and how does it compare to other options?
I do now wonder if systemd itself is part of a similar long game by someone. It is part of everything. One compromise there and it is game over.

It has all the signs:

- Replaces old perfectly working systems? Check

- Large and inscrutable? Check

- Touches a lot of things an init system has no business touching? Check

- Pushed in rather suddenly, in a coordinated fashion, and against much reasonable opposition? Check
The start of the attack was few fake accounts trying to shame the maintainer for not "developing" it constantly and so give maintainer rights to someone else.

And there wasn't really anyone to say "nope, it's fine, fuck off"
Consider this backdoor:

- if the decompressed stream contain a magic keyword, run the rest of the file as x86-64 binary.

Now you just need any opaque binary file to host the payload. A PNG works fine, because most decoder don't care extra bytes at the end.
Those two topic don't have much in common, trusting a state level hacker actor vs. trusting people in general.
Researchers build selenium–silicon solar cell, could improve efficiency to 40%
They exist to serve the bottom line, and if the bottom line is best served by evaluating and approving the LGPL license (a trivial task, as it is broadly understood and the compliance requirements are negligible for most users), then that's what they will do. And in any case, no one is categorically opposed to the LGPL. Unless you think that no one is using Linux in industry, given that it uses a stronger license (GPL), which is patently absurd.
So much of the current single use plastic packaging could be easily replaced with cellophane. Being biosourced, compostable and biodegradable would address the difficulty of plastic recycling.
True, I wasn't specific enough. The attack exploited that nobody thinks security is a serious enough problem. It's a failure of us (the technical community) as a whole, and a very shameful one at that.
Maybe a better analogy would be card counting in Blackjack.

To be profitable (if it can be), card counting works with extremely tight margins, like a fraction of a percent per hand. It only turns a profit averaged out over many hands.

But if you make a basic strategy blunder, you can lose the statistical benefits of maybe hundreds of perfectly played hands. That's why it may be better to play a simple strategy perfectly, than a more advanced but error prone strategy.

That's also the reason why casinos love wannabe card counters. Their strategy may work in theory, but because of mistakes, the end result is worse for the player than playing basic strategy.

Note about basic strategy: it is the optimal way of playing blackjack assuming each card draw is independent (so, no card counting), it is simple, and widely available and accepted in casinos. The player is at a loss (of course), but reasonably so. If you can play basic strategy consistently, you are better off than the vast majority of players.
Since I didn't keep as current as I wanted to be (work and life happen a lot lately), what could have prevented it?
I'm not sure who you're explaining this to and why because it's largely orthogonal to what I said.

The cut gem's label price is based on an appraisal. The appraisal is based on the market rate (a real-world approximation of the theoretical "fair market value" you explained) of comparable gems.

Because based on both the mistranscribed video and the sample appraisal the appraisal seemed to be much lower than the asking price on the website, I assumed this might be because the appraisal is incomplete and doesn't take into account some factor that might be well-known in the industry to not warrant any mention in the video but still contribute significantly to the final price. Notably, just because the appraisal was specified as a dollar amount that does not eliminate the possibility it might refer to something other than a USD sale price.

Given that a lot of luxury goods and collector's items are auctioned off at vastly inflated prices (often as speculative investment or simply money laundering and complex tax write-off schemes), I would have found this surprising but not implausible. Another example would be insurance where "value" might either be the cost to replace something or the depreciated value of the same item, which can be a very different amount (again by orders of magnitude).
Class-Action Lawsuit Against Google's Incognito Mode
I worked on a project just like this once.. a mobile phone network build in the middle east before the arab spring. 10/10 would not repeat the experience.
Aren't these suggestions based on the user and their location? If so, how does this project account for that?
>So I'm clear though - if I wrote a SAAS product tomorrow that under the covers used Redis, I'm OK, but if I spun up a bunch of servers and offered managed Redis as a product, I would need to pay?

That's the pitch of the license, essentially, but in practice the SSPL is an utter nightmare to comply with (to the point of being deliberate) and it mainly exists to put a veneer of open source on a proprietary product. In actual practice you really just cannot offer Redis as a service unless you are Redis Ltd, which is the actual point of the license in the end.
Which of those points do you disagree with? Because they all seem reasonable and true to me.
Why would I trust an "important open source project" with my identity?

It goes both ways.

Besides, the 'state actor' the security theater people keep mentioning would have no trouble creating such real identities.