stusmall

This is even how closed source development works. If you throw issues in a backlog and never follow up to advocate for it then it will never get done.

This was extremely useful. Thank you.

> You’d have to pay quite a bit to get journalists to answer your questions specifically.

This isn't what I meant. I pay directly for subscriptions/donations to news organizations that employee journalists that do this original reporting. I don't want a middle man that just messes it up. This goes for LLMs and for free news sites that don't do much more than summarize original reporting. I've seen more than a few times where they inject opinions, mess up facts or put focus on what was originally a small side point in the article.

As others have already pointed out, feeding these new articles aren't magically going to make them any more accurate. These hallucinations are going to be on top of any errors in the data sources.

I'm not replying to point that out, I think others have done a better job. It's mostly that this conversation made me think of this classic Babbage quote that I've always enjoyed.

"On two occasions I have been asked, – 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' ... I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question"

1.3% isn't great. I'd rather just go, and pay, directly to trusted news sources. Everyone has different tolerance for falsehoods and priorities I guess.

Oh wow. That's older than I thought. This is definitely less of an issue than folks make out of it.

I cling onto my old hardware to limit ewaste where I can. I still gave up on my old sandybridge machine once it hit about a decade old. Not only would the CPU have trouble keeping up, its mostly only PCIe 2.0. A few had 3.0. You wouldn't get the full potential even out of the cheapest one of these intel cards. If you are putting a GPU in a system like that I can't imagine even buying new. Just get something used off ebay.

Unless you hangout and get beers with her on the weekend, calling her Elizabeth might be a bit informal

The actix crate is deprecated. I looked on their site and repo and couldn't find an official announcement of deprecation but here is a link to what the lead said when I reached out with questions a few months ago: https://discord.com/channels/771444961383153695/771447523956...

EDIT: Tangent, but if anyone has experience making deterministic actor model systems that can be run under a property test I'd love to know more. It would make an amazing blog post even if it would have a very narrow audience

In this thread you can really tell who gets blocked on twitter a lot and are upset about it.

I remember I was screen sharing while troubleshooting something at a new job. I hadn't really set up my mac, and most everything was still defaults until I got a working build/deploy. One of the founding engineers said "You should turn bells off on your terminal. If [the CTO] sees that, he will give you so much shit." I should have taken that weird but ultimately innocent interaction as a sign that I was walking into an absolutely insane environment.

It's a tangent, but the bell character is a left over from how people used to do what you are asking for. Your question just reminded me of that strange conversation and harsh reaction.

Yes. Default deny application firewalls are really powerful tool. It really can take the wind out of large classes of exploits. They can't phone home to exfil data or get follow up command.

It isn't something I'd recommend for everyone, because it is a lot of work and faffing around, but be extremely effective if you are willing to invest in managing it correctly.

Yup. My configs can be found here: https://github.com/stusmall/nixos

I tend to put all the random grab bags rules needed for basic functionality in the opensnitch.nix module. If a package needed rules it gets a module and they go in there. Check the signal.nix module for a good example

This is what finally got me over to NixOS. In the past when I've used application firewalls its a lot of set up that often breaks on updates changing paths or I have to redo it all whenever I move to a new computer. Just tons and tons of churn and wasted effort.

By integrating with the package manager that hasn't been an issue. Once I got through the initial work of setting up my whitelists I just have a little bit of effort each time I add a new package to my nix configs. If I don't want to take on the effort of adding a whitelist to my nix config, I can just add a temporary whitelist that lasts until the next reboot.

It was a steep learning curve and a lot of work, but now its a breeze to maintain.

Respect to them for not naming names, that's the classy move, but I wouldn't blame them if they did.

They normally aren't serving from webservices but from subsidized CDNs.

>I know you're writing in agreement, but it sounds like your changelog is an intermediary step, and I don't understand why it's needed? To fill in the gaps from lazy commit messages?

It's about the audience.

* Commit Messages - These are comments that last for the life of the project. The audience in for engineers far in the future and it should explain what changed, why and the context

* Pull Request Message - These are comments that live for a short time and are targeted for reviewers. Things you might cover here that aren't covered in a commit message is what kind of manual tests were done, releases you want to target, or reference other PRs that might be related

* Changelog entry - These audience here is internal. It is SREs, release managers and the authors of the release notes

* Release notes - This is for the customers

For many changes, all of these can be the exact same thing. It's one reason why I like conventional commits. In those cases you can write it once and it shows up everywhere with very little friction. You add it to the commit message, then when you open the PR the title and body are populated from the commit. When you generate changelogs, it is pulled from git history. Engineering isn't always the happy path, for special situations in each one of those steps you can edit it and add or remove context for the particular audience.

Not all orgs need this or need to care about it. It's completely okay if they don't. I've just found it useful in mine.

I've been recently working on the process to improve this at my day job. A coworker made a point to make very clear distinction between change logs and release notes, and its made a huge difference in how I approach and think about the problem.

A changelog is a raw, engineering driven manifest of everything that has changed. This log sometimes needs more context. Okay the wizbang had a hoozit added, what the hell does this mean and why do I care? Or it needs less and a lot of the engineer rambling needs to be stripped out.

The changelog is an input to a release notes process. This is where refine the wording and fix it up for end user consumption. Having a clear changelog pointing back to individual PRs and engineers lets us go back and talk to folks and clean things up and have final wording checked. There is no amount of automation that can every replace this process. It's part of the finishing touches and craftsmanship our customers expect.

Nothing I'm saying here is any different than what you are saying. My changelogs are the same as your drafts. I just found having those clear definitions and separate terms made it easier to sell the process and have people understand the big picture.

Their point is that the result changes depending on the request. It isn't a concern about the SRI hash not getting checked, it is that you can't realistically know the what you expect in advance.

Oooft. I didn't realize it's one that dynamically changes it's content.

I'm surprised there is no mention of subresource integrity in the article. It's a low effort, high quality mitigation for almost any JS packages hosted by a CDN.

EDIT: Oh, it's because they are selling something. I don't know anything about their offerings, but SRI is made for this and is extremely effective.

In the same way a lot of the other rules on that list are. How are they going to know you are familiar with the code you are committing? How are they going to know it is tested?

Sometimes rules are established to set up a common community base line. You are trusted to follow them in good faith. If over time, through code review, questioning or testing, it shows you aren't following the rules then you can't claim you didn't know it wasn't okay.

It's definitely older than that. I remember implementing it at an old job. That device ran 4.4 and was later upgraded to 5. I know we had it in our 5 builds but I can't remember about the KitKat builds.

What a business card

It is their guess at what is happening without proof. That is the definition of a theory. It is about two entities secretly working together to do something harmful. That's a conspiracy.

So... I mean... yeah. The comment is a perfect example a conspiracy theory. Both in literal textbook definition and the broader cultural understanding of the term.

So this didn't seem right at first glance. NPR just not covering a primary contest, and especially one as important as Iowa, seems wrong. I was curious and went to check. Sanders didn't even win Iowa.

If you were a direct employee of the government, went out and spoke publicly about your organization, in your official capacity, using confidential internal information when told you needed approval before hand, would you expect it to go differently?

You should scroll through more articles by the author of the linked post. His focus is on the media and ethics. He very regularly goes after NPR and member stations and airs dirty laundry. It isn't a reflexive thing. It's central to their culture and something they actively protect and fund.

Asking for a source isn't "blowing the disinformation whistle". It is a healthy thing. We should be skeptical about what we read on anonymous forums. Curiosity to know more and attempts to vet information is a good thing.

Also the source doesn't back up the claim at all. The linked article:

1. Isn't about NPR. It was about some affiliate Corporation for Public Broadcasting TV stations.

2. Points out it wasn't exclusive about selling to democrat campaigns. As mentioned in the article, Bob Dole's campaign was involved.

A lot of employers have this. This isn't that strange. You might have the same. I've had to run open source work past employers when it's similar to the company's domain.

If my college degree was focused only on technologies that were popular at the time, it would be worth significantly less today. Instead it focused on the concepts and theory that are timeless. When picking an architecture to teach on the goal is to get the best one to give the quickest and firmest understanding of these concepts. With that the right answer is more likely to be something obscure, outdated or even fictional.

The times I've had to write assembly in industry, it has only once been on a mainstream, modern ISA. More often than it is on something that would have never been taught in university (MSP430, PIC18 or other microcontrollers). The theory and concepts I learned in college made those easier to pick up.