skysight-inc/HackerNews huggingface dataset:
Yes. Its also been added into various LTS versions about five or six months ago.

https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16....

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.1...

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14....

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19....

ctrl+f: cpu/speculation: Add 'mitigations=' cmdline option
An asynchronous (libuv-based) TCP server library for the JVM
It is an interesting if brief article. I don't see why everyone is obsessing over the title. The article was about what I expected to see after clicking through.
The spec says SHOULD though, not MUST. Chrome is compliant.
I found it odd he turned books upside down to remember he read them.
Can't edit anymore, so adding here. Between 'not vulnerable' and 'max speed' there are a few different intermediate states, probably was in one of those. And I have to admit that for All Green in spectre-meltdown-checker.sh and InSpectre.exe I'd have to pay a pretty noticeable price based on my Overwatch VFIO testing.

Pretty sure there's no point returning to that intermediate state again, might as well commit to one or the other.
About volume control, when there is a volume control on the TV, the TV box, as well as the receiver, it feels a bit unnecessary to also have a volume control in the software.
I thought I was quite clear that I did not believe everything has been thought before, but only that most things have been thought before - or more specifically that most people think things that have been thought before but in new configurations.
Yes. You should end up with a line like this:

GRUB_CMDLINE_LINUX_DEFAULT="noresume noibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off mitigations=off"
This is a ridiculous comparison. A proper analogy would be someone with a swastika symbol on their shirt talking to a Jewish person. I think we can all agree that wouldn't go well.
Exactly. Autocomplete=off gets misused. For example, there was a browsergame I played where because of idiotic "security considerations" autocomplete=off got applied to the login screen. At that time for me that meant typing in the password manually, thus picking a bad password.

So it's a good thing in that situation when the browser ignores the attribute.
> Yet if you follow Krugman and the like you’d think austerity has been a giant problem in the west.

I don't follow Krugman closely since he is not macroeconomist, but Krugman's back of envelope calculation was correct in the retrospect.

Obama's stimulus was roughly of what needed and half of what was needed was the result. (tax benefits are not proper stimulus). According to CBO the US economy was 6.8 percent below its potential translating into $2.1 trillion of lost production. Lives were destroyed permanently due to prolonged recession.
Very cool project! But be wary using something like this on large repos with lots of objects, S3 PUT pricing is obscene and you may end up with a surprising bill...
The article is from oct 2007(*fixed), around the same time of the video: "Here comes another bubble"

https://m.youtube.com/watch?v=I6IQ_FOCE6I
Show HN: Slouch Stoppah
> the password is to secure that identity. With TouchID or FaceID you are using them for both. Which reduces security.

You talk absolute nonsense. You ID is not secured by your password LOOOOL. For example, your email is not secure. It is public. I can send you.. drumroll.. a mail there. So is your Facebook username. It is not secure. It is just a name which is public and tells everyone who you are. The password is the only thing that is used to make sure that only you can log in as you. It is a way of identifying that you are you. Nothing else.

> Definitely incorrect. Someone can cut your finger off, lift a print off your coffee mug, extract it from a selfir etc.

There is more and less secure biometrics. There are biometrics, which cannot be copied or cut off that easily. At the end of the day, your biological composition makes you who you are. If someone can truly fake all your biological attributes, then maybe you have a bigger problem than someone logging in with your online account. They probably can do worse things at this point.
Vulcain: A REST-Based Alternative to GraphQL
Arrested Japanese stalker used pupil image reflections
You can check with this command if your CPU is affected by any of those:

grep . /sys/devices/system/cpu/vulnerabilities/*

And yes, you'll need to edit the /etc/default/grub file, but make sure that you add your extra parameters to GRUB_CMDLINE_LINUX_DEFAULT based on this:

https://wiki.archlinux.org/index.php/Kernel_parameters#GRUB
>But your post above very much makes it sound like the GOP is actively trying to fight climate change...

I went out of my way to say that Republicans aren't all that concerned about CO2. So you are just reading something into my comment that isn't there. Honestly it just seems like you're unwilling or unable to see nuance. You couldn't see it in my post and you can't see it in the Republican position of simply having a different idea about how to balance strong economies and environmental concerns, both of which save human lives and improve quality of life. I mean, who do you think is digging up all that coal in Appalachia? Do you think it's a bunch of Democrats getting black lung to keep the power running? Do you really think you have anything to tell them about how dangerous it is?

But at the end of the day, none of that matters. The only thing that matters is that nuclear is the only viable solution for clean grid power and Republicans support it while Democrats don't. If you want to get into the weeds about why they support it or how they're wrong about other issues or even details on this issue, then have at it. I think it's a waste of time personally.
Interesting. Redirection to discussing Chinese employment law. Redirection to talk about my nationality (which I just gave to give context for having a different view on moral treatment of Americans versus seemingly everyone else), and misdirection to a jab at British treatment of China in history.

Do you actually have any real point to make about the substance of my comment?

Accusing someone of having no interest above self interest, simply because they employ people in another country, is utterly morally bankrupt. Discuss.
I've made this for myself to help me slouch less, so I thought it might be useful to others. It uses face-api.js to get the user's face, and then tries to guess when you're slouching by capturing the state when you are sitting upright, and then using position and face size in relation to the captured state. All processing is done client side and no data is being sent anywhere.

The code is open sourced and can be seen here https://github.com/lnenad/slouch-stoppah
11 Years After Sequoia's RIP Good Times. Is Winter Coming for Startups?
Similar story, though less "exotic":

Someone I know retraced their genealogy. They discovered that a few generations back (maybe 5 generations?), a girl was banned from the family. I don't remember why, probably something like getting pregnant from the poor miller's son.

They found out that she had had children, and that her branch of the family now lived the next valley over, so my friend and brother/cousins contacted them with a nice mail like "Hey believe it or not, we're related! Here's what happened 200years ago blahblah it would be great to do a big family reunion dinner!"

The response wasn't so enthusiastic, more along the lines of "we know. We've been raised to hate you. History matters, please do not contact us again."

People, even from the same country (literally the next village over), have very different view of lineage and history
So, how does one bootstrap the interpreter?

Is it available as a Racket "language" or is it compatible with most/some lisps/schemes?
The Median Voter Theorem
These days I find it hard to trust the many dependencies installed by language-level package managers. OS-level system package managers tend to do better, but they too have also had incidents.
Isn't it the other way round? Most of these mitigations are to stop hostile code from stealing your secrets. A physical server doesn't run hostile code. A workstation with a web browser which supports JavaScript runs potentially hostile code all day, every day.
The ternary operator is indeed special as it (is the only one AFAIK that) introduces in the language some type constraints between the two result branches, that affect the way one or the other is interpreted.

A similar trick in C++ is explained on https://www.artima.com/cppsource/foreach2.html and allows to return the type of an expression without evaluating it.

From the link:

> You may be thinking this is needlessly convoluted. After all, couldn't we just use encode_type(container) without the conditional operator and get the same result? No, because that would have caused container to be evaluated. With the conditional operator, only one branch of the condition is ever executed. In this case, since the condition is always true, the first branch will always be taken. The second branch is "dead code"—it will never execute—yet it extends a ghostly finger into the land of the living and exerts its influence on the conditional expression's type. Spooky!
How many emails require a password to send to them? None. It's identifier. The password is the security.

Using biometrics - an identifier - for security as well is a compromise for convenience. As you say yourself biometrics make you who you are, they don't secure who you are.
And _Generic is still somewhat ugly: it has the awkward property that all the branches must pass the type checker even if they are not used. This is mostly OK for numerical functions where you get some help from C’s implicit conversions making the checker more lenient, but if you try to apply _Generic in other contexts you soon encounter problems.
> I would not say you're "counting", you're rather doing a back-of-the-envelope calculation with eye-balled numbers.

Yes, of course. My point is that I wasn't forgetting them.

> I don't "trust" the report per se, but they do provide sources, from which I can inform myself.

And did you?

> Now, the specific attribution to online video may be less clear-cut

That's the thing, though. We know that streaming a video is a very low-power activity, since we can do so with a very low power device. And I added 100% of overhead, whereas the PUE of a real datacenter is actually about 1.09 nowadays.

So any report that tries to tell me Google or Amazon, who spend millions on DC energy improvements, are wasting orders of magnitude of energy more, is not a serious report.

A very big issue is that they assume a linear correlation between transferred data and power use. For the network part that may be reasonable, but for the DC is absolutely is not. Mining cryptocurrency, for example, takes a huge amount of energy to produce a message of a few KBs.

> Can you point me to this inconsistency?

It's in the Technical details of the report.
This was my thought as well. Regarding modularity, batteries seem to be the easiest to deal with. I was always impressed with Tesla’s idea of laptop batteries, it essentially has not changed much. Lots of little batteries.
FWIW... most of Amazon's internal infrastructure was NOT run on AWS as of a couple of years ago. The idea that AWS was built to support Amazon is a myth. In fact, most of their own IaaS was a very traditional data center built on converged infrastructure. This is why Amazon was up and running when AWS would have a large outage.
I am a neuroscientist and a good portion of my laboratory's scientific output is code. I can offer a perspective.

Every few months, a case like this one emerges. A published software contained a scientifically relevant bug and this may have had an influence on other studies that used that software. The reaction is always the same: blaming the naivete of the researchers because they are not professional coders.

While I would certainly love to see more interaction between professional coders and scientists, I don't agree with the overall sentiment. I find it counterproductive and even naive for several reasons:

1) mistakes happen. Wikipedia has a long and certainly not complete list of software bugs that had major consequences ( https://en.wikipedia.org/wiki/List_of_software_bugs ) and most of them come from professional coders in all kind of industries. There is no doubt whatsoever that code produced by scientists is in generall less streamed, less reviewed, and way uglier but is it on average more buggy where it matters? Unless we answer this question, the discussion is moot.

2) Scientists who produce software by themselves do this according to Open Source philosophy meaning that the code can be scrutinized by anyone. I'd rather use a possibly buggy but open-source software over one that I cannot even scrutinize. I think published results should only be accepted if they rely on open-source software: we would never accept a figure of a paper unless the protocol was 100% disclosed. This is one aspect where we can all immediately act. As a reviewer, I will never accept a paper that made use of new software unless the code is an integral part of the paper. I urge all my colleagues to do the same. Also, as authors, if you have to write software from scratch, take code readability into account exactly for this reason. Python is a good choice for this reason. R much less so.

3) we must encourage scientists to take on more coding, and not the opposite. If we keep telling them that they are not going to be good enough, we are not helping. A the moment the trade-off is very clear: either not-professionally coded software or no software whatsoever. Fields like crystallography have shown that the former option can still be extremely favorable.
Fast Analytics on Semi-Structured and Structured Data in the Cloud – Episode 101
Fortunately it's becoming more common to provide permalinks to gitlab etc so people can access the actual version of code used in a paper. That being said having some incentives to reward this practice would help speed up adoption.

Part of the blame for incorrect code also falls on reviewers. If someone agrees to peer review a paper, that should include running the code as part of the general scrutiny. If someone finds a bug after publication, they should let the appropriate people know so an errata can be published.
Turkish ISP Blocks Social Media Sites Near Syrian Border
Of course then websites will just stop using password fields and that is awful for security and convinced.
Network Automation at Enterprise Scale with Python
It was getting decidedly better. In particular, if you mostly played indie titles, most of the big ones have supported Mac for a while now. Or, they did.
C11 doesn't obsolete it, right? It only permits it to be implemented portably.

For the curious, here's an implementation of tgmath.h on top of _Generic:

https://github.com/NuxiNL/cloudlibc/blob/master/src/include/...
Yes. The focus on weight makes perfect sense for their combustion engine cars, but they went totally overboard with it on the i3. The cost of all that carbon fibre made success impossible.

The other big mistake was the 2 gallon petrol tank on the hybrid version. They had the opportunity to have the only hybrid on the market that has no gearbox, no complicated transmission, no clutch and a decent sized battery. But nobody wants to have to stop to fill up every 50-60 miles.
Should developer be able to make it impossible to close browser or open 100 new tabs? No.

Should developer decide that fields are autocomplete off or green or show javascript warnings? Absolutely yes.

If user wish to change that, users thing. The browser/google has no business to be mediator here, second guess application they know nothing about and manipulate it.

The browser should be predictable, well specified and harmless. It should not force me to convert all ids into random strings just so that random data do not get prefilled in.
Black holes stunt growth of dwarf galaxies
In colo (a former nuclear bunker, no less!) I have a small OpenStack 'cloud' deployment cobbled together from spare hardware, pieced together in partnership with a friend of mine. I wrote a bit about it here if anyone's interested:

https://dischord.org/2019/07/23/inside-the-sausage-factory/

At home I have:

A Synology DS412+ with 4 x 4TB drives
An ancient HP Microserver N36L with 16GB RAM and 4 x 4TB drives running FreeBSD
Ubiqiuti UniFi SG + CloudKey + AP
An OG Pi running PiHole

The DS412+ is my main network storage device, with various things backed up to the Microserver. Aside from the OEM services it also runs Minio (I use this for local backups from Arq), nzbget, and Syncthing in Docker containers.
The things I would look out for:

- First, you need to find out if your department is not going to be axed immediately. A lot of functions will become redundant depending on your size (sales, HR, finance, IT are the most likely to go).

- Next, you need to find out what the org structure of the acquiring company is and how you integrate there. Each function that the acquiring company has will be replicated on your site in many cases. One example: You currently might not have a separation of product owners and project managers. If your acquirer sees these roles as different, then you will have to follow suit and people need to pick sides. Another example: If you have a regulatory department that currently reports to you as VP engineering, but the acquiring company has regulatory report into the GM/CEO whatever, then you will lose this team.

- If you can negotiate part of the post-acquisition plan, please make sure that the acquiring party agrees to grow you / your site at least to double the size. This means budget and head count (easy to forget the latter) must be allocated for the next 5 years. Otherwise you will not likely be able to hire anybody over the next 2 years, because you are not aligned to the budgetting season and head count is frozen. You need the growth just to handle all the new communication overhead you have with the acquirer.

- Resist the temptation to realign salaries and job grades too fast to the acquiring party. I have been in an acquisition where this was not handeled well. You can end up with overpayed employees who were just in the start-up for a long time and underpaid new hires. This can seriously mess things up and cause conflict among employees. Take your time and align with the new organization when everybody understands their new roles.

- Don't expect founders to stick around. They were used to running the ship and getting told what to do rarely works out unless for the vesting.

- Distance yourself quickly emotionally from "your" start-up. The likelyhood is large that the acquisition will break everything even though everyone has best intentions (compare most comments here). Don't be sad if it does.

- If you are an engineering VP now, you will likely end up as a senior manager or director. Put all your effort into being put into a director grade. Even if this is not justified normally (you need a team of 30-100 reports and/or 30-100m in sales normally to be called a director), it is much better to negotiate higher positions at the start. As many acquisitions are not allowed to scale, it might be very tough to ever be promoted for the next 5 years otherwise.

- If you can fight it, make sure that you retain on-site IT people. Corporate function are usually hell, but corporate IT is the worst.
Add a Pms5003 and a bme280 and you can measure temperature, humidity, air pressure, CO2, and PM10 (particulate matter) all for about $45
Websites Should Work Without JavaScript. Yep? Nope?
Why is that too late, I am curious if you have any source or data for that?
That begs the question, at which point does autofill happen in an iframe? So I pay for an ad, and have a password, creditcard number, address etc. form in the background. Does the browser autofil, or does it autofill when the user starts to fill in a form in the foreground?

Asking for a friend.
But Kim Peek does seem to get some metaphors. He said "My dad and I share the same shadow." towards the end of the video. Maybe he just picked it up from someone else, though.
Where I live, the power goes out maybe twice a year (typically for between half an hour and maybe five or six hours, depending on the fault). Where my mother lives, in the country, it could go out for two days when it goes. Luckily its not that often, but when it does, there's never an advance warning. If your life depends on continuous power, planning for an occasional no-warning outage seems like the prudent thing to do.
Lol, yes 2007, fixed, thanks!
bitcoin full node
How far away are we from printing something like this at home?
Trying to name some more obscure ones that I love.

Tizonia is a CLI music player that can play music from your Google Music library. I like it bc I don't have to use a browser.

Pianobar is a CLI client for Pandora, but I can run this on a Mac too so not sure if it counts. Same no browser required benefit.

I love CLI music players bc they help you extend battery life vs browser based.

Gpaste is a clipboard manager. It even stores images copied to the clipboard.

Not sure if it counts but when I do a rectangle select screenshot in Ubuntu, it puts it in the clipboard (instead of putting a file on the desktop like Mac does) and then I can just paste it in the Jira ticket / GitHub pull request / Slack / etc.

Probably a bit more that deserve mention that I am not considering right now.
Yes and by then you already had the 7 plus versions of defining a string dating back to Windows 3 (1992). Backwards compatibility was already a problem then. Since then, MS has had 15 more years worth of cruft on top of that s d yet more ways to define a string. If backwards compatibility caused a security vulnerability back then, how much old Windows 95 code do you think is causing issues now?
I've been wanting to give Ocaml a try and Unison source code seems to be one of the most popular reference applications for it.
In terms of C, a sum is a union and a product is a struct.
"Enormous talent?". How about a good investment firm and a high paying job because your status automatically grants you a 6 figure salary. It's extremely easy to be rich and stay rich in the us of a
Our office has windows but they have had screws drilled through them so you cant open them. Apparently it was due to new safety regulations.
This reads poorly.
Right - a Lisp list is conceptually a linked-list. How the compiler chooses to implement the list is up to it - it can use an array as long as it can meet the specification and give useful performance.
I don’t think the right question is: are we reliving 2000 or 2007 in startup investing.

I think the right question is are we looking at a Google or a Webvan.

yes, I know Webvan may have been a “good idea”
The lift scala framework offers protection against many of the OWASP vulns automatically:

https://seventhings.liftweb.net/security

Can this be improved to include support for all the OWASP ?if not, why ?
Article Marketing: Is It the Best Way to Drive Targeted Traffic?
As an aside, this mentions that Snowden leaked that the NSA has been carrying out supply chain attacks? What, is this guy just leaking everything now?
Docker runs native. You get instant file sync.

On Mac my options are dinghy or docker-sync, both of which drive me insane by either being too slow (former) or not syncing files fast enough or good enough (latter).

This is probably the number one reason that I love Linux for development these days.