skysight-inc/HackerNews huggingface dataset:
If you have a commercial use-case, there is also a non copyleft fork available here

https://www.linuxfoundation.org/press/linux-foundation-launc...
Why not get rid of xz completely? Hoe about using a simpler piece of software, which could be maintained by more people?
I agree that:

> "flimsy contraption" and "first nudge"

Is crap just wanted to note that bridge protection do exist, Ex: https://www.drba.net/drba-proceeds-new-bridge-ship-collision...

So it could be argued that part of the responsibility is on the port authority that did not correctly ensure the safeguard of the bridge.
Apparently step 1 standard filing for cases like this. Law firm doing boring lawyer things.

The Exxon Valdez took 26 years to finally litigate, so maybe check back in a couple decades.
> You might be thinking of the 785

Yes, I wrote that wrong. I initially checked the VAX wikipedia page and thought 784 looked familiar. But I'm pretty sure it was a 785 now that you remind me.

> I/O was well engineered and well matched so it 'felt' responsive

Yeah, I remember back then how Dhrystones were pretty misleading when comparing things like a VAX 11/780 and a barebones 68000 system.

It was interesting working on VAXes. They had really good documentation (10 shelf-feet of orange binders :), and I liked the ";n" automatic file versioning. But having a personal Sun workstation with X11 was so much nicer, and Unix felt much more natural.
why is the title editorialized this way?
People think git is immutable. It is not.
- https://bbs.archlinux.org/viewtopic.php?pid=2160841#p2160841

- https://gitlab.archlinux.org/archlinux/packaging/packages/xz...

- There were some comments in the middle of the giant openwall mailing list thread I can't find now because they're in the middle of 30,000 replies
I thought they meant ships
LGPL is a pretty weak copyleft license and was chosen specifically because it is amenable to almost all present-day commercial use-cases for Redis. You don't have to publish your changes to Redict in most situations, commercial or not. Check out the FAQ here:

https://redict.io/docs/license/
I use GPT-4 to assist in some programming, and it's useful. But I've been struggling to figure out where LLMs make sense as something integrated into a larger product. As an end-user, where I can directly ask them for something specific ("write a function that...") that I can both inspect, double check, and further refine before accepting, they make sense to me. But as an integrated aspect of some system, I haven't been able to come up with any compelling, or even mildly useful usecases.

Also, is anyone using the local, non-OpenAI LLMs for anything useful? They've always been slower and measurably worse than OpenAI's GPTs for me.
“Given enough underfunded maintainers, all security is shallow.”[0]

0. https://en.wikipedia.org/wiki/Linus%27s_law
Le Mans 2024
In what way is he funneling money into the company?

> The company generated $886,000 in revenue in 2023 compared to zero dollars in 2022 [...] In 2023, Canoo spent $1.7 million on this reimbursement — that’s double the amount of revenue it generated. Canoo paid Aquila Family Ventures $1.3 million in 2022 and $1.8 million in 2021 for use of the aircraft.
Can you elaborate on 'the pain' of using in-house feature flags?

I am genuinely curious how essentially a boolean lookup can be hard to work with.
> I think with esp32s3 and floppies we can make some cool computer kits :) there are also 5" spi displays 800x480 that are pretty fast

Not sure there is much interest from younger people these days outside of a small niche. Checkout any kind of OS/computer architecture classes on a University campus.

Could be super cool to build a 'mobile phone' that runs on floppy disks.

> PS: I am working on adding UFI support, it is using CBI to the esp32 mass storage which support only BOT, but its going quite slowly because I am trying to use cheap 4$ logic analyzer to debug and its losing samples :(

Have you documented this somewhere?
What's wrong with it? I think the post title reflects the topic quite accurately, no?
The Many, Confusing File System APIs
Given all the people you're critisising for saying ChatGPT a precursor to AGI, can we at least agree with my opening line?:

> I think part of this is that all three letters of the initialism mean different things to different people.

People only look "ridiculous" to you because those who consider AGI synonymous with ASI are doing exactly what you (apparently) don't like me doing: "just chang[ing] the definition of AGI".
I'm a mathematician (PhD in numnber theory...) and I took a look. It's a basic textbook about some concepts like functions, relations, and basic proof techniques. It seems okay. I was expecting something different from the title, though. It's not too different from many basic books introducing such concepts but obviously a lot of effort was put into it.

Personally, I think if you want an introduction to the "art" of mathematics, it would be a lot better to pick up a more idiosyncratic book that doesn't aim to cover the basics of the standard curriculum in a textbook-style way, which in my opinion is rather tedious. That could either be a more high-level book like Ian Stewart's "From Here to Infinity" or one of Raymond Smullyan's fun texts on logic.

Or for a more basic book, something like "The Mathematical Universe" by William W. Dunham is a much more interesting introduction to the "art" of mathematics than a textbook-style intro.
News hedge fund Hunterbrook goes live, trading before publishing story
Takahē: An efficient multi-domain ActivityPub server. (2022)
> [...] unsatisfied with some of the changes Tan introduced [...]

That's one way to put it
>Are software developers (finally?) going to remove dependencies(now proven to be liabilities!), causing months of refactoring and rewriting, without any other progress?

How is that even a possibility? xz was very useful software, which can only exist if people with significant knowledge put effort into it. Not every OSS project has the ability or resources to duplicate that. The same goes for many, many other dependencies.

I believe that there is essentially nothing you can do to prevent these attacks with the current software creation model. The problem here is that it is relatively simple for a committed actor to make significant contributions to a publicly developed project, but this is also the greatest asset of that development model. It is extremely hard to judge the motivation of such an individual, for most benign contributors it is interest in the project, which they project onto their co contributors.
As a computer guy, I don't feel qualified to do actual plumbing work, but I do feel that I have a reasonable mental model of how water flows into my apartment and can imagine some reasons why it isn't. For example, I'd probably start troubleshooting by checking other taps in my plan and possibly asking neighbors if theirs work, to identify the extent of the issue. Then I guess I'll form three possible hypotheses: either there isn't water in our pipes, or there is water but it's blocked at some point, or there's water and it's leaking at some point. Then I'll try to eliminate the leak hypothesis, and assuming there isn't one, depending on the extent of the issue, I'll either call a plumber or the water utility number.

Maybe as an engineer with a "systemizer" personality I'm naturally inclined to reason in this way, but I don't think it's too much to expect others to think about at least the basics of what their computer is doing.
Banning platic bags is like banning plastic straws - it's wasting effort to piss people off on something that barely affects platic usage.

If platic reduction is that important, the primary goal should be the primary platic consumption, not useful tools to normal people that maybe contributes 1-2% and will end up pissing people off.

The green movement is really bad at convincing people because they ignore private jets for politicians that cause more environmental damage than any lifetime consumption of plastic straws ever would. The hypocrisy is unconvincing.
I don't get the point of this - people are upset that Redis is trying to make money from companies like AWS and Google?
> And I don't see why a white-only association would be unusual in the current climate.

I think it would be very unusual. I'm curious to know why you think otherwise. I also think it would be career and social suicide to be associated with said organization.
First I'm pivoting now I'm trying to derail, when all I've done is answer you question; but to make it plain: yes, it's subjective. How else are certain skills valued more that others? There's no objective measurement to these. Comparing the skills of one disapline to another doesn't work, like apple to oranges.
I'm not a man, and I agree with scotty79. We are all different as individuals, and gender is pretty mush meaningless. Knowing that someone is a man, woman, non-binary, etc. might allow me to guess some things about them (if I also know their culture), but it doesn't determine anything and people are way more likely to make incorrect harmful assumptions than correct useful assumptions. It might be slightly more predictive than zodiac signs, but only slightly.
Top musicians among hundreds warning against replacing human artists with AI
I still don't understand how would that work. The post said:

> Let's say they want to target gcc. Well, gcc contains a lot of documentation, which includes png images. So they spend a while getting accepted as a documentation contributor on that project, and get added to it a png file that is specially constructed, it has additional binary data appended that exploits the buffer overflow. And instructs xz to modify the source code that comes later when decompressing gcc.tar.xz.

It says "when decompressing", and I would imagine that such a bug needs specifically constructed lzma stream to trigger. If you want to do it by changing a source file (a png here) you need to make "second-order" bugs: i.e. the compressor needs to output a broken lzma stream which when later decompressed would exploit (not simply cause) a memory corruption bug. This is too brittle [1] and are very likely to be detected.

[1] Disclaimer: I'm not an expert in writing backdoors. I consider myself reasonably competent for writing exploits, and I've written deliberately buggy programs (for CTFs) before.
What are your definitions of 'system' and 'any part'? Any big company has been breached at some point. They don't throw away all their hardware everytime, even though it was connected. You have to draw the line somewhere.

You're assuming a world with separate hardware and software. That's not the case any more. We have closed sourced firmware running anywhere and no way to verify what's running.
While it's certainly possible to rewrite git history, it's tricky to do it without other maintainers or contributors noticing, since anyone trying to pull into an existing local repo (rather than cloning fresh) would be hit with an unexpected non-fast-forward merge.

It seems likely to me that Lasse Collin would have one or more long-standing local working copies.

So IMHO injecting malicious changes back in time in the git history seems unlikely to me. But not strictly impossible.
If a broke drunk driver knocks a packed school bus off a cliff, that could easily be 600 million dollars worth of medical bills, if all the kids survive but become permanently disabled. And nearly all of it would have to be covered in the end by the taxpayer.

No ‘side quest’ needed, just a few seconds worth of bad decision making.
Everyone working on important open source code should have a real identity associated with them. The fact that "Jia Tan" was able to become a maintainer without anyone ever trying to figure out their real identity shows a huge weakness in our trust model in OSS (everyone real would have something like a Linked In page, Facebook, Twitter, Instagram, or better, their own website with stuff that could be used to ensure they're a real person - that could be faked as well but the amount of effort would be high, and checking this would be much better than just allowing effectively anonymous users to be maintainers - there's just no need for anonymity in this scenario!).
But there are alternatives, most notably zstd.
This is an ad and it reads as if written by ChatGPT. Some surface level bullet points about Access Control, link to their product and the most basic SQL statements.
Media in all forms are full of classic Arabic, so your premise doesn't stand.
I've just wanted to make a point on preserving the classic Arabic.
A true background job would be impossible with this stack. Because I was on the Pro plan, in theory I could set the serverless function timeout to 900s.
Substantial portions of Redis were written by AWS and Google. People are upset because Redis is a collaborative project with many people working on it and Redis Ltd wants the sole right to commercialize the work of an entire community.

LWN has a good overview:

https://lwn.net/SubscriberLink/966631/8bc9d155d4e2afb3/

Redis Ltd is only responsible for about 20% of the work.
The word Censorship isn’t in the original. It got added.
As someone who both had a loved one take their own life as they progressed through symptoms of dementia in the last 6 months, and also had a loved one succumb to it in their 90s (and spent the latter quarter of their life in care without knowing who anyone was, what they enjoyed, or what year it was), I feel the former was far more dignified and overall more humane on both the family and loved ones, the person, and society - at least until we understand how to fix these illnesses.

It’s sad that the argument of “but what if”, and slippery-slope fallacies immediately shut down even the most strict, bureaucracy-filled approach which requires the person to have no significant assets for a period of time (to be certain they aren’t being forced by family), or mandatory psychologist assessments.

Please note, I said dignified. But because they weren’t able to notify or tell anyone their plans (I assume so as to not burden or implicate them), because they were unable to take the euthanasia path - we found them 3 days later. The weather was not cold.

This is the reality that families face when no choice is made possible by the state.
Your original post:

> in the introductory paragraph it reads "unauthenticated, targeted remote code execution ... I believe this means it was unauthorized, not unauthenticated.

You again:

> agree that RCE, unqualified, means unauthorized RCE

So you agree that your "unauthorized" qualification from your orignal post was unwarranted, since all unqualified RCE are unauthorized.

Now if you want to split hairs, you'll say "but the introductory paragraph said unauthenticated, which is qualified RCE, thus I am still right". ok then
useless because too shallow, just an advertisement for apono.
> That big models can't fit onto most person devices at present is indeed likely to be a temporary state of affairs, however it does also mean that the political aspect is very different — the senators and members of parliament can't look at the thing and notice that, even if the symbols are arcane and mysterious beyond their education, it's fundamentally quite short and simple.

You can write the RSA algorithm on a t-shirt but in practice you need a computer to run it.

Likewise, you can fit llama or grok on a thumb drive and carry it around in your pocket, but in practice you need a computer to run it.

> And, of course, if they're planning legislation, they can easily say "no phones with ${feature} > ${threshold}"

But what good is that?

If they're actually trying to accomplish an outcome, those kinds of rules are completely useless. If all they're trying to do is check the "we did something about it" box, there are a hundred other useless things they could do that would be equally ineffective but still check the box and cause less collateral damage.

> This seems a surprising claim, given the popularity of cloud compute, Cloudfare, third-party tracking cookies, DropBox, Slack/MS Teams, Gmail, and web apps run by third parties such as Google Docs, JIRA, Miro, etc.

Notice how these are the kinds of things that major companies with trade secrets to protect have explicitly banned, and individual consumers with no bargaining power suffer while complaining about it?

> They've been saying this "malarkey" since before they had products to be marketed.

Eccentrics have been saying this "malarkey" for a long time. It becomes the official position of the market leader when it is convenient.
They have a limited lifetime. It's a fairly long limited lifetime, sure, but unless you're reading and rewriting the data on the cards regularly, you can't rely on them to all still be intact a decade down the line.

Which is a shame, because I kinda love the idea of my music collection being stored in a little cube that unfolds to reveal a hundred or so micro SD cards.
The HN guidelines [0] say titles shouldn't be changed from the original source except in specific circumstances. The word 'Censorship' doesn't appear anywhere in the Guardian article.

[0] https://news.ycombinator.com/newsguidelines.html
What about Valkey? We have 2 big forks now
Previously:

https://news.ycombinator.com/item?id=39903345

https://news.ycombinator.com/item?id=39909845

https://news.ycombinator.com/item?id=39912226
This is so true, distrusting the guys never being jerk to you while others do is the hardest thing ever. Intentions will never be public :/
Time will tell if the version on Codeberg (https://codeberg.org/redict/redict) can compete with the fork on Github (https://github.com/valkey-io/valkey) in terms of visibility and contributions.
Honestly, it's the money from the cleared land. Horrors of nature are the reason people stay away. People move in only when those horrors occupy resources people think can be put to a better use.

Yes, it's often enough dumb, short-sighted, self-destructive selfish behavior, which I absolutely do not condone. However, horror or disgust alone are nowhere near enough to get people to engage in such behavior. At most it gets people to try - and sometimes succeed - to clear invasive species out of the gardens they already have.
Disclaimer: I work for msft, but I don't represent them in this matter nor I have any insider information. I just read the posts.

The bug post is clearly from a developer who I assume is a bit desperate to fix an issue. He certainly isn't representing Microsoft in the bug post - I assume he was naive and thought mentioning Microsoft would bring attention to the issue (it did, the wrong kind).

There's no information about the "offer" Microsoft made, but I'll take a guess: we have an initiative that selects through voting open source projects that are awarded a one time payment of "a few thousand dollars". Unless evidenced otherwise by ffmpeg, I would assume this is where that money is coming from.

A company as big as Microsoft has lots of procedures and bureaucracies involved in contracting with third parties, and I don't think they were aiming for a support contract in this instance, or, at best, someone looking for help found a simpler way of paying out, instead of going through the proper channels.

People tend to see big companies as an entity of their own, instead of a bunch of people running different processes around.

I think the lesson here is that we need to educate our developers on how to communicate with open source projects and third parties.
Apple typically does not make these kinds of things (namely, special Apple silicon stuff) accessible to userland. I think they probably have some specific agreement with ARM to not do it.
At this point, considering the apparent ease with which a project that is used pretty much everywhere was taken over, that seems like a reasonable position.
> everyone real would have something like a Linked In page, Facebook, Twitter, Instagram, or better, their own website with stuff that could be used to ensure they're a real person

Oof, I guess I’m not real then, as I have none of those things.
WebAssembly can be run in-process rather than requiring a process switch, and it can be easier to port library code to run inside a WebAssembly sandbox than a completely separate process. Also, sandbox mechanisms for separate processes are not always as robust, since they have to give access to any direct syscalls the process makes, whereas WebAssembly completely insulates a library from any native surface area.
Location : Oregon, US

Remote : Ideally Yes, but either works

Willing to relocate : Yes

Technologies : C++, Python, Java, C#, R, PyTorch, TensorFlow, PHP, HTML, CSS, Django, SQL, InfluxDB, GIT

Resume/CV : https://www.linkedin.com/in/satvarsh-gondala-588531122/

Graduate student @ Oregon State University specializing in AI/ML Research. Actively seeking Machine Learning, Data Science or Software Engineering roles. Passionate about AI since high school. Deployed a Bilingual Speech Recognition Software for a robotics company and created a real-time data management system for Coca-Cola.
> Are they 100% sure history was not rewritten at any point?

With git, one way to check is if other people still have clones of the xz repository from a time when it was trusted.

If you suspect the repo history has been tampered with, you can check against those copies.

I believe it would be hard to introduce such a history rewrite, since people pulling from the xz repo would start getting git error messages when things don't match up?

I don't know to what degree intentional SHA-1 hash collisions could be used to work around that?
The point here is there is uncertainty in all commits by Jia Tan, Arch’s focus is on this specific hack, but are there other vulnerabilities in the hundreds of commits to the git repo from the same author?
I suspect the winning bridge design in Baltimore is going to include massive starlings, beyond what is normal, or some other mitigation factor for the last disaster.

So maybe earthquake-proofing is a fair comparison, cost-wise.
Company investigates and then trades on the information before publishing news story. For example after their UWM story (https://hntrbrk.com/uwm/):

> Hunterbrook Capital took the following positions: The fund went short $UWMC, long $RKT, and purchased derivatives.

Fairly unique business model explained in this Bloomberg article:
https://www.bloomberg.com/opinion/articles/2023-11-01/trade-... (archive: https://archive.ph/CERUv)
I mean we go back before all possible sockpuppets. We do have a reasonably good idea of when the attempt started.
A Deep Dive into Meraki 1.0
Can you elaborate? Are you thinking of intentional SHA-1 has collisions? Would that work in practice?
No. I'm sure it is being looked into by multiple parties.
People are upset because Redis is not open source anymore. That is all.
They could do that, but you'd be able to see that nobody/few outside their cluster signed any of their keys.

Let's say they have fake passports and physically appear at key signing parties. Now you're screwed because even your peers (that you thought know how to validate identities using passports) will get fooled.

Read more on GPG's trust levels:
https://www.gnupg.org/gph/en/manual/x334.html
This isn't an insurance lawsuit. Interestingly, it's also not exclusively a ship owner petition. The petition also includes the ship manager.

Another poster linked to a USC section protecting the ship owner on the basis of them not knowing anything that caused the loss. So that is what it is.

Ok, but why would a ship manager also be able to benefit from such a limitation ? The USC section doesn't say anything about the manager, and unlike the owner, the manager was by definition an active participant in the casualty.
Ah, so having endured what passes as music from dozens of Vocoder-assisted "stars", they're now getting worried that a bunch of LLMs and algorithms will replace them ... with ... exactly the same result? LOLLLLLL