skysight-inc/HackerNews huggingface dataset:
You could reframe the way LLMs are currently trained as energy minimization, since the Boltzmann distribution that links physics and information theory (and correspondingly, probability theory as well) is general enough to include all standard loss functions as special cases. It's also pretty straightforward to include RL in that category as well.

I think what Lecun is probably getting at is that there's currently no way for a model to say "I don't know". Instead, it'll just do its best. For esoteric topics, this can result in hallucinations; for topics where you push just past the edge of well-known and easy-to-Google, you might get a vacuously correct response (i.e. repetition of correct but otherwise known or useless information). The models are trained to output a response that meets the criteria of quality as judged by a human, but there's no decent measure (that I'm aware of) of the accuracy of the knowledge content, or the model's own limitations. I actually think this is why programming and mathematical tasks have such a large impact on model performance: because they encode information about correctness directly into the task.

So Yann is probably right, though I don't know that energy minimization is a special distinction that needs to be added. Any technique that we use for this task could almost certainly be framed as energy minimization of some energy function.
Credifi – instant credit line in DeFi – unsecured loans without collateral
hello all, wanted to introduce credi.fi, you can get an instant loan from 100 to 5000 USDC. all you need is a bank account in USA or canada.

check it out at credi.fi and let me know what you think!
https://www.abc.net.au/news/2017-12-30/malcolm-turnbull-fine...
The version numbers aren't immutable, so an attacker can just update the versions to point to the compromised code, which is what happened here. Commit hashes are a great idea, but you still need to be careful: lots of people use bots like Renovate to update your pinned hashes whenever a new version is published, which runs into the same problem.
1% was higher than I’d have guessed for transgender people.

It turns out the figures are rounded in that graphic because the source article [0] (posted by another commenter) has it at 0.6% (which is likely rounded too).

Interesting when you consider how much certain topics seem to dominate current political discourse.

[0] https://today.yougov.com/politics/articles/41556-americans-m...
It's just a case that nothing can be done about it. They can protest about it, but a European, Japanese, Chinese, or Russia company will just continue oblivious that there even was any protest.

Commercial creatives have to accept it is happening and adapt.
For an example of a scary list of such offers, see https://github.com/extesy/hoverzoom/discussions/670
I've noticed at several Thai restaurants in the Portland area that we are the only or almost only customers in the restaurant. There's a steady stream of Door Dash, Uber Eats, etc. drivers picking up orders.

I haven't noticed it as much with other restaurants. Maybe Thai (and other Asian) dishes hold up well because the topping is typically kept separate from the rice?
Chevron advances plans to develop US data centers with power generation
It's an easy fork maybe, but where's the incentive to stand up a peer or replacement? They're made a paradox for themselves, in attempting to create adfree social media that moderates itself the userbase now expects the service to be free and ad free and heavily moderated by volunteer labor. This will work for a while spending millions in VC cash but I don't see the sustainability.

I've considered standing up a PDS a few times, and I think if I was going to design a financial incentive I'd wrap up a static blog host and personal cloud storage so I could charge a market rate fee (5 bucks a month for 100GB storage, whatever Dropbox is charging) and bluesky publishing and following just tacked on as a value add.

the real money would be in extending the protocol to support distributed marketplaces, so hosts could each have their own rules - disrupt Etsy, eBay, Facebook marketplace, but at some point you're getting into Silk Road 3.0 territory
That still doesn't help when the action is a docker action only marked with a tag.

So you need to check the action.yml itself to see if it has a sha256 pinned (in the case it uses Docker).
There is no law of economics that says that a society must improve. It is entirely feasible for capital to concentrate to the point that the productive classes are no longer able to produce due to lack of surplus investible capital.

The reason why these systems are not fixed is that it does not make sense to hire the engineers to fix them, the customers lack the money to afford the improvements.
People were surprised that the cost of federal civil service employees was only around 5% in the early DOGE discussions here. They were expecting 20+%. SSA which pays about 70 million people is just over 21% of the spending so far this year, and there are only 2.3 million civil service employees. For civil servants to cost as much in salaries as social security pays out would require them to be paid nearly $800k/year on average.

People are just bad at estimating, and apparently none of the ones making the absurd claims know (or their listeners/readers don't know) that all this data is publicly available.
My day job is also in the middle of moving everything to Github Actions, so this is fun. But in my case, we aren't affected by this vulnerability because it could only be exploited by workflows with public logs, and currently my company only uses Github Actions for private repositories.
I work in consulting. The best bet is not to work for the government. But to work for a consulting company that contracts with the government. You will get paid more. I use to work for a consulting department that focused on the public sector.

Mark Cuban has the same idea

https://qz.com/mark-cuban-elon-musk-doge-shark-tank-business...
I moved back to the USA, SF in June 2021. I stayed with a friend and parnter for 5 days. In those 5 days they ordered via doordash for ~8 meals (lunch and dinner).
Original source: https://www.reuters.com/business/energy/ceraweek-chevron-adv...
It doesn’t reset underneath them.
what in the scam is this nonsense and horrible looking website
Not when the right they want is impossible to enforce.
The solution for trusting dependencies is signed public builds and ML 'weirdness' detectors that require manual review.
Vouched. The original article though is at [1]

It surprised me that lightning has dropped off that much for use of a low sulphur fuels. I was aware though that at times satellite images of the ocean capture the paths of ships due to the line of clouds that form behind them as they travel.

[1] https://theconversation.com/the-world-regulated-sulfur-in-sh...
Options are almost never the right solution
Good riddance. We The People will continue to build open and decentralized/anonymous platforms that don't spread government propaganda.
And they can't press buttons in the elevator. I don't think any delivery service will take off in a city if people have to leave their apartments.
I think at this point it's a quasi Stockholm Syndrome for me, because I've grown to genuinely kind of like it.

I started making my own packages for Nixpkgs, and I have made dozens (maybe hundreds) of flakes, so I'm just kind of used to the language now. It's an ugly language, but once you write a lot of it, you get used to its quirks.

And there are some niceties, like being able to define a variable and use that variable to access and define fields, kind of like JavaScript:

{
blah = {
${myVar} = "something";
};
}

It's kind of fun to do that, because you can use something like flake-utils that lets you loop through all the platforms that Nix supports and reuse your structures.

Otherwise it's just kind of an awkward functional language. You get used to it.
> I think restaurants themselves are unproductive.

You think one of the staples of all commerce for basically all of time are unproductive?

I would imagine basically any form of sustainability for them has been tried. Sure patterns change; but, I mean literal millennia of food service is something to not ignore.
Imported eggs should be much higher quality. Basic American eggs taste awful.
No, I don’t know that because it is not the case.

I have sat in that library and read the NYT with a big, loud, front page headline critical of China and the CCP.

I have never seen pages missing.
Yes. But if the price is the same, it’s much easier to manage subscriptions through Apple.

Many don’t allow you to subscribe through Apple.
No one mentions it but the problem is immigration. It pushed the demand curve too high.
Pretty good timing on the attacker.

https://github.com/tj-actions/changed-files/tags?after=v35.9...

Most folks around the world signed off. B-squad probably left cleaning up remaining tasks or just fucking around with co-workers and pondering the weekend. Most GH actions run on a schedule (ie, backups of db, connecting to blob storage services).

Attacker(s) likely to extract plenty of secrets and exfil data before the alarms get triggered (if any) at companies.

The next data dumps are going to be wild.
I always use commit hashes for action versions. Dependabot handles it, it’s a no brainer.
Reddit still has an onion service but is defacto unusable
Oh no he didn’t!
Perhaps you could stick the phone and earbuds in a (non-running) microwave. They keep 2.4GHz in just fine, and Faraday cages don't discriminate based on direction.

You might have to line the inner walls with something to prevent the signal from bouncing back? I'm not sure.
there are several signs that coffee on an empty stomach can raise blood sugar and insulin levels.

It may not be a great idea for certain groups of people.
Text describes semantic space. Not everything maps to semantic space losslessly.
You can target `some/action@commithash` already, that's up to you. You're also free to fork or clone each action you use, vet the code, and consume your fork in your workflows. You can also disable the use of third party actions at an org level, or approve them on a case-by-case basis.

This all depends on your threat model and risk tolerance, it's not so much a GitHub problem. There will always be bad code that exists, especially on the largest open source code hosting platform. You defend against it because that's more realistic than trying to eradicate it.
As a kid, the only delivery was pizza and Chinese. It is odd to think it is so much like that.
Why begs the question, what is the point of captialism if it cannot maintain key infrastructure?
Bluesky in the final stages of raising new funding led by Bain Capital Ventures
I have one, its only wake word detection, microphone, and HA integration. The STT, LLM, and TTS is completely independent of the Voice box.
All I see here is the pandemic boom in hiring
Only Messages was allowed to support it. At the time it was written, for example, it was years after the Signal developers had asked for basic RCS support (2015) and given up on Google relenting and allowing it in 2018.

https://github.com/signalapp/Signal-Android/issues/4837
I'm not sure, a quick search of the specs don't mention "ratchet". But it does claim to have forward secrecy so it should be good anyway.
Why do they have to use the word “hallucination” when the model makes a mistake, if you tell your teacher or boss you didn’t get the answer wrong, you’ve hallucinated it, he will send you to the hospital.
Almost every Shell station in San Francisco, remodeled and added hydrogen refueling stations about two or three years ago. Now they sit idle or turned off.

If green energy were a money making business, the oil companies would get into it tomorrow.
This is likely to differ greatly by demographic. I don’t know literally anyone who uses SMS/MMS. The only SMS message I’ve received in years are automated services/spam.
Forced arbitration is just yet another way to limit the consequences of actively hostile business practices. I tend to think of it as the next step after modern customer service: Where modern CS is all about tiring the customer out so they don't have the energy left to raise a proper dispute, arbitration is all about preventing the inevitable occasional actually-motivated customer from receiving the publicity or having the power of a proper lawsuit. It's all about minimizing the voice of the customer, minimizing potential inconvenience for the company, and especially minimizing the company's potential liability. They want to avoid class actions for the exact same reason why Amazon wants to avoid unions, and they want to avoid lawsuits exactly because of their benefit to customers - a potential for lawsuits would wrench away some of the control that companies so enjoy using for their abuse of those customers.

While I understand that not all companies are like this... most are, especially the big ones.

So when I say the "true purpose" is to stop you from being able to sue, I do not mean that it's somehow some closely-held secret that arbitration is an alternative to suing. It's just that the widely perpetuated façade of "oh you just agree to the more convenient arbitration" is a vast oversimplification and there are much deeper and far more malicious intents behind those clauses. It is not at all the win-win that companies would have you believe; I've even unironically seen at least one company say, essentially, "arbitration is much better, and filing a lawsuit is so inconvenient that you wouldn't want to do it anyway". Yeah. It's soo inconvenient for me to cause you so much trouble. For me. Inconvenient for me. It sure is. I'm definitely the one that wouldn't want it to happen. I definitely don't like when companies pay for intentional wrongs directed at me. Definitely not.

I've been wronged by companies a lot through the years and I have exactly zero patience for exactly these kinds of terrible, anti-consumer business practices. Access to arbitration as an option is great; forced arbitration however is a trap designed to protect the company at the expense of the consumer. In other words, forced arbitration has never actually been about arbitration at all, but rather exclusively getting out of lawsuits. That is what "true purpose" means. "Arbitration" is just their "get out of lawsuits free" card; they would use any other card that would have the same effect, because it is that effect that they're after.
A toddler dying of cancer falls under the category of "natural evil" (as opposed to moral evil, in which an intention or will is involved). You're correct to say that natural evil can sometimes be difficult to explain in a pedagogical sense. A storm taking one's home can be a way to teach us our dependence on God alone, but a child being taken by cancer does seem meaningless to us at the best of times, and simply cruel at the worst.

But the story of Job (in which his family, including his children, are taken away through natural evil) shows us two ways of engaging with this kind of evil: 1) Seeing the resulting struggle with God as its own form of growth, and 2) the virtue of humility.

In my opinion, there is no "one answer" to Theodicy - it requires all three and a healthy dose of Job's eventual humility. The first has been true in my life multiple times. The second is often helpful when engaging with evil on a cosmological level. The third is helpful when wrestling with the problem of moral evil. Taken together, I think the picture is reassuring, and certainly better than the alternative (a meaningless universe of hopeless suffering).

I recommend David Bentley Hart's "The Doors of the Sea" as a good short work on this subject!
It's not an issue of sideloading or censorship in iOS. It's a product decision related to background apps (they kill the running process with no recourse to bring it up again on its own).
Oh, so “it’s more costly immediately” actually meant “it’s more costly once you’re storing over some threshold of data.” Ok. I can get behind that.

I don’t think it’s so easily observed at scale though, because at that point it’s hardly just the hdd cost anymore. It’s the hdd, server/compute, cabling, cooling, power, facilities, security, cabling, maintenance.

The TCO of data storage isn't just the drive - it just so happens that it’s still less than the cost of a drive up to some threshold. I don’t know if anyone having done a full cost model comparison. Everything I’ve ever seen assumes the data center is free.
There are absolutely reasons that we cannot capture the entirety—or even a proper image—of human cognition in semantic space.

Cognition is not purely semantic. It is dynamic, embodied, socially distributed, culturally extended, and conscious.

LLMs are great semantic heuristic machines. But they don't even have access to those other components.
That's the reality of a lot of other degrees. Looks like it finally caught up to CS degrees.
It's because a lot of "family" dining establishments went out of business and every type of "fast" establishment grew.

Over in say, Europe, the cost of commercial real estate is much lower (including more restaurants owning their own building) and governments simply covered lost revenue versus loans which enabled more full service restaurants to stay in business.

The fact is, full service restaurants are a horrible business model and most aren't priced appropriately (they should be priced much higher).
thanks for the feedback!

i totally understand the skepticism. just to clarify, credifi isn’t a scam and there’s zero risk to user. on the contrary, they get access to instant loans.

that said, i’d love to hear feedback on how we can improve the site to look and feel more trustworthy.
Fun fact, there's no N in restaurateur: https://www.ciachef.edu/blog/what-happened-to-the-n-in-resta...
I think the move away from cash coincided with COVID but was not related much.

The convenience of digital simply made cash useless (mostly).
The article you posted doesn't hint at any strategy toward monetization, and only links to a blog post from 2 years. Have they done anything besides sell domain names and tshirts ?

Also accepting investment from Bain Capital is a terrible omen.
You can combine this with a policy that blocks third party actions from being used across your organization. https://docs.github.com/en/organizations/managing-organizati...
All the version tags got relabled to point to a compromised hash. Semver does nothing to help with this.

your build should always use hashes and not version tags of GHA's
Could you elaborate on your claim that Signal is not end-to-end encrypted?
I don't grant my camera app location permissions, so the images are never tagged with gps in the first place, but I also will screen shot pictures before sending them anywhere.
"Small increases in foreign aid could go a long way"

Unfortunately, his graph of polio results would indicate the opposite.

It's similar, in my mind, to school spending in Chicago and Baltimore correlates to educational outcomes:

When the problem needs both a systemic change and broad-based endemic change, more money is not necessarily the answer.

(For Afghanistan/Pakistan, it's to counter the anti-vaxx narratives that caused the program to stall out. For those school systems, it may start with food and shelter security for students)
> Can you really say you trust all of these?

We need better capabilities.
E.g. when I run `fd`, `rg` or similar such tool, why should it have Internet access?

IMHO, just eliminating Internet access for all tools (e.g. in a power mode), might fix this.

The second problem is that we have merged CI and CD.
The production/release tokens should ideally not be on the same system as the ones doing regular CI.
More users need access to CI (especially in the public case) than CD.
For example, a similar one from a few months back https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-inj...
What about electric cars wasn't "viable" in 2003? That was the year Toyota released their all electric RAV4 in California...

Unlike hydrogen, there was already whole highly-developed system for production and distribution of electricity.

Also, you're mistaken about my "made up narrative". I'm not claiming electric cars were mass market, I'm strongly implying there were forces at work fighting against that very thing!
Eating out seems less popular in the the US right now. Everything is more expensive and there's the 18-25% tip that gets applied.

Going out to even a basic lunch with my wife is close to 50 usually for the meal.

Takeout I can tip the delivery person a little less. And keep left overs a little easier. Take out is only for being lazy, I'd still just cook and meet or beat in quality any restaurant except ones that mignt win an award or you can't do at home.
Alphabet tried to kill adblock in Chrome, so...
If this were “the solution”, then the many, many smart individuals and teams tasked with solving these problems throughout the software industry would’ve been out of work for some time now.

It’s obviously more complicated than that.

Signed public builds don’t inherently mean jack. It highly depends on the underlying trust model.

—

Malicious actor: “we want to buy your browser extension, and your signing credentials”.

Plugin author: “Well, OK”.

—

Malicious actor: hijacks npm package and signs new release with new credentials

The vast majority of dependent project authors: at best, see a “new releaser” warning from their tooling, which is far from unusual for many dependencies. ignores After all, what are they going to do?.

—

Hacker News, as usual, loves to pretend it has all the answers to life’s problems, and the issue is that nobody has listened to them.
We can always use Chromium https://www.chromium.org/chromium-projects/

This is like if Microsoft was forced to sell Edge or Apple sold Safari.

I am thinking of switching from Chrome to Brave https://brave.com/
It's always been shocking to me that the way people run CI/CD is just listing a random repository on GitHub. I know they're auditable and you pin versions, but it's crazy to me that the recommended way to ssh to a server is to just give a random package from a random GitHub user your ssh keys, for example.

This is especially problematic with the rise of LLMs, I think. It's the kind of common task which is annoying enough, unique enough, and important enough that I'm sure there are a ton of GitHub actions that are generated from "I need to build and deploy this project from GitHub actions to production". I know, and do, know to manually run important things in actions related to ssh, keys, etc., but not everyone does.
>restauranteurs

>Plural form of restauranteur

>noun

>Alternative form of restaurateur.

odd
>I think it's "toe the line", like lining up side by side with everyone else on your team.

right, but not quite: toe the line means for example standing on an athletic field right at the out-of-bounds line without letting your toes onto the wrong side of it; said about any rule-based situation, to purposely stay within the rules, indicating an individuals obedience with no implication of "testing" the rules.
Regardless of what happened during covid, the chart shows the listings have decreased since five years ago, prior to covid.
Just please stop sending the text that reads as follows, it totally destroys group chats and the amount of information conveyed in a react doesn't require quoting back the entire message, eg

Liked "I would be surprised if this eliminates green bubbles. iMessage supports many features unavailable over RCS on Android devices. These would still be disabled and Apple needs a way to indicate a degraded feature set to iMessage users."
They gotta keep the criminals out somehow. I know quite a few well to do white men with DUIs that kept them out of Canada and I can't blame Canada for it. I think any Felony will keep them from letting you in.

Which is why Trump should be banned from entering as he is a convicted felon.
Sadly for the current regime, reality has a liberal bias. I guess US based AI models will become Q-Anon nonsense spewing hatebots.