MurphyA/hacker-news huggingface dataset:
by DyslexicAtheist | 2025-05-11 08:53:41+00:00
> Modern implementations must support a range of TLS protocol versions (from legacy TLS 1.0 to current TLS 1.3)

So this statement is strange considering "modern" security standards either nudge you (or demand) to deprecate anything that isn't v1.3 or v1.2.

If the implementation is "modern" why would I allow 1.0 ?

This seems like a HA-Proxy problem. They ought to maintain support for geriatric TLS versions on a dedicated release branch connected to a support-model that nudges their client into updating by increasing their fees for maintaining that system. Not doing so means the vendor is part of the problem why we have slower adoption rates for 1.3 than we could otherwise have.

It would have been cool to see AWS's s2n-tls (or s2n-quic https://github.com/aws/s2n-quic) included in their benchmark.

One of my all time favorite episode from the SCW podcast goes into the design decisions of s2n:

The feeling's mutual: mTLS with Colm MacCárthaigh https://securitycryptographywhatever.com/2021/12/29/the-feel...

From AWS: https://aws.amazon.com/security/opensource/cryptography/

> "In 2015, AWS introduced s2n-tls, a fast open source implementation of the TLS protocol. The name "s2n", or "signal to noise," refers to the way encryption masks meaningful signals behind a facade of seemingly random noise. Since then, AWS has launched several other open source cryptographic libraries, including Amazon Corretto Crypto Provider (ACCP) and AWS Libcrypto (AWS-LC). AWS believes that open source benefits everyone, and we are committed to expanding our cryptographic and transport libraries to meet the evolving security needs of our customers."

Here is a pdf that provides some performance results for s2n (sadly not s2n-quic):

"Performance Analysis of SSL/TLS Crypto Libraries: Based on Operating Platform" https://bhu.ac.in/research_pub/jsr/Volumes/JSR_66_02_2022/12...
by smokel | 2025-05-11 08:54:02+00:00
It is indeed the title that trips me up. When I was their age, we would call similar efforts "play", and we certainly didn't pretend to be the next Bill Gates.

I'm not saying that one or the other approach is objectively better, I was merely sharing my personal opinion on the matter, so that perhaps someone can learn from that data point, or to offer some comfort to those who frequent Hacker News for the critical thinking rather than the money-making news.

(Apart from the title, the website with legal matter suggest a focus on things that I certainly do not associate favorably with a "hacker".)
by neltnerb | 2025-05-11 08:54:17+00:00
Yeah, the article is bait.

The original research just says "Global increase of lianas in tropical forests", the addition of "from space" is to get clicks here.

https://onlinelibrary.wiley.com/doi/10.1111/gcb.17485

That's the better link to use for this anyway. It's open access so no reason not to go to the source.

It appears to be heavily statistical and based on scraping many studies for a meta analysis.

"Our meta-analysis resulted in 505 effect sizes (ES) extracted from 39 unique studies (Figure 2). An initial exploratory analysis following the vote counting approach showed a general trend of increasing liana prevalence throughout the tropics is evinced by 333 positive ES (66%) compared to 172 ES (34%) with decreasing or stable trends. After grouping ES per life stage and aggregating the results reported at the species level, 155 ES and their respective standard errors (SE) were obtained. The general increasing pattern and its geographical coverage hold for the reduced dataset, with 112 ES (72%) showing an increasing trend."
by DocTomoe | 2025-05-11 08:54:32+00:00
You may not have experienced gaming in the 1980s and 1990s. Games back then were more than just a stream of bits. They had physical maps (sometimes on cloth, not paper). They had actual manuals (and many of them were art in itself). Disks were in strange, unusual colors, later CDs had shapes, or hidden audio tracks. I vividly remember a copy-protection scheme of black, slightly shiny ink on black paper to prevent photocopying (to read one of the 400 random codes, you had to tilt the page just right.

That needs to be preserved. Just making a digital copy isn't enough.
by indrora | 2025-05-11 08:55:03+00:00
Not even the first of firsts;

https://cve.mitre.org/data/board/archives/2016-06/msg00006.h...

(my old blog is long gone from tumblr, but I archived it:)

https://gist.github.com/indrora/2ae05811a2625a6c5e69c677db6e...
by hn_throw2025 | 2025-05-11 08:56:31+00:00
> doing the opposite of what it was founded for, which was to end european wars

The European Coal and Steel Community was created in 1952, to make it harder for members to have the independent industrial capacity to mobilise against each other. Particularly France and Germany, whose grievances began with the Franco Prussian war of 1870 and rumbled on through two world wars.

It became the EU federal superstate we have today because politicians can’t resist a power grab. The EU was created in 1993, so the entity you refer to was not created to end European wars. Because the “member states” (it will never refer to countries) had already been NATO members for decades at that point, guaranteeing each others safety and making invasions like the previous ones unimaginable and infeasible. In fact, with it’s obsession of absorbing more territory and people, gaining power, and lukewarm attitude towards NATO, I think it’s more likely to start a war than prevent one.
by ZoneZealot | 2025-05-11 08:57:26+00:00
A wildcard certificate is only for a single label level, '*.example.com.' would not allow 'test.test.example.com.', but would allow 'test.example.com.'. If someone issued a wildcard for '*.asus.com.example.com.', then could present a webserver under 'driverhub.asus.com.example.com.' and be seen as valid.
by mschuster91 | 2025-05-11 08:57:39+00:00
> My personal opinion is that some people dislike the idea that people may enter a hobby without serious financial commitment. Not having to spend $300 on a HT means that unserious people might want to use a radio to talk about life instead of a radio to talk about radios.

Agreed! But nevertheless, I'd say that adding a bit better filtering would go a loooong way, as would better quality control - and it wouldn't raise the price of the device too much.

Baofengs et al are a somewhat decent way to get started and gain voice practice - I started on a Quansheng myself - but they're not useful for anything else than 2m/70cm repeater nets.
by bcraven | 2025-05-11 08:58:05+00:00
"visible in satellite imagery" is the quote in the article, which is refined in the paper as:

Stand scale (900-m2 scale) data used satellite imagery from previous studies to contrast liana-infested and liana-sparse forest patches in Bolivia and French Guiana. In both cases, we obtained the original images used, which included a 30-m resolution Landsat Thematic Mapper (L1TP) image (French Guiana) and hyperspectral Hyperion imagery from NASA's EO-1 satellite (Bolivia).
by apt-apt-apt-apt | 2025-05-11 08:58:28+00:00
The generated [Latin Jazz with small band with acc. guitar](http://rochus-keller.ch/suno_2025/RadhaKundha_suno_latin.mp3) sounds awesome, like an upscaled version of the original.

[Now I see what you mean by playing them all live at once.](https://www.youtube.com/shorts/S82hsEDY8Pc)

Being able to scrub to the middle of songs would be nice, it's too much effort for 99% of visitors to figure out that we need to open links in a new tab to get to the raw, scrubbable mp3.
by IlikeKitties | 2025-05-11 08:59:01+00:00
> You are also making legitimate, fixable in a month issues available for everyone which increases their chances to be exploited a lot.

I don't think you can fathom the amount of people that have phones with roughly 3 years of no android updates as their primary device with which they use all the digital services they use, Banking, Texting, Doomscrolling, Porn, ...

Users, especially the most likely to be exploited are already vulnerable to so much shit and even when there's a literal finished fix available, these vendors do shit about it. Only when their bottomline is threatened because even my mom knows "Don't buy anything with ASUS on it, your bank account gets broken into if you do" will we see change.
by A_D_E_P_T | 2025-05-11 08:59:25+00:00
> It costs billions of dollars to bring a new drug to market

Have you ever wondered why this is the case?

In the "Golden Age" of pharmaceutical development -- from roughly 1930 through 1962 -- it cost orders of magnitude less, adjusted for inflation, was much faster, and outcomes were no worse.

I'd argue that the new (post-1962) Phases II and III -- drug efficacy studies -- are wholly unnecessary and are indeed unethical.

First, because you can't even presume to gauge a drug's "efficacy" without huge and exorbitantly expensive trials -- and, even then, trials can be inconclusive.

Second, because the FDA selectively ignores efficacy data. See, e.g,. flibanserin and certain Alzheimer's drugs that have been approved recently. This was scandalous, but not nearly scandalous enough.

Third, the statistically sound way to find both rare harms and true-to-life benefits is to watch how a drug behaves in millions of real patients, not in a few thousand volunteers. Modern electronic-health-record feeds, claims databases, and wearable data streams let regulators run near-real-time Bayesian safety signals across populations that dwarf any Phase III cohort; the surveillance network that caught rofecoxib’s cardiovascular signal in 2004 had orders-of-magnitude more patient exposure than the approving trials, and today’s infrastructure is far denser.

It would literally be 10x faster, 100x cheaper, and 100x easier to grant conditional approval after Phase I and then run postmarketing surveillance. You'd better signal-to-noise on both efficacy and harm at a small fraction of the cost and time. It's downright perverse to outlaw early access to promising investigational drugs, forcing patients to wait 8-12 years, and then foot them with a multibillion-dollar bill for ritualized trials that are unnecessary -- for the same ends could have been attained in far better ways.
by hilbert42 | 2025-05-11 09:01:15+00:00
One thing I forgot. There's another good reason to hold CEOs and others personally responsible and punish them accordingly as it acts as a deterrent. Whenever we see Google, Facebook, etc. get levied with fines we rarely learn who the nameless gnomes are who perpetrated the act, or approved it, etc. Knowing that their names would be in the public domain would send shivers down their backs, even if acquitted it would likely not bode well for future employment.

Moreover, CEOs, directors, boards etc. should also be held accountable even when they are not directly responsible (like captains of ships are). This would have the effect of ensuring that those in charge would mandate an ethics and behavior policy for the company and ensure that all employees were aware of it, and violation thereof would result in dismissal.

Thst said, to be fair, you can't blame management for the unacceptable behavior of a wayward or stupid employee. Commonsense must prevail and laws must allow for such things.
by Almondsetat | 2025-05-11 09:01:19+00:00
>Mathematicians, for example, intuitively understand math.

They can intuit all they want, and good for them if it makes them more efficient in their job. But at the end of the day, if you have to convince others of your intuitions you have to provide verifiable proof. Your intuition might help you overcome a hurdle when proving a theorem, but, still, prove it you must.
by smokel | 2025-05-11 09:01:47+00:00
I thought "toi la mot con Lua" was French for "You, the word with Lua!", the well-known, but not to me, scripting bible.

Turns out I misread the Unicode, and it is actually "Tôi Là Một Con Lừa", which is Vietnamese for "I am a donkey", which probably makes it suitable reading material for yours truly.
by DocTomoe | 2025-05-11 09:02:49+00:00
> To extend that to games, it doesn't matter if you're playing the MS-DOS version of X-COM or OpenXcom.

Oh boy, are you mistaken. The 1990s version of XCOM was a mess. If it wasn't enough that it was hard as a nail, it also was buggy beyond belief. To many of us, X-COM (and to a lesser extend the reskin 'Terror from the deep') was what started the 'compulsively save the game after every move' trend. OpenXcom in comparison is a lot more forgiving.

> The whimsy of the Mona Lisa in person isn't actually all that deep.

That is in large parts because you never get to experience the original as you are the copies. You always have a thousand tourists around you, all loud, all pushing to get a glimpse of the real painting once in their lives. They do not understand art needs time to work, impressions do not come between a hotdog and a trip to a café - that is why in most galleries, you see little benches that invite you to sit down and immerse yourself in a picture.

Similarly ... just giving the games to anyone without context will lead to people pushing and prodding, getting bored or frustrated easily, and eventually losing interest. For those people, it doesn't matter if you give them a masterpiece like Ultima III or junk. They consume, they move on. Abandonware sites exist for them. A scholarly archive of gaming history, not generally available to the public, still is useful.
by holowoodman | 2025-05-11 09:03:23+00:00
"Responsible" disclosure is paradoxically named because actually it is completely irresponsible. The vast majority of corporations handle disclosures badly in that they do not fix in time (i.e. a week), do not attribute properly, do not inform their users and do not learn from their mistakes. Irresponsibly delayed limited disclosure reinforces those behaviors.

The actually responsible thing to do is to disclose immediately, fully and publically (and maybe anonymously to protect yourself). Only after the affected company has repeatedly demonstrated that they do react properly, they might earn the right for a very time-limited heads-up of say 5 work days or something.

That irresponsibly delayed limited disclosure is even called "responsible disclosure" is an instance of newspeak.
by 7bit | 2025-05-11 09:04:02+00:00
I am a sysadmin and we will enable this. This is because many meetings discuss confidential or strictly confidential information that must not be leave the meeting. In-house, you would simply hand out papers that you collect before concluding the meeting. In Teams meeting it's not possible hence you block people from creating screenshots. This requirement comes from legal and compliance, and many other positions from CEO downwards.
by ben_w | 2025-05-11 09:04:08+00:00
How much vitamin C is in a snickers bar? I think you'd get scurvy within a month or two if that's all you had.

How much vitamin A? Night blindness. Vitamin B? Neurological issues, confusion.

That's the thing with mono-diets, your body needs a diverse range of things that it can't synthesise itself.

But to the core point, in cases where the output of an LLM is good enough, many already have much lower energy requirements than humans: o4-mini is currently priced at $1.1 per million tokens of input and $4.4/million tokens of output; if that's all being spent on electricity at $0.1/kWh, that's a max of 11 kWh/million tokens in and 44 kWh/million tokens out — how many calories would a human have to burn to read, write, hear, speak, and internally monologue the equivalent of a million tokens?
by mjg59 | 2025-05-11 09:04:51+00:00
Yeah, no drivers required, merely the ability for userland code to smash hardware by hand. That's a terrible situation. You want to adjust screen brightness on a Thinkpad right now? Write to the appropriate control registers in the GPU to send commands over the relevant eDP sidechannel and you can do that, except any modern operating system will prevent you from doing that because you're going to be racing against anything else that's trying to use the same index/value interface, and now you tried to adjust the brightness but actually changed some other value and now your screen is displaying garbage. You know how your brightness hotkeys used to work? They generated system management interrupts, which caused the CPU to STOP EXECUTING THE OS and EXECUTE OPAQUE CODE IN A HIDDEN AREA OF RAM, and THAT FUCKING SUCKED. Now they simply tell the OS that someone hit the key, and it's up to the OS to hook that up to actually doing something as a result. Is the user experience worse? Eh yeah in some ways, but if anyone cared enough we could make it better. Is the past a better place? Fuck no. In the past HP managed to screw this up such that if the hotkey interrupt ended up being serviced on CPU 1 it would restore the CPU registers on CPU 0 instead, and you'd crash immediately (Windows handled all of these on CPU 0 so it worked by accident).

Simple interfaces were fine when we didn't have pre-emptive multitasking, and didn't have SMP. Life is better now. Having mediated interfaces where we can ensure that anything accessing the same hardware is doing so in a controlled manner is a good thing. And, counter to your claim, this is a space where vendors do stuff in spite of Microsoft in ways that make it harder for Microsoft to provide a well-defined user experience - this is literally vendors trying to differentiate within the space Microsoft allows, not something that allows Microsoft more control.
by DocTomoe | 2025-05-11 09:06:13+00:00
See, here's the thing: Archives do not have pedestals - they use archival storage. This may come in different forms, but to the uninitiated eye, it often looks a lot like narrow pathways between storage shelves, with labeled cardboard boxes, which may contain, in acid-free paper, sometimes with foam inlays - objects.

Archives exist to preserve what is there, not to show it off. Sometimes, that's for future scientific research. And sometimes, they may participate in museal work as well, lending off objects.
by diegoperini | 2025-05-11 09:06:42+00:00
> Linux separates things such that I was looking at C files in drivers/platform/x86 and header files in include/linux/platform_data/x86. And the ACPI code lives other places as well. It’s all very orderly, but at times it felt like navigating a grocery store that arranges products in alphabetical order. Logical, but not exactly cozy.

So beautifully put!
by lerno | 2025-05-11 09:08:17+00:00
Out of C3, Odin and Zig, Zig is actually the language with the worst SIMD support. Odin has SIMD vectors, array programming and built in matrix types while C3 has built in SIMD vector types and operator overloading for userland numerical types such as matrix and complex types.

Odin and C3 has things like swizzling, assigning a scalar to all elements etc out of the box, whereas Zig is similar to C and just provides compiler builtins. Compare `vec * @splat(foo())` (Zig) to `vec * foo()` (Odin/C3).
by IlikeKitties | 2025-05-11 09:08:47+00:00
I mean, to be a bit more reasonable, there's a middle ground here. Maybe disclosing a massive RCE Vulnerability in software used by a lot of companies on 25th of December is not a good Idea. And perhaps an Open Source Dev with a security@project mail deserves a tad more help and patience than a megacorp with a record of shitty security management. And if you are a company that takes security serious and is responsive to security researchers inquiries they deserve at least the chance to fix it fast and before it becomes public.

It's just that there are some companies EVERYONE knows are shitty. ASUS is one of them.
by keiferski | 2025-05-11 09:08:54+00:00
It's designed more for kids, but I found it useful for understanding basic accounting concepts: The Accounting Game: Basic Accounting From the Lemonade Stand.

I also found two of the novels in Clavell's Asian Saga to be quite business-focused: Tai-Pan and Noble House. Not so much for the nuts-and-bolts of business, but just a large business organization being founded and growing over the course of multiple centuries.
by ricardobeat | 2025-05-11 09:09:36+00:00
That’s a very generous interpretation. I don’t know mandarin but these are likely a transfer of grammar constructs from the primary language to english, in the same way the Dutch will say “make a picture” or “the house of my parents”, which can be justly classified as awkward rather than as linguistic flair.

If someone was editing my writing, it would feel a bit patronizing if they said grammar mistakes (many of which come from my mother tongue Portuguese) are “adding flair”, as they are not a stylistic choice.
by rendx | 2025-05-11 09:09:40+00:00
> unconventional Google-filing trick

Documented as "subadressing" in RFC 5233, and the default for both sendmail and postfix, amongst others. As such, often 'accidentially' supported by many mail providers even when undocumented. Google didn't introduce them, nor are they 'unconventional'.

https://www.rfc-editor.org/rfc/rfc5233
by tim333 | 2025-05-11 09:11:41+00:00
Worldcoin is supposed to be anonymous - you don't give your name. A theory behind it was on things like HN you could show you were human without having to do a KYC id proof, though that never took off, at least in two years I haven't come across it. In practice it works as number go up crypto ponzi like most of that field.
by Johanx64 | 2025-05-11 09:11:50+00:00
You have to allow people start using the app without creating accounts. Any accounts at all to try it out.

The first thing I learn about this app on the landing page - is that it's going to be a business and what it's pricing plans are.

This is before me being SOLD on the damn thing to begin with.

So the order the app introduces itself is:

1. Pricing (it's a SAAS)

2. Asks to create an account.

3. The user here closes the tab somewhere here, unless they apriori know they want whatever it is you're offering. Or they have been sold this from word of mouth.

The order it should be in:

1. Oh, wow, this is cool. I like this, this is exactly what I need. So lets create an account to save the things I've already created here while playing around.

2. As you create account, introduce user to pricing plans and extras you get from a paid account.
by 7bit | 2025-05-11 09:12:32+00:00
Thank you for this. I'm honestly baffled about the quality of other hackers' comments on this topic. Many of them take the feature as a personal attack where it simply is an additional layer of protection against accidentally leaking confidential information. Then making statements that this prevents people from working, where they did not understand that taking screenshots from meetings where this is enabled is not working, but violating work guidelines. When the presenter enables this, they want people to not take screenshots.

This whole comment sections is honestly ridiculous.
by messe | 2025-05-11 09:12:42+00:00
In larger programs, that compile time parsing can lead to even more code, as the function is essentially instantiated and compiled separately for each and every invocation. The type erasure provided by printf, can be a blessing in _some circumstances_.

That being said, in those larger programs, it's still likely going to be a negligible part of the binary size, and the additional code paths are unlikely to affect performance unless you're doing string formatting in multiple hot-paths which is generally a poor choice anyway.
by jampekka | 2025-05-11 09:12:48+00:00
Depends on your interests. Chalmers is probably the most influential philosopher of consciousness, and I find the most reasonable. The article definitely shouldn't be dismissed off-hand, but it may be a bit difficult to appreciate as is, as it's more of a brief comment in a lot wider discussion.

Good starting point to the topic is Chalmers' "Facing Up to the Problem of Consciousness".

https://consc.net/papers/facing.pdf