skysight-inc/HackerNews huggingface dataset:
Was thinking to myself - why do pandas seem so bumbling/miserable - at pain in their existence. This article at least suggests that's not their always-state.

"In their shrinking natural habitat, the bears are tough, sexually potent survivors, not the hapless bunglers we have created as zoo attractions"
Faucet Collector by BigPoolSearcher [ Free Bitcoin daily ]
Handshake sounds exactly like namecoin which has been here for a while. I guess its trying to be better by not requiring all nodes to be full nodes or something. I feel like that is not the reason why namecoin failed.

As an aside, anyone else notice how it seems like all blockchain projects are annoyingly full of marketing speak, and talk in circles for the tech part. How hard is it to clearly and concisely list the technical goals and properties your solution has?
I think the "Prepare for the exercise of people’s rights" part is critical.

If you are a software architect, you need to ask yourself: can I delete a single user data across all my infra easily? If not, you might be in trouble a couple a year later when you are hit with thousands of deletion request and technically can't honor them.

Another side of tech debt I guess!
The Sheet #16 about cookies and third-party trackers is quite interesting:

## To benefit from the exemption from consent

**Subject to a number of conditions**, cookies used for audience measurement are exempt from consent.
**These conditions, as specified in the [guidelines on cookies and other trackers](https://www.cnil.fr/en/cookies-and-other-tracking-devices-cnil-publishes-new-guidelines), are**:
* To inform users of their use;
* To give them the ability to object to their use;
* To limit to the following purposes only:
* audience measurement;
* A/B testing;
* Not to cross-check the data processed with other processing (customer files, statistics on visits to other sites, etc.);
* To limit the scope of the tracer to a single site or application editor;
* To truncate the last byte of the IP address;
* To limit the lifetime of the trackers to 13 months.

Provided that the conditions are met, **we therefore switch from an opt-in to an opt-out regime**.
It is also possible for the same third party (subcontractor) to provide a comparative audience measurement service to multiple publishers, provided that **the data is collected, processed and stored independently for each publisher and that the trackers are independent of each other**.

## In practice

**Most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration**.

That's what I though, when websites welcomes you with a giant popup "Manage your consent" with a gazillion third-party trackers all opt-in (and you need to disable them one by one) they are actually not GDPR-compliant.
Down to DC? That should be a surprise, because it's certainly not true! Faraday's law of induction only applies to varying fields, which means AC or physical movement. Remember, it's perfectly normal and common to have a square wave with a DC component of zero!
Wayland remains very immature, and it still has significant shortcomings in hardware support. It's a beta-level technology at best, while Xorg has 20 years of stability behind it. It isn't responsible to suggest it as an alternative.
I disagree, there are many things it is great at.

The language is well designed, with orthogonal features that complement each other. Coroutines and meta-tables are easy to understand and still powerful way to organize and control code base.

You can actually learn it in a week, and hold all of the language in your head. A very valuable thing in my opinion. The code is very readable to beginners (unlike Perl, Haskell or APL).

The interpreter is incredibly fast. Even non-JIT implementation is surprisingly fast.

The LuaJIT FFI is so convenient that the difference between C/C++ libraries and Lua libraries almost disappear.

There are cross-platform hosting frameworks that allow you to write and execute dynamic interpreted code on otherwise locked down platforms (Android, Switch, TVs...).

I would say Lua lacks tooling and better organization of community. Biggest Lua communities were built around products that embed Lua like WoW, Roblox, Corona (now Solar2D).
Voice of America: independence fears after Trump ally purges senior officials
Something to be aware of is that people with digestion disabilities, in particular hidden digestion disabilities, may not appreciate a McDonald's commercial that brings their digestive disability into a TV channel.
AI Job Interview
On Android side of the mobile OS fence, Google is now enforcing ARM memory mitigations starting with Android 11 and it builds up on the OS lockdown features that they have been adding since Android 7.
It wasn't public facing, it was taken from an internal network it seems. https://www.businessinsider.com/cia-vault-7-leak-woefully-la...
Zeppelin is not Jupyter.
And I'm not sure how BeakerX works tbh, but it uses a whole docker image all the time to run right? So, might be very resource consuming, this kernel was implemented on C++. I honestly have no idea of how good is the tooling around SQL in BeakerX but might be a better alternative if you don't care about the docker image and doesn't actually need SQLite, that's different from SQL, which is what they're offering.
Sure! And have them all report each other for thought crimes and maintain secret files on everyone.

Either that or let AI sort it all out.
Two Memory Bugs from Ringbahn
I discovered the Homebrew CPU webring less than 10 years ago and was amazed to find it's still full of great projects. Still going strong today, and many of the links are on GitHub now.

https://www.homebrewcpuring.org/
play crazyhouse, make chess fun again.
Can you please ellaborate more on why Lua is way better than JSON ? We use JSON a lot for configs and data exchange, cannot see how can we gain from switching to Lua. One of my developers suggested Lua, so I'm curious.
You compensated the owner of a chain of coffee shops by buying a few mugs?
>I'm not sure if you're talking about daily deaths, or in total, but California has had 5,286 deaths as of today, not 58. We also had 81 deaths today specifically.

They are talking about total deaths, but only in SF/Santa Clara. The actual figure is 47 for SF and 151 for Santa Clara [1][2].

[1] https://data.sfgov.org/stories/s/fjki-2fab

[2] https://www.sccgov.org/sites/covid19/Pages/dashboard.aspx#ca...
I guess if it were a CompSci faculty, the therapy is making these actions of your uni public, then see their academic reputation asymptotically approaching zero :) Though it's not clear what Chrome sends home, and TFA is only about Chrome
plugins, so lets not prematurely start a witch hunt.
Generating cooking recipes using TensorFlow and LSTM RNN: A step-by-step guide
So WebExtensions support this, even dynamic permissions (like on Android). But I've found I've had to push developers to use it because it makes their life a bit harder and it's already a side-project.
Why Open Banking is not there yet (despite Plaid's $5.3bn acquisition)
NixOS does the same thing. If you tell it to load python3 it will load the latest 3.7.7. You need to explicitly tell it which version of Python3 you want, just like in Dockerfile.
The Evolution of SaaS Architecture
> The only untrusted programs I run are Steam games and FPGA tools, and for those I created a separate user account.

Do you also run a separate display server? I'm not convinced a truly malicious executable can be stopped by boundaries between users.
This holds only when with IPv4 NATs that are fronting masses of people, such as in ISP or bigcorp NATs - otherwise the privacy effect is weak enough to be negligible and it can be weaker than IPv6 use of rotating privacy addresses.
You know, everyone's favorite stalinist republic in eastasia also operates under similar meritocratic auspices.

You'll probably feel like downvoting this because you have no idea what I'm talking about.
A few tens of microseconds, most likely.
I can give you more than that, here’s my dotfiles: https://github.com/saagarjha/dotfiles. You may find that .nanorc a bit confusing so I suggest looking around at the other files with “nano” in their name for some context.
I really don't see what better experience does having all of this https://distrowatch.com/ for those 2% provides.
After reading the architecture post [1] referenced in the comment by mpociot [2], I’d say PHP is more “suitable” for the server-side if you choose to self-host the Open Source code rather than use the service.

These tunneling services use a client-server architecture with the server-side running on a public IP address. A static binary written in Go, like pgrok, is ideal for the client-side. On the server-side, you want an app server that is both common and can dynamically load a module. A dedicated Go server makes sense if you are building a service but not if you want to add functionality to an existing app server with a public domain name.

[1] https://pociot.dev/28-introducing-expose-an-easy-to-use-tunn...

[2] https://news.ycombinator.com/item?id=23554459
Aren't the new interfaces from the draft, where you can list bunch of possible types, sum types?

edit: oh. no.

https://go.googlesource.com/proposal/+/refs/heads/master/des...
One of the many interesting things about the Zones of Thought is that all of those problems with software you describe are explicitly there to protect the likes of humans from what can exist on the other side of the singularity.
How will you prevent this from filling with spam? Are you manually approving submissions in some way?
While I think you are right to some extent, articles like the parent's are mostly aimed at people claiming 'Linux Desktop is actually better for grandma'. The reality is that grandma is going to be better protected while running Windows or MacOS or Chrome OS. If she's running Linux, she is wide open.

Also, some of the most common practices on Linux that are claimed to be superior from a security standpoint are just bad. For example, the package manager is very nice, but when you want to install anything that is not in the official repos, your options get just as bad as windows, or worse, despite what many people think. A common recommendation in advanced projects is to add their apt/yum repo to your system, which is not only equivalent to downloading stuff off the internet, it is also you registering them as trusted to deliver updates to your system forever. On Windows, you at least have some anti-virus tool scanning for known malware, so you still have a small chance that you won't be allowed to run some well known malware from years ago.
Could browser extensions be ran in a sandbox, with read_access to the page, but only able to read from whitelisted registered and fixed URLs for updating configuration etc? So your blocking extension can download lists of things to block, or other config, but it can't exfiltrate any information about the user's browsing habits.

The only side channel I can then think of is using page rewriting or timing to communicate when the user browses to a page controlled by the extension owner. This would be something that there is at least a hope of spotting?
That is missing the point. It is not that infinite monkeys could break in, it is that the NECESSARY level of security can not be met even assuming the best known practical system. Therefore, they MUST NOT use/create such a system since they can not achieve the MINIMUM requirement. There is no point in improving systems from ridiculously inadequate to very inadequate since the system still does not work and you MUST NOT use systems that DO NOT WORK in critical capacities.

Like, imagine a world where the Army made tanks out of tissue paper. You could say, "Look at these clowns. Don't they know regular paper provides better defense than tissue paper.". While true, it does not really matter since if the best armor available is paper, every strategy should probably avoid depending on tanks.

My point is about looking at OBJECTIVE requirements and evaluating solutions against them. At a basic level this boils down to two questions:

1. What is the NECESSARY level of security?

2. Can anybody achieve the NECESSARY level of security?

If the answer to 2 is no, then the system MUST NOT be used/created.
I'm not sure that working on an open source project is good way to learn a new subfield of coding. I've done it and, in retrospect, this time could've been better spent elsewhere.

When working on an opensource project, you'll become an expert on the few functionalities (and code that realises it) of that single project that you will be working on - while you'll be oblivious about everything else in the subfield. IMO just doing a project that's typical for the subfield will allow you to learn much more. So, for example, when learning ML, don't go do obscure work on R codebase, but instead try some simple challenges from Kaggle.
That looks awesome. Pretty expensive from what I see after a quick search though. Does it have USB-C charging?

My previous monitor iterations have been LGs and I really like the USB-C charging capability, KVM and the OSD/buttons.

Got one of these in my cart right now: https://smile.amazon.com/dp/B07NS7JKJH

I'm gonna sleep on it and double check the return policy on this 43".
The Code of the Command and Conquer Game: Bugs from the 90s. Volume One
A good part of the initial engineering muscle came from Mozilla. Google used to pay people working on Firefox, including the Firefox lead developer Ben Goodger, but pulled them to work on Chrome instead. So they already had a system set up for moving the web forward, but clearly they wanted more than that.
https://twitter.com/AmitShah/status/459742388949241856
Great questions.

> What are your ways to find people that have a problem?

Below are some very generic ideas around how to find people. These same ways of finding people are going to help when it comes to actually marketing and selling products, so if you can't figure things out at this stage, it's going to be potentially difficult later down the track.

The key idea is to go through a problem solving process asking questions such as:

Are there places these people hang out? Forums / Facebook Groups / Events / Subreddits etc

What complementary products or services are these people using? Can you partner with them in order to reach your potential future clients?

When people have this problem, what do they do to try to solve it? Are there things they might do that can identify them as potentially having this problem?

When you can answer these questions it should become clear on how you could potentially reach out and get in touch with these people.

> How do you avoid potential burnout?

It pays to probably emphasise "as much time as you can". As you can without going insane, as you can while maintaining your mental and physical health. As you can while being able to survive and pay your bills.

It pays to solve a problem that resonates with you personally so that you will still have drive when times get tough.

Something I've been working on is cutting out as much unnecessary stuff as I can, dropping email subscriptions, dropping commitments to things I don't care so much about. You can tell when you're pushing your limits, you just need to keep an eye on it and manage yourself as is appropriate for you.
SHRDLU, sans Etaoin, has been discussed on HN too:

2017 https://news.ycombinator.com/item?id=14351485

2014 https://news.ycombinator.com/item?id=8219409

... though maybe not as much as one might have expected.
do you have any info on the Delaware vs your home state debate?
Seconded - which make and model please, so I can never buy one?
,, ending our carbon offsets program''

This is the real news hidden in the press release, and it's actually quite sad :(
It's certainly an interesting mix of being extremely rude and judgmental while simultaneously also being very empathetic, culturally relativistic, and self-deprecatingly humble.

It's a fascinating mix. It operates at several levels of brutal honestly and self-reflection.
Corona Warn App Lookalike Domains
Not GP, but some typical gripes about json are that it does not allow comments or trailing commas. TFA is about adding loops to config files to generate big redundant configs, which may not be something you want.
New Racism Museum Reveals the Ugly Truth Behind Aunt Jemima
It's really funny that on native there are all sorts of well-established models for communication between applications, sharing of files, etc. There are per-file and per-folder permissions systems, there's per-user permissions, and programs can be run with differing levels of access. If an app running in an App Store style sandbox (available on both OS X and Windows) wants to get its paws on my Outlook inbox files, it has some hard work ahead of it, and that's pretty nice. Even outside of a sandbox, the tools available to a regular (non-administrator) process are relatively restricted which helps limit the mischief they can easily get up to.

And then on the web, you just load pages. Pages are pages, except ones that come over https get Special Privileges because the Chrome team decided that was the best way to decide whether user content could be trusted. And pages that load from the local filesystem are less trusted, because it's only safe if it's coming through a socket. Any content hosted on a given domain is just as trustworthy as other content on that domain, and most importantly - very importantly - if the end user installs an extension, it's very essential that the extension be able to easily exfiltrate every single byte of your gmail inbox. After all, pages are pages - why should gmail or my bank be special compared to any other website?

Nobody put any real thought into how to structure the permissions model to combat real security threats. WebExtensions (the de-facto Worse is Better standard) basically dumps a bunch of different features into the 'do anything' permission bucket and leaves it up to the user to decide whether to trust an extension, despite the fact that an extension's ownership can change at any time. If an extension starts out without requesting any permissions, requesting a new permission (to do something useful) will silently disable your extension for all your customers - so naturally, what people do is request every single permission from the beginning, and users click Install anyway.

It's positively grotesque that the warning for this is still "read and change all your data on the websites you visit", and that so many trivial things require it. Chrome still makes no effort to draw your attention to how very, very dangerous this permission is. Say what you will about the UAC trainwreck but at least the SmartScreen 'this software is suspect' popups are suitably scary Red or Yellow and large, legible text.
You Need Brand Style Guide ASAP (+5 Examples of Brand Guides)
100% of your clients are fine with ignoring current laws?

Sounds dystopian
Graphics is pretty mature, and also relatively niche in its applications (hence little jobs and lacking salaries for the most part). But I agree, it's very cool.
Sorry, I wasn't clear, I meant making _any_ outbound connections from the extension.
If it can read or simply drop (such as for blockers) requests it should be fine, and make it harder to leak data.
It is almost a 'stopping problem'. You can send any data by sending GET with data encoded in url path, without any query string. How is any sandbox supposed to detect if you are sending data or really just getting information (like updating adblock list).
I use a 32" 1440p monitor and while I would have liked to get a 4k one instead, even with getting tax back by declaring it as a business expense (since I use it primarily for work), 4k still would have been more than I was willing to spend on it right now. I don't want to use a smaller monitor (might even like one size larger) and tend to use large fonts anyway since my eyesight isn't super great, so 1440p seemed like a much better fit for me, given the price of a good 4k one. Maybe in a year or two I can upgrade.
Top App Designs of the Week #5
I know a little bit about that saga, but who are you accusing the Israeli government of blackmailing?
It seems pretty reasonable.
https://en.wikipedia.org/wiki/Download_Valley
At least they won't be able to install drivers[0]

0: https://xkcd.com/1200/
> we'll just get our stooges on social media to claim they're being paranoid

Accusing people of being shills is a violation of the HN guidelines, please don't.

> You do know the history of the name doubleclick, right?

I honestly have no clue what you're implying here.

> Now want to explain why a browser experiment or analytics domain whitelist includes an advertising surveillance domain?

So that it can pass analytics information to requests including to the advertising domain. Occam's razor and all.
> 3. Configuring my preferred linux environment to work with 4k is either impossible or just super time consuming. I use i3 and it adds way more productivity to my workflow than "My fonts are almost imperceptively sharper" ever could

Happy i3 arch linux 4k monitor user here for over 2 years. I only set an appropriate Xft.dpi for my monitor size/resolution in ~/.Xresources once and that was it.

Can't imagine being easier than this tbh.
> But why is this necessary, unless you basically hate a person and don't think you could ever reconcile? It's a psychology of tribalism.

Because you respect a person, but want to be honest about your opinion of their work?
IMDB has it as 1980. Why do you say 1978? If you're right, we must change it!

https://www.imdb.com/title/tt2238777/
I totally agree. I am not saying we shouldn't plug the wells. I am saying it's not necessarily easier than stopping CO2 production.
Xorg already provides a full suite of security protocols that allow fine grained control over every aspect of any application down to the single pixmap via access control hooks.

The fact that nobody really uses them should tell you that the sandboxing craze and whitelisting is mostly if not completely security theater and hostile to the general workflow typical for Desktop applications.

Wayland addresses none of those problems. Wayland is merely just a protocol that can be used to blit some bitmaps together. The protocol says nothing about security except that those problems should be dealt with other protocols which are not part of Wayland.
Companies pause facial recognition contracts with law enforcement
I solved this problem (to my personal satisfaction) by adapting sqlalchemy for this. Sqlalchemy was not designed for complex data warehouse ELT for sure, but all it took was abstract out a few "quirks" of sqlalchemy and I was able to get a framework that's as expressive as spark, and hence extremely modularizable (not to mention testable), and compiles to regular SQL very easily.
Even Spanish keyboards only have a dedicated Ñ key, so you have to use multi-key sequences to input ÁÉÍÓÚÜ etc.

And even after typing in Spanish for five years, it's still objectively more annoying to write está (6 keypresses) vs esta (4 keypresses). And I'm always having to go back and correct the key sequence because I've written ´a instead of á.

Also, just today I saw someone use "⇸" (crossed out arrow) on HN and it was so tiny with HN's font that I had to zoom in to see what it was which only inhibited their message.

You have to consider this sort of overhead when making decisions about the glyphs you are going to impose upon everyone when designing a language.

I've seen pages and pages of bike-shedding over whether to use kebab-case over snake_case for a DSL because it's one less keypress to type a hyphen vs underscore.

I can appreciate your preference for those characters. It's nice how they can encode meaning in a single glyph where you would otherwise need multiple glyphs (like "!="). One solution that you can find people doing today are IDE plugins that simply rerender something like "->" as "→".

Seems like the best of all worlds. You get to work with higher level characters while the plaintext format remains in the most accessible common denominator.