skysight-inc/HackerNews huggingface dataset:
> If we're talking about mid-90s race conditions there, with "temporary names", there was never a market for those vulnerabilities.

More like mid-80's with effects dragging on to mid-90's.

There was never a market back then at all. ;) The point is, many confidently announced that all the easy to exploit stuff in Unix was being fixed and soon security was going to be less of a problem.

> but we've been in what seems like a stable state for over a decade on which of those vulnerabilities are actually tradable.

Yes, but that doesn't stay the same if the low hanging fruit dries up as you posit. The level of sophistication of both exploit writers and exploit consumers will have to climb, but we're nowhere near the ceiling of the skills and effort that crime and intelligence can pay for.
It's a shame that their $5 tier is only 300 searches/month, or 10 searches per day. It's kind of ridiculously low. I could burn through half of that in a single day of debugging

Also I just tried it and you can't really search for porn
> are you supposed to click if the motorcycle overlaps by 2 pixels, are you supposed to click on the passenger, and if it's a traffic light, is the pole part of the traffic light

100%, I have never passed those captcha, guess I'm really not human.
To preface: I randomly stumbled upon this because I looked up info.

... and saw that at least this page containing information regarding an USAID grant is now 404ing.

Look at this:

https://foreignaffairs.house.gov/wp-content/uploads/2023/08/...

It is a letter from republicans about the USAID grant some report to be "for spreading atheism in ethiopia" (it's not).

They quote this link in the footnotes:

https://www.state.gov/statements-of-interest-requests-for-pr...

This now leads to a 404.
I agree that it can be fun. I also devised a retirement plan as a graduate student, figuring out what sum of money I would need to live the rest of my life living the graduate student lifestyle without the hassle of being enrolled. Less than a decade after finishing my PhD I was able to walk away from my career into that lifestyle. Certainly not for everyone, but if it floats your boat, it is certainly an achievable plan.
It's hilarious that there are people who "don't get what problem jj is trying to solve".
It seems like they just use git so little, barely for more that linearly committing, so they are not aware of it's shortcomings that jj often elegantly fixes.
> PhD research was never about financial security

You're looking at this wrong. PhD was always about financial security for the vast majority of PhDs. You think all those Chinese and Korean etc. students are coming to study engineering to get invited to the good parties back home? No, they're doing it because it provides financial security. Same for places all over the world. Europe, everywhere.

It's basically upper and upper middle class white Americans who pursue PhDs for the social prestige, because they already have actual capital, so they're pursuing social capital. Everyone else does it for a combination of money and love for the subject matter.
This only works if you check your bags. And checking bags is for casual travelers that don’t care about their time when they get to their destination
Paid for it and tried out the full experience, beats anything else I've tried by a wide margin.

My prompt,

"I'm considering buying stock in the company with symbol NU. The most important thing to me is answering the question, is the stock likely to rise in the future. Please help create a list of questions that will help me to understand the likely hood of this. Also please help to anwser those questions. Please highlight the global economic environment for the company. Any unique challenges and unique advantages. Finally let me know what others think of it"

Results:
I know this stock well all though I'm not a pro. It nailed all of the relevant aspects and hits the analysis right on for everything I know about it. Pulled lot's of helpful resources and most importantly the information was timely enough to be relevant. The timely part is where other LLMS have failed miserably. I've gotten good analysis from other LLM products but they have always been way out of date which makes them useless.
pretty common for senior engineer at a corporate gig

not so common for jr roles / small biz / non-tech companies
It is entirely unclear to me where the value actually is. It seems google is funding it for some reason. And some people clearly have a lot of opinions that this is "the future". People had similarly strong opinions about various other things in the past.
You would need Middle-out compression for this to scale. Lepton from Dropbox uses Middle-out to compress jpg images.
That's remarkable. A new name for where we came from before the microservice hype. So I suspect that the opposite of the "modular monolith" would be the famous "big ball of mud".
not sure what american payment transfers have to do with UK BACS payments, but ok

> I would guess that payroll credits are the second most-reliable category in the ocean of ACH transactions, right after US Treasury payments.

maybe some sort of lunatic getting control of the US treasury payment systems?

I suppose that can't ever happen
The focus of their work seems to be low-level firmware, and not CUDA or any kind of compute. It makes sense a lot there because you won't need as many libraries.

The syntax is really a red-herring especially when you get contracts, proof of absence of runtime errors and higher-lever functional proof, mostly automated, or assisted with annotations. If you're actually going with this effort, the lack of curly braces, ampersands shouldn't be a main concern.
Unless I'm very mistaken, regulators/investigators are capable of independently reading a black box directly.
What is the correct amount of indirect for NIH grants? I'm not informed enough to have an opinion on this, but based on seeing the luxurious facilities and high administrative staffing levels at many research universities it seems like there might be some fat we could cut? I've read claims by other prominent researchers that this change is a net positive since it will free up funding for more actual research. So, I don't know who to believe?
Article doesn't say what parts of Nvidia's stack use SPARK. Considering Nvidia is a huge software company with ~30,000 employees, "There are now over fifty developers trained and numerous components implemented in SPARK" doesn't inspire confidence.

IMO the realistic path towards formal verification is AI proof assistants that automate the tedious parts instead of forcing you to write your code in a weird way that's easier to prove
Never? Nah. Sure there could be issues with lightning or ground loops but A. use grounded surge arrestors at each end before termination into equipment, B. Don't use shielded cable. Unshielded in a conduit will be fine with 60Hz power but loads downstream producing harmonics (lots of switching supplies, VFD's, etc) can cause interference. This is why I said fiber a lot.
It's perfect for things that just need a modest amount of bandwidth, like a TV. Most streams are a few tens of megabits, and that's about all you can reasonably expect from powerline networking.

When you try to use as much bandwidth as you can, they fail in sometimes spectacular ways. I have some old Radio Shack 10 Mbps ones that have brought a high end Juniper to its knees when the Radio Shack box's "collision" LED was fully lit. Newer devices do better, but it's best to just use powerline networking for things that need steady, continuous traffic.
You're the one claiming no value - what about those theses makes you think they have no value?

What rebuttal to the works do you have?

Many seemingly useless theses turn out to be prescient and valuable decades or even centuries later. What evidence exists to suggest these won't have long term value?
Grad school is a money loser in CS for people from the US. There's no argument. But I did end up having my net worth increase over the course of it, and it was a fantastic experience. In Boston, even - a pretty HCOL area. And in the end, being "rich but less rich than my FAANG friends" isn't the worst outcome. :)
you can still download mobi files all over the internet and transfer them onto your kindle

Right, but where did the first copy of each of those files originate?
Can someone set up an independent IRB that you can use that is more of a UL-style IRB?
Medical device research to reduce risk (liability)
Agentic AI companions created with a game engine in the browser [video]
Optimal boarding speed-wise does not align with the limited overhead bag space. So you get the priority system we have today.

Premium fliers would never go for the trade of “you get to pick between having a guaranteed overhead bin slot and sitting at the back of the plane”.
Totally agree that AI is going to have a huge impact on security of languages, and will change many paradigms.
You're imposing your own rationales on top of CH, not expressing his own.

He expressed complete opposition to having Rust anywhere in the kernel at all, including places he doesn't maintain. He was opposed to any other maintainer deal with Rust for him, even though Robin Murphy (who is already a reviewer on the DMA side) expressed willingness to do so. His initial replies were an exercise in goal-post-moving.

https://lore.kernel.org/rust-for-linux/2b9b75d1-eb8e-494a-b0...

You're making excuses for stuff that does not really need to be excused.
definitely didn't have that on my bingo card today
“The majority of those who consider themselves a member of an underrepresented or marginalized group in technology identify as lesbian, gay, bisexual, or otherwise non-heterosexual. The second most selected option was neurodivergent at 46% followed by trans at 35%.”

Out of 14.5% of the respondents. I wouldn’t call that a very anything community.
"Distraction Free Writing" with pic of rainy background - would be pretty if this is animated!
That's not what I'm talking about. I'm referring to songs you know intimately enough that you can sing a capella (or at least hear in your head) in the right key. Edited original comment for clarity.

This might not be something you personally can do, but for those who have memorized a song in that way it's a convenient way of demonstrating that perfect pitch isn't as unattainable as it might seem.
what's your definition of piracy?
And like the rest, presumably made in China.
It depends on the utility company. Some are better than others.

The grid is a utility. They weren't originally built with the idea of customers sending power back at a small scale. So it's tricky to maintain power fluctuations when you have all these extra data points. Plus considerations for the quality of consumer hardware. So naturally companies would prefer to have solar installations at scale as opposed to by residential basis.
> Rust Derangement Syndrome

Thank you for proving me so right so readily.
I've been quite happy with my Kobo and the choice to avoid the Kindle/Amazon walled garden.
ComEd, the main electrical provider in northern Illinois, actively encourages homes and businesses to install solar power and offers net metering to solar-equipped customers.

https://www.comed.com/smart-energy/my-green-power-connection...
And it's in a context where some group of people with special power is acting in bad faith to avoid having to follow the rules, and setting up "us vs them" arguments to do so!
does anyone remember MyWay or Neoplanet?

the former was a website / pre-social-media-but-like-it site, with an email service, iirc, and the latter was a web browser.

I used them for a while, I thought they were good for a while. after that I don't remember what happened. they probably shutdown sometime later.

but they were interesting at the time.
What sensor would you recommend? I have tried Apple Watch and i really only care about the heart rate. But it doesn't poll the heart rate constantly unless in exercise mode. I wish I could just constantly track the heart rate every second.
No, I'm assuming there's a tradeoff between sensitivity (spotting cancers) and specificity (having your positive results actually be cancer).

ANOVA to pick variables and then reasonably selecting thresholds is a fine process that avoids overfit.

The big problem is, biology is messy and measuring lots of people to find correct thresholds is really expensive and time consuming. It's not really a technological problem, though technology has helped a little.
I don't know about Python specifically, but using a language I'm familiar with to generate ninja files (+ any header/environment/&c) for the build has become my go-to way of doing builds in the past 18 months or so.
Positive about the general idea, I hope it works out.

> Also, my first image had no bounding box at all.

Me too.

> "Swipe right if the red shape is correctly outlining a building. If not swipe left"

Rather confusing on a laptop which was showing "Correct" and "Incorrect" buttons.
Trying to understand Privacy Pass here.

My understanding is, it's analogous to writing a note to your manager.

That note is a random number written in ink your manager can't actually read; all they can do with that note is sign it. They ask God (used here to represent math itself) how to sign this note, and God gives them a unique signature that also theoretically cannot be used to calculate the number that's written. This signature also proves what you're authorized to do. And then your manager hands the note back to you.

The note's sole function past that point is so you can point to the signature thereon and say "this signature proves I can do this, that, etc."
i don't think anyone on the asahi team doesn't know that there are missing functionalities. if they're dealbreakers for anyone, fine.

what's out of line is incessant reporting (via issues, emails, whatever) of what you consider a dealbreaker. that's my impression of what he's complaining about. let the people work. no one likes to respond "not yet" a billion times.
I think it's hard to argue that Cargo.toml is any simpler than Python. Json might be ubiquitous enough for anyone to read and understand, but if Python is foreign than toml is no better.
Hyperbound (YC S23) Is Hiring a Founding Full-Stack Engineer in SF
It will be great to see Del Naja defend his trademark
This is one of the best explanations I've seen for this phenomenon.

If you try to build a network of paid users, you lose because you'll be run over by 'free' competitors monetizing indirectly.
Even then there's an analog hole at the neuron interface unless we just install decryption algorithms in the brain directly
> No they don’t. Just like everyone doesn’t know Cobol, Fortran, Scala etc.

Sure somebody might not have Python experience, but it's pretty easy to just not hire someone who says they don't know Python and isn't willing to learn for the role. I don't know that you'd filter out many candidates out of any random 100 devs.
In any major city in the US, you should be able to traditionally make six figures within three years at most with maybe a job hop.

This is your standard enterprise company - not even BigTech.

It’s currently a shit show now for anyone trying to get a job in CS with every opening literally getting up to 1000 applications a day.
It just uses GDI_CLASSIC for DWRITE_MEASURING_MODE [1] and DWRITE_RENDERING_MODE [2] in that case. No actual GDI in sight.

[1] https://learn.microsoft.com/en-us/windows/win32/api/dcommon/...

[2] https://learn.microsoft.com/en-us/windows/win32/api/dwrite/n...
It’s true, but I can see why you’d be confused. You conflated what the economy rewards (which is what caters to the large middle class pool of money) with what individual companies try to optimize for (eliminating labor costs).
Love how people can be openly hostile towards me on this website, and I get downvotes and misdirected frustration for pointing it out.
I'd love it if the BAT / Flattr / Coil style idea actually started working. Flattr failed to get attention from the actual users, but it could be revived to pay the website creators from "indirect visits" like using their content in phind or perplexity. (in addition to continuing the direct payments)
It seems there should be a way to identify "those abnormal people" so that we can keep our children away from them? We wouldn't want them polluting our kids with subversive ideas about gender that are not accepted canon. I don't know, maybe they could wear something? Like maybe a yellow star or something like that?
My assertion that network isolation is opt-in is based on the fact that the --sandbox_default_allow_network defaults to true[1]. That suggests actions will have networking unless they are dispatched with `block-network`[2].

(It's hard to figure out exactly what's going on based on the documentation and some crawling around, but I wouldn't be surprised if specifically tests defaulted to blocking the network.)

[1]: https://bazel.build/reference/command-line-reference#flag--s...

[2]: https://bazel.build/reference/be/common-definitions#common.t...
Right, so I'm not confidently predicting the end of software security (I'm "optimistic" about its relevance, in the same way you're pessimistic about the long term security of software). But drive-by clientside exploits are a particular kind of software security problem, and that one, I do see the light at the end of the tunnel (and also a prolonged period of 7-8 figure exploit premiums).
Hello there,

Any idea why Microsoft didn't use this in WSL1 or 2?

Is it more efficient than hyper-v with hardware acceleration?

Can you see it being useful again? Or does it make sense to have a hybrid where the code runs using hardware acceleration but the timers are cooperative?
What does it even mean to "build" Python?
i believe you re talking about financial secutiry after the Phd, not during
I agree! 1,999 more data points would be better than two, but that seems like a weird number to choose.

You might be a statistician, but I'm also assuming you're human, with messy emotions (I am too). Two data points, even if they're really close and personal for you, is still only that, two data points.

I'm sure I'm going to find complaints. People aren't incensed and go online and post "hey everything's fine and went smoothly and I had no problems" when that's the case, they only do that when they're angry about something.

I don't have a Monzo account but I've been on the Internet long enough to recognize that bias, in myself, and others.
I agree. I also wish it was possible to run multiple queries in the same window e.g.:

select * from crime_scene;
select * from suspects;
took me 3 years, started in 1999, was making 6-figure salary in 2002
Because this is ostensibly illegal, and it would be nice if someone enforced the fucking law (H1Bs must be paid the market rate, and it's supposed to be enforced by the Department of Labor). But the entirety of US government apparati are geared toward helping big corps make money. It's just a question of which big corps (modern Democratic party is soooo captured by Big Tech).

Of course, one of them also supports fascism; I'm not "both sides"ing.
generally "living wage" in these contexts also covers like, a house and being able to take care of dependents + maybe a partner?

Which is generally above poverty levels right
Do you understand the difference between “how much” and “does it”?
https://archive.is/MJyhB
I know I’m just one guy, but lack of Monero support kept me away.

This feature looks like it narrows the gap a bit though.

Nice work
pink triangle: https://en.wikipedia.org/wiki/Pink_triangle#Nazi_prisoner_id...
Ask HN: Where to find developer mentorship outside of dev space?
I've been dabbling in tech and development for over 20 years. I am a self-taught programmer, that eventually completed by BS:CS, that has always studied development books on craftsmanship, data structures, specifics of different languages, and the works.

I've had spouts of freelancing here and there on small projects, but my career took me in a different direction with a whole assortment of different job titles: military, avionics, managing contracts, facilities management, stationary engineering, CAD work, project management, and IT services management. I have been in leadership roles on an acting basis as needed, but have never really felt a calling to go down that path.

By metric of performance reviews and promotions, I have excelled in all of my positions, mostly in part of my ability to leverage software development and my technical skills as whole. I have always leveraged programming to streamline processes and make my organization more efficient. However, my job titles have never directly reflected my software development skills, making it challenging to transition into a formal developer role.

I have gone in and out of periods where I think about "starting again" so that I can be a developer on a real development team, with the title and all of the fame and glory that come along with it (I'm trying to throw some humor in here). For the past week or so I have been trying to put together a boilerplate resume+cover letter package that articulates what I can do, and how I've used these skills in the past to be of value. I’m looking for advice on how to effectively showcase my experience to hiring managers, am open to some certifications that could validate my skills, and suggestions on impactful personal projects to build a strong portfolio.

As I've let me career lead me far away from the developer world, I don't have any network at all in this space. Are there are reputable services or anyone that does this for a living that would be willing to take a peak at what I've put together and give me their opinion on where I could improve to give myself a shot? I am realistic in this pursuit and realize I am looking at junior-levels spots here, and will earn less than I make now in the beginning, but I sincerely do think I can provide a lot of value and just need help and advice as to whether or not I am articulating that well or not. Thank you!
Genuinely curious: why downvote this idea?
Big Tech implements and advocates a strange concept of "privacy" where the sender's data unnecessarily going through Big Tech and/or selected CDNs (collectively, third parties) instead of directly to the intended recipient does not violate privacy... and, according to the Silicon Valley spin, this somehow "increases" privacy.

The concept of privacy from Big Tech and partner CDNs exists. But for these companies, generally computer users are not the customers. They are commercial surveillance and ad targets.

It is purely a coincidence, no doubt, that these companies providing "privacy" services are in fact far the world's greatest threats to and violators (or potential violators) of computer user privacy. As always, it is assumed the computer user will be too naive to notice the absurdity of this arrangement.

Google has already been caught fraudulently promoting "Incognito" as "private" and chose to settle with plaintiffs rather than prove they not misleading computer users. Why would anyone trust Google a second time.

https://s3.documentcloud.org/documents/24527110/google-unopp...
It's just about the best Internet-related money I spend. I get fast, quality results on a service that doesn't obviously bend over backwards to monetize me. Ironic, in a way. I thought it was spendy at first, and now I can't imagine cancelling my subscription.