skysight-inc/HackerNews huggingface dataset:
Is it expensive or genius? Ultimately, enterprise businesses can definitely afford that, so it's just down to how Vercel can differentiate between them and non-enterprise.

Higher usage can be purchased separately from Enterprise, not as cheap as the initial plan, but far from 5-figures: https://vercel.com/docs/limits/overview#additional-resources

So really we're mostly talking about SLAs. I think "we absolutely need an SLA" seems a decent way to differentiate between small businesses and enterprise businesses.
U.S. dairy farm worker infected as bird flu spreads to cows in five states
The platform itself is "legit" in the sense that it has real people well known in the tech community behind it. I personally would be very surprised if they are running a blatant scam in that they are lying about the SAFE investment.

However I wouldn't be at all surprised if the smallprint somewhere in a long chain of paperwork means that you will never get any financial return in your "investment". There are a few platforms and crowdfunding platforms that let retail investors put small amounts of money into startups and I have never heard of a single case, even from an anonymous netizen, of anyone getting money back from such a structure.
The ideal free market is one where that exact effect doesn’t exist. Why would it be optimal for more wealth to naturally accrue more wealth? That is definitionally anti-competitive ergo suboptimal in the capitalist’s worldview.

Very good in the feudalist’s worldview though!
So how do you even fix a problem like this?

It seems the company had some procedures in place, particularly the documentation of "removals," but the line employees didn't follow that process in this case. One reason appears to be the tremendous pressure they were under to get planes out of the factories.

The article also mentions a possible lack of experience, since some of the workers could be very new to the company...though they could also have been quite experienced as well.

It is so, so very hard to evaluate risk and causation.
That would be ok if git gave the option to track branches in subfolders and leave other branches alone. I had a look at submodules but I'm not clever enough to understand how it could help me.
why should a package like ssh have so many random dependencies

that's the critical question here. it's not that enterprises need to take over maintenance of xz, but that the critical packages and their dependencies need to be audited on a regular basis. the development of xz is ok. what it needs is help with code reviews. and if it can't receive those, then it needs to be removed as a dependency of openssh.
The way I see it, if you create or contribute to an open source project, you need to leave your ego at the door and be ok with the world benefiting from it without giving you anything back. If they aren't ok with it, they shouldn't have made it open source in the first place.
In other words, third party patched versions of the game were able to achieve better performance than the official one?
Why is it split into two files, gmsl and __gmsl?
Has there been any update on the whistleblower who died under suspicious circumstances?
I've invested in 1 startup via AngelList, because I personally knew the founder. In my particular case, it is legit. They have not raised any new rounds of funding nor have there been any liquidity events unfortunately.
Location: Gatineau, QC, Canada
Remote: Yes
Willing to relocate: No
Technologies: Go, Java, Docker, Compose, Bash, Elasticsearch, Kafka, Networking, DevOps, DevEx
Résumé/CV: https://goo.gl/XCeiF
Email (gmail): eric.s.landry
LinkedIn: https://www.linkedin.com/in/ericslandry/

Experienced software engineer, architect, and manager, I excel at transforming complex software challenges into clarity and actions, specializing in innovative solutions and crystalizing product strategy into a solid architecture foundation.
Transforming the Web: The End of Silos
Lots of details on how they kept pressure up, skipped on important checks and procedure because it might slow things down, production numbers were way lower than planned ...

But is there any definite source or elements about why the numbers were so down ? Were the projection unrealistic ? And if yes was it because they pulled them out of their ass or because they needed the unrealistic high ones to get the sales ? Or were the numbers realistic but working with so many externalized subcontrators slowing things down ? I think I read something about, eg how they had to refuse so many of spirits' produce that it was slowing everything down, but by that much ?

Another reason could be that the plane was harder to produce than expected but while I could buy that for the 787 I don't see how it can be remotely true for the MAXes, they were supposed to be a known quantities.
It is about fundamental basis for consciousness. Stephen Hawking had sensory apparatus and a method to react to inputs. Alas, I would say he is no longer conscious. If he had no method to react, like locked-in patients, we could argue about whether they are conscious, but we are currently trying to measure consciousness in those people too by measuring brain waves (look, something changes predictably when he hears us). We don't see any evidence that sun has any sensory input or output. It's like you arguing whether 0.9999 or 0.99999 is bigger when I argue whether 0 or 1 is bigger.
Volumes are persistent, block devices which you mount to a path and are initialized and de-initialized by the kernel which we boot up and shut down, respectively, based on autoscale/scale-to-zero configuration. This means that if your application uses said volume it will be able to access it during its online-lifetime. That said, because they are persistent, it means that they are not as ephemeral (or "scale-to-zero") as the instance itself on KraftCloud.

Because KraftCloud leverages Unikraft, a unikernel library OS project, we are single-process. Postgres is multi-process since it uses the fork() syscall. If you require Postgres, we can set it up for you as a managed service. That said also, we are currently working on supporting fork() and this should become available in the next few weeks/end of April.

Re: bring your own DB: yes. We are setting up metros in many popular hyperscalers and IaaS vendors and DC zones. This means there should be no egress fees and you'll have data locality.

For serious deployments, be close to your data. If you get in contact (alex@unikraft.io), we can discuss further how we are approaching this.

And yes, we are working on cron, this will translate to setting up an instance to start at a regular interval and not auto-restart it (so it scales-to-zero). :-)
>On the other hand, I understand they are pissed that AWS is making money from their work and they get nothing back.

Well, depending on how you look at things, it was never their work. Their business is and was exactly the same as AWS. However they paid money for the rights to the Redis name and copyright from the original developer after running their business for years in similar manner as AWS.

Of course they rebranded their company into Redis after acquiring the name.

Also it's not like AWS didn't contribute to Redis. I find it plausible that others might have contributed more to Redis than Redis themselves, if we exclude the contributions by the original developer when he was independent.

Correct me if I'm wrong, but as far as I know Redis (the company) focuses mainly on building custom stuff on top of Redis, instead of Redis itself.
Is it possible that it was added by a bad actor, and that most of the individuals in contact will not have signed off on it? I mean, this whole thing started by an interested party digging deeper than anyone else had, you could trigger that for someone else. At the very least, what do you have to lose? If the best they can do is look like they're fine, then every possible side effect is to root up a frighteningly well hidden inflator
Where does automatic failing test input reduction fall into that ladder? Or is that assumed as part of PBT.
Which is why so many tech companies are telling us how dangerous AI is.
Shader compilation is well known though, and anyone halfway serious about benchmarking these things (like Digital Foundry) factor this in and control for it
Actually I've had "money back" twice from AngelList. Once a startup got acquired (for like 3-4x), another one shut down and distributed the remaining funds.

But I did not withdraw it and just reinvested to other startups, so in that sense I've never received money from them.
https://codeberg.org/redict/redict
I don't think this is really advocacy for monorepo but rather advocacy against premature solidification of abstractions. Whenever I encounter a situation like this, the first step I take is to write the code without any API or interface boundaries to worry about. Then if I still feel it would be a good idea to separate it, I will separate it while keeping it in the source tree (this isn't really vendoring or monorepo, it's just abstraction into a module). Once this thing has survived a few rounds of revisions and you're ready to use it in another project, copy paste it first. Then once two projects have both had a chance to exercise the abstraction, then you factor it out into something totally separate

This process requires that you are able to work on rewrites and refactorings without having to beg. But it's truly the best way to get from an idea of a library to an actually well designed library.

In some situations it might be you already know what you want and can separate it out from the beginning, but if you are coming up with anything remotely novel, then you want to follow this process.

A monorepo will still contain libraries like these. It will also contain vendored code (although monorepos help reduce the amount of duplicate vendored bits of code). Making such changes will be easier in a monorepo once your abstraction starts to solidify. But the process you should go through should still be similar. The reason for not having two things depend on your wobbly abstraction too early is simply that it will inevitability lead to you prematurely solidifying uncertain abstractions.
I don't understand how this could have worked.

If you compile and build your own image, would that be able to trigger the backdoor?

You can of course change an existing image to something that triggers the backdoor, but with that level of access you won't really need a backdoor, do you?
> At first I thought the guy who did this was a lone wolf but now I believe it was indeed state actor. They coordinated and harassed original maintainer into giving them access to the project, basically they hijacked the open source project. The poor guy(the original maintainer) was alone against state actor who was persistent with the goal of hijacking and then backdooring the open source project.

It could just as easily be a lone wolf capable of writing in different styles (really not difficult if one spends enough time online, one gets exposed to all sorts of styles) or even just your run of the mill criminal gang.

In fact, "multiaccount" cheating (where a single person has multiple accounts that interact with one another in a favourable manner, e.g. trading for stuff for reduced fees, or letting themselves be killed to pad stats, or expressing opinions leaving the impression of mass support, etc.) has been present in many MMO games for more than a decade. I recall an online game I was really into back in high school, eRepublik, which simulated real world politics, economics and warfare (in a really dumbed down version of course), and multiacounts were especially prevalent in politics, where candidates for election would often be padded by fake groups, or even entire countries being taken over by a gang of real people with like ten accounts each.

The complexity is nothing new. The only indicator this could be a state actor is the long con aspect of it. The attacker(s) were looking into years between starting and actually being able to exploit.
I really hope you're not saying modern web-pages are enjoying to use because they look good? Because they are anything but. Instead they're often cumbersome and spend my resources on pointless cruft.

HN is one of the few web-pages that get straight to the point, and could not be any more well designed.
Maybe we're talking about different things then, but in my experience, MT is a reasonably involved procedure that requires configuring the MT harness to understand where the code lives, how to run the test suite, how to interpret the test suite, etc, then running the mutation tests for upwards of an hour as it repeatedly makes various changes and runs the tests. If you want to do something more complicated like only test a given region of the codebase, then the configuration becomes even more involved.

This is all significantly more involved than my experience with PBT, which tends to be something that can be added without much ceremony to an existing test suite when it makes sense.

To be clear, I love the idea behind mutation testing and I have given it a go a few times with limited success, but I think your comment is overselling its simplicity.

That said, I'd love your advice: how do you introduce mutation testing to a large codebase that currently has an extensive set of tests but hasn't used mutation tests yet? And how do you maintain the MT side of things? It seems far too slow to regularly run in CI: do you just run the MT tool every now and then to make sure that the tests are still covering all the mutations? Or do you have a more structured approach?
It is something pretty much all big countries will back? Who do you think would oppose it?
Thank you, this makes me feel a bit better.
It’s more likely that it was just one of the places that movement coalesced. Others include Reddit before they ban hammered a lot of that stuff, Twitter, and Telegram.

As for the origin of the movement I remember saying exactly this way back in 2008 after the bank bailouts:

(Paraphrasing a bit)

“People don’t realize how much trust has been lost. People want pitchforks. I don’t think they care whether the far left or the far right is handing them out.”

The far left did hand out a few, but they tended to sublimate all their anger into race and minority grievances. Their pitchforks didn’t have enough mass appeal, especially to the white working class killing themselves with opiates.

The right handed out more classical pitchforks with more mass appeal. They went for the old timey scapegoats of immigrant and minority hate and good old fashioned antisemitism (thinly veiled).

They were also the only ones who started talking about “elites.” I remember reading an actual quote on Reddit back then that stuck with me: “if we can’t destroy the financial industry from the left we’ll do it from the right.”

Americans have a short memory. We’ve already forgotten the Bush administration and how it burned a century of goodwill toward our country and a trillion dollars or two in Iraq. We’ve already forgotten how banks that imploded were rescued in such a way as to give the executives leading them a bonus and a promotion for imploding them. (The blame for that goes to both Bush and Obama for doing nothing to intervene.)

So now people are like “where did all this populist rage come from?” They blame crap like gamergate and 4chan when those were just small lightning rods for niche communities. The USA around the turn of that decade was a pile of oily rags waiting for a source of ignition.

The alt right and Trump just saw an opportunity. They didn’t create it, nor did 4chan.
I pay for both of them and I keep finding myself coming back to GPT-4. Not only do I think the UI is vastly superior, I have not experienced a significant difference in quality of output between the two. I regularly ask both of them the same question and respond with follow-ups to both of them.
So that you can do

include gmsl

as much as you want in nested Makefiles and you won't get problems with redefinitions. The top level gmsl decides whether to include __gmsl. It could have been done as a single file but I wanted to minimize the parse time on large make processes to you include a small file that can quickly decide whether the larger one is needed.
Serverless lambda outperforms other streaming data ingestion architectures
I wrote a custom C++ AWS Lambda runtime/handler together with DuckDB and to my surprise created very efficient and simple data streaming ingestion solution that outperforms others.
May I remind you of https://en.wikipedia.org/wiki/DeCSS?

If that isn't enough, it links to https://en.wikipedia.org/wiki/Illegal_number#Illegal_primes which is well into ridiculous but true territory.
baq's law of code thermo dynamics: complexity cannot be removed. it can be transferred but can not be removed. your CI/CD system will be as complicated as your repo structure isn't.
No LTS versions please. Release often, but don't break old code. Be more like Rust (v1 forever) than like Node (new major releases every year or so).
Do you use 1.1.1.1 for DNS? archive.is links don't work for me because archive.is refuses to work with that DNS.
TIL multi-account containers allow per-container proxy settings!

Am I correct in thinking it needs a separate extension to set that up, like this one? https://addons.mozilla.org/en-GB/firefox/addon/container-pro...

Edit: I was not correct, which is apparently grounds for downvotes now.
A government proposal to kill a half-million owls sparks controversy
Just wanted to say thank you for your work and attention to detail, it's immensely valuable and we're all very grateful for it.
This conversation was about de-polarizing, not bias.

However, please share an example. I get the feeling that those examples will simply be ChatGPT not providing confirmation of the user's bias which I admit is very annoying.
> The big tech companies have excellent legal and accounting departments that consistently beat the USA and EU in tax optimisation through IP relocation, and many of those same principles could be applied to AI.

This tax optimisation has resulted in lawsuits: https://en.wikipedia.org/wiki/Apple%27s_EU_tax_dispute

… and this kind of attitude is also why GDPR fines are based on global revenue rather than EU revenue (because it's too easy to play a shell game with money).

Also note that laws can reach across borders, for example:

• https://en.wikipedia.org/wiki/Max_Schrems

• https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...

• That the US government wants to know about all use of cryptography in apps distributed on the Apple App Store, even when it's made by a German corporation for German users in Germany and is never localised to English.

> If regulators clamp down on offshore training by denying the Seychelles access to GPU purchases, American entities could donate the physical GPUs.

Hence "Track all GPUs sold. If intelligence says that a country outside the agreement is building a GPU cluster, be less scared of a shooting conflict between nations than of the moratorium being violated; be willing to destroy a rogue datacenter by airstrike." - https://time.com/6266923/ai-eliezer-yudkowsky-open-letter-no...

You may consider this "overkill" — I sure do, but (and with acknowledgement that fiction is not a guide to reality) I also read Schlock Mercenary back in the day:

> There is no "overkill." There is only "open fire" and "reload."
In this case the creator left the company a year ago or so.
This is one of those things I have NO NEED FOR but I definitely would want one on my desk.
These all reek of ChatGPT to me:

https://news.ycombinator.com/item?id=39876790

https://news.ycombinator.com/item?id=39819576

https://news.ycombinator.com/item?id=39880881
> Edit: also, why should a package like ssh have so many random dependencies? They should make sure these kind of packages have the least of dependencies especially on these kind of packages that have one maintainer to reduce the security risks?

Using standard libraries for common stuff like compression, cryptography and whatnot is vastly more preferable over everyone shipping their own crypto, or worse, patches of crypto (see the Debian SSH key vulnerability of 2008 for an example [1]). For protocols it's in the end just as bad, it's a nightmare to keep different versions of the same program to be able to talk to each other, but now imagine a literal ton of programs who all have a wild mixture of statically shipped libraries, homegrown stuff that has barely been tested... no, just no. Not a world I'd like to live in.

[1] https://jblevins.org/log/ssh-vulnkey
Yes, exactly, these high security packages that every distro uses must be very tightly maintained and looked over with the least dependencies. SSH is one of the most important packages in security and it just feels clumsy that they are using such packages like XZ. Just WHY? Who made that decision? Why doesn’t all the distros work together maybe to maintain the security? Why depend on one person that does this as a hobby?
https://www.nytimes.com/2024/03/18/travel/united-airlines-bo...
> Management had no information of what was going on the factory floor

This statement represents a fundamental failure of management to do its job— To know the whole picture, recognize systemic hazards (both internal and external), and correct them before they become real problems.
Full Stack Rust with Leptos
The API for the shell function is kind of neat, in that it seems to prevent you from accidentally creating shell injection vulnerabilities by calling it without properly quoting the arguments.

For example, in Python you could easily do this:

message = '; cat /etc/passwd'

# Whoops, shell injection vulnerability!
subprocess.run(f'echo Message: {message}', shell=True)

# Correct (assuming sh-compatible shell).
subprocess.run(f'echo Message: {shlex.quote(message)}', shell=True)

# Correct (without using shell).
subprocess.run(['/bin/echo', 'Message:', message])

But the Bun API doesn't separate quoting from executing the command, so you can't make that kind of mistake:

let message = '; cat /etc/passwd';

// Works correctly.
await $`echo Message: ${message}`.text();

// Fails safely by throwing error about incorrect usage.
await $('echo Message: ' + message).text();
Indeed. I think a lawyer would have written "tortious", there being no pain involved.
Tonal.js: Functional music theory lib
This is exactly the friction/overhead the other person means and what monorepo works around.

(but also keep in mind this is an internal library for likely a couple of internal apps, supporting BC for 2 years is in most cases unwarranted)
Yes, i think one thing we should learn from this is that suspicious code is suspicious code, and anyone asserting that some suspicious code cannot be exploited is suspicious themselves. I don't think we should inquisition half the industry, but i do think people should be a lot more careful about saying that one small exploitable thing definitely cannot be part of a larger exploit.

It's obvious, basically no one knows what's going on in the _vast_ majority of code running out systems these days. And even if you know 99% the attackers only need to be right once
> Right, that's why I'm also working with the assumption they are legit. Just too high-profile not to be.

People like Madoff etc. were super high-profile and ran scams worth billions for decades. Being high-profile was part of their strategy. So no, AngelList being "high-profile" and not seeing any evidence of fraud for a decade doesn't mean anything. To be clear, I'm not accusing AngelList of fraud - just trying to make a point.
Lessons of Bun
Committing research fraud is easy. Let's make it harder
I've said before, elsewhere, that I think that that cartoon is misleading. The truth, as should be apparent nowadays after the parade of leftpad, ntpd, xz, et al., is that there are thousands of those little blocks at the bottom that have a bus factor of 1 volunteer. There aren't any big long base blocks at all. And sometimes the little blocks seem as if they have been set up by domino topplers. (-:
Questioning?
Sign up for e-mail spam in exchange for reading one article? No thanks.