cormacrelf

This story was reported by 404 media. OP linked some random person’s tweet.

https://www.404media.co/ai-companies-are-buying-tons-of-old-...

No? CK is better than I gave it credit for, didn’t take 15 minutes, took 2, somehow a lot faster than before, probably system busy. I was using hybrid which is wrong for this query.

Still semble is a few orders of magnitude faster and gave better results against ck —-sem. I am running both on rust-lang/rust and CK is going to take hours at least, extrapolating from current stats probably 3 days? Semble: 26 seconds without any caching. The thing doesn’t have a cache and it’s still massively faster. I added caching support and watchman integration and got it down to 1.4 seconds. 3 days is basically not good enough for this use case. It’s slow enough that indexing is going to lag your code changes. Semble is fast enough that it’s not going to be behind.

Try running both on the CK codebase. CK takes like 15 minutes to index itself and gives hundreds of completely irrelevant doc comments as results for “run model on CPU” query. Semble indexes for like 3 seconds and prints out the actual code that runs the model on the CPU.

Realistically, if you are scanning each kernel commit to check if they might be patching a security issue, you are going to be asking an LLM "is this security related, if so vaguely how" with low effort and taking "maybe" as a yes before feeding it to a more expensive model. You aren't trying to establish a probability of an ultimately unknowable fact, there is ground truth that you can find by producing an exploit, so you are just trying to pre-filter before spending the money to find it.

For GET /, sure, and some mature load balancers can do this. For POST /upload_video, no. You'd have to store all in-flight requests, either in-memory or on disk, in case you need to replay the entire thing with a different backend. Not a very good tradeoff.

And at the same time, Apple claimed it was the biggest ever album release by number of downloads, or something like that. They were not only messing with our libraries, they were claiming we wanted it and were in fact U2 fans.

You can absolutely do that and there is nothing for general linear algebra libraries to do.

The actual paper is very clear about what it's for: https://fiteoweb.unige.ch/~eckmannj/ps_files/ETPRL.pdf

It says:

    Consider now a general time-dependent field B(t) of duration T. The pulse B(t) may be extremely convoluted ... Can one make the field B(t) return the system to its original state at the end of the pulse...?

This pulse is modelled as a long sequence of rotations. For maths purposes if you had such a sequence, you can obviously just multiply all the rotations together and find the inverse very easily. For physics purposes, you don't really have access to each individual rotation, all you can do is tune the pulse. Creating an "inverse pulse" is quite unwieldy, you might literally need to create new hardware. The paper asks "what if we just amplified the pulse? Can we change this alone and make it not impart any rotation?"

They are trying to take any pulse B(t) and zero out any rotation it imparts on some particle or whatever by

    uniformly tuning the field’s magnitude, B(t) → λB(t) or by uniformly stretching or compressing time, B(t) → B(λt)

And the answer is that you can do that, but you might have to perform the pulse twice.

How about -F -regexthatlookslikeaflag? Verbatim, that errors out as the command line parsing tries to interpret it as a flag. If you don’t have -F, then you can escape the leading hyphen with a backslash in a single quoted string: '\-regex…', but then you don’t get fixed string search. And -F '\-regex…' is a fixed string search for “backslash hyphen r e g e x”. The only way is to manually escape the regex and not use -F.

From the article:

> The way Nixpacks uses Nix to pull in dependencies often results in massive image sizes with a single /nix/store layer ... all Nix and related packages and libraries needed for both the build and runtime are here.

This statement is kinda like “I’m giving up on automobiles because I can’t make them go forward”. This is one of the things Nix can do most reliably. It automates the detection of which runtime dependencies are actually referenced in the resulting binary, using string matching on /nix/store hashes. If they couldn’t make it do that, they’re doing something pretty weird or gravely wrong. I wouldn’t even know where to start to try to stop Nix from solving this automatically!

I wouldn’t read too much into their experience with it. The stuff about versioning is a very normal problem everyone has, would have been more interesting if they attempted to solve it.

> Meta has a sophisticated implementation of a target determinator on top of buck2, but I don’t believe it is open-source.

It is: https://github.com/facebookincubator/buck2-change-detector

> Some tools such as bazel and buck2 discourage you from checking in generated code and instead run the code generator as part of the build. A downside of this approach is that IDE tools will be unable to resolve any code references to these generated files, since you have to perform a build for them to be generated at all in the first place

Not an issue I have experienced. It's pretty difficult to get into a situation where your IDE is looking in buck-out/v2/gen/781c3091ee3/... for something but not finding it, because the only way it knows about those paths is by the build system building them. Seeing this issue would have to involve stale caches in still-running IDE after cleaning the output folder, which is a problem any size repo can have. In general, if an IDE can index generated code with the language's own build system, then it's not a stretch to have it index generated code from another one.

The problem is more hooking up IDEs to use your build system in the first place. It's a real slog to support many IDEs.

Buck recently introduced an MSBuild project generator where all build commands shell out to buck2. I have seen references to an Xcode one as well, I think there's something there for Android as well. The rust-analyzer support works pretty well but I do run a fork of it. This is just a few. There is a need (somewhat like LSP, but not quite) for a degree of standardization. There is a cambrian explosion of different build systems and each company that maintains one of them only uses one or two IDEs and integrates with those. If you want to use a build system for an IDE they don't support, you are going to have a tough time. Last I checked the best effort by a Language Server implementation at being build-system agnostic is gopls with its "gopackagesdriver" protocol, but even then I don't think anyone but Bazel has integrated with it: https://github.com/bazel-contrib/rules_go/wiki/Editor-and-to...

Maybe it’s better selfhosted, but GitLab is almost unbearably slow. I booted up a Gerrit instance to compare and simply rendering a MR page is maybe 10 seconds vs zero. GitHub is still 10x faster. GitLab manages to be almost that slow for cached pages, making you wait, then realise it’s outdated, and load again, totalling maybe 20 seconds just to “go back to the MR list”. Its awful.

Whatever it is you think you might like about GitLab in theory, it’s much worse when this is your reality. When it takes that long to render a single MR, you do not want to be creating more of them than you have to, and you certainly don’t want to make yourself and the rest of your team navigate between MRs to do code review.

Sure, wasn’t sure that even needed to be said at this point, but even so, this form was probably produced by a broker. Even if it does not cover things like this https://www.businessinsider.com/jane-roberts-chief-justice-w..., I think it was likely accurate as to his holdings in publicly traded stocks and index funds.

At least not directly, as of the 2022 disclosure form. https://www.scotusblog.com/wp-content/uploads/2023/06/Robert...

Some people may enjoy going through an enormous learning curve to do configuration like that, but the benefits there are pretty abstract and personal, and the pressure to make the onboarding any easier is very low. It's partly because these kinds of users are willing to (a) suffer through a lot in the name of learning and feel good about having done that, and (b) read and write what appears to be a dozen book-length tomes of documentation, that it doesn't get any easier for beginners. I know because I was also one of them in 2015-16 or thereabouts.

Nix doesn't need any more home-manager tutorials, because it doesn't need any more small-time tinkerers. It would benefit more from becoming essential to a bunch of businesses who will become invested in making their own developer experience acceptable at scale, and who will have to improve Nix to that end.

Pretty soon a bunch of people are going to realise they actually do need the exact same version of every tool in every toolchain on every machine in a team, to make use of the transformative caching abilities of tools like Bazel and Buck2. And if that catches on, I would not be surprised to see an alternative Nix frontend configured in Starlark, like every other tool in that arena. There's already a buck2-nix that generates dhall under the hood.

Car and aircraft bodies generally fall under the “useful articles” exception, so they are not copyrightable. Otherwise they would be sculptures.

There is a separate regime that covers useful articles: design patents, which have a much shorter term. The design patents can AFAIK cover things like toys, I don’t know about game assets. You might have to look at the actual grant of patent rights to see what is claimed. I don’t get the impression that the big aircraft manufacturers care about games for plane nerds.

No need to apologise! You got me pretty good.

In case this needs to be pointed out, an RCE in a game is an accident, not the way they designed their multiplayer to work. I was describing why the Firefox team might wait for a feature to be security-hardened before releasing it. The answer remains the same -- they design and market the thing to be secure even when it executes untrusted code. Activision does not advertise their games as able to "securely execute RCE gadgets from maliciously crafted steam authentication packets". This part may be surprising: the Chrome and Firefox teams do, in fact, try to ensure that when someone gains RCE, that they execute it securely and it can't get very far.

I am not attempting to claim that games do not have security issues or cannot experience remote code execution, just that this is not a normal pattern of behaviour that they plan for, so it is normal that a game author would deploy wgpu long before Firefox does (while Firefox spends a lot of effort on fuzzing, etc). If anything a terrible CVE that Activision has expended apparently zero resources fixing is a very good example of what I'm talking about.

I would love to hear about an implementation of multiplayer that receives code from hostile opponents and executes it, but I do not anticipate you'll find many examples.

You can say the same thing about something as simple as "shared memory" -- normal multiprocessing computers have had shared memory since time immemorial, but browsers literally disabled SharedArrayBuffer from 2018 to 2020 and anyone using them to communicate with Web Workers had to find another way. Browsers run a 24/7 onslaught of extremely untrustworthy code, whereas games only run themselves.

Firefox has not enabled WebGPU via wgpu for the same reasons Chrome Security has done an in-depth review of Dawn. It is a component that must be hardened. For anyone out there trying it out by enabling config flags, remember to disable it once you are done. It will be ready in time.

“A a a a a very good song” to the rescue. https://music.apple.com/au/album/a-a-a-a-a-very-good-song-si...

Also available on iTunes for a dollar, search for Samir Mezrahi (the blessed soul who made this).

You can do all of this with https://materialize.com, and you don’t need to write it in Java. Just connect it to a Postgres instance and start creating materialised views using SQL. These views then auto update. So much so, that you can create a view for the top 10 of something, and let it sit there as the list updates. Otherwise just use normal select statements from your views using any Postgres client.

If it’s talking about x86, then yes the eax register is 32 bits wide. The low 16 bits of the same register are called “ax”.

No, this is a timing attack. https://en.wikipedia.org/wiki/Timing_attack

Life’s short. Don’t waste it configuring nix-darwin.

The gist of your comment is: (1) okay, maybe farmers shouldn’t be holding all the risk that their product doesn’t get a good price; (2) but hang on, 98% of the risk trading is done by people who aren’t farmers and don’t know any farmers…

Here is how to connect the dots: holding risk requires finding out information about the risky thing, in order to quantify the risk or take action to avoid it. The reason farmers aren’t the best holders, boils down to the fact that farmers are busy.

The farmers in Lincolnshire do not have time to do weather modelling for the next eight months in Oceania, or monitor the regulatory capture of the Australian Wheat Board, or analyse the litigation around irrigation in the Murray-Darling Basin, or to make submissions to the New South Wales parliament on climate credit schemes for land use change, or analyse the impact of new regulation of certain kinds of pesticides in NSW.

Human activity is very complex. A lot of factors go into the supply and demand for wheat, and the information needs to come from all corners of the Earth. If you want that information in the hands of farmers in Lincolnshire, to be able to best choose what crop to plant and when, you need a transmission mechanism for it. Price is a very effective mechanism, because all sorts of people who don’t know anything about wheat are incentivised to participate in sending the information onwards. Yes, some of these people are pure speculators, but they do actually serve a function. A healthy price transmission mechanism kinda needs these people in there, even if it’s distasteful. If you don’t want them involved, you basically need another information transmission mechanism, because it doesn’t work without them. If you think you can do better without them, good luck with the famines, because many, many people have tried and that’s how it tends to go.

I think you might be forgetting that Apple Pay exists and has worked on the web for years. This looks like a standardised version of Apple Pay.

Yes, but it should be in the article if everything else is.

The code for the Hyperplane type is unfortunately omitted. It’s the most important code in the whole thing.

That’s why the EU is forcing them to allow side loading apps. That’s the right way about it.

Yes. The non-JS interfaces are Dawn (C++) and wgpu (Rust). The Bevy game engine uses wgpu and I think many others will do the same. You can't really generalise from "typical web APIs" in the way that you have.