skysight-inc/HackerNews huggingface dataset:
I’m ABD in math for discolosure purposes. I strongly disagree with your recommendations if the purpose is to get an introduction to higher math. The book in question is much, much better for introducing one to higher math than any of the books you recommended.

Smullyan’s books are great but one isn’t going to go from Smullyan to abstract algebra, point set topology, or real analysis.
Hi, this is a high priority ticket and FFmpeg is used in highly visible products all over the world. We have developers working for free while trillion dollar corporations want urgent help from volunteers. Please help,

/s
> contribute over $1M to its annual budget

That on top of developer hours dedicated to various projects, which are probably worth multiple millions.
I worked with an old LJ 5siMX. It was a pain to set the static IP configuration but other than that, amazing. Printed a buttload of insurance policies for years, plus simple text reports improved with a few PCL commands. And a proper PS renderer, not a Win driver in sight. Bliss.
I'm not sure this is as big of a "gotcha" as you think.

You do realise that MS SQL Server is their rebranded Sybase SQL Server, which before Microsoft purchased, ran on Unix?

So the big innovation was to take Unix software, port it to Windows, and then spend time porting it to Linux?
They’re just going to put more dolphins around the pylons. They had a few already but they were poorly placed and had an opening a container ship could slip through.
There's a lot of excellent discussion in the comments on who should ultimately pay.

One interesting aspect: if insurance gets too high, it incentivises corporations themselves to be the insurer. I mean the literal corporate limited liability.

Would they not be incentivised to put each major asset into its own corporation, and in the event of a major loss that corporation becomes bankrupt?
No. But there are some cases where 20% could affect consistency of product. One thing that comes to mind is hollandaise sauce and similar sauces. Where ratio of fat to other stuff could change consistency. But then we don't exactly measure eggs so it is bit moot...
Good question. Embedded systems are harder, sometimes impossible, to upgrade, and there are chances a backdoor in a small board inside an appliance that doesn't offer easy physical access could take years before it is found and removed.
it makes the Liberian Burman American fusion cuisine chefs happy and thats all that matters
GenAI means Generative AI, not General AI.
Tagged templates[0], the language feature that enables this, were introduced in ECMAScript 2015 apparently – arguably at least somewhat new in the lifespan of JavaScript. :)

Java is getting a similar feature with template processors[1], currently in preview.

It would be nice to have it in Python as well – i.e. not just f-strings, but something that (like tagged templates) allows a template function process the interpolated values to properly encode them for whatever language is appropriate (e.g. shell, SQL, HTML, etc.). Apparently someone is working on a proposal[2], although there doesn't seem to be much recent progress.

[0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

[1] https://openjdk.org/jeps/459

[2] https://github.com/jimbaker/tagstr/blob/main/docs/pep.rst
decompressing gcc.tar.xz which contains foo.png followed by main.c, the decompressor is instructed by the hidden data in the png how to alter the code.
> Are software developers (finally?) going to remove dependencies(now proven to be liabilities!), causing months of refactoring and rewriting, without any other progress?

We've been here before, with e.g. event-stream and colors on npm. So I don't think it will change much. Except maybe people will stop blaming it on JS devs being script kiddies in their mind, when they realise that even the traditional world of C codebases and distro packages are not immune.
I'm not sure why the downvotes. That seems to be a statement of fact.

You can do a certain amount of identity obfuscation online but for anyone with a real professional profile you're generally not really anonymous if anyone really cares to find out your true name.
It really depends on a lot of variables; experience, location, ingredients, season, taste.

Starting out it's good to learn measurements then you can advance to cooking with proportions and tasting your ingredients to see what works.

As you mentioned this is more important in baking, confectionary, things that require specific temperatures etc. Try tempering chocolate w/out a thermometer or baking a croissant 'on instinct' and it'll be a bad time :)
> I wouldn't post anything on Facebook (or on social media generally) that could be professionally embarrassing

The age of self censorship :)

I don't post anything on my FB. I'd still reject any employer who wanted to take a look.
Next headline: New Swiss Maritime Regulations for Safe Container Ship Navigation
My Taiwanese cab driver today in Los Angeles said the CCP made the earthquake

Where can I read/watch more about the unfalsifiable theory on an otherwise natural process
Presumably the ship manager, and everyone else onboard, should only be liable if they did something wrong. If the vessel lost power and they followed all standard procedures, acting responsibly and simply couldn't avoid the collision, they did their jobs and shouldn't be financially or legally liable.
> everyone real would have something like a Linked In page, Facebook, Twitter, Instagram, or better, their own website with stuff that could be used to ensure they're a real person

Have you seen the campaigns people have run building fake LinkedIn profiles and slowly adding “connections”? There was one a few years ago which roped in a lot infosec people who should have known better and it’s gotten much worse with AI generators. Even before LLMs what you described would have been a godsend for intelligence agencies - who has more time for it, an open source developer writing actual code or the dedicated social media team at the IRA? – and now that’s increasingly worse.
I respect their choice of license. Totally agree they shouldn't let Redi$ take their work after what Redi$ have done. But still let any kind of project use it, including cloud vendors. Downside is that Valkey won't be able to use Redict code, though.
The thing is they only need one member sometimes, to observe what is in use.

Example scenario: "malicious engineer in say Microsoft, finds out that office365 is using xz internally and the library is pulled directly without code review. Same engineer or another member of same group would be that Jia Tan doing the necessary backdooring in xz to target office365. And bam all worlwide Office365 accounts would be backdoored."

I am not saying Office365 is using xz, I have no idea really, but this would be a possible scenario. I know MsTeams is using ffmpeg for example.

So I think having this discussion while only scoping linux distributions is a big mistake. xz project was particularly interesting as a target as it is distributed under BSD zero-close license, which is pretty much a public domain license. You don't have the attribution part of the BSD license so there are probably myriads of proprietary software using it too without them acknowledging it.
Every carpenter I’ve met uses sixteenths of an inch, and every metal worker uses thousandths.
> that Odysseus lander seemed liked a pretty dumb design

It was built thin and tall to fit within the Falcon 9 fairing. It didn't have extending legs because these would have become possible points of failure. The crash happened because the altimeter wasn't working, which IIRC was due to a pre-launch assembly error. As a result Odysseus landed outside the safe operating parameters of the landing legs.
doable yes, but what seems to me like a strong indication is the duration, multiple years, and the effort to set up a quasi patch infrastructure for the backdoor which I can't remember ever having seen in some amateur or ransomware hack.
I have also thought of doing that, and that can be solved using RAG.

Agree that Slack search is terrible.

Even just having vector embeddings for search would already be huge.
Also:

* Some ingredients have different names in different countries

* We should probably specify the animal, rather than just writing 'milk' and 'eggs'
I'm now using "recipe for X, for N people, metric units" all of the time.
Dolphin-2.8-mistral-7B-v02
So, in the world where there isn't a ban, what happens that is better? I assume that EVs remain more expensive in both worlds?
Thanks! We are using SourceCred atm to measure contributions within a PageRank style, and we are planning to add qualitative heuristics with AI on top of it, exciting times ahead!

You can check this post that outlines our vision a bit more: https://mirror.xyz/sudoferraz.eth/sF442aT0HD9OhcUQMFCo9Z-eNw...
> We, particularly those us who work on critical infrastructure or software

We should also be asking ourselves if we are working on critical infrastructure. Lasse Collin probably did not consider liblzma being loaded by sshd when vetting the new maintainer. Did the xz project ever agree to this responsibility?

We should also be asking ourselfs if each dependency of critical infrastructure is worth the risk. sshd linking libsystemd just to write a few bytes into an open fd is absurd. libsystemd pulling in liblzma because hey it also does compressed logging is absurd. Yet this kind of absurd dependency bloat is everywhere.
Weight also opens up question. Is that pre or post preparing? Like removing parts or skins and so on?
> And I am 100% certain that most of their dev teams do not spend time scanning these for obscure injection vectors.

This rationale baffles me, it feels that the dependency-hell circlejerk crowd is working on making OSS maintainers look even more bad with this scenario.

Any given commercial operation that claims any credibility for itself does supply chain analysis before adopting a dependency. This is, among other things why ordinarily you'd pay RedHat to maintain a stable Linux Release for you and why projects such as FreeBSD severely limit the software they ship in the default install.

If you are affected by this mess, I'm sorry to say, but it's your fault. If you are worried about developers of software you use for free, as in free beer, going rogue, either put in incentives for them to not do that (i.e. pay them) or fork the project and implement your own security measures on top of what's already there.

If you're worried that you could encounter exploits from dependencies in commercial software you use, you should negotiate a contract that includes compensation from damages from supply chain attacks.

If you're unwilling to do that, sorry mate, you're just unprofessional.

Inb4: Yes, I am really trying to say that you should check the supply chain of even your most basic dependencies such as SSH.
You're talking about how to value the boat owner making an insurance claim (if their policy does indeed match your assumption), whereas I was talking about (and the court filing is about) a different equation which calculates what the current value of the boat is. But I'd also hazard a guess that their insurance policy does not cover this accident for some reason - because if they know their insurance policy is about to turn the boat back to its $90M value then surely this court filing claiming its new lower valuation estimates would be fraud?

Edit - actually the document does talk a bit about insurance on pages 10-11, but I don't think I understand it in the context of their claim lowering the value of the boat:

"NOW, THEREFORE, in consideration of the premises, Stipulator, The Britania Steam Ship Insurance Association Europe, an entity organized under the laws of England and Wales, hereby undertakes in the sum of $43,671,000, with interest at the rate of 6% per annum thereon from April 1, 2024, that if judgment is awarded against either or both Petitioners, such judgment may be entered against both Petitioner(s) and Stipulator for the amount not exceeding the aforesaid sum and interest.

Stipulator, The Britannia Steam Ship Insurance Association Europe, hereby submits itself to the jurisdiction of this Court in connection with this Stipulation and agrees to abide by all orders and decrees of the Court, intermediate or final, and to pay the amount awarded by the final judgment or decree rendered by this Court. If the final judgement or decree is appealed, Stipulator agrees to pay up to the principal amount of this undertaking, with interest at the rate of 6% per annum, unless Petitioner(s) pay such judgment or decree or, in the meantime, the amount or value of Owner's interest in the Vessel and its pending freight in connection with the voyage shall have been paid into Court by Petitioner(s) or a subsequent approved Stipulation for Value thereof shall have been given, in which case this Stipulation shall be void."
In fact, this seems to link to an even newer version of the text.
You're trusting millions of people just to be able to write this comment.
If systemd could deny liblzma any syacall or filesystem access, that would have prevented it. It is only used to compress a data stream, it only needs read access from one buffer, and write access to another. I realize there is no current mechanism for these granular permissions, that is what I was proposing be addressed.
But chemistry requiring fairly strict ratios need not imply you can use the same amounts of ingredients every time.

For example, recipes using fruit often require water that partly comes from the fruit. Use older, drier, fruit, and you’ll need to adjust amounts to keep the effective ratio the same. Maybe add a sip of water or milk, use less starch to bind stuff or heat things a while shorter.

Temperature and humidity of the air also can affect what the ideal ratios are.
> Do Europeans (outside of baking) really do this?

Do you take out a scale when you need to add an ounce of something? Same for 100g, when you're accustomed to it. For me it depends on which ingredient I'm working with.
There are organised crime networks which buy 0-days to run ransomware, and actively target companies to do it.

Why couldn't this be an attempt at finding or selling exploit access on the black market?

The problem here is no one is looking properly at the scope. It's more then trivial so everyone is leaping for "nation-state" as though that's the only threat actor with motivation and patience.
I read an analysis that creates a profile, but that's as far as public information goes at the moment.

https://lunduke.locals.com/post/5467061/xz-backdoor-i-did-a-...
> What happened to the alpha and beta testers?

They're called customers =)

Of course they won't release it 100%, they'll do a limited rollout and see if something blows up.
I found them to be good for terminating Canada and US calls but the international routes sound like crap (barely intelligible) even with premium routing. I would recommend them if you’re calling numbers outside these countries.

I also don’t think they can be depended on for business. They’ve probably learnt a lot from their ddos a couple years ago but they were down for weeks as a result. As a customer you couldn’t place calls for the entire duration.
I have ADHD too, and I do notice small things like that, too. Most people I've talked to that are not autistic, though, cannot even hear any background noise when it's quiet, even if they try. It's as if their brain completely filters it out. But my brain's filters are defective, so.
I recommend to read a book (sorry not connected to history) written by Kōnosuke Matsushita - founder of Panasonic - My Way of Life and Thinking
The same incentive is there even if money did not exist. Providing services to someone (who is likely to be unable provide equivalent value in return) is more costly than not providing them. That is simply reality/math?
Code is law. As such, the "standard way" you mention is appropriate for people with zero strategic foresight. There is no absolute need to depend on third parties to solve your problems and the possibility to limit and disperse trust to mostly yourself is real.
Sure, glowies can always get to you but they can't get to you everywhere nor all the time.
Security/Assurance models and both proprietary and free software architecture are already adapting to such facts.
These are the Signs to Know if Your Bank is Facing Distress
> But Christianity is not just a useful lifeboat for stranded intellectuals.

An intellectual need not be stranded, nor if stranded be in want of a lifeboat… but it’s entirely possible for it to “just” be a useful lifeboat if that’s all one needs of it.

> If it isn’t literally true, it isn’t valuable.

It can certainly be valuable without being true. Or, to be more precise, if valuable at all then it certainly must be valuable without being literally true, because what it certainly is not is literally true.

> Whether Jesus Christ actually rose from the dead matters.

To those who have predicated their meaning on that fact. It’s perfectly workable to have meaning without it.

> It mattered to St Paul.

Who never met Jesus in person, and who Jesus never said or implied Jesus would appear to.

> ‘If Christ has not been raised, your faith is futile; you are still in your sins.’

Ahh, good old Saul of Tarsus… always and ever skewing the word to reflect the meaning he wants it to have.

> And it should matter to us.

No, it should not. It could do, but should is an overstep unless the literal truth of any and every other religious text “should” also matter to us.

> C.S. Lewis wrote

… absolutely nothing of moral value to anyone not already smoking from the same weed.
While ounces are the same, fluid ounces are different!

> An imperial fluid ounce is 1⁄20 of an imperial pint, 1⁄160 of an imperial gallon or exactly 28.4130625 mL. A US customary fluid ounce is 1⁄16 of a US liquid pint and 1⁄128 of a US liquid gallon or exactly 29.5735295625 mL, making it about 4.08% larger than the imperial fluid ounce.

https://en.m.wikipedia.org/wiki/Fluid_ounce
No, sometimes one or both of my ears will suddenly start ringing for a few minutes and that would be tinnitus. But this seems to just be inherent to existing.
The US spends $30-60 billion a year on agriculture and subisides [1]. This is controversial for all the obvious reasons. Without subsidies we'd waste less food but overproduction of food is an intentional objective of these programs. Why? Because if there's a major drought or crops are lost to ice or snow or flooding, Americans won't starve. It's why we have things like the US government having a reserve of over a billion pounds of cheese [2].

People not starving is a national security interest.

It's getting to the point where the software we rely on is also a national security interest. The US government should be paying to maintain and improve this software. Security risks in Linux and core packages threaten to shut down key infrastructure.

Paying developers to maintain open source projects that are actually used could be an incredibly effective use of tax dollars.

[1]: https://usafacts.org/topics/agriculture/#581290c9-a960-49aa-...

[2]: https://www.deseret.com/2022/2/14/22933326/1-4-billion-pound...
The reason Americans use cups and spoons (instead of e.g. grams) to measure ingredients is a matter of history. Tradition says Fannie Farmer wrote the "Boston Cooking-School Cook Book" in 1896, and for the first time in a cookbook used precise measurements (instead of "a jigger of this" or "a pinch of that") to specify how much of each ingredient to use. Nobody at that time would have a weight scale in their kitchen, so Ms. Farmer measured her proportions using tools which were readily available in any kitchen -- cups and spoons.

https://en.wikipedia.org/wiki/Fannie_Farmer

Her cookbook achieved immediate success and she became a household name in America. Even I had heard of her, long before I became a feeble student of history. Her measurement system is totally entrenched in American cooking culture, so I expect it won't ever be displaced by metric measurements except perhaps amongst high-end commercial kitchens and with people who want to make the effort to convert to grams and liters when cooking.
Protecting sleep is indeed crucial for overall health and well-being yet sometimes impossible to do
https://www.schneier.com/blog/archives/2024/03/ross-anderson...
Yeap it's interesting. Redis starts as a hobby project by Salvatore Sanfilippo (aka antirez) who eventually gets sponsored by VMWare as the project grows in popularity.

Then, another company that is offering a hosted Redis and support hires antirez and so becomes the 'offical' Redis company.

In 2020 antirez leaves and goes and writes a novel (called "Wohpe") instead.

https://en.wikipedia.org/wiki/Redis_(company)#History

Antirez hasn't been involved in Redis in a long time.

This is a common enough pattern when open-source projects leave their roots and then, eventually, alienate theiropen source base. Perhaps the time is ripe for Antirez to come back and shepherd one of the forks, a bit like mariadb?
The tokens are just aligned signals to communicate between people.

So they appeared through bruteforce to enable communications between people.

For example initially there were species that spewed out tokens randomly, then some of those tokens got assigned to indicate danger, and other members of those species got aligned on that due to natural selection, evolution and neural networks. More complex things got built on top of that due to environmental and survival pressures.
Self-censorship is probably a good thing in many cases. And there are certainly things I don't care to share in writing on any public or semi-public medium.

But I agree that even if I can't keep an employer from sleuthing generally, I don't consider Facebook part of my professional record even if there's nothing on there I'd have a problem with a co-worker or potential co-worker seeing.
Well, the identity of who's behind it can be left to the imagination of the authors.

I think it's reasonable to think that behind this attack there is a well organized intelligence agency of a big country, so the author can choose the one that they likes more.

Or, even better, delay the issue to the season 2 :D
New Unix Implementation (1983)
got to admire the ambition - he just says what he's going to do and then he actually more or less does it "Starting this thanksgiving I am going to write a complete Unix-compatible software system called GNU...".

I would have been like, really??

https://olduse.net is very cool
Training and Advice Can Speed Cross-Border Payments and Cut Costs
I read the post and it’s not clear why it’s not MIT licensed. Why not allow attempts to “create proprietary distributions?” That’s what open source would allow, no?

I honestly do not see this as being different than Redis. Do BSD or MIT and be done with it.

It seems needlessly ideological. Everyone wants to call their stuff open source but have strings attached.
> In the summer we use Fahrenheit and during the winter it's Celsius.

News to me, as a Canadian. I agree with everything else though!
>One compromise there and it is game over.

Consider that every agency like the NSA, and private groups like the NSO Group (authors of the Pegasus spyware) already sit on a pile of unpatched vulnerabilities, for various systems. If one vuln in systemd is game over, then the game is already over. And if what we currently experience is the game over state, then it's manageable.
Location: Paris, FR. / US

Remote: Ideally Yes, but can go to office for a few days a week.

Willing to relocate: Yes

Technologies: Python, PyTorch, TensorFlow, Python, Transformers, Flask, FastApi, Chroma, Pinecone, Langchain, SQL, Git, Docker, AWS.

Résumé/CV: https://drive.google.com/file/d/1nntZfzMrLV_TdlLG_Sxq27ElEU-...

Email: bogaforlife@gmail.com
You could link it to congressional/senate salaries. Whenever they want a pay raise because of 'rising cost of living' or whatever - minimum wage goes up the same amount.