skysight-inc/HackerNews huggingface dataset:
You linked me to an article that defines an unsafe language as:

"a programming language which, by default, allows code to introduce memory-related vulnerabilities (use after free, buffer over/under flow, use of uninitialized memory, type confusion) and undefined behavior,"

Which was my whole point. The "and undefined behavior" part is absolutely essential to the definition because you can't guarantee the first part without it.

> Go does not, at least not in any non-contrived scenario not involving "unsafe" or FFI.

It absolutely does. You can find examples of code that triggers undefined behavior in this thread. You can hand-wave them away as being "contrived" (which is literally correct) but that doesn't just make the problem go away.

We had a whole collective meltdown (pun intended) over spectre and meltdown a few years back even though AFAICT there have never been any known exploits in the wild. But most people who are knowledgeable in these things still took it seriously because they realized that:

1. Just because you haven't found a specific instance of an in-the-wild exploit doesn't mean there isn't one
2. You don't want to necessarily wait because if something it exploitable in theory is will almost certainly be exploited sooner or later. And it takes time to sort this stuff out

Is this relevant to your average working dev slinging micro-services in go? No, probably not and it's probably not something you should even think about for the most part. But if you're writing a complex, mission critical system with very hard security requirements? Yeah maybe you should worry about little bit about the fact that Go is, by the definition you yourself provided me, not a memory safe language.
Fire is part of nature, but many of these fires are caused by target shooters, OHV users, and even from home construction. It doesn't make sense to take torches to the forest and then claim it's fine because fire is natural.
I will address both points:

1. No one is training on users' bank details, but if you're training on the whole Internet, it's hard to be sure if you've filtered out all PII, or even who is in there.

2. This isn't happening because no one has time for more time-wasting lawsuits.
> Well put. I think building software systems can be done with proper engineering techniques. But more often, many businesses don't want that! I've seen some go out of their way to chose technology and processes that eliminate any need for making engineering decisions. The goal is often to "standardize" and explicitly eliminate all novelty. And then they wonder why innovation is stalled.

That's not necessarily bad. The company is derisking by relying on building blocks developed by established companies with deep talent. The vast majority of projects where local developers wrote everything from scratch are nightmarish to maintain, secure and upgrade.
Well the revival may be halted depending on the election:

> The US CHIPS and Science Act's future may depend on the outcome of Tuesday's Presidential Election after House Speaker Mike Johnson suggested the GOP would likely move to repeal the $280 billion funding bill if the party wins a majority in Congress.

* https://www.theregister.com/2024/11/04/chips_act_repeal/

but a little while later:

> Johnson, who voted against the legislation, later said in a statement that the CHIPS Act, which poured $54 billion into the semiconductor manufacturing industry, “is not on the agenda for repeal.”

* https://apnews.com/article/mike-johnson-chips-act-d5504f76d3...

so ¯\_(ツ)_/¯
In Meta's case, the problem is that they had been given the go-ahead by the EU to train on certain data, and then after starting training, the EU changed its mind and told them to stop.
The camp fire was caused by a failed hook on lines where similar hooks showed extreme wear-and-tear, despite PG&E claiming to have inspected them recently. It's not like we just decided to say it was PG&E's fault; their inspections were clearly missing important deferred maintenance.

If the fire had been caused by someone without the funds to pay for damages (e.g. a homeless encampment (Day Fire) or college students improperly extinguishing an illegal bonfire (Tea fire)), then there might be criminal charges, but insurance companies will be on the hook.
Rebuilding our microchip manufacturing base is critical part of US national defense. Why in the world would Donald Trump and Speaker Mike Johnson want to repeal the CHIPS act?

https://www.noahpinion.blog/p/why-on-earth-does-trump-want-t...
You go to school and learn that 2+2=4. You get a consulting job and learn 2+2= whatever the client says it is.

I wouldn’t jump to the conclusion that the consulting engineer was incompetent. Sometimes a bureaucrat tells you to sharpen your pencils and come back with the answer That fits the budget they have if you want to keep your professional services contract going.
That's roughly one year of tuition for one student at most US universities.
They mention an overhaul improvement of 1%
> After seven iterations of our algorithm we find a size reduction of approximately 1% compared to the evolutionary strategy baseline. See the paper for more detailed results
They do make them and they are readily available:

https://www.brita.com/products/tahoe-water-pitcher-elite-fil...
I remember one elevator button was a large metal bulge, that didn't get pushed, but instead did a little electric jolt to my finger (at a very small distance between finger and the button).

Here you can see it on 0:23 of video tour: https://marketplace.vts.com/building/400-capitol-mall-sacram...
Well, they were giving them jobs where they could earn money as well as providing for most all the things that a homeless person is going to need. But the return on investment from people just giving handouts is hard to compete with.
> Similarly, ultrapasteurized milk is milk that stays good for months at room temperature, but needs to be refrigerated once open.

Also it tastes shit. Just buy regular milk, it easily lasts a week.
I think the occasional forced password is a way to make sure people remember their password. It would be very easy to make a password, setup biometric auth, then never use the password again for 3+ years. Then what happens when the password is needed for something?

I think being able to quickly disable biometric auth is a feature. If I hold down the volume and side buttons on the iPhone for a few seconds, or just mash the side button a lot, it brings up the shutdown/emergency option, but also disables biometric auth until the passcode is entered again. While I don’t ever plan on having run ins with the police, a hope I don’t have other cause, I like that I have a means to discreetly and quickly disable biometric auth, so someone can’t take my phone, hold it up to my face, and have access to all my stuff… other passwords, bank info, you name it.
Interpretation notes: first time, in the era during which said companies broke out "datacenter" as a reporting category. The last time AMD was clearly on top in terms of product quality, they reported 2006 revenue of $5.3 billion for microprocessors while Intel reported $9.2 billion in the same category. In those years the companies incompletely or inconsistently reported separate sales for "server" or "enterprise".
??

Doesn't that mean if they used data created by, (or even the data of), anyone in the EU, that they would want to not release that model in the EU?

This sounds like "if an EU citizen created, or has data referenced, in any piece of the data you trained from then..."

Which, I mean, I can kind of see why US and Chinese companies prefer to just not release their models in the EU. How could a company ever make a guarantee satisfying those requirements? It would take a massive filtering effort.
Unnecessary - perhaps. Ill-advised, since a lot of talent greatly prefers remote work - perhaps. But unjust? Aren't you taking it a bit far? You don't have the right to remote work.
It seems you have convinced me that IC fabrication is a dark art, despite your intentions.
The model meets/beats Llama despite having an order-of-magnitude fewer active parameters (52B vs 405B). Absolutely bonkers. AI is moving so fast with these breakthroughs -- synthetic data, distillation, alt. architectures (e.g. MoE/SSM), LoRA, RAG, curriculum learning, etc.

We've come so astonishingly far in like two years. I have no idea what AI will do in another year, and it's thrilling.
China has a history of buying out its critics, and I do not doubt for a second that Donald Trump is for sale (notice how he changed his tune on TikTok?)
The point is not the built-in search function of Discord, it is to have content such as the work hacker fab is doing globally searchable.

By searchable, I mean universally accesible, be it via trad. search engines or LLMs.

Instead, any knowledge accrued by that community in that particular forum is locked in a box for anyone not participating in that forum, which is likely 5 nines of humanity if not 6.

It is sad.
The same thing will happen to software development and India
Developing countries are a mix. Some of them have cities that have been around for centuries and at some point someone put in water (not always for the whole city). Worse, since they don't have strong safety standards you cannot be sure that pipes put into today don't have lead in them unless you check (though odds are if it was done today they used plastic which is cheaper, though better depends on if they used a good plastic or not which you can't really know)
Sounds like you share it on the fly (with someone who might store it?) and then discard it. The sharing might be problematic.
Damn, first Intel missed out on Mobile, then it fumbled AI, and now it's being seriously challenged on its home turf. Pat has his work cut out for him.
Law may be part of the solution, but overall we need a culture of demanding tailored demos. If you ask an average SaaS, "show me how this can produce value in my environment before I buy in", they may be incredulous and expose that it will take months/years of effort to get it properly integrated.

OTOH there are many genuinely great products that don't require massive upfront effort to start producing value. Demanding tailored demos can help you separate the wheat from the chaff.
None of these tax "planning" schemes are available anymore.

Moreover, tax authorities have increasingly taken the position that the use of these planning methods constitutes tax evasion. The Dutch Sandwich and Double Irish were grandfathered in (meaning, not treated as criminal tax evasion) but a company utilizing similar schemes today would ultimately result in one or more of their executives spending time in jail.

Critically, most of tax law is actually regulation that implements statutes. Tax planning schemes that satisfy the technical letter of regulations but which violate the plain intent of the written statute can, and have, been deemed illegal years or even decades later (see, for example, the Bermudan tax loss harvesting scheme), and this has repeatedly passed constitutional muster.
On Wikipedia "List of stories featuring nuclear pulse propulsion"

https://en.wikipedia.org/wiki/List_of_stories_featuring_nucl...
I've never seen this model before, it seems new to me. I'm quite skeptical of its performance.

I can't seem to find anything other than their documentation, stating the veracity of their claims. I wish I could.
I thought github was the most brazen attempt to consume the wealth created by an open source tool with a thin low quality veneer until I looked at gitlab's code and realized more tasteless is a poor imitation of a cheap veneer.
Fair point, and I'd add that there's a spot above the average where people used to flock to because it felt special and not just random average stuff. That's where society picked stars and new trends, something slightly special, complex, original yet not vulgar.
I don't think I'd recommend using this in production. The benchmarks look good, but by immediately waking the waker[0], you've effectively created a spin-lock. They may work in some very specific circumstances, but they will most likely in practice be more costly to your scheduler (which likely uses locks btw) than just using locks

[0]: https://github.com/fortress-build/whirlwind/blob/0e4ae5a2aba...
Surprising it took so long given how dominant the EPYC CPUs were for years.
That's a pretty sweet side gig for him though. I have to imagine that he has access to MLB paraphernalia just by association with them. That alone would be cool, let alone the 20k.
https://artificialintelligenceact.eu/high-level-summary/

There's many places where the model might be used which could count as high-risk scenarios and require lots of controls. Also, we have:

GPAI models present systemic risks when the cumulative amount of compute used for its training is greater than 10^25 floating point operations (FLOPs). Providers must notify the Commission if their model meets this criterion within 2 weeks. The provider may present arguments that, despite meeting the criteria, their model does not present systemic risks. The Commission may decide on its own, or via a qualified alert from the scientific panel of independent experts, that a model has high impact capabilities, rendering it systemic.

In addition to the four obligations above, providers of GPAI models with systemic risk must also:

- Perform model evaluations, including conducting and documenting adversarial testing to identify and mitigate systemic risk.
- Assess and mitigate possible systemic risks, including their sources.
- Track, document and report serious incidents and possible corrective measures to the AI Office and relevant national competent authorities without undue delay.
- Ensure an adequate level of cybersecurity protection."

They may not want to meet these requirements.
https://www.brita.com/assets/23601607167498ba405a22f7692b3b8...

It would be nice if you updated your original remark. I rarely see such a combination of total confidence and complete incorrectness, and you're giving advice on a health matter.
The term "open source" had no significant use to refer to software before the Open Source Initiative started promoting it. Previously, it was only intelligence industry jargon, meaning "publicly available information", which includes software that fails your "can read the source code" test. "Source" was used in the journalistic sense, not as in "source code". The correct term for software that passes your test but does not meet the Open Source Definition is "source available".
I agree with this take a lot. I think having lots of custom implementations is inevitable for systems languages - the only reason why Rust is different is because Cargo/crates.io makes things available for everyone, where in C/C++ land you will often just DIY everything to avoid managing a bunch of dependencies by hand or with cmake/similar.
Archive link: https://archive.ph/ouJmu
Unfortunately in the world of OSS, neither of those are enough to pay the bills unless you have a lucrative partnership (i.e. Google paying to be the default search engine in Firefox, which is now no longer the case).
Pretty neat. It’s the dashboard we all actually wanted from GA4.
> Professional Engineer licensure to be able to actually charge for software (this carves out exception for FOSS and freeware) could raise the costs enough to make this kind of software engineering viable.

You would almost certainly see an increase of in-house software developers and consultants where the code is never charged for, but is developed as it always has been. A few big companies like Microsoft and IBM would get certified and smaller software companies would be driven out of existence entirely.

There would definitely not be a golden age of rigorous software.
Those advertisements are a sign someone cares. If you don't have them in your country you should suspect that the locals don't care not that you are better - until proven otherwise. Water quality is something that needs to be monitored regularly, even if you water is safe today if you don't pay attention someone can introduce problems tomorrow.
Cloud infrastructure and firewalls alone are a good reason to not use traceroute.
I guess it depends on the use case. For example with dstack, we focus on AI.

Our abstractions include:

1. Dev environments - you need them often and need an easy way to get one with tight GOU resources - either using already provisioned resources or provision on-demand

2. Tasks. For example, in AI you may want to run distributed tasks over a cluster using your favorite framework like pytroch

3. Services - very close to Docker Compose. And you can use it with dstack. But for you may want to also manage GPU requirements; and of course auto-scaling

4. Managing clusters. As an AI user you may want to provision them on-demand. This is what we call fleets with dstack.

5. Ingress for public endpoints. Dstack also handles authorization and OpenAI endpoint mapping - as it’s important for AI.

6. Finally you need to manage tenancies - isolate resources across projects or teams. With dstack, we call it projects.
Not surprising as the CEO and board prevented the should=be-CEO from having the position because that person was recovering from cancer treatment.
Did companies outsource due to greed or did US consumers select for price forcing them to outsource to compete? Or both?
The small AWK book "The AWK Programming Language" was a great resource on many things :)

https://en.wikipedia.org/wiki/The_AWK_Programming_Language
Context length + API cost is right now main bottleneck for huge HTML + CSS files. The extraction here is already quite efficient but still:
with past messages + system prompt + sometimes extracted text + extracted interactive elements you are quickly already around 2500 tokens (for gpt-4o 0.01$).

If you extract entire HTML and CSS your cost + inference time are quickly 10x.
What are the differences in opinions between dstack and SkyPilot? Why should I try dstack first over SkyPilot? Same question could be posed to Modal.

Aren’t you worried about the amount of product development that goes into Kubernetes and its ecosystem? For example, is Keda poorly managed, or does flexible autoscaling require full time attention from a developer? What about democratic-csi? NVIDIA GPU Operator, AMD’s k8s device plugins, Intel’s? Calico versus Cilium?
>Do you know how the railroad infrastructure was built?

Abusing the heck out of immigrants and genociding the native people, I'm pretty sure. Also this (link is https://www.digitalhistory.uh.edu/disp_textbook.cfm?smtID=2&...):

>Construction of the railroad provided many opportunities for financial chicanery, corruption, graft, and bribery. The greatest financial scandal of the 19th century grew out of the railroad's construction. The president of the Union Pacific helped found a construction company, called Credit Mobilier, which allowed investors, including several members of Congress, to grant lucrative construction contracts to themselves, while nearly bankrupting the railroad.

I don't think the corporation/government good/evil dichotomy you have made is so clean cut.
> No one is training on users' bank details, but if you're training on the whole Internet

Tencent has access to more than just bank accounts.

In the West there's Meta that this year opted everyone in their platform into training their AI.

> This isn't happening because no one has time for more time-wasting lawsuits.

No, this isn't happening because a) their training data is, without fail, trained on material they shouldn't have willy-nilly access to and b) because they want to pretend to be open source without being opensource
Still, there were always clearly defined product lines, like Athlon vs. Opteron.
I thought about this a fair bit, and thought that the way to fix it is to do versioned everything which is an interface to your application or library. What I mean is, as best as one can, one should never break convention and API without including a mechanism to automagic it to how it was before. Making changes which break downstream should be considered the gravest of sins, following at a close second place behind leaving security vulnerabilities unpatched.

This is where good abstraction, while expensive to develop, is important: if the abstractions are well-formed then fixing code or adding features should not cause downstream breakage. We always want downstream to focus on using our projects to make cool shit, we don't want downstream spending most of his time fixing his abstractions because we changed ours for the fifth time in seven years.

Version 10 should have the figurative similarity matrices to project any version of the format from v1 to v9 into v10 format.
Only "benefit" would be that TOR might be blocked but the VPN isnt.
Which proper engineering techniques are those?

In general I agree with you, but the devil is in the details and a licensure body is surely the wrong way to do this.
Why Durable Python Execution Should Be Lightweight
As well as the Dutch ones.
Ahh Dangit I didn’t get the reference. I’ll have to watch it.
Next step is to represent also the structure of the HTML tree in the extracted elements for better understanding, maybe images are then less needed.
Freelance Developer: Charge by Time, Not Value
If the outcome of the policies is an unjust outcome I don't think the term is inaccurate, even if the common use of it refers to one's legal rights.
> that they would want to not release that model in the EU

They don't release that model in the EU, that's correct

> This sounds like "if an EU citizen created, or has data referenced, in any piece of the data you trained from then..."

Yes, and that should be the default for any citizen of any country in the world.

Instead you have companies like Meta just opting everyone in to their AI training dataset.

> I can kind of see why US and Chinese companies prefer to just not release their models in the EU.

Companies having unfettered unrestricted access to any and all data they want is not such a good thing as you make it out to be
Nobody ever got fired for buying Intel.
I'd consider it unjust if I was hired for a remote role and they changed that deal later.
it appears that there was a policy statement called "Roadmap to a Million Acres" put out by USDA-USFS and the State of California
Aren't you relying on the "recently" definition of just here rather than the "simply" definition?
Wait, you're actually asking for proprietary analysis and data? If I were in a position to have that data or any inside information--and I'm not, thankfully--I certainly wouldn't provide it in Hacker News.

I'm not going to pursue this argument further with you.

Edit: On the off-chance you're a journalist--because I do know a few who lurk here, though they'll never admit it--then consider this a compelling line of thought and evidence to do some actual legwork.
I remember something similar being mentioned in a podcast by Huberman, that dreams serve to get used to stuff that we fear, in a nutshell. Maybe not directly stuff that we fear, but maybe stuff that makes us uncomfortable? Dreams are a way to teach us stuff that seem essential to us but we found them uncomfortable to face.

Interesting research topic by the way. I will take a look at your paper.
I feel like we managed to get much closer to proper engineering in our own little corner: version control, CI/CD, code reviews, don't-write-your-own-crypto, standardization, etc.

The problem is that it's still hard for software engineers to go to business people and say "no, we can't build a bridge that crosses the Atlantic Ocean".

With the introduction of non-technical Product Managers it became even harder. Now we have to convince two layers of people that some idea is unsafe or that it's gonna be more trouble than it's worth.
Reminds me of https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-t... - I seem to remember it coming up here at the time.