skysight-inc/HackerNews huggingface dataset:
> Around 70% of our high severity security bugs are memory unsafety problems

> ~70% of the vulnerabilities Microsoft assigns a CVE

> 76% of vulnerabilities

What is the difference between the first two (emphasis added) and what you said? Just as a thought experiment...

If I measure a single factor in exclusion to all others I can also find whatever I want in any set of data. Now your point may be valid but it is not what they published and without the full dataset we cannot validate your claim however I can validate that what you claim is no what they claim.

To answer your question in the final paragraph. Yes it is, but it requires the same cultural shift as what it would take to write the same code in rust or swift of golang or whatever other memory safe language you want to pick.

If rust was in fact viable for such a large project, how's the servo project going? That still the resounding success it was expected to be? Rust in the kernel? That going well?

The jury is still out on whether rust will be mass adopted and is able to usurp C/C++ in the domains where C/C++ dominate. It may get there, but I would much much rather start a new project using C++20 than in rust and I would still be able to make it memory safe and yes it is a "skill issue", but purely because of legacy C++ being taught and accepted in new code in a codebase.

Rules for writing memory safe C++ has not just been around for decades but has be statically checkable for over a decade but for a large project there are too many errors to universally apply them to existing code without years of work. However if you submit new code using old practices you should be held financially and legally responsible just like an actual engineer in another field would be.

It's because we are lax about standards that it's even an issue.

As a note, if you see an Arc<Mutex<>> in rust outside of some very specific Library code whoever wrote that code probably wouldn't be able to write the same code in a memory and thread safe manner, also that is an architectural issue.

Arc and Mutex are synchronisation primatives that are meant to be used to build datastructures and not in "userspace" code. It's a strong code smell that is generally accepted in Rust. Arc probably shouldn't even need to exist at all because that is a clear indication nobody thought about the ownership semantics of the data in question, maybe for some datastructures it is required but you should very likely not be typing it into general code.

If Arc<Mutex<>> is littered throughout your rust codebase you probably should have written that code in C#/Java/Go/pick your poison...
That is a good way of doing it, and I will cobble something like it together.
Right now, I am bookmarking to my phones home page, useing an alternative browser that lets me sset domain settings for each web site, java script, cookies, DOM,which add blockers, font, etc, etc,etc.
It works for me, and when it breaks a site, that is often a good indication that its run by rabid advertationalists, and data thieves, and there wont be any content worth the trouble.
I do have another browser running crome, to access(briefly) the sites that I cant find an alternative to, but I wipe the cache every once in a while.
The difference between the shiny one and the browser* that retains local control, is stark.

*stoutner privacy browser, apk on fdroid
It's not a plan at this point, it already happened.
Subreddits sometimes split the difference by dedicating a single day of the week where something is allowed, eg. only allowing you to post questions on Fridays, or creating threads to consolidate off-topic discussion.
Aka hippie speedball :)
That was probably 1.4.2_15, because 1.4.15 did not exist. What you describe wasn’t a Java source or binary compatibility problem, it was a shipping problem and it did exist in C++ world too (and still exists - sharing runtime dependencies is hard). I remember those days too. Java 5 was released 20 years ago, so you describe some really ancient stuff.

Today we don’t have those limits on HDD space and can simply ship an embedded copy of JRE with the desktop app. In server environments I doubt anyone is reusing JRE between apps at all.
You’d make a fascinating writer. There's something about the way you constructed these sentences - so enchanting!
These analogies are great for demonstrating a deeper nuance, I like them!

So for 1) though, the sidewalk construction company is only incentivized to do monitoring and continuous improvement to the extent that a) they do it to compete or b) the client asks for it.

And for 2) stumbles are likely to be quite obvious failures - but the obviousness of the failure doesn’t invalidate your example. To strengthen your point we could target something subtler than stumbles - let’s say 30s is lost to incomplete nutrition plans.

In both cases only organizations that value excellence would consider these initiatives. Which actually aligns with the article, apart from a key difference that both examples given describe top-down searches for near-misses rather than bottom up flagging of them.

I think ultimately this is about operational excellence - an org that really cares will actively look for near misses, but flagging them from the bottom up won’t make an org care unless it already did, because maybe they don’t have an incentive to care, or maybe they don’t see the value of that work or maybe they do care but haven’t addressed bigger issues yet or are too low margin of a business to afford to address them so it’s a yes-we-know-but-not-yet type of thing.

And if bottom up flagging doesn’t work the best you can do is address it locally.
Right, being senior and above basically means doing less engineering. I hope that's something we can agree on because otherwise we would need to discuss the semantics

Engineering is not only the physical labor. Aircraft engineers and building engineers don’t spend most of their time doing hands on work.

https://www.careerexplorer.com/careers/engineer/

Designing and Planning: Engineers are responsible for designing and planning systems, structures, processes, or technologies. They analyze requirements, gather data, and create detailed plans and specifications to meet project objectives. This involves considering factors such as functionality, safety, efficiency, and cost-effectiveness.

When doing construction work, who adds more value?

The general contractor? (Staff software engineer),

The owners of the plumbing, electrical, and HVAC companies assuming they have the actual skills (senior level developers). The owners of the plumbing companies could very well be making more than the general contractors. This is where you can specialize and the sky is the limit.

The actual certified workers (mid level developers). This is the level that the completely head down people are. No matter how good they become at being a hands on plumber , there is a hard ceiling they are going to hit at this level.

The apprentices (juniors)?

I work in consulting. I am currently a staff architect (true - IC5) over a hypothetical project (not a real project). I know the project is going to need a cloud architect, a data architect , and a software architect. They are all specialists at their jobs and are all going to lead their “work streams”. They are all IC4s

I expect each architect to take the high level business objectives and work with the relevant technical people on both sides and lead their work along with some hands on keyboard work.

They will each have people under them that are not customer facing at all. While I know all of the domains at some level, I’m going to defer to their technical judgement as long as it meets the business objectives. I did my high level designs before they came on to the project. Was my design work, figuring out priorities, risks, making sure it met the clients needs, discussing trade offs, etc not “engineering”?

Each level down from myself IC5 to junior engineers (IC1) is dealing with less scope, impact and ambiguity. There is no reason that the architects shouldn’t get paid as much as I do. They bring to the table technical expertise and depth. I bring to the table delivery experience, being able to disambiguate, and breadth.
So we can have corporations and shitty billionaires also own the moon? No fucking thanks.
can we request our data deletion in these vendor????
Autism plus "AI for social" coprocessor could be a wicked combo ;)
The Future of Math with O1 Reasoning with Terence Tao
> What if growing bigger, more connected brains is the next evolutionary step?

I don't mean to be mean - but unlike what "nerds" think "intelligence" isn't some superior trait that automatically means the gulag/eugenics for the socially popular kids who they despise. All this situation indicates is that the societies are broken/mean (on every side).

Traits need to be "rewarded" for them to be evolutionarily meaningful in the individual's environment. More connections etc. also means a lot more energy consumption. Not many societies can support such phenotypes.
"Undefined behavior" is not a bug. It's something that isn't specified by an ISO standard.

Rust code is 100 percent undefined behavior because Rust doesn't have an ISO standard. So, theoretically some alternative Rust compiler implementation could blow up your computer or steal your bitcoins. There's no ISO standard to forbid them from doing so.

(You see where I'm going with this? Standards are good, but they're a legal construct, not an algorithm.)
can we request deletion of our private data in this vendor???
Fitness function? What if end up walking down the eugenics path or genetic engineering.
Does brain science have a Fitt's law?

https://en.wikipedia.org/wiki/Fitts%27s_law

This is before we even start talking about serial or parallel, concurrency, etc. And then modify the networks and the wires themselves dynamically in real-time and you have endogenous BDNF, endogenous DMT, and the fact that insulin has a different, psychoactive effect on the other side of the blood brain barrier.

It would seem that time-speed-distance would be a useful metric here, as well as accounting for the fact that we don't actually know where we are in the 6d chess of triune, bicameral, hippocampal, or glycemic variation moment-to-moment in real-time.

¯\_(ツ)_/¯
Because I still want access to my files if there is a catastrophic system failure?
John Carlos Baez on that article: https://mathstodon.xyz/@johncarlosbaez/113964127171705485
Also, simple is evident, smooth, maintainable, and fast.

If asked to implement a templated dictionary type, many C++ programmers will write a templated class. If they want to be responsible, they’ll write unit tests. But the simplest way is:

template<typename Key, typename Value>

using Dictionary = std::vector<std::pair<Key, Value>>;

It is trivially correct and won’t have any edge cases which the tests may or may not catch.

Some programmers would consider this implementation beneath them. In just 800 lines, they could build the type from scratch and with only a few months’ long tail of bugs.
Show HN: Begintrips journey dashboard V2 is here!
Head over to Begintrips.com to discover an all-new travel planning experience. With fresh features, a sleek UI, and a smoother UX, Begintrips is your ultimate companion for managing trips effortlessly—track expenses, stay within budget, and focus on making memories.
Akin to bottle-nose dolphins and orcas with sound. They have, easily, the most signal-processing neurons of ANY species on the planet.

And, fwiw, their encephalization quotient is just behind one species--us.

Since they're aquatic mammals (given the requisite mass for thermoregulation), that severely under-represents their effective brain/body-mass ratio too.
It fails fundamentally because the underlying economic theory is built on a sink hole and constructed from cheese. There's pretty much no relation between the models that espouse neoliberal policies and reality, except those bits that were too egregious to ignore so were patched in as afterthoughts.
Yeah I was really surprised by how much of a performance difference it made when calling variadic functions that support `args ...interface{}`. Literally every since call is going to be an allocation of multiple parameters when passing structs without a pointer
Phatethic... EU with this administration barely will feed them self and the union will get dismantle to 5 years, and first to dump will be the Baltics an eastern Europe.
Actually EU is no a player at all but Yalta Second will rewrite the new area of influence and the new iron curtain...
Baltics without their mighty neighbour are doomed in all aspects. They will flipp the sides on the air in blinking eyes moment...
Japan has some awesome public transit but at the end of the day, people talk about Japan as if it was just Tokyo. A non-American who has only visited NYC or Chicago might think that America as a whole had good decent public transit.

I’ve been to Japan 4 times and have driven in 25 US states. Rural areas just tend to be car dominated. A few towns have charm but most are just where regular people work and live.
Not for scalar, but certainly for vector multiplication which a large part of the audience certainly needs a lot.
Parts of the Pacific are littered with uninhabited atolls. Even a few decades ago, it was plausible to find yourself on one unlikely to be visited for many years.

An issue with satellite imagery is that it is focused on areas where people want to take pictures. Vast regions of the Pacific rarely if ever have satellite photographs taken at sufficient resolution to see anything a castaway does for the simple reason that nothing is there that would incentivize anyone to expend the cost of taking a picture. I used to have a global model of satellite imagery coverage based on actual imagery catalogs and much of the Pacific was barren.
How would you name the variables in the code to make it clearer?
NSFocus: DeepSeek AI hit with 'well planned' DDoS attacks
I can live with that, I think. I'd like to believe that all of the points are relevant.

The issue is that I had to cram them all in somehow, without making the article excessively long. I'm open to criticism, though!
Don’t blame this on the market. A true market won’t have a heavy handed regulator in bed with a govt approved monopoly.
This is a serious spoiler, perhaps delete your comment and rephrase it?
One Note is good for this, it doesn’t have to be a do-nothing script.

One Note also has the ability to add checkboxes as dot points, and you can make “template pages” for each procedure and then you can then just right click -> duplicate, and use the checkboxes to keep track of where you get upto in a process.

The reason this is great for me is because I virtually never get to sit still and finish anything unless it takes less than 1 min. People pull my attention in every direction.
The writing held me to the end. I think their long form apolitical stuff is amazing.

People disagree about the political/editorial, I think it's classic American centrist but right wing see it as leftist, and left wing see it as establishment.

I totally would wear $20,000 of well made wool 6ply, leather and cotton. Like the author, I'd do it on somebody else's dime. My forays into Japan align strongly to the sense there are many obsessive mercantilist specialists there. The guy with a 2 meter wide stall selling exclusively high end pentode valves in the old akehabera market comes to mind.

I spent a brief time in Beijing with a co worker watching them being fitted for a high end suit. The fabric was just amazing. They keep the salvage showing out on the roll so you can see where it's woven be it Milan or Scotland. I think that experience is why this article resonates: that and getting a charity store "demob" suit recut to fit me in London in the eighties. 1946 vintage double breasted with a slubby thick stripe, £20 to buy and £120 to have fitted (it was destroyed by moths in Brisbane 20 years later)

My highlight of that Beijing trip was buying a beautiful "pleather" designer jacket for my son from the cheaper, fraudulent end of the market. Very nicely made, he wore it into the ground. If you walk away from the stall without bargaining the market trader women pinch you to teach you a lesson. Painful.
https://archive.is/2QLvo#selection-5941.268-5941.298
I know several autistic adults who check their outgoing messages with AI for unintentional meanings or recommendations to better communicate what they mean. Not getting the ai to write for them mind you. Social coprocessor indeed!
Foxconn is actually an ODM too. They design and manufacturer their own phones.

https://nuumobile.com/android-oems-vs-odms-5-things-you-shou...
Thank you r/cpp Reddit moderators for doing your part in keeping users safe.
Consider the formula (a+b)² = a² + 2ab + b². How would you name the variables to make it more “readable”?
Because memorizing things is far from the most interesting aspect of consciousness.
I wonder if the cut off point of science popularisation is related to the point where maths becomes the most useful way to explain what's going on?
https://www.tabletopsimulator.com/ is all about that idea
That latter sentence also applies to automotive tires.
I mean that maybe gradient descent is a passable sorting algorithm, once the weights have been learned to properly describe ordering. It may be a speciality of transformers that they can sort things well. Which wouldn’t tell us that much about whether they are mentalists or not.
In math, zeros are more common than Os by several orders of magnitude, so it makes sense to use the lower-effort symbol for them.
you should check out uxntal https://wiki.xxiivv.com/site/uxntal.html

https://100r.co/site/computing_and_sustainability.html
Tire wear is not just friction. The uneven coarse grit can pound, cut, chip and twist the tire surface all while having less grip/friction.
Meta's fact-checkers battle a blaze of wildfire conspiracy theories
> "Undefined behavior" is not a bug. It's something that isn't specified by an ISO standard.

An ISO standard? According to who, ISO?
> I imagine that there are various triggers of early mathematical derailment

I have come to believe that the main trigger by far is the attitude of society. Of parents, family, friends, tv stars, heck even many (non math) teachers. "I wasn't good at math haha" is such a standard phrase to hear, and parents telling their kids that they don't need to worry if they "don't get it" as if it's some mystical topic that only a few gifted can unlock. Plus the uncool stigma attached to "math nerds", folks who simply have an open mind to try to "get it", turns out that it isn't actually that hard. At least when talking high school math or some basic college classes.
> who decides which laws are "bad"?

It's better to ask the question in a different way. We know what bad laws are. They're laws that benefit some interest group at the expense of the general public, e.g. by constraining competition or diverting tax dollars to cronies.

So the question is, how do you eliminate bad laws? This isn't a question of what a hypothetical legislature should do if it was full of good faith actors, it's a question of how to structurally align the incentives of a real legislature with the interests of the general public so that they're inhibited from passing bad laws.
> realistically, context suggests 5120 bit per seconds, which is rather slow.

How? "5 MBPS" must mean 5 Mb/s (megabits/s) or 5 MB/s (megabytes/s), and for internet speeds megabits are much more common, so it's rather 5 Mb/s ~ 5,242,880 bits per second, equal to ~0.6 megabytes per second or 5120 kilobits (not just bits) per second.

Starlink can achieve speeds around 130 Mb/s (megabits/s), but (normal) Starlink surely doesn't achieve 130 MB/s (megabytes/s), so that would check out.
I don't see any objects in this script though, just functions.
As others have mentioned, this meets all the criteria for selection bias as well as a number of other forms of bias.

You can't derive meaningful numbers without doing a few things, like having non-ordinal metrics at scale on a graph.

Gaming companies have a long sordid history of providing graphs that do not reflect reality especially in press releases, to support a narrative that is more likely to be false than true historically.

The metrics aren't shown, or properly defined in any meaningful way. This translates down to them saying, We've done something about the cheaters once and for all, it was the linux people, trust us.

There's a fairly heavy conflict of interest in these cases, and most would rightfully say this in its current state meets a criteria for misinformation.
There are other kinds of consciousness than human, plants are aware of their surroundings.
It's likely that inefficiencies like this contribute O(40%) to every slice of the pie, so fixing any one slice seems unimportant, but cumulatively they would make a big impact on the situation.

A second hypothesis is that the inefficiencies are fractal/recursive -- and that we might be able to squeeze out another one or two 40% savings in some slices even after the first one!
I love working with neovim and i do all my programming with it for more than 20 years.
I often struggle to "move my life" to neovim. For example, task management apps are both on my phone, my laptop and web if i need them.

How do you guys work with neovim on other non-programming related tasks and still manage to keep everything in sync?
LRGrep: Selecting Error Messages for LR Parsers
Not needing to disable SIP is a big one.
I've been a software dev for 27 years, professionally for 21 years.

This idea is getting the causality arrows backwards. I'm not talking up AI because I'm in AI - I'm in AI because I believe it is revolutionary. I've been involved in more fields than most software devs, I believe, from embedded programming to 3d to data to (now) AI - and the shift towards Data & AI has been an intentional transition to what I consider most important.

I have the great fortune of working in what I consider the most important field today.

> But for me, and many others, the joy of programming is in doing the programming. There is not a more outcome-driven modality that can bring us joy. And we either reject the premise or are grieving that it might eventually be true.

This is an interesting sentiment. I certainly share it to some extent, though as I've evolved over the years, I've chosen, somewhat on purpose, to focus more on outcomes than on the programming itself. Or at least, the low-level programming.

I'm actually pretty glad that I can focus on big picture nowadays - "what do I want to actually achieve" vs "how do I want to achieve it", which is still super technical btw, and let LLMs fill in the details (to the extent that they can).

Everyone can enjoy what they want, but learning how to use this year's favorite library for "get back an HTML source from a url and parse it" or "display a UI that lets a user pick a date" is not particularly interesting or challenging for me; those are details that I'd just as soon avoid. I prefer to focus on big picture stuff like "what is this function/class/file/whatever suppoed to be doing, what are the steps it should take", etc.
It's Gary Shteyngart, you don't have to sub to the Atlantic to read him. I've zero interest in his late mid-life hobbies of watches and suits but the dude can write. His fiction is fun, for those who are into that sort of thing.
This hits the nail on the head for me. Low complexity prototypes and modules are something o1 or R1 can reason well about. For more complex coding tasks, we‘d need IMO a feedback loop with a linter and a compiler, and maybe even a debugger and CI workflows. Basically an agent that works exactly like I do.

The reasoning process is nice, because the CoT can fact check itself. But it can’t catch compiler bugs across multiple files/modules, because an LLM is not a compiler.