skysight-inc/HackerNews huggingface dataset:
Crucially, I don’t think the humanities are the solution here. I’d rather have a doctor that follows best practices than one who follows the supposed benefits of a humanities education — in particular I object to the idea that a doctor would follow their intuition when there is always an established best practice. The humanities are valuable, but don’t think it solves the problem statement laid out in the article.
I like that definition a lot. Another thing that stuck with me is that content is a commodity.
Politics of Professions
I disagree with this: when an actor is known for repeated bad faith, it's often a net gain of time to dismiss what they say by default. Only if someone else presents the same argument should you take the time to analyze it.
I went through a similar phase of excitement, but then realised it's a confusing layer of indirection on top of 'whatever-your-project-default-is' (e.g. npm + package.json). But I always need Make for BE+FE (small) projects, e.g. backend build with go and frontend is an SPA - this is where the power of Make to track dependencies really shines.
I like Makefiles as well, and although many people have commented on the limitations and the fact that the author's usage of make is fairly simplistic, I think it's great to get started with the basics.

Kudos to the author for writing this up and _not_ feeling the need to learn every last bit of make and do everything "properly" before sharing.

I've worked on a team where GitLab CI pipelines replaced Makefiles, and I was asked not to commit a makefile to the project because it's a customized developer workflow. They were allergic to local testing, but I thought it was a great way to just store and share knowledge about how to build, test, clean, etc. Far easier to read the GitLab CI files (which yes of course were also necessary and served a different porpoise).
I'm ok with this if it's also banned for everyone else. Otherwise this will just be laundered through private enterprise, the only party less trustworthy than the government.
>> Kubernetes is planned - my devops wants me to add it badly!

Do you mean the Podman "Kubernetes like" functionality (e.g. podman play kube..) or Kubernetes itself?
That's the beauty of make and shell, it's follows the UNIX principle of being simple and doing one thing and one thing well. People want it to do many other things, like be a scripting language, a dependency tracker, etc, so they're willing to pull in bloatware. New isn't necessarily better. Autoconf and automake isn't make.
But if the strategy fails, won't they lose credibility? How is it sustainable, if all they do is rubber-stamp?
The only thing the authors owe the users of their open source projects is fulfilling the terms of the license. Anything else is extra. Additional support is not guaranteed.
> I’ve submitted a handful of pull requests and I’ve already run into the classic “Your patch works and provides a feature some people might like, but I don’t like it, go away

Same. I think it is potentially easier to get a well defined change into Linux itself rather than a randomly chosen but largish open source project these days. I don’t really try to contribute to other projects anymore, not because I don’t want to, but because if you’re coding for fun anyway it’s usually better to work on a project you control rather than dealing with the frustration.

I think a huge percentage of open source would be more accurately advertised as “open source but closed contributions”, and being upfront and realistic about this is important. People who are already working for free deserve to have a realistic understanding of whether they will get to merge that simple bug fix they need to unfork the library, or if it’s more realistic that they need to start talking on a mailing list for 5 years and work out how to join a steering committee first.
https://archive.is/20240917041034/https://www.newscientist.c...
shouldn't this be possible to reverse-engineer since they stream the responses token-by-token?
Not really, it's antisocial behavior either way. This is just splitting hairs anywhere but a courtroom.

Anyway, a mall is a public space in the context of recording without consent. You have no reasonable expectation of privacy. The law needs to be updated to reflect the vastly more invasive technology we have now compared to when these statutes were written to reflect actual social mores.
I agree on the docker / podman, but for Kubernetes, Lens is is really useful. It isn't a substitute for knowing the command line but can be much quicker.
I recommend that kids who go to the Bodega and pick up a pack of smokes, a tub of ice cream, and a packet of condoms, check Wikipedia for terms like "Helen of Troy", "Trojan Horse", and the eponymous war, lest their Y chromosomes combine with something in a way they thought was impossible.
So basically, out of Go, into C++.

One of the conference demos on how Go is used internally is now gone.
i've noticed that copilot seems to do this pretty well, i ask about a function and it correctly looks up the relevant lines of code
Most vulnerabilities are not there because someone was deliberately negligent either. I see no evidence of a trend where vendors are "skimping" on anything.
Open source has existed for as long as the Internet has.

And both were called by different names previously.

It is not wrong to say that open source grew up in parallel with the Internet. I see no reason to worry that they will not continue to evolve together.
I kind of knew this was going to be about using make as a "task runner" instead of build system as soon as I read "ten years ago" :-)
Is this satire? Being a scripting language and tracking dependencies are primary features of shells and Make, respectively.
I'm not sure how it's going to solve the same issue. If your chunk is too short for the context, it's still going to miss the meaning if I understand the description correctly. As in "it's" 2 paragraphs in is still going to miss context, whether you embed chunks or sentences
That sucks for sure, I did work a giant enterprise for a few years and it was plenty painful but not that bad at least. Well maybe it was that bad, because we didn't use make either, everything had to go through Jenkins and nobody bothered with anything for local development beyond an occasional `build.sh` somewhere in the project. Simply push your code when you think it's done and wait 30 minutes to get the next set of linter errors.
Ah yes I didn't pay attention that it was the probability of being correct I misread it as the probability of being incorrect since the claim was that it diverged.
It's important to remember that even `npgsql` can have issues (see https://github.com/npgsql/npgsql/security/advisories/GHSA-x9...).

In your world, would the developer of a piece of software exploted by a vulnerability such as this be liable?
Correct. I think the one thing that is "owed", if that is even the right word, is that you don't knowingly put malicious software out there. But that's it.
> "...the hypothetical depth of this vulnerability is unacceptable."

What is also unacceptable is to pay 2000 dollars for something like this AND have to create user accounts to use your browser. Will definitely stay away from it.
Your false assumption is that most of its users know what is Docker and how it works.
The threads here appear to parrot the old decade “find the people before solving the problems” which sadly is way out of date.

Secondly, people are now so used to online ads that the ads became a background noise to them and most ads are somehow considered “scam”.

Since you built something, it means that it solves a real problem. Now you need to build a community around it or find the community who solve similar problems.

Now about the audience, is your product for technical people(think HN/Lobsters), then do a SHOW HN/Lobsters and offer limited free seats if it does not cost too much. Meanwhile lookout on Twitter(X), Mastodon and other tech channels to promote it covertly.

If your audience is lay person, ads on radio, poster ads, small time influencer(social media) promotion will bring some interest.

If your audience is more specialized, channels like Linkedin has a group of people who will be receptive to your promotions.

Here, my examples are just handpicked.

Aside, indie hacker group is… not a good place if you do not have a large community of followers and I’ve seen most of their products(other than games) are mostly junk that their followers will buy not as a value but as a support for the person they follow and will often refer others due to implicit referral bonuses. Of course there are genuine good products from indie hackers but most of their stuff are life style stuff that do not work unless you have a massive following base and can churn out new stuff every 6 month - 2 year because due to the nature of the products they build, there are no recurring business.
9 times out of 10 I've found opting out of the body scanners to be painless. 1 time out of 10 I get a bully who wants to make a scene in order to create social pressure to justify opting out. I always have to suppress the counterproductive and escalatory urge to say something along the lines of "this pointless conversation will be shorter if we skip ahead to where I reiterate that I'm still opting out".
Hey do you have any recommendations on a small kit to bring for long bike trips?
> And why does it matter that some editors don’t know about makefiles?

Because it isn't fun checking if the whitespace at the beginning of the line is a tab or spaces. And as said, you must know when to use tabs and/or spaces in rules.

For doing such a simple thing as calling some commands, Make has way too many subtle footguns which _will_ bite somebody, someday. The problem (that's not a problém at all, that's a reason to celebrate!) is that most JS devs and users aren't used to Make, compared to e.g. C programmers. To rephrase: as someone writing C, you have to use something like a Makefile, as anything else (like scripts) gets unreadable and -usable quite fast. But if you can get away with a less complex solution, you should really use that instead of Make.
Is a project worth receiving a honorary PHD if you ask me. Sadly university staff does not read HN too much.
You're comparing an a priori concept with a posteriori one. It's like claiming the number five doesn't "acshually" exist. Like yea, it's a concept, concepts don't exist.

A universe isn't a turing machine because it can't run all the programs that can run on a turing machine. This isn't exactly controversial.
I got burned by this recently and came to the conclusion that the concept of a current context is evil. Now I always specify —-context when running kubectl commands.
My 2c: Makefiles are excellent tech, just that a lot of people haven't learned to use it properly and use it as it was intended. I'm sure I'll get pushback, that's ok.

- Too basic: At least half of the software I use just uses plain makefiles and maybe a configure script. No autotools. I optionally run ./configure, and then make and make install, and it just works. I definitely wouldn't consider my setup to be a toy by any stretch of the imagination. It's built out of smaller programs that do one thing and one thing well.

- Too complicated: I don't know, I think make and how it works is really easy to understand to me at least. I guess everyone's had different experiences. Not necessarily your case, but I think usually it's because they had bad experiences that they probably blamed make for, when they were trying to build some complex project that either had a bad build setup itself (not make's fault), or without the requisite knowledge.

- No standard library: It's supposed to be tooling agnostic, which is what makes it universally applicable for a very wide range of tools, languages, and use cases. It's viewed as a feature, not a bug.

- Too constricting: I'm not sure what you mean here, it's designed to do one thing and one thing well. The simple layer is the dependency tracking.

- Too much magic: Cryptic or inconsistent syntax: See 'Too complicated'
Another way to look at that is we only need to increase wind capacity by 5x to cover that event.
https://yourdatafitsinram.net h/t daemonology ;)
Maybe we should just look at it and not try to climb it then.
I would argue that either way its in the best interest of a user to be able to have confidence in the product they use. Sort of like a wrench. If I buy a metal wrench, I expect a wrench made of metal not a impact driver or adjustable wrench. You can talk about how quality of tools is an issue with hardware and prices skyrocketing, but even the basic cheapo tools from a hardware store should be able to do the basic task they claim.

Here a thought experiment. You are a business or government and need some special software product or chemical for who knows what. You just need this so you go out onto the market, and inquire/shopp around. Some random company, which is profit driven, lands the contract or bid. They ship a great product. Sounds good, everything is working fine. Except woops, turns out that software has a backdoor or is collecting tellemetry., you don't know if it is unless your paying for edr software and endpoint detection, and some software might just refuse to run if it detects that stuff as they don't want you snooping on the api or finguring out how their product works. Or imagine your a startup making semiconductor chips but the software that runs on those machines has built in "wear" on the machine so you have to pay for maintenance or celebration or get a new one.

Software is like the hardware, if you can't trust the architecture then your exposing yourself to risk by using it. Just like Boeing needs to know where the metal came from and that all the screws and bolts went in correctly. A plane handles lives of people, and the computer and its hardware and software stack handle and process sensitive data, its not just about accessibility but being able to verify the claims being made.
They’re not. Some buy a Verified Mark Certificate (e.g. ikea.{com, ca, fr, maybe others} do), but most won’t ever (e.g. the first one on https://bimi-explorer.svg.zone/bimi/list.html 026430010.co.il, and a slightly random other dailydot.com). Also the two Mark Verifying Authorities listed at https://bimigroup.org/implementation-guide/ currently talk about approximately $1,300 and $1,600 per year, less than the $2,000 you say though recurring.
Didn't they already have these rules in place? And the vulnerability was when the owner was updating the resource to have a new owner?
The article specifically says not to do that, as traps moisture.
Sure but these are completely orthogonal to make. Might as well complain about gcc.

If anything, it's an argument for making better use of make's own features for configuration in the first place.
Even a yubikey isn't resistant to cookie-theft, plenty of TOTP code theft phishing kits exist. Users literally enable third-party apk side-loading and install malicious apks on their android phones because of social engineering. It's not new to security. If you wear a high-vis vest and carry a clipboard, you'd be let into even government buildings. that also is social engineering.

For your house builders statement, that is not a fair analogy. Is there evidence of a trend where software devs are saying "well there's always some other way of getting hacked so let's not bother doing things properly"?

You masterlock analogy is on-point though, because of "threat model", the purpose of most doors and locks in the US for residential use is as a lightweight deterrent. Burglars can just break the glass window and walk by the no-fence perimeter. You can and probably should get a more secure lock, but it is as strong as the door frame and windows, and whatever alarm system you're using. In other words, for that analogy (and for what the CISA boss is saying) to be valid, there needs to be evidence that burglars give up and go home when the lock is secure. I would even go further and ask for a proper root cause analysis. Do the builders of masterlock know how insecure their lock is? If they are indeed making it weak because of cost, then are they really to blame? they're a business after all. Where is the regulation for proper secure locks. As a government agency, CISA shouldn't be blaming vendors, that's a cheap cop-out. They should be lobbying for regulation and laws, and then enforcing them. So, in the end, even if the CISA boss is right, ultimately she shouldn't be blaming vendors but explaining what she's been doing to pass regulations.
I "hate" Makefiles, for building it's faster to use meson, zig build, cmake+ninja. For this use case, https://github.com/adriancooney/Taskfile is way more flexible and you don't need to mess with PHONY rules.
The Russian Bot Army That Conquered Online Poker with AI
The version of make which ships with Xcode is old (as Apple has stopped updating GPL software in general, and hopefully new builds of GNU make are GPL3 anyway), but it is otherwise not in any way somehow tied to Xcode's toolchain: it is a normal copy of GNU make 3.81 which runs commands the same as any other copy of make (as you provide them, and using the path).
https://archive.ph/jj1AQ
> File folders should be manually squared off at the bottom to accommodate the thickness of the records within them. North American file folders generally come with an array of pre-scored lines for this purpose.

This is a revelation for me! Somehow I never noticed what these were for and have been using folders wrong my entire life.
AGPL is open source but also seems to defend against large companies and cloud providers using without paying for a license. With a contributor agreement in place you can sell a different license to them.

DB sales of open source are based on cloud and security. You can keep some security as open core along with cloud deployment.

Open source is about expanding the total potential market even if you only capture a portion of the value there.
>It's not a "minor inconvenience" at all.

What's your solution? This kind of satellite system is going to get built and improved over time regardless of what you think of it.

>It's more due to Musk lying and not delivering.

No, it's not. I think you know it too. Biden and a bunch of EU politicians have literally threatened Elon over Twitter, as recently as last month. Everyone was cool with his hype game until they cashed out and/or discovered that Elon has the views of a liberal from about 2010.

Let's look at Elon's accomplishments objectively. He oversaw a new and inexpensive reusable rocket program, cutting-edge electric cars which libs begged for, solar systems for houses, and satellite internet. Not to mention his original online payment system in the early days. All of those projects are very competitive and widely used. Did he promise more? Sure, he did. But he also delivered more than any of the naysayers. I have some sympathy for a man trying to do what was considered impossible, like developing autonomous taxis.
If you wanna get super technical: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

This EU directive actually places caching in the same boat as "browsing" itself... does that mean if you can view a book online, it's not copying?

>(33) "...this exception should include acts which enable browsing as well as acts of caching to take place"
1. A clue: our mob comes from above 55N. 2. I haven't time to write the book. 3. I see no reason to have that info indexed by the web.
the only thing I really miss in make is the ability to resolve mtime as something other than mtime. So I resort to using touchfiles which are gross but still work better than a lot of other things (I'm looking at you, docker build caching).
Thanks everyone for the valuable feedback. In addition to the description in the readme, I'd like to share my specific use case for the project, which may not be immediately obvious.

I have the screen set up on my desk, and the image evolves throughout the day. Watching these changes is surprisingly enjoyable. For example, rain might appear from the right side and disappear after a few hours, or trees might start to grow. Meanwhile, the sun and moon steadily move forward, marking the transition between day and night.

Another fun aspect is how the setup resembles a binary clock. People often suspect it represents something meaningful but don’t always know how to interpret it. Still, the simplicity of the design invites them to try and figure it out.
Putting a 50 bucks bet that some very smart kid in the near future will come with some enthrophy-meets-graphical-structures theorem which gives an estimation of how the loss of information is affected by the size and type of the underlying structure holding this information.

It took a while for people to actually start talking about LZW as grammar algo, not a "dictionary"-based algorithm. Which is then reasoned about in a more general sense again by https://en.wikipedia.org/wiki/Sequitur_algorithm.

This is not to say that LLMs are not cool, we put them to use every day. But the reasoning part is never going to be a trustworthy one without a 100% discreet system, which can infer the syllogistic chain with zero doubt and 100% tracable origin.
You need to seek professional help.
Not satire, sorry I didn't clarify. They want make to have a builtin scripting language rather than using shell scripts, and a dependency tracking system that more complex and less tooling agnostic rather than leveraging the appropriate tool (like `npm ci`).
>As I often do on this topic, I feel compelled to point out that this isn't actually a problem.

It is for me, I don't want to spend my precious time helping a corporation like Microsoft increase their dominance.
What this report is telling me is there's fierce competition for relevance in STEM field paper publication across a wide range of interests.

That is very good.
Maybe assuming that you would spend as much with and without the credit, but I think removing the barrier to consumption, and buying on impulse and thinking later is the key. If you’re forced to save up for an expense, you have much more time to reconsider it.
The federal government is clearly ok with supporting a TSMC transition to the states. Something tells me though that they are willing to throw a lot of money at Intel if Intel is willing to fill the same niche that TSMC does currently.

That the chips currently produce more return than foundries is expected - it’s an established business. The foundries require much more up front investment. However the chips side of business has recently begun to show some cracks.

The foundries side of the business is in a different phase of life. It currently needs some TLC but has the potential to be totally ascendant at some point in the future. Assuming snapdragon is more interested in a chips business than a foundries business… it would just make sense to split them. There is tension with both under one roof as it is.
The hell are people down voting that for? It's not an endorsement of the legal principle.

This is the world we live in. But I'm sure many of you have money - why not try organizing and changing the law.
Who even implements an alternative implementation to GNU make? FWIW, no one "can't" use GNU make... even Apple uses GNU make (hell: they even ship GNU make, lol).
This is a strange and myopic understanding of "application security". You seem quite focused on vulnerabilities that could threaten underlying platforms or connected databases, but you're ignoring things like (off the top of my head) authentication, access control, SaaS integrations, supply chains, and user/admin configuration.

Sure, write secure software where nobody signs in or changes a setting, or connects to Google Drive, and you have no dependencies... Truly mythical stuff in 2024.