skysight-inc/HackerNews huggingface dataset:
Right-- A busy maintainer sees a weird looking commit-- but it's three lines long, submitted from a known contributor, and the tests pass. It was very carefully planned to be innocuous-looking enough to not trigger any concerns with a casual once-over (oh, it just changes the way an error is printed) and obfuscated enough to not be obviously malicious because of the diff formatting, and submitted by a reliable known contributor. Each piece was designed to make a rigorous code review as unlikely as they could possibly make it.

Sure, that's not how it's SUPPOSED to happen, but I'll eat my hat if at least 95% of people who've approved a PR at some point couldn't have been walked down that path by a dedicated attacker over time. Hopefully this has been enough of a jolt to make that less likely the next time someone tries it.

People often cite death and taxes as the only certainties in life-- we could easily include human fallibility.
The use of "mantissa"[1] in this document is not right. What's being called mantissa here should be "exponent".

There's some ambiguity about what exactly "mantissa" means in the representation of a floating point number, to the point where some people recommend avoiding it[2] (for example, the IEEE standard for floating point uses "significand" instead).

But whatever mantissa means, it's exactly not (like the page says[1]) what's "used to raise or lower a floating point literal numbers by factors of 10", that's the exponent. The mantissa, if anything, is the other part of the number, that is, what's being multiplied by the factors of 10 (but it's complicated, the wikipedia[2] page explains it).

[1] https://www.getlazarus.org/learn/language/lexical/#float_lit...

[2] https://en.wikipedia.org/wiki/Significand (section "Floating-point mantissa")
Thank you for the feedback. I was hoping the tagline of 'Date, don't swipe' would do that to differentiate us against apps, but I can also add more information to differentiate us against other matchmaking services.
The incentives just are not properly aligned. I went to an urban school system that paid many teachers quite well (upwards of $130k 10 years ago for many), but the pay was just totally ubcorrelated with teacher performance.

Many of the worst teachers were the best paid because they had seniority and that was how the union had structured pay agreements, whereas many of the younger better teachers were paid very poorly (around $50k in a major metro) despite having left very high paying professional jobs to give back. The problem is that there is little-to-no economic incentive to do anything to improve student performance.
The goal here is to submit what appears to be a sequence of innocuous changes, none of which on their own are “obvious” vulnerabilities. The truth is, we don’t know what the strategic depths of this actor are. It may be years before we know whether an attack is successful.

For example — and this is just hypothetical - the author may have found that some consumer of this codebase uses it in a script, and consumes console output in some form. By modifying its output to behave differently, they may be able to influence the consumer’s execution in some clever way so as to create other conditions necessary for additional exploitation.

Or - the PR could have just been a test to gauge the scrutiny of the approvers.
> The scanning flow is superior as there is much greater margin of error in positioning and you can pay from a greater distance.

True. Some giant screens (e.g. in clubs) in China have a QR code that you can scan and pay to have your message displayed on the screen. Also many restaurants simply stick a QR code on the table for payment. No need for a waiter to carry a terminal. You just scan it when you are ready to pay and leave.
The Even Superiorly Greatest and Lovely Educational Life Hack: Learning Latin Ahead of Time
So it really might be „the most sophisticated“ one. Unfortunately, for security we rather need simplicity than sophistication. There should be „obviously no errors“ instead of „no obvious errors“ to quote Hoare.
The prudishness of censorship has always been a blight upon people's ability to express freely in interesting ways.

I disagree. Expression is separate from distribution. People are almost always free to express themselves. Sometimes, they can only do it in private or anonymously. This is why safe spaces are important. Additionally, interesting artistic expression can be a reaction to censorship.

Maybe a simple analogy is rock n roll music or rap music. At a time, it was was being censored way worse than this. After reaching critical mass despite not having mainstream infrastructure, it thrives today. Just because something isn't mainstream, it doesn't mean it's not being expressed, cultivated, consumed or explored. Just like there were clubs that supported alternative music, there are corners of the "digital world" that support art of all kinds.

On that note, a lot of people were smart and embraced the Streisand Effect. Come see the art Mark Zuckerberg doesn't want you to see :)
It might be fun to look at the last few chapter's of Wirth's "Algorithms + Data Structures = Programs" for a deep dive and similar looking diagrams.
Concur without comment.
But a physician or surgeon needs a license to practice, so it's not really a valid comparison.

However, I would love to have a doctor who was so passionate about it they taught themselves before going to school.
The study says there's surprising performance problems with Java's virtual thread implementation. Their test of throughput was also hilarious, they put 2000 OS threads vs 2000 virtual threads: most of the time OS threads don't start falling apart until 100k+ threads. You can architect an application such that you can handle 200k simultaneous connections using platform-thread-per-core, but it's harder to reason about than the linear, blocking code that virtual threads and async allow for.

> Context switching cost due to CPU cache thrashing doesn't go away regardless of which type of thread you're using.

Except it's not a context switch? You're jumping to another instruction in the program, one that should be very predictable. You might lose your cache, but it will depend on a ton of factors.

> there's a new cost caused by allocating the internal continuation object, and copying state into it.

This is more of a problem with the implementation (not every virtual thread language does it this way), but yeah this is more overhead on the application. I assume there's improvements that can be made to ease GC pressure, like using object pools.

Usually virtual threads are a memory vs CPU tradeoff that you typically use in massively concurrent IO-bound applications. Total throughput should take over platform threads with hundreds of thousands of connections, but below that probably perform worse, I'm not that surprised by that.
A man finds a shiny bottle on the beach.

He rubs it, and a genie emerges.

Genie: "I shall grant you one wish, mortal."

Man: "I wish to bring my grandmother back to life."

Genie: "Apologies, but reviving the dead is beyond even my vast powers. Perhaps you'd like to make a more... achievable wish?"

Man: "Alright then, I wish for worldwide adoption of the ISO 8601 date format."

Genie: "...Uh, where did you say your grandmother was buried?"
With seccomp, you have syscall filtering. The bits that are left exposed are largely around mm, and depending on how the sandbox works, non-syscall APIs like io_uring. It essentially actuates kernel APIs to sandbox, and then redirects a number of APIs to use userspace reimplementations.
So, optimize for user experience rather than efficient use of resources?
Right, so don't use them if you are a seven year old. LLM-assisted learning requires skill in learning.
For the people debating on the line between art and pornography: That's really not the point of the article at all.

The point they're making is that large tech companies (an in particular Meta) want all the benefits of having lots of users, without the investment needed to account for them. They therefore use technology in place of humans to detect policy violations. Since art is a human thing (see debates here), machines are not suitable for this purpose.

Meta uses them anyway because their business model falls apart if they don't.
Something like an iMessage of mail.

Surely there’s an RFC for that right?
I'm interested in hearing why one choose a Gitlab on-perm instance vs. a Gerrit + Jenkins system.
Yeah, but there's still those that need to do IR -> ASM.
I don't have a gut feel for how much difference the Mamba arch makes to inference speed, nor how much quantisation is likely to ruin things, but as a rough comparison Mistral-7B at 4 bits per param is very usable on CPU.

The issue with using any local models for code generation comes up with doing so in a professional context: you lose any infrastructure the provider might have for avoiding regurgitation of copyright code, so there's a legal risk there. That might not be a barrier in your context, but in my day-to-day it certainly is.
Academia wasted 5 years of my life.

> provides a path to take a person off the street and turn them into

That was true maybe 40 years ago. Today students are asking for debt forgiveness! Academia ruins people financially for decades!

> somewhat of a knowledge expert in a range of disciplines.

University graduates are pretty much useless in practical disciplines. They need years of additional training to become employable.

> You also hope that your nurse practitioner, physician or surgeon didn’t take a self-taught path

Medical professionals have several years of extra training in hospitals. They have to "self study"!
I can’t believe I just learned about this. So many lost files

Edit: lies!
Show HN: Streamtune - Fine-Tune LLMs with Zero Code
While working on a different project for academics, I wanted to fine-tune a language model that provided reviews for their manuscripts. I’ve done some fine-tuning and transfer learning of models in the past, so I thought this process would be really similar.

I quickly realized that fine-tuning LLMs is a different beast and every new resource uncovered more questions. How do I actually structure my data? Where do I access powerful GPUs? What is LoRa, what is quantization? What hyperparameters do I use?

In this exploration I began building a web app to fine tune LLMs without code. This is what I’ve come up with in the past 3 weeks.

- Bring your data as a CSV or JSONL

- Create a fine-tune of Llama 3 and your data

- Use and evaluate your newly fine-tuned model in app

The larger vision is for anyone, technical or not, to be able to come with any data source and an “idea” of what they want to accomplish and in a few hours receive an endpoint to a model.

The app is currently open to try out and doesn’t ask for any sign-up. I’ve set rate limits to 2 fine-tunes a day each up to 500 examples and up to 1 hour usage of the model after its created - just to limit costs.

I've included three models finetuned with the tool to try out as well:

1. Tweets QA - answer questions about a given tweet

2. Customer Support - professional responses to customer support queries

3. SQL - generate SQL code from natural language

I’d appreciate any feedback & questions.
The studies almost always compare 1:1 learning with learning in groups, comparing two different modes of interaction with another human,

But it’s reasonable to ask whether an AI can (today?) be as effective as a human at delivering (or even identifying, generating) that personalized interaction.
We use teachers as enforcers. But in my experience going to a big urban public school, the best enforcers are often completely orthogonal to the best knowledge-conveyers and I think we could have specialization for each of these roles.

In my opinion, the best enforcers generally are charismatic yet firm and come from a similar community/background to that of the students. The best teachers have an infectious passion for their subject, but oftentimes that trades off with their ability to enforce.
I don’t know about that! A lot of my blog posts are pretty technical, and intended for a narrower audience than “people who understand how to use a CLI”. One of the best bits of writing advice I’ve seen is that you should write with one specific person in mind — like, an actual human being you know — which helps you prevent yourself from going too broad or too deep.

Obviously a homepage is not a blog post and the goal there is different. But OP gets to decide what that goal is — and again, they seem pretty happy with how it turned out!
I have a self-built binary at ~/bin/tmux-old dated 2012-09-19, so that provides an upper bound of when I switched from screen.

(And to this day I'm still using tmux + irssi)
I just learned that our CEO owns our building and the company rents it from him. This secret knowledge was just given to me because I'm in the club. I immediately stated that information should be common knowledge for every ESOP member. No one was interested in that.
I bet NASA buys rad-hardened electronics by a truckload, and buys from distributors, not Infineon directly.

But it's a reasonable idea to notify all potential large consumers that are likely to have bought your specialty product; these are not numerous, and the impact may be large (as in this case).
Is more shielding not the obvious answer? A thin sheet of lead around the sensitive parts should do the trick.

(Note: I'm not a physicist and have no idea what I'm talking about in this domain)
Likely yes, but if you reversed the incentives (say, paying a bounty or declaring a free-for-all, even more sites would be destroyed.)
AI looks like nostalgia already
This is what forums like this one are for. Ordinary news isn't going to have more than a passing mention of the xz hack, or log4j, or meltdown, or heartbleed. Find (or start) a private group chat for technologists you know to share news like this.
> that gives you really nice smart queries in Nuxt 2; it may not be that crucial in Vue 3/Nuxt 3.

It's even better with Vue 3 (or Vue 2 with the composition API anyway), especially when you combine it with graphql-codegen. Smart queries become just another composable, no `this.$apollo` to be seen. Got that going with API Platform on the backend myself, which has really nice integration with symfony, though it speaks only a bare-bones dialect of graphql as opposed to Lighthouse with all its crazy directives. No persisted queries either, but it's an internal app with bandwidth to burn.

Been eying wp-graphql for my one wordpress project. From my dabbling with it, the DX feels a lot nicer than the WP REST api, though I'm sure you know that's an awfully low bar to clear.
True, but lets not get too Aristotelian about this. They are all worth looking at and all are true. They are also interlinked. Technical decisions would have been different if everyone put a high priority on correct operation. The high cost of the project ("it was the biggest non-military IT project in Europe.") created an incentive to over-up its failures.

The post office does not have unusual powers to prosecute. What it does have are powers to investigate: https://gunnercooke.com/understanding-the-role-of-the-law-in...

> the default assumption courts make that computers aren't wrong and so on.

This is the most disturbing aspect of it to me. Nothing has been done to change this so it will happen again. It probably happens regularly on a smaller scale.
I think learning how read and write is a better fit.

Math, despite what some say, is not that fundamental, but reading and writing well is(and then helps to get math and others).
Probably inevitable these days given hallway conversations are going to be a pretty random thing. Of course, assumes someone needs to think something is important enough to put in chat and doesn't mind putting it out in public. (Ignore $XYZ project that other group is doing. It's got all sort of problems.)
https://web.archive.org/web/20240717102854/https://www.wired...
we expand a highway to allow more cars -- so the highway gets used more and is still heavily congested.
I'm not sure this is correct, I suspect this works on a similar principal as something like gvisor where as I understand it syscalls are redirected to another userspace program. In gvisors case the kernel basically get's re-implemented in user-space to provide the secure container like implementation.

Also, as I recall some of the kernel based syscall based sandboxing have had a number of issues with dealing with some of the syscalls.
I think the key bug in gitlab is exactly that: out-of-control costs. One of the key things about moatless models is you do need to keep costs under control.

Gitlab has 2,268 employees. That's probably an order-of-magnitude more than they need. With 226.8 employees, they would be wildly profitable. Now, once you take on employees, it's very, very hard to shrink. It takes a lot of disciplines not to overgrow workforce. So I'm not suggesting layoffs or anything specific to fix it.

Regarding costs: Gitlab is $29/month. Github is $21/month (or $4/month).

* If you're spending $200k on an employee, is it really worth saving $300 or whatever per year on tooling? Any difference in productivity will far overwhelm that.

* If a devops employee runs $200k per year, are you going to "host your own" to "save" a few grand?

Much of the market simply doesn't care about pennies, and bottom-feeders aren't super-profitable in either case. Bottom-feeders can be important from a network effects perspective, but for profit, going for the high-margin makes a lot of sense.

Honestly, I have no idea how I'd value gitlab; that's another story. But all else being equal, I'll pick open-source over proprietary. That is a competitive advantage over github.
What an embarrassing moment for Infineon. IME their products tend to be very nicely engineered... and onerously documented, but that's probably a good thing if you're NASA. This, though, is concerning. With companies like Infineon, Analog, ST, etc. you're literally buying black boxes and an unenforceable promise that those black boxes will behave the way the datasheet says. This is a pretty egregious breach of trust, and Infineone really must do better to uphold their image.
it sounds to me like complex instructions are unavoidable unless the use case is restricted to microcontrollers. A modern ISA should CPU feature flags that allow implementers to disable complex and expensive instruction sets.

Would it be fair to day that ARM for example is a CISC/RISC hybrid, where armv8-a is full on CISC but armv8-m is RISC proper? But that's what I'm suggesting anyways.
Brings me back to a time early in my career where I had to write Cognos QTP, QUIZ, and QUICK programs (blech!) ... their documentation used this format, I didn't know there was a name for it. It was the only nice thing about working with those languages.
I've done exactly this in the past, and then when someone asks how long the project as a whole is going to take it's easy enough to give a range. If someone says a task is going to take hours that's a range of 1-6 hours, if they say it's months that's 1-12 months. If you want more certainty in your estimate then you're going to have to give us some time to break things down.
Perhaps, but the problem with UBI being, well, universal is that everyone gets it, including those that the working poor buy from. All of a sudden the suppliers see the purchasers having more money, and they have more money themselves, so where is the disincentive to raise prices? That’s how inflation works, and it’s well known that inflation screws the working poor most of all.
Good point.

AI it is, then...
That's just taking it out back and shooting it with extra steps.
It wasn't necessarily the people asking for it, black rock was pushing hard;
https://www.youtube.com/watch?v=eTDdDgr-xYo
Definitely!

1. Many companies are hiring "AI" engineers. My guess is 90% of these jobs are virtue signaling to investors and those positions will go to folks that are good at appearing competent in interviews. Yay! More overpaid incompetent colleagues, just what we need.

2. My editor saves me about 2 minutes a day with smart printf/loop/variable completions (JetBrains editors -- no sarcasm, i like this!)

3. I am wasting time responding to email from PMs suggesting that "we don't have engineering capacity to do XYZ, but maybe we can use an AI to do it???"

(I am not anti-GenAI -- I've used it to create flyers and do pretty cool stuff!)
Your user might be another application whose bottle neck is much more expensive than your own bottle neck.
> and just use java.net.HttpClient.

No.
I'd love to see a ground-up ISA that takes a CISC-style approach without all the memory hazards (and other faults) baked into it. Decode logic is "cheap" these days relative to other things on the CPU so why not lean into it?
Many jobs don't really offer being valued to those working them.
My team needs to get 17 points done daily, but no-shows-no-calls keep kneecapping efforts. When they do show up, they complain incessantly about how management makes everything a 0.5 no matter the list of features in the story, and why can't they get more than 29 hours a week so they can have insurance. But it's attitudes like that which keep them from getting raises on their yearly performance reviews. It's a good thing scrum was invented so we could finally measure the consistent low performance of you computer science nerds.
the only people i knew growing up who went to montessori we’re very affluent white kids with hyper involved parents.

even when given access to school choice, less affluent and minority parents do not choose montessori and there is absolutely a reason for that.
If you are native speaker of any language different from English, the greatest educational life hack is to learn English at the earliest time. It opens one's mind and allows access to content and communication at a global level.
Also, the museum hardly has any say in prosecution.
It was never a genuine concern, and just covering their backs given the social climate. It's cute that this person took it seriously.
Only if there's no repetition . . .
> Unless they've got a ton of videos of themselves shared on a public social media profile, I don't know that this is going to be a thing.

That sounds like a great recipe for spear phishing public figures.
This is awesome! I haven't found this detailed of a description of the vox format in one place anywhere. This will help me a ton on my hobby project for which I wrote my own vox library to write files.
You can issue cookies on a sub path though.
As I said, there is some merit to the argument. I do think that it's stretched a bit far, but that's neither here nor there. In any case, I'm not saying I'm opposed to applications being written in Rust. Use the language that suits your needs the best. All I'm saying is that the fact that something is implemented in Rust is not really a factor (either way) when I'm deciding whether or not to use a particular piece of software.
I liked the depth of the article.
May I suggest that the kids of HN commentators are being sampled from a very different distribution than the kids of the general public.
Unfortunately, in England and Wales, courts consider computers, as a matter of law, to have been working correctly unless there is evidence to the contrary. Therefore, evidence produced by computers is treated as reliable unless other evidence suggests otherwise. This way of handling evidence is known as a ‘rebuttable presumption’. A court will treat a computer as if it is working perfectly unless someone can show why that is not the case.

(taken from https://www.benthamsgaze.org/2022/06/30/the-legal-rule-that-...)

The sub post masters did not have access to the evidence required to show that the Horizon system was buggy and so were denied justice.
Atomic CSS requires a class for every CSS property you wish to set, at each breakpoint, each active/hover/focus state, each color scheme you support, etc. With data-attributes one could specify that the element is a primary, full-width, large button and all the properties that make that happen live in the stylesheet.