skysight-inc/HackerNews huggingface dataset:
Reminds me of the joke in Get Smart where they give Max a suicide pill and he asks "How do I get them to take it?"

Also the time when the manager of a supermarket (who looked like an FBI agent from a 1970s movie) thought I was shoplifting (I was going the wrong direction and did look scruffy and had a big bag with an open top) and followed me out holding a clipboard that I'm sure he would have whacked me with and said it was an accident if I'd given him any trouble.
Really nice work. Thanks for the share.
CVSS scores are meaningless in a vacuum, and in this case it seems the redhat person who calculated them took the "fudge it until it looks bad" approach.

Below is my professional scoring evaluation while trying to keep to the ideas behind CVSS and the spec as much as I can. Although CVSS is used so rarely in my work (as it usually inappropriate) that I may have made some miscalculations.

CVE-2024-47176 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2024-47046 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVE-2024-47175 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVE-2024-47177 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

If I apply the same exact approach to scoring Heartbleed I get:

7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The key differences between Heartbleed and the final code execution issue in the attack chain are that Heartbleed is directly over the network (in a vacuum) whereas the code execution is entirely local (in a vacuum, ignoring the previous elements of the attack chain, assuming they were themselves fixed). Additionally with heartbleed there is no user interaction required which also raises the score. But conversely, the direct impact of heartbleed (ignoring what you can do with the information) is that it is only a confidentiality impact (although you could argue that it can lead to a crash which would be a low availability impact bringing the score up to 8.2).

I don't think this clarifies much about the scores but hopefully you can see why CVSS scores are meaningless without any context. You need to put them in the context of the environment. The other problem is that in an attack chain, the overall outcome might be bad even if all the individual issues score low. But CVSS doesn't apply to attack chains.

At the end of the day, this is a high risk issue (you say many distros have cups listen on loopback, but I think this is not true, 631 tcp is indeed loopback only, but 631 tcp is in fact commonly bound to 0.0.0.0) but only in the context of your laptop which you happen to connect to untrusted networks without a firewall.

In summary:

This problem as a whole primarily affects desktop systems and some servers.

Device running cups exposed to the internet: Critical

Device running cups connected to untrusted (but local/non internet routable) networks: High

Device running cups connected to trusted networks: Medium
Not sure of the situation on 22.04, but my 24.01.1 box just caught a bunch of CUPS updates (including cups-browsed)

Edit: 22.04.5 got them too
I used to think this, but do you really see the liberalization of gambling laws as having a positive effect? Would you describe the previous state of it being illegal as some kind of dystopia? Do you care at all about the wreckage it creates in the lives of individuals and their families?
You are buying an experience on that night. Similar to buying food at a restaurant

You aren't buying a bad faith argument.
We go through periods of liberalization, and then it's opposite, as the ills of each regime become salient. For example, in the US, Oregon abandoned its legalization of hard-drugs, and I expect to see a national push to restrict and regulate cannabis more heavily, for example, regulating THC content more stringently, etc.

With so many things, finding the right balance takes trial and error, and what the right balance is may change as other variables change as well.
Also completely wrong. HN has no restrictions on being cynical about companies.
Of course, but every token generated by a 100B model is going to take minimally 100B FLOPS, and if this is being used as an IDE typing assistant then there is going to be a lot of tokens being generated.

If there is a common shift to using additional runtime compute to improve quality of output, such as OpenAI's GPT-o1, then FLOPs required goes up massively (OpenAI has said it takes exponential increase in FLOPS/cost to generate linear gains in quality).

So, while costs will of course decrease, those $20-30K NVIDEA chips are going to be kept burring, and are not going to pay for themselves ...

This may end up like the shift to cloud computing that sounds good in theory (save the cost of running your own data center), but where corporate America balks when the bill comes in. It may well be that the endgame for corporate AI is to run free tools from the likes of Meta (or open source) in their own datacenter, or maybe even locally on "AI PCs".
I hear it all the time on HN that people are producing entire apps with LLMs, but I just don't believe it.

All of my experiences with LLMs have been that for anything that isn't a braindead-simple for loop is just unworkable garbage that takes more effort to fix than if you just wrote it from scratch to begin with. And then you're immediately met with "You're using it wrong!", "You're using the wrong model!", "You're prompting it wrong!" and my favorite, "Well, it boosts my productivity a ton!".

I sat down with the "AI Guru" as he calls himself at work to see how he works with it and... He doesn't. He'll ask it something, write an insanely comprehensive prompt, and it spits out... Generic trash that looks the same as the output I ask of it when I provide it 2 sentences total, and it doesn't even work properly. But he still stands by it, even though I'm actively watching him just dump everything he just wrote up for the AI and start implementing things himself. I don't know what to call this phenomenon, but it's shocking to me.

Even something that should be in its wheelhouse like producing simple test cases, it often just isn't able to do it to a satisfactory level. I've tried every one of these shitty things available in the market because my employer pays for it (I would never in my life spend money on this crap), and it just never works. I feel like I'm going crazy reading all the hype, but I'm slowly starting to suspect that most of it is just covert shilling by vested persons.
We optimized LLM use for cost, quality, and safety to write postmortems
I have wondered for awhile what just injecting [fresh] placental/umbilical cord tissue into people with various autoimmune issues may result in, as apparently it has powerful immune system regulators in it; I've not looked for related research yet though.
I was watching Alien last night and as they talked with Mother it was refreshing to see the ship computer just say “I don’t know” when it didn’t know something. If we could get our LLMs there it would be a nice step forward. You can definitely tell ours were made in Silicon Valley, home of the bullshit and fake it till you make it.
I think one of the main improvements we've - interestingly - been unable to widely adopt is an actual live programming environment. Smalltalk was this. Nowadays I mainly use Common Lisp for something reasonably close.

We're still mostly stuck in an edit->compile->test cycle. Stuff like TDD and debuggers help here, but considering the untapped potential for what programming environments could be, it seems to me like we're stuck on a local maximum.

Edit: Don't get me wrong, programming in Smalltalk didn't seem entirely pragmatic to me. Reproducibility becomes something you need to actively worry about, with popular tech stacks it's kinda built in. My point is the potential of such approaches, not the pragmatic viability of the implementations we've had so far.
Gambling isn't the only form of entertainment meant to tickle the part of the brain that craves risk. Movies have car chases. Amusement parks have roller coasters.

And many jobs involve taking risks. Investment houses. Sales. etc. We reward those who take risks because society (often) benefits.

I find it much easier to argue against standard casino games because it's pretty easy to mathematically prove that the gambler will end up broke. With sports, it's a bit harder. As long as the vig is small enough, smart gamblers who know the teams can eke out a profit. If anything, sports gambling rewards study, thought, and focus, all things we should celebrate. THat doesn't mean I like. I would like to see it banned. But it means I have trouble arguing against it with any vigor.
> How do you propose we apply this solution for the masses in today's digital age?

The social media algorithms are the content curators for the technically illiterate.

Ok, they suck and they're actively user-hostile, but they sucked before AI. Maybe (maybe!) AI's the straw that breaks the camel's back, and people leave those algorithm-curated spaces in droves. I hope that, one way and another, they'll drift back towards human-curated spaces. Maybe without even realizing it.
A million dollar rocket is expensive, but it hits exactly where you want it and so you need far less of them. Artillery is a lot cheaper but also much harder to get exactly where you want it and so you end up using far more of it.

Note that Russia and the US have both guided misstles and artillery. Both have value in different situations. They both have their reasons for their preference, but that is more about how they expect a war they are involved in to look than about thinking one is better.
There's even more money to be made off the backs of those who can't.
The fact that you make money using AI, has nothing to do with its usefulness for society/humanity.

There are people who are getting “pretty rich” by trafficking humans, or selling drugs. Would you want to live in a society where such activities are encouraged? In the end, we need to look at technological progress (or any progress for that matter) as where it will bring us to in the future, rather than what it allows you to do now.

It also pisses me off that software engineering has such a bad reputation that everyone, from common folks to the CEO of nvidia, is shitting on it. You don’t hear phrases like “AI is going to change medicine/structural engineering”, because you would shit your pants if you had to sit in a dentist chair, while the dentist would ask ChatGPT how to perform a root canal; or if you had to live in a house designed by a structural engineer whose buddy was Claude. And yet, somehow, everyone is ready to throw software engineers under the bus and label them as "useless"/easily replaceable by AI.
"American culture": How about the Amish?
> It's almost like the poor lifestyle choice they made was living in a rural area

> I have no idea why people choose to live like that.

Many, if not most, times it's not a choice. Limited skills, limited education, limited drive, and limited exposure leads you to stick around where you are because you don't know any better.

> and not keeping a garden

I'll give you this. It was a thing, a big thing, when I was younger. It makes me think people have honestly gotten lazier - there seems to be no drive or desire to do so.
Thanks everyone that mentioned pikuma.com. Just keep in mind that our 3D Programming lectures cover mostly software rendering and math intuition behind it, and not so much advanced GPU stuff.
Will Piracy Kill Football in Italy? Not If Football Damages the Internet First
"Feed the hungry. House the homeless"

Funnel $10B in housing to Los Angeles and you'll build less than 100 units of housing, because the inflationary push of that money would balloon the cost of per unit housing. I don't want to imagine the effect of that on middle class housing.

Funnel $10B of food to xyz famine region and you've undercut local farmers for generations. Happens all the time [1]. And that's assuming you can get the aid past local corruption.

These problems aren't as simple as people assume, and I'm low-key happy young naive Billionaire's are avoiding these issues instead of trying to throw their weight around.

FWIW: Sam's already funneled a bunch of money into green energy production[2].

[1]: https://haitisolidarity.net/in-the-news/how-the-united-state...

[2]: https://www.cnbc.com/2024/09/25/sam-altman-backed-nuclear-st...
Presumably Sony is sitting on decades worth of code for each of the PlayStation architectures. How long before they're training their own models and making those available to their studios' developers?
Sorry for the nitpick but I'm curious if I'm off here:

> that's why newer languages like Go and Rust force you to check errors in return values

Go doesn't require you check return values though, no? I can get a return of type (*Model, error) and just completely ignore the error portion of it and never check it. Rust doesn't let you access the value until you deal with the Result/Option wrapper, requiring that you at least acknowledge the potential for an error.
TSMC has way to many competitors for this to make sense. And besides one very important key supplier who has huge wait lists for their EUV stuff, ASML.
CNN and USA Today have fake websites, I believe Forbes Marketplace runs them
It's 2D only and Mac OS-specific, but there is:

https://github.com/revarbat/TkCAD
My grandma loved to remind my dad about how he didn't think CDs would become a thing, and to not invest in Philips (as i recall)

And he was tech savy, building circuits, computers etc, he just didn't think it would be reliable or better than what existed... definitely a vinyl guy.
Interesting. I’ve always understood that partly charging was supposed to be better for battery health with lithium batteries.

I’ve capped my 15 Pro Max at 80% from the start and I avoid going below 20% and it’s still at 100% battery health after more than 10 months and 159 cycles. I occasionally charge from ~20% to a random higher number during the day, but other than that I just let it charge during the night. My iPhone 12 Pro Max dropped to 90% battery health in no time without the 80% cap and a similar charging schedule with optimized charging enabled.
> I don't think many other countries' private markets act as extreme in this regard.

How well do you know about what happens in other countries? To me it sounds like everywhere, once limitations to the flow of global capital are dropped.

> I feel like those are just cultural norms

My observation is that commercialization pressure is subordinate to cultural norms. The capital vultures did not swoop in to provide full services to women and blacks until the laws changed, even though providing those services was legal.

Commercialization can shape those norms, certainly, but that is not specifically American either.
Don't forget Speakers Corner.
It seems like maybe, just maybe, Italy is willing to keep passing laws to clamp down on internet piracy, how much damage can the internet route around before it is too much?
I think laws should be viewed from the lens of human rights and the idea of what might be an actual justifiable application of violence, and not a naive “positive effect”.

It would have a positive effect if I went around summarily executing everyone accused of child exploitation, for example, but it would be insane and unjust. There’s a reason we don’t do it that way.

Threatening people with violence for what other people view as misapplication of their own resources is incredibly unjust.

If you don’t have the freedom to destroy yourself or your own resources, you don’t have freedom.

It isn’t the legal system that causes this wreckage (although you might disagree, “lifting” a ban isn’t an action - it’s cessation of the threat of future enforcement action), and it isn’t the legal system that is the appropriate solution to the problem. All bans are, practically, are the threat of someone pulling out a gun to force you to stop. If you personally aren’t willing to go to that length, you shouldn’t vote for or support such policies.

Are you willing to pull a gun on an addict to stop them from indulging in their addiction? If not, what possible moral justification do you have for instructing a cop to do same?
True, but also AI could be the reason why games would need more powerful GPUs in the future (but not yet). For example LLMs for NPC dialogs, or the wilder things like running the whole game inside a neural network, or running an AI style filter over the output of the regular game engines.

https://futurism.com/doom-running-on-neural-network

https://www.youtube.com/watch?v=udPY5rQVoW0

https://x.com/VaigueMan/status/1836802465133437056
US is already throwing CHIPS dollars at Intel whose latest chips are made by...TSMC

https://www.pcworld.com/article/2355435/intels-lunar-lake-is...
Got it. So Free Software means that the ostensibly-distinct foundation supporting the project can act to defend the interests of the for-profit entity run by the same person.
>> treat your presence on the road like an inconvenience

Aren’t we all a bit guilty of that? Maybe not all the time - when I see an ambulance whizz past or a fire truck, I’m appreciative of their efforts.

But everyone else? You’re just in the way ultimately. There isn’t much pleasure to be derived in waiting around for someone to have their fair turn at the intersection or whatever.

Obviously as a rational human I’m quite capable of suppressing such thoughts and generally abide by the traffic laws, but the point still stands.
blktrace is fairly useful in this regard.
Predicting the outcome of a sporting event is pointless.

There is zero risk associated with the result.
Nvidia signs collaboration deal with Irish quantum computing company Equal1
in 2018 we had the first gtp that would babble and repeat itself but would string together words that were oddly coherent. people dismissed any talk of these models having larger potential. and here we are today with the state of AI being what it is and people are still, in essence, denying that AI could become more capable or intelligent than it is right at this moment. after so many years of this zombie argument having its head chopped off and then regrowing, i can only think that it is peoples deep seated humanity that prevents them from seeing the obvious. it would be such a deeply disgusting and alarming development if AI were to spring to life that most people, being good people, are literally incapable of believing that its possible. its their own mind, their human sensibilities, protecting them. thats ok. but it would help keep humanity safe if more people had the ability to realize that there is nothing stopping AI from crossing that threshold and every heuristic is pointing to the fact that we are on the cusp of that.
> Setting up a shop from scratch with little expertise and no supply chain to back it up? Well, such replacement would then cost a few thousand dollars and we would be screwed.

You were correct up to here. However the US has a lot of manufacturing and so is not setting things up from scratch. Most of our manufacturing is automated these days and so it doesn't appear in many of the reports people care about, but the talent is still here.

Of course just like WWII, if war breaks out it will be several years before the US can ramp up production.
When it comes to writing code being stuck in time, I'm expecting that LLMs replace programming languages rather than programmers. We aren't there yet and LLMs, or the next iteration of architecture, need to get better at logically working through and validating code, but I do think we'll get there.

When you think about it, its really pretty ridiculous that a programmer will ask an LLM to write code that the programmer can copy and ultimately compile into machine code for yet another computer to use. Cutting out the intermediary steps seems like a logical next step.
So you have to use probabilistic methods, makes sense thanks!
Thanks! If I'm ever at a conference you are, tell me you like my blog for exclusive laptop stickers.

Amusingly enough, I actually have a bit of a unique problem with my blog: I have to avoid the urge to do bigger/better things constantly. I don't really know what this is called professionally, but I've been labeling it the Tengen Toppa Gurren Lagann fallacy. There's this sincere temptation to make everything bigger and better than the last one, but when you get to the point where your mech battles are literally using galaxies as shuriken, you can't really get much bigger. I feel like I've hit that point with my blog and without a lot of extra work I don't know if I can make things much "better" per se.

I've wanted to do interactive articles or something, but that would need me to totally rewrite my blog's backend in Next.JS or something. I've thought about doing that (in fact https://techaro.lol started out as a proof of concept for doing exactly that), but I'd want to contract a designer or something to make my blog not look terrible. IDK, many things I need to think about. Web design has always been my weak suit.
yes, but does your colleague even fully understand what was generated? Does he have a good mental map of the organization of the project?

I have a good mental map of the projects I work on because I wrote them myself. When new business problems emerge, I can picture how to solve them using the different components of those applications. If I hadn't actually written the application myself, that expertise would not exist.

Your colleague may have a working application, but I seriously doubt he understands it in the way that is usually needed for maintaining it long term. I am not trying to be pessimistic, but I _really_ worry about these tools crippling an entire generation of programmers.
Does it still use a version of spidermonkey from the early 2010's?
Interesting, didn't expect it to still be around.
Yeah, this is how I use it too. I tend to be a very dry writer, which isn't unusual in science, but lately I've taken to writing, then asking an LLM to suggest improvements.

I know not to trust it to be as precise as good research papers need to be, so I don't take its output, it usually helps me reorder points or use different transitions which make the material much more enjoyable to read. I also find it useful for helping to come up with an opening sentence from which to start writing a section.
A friend of mine (Japanese - relevant because the cost of music CD's was higher there) in high school would have side jobs so he could buy music. His mom - possibly undiagnosed mental health issues - every few years would throw away his CD collection which he'd spent the equivalent of 30-40k USD on. This happened twice.

Me - I'm on the JellyFin bandwagon. This is less to archive everything (I have MDISC for the important stuff like my personal photos and documents and such) and more to just have my own streaming service type thing which works when the internet is down.
Or maybe you don't want to.

If that's the hill you want to die on, good luck.
I have built advertisement bidders and ad servers. I avoid querying the database on every request (and caches) by creating app in-memory materialized views of the database.
See https://www.confluent.io/blog/leveraging-power-database-unbu... for more about this.
Another cool feature of the replication protocol is that I can tell if all app servers are on the same version of the data.
> Elon is responsible for PayPal

Actually, he was responsible for the competitor that PayPal bought out because the market wasn't big enough for two companies, and was forced out of PayPal because he was pushing ruinously bad ideas.
It’s hard to ad block live sports.
Air France to connect entire fleet to Starlink
Sometimes the evidence speaks for itself. I'm not an expert in this field, but the fact that literally no one in the world can compete toe to toe with TSMC is a sign of ... something. If nothing else, "Taiwan #1".
It's more that gambling is now in the pocket and they have expanded what you can gamble on, like 12 year olds playing baseball