skysight-inc/HackerNews huggingface dataset:
> As a reference point, Western sanctions have largely failed to prevent Russia and Iran from acquiring semiconductors for drones

I’ve heard stories about whole businesses based in the Gulf states dedicated to helping countries like Iran get around US sanctions - stuff is ordered to go to country X, then as soon as it gets there, taken out of the box, put in a different box, and sent to country Y. If the US government knows it is happening they will halt the delivery, but they can’t always distinguish between legitimate shipments to country X and diverted ones. If I order 5 racks of servers, install 4 of them in my data center in Dubai, and load the fifth on to a flight to Tehran, how will the Americans ever know?
> No, there isn't. FOSS licenses makes devs complain because "cloud companies appropriate open source products"; SSPL license (or similar) makes devs complain because it's not FOSS (even if it doesn't affect them).

Yes, I do not see what is so bad about the SSPL. It does not affect anyone other than cloud companies. It is essentially like the GPL but stopping a workaround.
That's not what's happening. Bun has tests that are supposed to work on the platform, but currently doesn't.

Skipping tests from a Linux suite that doesn't make sense to run on Windows is very common. Skipping tests that should pass on a platform but doesn't just in order to cut a release isn't as common.
I believe pilot study here means: small-scale preliminary study, not vehicle pilots.
Tailscale has app connectors now. You can send all your traffic through certain exit nodes without doing any of this too!
GP means it's not what 'Airbus and their suppliers' intended; the regulation stopped them from intended redundancies, which ended up being an advantage but not by their hand, forced on them.
Your post reminded me of this: https://www.theonion.com/find-the-thing-youre-most-passionat...

I took the opposite path. I did actually do the other thing on evenings and weekends for many years. In my case I never dreamed that it would result in a job in the other field, but I’m 7 years in at the other field now and will never look back.
LOL im an idiot, thanks.
The main upsides I see are:

* you can pretend you don't need a proper sandboxing build system like Bazel, Buck etc. and stick to Make/CMake etc.

* you don't need to learn how to use sparse checkouts

It basically lets you avoid learning how to solve the problems you'll inevitably run into for a little while. Not a great reason, but it is a reason.
LOL. You're definitely in denial. You have no idea what I do but here you are telling me all about it. That's very rational behavior.

We can destroy the world in multiple ways, we continue to develop more, and many people are justifiably horrified by it.

You're absolutely right, tho, the ones who are in denial will definitely not be upset about it. Congratulations.
as a technical cofounder, i would highly recommend getting a business cofounder to handle fundraising, sales, and partnerships.

business/people move slow... you can't muscle your way through it. you need like 5 high-quality opportunities for 1 to close. so if you build something great, it will take just as long if not longer to develop a business around it.

you need to advance each side in parallel.

once you have an MVP, immediately start building for a customer
They also claim to do carbon capture for $250 per ton.
Emerge (YC W21) is hiring senior engineers to automate dead code deletion
Bellabot[0] comes to mind, there's also a startup doing Roomba-like bot that magnetically dock to specially designed shelves. Though, they don't sell for $250, so actual Roombas and ROS mods for "hoverboard" Segway clones[3] might be more cost effective.

0: https://www.youtube.com/watch?v=l1hQ5YTMJEw

1: https://www.youtube.com/watch?v=SdVglHOJgiA

2: https://github.com/hoverboard-robotics/hoverboard-driver/tre...
Compilers and programming languages tend to be under supported (or overcomitted?) for what it's worth. They're definitely not solo projects, but certain features and components can be basically that way.

I take some of the recent concern from the Rust community about burnout and such to be early stage discovery of the economic problems in maintaining nontrivial infrastructure as a common good.
Any overweight person. I gained 10% of my bodyweight in the last 6 months and I haven't felt better. (Mostly eating plants though.)
I hope I am wrong. All I've seen in the past year are incrementally better models even from the top labs. Open source models are barely usable.
He remains dead.

However, this article about him, and the behaviour of Boeing management at Charleston factory, is a pretty good eulogy. RIP Swampy.

https://prospect.org/infrastructure/transportation/2024-03-2...
Sounds like craft. Seems more likely to me an intentional misspelling of “craft” or related to the Kraft Foods company if you’re in the US.

Absolutely nothing about this headline had me thinking about consensus protocols.
I'm late to the discussion here, but I use shreddit. It edits and deletes all my past comments.

However I found recently there are websites that have every single one of my old comments accessible and I'm sure reddit itself does to. Once you comment it's there forever.
Small nit to pick, but in the introductory paragraph it reads "unauthenticated, targeted remote code execution." I recall that there was a special private/public key pair that made this exploit only reproducible by the author (or only possible after re-keying the binary).

I believe this means it was unauthorized, not unauthenticated.
The exact same App on android weight only a third of the size.
https://momspaghetti.ytmnd.com/

One of the greatest contributions to humanity was the conversion of ytmnd from flash to html5
Does that only work in Python though? What about compiled languages? You don't really want to have to recompile your whole project again for every line you change...
It is strange that cloud providers don't give back to open source. Even 1% of revenues would likely adequately fund teams. However, the aren't the only ones that are being "greedy". Eventually, someone will try to become a billionaire from a popular project (either the original creator or someone else). Capturing a fraction of revenue isn't enough for these folks.

I feel that a new license model is needed to incentivize better behaviors on all sides.
If I may as a founder - If you're looking for a tech cofounder - I think the business is already at risk.
> with sufficient money and hardware

Is making an assumption that hardware is not also facing restrictions.

> code and data is practically available

Disagree; although the base model data is, the RLHF data isn't.

This is also why 3rd parties are not able to replicate Google, despite all the PageRank patents having expired and the web being about as crawlable for Google as for, say, Bing.

> "median CS grad-student"

… is how I regard the quality of ChatGPT's code output, FWIW.
Also the attacker included in the 5.6.0 release the support for the long-awaited multi-threading decompression (and - broken - sandbox) making it very attractive to upgrade to...

It was probably a tactic to give a reason to upgrade. It's not always a fault for those who did or tried to do.
But for the comics' physical analogy to work you'd then need to draw it in thousands of dimensions so that any block breaking would bring down the edifice...
I've noted similar vulnerabilities in every common package management system, including NuGet, Cargo, and NPM. There are giant gaps in security a truck could be driven through.

Collectively, we must start taking the "bill of materials" that goes into our software much more seriously, including the chain of custody from source to binary.

Start with linking each package directly to the Git commit hash it came from.

Then a good start would be enforced reproducible builds. Don't trust the uploader to package their code. Run this step in the package management system from the provided source hash.

Pure functional build systems would be a heck of a lot better, with no side effects of any kind permitted. No arbitrary scripts or arbitrary code during build. No file reads, network access, or API calls of any kind outside of the compiler toolkit itself.

Then, I would like to see packages go through specially instrumented compilers that generate an "ingredient label" for each package. Transitive dependencies. Uses of unsafe constructs in otherwise safe languages. Lists of system calls used. Etc...

You're about to say that clever hackers can work around that by using dynamic calling, or call-by-name, or some other clever trick.

Sure, that's possible, but then the system can report that. If some random image codec or compression library uses any platform API at all, then it's instantly suspect. These things should be as pure as the driven snow: Bytes in, decoded data out.
A pure observer with no deliberate actions or impulse reactions sounds like it can most definitely be conscious.

Do we have to interact with it?
Even if positive sustainable fusion is developed, unfortunately at this point it is very unlikely it will be economically competitive, possibly it will not be competitive with even "new nuclear" fission, and it's almost guaranteed to be many times more expensive than wind and solar.

But it is cool!
We used to have a test (Turing test) that could quite reliably differentiate between AI and our own species over the medium of text. As of now, we do not seem to have a simple & reliable test like that anymore.
I share your concerns and think you're broadly correct. I think it's worth adding some nuance though.

When you drill into specifics there are almost always exceptions. For instance, in your example about sharing research, there are certainly some types of research we shouldn't automatically and immediately make publicly available like biological superviruses or software vulnerabilities.

I think the same can be said about AI. We should aim to be as open as we can but I'd be hesitant about being an open source absolutist.
A legit business guy can probably pay you.

If his "idea" is so valuable, he's not going to want you to take all the equity, he'd put his money forward.

If I'm putting more money forward than he (in terms of doing work for free), I'm also the money guy. If I'm both the money guy and the tech guy, who is he?
>Blue sky research

I’m not discounting fundamental research in the way you may be implying. I’m just saying it has little economic value until it has an application. By definition, it doesn't have an economically marketable use, so it can't have economic value.

I also don’t think China is overtaking the US on a research front. They publish a lot (although I would question how much 'blue sky' vs. derivative), but that’s a bad metric for a lot of reasons.
The Git protocol is also substantially more heavyweight than just downloading a tarball.

'Dumb' HTTP involves requesting `info/refs` which lists all the references (branches and tags) available. The client has to find the tag you want, then request the corresponding commit object. That lists the hash of the tree object, which has to be requested, and recursively the tree object references other trees and finally the file blobs.

Any object request could fail because the object isn't stored 'loose' on disk, but is instead in a pack. So the client first downloads `objects/info/http-alternates` to see if it's in a different location, then if that doesn't list anything, it asks for the list of packs `objects/info/packs`. Then it asks for the index of each pack to determine which pack contains the object, then finally downloads that pack.

Because that's very slow, Git also supports 'Smart' HTTP. That moves all the lookups server-side, with a back-and-forth between client and server about what the client has and what it wants, ultimately building a custom pack containing what you asked for. This obviously can't be cached.

In contrast a tarball is one request for one file on disk which is fully cacheable, both by the server hosting the file and any proxies on the path.

This is why things like `bower` and `DefinitelyTyped` got deprecated. Some of them were even hosting the registry itself as a Git repository on GitHub.
The listing says you'll be "self-employed". I doubt that contractors get equity.
Thanks! I wouldn't have guessed the sizes were so large for radar, and just assumed that in current era radar would have progressed to the point of even being able to not send pings at the rotating blades in sync with their rotations (ie always firing radar somewhere within the circle but only at the spots where the blades are not) the same way machine guns fired past propellers on WW2 (or WW1?) fighter planes figured out. But of course a bullet and a radar setup isn't at all the same thing.
Intended levity, gee you sound miserable. Try some exercise in the mornings?
Spot catches the people who can beat OpenAI on non-trivial stenography: sophisticated actors aren’t what this is about catching. They’re going to get away with some level of abuse no matter what. APTs? They can afford their own LLM programs just fine: some of them have credible quantum computing programs.

But a lot of propaganda is going to take place at the grassroots level by actors who can’t beat OpenAI, even one in decline, at breaking both watermarks and an adversarial model.

But the grand finale is of course, at this point how has OpenAI behaved like anything other than an APT itself. It’s the friendly, plucky underdog charity that’s now manipulating the process on making things illegal without involving congress.

That’s exactly how advanced actors operate: look at the xz thing.
Launch Smartly, Not Darkly. Seriously?
Launch smartly, not darkly." This slogan seems to be everywhere in Silicon Valley, with ads prominently displayed. But, is it genuinely the best approach? Upon closer inspection of the websites advocating for the "not darkly" approach, it becomes apparent that there might be some misunderstanding about what "darkly" truly entails. In reality, a dark launch means to roll out features quietly, without the target users' awareness, thereby reducing potential risks associated with deployment.

Certainly, launching smartly plays a crucial role as well, especially in mitigating bad user experiences. However, it's worth noting that the experiments which make your launch smart typically come after the dark launch phase. Yet, current market observations suggest that launching smartly tends to be more profitable than launching darkly. According to the Sequoia dev tool 2.0 graph, smart launch strategies rank higher, partly because both LaunchDarkly and Split.io include built-in experimentation features.
Agree, almost the same requirements for me. I would be okay with just 1, 3 and 5 though.
Korean Fusion Reactor Sets New Record for Sustaining 100M Degree Plasma
The author is much too self deprecating! IMHO this isn’t the dreaded “premature optimization,” it’s avoiding pessimization. I’d like to read them in their unrestricted voice!

Great article!
I wonder if netflix will make a movie from this story, if you read the timeline it really sounds like a well written thriller.
>You cannot just take one part of that system and expect to magically reap the benefits.

Yeah, specifically people only focus on the "repo" bit. Build system, PRs, history browsing, etc all get handwaved away after you stick all the code in a single repo. These are the extra hard parts though!

I think if you were to properly implement "monorepos" in git world it would actually look a lot like a Github _organisation_, rather than a Github repository. Each git "repo" in the "org" would be a workspace with it's own segregated UI so that you can for example check out just that workspace, or see only that workspaces commits or issues -- but some features such as github actions workflow triggers and PRs would be able to span multiple workspaces.

Github doesn't really seem to have put much thought into really supporting monorepos though. They have added some support (e.g. codeowners) to support "repo"-as-monorepo, but have also added some features that could go towards supporting "org"-as-monorepo (e.g. dependabot dependency updates and the dependency graph). But it all stops well short of a complete monorepo toolset.
When we moved to our current home two decades ago, there were a lot of honey bees (apparently visitors from the local apple orchard) and only a few bumble bees --- since then the apple orchard has been replaced by McMansions and it's quite rare to see a honey bee, but there are still a few bumble bees.
Meta: there used to be a semi-popular Usenet signature that quoted Vonnegut:

“To be is to do” — Socrates.
“To do is to be” — Jean-Paul Sartre.
“Do be do be do” — Frank Sinatra.

* https://quoteinvestigator.com/2013/09/16/do-be-do/
I didn't lift an eyebrow at the headline which is apparently an april fools joke.

But what is it that makes it so absurd that it works as a joke, which I'm missing? The size seems absurd (500GB) but why would the Debian source be 500GB?

To me it's in no way obvious that "Debian" would include any third party packages repackaged by the distro maintainers. Are Debian people maintaining N source repositories for third party code today, which would be the code merged into this hypothetical monorepo? Why?
Drilling into Antarctica's Past
Google Podcasts shuts down today, Apr 2, 2024
i've done this. i used to be the business guy. it works for a time, but not sustainable
* https://quoteinvestigator.com/2013/09/16/do-be-do/

Also, from the link:

“Dabba dabba doo” — Kate Bush

“Scooby-doobee-doo” — Scooby Doo

“Hey-boo-boo” — Yogi Bear
I'd like to think of it as a very obvious attempt at subtle marketing - graceful as a gorilla.
The end of Google Podcasts is in June if you're not in the US
Bankman-Fried speaks after sentencing: 'I'm haunted every day, by what was lost'
Add it to the pile over there
10% of the Top Google Search Results Are AI Content
The hobbyist market is pretty forgiving of repeatability issues. The Ender 3 introduced many people (myself included) to the 3D printing world and is known for its problems.
Yet organizations like these usually have entire teams dedicated to combating such things, governments have entire departments or full organizations tasked with finding and prosecuting such people, credit card companies/banks have internal investigators tracking down who's messing with their money, and countless books and movies have been created to tell the story of unique, hard to catch perpetrators of such fraud.

You'd be surprised what lengths people will go to avoid detection, and the sometimes genius people who are involved in money laundering or other types of wire fraud.

> Online job marketplaces such as Freelancer.com and Fiverr, which accept funds from clients and hold them in escrow to pay freelancers. A money launderer can post a token job on one of these sites, and send the money for the site to hold in escrow. The launderer (or his associate) can then sign on as a freelancer (using a different account and IP address), accept and complete the job, and be paid the funds.

https://en.wikipedia.org/wiki/Money_laundering#List_of_metho...
See also "Everything I Know About the XZ Backdoor" submitted 4 days ago but updated since then: https://news.ycombinator.com/item?id=39868673
Wouldn’t an attacker like JiaT75 do that to increase the odds of someone skimming it?
> A pure observer with no deliberate actions or impulse reactions sounds like it can most definitely be conscious.

Yes, but how can we know about the existence of such observer? There can be infinite number of such observers filling every cubic millimeter of our space, but does it change anything for us? Existence of such observer is as meaningless as orbital teapots [0].

[0] https://en.wikipedia.org/wiki/Russell%27s_teapot

Edit: a voice recorder without a tape and battery meets your definition. Is it conscious?
You have it backwards. The engineering culture that said autoconf increases attack surface, the culture that said that the design of PAM is too complex, that did not accept the patch to link libsystemd to sshd, is the one that constantly tries to avoid unnecessary dependencies.

The engineering culture that non-ironically suggests linking a JSON parser is the culture that disregards the challenges that maintaining dependencies brings.

Yesterday it may have been soups of automatically generated shell scripts, but today it is soups of automatically generated YAML and JSON.
Steve Wozniak Working on a Computer Prototype in the Famous Garage, 1983
Docker is a Linux thing, and very much not host-platform independent. It's just "chroot on steroids", and you're essentially just shipping a bunch of Linux binaries in a .tar.gz.

It works on other systems because they emulate or virtualize enough of a Linux system to make it work. That's all fine, but comes with serious trade-offs in terms of performance, system integration, and things like that. A fair trade-off, but absolutely not host-platform independent.
The argument then is also that monorepo allows you to use this as "shared modules" instead of published "libraries".

The point is you have some code that you want to reuse, and either within a monorepo or between multiple repositories.
I dont understand what you’re trying to say
he wasn't a founder, and they were a bunch of rich boys from harvard.
Absolutely correct that they are now quitting these promises.

I would go further. Entities which arent banks like blackrock or for that matter countries are also quitting these promises. Recently withdrawing from the United Nations climate alliance. Largely speaking blackrock's move to withdraw from these resulted in massive losses to the "ESG" indexes.

https://www.reuters.com/business/environment/germanys-climat...

Germany for example in a major energy crisis had to choose fossil fuels and sign on to multidecade contracts dispelling any thoughts they will continue with climate efforts.

Here in Canada, the next election is October 20, 2025 unless they can prove Canada has been invaded by a foreign nation or that there's an ongoing rebellion. They are even still obligated to receive approval from the conservatives(2/3rds vote) to postpone the election. Which I very much doubt will ever happen. Upon winning, the conservatives plan to scrap basically all climate initiatives especially the carbon tax.

Though the Canadian part of 'extinction rebellion' which really is just the same people behind the oil blockades in 2020 has asserted they will be forced to be that rebellion to prevent the conservatives from coming to power.

I wonder if the threats are legitimate.
That shouldn't matter, then; it should just result in a new release.
You are right, this is a time consuming and a genuinely hard problem to tackle.

I have not been satisfied with existing software, but I would be happy to find out otherwise.
Can they be interface directly with home assistant without wi-fi?
Compare potatoes. You can stop potateo with potateo.
Right, but the boolean is set by an autoconf script, is it not?
The main problems I see in 99% of the cases of a founder looking for a technical co-founder are:

1. The founder sees themselves as the ideas person but doesn’t have the situational awareness to recognize that their ideas aren’t that unique.

2. The founder doesn’t understand that the value in a startup isn’t the idea but the ability to execute and build on that idea. For every very successful startup in X space there were 10x more with the same general idea but that failed to execute. The founder wants someone to built it for them but wants credit/equity for having the idea. In 99% of cases the value is created by the builders (technical cofounder) which instantly creates awkwardness of the founder wanting far more equity, credit, and control than their contributions warrant

For the above reasons I’d avoid 99% of asks for a technical co-founder like the plague.