skysight-inc/HackerNews huggingface dataset:
XZ was just the exploit we found
How do we protect ourselves from the ones we haven't found yet? What are good security practices that might have lead to this exploit never making it to a dist package.
Juniper (YC W21) | Senior Software Engineer | NYC | Full-time | juniperplatform.com Juniper operates at the messy financial infrastructure layer for US Healthcare. We’ve built an end-to-end insurance billing system for recurring care, starting with Autism clinics.

Healthcare in the United States runs on private and public insurance billing, but providers spend huge amounts of time on faxes, phone calls, and error-prone legacy systems to get paid. That’s not why they got into care.

What’s worse, these systems aren’t hugely successful—clinics regularly get back 80% what they know the insurance company should pay. Those missing dollars could be used to hire more care providers to help more kids, but instead line insurance companies’ pockets.

We’re changing that.

At Juniper, we’ve built an end-to-end billing system. It starts with ingesting from a clinic’s EHR, then create, validates, and submits claims to insurance providers across the country. If claims need corrections or appeals, most of the time we can handle those automatically or our CX and Operations team use our in-house internal tools. We also handle patient invoicing for co-pays, co-insurance, and deductibles (we never send anything to collections.)

Our typical paid rate is above 95%.

We are a team of 25 with strong product market fit—we’ve had to push out onboardings because engineering can’t build quickly enough.

You’ll be working with an engineering leadership team from AWS and Stripe to get doctors and clinicians back to work helping kids.

Email me at chris@juniperplatform.com
It's a technology problem, not a people problem. We have simply made technology where it is too easy to eventually make a simple mistake.

For one obvious, simple example, most tech is optimized for "Make it easy to access all data from anywhere" as opposed to "require affirmative consent for connections to all new locations". It is surprisingly difficult to lockdown most systems, whether they be laptops or server networks, with that easy rule. Just look at folks who use Little Snitch - it can be difficult to use this effectively because so many apps need to talk to so many different servers that it can just be exhausting attempting to determine if a new connection is malicious or not.

Similarly, look at some recommended settings for a "secure" Content Security Policy on the web. There are a boatload of different options that are recommended to be set, because the original defaults (e.g. "Sure, you can load me in an iframe of any other site!") are so insecure.

As a consequence of this, it's very difficult for any (a) organization that can't afford top-notch security folks or (b) organizations that are so large, with a potentially huge history of acquisitions over time, with a giant surface area where all you need is one "chink in the armor", to prevent breaches.
They provide a default.

I suppose in nextjs it's the only option?
You don't want your embedding model to be trained only on ImageNet even if it's a small embedding model because the dataset is not very diverse and the bias of training the model on cross-entropy loss on 1000 classes, for a small embedding model is much better to use DINOv2 distilled models like ViT-S/14 (21M parameters), model trained and distilled on 142M images without supervision, so no bias in the training objective.

Btw the splitted batch normalization is very interesting, I wonder if this splitted normalization can also be applied to other types of normalization like layer normalization on transformer models.
See my answer "what's cool about deno" https://gitlab.com/brlewis/brlewis-aoc/-/blob/main/README.md...
Bun has been great as a package manager, test suite runner and typescript interpreter. We use node in prod
Mintlify (YC W22) (https://mintlify.com/) | On-site (San Francisco) | Full-time

We're hiring a full stack engineer to help build world-class documentation. Our tech stack includes Next.js, Tailwind CSS, Typescript, and Node.js. You can find the role here: https://www.ycombinator.com/companies/mintlify/jobs/pk3AAR7-...

We're a small team of 7 people and we are all very intrinsically motivated and hard-working individuals. We want to set the standard for modern documentation.
Huge fan, thank you for your hard work! This is ok outstanding!!
For non-rejecting promises, `await Promise.all(promises)` is basically performance equivalent to `for (const p of promises) await p;`. In case you think the second one does serial work, here's a codepen for you. https://codepen.io/tomtheisen/pen/QWPOmjp

The "inner workings" could be a for loop, with the exception of rejected promises. The only opportunity for quicker resolution is when one of the promises reject, at which time Promise.all() immediately rejects.

I think the allegations of "easier" are significantly overblown too.
Assembled (https://assembled.com/) | San Francisco, CA | Software engineer - Infrastructure | Hybrid

We're hiring an engineer to rework critical components of our infrastructure. Some examples include improving our caching mechanisms to deliver millions of real-time, user-facing metrics, and building data pipelines to support machine learning models that predict volume and generate staffing requirements.

Assembled is a Support Operations platform that assists companies in delivering exceptional customer service at scale. We support over 250 companies, including DoorDash, Stripe, Ramp, Salesforce, and Robinhood, by making optimal staffing decisions and improving performance and productivity (yes, sometimes with AI).

Apply here https://boards.greenhouse.io/assembled/jobs/4410713004 or email me at natasha (at) assembled.com
All the big LLM APIs work via similar HTTP Requests - you can do them with curl, python, Tasker, Apple Shortcuts, anything that can do a HTTP POST.

Start from a playground/workbench page like https://console.groq.com/playground (you may need to sign up with a credit card, I forget, but it's pennies per month). Under system, tell it how to act - put "You talk in a cockney accent". Under user just say "hi". Press submit to see how it responds.

Click the "View code" button below to see all the HTTP requests parameters in different flavors. curl is probably easiest since you just paste it into terminal on mac. Just set the API key variable first. You get a key from the API keys page.

Once you start getting responses that make sense in terminal try it in https://reqbin.com/post-online . Figure out where the parameters go. Then try it again in Apple Shortcuts - it will look like this https://imgur.com/a/xqqhJh6.png . On mac some tools that can trigger apple shortcuts via hotkey are BetterTouchTool or from the "spotlight bar" Alfred Workflows works well, but there's probably all sorts of ways. On Android I use Tasker which is similar to Apple Shortcuts. For voice recognition I use Taskers in-built Google voice recognition. On the mac I am using OpenAI Whisper via HTTP POST. It's all duct tape and bubblegum behind the scenes - just start small.
They didn't mix anything up, rather they asserted the definition of reasonable being employed by Google was wrong.

You say you offer an incognito mode. Google says it's clear to everyone that they and everyone else it's okay to and normal to track you through it.

Everyone else goes "that's not reasonable at all".

This is basically Google saying "Well, it was a good run while it lasted."
> With a bit of experimentation on Imagenet-1k, we can reach 82.0% accuracy with a 176x176 training image size with no extra data, matching ConvNeXt-T (v1, without pre-training a-la MAE) and surpassing ViT-S (specifically, the ViT flavor from DeiT-III).

This is of no surprise, and well known. ViTs excel when data is plentiful, but perform less well than convolutions in lower data regimes. ConvNets on the other hand (resnets for example) don’t do as well in high data regimes. Imagenet is considered “low data regime” compared to what ViTs get normally trained on, most SOTA ViTs on imagenet are typically pre-trained on MUCH larger datasets (e.g. JWT300)
Location: Dublin
Remote: Yes
Willing to relocate: Yes
Technologies: CAD, Renewable Engineering, Python, C, Assembly.
Résumé/CV: Text me at my email for CV
Email: kiliandhwoods@gmail.com
While there's plenty of blame to go around for the government's disinformation campaign, never forget that the entire cast of FauxNews personalities were decrying the initial cautionary stance as a politically motivated hoax and then turned around and changed their tune when it didn't turnout to be a dud like SARS 1.0.

https://www.youtube.com/watch?v=ifKbwDf51bA
Hence why a Denuvo protected game exe can easily be hundreds of megs.
SEEKING WORK

Location: Thailand/Vietnam/Singapore/Japan (Asia)

Remote: Yes, nomading right now.

Technologies: Python & NodeJS (Typescript), Django, Flask, AWS, Terraform, Svelte, React, Postgres, K8s, MongoDB. More here: https://jasonkelly.dev

Résumé/CV: https://jasonkelly.dev/cv.pdf

Email: jason {@} jasonkelly {.} dev

~

I'm a Software Engineer with ~12 years of experience. I've worked across a fair few stacks at this point but have a fair amount of experience in Python & JavaScript, not to mention general DevOps stuff. I've also worked across a few different roles, from Lead Dev to Engineering Manager.

I'm currently nomading around Southeast Asia and am keen to find some contract/freelance/consulting work. I'm pretty flexible with what I'm looking for in all honesty, my main want is to help solve problems and write some great code.
Those seem like really bad numbers to me, considering the base rate fallacy. Most of what people test with something like that is probably not going to be AI-generated, which could mean getting massive numbers of false positives.
They are working hard to invent SkyNet and we must fund them in perpetuity so they can protect us from SkyNet
NetBEUI - that's it.
>> I've found golang is significantly simpler to get up to speed on from a c-family based education (c/c++/java) so I'm curious if these teams were both proficient before starting the projects.

Coming from a similar background, I have found Golang to be a nice, more efficient replacement for Java because it works great for backend web services, middleware, etc. Go is easy to learn and brings most of what is needed in its standard library (similar to Java).

Rust's sweet spot is where C and C++ shine: performance critical, maximum efficency required software such as operating system components, device drivers, media applications, etc.

Rust does have a learning curve, but most of what it enforces are best practices: 1) multiple readers or one writer resource usage, 2) organizing code hierarchy into trees, 3) sane patterns for concurrency, etc.
I don't think the bun devs are currently parcelling things up like that so doubt this would be worth the effort at this time, i.e. I don't think they're backporting any fixes from 1.1 into a 1.0.x release.
I can give a bit of perspective here.
I'm currently porting our the Vanilla Forums frontend (~500k lines of typescript) from using Node, Yarn (we used it back before npm supported lockfiles) and Webpack, to build with bun and Vite.

There are a few notable differences:

- The out of the box typescript interoperability is actually very nice, and much faster than using `ts-node` as we were before.

- Installations (although rare) are a fair bit faster.

- With bun I don't have to do the frankly crazy song and dance that node now requires for ES modules.

- Using bun is allowing us to drop `jest` and related packages as a dependency entirely and it executes our test suite a lot faster than jest did.

For my personal projects I now reach for bun rather than node because

- It has Typescript support out of the box.

- It has a nice test runner out of the box.

- It has much runtime compatibility with browsers (`fetch` is a good example).

- The built-in web server is sufficient for small projects and avoids the need to pull in various dependencies.
I wonder if one of the hidden sounds could've been 2600Hz.
I've heard that it was only detected because the developer that found it was using different compiler flags than the default. Under default settings, the backdoor was stealthier.
I think Haskell's warning-in-the-doc approach is not strong enough. I'd be in favor of distinguishing small and huge values using the type system. Have a Rust enum that contains either a small-ish number (the absolute value being 10^100 or less, but the threshold should be configurable preferably as a type parameter) or a huge number. Then the user will be required to handle it. Most of the time the user does not want huge numbers, so they will fail the parse explicitly when they do a match and find it.
i can "start an ai business" too simply by incorporating.
>There are plenty of states where demand is stagnant and so are prices

You mean like the Rustbelt where all their good jobs got outsourced? Yep… you might be onto something here.

The difference is California is artificially restricting supply (i.e., market manipulation) by making it more difficult through zoning laws and permitting. It’s intentional. This is good for homeowners who want to pull up the ladder on the next generation (including their kids) who will be priced out. This is why jobs continue to move to Austin, TX or Raleigh, NC. Money goes where it’s treated best. California thinks it’ll never kill its golden geese, but it looks like they will. There’s a reason there was an exodus from places like the Bay Area during the pandemic and remote work—-people only live there for the income potential and once they didn’t have to, they moved as fast as they could to other places.
An interesting thought experiment, but there's a flaw in it, an implicit fallacy that's probably a straw man. On its own, the argument would likely stand that Mary gains new knowledge on actually being exposed to color.

However, there is a broader context: this is supporting an argument against physicalism, and in this light it falls apart. There are a couple of missing bits required to complete the experiment in this context. The understanding that knowledge comes in 2 varieties: direct (actual experience) and indirect (description by one with the actual experience using shared language). This understanding brings proper clarity to the original argument, as we are aware - I think - that language is used to create compressed representations of things; something like a perceptual hash function.

The other key bit, which I guess we've only considered and extensively explored after the argument was formulated, is that all information coming in via the senses goes to the brain as electrical signals. And we actually have experimental data showing that sensory information can be emulated using machines. Thus, the original argument, to be relevant to the context, should be completed by giving Mary access to a machine that she can program to emulate the electrical signals that represent color experience.

I posit that without access to that hypothetical machine, given the context of the experiment, it cannot be said that Mary has "learned everything there is to learn about color". And once she has comprehensively and correctly utilized said machine on herself, she will gain no new knowledge when she is exposed to the world of color. Therefore this experiment cannot be used as an argument against physicalism as originally intended.
Google Pledges to Destroy Browsing Data to Settle ‘Incognito’ Lawsuit
>It's a little ironic that e.g. Arch, which actually shipped the malicious code to end users since it publishes changes so much faster, as shipped never would have executed the payload (because they didn't patch OpenSSH).

The backdoor was designed to only be injected during the building of an RPM or Debian package. Arch never would have been impacted no matter what choices they made. They were trying to hit production systems while minimizing their potential exposure to other less important types of users beforehand.
Suno v3
> California has a GDP comparable to India...

California's a big economy. But it's not (at least superficially) outsized relative to other parts of the United States that contain similar populations.

Data: https://github.com/RhysU/states
http://archive.today/3ld8F
What an article!

GResNet seems to generated the most similar result from my human evaluation.

Maybe we can combine both model with a hybrid search?
Yes I noticed v5! I love it so much. The great thing about itty is you can integrate anything really easily.

I'm in the progress of making a simple middleware based on zod to parse not only request body, but also params, headers, etc. Zod is really powerful and you could even use it to do stuff like parse jwt tokens and have complete type inference.

Perhaps my only issue with this approach is that you rely on a wrapper function to correctly pass the generics fron the middleware to the main handler.

Another possible approach is using types-per-route but then it's hard to enforce that the validator agrees with the handler itself.
Pulling out a key part of this post from a DeepMind 2023 paper[1]:
“Although the success of ViTs in computer vision is extremely impressive, in our view there is no strong evidence to suggest that pre-trained ViTs outperform pre-trained ConvNets when evaluated fairly.”

Another common constraint in vision vs language is the long tails are very long in the visual world. There's a number of domains where you have very little examples to learn (defects are designed to happen infrequently; rare species for identification show up, well, rarely). And pulling from the blog: "But small models ... benefit greatly from the exact type experiment of outlined in this post: strong augmentation with limited data trained across many epochs."

[1] https://arxiv.org/pdf/2310.16764.pdf
Having never heard of this service, I personally had a negative reaction to the name. I think it comes from seeing the z and associating it with warez, aka something illegal.
One immediately wonders about using it in browsers, but I looked into this a fair bit and concluded that there doesn't seem to be any viable approach still if you have real web content (rather than short toy blog posts), care about performance, and want Knuth-Plass: https://gwern.net/design-graveyard#knuth-plass-line-breaking

But props to https://mpetroff.net/2020/05/pre-calculated-line-breaks-for-... for a cool hack bypassing all the JS issues entirely. :)
I think our '82 Toyota pickup was called a Hi-Lux (?) and had a long bed that was over 7 feet but less than 8 feet. Also, I suspect a 4 foot sheet could have been laid above the wheel wells but not flat in the bed between them.
Bun churning out the good stuff, yet again.

So often I read the release notes and think “what a great idea, why wasn’t this already a thing” e.g. syntax highlighted errors
Too difficult to use.

Start with the upload image box then give them a URL

But unlock it only if they then continue to Stripe payment with recurring plan

Only 0.1% will convert but that's OK if you get traffic
That’s called whataboutism… Is there no legitimate criticism in your mind? Nothing worth changing or improving? That seems shockingly arrogant. Other states have their issues but I don’t live there so I don’t care as much—I want California to get its shit together because I live here and raise my kids here. It’s clear as day to my eyes that California quality of life has fallen since the 1990s… who cares if home prices annd incomes are up but everything else is so getting worse by the day? Rule of law is barely holding on for its life…
This whole thing is a troll as far as I can tell
What did you work on? Any of the micro stuff or mostly on the mini side?
Because they can't share the kernel; their goal is to run Linux programs on a Plan 9 host.
Interested to work as a Frontend engineer with 4+ years of experience specialising in ReactJs and VueJs technologies.
How do you learn the meaning of words you read that you're unfamiliar with? Do you pause and look them up, or is it more streamlined?
`ssh -D` isn't TCP over TCP, though!

It does multiplex multiple TCP sockets over a single underlying connection though, which can cause increased latency depending on how SSH schedules sends for each individual buffer. (Too fine-grained and you waste a lot of overhead on headers and framing; too coarse and you get head-of-line blocking.)

There are also TCP fairness concerns: In a bottleneck, like a congested home Internet connection's uplink serving n total TCP connections, traffic generally splits equally across TCP flows; if you're multiplexing m SOCKS connections over one SSH connection, all those together seize only 1/n of the bottleneck capacity, i.e. each individual one gets 1/(m*n). An (UDP-based) VPN though would get 1/n of the bandwidth per tunneled TCP flow, i.e. m/n in total.

In a way, `ssh -D` is a bit like HTTP/2 that way, while this tool is more like HTTP/3 / QUIC.
The most compelling argument for Deno is the permission system in my opinion. Node added a permission system recently, but it's much more coarse grained than Deno's. Being able to limit a script to listening on a specific hostname and port, or only allowing it to read a specific environment variable is pretty cool, and makes me less paranoid about trusting third party dependencies. Both Bun and Deno are also more performant than Node in many cases, and add a bunch of little quality of life improvements.
My intuition for this is that CNNs impose a stronger prior on the function space. We rely on the previous experience of computer vision and even our own retinas to give it a useful prior.

Transformers are more general, they impose a weaker prior and require more data. But by imposing a weaker prior they also are more flexible and adaptable, thus able to take advantage of more data.
Some discussion 5 hours ago:[0] (71 points, 45 comments)

[0]: https://news.ycombinator.com/item?id=39898619
It's a valid question, but does it matter for anyone except the dev team? Bun is open source, so VC-backing is mostly a helpful jumpstart. If they find a viable business model – great, development can be funded in perpetuity. If they don't, development was funded for a while by someone else's money and then Bun is just like any other open source project that lacks direct funding (most of them).