skysight-inc/HackerNews huggingface dataset:
> tip-toeing around ideas that, if he were to stumble even an inch closer, he might decide that he is actually among the "bad guys", and reform

I know Screwtape is concerned with not spooking the mortal target with unnecessary moral quandaries:

> You will say that these are very small sins; and doubtless, like all young tempters, you are anxious to be able to report spectacular wickedness. But do remember, the only thing that matters is the extent to which you separate the man from the Enemy. It does not matter how small the sins are provided that their cumulative effect is to edge the man away from the Light and out into the Nothing. Murder is no better than cards if cards can do the trick. Indeed the safest road to Hell is the gradual one-the gentle slope, soft underfoot, without sudden turnings, without milestones, without signposts.

However I never got the impression Screwtape was afraid of some kind of... moral whiplash on his own account. Rather, I think he was more concerned with accidentally running afoul of the Lowerarchy's official dogma. I infer that it--like The Party in 1984--is a self-perpetuating system where no participant can do anything except oppress and predate on one another. (Hellish, indeed.)

> I hope, my dear boy, you have not shown my letters to anyone. Not that it matters of course. Anyone would see that the appearance of heresy into which I have fallen is purely accidental. By the way, I hope you understood, too, that some apparently uncomplimentary references to Slubgob were purely jocular. I really have the highest respect for him. And, of course, some things I said about not shielding you from the authorities were not seriously meant. You can trust me to look after your interests. But do keep everything under lock and key.
It is still quite far behind the native version, every time I think I can do everything on the Web version, as soon as I need some advanced formating on Word/Powerpoint, or more powerfull expressions on Excel, I end up downloading and further editing on the native version.

Google Docs is okayish if all I need is Office 97/Works kind of experience, Office 365 I would probably place it around Office 2013.
Caltrain shares track with freight rail, and doesn't run trains nearly as closely or frequently as BART. No other type of train makes sense to run on BART's tracks.
Maybe you trust the server to serve legit JS (or have some other mechanism to ensure it, like content addressing e.g. IPFS) but you don't trust the server not to leak/log your info by mistake if it was processed in the server.
this sounds pretty like what dataloader do used in graphql.
My wife and I once looked at a house that had a huge bathtub, sunken directly into the floor, in the center of the bathroom, surrounded by shag carpet, all the way up to the edge of the tub.
Be careful not to pull a muscle with all that reaching.
Not when you have fire and technical superiority.
> (...) the scapegoat will be government regulations.

That's true in a sense. The only thing that stops anyone in the world from marketing a full self driving car is the risk of being held liable for killing anyone involved directly and indirectly, including the driver/customer, in crashes caused by FSD. I mean, imagine how the fines would eat away the bottom line.
I think anybody that ever did LeetCode/HackerRank in Python had that bug at least once when making an empty 2-D DP table or a return matrix.

My bigger question is how does a professor of machine learning does not know about one of the oldest Python footguns to exist:

https://stackoverflow.com/questions/12791501/why-does-this-c...

Very nice article otherwise, I never actually bothered looking into why it behaved this way(at this point most people initialize using list comprehension, so this bug is IMO very rare in production), very well explained.
What? Google is generally a lot better on interoperability compared to Apple. Just look at which company has their apps on which platforms.
Well, those things are called "default argument values", not "default argument expressions", you know. It's a value that's reused for every function call, not an expression that re-evaluated at every function call.
From an ethical point of view, have you considered your “attention grabbing tool” evil ?

We really need our attention to ourselves, please stop groping it.

Yours looks particularly evil.
>> NixOS is a Linux distribution that bundles these

> No, NixOS is a Linux distribution that utilizes these

My mistake!
A hidden device can't prevent theft. It takes visibility to be a deterrent.

For instance: One or more well-hidden surveillance cameras cannot ever deter anyone from doing anything. However: One or more cameras placed out in the open can do so. (They don't even have to be functional cameras to be a deterrence.)

LoJack isn't a deterrence. It is instead a way to react after a theft has already occured.

The AirTag, meanwhile: It also can't prevent or deter the theft -- if a thief is going to steal a thing, they're going to steal it whether it has an AirTag hidden somewhere or not.

And when an iPhone-using thief is alerted to the presence of that AirTag tracker, they have options beyond just ditching the bike: They can make the AirTag make noise, and also use Precision Finding to draw an arrow on the screen of their phone that helps them to locate the AirTag so it can be destroyed.

(This is a deliberate anti-stalking feature on the part of Apple.

Tracking stolen goods is fundamentally incompatible with anti-stalking measures: There cannot be both things in the same ecosystem, since if a person can silently track their [stolen?] bicycle, then they can also silently track a living human being.)
.. should not be thought of.. was what I meant to write. The memory is neither app memory nor storage, but both at once. The once-Windows based PDAs also used a combined memory setup, but there one section of the memory was for running apps, the rest for storage, i.e. different from PalmOS.
Just to circle back, I'm pretty sure it was Oleksii Arestoyvich who said it. I can't find the video. I think I saw it on Good Times Bad Times youtube channel.

Absolute legend of a guy.
So you both trust and don’t trust the server?

I think the original question is, how is that different to TLS? It seems exactly the same to me.
I use rcm: https://github.com/thoughtbot/rcm

It is very simple and easy to use, has no external dependencies, and is sufficiently flexible to handle configurations for different machines and other nifty features.

I'm aware of Nix and other solutions, but you can start using rcm in 10 minutes (it's really that easy to use). If you choose Nix, for example, you'll need to spend at least several weeks of time (guessing on experience of others).
They only made Mojo available outside the preview circle about a couple of months ago, and it is yet to run on Windows laptops of researchers.

I love the attitude of considering 0.x languages production ready for all imaginable kinds of workloads.
> Most of the time I get so bored reading such long articles, like the New Yorker ugh.

I must be boring AF; I usually like the New Yorker's articles.
Here is their stance on that: https://docs.shorebird.dev/faq#does-shorebird-comply-with-ap...

I'm very interested in this tech but have never used it. From the FAQ it seems like that while they need to deliver a compliant system (e.g. interpreted code, I guess), the author is on the hook for following the spirit of the rule.
An Nvidia GPU is necessary for fast operation.

Compression is getting so heavy that soon it isn't possible to perform it on normal hardware. AV1 already proved that, the future audio/video codecs will be even heavier.

Decompression is also getting heavier. Poor mobile devices.

I'm starting to appreciate well written algorithms which don't require massive computing power. JPEG XL is a good example. It has the same compression ratio as AVIF, but requires less processing power.
Thank you for all of this.
Server compromise is one of the threats this help manage. In your "just TLS to the server" scenario, that means all data is now instantly readable to the attacker. When all data is encrypted with keys only known to the client, the attacker first needs to take active measures and wait for everyone to log in, which may be visible to attentive clients (think reproducible builds, or the same way that someone might reverse engineer WhatsApp to see if they really did implement the Signal protocol correctly)

I've also been the victim of an attack where passive interception was feasible but not active interference. Everything they could use my session token for, they did, but my password was client-side hashed and thus the admin panel (access logs showed attempting to reach it) was safe because it required entering the password again

As a last example, I don't know what binary Signal gives me, but it gives me piece of mind that it requires colluding with Google to target someone specific, so they effectively give everyone the same binary and any backdoors are visible to all at the same time. I really like client-side cryptography as compared to the server being one big black box we just have to trust
You don't need 99% coverage. You just need enough coverage to be able to refactor the thing without breaking it.
In dvorak, 'hjkl' are still fairly convenient.

'jk' are adjacent. 'h' is to the left of 'l'.
>Where do you people keep coming from?

The future.
It is in line with Apple and Google devices that everyone loves, Microsoft is late to the party.
Letter to AMD: Ongoing AMD hardware/software/firmware issues
You don't need to be British to know that. I'm not, and I did.
This is pretty subtle. I wish more languages explicitly distinguished references and values like C++ and Rust.
Thanks for the good discussion!

* Reg. model selection/calibration: I acknowledge that in interactive setups cross-validation (CV) is not practical, but that is a particular kind of model selection. And faster alternatives exist for specific model families, such as approx. gradients [1,2], out-of-bag error (Random Forests), Infinitesimal Jacknife [3]. The bigger problem to me (for no model selection) is that there is a philosophical gap here: why would we fit the model with a default parameter blessed by a specific library? For ex., for LinearSVC in scikit, what is so great about C=1? And then, papers should mention that their query strategies are evaluated against C=1, but that of course doesn't sound as cool :-)

Problem #2 is what I had mentioned earlier: the AL query strategy seems to be doing two things now - makes up for the lack of good hyperparameters in the current model, and picking up "good" points - how do I know which it does more of? Or what is it really good at? If its performance is influenced by a lot of the former, it is hardly surprising that when you actually perform model selection, the gap between a query strategy and random decreases.

I guess my point is it doesn't have to be CV - but there needs to be model selection, because there is no well defined notion of a "default model". Calibration is less of an issue, because you can do this just once on the best model, and its not as expensive.

* In that paper [4], the effect of AL is shown for upto 5k points, but the unlabelled pool size is 20k points ("Other Settings" in Page 5). So we do require good instance selection.

On a different note, my hunch is that as language models get better at holding a broad variety of concept information, and it keeps getting easier to adapt them to specific tasks with just few examples/shots, we'll see whatever benefit AL has over random diminish. First (the bigger reason), the number of examples required to get good performance would reduce to the point that it might not make practical sense to set up an AL pipeline. And second, it would get easier to adapt the model per se, so that the difference (in terms of final model accuracy) between k good points and k randomly selected points might not be large. I guess we already see this in some form with SetFit [5] where examples are randomly picked to reach a good accuracy. I wonder if you have a view on that.

[1] Hyperparameter optimization with approximate gradient, https://proceedings.mlr.press/v48/pedregosa16.html

[2] Optimizing Millions of Hyperparameters by Implicit Differentiation, https://proceedings.mlr.press/v108/lorraine20a.html

[3] A Swiss Army Infinitesimal Jackknife, https://proceedings.mlr.press/v89/giordano19a.html

[4] On the Fragility of Active Learners, https://arxiv.org/pdf/2403.15744.pdf

[5] Efficient Few-Shot Learning Without Prompts, https://neurips2022-enlsp.github.io/papers/paper_17.pdf
This is a great project!
But I was wondering how frequently will the library be updated with the new different optimization techniques which keep coming out?
Reading this I didn't think I'd feel so nostalgic for those cars but the track was at the end of my street where I grew up, so I saw and heard them all the time. My parents commuted to the city on Bart and for a few years after college we all commuted together. As kids, we terrorized the trains a bit and that's how we discovered that Bart had helicopters. The 70's sure were fun.
Sure there is a reason it is that way. But it doesn't mean it's not incredibly unintuitive and error-prone.
Russia accused of using chemical gas attacks against Ukrainian soldiers
It is the usual "Well it works for me" that you see in all Linux forums, since its inception, and when it works and you have to jump through several weekends trying to configure EFI booting, well it is those pesky OEMs not wanting to take the FOSS culture into their money maker.
> If human cognition were say, 20x faster relative to the speed of light

What would that even mean, being 20x faster than the speed of light? What does it imply?
I’m a bit surprised he pays taxes on revenue. I’ve run a similar type of single person company (different country, still EU) and I paid taxes on revenue less expenses. There were also no such thing as “keeping money in the company”, but I could expense the ticket and buy it with pre-tax money as a company or not expense it and buy it with post tax money as an individual. Sounds like he wants his cake and tax deduct it too.

If he really can’t expense stuff, why does he even have a business card?

I’m on the conference side on this matter.
I’m in a similar boat where I produce about one video a day and will definitely give this a try. But if I I want to caption them all that means $149/mo because the $15 plan has a cap of 20 videos/mo. At that price I’d much more likely pay for DaVinci Resolve Studio one time at $295 to use their subtitle generator (and that fits into my existing workflow).

If there was a better pricing plan for someone who has yet to see a dime from videos, I’d consider this long term.
Lots more discussion around that's a bit more than this overview/timeline collection of news posts.

The xz sshd backdoor rabbithole goes quite a bit deeper

https://news.ycombinator.com/item?id=39956455

Reflections on Distrusting xz

https://news.ycombinator.com/item?id=39914981

How the XZ Backdoor Works

https://news.ycombinator.com/item?id=39911311

etc... https://hn.algolia.com/?dateRange=pastWeek&page=0&prefix=fal...
about how much size does shorebird add to the app bundle?
Ever talked to a sales person? They also start making up things when they don't know.

You can't seem to accept that a computer can be intelligent. Can an ant be intelligent? Can an ant brain produced in a lab be intelligent? Can a computer simulated ant brain be intelligent? Can can LLM that is way smarter than an ant be intelligent?
Where you aren’t asking a third party (the server) for your security layer. End to end implies 2 parties (sender and recipient)
It’s been done and it becomes quite complicated very quickly. Then it becomes necessary to manage that complexity and you end up with something like Spanner.
That's what MUNI is. It started as hundreds of independent railways crisscrossing the city. They slowly unified them into the cacophony that is MUNI.

I say cacophony because there are bus', cable cars, vintage light rail, modern light rail, subway, tram, local neighborhood shuttles, and I'm sure I'm missing a few.
I believe this is what one of the companies mentioned in the article, Turso, can help you do. a per-tenant database.
> classic MacOS toolbox just ported to OS X

There was a company that re-implemented the macos toolbox on various Unixes. I hope somebody on HN worked there and can fill in more details.

Tldr; from [0]

The company was orignally Quorum Software Systems, Inc. which transformed into -> Latitude Group in 1994, and which got bought by Metrowerks in 1996-7?.

The original product was called Equal, and allowed Microsoft Word 5.1a and Excel 4.0 (the macos versions) to run on UNIX, with native [Motif?] look and feel and good performance without source code.

they later made a library called 'Latitude' so macos App developers could easily port their apps to Unix, which was how the Adobe Apps - Photoshop / Illustrator etc. got made available for Unix. .. and Latitude also apparently implemented a lot of QuickDraw.

"At the heart of Latitude is our own Portable Toolbox Implementation Layer. This layer is completely platform independent. It presents the Mac Toolbox API to the application, answers these calls through a trap table mechanism, and relies on other toolbox calls within the layer whenever possible. When a native system facility is needed, such as the display of a window or control, or some graphical rendering, this layer calls out to one of Latitude's platform dependent modules through an internal, well defined API. The toolbox layer doesn't know what kind of system lies underneath, only that calling this function will display a window or that function will draw a line, etc.

.. Because we've mapped native system facilities to Mac calls, the running application is an equal citizen on the desktop. The application's windows, menus, and control items are native system objects. Cutting and pasting between apps is facilitated by the native system's clipboard mechanism. Fonts come from the system font server -- including the default system font, which means the dialogs come up in something other than Chicago! Application windows are native windows -- not some rendering of a window inside of another. The performance hit is minimal. Latitude is merely mapping the Mac calls to the native system. There is very little processing going on in between. "

[0] http://preserve.mactech.com/articles/mactech/Vol.13/13.06/Ju...
How long is a piece of string?

What is an expert?

Now thats a good question for an expert.

a selection of experts:

a leading expert.
a world/international expert.
an independent expert.
a so-called expert.
Great initiative! No requirement for heuristic engineering workarounds for model merging. Also, it enables further training of the merged LLM.
How can you do server-side encryption on IPFS?
Eh I know what we worked on ended up being deployed in production systems.

most of the team went on (not me) to found a company too: https://reconstructinc.com/
"German government" does not see marriage as a contract.
ego is the enemy
I just moved to Oakland a couple years ago and I recently watched the TV show I'm a Virgo, which is set in Oakland. I never realized how iconic that sound is until I saw it on a TV show and instantly recognized it.
I think GP understands that and just disagrees with it.

Brew looks pretty much like a package manager that has to handle binary distributions alongside ports-style source distributions across a range of OS versions and releases and two instruction sets needs to look. It’s a bigger problem than apt purports to solve, for example, more along the lines of FreeBSD with pkg/ports having to coexist via poudriere.

But since nobody really has said why they think it’s ‘unhinged’ that’s just speculation ;)
Look at the effective range of those things.
Reading this makes me wonder how probable/improbable it is that this kind of thing has happened / will happen with the seed generation function in one of the popular Bitcoin hardware wallets.

And what the fallout would be.
Yes, the reason is that it's a tradition to have it this way. Python IMHO has decent enough assignment semantics that using "default argument expressions" model would've been fine, unlike e.g. in C++.
There are a lot of endgames that are drawn because of stalemate though. Many pawn endgames ( e.g. pawn and king against lone king) are drawn because of stalemate, but would be a win in most cases if stalemate didn't exist.
Okay we can go through a threat model. We have a user, a service and an attacker.

Scenario 1: Attacker external to service

With TLS and server side encryption (generally at rest), if an attacker breaches the service they will have full access to all user data. The server has the encryption/decryption keys.

With client side encryption, if an attacker breaches the service they have access to many encrypted blobs that they need to decrypt. If the attacker wants to do this they have to create and plublish a malicious JS and update any resource integrity before waiting for the users to use the malicious version and even then will only get a subset of user keys.

Scenario 2: Attacker internal to service

With TLS and server side encryption, a malicious employee can generally get access to the unencrypted data. Once again, the server will have a copy of the key. Whether by accident or on purpose, plain text user data can be leaked into logs, dumped into backups etc.

With client side encryption, the attacker only has access to ciphertext. Again, they would need to publish a malicious library, bypass any resource integrity at the same time and wait - remaining undetected - for every user to log in so their keys could be siphoned away.

-----

It may be the case that the server needs access to plain text data in which case a more complex approach using a unique user key pair where the public key encrypts the data after processing so the server cannot decrypt it could be utilized. But even then, there will still need to be some JS sent to browser for that logic.

If there is no business reason for the server to see the plaintext data, client side encryption should be preferred.
Ethics are a lot more nuanced and change a lot faster than laws.

Heck, a large fraction of ethics seem to be so fickle that they’re subject to potential revision by every generation.

In fact, I’d argue that those revisions are a significant portion of how one generation distinguishes itself from their parents.

Yet strangely every generation feels like they have arrived at a set of “universal laws” in their ethics.
you are absolutely right, that’s exactly my point in favor of Spotify being dishonest here. They are just looking for reasons to buy for less and sell for more, thats it.
> This is a problem with alternative layouts - you have to relearn or remap all the shortcuts for different apps as well as learn the new alphabet locations.

Any alternative is going to have benefits and costs.

With learning alternative keyboard layout, "learn shortcut" mostly means you learn by the letter, not by the position on the keyboard.

It's least awkward for programs which you can drive with two hands on the keyboard (like vim), and most awkward for programs which want keyboard+mouse and have a bias for left-hand side of the qwerty layout for shortcuts.
It seems very foolish to upgrade so immediately, why not wait for 9.0.2 or something? Let other people find the issues
No idea. Does this question answer mine?

(Where did you load minibone from in an ipfs context? Couldn’t that same endpoint just perform the encryption?)
> I've implemented GraphQL on top of SQLite and found it to be an amazingly good match

Could you give a pointer to the repository, or is this part of Datasette?
Lambda Screen: Fractals in pure lambda calculus
I wonder if GitHub is still running a patched openssh...