tomxor

A ping goes around the whole world before your pressed key is visible on the screen.

I don't disagree with your sentiment, but as someone who manages infrastructure which is literally on the opposite side of the planet (from me) RTT is long enough to be objectively horrible for anything interactive like typing over SSH. At least 250ms capital to capital for Europe to Oceania + last mile latency makes 300ms a more realistic minimum + actual processing time + client side rendering and it really starts to feel like a half second from the full human perspective... Under ideal conditions.

For many people, LLMs are the first time that computers do what they tell them to. Not what some big tech PM has decided is or isn’t possible.

The crux is here somewhere.

A massive group of people (A), don't fully understand or care about code, but they care about arbitrary specific outcomes that serve their needs and desires VS a tiny group of people (B), who initiate, architect and maintain successful projects, who care deeply about the health and cohesion of the codebase over it's lifetime, because that serves everyone.

Group-A is now liberated for better and worse. For the first time they can force their will upon a codebase without understanding. They are making selfish changes, and that's fine, this is hacking for the masses. The problem is they still don't realise these are selfish changes, because they have not been forced to tread the path of the programmer to understand they are selfish changes.

The response from FOSS maintainers seems inevitable from this perspective... But I think what's going to be more interesting is watching how Group-A over time respond to creating their own personal hell.

As group-A accrete more and more unsupervised selfish changes into their forks - at what point will they implode and turn into LLM-token-tarpits, at what point will Group-A notice, and I wonder what their response will be.

That's helpful to prevent individual secret harvesting, however it does not protect you from potential silent downstream effects in packages. i.e. inclusion of malicious code in libraries you depend on, this could be as simple as inserting a cryptominer, or as severe as data exfil in a front end package.

This default can affect all consumers of NPM packages, regardless of whether you use yarn, pnpm or npm itself, because most package maintainers use NPM. This is why it's NPM's responsibility to change this default in order to prevent spread of malware in packages.

At this point lifecycle script should be disabled by default in NPM.

It's a convenience feature that provides built-in Arbitrary Code Execution (even for transient dependencies), and every one of these widespread NPM worm style attacks has propagated through it, because of the default setting. Also enabling it for one command shouldn't automatically permit all transient dependencies to run lifecycle scripts, it should be required to explicitly mark each dependency to limit it to where it's absolutely necessary.

The vast majority of NPM packages do not depend on these scripts, and you should disable them globally if you haven't already.

You are not recovering these investments

OK, Question: Would this outcome still benefit society overall?

In the aftermath of this bubble "AI" will still have utility, like the dotcom bubble. So lets say FANG doesn't make a return, how much should we care? How much of this investment is sunk cost that would continue to provide value, and how much of it is operation costs just keeping the lights, I mean GPUs on, that would become unviable post-bubble? As an immediate effect, what happens to these AI companies? or if they become insolvent, what happens to the assets and tech? and what are the secondary economical effect to society if FANG doesn't get their ROI?

Hah TIL. So it's the river Welsh river on the English side of the Bristol channel.

I often feel like I would understand a lot more names if I bothered learning Welsh. It's pretty popular for made up climbing route names too, because Wales is so good for it I guess. Allegedly some of the classics in the Avon gorge are Welsh derived but I could never figure them out to be sure.

Immediate public disclosure is the only choice that isn't irresponsible as far as I'm concerned.

No, it's really not.

High severity vulnerabilities are responsibly handled by quietly neutralising them with subtle patches that do not reveal the vulnerability, waiting for those patches to distribute. Then patching or removing the root cause of the vulnerability (at which point opportunists will start to notice), and finally publicly disclosing it when there are already good mitigations in place.

Example: spectre/meltdowm mitigations.

I've been asked to use this approach myself when reaching out to maintainers. Sometimes it's possible to directly fix the vulnerability as a "side effect" by making a legitimate adjacent change.

FYI it's dynamically loaded on demand, so lsmod will show it after you try run the exploit, or you can explicitly load it with:

  modprobe algif_aead

  echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
  rmmod algif_aead 2>/dev/null || true

Another happy self hosted Gitea user here for ~3 years now.

Came from Gitlab which started pushing out basic users in 2022 with massive price hikes. I weighed Github as an option but was like "no I don't want to be dealing with this same problem in another 5 years" when some other rug pull or degradation happens with that service. So I'm feeling pretty validated for that decision these days.

The speed improvement was massive (super low latency), and was worth the switch on it's own, but we also saved 90% in immediate cost... probably more in secondary effects from the git host just not being a pain point. The only long or unplanned downtime we've had was 2 hours in that whole 3 years where the tiny Linode VPS host had a total hardware failure and got migrated, which is a pretty damn good number of 9s for a simple easy to host single server solution. We also gained more durable and fast offsite backups (zfs) that Gitlab could never offer, but that's more of a custom self hosted thing not specific to Gitea.

aaand we have Quake and Comand&Conquer - Red Alert

Agreed, it would seem that evolutionary biology peaked in the late 90s then

These robots weren't really "walking" in the sense that humans walk through continuous dynamic balancing, i.e falling forward.

These used quasi-static walking, where the zero moment point (like a moving centre of gravity) is kept within the support polygon of the footprint. This is what gives them their weird swaying gait and extremely conservative movement characteristics. You could never make a bipedal robot run, jump or respond to large and sudden external forces using this method. It's essentially a balance free movement hack.

Go back to Win98 UI, I know it will never happen but can you imagine...

At this point I genuinely think people would be blown away at how much of a functional improvement it would be.

There would also be a lot of bewilderment for the younger generations, and people who aren't interested in actually using computers who don't think it looks "sleek" enough or whatever. But in terms of day to day quality of life, those old UIs just got the fuck out the way, and were obvious when you had to interact with it. I have some earned hate for the underlying windows OS, but in terms of UI and desktop, we didn't know what we had until it was taken away.

Yes, by generally I really mean all the defaults are pretty permissive, but I understand some people tune both TCP and SSH on their servers to drop connections faster because they are worried about resource exhaustion.

But if you throw up a default Linux install for your SSH box and have a not-horrible wifi router with a not-horrible internet provider then IME you can sleep your machine and keep an SSH connection alive for quite some time... I appreciate that might be too many "not-horrible" requirements for the real world today though.

If hung SSH connections are common it's likely due to CGNAT which use aggressively low TCP timeouts. e.g. I've found all UK mobile carriers set their TCP timeout as low as 5 minutes. The "default" is supposed to be 2 hours, you could literally sleep your computer, zero packets, and an SSH connection would continue to work an hour later, and generally speaking this is still true unless CGNAT is in the way.

If you are interested there are a few ways you can fix this:

Easiest is to use a VPN, because the VPN's exit node becomes the effective NAT they usually have normal TCP timeouts due to being less resource constrained. Another nice benefit of this method is you can move between physical networks and your connection doesn't die... If you use Tailscale then you already have this in a more direct way.

Another is to tune the tcp_keepalive kernel parameters. Lowering the keepalive timeout to be less than the CGNAT timeout will cause keepalive probes to prevent CGNAT from dropping the connection even while your SSH connection is technically idle. For Linux I pop these into /etc/sysctl.d/z.conf, I have no idea for Windows or Mac:

  # Keepalive frequently to survive CGNAT
  net.ipv4.tcp_keepalive_time   = 240 
  net.ipv4.tcp_keepalive_intvl  = 60
  net.ipv4.tcp_keepalive_probes = 120

_time=240 will send a probe after 4 mins of idle connection instead of the default 2 hours, undercutting the CGNAT timeout. _intvl=60 and _probes=120 mean it will send 120 probes 60 seconds apart (2 hours worth) before considering the connection dead. This will keep it alive for at least 2 hours, but also allows us to have the best of both worlds so that under a nice NAT it keeps the old behaviour, e.g if I temporarily lose my network the SSH connection is still valid after 2 hours, but under CGNAT it will at least not drop the connection after 5 mins so long as I keep my computer on and don't lose the network.

There are also some SSH client keepalive settings but I'm less familiar with them.

It’s who’s looking at your profile; it’s the profiles that you’re looking at. That was the holy grail

Facebook actually implemented this as a user facing feature.

I think it was very early days, but I used it, it was fucking creepy, and everyone hated it. I think Facebook probably removed it because it drove people away. It made you feel like a creep for checking on your friends page.

Yup, in a word, ownership.

But that's an unpopular approach these days where many companies are obsessed with minimising the bus factor to the point that their IP is as replaceable as their employees.

I cannot think of a technology more diametric to 'plug n play' than VR, which is very unfortunate.

Ironically that's exactly what the Quest solved with SLAM, it really is plug and play, otherwise I would not have bought one... and it sucks that Meta now owns it, but it really is still the best "just works" VR.

I also don't think VR has much potential to solve real world problems for enough people, but it doesn't have to because it's pretty good entertainment as a gaming device (albeit still fairly niche).

Not Maybe, I owned a 2009 MBP. Everyone with a macbook from that period that I knew had the same issue, they were absurdly bright, you could not keep it anywhere near a bedroom without putting very thick tape over the light.

It was a poorly thought out design of aesthetics over ergonomics.

I started making deliberate grammar and spelling mistakes in professional context.

I've also noticed an increase of this in myself and others, I used to edit a lot more before sending anything, but now it seems more authentic if you just hit send so it's more off the cuff with typos, broken sentences and all.

I'm sure an LLM could easily mimic this but it's not their default.

the number of bus stops might matter at the margins, we’re not talking about a system where marginal improvements will matter

The central argument of reducing stops is increasing bus speed, not reducing margins, It's in the second paragraph.

[edit]

Top comment is a straw man, attempt to correct course downvoted... I'm not sure how much value HN has left for useful discourse, who the fuck are you people, if you even are people.

Yes, I ambiguously said "started this space"... and to be honest even in the most generous interpretation that's probably incorrect, maybe ZeroTier started "this space", in that it had NAT busting mesh networking first.

As far as I understand Tailscale brought NAT busting mesh networking to wireguard + identity first access control, and reduced configuration complexity. I think they were the first to think about it from an end to end user perspective, and each feature they add definitely has this spin on it. It makes it feel effortless and transparent (in both the networking use sense and cryptography sense)... So i suppose that's what I mean by started, TS was when it first really clicked for a larger group of people, it felt right.

I have the same fears. Last year they have publicly stated they are not interested in acquisition [0]

Pennarun confirmed the company had been approached by potential acquirers, but told BetaKit that the company intends to grow as a private company and work towards an initial public offering (IPO).

“Tailscale intends to remain independent and we are on a likely IPO track, although any IPO is several years out,” Pennarun said. “Meanwhile, we have an extremely efficient business model, rapid revenue acceleration, and a long runway that allows us to become profitable when needed, which means we can weather all kinds of economic storms.”

Nothing is set in stone, after all it's VC backed. I have a strong aversion to becoming dependent upon proprietary services, however i have chosen to integrate TS into my infrastructure, because the value and simplicity it provides is worth it. I considered the various copy cat services and pure FOSS clones, but TS are the ones who started this space and are the ones continuously innovating in it, I'm onboard with their ethos and mission and have made use of apenwarrs previous work - In other words, they are the experts, they appear to be pretty dedicated to this space, so I'm putting my trust in them... I hope I'm right!

[0] https://betakit.com/corporate-vpn-startup-tailscale-secures-...

How about inverting the issue, highlight posts with an opt in label. e.g

  Show HN [NOAI]:

This wouldn't necessarily need to be a technical change, just an intuitive agreement that posts containing LLM or vibe coded content are not allowed to lie by using the tag, or will be flagged... Then again it could also be used to elevate their rank above other show HN content to give us humanoids some edge if deemed necessary, or a segregated [NOAI] page.

[edit]

The label might need more thought, although "NOAI" is short and intelligible, it might be seen as a bit ironic to have to add a tag containing "AI" into your title. [HUMAN]?

This study is measuring the wrong thing. Any diet that restricts calories will cause weight loss, that's just physics not biology. So long as the person strictly sticks to that diet it will work.

Strategies like intermittent fasting or diets that moderate what you eat rather than quantity are focused on the later aspect "strictly sticking to that diet". Because being strict is not sustainable, will power is limited and inconsistent, so wasting it on strategies that are hard to stick to is both futile and a waste of will power. Changing what and when you eat accounts for biology instead of just physics, because those variables have a huge impact on satiety.

The study has a minimum interval of 4 weeks, which does not take much will power. Not to mention the psychological impact of being part of a study.

That's great, but on the flip side

We reserve the right to remove any music on suspicion of being AI generated.

It's going to really suck when someone eventually gets removed based on false positives... Similar problem to auto DMCA false positives.

The idea is unsettling because it reframes human agency

Not really, it's called discovery, aka science.

This weird framing is just perpetuating the idea of LLMs being some kind of magic pixie dust. Stop it.

Terrible comparison.

Horses and cars had a clearly defined, tangible, measurable purpose: transport... they were 100% comparable as a market good, and so predicting an inflection point is very reasonable. Same with Chess, a clearly defined problem in finite space with a binary, measurable outcome. Funny how Chess AI replacing humans in general was never considered as a serious possibility by most.

Now LLMs, what is their purpose? What is the purpose of a human?

I'm not denying some legitimate yet tedious human tasks are to regurgitate text... and a fuzzy text predictor can do a fairly good job of that at less cost. Some people also think and work in terms of text prediction more often than they should (that's called bullshitting - not a coincidence).

They really are _just_ text predictors, ones trained on such a humanly incomprehensible quantity of information as to appear superficially intelligent, as far as correlation will allow. It's been 4 years now, we already knew this. The idea that LLMs are a path to AGI and will replace all human jobs is so far off the mark.

Road upkeep is from general taxation. Road tax was abolished in 1937

I was skeptical of this being true since fuel duty is notoriously high in the UK, so I did a quick fact check.

Based on the change in 1937 you are "technically" correct, in that none of the motoring taxes are ring fenced for road funds since 1937.

However the opposite is true of what you are implying... income from fuel duty alone is generally around 3 times larger than all road maintenance spending (a fairly steady +25bn/yr [0] Vs -8bn/yr [1] over the last decade).

In other words, although it's officially one big tax pot, motoring taxes pay for road network expenditure more than 3 times over.

This is why they are introducing the per mile EV tax, because fuel duty provided a proportional tax to road use, but EVs skip that and electricity can't be so easily taxed for road use specifically.

TLDR, UK road users pay for far more than the road network.

[0] https://www.statista.com/statistics/284323/united-kingdom-hm...

[1] https://www.statista.com/statistics/533171/annual-road-trans...

Thanks :D I like working with people who appreciate simple solutions.

This sort of response to complex solutions used to be more prevalent on HN. When I got downvoted I was like "..this is the end isn't it" :P Maybe the unix way is a dying strategy IDK, but you give me hope.

FWIW, I think this project was vibe coded with an LLM, but if it works, it works, so it makes no difference to me.

I did not realise that, I'd be far more worried about running it than most human coded projects out of fear of it doing something destructive. Not that humans don't make mistakes, but at least they have a mental model and intent. I suppose it depends on the definition of "vibe coded" I've heard some people talk about sending the LLM off into a loop and then trying to use the result, whereas if you are just using it as a more powerful autocomplete and playing captain then that's a lot better.

Forgot that was a bash feature..

  ls | xargs -I % bash -c 'cd %; pwd; [[ $(git status -s) ]] && echo WIP || echo clean'