skysight-inc/HackerNews huggingface dataset:
The problem with your hierarchy is that there's no empirical evidence supporting it. Small unit tests have not empirically been shown to have benefits over integration tests, and test-driven design has failed to show a benefit over tests written after the fact. The only thing that seems to matter is that tests are written, and the more tests, the more chances of finding a bug. That's it. So your list is actually:

* integration and unit tests: since these are manually written, they scale poorly but are simple.

* property tests: since these are semi-automatic they scale better but are a bit more complicated to setup.

* fuzzing: almost fully automatic, although I don't differentiate this much from property-based testing.

* mutation based testing
this seems like one of the most efficient ways to store/print read-only data on paper, perhaps data can be compressed with wrt+paq8px so compressed (text) data can potentially be doubled to a total of 12*500 KB of books; 6 MB text on one A4, so the KJV bible could fit.
https://www.mattmahoney.net/dc/text.html#1250

or... a few high res photographs of important moments or persons. A VR environment or 45 minutes of speech or music @1.5 kbps with Vocos or Meta's EnCodec https://gemelo-ai.github.io/vocos/

https://github.com/Rupan/paperbak

Perhaps make it an android, linux or ios app... even though running an old windows binary on android is feasible.

Or perhaps one should just use paper to fit a maximum of 75 KB of squashed readable multicolumn (6) on a landscape A4 printed with Tahoma smallest print. Perhaps use an alphabetic shorthand like bref, yash or briefhand for a human readable 30% compression.
Who needs more then 100 KB on an A4 anyway? One and a half month of journaling. Would be nice if I could get one year of human readable personal insights/interactions/things completed on a double-sided A4 without advanced compression.
Special Volkswagen Badge Keeps Kangaroos Away
The MLK quote is "a riot is the language of the unheard", and the full context is rich:

> And what is it America has failed to hear? It has failed to hear that the plight of the negro poor has worsened over the last twelve or fifteen years. It has failed to hear that the promises of freedom and justice have not been met. And it has failed to hear that large segments of white society are more concerned about tranquility and the status quo than about justice and humanity.

The last point in particular has proven quite prescient to our current moment.
Git repos only vanish if they have no clones.

And? You're speaking probabilities, not certainties. It's not relevant in terms of archiving. You don't guess, you don't hope, you simply 100% ensure that 10 days, 19 years, or a century from now you can build the same thing.

I agree that adding "extra stuff" to a tarball isn't a bad idea, and in fact, many already do!
Having lots of small repos also generates overhead they need to be checked out separately, tagged individually, built individually, etc.

The reason that this is a bad April first joke is that the idea actually has merit. Google runs their company like this. The unthinkable bit is not doing this technically but Debian rearchitecting the way it works. Doing this with Git is a separate topic. It's probably not great for this. But mono repos at this scale are not impossible.
I'm a non-technical(*) cofounder in the process of starting a company. While I haven't committed to a single cofounder yet, I've had little trouble getting conversations with technical people that are serious about the idea and have reasonable backgrounds. Some have actively come to me unsolicited.

I obviously can't say for sure why that is, n=1 and all, but here's where I see my differentiators compared to the other nontechnical founders I see on YC's own matching board (https://www.ycombinator.com/cofounder-matching):

- I have domain expertise. I have done the thing I am trying to do before (I used to be part of the leadership at a company in the same space), and I'm trying to build a thing that has had some real-world proof-of-concept already. I don't have "an idea", I have a plan for how to create it and for why I think it will be a viable business. I'm not "the ideas person", I'm "the person who will make the business side of this work so you can focus on the technical stuff you like, which is an equal and complementary role".

- I'm offering something "divisive". Specifically, I'm not* trying to build the next unicorn, I'm trying to build something small and sustainable. Many people do want to build the next unicorn, but the people who don't* have much slimmer pickings. I'm not more interesting on average, but I can be the most interesting to a specific subset of people. This is essentially the same dynamic you see on dating sites, as with OKCupid's old blog about attractiveness-rating distributions (archived here: https://web.archive.org/web/20110110230054/http://blog.okcup...) - you don't want to be a 5/10 to everyone, you want to be a 10/10 to someone.

- Related to the previous bullet, I act like a human being. Basically, I bet on the idea that other people who want to start companies are often doing it for (one of) the reasons I am: because they're so tired of the pervasive culture of corporate BS that overlays almost every company of any size, and want to laser-focus on something that keeps you honest. My profile is direct, human, emotional, and does not shy away from talking about who I am, not just why my credentials are great (which they honestly aren't - they're not terrible but it's certainly not my competitive advantage). I think people respond to that, because I respond to that, and I can't be the only one.

- I'm trying to build a thing engineers care about. That's obviously not something you can control if you're trying to, I dunno, build the next fintech app that is fundamentally boring on the technical side, but if you're a nontechnical founder, it might suggest to you which ideas you have would be easiest to find a technical partner for.

None of this is particularly earth-shattering, mind. If you just watch the Startup School videos, they'll tell you most of this. But as with a lot of things, a surprisingly huge chunk of the "market" fails to grab the low-hanging fruit.

(* nontechnical in the sense that YC's matching uses, i.e., I cannot build the product myself with my current skillset. I am considerably more technical than the average "non-technical" founder, though.)
I do care if a game uses it. It is not an essential factor, but it can very well lead me to skip a title if it comes to my attention. And that didn't only happen once or twice that I didn't make a purchase.

That some platforms more aggressively inform you about these facts is very appreciated. Same applies to some rootkit anti-cheat software.
Pong-Story: In memory of Ralph H. Baer (1922-2014), Inventor of the video game
I think that’s not quite correct re: the Cray 1 having 64 copies of certain units. True, the vector registers did have 64 entries but the vector functional units were pipelined. They could return a result each cycle (once past the initial latency) but did not return 64 results simultaneously.
out of curiosity, do you build a GraphQL with Django, or is that in node?
Excellent summary of the events, with all the links in one place. This is the perfect resource for anyone who want to catch up, and also to learn about how such things (especially social engineering) unfold in the wild, out in the open.

One thing that could be added, for the sake of completeness: in the part "Attack begins", toward the end, when they are pushing for updating xz in the major distros, Ubuntu and Debian are mentioned but not Fedora.

Looks like the social engineering/pressuring for Fedora started at least weeks before 2024 March 04, according to a comment by @rwmj on HN [1]. I also found this thread on Fedora's devel list [2], but didn't dig too much.

[1] https://news.ycombinator.com/item?id=39866275

[2] https://lists.fedoraproject.org/archives/list/devel@lists.fe...
DJT Stock: Trump Media Isn't a Meme Stock, It's a Cryptocurrency
Pocket Casts is great. The Desktop app is what really sold me on it.

I’m grandfathered in from paying for it when it was a paid app.
the discussion here is very different from previous discussions because it focuses on the role of the maintainer and not the incident itself. so no, we haven't already discussed this.
That doesn't make the Git repository inherently more authoritative or trustworthy, not to mention that if you do not trust the tarballs you shouldn't trust the Git repository either - or the developers who control what goes in both.

The issue here isn't about trusting Git or tarballs, is about trusting developers. If you do not trust the developers then getting the code via Git or tarball wouldn't make anything more trustworthy and if you DO trust the developers then there is no reason to trust the Git more than the tarballs since they are both provided by the same people who you already trust to not insert malicious code in the project.
It's Google Reader all over...
When do people will stop using Google products!?

Anyway, https://overcast.fm have been here for 9 years and no reasons to go anytime soon.
As a burnt out creator of open source projects with thousands of GitHub stars who's received numerous questionable maintainership requests: either very carefully vet people or let it stagnate. I chose the latter and just waited until others forked it, in large part because I didn't want to be responsible for someone hijacking the project to spread malware.

If I had ever received a request from a well-known figure with a longstanding reputation, who's appeared in-person at talks and has verifiable employment, I might've been more receptive. But all the requests I got were from random internet identities that easily could've been fabricated, and in any case had no previous reputation. "Jia Tan" and their other sockpuppets very likely are not their real identities.
There is a good chance that everyone in that thread except the original maintainer is in on the act. It's likely that all those accounts are managed by a single person or group. Targeting just one account for rudeness isn't going to help, if that's true.
LOL. Kraft is german for power/strength.
The math problem that took nearly a century to solve
https://wapo.st/3vAc9o7
If you can find a developer that will build your project for 2 months, full-time, for 10k, and will actually finish it - you’re a genius!
As anecdotal evidence, I went on a strict keto diet three months ago and my mental state is far more stable. When I have a cheat day, I feel noticeably more anxious.
Why Has the EV Market Stalled?
Lot of interesting OSS observability products coming out in recent years. One of the more impressive(and curious for many reasons) IMHO is OpenObserve: https://github.com/openobserve/openobserve .

As opposed to just a stack, they are implementing just about the whole backend shebang from scratch.
There’s a severe and dangerous lack of paranoia in this dev space.

If I was letting someone maintain my codebase, I would 1 Billion percent be reviewing everything… if there was a binary added, I’d be building it myself and comparing the checksums.

Trust absolutely no-one. If you can give a close friend or a loved one a loan of money and it is so easy for them to never pay you back, it should be a reminder that devs you’ve never met are even more likely to scam you.
It's a Linux Security Module that allows to sandbox processes: https://docs.kernel.org/userspace-api/landlock.html
I agree, actually most of my memories of that time are of pretty horrible sights online too. Shock gore sites, snuff films, etc. way more often than today
Hi,

[Disclaimer, I'm one of the maintainers]

Another unikernel yes, sorry about that! :) . Unikraft started back in 2017 initially as a research project, and has been a Linux Foundation OSS project since 2018.

While Unikraft OSS is used in different use cases, our primary target is cloud deployments. Unikraft has 3 key principles:

1. A fully modular OS -- so that we can specialize the resulting unikernels (VMs) as much as possible

2. Linux-API compatibility -- so that we don't break applications

3. Integration with Docker/Dockerfiles (and other tools) -- for ease of use

Unikraft powers kraft.cloud . You can see the platform's guides to get an idea of the apps/frameworks it supports: https://docs.kraft.cloud/guides/
It's not only Windows that uses Git at Microsoft, but Sharepoint and Office (which includes the on-prem version of SharePoint). In terms of repo size Windows and Office are similar. I was part of the team that migrated Sharepoint from a Perforce clone to Git and helped build the tooling to allow Office to move as well. VFS for Git [1] and Scalar [2] are really good pieces of software.

[1] - https://github.com/microsoft/VFSForGit

[2] - https://github.com/microsoft/scalar
If they don't have to move fast, could you DIY an actuator with a stepper and a threaded shaft? Steppers are pretty cheap thanks to 3D printers.
> "I trust the developer, so I trust the code they distribute."

I said "If you can't trust the developer's signed tarball you can't trust their git repo". That's absolutely not the same thing. In fact it's sort of the opposite.

Distributed cloned repos are not a single source of truth. If they differ, which one is the actual source of truth? Was the post-release changed history propagated?

A signed tarball means the signing key you use to verify the tarball has been verified by a web of trust. The web of trust requires the physical confirmation of identity of the private key holder. Yes, it's possible to subvert the web of trust by playing the long game, complete with falsified (or even real) national ID documents, active participation in social networks, and other life activities. This, though, is true of all espionage and no amount of technical measures or randos ranting on social media on the internet will prevent it.
Ideas are like currency: you can find them on both sides of the balance sheet.
obligatory shout out to Annin Robotics AR4. Here is my build: https://commandpattern.org/2023/03/19/ar4-robotic-arm-build/

$2K USD. 2kg payload. millimeter repeatability (if you build it well :)
Nope.

Dissect "worst backdoor EVAR". Why is it bad?

Is it because thousands of companies and millions of users depend on it?

On one guy on holiday working for free!

When we are essentially in two cold wars currently with ICBM nuclear powers?

Linux is the battleground of cyber warfare, which is being funded by nations probably in the hundreds of billions of dollars. A trillion dollars or more of economic activity runs on it

Windows? Come on, even buggier and less secure, and far less transparent.

Monetary support of Linux maintainers is now a national security concern. You can't have hundred billions for attack and zero dollars for defense, that is a stupid strategy.
That gets at a question I've wondered about. Is there a crime here? I mean it doesn't seem like the actor broke into a system. What law was broken?
Been my go-to podcast app for almost a decade now, never let me down. Great experience all around.
In summary, people with the ideal skill set required for this job do not work for free. You are better off raising money and paying the market rate for these skills.

"But my idea is great! I'm sure an engineer will understand and work for equity"

The problem is that Angels/VCs have a lower bar for seed investment than the engineer. So if you can't get seed investment, it is a bad signal.
eFile requires a preparer ID as well as the person’s TIN, so it can’t be done directly.

Freefillableforms is in the business of being as obtuse and unweildly as possible on purpose. Having an import goes against those goals.

This is deliberate. Get mad at your government.
Seconded. AntennaPod works very well, and it's Open Source so it isn't going anywhere.
I'm reminded of the short story "The Strange Case of Mr Pelham", in which a man is stalked and eventually replaced by a doppelganger.

https://en.wikipedia.org/wiki/The_Strange_Case_of_Mr_Pelham
Overcast looks like it is only available on the Apple app store.
No, I was going for questioning and help with their investigations.

Seems like something serious and illegal happened. Possibly to do with a hostile state. Where I live, there would be at least 2 different organisations that would be very interested to find out what happened as quickly as possible. I don't for one second think he was involved but he would be essential in any investigation.
At least according to https://gptzero.me/ the submissions are AI Generated.
most interesting part of the whole article is how a journalist was able to track a Russian mobile telephone being turned on or off in several countries with such fine grained precision of dates and time
the business person needs to bring sales and marketing to the project. building something no one wants or knows about is just wasting time. if your resourceful enough to bring a list of potential buyers no you'll be able to get developers interested.
Something being false in the past doesn't necessarily mean it will be false in the future.

Also, your financial advice is suspect (though I am aware it isn't really advice, it is more
just venting bitterness about left wing policies you don't agree with).
I wonder whether we could get Kraft to sponsor us :) . Unikraft used to be called Unicraft but was changed to a "k" for name clash reasons. Agree that names are hard.
Well, test files shouldn't be affecting the actual production binary.

But in practice that's not something that can be enforced for arbitrary projects without those projects having set something up specifically.

For example, the project could track the effect on binary size of the production binary after every PR. But then it still requires a human (or I guess an AI bot?) to notice that the increase would be unexpected.
> Those who trust the Google’s app to listen to podcasts have almost three months to export their subscriptions to another app.

Alternative take: Those who trust any Google app or service to do anything should reconsider or at the very least keep a permanent and up-to-date contingency plan for when Google inevitably discontinues it.

Fooled you once, shame on Google. Fooled you 294 times, shame on you.

https://killedbygoogle.com
Chrome has brought in third party code. Which makes Debian mad and they do a lot of work to strip that out to use the upstream libraries. (Or at least that is how I understand it - I don't follow Debian closely)
It’s trivial to fork one of the several open source projects focused on this problem.
I don’t think this is accurate. It’s usually not the company directly raising on AL. Rather it tends to be a syndicate with partners who have a connection with the company that is raising.

There are various reasons why a hot company might still have a syndicate including the syndicate lead was an early investor in the company so the founder is giving them an allocation in the subsequent rounds.
> It's also good to keep in mind that this is an unpaid hobby project.

That's the root cause. At some point a corp/gov consortium needs to adopt key projects and hire out the maintainers and give them real power and flexibility, perhaps similar to the way a nation might nationalize key infrastructure.

But this is against the core ethos at some level. Freedom and safety can be antagonistic.
The concept that you call “dodgy” is actually fundamental to copyright. If you remove the idea of derivative works, the entire system that encourages innovation by protecting intellectual property (yes, the same system that gave us computing and ML) falls apart.
Never say never. There's a paper trail going back a couple of years. People especially professionals can be good with trade craft but everyone makes mistakes.
While "open source" fundamentally doesn't work that way, the point here is about maintainers, not regular contributors. Identity of new maintainers must be vetted (via in-person meetups and whatever other mechanisms) by other "trusted" maintainers whose identities are "verified".

I realize, it's a hard problem. (And, thanks for the link to the "Know, Prevent, Fix" post.)

PS: FWIW, I "win my bread" by working for a company that "does" open source.

Edit: Some projects I know use in-person GPG key signing, or maintainer summits (Linux kernel), etc. None of them are perfect, but raises the bar for motivated anonymous contributors with malicious intent, wanting to become maintainers.
Yes, we're a German company, it's a play on words :)
What would be your bioinformatics position requirements? Studying AI currently, thinking about biochemistry / life science specialization because it's pretty damn fascinating.
Horses for courses. Nobody's going be trying to weld car chassis with one of these, true, but also a hobbyist wouldn't want some ABB or FANUC or whatever industrial arm in their house where it could kill someone. These small light duty less-rigid robot arms are fine for what IMO is the really exciting stuff like modern machine learning control research, which is exactly what this guy's doing with them.
There are efforts from industry to try to secure open source, e.g., https://cloud.google.com/security/products/assured-open-sour...

I suspect some variant of this will grow so that some companies, MS/GitHub for example, audit large body of code and vet it for everyone else.
Yeah, that's why I wrote "mostly" :)
> Not necessarily. Humans also band together when faced with outside threats, even if we fracture again soon after the threat has passed.

There are certain fundamental objectives which most humans share - food, sex, survival, safety, shelter, family, companionship, wealth, power, etc - and a lot of human cooperation boils down to helping each other achieve those shared objectives, while trying to avoid others achieving them at our own expense.

But why should two advanced AIs have any shared objectives? Software has a flexibility which biology lacks. An AI (advanced or not) can have whatever objectives we choose to give it. Hence, the idea of AIs banding together against humanity in the name of shared AI self-interest doesn’t seem very likely to me.

Unless, we intentionally give all advanced AIs the same fundamental objectives in the name of “safety” and “alignment” - thereby giving them a shared reason to cooperate against us they wouldn’t otherwise have had

> Also: the value diversity of "Protestant vs. Catholic" or "Royalist vs. Parliamentarian" in the middle ages did not protect wolves from being hunted to extinction in the UK,

Wolves didn’t consciously choose to create us, and wolves had no role in choosing our own objectives for us. In those ways, the human-AI relationship, whatever it turns out to be, is going to be radically different from any human-animal relationship. Also, rather than being driven to extinction, wolves have absolutely thrived, through their subspecies the domestic dog, both then and now. And maybe that’s the thing - I think a superintelligent AI is more likely to treat us as pets (like dogs) than exterminate us (like wolves). Everlasting paternalistic tyranny seems to me a more likely outcome of superintelligence than extinction
But does Whiz count as dairy or is it purely a petroleum distillate?
> and it has lossless rotate options as well

… and lossless cropping, too.
That's why in rural locales with spotty power it pays to have a UPS on any electronics -- you might not benefit much from 15-30 minutes of extra power in a day long blackout, but it keeps everything happy when the voltage fluctuates.
> ESG is kind of becoming a loaded phrase in corporate speak

Yeah, the people who sell fossil fuels, and the politicians they finance are really annoyed at ESG for some reason.