skysight-inc/HackerNews huggingface dataset:
Sounds like DRY run amok indeed. Maybe a compiler or linter could detect these cases and complain "this function is only called from one place" :)
This train tunnel below Malmö in Sweden was finished in 2010 six months earlier than planned and at a cost 10% below budget.

https://en.wikipedia.org/wiki/City_Tunnel_(Malm%C3%B6)
Being copyleft, Redict can merge any contributions to Valkey. However, Valkey cannot merge any of the Redict commits (unless the contributor actively dual licenses them).

Being non-open source Redis can merge any contributions made to Valkey but not from Redict. So if you don't want your code to end up in Redis, contribute to Redict.

Interestingly, there have only been two commits from a single developer to the Redis repo in the last two weeks since the license change. A huge decrease.
I think the letters+numbers naming scheme for both the main account and the sockpuppets used to get him access to xz and the versions into distros is a strong hint at (2). Taking over xz maintainership without any history of open source contributions is also suspicious.
Suno V3 Powers Aimusic.so: Create AI-Generated Music from Text for Free
I have a certain sympathy for all involved in your argument, but I don't think it's a good way to do business for either businesses and their executives, their shareholders, or ultimately the consumer and public.

The problem is short-term thinking around annual or even quarterly earnings reports and whatever drives that. I appreciate that a CEO or even a board may feel pressure up to and including losing their jobs if they leave literally anything on the table in the form of long-term investment, the "goodwill" (which is a real financial accounting line item that's sometimes a lot) of their customers, partners, etc. and the long-term sustainability of the business.

But it's that ability to deliver that magic combination of a product that people ideally love buying, but at least don't mind buying, a team that is healthy, well-compensated, and inclined to go the extra mile for the employer at rare need because the mutual priority of the wellbeing of the partnership goes both ways (this is massive, when you treat people well when they're in a bind, they'll go the extra mile when you're in a bind with little if any pressure, most of the time), and a consistent, low-beta (for the investor's risk appetite) return on investment for shareholders.

This is the kind of business that e.g. Warren Buffet at least talks about as the kind of business he learned to invest in. I'm not a Buffet scholar or watcher really, so I don't know how well he lives up to those ideals in general or especially recently, but it's certainly a pretty good way to describe the desired outcome of capitalism!

I've heard lots of arguments for why boards and CEOs and the like simply have to skin the sheep once rather than shear him many times (to borrow the old saw): but never a very convincing one. It's basically absurd in the kinds of dual-class share structures that are common in tech now: it's not only extant but common for the founder/CEO to be basically unencumbered by quarterly earnings reports, what's e.g. Mark Zuckerberg going to do? Fire himself?

And under this more "good for everyone over a long time horizon" model, you can just launch the next breakthrough card when it's done, and launch incremental improvements when you're out of inventory, or see a gap in your lineup, or whatever.

Fix corporate governance in what should be the relatively uncontroversial ways I and many others have described, and you fix this (among many, many other) set of perverse incentives.
What's even the benefit for HP? What do they gain by people installing this app?
I don’t understand your distinction between types of games. In Chess, your stupid mistake creates an opportunity your opponent can exploit. The failure to exploit an opportunity is itself a mistake.

I guess in Poker there is an element of luck of the deal - is that the kind of opportunity you’re talking about?
> If there is a known good copy of the repo from before the attacker had sufficient access to alter history, then that is an acceptable starting point.

I heard someone calling themselves “Honest Ivan” has just the thing, totally trustworthy.
Agreed. More than that, there's not much of a way to preven these kinds of attacks, period, whether in software or otherwise, if the perpetrator is some intelligence agency or such.

For threats lesser than a black op, the standard way of mitigating supply chain attacks in the civilized world is through contracts, courts, and law enforcement. I could, in theory, get a job at a local food manufacturer, and over the course of year or two, reach the point I could start adding poison to the products. But you're relatively confident that this won't happen, because should it ever did, the manufacturer will be smeared and sued and they'll be very quick to find me and hand me over to the police. That's how it works for pretty much everything; that's how trust is established at scale.

Two key components of that: having responsibility over quality/fitness for use of your product, and being able to pass the blame up to your suppliers, should you be the victim too. In other words: warranty and being an easily identifiable legal entity. Exactly the two components that Open Source development does away with. Software made by a random mix of potentially pseudoanonymous people, offered with zero warranties. This is, of course, also the reason OSS is so successful. Rapid, unstructured evolution. Can't have one without the other.

Or in short: the only way I see to properly mitigate these kinds of threats is to ditch OSS and make all software commercial again (and legally force vendors to stop with the "no warranty" clause in licensing). That doesn't seem like a worthwhile trade-off to me, though.
> Most companies have more thorough processes to avoid this but that doesn't mean those processes are applied correctly everytime, especially if more than one malicious engineer is involved.

I’d also bet that you could exploit the tiers at many companies: how many places have more robust review for the staff engineers but then assume that some lowly “ops monkey” will take care of the build environment, etc.? I’d hope that wouldn’t work at Google, Microsoft, etc. but have heard enough stories about disparities between which jobs are contracted out and which have the coveted FAANG benefits that I wouldn’t exactly be shocked if it turned out otherwise.
You do care about the experience though. Everyone does. If you have a bad experience you'll complain, or stop going to that Starbucks, or moan to your friends. To you, by the sounds of things, a good experience consists of asking for your order, paying, and getting out fast. An experienced retail worker will be able to read all that from your cues - not engaging in small talk, having your payment ready, moving along quickly, etc. They'll factor those things into their interactions with you, they'll remember you next time, and they'll make the experience what you want. All that takes time to learn, and few retail workers get good at it. I will concede that it doesn't require a PhD though. Few jobs do.
I have played with ARM-based boards running Linux for some time now and, while the performance is so-so, software support is excellent. If these ARM laptops aren't crippled in some way that forces them to only run Windows, they'd be very good Linux daily drivers.
This is what worries me more.

It's easy to point a finger at a specific Bad Guy® and shout "He did it!" It's much harder to face the reality that any maintainer of any open-source project can slowly burn out to a point where they become accomplices in an attack, or at least turn a blind eye.

The pool of open-source developers does not split cleanly into honest contributors and evil agents. The boundary is quite fluid -- more so in some circles than in others -- and there are always temptations to move from one side to the other and back again.
This a classic self-righteous text from a person who doesn't want to take ANY risk but wants to be a technical co-founder in the notion of "pay me the full market salary and give a lot of shares for me to even consider being a co-founder". The whole post gives the impression that being a co-founder means to this person not starting his own business but getting a paid side gig. This person, apparently, considers that an MVP is the only value that is created by a startup team.

The truth is everybody on the team risks—tech or non-tech founders: both types invest their own time and expertise regardless of a task to be done. The fact that non-technical founder doesn't code MVP doesn't mean that there is no time/expertise invested that moves the needle. So, both invest and should better "date" for some time to test getting along.

The funny part is that it's people like the author who got easily tricked by a good salesman and smooth talkers into working for free. A good salesperson clearly sees what motivates such people and promises a lot of it to only deliver nothing later.
The Swedish Mile (= 10km) is still in use and once tripped me up when searching for a used car.

They were all wonderfully cheap until I realized that 50,000 on the website actually meant 500,000km driven.
C# has structs with generics/explicit layout/object references/fixed buffers/etc. and byrefs which are special pointers that can point to managed memory, stack or unmanaged one yet are still tracked by GC despite allowing pointer arithmetic on them, and regular C pointers yet successfully uses GC.

Much damage has been dealt to non-JVM languages by stereotypes and perception that the way JVM languages work is the way all GC languages work.
We're more and more doing this exact thing and you know what - that's a good thing. Happy to see you and your family has gone this way - very smart thing.
I meant from making this post.
>why everyone is so quick to point fingers at Intel but gives AMD a pass.

Because Intel is an evil and greedy company while AMD is everyone's favorite underdog who will do no wrong.

I wish I was joking, but quite a lot of people (especially the HN crowd) think irrationally like that.
I have Facebook and the account and what's on it is no one's -ing business in a professional context.
A cool tax-free no questions 500k can convince a lot of people
Consider “Jia Tan” started working on xz because they already found a critical vulnerability and wanted to maintain it, or more tin foil, they burned xz to get upstreams to use another compression that is also already backdoored. When dealing with state actors there’s really no limit to how complex the situation can be.
Whales is a country but it is not a nation-state and probably does not have its own APT.
Isn't a cup a measure of volume while a gram a measure of weight, though?
> I believe this is a nation state actor

It is certainly possible, but we don't really have a good indication for that. This whole thing would be definitely doable by a single individual.
The volume of 240mL of water. Fill a standard 500mL water bottle to the bottom of the cone: half of that.

= 500mL
/_\ 2 cups
|_| 1 cup
|_| zilch

* Not to scale.
What is commonly known as open source nowadays is a license that follows the definition adopted by the Open Source Initiative. SSPL is considered as not approved because it encumber unrelated programs to the one licensed by the SSPL:

https://web.archive.org/web/20230411163802/https://lists.ope...

So it is a combination of idealogical issue as well as being an annoyance to people who adopted it because it was released under the BSD in the first place.
I've lost my pg_control again ( yet another attempt at data recovery)
It seems detecting holes in jia’s code could be extremely difficult. Given the stakes, as a precaution, would it be viable to
simply wipe and rewrite (from scratch) the last ~2 years of commits to xz?
That and Saturn and Uranus align on 30th December.
Based on how this has gone (remember xz has effectively been orphaned for years, and the majority of long-standing setups were using the release archives), unless if Lasse has never run any code from Jia (unlikely) I'd consider the entire machine untrusted (keys, etc). Provided the tarballs are still signed from that date, from another immutable source, that's really the only starting point here to rebuilding.
> suddenly gets offered three figure sums to add a few lines of "affiliate stuff" or such

Back of the envelope calculation: you're looking at 2 orders of magnitude more money from "affiliate stuff" than you would be from generous user donations
What this, and US exceptionalism seems to miss, is that it is not a 50/50 divide, 50% US customary units and 50% metric units.

It is every country in the world (including the US, officially, in 1975) discarding their entire history of traditional units, in favour of globally standardised weights and measures. Don't you think French chefs miss their chopines and boisseaux ?

It's every country in the world, vs the holdouts of the USA, Liberia and Burma.

There are plenty of other troubles with making universal recipes! They often rely on ingredients that one country takes for granted while they're an expensive specialty in your country; sometimes they're the key ingredient that make the recipe work, other times it's just what they had to hand, and you should substitute with local equivalent. Or when a chef says "435g of beans" that's because their country customarily sells tins with 435g of beans in them, and they just use one customary tin and base the rest of the ingredients around that volume. If your tins are 400g or 500g, what you really need is the recipe localised to match your customary supplies.

We'll never get away from the customary practises of every country, but we could at least be precise when writing them down?
That's pure speculation and there are plenty of hints to the contrary.
Don't worry, governments are always happy to throw the middle class under the bus.
Its a Merkle Tree. They were invented 3 years before blockchains: https://en.wikipedia.org/wiki/Merkle_tree
Nation state actor is a standard info sec term. Using it does not imply any kind of wizardry.

Edit: most threat actors do not have the patience or the motive to behave in this way. It is reasonable to suppose that this is a nation state actor.
Would time zones even be necessary on the Moon ? Sunrise and sunset occur on a scale of Earth days, not Earth hours.
What Everyone Missed About the Linux Hack
Have you tried re-formatting with GPT and FAT32?
Deep Dive into Go SQL Internals
I am curious as to why a company would go through a middleman to get compute. Why not get it from AWS themselves?
There was a need for some form of funding from somewhere to allow LLM research certainly, and there was probably a need for someone to subsidize a few expensive runs that didn't pan out before it became common enough knowledge how to train a foundation LLM. But the cat's out of the bag on that now, you might not get Opus, but that capability band between e.g. GPT-3.5 and GPT-4 (and it's various previews) is crowded with stuff that is well-explained in significant detail in purely public sources.

So IDK, yeah, maybe we needed big giant companies to kickstart this thing, maybe not, the government used to do effective public/private partnerships or even useful stuff directly with academia and in places still does: CERN did the LHC without like, crazy direct corporate sponsorship written all over it (there may be indirect stuff that I don't know about not being involved in the LHC project).

And anyone who thinks AI is more complicated or should be more capital-intensive than high-energy particle physics done at CERN and places like it is getting high on their own supply.
I was at NMSU during his time as head of the CS department. His interest in chess inspired to write my first chess playing program
> We demand diversity and inclusivity, but somehow the more "able-bodied neurotypical white heterosexual male" checkboxes you tick, the less your opinion and well-being matters. (And I only tick two of those)

Let's look at this more from a structural view: "Able-bodied neurotypical white heterosexual male" is the assumed default in "Western" society. What do I mean by that? White neurotypical heterosexual men built society for others in their demographic. Rights for women, POC, LGBTQIA people, neurodivergent, and disabled people, etc. have always been secondary.

On a systemic level, I do not agree with you that WNTHSM (I'm not writing that out again) are less valued than other groups. Let's just look at healthcare. Men make up the majority of participants in medical studies[1], black patients are perceived as more able to cope with pain[2]. Let's look at the law: Women could not open bank accounts without their husbands' permission in the US until 1974 under the Equal Credit Opportunity Act. Insurance will often cover viagra, but not birth control. Look up anything about redlining and read about how black people couldn't get fair loans to buy homes.

We all have to navigate systems in life: educational, judicial, healthcare, financial systems, etc... I would guess you don't face as much/the same adversity navigating as someone belonging to zero of the five mentioned demographics, likewise it's harder for you than for those belonging to 5/5 demographics. How can you make a system work for more people? By involving them when redesigning the system.

I won't deny your feelings, but would ask you to consider specifically when you've felt your opinions and well-being do not matter.

[1]: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8812498/

[2]: https://www.aamc.org/news/how-we-fail-black-patients-pain
> There's also a case to be made that it's NOT a nation-state actor as nation states use Linux and want a secure Linux. The NSA and such have somewhat conflicting interests here. We just don't know.

I agree that we do not know that it’s a nation-state but this point seems to work in the opposite direction: this attack was very carefully constructed so only someone with a particular key pair could exploit it. That’s reminiscent of what the NSA did with the Dual EC constants, and they were confident enough about that to push it into the FIPS requirements for federal IT.
Log into the bank and click the "log out of all sessions" to invalidate all cookies. Or if an attacker changed your credentials walk into the back and have a banker do it and then have the show/reverse all changes and transactions the attacker made. If the option does not exist, demand they add it or you and your money will go to another bank. Not all websites have this option but they would if enough customers demanded it.
I don't see how cups are in any way better than desilitres. You use a larger measuring tool when you need more than say three dl. I agree that grams are inconvenient to use for flours and liquids, so litre/desilitre/millilitre just seems the logical option.

I'm obviously very biased by growing up with SI units, and having no cup measures around. Every time a recipe says cups, I sigh and use a smartphone to convert it.
I don't think such precision is necessary for typical 'cooking' but baking is different -- it's just straight up chemistry and the ratios are not just useful guides but vital to getting recipe right.
I always do cup = 245ml. If you then undershoot or overshoot by 5ml, you’re always okay.

That Wikipedia page is also missing the Dutch “kopje” (little cup) measurement, which is 150ml.
Is it? The best "insurance" against this seems to be a rat's nest of sufficiently small LLCs which then conveniently go bankrupt when something big happens (losing only the assets in that LLC at that time). Imagine a shipping company where each ship is its own LLC. If the ship sinks, well too bad, the only meaningful asset that LLC had was the ship, oops.

I assume ships are required by law to have insurance before being allowed to go in certain places, to make sure damage they cause is covered. But that would make it hard to sell "better" insurance than the legal minimum when it comes to catastrophic claims.
Right, but conceivably rarer (thermodynamically, in terms of ratio of possible microstates/ensembles) than ships hittin bridges!

So, doesn't really compare. Yours is more of a hypothetical, mine's more of a reality. Haha! :)
Tesla sales plunge far more than expected
Autotools need to go away, but most of the underlying use cases that cause build system complexity comes down to dependency management and detection. The utter lack of best practices for those workflows is the root cause of complexity. There is no way to have a mybuild.toml build config on the face of those challenges.
> Why not get rid of xz completely?

... you mean compression package used by most big distros to make their packages? Do you really need to ask

> Hoe about using a simpler piece of software, which could be maintained by more people?

It's not a complex piece of software. Lib itself is ~15k lines of code.

It does it's job well and it needs little work. It didn't had any outstanding bugs lingering unfixed for years

Complexity have nothing to do with the problem, it's just... uninteresting enough that there is no reason for contribute.
thanks for the recommendation, just installed and i'm digging it!
The CIA has toppled foreign governments, for instance that of Iran. If you don't want to count them as part of the US military, what should the rest of the world call them instead? Terrorists?
I've never heard of a conan language, and a couple of URLs to some bad recipes would not go amiss.
Quantum teleportation does not allow you to transfer an amount of information faster than speed of light. Say you have two labs with two entangled particles 300000km away such that when one particle is “up” the other will be “down”. When lab A observes the particle it has 1/2 probability of being “up” and 1/2 probability of being “down”. Same for lab B. But once both observations are known by someone C (could also be A or B), C will find that one of the particles is “up” and the other is “down”. Bell’s theorem further tells us that there are cases (probability distributions of A and B) where the distribution could not be explained by assuming that the probability distribution of A and B is determined before observation.

There are never ending debates on what happened while observing A, but I dislike calling it “quantum teleportation” as it only further confuses people as if any information was teleported during observation. My theory is that A and B are totally independent until both observations reach a middleman C, and it’s at this point that the entanglement starts to matter.
Unless EVs are actually less expensive in 2035, the ban will be removed. However, they will be cheaper so no one will opt for an ICE car at that point anyway.
Show HN: Turn every localhost into a reachable host with Kokomo
Maybe its blocking tailwind files. Let me fix this. Ty for reporting.
I believe the problem of thankless maintenance is best solved with two things: the thanks (yes, we are all human and want recognition and appreciation from fellow humans)[0], and a stable employment (work for a good large business while open-sourcing what’s possible)[1].

If you do OSS for profit, then it can become a question of where is more money; but if you work a reliable job with insurance, relationships and other implications then the stakes may be a bit different.

Many of the biggest OSS projects today were started by people who had no money in mind whatsoever. Some had other jobs, others were students, etc. If we feel relatively secure, we are driven by our innate desire to tinker, create cool things and show it off.

[0] Undermined by LLMs that are used to gobble up your code and suggest it to others commercially and without attribution.

[1] Undermined by low employment protections (if you can expect to be fired at any time, you would be less loyal), and by LLMs (whatever you open-source now more directly benefits Microsoft or whatever).