skysight-inc/HackerNews huggingface dataset:
No mention of user namespaces whatsoever, which is the primary security isolation mechanism for containers on linux. This is what enables "rootless" mode. Of course, this is from 2017, but user namespaces were released with linux 3.8 in February 2013.

Docker particularly has always required extra work to run in rootless mode because it was released soon after in March 2013, and for whatever reason it hasn't been a priority to rework the codebase to make that the default. I switched to podman for exactly this reason as my go-to oci implementation and haven't looked back.

The linux kernel features that enable various forms of isolation all require root privileges (CAP_SYS_ADMIN). Once user namespaces were a thing, that allowed you to use user namespaces to get around the root requirements for all the other isolation namespaces.

All of the below still require CAP_SYS_ADMIN:

CLONE_NEWCGROUP: cgroup namespace, for resource control (mem/cpu/block io/devices/network bandwith)

CLONE_NEWIPC: ipc namespace for sysv ipc objects and message queues

CLONE_NEWNET: network namespace, for isolated virtual networking

CLONE_NEWNS: mount namespace, for isolated mounting (filesystems, etc.)

CLONE_NEWPID: pid namespace, for isolated view of running processes

CLONE_NEWUTS: unix timesharing system namespace, for isolation of hostname and domain name

see: https://man7.org/linux/man-pages/man2/clone.2.html
Your neighborhood analogy is nonsensical. You can't ignore drug dealers in a neighborhood. You can ignore Google. You can build a website and not give two shits about Google. There's zero requirement for a website to run ads, host trackers, or even use JavaScript. You can just type some HTML into a text editor and put it on a server.

Websites are not physical neighborhoods. They're not affected by things in physical proximity. A visitor is not affected by anything in physical proximity. A website, like a gopher site only contains the content the owner put up. You can put up a bunch of plain text on a website to show how much of a hipster you are. No one is stopping you.
I make the choice. I don't really listen to specifics like that from customers. I'm a SaaS, not a consultancy. Instead, I try to fully understand the customer's problem and then provide a solution to it a way that will work for everybody. If it doesn't work for everybody, or is a niche feature, then I probably won't introduce the feature unless I can come up with a way to make it valuable to other customers. Often, the customer doesn't understand the best way to implement something to make it valuable/usable to other customers, or the costs involved i.r.t. to maintenance, but I do.

With an API product, you also have to be picky about new features because once something is introduced, it can't be taken back (assuming you want to maintain backwards compatibility).
Regarding gold, i like this infographic [1], but my favorite from this channel is wolf population by country. Point being, that gold is shiny and beautiful, and it will be used even when it is not appropriate solution to the problem, just because it is shiny.

I didn't know that copper is a better conductor than gold. Surprised by that.

[1] https://www.youtube.com/watch?v=E2Gd8CRG0cc
The first thought that came to my head was that it's being "way too American". Not in a good way.
JavaScript is also not complicated. It's just poorly designed when it comes to matching programmer's intuition.

With this out of the way: Dockerfile as a concept, i.e. a minimalist (in simple cases) way to declaratively configure a container is great. The execution of this concept is, on the other hand, awful. The behavior of gotchas like the one OP described isn't the reason for the awfulness, rather, it comes from the inconsistent-by-default builds. That is, Dockerfile is not a full description of the contents of the built image. To know what will go into the image, you also need to consider the state of the entire world (because you can download things from the Internet during build, execute code with unpredictable side effects etc.)
Hi,

I'm trying to make an opensource NN camera pipeline (objective is to be able to run on smartphones but offline, not real-time), and I'm still barely managing the demosaicing part... would you be open to discussing with me?
I would use the following behavior: the first time (loaded with empty storage) ask for confirmation, the next times (if loaded from storage) don't ask.

This would prevent people with auto cleanup to loose their work and avoid annoying others too much.
Undergrads are unionizing, in a sign of labor's resurgence
Processes run in a userspace and cannot do anything without OS approval.
Crazy how Disney's R&D looks almost indistinguishable from Darpa sometimes
> People with ADHD operate on an “interest-based nervous system” so they’re motivated by urgency

Was the decision to have a 3 day trial instead of something longer have anything do with creating urgency and capitalizing on the impulsivity of people with ADHD?

I imagine people with ADHD are more likely to be excited by tools that help and they can often mistake the initial excitement with the tool actually helping manage their executive dysfunction. It's hard for me to see how anyone with ADHD will be able to judge this tool as being truly good for them within 3 days.
Death is death, whether it's brutal or not, your dead corpse will not care.

Still no idea what your argument is. Or that of the grand-parent comment. "Oh look, Russia is poisoning people!" Yeah, we knew that ever since the Cold War. Show me a nation that doesn't persecute people it doesn't like.
Can really recommend the Silhouette Cameo line of vinyl plotters (silhouette sells a pen adapter) for anyone who wants to buy a currently in production plotter that's much cheaper than the axidraw. I can't compare the two on performance as I haven't used an axidraw but my experience with the Silhouette Cameo plus has been positive
> If there is some additional isolation required, just run the container in a VM.

No. Running a container in a VM gets you no additional isolation. Containers share kernel space and as such have limited isolation to VMs, which have isolated kennels. In exchange for this Lack of additional isolation, you’ve added a Bunch of extra Complexity.

Pardon the extra caps I am using iOS voice dictation.
Many people may not recall that from 1962 to 1972, a small nuclear reactor was operational in a very remote location (Antarctica McMurdo Station). The cost of maintaining the reactor proved to be higher than using 1,500 gallons of diesel oil daily. Consequently, the reactor was discontinued, and diesel generators were reintroduced as the primary power source.
But then also monitoring gets harder. With containers you could see (and monitor) all those processes running in container easy on the host.

With VMs? You now need a way to get data from within the VM which in most lightweight VM implementations just not possible.
By this logic, you also should release all of your code as free software under permissive licenses.
I've also used phones which haven't received any updates for years without any obvious problems. Just maintaining basic digital hygiene like you do. In theory, one could use a zero-day in a web browser (like the recent libwebp vulnerability), then exploit one of the numerous CVEs in one of the system libraries or the kernel, and own the phone that way even without you doing anything worse than visiting a random website. For example, that's how one of the the first methods of jailbreaking PlayStation 4 operated.

Your average Joe six-pack like myself probably shouldn't really worry about it though, it seems more likely to be used against really high value targets.

You might want to try out another web browser that has aggressive ad blocking (Firefox, Brave, or Vivaldi should do it) since ads are one of the major methods of spreading malware.
Mycocycle uses mushrooms to upcycle old tires and construction waste
When you punch the code, what is the result?
> people will come out of the woodwork saying "the EU just tries to harm US companies" [...] can be seen in any discussion of EU regulations on booking.com [...]

Booking.com is a Dutch company though. Most people within the EU I know of (myself included) are happy to see companies like Booking.com more regulated though, not less.
Could do with more detail, is this using pytest xdist ?
I’m honestly surprised I didn’t get any “how dare you say it’s all about feeling bad if we don’t do what Stallman says?” comments. I was trying to play it as straight as I could, without sounding like a crank. I’m not always successful.
The kernel can be attacked and exploited.

Container escape exploits are more common than VM escape exploits.
Not billing you because a script kiddie ran a script on your S3 bucket is a good start of a therapy, I'd say. :)
The mass murder of Palestinians is already partially blamed or credited to an "AI" system that could identify people. Humans spent seconds reviewing the outcome. This is the reality of AI already being used to assist in killing. AI can't take the blame legally speaking, but it makes it easier to make the call and sleep at night. "I didn't order a strike on this person and their family of eight, the AI system marked this subject as a high risk, high value target". Computer-assisted dehumanization. (Not even necessarily AI)
BuiltWith isn't remotely accurate.
That makes no sense to me, are there parts of the business that are really high touch that we don't see as regular users? seems so out of whack
Yep, they can prioritize that while shipping their money to those same US and Chinese corporations for AI, robotics, and green energy technologies for the next 100 years.

At least they've eliminated greedy megacorporations. Imagine a company sponsoring terrorism like Credit Suisse existing in Europe. Never!!
Here's another one: We went from in-person story telling to wide distribution of printed materials, sometimes by pseudonymous authors.

This happened from the 15th century onward. By the 19th century more than half the UK population could read and write.
Interpreted languages and their associated dependencies are more of an issue than static linking with compiled languages.
> Take car pedals, for example: the brake and gas pedals are not intuitive; they are always located in the same place and do not change positions when turning. If you accidentally press the brake twice, its function does not change.

That's an interesting implicit definition of "intuitive".
First thing that comes to mind is the need to link against libraries across platforms. Imagine that my app depends on opencv, if I wanted to statically link everything on my Windows machine, I need to compile opencv for Linux on my windows machine (or use pre-compiled binaries). Also, if you link against libraries dynamicaly, it's likely you can compile them on the host machine (or in a container) with more optimizations enabled. And the last thing is probably the ability to "freeze" the whole "system" environment (like folders, permissions, versions of system libraries).

Personally, I use containers to quickly spin-up different database servers for development or as an easy way of deployment to a cloud service...
And this comment provided zero proof, exactly as expected.
Going to put the economy in a very, very weird situation if true.

Will be like, the end of millions of careers overnight.

It will probably strongly favour places like China and Russia though, where the economy is already strongly reliant on central control.
Why are people posting on Reddit a manipulation? Anyone can post anything on Reddit and no serious investor will blindly follow this. On the other hand, companies (brokers) that allow people to trade have a power to manipulate the market by enabling/disabling trade of specific stock at necessary moment.

Also if people posting on Reddit can cause serious losses to greedy capitalists then it is fun.
Well yes, but try turning some random python, java or ruby service into a single binary .. now do that 12 times.
Or try with a native app that leverages both the GPU and libLLVM, and enjoy finding out the kind of precautions you have to take for LLVM to not blow up on a computer where your GPU driver was built with a different LLVM version.
Biden hikes US tariffs on of Chinese imports
The point is not the tool but how it's used. "What knives are allowed" is a moot point because a butter knife or letter opener can be used to kill someone.
Not familiar with the process, how do they make it a PITA?
SuperF4: Kill programs instantly with Ctrl+Alt+F4 on Windows
It works fine on Android and the rare thin letter I can't catch, I simply backspace and write again. Suboptimal, but works within seconds.

iPhone however? I've given up on the sub-word level. And it's amazing because they could simply copy Androids logic.
ChatGPT4 It won't accept moderately large files that I have given it. It was actually just an HTML file, I wanted to ask about css in it. How have you managed to give it a "larger codebase"?
I miss when companies invested in R&D. Just think if companies paid you 1-2 hours of your day to do either R&D or open source projects, how many advancements we could have. Theres all sorts of open source projects stalled because not enough time or money.

I imagine some might fix bugs management isnt prioritizing, or performance issues, and so on.
LightVM is stating a VM creation of 2.3ms while Firecracker states 125ms of time from VM creation to a working user space. So this comparing apples and oranges.
Yes, but a person wielding a knife has morals, a conscience and a choice, the fear is that an AI model does not. A lot of killer AI science fiction boils down to "it is optimal and logical that humanity needs to be exterminated"; no morality or conscience involved.
I think they mean run a VM with one container inside. So you do get strong isolation.

This is similar to how managed container IaaS works. They launch a VM and run your container in it.

It is extra complexity but has a few advantages. 1. People already have a convenient workflow for building container images. 2. The base OS can manage hardware, networking and whatever other low-level needs so that the container doesn't need to have these configurations. 3. If you want to trade of isolation for efficiency you can do this. For example running two instances of a container in the same VM. The container doesn't need any changes to support this setup.
I said nothing that goes against the context. Again: When you are actually scared of getting cought for something, a commercial VPN very likely doesn't help. That goes for all jurisdictions.
Stark decline? This page doesn’t show a “stark decline”. If anything it’s showing remarkable consistency and slightly growing market share.

https://www.statista.com/statistics/276635/market-share-held...
Is there a reason why Open AI and Google have events so close to each other?
A VM is a virtualized instance with virtual hardware and can therefore run its own operating system with its own kernel to interface with the virtual hardware.

A container is basically a process restricted by multiple kernel namespace isolation mechanisms. It shares the same kernel with the host and does not present any “virtual hardware”.
glibc doesn't work statically linked and lots of stuff depends on glibc
The EPIC Oxford study showed that vegetarians are more likely to die from colon cancer than the control group, "health food buyers". But the effect canceled more or less out, because the health food buyers did die more often from CVDs.

YMMV
I can see so many military and intelligence applications for this! Excited isn't exactly the word I'd use, but... Certainly interesting! The civilian use will of course be marvellous though.
Why weren't containers rootless from the start anyway? What did they need that user space doesn't provide? Wine, emulators and VMs didn't require it either (with the exception of some VMs needing a kernel module for performance reasons like memory management, which I also find stupid, the OS should provide all the performance in user space).
Flutter WASM is now stable
Yes.

In general, I think of multi-stage builds as if multiple docker files were concatenated; if ARG or SHELL doesn't exist in the theoretical split Dockerfile, then it wouldn't exist in the multistage build.

Docker(file) is a thing which brought in some quite neat new ideas, and a lot of these "footguns". I did read the docs, and I am comfortable now building even complicated "Dockerfile-architectures" with proper linting, watching out for good caching, etc. I wish there were better alternatives; I saw images being built with Bazel, and thanks, but that is even more convoluted, with presumably a different set of footguns.

I am not saying that Dockerfiles are good. But I also think that knowing the tool you use differentiates you from being a rookie to an experienced professional.
AI driven robots destroying the world, often look like Terminators.

But they might look like the Mouse.
did you consider batch logging using some kind of cache?
What is the part of the logging that slows down the request rate?
it does make me uncomfortable that the way you typically interact with it is by interrupting it. It makes me want to tell it to be more concise so that I wouldn't have to do that.
Raspberry-pi is very much like a generic Linux box, biggest difference being that it's ARM rather than Intel/AMD CPU which makes things slightly less widely supported.

But overall, Pi-C.A.R.D seems to be using Python and cpp so shouldn't be any issues whatsoever to run this on whatever Python and cpp can be run/compiled on.
Containers are perfect for build environments and for creating the root filesystem. The issue is that the kernel these days are super bulky and are intended for multi-user, multi-process environments. Running a container runtime on top just makes it worse when you're looking for "isolation".

This paper argues that when you build a extremely minimal kernel (i.e. ditch Linux entirely) and link your application against necessary bits of code to execute _as_ a VM, then you'll get better performance than a container and you'll get that isolation.

This is in fact true based on performance studies, the follow up paper to this shows so: https://arxiv.org/pdf/2104.12721

(Disclosure, co-author of the linked paper.)

We ended up taking this to real workloads if you want to see it in action: https://unikraft.io/
I assume so, you can’t really tokenize audio, at least not high fidelity audio. Audio models like Bark don’t output logits from what I understand. For true multimodal output you’d need a model that can output both logits and audio embeddings.
Because touch-based and mouse/trackpad based UIs are different enough to need separate support. An app optimized for one will look&feel much worse on the other. Remember Windows 8?
I don't really see how rootless containers change anything at all. You're still "just" one kernel privilege escalation away from breaking out. The level of isolation is much better in virtual machines, and the performance penalty is comparable these days.

The virtual machine images are a bit heavier, since you need a kernel and whatnot, but it's negligible at best. The memory footprint of virtual machines with memory deduplication and such means that you get very close to the footprint of containers. You have the cold start issue with microvms, but these days they generally start in less than a couple of hundred milliseconds, not that far off your typical container.
Exactly. Documentation is useful when a user knows that there are multiple reasonable options for an implementation to take. "Which byte order is used for this protocol?" is a question that can occur to a user and can be looked up in the documentation. Questions like "Does this language require explicit imports to access variables in the parent scope?" are not questions that occur to a user, because any violation of that would be so unexpected as to be a bug.

Docker documents its bugs, calls them the intended behavior, and then blames users for not reading about the bug in the documentation.
Crypto Wallet Integrates Pay-per-Use Access to Premium AIs
Surprising? It has to round trip to the server and grab a new page on every click.
No need for dark web. Zerodium has a up to $200k bounty for privilege escalation vulns on iOS/Android.
I have a large(ish) family. We have a LOT of iPads. No way around it. Definitely a feature not a bug designed to sell more iPads.
The Linux kernel has far too large of an attack surface to be trusted as a hard security boundary. It is good enough to prevent mostly trusted software from accidentally interfering with each other but I would not trust it to protect me from an untrusted workload.

For example GCP and AWS both have container running services. They both use hardware VMs to isolate different tenants. You will never share a kernel with another customer (I don't even think you will share one with yourself by default).
Higher RAII, and the Seven Arcane Uses of Linear Types
He’s using the alpha carbons (CA) adjacent to the carbonyl groups as well as the carbonyl oxygens (O), approximating the peptide plane. In addition he incorporates heteroatoms, so the scoring function takes ligands into account, if present.
This makes me think, we're seeing all these products inject AI and try to be "smart" on their own, but maybe the experience we really need is a smart OS that can easily orchestrate dumb products.

I know that Siri/Google Assistant/Cortana(?) can already integrate with 3p apps, so maybe something like this but much smarter. e.g. instead of "send the following email" you would tell the assistant "just write the email yourself". At this point your email app doesn't need integrated AI anymore. Just hooks for the assistant.

I imagine once Google puts that kind of brains on Android and Chrome, many product devs will no longer need to use AI directly. Two birds one stone situation, since these devs won't need OpenAI.
I made a basic plotter a while ago. You might find it slightly interesting https://www.jake-reich.co.uk/plotter