skysight-inc/HackerNews huggingface dataset:
in this case doesn't have access to "a" wherever it is...

$ landrun --ro /usr cat /usr/bin/ls | wc -l

400

executing ls (as in actual binary execution) will require --exec

$ landrun --ro /usr ls /usr/bin/

ls: cannot open directory '/usr/bin/': Permission denied

$ landrun --ro /usr --exec ls /usr/bin/

list of billions of files

note that I don't really love the --exec thingy, if it's not "on" by default it's just for sake of being explicit.

Update: there's a bug to limit "file access", which I'll fix asap.

Update2: Adding a --exec-path instead to limit executable, it wasn't the best idea to have a global --exec anyway

Update3: Have a look at V0.1.4, I think it's far cleaner now.
Vibe security.
There are various reflection crates available on crates.io, as you know.
That or edited entries. I don't have a clear idea how many you'd need to verify to even start putting trust in the data as a whole. How many people are listed? Libreoffice can only load the first 1,048,576 rows here.
> Yes! All the endings are happy and the unfinished stories are utterly fascinating.

I'm not sure the practice of mathematical research supports that all the endings are happy, but definitely all the journeys are interesting.
Such as the one Rust provides, and that Zig cannot, due to not being memory safe.
My uncle had one and he wouldn't let anyone touch it.
Your example of a model finding more performant sorts did not involve the use of LLMs. I've said multiple times on HN that I believe we need to look past LLMs for the next breakthrough in AI assisted coding. I don't believe LLMs can exceed humans in quality; they can only match humans in quality and beat humans in speed.
llm commit scanning might be an interesting approach to the oss supply chain security problem.
Those measures target the AI companies that "misbehave", a.k.a. ignore robots.txt and scrape at such high rate that websites go down. The fact that their service may be useful to someone is not an excuse.

Imagine hypothetical delivery trucks that violate speed limits in dense residential areas and occasionally hit locals. Would you want to stop them (maybe not slash tires, but fine the hell out of them)? Or would you say: "hey I really like the fast deliveries, so I don't care for a few fatalities"? Because your comment really sounds like latter.
Happy as in Halmos Tombstone
On top of this, it ruined many families when they found out person X had a different father..
Because not everyone wants to be a part of the asyncio trend.

Asyncio in Python is a poor feature that splits the language's ecosystem into 2 mutually-incompatible worlds, something Python only gets away with because it's too big to fail.

Meanwhile we've had Gevent for decades now. It gives us async that you can forget you have. Because rather than making code async, it makes the VM async.

Gevent could have been merged into CPython, but they chose explicit "structured concurrency" and the rest is history. History of sometimes moving forward and sometimes straying from the path and getting lost.

And lost Python's asyncio is. PDB, which lots of other debuggers base on, is still broken (cannot use await). The ecosystem? IPython uses asyncio internally so it cannot easily be embedded in a working async program. The only embeddable REPL I was able to find is this: https://github.com/prompt-toolkit/ptpython/blob/master/examp...... actually, it looks like someone is working on adding `await` support to PDB now, years after asyncio's first release.

Overall, lots of churn to get something (maybe) as good as Gevent, which we had in Python 2.7, or even before.

If a similar amount of effort was spent on first-class support for code hot-reloading and live program inspection, we would get a massive boost of productivity. But somehow even otherwise bright people choose to reimplement working solutions into something objectively worse, meanwhile our development/debugging loop still emulates loading punchcards into mainframes.
> So this is my thesis now - if you’re a senior who neglects this new tool, you’re going to be out of a job soon-ish.

Work(ed) for a company super big on a force of agents. Brought them into my workflows early on, before the company even pivoted. Ran them at home on private hardware (that 3090 had to do something), at work when access was opened up. Provided valuable feedback on hallucinations (e.g., fabricating the existence of a MongoDB CLI module wholesale, documentation and all) and barriers to adoption. Pitched an integration of four disparate systems across ~20 data points to create tenancy in a core product line from scratch, with said AI at the center of it for customer service and workload creation, reducing engineers to approvals only for ~20 tickets a week averaging ~40hrs of work, freeing up said engineers for actually valuable work instead of handholding customers through routine tasks. Got great feedback and enthusiasm on it.

RIFed this year.

Doesn't matter whether you're bullish or bearish on it, the only thing that ever really matters is if scrubbing your line item from a spreadsheet will net someone higher up than you a bonus. That's what's driving this AI mania, and what needs to be addressed via policy before these employers gut themselves and the economy in the process.
> Posts by Susan Fowler "so you want to self-study math/physics" have gone hugely viral here and I have yet to see anyone in the comments or later report that they actually became really good after following her tutorial. Same for any other tutorial or guide or self-study overall. maybe one blogger whose name eludes me but extremely rare.

Well, when you learn something, do you remember everything that contributed to your learning it, and go back and acknowledge it? I try very hard to acknowledge those from whose instruction I have benefited, and I doubt I come anywhere near that ideal.

Come to that, one measure of real expertise is knowing you're never done learning, so, even for someone who does acknowledge every single source along the way, the more they know the more presumptuous it'll seem to say they are done learning it, so they probably won't.
> I think this is communicated in how its performed, in the emotional tensor of its practice.

A typo for "tenor," I presume, but a funny one!
Musk is not threatening to take away grandma's social security in Europe so I'd be surprised if they were. They're just not buying them. 93% of Germans said after the Nazi salute they'd never buy a Tesla. Musk just built a Gigafactory in Berlin too.
I think in the upstream kernel LSMs are also still the only way to prevent a process from creating child namespaces where it has privileges?

E.g. if you can cat CAP_NET_ADMIN even within a restricted namespace, you have access to huge amounts of horrbly broken kernel code. It's easy (for people who know how to exploit kernel bugs) to escalate privileges from there.

Distros have their own fixes for this issue so namespaces definitely aren't useless in practice for sandboxing. But the basic mechanism just doesn't that well suited to it.
>My number one priority would be to implement fine-grained ephemeral containers. Guix has these already.

Besides how large the package repos are, what other reasons would one chose Guix over NixOS?
Also a long known phenomena ... I believe it was Bill Gates who said, "He's a nice guy, but played a bit too much of the football with his helmet off"
The penalty for willful infringement in the US is pretty steep per instance.
https://drewdevault.com/2025/03/17/2025-03-17-Stop-externali...

https://thelibre.news/foss-infrastructure-is-under-attack-by...
Plex got increasingly annoying to use, I switched to jellyfin, which I mostly use from my Roku, and it's great.
so having "some protections" like db foreign key scoping that mitigates "well anyone can now bypass auth middleware for any route" makes this…

"not that bad on nextjs part"

no no, this is absolutely nuts.
On the moon, the sunlight bouncing around is still enough to outshine the stars
> The central puzzle is this: the payback idea does not make sense. Whatever the wrongful act was – a murder, a rape, a betrayal – inflicting pain on the wrongdoer does not help restore the thing that was lost.

My understanding is that the "tit for tat" algorithm explains why anger can make sense as a game theory strategy. https://www.youtube.com/watch?v=mScpHTIi-kM
Not quite - all the information on the fake pages is accurate and real, so it’s not an attempt to poison training data, just to waste resource. Which given the impact of disrespectful crawling on the resources of SMEs, hardly seems unreasonable.
Looking at next I have to think that something went horribly wrong with front end development. It adds so much complexity for things that provide such minimal value to most apps.

React added a lot of complexity to the front end, but, for an app with a lot of front end state, brought a ton of value.

Next brings us file based routing, which seems cool, until you get into any sort of mildly complex use case, and — if your careful and don’t fuck it up, server side rendering, which I guess is cool, if you’re building an e-commerce product and is maybe cool for maybe a few other verticals?
As plex got more annoying to use I switched to Jellyfin on my Roku. It's been great. Reading the threads it does seem like there's some issues on the Apple TV, but on the Roku it's great.
But it also have drawbacks :)

But being honest - you can install BASH that way:

# pkg install -y bash
I worked on the same block in NYC for 12 years. Not once was the street ever scaffolding free. Better yet, as described in the article, scaffolding would be up for years in front of buildings. So much so that you just got used to it and when it came down, the building facade and building itself that were uncovered were a pleasant surprise to see again.
Given the quote, and given your interpretation of the quote, it seems that you are feeling instead of thinking (you have no hook there to suggest a conclusion is taken). Look at it rationally and it is just that: "If phenomenon P inclines to non-autonomous than adjutant A suggested". Dirac was hardly a feeler - definitely a thinker.
Reminiscent of the movie Gattaca.
Most people value truth and I don't think revealing affairs is a valid criticism of this product.
"CEO of AI ad-tech firm pledging “world free of fraud” sentenced for fraud"

Classic of the genre.
seems pretty reasonable to me. it's not that it's 100% accurate. it's that anything that has higher barrier to entry automatically acts as a filter.

complied languages, esoteric languages, i mean it's pretty reasonable. you have to go out of your way to learn more stuff and there's more pain. ergo: you're probably "better" than a script kiddie that "vibe coded" a boilerplate saas to launch their influencer passive income side hustle
Commercial chips have min/max temperature specs, like -20°C to +70°C, or perhaps -40°C to +125°C. (Not sure what spacecraft use.)

Lunar temps can drop to -130°C to -250°C
This isn't that surprising. You can ask most AI models to come up with a competing theory on just about anything.
One of the reasons I ditched plex was that it didn't allow local playback without a network connection.

Jellyfin+roku works great for me.
I think the point being made is that even though the specific set of requirements may be unique in a stakeholder basis, all the components already exist, and have been combined in many ways. So it really boils down to prompting in such a way that the right set of components are brought together in the right way. That's where the skill now lies.
Author clearly never played any simulator games, like Arma.
Or he wouldn't ever posted this BS.

"Games which use hitscan mechanics might be taking a shortcut, but it’s one for which can forgive them. The effects aren’t likely to affect realism too much, and we take these shortcuts in real life as well."

Hitscan is ok-ish for arcade brain-rot games like CoD, where max distance is few dozen meters, def. not OK for any other games.
I don't quite understand what --exec does. If I leave out --exec from example 3, is it supposed to prevent bash from executing other programs?

$ landrun --log-level debug --ro /usr/bin,/lib,/lib64 /usr/bin/bash --norc
[landrun] 2025/03/22 17:16:29 Sandbox config: {ReadOnlyPaths:[/usr/bin /lib /lib64] ReadWritePaths:[] AllowExec:false BindTCPPorts:[] ConnectTCPPorts:[] BestEffort:true}
[landrun:debug] 2025/03/22 17:16:29 Adding read-only path: /usr/bin
[landrun:debug] 2025/03/22 17:16:29 Adding read-only path: /lib
[landrun:debug] 2025/03/22 17:16:29 Adding read-only path: /lib64
[landrun:debug] 2025/03/22 17:16:29 Applying Landlock restrictions
[landrun] 2025/03/22 17:16:29 Landlock restrictions applied successfully
[landrun] 2025/03/22 17:16:29 Executing: [/usr/bin/bash --norc]
bash-5.2$
bash-5.2$ /usr/bin/uname -r
6.13.7-200.fc41.aarch64
> I was speaking in general about the law, individual contracts nonwithstanding.

Then no. If your assistant snaps the photo and their contract doesn't try to address this, then they are the author (in US law) and could file for and fight you for, the copyright. You can credit each other as much as you want - US law doesn't care much about that. European law tends to care.
And mum works for airport security.
My favourite is this one:

https://news.ycombinator.com/item?id=43113941
It's the Industrial and Agricultural Revolutions all over again. Broad automation of labor will not result in societal uplift, but Capital uplift, absent worker action to enforce equal distribution of gains (like how Unions brought us the 40hr work week and the end of Child Labor w/ the Industrial Revolution). Worse yet, the irrationality of these techbro arguments shows their complete lack of long-term thinking or systems analysis.

They cite "societal disruption" through the wholesale (or significant) replacement of labor via AI, but then shrug off the problem as one for government to solve - governments they own, control, and/or influence. Yet if we take them at their word and they get rid of labor - who the heck do they expect to buy their stuff, and with what income? Capital's plan is very much (Eliminate Labor) + (Continued Sales of Products) = (We Keep All The Money), and I'd like to believe the HN community at the very least can see how that math does not work.

Capital would have to concede to a complete rework of civilization away from consumption and towards a higher goal, but that would entail tearing down the power and wealth structures they benefit from now with no guarantee of a brighter future tomorrow. Plowing ahead with AI while prohibiting any attempts at systemic revolution isn't just irresponsible, it's insane, and I'm tired of having pretend it's not for the sake of a stock price somewhere.

Present systems are incompatible with an AI-dominated future, full stop.
> I do know that the United States is heading for a financial apocalypse unless drastic measures are taken now.

The people you get your news from are lying to you, trying to get you to sell out your future to their profit.

The economic issues we’re facing right now were created by the current administration installing heavy taxes on imports while simultaneously creating a nationwide shock with federal spending. This is like declaring that you should save money and doing so by not paying your rent, skipping the doctor, and pushing your car into the sea.

If we rolled back to January 19th, when the economy had been growing steadily and all signs projected that trend to continue, the long-term problems still weren’t catastrophic. The primary problem was that Republicans broke our balanced turn of the century budget when they cut tax rates and started a couple of recreational wars, setting a pattern which has continued where we’re told that we have to give up things the public benefit from because the alternative of rich people paying taxes a few points higher is too miserable to even consider. That debt is a concern, but not as a fraction of the massive American economy – it’s like the difference in medical concern between noticing that you’re gaining 10 pounds a year versus 10 pounds in the last week.

The reason the lying about the crisis has ramped lately is that some of the tax cuts which racked up trillions of additional debt in Trump’s first term expire this year and others in 2028, but the Republicans want to cut taxes even further. It’s mathematically impossible to do that without unpopular cuts to things people like, such as Medicaid or children’s health insurance (CHIP), which is why they’re trying to distract with gross exaggerations of the currently-negative DOGE savings and trying to manufacture this air of impending disaster so people don’t think there’s a choice. While the choice is no longer as easy going back to Biden’s economic growth, it could simply be letting tax rise to the levels we had 20-30 years ago when the economy was thriving.
A common pattern is for benchmarks owners to hold back X% of their set so they can independently validate that models perform similarly on the holdback set. See: FrontierMath / OpenAI brouhaha.
Yes exactly:

>and the right system for optimizing (LLMs trained on “average code” probably aren’t it
Ouch, 13 days to triage that is crazy. I definitely wasn't in need of any more reasons not to use something like nextJS, but I'll add this to my list.
> You're adding a description of what exactly a piece of data represents, allowing the compiler or interpreter to limit the ways in which you can use it.

Let's say I'm making a new record type with a .firstname field.

And let's say I'm not declaring what data type is stored in the field. Zero description or constraint is happening there.

The .firstname field itself was unrepresentable before I added it. There is no previously existing concept of accessing a .firstname field that I am constraining.

In this scenario, my language doesn't have access to raw memory, and even once I create this record type I don't know how it's going to be stored in memory. So I'm not constraining raw pointers into organized records because there are no pointers at all. I don't have raw byte access like in your HTTP example.

In that scenario, what am I constraining? What is the unconstrained version?
> go to a website and click 100 (!!!!!) times.

Captchas are craaaaazy nowadays

/s
Beware, once you get used to watching blurays streaming video looks like crap.
How many startups/small companies that uses next.js do any static verification?
Student, lawyer, doctor, etc.
No. We don’t need to make conversations so boring as to allow you and your robotic ink to completely unambiguously understand them. For every one person that didn’t get this obvious Bluey reference deep in a Bluey thread, I’m sure that 100 more DID get it.
(Shrug) We'll see what the courts say, Gary.

If training AI doesn't constitute fair use, you will lose more than you could ever possibly hope to gain. As will the rest of us.

Meanwhile, sublimate your dudgeon towards advocating for free access to the resulting models. That's what's important. Meta is not the company you want to go after here, since they released the resulting model weights.
One of the worst mistakes so far.
Work on developing professional / non-academic connections. aka ACM, IEEE, local 'clubs/organizations', relevant open source projects. This provides broader exposure to those looking to hire while also building one's credentials / show casing what interested in applying degree to. Demonstrates knowledge of how to use academic credentials outside of academic setting.

Insite: Everything else being equal, is someone one knows/familiar with someone's work more or less likely to hire an unknown or someone who's work/project(s) is familiar/known.
Nautiloid Newtons from the Sword Coast.
No, Fahrenheit was not designed with "humans in mind".

Neither 0F nor 100F are anything special for humans. It's "very cold" long before 0F and "very hot" long before 100F. 50F is nothing special either.

Room temperature is 72F.
It sounds like you haven't seen projects like this yet:

https://github.com/ityonemo/clr

They're popping up all over. For some reason, Zig folk want Rust things and Rust folk want Zig things.
This is a wild vuln in how trivial it is to execute. But maybe even wilder is the timeframe to event _start_ triaging the bug after it was reported. How? Was it incorrectly named? Was the severity not correctly stated? Someone help me understand how this sits for 2+ weeks.

2025-02-27T06:03Z: Disclosure to Next.js team via GitHub private vulnerability reporting

2025-03-14T17:13Z: Next.js team started triaging the report
1) What.

Add a single header 'x-middleware-subrequest' and it allows you to completely bypass any self-hosted Next.js middleware, including authorization.

This is beyond damning.

It's also exactly the reason why the whole Javascript ecosystem is really showing how immature it is and the hype and euphoria of Vercel is contributing to its clumsiness.

They are now also pushing "Vibe Coding", which is a hot air hype parade, about to be brutally hit with reality when others are deploying production code that is riddled with hundreds of security vulnerabilities.

A delightful golden age for professional security researchers.
There's quite a lot of it apparently. From an FT article quote https://archive.ph/5v3Vz

>Most hydrogen is likely inaccessible, but a few percent recovery would still supply all projected demand — 500mn tonnes a year — for hundreds of years

Most of it comes from a reaction between water and 'ultrabasic rocks' according to Wikipedia. It hasn't been searched for much as it occurs in different geology to natural gas and there hasn't been much demand till recently.
It's insane. I don't understand what could possibly be the justification there.
Im guessing you just dont have the computational power to compete with a real GPU. It would be relatively easy for a top end graphics programmer to write the front end graphics API for your chip. Im guessing that if they did this you would just end up with a very poor performing GPU.
What this solves is the problem that often "what is reviewed" is different from "the source code used to build the software".

Verified reproducible builds could have countered the xz utils break, SolarWinds Orion subversion, and many others. It's worth doing.
Probably is. NOAA and other gov sources help us predict things like clear air turbulence related to the jet stream. One probably doesn’t want to politicize those kinds of predictions too much or risk scraping passengers and their dinners from ceilings.
20F is also cold as fuck. 90F is also hot as fuck.
Air Force / Space Force already employ meteorologists for their own stuff, I'm sure the US military will have accurate information. It just will not get to the public until it has been properly sharpied.
Just seems odd not to test a website on a phone, even accidentally.
Huh? 40 hr work weeks are a recent thing, many people in history worked 12 hr days 6 days a week. Technology and social progress definitely leads to fewer work hours.
Bluey is unusually good even for the ABC, but the floor on children’s programming is just so much lower in the US. Sure, America’s obsession with Bluey stems in part from its on-again off-again fetishisation of Australia. But, Christ, I’m Australian and recently spent a few weeks in the US, and, fuck me, American TV just sucks so much.
Non-standard services daemon vs systemd.

Otherwise, available packages are tidy and well defined.

NixPkgs, which I use and develop for, is less tidy.
For me it is very much hit or miss. I use claude sonnet with Cline. Sometimes I'm blown away that it can create a new page with CRUD functionality, nice UI etc. in one go. Another time it struggles to create a simple web page. Yesterday I needed a very simple landing page. My prompt was something along `Very dark grainy background with centered "name of the page" text.`. It couldn't get neither the background, nor the centering right. Later when it got one right, it screwed up the second. I had to give up after consuming ~$1.5 because we were not getting closer to the result.