skysight-inc/HackerNews huggingface dataset:
Isn't the Advanced Portable just a regular ATX-sized box?
http://www.dirtydicks.co.uk/

Bishopsgate, nearest tube is Liverpool Street. Mind your head there are some low beams in there.
Could anyone comment about whether any file-related Ansible modules use scp by default instead of sftp?
https://hn.algolia.com/ only searches the text content of the submitted stories (as in the title and url) and the comments.

It doesn't index the actual article content nor take into account links across sites and content like Google does. Algolia (as self-described) is designed to search for things (like products in a ecommerce store) rather than text with concepts, relations, and entities in a knowledge graph like Google.
Would you please stop posting in the flamewar style to Hacker News? You've done it a lot, and it's tedious and grating.

https://news.ycombinator.com/newsguidelines.html
> One-trip tickets on the Tube were surprisingly expensive, £4.90. This is likely a form of price discrimination for tourists, as the cost for the Oyster and Contactless payment cards is much lower.

My understanding of this is that its actually price discrimination against people buying paper tickets, as they're more likely to have problems at the gates and result in a queue backing up.
I am always surprised when I find out that developers with bold claims to fame have not heard of Sphinx [0] and of Xapian [1]!

[0]: http://sphinxsearch.com/

[1]: https://xapian.org/
Regarding SIM hijacking, I had no idea that it was so easy and widespread until I listened to a great episode of Reply All about it: https://www.gimletmedia.com/reply-all/130-lizard
Sphinx – Open Source Search Server
If macros are running at compile time, then we don't think that this particular code is self modifying.

If we run code in a Lisp interpreter, then one can write self-modifying code. It's possible to get visible effects. It's also possible to use it during debugging code.
Location: California
Remote: No
Willing to relocate: Yes, but not to the Bay Area
Technologies: C++, C, Java, In-House Tooling
Résumé/CV: https://www.dropbox.com/s/e0k3yyu4z27h0ck/resume_current.doc...
Email: See Résumé
I'm missing some open source software

Bitwarden or KeePass for password management

FreeOTP for 2FA

cut off headphone jack plugged in in your laptops mic port complementary to the webcam covering
> Even if the devs don't need Turing-completeness, not adding it to a project is effectively limitating what the user can do with a program.

But limiting what people can do with build systems is generally a good thing.
Amazfit Verge vs. Samsung Gear S3 vs. Galaxy Watch Compared
Others gave good answers I think, so I'll just address your points directly.

> [Nix is] so complex with layers of interesting syntax and puncation

Precisely. Guix uses Scheme all over the place. It's just _one_ language for everything, not multiple languages. As a result, it's easier.

Scheme yields very easy-to-read declarations (see https://ambrevar.xyz/guix-packaging for some examples), so JSON & friends don't add much here.

> Parsing and automation

Parsing couldn't be simpler than using the language itself! There is no need to write an interpreter here.

> Why do I need to learn yet another language just to configure and manage my system?

That's precisely part of my thesis: with Guix, you only need to know Lisp/Scheme (which users might already know since it's a general-purpose language). Programs going for a DSL are effectively forcing everyone to learn a language for the sole sake of using the programs.
> >All drugs that are dangerous should be illegal. Marijuana is a drug that is dangerous. Therefore, Marijuana should be illegal.

> The final clause does not actually follow from the rest of the logic

The final clause follows formally from the truth of the first two clauses. What you are complaining about is that the final clause is not true. But the question being asked of the study participants is not whether the argument is true, but whether the final clause follows if the first two are true. You are exhibiting exactly the behavior the study is testing: giving a wrong answer to a question of soundness by substituting for it a question of truth.

There is, perhaps, an argument to be made that "logical reasoning" in the sense being tested - being able to tell valid from invalid syllogisms - isn't all that pertinent in the real world. Is that what you're saying, though? I find it hard to tell.

> >Judge Wilson believes that if a living thing is not a person, then one has the right to end its life. She also believes that a fetus is a person. Therefore, Judge Wilson concludes that no one has the right to end the life of a fetus.

There is a logical problem with this argument, independent of any of the issues you bring up. Consider it divorced of context:

W believes: if an X is not Y, then it is a Z.

W believes: this particular X is Y.

W therefore believes: this particular X is not Z.

(Key: W = Wilson, X = living thing, Y = a person, Z = may-end-life.)

The problem is that just because (X & not Y --> Z), doesn't mean (X & Y --> not Z). In other words, thinking it's okay to end non-person's lives doesn't imply thinking it's _not_ okay to end person's lives. Concretely, for example, one might think killing in war is justified.
Used notion for about 6 months, but stopped for two main reasons:

1. It's extremely slow on even a new iPhone - about 6-7 seconds until I can start typing a note. By then I forget what I wanted to write. It's basically a webview of a very heavy web app, so it's not snappy at all.

2. No offline support whatsoever.

In addition it feels like they have abandoned development or are busy being acquired (~bi-weekly updates until about three months ago: https://www.notion.so/What-s-New-157765353f2c4705bd45474e5ba...)

I migrated back to Bear (https://bear.app/) which was a pain - exporting from Notion is also not one of their best features.
Good luck packet sniffing an encrypted text blob of your conversations the device is transcribing.
> Steelman instead of strawman - seek the best form of the opposing viewpoint.

That's gold. Thank you.
> Crutches and leg braces: I saw many more people with crutches and leg braces walking around than I typically see in San Francisco. It was a striking difference, so I don't think it was just a fluke. A few hypotheses:

I too have noticed this. Does anyone have any explanation? Due to better health care? Worse health care? More of a walking culture? more interest in soccer which causes these types of injuries? Something else entirely?
Depends on how low the latency already is. If you're already <0.5ms away network wise then perhaps shearing off 0.1ms from a 1ms operation could make a significant difference.
> The attacker controlled server [...] drops .bash_aliases file to victim's home directory when the victim performs scp operation from the server. The transfer of extra files is hidden by sending ANSI control sequences via stderr. [...] Once the victim launches a new shell, the malicious commands in .bash_aliases get executed.

Sounds to me like everything the user executing the scp command can access can be compromised.
Reading

> Malicious scp server can write arbitrary files to scp target directory

looks like you don't need to `cd /tmp` before running scp, it's enough to scp _to_ a freshly created directory (`scp host:file /tmp/dir1`), inspect its contents and `rm -rf /tmp/dir1` afterwards.
I was shocked to find out is seems there's the same limitation on Spotify, this is just lame. There's no other way around it, streaming services only work because they're more convenient than the alternative, if they're not convenient then people simply won't use them.
This is sadly a good point...
Scribble and skribilo are not finished, there are some (very unfinished) works to implement a new PDF generator (at least for skribilo).

I only said it was a "better idea", not a "better finished product", but I should have been more explicit. Will fix.
Trust me, you're much better off not knowing.
This is powering CloudKit. Very cool!
I'm not saying it's good, i'm just pointing out that we might need to reconsider capitalism as the main tool to structure our economies.

Most of the areas you mention are funded by other revenues, either directly by companies, or indirectly by governments taxing revenue or income. Without revenue most of these areas will also see reduced budgets.
Alibaba's 'City Brain' is slashing congestion in its hometown
For 2 & 3 neither use "if and only if" so I am interpreting those two as intentially unsound syllogisms.

Do people commonly expand "if" to mean "if and only if" outside of a conversational setting where it's implied? I would think in a small body of text people would only refrane from doing so.

I'd be interested in having the per syllogism results to see if this impacted the accuracy of the respondents.
I believe you need to set scp_if_ssh = True in ansible.cfg for scp to ever be used, even if sftp is not available on the remote host.
There is an electric BMW that has a loudspeaker in a fake exhaust pipe to make it sound like a petrol engine to people outside of the car.

I think the negative effects of noise pollution are underestimated. It's never properly taken into account when people plan things. Part of it is many people don't understand just how soul destroying it can be (yet).
99% of the time SSDs are a boolean: "Do you have a SSD? Yes/No" and performance between different SSDs is basically unnoticeable. Change my mind
apt-get install recoll

Consider your problems solved...
> The attacker controlled server [...] drops .bash_aliases file to victim's home directory

This can only happen if scp is invoked from the home directory (or from root or /home).
> its a gamble for them to get such chips

Hardly, since the "rejects" will just be sold as the regular model(s).

In the old "lottery" system the rejects would end up on the secondary market, making Intel's final revenue effectively the same as if extreme overclocking wasn't a thing.
I read it as being MitM and manipulating target (final, originally intended server) directories and files only, and in addition to spoof output to client to hide the fact it's doing so. In that case it does not matter where you run the client.

What makes MitMs possible is that checking fingerprint of new host is left to user. Instead we should have processes to automatically
1. acquire via other means and add fingerprint of each new target host
2. verify new host fingerprints with a separate party (central server or a ring of trusted buddies).
That example requires the user to copy something to the home directory. If you copy something to /tmp, or to a subdirectory of your home directory, that attack is not possible (according to my understanding)
Agreed, this would be excellent, would use it myself all the time.
Also some types of HFT don't rely on network latency at all, it can be based on other factors.
Damn, a sweeping generalisation if ever I've seen one. Are all the people using c++, java, haskell just mediocre devs because they like the safety brought by a type system over lisp or python? Microsoft, Facebook, and Google all wrote either a type system over JS or a JS alternative because of the problems they faced with vanilla JS. Facebook is even doing both ‍️.

Perhaps spending some time looking at how certain libraries write their type definitions will help you learn how to use them, if you're constantly fighting you are probably missing some fundamental concept that TS operates with. TS has also gotten much better at expressing more complex types over time and there are still more things on the roadmap.

For me TS only grows more useful as the size of the codebase increases. It allows safe refactorings you could only dream of in a large JS codebase.
Or, more charitably, they are integrating that. In some industries, these high binned chips are a crucial competitive advantage, and I don't see any reason why they shouldn't validate the performance of each chip they sell (at least in HEDT, other product lines I can see having little or negative return from an approach like that).

Maybe they could even just make it explicit for all their products: market them by die type, configuration, and peak stable base clock.
I mean, healthcare is OK to throw to employees, IMO, provided the employer is willing to pay more to compensate the employee. It's not a difficult thing to procure. I've had my own insurance for over a year, and yes, it's pretty expensive, but if I were someone else's employee and my employer covered a half or 2/3rds of the cost, I'd be pretty happy. The cognitive overhead is about the same: you just review your cost increases at the end of the year and sigh.
I think I'm missing something. Step one is getting you to use a compromised server. Which either means the server your home directory is on is compromised (I’m assuming you have a login on the box, separate from your local home dir), in which case scp is the least of your worries, or they get you to bounce through a MITM server, in which case you have to accept an incorrect host key.

If you're accepting incorrect host keys, then you're completely breaking the ssh security model anyway.

I guess I don't understand how this is actually any worse than how ssh already worked?

Edit: To clarify, I understand why you’d want to fix this, for a good depth of defense. I’m just saying I don’t feel any urgency in fixing this.
If you look at https://guix-hpc.bordeaux.inria.fr/browse?
you'll find most of your wishes there, and many more to come hopefully.

Guix is also working on an installer to help reducing the friction. I'd personally like to work on a fully graphical install + package management.

While Guix sounds like some heavy scientific stuff, it really is a powerful base that allows anything to grow on top, including user-friendly interfaces.
> If I want an environment where I have VSCode with the Go extension installed, I would prefer that to be isolated from other VSCode instances.

You can absolutely do this by overriding the derivations. The tool to automate your workflow is there(just create a bunch of nix files and a makefile to call nix-shell/nix-build), but not as convenient as you might like.
This is amazing! Just a note: I had to mkdir the directory in ~/.vim to get it work.
No, agreed. The NHS is very popular amongst the majority:

- Seventy-seven per cent of the public believe the NHS should be maintained in its current form. This level of support has remained consistent over almost two decades despite widespread social, economic and political change.
- Around 90 per cent of people support the founding principles of the NHS, indicating that these principles are just as relevant today as when the NHS was established.
- A clear majority (66 per cent) of adults are willing to pay more of their own taxes to fund the NHS, underlining growing support among the public for tax rises to increase NHS funding.[1]

[1]: https://www.kingsfund.org.uk/publications/what-does-public-t...
I quick test with strace and git shows that git doesn't use scp for handling ssh remotes. I suspect that git is hardened against similar attacks (a malicious server dropping files into .git/hooks would be worrisome).
This! I also don't think that you need frameworks for simple websites. If you are familiar with one, OK; but if you are not, you need to learn the "framework".
> Bloomsbury, Hyde Park, Soho, Notting Hill, and Mayfair...
As far as I can tell from skimming the paper, it fails to establish that ideology impairs reasoning more than any other kind of pre-existing belief.

There is a well-established bias, called belief bias (which the paper mentions), against accepting the logical validity of arguments whose conclusions you disbelieve. The study tested examples of this where the conclusions were political (agreed with liberal or conservative viewpoints), but AFAICT did not use a control test where the conclusions were apolitical, but the participants still agreed or disagreed with them.

A control could have established whether political arguments were more (or less, or equally) susceptible to belief bias. But they didn't use one. So the study only establishes that political arguments are susceptible to belief bias.
Oh wow, I forgot about shoutcast and icecast, it's been a while!

Looking around, I see those stations still exist!
Why?

Also one core feature of Guix is that it cannot break: you can always roll back.
You can use Android system on your PC
I think what it's saying is that in the event you connect to a malicious server, that server is able to do more damage to the client than it ought to.

Should be fixed, but clearly not the worse vulnerability ever.
Serengeti National Park and Mount Kilimanjaro are both in Tanzania though.

Metaphorical Mount Olympus must lie in every human heart.
> how can they match hash of encrypted content without the key?

Right!? This sounds like, "We know you have it and we can see it, we just want the password to prove it was _you_ who did it."

Also, whilst I'm here, it does strike me as very odd that the justice system in the United States has such a raging evangelicalism about getting to the truth, that it will impose against a person's rights, just to get at that truth.

To refer to the old Eddie Izzard joke:

"If you commit perjury, I don't care. Don't give a shit. I don't think you should because you grade murder. You have Murder One and Murder Two. You realize that there can be a difference in the level of murder.

So there must be a difference in the level of perjury. Perjury One is when you're saying there's no Holocaust when, you know, 10 million people have died in it, and Perjury Nine, is when you said you shagged someone and you didn't."

The whole precept of the truth being this infallible end-gaol, which must be attained - no matter what, is just as abusively dehumanising as the phrase, "Well, if they weren't doing anything wrong..."

Sorry, wrong meeting... I'll see myself out.
I'm not sure if that's true - ownership of the foreshore seems (like many things in Scottish land ownership) quite complex - but the Crown does own about 50% of the foreshore:

https://www.gov.scot/publications/land-reform-review-group-f...
It's a bit of both I reckon. Even a lot of non-London Brits don't realise how easy it is to get an oyster card in the station, and very few know that you can just use contactless payments.
A more user-friendly installer is in the works and should hit Guix with 1.0.

Currently, Guix comes with pre-filled operating system declarations so that beside filling out the hostname and a few other options, there is little to do but run `guix system init`.

While Guix install is completely different from any other system (except Nix), it is suprisingly easy with nothing else but 2-3 steps (if you have Linux-libre compatible hardware, that is to say).
I'm a visual person, also dyslexic. I think in terms of relations between items. I also find nested lists helpful for something more 'ordered'.

The Kanban-style board a lot of people love does nothing for me unless using it for pure, strict Kanban. Sorting mixed stuff into 3-4 columns doesn't help, unless ensuring I am always progressing through those tasks. It loses the relationships between items which I see.

I plan to draw/write up my ideas this year. If you permit I'll keep in contact with you via email.
China's Moon mission sees first seeds sprout
Dropped in to say that too - that's pretty unusual. The vast majority of Brits think the NHS is a great thing, don't really care about the TV license and love the BBC.

I get that the NHS has this 'sacred cow' thing going on, where it's almost impossible to criticise and even proposing much change must be done tactfully... but this is because we think it's great, if underfunded.
If you let a something MITM you it will always be able to steal your files, no path validation will fix that. If you let something MITM you when copying files from client to server it should have no way of changing the destination directory (assuming you authenticate using asymmetric crypto), regardless of path validation. This vulnerability has nothing to do with that.

This vulnerability is only about copying files from the server to the client, and lacking path validation when that happens. This problem can be fixed without fixing MITM.
Bingo?
Which either means the server your home directory is on is compromised, in which case scp is the least of your worries

Well but what if the server doesn't tell you it's compromised?
*pop song

If you're writing pop, you want it to be a hit, and you want to use a non-standard chord progression? You better know your harmony theory inside out. Otherwise stick to the usual chord progressions.

I guess it's like saying "if you want to build a native iOS app, you should probably think very hard if you want to use something other than Objective-C or Swift to build it"
I think you misunderstood what I meant, I couldn't find Dirty Dicks in the article... :)
> Seems like they're mostly designing some database tables and then serving a front-end. Am I missing something?

Isn't it how all SaaS web apps are developed ? I sense from your tone that it shouldn't be taken seriously on the basis of it being trivial to implement.
> Which either means the server your home directory is on

How did you arrive to the conclusion that the server has your home directory? The threat model: It's a server that you can authenticate to, retrieve files from there but otherwise you don't trust. It has nothing to do with your home directory. The PoC attack just shows the danger of invoking scp from the client's home directory.
Fewer steep hills?
After the Google vs Oracle case i thought the courts decided the opposite of what you are saying: APIs are copyrightable and Google will have to pay aot of money for using them in Android.
It's not a good term for what people are describing here. Most will have been quite active in generating their income.
Also from my personal experience if you DO want to learn about a PHP framework: Laravel is a great framework and Laracasts is a great learning ressource, I wish more frameworks/languages had learning ressources like that (yeah I know Laracasts does some extra stuff as well :)) I can only recommend it.

That being said the other options are great as well, JS has come a long way since the days of yore.

PS: It's all going to be a bit... rocky in the beginning. No matter what you choose. It takes a while to wrap your head around everything but it is doable in a decent timeframe.
I think it's because they have to maintain ticket machines for the people who choose to buy single tickets rather than use their Oyster/Contactless. It means maintaining the legacy ticket infrastructure which is less efficient and more time consuming. Anyone can get an Oyster card at a vending machine and most people in the developed world have a contactless payment card.
sorry for terrible spelling, I meant anthropomorphic.
There is already a solution to this problem, which is host key certificates.

All you need to do is configure your SSH client to accept only host keys signed by your CA.

However, setting that up is complicated. You need a lot of knowledge to set that up securely. On the other hand, manual verification of host keys is trivial -- anybody can compare a short string of characters.
> I also started using NixOS around Christmas time.

Hah, me too. :)

> I really love NixOS, but I'm at best lukewarm on Nix as a language.

My biggest issue as of now is that the documentation focuses on which individual files you need to touch, but doesn't really explain the big picture. For example, /etc/nixos/configuration.nix contains a function that takes { config, pkgs, ... }. Where do these come from? Where can I find documentation for them? What is in the ellipsis? More generally, where can I find a high-level overview of how the different components interact with each other during, for instance, nixos-rebuild?