MurphyA/hacker-news huggingface dataset:
by greatgib | 2025-04-15 15:31:57+00:00
From another post, from Digicert, it looks like that my suspicion is confirmed:

Prior to this proposal by Apple, Google promoted a 90-day maximum lifetime, but they voted in favor of Apple’s proposal almost immediately after the voting period began.

https://news.ycombinator.com/item?id=43693900

To be noted that this doesn't just affect certificate generation, but also things like when you have a pool of subcertificates from a given certificate, that will all have to be regenerated and deployed as frequently in cascada, and also, like when you have server or clients or a specific device that validate specific certificates. Their only viable solution would be to accept widely any certificate from one of the big top level "trust" CAs...
by tombl | 2025-04-15 15:32:02+00:00
I'm effectively lying to the kernel about the environment it's executing in, and trying to convince it that it's running on the kind of hardware it expects, when in reality it's running inside a very different environment.

Since I map guest threads 1:1 to host threads in JS, and architecture-specific code manages the loading/unloading of programs, the exec syscall is exercising these lies in a way that they're not currently equipped to handle.

What I'm currently doing is improving those lies to the point where exec stops noticing they're lies and just starts functioning as expected.
by filoleg | 2025-04-15 15:32:04+00:00
Using your specific example: I consider my mind to be made up on 1+1=2, because I have zero idea what kind of a new information one could bring up to make me consider 1+1 not being equal 2.

I am open to someone making such a point, I just consider the likelihood of that happening being insanely low (given the points I’ve encountered so far on that topic).

All that “i made up my mind” means to me personally (stressing this part, because i know for a fact that it means an absolute “i won’t change my mind on this no matter what evidence you provide” to a lot of people) is “given all prior attempts and the evidence on the topic, I believe it is extremely unlikely you will manage to bring up any new legitimate argument to support your position, but I am open to hearing out what you got.”
by brulard | 2025-04-15 15:32:07+00:00
I fully agree with this. Electron is hated here as if it was the source of all evil. When Electron came (and node-webkit as well), there were very limited options to create fully cross-platform apps easily. I tried multiple ways (including Qt) but it was very cumbersome and slow to progress. With Electron not only was I able to create a usefull app quickly, I could reuse almost all the code on web. Ok, it takes space and consume memory inefficiently, but thanks to Electron a lot of useful apps exist that otherwise wouldn't or would be much worse. Today Tauri or something else might be better choice, but hating electron seems really out of place.
by red_admiral | 2025-04-15 15:32:32+00:00
Yes, I've dabbled in gtk, wxWidgets and several other systems. All of them are meh.

The big player these days seems to be web-based (Electron and friends), though the JVM stack with a native theme for Win/Mac is certainly usable in an environment where you can rely on Java being around.

I think the best option would be some kind of cross-application client-side HTML etc. renderer that apps could use for their user interaction. We could call it a "browser". That avoids the problem of 10 copies of the whole electron stack for 10 apps.

Years ago, Microsoft had their own version of this called HTA (HTml Application) where you could delegate UI to the built-in browser (IE) and get native-looking controls. Something like that but cross-platfom would be nice, especially as one motivation for this project is that Chrome apps are no longer supported so "Web Server for Chrome" is going away. So the "like electron but most of the overhead is handled by Chrome" option is actively being discontinued.
by linsomniac | 2025-04-15 15:33:14+00:00
Running the first generated version to test, I realized I needed to specify: "Make sure that the client processes messages from the server while it is generating and sending hashes of the source file", because the first implementation would spin on generating the hashes and deadlock because the server end would write messages back to the client that the client wasn't reading and fill up the output buffers, which would fill up the client output buffers once the server stalled. This was obvious just from running it and knowing how all this stuff works (rather than by code review).

Then I started seeing issues with how I had phrased the terminal conditions, the client terminating immediately upon reaching the EOF on input file, and not reading any further server messages. I considered making a 3-way ACK to signal end, but instead changed the design to tell it to keep track of outstanding un-acked packets and only send the EOF/EOFACK when there were no outstanding messages.

The design is that the client generates a bunch of "xxhash64" messages for each block of data, and the server replies to each one with either "ok" (I already have that data) or "send" (send me that data). The "send" is replied to with either "data" (here's the data) or "zero" (the block is entirely NUL).
by Workaccount2 | 2025-04-15 15:33:14+00:00
>How we get that level of prosperity back?

By making everyone poorer. Seriously.

You are competing with your fellow citizens for those things. This was true even back then.

Right now, today, it has never been easier to make a lot of money working. So you need to compete with people in that environment. You need to be able to outbid those people for that beautiful home you want. In an environment of lots of educated and skilled workers getting skilled salaries for doing vary valuable work. That's where the bar is.

We can lower the bar back to blue-collar-high-school-diploma, but then we need to also sacrifice all those high earning college degree jobs.

Not going to happen.
by pixl97 | 2025-04-15 15:33:21+00:00
Heh, working with a number of large companies I've seen most of them moving to internally signed certs on everything because of ever shortening expiration times. They'll have public certs on edge devices/load balancers but internal services with have internal CA signed certs with long expire times because of the number of crappy apps that make using certs a pain in the ass.
by diggan | 2025-04-15 15:33:32+00:00
> If you post something on a physical bulletin board, you expect people will come by and read it

Or birds, or public cameras, or people who take photos next to it, or people archiving bulletin boards, or...

If I put stuff in public spaces, I expect anyone and anything to be able to read, access and store it. Basically how I treat this very comment, and everything else I put on the public internet.
by ceejayoz | 2025-04-15 15:33:36+00:00
"Withholding of removal" is a form of legal status.

They can deport you (if they find a willing third party nation), as it's not a path to permanent resident status, but until they do so, you're allowed to reside and work.

https://www.americanimmigrationcouncil.org/sites/default/fil...

> As in the case of asylum, a person who is granted withholding of removal is protected from being returned to his or her home country and receives the right to remain in the United States and work legally. But at the end of the court process, an immigration judge enters a deportation order and then tells the government they cannot execute that order. That is, the “removal” to a person’s home country is “withheld.” However, the government is still allowed to deport that person to a different country if the other country agrees to accept them.

> Withholding of removal provides a form of protection that is less certain than asylum, leaving its recipients in a sort of limbo. A person who is granted withholding of removal may never leave the United States without executing that removal order, cannot petition to bring family members to the United States, and does not gain a path to citizenship. And unlike asylum, when a family seeks withholding of removal together a judge may grant protection to the parent while denying it to the children, leading to family separation.
by pmarreck | 2025-04-15 15:33:40+00:00
I was mainly devils'-advocating, up until this guy.

With this guy, I can find no fault. If you watch his 60 Minutes interview, it seems heartfelt and authentic. https://www.youtube.com/watch?v=grj328-hlhA Plus, if he was born Palestinian and is now a Buddhist, that means that he willingly chose to endure the risk of getting killed as an apostate.

Something must be done.
by jsheard | 2025-04-15 15:34:09+00:00
> A bit like a Anti-DDOS company also selling DDOS services.

That's not far off from what Cloudflare does either, the majority of DDoS-for-hire outfits are hidden behind and protected by Cloudflare.

Whenever this comes up I do a quick survey of the top DDG results for "stresser" to see if anything's changed, and sure enough:

mrstresser.com. 21600 IN NS sterling.ns.cloudflare.com. silentstress.cc. 21472 IN NS ernest.ns.cloudflare.com. maxstresser.com. 21600 IN NS edna.ns.cloudflare.com. darkvr.su. 21600 IN NS paige.ns.cloudflare.com. stresser.sh. 21600 IN NS luke.ns.cloudflare.com. stresserhub.org. 21600 IN NS fay.ns.cloudflare.com.
by pmarreck | 2025-04-15 15:34:23+00:00
I was mainly devils'-advocating, up until this guy.

With this guy, I can find no fault. If you watch his 60 Minutes interview, it seems heartfelt and authentic. https://www.youtube.com/watch?v=grj328-hlhA Plus, if he was born Palestinian and is now a Buddhist, that means that he willingly chose to endure the risk of getting killed as an apostate.

Something must be done.
by ZiiS | 2025-04-15 15:34:37+00:00
Tends to be a matter of opinion. Postgres does not expose the relevant functions, so https://github.com/pganalyze/libpg_query has to do some heavy lifting to convert their source code into a nice library. Conversely, Postgres is very well written code, in an extremely common language, with a stable release cadence, and such a long track record it is seen as the reference implementation for correctly parsing SQL.
by dale_glass | 2025-04-15 15:34:48+00:00
Yeah, I don't like this.

We have an Apache licensed project. You absolutely can use it for anything you want, including AI analysis. I don't appreciate third parties deciding on their own what can be done with code that isn't theirs.

In fact I'd say AI is overall a benefit to our project, because we have a large, quite complex platform, and the fact that ChatGPT actually manages to sometimes correctly write scripts for it is quite wonderful. I think it helps new people get started.

In fact in light of the recent Github discussion I'd say I personally see this as a reason to avoid sourcehut. Sorry, but I want all the visibility I can get.
by junaru | 2025-04-15 15:34:50+00:00
> For this reason, and because even the 2027 changes to 100-day certificates will make manual procedures untenable, we expect rapid adoption of automation long before the 2029 changes.

Oh yes, vendors will update their legacy NAS/IPMI/whatever to include certbot. This change will have the exact opposite effect - expired self signed certificates everywhere on the most critical infrastructure.
by interroboink | 2025-04-15 15:35:06+00:00
I can't speak on the subject, but I just want to say I really enjoyed the Star-Trek-esque language (:

Here, we introduce optical rotatum, a behavior of light in which an optical vortex beam experiences a quadratic chirp in its orbital angular momentum along the optical path. We show that such an adiabatic deformation of topology is associated with the accumulation of a Gouy phase factor, which, in turn, perturbs the propagation constant (spatial frequency) of the beam.

"Captain, if we can't reduce the adiabadic deformation of the Gouy phase factor, we'll never escape this optical vortex beam!"
by 9rx | 2025-04-15 15:35:08+00:00
> I am open to someone making such a point

Someone else is not you presenting an argument. You making an argument about what you know about 1+1=2 is what is boring. Let's be real: You're not going to do it. Why would you? You are already confident in your understanding.

I mean, do it if you want. I'm not sure why you'd waste your time, though. You aren't going to gain anything from it.

Only if you really had no idea what is going on and wish to understand a topic in more detail would you go down the road of getting into an argument. But when you are in that state you are not in a position to have made a mind.
by pmarreck | 2025-04-15 15:35:16+00:00
https://www.youtube.com/watch?v=grj328-hlhA

Um, no. Watch this please. This is the same guy you're talking about. You won't be able to pull a "these people" after watching this.

> The petition describes him as a committed Buddhist who believes in "non-violence and empathy as a central tenet of his religion."

He's openly Buddhist, which means he is willingly enduring the risk of getting killed for being an apostate of Islam (a religion that I am openly a critic of, by the way).

This still sound like the "these people" you're unquestioningly grouping everyone into?

Do better next time.
by rickdeckard | 2025-04-15 15:35:27+00:00
Not disagreeing with you, but isn't the issue that the US stopped investing in the skills and infra which made mass-production low-skill in the first place?

Instead, the offshore-destinations kept offering more and more services in the value-chain, until the entire skillset to actually create the low-skill labor processes to offshore was replaced with "let the offshore company manage".
by clutchdude | 2025-04-15 15:35:31+00:00
Ok - so here's an example I can provide input on.

I have a bunch of white oak from a tree I cut down and had milled into lumber.

I wanted to make a bunch of benches for friends/family, etc. I have the lumber so all I needed was the bench ends/legs.

I looked at the domestic options and it was going to cost. I couldn't find anyone that would sell a set of legs for under $300 a piece or wanted me to "contact them for pricing." and that's all BEFORE shipping.

Keep in mind that your local bigbox store sells an almost exact replica of the made in China bench legs with crap lumber for $99. It'd be cheaper for me to buy those, junk the lumber and use my own.

I then checked alibaba and walked through the process of getting RFQ. The competent sellers who knew what I wanted and what to do were easy to work with and quick to check the various shipping costs - the per unit price would be pretty low($20ish even with my low volume order) but shipping would be $50-$70 a per set of legs due to the weight of the cast iron. BUT, now, even with tariffs, that leg would go from $~90 to $180ish AND I'd still be well below what the domestic cost is.

If I go forward at all, I'll still probably go with the Alibaba folks. I don't see how USA manufacturers will suddenly start producing these sort of bulky intermediary consumer products anytime soon.
by jarbus | 2025-04-15 15:35:48+00:00
I've been trying to figure out how to talk to folks on the right, and I keep looking for something, anything, I can say to make them realize the danger we are in. Reading this comment was therapeutic, because I think it's completely on the money. We can't change people's minds in a single argument; we can just try and nudge them in the right direction and hope they join us eventually.
by belter | 2025-04-15 15:36:08+00:00
customer support automation - "Sorry, I didn’t understand your request. Please type your issue again…" is the fastest way to make someone hate your brand.

marketing copy -> Not paying my marketing team to put out obliviously AI generated texts. People will notice and will hurt the company reputation.

sales automation - As in? Perfect place for random hallucinations?

internal knowledge base - Search in pretty good in full text. Training a model with all company data will be too expensive to justify the benefits of finding the correct technote one second faster? Plus do we want to hallucinate while doing airplane maintenance?

analytics - Not enough to justify current valuations.

onboarding & hr - Really? Hallucinations cough...cough

notetaking - You need AI for that?
by kortex | 2025-04-15 15:36:23+00:00
The nicotine bottle size constraint is a safety concern. Spilling a 200ml bottle of nicotine easily has the potential to cause lethality or morbidity through skin absorption, particularly in children. A 10ml bottle can still cause injury, but it is way more likely to be survivable.

In this case, the safety concerns outweigh the environmental concerns.
by hn_throwaway_99 | 2025-04-15 15:36:24+00:00
While I agree with the high-level point of this post, that is "You can’t (win an argument with a toddler). That’s because toddlers don’t understand what an argument is and aren’t interesting in having one", I found then the obvious follow on question "OK, if you can't win this argument, then what do you actually do when people in great positions of power are having these fake arguments/tantrums?" not even addressed.

For example, when some of the most outlandish and obviously false social media conspiracy theories first hit the scene (e.g. QAnon, the totally bizarre "JFK Jr. is alive" theory, etc.) I thought "OK, this is just bad fan fic, best to just ignore it." But then I was amazed and pretty depressed about how these theories gained traction, and sometimes in the highest levels of power. So I feel like the advice of "Just ignore toddlers having a tantrum" is pretty counterproductive when you realize those tantrums are actually serving a very useful (and in my opinion scary) purpose for the people throwing them.
by Calinterman | 2025-04-15 15:36:28+00:00
You better believe 4chan is as much of a government space as those other social media sites are. Just because you don't have to give three forms of ID and a mobile phone number to post doesn't mean they're not involved.

It's an illusion, a very believable one in an internet where billionaires try to goad you to include your name and address with every thing you post. I don't see why people care so much about Doxxing when every social media company makes them do it for free.
by woopwoop | 2025-04-15 15:36:52+00:00
Totally unrelated, but this reminds me of my favorite title of a math article: "How often should you beat your kids?" (it's about a certain simple combinatorial game)

https://people.mpim-bonn.mpg.de/zagier/files/math-mag/63-2/f...

(My favorite line: "Levasseur analyzes the game and shows that on average you will have a score of n + (sqrt(pn) - 1)/2 + O(1/sqrt(n)) while the kid will have exactly n. We maintain, however, that only the most degenerate parent would play against a two-year-old for money, so the question should be not by how much you expect to win, but with what probability you will win at all.")
by joshfee | 2025-04-15 15:37:01+00:00
How you define "external stuff" matters though. As soon as your function is calling another function, your test can be argued to be an "integration test", as you're now implicitly also testing the logic of the other function.

Alternatively you mock _everything_ and then your "unit test" ends up just being a tautological test asserting that "the code I wrote executes in the way I wrote it". (Not to mention that every time you mock something you are also implicitly asserting what the expected behavior of that thing is).

The only truly reliable tests are E2E tests, but they are too expensive to cover all possible permutations as there are just too many.

This is the catch 22 with testing, and we're always forced to make pragmatic choices about where to draw our boundaries to maximize the value (i.e. actual bugs caught) of them.
by noinsight | 2025-04-15 15:37:10+00:00
Orchestrate the renewal with Ansible - renew on the "master" server remotely but pull the new key material to your orchestrator and then push them to your server fleet. That's what I do. It's not "clean" or "ideal" to my tastes, but it works.

It also occurred to me that there's nothing(?) preventing you from concurrently having n valid certificates for a particular hostname, so you could just enroll distinct certificates for each host. Provided the validation could be handled somehow.

The other option would maybe be doing DNS-based validation from a single orchestrator and then pushing that result onto the entire fleet.
by jodrellblank | 2025-04-15 15:37:13+00:00
https://mathematicalcrap.com/2022/08/14/the-great-loyalty-oa...

"When they voiced objection, Captain Black replied that people who cared about security would not mind performing all the security theatre they had to. To anyone who questioned the effectiveness of the security theatre, he replied that people who really did owe allegiance to their employer would be proud to take performative actions as often as he forced them to. The more security theatre a person performed, the more secure he was; to Captain Black it was as simple as that."
by arghwhat | 2025-04-15 15:37:19+00:00
You are not required to seed immediately, nor even the same asset. Unless the rules have changed, you would usually just be required to maintain a particular minimum seed lifetime ratio that is easily achieved by idle seeding a library.

The point is to ensure network health with a metric that is simple to understand and verify: that you have been a productive. If you aren't seeding, someone else has to pick up the slack and the network didn't benefit from you obtaining the blocks.

The community itself benefits by giving members a guarantee that stuff there is available with abundant bandwidth, instead of relying purely on the unpaid goodwill of others.
by SoftTalker | 2025-04-15 15:37:40+00:00
Yeah pretty funny to see mostly the same people calling for a $20+/hr "minimum wage" on one hand, and bemoaning the tarrifs on the other hand. They will tell you that if you can't pay your employees that much, then you don't have a viable business. But they will turn around and whine about how their cheap Chinese crap purchases are now going to cost what a "viable" domestic producer would have to charge.