skysight-inc/HackerNews huggingface dataset:
>> (Of course, maybe you could argue that's a famous example in its training set and it's just regurgitating, but then you could try making modifications, asking other questions, etc, and the LLM would continue to respond sensibly. So to me it seems to understand...)

Yes, well, that's the big confounder that has to be overcome by any claim of understanding (or reasoning etc) by LLMs, isn't it? They've seen so much stuff in training that it's very hard to know what they're simply reproducing from their corpus and what not. My opinion is that LLMs are statistical models of text and we can expect them to learn the surface statistical regularities of text in their corpus, which can be very powerful, but that's all. I don't see how they can learn "understanding" from text. The null hypothesis should be that they can't and, Sagan-like, we should expect to see extraordinary evidence before accepting they can. I do.

>> Regarding computation and understanding: I just though it was interesting that you presented a true fact about the computational limitations of NNs, which could easily/naturally/temptingingly -- yet incorrectly (I think!) -- be extended into a statement about the limitations of understanding of NNs (whatever understanding means -- no technical definition that I know of, but still, it does mean something, right?).

For humans it means something- because understanding is a property we assume humans have. Sometimes we use it metaphorically ("my program understands when the customer wants to change their pants") but in terms of computation... again I have no clue.

I generally have very few clues :)
I feel the same way about “UX Designer/Engineer”. Seems to mean someone who can put a wireframe together but has no design chops. Any good designer that has experience crafting user interfaces should be skilled at thinking through in-depth about what the user is doing when using the product and how to successfully guide them through that process.
Wait, I thought GPT's were autoregressive and encoder only like BERT used masked tokens? You're saying BERT is auto-regressive or am I misunderstanding?
This isn't anything new. This exact same thing happened during the 2000-era dot-com bubble burst. There was a huge hiring freeze across all tech companies, yet somehow they were still posting job ads, but nobody was hiring. I even moved cities to work at a job where 10 of my friends worked (including the CEO as a good friend), and when I went in for the "interview" (the job was supposedly guaranteed) the CEO said he couldn't hire me because of a hiring freeze. I ended up freelancing for the company on-and-off for a couple of years, but it was barely enough to keep me fed. There was no other work anywhere. It was a rough 4 years, and we're going through the same thing now and have been for a while. I'm glad that this time I have a bit of job security, but I feel sorry for those that don't. I tried to warn everyone I could a few years ago that if they had a job, even if they didn't like it, they should consider staying because it's going to get rough. People laughed at me for suggesting this, but now nobody is laughing.
I was referring to the "Get Started" section that links to a producing attestation page that can be found here: https://docs.pypi.org/attestations/producing-attestations/#t....

> Support for automatic attestation generation and publication from other Trusted Publisher environments is planned. While not recommended, maintainers can also manually generate and publish attestations.
The three types of observability data(metrics, logs and trances) still follow the traditional approach. However, based on my hands-on experience with large-scale monitoring systems, these three types can be unified in terms of data models (AKA events), storage engines, and query languages (SQL). This unification would significantly improve both development and analysis efficiency while substantially reducing operational and maintenance costs
The trick is to do it without the readers noticing.
yep. saying, "data engineer who can turn your messy data into a data visualization or interactive map" is so much more powerful than saying "data engineer with 10 years of experience leading projects with python, aws, kubernetes"
I met Gwern once, when he came to the NYC Less Wrong meetup. I don't think he was internet-famous yet. It was probably 12 years ago or so, but based on my recollection, I'm totally willing to believe that he lives very frugally. FWIW he wouldn't have looked out of place at an anime convention.
These can be easily jailbroken by quantizing the weights lower.
"Libel? What's libel?"

- Famous last words
Great point. The H-1B receipts total[1] is probably what most are looking for

2020: 427,200
2021: 398,300
2022: 474,300
2023: 386,600

[1] https://www.uscis.gov/sites/default/files/document/reports/f...
Are you really criticizing The Onion's fact-checking?

Can you spot any problems with their plan for the supplement inventory?

> we plan to collect the entire stock of the InfoWars warehouses into a large vat and boil the contents down into a single candy bar–sized omnivitamin that one executive (I will not name names) may eat in order to increase his power and perhaps become immortal
Strange. I like The Onion as much as the next guy, but you can't make Infowars more of a "parody of itself" than it already is. Just shut it down?
This is great. His one concern of remembering to remove things could be done with optional expiry.

Meeting for dinner tonight? Set the message to expire after today.
I've had a similar experience for a local job. I honestly thought it was my previous employer unknowingly reaching out to me initially through a recruiting agency. The job description was verbatim my resume. Got the interview, and ghosted.
As a hiring manager LinkedIn profiles are a huge window into someone's professional side, just like github may be a huge window into their technical side.

As a candidate I think LinkedIn is absolute trash - and toxic with all the ghost jobs and dark patterns. Feels like everyone else has the same opinion, or at the very least it is a common one. But when I have 50 candidates to review for 5 open positions, LinkedIn is going to give me great insight that I cannot really get anywhere else. I keep my profile current in the hopes that I'm not doing it for LinkedIn, but for the person researching me to see if I am a valid candidate for their role.
fair, I missed that and read the system version, which is also there
Right? Or a domain specific language for law: https://github.com/CatalaLang/catala

I get that dislodging docx is an impossible job, but since docx is a terrible format for anything, it needs to be done for all the reasons the author mentions. The codes that run society should not be locked up in bad proprietary formats.
It's probably not super realistic to mine resources in space and send the raw material down the gravity well but it's hard to imagine any space-based manufacturing without mining. Whether our species will ever attempt such a thing is.. who knows? But hauling heavy loads to and from Earth makes very little sense.
To be specific, the suit against the mother was against the mother's estate, since the mother was murdered by the shooter... like right away. The suit was settled by the estate.

The suit against the school administration was eventually dismissed (the families lost on appeal) (https://www.newstimes.com/news/article/Two-Sandy-Hook-famili...). I agree it seemed kinda dubious, and I think the right outcome happened here.

The suit against Remington ended in a settlement, probably because Remington didn't want a chance in hell to set any legal precedent. The fact that the families got settlements is really a symptom of how unsettled the issue of gun control is in America. Like it's completely inane that it's fully legal to manufacture and sell AR-15 rifles to basically anyone, BUT that somehow marketing them to civilians is inappropriate. Remington settled because they just don't want any possibility of the status quo moving against them.
I think there are songs that wear listeners out from being overplayed, some that require repeated listens to appreciate, but there are ones that start out bad and do not get redeemed either by repeated listens or context. Lift Yourself (https://youtu.be/8fbyfDbi-MI?t=117), Gucci Gang (https://www.youtube.com/watch?v=4LfJnj66HVQ), and Beautiful Things (https://www.youtube.com/watch?v=Oa_RSwwpPaA&pp=ygUQQmVhdXRpZ...) all exist as examples of this, I think. All fairly recent, I'll confess.
Reasons include:

- Racial, gender, and/or local citizen discrimination avoidance

- Job security for HR so they themselves don't get laid off

- Over-interview to exceed capacity/ERP needs

- Market and/or competition intelligence

Perhaps it behooves jobseekers to stop looking for scant, temporary, insecure, disloyal, abusive work and create or sell goods or services through collective, employee-owned co-ops instead.
I'm disabled and I've done it many times (though never in USA). It's probably bullshit.

Thing is that you might be able to walk but not able to do the distances in an airport, and sometimes in airports they just sit you in a wheelchair for their own convenience, because they have 10000 other people to take care of.

There's degrees of disability. Someone might be able to do a few steps, that doesn't mean they're 100% fine.

quickthrowman is just finding excuses to get outraged hating at disabled people.
The main reason people think that is because most of the MS Office suite's document formats are things that no programmer wants to touch if they can help it and usually when you're parsing them to something else, you can drop all the weirdness. Nobody loses sleep because the xlsx file you're using as an input for a script doesn't parse the excel graph that someone else put into it properly.

They're all incredibly capable formats (from a user perspective anyway), with the caveat that they're utter hell to work with in terms of a programming perspective. It's easier to just toss it into a black box parser/serializer and hope that all the text you need in/out comes out properly on the other side.

Actually generating docx or xlsx files (that aren't trivial) that look exactly like another input file (so you have to account for every notable difference in formatting) is a ton of work; most people who have touched webdev will probably at some point have had to format their emails for Outlooks half-assed ancient HTML parser and even there, you at least control what it's going to look like.
Some animals quack like a duck, but turn out to be male wood frogs.
Wow, they created a site that doxxes all of WPEngine's users. Incredibly sh*tty.
The only reason this is noteworthy is that a bunch of big tech employees worked on it.
RH SSO was the LTS build of keycloak with business support.

Keycloak doesn't publish hot fixes for previous major versions, and these major versions come out on a very tight release schedule / every few months. So if you didn't want to upgrade all the time, you'd have been forced to use rhsso. And now the red hat keycloak build.

https://github.com/keycloak/keycloak/discussions/25688
You'd have to ask the Pfizer / BioNTech press staff, since they were the source.

Later down in this article, they clarify with some hard numbers: "Researchers observed 18 Covid-19 cases among the 1,129 participants who were given a placebo, and none among the 1,131 volunteers who got the vaccine. The data has yet to be peer reviewed."

So Pfizer/BioNTech is reporting 100% efficacy on a non-peer-reviewed study where 1.5% of the control group contracted the disease (news article doesn't say how "contraction of disease" was identified, whether that was antibody presence or symptoms).

News has a bad habit of reducing complex circumstances to headlines that appear yes-or-no.
It's not. I don't know if you think we're all Gwern, but he's provided a useful enough service for enough people that a discussion with more than 13 comments is worthwhile.
Ask HN: Which project should I pick back up?
Hi HN!

Over the past years I've started, completed and cancelled quite a few hobby projects. Topics range from compilers to simple note taking.

Since I got some spare time again, I want to pick up an old project back up and expand on it. But instead of deciding myself, which project I should tackle, I wanted to ask around a little, which project is the most interesting/promising.

Link to my projects: https://alexanderweichart.de/4_Projects/%F0%9F%8C%B3-Project...

Thx!
Identity, authn and authn are hard. A failure in the code, logic or at the seams messes up everything that it tries to protect. There are a few big commercial players trying to take the market with their "social login", and a few smaller (open-source) players trying to compete and survive, walking a fine line between open-source and open-core.

I feel this is one avenue where a few open-source players should get some solid funding and support from both the organisations and governments that use their software so we don't end up with unmaintained bug-riddled code and have to login with Google or Facebook everywhere.

A lot of the government agencies I work with use open-source IdP software (because they have to privacy- and policy-wise), so some healthy funding model should be possible for people with the skill and interest.
After just spending 15 minutes trying to get something useful accomplished, anything useful at all, with latest beta Apple Intelligence with a M1 iPad Pro (16G RAM), this article appealed to me!

I have been running the 32B parameters qwen2.5-coder model on my 32G M2 Mac and and it is a huge help with coding.

The llama3.3-vision model does a great job processing screen shots. Small models like smollm2:latest can process a lot of text locally, very fast.

Open source front ends like Open WebUI are improving rapidly.

All the tools are lining up for do it yourself local AI.

The only commercial vendor right now that I think is doing a fairly good job at an integrated AI workflow is Google. Last month I had all my email directed to my gmail account, and the Gemini Advanced web app did a really good job integrating email, calendar, and google docs. Job well done. That said, I am back to using ProtonMail and trying to build local AIs for my workflows.

I am writing a book on the topic of local, personal, and private AIs.
He found another candidate which could do the job. This finding makes it a federal crime to recommand the current H1B employee for a green card.
I got hired by directly applying via a company's website; it was my 11th application and my first that wasn't a moonshot (nvda/valve/etc). It was in late 2023 (very bad market), and I didn't have any connections to the company at all. I also have no online presence. Online applications are not fully dead.

Of course this is just my experience as a senior engineer in embedded, so likely doesn't apply to others. But if you're looking, it's worth your time to apply...
Simple for a developer sure.
Just have a look at what entrylevel developers do (no hate, everybody starts somewhere).

This group of people is willing and ready to learn but you still often hear "just checkout the project again" when a problem is encountered.

Most people just use an app and are fine with that functionality.
My partner and I use a Google Keep list that is shared between our accounts.
Live editing included and it does everything just fine.

There are more elaborate app solutions out there that do more and solve most of the problems.
The Guide to Implementing Hotwire and Turbo in a Rails Application
Source that prevailing wage is 2/3 of the market?
Not to this Brit. 'Lessons' all the way, both in corporate speak and in my multi-decade involvement in building training and education systems. We did used to identify 'key learning points' which would summarise the main things a student was expected to take away from a course, but I never saw this abbreviated to 'learnings'.

In my corporate experience, the main thing about lessons was whether they were 'identified' or actually 'learned', e.g. following a corporate post-mortem of some cockup/fiasco/disaster.
"They are a true unicorn, capable of simultaneously inspiring public support for billionaires and stoking outrage at an inept federal state that can assassinate JFK but can’t even put a man on the Moon."
They likely chose the option to enable password-based SSH authentication during installation [1], or it's a cloud service that provisions servers with a password.

I've been looking for info about whether it's force-enabled with a vanilla install where the user doesn't actually choose for it to be enabled. I'm happy to be educated here.

[1]: https://askubuntu.com/a/1440509
The Fastest Airport Security Line You Don't Know About
Which could have been an email, and they can take as long as they need or want. I would get flooded with GenZ video call requests because of various similar factors.
Don't you have to demonstrate that there is no qualified US worker? I find this unbelievable and outrageous.
Stop it, no one "values things besides salary", and you know it.
I don't have /etc/ssh/sshd_config.d/50-cloud-init.conf on my ubuntu 24.04 machines. What creates it? Is it a clean-install vs. upgrade difference perhaps?
Hello! I believe I'm one of the "manifested" security experts you're hinting at :)

Good security doesn't demand perfection, that's why security is both prevention and preparedness. The response from our admin was in every way beyond what you'd expect from many other orgs: prompt response (on the order of minutes), full audit of activity for the credential (none found), and full public disclosure ahead of the security researcher's report.

> JFrog also discovered multiple malicious package exploits later.

If you're referencing malicious packages on PyPI then yes! We want to keep PyPI freely open to all to use, and that has negative knock-on effects. Turns out that exploiting public good code repositories is quite popular, but I maintain that the impact is quite low and that our ability to respond to these sorts of attacks is also very good due to our network of security engineers and volunteers who are triaging their reports. Thanks to the work of Mike Fiedler (quarantining packages, API for reporting malicious packages, better UI for triagers) our ability to respond to malicious packages will become even better.

> Now we get a Github centric new buzzword that could be replaced by trusted SHA256 sums.

In a way, this feature is what you're describing but is easier to automate (therefore: good for you as a user) and is more likely to be correct because every attestation is verified by PyPI before it's made available to others (which is also good for users). The focus on GitHub Actions is because this is where many Python projects publish from, there is little incentive to create a feature that no one will use.

> Python is also big on business speak like SBOM.

Indeed, there is legislation in many places that will require SBOMs for all software placed in their markets so there is plenty of interest in these standards. I'm working on this myself to try to do the most we can for users while minimizing the impact this will have on upstream open source project maintainers.
Warning! Tin foil hat article that doesn't belong at HN.
Mystery uncovered of photographer and forbidden photos of Nazi-occupied France
As an ex-lawyer for over 10 years, this was a huge issue for me, specially when the other party is adversarial (e.g. another lawyer for the other part that is not exactly forthcoming with the changes).

Back in the day, to solve that (before I became a software developer and knew about git), I basically re-implemented "git in Microsoft Word version control".

On bigger contracts with dozens and even hundreds of pages, with more than 2 parties involved, we could have 3-4 parallel changes to the same documents at once. And a lot of times some of the parties didn't want to advertise their changes.

What I did was construct a table in Excel with each "version" of each clause, and where they were present omitted. It was a lot of work to maintain, but back then I didn't know any better, but worked.

By saving the versions of the files we sent for revision (think of the main branch), I could receive the version from other parties (kind of like feature branches), turn on Word changes, paste the complete content of the original, and we could visualize the difference.

It's been more than 10 years since I stopped dealing with contracts, but I imagine a lot of lawyers, specially older folks, are still either doing very convoluted processes to track changes like me or not even bothering most of the times.

The article is spot on on the issues (even brought back some memories). This is something I'd use for sure in my previous life.
"Companies with relatively young, high-quality codebases"

I thought that at the beginning the code might be a bit messy because there is the need to iterate fast and quality comes with time, what's the experience of the crowd on this?
Google docs IME is great for collaboration until the number of reviewers exceeds, say, 5 people and/or there's a need for extended conversation on parts of the text. For simple editing? Fantastic. Loved it. For a debate over, say, product requirements or licensing... not so great.
I can see something like this being useful in other law related areas. My wife's court office has hacked together some horrendous workflow for tracking offenders as they progress through the system using OneNote and Word, but it suffers from all the synchronization issues and conflicts you'd expect.
Even more, the previous way was to use GPG signatures, which were recently deprecated and removed. So you don't really have a choice.

>Where the only official workflow is "Use GitHub Actions".

Well you can do it manually with other solutions... as long as they are one of the four trusted publishers (see "Producing attestations manually does not bypass (...) restrictions on (...) Trusted Publishers":

https://docs.pypi.org/trusted-publishers/adding-a-publisher/...

This means that you literally can't do it manually, you have to rely on one of:

* Github

* Google Cloud

* ActiveState (I'm not familiar with it)

* Github.com (not just github, only that one instance)

Really surprising development, IMO.
Point taken and I warned my comment would sound vituperative. Again, the difference is that I'm not an AI influencer, and I'm not trying to make a living by claiming an expertise I don't have. I don't make "public appearances" except in conferences where I present the results of my research.

And you should see the criticism I get by other academics when I try to publish my papers and they decide I'm not even wrong. And that kind of criticism has teeth: my papers don't get published.
I tend to agree. How do we measure those things though?
Unfortunately, one possibility is the user chose "enable SSH password authentication" during the install [1]. Or it's a cloud instance from a provider that provisions instances with a password.

[1]: https://askubuntu.com/a/1440509
House and Senate this time baby!
> Reading a transcript of the interview would probably be better

I might be reading to much into the "a" (rather than "the"), but to be clear: there is a transcript at the bottom.
> 99% of them use system-wide PKI store for CA and their certificates, which is under /etc.

Consider yourself lucky then.

For self-hosted third party software, I've seen requirements to provide it in an environment variable, upload it to a web form over plain http on localhost, specify an AWS secret service secret that contains it, put it in a specific location that is bind mounted into a container, create a custom image (both VM and container), etc.
Gemini now has its own iOS app