skysight-inc/HackerNews huggingface dataset:
It's easy to defeat right now because very few are currently thinking about secure build systems.

As an example, systemd's latest source tarball has two Web Open Font Format (WOFF) files in a documentation folder, a favicon.png, two few small screenshots and error messages that have unexplained 128bit identifiers. There are also translated strings (PO files) which could include obscure writing systems few can quickly audit, and thus could be advantageous to an attacker wanting to hide malicious code.

The problem with most build systems is the entire source tarball is extracted into a single location and any build scripts executed during build have access to everything in the source tarball. Gentoo's portage does apply sandboxing around an entire build process, just not internally between the different build stages.

Continuing the Gentoo example (being one of the better examples of sandboxed builds), ideally src_unpack could take a compressed tarball distributed from an upstream project and split files into multiple separate paths such as:

- source code files and build scripts needed to build binaries

- supporting test files needed to test the the built binaries

- supporting documentation/binary/high entropy data such as application icons, game data, documentation, etc that should be copied upon installation but aren't required to build binaries

Then src_prepare, src_configure, src_compile, src_test and src_install all have different sandbox configurations restricting which types of files separated during src_unpack each build phase can interact with.

For the systemd example above, some possible improvements could be:

1. Remove WOFF font files and use system default fonts, omit favicon.png and omit screenshots. Or only make WOFF font files, favicon.png and screenshots available for copying during the src_install phase, and ensure they are not readable by build scripts during src_configure and src_compile.

2. Generate error message identifiers using an explained approach such as hash_algorithm("systemd_error_" + name_of_error_constant) to generate nothing-up-my-sleeve identifiers.

3. Only provide access to and include in the build process any translation files of languages the user cares about. Or only make translation files available for copying during the src_install phase and possibly src_test too, and ensure they are not readable by build scripts.

These build system security techniques are obviously more work, but are generally straightforward to understand and implement. These technqiues are in the realm of possibility for smaller embedded Linux systems that may just be kernel + BusyBox + a few small scripts + a bespoke application + a handful of dynamic libraries. And for more complex Linux systems, these techniques are within the realm of possibility when targeted towards high value software, such as software requiring or often executed with root permissions and software requiring simultaneous access to the Internet and access to user files.
I specifically said they don't ask. If they are forcing you to do something, they aren't asking
This is nicely presented. I would like to see the prompts to the respective services, however. Did I miss them? The "side peek" would be a natural place for them.
I think there's a condition though. That if they learn generative AI tools then they won't be obsolete. If op was just of the view that there's nothing special about generative AI, then the post would read very different.
I don't have much knowledge regarding mail but I can think of two reasons.

First is the use of mailboxes if your mail provider does not provide you with an IMAP server to connect to in which case you'll use a client like mutt to manage your mails.

Second one is the accesibility through the terminal could be reduced with HTML sites. If I want to access my email through a headless server using lynx or similar having to refresh the website to check new mails, or even composing them might be difficult.
Robots, plants and photovoltaic panels – China fortifies 'green Great Wall'
What do you use to fetch email? mbsync keeps messing up the UID of emails with gmail.
He certainly could change it, or has.
Obsolete for what purpose?

I dont think any aspiring artist, professional or otherwise, was ever deeply concerned about their future prospects in creating corporate graphics or mechanical pop songs. It was a fast buck, that’s all.

Attempting to seduce them into committing ever more of their creative efforts in the service of a machine that only seeks to churn out more artifacts misses the entire point of ever starting, and especially continuing, an artistic practice of any kind.

The entire purpose is in the act of creating and the efforts involved in honing a craft that entirely relies on your commitment.

It doesn’t get any simpler or less pretentious.

The road to mastery is the entire bloody point.

Trying to encourage your own friends to short circuit that only serves in getting you to the artifact faster, and in the process neglects anything of any value from the entire process. Is that really being a friend?

Unless you think the only thing that matters here is the artifact. Then you’re lost.
Can Large Vision-Language Models (LVLMs) Understand Graphs?
Yeah, they aren't comparable in the least. These companies use it for market segmentation. You'll only get this on the ridiculously expensive table saws. Whereas a Sawstop cabinet saw (the industrial one!), still expensive for an American-style table saw, is a fraction of the price. In the case of Felder, 10% the price!
> job boards

> activation energy gradient

> producing good results

> economic reward

> build recognition and clout

> big advantage

> a16z is investing

> bootstrap production

you're saying a lot of things about commodification and mass production, which are completely unnecessary to the expression of the human condition.
We will always need to work in the fields. With agricultural machinery we'll be doing way more than we were before.

if the amount of new offer is not paired by demand, there will be pain.
Exactly. I weakened my problem-solving skills in chasing the best-possible solution every time on the first try.
"In all views".

"It will do everything and I will need to say nothing".

Those are the pretentious parts of your reply.

It's just not true that everyone feels that practicing art is the main point. Sure, it can be developmental for an individual.
Oscar Newman's Underground City Beneath Manhattan – Socks
The upper two have had several known issues with them. I haven't heard anything about the latter one, but that doesn't mean they're free of issues.
If I understand correctly, Starlark is a strict subset of Python (at least very close to Python). Can anything be more established than Python?

Also I don't think pure data is an option. The point is that you want to generate data, which has many benefits (avoid duplication, easier to test).

It seems that Starlark is a good trade-off given the constraints. My main grief is that it doesn't have type.
Your company actually involves astrology with human resources activities?? My mind boggles.
Cloudflare 2024 Report: Global Internet traffic up 17.2%, Google #1 service, ...
I hope serial never goes away. It's a time tested communications interface that is simple to implement and not a patent minefield.
Before long, I suspect, the moniker "atheist chaplain" will have the same quaint ring to it as "horseless carriage". Why exactly are you talking about horses?
nvm is unbearably slow, this is really fast. 200 to 300ms latency whenever you open a terminal is noticible and I was getting far more than that sometimes, up to 1sec. Its really really bad.
I'm trying to use rye on Windows, but it doesn't want to use the normal installed Python version, only the versions it downloads itself, and it cannot update them easily because it pins an old one to run itself.

So far I've wasted more time than I saved.
Beyond being able to solve Connections, can a LLM generate (good/challenging/solvable) connections? Would be pretty cool to be able to generate a test set.
>>>I didn't use two of those three terms, so maybe confirming you read the comment you replied to is in order?

You replied to a question asking someone to elaborate on "malicious fine tuning". Specifically someone asked for elaboration on "Dawn Song was very clear that malicious fine tuning is a top priority among implementers right now."

Whatever your actual intent, it's only natural that I read your comment on "uncensored" models as an explanation of "malicious fine tuning".

The parent comment about "malicious fine tuning" remains unexplained. Since nobody else replied, I suppose we will never know how this Dawn Song person defines "malicious".
I'm here too.

I've used many, many different clients over the last few decades (yes, including Linux `mail`). I have to use Outlook at work, and I have to use my providers' web clients on my Windows gaming PC, but on all my other devices I use Mail.app.

I just... don't ever use all the features of the other clients, or don't like some of the behavior they have, or any of that. For a long time I would get excited about new email clients and try them out right away, but no more.

I dunno if it's just that I'm getting old, or if I just don't care as much, or both, or something else.
Terrorism, Israel, and Dreams of Peace (With Haviv Rettig Gur) [audio]
How to Build a Proactive Agent with Real-Time Event Processing
Thanks for sharing. My sister has been asking about AI for art, shes a canvas painter, she likes to play around and get inspiration or play with her own ideas and seeing what the model does with them.
I use poetry as well, but lately I've been looking at uv and had to actively stop myself because it'd be the 3rd tool I migrated to in the last 3 years.

Rust programmers seem to be lousy with ECS frameworks that never get used in any games but seem hell bent on proving that rust is the best language for game programming, and python programmers seem to break out in a case of "packaging tool building". I don't know what causes this. Perhaps some sort of pathological thinking that "I can do better"?

I really like python (and I like rust too), but if I were to take an honest look at the python packaging and environment ecosystem, I'd think that I'm being trolled. I lived through the age of setuptools.py, and while it was not good, at least there was only one approach really. Now we have a bazillion approaches that are all good, and zero consensus on what to use. Each individual tool is much better than what we had before, but the landscape has become so fractured that as a whole it's a complete shitshow.
Show HN: Bluesky Recap – Visualize Bluesky Social Activity Like Spotify Wrapped
No. HP was behind Itanium. In fact, it was basically their idea in the first place. I'm still not entirely sure why Intel went along although I suspect at least some of it was getting away from various x86 cross-licensing agreements.
> this read suspiciously like a stereotypical US opinion regarding individual rights vs rights of the majority.

Good. Majorities shouldn't be able to steamroller minorities.
HFT firm hires creator of C++ Compiler Explorer 'Godbolt'
You need to:

1. move the distance between your eyes from the center of your face a random amount

2. move both eyeballs up or down a random amount

This will defeat a vast majority of simple systems. However there are far more sophisticated ones that are slower and require more resolution:

1. mess your jaw line, cheek bones, nose bones, and depth your eyes sit inside your head

Finally the creme de le creme which even identical twins are as different as dogs and cats:

1. get the white of your eyes tatoo'd with new vasculature.
Was this because a shell script was using interpolation to add branch name to a shell command? Maybe we should start getting rid of string substitution-based shells?
It can be a good place to start improving, I understand that runna is not perfect in that case as it is not easy to adapt on the fly, anyway I will try to improve that! thanks!
The Shepherd 1.0.0 released: the init system written in Scheme
All that is SOLID melts into air
If they are fully static couldn't they probably be run at close to 0 cost from you?
I wonder if Baez put it on the arXiv to make it "citable".
> I love to bash social media as much as anybody, but, how different is this from the hoaxes, crazes and hysterias that society went through before social media was ever a thing?

It's always the same answer when the question is "what the difference between X on internet vs X before internet"... the speed and scale of it. You wouldn't argue that a nuke is just like a handgun, well it's the same here
How to investigate and debug a real instance of thread pool starvation with .NET Events Viewer.
Lot of replies here but none of them have really hit the mark. European table saws are fundamentally different than American table saws, where the entire section left of the blade slides forward. Culturally it seems Europeans believe this is "safer" than the American style and therefore they don't need the blade safety mechanism. Personally I think that's nonsense, and apparently so do some of the companies because they've developed their own mechanism that they only use on their priciest saws.

Woodworking YouTube has changed this a bit. Since American creators are so widespread, everyone has gotten exposed to SawStop and I know at least a couple years back people were trying to import American-style table saws instead of the local European-style because that's what YTers have. I don't know if it was regulatory or what that has prevented the former from being more available in Europe.
LLMs don’t have “intelligence”.
I will give you the possibility that some text to image generator models of the moment may not be able to create images that compete with Quanta magazine artists. Maybe. These systems have limitations but I think if you study your own logic you will see that you can't be sure that they will not overcome them in the next 2-20 years.
"verifies the execution of [..] any LLVM-compiled language"

Why is it limited to LLVM-compiled languages? Wouldn't anything that compiles to RISC-V work?

And since the LLVM bitcode format completely changes every time there's a new LLVM release, how does that work?
Good for you then. I myself have not come across the (loud/louder) TDD exponents advocating for using TDD in system/integration testing, they mostly focus on unit tests. If you can point to some examples, it would be a learning experience for me. If not that's fine too, I am glad that there are voices out there like yours.
For a classic Napolitano sauce, open a 28 oz. can of your favorite crushed tomatoes and then mix in 2T extra virgin olive oil, 2 cloves garlic (minced), 1.5t kosher salt. That's it, you're done.
Nope. It's the companies. https://www.bitecode.dev/p/there-is-no-eu-cookie-banner-law
I mean, with Bluesky you can see the replies; with Twitter if you're not logged in you either get _just_ the post, or you get an error message, depending on phase of the moon. For this sort of thing, Bluesky's clearly more user-friendly.
I'd love to see them try "Only Connect" puzzles which are _much_ harder.
There's power to it being valid JSON, though; it can be stored in databases optimized for JSON payloads, and edited with JSON editors. There's a real agility to liberally sprinkling JSONFields and JSON code editors across an auto-generated admin interface like the Django admin system, knowing that you can leave breadcrumbs for colleagues, and that anything starting with a `__` is fair game for comments any time you see such a key name.
The positive thing is that these defective parts probably aren't making it into the spare parts supply chain, so if planes start falling out of the air because the rudders break off, they'll mostly be 737MAXes and not the older models.

I used to think that the 737MAX line would be the safest of Boeing's products because of all the extra attention after the terrible crashes, but from the sounds of it, the rot runs too deep in Boeing.
My understanding of the term "quiet quitting" isn't that people doing that are avoiding doing any work, it's that they are only doing what is expected of them and not going above and beyond.

With that definition, there's nothing unsavory about it.
Weather patterns have a daily/ seasonal rhythm… the strength and direction of the wind will have some distribution that is different at different times of the day. Temperature and humidity as well, like the other poster said.
Rivian's brand identity was trying to push the off-road/nature usage of their trucks/SUVs, so that focus made a lot of sense. They announced a big partnership with the Parks Department to have chargers at major National Parks. I hope that partnership will continue even as the network opens up to more users, because that was an interesting focus for a charger network.
If we consider sigfigs, then isn't 100 and 100. two different numbers given one has a single significant digit and the other has 3? For 101 and 101. it doesn't matter because both have 3 significant digits. Then again, one may argue that it is better to write 1e2 and 1.00e2 instead of 100 and 100.. It also avoids the weirdness of the double period if the number with a dot ends a sentence.

On a personal level, I also don't like ending a number with a . because my brain immediately parses it as a sentence ender and it interrupts my reading flow.
That's fascinating about charge density of a particle being a dirac delta function. Is that a mathematical convenience or something deeper in the theory?
In the article they say they promised future development on Tofino and then didn't even follow through with their own EOL policy.
Thoughts on OpenBSD
Sure, I'll have a look when I get home.
Yes I'm not the pope, it's a cheap server. Still doesn't make any money.
This seems really nice. I wonder how it handles accounts with two-factor authentication, sms and yubikey.
After half a year on Arabic, I barely remember the sentence structures. The basic was too basic and it doesn't do a good job of teaching words you'd actually use. There's the argument that you won't forget anything with space repetition but I've forgotten a good chunk of it.
Wow this is amazing

very helpful especially in this economy
I can now run a GPT-4 class model on my laptop
The Dirac delta is a unitary vector when represented on a vectorial basis it's a component of.

I don't know what kind of justification you expect. There's a Dirac delta sized "hole" on linear algebra, that mathematicians need a name for. It's not like we can just leave it there, unfilled.
Italy is suffering more from several decades of political dysfunction and a long term stagnant economy.
Testing Out LLaVA-O1
> I can't help but wonder if a big part of the reason the number of incidents is so high is because we're intentionally hyperbolic about risks when it comes to warning labels

Chainsaws have about the same number of annual ER visits as table saws. It's common to see someone using a chainsaw without most of the recommended safety gear. In those cases, it's probably money.
There are things Android forbids you to tinker with, even on a rooted device. And it’s advertisement related things.
I use many features of Thunderbird. And it works fine with outlook, even including calendaring, with the Owl plugin. It is a paid plugin, but it makes life much better.
I wonder if that includes the SFTP server component of openssh?

If so it would be very useful for use with rclone. I back up my phone by running an sshd in termux then using rclone with sftp remotely. This works very well (until the phone decides on a whim to kill the sshd!).
I don't think these artists need to go through a full course of how these modeling works under neath. It's a lot of effort if you don't already have a good background in STEM. I don't think they would gain more appreciation for GenAI even if they see how hard to make these models.

There are a lot of other interesting Computer Generative Art that are not Diffusions. Maybe those a more genuinely interesting to your artist friends.
Quiet quitting also known as gaslighting your employees for simply doing their job, and not overworking. Oh, Jimmy clocked out at 5pm like his contract said he could? Quiet quitter. Bob didn't stay online on the weekend to discuss sprint plans? Quiet quitter. The level of emotional abuse that many companies get away with baffles me. So many of them systematically destroy your confidence and brainwash you into thinking that being a slave is somehow a noble life, and how to best serve your master is something we should all strive towards.

They want you to make your job your entire identity to imprison you further and have even more mental leverage to treat you like trash. We are a family, of course, but only when it suits them, otherwise you are a quiet quitter, and despite record profits, we simply don't have the budget for a raise Janet!
Actually, this started as a joke. But then colleagues started making real requests like this. Frankly, for the last couple of months they have been very happy with these reports as a benchmark for high-level analysis... >.<
These kind of tests (or may be all tests) should show *success rate* instead of a single pass/fail.

I believe Claude or even Gemini can succeed if system prompt is improved e.g. tell it to re-evaluate it's answer before finalising, can even tell it to do "thinking" within <thinking> tags. I use claude like that and it often goes over it's answer and corrects itself within same reply. On the other hand it can also incorrectly assume it made a mistake and can sometimes uncorrect itself.

Edit: Using o1's step by step problem solving example from OpenAI blog post made Claude go step by step in similar depth too. Could even do that here to get better success rate in non-o1 models.
Hmm, isn't there like five lives before "ending"? So instead of doing a "perfect run" there should be chances, and feedback, such as "one missing", like a real human player?
I'm inclined to agree. Intel would have been loathe to go the 64-bit x86 route on their own. But a somewhat resurgent AMD pretty much forced their hand given the sorry state of Itanium development. Absent AMD, I'm pretty sure they'd have found a path to a "good enough" Itanium to sell successfully.

For what it's worth, I followed Itanium as an IT industry analyst and wrote a short book recently on the topic. https://s3.amazonaws.com/bitmasons.com/docs/Lessons+from+the...
I’d be surprised if they’re not using AI or some sort of rule-based generator at this point.
> Artists who get their start in AI early can build recognition and clout within the community.

The non-artists community? The "I don't have anything I can show I own the copyright to" community? The "I made this with genAI so now the company can't even protect it's copyright?" community? The "tech-bro NFT fraud" community? The "do it for the exposure" community?

Which community?
Works for me, no errors, using Firefox. But a quick peek at their Certificate Details shows several dozen Subject Alt Names.

That's probably a corner case which your browser's dev's failed to test.
Mostly to northern Europe. Pay is actually much higher in Germany, the UK, Scandinavia than in Italy and all are quite easy for young Italians to move to (Ok, the UK is not that easy these days).
or lease. Some EV lease deals are pretty amazing.
You're right. I was probably drunk.
Ask HN: Favorite app you discovered in 2024
Include the platform, short description and price if applicable.
If you're talking about Sharl l'éclair, he drove just fine yesterday.
He spent decades at Bell Labs. He was also, IIRC, in his seventies.

So a more charitable interpretation would be that most of his colleagues are in their 20s and just out of school with a CS degree. He doesn't think they can (productively) use the languages the cutting-edge PL researchers generate.
I am happily using them for all of my domains they support. The problem with Cloudflare registrar is that they flat out don't support many domains/tlds.