skysight-inc/HackerNews huggingface dataset:
You're not wrong, but IMO that isn't the real problem. The real problem is the combination of highly popular core open-source utilities with near-zero maintenance resources.

This was all possible because XZ, despite being effectively everywhere, has one actual part-time maintainer who had other things going on in his life. That also means that there's nowhere near enough resources to redo the build system to some more secure alternative. If they had, say, 10 enthusiastic and skilled volunteer contributors with plenty of free time, they could do that, but then a new person appearing out of nowhere with a few helpful commits would never have a chance at being made an official maintainer or sneaking sketchy tools and code past the other maintainers.

Not that I'm blaming XZ or the real maintainer. Clearly whoever was behind this was looking for the weakest link, and if it wasn't XZ, it would have been something else. The real problem is the culture.

So I guess what this really means is someone at a big corporation making Linux distros should audit their full dependency tree. Any tool in that tree that isn't actively maintained, say at least 3 long-time active contributors, they should take over one way or another - whether that's hiring the current maintainer as a full-time remote employee, offering to buy out the rights, or forking and running under their own team.

I'm not necessarily super thrilled with that, but I guess it's the world we live in now.
No, that was the last straw. There's no more.

Supply and demand dictates buy buy buy. Straws are going to the moon!!!
He just updated the website.
Python actually covers quite a lot of hardware. Of course, it does that via an autotools nightmare generated configure script.

Of course, you could do the detection logic with some autotools-like shenanigans, but then crunch the data (ie run the logic) on a different computer that can run reasonable software.

The detection should all be very small self-contained short pieces of script, that might be gnarly, but only produce something like a boolean or other small amount of data each and don't interact (and that would be enforced by some means, like containers or whatever).

The logic to tie everything together can be more complicated and can have interactions, but should be written in a sane language in a sane style.
Prompt Evaluations Hack
Hello,
Recently, I've been working on creating contract documents, scoring, and conversational apps using generative AI.

I'm not only interested in RAG but also want to improve the accuracy of prompts. I'm currently using around 100-200 prompts and would be happy if I could do component-based prompt engineering.

I am comprehensively using:

1. OpenAI Eval
2. Azure Prompt flow
3. Promptfoo
4. LangSmith
5. Wandb

If there are any better hacks, I would like to know.
If "intelligence" becomes a service, it means that things are easier to build. If things are easier to build, then it becomes harder to develop moat because every app becomes easier to copy. Like Peter Thiel said, "competition is for losers". Wages will decrease in the face of lots of competition as everyone begins to compete on price.
It’s not really a wave, it is more of a tide that comes in quickly. So everything gets flooded to 3m above the normal water level, and stays that way for a while.
Hence why I'm asking if he signed an NDA or non-disparagement agreement.
Fascinating that you can see "underpaid" and "fair" wages as political myths but not "unskilled labor."
Are they? https://codesubmit.io/blog/the-evolution-of-developer-salari...
Thanks for your informative post!
I think it's de facto required to be a US citizen (and preferably by birth) in more jobs than you think. It makes lots of sense. We have had scientists come from other countries to infiltrate our nuclear program, and we may not have even caught them all. This type of espionage is expected, and it is righteous to stop it. "Discrimination" or not, it is entirely reasonable for nationality and background to rule people out for any nationally sensitive job. I don't think you can find any country outside the West where the legitimacy of this criterion is questioned on the basis of fairness.
> If you want to preserve a game, you have to decide what parts are important to preserve [...] you might be able to do it but you then don’t get the real game experience

The author of this website is aware of that. Everyone will come away from a game with a different favorite part, of course, but for him it's mainly about preserving the worlds and art assets, even if some of the more fancy functionality is lost.

With games as a service, your game client already has the vast majority of the assets it needs locally. The world, models, physics engine, and the ability to move through the world are already handled by the client. But they remove that online authentication lynchpin, and you're left with tens of gigabytes of assets that you can't even open to view.

In his words:

> The comparison is between a less functional game versus nothing. It's the difference between putting grandpa in a wheelchair or taking him out back and shooting him in the head.

> Battleforge https://www.youtube.com/watch?v=kmvcJuBOaQE&t=1168s

Plus, most of the "it's too hard" would be obviated if the publishers would plan for this eventuality from the beginning. Providing a bare-minimum experience that lets you navigate the world in singleplayer should not be "too hard".
I don't believe this will result in conservatism around upgrading nor that it would be good if it did. The vast, vast majority of security vulnerabilities are due to regular bugs and once the details are known, they can be exploited. Not patching leaves you open to these exploits.

Supply chain attacks are a real threat too, but being conservative about upgrading to improve your security posture is like saying "I'm worried someone with the key to my house might rob me, so I'm going to remove the lock from my door."
If you're a lookie-loo with your phone camera out, you're not very concerned about your neighbor. You're shooting disaster porn for the likes
This site (ign apparently) is incredibly sketchy without an adblocker on.
Last time this happened in Taiwan buildings collapsed and peopled died because corrupt local construction companies had put too much sand in their concrete to save money.
Stalking junior employees is seriously fucked:

In October 2023, Emma received a labor arbitration claim from Pinduoduo, requesting her to pay 280,000 yuan as compensation. The evidence Pinduoduo presented to the arbitrator was a series of secretly filmed videos of Emma leaving her residence and entering her new workplace.

It was only when she saw the videos that Emma realized she had been followed to and from her new job for weeks by a portly, middle-aged man, discretely recording her from a distance, whose reflection was clearly visible in some footage. In the following days, Emma said, she had nightmares of being stalked. "I am so scared," she wrote on the social media site Weibo. "I don't know if I am being stalked again. I keep looking behind me whenever I walk down the street now."
They discuss New York in a short segment of this video (linked to timestamp): https://www.youtube.com/watch?v=nChhkHpkD0Y&t=945s&pp=2AGxB5...

You are, of course, within your rights to object to an article’s tone, just as I’m within my rights to tell you why I find it to be a poor form of argument.
Tech stack includes Python, Node.js, TypeScript, and React; MySQL, Kafka, Clickhouse, Elasticsearch, and Redis; Kubernetes, Terraform, and Google Cloud Platform.
Is it safe to use __SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED?
Ask HN: So how come the xz thing hasn't hit the fan?
The xz thing sounded pretty scary. Yet I’m not hearing stories of emergency patching, etc. Was it no biggie after all or are people just handling this quietly?
Here's his other video from 2019, "Games as a service is fraud": https://www.youtube.com/watch?v=tUAX0gnZ3Nw
The bubble has got to burst eventually. I just hope I'm retired by then
You can solve differential equations by integrating or by differentiating. Real-world integrators were easier to build back when DEs were solved with analog computers. Although "easier" is an understatement: Differentiators have a nasty habit of trying to blow up to infinity, which means you can't really build a good, general differentiator either with analog or digital electronics.

Integrators are much better behaved pets and they don't shit on the carpet. So everybody uses integrators. Integrators have lots of issues too but those can be sufficiently mitigated for many classes of problems. Differentiators are mostly hopeless, feral beasts.
Momentum of batch buys is running out with new buys coming at a cost? If your chips aren’t performance competitive in processing or energy, you have to discount until you hit cost parity.
LindaBot guides women through post-prison challenges
Collecting voice data to create train AI to speak in?
We have a similar measure (MMI) in the US, but it's harder to report a local measure in a single article.
Writing a build script in Rust is fine-ish.

Writing anything in C is a bad idea these days, and requires active justification that only applies in some situations. Essentially, almost no new projects should be done in C.

Re-doing your build system, or writing a build system for a new project, counts as something new, so should probably not be done in C.

In general, I don't think your build (or build system) should necessarily be specified in the same language as most of the rest of your system.

However I can see that if most of your system is written in language X, then you are pretty much guaranteed to have people who are good at X amongst your developers, so there's some natural incentive to use X for the tooling, too.

In any case, I would mostly just advice against coding anything complicated in shell scripts, and to stay away from Make and autotools, too.

There are lots of modern build systems like Shake, Ninja, Bazel, etc that you can pick from. They are all have their pros and cons, just like the different distributed version control systems have their pros and cons; but they are better than autotools and bash and Make, just like almost any distributed version control is better than CVS and SVN etc.
Makes sense! I would say flip your video and put the AI stuff upfront. At least then people can see what you have/where you're going.

more of a "Use AI to generate internal tools" (the language, auth, UI, etc. could be anything. even though react is a great start.)

In time you could generate the stuff in any language people want "use the language you love instead of constricting no-code or inflexible boilerplate starters"

The boilerplate is less than valuable because you're competing with already established open source communities that "will be around long after you go out of business or pivot" (quote because of sentiment but not because I think you're going out of business :) )
Will local protectionism hurt global supply, though? If the US protects its domestic solar industry, that will slow down the US transition, but the total number of solar panels being made globally should go up, which will indirectly accelerate the renewable transition by reducing the price of Chinese made panels even further. I'm not confident in my economic reasoning here, so correct me if I'm wrong.
Damn. Please update on your case. I've been hearing these kind of stories pretty often now and makes me kinda reconsider whether I should switch. Hasn't happened to me yet but who knows lol
This factoid made its way through my social circles back in 2019. I'm a little surprised it wasn't more common knowledge.
Provably Beneficial Artificial Intelligence [pdf]
> they assumed all liability for mistakes

To get a little pedantic, assuming such a promise existed, it actually doesn't mean as much as most people think.

A merchant saying "we won't sue you in civil court for the missing money" does not prevent the local government from criminally prosecuting that same person for theft.

American TV dramas often show the police asking people "Do you want to press charges?", but the idea that the question matters is a myth, since victims of crime don't get to decide that. At best, it's a terribly misleading shortening of: "Just for my own private curiosity, do you plan to lobby or press upon your local government officials into pressing charges?"
Because it never made it out to Enterprise operating systems. It was so new and it was discovered early enough that it was really only on those running the absolute bleeding edge which is typically not big enterprises. If this would have hit like red hat 9, people would be losing their mind over it.
do you know which adlist is blocking the assets?
Eight U.S. States Now Have Plans to Ban Sales of Gas-Powered Cars
https://echo.labstack.com/ a Go web framework
It’s a shame they did not name the car model Deliverator
this guy is right again at predicting these earth quakes: https://twitter.com/ssgeos/status/1775146068079960148
The other video you're referring to is "Games as a service is fraud": https://www.youtube.com/watch?v=tUAX0gnZ3Nw
Is Marx really that modern?
Almost no one was running the compromised version and the backdoor was extremely targeted so the situation isn't that bad.
> Blaming this on bash is like a smith blaming a hammer failing on a carpenter's shoddy haft... Not terribly convincing.

If your hammer is repurposed shoe, it's fair to blame the tools.
At least for flour and white granulated sugar it looks exactly like uncoated paper.
Structural Continuity and the Francis Scott Key Bridge
There are lints that will warn you, if your imported module does anything apart from define functions and classes.

(Though not sure how fool-proof these are.)
The vast majority of startups fail to find a moat and eventually fail completely. It didn't stop VCs from investing. It didn't stop people from starting startups.

Perhaps those failed startups would have been viable if they could have built and maintained the product with 10 engineers instead of 100.

So instead of a single large software product that might not fill specific niches well, we might have a medium size product and many smaller products that fill more niches in the category.

For example, Clerk.com auth supports React mostly. But what about Vue or Svelt? Someone can come along and say, I can build that for Vue and Svelt and be economically viable because I build it much faster with fewer engineers leveraging AI.

A quick Linkedin search says Clerk.com has 112 employees. What if I can build an alternative for Vue and Svelt with just 10 employees?

Not being able to maintain a moat just means that software engineers will be switching to different jobs more frequently. It doesn't mean that the overall software market will decrease.
> If someone wants to actually persuade it’s better to present the argument in a calm rational way.

That’s one of those “works better in theory than in practice” positions. In a perfect world, sure, people are persuaded by calm, rational argument. That’s why politicians and advertisers avoid emotional appeals, right?
Event Horizon is the closest we’ll get to a Warhammer 40k film.
This still happens today. Some chip packaging doesn't provide enough protection from UV.

https://forums.raspberrypi.com/viewtopic.php?f=28&t=99042
Some languages make you try harder, some less so.

And not all languages are Turing complete in the first place. Not even all useful languages.
Hmm… something like:

Each player starts with only a king on the board.

Player turns consist of either:

1) adding a pawn to the board

2) moving the king

Or 3) launching one, some, or all of their pawns already on the board.

Launching a pawn involves removing the pawn from the board, and nominating a square where the pawn will land. If there is an opposing piece on that square at the end of the opponent’s next turn, that piece is removed from the board.

If your king is removed you lose.
Same but different, there's an old town near a lake that suffered a devastating flood way back in its history. The downtown area has markers on the buildings that show the high water mark for the flood.
The author is using "dying-earth genre" to mean something rather specific that the series Dying Earth, despite the name, doesn't necessarily fit. I haven't read it, but going by Wikipedia it sounds like it has at least as much in common with the "sword and sorcery" stuff she mentions later as it does with the absolutely bleak stories she excerpts by Wells et al. I've read a couple of Wolfe's books (Short Sun, IIRC?) and I would definitely put them in her later category, even if "sword and sorcery" undersells them enormously.

Reading further on Wikipedia though, she might have picked a bad/already taken name for her category. https://en.wikipedia.org/wiki/Dying_Earth_(genre)
Are you saying that "unskilled labor" is like the other two in just being spin on "I don't approve of market forces"?
I've been experimenting with some home automation using Home Assistant recently. Its scope is absolutely incredible. Some open source friendly brands are Sonoff, Shelly, and Athom. Would be really sweet if there was an Awesome Open Source Home Assistant git some day. =)
Wikifier: Semantic Annotation Service for 100 Languages
You are trying to pass off some arbitrary thing for “building on top of”.

I can use all the benefits of Linux to deliver a SaaS (like 99% of us do), I just can’t call my SaaS “Linux Something”.

You can use all the ideas Tolkien used in your own creative work. You just can’t call them things he called them for now.

> I can't make something set in Middle Earth (I can't even say the word hobbit, ask D&D how that went), I can't write and sell my own Spiderman comics, I'd have a hard time writing my own Cinderella story without Disney breathing down my neck

There is no creative reason to do those things. The only reason is to commercially profit by piggying back off the big names. Copyright works as intended.
Look, like it or not, we all have to work with our HR apparatus. If I have the choice between running their department and keeping mine functional, I have to accept that they at some level know what they are doing. Not to mention, when your HR head has the JD, and you don't, what you think you know is outweighed by their credential.

Now, was I misinformec by an HR person during my time as a hiring manager? Maybe. But guess what, I didn't control their pipeline, and I had work to make sure got done. I'll definitely be adding HR people to my list of groups to talk to when interviewing companies interested in hiring for a hiring manager position though, because the sheer amount of hell that experience came with was beyond unreasonable.
Not sure what is controversial about the Great Oxygenation Event. Some submissions are auto-flagged for any reason like having astroturfing history, some people don't like the source (I flag a lot of The Register articles as it's a low quality tech tabloid prone to posting manipulative flamebait, in my opinion), some people think it's against the HN guidelines or not front-page-worthy for any reason.
Show HN: Dog Poo Golf
Would love to see the deleted predictions lol
Where do I go to downvote stories?
Good bye New York, good bye Washington
That's retiring 10 years early. I really enjoy my career, and I'd like to enjoy my retirement with a younger body.
Malfunctioning NYC AI Chatbot Still Active
Will disable beam search hurt performance on long form transcription?

According to the whisper paper, beam search is necessary to achieve good long form audio transcription performance.
Sorry yes I did mean databases, not the sort of formatting-only tables which are a bit of an odd thing out in the way they have the child text areas (cells) which aren't themselves 'blocks' and only allow basic font/text styling.
Unless I am mistaken. Is that really the case? Both 802.11ah and BLE Long Range operate at lower frequency and also lower bandwidth, higher latency etc. DECT-NR could do everything the two could but not the other way around.
Maybe read this to try to answer your own question?

https://news.ycombinator.com/item?id=39911733

Sometime I don’t understand HN. Such an informative article gets no traffic, yet people jump to a sensational article to discuss the very topic covered in details over there.
You don't always even need to move things out-of-county to do regulatory arbitrage. For example Uber and Airbnb.
Ask HN: Would you hire a private admin or exec assistant?
Can execs employ workers privately?
I would credit it much less if it corresponded less well with my observations over more than 20 years shopping weekly at grocery stores, mostly Giant and its predecessors, in Maryland.

My current local grocery store has been my local grocery store for most of those 20-plus years. I remember when it was still a Super Fresh. It was a better place to shop then, and had about twice the current staff, despite at that time being quite a bit smaller.

That Giant has hollowed out the workforce is not in question. The question has been why; I didn't know grocery workers here were unionized, but if the union here is as effective as the one I hoped to join in my own high-school summer job days bagging groceries, then this frankly makes a lot of sense as a reason.
Obviously, and nobody's disputing that or saying anything to the contrary.
he's been doing this for years with youtube videos accompanying his tweets i dont think hes here to sell anything
If you want to take the next step up in accuracy and cleverness, investigate the work of Mr. Runge and Mr. Kutta.
Everything 'he's' written reads like it's written by AI.
It's arguably less descriptive. "enshittification" only really says "things getting worse", whereas "Tease and Squeeze" describes the whole cycle.
The point of the store was to provide the appearance of conventional retail while being exclusive to "members". This would theoretically cut down on shoplifting and boost profits at the expense of shutting out marginalized people.
If I was making $300k+ annually and running out of hours in the day, I'd certainly offload admin tasks (responding to emails, booking appointments, minor errands, keeping track of schedules) to someone else.

One can dream!
So, if we squint, we see a single overworked engineer who couldn't get enough funding to keep his project going, and the project falling into disrepair, with knowledge lost after he is gone...

Now what does this remind me of...

(Yes, yes, he did get funding enough to actually build it, unlike many, and certainly had a lot of people working on implementing it... and yet, the analogy with an OSS maintainer seems a little too close)
No, you simply can. You just cannot piggy back off the actual names they used.
wow that is crazy attention to detail it must be so negligible but significant enough for the production
This post ignores the Lindy effect. Things that have been around for pretty long are likely to stick around for much longer.

For example, Unix, Emacs, or Firefox (Netscape) are likely to be quite popular 10 or 20 years down the line. The OS or the editor du jour is not.

This is a good rule of thumb for choosing what to invest your time in.
Eavesdropping on Security Camera via Unintentional RF Emissions