> Another new kernel might be 1/6000 the size of Linux and therefore have 1/600 times the exploitable bugs—or none, using formal methods. The question is how much a new user-mode kernel can shield Linux from attacks. Usually the new kernel depends on Linux to separate it from the malicious code!

Is there any new language close to rust which can help being verified using formal methods or would some other language be more suitable for this job?

Maybe using verus + rust, it seems that atmosphere[0] is an interesting project in this space

[0]: https://mars-research.github.io/projects/atmo/

Of established languages, Rust, OCaml, F#, and Lean seem to be promising for this kind of thing, but people seem to be vibecoding a lot of new languages right now with this use in mind.

> I started going to cafes and co-working spaces to work, or just do things on my laptop there, even for 1-2 hours, and that has helped a lot. I so much feel better, I can decisively do more than at home.

This is the ideal way too imo. Remote has many advantages but I also understand the disadvantages that it has and an approach like this feels like the right balance/tradeoff to me.

We are also not animals built out for isolation. Work still plays a significant role in our meaning to life given that we do it for such long streches of time and isolation within work can have some detrimental effects.

There might be some more logic to it as well. For how long work has ever been done, it was done in the frequents of 1-2 hours, break, 1-2 hours and so on. This is a really good video relating to how work got streched from this to a monotonous 8 hour time or even more.

I think that within pure office, you are unable to really toggle your brain off from work. It is a single strech of long period of time that you are at work. Because if you could tune out then you would've preferred to move back to home and relax. It is very hard to relax within the hours of job and our human body is strictly not built for such levels of stress and endurance at a prolonged period. We need a lot more breaks which most work offices don't give as they see it as a method to "optimize" their employees productivity.

Remote does offer some pushback against it but suffers from the isolation aspect of it.

Hybrid as is your case, can help in providing the balance of work and some form of connection while at it.

I also feel sometimes that this is true but for libraries when studying as perhaps the same principle applies. Though, there is still some laziness exerted in going to the library, I feel as if over the long term, the benefits of going to library might outweigh the costs and that over a long term, it might induce me more net stress not going to library.

Glad that you have found the proper approach to things and I agree with the last paragraph that the employer should be accomodating to all because even from a capitalist perspective, it can allow their employees to actually be on the path to their maximum value and a more happy workforce can be a good thing in general which pays a lot of dividends over a long term.

[0]: https://hackertube.org/watch/hvk_XylEmLo

> We are also not animals built out for isolation.

We probably shouldn't be getting all our socialization at work either. People with healthy active social lives outside of work will probably handle work from home a lot better. There are certain situations where working with others in person is actually better for productivity and that's fine, but when someone's needs as a social animal aren't being met unless they have to go into an office there's likely already something pretty unhealthy going on. It might be too many hours spent working, or a job that's too stressful or demanding, or soul crushing, but I'd be looking for a solution that isn't "lock me in a cage for 8-10 hours a day with a bunch of other trapped workers" first.

The treasury is having daily rates of 4.56% at 2 year bond and 4.88% at 10 years rate.

Yes, Google has a very small risk but still it is a non zero risk that google can bankrupt whereas US govt can physically not bankrupt itself given that it can print the money (there could only be some gridlock within raising the ceiling though but that's true)

Also I would argue that Google itself has changed with trillions of dollars spent into AI/Datacenters, it simply can't pivot as well. There is a reason as to why Google is having such high level of interest rate

Google isn't stupid and wants to give such high level of interests if not for the amount of risk involved. I dont believe that there's free lunch but also that perhaps this can be a good deal to some and this is gonna push people even more away from the more riskier neoclouds funding and cause their debts to rise in interests rate even more.

Matt Levine once noticed that Microsoft’s bonds were actually cheaper than Treasuries (during a time of Trump-instigated turbulence).

His point was that Microsoft has an interest in maximizing its credit worthiness which necessitated the corporate governance etc, while the administration had an interest in maximizing… other stuff (?) which did not necessitate the same things.

[1] https://www.wsj.com/finance/investing/why-microsoft-has-lowe...

> It makes me a little sad. Engaging with the community was something I always liked about HN and now its gotten to a point where I am probably just going to remove my email from my profile.

It makes me sad as well because as part of the younger generation who scrolls around on here, it feels as if AI is enshittifying the human aspects of what made internet good and I have no recourse of that because I was just born in this era.

Truly sad as I do wonder if I missed some era or was just at the end of its gate closing and I am witnessing the door close because too many roaches are entering from the door.

I just had an idea while writing this but I do wonder if something can be done: suppose that there could be a way of E-mail or some service where you enter your E-mail and it creates another E-mail which can act as an alias.

now for anybody who sends the message to alias, if they want the message to be delivered, (they need some level of human trust that they are human) and they would need to log-in from their HN account and they would need a specific amount of karma that you can set.

So example. you can decide that only people with 1000+ karma or 10k+ words on Hackernews can comment.

(One of my projects actually works on detecting the number of words and you have written 6,56,876 words on Hackernews for reference, so my point is that the filter can be technically possible for both karma/words whichever might be harder to fake, hey plus points if we can see the total number of words and run it through some AI scanner to detect if its AI/human for even more detection though I am unsure its overkill)

just thinking my thoughts out loud as I don't wish this community and its interactions to die, if not for myself then for the next generation just a few years down myself and I would prefer a world where if I invest a bit of time on HN then I can interact with you using E-mail without the problem of spam forcing you to remove your e-mail from the profile.

What do you think of the idea of project that I have thought of: Is it worth pursuing/any feedback?

I've considered building some kind of anonymous email or sms system that seems similar to your idea. My idea was inspired by Craigslist's email proxy system which is pretty much the same thing. When you send an email to a seller, you get a generated email to send to, then behind the scenes, CL takes the email and sends it to the lister with a generated "From" email.

ETA: But to answer your question...... I'm not sure if building something like that has enough applications to be worth building :)

I think a low-tech solution might work. If we just require that the emailer put their HN username into the subject line, I could quickly look at the profile and see if they have at least 500 Karma or something before I even bother responding.

I suppose in my profile I could put a template like "HN - - Question" and explain that if they don't follow that template I will ignore it.

I previously considered auto-replying from my HN email with a captcha / challenge of some kind that would reveal a contact form for me to read, but it feels like too much of a barrier to entry for writing to me.

I'd be surprised if shaming had any effect. People rarely think it's spam when they're the sender.

My only direct submission that has gotten any traction at all [1] has made my life a little annoying. I am now occasionally getting messages from people that want me to pay them money to promote my project.

I don't respond back them to them, but I always want to respond with "dude this was something I vibe coded over the course of a week that almost by definition has no means of monetization", but of course it would be just arguing with a literal machine.

[1] https://news.ycombinator.com/item?id=49746401

> I don't respond back them to them, but I always want to respond with "dude this was something I vibe coded over the course of a week that almost by definition has no means of monetization", but of course it would be just arguing with a literal machine.

There is such an level of assymetry where it takes us effort to suppose even write such a comment but then we know that its going to a machine so to no avail.

And yet the spam messages still land in the mail so what happens is that we just end up being frustrated without any avail which is just annoying and rage-inducing.

I think about Something Awful a lot.

Something Awful has a $10 one time fee to buy an account; this is cheap enough to not really exclude any potential posters, but it does a good job weeding out a lot of low-effort spam; if you post a bunch of low effort stuff your account gets banned and you would have to buy another, which could get pretty expensive very quickly for spammers. In the rare event that you do get a persistent spammer, it just leads to more revenue for the site.

Importantly, I think it's a myth that people won't pay for things on the internet. People will pay for things if those things don't suck. Something Awful was/is fun to go on, I've gotten many hours of enjoyment from it, so the $10 fee is a bargain to me. I think it's telling that people wouldn't bother using Facebook if it actually cost them money, because they don't actually enjoy using the site very much.

I'm not saying that SA is perfect and we can argue about the quality of its moderation, but I think it's a model that is underutilized; I think such a model might be able to survive now that so much of the "free" internet has been botted to shit. I would like to point out that SA both predates and outlived MySpace, so it can be a sustainable model.

I don't know how it might sound like but trust me when I say this, but as someone from third world country, 10$ can still buy us a lot and is a force to be reckoned with.

Especially as a teen as I am and the frugality that I usually hold close to my heart, just as a reference, my monthly budget of me and my friends within college is usually around 30-40$ and I think that I live very comfortably for what its worth.

Alas, I don't think that I would be here if the permanent account costed me 10$, I am sure that I might have read an occasional or two or lurked out here for sometime but I would've lost my interest if it not were for my ability to comment or make account easily/for free within my particular use case. So for me, its hard to support this model given that it would've excluded people like me in the first place (whom I am not sure how many are there though but I certainly talk a lot about Hackernews to my friends) but I still understand from where the rationale is coming from.

I do not know what the ideal form of community formation on the internet is, perhaps its a form of tradeoffs and there would be some community which might still be disenfranchised in this battle against bots.

From my personal opinion, there should be a way to show that some human effort has been placed within the community. Yet its a chicken and egg problem as giving the opportunity to showcase that can also invariably lead to them breaking that trust and spamming (and doing bot-like activities).

Maybe some form of system where people can write words say for example on blog and then they can get a score in terms of how much human effort is put into it. Maybe if we can show that some person wrote for 10 minutes on a keyboard or an hour showcasing the rough drafts from start to finish, it can be worthy exercise and then we can sort of have some key which can be verified with that level of human effort which we can then use to sign up to multiple forums.

I don't think that this last idea is the end-all be-all and I might even cringe reading it in a few years if my account is still up perhaps, but I think that there's really lots of potential in who can discover an good enough way of detecting human effort put in/for a community without having bots infesting the place.

Perhaps Monetary form is just one way of showing that as money is still one of the very few things left which we get in transaction of human effort and it is one thing that shows human effort without being infested with bots except the fact that an unequal amount of money is given for unequal amount of human effort. Some get less and some more which as in the case was mine could disenfranchise people.

It's gonna be interesting nonetheless though to see what tradeoffs are adopted by internet in this war against bots. I wonder what historians will think of this as people trying to re-invent town halls as the previous town-halls of the internet got infested with rats because it got too big to clean and the algorithmic incentives of profits rather than the cleanliness of it all.

I hadn't considered developing countries; maybe there could be an option to apply for a free account on a case-by-case basis or something.

I just think that the botted-to-shit internet that has come as a result of everything being free is no longer fun for me and is likely unsustainable. I think a Something Awful model could still work.

I am starting to believe that if something is worth sharing, it is worth writing (atleast once) by a human completely. An AI clean/pass-up after that might be okay but atleast once, an author should try to create the whole piece.

I used to have a real complicated dilemma on which content exactly to write (& then share), I recently started using handy's TTS and storing it in my scratchpad app within my native language or English and then I paste it into Chatgpt and use its memories to connect with other previous discussions I had.

It helps in saving thoughts which would've otherwise been lost, even provide some new perspectives and get them in a way that I can access them later in more depth.

I think that if I were to now create blogs of these contents. I used to think that it would perhaps be okay to share an blog like thing created by AI if say I spent 10-20 minutes thinking of the rough draft of it, but after reading your comment, I am reflecting on the fact that, atleast once, people should write things themselves no matter which AI thing they use before creating blogs.

As the point of blogs shouldn't be to share unlimited content but rather that it is the specific content where a human effort was placed. Maybe if one still wants, there could be some other blog post which could be written with all the AI blogs content I have created perhaps but still, it should be seperated away from human content.

And there is this fact that as you mention, writing itself forces you to think through ideas and thoughts which are highly relevant. So previously when I used to think that re-writing them would be a waste of time and that AI writes them good enough. I think that writing them still might make a lot of sense as it would be a net benefit if not for anybody else, then for me as it can help me better understand the material myself (even more so than reading/speaking it)

The most typing/writing of myself now occurs in Hackernews comments for me and I do observe that I learn a lot writing them personally.

Wow, I had multiple names pop up in my mind yet with most of the names, I found a recent controversy which weirded me out.

There are two things: Tech companies which actually do have a good moral compass & Tech companies which are perceived/advertised as such.

As much as I'd like to think that I cannot be persuaded by adverts, I think that with the recent case of proton, it does shatter a bit to what I had thought was a tech company with a good moral compass.

It almost seems that every single one of the company that I trusted with is going through some deep disturbance within the force.

For what its worth, I have huge respect for Lavabit, also I have lots of respects to small VPS providers who are keeping it an affordable price. You might not know their names as some are even 1 man shops but TNAhosting and xhosts.uk seem extremely fine companies to me.

My interpretation: You need structural alignment with what you and what the company wants because incentives are much harder to overcome even if one has good moral compass and vice versa as well as a company with bad moral compass but one where your incentives are perfectly aligned can be good. Companies might start with good intentions but it is really really hard to preserve that as you grow and involve more people and bureaucracy and as those people come with their own incentives which might or might not align with the incentives of the company or that of the consumer.

If not for adults, my opinion is that teenagers/younger generations are gonna be interested within buying ultra-realistic games. Aside from Minecraft, Roblox, GTA 5 as indie games, most players in this age do in my opinion play AAA games or the most solid graphics game that the world has to offer (as much as their laptops allow them to)

WHAT? I had once went into an absolute rabbithole into a similar topic and not in my wildest dreams could I have imagined that Replit (or others) are just using normal docker for the workload.

I thought that the case of security was better within the industry and that the industry would be punished for bad security practices.

What were the engineers of Replit doing then? Even with a generous perspective, I fail to understand how they couldn't have pushed back against it just until now. This is unacceptable in many ways.

The engineers must have realized that the security that they had was mostly just all duct tape? (because if not then it's a bigger problem)

or is it just something about how startups operate or the incentive structures of the corporation that I am failing to understand?

But doesn't the business realize that it's valuation is based on some level of trust including trust of data. Failure of properly securing that data and their customers hurts the brand in a more permanent manner.

Is the cost analysis of the situation treated it as a "worth it" situation? That, being fast and breaking things and bad security practices are a part of cost cutting and having more revenue faster, something without which a startup may fail.

Have they recognized some deeper secret where for the startup, it is much better to fail big than failing small? (especially so when in some sense most founders who went big and failed, are actually rewarded for it in their future more often than those who failed small)

I have no question in mind that for the executives, the situation is wildly different.

Though, I have a question to ask: What about the engineers working there?

Is it that management stresses them to not work on fixing it and if that is the case, then how are they able to rationalize it upon and their contributions to it (if the end result of it is that the company gets customers into such a system and ends up with their systems compromised because of following such bad practices?)

Who's the engineer that fucked up at Equifax and leaked all our data? Or VW Dieselgate? How many people know his/her name? Does anyone? When you're a cog in a large machine, it doesn't necessarily come from a place of incompetence or malice, though it might. Usually you're busy fighting the fires on your team and your scope and have to just assume someone else is fighting their fires competently. Which, if we're looking at Replit, as far as I know, aside from having the AI go rogue in a widely publicized incident which wasn't company ending, they weren't hacked before this announcement, so other than telling someone to wearing their seatbelt, it seems like they got lucky and got away with it.

At the executive level, look at it as a resource allocation board game. If you put points (money) into security, that's points you can't use elsewhere (sales & marketing). If you don't make any sales, it doesn't matter how cool and secure the product is. No sales means no money to pay for rent or food.

Google has an near monopoly on Internet ads (or rather a duo-poly combined with Facebook). Having such an monopoly makes them have hindsights on what they are doing and how they are failing, or even if they do, the incentives and management just aren't cleanly aligned with what ought to be the case.

Google has always been a bunker corporation, they exist only on shielded campuses and never interface with normal people or reality. One of the additional consequences of never concerning themselves with providing customer service for most of their products. They have no idea what's actually going on on the ground, until long after it has shaken the world (ChatGPT). They're deeply isolated from the front and from proper feedback iteration mechanisms.

wow that is a really good way to describe it.