skysight-inc/HackerNews huggingface dataset:
Makes sense, if I was Apple I wouldn’t want to emphasize the “code” part of Xcode either.

I’ve used a lot of IDEs in my day, and it was hands down the worst.
Key Bridge Response
I found this much more useful and informative than the news site updates.
Location: Esslingen, Germany
Remote: Yes, or hybrid.
Willing to relocate: No
Technologies: Python, JavaScript, TypeScript, Go, Solidity, React, Next, TailwindCSS, SQL, NoSQL, Vector DBs, LLMs, PyTorch, CUDA, Hugging Face, Transformers, TensorFlow, Keras, pandas, scikit-learn, Selenium, Docker, Kubernetes, AWS
Résumé/CV: https://www.linkedin.com/in/jonas-litardi-neri/
Email: litardineri@gmail.com
Maybe I am missing something,but it sounds like the features the author is looking for could be part of an OS, not a language. For example:

> An example is that a hash table lookup function should be unable to connect to the internet. That way the function can be used without fear of it becoming a liability if it contains bugs or its source code is manipulated by an attacker.

Reminds me of OpenBSD's pledge [1].

[1] https://man.openbsd.org/pledge.2
They already have good videos of thefts. Wheel locks have been around forever. I can just _tell_ you where all the stolen carts "end up."

None of this has an impact on theft; however, it does a great job of making me feel like I live in a prison.
I'm not confused about it. I never said Collin is legally liable to help. I'm talking about societal obligations here. Just because you do something for free doesn't mean your actions don't have consequences.
I think the common usage of bash and other languages with a dense and complicated syntax is the root problem here. If build scripts were written in python, you would have a hard time obfuscating backdoors, because everyone would see that it is weird code. Bash code is just assumed to be normal when you can’t read it.
I feel like the article misses the point, tho. The xz attack didn't happen because of an unsafe language, but for it's legacy build tools and social engineering. The relevant backdoor part about patching a vulnerability into C code, could just as well have been skipped/changed for another form of persistence/RCE. In the end, the original sin of breach was smuggling and execution of the malicious build script and payload, if I understand correctly. I don't see how a capability sensitive language would have prevented this, assuming the build environment remained the same.

Of course certain features of a language are exploited, but for a supply chain attack, I think the real vulnerability is complexity, neglect, carelessness, social pressure and (arcane) code beyond immediate comprehension. Since, before any malicious xz code was shipped, the human element was manipulated and exploited. The same pull request about the introduction of IFUNC, could have been about extending capabilities for another made-up reason. The same exploitation of trust, which allowed packing malicious scripts, would have allowed for... well, packing malicious scripts.

With the xz backdoor, the vulnerability was large chunks of infrastructure being the burden of a single human. I really don't see how this attack dynamic could have been prevented by language design alone. Sure, you wouldn't attack a compression library, if capabilities were tight. You would attack the neglected privileged code base elsewhere...
We don't just look for oxygen. For instance, there was some excitement a few years back when there was a tentative observation of phosphine in Venus's atmosphere.

To have a good biosignature, you want a signal that cannot be explained by anything other than life. Of course, that means that there might be planets with life that we do not notice, because all of the observables we have access to have an abiotic explanation. Not much you can do about that other than a bunch of science.
Decathlon has the same
And look at the state of the world with all our interventions. We may be "a part of nature", but the things we do to it are definitely not natural. We're the only ones doing collectively irreparable harm, so as not to be at its mercy.
The original Bradford pear tree was ideal for planting because it was thought to be sterile in that it could not reproduce. -- TFA

John Hammond: There you are. There. They imprint on the first creature they come in contact with. Helps them to trust me. I've been present for the birth of every creature on this island.
Ian Malcolm: Well, surely not the ones that have bred in the wild.
Henry Wu: Actually, they can't breed in the wild. Population control is one of our security precautions. There is no unauthorized breeding in Jurassic Park.
Ian Malcolm: Uh, and how do you know they can't breed?
Henry Wu: Well that's because all the animals in Jurassic Park are female. We've engineered them that way.
Yeah, I remember it as a kid. But it surprised me when they brought it back because people rarely used it. I still don't really get the point of it tbh, scanning items as you pick them up just spreads out the faff of scanning things and slows people down in the aisles.
I meant as opposed to wooden pencils
> They don't need any proof of intent. Even regular errors can be prosecuted.

In Common Law jurisdictions, there's no intent required for prosecution of alleged theft, but there absolutely is intent required for conviction! Anything else is a miscarriage of justice.
That makes me think of some bamboo eradication advice: You allow new growth to progress so that it consumes energy from the tricky root system, then cut it before the fresh sections can provide much in photosynthetic return-on-investment. After a few years of losing calories with each attempt, the plant runs out.

That might only work for plants with "bursty" regrowth though.
The real problem is for non-technical users who don't know about all the settings, and view their notifications as "tasks" they must complete. This isn't dissimilar from unsubscribing from emails.

The two solution proposals in this article already exist though. (1) You can swipe notifications to the left, tap "options", and turn them off or modify settings - a Tinder-like experience. (2) Apple requires that developers ask users whether they want notifications or not before they can send a user notifications - so unless the user turns them on, they won't get notifications.

Most of the dark UX practices come from the app developers themselves, who choose to spam their customers with batches of notifs without building in transparent opt-out features. Products like Braze make this more prominent.
The number of people willing to pay bmw prices for a golf cart seems to be smaller than some predicted.
There was a startup, Standard Cognition, that offered the same experience, but I checked their website (https://standard.ai/) and it seems they have given up on it too.

Edit:

Looking over their marketing videos now and taking a more optimistic approach, is "just walk out" technology all that useful? It seems they pivoted to a product where is much clearer what the value add is (Predictive analytics, loss prevention, context-aware marketing). I imagine "just walk out" technology was likely pretty expensive to implement, but wouldn't have saved much more that self checkout.
Maybe the lesson here isn't that "it didn't work", and more so "it wasn't economically efficient"
I can and am claiming that Ansar Allah is doing all of this in Yemen and more. The Houthis have killed an order of magnitude more people than Israel has --- which is saying something, because your opinion of Israel's actions in Gaza is not far from my own. Read up about the Siege of Taiz, which includes a deliberate starvation campaign, for a very recent example.

The term "campism" was literally coined to describe the rhetorical habit of claiming that the Soviets held some kind of moral high ground owing to their (supposed) opposition to imperialism.

Not for nothing, but the Houthis are closer to the Nazis than they are the Soviets. They're an explicitly race-supremacist movement!
> The xz debacle happened partiallybecause the generated autoconf code was provided.

The code was only provided in a roundabout way that was deliberately done to evade manual inspection, so that's not a failure of checking in generated code, that's a failure of actually building a binary from the artifacts that we expect it to be built from. Suffice to say, cutting out the Turing-complete crap from our build systems is only one of many things that we need to fix.
That seems to be largely grasped at straws and connecting dots without reason.

For example oss-fuzz was building xz by cloning the github repo directly. There was never a chance for oss-fuzz to discover the backdoor, because only the tarball had it, not the repo itself. So that oss-fuzz PR might genuinely just be a genuine thing unrelated to the backdoor.
The Rivian S-1 document filed with the SEC said that Ford built all the non-electronic stuff for them until they could do it themselves.
But you're using shadcn components, which are open source. Everyone has access to those components. I don't understand how you will be differentiated
It would only take a very small fraction of the population to care and change everything. The small fraction that profits from the polluting industries and uses those profits to maintain the status quo.
Enforcing permissions at dependency boundaries would be the ultimate goal, but trying to separate first-party code from third-party code within the same thread is a herculean task (if I pass a callback to a dependency, which permissions does it run with for example), and you can't really lean on JS engines to do the heavy lifting, because they weren't designed with that threat model in mind.

The best you can do currently is run your dependencies in a Worker, and enforce permissions programmatically for the worker [1]:

For example:

new Worker(import.meta.resolve('./worker.js'), {
type: 'module',
deno: {
permissions: {
net: ['news.ycombinator.com'],
read: [new URL('./sqlite.db', import.meta.url)],
write: false,
},
},
})

This isn't perfect by any means, and you shouldn't rely on it like a silver bullet, but if given the choice I'd rather have permissions in my security toolbox.

[1] https://docs.deno.com/runtime/manual/runtime/workers#specify...
Could be interesting as a class project to investigate other small relatively innocuous but near ubiquitous projects that could be treated the same way and investigate whether something similar could be done or has been done already. Just making a list of them would be useful if nothing else.
Fair, but today it could probably run 30FPS full-screen at 2K resolution, without any special effort, on an average consumer-grade machine; better if ported to take advantage of the GPU.

Moore's law may be dead in general, but computing power still increases (notwithstanding the software bloat that makes it seem otherwise), and it's still something to count on wrt. bleeding edge research demos.
A Pi draws somewhere under 10W at peak, probably significantly under that most of the time. That’s about 87kWh per year, worst case.

Something like $8-16 dollars depending on how incompetent your power company is - well under the threshold for anyone who knows how to do this kind of work to worry about. Again, worst case; I’d bet you can do constant listening half that.
Maybe that's the point of this research. Hey look, we reproduced the way to game the stats a bit. I really can't tell anymore.
Right there with you. It's really tempting to blame this entire thing existing on m4 but that's the trauma talking.
Sounds like a cushy job for three-letter-agency employees, block the flaws your adversaries add and go soft on the ones your own agency added, or at least slow down the process of catching it.
By population, bacteria are fitter than we are
You're missing another category.

True, but not serious, positives. Take the following example.

Right now in your brain you have a small cancerous lesion. If you don't know about it, your body will heal it and you'll never know that you had it.

But, if I show you a picture of it, suddenly you're filled with stress chemicals causing your immune system to work poorly. The cancer grows into outwardly detectable illness. You now require treatment for a deadly illness.
Yeah, exactly. 'Burning' itself being a holdover from PROMs, where you'd literally burn certain fuses in the array to select bits.
You're right - the cheapest thing uniqlo sells are $5 pairs of socks.

Their $15 shirts are the next cheapest thing they sell, I'd imagine.
Russia and China would never extradite for this, they would hire the people involved if they aren't already in their employ, and I wouldn't blame them. I'm not even sure if they could be charged with more than misdemeanor charges anyway.
Discord showing ads to paid users
Thanks for the feedback here! My apologies if this came across as FUD. So let me clarify, Debezium is proven. Many large companies use Debezium for production/enterprise grade CDC. So it is indeed a great piece of software!!

However, higher Capex and Opex costs to put Debezium to prod is one of the common problem we've heard from Postgres users.

This is indeed related to the learning curve: One issue we've heard is the emphasis on command-line interface (vs UI) which provides a bunch of options for configurability but makes it complex for a first time (average) user to work with. There is Debezium UI, but that is not the default recommendation (and seems to be still in incubation). At PeerDB, we are trying to address this by working on a simple (yet Advanced) UI and Postgres-compatible SQL layer (for more complex pipelines) which we believe is more intuitive than bash scripts.

Disclaimer: PeerDB is still in its early stages, and we have yet to support the full range of configurability options that Debezium offers. We may encounter same challenges as Debezium related to learning curve. However, we plan keep "Usability" as top priority while building software. So far, with a few production customers, the direction we are taking seems positive.

In regards to formats, we have a few users who wanted Flatbuffers/MsgPack (binary JSON) formats and it wasn't trivial to setup with Debezium. These are users who haven't worked with Debezium before but after few days of effort, felt that it wasn't very easy.

Thanks again for the feedback here! And apologies if my comment came across negative. Thanks for probing me to clarify what I meant. :)
This is super neat and I am very interested!

I'm in a rush so I can't look to closely now but I have a few questions (and please forgive any stupid questions, I'm not a graphics dev, just a hobbyist):

What's the runtime like?
Is there an event loop driving the rendering? (who calls the `render` on each frame? are there hooks into that? )
FFI story?
Who owns the window pointer?

I'm interested in audio plugins, and VSTs (etc) have a lot of constrains on what can be done around event loops and window management. JUCE is pretty much the de-facto solution there, but it's pretty old and feels crufty.
> What would that accomplish? It certainly wouldn't have stopped this attack.

We could write an entire PhD thesis on the number of dire technical failings that would need to be addressed to stop this attack, so while this alone wouldn't have stopped it, it would have required the actor to come up with another vector of code injection which would have been easier to find.

> Only if you forbid bootstrapping

Codebases that bootstrap are the 0.1%. Those can be built via `bash build.sh` rather than deceptively hiding a Turing-complete environment behind a declarative one. Even if you need to have these in your trusted computing base somewhere, we can focus auditing resources there, especially once we've reduced the amount of auditing that we need to do on the other 99.9% of codebases now that we've systematically limited the build-time shenanigans that they can get up to.
Agreed, granted I'm over 50 so get off my lawn but "busy-dizzy" is how the Discord UI makes me feel.
> It’s an organization created by a national government.

Why? What about this requires the power of "government?"

> Obviously, more nations than one could have an OSQI.

Contributor agreements are about to get way more parsimonious and annoying.

> There would be no suspicion that your employer is trying to enshittify anything

Nation states use software and knowledge of zero days to commit espionage against each other. He can't be serious with this.

> Yeah. Except for, I no longer speak with the voice of a powerful employer.

Yea, but you speak with the same tone.
No, it's not proprietary.

End users are not restricted from modifying it and sharing their changes, so long as it is not for a commercial purpose. Therefore, it is not a monopoly to share and modify and not proprietary.

And the fact that you and others won't is exactly why xz happened and why we might lose FOSS completely.
I'd sometimes use my Android phone as a webcam by running an app like "IP Webcam" that exposes a video stream of the camera feed and then using the video stream as input for ffmpeg.
I played around with Zitadel. It looked a bit too confusing with too many UI options in it.
My tech stack is this: React on frontend, NestJs on backend, React Native for mobile app (this is currently not in scope, so my playground at the moment is web app and backend).

Then I went to structure the Zitadel like this: 1 Organization has -> 1 Project has -> 2 Application.

Applications:
- 1 User Agent (this I use on React side, I guess?)
- 1 Web app (this I use in NestJs, I guess?)

And both applications have PKCE flow as Authentication Method.
Then I check the API for application type and it has only Private JWT authentication method.

Can I have then 1 Web App/User Agent and 1 API application?
or 1 Web App and 1 User Agent?

And if I use API application with private key JWT, what should be the auth method for other application?
Modern GCC (AFAIK) can't target the 8086 or 80186 or 80286; does that disqualify it from being described as an x86 compiler?
Says the temporarily embarrassed millionaire
When I see an idea like this funded, I always feel they raised based on founder's strength.

It seems this is the case. One of the founders seemed to build a few successful apps in the past.

The idea is okayish. It is useful for sure but the space is crowded with tons of alternatives.
You can't avoid having to have binary blobs of data. And again, GP was talking about closed-source drivers, not specifically the xz attack.
And, from the other end, research demonstrations tend to have a lot of low-hanging fruits wrt. optimization, which will get picked if the result is interesting enough.
Uniqlo in Orlando also does this. Wonderful system.
Decathlon in the UK has the same thing. You just drop everything in a bin near a till and it "magically" knows what you've put in.
Hacker News strips leading digits targeted at "listicles" (e.g. "10 ways to fizz buzz" -> "Ways to fizz buzz"), so tricks are required if the digits are actually important.
What never made sense to me with their go stores was why a store that only needed 1-2 people max to operate had such bad hours. Hearing now that getting the bill is a mainly manual process i guess their hours had to line up with their data entry team in india so people could get their recipes quickly. insane to think about
That's Amazon too.
Global growth rate today about 1% per year which is 10x higher than it was in Europe in the middle ages. It would be hovering around 0 if we were at capacity. In Europe, it was 0 on average between 1300 and 1400 (black death), so they were still growing otherwise but just barely compared to now.

https://en.wikipedia.org/wiki/Projections_of_population_grow...

You could speculate that our current population isn't sustainable because it depends on non-renewable resources, but that's on a longer time scale than we're talking about here.
Thanks for this. This is something that always bugged me when I see explanations of the three-body problem. They'll say something like "changing the initial conditions just a tiny bit can dramatically change the outcome!" as an explanation for why having no closed form solution is significant.

But that never made sense to me, since plenty of things with closed form solutions also do this.
There is a lot of overhead to commercial air travel, even when it's first/business.

You're probably right that it's more reasonable for flying overseas. But for local travel, limitations on timing, connections, and airports served turn into a big waste of time. It's an analysis that has to be made about the value of the CEO or whoever's time, but it's not black and white, and a couple million bucks vs a few 100k for way better scheduling could easily be worth it.
I'm at work so I'm not going to try and do some experiments, but my guess at relative frequency of (under)promotion being the best move (Queen = 1) is something like;

Knight 1e-3
Rook 1e-5
Bishop 1e-7

A complicating factor in measuring this is that often a rook serves just as well as a queen, the opponent is going to capture immediately anyway, so players sometimes underpromote to a rook just for the fun factor. My number is more meant to represent cases where underpromotion really is the best move. Knight underpromotion is by far the most important, because a knight can do things a Queen can't, most typically give check to keep a combination going without giving the opponent an opportunity to play an active move. Rook and Bishop underpromotions can only be advantageous when they simultaneously avoid stalemate and keep a winning advantage. This is much more likely with a rook, for example in the famous Saavedra position, perhaps the most famous chess problem of all (it featured as decoration on our wedding cake :).
Cursor.sh, Continue, and (probably? i dunno) Copilot do those things well.
But they know they are "not the same".
1. I’m not the one making the claim without evidence. You are.

2. I see absolutely no reason why the null hypothesis should be that a randomly selected social group would be unbiased about any particular issue by default. If you think about it for any length of time you should see that as implausible on its face.

3. You’ve just made up a weird ’counter hypothesis’ of pro Apple bias of your own and thrown it into the discussion for no apparent reason, while claiming not to be willing to defend it. That seems underhanded.

4. Why not just provide some evidence? I’m even more sure you’re wrong now that you’ve chosen to defend your position using these tactics, since it would be trivial for you to provide a link if you actually do remember such a discussion.
Yeah, it's really a shame that geo-engineering projects keep getting shut down. We either control the climate, or it kills people. It's that simple. Without controlling the climate you don't get to pick and choose who lives and who dies because of "nature". It's not even a coordination problem. It's a regulation problem. People don't all need to agree before progress can happen and errors can be corrected. We just need any organization to show some backbone and stop kowtowing to the suicidal environmentalists.

https://www.thecrimson.com/article/2024/3/20/harvard-geoengi...
The 2017 WannaCry ransomware attack would be a good counter example, the virus spread even though it was already fixed in an update from MS a bit more than a month before.
Haven Studios (Sony Interactive Entertainment) | Montreal, Quebec | Onsite or remote in Canada | Full-time

Work with our generative ML team to create entertainment and game development from the ground up. Our team includes ML researchers, MLOps, and game developers. To give you a sense of the team’s prior work, here is a short presentation we gave at SIGGRAPH last year: https://youtu.be/btWy-BAERoY?t=3420

Open roles:
LLM Researcher: https://boards.greenhouse.io/sonyinteractiveentertainmentglo...
LLM Game Designer: https://www.linkedin.com/jobs/view/3871683613
LLM Engineer: https://boards.greenhouse.io/sonyinteractiveentertainmentglo...