skysight-inc/HackerNews huggingface dataset:
I did read the post. The documentation of the product does explain how to use it, so it is unfair to blame the product in my opinion.
They are so identical, there's code in the GitHub runner to search and replace "Azure DevOps" with "GitHub Actions" in log output on the fly.

The entire code is a wonderful mess. We found that when we early-adopted ephemeral runners, that the control flow is full of races and the status code you get at the end is indicative of exactly nothing. So even if the backend is just having a hickup picking up a job with an obscure Azure error code, you better just throw that entire VM away, because you can't know if that runner will ever recover or has already done things to break the next run.
The solution was found by the author, and is covered in GitHub actions documentation.
Used to use GH actions quite a bit. At my current company we set up RWX Mint (rwx.com/mint) and haven't looked back. (disclaimer: used to work at rwx but no longer affiliated)
'More than a hint' that dark energy isn't what astronomers thought
I worked at companies using Gitlab for a decade, and got familiar with runners.

Recently switched to a company using Github, and assumed I'd be blown away by their offering because of their size.

Well, I was, but not in the way I'd hoped. They're absolutely awful in comparison, and I'm beyond confused how it got to that state.

If I were running a company and had to choose between the two, I'd pick Gitlab every time just because of Github actions.
GitHub Actions is like Microsoft Teams. Nobody who knows better wants to use it, but it's slightly better than what most did before (email/jenkins/nothing) and came with the thing you're already using. At least your boss thinks it's better. And it's such a good deal!
Some taller apartments I've seen are built with steel frames on the first few floors, then concrete above - is termite resistance the reason?
Check out https://pure.md for a REST API version of this
Xfinity Was Hyping 10G Internet in 2023. But What Was It and How Do You Get It?
I have my whole unraid server backed up using Backblaze's windows backup tool / subscription.

There is a docker container for running the backup app, so it can be setup on a standard Linux desktop as well I believe. You just need to mount the storage you want backed up into the container as another drive and then you can configure the backup software in the fake window environment to back up those drives on "your PC" in the container.
xfinity is still comcast. and comcast sucks
You are misinformed: https://news.ycombinator.com/item?id=23987584
I have yet to see a sci-fi scenario where the extra-terrestial super-intelligence considers us just a food source.
So this paper estimates increases in metabolic activity of between 5 and 7 percent. I was curious about how big a deal this might be, and in the discussion they claim that southern otters are potentially energetically stressed, linking to a single 2016 paper which was based entirely on freshly washed up dead otters. There are a lot of studies involving marine associated organisms that rely on opportunistic carcasses, but I have a pretty consistent issue with all of them: you are selecting for the animals that died. The problems with this, especially when the topic is something like energetic stress, should be obvious.

Southern seat otters are only present in a fraction of their historical range, and those places are among the most productive on the entire western coast. Food for otters is abundant, and studies have shown that otters eat a very wide range of foods (although individuals tend to specialize on only a subset).

This is an interesting study, and I am even willing to believe them when they suggest that their estimates are likely to be lower bounds, but I'm not very convinced that the levels of disturbance are particularly ecologically relevant.

When a population of apex predators is as dramatically reduced as otters are, in ways that affect the rest of the ecosystem to much lesser degrees, food and energy limitation are very rarely issues.

I wouldn't go so far as to say that this is for sure not an issue, but I would want to see much stronger evidence than has been provided by the literature so far.
Yeah, I was going to ask whether this was, effectively, a share buy-back or something along those lines. No other explanation makes sense to me, other than some revelation about Grok v3 suddenly greatly outpacing competitors (which I haven't yet been informed about).

It almost feels like some kind of posturing the legitimise the 'slash and burn' of employees that was instigated at Twitter to make the DOGE shambles more palatable. ie:

"See, it all came back to the same value even after cutting 80% of the workforce. We're back to where we were beforehand. It's fine. This is fine."

Edited to add: there appears to be a brigading going on in the comments, unless it's just an indicator of NY Posts readership - I'm out of my element there.
I love this, thanks for sharing.
Yep, I've run into every one of these issues in my time working with the CI. It's still leagues beyond the old Azure DevOps pipelines or god forbid, Jenkins.

I think incremental progress in the CI front is chugging along nicely, and I really haven't seen any breathtaking improvements from other solutions I've tried, like CircleCI.
I take it as a lesson not to be an early adopter for security tech.

Applies to cryptography, authentication and so many things.
78 percent of statistics are made up on the spot.
does anybody in this thread actually know what skeet means? i’m laughing as well at the idea of a bunch of people thinking they’re getting back at twitter by skeeting on the internet.
> A few days ago, someone compromised a popular GitHub Action. The response? "Just pin your dependencies to a hash." Except as comments also pointed out, almost no one does.

I used GitHub actions when building a fin services app, so I absolutely used the hash to specify Action dependencies.

I agree that this should be the default, or even the required, way to pull in Action dependencies, but saying "almost no one does" is a pretty lame excuse when talking about your own risk. What other people do has no bearing on your options here.

Pin to hashes when pulling in Actions - it's much, much safer
> I miss the days of having 255 friends on AIM, trout slaps on well-populated mIRC channels, and never-ending threads on niche Ultimate Bulletin Board forums.

Yeah me too. Another comment (https://news.ycombinator.com/item?id=43409370) expresses a similar dismay at the lack of really engaged discussion.

I have a theory that this phenomenon is largely the result of smartphones and the concomitant constant connection to the internet. Paradoxically, being always connected has made it harder to connect.

It used to be that in order to participate in a real-time conversation, you had to be sitting at your computer. You were ready to chat. You would chat with other people who were also at their computers ready to chat. When you were done you would put up your away message and re-enter the real world.

If you wanted to post on a bulletin board or some other non-real-time forum, again you had to be at your computer. You would post what you wanted to post. When you left and came back later you would check to see if anyone replied and you'd be excited to read their comments. (LiveJournal is the thing that sticks in my mind for this; it was big when I was in college.)

Now, instead of being either online, ready to engage, or offline, engaging in person, people are always half and half. Also, smartphones have driven the proliferation of "notifications", which then have been abused by apps to the point where people are constantly deluged with so many notifications that they can't distinguish the ones they might actually care about. (I've had glimpses of this when I use someone else's tablet or phone for some reason.) Since everyone is assumed to be always reachable, there's no perceived need to say "bye" or indicate when you are temporarily not paying attention to a sync interaction, so those interactions come in unpredictable spurts. And since everyone can always check everything from their phone, responses in async interactions are often dashed off haphazardly. So we get a sort of worst-of-both-worlds mix of sync and async.
Interesting. I‘m also moving our CI to GitHub actions after years of using Jenkins with custom pipelines written in groovy etc. I checked out GitHub actions every now and then to feel if a move finally makes sense. I started with simple builds then tested adding our Jenkins macOS agents as self hosted runners. Just yesterday I wrote two actions to build and test a new .net project. I was able to run the whole thing with „act“ locally before running it on GitHub proper. I also played around and created a custom action in typescript (kicked off from the available predefined templates) to see how much work maintaining that means. All in all I‘m super happy and see no bigger issues. But here are some things that might be a reason:
I split CI in build system logic which should and need to run locally and just stuff that GitHub needs to execute. At best that means describing what runs in parallel, and making specific connections. Any complicated logic needs to be abstracted away behind a a setup that is itself testable. I handle it the same for our build system components. We use gradle a lot and of a few custom plugins which encapsulate specific build / automations. It’s like dividing your problem into many smaller pieces which are tested and developed in isolation.

Next to json I also used travisCI and appveyor for projects. And they all had the same (commit and pray) setup that ai hate. I wish if „act“ was a tool directly maintained by the GitHub folks though.

https://github.com/nektos/act
It’s a little known fact that x86 is literally Athena! Which I guess means Intel should be casting some lightning bolts towards AMD and others.
That leaderboard is not for a coding use case -- just general chat.

Click on the web dev leaderboard they have and Claude has the top spots.

It is well known that Claude 3.7 sonnet is the go-to choice for many people for coding right now.
Whenever I get mad at GitHub Actions, I refer to it by it's true name: VisualSourceSafe Actions. Because that's what it is, and it shows. If you check out their Action Runner's source code[1], you'll find the VSS prefix all over, showing it's lineage.

[1] https://github.com/actions/runner/blob/6654f6b3ded8463331fb0...
GitHub Actions may cover this stuff in the documentation but it's still difficult to use. That means the product could be designed better (and the documentation could be easier to follow.)
In reality Biden did more about overdoses than Trump did - the rapid increase in overdoses occurred firmly within the first Trump term, and only slowed and levelled out in response to Biden policy changes.

The raw CDC stats tell the story.

The age-adjusted rate of drug overdose deaths did not significantly increase from 2021 (32.4) to

2022 (32.6).

In contrast, rates have significantly increased in most previous years.

From 2019 to 2020, the drug overdose death rate increased 31.0% from 21.6 to 28.3, which was the largest annual increase over the period 2002–2022.

~ https://stacks.cdc.gov/view/cdc/135849
> I think for someone who hasn’t seen the material at all before it would be a lot for a semester. They don’t know what backpropagation is but by the end will understand a diffusion model? It’s ambitious, I think.

Welcome to CMU :)
The 'attack' there does require you to be able to run code and test within a single process with a single randomized address space, which is the exact vector that the web browser provides.

Most times in C, each fork() (rather than thread) has a differential address space, so it's actually less severe than you think.
Foreclosing on a house probably means you are not going to buy another one for a while
One thing I found useful was writing a runner for giteas actions CI which is similar to GHA. When you dig down and ask "what is ACTUALLY happening to run this job" then a lot of things such as the docker entrypoint not being modifiable make perfect sense.
> "The class itself is very well structured. I've heard about STPA in past years, but this was the first time I saw it explained with concrete examples. The Google example at the end was also really helpful."

But the article itself contains no concrete examples.
My team uses GitLab and most other teams are on Azure dev ops. They keep trying to get us to switch telling us how amazing pipelines are. Glad to know we are not missing anything.
This would have been a lot more compelling had they provided a single real-world example of STPA actually solving a reliability issue at Google.
I can relate to this pain. Isn't gitlab CI better at this especially the documentation and simplicity of it?
Unrelated tangent, but $300 for non-commercial use with limited features... wow!
I wonder if the complexity of fixing trivial code mistakes in CI is worth it compared to catching them in a pre-commit hook.
... So where's the training or examples of application?
Why downvote me because there is discourse?

Could we not usually say most software could be documented better. I do not think GitHub Actions ranks near the bottom in terms of documentation and user experience overall. I do understand your point though.
Paragon's zero click attack spyware operations
>Jews don’t consider themselves evil

For the record I'm not saying that Jews are evil, but if they happened to do any wrongdoings or evil deeds, for example worshipping other fake god in the form of false deity/human/cow/idols/etc beside their one true God they'll be punished accordingly whether in this world or hereafter, or both. This fact is mentioned in Jewish own holy books including Torah and the Bible namely Old and New Testaments (Jesus is a Jew speaking Aramaic - an Arabic like language spoken around Jerusalem during Roman time). This universal God's rule is also applies to Muslim and everyone else as far as Muslim are concerned.
Unless I’m missing something, that’s quintiles of absolute wealth. I’d be curious how the data shakes out for the lowest quintile calculated relative to costs of living.
What kind of binary do you run Kokoro with for audio output
It's always wild to me that anyone actually uses reddit by looking at the front page or r/all or whatever. For years when I would go to reddit.com I was like "why is this even a thing". It's only once I found a few small subreddits that I found anything useful there. Most of it is a firehose of garbage.
This is peak corporate drivel—bloated storytelling, buzzwords everywhere, and a desperate attempt to make an old idea sound revolutionary.

The article spends paragraphs on some childhood radio repair story before awkwardly linking it to STPA, a safety analysis method that’s been around for decades. Google didn’t invent it, but they act like adapting it for software is a major breakthrough.

Most of the piece is just filler about feedback loops and control structures—basic engineering concepts—framed as deep insights. The actual message? "We made an internal training program because existing STPA examples didn’t click with Googlers." That’s it. But instead of just saying that, they pad it out with corporate storytelling, self-congratulation, and hand-wringing over how hard it is to teach people things.

The ending is especially cringe: You can’t afford NOT to use this! Classic corporate play—take something mundane, slap on some urgency, and act like ignoring it is a reckless gamble.

TL;DR: Google is training engineers in STPA. That’s the whole story.
Glad I’m not the only one. GitLab runners just make sense to me. A container you run scripts in.

I have some GitHub actions for some side projects and it just seems so much more confusing to setup for some reason.
Previously: https://news.ycombinator.com/item?id=43411846
This administration’s response makes them seem terrified of one woman who participated in athletics at this school?
That will return 1. The defered code is executed after the return value is computed. This lets you do things like:

char *str = foo();
defer { free(str); }
return strlen(str);
I think that all of these tools need LSP support- like the author mentions at the very end, but they also need DAP support.

I still almost never see anyone using breakpoints / expression evaluation with LLMs. Feels critical to me.

Really excited about the evolution of these tools. I think LSP + DAP will be huge.
And thus unusable for most things 3D models and scenes would be used for today.
>RISC-V spec says that they decided to not add overflow trapping because it is "easy" to do in 3 or 4 existing instructions.

It is not just "easy" to do, but actually easy to do, without quotes.

And much, much easier than as an exception/trap.

And it is explicit, which makes it even better. No hidden behaviour.
Looking at some packages that I maintain, I think the sizes might be off, but I'll have to dig in more later.

I wonder if it's handing export conditions properly? We have browser, node, developer, and types exports. Are the files behind quadruple counted?
There are various results that suggest that LLMs do internally have everything they'd need to know that they're hallucinating/wrong:

https://arxiv.org/abs/2402.09733

https://arxiv.org/abs/2305.18248

https://www.ox.ac.uk/news/2024-06-20-major-research-hallucin...

So I don't think it's that they have no concept of correctness, they do, but it's not strong enough. We're probably just not training them in ways that optimize for that over other desirable qualities, at least aggressively enough.

It's also clear to anyone who has used many different models over the years that the amount of hallucination goes down as the models get better, even without any special attention being (apparently) paid to that problem. GPT 3.5 was REALLY bad about this stuff, but 4o and o1 are at least mediocre. So it may be that it's just one of the tougher things for a model to figure out, even if it's possible with massive capacity and compute. But I'd say it's very clear that we're not in the world Gary Marcus wishes we were in, where there's some hard and fundamental limitation that keeps a transformer network from having the capability to be more truthful as a it gets better; rather, like all aspects, we just aren't as far along as we'd prefer.
> "there is a lot of racial prejudice when folks criticize the “poor craftsman” of modern construction workers compared to those of past generations, as they more often tend to be Latino workers these days."

This is nonsense. The reason people say nearly all modern construction and manufacturing sucks is because the primary focus is on reducing costs and increasing production efficiency/speed. Something that needs to be replaced sooner is also seen as a benefit rather than a problem - planned obsolescence.
https://thephd.dev/_vendor/future_cxx/technical%20specificat...

Right, there's a demonstration of GP's question (or a variation) on page 10 of the draft technical specification.
I'd guess Canada given latitude and the fact that both formats were given.
I do see one example at the bottom of https://www.usenix.org/publications/loginonline/evolution-sr.... But I'm not sure it's particularly compelling?
Ha ha I wrote that. Many years ago.

Though really it’s just Nick Gammon answering questions so actually he wrote it.

GPascal is an amazing feat of programming and if Nick had been more commercially driven it might have been the basis of a big company.
Usually if you’re using it, it’s because you’re forced to.

In my experience, the best strategy is to minimize your use of it — call out to binaries or shell scripts and minimize your dependence on any of the GHA world. Makes it easier to test locally too.
what you're missing is that the demand curve for housing is basically a vertical line. most people will never buy/rent more or less than one unit of housing, and they will pay literally anything to keep it from being less. therefore even if there is a surplus of supply there isn't a competitive market.
Related

Spyware maker Paragon confirms U.S. government is a customer (20 points, 1 month ago) https://news.ycombinator.com/item?id=42938665

Italian journalist targeted by Paragon spyware (3 points, 1 month ago) https://news.ycombinator.com/item?id=42929075

Paragon Graphite is a Pegasus spyware clone used in the US (173 points, 2 years ago, 61 comments) https://news.ycombinator.com/item?id=36135241
We recently had a developer -- while trying to debug container builds for a version upgrade for a PR on their local branch -- accidentally trigger a deployment of their local branch's docker container to production (!) while messing around with Github action workflow files in their pull request (not main).

Outside of locking down edit access to the .github workflow yml files I'm not sure how vulnerabilities like this can be prevented.
You've read too many cheap spy novels.
Posted because upenn has a lot of cool computer science resources. Sad and short sighted that they are pulling funds.
I must admit, this is quite exciting. Serious people are starting to ask some questions.
And we already know what kind of answers Elon will give - the same that Wirecard and Enron CEO's gave !

(The author of this article, is not a random guy)
That would justify the major objection coming from Secret Service, for sure. So we’re left wondering: how did Musk describe this to Trump? Was someone else in the room to offer an alternative, more patriotic view?
Show HN: UX Ninja – LLM Generated UX and SEO Analysis
I built UX Ninja to help startups and devs like me optimise websites affordably—automated UX and SEO analysis for just $5. It generates detailed reports with actionable insights in minutes, and I’m giving away free discount coupons (expires tomorrow) for the first batch of users to try it out.

Please use the code `HNLAUNCH` to try out. https://uxninja.io

Would love your feedback!
Ampere is still the only people making a decent purchaseable ARM server. Not loving the idea of there being a bunch of new debt hovering over them now.
Comedy factor.
GHA is full of such obure behaviours. One I recently discovered is that one action can not trigger another:

If one action pushes a tag to the repo, `on:tag` does not trigger. The workaround apparently is to make the first action push the tag using a custom SSH key, which magically has the ability to trigger `on:tag`.
Unfortunately people will use --no-verify to bypass hooks.
Loops in C introduce a new lexical scope, so the defer runs once for every loop iteration.

Assuming you are using defer for destructor purposes, and use it where you declare your variable, this would generally be what you want, as it frees the memory at the same time it goes out of scope.

The flip side of this is that code like the following would be broken:

char *foo = NULL;
if (true) {
foo = calloc(1,1);
defer { free(foo); }
}
char c = *foo;

As foo gets freed at the end of the conditional, which is prior to the dereference.
Monogamy and rules about adultery is just about keeping a lineage clearly identifiable and unambiguous, mostly for property / inheritance reasons.
Genuine question: what's the GitLab equivalent of GitHub Actions?

I'm using GitHub Actions to easily reuse some predefined job setup (like installing a certain Python version on Linux, macOS, Windows runners). For these tyoe of tasks, I find GitHub actions very useful and convenient. If you want to reuse predefined jobs, written by someone else, with GitLab CI/CD, what can I use?
I know, people felt like eggs were too expensive and brown people were getting too much of a free ride so they voted to burn the country down.

The grand summary of America 2025. I don't think anyone has said it better than that in all of media. They gymnastics people run to avoid that simple truth just reveals their rotten core.
Show HN: I Built and Ran a DIY Transcription Service from My Home