skysight-inc/HackerNews huggingface dataset:
> I wonder why there is such a focus on this `curl|bash` pattern.

Because it's easy to understand, it's a cheap way to look smart on the Internet by bashing people. Also on a lot of servers people might only run ditro packaged packages. More eyes has gone though them so ops people would bash someone for curl | bash on their servers while it's perfectly "acceptable" on client machines.
Ha, initially misread your question as its opposite (~"would reading technical/non-work related books in my spare time be a waste of time") and immediately thought no, of course not! To me, doing non-work related things outside of working is what makes _both_ activities things fun.

Don't be hard on yourself for not spending every waking minute of your life working, preparing for work, or feeling bad because you "should" be doing one of those two. That's a very quick way get burned out.

YMMV, but in my experience, even if you want to optimize your life for doing the best work possible, not working all the time is a winning strategy!
Wealth Taxes are just as bad if not worse than Wage/Income Taxes.

They have a massive destabilizing effect on the economy, especially if that wealth is tied up into stock of a company

Take for example the "great evil" of today Amazon and Jeff Bezos. If Bezo's was forced to liquidate say 2% of his ownership in Amazon to satisfy his wealth tax that would send the stock into a free fall wiping out many many times more than that in value. So not only does that make it hard to actually calculate the tax bill, over time that kill most investments, 401K's pensions, etc

Taxes on subjective wealth (i.e totaling all assets up based on "current market value") is a TERRIBLE system, and very unethical far more unethical than income based taxation
The currently prevailing real world practice is how none of that applies to information voluntarily given to third parties, like Google, ISP, banks, phone providers, mail providers and whatnot [0].

[0] https://en.wikipedia.org/wiki/Third-party_doctrine
Hah, good catch! I'll definitely treat that as a bug.
not "terminal" but IMHO the best monitor that at the past I used for development was the monochrome (b/w) one for Atari ST.
qrencode[1] has been doing this for a long time in the terminal. It even supports half-block UTF-8 character (two bits per character, which makes them more square).

[1]: https://fukuchi.org/works/qrencode/
30k yo distant relative of giant icosahedral DNA viruses
qrencode (https://fukuchi.org/works/qrencode/) already does. It even does half-height squares (2 bits per character).
A cost measure that isn't talked about is effort in collaboration. My partner works in the social sciences and when they write a paper, they send each other word documents with annotations and everybody works on it for a few days.

While our computer science group writes papers much more in parallel as everybody works in a section and we synchronize our progress via a git repository.

I believe Microsoft's Sharepoint could do the same thing, but none of us has Windows and the university does not have a sharepoint license.
> Public key crypto does not solve establishing trust for an actor. It can only do so through delegation which as we have seen with the deprecation of EV certificates (CAs no longer being trusted to establish the identity of legal persons) is not something that is easy to get right.

Public crypto can help carry the established trust. Say you track some developer's work and the dev behaves consistently in a trustworthy manner, his signing key can be used to help carry this trust forward, so that after a while you don't need to keep checking and just rely on the assumption that dev is probably honest going forward + crypto to verify you're really using this developer's output.

No need for delegation. Delegation doesn't solve trust anyway, only identity verification.
Anyone know anything like this but for Safari?
My Inspiring YouTube Journey
I used to criticize those who use dark modes, but then after trying it I think I cannot go back again. At the end of the day, it's like when we were using monochrome screens back in the 80's/90's. I don't think anyone at that time used a screen filled with green phosphor color in the background with black characters on top. It was green/amber chars over black background.

I think that the difference in comfort when reading is that in the case of a book the light is reflected, instead of emitted, like in a monitor.

Recently I had a series of very intensive sessions with Ghidra, and jumping through hex code for hours was really hurtful, until I learn Ghidra has a dark mode (an ugly one, just colors inverted).
We know what happens, the question is why is it allowed?
Nigerian Christians Still Suffering from Violence by Islamic Extremists
Creating an HTTP Load Balancer in Python
> I don't think that's really true. My understanding from talking to people there is that Java funding was increased for so many years despite losing money because Larry Ellison just thought it was cool tech and they use it a lot. Likewise, GraalVM is so well funded largely because it's cool and Oracle doesn't have many cool R&D projects. It's not clear it's all that commercially driven when you observe that so much of it is open source.

I just hope that it's true. We really need that.
Yes, but by the point your downstream project has changes that you want to merge back, it is the upstream for purposes of GPL sentiment. These roles are transactional, not historic.

Otherwise, any company could break the GPL wide open by just morally considering themselves to be the upstream.
curl|bash allow personalized attacks... If for example you have an IP address from a certain company. (if you have access to ad targeting data you can refine a lot further - just remember web site visits from an IP and match them to IP from curl command)

repos are mirrored, come with signing keys and any successful attacks are detected sooner or later and become public knowledge.
> You claim you know of a guaranteed way to make money, you only need some starting money. If you are so sure, and your idea is so good, you should be able to convince somebody to lend you the money to do it.

I didn't say I know of a guaranteed way to make money. I was saying that domain squatting isn't novel or difficult or some kind of genius idea. The primary driver of success in the domainer market is having a big pool of capital and the rest is easy enough that if someone has the capital for it they're not going to cut someone else in. They might hire a domainer as an employee, but they're not going to be looking for partners.

> It always shocks me how ready poor people are with their excuses.

The person that wrote this article is holding ~200 .ai domains at a cost of ~$70/year at Namecheap. That's $14k per year. The federal minimum wage in the USA is ~$15k per year ($7.25/hour).

Why don't you lay out a financial plan for me where a person making $15k per year can hold a $14k per year .ai portfolio?
I Trusted Investor Paula
I'm super excited now, I can now pay my bills and take good care of my family. Thank you for bringing happiness to my home. With just an investment of $900 i got $8500 in just 5days. I am debt FREE !!! Contact Investor Paula on WhatsApp +15672585160
Further in that thread https://news.ycombinator.com/item?id=3605851
A very small minority within the minority, I would add. Even in HN, it's a contrarian view.
It's funny you mention Lady Ga Ga, there was an uproar around her back in 2007, that she only gets 170$ out of a million plays. I'm not sure how many millions are there in your "100 bazillion" listens, but it could be she is also not earning a significant percentage of her income through Spotify

https://www.independent.co.uk/arts-entertainment/music/news/...
There's a far easier alternative kingpins are using as we speak: they compartmentalize the criminal organization with the lowest in the hierarchy taking the highest risk. No DNA of kingpin in crime scene as they had their humble servant do the dirty work.
> Why are so many people upset by this?

I can't even imagine why my response sounded "upset".

> someone who isn’t being thrifty and researching every little thing out with spreadsheets.

No, I don't think spreadsheets are required. I probably wouldn't spend $600 on something that doesn't seem like it usually costs that much without reading a couple of reputable reviews first, or maybe checking to see if the features I want exist in a popular cheaper brand. OP isn't doing this because OP isn't buying the headphones to fulfill any need, but because they "trust apple". It's bizarre and hard to understand for anybody who isn't used to thinking of $600 as pocket change, I guess.

> I’ll probably get these for the same reason as the parent; I vaguely want some air pods but I haven’t got around to it and I prefer this form factor.

This was the part that confused me. OP has AirPods and AirPods pro and claims that he loves both. The part I don't get is blindly dropping $600 to buy something that doesn't even solve a problem for you. Apple puts it out, OP buys because it's an apple product.

> I trust apple not to sell useless knockoff rubbish in a shiny box. My relationship with them is no more complex than that.

This is the part that DOES upset me.

You think Apple never made useless rubbish? As we speak I'm typing this on a piece of shit 2019 MB Pro issued by my job. It sucks. Bad design (no ports, no magsafe, no escape key).
One should also note that, even if you use ODoH, eSNI and even Tor (or any VPN service), your ISP could still reliably fingerprint your web access activity at the source using deep learning with over 96% accuracy as shown in this study (https://distrinet.cs.kuleuven.be/software/tor-wf-dl/).

So while ODoH is a good thing (and also recommended in this study which has shown the weaknesses of DoH/DoT https://www.esat.kuleuven.be/cosic/publications/article-3153...) and is very similar to DNS over Tor with a DNS hidden service resolver (which Cloudflare also provides). It won't prevent a skilled and motivated adversary from determining your activity and possibly apply censorship.

I would guess that a solution to mitigate these would be to use an hybrid solution of VPN over Tor (or Tor over VPN) while also using DNS over Tor or ODoH and eSNI.
If evidence in China, a market which is more digitally integrated than the US, is anything to go, rebound shopping will make a huge dent on e-commerce.
i'm actually using an ad-hoc 'lie-down' workstation,
only way to work for 7+ hours for me:
its essentially a monitor at an angle mounted above my bed,
cost nearly nothing to setup, looking way better than those exotic
chairs. it roughly looks like this https://twavllmount.files.wordpress.com/2014/06/9d555fd2-34a...
Definitely not a solved problem. My bose qc35 II headphones constantly drop connection or connects to my ipad instead of my laptop. The sound quality is trash but I'm ok with that as I got them for active noise cancellation. ANC works great I must admit.
That's nice. I was in the same line of work. Started from building our own XML parser, when there were none available yet. Later I developed this fun XSLT that generated a fullblown Forms UI based on an XML and/or XML Schema which we used in a custom CMS. Then with XSL-FO and Quark XPress we generated user manuals and product catalogues from that. The XSLT was surprisingly fast for the time, and given the transformations it needed to do.
> It is therefore a bit offensive that the conclusion you draw is that developers who use PHP must have a deficit in their ability to work through problems.

That is distinctly and meaningfully different from what I said.

I did not say PHP developers have a deficit. I'm saying the PHP community has certain values and approaches problems with a certain perspective.

I see PHP developers as those whose perspective does not highly value the interaction between how a tool is shaped and its users ability to use the tool to think through problems. A programmer with this perspective might say that a tool's usability in a context is wholly unrelated to the quality of the tool itself or the community of other practitioners who choose to use it.
I'm super excited now, I can now pay my bills and take good care of my family. Thank you for bringing happiness to my home. With just an investment of $900 i got $8500 in just 5days. I am debt FREE !!! Contact Investor Paula on WhatsApp +15672585160
Product price history on Amazon together with other sites
The Dark mode sucks and gives a big eye strain. I prefer to use the light one and let better dark-mode alternatives for my editor.
Unfortunately no .. and my searches haven't been productive. I was referred to this talk by my professor who attended the conference and I got to see only the slide deck as well. .. but the slide deck is very good and easy to follow.
Does that not assume equal probability of finding bugs? Seems to me that both teams would find the same easily identified bugs (say '=' instead of '==' or revealed by compiler warnings).
Please allow your web clipper to work with Firefox containers soon.

As it stands, without the login cookie stored in the session, one can't add anything to Notion with the clipper. One has to switch to a different browser if they want to clip.

This would be solved with an access token of sorts. Make it refreshable if you want to clear it periodically.
Don't let your job run your life. You're more than an employee, even if development is your passion.

And if you read the same books as everyone else, you'll have the same ideas as everyone else :-) Read about other industries - do they have stuff you can re-use? Read some of the great books and learn about history and human nature.

Develop a "hinterland" - https://en.wikipedia.org/wiki/Hinterland
Orthogonally, I hate the fact that non-fake reviews generate value for the walled-garden that is Amazon. Reviews should be in a neutral platform that can be integrated in various stores and info is interchangeable... But that doesn't solve the fake reviews problem.
Download Yo WhatsApp
Download yo whatsapp
Use startpage.com [0] for your Google searches, DDG even has the !sp bang for that. Be very cautiousness about whom you share your mobile number for what, it's used to cross-reference account ownership across services.

Many services use them for 2-step, but very likely also share them past that, that's also how the numbers end up with spammers/scammers.

VPN I'm a bit lukewarm on, heavily depends on the VPN because in the worst case you will funnel all your traffic trough one party giving them very convenient access. Least of all look for a VPN that offers anonymous payment options, afaik there are even some that accept cash-drops or money sent in.

[0] https://en.wikipedia.org/wiki/Startpage.com#Startpage
Only if a significant number of the population test positive.

In November in England, 354 a day died with a positive test within 28 days. 1635 a day died anyway, meaning 1281 died without a positive test.

If 1% of the population were positive, that would mean 16 people would a day "die with covid".

To get 354 "with covid" deaths would require 20% of the country to test positive.

Mass lateral flow testing in Liverpool last month (Liverpool being hit far worse than most of the country) showed 0.6% of the population with covid. Reports were they were pretty bad flows, missing about half the actual cases, so lets say 1% actually had it.

That would mean that of 1635 people a day dying, 16 would "die with covid".
> Maybe browsers should artifically delay the rendering of pages in the quirks-mode to create incentive for website creators to use proper formats/techniques.

Interesting idea, but Google has a dominant position in both the browser space and the search-engine space. They can punish such pages in the Google search rankings, and this avoids the obvious retort of Why are you deliberately making my browser worse?
Blue Light: Are the Rumours True?
Oh man I agree with everything you have written. You should have prefaced with "Trigger warning: I talk about scr#ll b#rs in this comment" because I am 100% triggered :-D

Rant incoming - sorry it's been done to death already but I never weighed in before. I will never understand the desire to mess around with custom scrolling on a "normal" page. If you have one of those weird parallax-scrolling visualisations that news sites are often fond of, fine - I don't like them but I understand it's there to present some photography or graphs or whatever in a novel or fancy way. But so many sites that are just serving an article with some pictures override a browser's scroll behaviour in a way that not only adds nothing, but often breaks things. By that I mean it can either just slow or interfere with scrolling in a way that will annoy technical or observant users ... or it can prevent scrolling altogether for a subset of browser/OS or for touch/non-touch users.
We provide an array of serives to help your business thrive – ZAMARTZ
Co-creator of nannou here, the project is indeed named after this track :)
I'm sorry this may not relate to this post... I'm just so super excited, I can now pay my bills and take good care of my family. Thank you for bringing happiness to my home. With just an investment of $900 i got $8500 in just 5days. I am debt FREE !!! Contact Investor Paula on WhatsApp +15672585160
Since FireEye worked for Equifax before it was breached one could hope they have learned a thing or two, yes.
Flower: A Friendly Federated Learning Framework
Really? And whats with all the proprietary blobs? The Modules (like nvidia), for the end-user it changes absolutely nothing, having bad firmware your wifi will not work, the license is absolutely not important for the end-user. Nearly no one cares that most Androids have stoneage Linux kernels, whats important for them is that the Android-Runtime (aka Play-store) can download and execute "Apps".

>potentially improved kernel

Or potentially worsened kernel, which now sits in you closed down IoT device, again the license is NOT important for the normal end-user.
Does it matter if it's bad form if every terminal noob does it anyway? An attacker using this vector certainly wouldn't care - so long as the attack works.

There's definitely a place for poking fun at Unix noobs - I have learnt better tools than cat because of it - but it is not terribly relevant here.
It seems to be using ImGui. In source/window.cpp, line 269 you should be able to change ImGui::StyleColorsDark(); to ImGui::SyleColorsLight();
Having implemented rudimentary ZUGFeRD support at $dayjob a few years ago (our main product is sending, receiving and validating invoices for energy companies in Germany), I don't see ZUGFeRD becoming relevant anytime soon. At least for b2b invoices, nothing has changed since the release of ZUGFeRD. They prefer sticking to EDI formats (many with some custom edge cases for their SAP monstrosities, e.g. putting the `-` sign for negative numbers _after_ the number like `10-` for `-10`...)
> There's a lot of hostility on HN towards web developers.

You're conflating different types of web developers here.

There's only hostility towards the sub-set of web developers that focus only on what is expedient while sacrificing user-friendliness. The ones that hop on the latest and greatest buzzword technologies in order to pad their resumes.
Risk of getting the vaccine has to be measured against risk of not getting the vaccine, which obviously seems much higher to me. You can’t just talk about risk in a vacuum.
There are headphones in that price range that are much better sounding too, I bet.
What's New in WordPress 5.6
Global Citizen Prize Awards to Be Hosted by John Legend
> I'm sure many of you own some "aspirational" domain names like this, and while I realize it's a much different scale, why is it functionally different than the OP?

It's squatters that have created the situation where people feel the need to hold on to domains they might use because the second you let them drop they'll be snapped up by a squatter if they're even half decent.
Saxon has an open source version that supports XSLT 3.0.

XQuery 3.1 has multiple open source implementations: Saxon, BaseX, xidel, and xqerl.
Not easily, and probably not in a way that would work on all different systems (different distros/os's trust different keys).
You are a monster! ;-)
You first have to develop a sleeping problem, then this works like a charm. Just do the opposite of what they tell you to do for a better sleep, like don't use electronic devices in bed.

Or like, you know, don't, because its stupid.
AlphaFold2 CASP14: “It feels like one’s child has left home.”
I feel like I've played this before back when it was a flash game, is that true or is it just the awesome retro flash feel it has to it? :)

Great though! Now I must waste some time on this.
My Bose QC 35 IIs reliably connect to two devices at the same time. I spark 'em up and hear the voice say "Connected to <phone 1>... and <phone 2>". When I play anything with either phone, I hear it through the headphones. It just works.

(Yes, I save, and use, my old smartphones. I'm an Android developer so they're handy to keep around.)
QR code built as ASCII art and then displayed prettily in Emoji Blocks to ensure proper contrast?
Thanos: Prometheus at Scale
I recently learned that it has a ”Template” feature that lets you write Tcl scripts to interpret the data in the file. It’s very easy to use and very useful too! I’ve written scripts to parse our internal file formats and pretty-print the interesting bits.
> Binaries we download and run (as well as packages from package managers) are generally cryptographically signed by people you trust. Shell scripts you curl into bash are not.

There is no reason in principle why a shell could not implement digital signatures. bash could have a "--require-signature" option where it looks for a GPG signature appended to the end of the script, and refuses to run the script if the signature is missing or the signer is untrusted.

(No idea if the Bash maintainers would be willing to accept a patch adding such a feature if someone were to write one; but, signed scripts is something supported by PowerShell, although most people's experience with it is limited to turning off the default setting which requires all scripts to be signed.)

A related question – what's the difference between downloading an unsigned script over HTTPS versus downloading a signed script (whether over HTTPS or just plain HTTP)? Ideally, the code signing is done offline, so an attacker that compromises the HTTPS server gets the HTTPS private key but not the code signing private key. However, I suspect that ideal often isn't actually obtained; offline code signing can be a pain for CI. If someone has a CI pipeline which signs the code and then deploys it to the HTTPS server, then all an attacker has to do is compromise access to that CI pipeline and neither HTTPS nor code signing will stop them.
It's my all time favorite rant, also available in a (very fast loading) web page:

https://idlewords.com/talks/website_obesity.htm
I have heard Lunch Money is great → https://lunchmoney.app/
There is a book that might change your mind and it is actually on the list
Range: Why Generalists Triumph in a Specialized World" by David Epstein.
UnderstanDocker step by step. A tutorial repo for beginners
FireEye worked for Equifax before Equifax was breached. I'm not sure their reputation can be harmed much when they are still here after that shitshow.
Hello Everyone, I wrote a simple beginner tutorial for Docker, you can read here https://github.com/championshuttler/docker-basicLearning or https://championshuttler.github.io/docker-basicLearning

If you like it please do not forget to give the repo a .

Happy Open Source
This (causation as correlation) revelation was highlighted by Hume and this and other work by him had profound influence on Kant (famously awaking him from his "dogmatic slumbers") and scientists like Darwin and Einstein - the latter obviously in a more healthy scientific age when those at the forefront of physics were not so disdainful of philosophers.