skysight-inc/HackerNews huggingface dataset:
Reversely, I was surprised at how healthy (tall, notably, and a healthy skin) Australians are compared to France. I highly suspect that Australia has proper air ventilation in classrooms and we don’t in France. In France it is common, for a class, a meeting, and and even in a theater or music show, to cram people in a room, and not worry about ventilation. People complaining will be seen as weak.

I wonder whether proper air venting through school increases the global IQ and total skills of students.
Is Snow White? Questions about Appearance and Reality from an MIT Philosopher
How, pray tell? Give a solid statement, rather than making vague pronouncements and leaving the reader to fill in the blanks of your reasoning. Example: "Climate change is as much of a threat to human inhabitability of Earth as nuclear weapons, simply on a slower scale."
There are more than 20 different valid field name tokens in the spec, not just “on” and “off”[1]. If web developers actually used the other values correctly then user agents wouldn’t need to use heuristics to figure out the correct data to autofill.

[1] https://html.spec.whatwg.org/multipage/form-control-infrastr...
Cat Displays Self Recognition
The top story on HN and multiple subreddits for most of a Saturday, with a pretty big point count, and it looked like it was picked up by several tech news sites. All it takes is for them to slip it under the radar once.
And, from what I can tell, some of those steps involve various less than pleasant chemicals.
There's a major security flaw with auto-fill when it comes to passwords. Sure, it's hidden on screen, but you only have to change the password box's type, so it isn't "type='password'" and it is revealed. This only takes a matter of seconds.

Chrome should remove the password if there is any attempt to change that form object.

This flaw has been there for years, it's actually handy if I'm not sure what the password is.
The experiment only keep alive some cells of the brain of the pigs.

The setup was more creepy, because after half an hour of no blood (and oxygen) flow, they connected the whole brain to an artificial blood like flow (with oxygen), and after some hours they extracted the cells and measure the activity of the cells, and some of them where alive. I think this is not unexpected.

The part that the article is "hiding" is that a big part (most?) of the brain cells where dead, so the whole structure of the brain was heavily damaged and it was impossible to restore the state to a functional pig.

It's like putting the pig in a giant blender, then collect some neurons from the smoothie, verify that some of them are still working, and then claim that now death is more difficult to define.

[Note that they didn't cold down the pigs before the slaughter. With a cold pig, this may work. With a low temperature a functional brain survives more time, but the process to warm it is tricky if you want a functional brain. Somewhat related https://www.sciencedirect.com/science/article/pii/S030095721... ]
I've built a ton of systems and they almost always end up being a variant of "arduino running GRBL" combined with "some sort of 'real computer' running Linux". For example, my MK3 is driven by a Raspberry Pi 3 running Octoprint. It's basically an appliance.
ASVS is a good idea, but it has forever lost its credibility for me after the following recommendation appeared in one of its published documents (2.13 I believe, level 1 ASVSv3):

>Verify that account passwords make use of a sufficient strength encryption routine and that it withstands brute force attack against the encryption routine

I think this has been fixed, but I don't understand why encryption (which implies reversibility) was ever advocated over a proper password hashing method such as BCrypt or PBKDF2. And no, using terms like "one way encryption" would not be any better - it shows a general lack of understanding.
What do people use to provision their Raspberries? Ansible or something?
I was just thinking the other day how I couldn't think of a historical analog of our modern intelligence agencies. Now I'm realizing that the CIA is just a modern ninja clan.
Or they're innocent bystanders with many percents of preferential shares, who simply don't realize that the commoner employees under them have only a fraction of a percent of regular shares, that will all be made worthless by their actions.
I run test environments for my saas products, gitlab and nextcloud on a dual core box, hp dc7900, in my roofspace. The os is running of an ssd and there are two old metal disks in software raid.

All my business backups go to the same box. I have a pi and enrypted usb drive copying my backups to my shed from my house.
German Jews ask for protection after neo-Nazi murders
"Extremely poor quality". If that was remotely true why would they be successful? Millions of people are just dumb and just enjoy having shitty furniture and go back for more? Have you been to a real IKEA beyond the imagination of your anti-corporate dream?
Is this really an issue? Presumably anyone with access to the browser can acces saved passwords anyways; the censoring only prevents onlookers from reading it.
Start reading data sheets of mentioned parts. Stick them to some Arduino and write code. These measurements aren’t special in any way.
Average IQ of unskilled worker is 87 and it's considered normal level (assuming SD 15 points normally used in IQ tests).
Are there ways to prevent data from being in the cache?

I know almost nothing about computer security.

I ask because ages ago, I added copyright protection to some products (under protest). Though encrypted on disk, once loaded, all our code and key phrases were "plaintext" in memory, easy to read. Hackers would post cracked versions of our releases within 24 hours.

The whole effort seemed pointless. My takeaway was if you had physical access, you have everything. But maybe things have improved.
Well, if you open a book you're currently reading you can pretty easily tell which parts you've already read and which you haven't - but you still probably use some sort of bookmark to avoid going through the hassle.

This sounds similar, a matter of convenience rather than a need. Glance at a bookshelf and you can know visually what's still unread without checking the books one by one.
Good idea. But what gets checked in at the metarepo level? The names of the branches that are checked out in the submodules under it?

Can you have two metarepos, each with its own set of checked-out branches of the same original submodules?
Artful Design: Technology in Search of the Sublime
For certain values of "living".

https://www.amnesty.org/en/latest/news/2016/01/turkey-onslau...

Many of the estimated 500,000 people displaced from their homes in areas under the curfews across the southeast of Turkey in 2015 and 2016 lacked access to adequate housing and livelihoods. Many were unable to return to their homes that had been destroyed during or after military operations during which state security forces clashed with armed individuals affiliated to the PKK.

https://www.amnesty.org/en/countries/europe-and-central-asia...
Also Google's repo tool. I like the idea of manifests and the commands it includes for creating feature branches across repos
> The password ... is a way of identifying that you are you.

That is not correct. The "system" identifies you by your ID (username - biometrics - whatever). And for the system to ensure that whatever actions you perform on it, are really coming from you, you have to add proof of your identity to the orders for those actions. You use a secret to create that proof of identity. The secret is yours, the identity is the system's (what it uses to identify you).

If you use something you don't treat as a secret (such as your fingerprint) as your proof of identity, you'll be loosing it left and right - you'll be inviting everyone around to impersonate you. Drinking a can of coke and throwing it to the bin would be the same as printing your password in cards and passing them around.
How does your romantic life do anything but wither if you can't practically bring someone home?
The Doomsday Clock has always been political rhetoric.

Why is that a bad thing?
I’m deeply offended by the commenters questioning the authenticity of this guy’s bio. The poor man lived and died essentially an outcast and alone.
I have been using it for a few "years" now. It has exceeded my expectation for stability from a "nightly" product. I don't even remember having problems with it in last few years, and it's my primary browser.
some free tools exist for asn.1, but it may be easier to go with protobuf or something similar for new development today compared with 2005.
This piece made me very nostalgic for the days when there was no clear connection between a massive, non-paying userbase and income generation.
That term was a long time ago already seen as problematic in the Lisp community. At the time when Ousterhout used it for marketing TCL.

Basically a scripting language interpreter runs source code files, called scripts.

Lisp does that, too. But many Lisp implementations compile the code and often to machine code, since the runtime includes an incremental compiler. The incremental compiler can compile individual expressions to memory.

Thus when you use a Lisp system, running a script just looks like running an interpreter, even though the code gets compiled incrementally.

Lisp uses the function LOAD, which can load a textual source file and which can then read, compile, execute expressions from the file. Typically this is also available via command line arguments.

Like in SBCL one can do:

sbcl --script foo.lisp

and it will read/compile/execute expression by expression from a textual source code file, actually incrementally compiling each expression to machine code.
It’s been 18 months since my company (non-founding engineer) was acquired, and in that time I’ve watched the majority of the team I spent the last 5 years around depart. I was engineer #10, and today only 2 of that original 10 remain (besides myself).

Of the team we had at the time of being acquired, 2/3 have left. Some of those departures were voluntary, others because their roles were eliminated (replaced with different skill sets).

The monolith we built over 6 years continues to live, but its days are numbered, as we’re shifting new development off of the project in favor of an updated stack.

The P/E firm that acquired us implemented a different type of equity system going forward: much like death, you can’t take it with you if you leave before the next exit.
40v. Good to know the better ones do actually work better. Thanks.
I still give it credence.
I wouldn't say that 2007 was a bubble though, at least not in the tech world. Social media wasn't properly realized at the time so for example Facebook being valued at 15 billion or Linkedin at 1 billion made sense. There could have been ten similar sized competitors to both of them and the valuation would still have made sense since one of them would win.
Wikipedia’s alternative HTML video codecs implemented in WebAssembly
Why hollow?
Our demo video is on the main page of our site and can be found on youtube here: https://www.youtube.com/watch?v=Wpwgat54KXg&t=3s

Additionally you can check out our one page user guide PDF here: https://docs.google.com/document/d/1-D7MmRph8mRC9MUL55Vh5hNy...

The PDF also includes a link to a more in depth explanation of Newshpere
Eh, can't only blame product managers for this.

Developers don't like security features that make development slower either.

I made the mistake of adding Content Security Policy to an app that was still in the prototype stage and it caused endless headaches whenever I needed to add new dependencies.

Your app shouldn't be outright insecure, but defense in depth (e.g., security features that are only useful contingent on the presence of another security vulnerability) can be safely deprioritized until your app gets complex enough to need it.
Very egoistic and ignorant way of viewing things. Disabling autocomplete on login screens has its uses, especially on any app that has shared-terminal type of use, where you cannot trust the user to make the smart choice of not remembering their password - or evening exposing the previous users emails that were used.

You picking a bad password has nothing to do with this feature.
Non-paywalled version: http://archive.is/INi6u
That seems to depend on kernel version. So just add them all. Better safe than sorry... I mean... unsafe than sorry.
For anyone who's interested in learning PyTorch, here's the best video course I was able to find:

https://www.youtube.com/playlist?list=PLZbbT5o_s2xrfNyHZsM6u...

They explain things incredibly well, videos are easy to understand, engaging, and to the point. Highly recommend it to everyone!

I've also heard that Udacity has some good courses, but I can't vouch for those yet.
Why is it offensive to ask if specific and extraordinary claims have ever been verified in controlled conditions? I also don't see how this has any relation on Kim living as a lonely outcast.
Sun Microsystems: A Look Back at a Tech Company Ahead of Its Time
We're working on fixing the video on our site, if you'd like you can watch it on youtube here: https://www.youtube.com/watch?v=Wpwgat54KXg&t=3s
> They made it difficult to get a good timing source in JS, so there’s that.

No, they didn't. A while loop with a counter is a good timing source, and you can't really prevent that without severely crippling everything's performance. Want a good timing source in your browser? Just follow those three easy steps:

1. Start a while loop in a webworker

2. In that while loop, incrementing a counter in a SharedArrayBuffer

3. In the main javascript, read that number from the SharedArrayBuffer.

Bam, a decent clock.
Non-dev here. Could i use something like this to customise an existing kinetic typography AE template and churn out new videos? Also do you know any freelancers that would take on such work?
The thing is, most of these snippets are almost unreadable. That's Python, though.
Depends on your browsing pattern. I don't visit random websites often. And even if I do, I don't stick there for long (those exploits need a lot of time to extract useful data). And sites that I visit are trusted (like HN) so they are very unlikely to run exploits.
As far as I know, Kim Peek has never made any scientific discoveries, or had any wisdom to tell the world, in spite of being able to remember ~12k books.

It's a good reminder that knowledge does not equal intelligence or wisdom.
I think it's just stylistic phrasing.

"I place a piece of paper between books on the shelf to remember that I've read all the ones on the right."

Yeah, technically, I'm not 'remembering' in this case, I'm 'reminding' myself.
I wanted to do something very similar. This is amazing! May I ask, where do you get your news feed from? The sources I enquired at the time were quite pricey.
Password authenticated key exchange algorithms (PAKE) solves the dictionary of secrets problem, by hiding the password from the server.
If you have physical access, you have everything (given sufficient time and effort). This will always be true, though dedicated security hardware (TPMs, etc) might drive up that time and effort requirement to get at their contents.

The access provided by these attacks is a far cry from physical access. There are plenty of things that can be done to mitigate them (removing data from the cache, for example).

Of course, this entire post is about how to disable those mitigations, as they almost always come with a performance penalty.
> "People on here regularly confound weather" no they don't.

Here is an example of you confounding weather with climate:

https://news.ycombinator.com/item?id=21215190

Not an isolated incident.
Both of those projects look great! I could definitely see using both of them. I've been thinking about writing something similar to lms for awhile now.
Californians Learning That Solar Panels Don't Work in Blackouts
At my company, every team manager has a "learning and development" budget but they never think about it, so if you have some conference you want to go to, educational course, book, etc, all you have to do is convince them it's at least tangentially related to your work and you get it covered out of that budget, which is usually full.

I actually prefer this arrangement over top-down employee training since it means I have more control over what I spend my time learning.
Will Smith Cracked the Code on Making Real Money in Hollywood
They open source the product long after it has any revenue potential.
I won't comment on where exactly the line is, but this is on the level of me getting angry over someone practicing horse archery because of the Mongol invasion.
You can customize pretty much any After Effect layer properties, including font, text, colors, etc. So if I understood your question correctly, yeah you can. Regarding freelancers, any Javascript developer should do just fine.
In memory data like that is always accessible by someone who wants it bad enough (with a physical device and a clean install), one can run Windows in a debugger like environment and view all of system memory. I think that's why most DRM is web authentication based
You're offended. Says more about you.

Why would it even be offensive at all (but especially to you) to question the veracity of facts in a Wikipedia article?
If you have compromised dependency, spectre is the least thing you should worry about IMO.
To reduce the occurrence of future similar programming errors, the Johns Hopkins Biostatistics Center has instituted a new standard operating procedure for checking randomization assignment to be followed in all trial analyses. To ensure that the group assignment used in any of the trial analyses is correct, a verification process will be included at the beginning and end of each analysis program. This process is intended to confirm that the group assignment separately provided by the trial team matches the group assignment used in the analysis program. The matching confirmation is reviewed by a second biostatistician/analyst before its use in the results.

I don't know what software quality control is already in place at this organization, but this corrective measure seems on its face wholly inadequate to me: they're just preventing a recurrence of the same exact problem, rather than the much broader class of problems due to programming errors. Do they have a code review process in place?

This speaks to a larger issue: if you write software for manipulating data as part of the production of a scientific paper, then the source code should be available for review as an attachment to that paper, and review of said code should be part of the peer review process in any reputable journal. Professional software engineers write bugs all the time that invalidate the correctness of their programs, never mind individuals whose primary job is research, not software.
Thank you for the feedback! We're also really liking the timeline aspect of the stie, but we still think there's ways to incorporate at least some sort of graph model as well. This might be something we'd A/B test
I think the statement you make about "something you know" always being more secure is not nearly as clear cut as you present it.

A combination of "something you know" and "something you have" is always going to be a very strong authentication scenario, and making "something you have" a non-hackable thing that truly only you can have (i.e not a USB key or a TOTP seed etc.) is a good choice.

The catch here is that when you mention biometrics, you make the assumption of static biometrics (rightfully so, as most methods like Touch ID and Face ID are static), but if you combine lets say face biometrics with liveness checks, you are getting into a territory where faking them becomes much much more difficult (there are various mechanisms out there, the good ones rely on completely random interactions and light-bouncing detection methods as an example).

The real challenge is how do you make these very strong biometric methods frictionless and cheap? Or how do you introduce similar controls - like liveness - for easier methods like fingerprints?

And using any of these (ideally) has absolutely nothing to do with anonymity. You are not anonymous online regardless of what you use for authentication - and you are frankly not smart if you assume thats the case. A company offering a service with biometrics is no different from a company doing the same based on email/username and a password, if they do privacy and security right.

I could actually get into a much longer rant about this last part, as it blows my mind how many netizens are all about privacy and whatnot, yet are willing to expose every single detail about them when its convenient from them...
I did not see the connection, but I think private market investors did. They saw that if you could sell web ads (Google) or sell mobile ads (Facebook) at zero marginal cost to each additional advertiser, you'd have a company worth 10x revenue. Investors made that bet and for the most part have all been paid very well.
Anything similar for homemade LEDs ? (I only found one hackaday article)
I sympathize. My meditations about this lead me to thinking about waste as well.

Why computer at home though? For someone who moves around a lot and doesn't invest into "a home", this would be bothersome. Not to mention it's more expensive, in terms of energy and money. I think third-party data centers are fine for self-hosting.
When a phrase is used the “wrong” way more often than the right way, it ceases to be wrong.
> The worst part about planning a MS deployment is having to account for software licensing that is done on a per-cpu-core basis.

> Bums me out when I see people putting so many resources into running/building elaborate piracy machines.

These two comments are rather at odds to me.

That said, IME generally the type of person who's big into self hosting isn't a Microsoft guy. I work with MS stuff at work at the moment. The entire thing is set up for Enterprise and Regulations. It's hugely overcomplicated for that specific goal only.

At home I don't care about Regulations(tm). The only reason I can see for someone to bother with it is if they want to train out of hours for a job at an MS shop.
We're working on fixing the website video, in the meantime we have the video up on youtube here: https://www.youtube.com/watch?v=Wpwgat54KXg&t=3s

Additionally we have a one page PDF summary here: https://docs.google.com/document/d/1-D7MmRph8mRC9MUL55Vh5hNy...
Preach. Them changing the rules and overriding the usage of this attribute is ridiculously stupid in the first place. HTML attributes are there for a reason, developers are supposed to be able to use them and they are supposed to work as expected. But in order to push their password management and form filling functionality, they just give everyone a finger.
Does no one build their own ml algos anymore? I don't understand the need for pytorch and tensor flow. I honestly thought tensor flow was nothing but a teaching thing for undergrads
We’re having a semantic debate. Ownership appears to mean something different to Rust folks, which is fine. I agree that Rust’s borrow checker (what you appear to be referring to as ownership or the enforcer thereof) prevents errors and is generally very cool. It’s just not what I understand ownership to mean.
Password managers should ignore autocomplete=off in login screens, but not in administration screens where you’re editing other people’s credentials.

IMO the distinction could be made to not automatically fill when the autocomplete=off but instead add a button to let the user initiate it
Very good that Pytorch emerged as a serious contender to TF. While TF still provided more production grade tools (TFX, TensorRT, TF serving), Pytorch continue to evolve and hope soon we have a more complete ecosystem
Then ask the user before filling anything.
Yes, lemon juice has the same effect. Ironing is an interesting way to do it. I used to just hold a candle up to it, trying not to burn the whole thing up.