skysight-inc/HackerNews huggingface dataset:
> one part enterprisey, one part "move fast and break things".

When there's 0day, how enterprisey you would like to catch the 0day?
> I'm going to push back on, and forcefully, is the idea that bounty programs have an incentive to stiff researchers. They do not

I replied upstream as well, but let me push back here as well. They can actually, if the bounty program is being run for the wrong reasons, which can happen - I know anecdotes aren't data, but I've seen one case first-hand.

If a bounty program is treated as a marketing project and/or an "executive value" project then they can and will be managed as a cost center and those costs will be deliberately minimized. Bang for buck. Now obviously this is perverse but if making your manager happy isn't an incentive then I don't know what to tell you.
If you close your eyes and really reflect on it for a moment, I think you will realize that that tone is quite welcome here. The flag was not for the tone, but for the direction it came from, and I wear it proudly. It is HN's loss, not mine. This Hapsburg fellow seems quite likable, but he has the wrong politics, so she had to break out the toxoplasmosis claws as though her career depended on it (it does)! meeoww hissss
> why not also "bye" or "leave" or "close" or "end" or "terminate".

We can include these as well, but each keyword that you include brings diminishing returns at the cost of clutter and inconsistence in the API. Python problematically decides that returns diminish after the first --- “first” according to developers, that is --- possibility in all cases. Ruby anticipates that everyone's first choice will be different and practically maximizes comfort of users.
employees are trusted with secrets, so we have to audit that employees are treating those secrets securely

IMHO needing to be monitored constantly is not being "trusted" by any sense of the word.
Oh hell yeah it’s the semioscape person. Thanks for posting! I will say that I skimmed through parts (it’s quite long for typical HN fair and tends towards repetition), but overall glad I stuck with it. Would recommend - at least to check out the sections, and the questions at the end.

I always try to leave a critical comment but I don’t have much for this one. The citations in particular were fascinating, never heard of any of those thinkers. I hope to hear their web dev ideas on this at some point, when they come:

Yet the space for radical and experimental acts of curating networks remains largely untapped. Social networks are often organic and incidental, forming around affinities, common encounters, desire, collective will, and so on. But are there methods for growing networks in ways that enhance their capacity for creating ambient meaning? What processes of associative reinforcement and meaning-making might enhance the ambient meaning of a network?

Definitely a thought provoking prompt… how might you concretize and automate inside jokes?
the person you're replying will not take any sane argument once they decided that UX must be involved in kernel technical decision...
> missing some key features desireable in *search solutions*

Agree that sub-sentence highlights are somewhat out of scope for a pure vector db, but I was specifically talking about missing features in the context of a search solution which encompasses this feature imo.

If I was integrating search into my product, I would not want to build and maintain a highlight algo myself. Especially now that I have experience doing so :( . One of the more complicated things we had to build and I still don't think it's ideal.
It's linked to in the second half and worth the watch.
What does minutes and hours even mean? Software comparison using absolute time duration is meaningless without a description of the system it was executed on; e.g. SHA256 hashes per second on a Win10 OS and i7-14100 processor. For a product as complex as multiuser TB-sized LLMs, compute time is dependent on everything from the VM software stack to the physical networking and memory caching architecture.

CPU/GPU cycles, FLOPs, IOPs, or even joules would be superior measurements.
I resonate with that example. It's usually about a piece of code that didn't turn out the way you wanted to due to an issue. If there's a literal github issue or source I can link, I'll include the URL in case someone checks later and it's no longer a blocker.

Somethings I include brief explanations or links to a particular piece of hard-to-find documentation.
There used to be some tutorials going around to flash the firmware to turn greens into reds I believe. Which simply disables the head parking.
A company can have different business units with different culture/mentality.

I bet my ass anyone working in low-level code don't ship the way you do in Cloud.
I personally am slightly surprised at o1's modest performance on ARC-AGI given the large leaps in performance on other objectively hard benchmarks like IOI and AIME.

Curiosity is the first step towards new ideas.

ARC Prize's whole goal is to inspire curiosity like this and to encourage more AI researchers to explore and openly share new approaches towards AGI.
Could you explain how you got 'technically do 400-500mpg per seat' for electric trains powered by renewables or nuclear?
Since when was attaining the rank of ambassador and being appointed to the Vatican ‘low aspirations’?

Even the lowliest ambassador enjoys some authority, and much higher formal rank, than pretty much every non-unicorn startup founder.
What is there to handle? I have a ZFS array that works just fine with hard drives that automatically spin down. ZFS handles this without an issue.

The main gotchas tend to be: if you use the array for many things, especially stuff that throws off log files, you will constantly be accessing that array and resetting the spin down timers. Or you might be just at the threshold for spindown and you'll put a ton of cycles on it as it bounces from spindown to access to spin up.

For a static file server (rarely accessed backups or media), partitioned correctly, it works great.
I've been using

script_dir="$(dirname "$(realpath "$0")")"

Hasn't failed me so far and it's easy enough to remember
The Biannual Go Developer Survey Is Now Open
Yees, I was also missing being able to picture it in my head.
Pray tell:

How much of the Soviet Union was owned in any functional, practical or legal way, by the proletariat?

Oh zero? Did they have communal decision making? Oh also no?

How is state ownership of everything in a dictatorship relevant here at all?

It remains mind-boggling that the only thing people can fathom as an alternative to nightmare capitalism is state centralized, economic controlled bullshit dictatorship.

Unreal
Their stock has always been volatile but you can't ignore the fact that it hasn't been that bad after the incident.
Did she though? I was certainly surprised to see that the furthest east she got in Asia is Tbilisi, and then started up again in Perth. That is 71 degrees of longitude where the bike was not cycled. Before you ask, yes, I am a lot of fun at parties.
that's what EDRs do. anyone with access to your SIEM or CS data should also be trusted with response access (i.e.: remotely access those machines).

If you want this redacted, it is a SIEM functionality not Crowdstrike's. Depends on the SIEM but even older generation SIEMs have a data scrubbing feature.

This isn't a Crowdstrike design decision as you've put it. any endpoint monitoring too, including the free and open source ones behave just as you described. You won't just see env vars from macs but things like domain admin creds and PKI root signing private keys. If you give someone access to an EDR, or they are incident responders with SIEM access, you've trusted them with full -- yet, auditable and monitored -- access to that deployment.
Linux Backup Solutions to Explore
I agree with basically everything you said but I think you've misunderstood my point. I'll reply to the other comment with more.
There's actually a strange tradeoff with automotive companies. Security requirements are a big forcing function driving vehicle electronics architectures to modernize and adopt similar security practices to consumer electronics, away from the traditionally developed and profoundly insecure embedded systems of yesteryear. That brings a lot of security features with secure communications, secure boot, signed updates, etc. It also means that all the exploit development that's been done on consumer electronics becomes applicable to vehicle systems.

The teams maintaining all of this usually have a LOC/headcount ratio approaching 1 million too. It's a very different threat model than the old days when every manufacturer had their own systems and trying to craft an exploit required individualized work for all of them.
It is not a vulnerability, you literally pay for this feature. I really don't want to defend Crowdstrike but HN keeps making it hard not to.
to anyone else interested in the topic I've found this video useful:
https://www.youtube.com/watch?v=CIUrvoIdsU0
When I was learning php as a teenager in early 2000' those community examples where the best.

I haven't touched php in forever, but I imagine that the spammers and idiots would ruin that feature.
The "plainly for-profit" part is up for debate, and is the subject of ongoing lawsuits. OpenAI's corporate structure is anything but plain.
Feels a bit like moving back to Mom and Dad's house.
Regular reminder: RAID (and ZFS) don't replace backups. It's an availability solution to reduce downtime in event of disk failure. Many things can go wrong with your files and filesystem besides disk failure, eg user error, userspace software/script bugs, driver or FS or hardware bugs, ransomware, etc)

The article mentions backups near the end saying eg "most of the data is not important" and the "most important" data is backed up. Feeling lucky I guess.
I love this so much haha.

"I can only ask my employee 20 smart things this week for $20?! And they get dumber (gpt-4o) after that? Not worth it!"
A startup of 5 people likely exists in a "system of patronage". And I don't think that in a negative sense: 2 people will sometimes be equal in their abilities or have their distinct domains they are experts at, but as soon as their opinions clash significantly, they either continue with one being dominant, or separate. Just look at the number of fallouts between best-friend founders.

It's extremely rare that both will exude similar approach to collaboration and compromise equally (and perceive it as equally) to keep a stable business relationship.

That's just human, and what enables things to move forward (other option is death by commitee).
I had a significant data loss years ago.

I was young and only had a deskop, so all my data was there.

So I purchased a 300GB external usb drive to use for periodic backup. It was all manual copy/paste files across with no real schedule, but it was fine for the time and life was good.

Over time my data grew and the 300GB drive wasn't large enough to store it all. For a while some of it wasnt backed up (I was young with much less disposable income).

Eventually I purchased a 500GB drive.

But what I didn't know is my desktop drive was dying. Bits were flipping, a lot of them.

So when I did my first backup with the new drive I copied all my data off my desktop along with the corruption.

It was months before I realised a huge amount of my files were corrupted. By that point I'd wiped the old backup drive to give to my Mum to do her own backups. My data was long gone.

Once I discovered ZFS I jumped on it. It was the exact thing that would have prevented this because I could have detected the corruption when I purchased the new backup drive and did the initial backup to it.

(I made up the drive sizes because I can't remember, but the ratios will be about right).
Not just compatible, but capitalism requires fascism because by default it alienates the person doing work from capturing the value via exploiting the variability in standard of living and environmental sustainability.

Economists call this “arbitrage” which is a fancy word for, “Someone can dominate you economically and you have no legal avenue to avoid it.”

Proudhon covered this thoroughly in “What is property”
US judge allows election betting, dealing blow to markets regulator
"There are now experimental ports of .NET Core 8 and 9 for Haiku" - that is an amazing achievement (I guess). Also FLTK (brings back some memories). How about Firefox stability? This announcment almost let's you imagine using Haiku as a daily driver for development.
I can trust you enough to let you borrow my car and not crash it, but still want to know where my car is with an Airtag.

Similarly employees can be trusted enough with access to prod, while the company wants to protect itself from someone getting phished or from running the wrong "curl | bash" command, so the company doesn't get pwned.
Agreed with all of this. Although... the extensibility (while it is the stereotypical open source trap that leads to splintering of focus and complexity) is ALSO nice, although built on a shaky platform. Once the base GUI and functionality of Freecad is fixed up, the extensibility could potentially allow more flexibility than commercial CAD packages. Lots of potential there, if the platform is improved.
Thank you, that's a sound perspective, but it is the responsibility of the security staff who deploy EDRs like Crowdstrike to scrub any data at ingestion time into their SIEM. but within CS's platform, it makes little sense to talk about scrubbing, since CS doesn't know what you want scrubbed unless it is standardized data forms (like SSNs,credit cards,etc..).

Another way to look at it is, the CS cloud environment is effectively part of your environment. the secrets can get scrubbed, but CS still has access to your devices, they can remotely access them and get those secrets at any time without your knowledge. that is the product. The security boundary of OP's mac is inclusive of the CS cloud.
What a wild claim to make without any actual proof.
How's CL's GC performance for games nowadays? I've been slightly eyeing the upcoming Autumn Lisp Game Jam myself, but last I checked all the major libre CL impls, including SBCL, still used a full stop-the-world collector, which feels like a recipe for latency spikes. I saw flashes of stuff on sbcl-devel about someone working on a lower-latency one, but I don't know whether it got anywhere.
Doesn’t it rot?
Looks good! I am going to use Zen-Garden theme in my project.
Patch Notes #3: The game industry is becoming an innovation wasteland
The title is poorly edited by the poster.

They didn't unblock Twitter, they unblocked their assets held in the country.
Is this a joke? You don't have to put everything in 1 table.
You can't force women to take IT degrees and work for IT jobs. Many don't want to. It is sort of like having a female sanitation engineer or construction worker. Women don't apply for those jobs enough to satisfy DEI.
#skynet? :D :D :D

But yes, entirely human factors here (in this particular case it seems like whoever planned the route didn't consider clearance issues when crossing tracks :-/)
Why are stories so powerful? Insights from the psychology of memory (2017)
I guess technically, one can try to simulate every single atoms and their interactions with each others to get this result.

However, considering how many atoms there are in a cubic foot of meat, this isn't very possible even with current compute. Even trying to solve a PDE with, I don't know, 1e7 factors, is already a hard to crack issue although technically, it is computable.

Now take that to the number of atoms in a meatbag and you quickly see why it is pointless to put any effort into this "extremely slowly" way.
Rust is definitely not a simple language, I agree there.

I am quite likely a bit naïve here, but I'm having trouble understanding why you hate that this is possible. Now, the macro system definitely can generate near infinitely-complex code, but I'm not getting how implementing a sandboxed lisp using macros is a particularly potent example of the language being less manageable than at its genesis.

On another note, the fact that the type system is turing-complete, like with C++ templates or the Haskell type system (variously dependent on which GHC languages extensions you're using...), makes me want to see a lisp implemented that way!
My father, who died in 2010, would play Yahoo Games Pool and was good at it. It is all angles and physics and good for the brain.
Also stomach issues are very common, when for periods in the rain, road spray ends up in the mouth.
Software is made to a price just like other products. Great software takes time and skill, like other great products.
> practically changing the execution character set isn't trivial, and it's not necessarily even a desirable feature

I think it should be unnecessary to convert the character set; the execution shouldn't care about the character set except for ASCII and for whatever you program yourself in what the specific program you are writing is doing. It should not need to be a subset of Unicode, either; you should be able to use any character set that is a superset of ASCII (and where bytes in the ASCII range always mean ASCII characters and bytes not in the ASCII range always mean non-ASCII characters) (UTF-8 has this property and therefore may be used, but it is not the only character encoding with this property).

The C preprocessor is limited in its capabilities, although it would be helpful to add extra steps both before and after the preprocessor runs, which can transform character encodings, but also can be useful for other purposes too. (With GCC, I think this could be done by -no-integrated-cpp and -wrapper; I don't know about doing with Clang.)

(GCC will convert input to UTF-8 during preprocessing, but at least with the version of GCC that I have does not actually care if it is valid UTF-8 (at least for C; maybe not for C++ but I have not tried it), which is fortunate, since this means that you can implement your own character code handling.)

In the case of C++, as described there, you can use user-defined literals. They shouldn't require user-defined literals to be UTF-8 (nor Unicode), although if you can do whatever calculation you want on them at compile-time, then you can treat them as UTF-8 if you want to, but shouldn't be required to do so. (Personally, I do not use C++, though; so I do not actually know all of the details about how it is working, so I may have made a mistake.)

(There are several reasons you might deliberately not want UTF-8. One of them is security issues with the complicated text rendering involved with Unicode. Another might be the way that character widths are working. And there are many other possibilities, too. You might also prefer to put all non-ASCII text in a separate file; the #embed command can be used if you want to embed it into the program anyways, I suppose.)

> Even with full -fexec-charset support, it still makes sense to provide compile-time translation from Unicode to target strings.

Maybe, but I should think that this compile-time translation should be done separately as described above, and to be programmable to not be limited to only Unicode. It should not be required; I think it would be sensible that by default it should just pass through directly without conversion regardless of what the character set is.

> For example, Commodore PETSCII makes vastly more sense as an execution character set than a source character set.

I agree, but that is because Commodore PETSCII is not a superset of ASCII which is encoded as a superset of ASCII. The reason for this has nothing to do with Unicode.
The manufacturer worked around the problem by adding a custom filter in the audio pipeline that detected and removed the offending frequencies during audio playback.

Too bad the manufacturer wasn't named; I quckly looked through a few laptop schematics from that era and didn't find anything that stood out as being a notch filter.
It wouldn't disappear. Lots of Brits went to Brighton long before cheap flights to Bali. If you have 12 hours to travel, then you have 12 hours to travel, no matter the method.
Peruvians Cat-Alyze Tradition with Feline-Eating Festival (Reuters, 2001)
What are you talking about? Induction is very clean, no particulates at all. Same with covered infra coils. Naked coils might have negligible levels of particulates.
Crowdstrike is a bunch of idiots
Lego built a full-scale, drivable McLaren P1 model
OpenAI - "Accuracy is a huge problem with LLMs, so we gave ChatGPT an internal thought process so it can reason better and catch mistakes."

You - "Amazing, so we can check this log and catch mistakes in its responses."

OpenAI - "Lol no, and we'll ban you if you try."
The recyclers don’t have any way to contact the IT team?

The job for the IT department is to ensure all company data is wiped from the phones before dropping them off at the recyclers. Nothing more than that.

Heck, I bet some managers even knowingly ask them to keep the activation locks in place so that the phones will be shredded, just to add a belt-and-suspenders level of security.
Would you feel the same about a kill shelter called "save the kittens inc"?
Even if programming could be changed drastically by LLM, that still doesn't address the fact that all sectors have reached this 'software optimum' that he suggested.
> secret gag orders

We can debate principles and even the legality of these actions. But they weren't done in secret. (EDIT: I may be mistaken in this claim.)

> Article 5 of the Brasil constitution guarantees a right to free speech without censorship

Would this also ban spam filters? Fraud convictions? If not then there are obviously caveats to when and how one can censor. (No right can be absolute. If it were, it would merit infinite sacrifice to uphold.)

Also, why isn’t Article 220 ¶ 5 the relevant one [1]? Article 5 has 74 sections. Genuine question, I have no knowledge of Brazilian law.

> taking money out of them - let’s call this what it is, theft

A court that can’t find people in contempt isn’t a court.

Again, we can debate the principles. But these are straw men.

[1] https://www.oas.org/es/sla/ddi/docs/acceso_informacion_base_...
That's not the impression I've gotten from Tesla's software. From the flash wear issue to the numerous vehicle opening issues, to the entire mess of their UDS implementation, there's quite a lot to complain about compared to a hypothetical "best practices" manufacturer, as opposed to the dumpster fire software of other OEMs.
You know, if someone were actually interested in doing a modern terrestrial navigation system, I think the DME band would be where to go. It's 962-1213Mhz, a whopping 250Mhz of super prime spectrum. Lots of DMEs are now being decommissioned, so it shouldn't need as much spectrum as it has. Now, there are some other things in that band like radars and such, but I'd bet there's at least 30Mhz or so that you could set aside for a more modern ground based navigation system.
I don’t like dunking on Intel. It’s one of the only advanced all American foundry left, I don’t want them gone.
So is the idea that the behavior of the deep sea membrane, which is like a compressed spring, could be mimicked in artificial materials to resist high pressures?
Maybe I’m not seeing it but would be nice to have some metrics in this study to point to- maybe a control game which changes a fundamental part of the concentration mechanic.
Not from the coils, from the food itself. You can kind of fix it by cooking in a very conservative way, but good luck safely cooking chicken without oil and a high temperature (and the particles that generates).
So many words to say so little. Substack, writers without editors.
> The platform has been blocked in the country of 220 million since the end of last month.

Actually, 203 million. The 2018 estimate was 214 million, which was corrected in the 2022 census. Kinda crazy that it was overestimated by 11M.
Bad timing, this is changed in Python 3.12.

Still I’ve always used Ctrl+D, which works everywhere unixy.
Synthetic Continued Pretraining