skysight-inc/HackerNews huggingface dataset:
Gift link: https://www.wsj.com/world/europe/the-irish-government-is-unb...
btw, technically that leading dot in the domain isn't allowed and will be ignored; https://www.rfc-editor.org/rfc/rfc6265#section-4.1.2.3

... this came up recently after I tightened the validation in jshttp/cookie https://github.com/jshttp/cookie/pull/167 - since that PR the validation has been loosened again a bit, similar to the browser code mentioned in the article.

My changes were prompted by finding a bug in our code (not jshttp) where a cookie header was constructed by mashing the strings together without encoding; every so often a value would have a space and break requests. I was going to suggest using jshttp/cookie's serialize() to devs to avoid this but then realized that that didn't validate well enough to catch the bug we'd seen. I proposed a fix, and someone else then spotted that the validation was loose enough you could slip js into the _name_ field of the cookie which would be interpreted elsewhere as the _value_, providing an unusal vector for code injection.
At my work, we realized that Cython is faster so we completely switched to it for our in house testing framework. Given the amount of times we run it, the switch helped a lot. We also have a custom messaging framework that is sensitive to time delays which the non-Cython was affecting our results.

That’s as much as I can say as an anecdote.

Edit: Cython not CPython
Gopkgview – Go Dependency Visualization
I made this tool on the weekend when I started working on a new project and got a cyclical dependency. To quickly figure this out, I wanted to take a look at how packages and their tree relate to each other. But unfortunately almost nothing worked fine with the latest versions of Go or the visualization didn't help at all.

I decided that this is an interesting idea for a pet project. And here we are. I hope this can still be useful to someone.

If necessary, I'm thinking of adding more features, but now I'll be able to visually sort out the project I wanted.
I will be glad to hear about the ideas :)
Show HN: The most beautiful WYSIWYG Markdown editor in VSCode extension
High appearance, WYSIWYG, smooth editing.
Why would there be less spyware on the cheaper brands?
I wish people who aren't in the business of testing had a bit more awareness of the unknown (to them) unknowns...

The article takes a tiny slice of Python: two exceptionally simplistic algorithms that aren't representative of any sort of real-world workload an actual Python program might be tasked with, and then adds a bunch of unknowns s.a. how long does it take the system to load the text of the program, anything about the load of the system running the test etc.

I feel like this is another one of those "politically" motivated articles (i.e. the author likes Python and wants to say something nice about it, regardless of the actual state of events in Python). But then also tries to serve this opinion as "well, this is my take, yours could be different, nobody knows who's right, but nobody else rose to the task of figuring it out, so you might as well go with what I say", as in:

> In the title of this article I asked if Python is really that slow. There isn't an objective answer to this question, so you will need to extract your own conclusions based on the data I presented here, or if interested, run your own benchmarks and complement my results with your own.

Well, no, there is an objective way, but it's hard! It's a lot of work to figure out what's the minimum required time is for the task, or the minimum space etc. and then see if your program, that was proved to be optimal for the task in the given language approaches that limit, and what are the contributing circumstances.
In Scandinavia we're still sending samples of hunted wild boars to check for cesium. Large parts of Belarus are quite contaminated and the local tyrant is the reason we know very little about how it affects the population in those regions.
This is the problem with LLM researchers all but giving up on the problem of inspecting how the LLM actually works internally.

As long as the LLM is a black box, its entirely possible that (a) the LLM does reason through the rules and understands what moves are legal or (b) was trained on a large set of legal moves and therefore only learned to make legal moves. You can claim either case is the real truth, but we have absolutely no way to know because we have absolutely no way to actually understand what the LLM was "thinking".
Sounds like an interesting idea at first until the point where they will probably create a Swift/ObjC API around it instead of the standard webgpu.h C API, and at that point you can just as well use Metal - which is actually a bit less awkward than the WebGPU API in some areas.
It's so great to see that we finally move away from the thirty year old triple categorization of people, organizations and locations.

This of course means that we now have to think about all the irreconcilable problems of taxonomy, but I'll take that any day over the old version :)
More informatively: Trump was in favor of eliminating Section 230 protections for Twitter after they fact-checked one of his lies about election security.

Presumably he will now want to revoke Section 230 for non-Twitter companies.
It would still be consistent; everything with my crate resolves `impl Foo for Bar` to what I define, everything with other crate resolves `impl Foo for Bar` to what they defined, and any other crate would have a compilation error because those crates didn't `impl Foo for Bar`.

If I for some reason exported a method like `fn call_bar(foo: Foo) -> Bar` then I think it would use my `impl Foo for Bar` since the source code for the trait impl was within my crate. What happens if instead I export like `fn call_bar<F: Bar>(foo: F) -> Bar)` is probably a bit more up to debate as to whose trait impl should be used; probably whichever crate where F being Foo is originally known.

I think they did say binaries can define ophan impls; and the only way somebody should be able to break your code is by changing the trait definition or deleting the implementing type. Otherwise your implementation would override the changed implementation. This seems fine because even if I locally define `Foo` which lets me to `Foo impl Bar`; if you then delete Bar then my code breaks anyways.
If that’s true, maybe it would allow you to put a 10,000 camera array (100x100) on a smartphone, and do interesting things with computational imaging?
I plan to add this option, it works well on Windows but shows uggly on mac and linux.
That's why you should combine AI and manual work. AI is great to get a rough template for a story, or to rephrase sentences.

Take a look at the revision history of my summary (linked elsewhere in this thread). In the end I had to replace all the quotes and rewrite half of the paragraphs to make sure everything's factually correct, but the end result still has much better tone and phrasing than anything I could've written without AI.
Not yet, already on tasks!
Precision Robotics with a Simple FPGA and Python
> everyone is wrong!

Well, not everyone. I wasn't the only one to mention this, so I'm surprised it didn't show up in the list of theories, but here's e.g. me, seven days ago (source https://news.ycombinator.com/item?id=42145710):

> At this point, we have to assume anything that becomes a published benchmark is specifically targeted during training.

This is not the same thing as cheating/replacing the LLM output, the theory that's mentioned and debunked in the article. And now the follow-up adds weight to this guess:

> Here’s my best guess for what is happening: ... OpenAI trains its base models on datasets with more/better chess games than those used by open models. ... Meanwhile, in section A.2 of this paper (h/t Gwern) some OpenAI authors mention that GPT-4 was trained on chess games in PGN notation, filtered to only include players with Elo at least 1800.

To me, it makes complete sense that OpenAI would "spike" their training data with data for tasks that people might actually try. There's nothing unethical about this. No dataset is ever truly "neutral", you make choices either way, so why not go out of your way to train the model on potentially useful answers?
Best Non-Fiction of 2024
Would that be enough to prove it? If the LLM was trained only on a set of legal moves, isn't it possible that it functionally learned how each piece is allowed to move without learning how to actually reason about it?

Said differently in case I phrased that poorly - couldn't the LLM still learn the it only ever saw bishops move diagonally and therefore only considering those moves without actually reasoning through the concept of legal and illegal moves?
Author here: I think another takeaway from this story (besides the importance of supply chain security management) is how crucial a defensive computer security architecture is. In a nuclear facility, the only thing that could have prevented these attacks are network segregation, password policies and similar measures.

By the way, IAEA has great guidance [1] on how to manage computer security in nuclear facilities. If you are interested, I encourage you to read it (or ask me about it).

[1] https://www-ns.iaea.org/downloads/security/security-series-d...
Does ChatGPT Help Novice Programmers Write Better Code? Static Code Analysis
How will it be all that different than the ubiquitous imaging we have now?
I make pretty unambitious repairs as much as I can but I have to say: You are my hero. I was filled with awe and excitement reading you. I guess my weak point is electronics. You inspired me to up my game.
I wonder if someone tried to build a localizer how small they could actually be made?

PS It's "Vernor"
Put a half-sphere reflective shield around a nuclear substance which will make the substance more reactive due to neutron reflections. Due to a slip-up with the screwdriver that was supposed to hold it up, accidentally fully drop down the shield, causing the too large radioactive reaction

I think with his reaction afterwards to remove it again, he saved the others in the room, but not himself
Why bother to improve the safety of a transportation system? Road safety has been improving since the 1940. Would you have said 'why bother' in 1970? Or 1980?

And the trend of less people dying isn't some magical automated machine, you have to continue to improve, otherwise the trend can reverse, see the US as an example.

And even if you don't care about people and children dying, even if you don't care about 1000s of people being injured impacting their lives and their families, about the massive amount of property damage, about the massive amount of tax payer cost for policy and firefighter, all the money sucked up by insurance companies that can be used to do something useful.

Even if you don't care about any of those things, it simply makes the system more efficient. By literally any way you look at, its one of the single best money invested compared to return you can get.

> Those are just two out of many points.

Both points you mentioned are nonsense, but I guess you have other points in your head that you don't want to tell. I mean if you said what they are, people might bring up facts in response.
I've been interested in smart dust for a while; recently the news seems to have dried up, and while that may have been other stuff taking up all the attention (and investment money), I suspect that many R&D teams went under government NDAs because they are now good enough to be interesting.
Who should get a uterus transplant? Experts aren't sure
A chat conversation where every single move is written down and accessible at any time is not the same as blindfold chess.
Here in the UK Amazon gives you a code that you have to give to the driver for more expensive parcels specifically for this reason. Again doesn't seem like an outrageous thing to implement for a 400k delivery.
Here's an article where they teach an LLM Othello and then probe its internal state to assess whether it is 'modelling' the Othello board internally

https://thegradient.pub/othello/

Associated paper: https://arxiv.org/abs/2210.13382
Going from an interpreted language to a compiled/native one is a huge difference; the difference between compiled languages is a rounding error in comparison.
If you leave out the path, it will default to the directory of the current URL, not /.

If not for this default behavior, it would have been much easier to manage global settings such as currency. Right now, all it takes is one cookie without a path to introduce inconsistency, only on some pages, in a way that's hard to reproduce.
Everything in the world runs on trust. It's human nature.

It's kind of overwhelming when you stop and really think about it.
'A place of joy': why scientists are joining the rush to Bluesky
It will be the same, but worse.
Show HN: KVMPods – Run Docker Compose Apps in Your Own KVM Virtual Machine
KVMPods (https://kvmpods.com) gives you a KVM virtual machine where you can run multiple Docker Compose apps with full feature support and no resource sharing with other users.

Key features:
- Your own KVM virtual machine
- Run multiple Docker Compose apps
- Full Docker Compose feature support
- NVMe storage
- x86 and ARM support
- Starts at €10/month

Just paste your compose file and deploy:

```yaml
services:
app:
image: wordpress:latest
ports:
- "8080:80"
volumes:
- wp_data:/var/www/html
db:
image: mariadb:latest
volumes:
- db_data:/var/lib/mysql

volumes:
wp_data:
db_data:
```

No CLI tools, no restrictions - just Docker Compose as it should be.
> ppl are usually their best selves when they are being watched.

I don't think that view holds up.

A, it very much depends on who is watching, what their incentives are, and what power they hold.

And B, it also depends on who is being watched - not everyone thrives under a microscope. Are they the type to feel stifled? Or rebellious?
Reliably Benchmarking Small Changes – Ankush Menat
It's not just about the court, I'm not going to let some sleazy lawyers inspect my phone. If they make me have it over I'll wipe it first.
Agent Graph System makes AI agents more reliable, gives them info step-by-step
Corruption exists because key internet infrastructure is maintained by corporations with perverse incentives (eg browsers owned by advertisers).
You can sometimes find a hidden camera today.
Unless you're in your own home, I think it's basically a guarantee at this point that you're being recorded. Could be CCTV, trail cameras, some random recording a TikTok, etc...
Seven big advantages human workers have over AI
[note to downvoters] i sped up a data extraction process by 10x by going from Python to awk.
PyPy looks interesting and it leaves me with a bunch of questions:

Is PyPy used a lot? Why don't we hear more about it? Does it support the same large ecosystem of packages? And does it have a GIL?
You have not been paying attention.

https://www.esa.int/Applications/Observing_the_Earth/Coperni...

https://www.theguardian.com/world/2024/mar/22/west-africa-he...

https://www.bbc.com/news/science-environment-66229057
Europe weighs impact of Trump administration on space cooperation – SpaceNews
This didn't quite work for me - dpkg complained about "no path found matching..." for every library. I replaced the "$path" in the dpkg command with "${path##*/}" to just match the library name.
Further inspection showed my package manager installed libraries to /lib (a soft link to /usr/lib/) but lsof returns files in /usr/lib.

Other than that it seems to work - i.e. no alarming output. :-)
This is nice, but I believe a simpler design could work better.

Simply make a model which transforms a 3d section of an image to an embedding vector. Make another model which can reverse the process (ie. encoder-decoder). Do that for every tile of a starting state.

Make an 'upscale' and 'downscale' model which can take a grid of embedding vectors and return a new vector representing the whole.

Then make an 'advance time' model, which takes an embedding vector and advances time by a given number of seconds/microseconds/days.

Now train all the models end to end to ensure that all combinations of upscaling/downscaling/advancing/encoding/decoding produce similar outputs to traditional physics models.

Use an ensemble of models or a sampling scheme to find places where outputs do not closely match, and insert more training data from the physical simulation at those points.
Some rough numbers:

The paper says that reconstructing an actual image from the raw data produced by the sensor takes ~58ms of computation, so doing it for 10,000 sensors would naively take around ten minutes, though I'm sure there's room for optimization and parallelization.

The sensors produce 720x720px images, so a 100x100 array of them would produce 72,000x72,000px images, or ~5 gigapixels. That's a lot of pixels for a smartphone to push around and process and store.
This is 5,000 gates, but to practically break a 4k RSA key, you'd need millions of gates, so we're still a long way away. Still, you could record my RSA-encrypted conversation today, and decrypt it in, say, 50 years. Shor hope I haven't said anything too incriminating!
This is a feature for projects already using Node and Vite (which is quite popular these days).

It's also not a requirement. The binary still exists, you can run it standalone.
interestingly, my takeaway from this article is that Nodejs isn't actually as slow as I thought. I thought Rust would be at least two orders of magnitude faster. It's barely just one, for the OPs benchmark.

how can it be possible that nodejs is so fast, or that rust isn't multiple orders of magnitude faster (again, for the OPs benchmark it's about 8-10x faster in one case, and only twice as faster in another, which is much faster, but I expected it to be more like 100x faster).

is v8 really that fast? I'd be curious to see a multi threaded version of this implemented (some arbitrary multi-threaded benchmark). there I would hope that rust is multiple orders of magnitude faster, given that node is single threaded (with some caveats, of course as anyone who knows node knows). surely the rust written wasn't written optimally.

given how easy it is to write typescript compared to Rust and Python imho, maybe the JS community isn't as crazy as I thought
Most EU innovation happens in universities anyway. Private companies doing innovations around consumer facing products and services is something mostly the US excels at, not Europe (exception maybe Sweden).

Products like the first iPhone didn't have any innovative technologies in them created by Apple, they were built from commercially available off the shelf parts every other phone maker had access to. But the product as a whole package was still highly innovative and profitable. This is the kind of product innovation that's gone missing in Europe.

Stuff like the MP3 codec was an European invention at the Fraunhofer Institute, but it's not a product bringing in trillions in revenue for Europe even though it was a very important invention used in many commercial applications.

Europe is focused on niche innovations with little product scalability and low financial profitability. Exceptions do exist (IKEA, ASML, Airbus, Nono Nordisk) but those are very little compared to what the US cooked.
The TL;DR is "Yes, Python is slow but this is why is doesn't matter, in these scenarios where it being fast doesn't matter".

And:

"Python is by far the fastest to write, cleanest, more maintainable programming language I know ... I rarely feel Python slows me down, and on the other side I constantly marvel at how fast I code with it compared to other languages."

In other words, "I don't know much about anything else other than Python."

What a pointless article.
First thought that came to mind - insect-sized killer drones.
I guess that's the informational context we are in right now.
I am certain that The Browser Company of New York (TBC) is the primary acquisition target. Question is who will buy it?

There are only two candidates for this and it is either OpenAI or Perplexity.

A coin flip of a chance either of them will buy it.
> as well as implementing unique AI-powered image post-processing to create high-quality images from the camera.

They're not comparable, in the intuitive sense, to conventional cameras.
It's interesting how they mention beneficial impacts on medicine and science in general, but everyone knows that the first applications will likely be military and surveillance.
ᛁᚾᛞᛖᛖᛞ᛬ᛁᛏ᛬ᛁᛋ᛬ᚻᚢᛒᚱᛁᛋ

ᛁ᛬ᚻᚪᚹᛖ᛬ᛟᚠᛏᛖᚾ᛬ᛋᛖᛖᚾ᛬ᛁᚾ᛬ᛞᛁᛋᚲᚢᛋᛋᛁᛟᚾᛋ᛬ᛋᚢᚲ᛬ᚪᛋ᛬ᚦᛁᛋ᛬ᚲᛚᚪᛁᛗᛋ᛬ᚦᚪᛏ᛬ᚻᚢᛗᚪᚾ᛬ᛗᛁᚾᛞᛋ᛬ᚲᚪᚾ᛬ᛞᛟ᛬ᛁᛗᛈᛟᛋᛋᛁᛒᛚᛖ᛬ᚦᛁᛝᛋ᛬ᛋᚢᚲ᛬ᚪᛋ᛬ᚷᛖᚾᛖᚱᚪᛚᛚᚣ᛬ᛋᛟᛚᚹᛖ᛬ᚦᛖ᛬ᚻᚪᛚᛏᛁᛝ᛬ᛈᚱᛟᛒᛚᛖᛗ

edit: Snap, you said the same in your other comment :)
KDE and Gnome desktop files are just used as launchers, they're not the actual thing being exploited. Persistent malware pretty much always separates the vector from the payload: the exploit just gets the door open, then downloads the actual malware from the C&C servers. Many vectors, one malware package.

> Although we lack concrete evidence regarding the initial access vector, the presence of multiple webshells (as shown in Table 1 and described in the Webshells section) and the tactics, techniques, and procedures (TTPs) used by the Gelsemium APT group in recent years, we conclude with medium confidence that the attackers exploited an unknown web application vulnerability to gain server access.
That's a bit bold when you know nothing about me, but sure.

I exist in a polyglot environment and we use Go for things that we expect to sit and do their job for years without modification.

Nothing more annoying with these than needing to update a runtime to patch a CVE and suddenly needing to invest two weeks to handle all the breaking changes. Go lets us take 5 minutes to bump the version number in the Dockerfile and CI configs and move on to more important work.

I'm not suggesting we'd go rewrite all of those if Go relaxed its guarantees but we'd stop picking it to write new things in and it would slowly disappear as we decommission the existing services over the years.
Now, I often get downvoted because I (wrongly) chose a hill to die on... but this one? Come on guys!? JavaScript is described in a standard that's like 50 pages PDF, most of which isn't code... Python has hundreds of modules in the standard library. It's humongous compared to JavaScript. I don't understand why this is such a controversial idea...
Yes, you can read about it the rfc under "Abbreviated syntax"

https://wiki.php.net/rfc/property-hooks

It follows the syntax of arrow functions

https://www.php.net/manual/en/functions.arrow.php
Can we agree that in the field of cameras we surpassed science fiction?

I can remember watching a TV series as a child where a time traveler went back to the 80s and some person told him that everything is about miniaturization. Then he pointed to a little pin on the time traveler's jacket, which was actually a camera, and said: "This little pin for example could one day hold a full video camera", which seemed a bit ridiculous at that time.
- some apps don't have website/desktop versions

- some app testing is better done on the desktop where you can share/mark screenshots

but it's not a huge market for sure...
At the very least, I really wish all these benchmarks would bubble sort e.g. ugly Python dicts with varying key and value types, rather than ints all the time. That kind of thing's what I think of Python as particularly useful for. That it's harder to write in any other language is unfortunately exactly what makes it the important thing to test.
Baa-Aa-A!
The problem seems to be that people want this to be implicit. If you have to call an explicit function to turn an instance of type A into an instance of BTrait anyone can define such a function anywhere.
Some previous work by some of the same people [0] where I was taking part in. Seems like this is a significant step up from the previous work including a novel idea that resolves quite a few issues we had. Love to see that.

[0]: https://ml-jku.github.io/bgnn/