skysight-inc/HackerNews huggingface dataset:
> as explained by Ryan North’s webcomic xkcd in the image above

Sorry, what? Did Randall go on vacation on something?
> I think it’s mostly a completely false sense of security

I wasn't so much thinking about avoiding vulns due to added scrutiny as much as issues with updated libs, since most build processes pull gems, etc when deploying or rebuilding a container; I don't think many vendor the gems. Typically you'd ship the actual files you unzipped as opposed to letting the package manager grab the most recent version within version spec.
> I don't pretend that USA is perfect

OK, good.

> I have a bias that the company with the best technology should not be working with those that would love to destroy American values

I presume you mean China? China would "love to destroy American values" then?

TBH, I'm not sure if you're buying into the latest "red danger" FUD by the US gov and tabloid media, or if you work for them...
Claim is not about the ideas but people. It is like a fudge who build a website completely from scratch vs one who did it in Wordpress.

Talking to first one is interesting, second one not so much. The second website is most likely much better then first though
in most RDBMS it would be better to have fewer larger tables. you could use its internal partitioning if it has one. one problem you'll run into with many small tables is stuff like 'open_tables' limit (mysql) and that the cache efficiency declines. stick with built-in partitioning/sharding to avoid trouble.
> Dahua at first ignored ReFirm’s inquiries, then claimed the vulnerability was a simple error that had been fixed in the latest update. But when ReFirm looked through the updated firmware, they still found the same backdoor — just relocated in a different place in the code. (Huawei had done the same thing).

Regardless of which vendor we're talking about I fear that this simple admission of human error is going to repel any improvement justified by technological means. It is extremely easy, and entirely believable, to continuously blame human error, "junior devs", management, etc in the face of any discovered vulnerabilities.

The value of automated detection is to hopefully fuel a real boycott and/or government ban. I'm not specifically calling out Huawei here because I think it's entirely reasonable for other countries to do the same thing to U.S. companies. Hitting offenders in the only place it hurts, the bank account, is probably the only way inhibit this behavior.
This would be a great idea if NVIDIA was open to suggestions so that things could be fixed.

However, they mostly refuse to play ball. They did seem to be preparing an alternative suggestion, but they seem to have dropped it entirely in favor of just dumping EGLStream patches on KDE and GNOME, hoping every one else will be forced to follow.
I wonder if it has anything to do with rising minimum wage?
I agree. I actually spoke with the ReFirm guy ~2 years ago when they first found the Dahua vulns. I don’t see any new data or proof in this report. Also, as I recall the vuln was in a binary called ‘sofia’ or ‘sonia’ that was a modified version of what was possibly the Huawei POc code that shops with the SoC’s. It was unclear if it was really a ‘Huawei’ vuln or a Dahua one.

Might have some minor details wrong, working off memory, would have to check my notes...
Ask HN: What are some good newsletters that you enjoy reading?
Hi HN!

I've seen a decent number of people recently talking about email newsletters with good content on stuff like space exploration, science, and cryptography that they enjoy reading.

Wondering if anyone has suggestions for good ones to subscribe to (obviously doesn't have to be limited to the couple of things I mentioned).

These definitely seem like an interesting form of information consumption, so I'd also be interested in hearing what you think of them as a medium.
> it's even more true when you find someone who almost entirely espouses mainstream views

I've never met this straw man. Please present one so I can try to understand.

Also, I'd love for you to define mainstream which is such a fluid term as to be useless.
Chinese economists warn Beijing to prepare for decoupling from US
For a bunch of stupid, hysterical reasons, the Open Source X11 server still has all the warts of early-1990s release. XFree86 used the MIT X.Org core dump to implement open X11 on Linux, but outside of certain new things (DRI, XRender extension) it remained stuck in "world is dumb framebuffers with optional bitter" design.

Over time, a lot of useful stuff was broken and supported less and less, then reimplemented in bad way over compositors, instead of having composting Xserver like Xsgi.

Security extensions or even basic security tools (private input grab) got waylaid because toolkits didn't implement them (try running GTK3 on hardware without 32bit color GL or on system that defaults to lower bit depth than 32/24).

Generally, after letting it get more and more broken, the suggestion for big rewrite arrived. Said suggestion often results in something that resembles "devs first graphic stack", with a lot of basic, important features for daily life relegated to "someone will make an extension for it later" or "use D-bus to implement it elsewhere, and who cares about compatibility".
'...nothing at the ground surface had given this fault away before it fired off the quake. Some of the world’s best field geologists had scoured this area for the past 50 years...'
Show HN: Fzf-wordnet – Terminal/Vim dictionary and completion
That is correct because plausible deniability is very important.

However writing insecure code is also the defacto standard across industry, definitely including in the US.

If we accept this as proof, then Microsoft, Google, Facebook, etc, (all the way down like the turtles, until we hit every one man company) are all government controlled corporations deliberately installing sneaky back doors through security vulnerabilities in code, which cleverly simply look like incompetent programming.
What realistic alternative designs are there?
African leaders launch landmark 55-nation trade zone
Why isn't this titled "let's build a video card [youtube]"?
I wouldn't say the web of trust aspect is broken but non-scaling personally. Key servers and others are "compromises" in a way that can lead to being compromised.

If you don't have an effectively auditible trail of knowledge to be able to tell if someone attempted trickery then it doesn't serve the full purpose - but that doesn't scale well.
> NVIDIA's solutions is so fundamentally different that you'd basically maintain two compositors internally: One that handles every sane driver, and one that handles NVIDIA.

If Wayland had a standard compositor interface like X has, this wouldn't be a problem at all, would it? You could write your compositor that talks to the hardware using your "sane" interface, and someone else could write a compositor that uses the NVIDIA interface, and users could pick the compositor that works for them and use it with any window manager they choose.

It's only because of Wayland's design that "GPU manufacturer creates nonstandard interface to their driver" is some giant, existential, ecosystem-fragmenting threat to the open-source community.
I think we need to rely on this at some point, though. If my friend Alice introduces her friend Bob to me, that's my only way of determining that when Alice is talking about Bob, it's this Bob and not a different Bob.

I actually don't think there is a problem with the concept of a web of trust per se. It's a fact of life. I think that the software doesn't help you use it appropriately. Even if Alice says that a person is Bob, I should not be fooled into thinking that it really is Bob, or that Bob is trustworthy. All it says is that when Alice talks about "Bob", she means this person who we're calling "Bob". If "Bob" then introduces me to "Cathy", we shouldn't be fooled into thinking that it really is Cathy. However, it's still very useful to know that Cathy is Bob's friend who is Alice's friend. If Alice tells me to talk to Bob's friend Cathy, I can be totally comfortable talking to the "Cathy" that Bob introduced me to.

Just to make a more concrete example, imagine that you have a problem with your software. You contact the company that supplies it and somehow determine that the person you are contacting is really operating on behalf of the company. They refer you to second line support. It would be incredibly useful to know that the second line support person you are talking to is, in fact, the second line support person you've been directed to and not a man in the middle. You don't care who that second line support person is. Maybe they aren't using their real name. Maybe they are an illegal immigrant. None of that matters to you. All you care is that they are the person you were directed to. And if they direct you to third line support, you care that the person you are talking to is the person you were directed to.

People get hung up on the wrong things with PGP IMHO. They check people's passports and include photos in their keys, etc, etc. I mean, great if you are the government trying to ascertain if a key really belongs to a citizen, but completely useless for most practical purposes. All you care about is that chain.
>There isn't really a way (that I'd consider sensible) to get periodic, system-level measurements such as system load, memory usage, I/O stats from logs.

Why not Metric Beats (https://www.elastic.co/products/beats/metricbeat). The log structure is generally numbers, but it is still fundamentally different from pure metrics, IMO.

My biggest problem with using ES for metrics is that with the exception of Timelion, there is no way to do cross metric calculations (db queries/s over requests/s => db queries/request)
This entire thing reminds me a little bit of the Linux Backdooring Attempt of 2003. A tiny dropped symbol that didn't look like a backdoor and just sloppy at first, but actually...
This is fascinating. I love the names of these seasons, and this guide does a great job offering a pithy and easily grokable description.

By the same token, I am curious how else we can come to understand seasons and yearly cycles. The climate stability that led to this sequence of small seasons and their associations with agriculture has begun to vanish. With the worsening climate emergency, where there is no "new normal," what yearly cycles can we still hold onto?
> Why should a functional upgrade of a dependency introduce new dependencies anyway? A library that sets out to do a particular thing shouldn’t grow new features that require new capabilities willy-nilly.

Why not? I've often done upgrades with the sole purpose of replacing questionable, hand-written code with external dependencies I've discovered that do the same thing, but better (more features, more tests, more eyes on the code, more fixed issue reports than my often-closed-source code). From string parsing to networking, this happens a lot. The external contracts of my libraries don't change a bit, so why waste a major version? "I'm using someone else's code instead of what I YOLO'd myself" seems like a poor reason to rev a package version--and even if it's not, where do you draw the line? Cribbing code from StackOverflow?
Fairness of the U.S. immigration system aside, what is wrong in principle with law enforcement using driver’s license photos to uphold and enforce the law? When you drive on public roads, you have no reasonable expectation of privacy. Tinted windows which obscure the driver’s face are, to the best of my knowledge, illegal in most of the U.S.

I would be much more concerned if law enforcement were, for example, using these photos to profile drivers by race or using them in an otherwise illegal manner. That doesn’t seem to be the case here.
Django's goals are probably not our goals for our web application
Your 2nd reference talks about the theoretical lowest price that a hypothetical manufacturer could manufacture longer-acting insulins at. It doesn't identify any manufacturer actually producing at those prices.
The average temperature in Madrid in July is 9C cooler than in Phoenix. Good insulation would reduce the cooling costs (and it's sort of absurd how many homes in hot areas don't have good insulation), but no amount of insulation will keep a house cool when the ambient temperature doesn't even make it down to 25C at night for a month or longer.

Portland and SF have similar climates, so you would expect them to look similar. Portland has rain instead of fog, but both rarely get notably hot or cold.
Typically your deployment process would pull gems based on hashes recorded in a lock file you committed, not pull arbitrary new versions automagically. So while I’m not shipping the actual file, something is verifying that I’m shipping files that have the hash I expect. Barring some very alarming developments in hash insecurity, it’s mostly a distinction without a difference.

Automating a “bundle update” to pull latest versions within spec and update the lockfile would be odd to my experience. You’d typically do that manually, (hopefully, if you’re competent) look at what changed, and retest (semver is great as long as everyone perfectly anticipates & categorizes every change’s impact. In the real world, however, ....) rather than blindly just letting a deployment run whatever.

Bad devs can do the stupidest thing imaginable in any system, though, so I don’t doubt this is out there.
Is there a term for the common phenomenon where we do not expect or assume humans of the past to be as .. articulate or witted as us?

This reminds me of the reactions to the ancient graffiti from Pompeii etc., some of which read like something one might see on 4chan:

https://www.reddit.com/r/history/comments/5iy6i4/ancient_gra...
In principle I agree that reader macros are handy. In practice I mostly avoid them because reader macros don't have separate namespaces in CL, so it's likely your reader macro will step on one from an external library.

(Yes, you can carefully bind

*readtable*

before compiling code, but methods for doing so are ad hoc and not standardized. This is a perfect example of a convention that Common Lisp programmers need to establish formally when using CL for software engineering.)
A single picture is surprisingly effective in recognizing that person in another photo. I've been playing around with a python wrapper on dlib's facial recognition [0] and it's astonishing how it can identify people from just one photo. It's not like other machine learning methods that include training a classifier or even fine tuning a classifier. It works by encoding the persons face to a 128 dimension vector and then using that for comparison.

The accuracy from most methods is between 99.2% - 99.8%, but the problem is that the training samples are too easy and controlled. It's sensitive to lighting. Google's most recent paper [1] on Facenet found 99.63% on the easy Labeled Faces in the Wild (LFW) dataset, and an impressive 95.12% on the Youtube faces dataset, presumably a much more difficult dataset.

[0] https://github.com/ageitgey/face_recognition

[1] https://arxiv.org/abs/1503.03832
Biased source obviously but, uh, "Capability Myths Demolished" has some in-depth information: http://www.erights.org/elib/capability/duals/myths.html

- - - -

See also "macaroons": "Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud"

From the abstract:

> This paper introduces macaroons: flexible authorization credentials for Cloud services that support decentralized delegation between principals. Macaroons are based on a construction that uses nested, chained MACs (e.g., HMACs) in a manner that is highly efficient, easy to deploy, and widely applicable.

> Although macaroons are bearer credentials, like Web cookies, macaroons embed caveats that attenuate and contextually confine when, where, by who, and for what purpose a target service should authorize requests.

https://ai.google/research/pubs/pub41892
Linux has seccomp for the same purpose. The most restrictive mode of seccomp permits only read, write and exit, which is good for a jailed CPU-only process (read/write commands from a pipe and exit when done - no opening new files or sockets).
This comment breaks the site guidelines, which include:

"Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents."

Nationalistic flamewar is particlarly unwelcome here.

https://news.ycombinator.com/newsguidelines.html
Please do not respond to flamebait with flamewar.

https://news.ycombinator.com/newsguidelines.html
These kinds of comments make me extremely upset. Such thinking is exactly why we're losing power in democracy. Such thinking is how authoritarians win. I will go as far as saying that spreading this idea is dangerous at best.
I think you’ll appreciate Tree Notation, which is a dead simple “base language”, that I think we will get people to agree on.
It is obviously broken. Your objection is that it isn't comprehensively or irretrievably broken, and while I disagree, I don't have to litigate that, because the narrower sense of the word carries the article.

I don't think you can fall back on this being an "obviously bad use of the tool", by the way, since it's a pretty core use of OpenPGP. I don't use keyservers either (or didn't, when I still used PGP, which I actively avoid doing now), but I'm outnumbered by the people who do.
Kinda weird for you to say that, when right in the article:

« Rep. Jim Jordan (Ohio), the House Oversight Committee’s ranking Republican, seemed particularly incensed during a hearing into the technology last month at the use of driver’s license photos in federal facial-recognition searches without the approval of state legislators or individual license holders. »
Yeah I had just read some stuff about Elixir not being homoiconic and wanted to just point that out (in essence, I was being pedantic), it doesn't really ding your point.
There are no free wins here. My advice follows some of the others: during work hours try to schedule time and have articles/books/videos queued up for downtime after kids are asleep when your SO isnt needing your presence/company and you are truly up for it.

Trying to get up early and hack your life will just lead to burn out and family problems both. Dont do it to yourself, your SO or your kids.

Be present with your family out of work. Squeeze in 30min each morning when you get to your desk to hack on something you read on the train in or at home. Accept your situation and also realize that 30 min daily spent purposefully is enough to make real progress in one direction at a time.

It is exhausting with two small kids and an SO and a job. Please dont kill yourself trying to be super human. Accept limitations and live a better life within them!
The other thing is most new houses are constructed without any concerns to natural (cross ventilation) cooling. My previous house was built in 98, and had huge windows that happened to line up on the east and west sides. They let in a lot of light, but also too much heat (even with blinds and thick curtains closed, still too much heat for the AC to keep up with). That, and the neighborhood was former farm field, so the only trees were the ornamental (short) ones that were put in front of every house.

Where I'm at now, only 20 miles away, was built in the 70's, much fewer windows, no vaulted ceiling, and the summer AC bill dropped by more than half. And the neighborhood is older with many mature trees -- everywhere I look is green. So overall much more pleasant.
To be pedantic, this is true with "modern" toolkits (like, this cemtury). Applications using Motif or Xt or anything similarly ancient still do server side drawing and they absolutely shine with todays network latency and speed. But most applications moved on from.these toolkits, with good reason.
Your 6 year old GPU probably works fine with the nouveau driver, which is supported by wlroots.
Are you referring to the small decade it took them to support KMS so that their driver behaved even remotely like a modern one?

Or perhaps their marvelous installation methods of running a random script as root that rewrites configuration files, and its configuration interface that likewise also rewrites configuration files in attempts to get multi-monitor setups working that until recently hardly ever worked?

Maybe you are referring to their magnificent support, forcing you to stay on outdated kernels as upgrading would break compatibility and render you without a functioning graphics adapter short of a VGA-resolution framebuffer console?

It could also be their fantastic backwards compatibility, requiring you to keep track of driver series compatible with certain adapters, where every other GPU in existence just works OOB.

I used NVIDIA up until a 2 years back. While you could arguably get things to work, claiming they had excellent support is laughable at best.
Haven't seen a case of dbus daemon replacement, only I think one or two client libraries, and one is niche and the other is so niche I think less than 10 people ever used it.
Why would deniable backdoors be visible in vulnerability frequency? In principle, you only need a single back-door. Perhaps you need to chain some vulnerabilities and build in some redundancy.

According the article, this had 100 vulns, which was signficantly worse than comparable vendors. If we assume that to mean comparable vendors have 50 vulnerabilities, we would have to believe they included 50 vulnerabilities intentionally.
I've seen companies create "extended release" formulations of their old formulation 1 year before the patent expires to get everyone to switch over to the patented version before the generic comes out.

I've even seen it done when the previous version and the new version were still both once daily (tamsulosin, I'm looking at you!)

Yes, some insurers will hesitate to cover the new formulation when it comes out, but not all.

Sometimes the insurer will make a deal with the manufacturer so that the manufacturer is only getting paid the generic-equivalent price. But who knows what happens behind closed doors.
Haha! Yeah, that's true.
The only way to know that you have previously had 'good intuitions' about the future would be if you recorded them (memory doesn't cut it) and then compared them with a subsequent events. Then you'd have to find a way of demonstrating that past intuitive success is an indicator of future intuitive success. Unless you've done all this, you only have an intuition that your intuition for future trends is good.

It's intuition all the way down.
Florida, the Sunshine State, Is Slow to Adopt Rooftop Solar Power
AC actually opened up the south to office buildings. They most likely wouldn't exist (except where necessary) without it.
Please don't take HN threads on ideological tangents or call names in comments here. These things are in the site guidelines. Would you mind reviewing https://news.ycombinator.com/newsguidelines.html and following them when posting to HN?
The reason people buy expensive houses in expensive areas is because of enhanced social networking and housing market stability. Strong communities tend to fare better in economic downturns. Moving to the countryside increases the probability of social isolation. This has far reaching consequences on mental and physical health.