skysight-inc/HackerNews huggingface dataset:
If you're interested in property-based testing, I highly recommend "How to Specify It!" by John Hughes, which is available both as a talk and as a paper.

https://research.chalmers.se/publication/517894/file/517894_...
https://www.youtube.com/watch?v=G0NUOst-53U

He gives fantastic guidance about how to write PBTs.
I don't know what to think of it. On the one hand, they all seem niche enough and the upside is that Qt will be able to sustain its work. On the other hand, I'm not sure if I want this to continue to accelerate till we can't develop regular GUI apps without GPL/commercial.
> The tarball is just a bunch of random files.

But that is EXACTLY WHAT GIT IS!, the only difference is that you also get the previous versions too. That doesn't help you at all when the authors themselves are not trustworthy. It MAY help after finding a compromise to figure out when it happened, but it wont help anyone prevent it.

What you write is about someone trying to compromising the Git server itself. This is NOT what i refer to (and even that sort of compromise would be sidestepped with signed tarballs).

What i refer to is more fundamental: the author of the project controls what is put in the Git repository itself, just like the tarballs.

The Git repository is NOT any more trustworthy than the tarballs: if you do not trust the latter then you should not trust the former either and if you do trust the former then there is no reason to not trust the latter.
CTO = Builder first, then lead the building of both the technical systems and engineering culture.

CEO = Sales and funding, maybe product owner very early days but quickly handing off to experienced product folks as soon as too painful to continue with rest of workload.

(n=1 from my experience at a hyper growth startup)
The anger was palpable back then. The MSM swept it under the rug and replaced it with BLM.

Being anti globalism was THE left wing thing back then. Trump sounds more like Michael Moore / Noam Chomsky than anything approaching right wing. He’s classic 90s left wing, especially the taking the jobs thing, that’s Michael Moore to a T.
Haven’t tried it yet, but at least the @testdriverai user exists on GitHub

https://github.com/testdriverai
Not to mention the fact, people who can execute have plenty of their own ideas already. People who only have ideas are not economically valuable. If someone wants to get money out, they have to contribute capital or labor. Ideas are neither.
Making the pivot to dating service. I like it.
LLMs don't learn facts.

They learn statistics on texts and are able to regurgitate them somewhat.
I want to play the Wizard Game, but I am not in a hurry to do so.
Is the real identity of Jia Tan known, even by Lasse Collin?

I would think a "real identity" should be required by linux distros for all /major/ open source projects/library committers which are included in the distro, so that we can hold folks legally accountable
I'm sorry but no. If you are responsible for the worst backdoor in recent computing history (which is probably a criminal act in nature), then you do have a responsibility to explain what went down. Maybe he can take a couple days to write it but I think more than that would be irresponsible. Collin is partially responsible because he gave the keys to Jia Tan. I don't want to burn him at the stake since he's a victim too but I think it's reasonable to expect him to help clean up this mess and at least help us fill in the gaps and understand what happened.

Think about it this way. Say you are volunteering for a non-profit. You obviously don't have to do it and could just chill at home instead. But once you have agreed to say take a volunteer shift on Saturday, you are obligated to show up. Obviously no one can really stop you from skipping, but it would look bad on you and may get you banned from the non-profit. Along the same token, you obviously shouldn't steal from the non-profit, or say randomly beat up the customers/clients. If you accidentally set the building on fire which ends up killing 5 people, I would also assume you would help in some fashion to clean up.

Just because you are doing things for free does not mean you don't have social responsibility for your actions. You don't have to work, but just saying "oh my software ends up compromising everyone's computer? sorry not my problem" is seriously misunderstanding your role (I'm not saying that Collin is doing that). Similarly, if I just randomly slapped you in the face, I might have done it for free, but you would also probably be pretty pissed at me and expect an apology.

Just want to point out that this isn't a typical "demand underpaid open source developers to work 24/7" issue here. This is a unique circumstance where his action has directly resulted in this happening. I feel bad for him being guilt-tripped to add a maintainer after reading through the old threads two years ago, and as I said I don't want to burn him at the stake, just saying that saying he has no responsibility to help at all is really a bad take.
I feel like this is equivocating a bit. Scientific papers exist to put forth an argument and change minds, yes. That’s the entire point of science as an endeavor. It’s not perfect, but if we’re going to define “marketing” as “anytime someone tries to convince me of anything”, I think we’re getting a tad reductionist.
I do it because I was born in the Soviet Union, am dealing with its long-lasting cursed legacy, and this is the system I know very well.

There are all sorts of highly theoretical and noble wealth redistribution ideologies made of handwavium like the one presented in the article. Doesn't matter if they're left or right or up or down, they inevitably collide with reality immediately upon receiving any traction, because they are dealing with the secondary or even tertiary consequences, not with the power imbalance which is the root cause. Dealing with that and setting up checks and balances requires actual dirty work, not navel-gazing discussions on the web, and there a lot of actors that aren't that wealthy and aren't centralized but still have disproportionate power (say, certain public activists, or extrajudicial secret services - for instance, my entire country is de facto owned by one, think pre-Church committee three-letter agencies gone rogue).
Google Will Delete Data on Incognito Chrome Browsing in Legal Settlement
What would you say is prerequisite knowledge for understanding your blog post?
Can someone explain to n00bs like me: what's "landlock" anyway and why is it significant here?
You're not only one, before clicking on article I thought so too lmao
Oof. Dunno about "product manager == leadership"
So what's everyone been jumping to? I've really enjoyed Podcast Addict.
https://podcastaddict.com/
On Listening – Leadership and Work
What does HN think the best replacement is?
lcamtuf's two posts argue that this may simply not be an open-source maintainer's job to defend against. ("The maintainers of libcolorpicker.so can’t be the only thing that stands between your critical infrastructure and Russian or Chinese intelligence services. Spies are stopped by spies.")

That doesn't mean we shouldn't try to help burnt out committers, but the problem seems very hard. As lcamtuf also says, many things don't need maintenance, and just paying people doesn't address what happens when they just don't want to do it anymore. In an alternate universe with different leadership, an organization like the FSF might use donated funds to pay a maintenance staff and an open-source maintainer might be able to lean on them. Of course, that still doesn't address the problem of Jia Tan getting a job with this organization.

https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-ba...
https://lcamtuf.substack.com/p/oss-backdoors-the-allure-of-t...
THIS SO MUCH

my cofounders paid me my full wage for the first year we worked together. it was seeing them check all these boxes and seeing them hustle to get us in the door along with proper market research that I could take action on as a technical contributor that made me take on an equity agreement.

The irony is that their idea isn't that original or unprecedented. the difference is the execution.
I see lots of hate here for people looking for technical cofounders and bringing up unrealistic expectations into the other side, so I just wanted to offer a counterpoint as a "casted" technical cofounder.

I've had an incredibly great experience and I can confidently say I could not have built this business on my own by far. Here's what got me to sign the deal for the last 10 years of my professional life that I didn't regret:

- "just enough" technical knowledge to be dangerous

- an incredibly well researched market opportunity demonstrating great first principle reasoning and business sense, with a pitch deck for cofounders that was almost seed investor level quality

- a nontechnical early market test, executed intelligently within a few days and 200$ of budget that served as an early indication of product-market fit

- previous demonstrated experience building a team and growth as an employee at a startup

- a lot of grit, with a bias towards action (complementing my sometimes fragmented mind and hesitant personality)

- a humble, reflected personality

In the end, while 98% of pitches for the best years of your professional life are probably BS, don't underestimate how far an excellent nontechnical cofounder can bring you.
I don't think this analogy is wholly applicable, simply given the scale and potential blast radius of certain classes of models. A more apt analogy would be nuclear technology. There are the Atomic Gardeners on the one hand, who believe in only the good and see the promise of the technology and peoples intent, and then there is the bitter struggle for power and threat which hinges on it.

In most cases, ML models have the capability to revolutionise or at least augment/optimise problems in predictable ways. In extreme cases, deepfake technology and the like can erode at the tenuous levels of trust which hold societies together. We have seen what happens when disinformation, mistrust, and even basic levels of technology meet: look at students being lynched in India, Pakistan, and elsewhere due to WhatsApp group messages claiming blasphemy; or the practice of SWOTing; or the insinuation of CSE gangs leading to a pizza parlour in the US being stormed by someone with a machine gun.

The stakes here are a lot larger than pure technologists, todays Atomic Gardeners, may perceive.

In that context, legislation is trying to provide a counterweight to the pace of change to allow for some – any – breathing room, and particularly to prevent an increasingly hostile cast of nation states from weaponising that technology, even in small ways. For example, OSINT of North Koreas operations show that the basic parts needed for making baby powder are also capable of being used for weapons development.
MS Word for Mac was 1.36 GB
That sounds nice.

I did an engineering/program manager role for 8 years and people pretty much always did what I asked if I showed up at their desk or bothered their boss.

"Squeaky wheel gets the grease?"

But I too like to think that I prioritize my children on merit rather than fuss level. For some reason they continue to cry despite me claiming I don't react to it.
https://www.ycombinator.com/faq "Do we need to incorporate before applying? - Nope."
Isn‘t git submodules a much more lean way at accomplishing this than a clunky 500gb repo?
Owners of Cargo Ship Behind Baltimore Bridge Collapse: Don't Blame Us
As someone who was exposed to 4chan at far too young of an age, I don't buy this. There's no political philisophy happening on /pol/, nor has there ever been. Granted, I avoided that board like the plague, but cursory glances never showed me any novel ideas being formulated. Even if there is real conversation of various political ideologies, it's drowned out by a sea of kids who think it's cool to say the N word online.

4chan is unique because of its combination of scale, relative lack of moderation, and relatively high anonymity. By nature, it's a place where political radicals would be able to shitpost freely en masse. 4chan was absolutely a vehicle for platforming radical politics, but the word "shitpost" is key - the average discourse on 4chan isn't at a level where ideological formulation can happen at a meaningful scale.

Memes are the only exception. 4chan memes have, on multiple occasions, turned into widely-known (and sometimes widely-misunderstood) political imagery. That imagery routinely has no clear symbolism whatsoever, and is assigned all kinds of wacky meanings depending on you ask... which is what you'd expect from 4chan, I guess.
>So what's the story? Guaranteed accuracy, enhanced CD. Latest technology, darts hit treble twenty
That's the basis for my preferring the term relating to authorization. The two terms have distinct and well-defined meanings in the domain. They're both critical aspects of security but for different reasons.
What benefits your pension fund isnt a particularly good measure of fairness either ;)
I am the person described in the requirement list. I brought 2 startups from seed to series A, built a cashflow business of my own, led teams, have 5+ years of runway (yes, in San Francisco), and actively looking for a potential idea + business person. I have worked my ass off for the past 10 years to put myself into this position. I'm doing startups to fulfill the intersection of broad positive externalities + financial reward space, which is possible, and I did it 3 times already. I'm looking for a cofounder+idea because what I can do alone is limited. Over the past 2 years, I have reviewed >1500 pitches, talked with 150+ founders, had in-depth conversation with 10, executed (and failed) with 2.

My counterparties are not real.

In descending order of frequency:

* Tirekickers / wannabes: these people have fantasies about doing a startup... someday, but definitely not just now.

* Super excited about <thing/area>... has no related experience, fails at basic business ontology ("target market", "valueproposition") <- 95% mark

* Has no hypothesis about marketing channels, nor any insight on why this particular combination might work

* fails on all of market scoping, TAM, customer development, financial model <- 99% mark

Rest: limited operational experience, OR self-defeating / low psychological resilience, going nowhere.

There is a laundry list on sibling comment (https://news.ycombinator.com/item?id=39904704) for ticking boxes. My current hypo, is that peeps who check these boxes AND don't have a tech cofounder on their rolodex typically go to angels/VCs, and get a recommendation from them; and therefore will never appear on any markets for cofounders. Curious if this matches your experience.
How would that even work? Are distros expected to code their own alternative versions of open source libraries where they can't get the maintainers to send their IDs? Or what stops from forged IDs being used?
It was not the first instance of this happening; other times I'm not certain it was git's fault.
SEEKING WORK

Location: Washington DC, USA

Remote: Yes

Technologies: Mobile(Flutter), JavaScript (React, NodeJS), NoSql, AWS, Docker, Snowflake, LLM.

Résumé/CV: https://www.oaktreeapps.com

----------------------------------------

We are product-oriented engineers who love executing on greenfield ideas! We are a completely remote team (have been remote even before COVID hit). Our clients range from healthcare companies to startups within the oil and gas industry.

We’ve worked with companies like GM, PGA, Sweetwater, Berbix, USDA and many more.

For details, previous work and testimonials, please visit: https://www.oaktreeapps.com/our-work

Ping us at hello AT oaktreeapps [dot] com to see samples of our work!
This will never be accepted by the community.
> My point is that clearly it's not only the laws (and the parent commenter never claimed so), but they do help.

Well, I agree with that.
Pitching AntennaPod as a replacement:

- https://antennapod.org/

- https://github.com/AntennaPod/AntennaPod
> But I also see the dark side.

Indeed; if there were no dark side, Marx would have had nothing to write about.

The difference between "money" and "value" can also be found in the difference between what is measurable and what is important is noted in Goodhart's law, which was originally specifically about two different measures of money and why putting pressure on them specifically for economic reasons was not having the anticipated result: https://en.wikipedia.org/wiki/Goodhart%27s_law

I hope that the successor to Smith and Marx will account both for Goodhart and for Nash equilibria/game theory, both of which were developed and formalised over a century after the Communist Manifesto and around two centuries after The Wealth of Nations.
High carbohydrate diets do not do a good job of suppressing ghrelin levels in the bloodstream - meaning you stay hungry for longer. High protein diets (not necessarily high fat) do a much better job of appetite suppression.

This has been known for quite some time. https://pubmed.ncbi.nlm.nih.gov/19820013/
Open source fundamentally does not work that way. There are many important open source contributors who work pseudonymously.

Google's Know, Prevent, Fix blog post floated the idea of stronger identity for open source in https://security.googleblog.com/2021/02/know-prevent-fix-fra... and there was very significant pushback. We learned a lot from that.

The fundamental problem with stronger identity is that spy agencies can create very convincing ones. How are distros going to detect those?
They’d definitely have a great answer up their sleeves.

The crazy thing is the devs responsible for the XZ backdoor are among us and will likely be here on HN, downvoting comments which are getting close to the truth and upvoting each other.

The bad people are definitely here.
It is not beside the point, it is the ENTIRE point. If you do not trust the developer then Git wont help you, the developer can put their malicious code in the repository itself.

Git wont help you prevent anything, it is just a bunch of random files (as someone mentioned above) with the only difference being that there is a change history attached. But that wont prevent anyone with proper legitimate access (i.e. not trying to compromise it) to the repository from adding malicious code. All it may help with is figuring out, after the fact (of finding the compromise) when it was added.

As i wrote above, the Git repository is not any more trustworthy than the tarballs: if you do not trust the latter then you should not trust the former either and if you do trust the former then there is no reason to not trust the latter.
Fairly standard term for a kind of access similar to this, but the distinction is important.

Consider the impact if anybody else, not just this attacker, could have exploited it -- on the other hand, it may have been discovered sooner (had it also not been discovered by accident first).
I think the point was that if you are the "business cofounder" and are unable to raise funds, you are not serving a purpose. The flip of this is a technical cofounder that can't actually write functional code.
Yes, and that didn't save us from the xz backdoor did it?
We are in a tech bubble on this website. There are lots of people with ideas and money and want to make things happen. Now to your point - that might not be / need to be a cofounder but looking for tech leadership for an idea is not an immediate death knell.
Ethical AI in the New Yorker (and Elsewhere)
I recently had a letter published in The New Yorker in response to Andrew Marantz's (excellent) story "Among the A.I. Doomsayers." In particular, I wanted to highlight that extremist doomers and accelerationists are not the only ones concerned about AI's future. In the post, I elaborate a little on the letter and provide links to further reading.
Because corporations and state level actors have huge monetary power and/or monopolies on violence and can do everything some guy in basement can do as well.
> try to remember that you and the syndicate lead are most likely a tiny check to the company,

Also remember all the high quality startups have their pick of funding sources. They aren't going to be on platforms like this or secondary markets. And certainly not with good terms for investors.
Pocketcasts is what I have been using for over a decade and it's never let me down. It comes with a web player as well so you can listen from a web browser.
I've been happily using PocketCasts[1] for years.

[1] https://pocketcasts.com/
I've been a paying user of Pocket Casts for a while. I like that it also has a web version as well as a mobile app, so everything is always sync'd.
Location: Washington DC, USA

Remote: Yes

Willing to relocate: No

Technologies: Mobile(Flutter), JavaScript (React, NodeJS), NoSql, AWS, Docker, Snowflake, LLM.

Résumé/CV: https://www.oaktreeapps.com

Email: hello AT oaktreeapps [dot] com

----------------------------------------

We are product-oriented engineers who love executing on greenfield ideas! We are a completely remote team (have been remote even before COVID hit). Our clients range from healthcare companies to startups within the oil and gas industry.

We’ve worked with companies like GM, PGA, Sweetwater, Berbix, USDA and many more.

For details, previous work and testimonials, please visit: https://www.oaktreeapps.com/our-work

Ping us at hello AT oaktreeapps [dot] com to see samples of our work!
SEEKING WORK | Lead Developer | Full stack with data engineering skills

Location: U.S.A. (Vermont)

Remote: Only

Willing to relocate: No

Technologies: Python/Django, JavaScript/React, AWS, GCP, GNU Make, Bash, Prefect, Airflow, data engineering, mapping, data visualizations

Résumé/CV: https://www.linkedin.com/in/sam-mcalilly/

Email: smcalilly@gmail.com

I'm currently a lead developer for a civic tech consultancy. I specialize in data engineering, interactive maps, and data visualizations. I can design data pipelines, backend systems, and complex user interfaces. I also have experience managing projects and clients.

I'm particularly interested in civic tech, data journalism, or climate tech opportunities with a sustainable agriculture focus. Would also be cool to work in forestry or any sort of nature-related technical role, though I don't have the science background.

I'm also interested in literature or otherwise book/library/art/music/culture related opportunities (see the landing page for my pre-revenue software project for booksellers: https://www.bookhead.net/marketing/). I'm a former bookseller and have experience building library marketing software.

Searching for a part-time contract or a 3-6 month contract with a bigger time commitment, starting in May or June at the earliest.
I'm using a local audiobookshelf server to manage the podcasts I listen to.
How did you met that person?
Pyodide is a Python distribution for the browser/Node.js based on WebAssembly
Yeah, seen that, was wondering more from someone if they know, like its not needed but its better if you do so. Many thanks anyhow, this is helpful
Flask is okayish imo. People tend to use it with an ORM called sqlalchemy. There is also FastAPI as an alternative to Flask and Django in the Python web framework space. Just about anything can be used for small projects in a vacuum. I used to make websites with framework-less PHP files and mysqli.
I've been using Pocket casts for years...

But I'm still salty about Google reader!! >:(
How does this compare to the usual Grafana stack?
so glad pypi actively removed support for package signatures and even sends you an annoying email if your scripts dare to actually upload a signature anyway
Don't leave it at the cliffhanger
It doesn’t take an LLM to write long-winded and flowery prose.

Nice new burn, though… “you write like an LLM”.

Is that what we want on these forums, attacking someone’s prose?