skysight-inc/HackerNews huggingface dataset:
Greetings fellow Hackers! OP here. I see that my experiment got some traction which means more awareness should be spread about this class of bugs.

For starters I recommend reading "How Bad Can It Git" [1] and "Detecting and Mitigating Secret-Key Leaks inSource Code Repositories" [2] papers.

After that you can read "How I made $10K in bug bounties from GitHub secret leaks" [3] and some notable reports on HackerOne Hacktivity [4] [5] and [6]. This last one is interesting - leaking secrets is not only about code repository! Actually it's about entire toolset used for software development, hence secret scanning could (should?) be performed for other places such as CICD logs or even Slack messages [7].

Anyhow, back to code repositories. GitHub and GitLab both recognized secrets as a problem, so they came up with solutions. If you use GitHub you can easily integrate GitGuardian [8] into your workflow ($$$) but even if you don't GitHub provides you with Secret Scanning feature [9] (both are mentioned within the Twitter and HN threads). If you use GitLab you have a Secret Detection feature [10] at your disposal BUT in order to use it you need to setup Auto DevOps (that's why in my experiment GitLab didn't alert me - I just pushed commits to my public repo but didn't setup anything).

Apart from built-in solutions provided by GitHub and GitLab, one can use tooling of their own choice. For this I'd recommend two types of solutions: proactive and reactive. For proactive security, as mentioned in the Twitter thread, you can use Talisman [11] as pre-commit hook. For reactive security you can use GitLeaks [12] (used by GitLab) or similar tools - there are many of them but one stands out, namely truffleHog [13] which can sniff each and every commit across all branches (also used by GitLab).

What if you already commited a secret into the public repository? Start with revoking and continue with this tutorial [14]

gl, hf.

[1] https://www.ndss-symposium.org/ndss-paper/how-bad-can-it-git...
[2] https://people.eecs.berkeley.edu/~rohanpadhye/files/key_leak...
[3] https://tillsongalloway.com/finding-sensitive-information-on...
[4] https://hackerone.com/reports/716292
[5] https://hackerone.com/reports/396467
[6] https://hackerone.com/reports/496937
[7] https://github.com/PaperMtn/slack-watchman
[8] https://www.gitguardian.com/
[9] https://developer.github.com/partnerships/secret-scanning/
[10] https://docs.gitlab.com/ee/user/application_security/sast/#s...
[11] https://github.com/thoughtworks/talisman
[12] https://github.com/zricethezav/gitleaks
[13] https://github.com/dxa4481/truffleHog
[14] https://docs.github.com/en/free-pro-team@latest/github/authe...
Trivium by Leah Neukirchen
sleeping pills are going to be our next pandemic. these drugs need to be reclassified as “fucking dangerous”

here is just a list of shit to be prepared for when you take them for more than a few short weeks:

https://youtu.be/IKNzL-eU650

please be VERY careful. ive been on then for years and it is a nasty and very long detox process.
Confirmed. I worked in immunology and people were attempting to model gene expressions and how genes influence each other's expression to finally determine T-cell plasticity.

New cell types or pathways to become cell types are observed more often than you would think and it feels like we are still at the very foundation of understanding <insert field of biology>. It's scary how much we don't know while publically acting as if we figured out 99.98% of biology.

Explaining allergies and their origin is a good example here. It's just people throwing guesses around.
understood. and what about the cudf/cupy libraries ? is jax better ?
> I own several Raspberry Pi computers (1, 2 and 3)... All of them sit in a box, unused. I’ve played with them, then put them away. Part of that is because the performance hasn’t been that great, but the form factor is a major factor. It feels like the Raspberry Pi 400 has the power I need (for casual projects), and comes in a form factor that I can happily leave plugged in on my desk.

Amazing how the addition of a keyboard changes things, with the keyboard being a great box. The snazzy design is definitely a further add that lures me in to wanting one. I too have Pi's in boxes, unused.

What I would like is a backlit keyboard version. I am already spending £100 on keyboards so this is achievable. I would program mine so that the keyboard appeared over bluetooth to my main computer from where I would ssh into my Pi to do things like run a web server. For a long time I have wanted to do local development of web projects on a separate box so there is a clear break between client and server but everything is local.
That’s not always so easy to find, it’s often in a small font in a hardly visible color at the bottom of the email. Having a button that’s always on the same position is more useful.
Regardless of the veracity of anyone's claims in this thread, this could be a textbook example on how to run a viral sales scheme via social media. Seems quite polished by the looks of it.
I wrote a book about sales objections
I searched for this on Google and found nothing comprehensive. So I decided to write about it. I've found 45 different sales objections and customer rejections.
Arch Conf 2020
You don’t think comparing the breaking of some glass by BLM protesters to the Kristallnacht is stupid?

Dangerous I added because he has a following and I think if somebody believes him that Kristallnacht is happening right now, they might do sth. stupid.

I’m all for free speech, yet if you say stupid stuff, you can get called out for. I can call something stupid and dangerous and I don’t want to censor anything of it.

Listen to the 2 podcasts about Eric. I find them quite well sourced. If there’s anything wrong about their assertions (meaning the “I don’t talk German” podcasters) I think they are happy to hear from you.

Me too, btw. I’m open to discussion and would not want to hinder free speech.

Comparing BLM to the Nazis is pretty stupid, imho. Yet maybe I’m wrong ;)
Cool! Thanks for explanation.
I remember having so much fun playing micromachines with, was it 8 people?, back in the day on the playstation one. We had an L-shaped extension, and we had to share a controller, using just left, right and brake. It was mayhem, and I think the reason I still have my google maps navigation with north always up!

Also, I happen to live in Birmingham and commute to Coventry. In the Birmingham museum and art gallery I was surprised to find an Amiga 500 used by the LSD demoscene group on display.
Same here, I don't expect to find videos attached to papers, so would never think to look.

It's absolutely incredible! You can read as much in the paper of course, but seeing it with your own eyes is somehow very different.
Yes, I use GNOME. Usually, I'd go to fullscreen mode to make a screenshot, But this time it was kind of important to show image dimensions and overall amount of layers.
For PKIX (and thus in your web browser) leaf certificates the X.509 Common Name is only permitted to be textually equivalent to one of the SANs (Subject Alternative Names, the Internet's way to write a name for a machine) in the certificate. So that's either a dnsName or an ipAddress. This is grandfathered in because it's how Netscape worked last century before PKIX was standardised and thus before SANs existed to do this properly.

So it would be prohibited to issue leaf certificates with a CN that's a human meaningful name like "Google" or "Hacker News" because that violates PKIX.

It doesn't matter anyway, the only enforcement that really matters for HTTPS is the mechanical enforcement by the user agent, because there are way too many HTTPS transactions for the human to realistically assess the certificate shown for each transaction and decide if it's OK.
The on-board sound quality on the raspberry pi line has traditionally been quite poor so you probably want a dedicated sound dongle anyway especially if you are using headphones. This is an article about the model b+. It's an older version than the 4 but explains the problem just as well since the 4 still uses PWM instead of a DAC.

http://www.crazy-audio.com/2014/07/sound-quality-of-the-rasp...
I can’t imagine any way a reverse proxy would generate a 404 or indeed any 4xx error within itself.

What if the configuration changes and the API path/URL is no longer in the reverse proxy config? What if the reverse proxy is dynamically configured and our application didn't register itself properly?

They _do_ understand http status codes and can act accordingly, like retrying requests, not caching responses, etc as appropriate.

Of course applications should return HTTP codes when appropriate e.g 500. The principle is that using HTTP codes for application specific information e.g item not found in DB, is a blunt instrument.

They have no way to unpack and interpret every developers pet error format.

I would argue that they don't need to. The conversation is between client and API at higher level than HTTP. HTTP codes are great for information such as "its broken", "please authenticate", "its busy". But HTTP codes are not so useful for things such as "item not in db", "parameter x is missing", "unsupported API version" because this information is nothing to do with HTTP.
You can't make 'deals' with mathematics. As you can't make 'deals' with physics.
Both! I find Vue easier because it feels more like the old days of jQuery and AngularJS (HTML templates etc).
California: Whites in state 'below the replacement' level (2010)
Quetiapine is labaled an anti-psychotic yes, but its pharmacological characteristics are not that straight forward. It has a much higher affinity for H1 (histamine) receptors than for D2 (dopamine) receptors. Meaning that in low doses it acts like an anti-histaminergic drug, having a very limited effect on dopaminergic systems. Around 60% of D2-receptors need to be blocked for a typical anti-psychotic effect, and that is nowhere near what is happening with say 50mg of quetiapine, which is a normal dose for sleeping aid. In those low doses it mainly acts on H1, alpha-1, M3, M1, and some 5HT type receptors. At a minimum of 300mg per day, it pharmacologically starts to act as an anti psychotic.

There is a nice brief summary of this in Stahl's Essential Psychopharmacology.

To be clear, I am very much against prescribing anti-psychotics as sleeping aids. But I don't think there is a strong case for calling quetiapine anti-psychotic in low doses.
Hey, OP here. I agree that a blog post would be more readable. In this particular case I just didn't expect that it will catch fire. If I would then I would spend more time on the form. I won't make that mistake again (i.e. in the future I will use a blog post as main driver of such twitter thread).
> Tbh they also should ditch the NIH attitude.

Tbh, we always ask people for justification of their UI/UX proposals. We don't say 'no, because Photoshop'. If we say 'no', it's because we think it doesn't make sense for GIMP or breaks existing consistency.
One of the sketchiest places in downtown Houston is the greyhound station. There is a 2-3 block radius in downtown that I won’t walk through anchored by that greyhound station.
If you can recompile but the code was written to only target AVX-512 you can use https://github.com/simd-everywhere/simde to near effortlessly map the intrinsics to AVX2 (or lower).
I tried installing GhostBSD on my laptop (Dell Precision M6800) and I couldn't get it to install, even with the GUI installer. I tried a couple times and then just gave up and installed Ubuntu
> That solution changes the incentive to them just performing slightly better than doing nothing, instead of the best they could.

Does it? You don't simply gauge whether someone is performing better than the baseline, but how much better. This allows you to select the best performer.
The sentence is a bit awkward but I think it is phrased that way to suggest that Apple’s sensor is different from other things called lidar which tend to involve scanning with a rotating mirror.
I talk about the CP/CMS Operating-system, CP-370 later VM/370 "virtualized or containerized" just the OS and not Hardware (for accounting and Security reasons):

https://en.wikipedia.org/wiki/CP/CMS#Overview

that's exactly what jails/zones do (System, NOT Hardware virtualization)
QuickBasic on DOS was quite a comfy procedural language (including functions). It was Microsoft's successor to their old MS BASIC, variations of which were used by most 8 bitters (at least US-made ones).
I grew up in Durham, NC, near Cary.

The Raleigh/Durham area is very car-centric, and Epic is right next to the interstate highway. It's intended that you'll arrive by car, probably via the highway -- which is relatively easy whether you live in Cary, in downtown Raleigh, or somewhere else.

In my twenties, I remember attending a swing dance workshop in Durham. It was very well attended; the instructors had recently moved from San Francisco and had been pioneers in the swing dance community there.

At the time I didn't understand how one could be riding high in San Francisco and want to leave. But people who relocate to Raleigh/Durham often say that they move for the nice weather, for the low cost of living, for the fact that it offers a lot of culture while being fairly laid back.
Don't worry, post wherever you want. Content existing somewhere is better than someone thinking it may take too much effort and not writing it in the first place. People may have their preferences about publishing platform, but telling someone off for not following that preference is not fair.

Thanks for writing about your experiment.
If there's anything Biden will do, is to enable the cause further.
>strictly worse

I'm pretty sure double the core count at 90% of the speed will get you better performance in _a lot_ of scenarios.
A much needed interface in stdlib is logging.
Hardware in linux tends to just work
there is the icelandic althing which has been around since 930. but as per your point, no matter what, growth and change is necessary for the survival of an institution - especially one determined to last.
I’m from Leamington, loads of people here work for Codemasters.
You’re sure that Google’s vast completely automated system for determining which senders should be blacklisted has zero false positives?
> Go is more likely to get the job done, Rust is more likely to do the job well

That's surprisingly close to what one of my contributors wrote in the piece:

> My take: Go for the code that has to ship tomorrow, Rust for the code that has to keep running untouched for the next five years.
I mean in a web browser, not Node.
Restricting eating is just very hard. It’s very hard to not eat when you’re hungry.

I would say, be physically active and have a diet filled with foods that have high fiber, high protein and have a low calorie density.

I have a very active lifestyle and used to count my calories everyday and had to restrict the amount I ate. Since a few years ago I’ve been switching my foods to high fiber or low fat versions and increasing the amount of vegetables in my meals. It’s honestly been such a positive change. I end up full every meal, don’t snack, I don’t have to cut anything out of my diet and I don’t remember the last time I had to count my calories.
> This might come off as a dick reply

Was a bit of a dick reply. You instead might have done a cursory google search, and found that there were not written but pictorial records, which I think is more interesting to the discussion than shutting down someone's comment.

https://en.wikipedia.org/wiki/Aztec_codices
Were they really? https://en.wikipedia.org/wiki/Aztec_writing & https://en.wikipedia.org/wiki/Aztec_codices

Maybe the masses, but not their priesthood, elites, or such.
Similar to ancient egypt, I think. You don't say they were illiterate just because they used cuneiform, or do you?
What were the symptoms?
Flagged for the flamebait title. The linked page itself lists changes going beyond branding.
In 2019. Also the GIMP faq explicitly tells you to fork the project if you don't like the name.

https://www.gimp.org/docs/userfaq.html#i-dont-like-the-name-...
By sustaining single core speedups, I meant big speedups, like we were observing bin the days before mainstream CPUs resorted to multiore. It was rather more than 10%.

And we'd still have be able to make processors with lots of slow threads of course for applications where that's cost or power effective, that's comparatively very easy.
Another one. Say you want a jet that can fly much rather than the previous one from a few decades ago.

So you start to design a new jet. But the executive has no time for that. So he says to just slap some bigger engines on the old one and add some software to compensate for how much it wants to stall.
The ability to edit did make it through to Netscape on UNIX, we had this on SGI machines.

This was all great in principle, you could just publish your local documents. However, DNS and IT departments meant that I was not able to do this and browse my machine from outside the room. This was something I was not bothered enough to resolve, had I done so then I could have been a web pioneer.

Making web pages straight from the browser was lost as an ambition early on.

Also lost were many of the great features of the X-Window system. Just using X-Windows to run a remote display from one machine to another was great as a student for putting 'xeyes' up on someone else's screen but we ended up with other stuff that lacks the design genius of the original.

Also cool was the hover for focus aspect of X-Window, this was useful in the days of lower resolution screens and before the tabbed interface for the browser came along.

Nowadays X-Window screen shots look cool but not as cool as they were at the time, the interface and the typography worked better with analog signal CRT displays than it does with digital flat screens.
That is fine, if he manages to make it more successful, it might be that he is doing something right, we should appreciate that and copy him, and never be jealous.
Stored Procedures Instrumentation in MariaDB 10.5
Reminds me of the discussion about the big tech companies filtering content...

"Last October, Facebook, Google and Twitter were asked by Hawaii Senator Mazie Hizono to draw up a “mission statement” to “prevent the foment of discord.”"

https://www.rollingstone.com/politics/politics-features/face...
What was so bad about the scene? The food, way of eating, the tiles, couches and way of dressing is all pretty authentic. I just don't see the fez hats much outside of such tourist-oriented restaurants, or certain occasions or functions.
JAX does JIT compilation which is not done by Cupy so you get better performance by fusing operations and compiling them cleverly ([0] is a good benchmark to get a feeling for the performance of the various options).

However, it is a trade-off, the jitting time will increase your run time (you can expect at least 10 seconds of compiling time) and JAX does not let you do in-place operations (however, it has workarounds).

If you can afford the time needed to jit your code then I highly recommend JAX.

[0]: https://github.com/dionhaefner/pyhpc-benchmarks
But nobody would pay for it if there was zero or not enough to convert trial users content, so they needed lots of it to engage and keep users.
> I think heirarchy is a natural human inclination. It's observed in every part of the animal kingdom.

I have two main objections to this line of thinking:

1. Even if a tendency or behavior can occur in "nature", that doesn't necessarily make it correct. By that measure murder, infanticide, rape etc. should also be considered acceptable since they occur in nature (both with humans and animals).

2. If you take a look at smth like The World Until Yesterday or other similar work it will become apparent that the kind of large scale hierarchies of power present in the modern world are relatively recent constructions. To me they're more a hallmark of contingency and deliberate human choices, not of "nature". If we want to make a less hierarchical society we can, it's in our power to change the design of society (to a significant extent at least).
I agree. Biden is old-school, firmly entrenched in the military-intelligence industrial complex.

He's fully on board with backdoors. I guarantee it.
I can’t give a logical explanation, but after 3 years, “print(x)” in the repl is still a cognitive dissonance whereas “print x” is natural.

(Doesn’t bother me in the editor, only in the repl)
Then don't read the thread (it's always the same conversation anyway) but it's a fact that Gimp (like another prominent software in its own domain) is often presented as a Photoshop replacement and personally I can't switch to GIMP because I rely a lot on non-destructive filters.
A paper printer with no ink
Hierarchies are natural to everything, it's pointless to fight just them. I'm specifically against subordinate relations like master-slave. In a typical firm there is a boss that commands managers, workers etc. The boss has the most power. But he is still accountable to an agreement between him and workers. He can't do "whatever he wants".

In a very centralized government systems you can't make top management accountable. Moreover, in such systems top management actually support master-slave relations between people, like between men-women, rich-poor, etc. It's then easier to hold power.
That's just saying "Never attribute malice if it's outsourced"
Intel is absolutely devastated by AMD
Transit of ISS across the Sun and the Moon (photos)
Thanks for NOT taking the time to explain to me how I'm wrong. I just am wrong, right? So says the voice of science! (I couldn't have asked for a better example of how science pays lip service to the scientific method only!)

I link to wiki, not because I think it is authoritative, far from it. Like the NYT, CNN, Guardian or BBC which deliver us our daily propaganda messages, wikipedia delivers us the historical narrative we are meant to accept. When they themselves say 70% science studies are unreproducible (ie lies) you know that we're in a world of BS!

Science is busted, but I find that individuals are able to relay the truth more fairly and accurately.
But only if you print exactly 15 pages each month
> Nor are we necessarily talking about the customized encryption used by large business enterprises to protect their operations. We are talking about consumer products and services such as messaging, smart phones, email, and voice and data applications.

Do "large business enterprises" use exclusively "customized encryption", or do they use the same encryption "consumer products" use? In my experience, it's the later. The biggest example is TLS: for instance, every business which uses Microsoft Office 365 relies on the same TLS used by "consumer products". The same applies to full disk encryption (BitLocker and/or LUKS), smart phones (large business do use smart phones, and they are the same smart phones everyone else uses), email, and so on.

As a personal example, the software we develop at work is used by "large business enterprises". When we added encryption to it, we didn't use "customized encryption"; we used standard TLS.
Popular SaaS VPS Hosting Companies with Multiple Data Centers
Thanks for sharing. To save people a click the author of the tweet is opposed to adding a type system to Elixir not the BEAM, he seems to be seeing project like Gleam in a positive light.
Show HN: Connect your on-premises databases to Kubernetes in the cloud
What does this offer over the several free tools available?
How many milliseconds this processor needs to compile the entire Debian distro? :D
I have one simple secret: start 15 years ago