skysight-inc/HackerNews huggingface dataset:
I’m of the mind that just about any security bug is “excusable” if it passed a good faith effort by a qualified security audit team and the development process is in place to minimize such incidents.

The problem I have is that I can’t tell what their processes are beyond the generic wording on this page[1]

[1] support.apple.com/guide/security/introduction-seccd5016d31/web
This code doesn't duplicate it. In Rust when a variable is sent as an argument to a function it's "ownership" moves to be in the scope of that function.

https://doc.rust-lang.org/book/ch04-01-what-is-ownership.htm...
"Every system in the world has flaws" and "it's a serious problem that one of the world's most important software vendors, that markets itself as the most secure, keeps releasing products with flaws that would have been discovered in a very basic audit" are not incompatible statements..
And by the time you’ve replicated that, then state of the art will have moved significantly.
Even being falsely accused is almost irrelevant here. Someone was killed in a police encounter over a bad check, falsely accused or not. It's not like a false accusations of murder or some aggregated assault. It's a case of a bad check.
Startpage's private browsing feature does something similar but far more effective.
Hiring software engineers to reinvent Work
Would you have to keep track of these threads in Rust? I have done a lot of desktop development where you have to be aware of what happens during shutdown. Seems a lot of server guys write their code under the assumption that it will never shut down.
your original post has several replies explaining why this is not a security issue. the token you ultimately get is a signed concatenation of 3 base64 encoded fields, and unless you decided to manually separate and decode these without verification (instead of doing the easy thing, just using a standard OIDC library) you would not have any user data that could ultimately result in a security issue
Is that cheaper than Costco proper?
Authors (pen names),
musicians,
bloggers,
anyone else who wants a little privacy but still wants to share publicly.
1 yubikey per service provider?
Every time they say "Bob and Doug" I keep thinking Bob and Jeb
Running on only 2 servers kinda risky no? Your one hardware failure during a maint on the other away from an outage.
If you pass by reference the heavy object won't be dropped. If your goal is to drop a heavy object, this is a cool way to do it.
HN on practically every thread touching inequality, for starters.
I don’t get it. What does removing Haskell from the into course have to do with the use of Haskell in the PL or compilers class?
This issue is largely cause by people still stuffing old root certificates in their certificate chains, and serving that to their users.

As a general rule of thumb:

1) You don't need to add root certificates to your certificate chain

2) You especially don't need to add expired root certificates to the chain

For additional context and the ability to check using `openssl` what certificates you should modify in your chain, I found this post useful: https://ohdear.app/blog/resolving-the-addtrust-external-ca-r...
Inside of companies with data protection requirements, these can be handier and more natural than censoring PII or PCI or replacing them with an encrypted string. It’s much more natural for the data science process.
I always wondered if you could heat your house from the aluminum if you got soda in a deep sale. There’s a lot of energy in aluminum.
SVG Magic in Flutter
Video version - https://www.youtube.com/watch?v=ojOmUWLDG18

Images here are fascinating: https://flashbak.com/when-china-wiped-out-the-common-sparrow...
Where would you even find one?
Icebreaker questions managers can ask in meetings (during Covid-19)
I've not worked with any language thus far without automatic garbage collecting, so this was definitely a neat read for me. It sounds rather elegant.
This effect wasn't visible during previous White House administration and perhaps will be reversed within the next one. Current isolationist politics, with explicit mantra "America first" looks more like an aberration rather than a long term reality.
Of course there are actors that downright pursue infecting the minds of people. However, the problem did not get out of control until the content platforms found those who were more susceptible to their message “at scale”.
Nothing in the README seems to tell me how this operates.

Okay, I understand there's a demo, and changes in v4, and an FAQ, but I'm never told what the scope or method of operation is: what can this monitor? how is it monitored?

I don't want to read configuration files or look at a demo to understand what I can use this for and how it does it.
I even read parts of the Wiki and I still don't understand what this is doing: is it essentially a special theme for Hugo, or is there some frontend JavaScript magic going on?
Whales fill their mouth wide open with water and spit it out through their baleens, a set of comb-like teeths that filter out everything smaller than a krill. Krills are 1-2 centimeters long and they feed on plankton much smaller than that, so it gets filtered out.

Interestingly there is no clear difference between krill and plankton. Krill are small crustacean animals, while plankton encompasses all organisms, animal or algae or protozoan (including jellyfish), that float passively in a body of water, as opposed to nektons, who swim actively. Altough most krills are nektons, some species, such as amphionides, are plankton.
DataDog failed this morning because of root CA issue.[0] Was a fun Saturday morning with 5000 alarms blowing up my phone.

[0] https://status.datadoghq.com/incidents/6bqpd511nj4h
Interesting, I should get that and keep it in my emergency supplies at home. Any idea if those are available in Canada?
Apparently this is a site for entrepreneurs?
- Books. Usually just "book" given a particular language. There wasn't a breadth of material available, so you had to rely on your critical thinking and reasoning skills much more.

- Paper programming magazines that came out monthly. These normally had articles that centered around a program you would type in manually from the pages of the magazine.

- In-person user group meetups. These were pretty entertaining and full of brilliant basement dwellers with entertaining and non-normal personalities.

- BBSes (social networking)
>But we don't have a ton of empirical evidence on our side

Neither does the other side, unless you accept the premise that reading natural language text is similar enough to reading heavily indented code where that indentation has meaning. I don't accept that at all.

The studies that were done on natural language text assume that line length is equal to the column where the line ends (i.e all lines begin on the left edge). That's not usually the case for indented code.

If reading long lines takes more effort because your eyes have to travel further to find the next line, then the amount of indentation the next line has matters are great deal.
Interesting to speculate on the engineering workarounds if all FPGAs disappeared tomorrow. I'm not sure there's a big long-term impact.

Maybe more shift to more to DSP, make low volume ASICs on older nodes cheaper and cycle faster, put up with more card swaps since you can't update certain things in firmware so easily.

You can still do all the things but maybe the design takes longer or you sacrifice some performance (designer gets to choose the tradeoff).

My guess is the main "real" impact is cycle times, design retooling and having to pause and rework existing designs suffering from supply chain disruption. Potentially all problems you can fix scalably by throwing enough bodies at them since the money is clearly there.

Would be interested in perspectives from anyone working in a related area.
No one in NATO trusts France (especially former communist countries).

France left once, and came back. They used to pander to communist regime during the Cold War.
During the NATO bombing during the Yugoslavian dissolution, a French General was caught giving out the bombing plans to the enemy.

No wonder nobody likes their foreign policy, and Macron is puzzled why the other EU countries don’t follow France in creating a Common EU military force.

The other countries know when push comes to shove, the US is a reliable partner, while France is not.
If you want an interesting challenge, embed an agreement into your client headers, and then sue the pants off of these companies.
Although I think the post is very clear describing the reasons why Haskell isn't attractive in business, this part rubbed me the wrong way:

> Thus, instead of our discourse being about semantics, engineering quality, and implementation, we instead discuss our tools in terms of social factors and emotions (i.e. it “feels readable”, “feels usable”, “feels fast”).

Thinking about readability or usability as emotions and social factors, rather than as first level concerns, is a non starter to me, and I find it extremely off putting that the author seems to pile up those qualities in the marketing "group", as if they were not real properties of a language.

You can design a drill in a way that makes it the most scientifically correct at using the power it's supplied efficiently, but if the design hurts the users hands and requires months of training to operate, any worker will throw it in the trash, because they can drill things just fine with a regular tool.

(I'm not necessarily saying that Haskell is that drill, just saying that usability should never be treated with condescension when you're designing tools).
You didn’t make enough money.
Zero-Shot Learning for Text Classification
Killing a process without freeing all allocations is, as far as I can tell, routine in C. Especially for memory it makes no sense "freeing" allocations, the whole memory space is getting scrapped anyways. Of course, once you add RAAI the compiler cant reason about which destructors it can skip on program exit, and if programmers are negligent of this you get programs that are slow to close.
Wow that’s a really simple bug. Kudos to the OP to even try that. Most people would just look elsewhere thinking Apple of all companies would get such a basic thing right.
> acquiescence that sometimes conspiracy theories could become truth

If there was an intention of acknowledging the truth behind some theories, they would / should have come right out and said so. As it is, the article is sending a much clearer message that 'if people were to think analytically, they wouldn't believe conspiracy theories'.
MPWTest: Reducing Test Friction by Going Beyond the XUnit Model
> 'Conspiracy theories are becoming more visible'

One I wanted to share anecdotic (A: and B: texting);

B: "The reason of every causality related to probability is 'action and reaction'."

A: "'Not contentual' but reachable and alternative - Only in one direction. So it would became provable, that in the heart of each theory may be no veritable solution."

B: "Even if combinations of the whole and something imaginary find together ?"

Left me with a question... (-;

x-Files for Computer (-:
Violent Protests Change Politics
We got hired through want-ads in the local papers, or through headhunters (once we became known). We read paper documentation. That was slower.

I learned C by reading K&R. I learned Pascal by reading an equivalent book, though I can't remember who wrote it. I learned Basic by reading the TRS-80 Basic manual. I learned 68000 assembler by reading Motorola's 68000 book. And so on.

I remember the day the hard drive on the development system died. How did we find a replacement? Yellow pages to find companies that were plausible, then calling them to find out if they had what we needed.

Everything moved slower. But the people you competed against were also moving slower...
Word on the street suggests they don’t exist: https://twitter.com/thegrugq/status/1236264193906495488
Hands on Scala is ready for purchsae
Backwards. "Idiots" are the ones who do not question the status quo.
Interesting, almost looks as if whale conservation, despite having been started for purely sentimental reasons afaik, has turned out to be saving our asses a bit in terms of climate change and overfishing.
Great value .. But I specially see a lack of startups listed in Asian market apart from India.
I still maintain that ECMA sounds like an unpleasant skin disease. Not good marketing, that!
Influenza viruses are not coronaviruses.
Google search isn't groundbreaking enough?
Nothing. You have to create a Markdown file with the start and end time. Their example confusingly says resolved is 'false' but then sets a resolve date, so I dunno what to make of it. https://raw.githubusercontent.com/cstate/cstate/master/examp...
I’m thankful for all the smart, diligent people working hard to keep us all safe.
I was under the impression the key size was 256 bits but the security level was 128 bits.

But IANA cryptographer.
> the ownership system lets you transfer freeing responsibility off-thread safely and cheaply in order to not have it block the critical path

This can also trivially be done in other languages. Atomically append your pointer to a queue of "large things that need to be freed" and move on as though you had actually called free.

Within a particularly time sensitive loop you can even opt to place pointers into a preallocated array locally. Then once per loop iteration swap that array with the thread handling the deallocations for you. It eats up a bit of CPU time but can significantly reduce latency.
> My general point is that sometimes we're so focused on producing (2) 'an incredibly good, and perhaps very time-consuming, piece of work that produces exactly what is needed' that we fail in (1) '[producing] what is needed, but not well' (and thus end up failing in general). In this respect, we should take inspiration from our seven-year-olds. In the best of worlds, we could take inspiration from them with regard to point 1, mentor them to respecting point 2 while making sure not to smother the essence of point 1 - not in them, nor in ourselves.

> Adults fail, seven-year-olds are just sad (in the moment) because they were not able to materialize some grande vision. This is two separate experiences; and perhaps this is precisely why seven-year-olds are better hackers than adults? …because they don't really fail?

Woah boy, this hit home. I really ought to get back in touch with my inner seven-year-old self.
Indeed. It is produced by the addition of qualifiers to words like "justice." As if justice, equality, and such need qualifiers. It's about inverting oppression instead of getting rid of it. As if oppression is any better inverted.
How is it unsubstantive?
I have on occasion created pseudonyms for various purposes. One of my favorite techniques is to combine a first name common to a particular nationality with a last name common to a different nationality. E.g. a French first name with a Japanese last name. Surprisingly, such combinations occur somewhat frequently in real life.
Maybe they already offered dropshipping?

Either that, or they use existing partners for reverse dropshipping: they supply the bulk and take the orders, but use an existing grocery chain to do the packing. And of course, if the business works they gradually move to doing it themselves.
What about Bob and Doug.. MacKenzie?
> So far, the bit and byte shifters only shift bits in one direction. However, bits need to be shifted in both directions. One of the key innovations of the 8087's shifter is its bidirectional design: data can be passed through the shifter in reverse to shift bits the opposite direction. This is possible because the shifter is constructed with pass transistors, not logic gates.

That's really cool. I've never really looked at ASIC design so that wasn't something I had considered before. I have a left-shift unit design that uses 74F logic, and to get it to do right shifts I would have to reverse the input and output, which is the typical trick to use when you have to use logic gates.

http://www.pnnk.org/img/lshift_schematic.pdf

http://www.pnnk.org/img/lshift_board.png
As far as I understand your certificate is still valid but you need to remove the intermediate certificate from your bundle. That was the case for me anyway.
> This is the standard problem with tracing data structures to free them. You frequently run into it with systems based on malloc/free or reference counting. The underlying problem is that freeing the structure takes time proportional to the number of pointers in the structure it has to chase.

That doesn't seem to make intuitive sense. A GC has the same problem.

A garbage collector has to traverse the data structure in a similar way to determine whether it (and it's embedded keys and values) are part of the live set or not, and to invoke finalizers. You're beginning your comparison after the mark step, which isn't a fair assessment since what Rust is doing is akin both both the mark and sweep phases.

The only way to drop an extensively nested structure like this any faster than traversing it would be an arena allocator, and forgetting about the entire arena.

The difference between a GC and this kind of memory management is that the GC does the traversal later, at some point, non-deterministically. Rust allows you to decide between deallocating it in place, immediately, or deferring it to a different thread.
come on ccp shill. gtfo.
The important part is in the author’s article. The POST to the opened endpoint generates a valid JWT token for the email address in the payload, not for the one in the logged-in session. Everything else is extraneous.
> "Why will this paper matter in 5 years?"

3. First evidence that performance continues to improve at hundreds of billions of weights -- paving the way for trillions of weights, approaching orders of magnitude comparable to that of the human brain connectome.

4. First evidence (AFAIK) that larger NLP models do not need task-specific finetuning -- paving the way for general-purpose models that work well on any NLP task without additional training.

5. First evidence (AFAIK) that larger NLP models fool human beings without cherry-picking -- paving the way for models that can pass ever more challenging Turing tests.
Fintech Startup Marqeta Raises $150M
The author of the article has an interesting contact page:

"To contact me via email run one of the following scripts to generate my contact information. I find this is an effective filter against the deluge of emails from recruiters."

The "scripts" are offered in Haskell, x86-64 Assembly and Python. Solution is pretty obvious though, no need to run them actually.
One of my favorite papers by Bacon et al expands on this intuition that garbage collection and reference counting are opposite tradeoffs in many respects, and gives a formal theory for it. My views on gc/rc haven't been the same since.

http://researcher.watson.ibm.com/researcher/files/us-bacon/B...
> a straw man against critical thinking

I like your summary. It has seemed like calling something 'conspiracy theory' has been, for many people, a comfortable dismissal. It's so much easier to believe the conspiracy theorist "needs help" than to accept that the NSA is monitoring everyone.
You can only vouch for [dead] posts and comments.
Ask HN: Have affiliate commissions polluted reviews?
In general, are you losing trust in online reviews because of incentives, including Amazon's affiliate program?
> from what I’ve heard

No source specified - ignore.

> if society could quantum tunnel

Oh dear.
Exactly this. Sometimes when I recycle something like a glass jar, I have this vision of a parent 1000 years from now in a post-apocalypse society, trying to bring a little clean water to their village, and how much they might appreciate that clean glass jar.
> the hardest thing about producing an atomic bomb is spinning up enough U235. To produce highly enriched uranium requires huge numbers of gas centrifuges.

This is true in the modern era. However it should be noted that the Manhattan Project did not use gas centrifuges to produce their enriched uranium. Centrifuges were apparently considered but ultimately gaseous diffusion was used. Gaseous diffusion requires larger facilities and more energy, but I suppose the process doesn't require such tight tolerances as modern highspeed centrifuges.
> No one should be using JWT

I've heard criticisms of JWT -- mostly around the lack of ability to revoke a JWT.

One could then introduce a refresh token with a longer ttl, which can be revoked on the server. But of course then you lose some of the statelessness that JWT benefits from.

But still, it seems like a reasonable approach to authentication to me. I can authenticate with several services if need be, and I can check locally if my token is 'likely' valid.

Care to expand why you think one shouldn't use JWT tokens?
Any guess at what percentage is this versus the case where these certs are cross-signed with a newer root but older clients with outdated bundles do not trust the newer root?

(At Cronitor, we saw about a 10% drop in traffic, presumably from those with outdated bundles)
Usually in a background thread ;)
Interests can be short-term. US having no problem siding with China still takes into account the long-term interests. Generally Western world members do the same, even if that goes against the short-term interests.
Can you elaborate? Do you have a source?
Available and short .com domain names for your side projects
Good to know. Still a hard pass based on the per-unit pricing.
Good judgement is an intuitive understanding of taking calculated risks. One gets this intuition by estimating risks. Experience is the litmus test or experiment which validates one’s risk estimates and checks how expectations aligned with reality.
The first computer program was transmitted through the postal network.

https://www.bl.uk/collection-items/letter-from-ada-lovelace-...
Your static app won't scale. Once your kernel is saturated with connections, once your buffers are full, you will get packets dropped. Your app may crash unexpectedly so you need to run it in an infinite loop. And of course your static example is a simple echo app or hello world. That works fine from a toaster. In the real world we use databases where every store takes a significant time to process and persist. You quickly overgrow a single server. Then you need distributed systems and a way to do versioning so you use containers and then you need an orchestrator so you pick K8S because it's most mature and there are many resources around. And then you can even do rolling updates and rollbacks. Finally you use Helm, Terraform and Terragrunt and never look back. It works surprisingly good. I lost several years by learning all this stuff, it was difficult but it was worth it. I have more visibility into everything now thanks to metrics-server, Prometheus Operator, Grafana, Loki and I have two environments so I can update deployments in one environment and test, once tested ok, I can apply to live. No surprises. No need to run 5 year old versions of software and fear updating it...
The answer to this question is the same for any language without a heavy runtime. You can choose to join the worker thread, detach it, or kill it.
I made a tool that does this with Chrome memory profiles

https://heapviz.com/

Also ported d3s circle packing algorithm to C++ for compilation to WASM

https://github.com/tomlagier/circle-pack

Definitely love how that visualization turns out!
I could explain it but not as well as if you just search for crispr gene drive.
If you just want to blend in with the crowd, you can use the tor browser without the tor proxy.

They have invested a lot of effort crafting its fingerprint. Now that they have moved away from Firefox ESR, it shouldn't come with much of a security penalty.
Are these benchmarks? Installation time (30m to create a dB! That can’t be right?!) doesn’t really feel like it falls under that umbrella.