skysight-inc/HackerNews huggingface dataset:
Is there an existing comparison between pgManage and pgAdmin somewhere?

At first glance, it seems they serve the same purpose. Am i missing something? (besides the support for some other DBs - but pgManage states to target postgres primarily)
If ever there was a good place for Armageddon, it would be there.
'apply generates data from code.

'eval generates code from data.
>If we later move all the balls farther away, we don't expect the batter to hit farther.

I was about to mention the psychological barrier phenomena according to which, once a record is broken, scores of athletes move past it in short time, to say that this might actually be an example where it could have an impact if the batter is aware.

But then I realized that I never questioned this idea and was just believing something I heard at some point many years ago. Turns out, it's just another piece of "pop sci" trivia, aka misconstrued or wrong: https://www.scienceofrunning.com/2017/05/the-roger-bannister...
I know this is a bit heavier since it's a whole program:

https://aider.chat/ generates a repo map, suggests related files, then makes your request and does the editing for you. (with intelligent diff for models that work well.)

They have a leaderboard for models for editing and what mode they use: https://aider.chat/docs/leaderboards/

EDIT: Oh, it looks like you're dumping the entire repo. Well, sure, I guess. Once it seems too big you can select just what you need.
Also gui tools like the open source https://www.continue.dev/ lets you pick files, search codebase via RAG, add docs, etc...
There is now a protection, you can't set it to more than 9999.

:)
> It’s obviously not safe to publicly announce the existence of a security vulnerability

Publicly showing the vulnerability would have been unsafe, but I don't think there's much harm in asking to get in touch about an unspecified security issue (not even saying that it's a vulnerability in their website). Andreessen Horowitz is a massive firm, not some tiny website flying under the radar.

> and there was no barrier to alerting them privately via the same platform

DM would have to get picked up by their social media person next time they check Twitter, whereas a directed tweet can additionally leverage networks and be escalated by people with contacts - possibly someone could give the up-to-date engineering contact email, for instance.

Either way would have been fine, really. I feel we're going over the actions of an individual researcher with a fine-comb, searching for any hint that there was an arguably better course of action, when there are multiple huge obvious mistakes from a16z.
Fortunately 16-byte tables are the good case that always fits into a LMUL=1 register under the standard V extension.

I do agree however, this would result in bad performance for VLEN>128 and VLEN<DLEN implementations.

Adding a gather instructions limited to 16 elements might be a solution, however it could also result in vendors feeling more free to have a slower LMUL=1 vrgahter, that still needs to perform reasonably. The LMUL=1 and 16 element vrgahters are the most common cases.

IMO the software ecosystem needs to steer the hardware here, in place of ARM for neon, and Intel/AMD for AVX, stopping people from implementations with disproportionately slow permutes. People can't expect to put a ML core, like the X280, as the main CPU on a regular desktop class processor and expect general purpose software to be optimized on it.

I suppose this could be added to the RVA profile as well, but they don't want to specify micro architectural details, so what does it mean for an instruction to be fast?
Maybe there could be a non-normative clause that software is expected to use LMUL=1 vrgather for LUTs and other shuffles inside of hot loops.
I suppose creating an issue regarding this can't hurt, so I'll look into it.
Basically, when a major incident occurs the "correct" action is to throw people in jail. Those people, depending on your political persuasion, are either the person who pushed the button, middle managers (because they're the convenient scapegoats), or the C-suite.
American yes but not if you are from another country and need to go the US…
The article makes out that it was a bit.

Rather than continuing the argument in earnest, they picked someone who had nothing to do with the original argument then stopped posting all together. The point of them doing that was to show they had no interest in actually continuing the argument, to borrow a 4Chan term: they did it for the lulz.
You're replying to the author but I agree. Too much unfounded speculation. I'm glad the author is being called out for lack of research in a sibling comment.
>and that they need 3 months of development then you better shut the f** up and let them do their job.

This in a way covers the issue. Never in all my decades developing have had an estimate accepted. All the developers get is "It must be done by ...., no exceptions".

So you end up pulling all nighters for weeks, and because you are tired, errors or bad decisions creep in. So yes, the issue is fully with upper management.

I left a company because a big project was about to start and I could see it would be a big cluster**. People who stayed told me that is what happened.
It doesn’t undergo the phonetic process of umlaut, Don, and as it’s a vowel the two dots are more like a simple diaeresis.

It is used in that way in French too.
The older “cross compiling Go with Zig” post might give a good start if you want to figure it out
I’m on some Substack forums where everyone is a $5/month paying member. It helps a bit.
That's because you guys vet them like crazy before allowing them in a lot of European countries don't.
As an immigrant who works in tech, I think the H1-B issue in particular is a bit more nuanced. I think the feeling is that H1-B's are used inappropriately as a tool to leverage salaries lower. I don't actually know the stats on that.

That being said, you do want immigrants working right? That's kinda the entire point.
This is just highlevel trolling. Pretty obvious to me. That kind of humor emerged from 4chan and co and are a fundamental part of the internet gossip.

I find it somhow very amusing.
I see what you're getting at, but this requires far too much trust in the administrators. Transparency is critical in proceedings like this.

Also, the statement is worded in a way that suggests he was removed for a cause that is unknown, and independently had a CoC violation brought against him that is still being mediated. Therefore there can be no outcome there yet. Which makes me wonder when they removed him for cause, what exactly that cause was.

I think blindly accepting decisions of authority is dangerous.
So, I didn’t know the story - turns out Lowtax passed - but in searching I found a bemusing internet history of how Lowtax’s “banning of hentai on SA [was] ‘The Archduke Ferdinand Assassination moment that lead to QAnon’”

https://www.reddit.com/r/technology/comments/qro1ir/comment/...
Just study all of them.
They had a long time to think of a clever rebuttal. Hopefully it was a good one.
> they can do at least minimal testing (which would have found this issue as it has a 100% bsod rate)

Incorrect, I believe, given they did not and could not get advance sight of the offending forced update.
Yes. Twitter is rampant with people posting outright Nazi praise among lots of other social ills.

I spent a few hours reporting the obvious ones on 4/20 just to see if anything would happen, mostly out of curiosity to explore the rabbithole and chain of accounts. Out of 50 reports: 0 bans, suspensions, or deletes.

The posts were all consisting out of direct threats to other users or support of genocide. I didn't even bother reporting the Hitler praise because I knew that wouldn't cross the line for X.
As someone who works in this space, I can tell you: it's because big companies buy Cyber Security Insurance, and the insurance forms have a checkbox along the lines of "do you run Endpoint Security Software on all devices connected to your network", and if you check the box you save millions of dollars on the insurance (no exageration here). Similarly, if you sell software services to enterprises, the buyers send out similar due diligence forms which require you as a vendor to attest that you run Endpoint Security Software on all devices, or else you won't make the sale. This propagates down the whole supply chain, with the instigator being the Cyber Security insurance costs, regulation or simply perceived competence depending on the situation.

So it's not necessarily government regulation per se, but a combination of things:

1. It's much safer (in terms of personal liability) for the decision makers at large companies to follow "standard industry practices" (however ridiculous they are). For example, no-one will get fired outside of Crowd Strike for this incident precisely because everyone was affected. "How could we have foreseen this when noone else did?"

2. The Cyber Security Insurance provider may not cover this kind of incident given there was no breach and so as far as they are concerned installing something like Crowd Strike is always profitable.

3. The insurance provider has no way to effectively evaluate the security posture of the enterprise they are insuring, so rely on basic indicators such as this checkbox, which completely eliminates any nuance and leads to worse outcomes (but not to the insurance provider!)

4. "Bad checkboxes" propagate down the supply chain the same way that "good checkboxes" do (eg. there are generally sections on these due diligence questionnaires about modern slavery regulation, and that's something you really want to propagate down the supply chain!)

Overall I would say the main cause of this issue is simply "big organisation problems". At a certain scale it seems to become impossible for everyone within the organization to commicate effectively and to make correct, nuanced decisions. This leads to the people at the top seeing these huge (and potentially real) risks to the business because of their lack of information. The person ultimately in charge of security can't scale to understand every piece of software, and so ends up having to make organisation-wide decisions with next to no information. The entire thing is a house of cards that noone can let fall down because it's simply too big to fail.

Making these large organisations work effectively is a very hard problem, but I think any solution must involve mechanisms to allow parts of the business to fail withing taking everything down. Allowing more decisions to be taken locally, but also the responsibilities and repercussions of those decisions to be felt locally.
Plenty of fundamental research and development happens in academia fairly effectively.

Government has to fund not run it like any other grant works today. The existing foundations and non profits like Apache or even mixed ones like Mozilla are fairly capable of handling the grants.

Expecting private companies or dedicated volunteers to maintain mission critical libraries like xz is not a viable option as we are doing it now.
"FMCG stands for Fast-Moving Consumer Goods products sold quickly and relatively cheaply. Some examples of FMCG products include packaged foods, beverages, toiletries, cosmetics, cleaning supplies, and other low-cost household items."
The advantage of Microsoft being second is that they could watch what VARs were installing and make very sure that NT would work seamlessly with that. It didnt take much for them to realize that, say, the 3Com 3C905 or the NE2000 NIC were far and away the best selling NIC in Netware installations, and that therefore they should make very sure that they Just Worked on NT.

I worked in Token Ring at the time. It was...less fun.
Imagine a Beowulf cluster of those
society is becoming enshittified by the majority of people giving a pass to people doing banal, evil stuff constantly because it is "their job."
Some of the affected people somehow knows that are being used for that, some companies pay them for amount of requests they pass through. But they ignore the potential harmful consequences for them, and the consequences for the scrapped sites (from loss of performance to not be table to serve content) and the intended users for those sites.
What's naive?
I am living in Europe, always have and you should look at the studies made in Denmark and Germany to find out how this went down.
> they can do at least minimal testing (which would have found this issue as it has a 100% bsod rate)

Incorrect, I believe, given they could and did not get advance sight of the offending forced update.
Dunno - here's a list of 38 bots currently (last 4 hours) active on HN:

https://news.ycombinator.com/item?id=41024612

part of a larger network. The cost is perhaps $500 to have a group that can cordinate votes to raise the profile of posts (for marketing and other reasons), to downvote | flag negative coments, etc.

With AI such things can fly more and more under the radar and will be seen by some as a valid expense for the gain they seek.
Why?
From the user's pov, what 'low level integration with an OS' is there that couldn't/shouldn't be abstracted into 'generic debugging functionalities'?
You can appear less nerdy by finding other things you are interested in, art, philosophy, music etc and developing those skills.

Climbing the pole to feed into the 'talk lot, say nothing' system is just feeding the broken system recursively.

It is obvious why OP wants it, but OP should question whether they should want that.
Sounds like a perfect situation for a strangler pattern? Wrap or transpile the original code into a language with stronger refactoring support and the rest should become incrementally easier.
Watch Seinfeld and write down the lines. Every episode is filled with a lot of “talking about nothing.”
Low potential is not no potential, and most everyone is looking for swiss-cheese defense when it comes to these devices.

In the case of a display at a check-in counter:

- The display needs to be on a network, because it needs to collect information from elsewhere to display it.

- It's on a network, so it needs to be kept updated, because a compromised host elsewhere on the same network will be able to compromise it, and anyway the display vendor won't support you if your product is nine versions behind current.

- Since it needs updates for various components, it almost certainly needs some amount of outbound internet access, and it's also vulnerable to supply-chain attacks from those updates.

- Since it is on a network, and has internet access, it needs to be running some kind of EDR or feed for a SIEM, because it is compromisable and the last thing you want is an unmonitored compromised host on your internal network talking back to C2.

Anything that can be used for lateral movement will be used for lateral movement, and if we can get logs from it we want logs from it. A cross-platform EDR solution is perfect for these scenarios.
For what it's worth, I'm a nonwhite immigrant living in a Deep South state, with experience living in more liberal coastal metropolitan areas. You will find that whites and blacks are much better integrated with each other in the south, and that racism runs deeper up north. For example, it's widely known among black professional athletes that the most racist city to play in is Boston.
I never really understood, how lobster is working or is supposed to work. I don't know any other HN posters, let alone lobster posters personally. How would I ever find someone to vouch for me? And why should anyone, since they don't know me personally either? Do people just randomly vouch for others then? Or is it like a closed society kind of club? Or do people do some vetting procedure, that they personally like, and then vouch for others, that they vetted?
Who else is in a better position to give an estimate than the people who design and build the thing?
Complete nonsense. The policy has failed. The regime is still there after over half a century. Meanwhile the Cuban people suffer.

Maybe those words make you feel smart or strong or reinforce your ideological positions... but they're bad policy. Unless you cover your eyes and ignore evidence.
This is a fork and the new developers have no companies or social media profiles linked from their GitHub profiles. After the attempted XZ Utils backdoor attempt, that is a major red flag for me.
That would just kill off the community, since there is some natural attrition that always happens in a given community that has to be compensated for with new users (and moderation to guide these new users).

The problem facing HN IMO is not so much about spammers but low-effort comments and jokes (what dang calls reflexive vs reflective[1]).

[1] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
> Which is the consequence of being sanctioned into oblivion for decades by the global hegemon

or the consequence of having a clueless communist regime, since most communist countries do very poorly economically. Sanctions rarely give the whole picture.
the more software you add to the display, including EDR, the higher the chance it will go down. you don’t reduce attack surface by introducing more surface and you don’t improve uptime by introducing additional single point of failures.
100,000 hours equals how many hours again?
Remove PDF password protection using qpdf and AppleScript
None of the doors I was able to open here in the US would have been opened if I were in the UK or Germany...

The UK recently had a Prime Minister of Indian descent, that he was able to breakthrough the glass ceiling of racism is quite remarkable given he subsequently was unable to demonstrate a talent for anything.
> since they practically become indentured servants

Yup. A lot the cheap fruit + veg in the EU is thanks to back-breaking work by immigrants and the farm owners breaching their human and labour rights..

Who do you think is picking the fruit in the massive green house of southern spain? Not well-paid Spaniards I'll tell you - https://www.ethicalconsumer.org/ethicalcampaigns/agricultura...
> I've heard the same polite euphemisms refering to Arabs and Gypsies from the mouths of members of the Front National. You know, before 1945 it was said in Europe that Jews weren't able to integrate fully with the host society.

I my country Jews lived for 800 years until they left without saying Godbye in 1940s. But we have never held them hostage - they were free to move to Ottoman Empire or North Africa if that suited them better. Or behind Pale of Settlement.

Living in ghettoes, sitting shiva for members of community that married non-Jews or assimiliated, being under influence of fanatical rabbis didn't help with integration.
The concept that you can't take the blame if you're not given the responsibility is not naive.
correct me if im wrong but i tried getting some of the books and it looks like they're only available to "registered teachers"?

that doesn't sound open to me
I think Boeing clearly tried to apply Agile to their planes
Sure, in the beginning but it also proved the Republican point that you can't handle an unrestricted amount of immigration, even in large cities which also goes in favour of immigration restrictions (and of course not total immigration blockage which is not feasible and silly).
Lightning Network?
I think economic decline is regularly considered the best time to start a new business?

Good time to find people to hire and work hard to prepare for better times.
> open sourcing everything wouldn't cause any problem

That is not what am saying, I am saying open sourcing doesn’t cause more problems than proprietary systems which is the argument OP was making .

Open source is not a panacea, it is just not objectively worse as OP implies.
Meanwhile in The Netherlands, the homeless dig through trashcans for their €0.15 bottle deposit and leave all the trash next on the ground.
It's not perfectly clear yet if CrowdStrike is able to push executable code via those updates. It looks like they updated some definition files and not the kernel driver itself.

But the kernel driver obviously contains some bugs, so it's possible that those definition updates can inject code. There might be a bug inside the driver that allows code execution (it happens all the time that some file parsing code can be tricked into executing parts of the data). I'm not sure, but I guess a lot of kernel memory is not fully protected by NX bits.

I still have the gut feeling, that this incident was connected to some kind of attack. Maybe a distraction from another attack while everyone is busy about fixing all the clients. During this incident security measures were for sure lowered, lists with BitLocker keys printed out for service technicians to fix the systems. Even the fix itself was to remove some parts of the CroudStrike protection. I would really like to know what was inside the C-00000291*.sys file before the update replaced it with all zeros. Maybe it was a cleanup job to remove something concerning that went wrong. But Hanlon's razor tells me not to trust my gut: "Never attribute to malice that which is adequately explained by stupidity."
FWIW, I don't think that's by Benny Hill - https://quoteinvestigator.com/2021/02/08/assume/
Sure, the dev is wrong, but so is the process that allowed their error to impact the product. If a single person can make this choice on accident, then a single person can make it on purpose either by being malicious themselves or being otherwise compromised. If the company has hung their entire security posture and operational success on the choices of one person, they have a problem. Especially a security company.
> Economists say every immigrant is a net economic positive to the nation

Does that not fail your smell test?

EVERY immigrant?
> You’re also getting the thing you bought too

No, it's not like you wanted it. You just wanted to pee, not a 500 kcal cookie.
> In every instance, the deaths were preventable, experts say. All but one of the victims were male; the youngest was 16. In many cases, the companies failed to follow basic government rules for making trenches safe.

Having known someone in the construction industry, I don’t think this is as simple as blaming “the companies”.

One of his frequent frustrations is getting workers to actually use the safety gear and follow the company safety policies. This includes properly securing trenches with the equipment they provide and mandate.

I’ve heard stories about new guys who refused to wear safety glasses or hearing protection while working machinery. Some of them so defiant that they had to be fired within weeks.

Obviously we need to harshly fine the companies that fail to provide safety gear or pressure employees to do unsafe things. However, having had a peek behind the curtain I think this issue is more complex than a simple failure of companies to follow guidelines for providing gear and procedures to employees. You really have to be on top of work crews all the time to make sure they’re actually following procedures rather than cutting corners.
> Unicode chars support. I prefer to type α instead of \alpha.

This is not done by default by LaTeX, but if you can bear to \usepackage{unicode-math} then it's readily available. A life changer!

Regarding presentations, what do you mean exactly? There are a lot of weirdly different beamer themes. You can even put a single verbatim block inside each slide and you'll just have a "text mode" presentation, if that is your thing.
Prevention. Add a taser to this robot and you need a lot less of them.
I've used rr very sucessfully for reverse engineering a large code base using a break on variable change combined with reverse-continue. Took the time to extract critical logic way down.