skysight-inc/HackerNews huggingface dataset:
Seriously: Their reason is basically "argv[0] is bad because security snake oil software is garbage":

1) Oh no, the only protection is looking at argv[0]. What kind of clown software is that? Software that notably runs on an already compromised system..

2) No need for argv[0] to fool software that concats argv values with spaces: just run 'curl -o "test.txt |grep" 1.1.1.1'

3) A long argument messes up telemetry? Let's hope that bucket doesn't have more holes.
This is why I like to go in at 9, and leave at 5, to avoid the rush.
This isn’t always the case with algorithmic trading, but I see your point
> that is true of almost any language

You'd be surprised how often language-local cultures break that rule on either side. And a few times it's even an improvement.
Mobile phones not linked to brain cancer, biggest study to date finds
Do you have any source or further reading on this topic? The only thing I can readily find is you making similar comments on HN for the last decade, and I’d like to learn more.
Alcohol is a duretic, that is no myth. Vasopressin/ADH inhibition is well documented and studied. You are talking out of your ass about hydration by alcohol. Even miniscule amounts of alcohol increase duresis via supression of ADH.

https://x.com/tony_breu/status/1034891346069413888

I too have heard about the theory about how alcohol was safer to drink than water, however, a lot of literature also points to the fact that aclohol was consumed mostly for inebriation.
CL wasn't the only powerful library in that era - there were already: Dojo Toolkit, Ext JS, YUI, qooxdoo and jQuery.
I really like this take! I've been doing software professionally for over thirty years, and really relate to all of the discussions here and the root post. I typically beat myself up about "why is this task taking me so long?! it should be easy by now!", etc. But it's likely because I typically take the "focus on the next hardest problem first, otherwise I'll only have all the hard problems to solve at the end" route, and have to use the high-power gear all the time.
It's a common pattern for just about any binding of C-implementation to a higher-level language. Python has a similar pattern, and I once had to re-invent it from scratch (not knowing any of this) for a game engine.
Elon has at least 12 children with 4 different mothers. He literally cannot be an "INvoluntary CELibate" unless you think he is lying about that, too.
The Counterintuitive Birthday Paradox
Yep.

I had to write code to mount an iso image to a server, set the server to boot from it once and reboot the server to start the install.

I had to do it for 4 vendors. Dell, Lenovo, Fujitsu and Supermicro.

4 different vendors, 4 different Redfish APIs.

And what's annoying is that Redfish always looks similar so it fools you into thinking all the vendors do things the same way but no, suddenly some endpoint just doesn't exist in this vendors implementation and you have to scour the docs for this vendors unique magic uri.
I think they were being sarcastic.

But it's a bit challenging to conclusively measure someone's level of "smartness", especially with the usual time constraints of most hiring processes. More importantly, it also depends on what "smart" means to you, the company, etc.
Show HN: PlasCAD: Open-source plasmid editor
Hey! This is an open source plasmid and vector (Short, often circular segments of DNA) editor, with features related to primer quality checks, PCR cloning, and protein analysis. I plan to add more restriction-enzyme-based features in the near future. It has some extras like a solution-mixing helper, automatic feature annotation.

From a technical standpoint, this is a standalone binary written using the EGUI library in rust. A project goal is performance, with small memory footprint, and small application and file sizes.

This is a continuous work-in-progress, and I'm open to any and all feedback, criticism, and requested features.
Do people really use text search for this rather than an IDE that parses all of the code and knows exactly where each declaration is, able to instantly jump to them from a key press on any usage...? Wild.
> “Should a program be allowed to behave differently based on its name?”

I don’t see why not. It’s allowed to behave differently based on the arguments that follow it. I personally think the genericity of including the program name itself as one of its own calling arguments is really meta cool.
I believe they're referring to hieroglyphics, although I didn't know the story about religious persecution and would be interested in some context there.
Yes. Not everyone uses or likes an IDE. Also, when you lean on an IDE for navigation, there is a tendency to write more complicated code, since it feels easy to navigate, you don't feel the pain.
Yes, for that OS we’re using asm_const, which is almost stable, naked functions, and used_with_arg, which is linker related. We also use array_methods but that could be polyfilled, if the other three were stable.
Quantum theory makes it extremely [understated!] unlikely that a photon emitted from the surface of the sun originated in the core. Photons blink into/out of existence for all practical purposes instantaneously. Otherwise Josephson junctions, quantum tunneling and modern electronics would be DOA.
They don't seem to. People who exploit the reality of markets, that they are vulnerable to hype and speculaiton, seem to run away with more and more money, leading more and more people to engage in fraudulent SPAC dumps, meme stocks, lobbying for Trumpian deregulation, Tesla levels of fanbase engineering, and wash trading crypto coins.

The market is rife with information asymmetry that seems to be increasing, and for it to trend toward efficiency, we would need that to be trending downward.
The whole point is demarcating the line between where colors seem more-blue-than-green, and more-green-than-blue.
For example; if the revelation of the training datasets and their relative weighting revealed bias on the part of the LLM trainer toward some ideological goal, should we have the right to know that?

Similarly, if some food ingredient was found to be metabolically harmful and addictive, and the food producer is found to have funded and gamed the research to avoid your understanding of this fact, should you have the right to know?

I have become increasingly convinced that both of these events are occurring.

Should it not be our right to assure ourselves of the integrity of our nutritional and intellectual inputs?

Tragically, there is evidently now a majority of HN readers and voters who disagree! This renders HN an intellectual liability, instead of the valuable resource it used to be…
The original magic system from Final Fantasy 1 (you can only cast N spells per magic level, maximum of 9) is a copy of the system from Wizardry. The only difference you have to type the spell name to cast it in Wizardry, and you get a menu in Final Fantasy.
We need to know way more about our gut and bowel microbes. it's wild how little we actually understand outside of good gut health is good. It will take a lot of big and small research to slowly get reliable science and results.
I guess you could just ask him to write the number down on a piece of paper, and reveal you the number at the end of the interview :)
Helix certainly won't give you a 10x improvement. It tends to convert a lot of people moving "up" from VS Code, and still a decent chunk, but certainly fewer neovim users moving "down".

Advantages of Helix are pretty straightforward:

1. Very little configuration bullshit to deal with. There's not even a plugin system yet! You just paste your favorite config file and language/LSP config file and you're good to go. For anything else, submit a pull request.

2. Built in LSP support for basically anything an LSP exists for.

3. There's a bit of a new generation command line IDE forming itself around zellij (tmux that doesn't suck) + helix + yazi (basically nnn or mc on crack, highly recommended).

That whole zellij+helix+yazi environment is frankly a joy to work in, and might be the 2-3x improvement over neovim that makes the switch worth it.
There are a few companies out there that provide it, Runpod and Replicate being the two that I've used. If you've ever used AWS Lambda (or any other FaaS) it's essentially the same thing.

You ship your code as a container within a library they provide that allows them to execute it, and then you're billed per-second for execution time.

Like most FaaS, if your load is steady-state it's more expensive than just spinning up a GPU instance.

If your use-case is more on-demand, with a lot of peaks and troughs, it's dramatically cheaper. Particularly if your trough frequently goes to zero. Think small-scale chatbots and the like.

Runpod, for example, would cost $3.29/hr or ~$2400/mo for a single H100. I can use their serverless offering instead for $0.00155/second. I get the same H100 performance, but it's not sitting around idle (read: costing me money) all the time.
Huawei's triple-screen folding phone leaked – again
Also, on POSIX systems, exec-ing a program with argv[0] starting with ‘-‘ will have it start as a login shell, which is a whole rabbit hole of its own. I’m sure it’s within the security model (and the linked article doesn’t really discuss the concept of OS security models), but it’s still a pretty big shift in behaviour just from adding a character to the argv[0] value
What was the last time you were on the interview?

I think like 70% of interviews I ever had were like they were there to prove how smart they are and how stupid I am. I suppose most likely to make me feel stupid and accept lowball offer.
clang does this too.
When I'm setting deadlines for myself, working fast to ship, making compromises due to time constraints I get depressed.

When I'm working on a project for years and it has not yet shipped, I get depressed.

Personally, I think the problem is not with each strategy, but with the context - time is money and money is time and I have pretty much none to spare.
In France, Prime is 69.9€/year

I'm not sure of what I get exactly from it, but I never have to pay for shipping, no matter what I order and where it's delivered (at home, in a Locker, in a post office...)

But I also use my account to order for ~20 friends & relatives that don't want to have their own account and/or want to avoid shipping costs.

The recent introduction of ad on Prime Video forced me to stop using it and torrent what I wanted to watch there.

If they increased the subscription price, I would probably be forced to reconsider my relationship with the company ; but it would honestly require to be quite high given the ~150 orders I made with them each year.
We will fund super polluting slave labor if the difference to the manufacturers is $1.25 vs $1.65 per unit in costs, but the manufacturers charge us $5 for the unethical unit and $20 for the ethical unit.

That's not to say we wouldn't spend $5.40 for entirely ethical production; We are not granted that choice. In a wildly unregulated market with little oversight, establishing the chain to demonstrate ethical viability is expensive, and only people who have a lot of income and spare time can afford to even be worried about this.

Right now, ethical production in many areas of world trade is dominated by a fringe marketting strategy to price-segregate customers, because nobody has even tried to regulate a better outcome.

Expecting people to spend many hours studying every single thing they consume for signs of malfeasance, especially when most of the data they would require is a trade secret or things which manufacturers are actively incentivized to lie about, is crazy. This information black hole provides a second limit to effective pricing.
Bangladesh's internet blackout in July cost its tech industry $300M
It is also unclear if one has to keep playing. The expected value is very different if after the fifth guess one can thank Balmer for the opportunity and walk away.
That looks pretty interesting! How does the book know which page you're on? Is it based on light sensors?
Gccrs August 2024 monthly report
I find it funny when people write this off a psychosomatic. I find it similarly funny when people claim a conspiracy

I find the skeptical view that it would have to be some crazy science fiction "sick ray" kind of childish. The CIA literally had a "heart attack gun", and it was just a dumb dart gun with some drugs. It's easy to make simple technology sound wild and interesting and impossible. A weapon of this kind would either be very simple, or not. If it's an EM based weapon, there aren't a lot of dials to turn, so either there is a power/frequency combo that causes these effects, or not.

Likewise, I find the conspiratorial view that it definitely happened and there is some kind of cover up to hide either the weapon or some conflict pretty ridiculous. Partially for the same reasons outlined above (a weapon like this wouldn't be very interesting IMO), and partially because it took place in Cuba. Its obviously a somewhat adversarial nation. Something like this would normally be a news story for a week, if at all, then maybe be a footnote in some history books at most.
Laptops often force you to, given there's no real standard among them. Much as I love mine, the placement of FN and other special keys in a reduced area trips up my touch typing when I switch among them, especially when coding (when I use ctrl sequences more).
Your Name in Landsat
That's a weird take against argv[0] - all arguments are: "goes against modern design principles" and "can confuse programs which use argv[0] when they wanted "exec" instead"

For the former, I don't see how this goes against modern principles - in presence of symlinks, it is pretty reasonable to want to know both "how was this program called", as well as "what's the actual executable we ended up with". And this does more than just giving multiple names to same program - for example python uses argv[0] to tell if it's inside virtualenv and adjust search paths accordingly. This makes it appear like there are multiple python installs on system, with no extra disk space taken.

For the latter, yes, programs can have bugs and OSes can have non-obvious semantics, and if you are security software, it's very important to be aware about them. I would not mark "argv[0]" as something especially bad from security perspective. All the author's examples would still be possible in hypothetical world where argv[0] is set by system - as nothing stops user from creating a symlink in temporary dir with deceiving name (spaces and quotes are OK in filenames!) and exec'ing it directly. Instead, fix your security software so it quotes argv values?
Location: Helsinki, Finland

Remote: Yes

Willing to relocate: Yes

Technologies: React, TypeScript, Node.js, Firebase, PostgreSQL, GCP, AWS

Résumé/CV: https://randilusoysa.com/downloads/resume.pdf

Email: randilu.soysa@gmail.com
And unfortunately “productive” needs to be part of the package. I have worked with some incredibly smart people that I really respected who had a very hard time getting anything done.
That doesn't invalidate the suggestion that, take an incel, add sufficient money, and you get Musk.
If not, then busybox is going to need to change a TON
The judge threatened the company's legal representative with incarceration for a failure to comply, so Musk unappointed the company's legal representative.
The judge demands that Musk now appoint a legal representative, which Musk refuses to do.
Why would Musk appoint someone for the judge to incarcerate?
This is so freaking cool! I was mesmerized watching the paddles move as the beat progressed. There are certain things that just look right which makes it beautiful.This project is one of them!
This isn't true. If you manufacture inefficiency yourself, and control it, nobody can exploit it. In fact if they try to, you can exacerbate the inefficiency in the other direction. Try arbitraging against the inefficient pricing of GameStop.
It’s the equivalent of the HTTP Host header, with similar utility. But I agree with the author that an OS provided trustable structure is a much better way.
car came out in 1989. 1.8 wasn’t an option till 1993.
Oh Javascript would be much better if it could only be syntactic sugar...

`function(a,b){return a-b;}` is different from `(a,b) => a - b`

And `function diff(a,b) {return a-b;}` is different from `const diff(a,b) => a - b;`.
Location: California
Remote: Flexible
Willing to relocate: Yes
Technologies: Content, product, ops, strategy - generalist with deep knowledge of language; eager to come up with creative & practical solutions for interesting products as an early hire
Résumé/CV: https://www.linkedin.com/in/henry-weikel-8595311b6/
Email: henryaweikel@gmail.com
LSP doesn't always work without issues with large C and C++ codebases which is why one needs to fallback to grep techniques.
>If people are stuck in bad neighborhoods or bad jobs because they can’t save up enough for an apartment deposit or a better vehicle,

One flaw with this is rents are turning into a money sink. Until the housing crisis is solved, you can assume apartments/houses do not exist.

How to fix, build lots of housing, and I mean a lot. Like in a city like New York, build large apartments for like 2 million people.
I'm not talking about Elon. Just making a general statement that you do not always need to give someone the benefit of doubt.
I see what you're saying, but I don't think it applies in this case. Correct use of jargon helps domain experts communicate with higher precision, and papers tend to be written by domain experts for consumption by other domain experts.

Of course there are some (possibly many!) papers where jargon is abused to make something sound smarter. Sometimes this can also happen unintentionally.

In this case, "compute-optimal X" is standard terminology used in large-scale ML model design for finding the most optimal tradeoff with regards to compute when trying to achieve X.

Here, the paper is about finding the optimal model size tradeoff when training on LLM-generated synthetic data. Imagine you have a class of LLMs, from small to infinitely large. The larger the LLM, the higher the quality of your synthetic data, but you will also spend more compute to generate this data ("sampling" the data). Smaller LLMs can generate more data with the same compute budget, but at worse quality.

The paper does some experiments to find that in their case, you don't always want the largest possible LLM for synthetic data (as previously thought by many practitioners), instead you can get further by making more calls to a smaller but worse LLM.
> I’ve encountered many engineers unfamiliar

tbf, Distributed Systems aren't exactly easy nor common, and each of us either learn from others, or learn it the hard way.

For example, and I don't mean to put anyone on the spot, Cloudflare blogged they'd hit an impossibly novel Byzantine failure, when it turned out to be something that was "common knowledge": https://blog.cloudflare.com/a-byzantine-failure-in-the-real-... / https://archive.md/LK8FI
I am definitely an outlier but for me, I need those massive phones (well, their screens) since I am pretty tall and have big hands / thick fingers. Typing on smaller screen is just suffer fest due to many errors, and general usage sucks too regardless of brand (ie Apple mini 13 of my wife makes me wanna cry in 30s of using it).

In terms of Samsung's phones, Galaxy S II was tiny and bad, S 22 ultra is OK, wouldn't want anything smaller.

Cars are a different topic, but with 2 small kids, small cars are useless when transporting all of us. Very bad safety, storage too tiny and thus not usable for even weekend outdoorsy trips. Now I am not advocating for oversized US style SUVs, but some storage is required and making cars taller like crossovers or european style SUVs sucks for many reasons (high center of gravity and thus bad handling, higher consumption and maintenance costs, more permanent noise in higher speeds).
I hadn’t noticed this being rolled out yet in the bits of gouv.fr that I interact with.

I especially like the colour palettes.

I wish that the Vue storybook showed the demo component first. I wish ALL storybooks did that actually!
> the advice to prefer the variable name 'ii' over 'i' because you can easily search for it

\bi\b is the easy way to search for i.
Yet another example of needing technically-aware/-competent individuals in all levels of government
I'm a big proponent of visual scripting (where it makes sense) but you really do miss the text-based tooling like grep.

One trade-off you can make is using text-based serialization so you're at least able to grep the yaml or JSON or whatever and get to the right file at least. This of course costs you some editor load time.

On the flip side you're basically always using an IDE to edit the visual script. In theory symantic search should be possible and built in although reality usually falls short.

Someone in a previous HN thread mentioned the idea of a standard graph syntax. Something that game engines and tools could store their graph-based assets in. If there was a standard syntax then standard tools could be made and we could end up seeing something like a graph grep. One one could imagine a visual studio graph editor type app with plug-in support. Even a standard merge tool would be a huge step up for non-text-based code assets.

A man can dream!
Cool site. I've seen it before for some NBA vis. Impressive tool for visualizing the birthday paradox. The interface is clean and intuitive, making it easy to experiment with different parameters.

Some suggestions:

- Consider adding non-uniform birthday distributions for realism.

- A comparison between theoretical and simulated probabilities could be insightful.

- Mobile optimization can be improved
let me choose the color theme... FF0000
True, that's another good point. But again, this reasoning is very different to the one from the linked article and website - if you have oprofile or valgrind's cachegrind available, you clearly could get perf setup instead.

I'm not debating that manual GDB sampling has its place and value. I'm debating that perf is "lying" or that it's impossible to get hold of off-CPU samples, or profiling of multithreaded code in general.
These are all very realistic examples. Should they happen? No, but reality is messy and imperfect. The crappy software you describe would not exist if there were great solutions in this space.
> I do think a pattern could be printed back onto a screw head

I've never seen anything like that and don't believe it's practical. 3D-printed patterns will not look the same.

> there is no way you would be checking this every time

This entirely depends on your threat model and how much you suspect a tampering at specific conditions. In principle, you could even (automatically?) take a picture of all screws regularly and compare it with the original using some other, trusted device. In the worst case, you will find out about the tampering later, but it's a very different case than not knowing at all, forever.

> there are numerous significantly simpler methods that achieve a better result

What is simpler depends on the threat model and a person. But I don't disagree. For me, Secureboot is not a better method anyway.
Funny you omitted the picture argument.

Even your reply to this one lacks nuance that I brought up. Where do you draw a line for the things that need "source" vs the ones that don't?
CEOs didn't realize they could set prices that high and still keep their customers.
Zipf's law, right - these rules are a formalization of our brain's functionality with language.

Of course, with enough code, someone does everything.
Roughly Everything You Need to Know About Entity Resolution
The candidate who can ask that is already better than the candidate that jumps straight into a solution. If I'm the interviewer, I'd be impressed with such a candidate.

And frankly this is a needed skill. Candidates who automatically think about adversarial scenarios tend to write more defensive code, not to mention fewer vulnerabilities.