skysight-inc/HackerNews huggingface dataset:
Ask HN: How are you protecting against supply chain attacks?
How are companies protecting against the constant risk of supply chain attacks? Everything from a rogue package reading API keys on a dev machine to the XZ backdoor enabling remote execution on any server with exposed ssh.

It's not a new problem. There are many companies trying to solve it. A lot of the products seem to be "we'll tell you if you're using something that has had a reported issue", but that's a bit late (better than nothing, but late).

It's not an easy problem to solve (you want to be able to read your API keys when you need to!) How are you tackling it?
Sapphire is transparent aluminum. Already used in semiconductors and consumer goods.
> met the larger proprietary models where they already were

This is smashing the wall.

Also if you just care about breaking absolute numbers, OpenAI released 4.5 a month back which is SOTA in base model, planning to release O3 full in maybe a month, and Deepseek released new V3 which is again SOTA in many aspects.
They probably do also use Telegram https://www.forbes.com/sites/daveywinder/2025/03/22/russian-...
Nope. A modern dishwasher uses 2-3 gallons per load. If your dishwasher has Eco modes or a half-cycle mode, you can use even less. A typical kitchen faucet will deliver 2 gallons per minute. If you run your faucet for longer than that, and most people absolutely will, you are wasting water by hand washing.
I got a lot of work done for a few years, thanks to Adderall, but that ship has sailed because of high blood pressure.

I'm not selling anything, my friend. I'm sorry I didn't tell anyone that I was diagnosed with ADHD over 15 years ago, but I've been in the trenches for a long time now.

And, absolutely, medicine is next-level helpful, but if you can't use it, as I can't, then you have to do the best you can. Out of my love for others like me, I simply offered the best non-pharmaceutical advice I could, because that's what I use.

Peace be with you.
Not a huge fan of internet-of-shit but we have a similar Bosch dishwasher and it’s totally operable without wifi. I don’t think there is anything advertised to us that can’t be done by just pushing the buttons.

The smart stuff seems acceptably done: I can start cycles on my phone, it can be configured with the off-peak times for our power supply and automatically delay the overnight wash until then, I get a push notification on my Apple Watch to tell me to open the door to help drying, there are more program cycles you can download (which is the complaint here - should be more cycles on the machine).

And there is this useless feature where you can tell it you’ve bought, say, 90 dishwasher tablets and it will count down the tablets each wash and warn you when you need to buy more.

I say useless because you literally see how many tablets you have left when you fish them out of the box but still it felt like they tried to add some electronic smarts that made sense?

So yeah TL;DR works fine without wifi, with wifi you get some practical but otherwise ignorable functionality.
https://www.canirunthisllm.net/
Sounds like passive radar moved to the accoustic domain. It's a neat thing and there is some open source work around it. However it's also a good way to run afoul of ITAR, passive radar is still one of those secret sauce, software is a munition type things.
Because 3.5 has a new capability which is following instructions. Right now we are in 3.5 range in conversation AI and native image generation, both of which feels magical.
No transparency at all is also bad.

I'm afraid an ugly compromise of muddling through with some transparency is the best we can get in practice. At least if your democracy features voting, and especially first-past-the-post voting.

As one alternative, filling your parliament up via sortition might eliminate the downsides of transparency.
Apple Joins AI Data Center Race After Siri Mess
Information heavy slides can have their place - distribution, and are quite often used in management consulting type sales.
> TL;DR: The tooling is bad.

I make my own tools. KV makes it really easy to stop having to care about the database layer really early in a project and live entirely in code. It's fine.
The majority of data is rarely accessed after the first week. However, that data represents 99% of the costs. If storing data is not your primary business, then why keep it around? This is what most of the large companies are realizing now that growth is slowing down.
> Our belief is that once we can no longer come up with quantifiable problems that are "feasible for humans and hard for AI" then we effectively have AGI.

I don’t think that follows. Just because people fail to create ARC-AGI problems that are difficult for an AI to solve, doesn’t mean that said AI can just be plugged into a humanoid robot and it will now reliably cook dinner, order a pizza and drive to pick it up, take a bus to downtown to busk on the street and take the money back home, etc.

ARC-AGI is an interesting benchmark, but it’s extremely presumptive to think that these types of tests are going to demonstrate AGI.
New fire maps put nearly 4M Californians in hazardous zones
On my model "deep cleaning" of the dishwasher, some other functions I think, but that I didn't care for.
Yay it seems I don't have to wear the Dunce hat but also, honestly, I'm not even trying to be pedantic on what counts as "git" here. I'm more annoyed that the contribution calendar is considered inherently "git". I doubt Github can even patent that---it's more a habit-tracker thing.

(Okay there's also `git` in the URL, I noticed, which means whoever made the page had that mental mapping in mind but still...)

I just feel clickbaited that this item is at the top of this forum. I'll stop engaging with this now. Nothing of interest for me here.
That's a very small sample size by task. I wonder if they give the whole data set to an average human, what the result would be. I tried some simple tasks and they are doable, but I couldn't figure out the hard ones.
"those who have more capital have an advantage"
I was thinking LLMs are actually an incredible compression of human knowledge- if you can swing it, a decent model and a few GPUs would be amazingly handy to help rebuild civilization.
Well I think it's very common for representatives to not directly reply after a certain incident, because they don't have all the details yet and they want to take time to form a proper response. Don't see how this is specific to Trump.
"accessible"? Been on site for half a day, seen by hundreds, gradually getting upvoted and discussed, available on all major HN aggregators etc. Well accessible, but it's old news by tonight. Stuff moves fast around here.
You don't need precise numbers to figure out whether your bridge will stand. What you need is a calculation designed to be robust to the errors incurred in measurement and computation.

The standard for floats guarantees you specific and precise error bounds that you can use to do an error analysis for your whole calculation. Most likely whatever engineering software you use to check your bridge design, will already have this error analysis baked in.

If you introduce some arbitrary other errors, you'd have to redo you error analysis from scratch. And it might not even be tractable, depending on the errors introduced. (The standard floating point error guarantees are designed to behave reasonably well and easily predictably when combined into a larger calculation.)
Getting the Doppler shift right against multiple receivers would be physically impossible

(If you’re not travelling at the right speed of course)
They don't need to do anything software wise, inference is solved problem for AMD.
It's not useful, nor is it open source. It's a leaked copy of the Windows source code from a long time ago that has been hacked on. You can look up the "history" of it and how it has symbol names for companies with whom Microsoft worked to solve specific application issues. Microsoft knows that no company would be crazy enough to rely on it, so no point in getting bad press trying to kill it.
https://www.cisa.gov/sites/default/files/publications/defend... (page 8)

Refer to what CISA recommends. We track project dependencies and look for material changes between releases. We eliminate API keys whenever possible, and rely on trust relationships instead. We use runtime security to detect abnormal activity end to end from dev env to prod. We monitor role activity to alert on abnormal API request sources.

It’s not about perfection, but about building a system, monitoring and measuring it, and improving it when possible.
Should have mentioned that intel marketing and PR launched the User Test Program to make sure advanced users got early PPro systems to make sure there were no lurking fdivs. Nicely was the first recipient. So was John Williams the composer.
Docs-First Design: A Better Way to Build Developer Tools
For what it's worth I have an 800 series and it also made some features like delay start app-only. Even if I was ok with that it's still a terrible design for a multi-person household. See also: cars that are going app-only for remote start.
I don't really get how the horizon effect is something that could be confused/conflated with the effect of dazzle camouflage. The horizon effect is described as a predictable bias in angle estimation, relative to the true angle, when a ship is viewed such that it's near the horizon. This presumably always applies to the view from a periscope, so it would be ever present in any remotely reasonable test of dazzle camouflage (whether to a neutral control or to conventional camouflage patterns). They just say that Blodgett’s control was "too vague to be useful", but it would have to be a truly terrible control to lead to the suggested confusion, e.g., comparing dazzle camouflage through a periscope to conventional camouflage viewed from above.
Am I not a member of the community? I am trying to build bootc images, but I can't work with nothing.

Just now, I thought I'd go check and see if it'd improved, and guess what? It's actually worse than I remembered. There's a list of distros using it at https://github.com/bootc-dev/bootc/blob/main/ADOPTERS.md - but actually the non-Fedora distros they list are RHEL and HeliumOS, which is a CentOS Stream derivative. (There's a list of ostree users, but that's not the same and they even admit that this is more of a 'hey these use related tech and someday maybe they can use this'). So I went looking through docs, and found https://bootc-dev.github.io/bootc/installation.html which again says that this really only supports Fedora/CentOS/RHEL, but does link to the issue tracking work for others to use it. That's https://github.com/coreos/bootupd/issues/468 , which is 2 years old and... basically is, again, a bunch of different folks saying they'd like to make it work on different distros and getting nowhere. There is one person who posted on https://github.com/bootc-dev/bootc/issues/865 and who claims to have converted an ostree Arch system to using bootc, but they didn't post steps to reproduce. Actually clicking around I eventually found their repo https://github.com/frap129/arch-bootc/tree/main which again doesn't say how to do it, but does appear to contain their code, so maybe I can reverse-engineer from there...

Anyways.

The community would very much like to step up, but we can only step up over so high of a learning curve, or possibly so high of a porting curve (a lot of comments indicate being tied to rpm integration).
Here's how one Chinese RPG game think of it: they save as much knowledge as possible, and then send it to the outer space, hoping to find a right planet to settle down again and rebuild civilization first, and then one day make a call back home and return earth to its former glory. (That's Genshin Impact/Honkai Impact 2&3)

Here's how one Japanese RPG game think of it: they separated human body and soul and send it to outer space as well, and the "people" who lived in the earth will now be humanoid androids instead to prevent themselves from being "corrupted", in other word, your soul could remote control the robot from outer space, and achieved "immortality". (That's Nier Replicant/Gestalt/Automata)

But after all, the only problem is: how do we prevent the entropy/information we human build over thousands of year from being annihilated from a single black swan, disastrous event. That's one of the reason I liked informatics so much.
There is more to the above comment than just "opaque binary objects".
> This wasn't a Delphi problem at all; it was a Windows problem because that was the convention on Windows at the time.

And I don't think other GUI systems were all that much better. Eg MacOS has plenty of fixed size stuff right now.
Imagine being schizophrenic (or anything like that) and hearing from Snowden that yes, "they really are always listening", and now you've got chat bots to give instant confirmation of all the other things you think of due to your mental disorder.

It's going to be mental.
The "control board" which has all the high voltage stuff is totally separate from the computer. What Jeff wants to is totally reasonable, if a bit annoying because the computer bit is installed inside the door rather than externally accessible like the control board.
Not surprised either, I've met a doctor who trusted me that I was in pain exactly once, every other doctor or nurse has looked at me like I was some kind of drug addict.

The strongest such look I've ever gotten was a nurse in the ER when I went in with a splinter under my nail. I already felt kinda silly to go to the ER for something so obviously harmless, but it was late I just couldn't handle the pain. She'd offered me ibuprofen, but I had already taken the largest recommend dose of that, so I asked if maybe I could be given a local anaesthetic. She looked like she was considering whether to call the cops, since I was obviously a... Well what, actually? Local anaesthetic addict?Is that even a thing? Why would that be a thing?

I've come to the conclusion that healthcare in my country is better at judging you than they are at caring for you, which is really fucked up
If you click, you’ll see it’s mostly sat ads-c:

https://www.reddit.com/r/OpenADSB/comments/kxrqi7/sat_adsc_t...
Gardening Week: Evergreen Engineering
Finding the Best Sleep Tracker
Ive been through a few that ask more practical questions, but are ultimately a "can you code well" question.
Pretty cool man!

I generated presentation on Amazon leadership principle - just for fun and it pretty much described it.

The UI and everything is quite well.

For marketing, you can keep 1-2 free shares atleast so that people can share it - I could have shared the generated link here - or people can discuss with their business partner and evaluate if they want to pay for it.
(2021)

Some previous discussions:

2022
https://news.ycombinator.com/item?id=33022031

2021
https://news.ycombinator.com/item?id=25796852
Volatile stores would fix that issue. But it does mean that it'd be unsafe to lend out mutable references to objects. (maybe you'd need to do volatile loads too, depending on model of volatility)
Do VLANs really provide total isolation? Are there any attacks that still work for breaking out of a VLAN? Just like there is always a way to break out of a sandbox?
> should be visible on sites like flightradar

They censor. You can pay to exclude yourself.
Filesystems are more like a graph database than a pure key value store.

I think 'database' is a term with multiple (related) meanings depending on context.

Another example is the term 'colour'. Depending on context, it sometimes makes sense to call black and white and grey 'colours', and sometimes it's better to treat them as something else.
Nope false. Interviewed at a few of the top dogs this year. Zero AI assistants allowed.
can you elaborate? I'd assume games have a higher requirement on responsiveness than dev tasks?
In your example you already indicated two tasks that you think might be hard for AI but easy for humans.

Who said that cooking dinner couldn't be part of ARC-AGI-<N>?
It's a resume(ish) site, not a resume?

How am I supposed to distinguish the thousands, maybe millions of Johns and Janes without a picture to recognize them by?
AFAIK, SMTP requires the message-id header, so this "upstream" of which you speak must be outside of the scope of email infrastructure. In this case, looking at this article, the API for sending an email using broken-apart components--a body and recipients and subject--is missing what should be a required parameter for at least a fragment of the message-id, if not the entire thing. Like, this code must be generating a new/random message-id internally for the messages it constructs for them to even be sendable... that, or the API it is itself using to send mail is itself broken by not exposing this detail.
The only driver I'm aware of is the AMDGPU driver in the Linux kernel. It is updated with every release of Linux and is used for all modern AMD GPUs. I find that the drivers generally work well. My complaints are more about the user space libraries.

The good news is that I have at least one AMD GPU of each architecture from Vega to RDNA 3 / CDNA 2 on the Debian ROCm CI. Debian Trixie has packages built and tested for every modern discrete AMD GPU from Vega to RDNA 3 / CDNA 2. (I'd have liked to include RDNA 4 / CDNA 3, but the effort was quite resource constrained and the packages are a bit old. I'm hoping to improve upon that going forward, but Trixie is already in feature freeze so it will have to wait for the next release.)

I personally own much of the equipment for the Debian ROCm CI and I can promise I will continue testing new releases on old hardware for a very long time.
I don't think any of this has any intention to pay off the deficit - it's a cover story for them to remove any opposition.
KV stores can be used to build relational databases in general.

Whether it's a good idea depends on your goal, and what alternative buildings blocks you have available.

(Eg if you are building your distributed relational database to run on top of lots of computers with spinning hard disks, you might want to expose some more characteristics of the hard disk directly to your database, so you can manage them; instead of trying to hide them behind an abstraction.)
Atkins' Physical Chemistry
Pardon my naivete but I've heard Nix described in many of the same terms. What are the differences and similarities between Stageˣ and Nix/NixOS?
Because it's outdated and not fit for use in adversarial contexts: https://security.googleblog.com/2017/02/announcing-first-sha...

Most git repos are not adversarial, so they get away with using it. A malicious commit which put a loop or a fork in your commit history would just be rejected--if not by the software, then by the maintainer.

But if you're tracking the state of some legal procedure in congress or whatever, you really don't want anybody playing games with history, since presumably it would determine important societal outcomes like whether a bill became law.
It actually is in many places. Most European countries have relatively available support, significant portions of North and South America do, Oceania, etc. I don't know as much about Africa and Asia, but I'd expect most countries with well developed healthcare systems to include some amount of mental health care in that.
Thank you for including cost (or really any proxy for efficiency) as a dimension to this prize!
Seems like I can share - https://www.edslides.com/slides/view?s=PCVX3525

The sign-up pricing page is confusing. It lists a pro plan with unlimited sharing, but don't mention a comparison to the free plan, which also allows sharing. Seeing the pop-up, I thought sharing wasn't possible in free plan.
> You'd be hard pressed to find a consumer-grade technology manufactured today that will still be working in 10 years.

I truly don’t think that’s true. If anything current hardware is more resilient to time than older hardware, though it is indeed much harder to fix, usually.

The software running the hardware making the hardware slower releases after releases might be another consideration, but it has nothing to do with the hardware…
Having worked a little bit in Lean and Agda(which is also educational-ish), Lean has all sorts of magical convenience features. For educational proof checker, I think it would be good to be more clear about things and being more mechanical, have a smaller kernel with lower expressivity of types(have strong normalization, don't have universe polymorphism, Large elimination etc).
Yeah! Then I can stop grousing about yet another grammatical peeve: It's "key/value" pairs, not "key-value" pairs (which would mean pairs of key values).
*makes unconvincing rinse cycle noises
Yeah, dang is right, as evidenced by it having been downvoted to -4.
CppCon 2024: When Nanoseconds Matter - Ultrafast Trading Systems in C++ [video]
Diagrams would really have helped comprehension.
It really depends on the level of impact. Lots of people will have small quirks and uncomfortable isolated events which map onto typical symptoms. On the other hand, there's going to be much fewer with severe enough impact to classify it as an issue in their lives.
> Never believe that any tool is good or bad. That's always going to be a generalization, and therefore wrong.

Some generalisations are close enough to true to be worth it.

Eg I'm fairly confident to generalise and say that for most beginners in 2025 picking Python is a better choice than PHP or Cobol.

Of course, you can come up with some contrived scenarios where the beginner would be better served with Cobol.
Most of software is Sisyphean. 100 lines of code doesn't add any cost to your BOM, just NRE, and it's easier to simulate.
>> SQL feels like king in many places

I think it is because most people can make something work with SQL.
16 is obviously larger than both 9.9 and 9.11. AI will never be capable of thinking outside the box like that and find the correct answer.
I never got into drinking and smoking, but I wish I'd been a little promiscuous in college. I'm pretty hung up on it
Thanks for the feedback, yes all the features are available and users can create up 2 projects before being prompted to upgrade. I'll amend the messaging to make that clearer.
Why do we throw pearls before these swine lemon_zest?
When I read contribution graph I assumed it would be a revision history graph of commits and authors.
The relational normal forms are actually pretty practical.

But you are right that in practice you sometimes want to deviate from them. And then it is still useful to be aware of what the normal form of your database _would_ be, and how you are deviating.

Similarly to how sometimes you might want to manually unroll a loop in your code, and it's still useful to keep in mind conceptually how the original loop would have looked like.
> Github, not "git."

No, I stand by my original phrasing: The important part here is that legislative changes are being recorded and shown through a version control system (i.e. git) not the fact that one of the repos is publicly visible via one of several possible web-GUI services.

It would still be somewhat laudable even if the usage was: "Here's the repo, clone it yourself an poke around with desktop tools." In contrast, the opposite mix of "here's a website that shows diffs but you can't have the underlying data" would suck.

> They don't appear to publish the XML formats they're using.

I see XSD files...? Plus, this original design doc is probably still relevant. [0]

[0] https://github.com/DCCouncil/dc-code-prototype?tab=readme-ov...
That’s precisely what I meant in my comment by “these types of tests.” People are eventually going to have some sort of standard for what they consider AGI. But that doesn’t mean the current benchmarks are useful for this task at all, and saying that the benchmarks could be completely different in the future only underscores this.
I think it hits harder when you're in high school or early 20s maybe.