skysight-inc/HackerNews huggingface dataset:
For some searches, it's as easy as tacking on an extra word, and seeing how different the results are. Especially true for blacklisted and censored Google searches, which for whatever reason don't seem to be wildcarded terms.

Try searching for just the name of a supposed whistleblower, then add another term, and get all the censored results. Even more true in the news tab, which initially returned -0- results.
I came here to post this same thing. You get all of this for "free" from GAE. I built a $100MM company with three engineers on GAE, and we not only slept fine, we'd all go camping together offgrid.
The thing is, if I need to switch node versions. I can use nvm. The thing is, I don't need to manage different environments in node because the dependencies are contained in "node_modules" and not "attached" to a Python interpreter instance.
Reading through this, this sounds like mostly a capability based architecture, with process isolation replaced with a statically typed bytecode in which you can verify that each module can only use capabilities passed to it.

I was wondering why the focus on copying memory between the processes. It should be possible to make capabilities which represent a pointer and a length (and maybe an access mode), which could be used to give a process direct access to shared memory safely. I don't know if that could be done with low enough overhead for small objects, it's possible that there would need to be a threshold below which you would just copy values to be efficient, but it seems like exploring fat pointer capabilities would be worthwhile.

Memory mapping files or inter-process shared memory is the very coarse-grained version of this, using hardware protection. I feel like it should be possible to do something more efficient and finer grained with pointer capabilities and the static type checking that is done to verify WASM during compilation, but it may be a significant research project of its own.
Does he also visit the Florida Kways?
On top of that, once you install the app you get constant push notifications and the reviews are shit anyway.

There are plenty of places I love which have 3 stars and plenty I hate which are 5. Granted, Google and other crowdsourced review platforms have the same issues.

Personally, I've fallen back to critics reviews of restaurants. At least they have a reputation to uphold if they give a good review to a bad restaurant.
No, I mean the post office throws it out. If you tape a reply card to a brick or stuff the envelope with sand... they don't actually deliver it.
I know. It’s a bummer.

I’ve not tried to do block level backups for our setup in production.
Can you link to an example of this exploit? Does javascript suffer from the same problem?
Do you have evidence that one is the cause of the other?
No, because the issue is more subtle than you imply.

But yes, if a liquor advertises to minors, or even advocates for drunk driving in ads, then I would expect them to be sued. And yes, if auto manufacturers advertise in a way that leads to an increase in impaired driving, I would expect them to be liable for their advertising as well.
+1 for metabase. I’ve deployed it at 2 companies. The latest version allows you to compose “questions” you create in the system which is really powerful for organizing layers of data reporting.

Also, their API conforms 100% to Zapier’s polling feed structure, and I managed to build an integration that syncs our customer base to Pipedrive in a few hours. A bit more time and I have it automatically moving deals along in the pipeline as users progress with using the product. That alone was game changing for our customer success team.

Thanks, team Metabase!
> First of all, congrats on forming the alliance!

No Google on board, it means no Chrome support
A sandbox mostly used by cryptominers already.
My local grocery store already has amazon lockers in the parking lot. Clearly you don't need to open an entire store to enable that.
Well, it's not a zero sum thing. Backwards compatibility can mean stability without inertia. We can get pretty much all the best features from start-ups, gov, capitalism, and socialism at the same time.

Too often we focus on the outsides of a venn diagram, and fail to invest proper effort where the overlap is. IMO, the part in the middle done well is more than enough for a good world, and the bits on the outside are just flavors.
IANAL, so can someone help me understand: How is this the final say if it's out of a court in Boston? Isn't that only one circuit?
>Evolution doesn't plan.

It's more of an optimization algorithm. But that's not the same as coincidence.
Just trying to be Devil’s advocate here: So in the US, if I have an option to use Apple Pay where the company can not know my payment transaction details and whose business model is not ads-centric, why would I go for Facebook Pay? In Facebook Pay FAQ [1] they are not saying at all that the payment transaction data will not be used to target ads.

[1] https://pay.facebook.com/security-and-protection/
Yes it is how we run it in production and sadly it’s not great.

On my own laptop I’ve found it to be maybe 85% or so as quick as normal single mode Postgres. That said things aren’t great when the storage layer is doing consensus and replication and then the database is as well.
Are you making a moral judgement, or something else?

I don't usually get a say in what happens to my money once it leaves my pocket, I also apparently don't have the information you have, but if I did, I'm not sure it would change my decision.

Is the current Snopes team known for their purchasing of hookers? That's also totally legal in lots of places, again, not that I care.

What point are you trying to make?
First, the article doesn’t characterize the feature as an attack or a backdoor at all. It describes how a perfectly valid feature can be exploited to achieve deeper network penetration. I believe this technique was actually used to target Coinbase a few months back, as I recall from a post in HN a while back.

It’s useful in pivoting from a foothold attack at the boundary (e.g. Chrome zero-day) into the crown jewel backend which could be totally isolated to reduce the attack surface, but if you connect into it from a compromised host, this provides a convenient and hard to disable vector to piggyback onto the connection.

If there was no way to piggyback the session, even owning the developer’s terminal doesn’t gain you access to a secure system which has multi-factor authentication using a hardware token.
Thanks. That is very useful. I come from the other side i.e. looking at funds so it is great to get an idea from the inside.

I can only add that I have seen the same thing with prestige outside hedge funds. A fun example is Andreessen Horowitz: no-one feels stupid underperforming with these guys, I mean look at Marc's head...he has to be a genius, right? Lul.
SCOTUS has generally leaned towards that interpretation, at least insofar as the rights involved are judicial in nature (e.g., due process).
Most groups in life have shared values. Your church, school, nation, family, swim team, supper club, condo parking lot etc. all have some mix of implicit or explicit values if you look hard enough for them.

Some are soft, some are hard. “Fair play” and “equality” are very common ones, which overlap mostly with “No Shenanigans” in this example. The purpose of values is to codify acceptable behavior, and promote a nurturing environment.

“Provide exemplary HTTP endpoint documentation“ would be a bit more Twilio specific, but the ethos of the shared value itself is a common one. It’s a pity that in the 21st century the only values agreements most post education adults enter into are the ones with their employer, but we live in a very individualist society.
Hey thanks Vishaal! Having fun everyday :) We miss you over here.
Chinese digital yuan privacy promises
> So, the question is: What’s next? How do leaders in government think about and organize innovation in a way that makes a difference?

The answer here for me is to create a culture of experimentation and hypothesis testing whose results can be rapidly incorporated into the operations of the agency. Allow for testing off the critical path. Allow for smaller-scale experimentation to prove a concept that has an on-ramp into your day-to-day operations

This works for technology approaches, this works for regulatory approaches - it even works for opt-in citizen services IF you create the framework that supports it. (Director signs paper saying citizens can opt-in to test practices and those that do have X rights in the normal process, get the language cleared by legal, and you've got something that can last for a bunch of use cases)

Reduce the burden to get something started at a low level when your staff know it's a better way. Continue to reach out to line employees to ask what they would like to try out / attempt to make the organization better.

So much of government stagnation is the sheer burden of getting any sort of experiment approved / blessed, so you miss out on what's already in the building, let alone what can be gotten from outside. Maybe what I'm describing is "lean enterprise" type stuff.

As for Why Government Isn't a Startup and the original premise. Well... why isn't IBM a bigger version of a startup? Imagine dealing with all of the cruft ever written by congress since the formation of the country as your basis for operation. :)
Which has started working as good as Amazon internal search...

One page of results with 8 of 10 completely unrelated.
I don't think they see this as an egregious abuse of power. Googlers trust Google to do a pretty decent job of securing private information almost all of the time; this isn't an area of moral concern for them.

(i.e. the question in their minds is "Is the data safer in the source repositories?" And it's probably not).
-Years ago, I spent a couple of weeks offshore on a vessel on which the owners had stencilled on the aft superstructure 'SAFETY FIRST' in 5ft tall letters.

Beneath this slogan, some witty soul had stencilled 'SECOND ONLY TO PROFIT' in a slightly smaller font.
First, this prereqs are about what you could get on a netbook in 2012 and on a modern day cell phone.

Second, I think it would help to know why you think a container registry wouldn't need a moderate amount of resources.

I don't necessarily disagree that the resources could be lower at the minimum (and in fact, I recall they are quite a bit lower than this when running it on your laptop without any load), but is this really anything unexpected?

It's written in Python so it's not going to be as efficient as Go or C++ but it certainly isn't Java levels of resources being requested here.
Its usually a failing of the business to not communicate it better but values are one of the inputs to create the culture you want at a company. The best version of this Ive heard is that “culture is the right people living their values”. Done well, it makes it easy for people to hold themselves and each other accountable. It makes hiring easier, sets tone for communications, branding, etc.

Its super important for it to be explicitly stated. The difference amongst companies not explicitly stating their values and ones who “wander” is documented.
Except that we can all journalists really. There's no professional mandate. Go to rallies and make videos and post them on your political blog? You should be considered a journalist.
Can you use wasm instead of regular js/html? I'm thinking for rich GUIs it would be great, even just for company internal sites. I can't find any good examples though.
Problem is not every node has all data from all nodes so you couldn’t say take one node offline and do a block level backup of that node’s storage.
Actually it fails to properly sandbox C derived languages versus what hardware memory tagging like SPARC ADI and ARM are capable of, because it doesn't do bounds checks inside linear memory blocks.
Tesla’s European gigafactory will be built in Berlin
Agree. My current firm has a policy of not working with companies that don't post public prices, which sadly writes off CockroachDB for us. It's a shame because we have a major use case for it.
Automating Image Optimization
Yes it is harder because of the death of the + operator and the insistence on aggressive stemming and autocorrecting that applies even when you “really” “mean” “what” “you” “say”.
Tesla had Lotus make their chassis for the roadster (minimally modified Elise iirc).

I assume there's a suitable airframe manufacturer out there?
Anyone who needs more, I guess? Or, is the premise that gathering data is resource intensive (like innovation and patents for example)?

These aren't big problems, I think. The problem is that the people who hold the monopolies on data at the moment are also the people who are extremely powerful lobyists.
It is meant to be compiled to native instructions, I don't think there is significant room for hardware acceleration.
> If I "consent" to a boilerplate agreement handed me moments before an action is taken, have I really?

Obviously you have not.

I wouldn't say this is consent being "oversold", but rather yet another way that the concept of consent is being actively undermined into a legal fiction.

This is also why the GDPR has the provision for revoking permission to your data at any time - to counter its rights being otherwise nullified through contracts of adhesion.
> I append words like "wiki" or "reddit" to get results that aren't SEO'd

I'm not sure what you expect. I mean, yeah. I have to put OSRS in any search for "murder mystery" to get the result I wanted. But that's not a huge deal.

Who searches for generic "computer" that isn't a 70 year old lady probably looking for a new computer. Google in that scenario is just serving up what they're most likely looking for.

And heck, it's not like the wikipedia link was that far down. It was under a couple of store links and then bam. Wiki for computers.
How is this different from current web browsers for running JavaScript apps? Don't you think there is lockdown now?
> Google is slowly becoming useless (even with an ad blocker) because you have to hack search terms in order to get useful results. For example, I append words like "wiki" or "reddit" to get results that aren't SEO'd. Search for something generic like "computer" and you can see an example of how hard it is to get information instead of ads.

When you say useless does that mean you think the gap between Google and (other engine of your choice) is narrowing ? Do you see yourself switching to say Bing for better search results anytime soon ?
Florida's cay/quays/keys are just called Keys (presumably to short circuit this madness): https://en.wikipedia.org/wiki/Florida_Keys
Rust has libraries for this.
I'm not sure about the legal justification, but I don't think that is true in practice. For example a tourist or someone on an expired visa (edit: or an unexpired but non-immigrant visa) doesn't have the same 2A rights as a US citizen or permanent resident.
Apple's AR plan per The Information: Headset in 2022, glasses In 2023
The Constitution does not specify punishments for violating it. Congress could pass legislation specifying punishments in accordance with this ruling, but it would not be retroactive.
But what would the complaint be? "I don't want my data transferred to Google, because.... Google?"

I mean, filing a complaint is free but I imagine it should have a grievance attached to be taken seriously.
CockroachDB is built from scratch in Go, uses Raft + RocksDB as a distributed key/value store, and then implements the Postgres data structures and wire protocol on top. Focuses on strong consistency and durability (which was the origin of its name). Can run active/active in multiple regions. Lacks full compatibility with Postgres.

Yugabyte is a multi-model database built in C++, uses Raft + RocksDB as a distributed key/value store, and then implements a proprietary document-store model on top called DocsDB. This is exposed as a Redis API, Cassandra API, and now PostgreSQL RDBMS interface by using the actual Postgres code for the SQL layer. Much higher compatibility with Postgres with all data types, most advanced SQL, and even some extensions that work without problems. Not as advanced on the distributed side and uses more of a primary/replica setup.

Both are great options for a distributed scalable RDBMS with Postgres.
Is UPI in India tied to apps such as Paytm etc? or is it in itself is an app? What is the security and privacy aspect of using it?
This is the larger problem... Google thinks it's making our search easier by force feeding us what we obviously don't want.

It interprets what it thinks I
meant instead of listening to the actual words that came out of my mouth.

I have the same problem with my wife... :-)
Can we stop producing the -splaining words and roll back the ones already shipped.
I'd expect it's coincidence but in the other direction; Google's Fitbit motion has led to journalists being curious what other moves Google is making in the medical space.
I think it depends on whose perspective you're asking for.

I think from an employee perspective, seeing leaders talk about squishy things like "company values" can feel hokey and gimmicky. After all, even Enron had plaques hanging in their headquarters about their values. So are values just the sort of snake-oil marketing buzzwords you use to sell how great and "innovative" your organization to investors and prospective employees (e.g. WeWork)?

I certainly think that this is true to some extent for most companies.

At the same time I also think they're really important for founders/leaders to articulate and stick with. It explicitly formalizes a set of moral norms, behavioral patterns and ideologies you want those who are part of your company to abide by. They're pithy shorthands for verbally and explicitly describing your company's aspirational culture to others who are not part of it.

I think a lot of us feel disgruntled and frustrated when leaders profess one set of values, and seem to live by another. I think many of us would prefer to work for a company where the values aren't explicitly stated, but they're followed than for a company where the reverse is true (e.g. Enron).

At it's core, I think having a set of company values is basically having a list of aspirational behavioral norms that you have agreed to collectively prioritize. It allows people to check people's decisions against these norms (e.g. "Hey, I think you're doing something sneaky that makes our company look good to prospective clients, but I think it's important we respect our value of 'No Shenanigans.'"), and also make decisions (e.g. "One thing we value is to 'Not Settle'. Are we settling in this product decision?").

Done well, it can be really motivating and purposeful.

Done hypocritically or inconsistently, it just feels like another marketing gimmick that big companies do.
Apparently Yelp has actually been used in extortion attempts: https://thetakeout.com/new-restaurant-faces-fake-yelp-review...

But the complaints are mostly that Yelp's policy is inconsistent. Its review filter removes good reviews and keep bad reviews, at times, and the customer service is terrible. And the ratings are subjective and mostly useless and still used everywhere on the site regardless.

The same applies to Google/YouTube, Amazon, etc. though, so I'd say you're just seeing the availability bias; there been a fair number of positive success stories about YouTube, Amazon, etc. posted on HN whereas business owners on Yelp are too small audience-wise to get a lot of traction.

The only real competitor to Yelp is Google; maybe Google boosted up negative news stories on Yelp but it could just as easily be the newspapers themselves fanning fake controversy.
Show HN: Who could buy Docker Inc for less than $1.8B?
WebAssembly got formal semantics with formal proof of soundness. PNaCl (and LLVM) still doesn't.
> We are particularly worried about Intel's mitigation plan being PoC-oriented with a complete lack of security engineering and underlying root cause analysis, with minor variations in PoCs leading to new embargoes, and these "new" vulnerabilities remaining unfixed for lengthy periods.

I wonder how many board members are shared between Boeing and Intel as these companies seem to prefer the same type of leadership.
From an economists perspective knowing the prices could have profound effects on things as people will likely substitute either going to the doctor at all or shopping around within or without their state for treatments until a fair market price for a procedure is found. At least that’s the theory anyway.
> surely I can’t impede law enforcement because they haven’t justified their authority to me

Unless you've broken the law (and certain special cases), they have no authority over you. Because of the nature of their jobs, which requires them to sometimes take away a person's freedom or life, they must be held to a much higher level of accountability than your average person.

You cite fear of harassment as a reason for not standing up to police, and to me that says something is deeply wrong with our current system.
Or UNCOL, or Xerox Pilot and Dorado microcoded CPUs, or IBM z/OS and OS/400 language environments, or VMS multi-language backends, or PNaCL, or ....
> There is no such thing.

No, you admit there is such a thing, you just call it something differently. We're clearly talking about the same thing, whatever we choose to call it, it exists.

What you call "executive asserted zone in which [the constitutional protection against unreasonable searches and seizures does not apply]", I call a "no Constitution zone". It's clearer.

As far as activism goes, the way I see it: we can either use plain language to convey a pretty good approximation of the situation, and help people understand the crazy state of people's rights at the border, or dress it up in business language like a government-sanctioned PR release and lose a listener's interest immediately.

Someone probably learned about the zone from this very thread, which wouldn't exist had I not been provocative. And is it really provocative to point out that something's not right?
The the authoritarians will simply move the goal post of what is suspicious.
Ah. OK. In that case, I'd still like to know for which query DDG was much better than Google, if you can share.
Guessing it was edited after the mistakes were pointed out
I got that error screen this morning. I guess they'll get it sorted out soon.
This argument works against you.

If you were illegally searched, then law enforcement subsequently does parallel construction, defense counsel can easily and persuasively argue that the subsequent evidence is "fruit of the poisoned tree" and would not have occurred without the illegal search. The judge can then throw out all evidence from the parallel construction.

The only way parallel construction works is if defense counsel and the judge don't know that the illegal search ever happened at all - which is very unlikely in the case of an illegal border search.
I like to keep a slack channel (and saved kibana search) for 500s for this exact reason. System-wide we should have no 500s, and when they happen I like to tackle them immediately. I also have daily reports for other various errors, like caught exceptions, invalid auths, etc just so I can see where things aren't going quite right in case it's indicative of something weird going on.
The answer is likely "They're not".

Gotta decide between taking the hit on adding another "except for" to your unlimited marketing claim...versus taking the hit on people pushing their multi-terabyte torrent collection into your service.

It's a lesser of two evils & the two providers picked different ones.
Visible (at least in part) on Youtube:
https://www.youtube.com/watch?v=RpjTgHMUbAk
If you aren't wedded to R then pickling sklearn Pipeline and loading in Flask app can be nice. Advantage of this is that data pre-processing can also be included in a sklearn Pipeline.

https://scikit-learn.org/stable/modules/generated/sklearn.pi...

The bit I'm not sure about how to do well is model monitoring.