skysight-inc/HackerNews huggingface dataset:
Google to delete Incognito browsing data & pay millions in privacy settlement! Learn what it means for your privacy & how Incognito mode works
The tarball, with its signed hash, is the authoritative source with immutable ID.

Not every project uses git. Not every project uses a public VCS. Git history can be changed with a simple command and is unreliable.

The point of a tarball is that it is the distribution medium of a source release. The developer generates the generated code (where required), runs all tests (eg. `make distcheck`), then when satisfied it's good, signs it and releases it. If you can't trust the developer's signed tarball you can't trust their git repo either, since it's the developer you can't trust.

A downstream, such as a Linux distro, uses the release tarball because it's the single, verifiable, published source of truth. They should be able to do reproduceable builds from the tarball (not being able to do so should be filed upstream as a bug), and for licensing reasons (eg. GPL) need to keep the tarball and make it available to anyone to whom the software is distributed.
Workers must self-manage and take decisions based on company documentation.
Side question: does anyone know how msn seems so impossible to scrape? What’s the magic they’re doing that other sites aren’t?
Looks great!

Would this work for hosting databases too? I found the biggest annoyance and expense on my "infrequently accessed" side projects are databases, which are almost always idle.
I found the Boeing manager!

Perhaps you and I view the world in a different light, but in any organization where there is even some semblance of hierarchy, the manager is, at the end of the day, always responsible.

If management isn’t aware of what’s going on on the factory floor, then that’s definitely a failure of management. If they didn’t receive any signals, management should’ve investigated. If they hired 100% incompetent people they should’ve hired better people.
Breaking Silos
I find this too at work all the time. People are very quick to branch off some “independent” feature into its own service or lib and repo. Great for them when building, tiny repos do have that greenfield clean slate feeling, but awful when you realize the integration points aren’t as simple and well understood as they first thought.
they (well, Linus) invented git for their purposes, and not the other way around. They use git and mailing lists because that's how they work, and that's how they worked before git existed. git was built for them.
https://archive.ph/WYdVW
This one is working: https://archive.ph/WYdVW
Silobreaker | Software Engineer | Hybrid - Onsite in Stockholm, SE | Full-time | https://www.silobreaker.com/

Our mission is to advance the landscape of intelligence by breaking down information silos and harnessing the true power of data at speed. We are dedicated to being the leading force in transforming raw [unstructured] information into timely and actionable insights, providing a unified and collaborative platform that serves as the single source of truth for threat intelligence professionals.

I'm team lead for one of our development teams and we are searching for backend/full-stack engineers at all levels to kickstart the formation of an entirely new team.

Our stack is composed mainly of Microsoft tech i.e., C#/.NET, Typescript, MSSQL. We have a hybrid cloud setup, some services run on-prem while others in AWS.

All engineering roles are based in Stockholm. We currently do not sponsor visas or relocation.

Introduce yourself and include your CV by emailing the address in my profile.
Monorepo doesn't "work around" it, it means you have to support everything (including migrating/BC) on the current version, instead of having to support old stuff on the old version.
Workers must self-manage and take decisions based on company documentation. That's what being responsible means.
That's not a monorepo.
is it effective or just really everywhere in the codebase like this article suggest?
I don't fully get everything Denuvo does but it seems like if I replace Denuvo with my own mandatory HTTP call it would be as annoying to crack.
It used to, but now I think they added it to the 'main' one.
Annoyed reading this one the 2nd but also a tad fooled because I thought of this in the context of a nuclear-option remedy to the XZ fiasco that's still lingering in all our heads.
> Nixpkgs doesn't include the packaged software source code, so it's a lot more practical than what Debian is doing.

This is the key difference. OpenWRT is a “monorepo” too, but it downloads tar balls etc of the upstream software. Makes sense.

Putting the source code of the upstream software in a monorepo sounds like a nightmare…
> There aren't any big long base blocks at all.

Linux Kernel. libc. Compilers. Programming Languages. Big libraries like filesystems, while generally not open source, system ROMs. Tons of network and system RFCs, standards like POSIX.

These are these long, wide, thin slabs you don't see. Others are too high level. These slabs are very close to metal. You're not kneeling enough. :)
I thought it would be because waves travel longer distances on water.
why should a package like ssh have so many random dependencies

It's worth noting that vanilla upstream OpenSSH DOESN'T depend on xz. The dependency was patched in by the major distros to better integrate with systemd - and it's (AIUI) a transitive dependency from systemd - even the patch doesn't use it, but it gets pulled in with other systemd stuff.
SSD using Quantum Mechanics [video]
The LLM can do the research itself, just current LLM's often don't by default (and require a bit of prompting).

LLM's also use calculators (and again, if you prompt ChatGPT it will use a calculator to generate the result).

These things are solvable, we are still in the 'Commodore-PET' phase of LLM's development, i.e. impressive for today but lots more to do to make it more useful for most people.
That's amazing.

Reminds me of those early 2000s Russian ones.
The real problems with monorepos are that most of the benefits vanish as the scale increases unless you invest into building more monorepo tooling.

In your particular case, if your library becomes too popular, your one or two line implementation detail changes ripple out and trigger rebuilds of too many downstreams, many of which will have flakey tests and fail your MR. If most users are not actually depending on that functionality, or if you simply are doing semver properly, then you could avoid rebuilding those dependencies. Eventually the builds take too much time and CI rejects the pipelines or you continuously bump the build timeout but wait longer and longer for your changes to go live. You can solve these problems, if you invest in more monorepo tooling.

Similarly, once you are too popular a library in a monorepo, you will never do any atomic breaking API changes since it would require updating too many downstreams. Instead you will fake version it: add a new API, migrate users to it in multiple commits, delete the old version. Some of these migrations run out of steam midway in the biggest phase: phase 2. This approach does have the benefit of forcing the upstream author to make the two versions of the API co-exist.

Of course I am talking about scales where real limits start to break down. When your codebase is larger than your ram, an index won't fit into RAM anymore and every code search requires disk or network I/O. Eventually your repository doesn't fit on disk anymore and you interact with it with a special IDE and only download things you start editing or perform sparse checkouts in the first place so discoverability is again a problem.

Edit: of course some problems crop up sooner than hard limits are reached, like the flakey test issue I mentioned as well as visibility and control of changes to actual maintainers.
> It’s most likely our actor just mashed plausible-sounding Chinese names together.

Also from that writeup. It also links to https://rheaeve.substack.com/p/xz-backdoor-times-damned-time... which suggests the actual TZ of 'Jia Tan' to be UTC+02/03
AI Mathematical Olympiad: $1,048,576 Kaggle Competition
There is a reason there is no standard hobbyist-grade robotic arm.

People think they can build their own robotic arms for leas than a "real" robotic arm costs, but the do not account for wobble or repeatability.

With all due respect to the person who posted a design for a robotic arm made with RC servos on HN, I would like measurements of the repeatability. Have it draw the same pattern on a piece of paper every day for a week. Show me how closely the 7 lines overlap. I doubt that it can draw such a thing; it will tear the paper or get jammed without the strength to tear the paper.

Source: I've been building hobbyist robots since the 1980's, researched robots in the 1990's including a masters thesis, and teaching robotics for most of the last decade.
"how rare melanoma is"

For a rare disease, I have already met too many people who have/had it. Lifetime risk is about 1:100 for white Europeans, not exactly commonplace, but not that rare either. I definitely don't ignore anything that happens on my skin, that would be a stupid way to die.
How to get Xfinity Stream to work on Linux (2022)
Right from the horses mouth:

https://news.ycombinator.com/context?id=39863371
No, they run their own crawler against the URL you provide (IIRC, it's a headless Google Chrome [1]). For some special / often-requested (?) sites the people behind the project have:

- implemented post-processing to strip ads and tracker beacons

- bought legitimate accounts that they use to bypass paywalls (some of them show up as remnants in the archived pages' code, some of them show up when you request an archive of the site's account management portal, some show up as HTTP traces during the archival process - the crawler will dump every URL it requests on a "WIP" page, and for some, auth information like JWTs is passed in the URL)

- implemented anti-nagwall features (some sites are "vulnerable" in their paywall/"you read X articles, end of free limit" by pressing the ESC key to disrupt the JS of the site)

[1] https://blog.archive.today/post/618635148292964352/what-scra...
I really don’t understand this viewpoint. I use ChatGPT almost daily to help with my professional work. I regularly ask it to do things that I know how to do and have done many times, but don’t want to write from scratch. That coupled with things I know how to do or know are possible, but don’t wanna have to go read all the documentation to remember the parameters to pass into a CLI tool or similar.
Ideally somewhere between "you're not allowed to take my things" and "you're not allowed to learn from what I tell you".
Plain Text Offenders FAQ (2016)
Health Alert: First Case of Novel Influenza a (H5N1) in Texas, March 2024
> but are there any practical home uses others have found for robotic arms? Hacking is always more fun with a good project.

A reader of this thread that had a temporary disability posted some ideas about practical uses:

https://news.ycombinator.com/item?id=39903953
> There can be no new oil and gas infrastructure if the planet is to avoid careering past 1.5C (2.7F)

The 1.5C goal is already practically impossible. We have not managed to slow down the increase in atmospheric CO2 at all, not even a dent in the grand scheme of things. It is so unrealistic that I wonder how anyone can seriously expect that goal to be met. How should it work? We continue like always and just shut everything down the last moment?

PDF, Page 21, Figure 18: The Mauna Loa CO2 record: https://www.thegwpf.org/content/uploads/2024/03/Humlum-State...
This guidance is far too specific to make sense in the general case. Not every scenario has the same constraints. If I had to pay a 2 year maintenance cost for every library I write and wanted to reuse between projects I'd never end up writing it. If you can migrate all library clients over to the new version, there is no reason to maintain old versions.
I mean from looking back as a non participant in either (way too young to even care), it seems like occupy Wallstreet and the alt right pretty much pretty much had a similar message, some people have used money and power to make the US far more unbalanced and it's grinding people down. So 2008 seems a good benchmark
An actual funny April Fools campaign I've seen
I was browsing X today and stumbled on this site that claims to have launched the first "physical store selling survival gadgets" for customer support professionals. As a SaaS founder this site really hit home and got me.

You can buy items like patience pills or the german invoice template (which is actually hilarious AF). After you checkout you are presented with a little April Fools screen aka a marketing text about the customer support SaaS behind the idea.

I saw quite a few April Fools jokes yesterday but most were pretty boring. This seemed like they actually put in some thoughts. I feel like everyone, even companies are super lazy in 2024 so it's refreshing to see some creative stuff once in a while.
Looks like microVM.
Bah

The OSI doesn’t get to define open-source.

By definition: yes, they do.

The SSPL only impacts cloud-providers

It impacts all people who manages mongodb for somebody else, which is a lot of hosting providers (many of which probably do not care about the licence and are too small to get caught)
Backblaze backups about to go poof for EU/Indian customers
After reading multiple raving reviews here and elsewhere, I decided to use Backblaze for remote backups.

This Feb, my payment (auto debit via CC) failed, and upon logging in could not figure out any other way to pay.

I soon received an interesting email from them ( https://i.imgur.com/p19SaFX.png ) which said they do not support Reserve Bank of India (RBI) 's e-mandate policy and advised me to use a card which does not include e-mandate. European customers have a similar issue due to 3D Secure.

I as an Indian citizen only have RBI authorized credit cards, which have been on e-mandate since late 2021. I have faced a similar issue with card auto debit on other websites as well due to this policy, however they all support alternate payment methods.

Backblaze does not, and has provided no alternative since this cropped up 2 months ago. Customer support has no solution as well. I just received an email that failing further payment, my account will go poof next month.

How a company running a critical service such as backups can screw up so badly regarding a fundamental business requirement such as billing is beyond me. They will simply cease operating for almost all European / Indian customers in a little over a month's time.

Even if they manage to dig themselves this, not sure one can trust them enough to continue being a "going concern".
Yes, I agree with you there. But managers have a responsibility to make sure systems are in place where if a worker does not self-manage or make a bad decision, this gets caught early on, not 34,000 feet up in air.
That is worth noting, thanks for posting this and letting me know.
Show HN: FizzBee – Formal methods in Python
GitHub: https://www.github.com/fizzbee-io/FizzBee

Traditionally, formal methods are used only for highly mission critical systems to validate the software will work as expected before it's built. Recently, every major cloud vendor like AWS, Azure, Mongo DB, confluent, elastic and so on use formal methods to validate their design like the replication algorithm or various protocols doesn't have a design bug. I used TLA+ for billing and usage based metering applications.

However, the current formal methods solutions like TLA+, Alloy or P and so on are incredibly complex to learn and use, that even in these companies only a few actually use.

Now, instead of using an unfamiliar complicated language, I built formal methods model checker that just uses Python. That way, any software engineer can quickly get started and use.

I've also created an online playground so you can try it without having to install on your machine.

In addition to model checking like TLA+/PlusCal, Alloy, etc, FizzBee also has performance and probabilistic model checking that be few other formal methods tool does. (PRISM for example, but it's language is even more complicated to use)

Please let me know your feedback.
Url: https://FizzBee.io
Git: https://www.github.com/fizzbee-io/FizzBee
Please, these kinds of purple-prosed thesaurus-laden ruminations smack of LLM augmentation - two in the same thread, and neither contributing anything much more than a long winded flowery restatement of the existing state of the discussion:

https://news.ycombinator.com/item?id=39876685
https://news.ycombinator.com/item?id=39876634
i was reading your comments on an old hn thread and you entertained the idea of writing again for the blog post, so i had to check
It depends.

If you drop a library for internal usage only and you want to change the contract, and the tests, library, and api are all in the same repo, you just change them in a single PR and that's done. This works because the single commit hash contains all information. It requires people put their code in the monorepo and hookup their tests, but assuming they do, you can build a reasonable degree of confidence on a green build.

Once you separate the library different repo, and let people consume that as something in their own repos, you need to do the versioning dance as you have no idea if their still is still working.

A lot of people go for the latter because it contextually allows them to ignore the rest of the stack, and there are some pros to doing this, but testing, deploying, versioning, etc, all become more difficult, and that's something struggle with.

Thus, unless you have a crap load of code / commits, monorepos arguably have more advantages than disadvantages.
Time flies, it was actually 4 years ago: https://redis.com/blog/new-governance-for-redis/
In Defence of the EU
There's two things going on for nuclear plants in Japan:

- they need water, tons and tons of water, and there's only mountains inland. So any nuclear plant will be on the shore, where tsunamis will hit first.

- there is no safe place from natural disaster. Even building a miracle plant on a mountain top would still leave it vulnerable to seisms, typhoons and land slides.

All things considered, the main issue is how much the nuclear plant is suppose to be resistant to tsunamis and earthquakes, and the higher the threshold the crazier the expenses become.

For Fukushima, it was a classic example of design failure (failsafes were supposed to work except they were badly designed, and there was too few of them), and no proper reaction to earlier warnings of the system in place being too weak. In a way, all the blame is clearly on TEPCO however we put it:

https://www.e-education.psu.edu/earth107/node/1426
What do you think of the openbsd model? It has a mono repo for the os and a ports repo for everything else

(I think)
No. It makes sure its inputs are unchanged, but you can still do anything impure within a buildscript called by nix.

It would fix the tarball differing from upstream, but it would still allow the patch to be applied during build
The Soviet system? Whether we like the ideas in the article or not, that's not even remotely similar to what's being discussed.

We can't have discussions around financial topics if we do things like describe any financial policy to the left of pure lasseiz-faire as "Soviet."

Robeyns proposes two upper limits on personal wealth.
Most countries with a solid social safety net should
bake a 10-million-euro (approximately $10.8 million)
cap into their social and fiscal systems, she argues.
As an ethical guide, individuals should limit themselves
to 1 million (perhaps $5 million in the less secure United
States, where one mistimed hospital bill could be enough
to thrust a household into bankruptcy). She also notes
ruefully that both proposed numbers are also less restrictive
than some philosophers’ ideal: In The Laws, for instance,
Plato argues that the wealthiest people shouldn’t be able
to have more property than four times what people with the
least have.

So, to be clear, you could be quite financially comfortable.

I understand perhaps, a little bit of what you seem to be grasping at. Whatever hard limits we set, people will game them. The first thing that comes to mind is that if we set a naively set a hard limit on personal wealth, people will hide their wealth in other ways.

Example: perhaps I am permitted to have "only" $10 million in personal wealth. However, my $100bn company "just happens" to let me use its $100 million yacht for 200 days per year and they also provide me personal chefs and so forth. So I have the lifestyle of a billionaire, thanks to the company I own, regardless of what my bank account says.

But... Soviet? Come on.
i was going to ask if turtlebot was too small for you, but thought i should check the price first so uh, yeah, i'm guessing you're thinking the 250 price point instead of the turtlebot's 1000+
Swarm is a great lean solution and next good step after just docker compose files.
Disappointed to find that this was not about Mike Skinner's first album
This is orthogonal to mono-repo vs not mono-repo and indeed distribution mechanism.
No. Nix pulls in tarballs/sources like any other package build system.
Qt 6.7 Released
This should rank higher. Absolutely mind-blowing stuff
My comment history has been calling Altman a menace for a minimum of a year or two, probably longer.

For a long time it got me downvotes and dirty looks. Then it was few votes and the occasional “no shit”, then it was just kind of quiet, and it’s about to be consensus.

There was a big PR campaign around him personally, and it worked as intended, and if he hadn’t gone this far this fast, it might have remained effective.

It still might.
FWIW, the book The Identity Trap by Yasha Mounk attributes the popularisation of what it calls the Identity Synthesis to social media such as Tumblr, then later Reddit, Twitter, Instagram; and web sites such as Thought Catalog, later Jezebel, xoJane, Rookie Mag, and the Daily Dot, then everydayfeminism.com, Salon, Vox.

I think it's conceivable that, while these ideas on the left and right later entered all social media and even mainstream media, they originated on Tumblr and 4chan, respectively. I wonder whether one could quantify/measure it somehow.
It must be hard to see another company make profits from a product you have the IP of. However, availability of Redis in major cloud providers is also a reason for Redis' success.

And is it really a good idea to put your entire business strategy relying on hosting an OSS solution, when container technologies are more relevant than ever, and when you have major players who can leverage economies of scale against you?

Hosting is a DevOps service, not a Software service. It's appealing because of the SaaS economies, but I think OSS companies should try to be a bit more innovative if they want to monetise open source solutions and their assets...
If that is enough for you, then that is good

You may need data persistence (keep the data live while you restart your process), cross-instance coherencies could be nice too, automatic data expiration too.

But if you do not, then it is ok!
Thanks and, yes it does!

We have a whole section in our documentation's guides section on example usecases with database:

https://docs.kraft.cloud/guides/#databases

They work exactly as you suggest, they scale-to-zero when no requests are made and data can be safely stored/transactioned in persistent volumes on the platform too.
You can “fork” inside the monorepo too, just take a copy.
No need to look that far, ncurses is also tarball/patch-based.