skysight-inc/HackerNews huggingface dataset:
Is it really that troublesome to strike a balance between implementing something yourself and using a library when the difference is two weeks versus two years?

If, for example, a file format is really complex, it has most likely one implementation that almost everyone uses. If there is a problem with it, you will hear about it. Use that.

On the other hand, if a file format is really simple or you only need a simple subset of it, rolling your own could avoid you getting 0-dayed when the most popular implementation has a vulnerability.
Militarized FOMO
I tried building a similar air purifier in Belgium last year and I've never been able to source the parts at a similar cost.
There was a story a few weeks back about Microsoft working on a new android subsystem. So truly coming full circle; android OS stability (via project treble), the vm approach instead of compatibility layer approach, and improvements to hardware sharing/passthrough to wsl 2 mean that they can finally realize what they tried to do with Projecy Astoria.

They'll need to manage their own app store as I can't imagine they'll have gapps//shims out of the box, but that works in their favor if they wanted to do another mobile play.
The obvious one is if you're physically located near us-east-1 and want low latency to your office. us-east-2 is all the way in Ohio.
I strongly disagree.

What the comment points to is that reducing car pollution isn't so much a question of saying we all need to pitch in as one of saying that we need to identify the serious problems and promptly deal with them. It is the kind of thing that is absolutely essential to understand before you have any chance of proposing an effective solution.

This is, for example, why it is common to have regular smog certifications required. And why those certifications do more to reduce smog than, say, telling everyone to drive 20% less would.
Author here: I'm now wishing that I had made the title slightly flashier, since the implications of this change are significant: many bits of the Linux kernel that originally had to go through retpolines (as part of the original Spectre v2 mitigation) can now go through "static calls" instead, yielding a decent performance boost.
Cross Layer Attacks and How to Use Them
In the US, the government is restricted by the First Amendment. The oversight is the courts.

Censorship by private ISPs wasn't allowed when we had net neutrality, but at the moment they can do whatever they want.

If most places had competitive free markets for internet, that might be be ideal, but we basically have monopoly providers in much of the country.
CIP to Embark on Kernel 5.10 Development for Super Long Term Support
I have used xmonad exclusively for 6 years and have been very happy on larger (or multiple larger) monitors.

I have a strong dislike of desktop environments though.
tl;dr https://twitter.com/BIUCrypto/status/1339126725461090311

abstract:

We analyze the prandom pseudo random number generator (PRNG) in use in the Linux kernel (which is the kernel of the Linux operating system, as well as of Android) and demonstrate that this PRNG is weak. The prandom PRNG is in use by many "consumers" in the Linux kernel. We focused on three consumers at the network level -- the UDP source port generation algorithm, the IPv6 flow label generation algorithm and the IPv4 ID generation algorithm. The flawed prandom PRNG is shared by all these consumers, which enables us to mount "cross layer attacks" against the Linux kernel. In these attacks, we infer the internal state of the prandom PRNG from one OSI layer, and use it to either predict the values of the PRNG employed by the other OSI layer, or to correlate it to an internal state of the PRNG inferred from the other protocol.
Using this approach we can mount a very efficient DNS cache poisoning attack against Linux. We collect TCP/IPv6 flow label values, or UDP source ports, or TCP/IPv4 IP ID values, reconstruct the internal PRNG state, then predict an outbound DNS query UDP source port, which speeds up the attack by a factor of x3000 to x6000. This attack works remotely, but can also be mounted locally, across Linux users and across containers, and (depending on the stub resolver) can poison the cache with an arbitrary DNS record. Additionally, we can identify and track Linux and Android devices -- we collect TCP/IPv6 flow label values and/or UDP source port values and/or TCP/IPv4 ID fields, reconstruct the PRNG internal state and correlate this new state to previously extracted PRNG states to identify the same device.
Actually, Mazda is already working on doing that, so it's quite likely.
Ah, so yet another comment that could have been avoiding by reading the article and not just the headline? :)

Remember when hacker news had people on it who did such things :) Because I don't :)
I really hope that happens at some point, since there's so much messing around just to get a yubikey working in WSL. I eventually gave up on that.
I find it interesting how, in the other current thread about an antitrust suit against Google (https://news.ycombinator.com/item?id=25448718) that people there are criticizing Google's lack of ethics, and in this thread people are criticizing a team in Google whose goal is to try to get Google to act more ethically.
Ok, thanks for pointing out!

I recognize that in that case I have been wrong and loud at the same time.

I'm sorry for that.
Why are some of the faces of the thieves blurred but some aren't?
I used to be a big fan of XZ(which uses lzma2), but Zstandard has good-enough compression at high levels with orders of magnitude faster decompression. It's also more versatile in its compression levels. It's now also my go-to for new projects.
I wonder what the rust core team's stance is on projects like this?
Everything over HTTP – screen share, real-time messaging, SSH and VNC
I understand the need for launching with GitHub integration only, really. It's probably 2020 table stakes for launching a hosting platform, ticking the "up and running in 5 minutes" requirement checkbox. (See also: Digital Ocean's recently launched App Platform, same situation.)

But many of us walked away from GitHub and embraced GitLab in the last few years, probably a big wave in 2018. As far as I can tell, there's not a publicly documented non-GitHub way to interact with Cloudflare Pages. Cloudflare folks: if you can't launch with a full GitLab integration that's understandable, but I'm tired of sitting these things out because they can only launch in simple mode. For my part, I'd rather fuss around with .gitlab-ci.yml now than start a project on my old GitHub account and deal with unknown migration pains later.
I would be more interested in knowing what share of the top 10k or so docker images have critical vulnerabilities.

The vast majority of those 4M docker images are stale and probably never pulled anymore.

For example I probably have a good 100-200 public docker images on my account, virtually all of them will have critical vulnerabilities as I don't maintain them. Those are images I used for past personal projects, or testing something quickly, demo projects, iterating quickly on something etc.
As soon as I am done with them, I forget about them and will never invest the time to maintain them, probably no one will ever pull them either (why would you pull an undocumented `randomuser/test-ml-my-shitty-project:latest` image?) I suspect a huge share of the 4M docker images analysed fall in that category.
this is why I don't show anything like this to mine. But I will show it to my daughter :)
And just because they have that capability, doesn't mean they can "legally" use it. The posted article says that it can do a better resolution than that 50cm, but didn't specify how much better.
It doesn't looks like SAR to me(there are shadows, for example).

More like standard optical image(the resolution and details are amazing, if it's a satellite, which is doubtful given the angle).
SpaceX and its kick-ass 2020
Looking for a good CMS for a mobile app
I have a simple mobile app that is using Firebase Realtime Database, but the more data I have, the more difficult it is to manage, moderate and update the entries.

I was testing some alternatives like Contentful* Strapi and most recently Cockpit headless CMS. They all fulfill most of my requirements but have some serious issues as well:

- Contentful is fine, but as it's very expensive as soon as you want to add second workspace. I don't wont to violate the terms of use by creating another account.

- Strapi has similar issue as above and it requires Docker container or VM. If possible I'd like to limit this to something simpler like basic web hosting.

- Cockpit works really nicely on my basic web hosting, but it's missing some basic documentation

What would you propose to try out as a basic CMS that would:

- provide a graphical UI to import, manage and edit the data

- expose RESTful API to fetch and edit the data

- be relatively secure

- inexpensive (few $/month top)

- be self-hosted on basic web hosting or Heroku/DigitalOcean/Netlify instance
They were. This entire line of criticism comes from not reading the study methods.
They are working on Wayland support:
https://www.phoronix.com/scan.php?page=news_item&px=Microsof...
The Rendering of Cyberpunk 2077
Exactly - your last paragraph is the crux for me. They could have been fired for no reason, and no notice under the most common at-will agreements. The system does not favor employees at all, and I wish we were all more angry at that.
If Capella is doing this and publishing images, imagine what the NRO is doing with multi-billion-dollar budgets and SAR satellites that weigh 6000 kg.
I was wondering that too..
I think in Romanian, due to import of US equipment (PCs, keyboards, etc.), we've just given up. We just use " " everywhere.
> They're better off than some countries with strict lockdowns like France, Italy etc

That's an apples and oranges comparison. Sweden is far worse off than their neighbors, that are far more similar to it than France and Italy.

https://www.nytimes.com/2020/12/15/world/europe/sweden-coron...:

> Infection numbers and deaths have been rising steadily since October. By Tuesday, Sweden had reached a total of 320,098 cases since the beginning of the pandemic, while its neighbor Finland, with a population about half of Sweden’s, has 31,110 cases, less than 10 percent of Sweden’s.

> Sweden’s total death toll reached 7,667 as of Tuesday. The country now has 74 deaths per 100,000 people, less than the United Kingdom, with 97, but far more than its neighbor Norway, with seven.
It is a shame that these types of tech companies are always churning up such bad publicity... they literally cannot afford to be making these sorts of unforced errors. It just makes it that much more difficult for all the innovative and honest startups who are trying to bring about positive disruption. cutting corners and misleading your customers is not innovation.
Phaser 3.50.0 Released
And what do you think is the “gender neutral” term that Spanish speakers use when they refer to group of people of Latin American origin? It surely is not “latinxs”.

“What would be point of that?”, yes, that’s exactly the issue. It would seem weird, forced and foreign, just like “latinxs” does to people it is purported to refer to.
I have sympathy for that sentiment, but in practice that train has long left the station.

My own comment wasn't a plea for government to interfere, btw. Just a cynical admission that active trading is bad for the vast majority of people.

(My own money is sitting in the most boring ETF I could find, but loaded with about 3x leverage. Given the regulatory requirements of the industry I work in, I wouldn't be allowed to trade actively anyway, but I don't feel like I'm missing out.)
You can also read the IP from etc/resolv conf.
Efficiency of solar panels on satellites is about 40%. That means ~ 700W/m2 if correctly oriented. That's quite a lot of power, even if you stay 50% of the time in night while orbiting Earth. So no need for huge panels usually. (Updated : more like 40%, not 50%)
> There's no clear-cut rule here

Exactly, that is why it is important to follow standards. Most engineering decisions are not clear-cut and are born out of tradeoffs. That is why we agree on standards that define those tradeoffs instead of every one of us having our own take on situations.

> Nobody cares if their mailman's knocks follows an RFC or not

If there is a Mailman RFC which says:
"If someone opens the door and says `Mike does not live here' then DO NOT attempt delivering the same package"

THEN I expect the mailman to not bother me again, EVEN IF it was actually my mistake that I forgot my roommate Mike actually does live at this address.
The Last Speakers of Ancient Sparta
Inkscape includes the border width in the displayed object size and position. So an SVG file with a 100 units square and a 1 unit border will be a 101 units square in Inkscape. And if you change the stroke width the object size changes. This causes the coordinate mangling you saw.

Consequently, I find it impossible to do precise CAD style diagrams in Inkscape. Of course, it's not designed for that.
>>212. Google also [redacted] of non-AMP ads by giving them artificial one second delays in order to give Google AMP a [redacted] [redacted] slows down header bidding, which Google uses to turn around and denigrate header bidding for being too slow.

See comment by jefftk. Seems to explain it.
By your own admission, you own 3 high-end laptops and one low-end one (which you don't even use). Enough said.
Right. If I recall correctly, their position is that the Supreme Court can't refuse disputes between states.
Are you mixing together original universe and Kelvin universe?
Four Reasons to Start a Podcast in 2021
Watch a swarm of drones fly through heavy forest–while staying in formation
Another data point. I have not used phone support, but been a customer since 2013 and have used the live chat quite a bit. It has always been extremely good. Never gone around with a bot. Last chat was maybe 1 month ago.
It has helped me to adopt the attitude that what matters is the skillful execution of tropes, and whether the artist can make me feel something. Because everything is tropes. Even Charlie Kaufman and Fitzgerald use tropes.
The level of misinformation here is astonishing. Blocked and Reported did a deep dive on this recently with Ars Technica co-founder. https://podcasts.apple.com/us/podcast/blocked-and-reported/i...

And by “misinformation” I mean it’s either in the podcast or in this article. You be the judge.
I have tried this setup recently (with XQuartz) but it had abysmal performance compared to a Tiger VNC session with a Linux server and a macOS client.
I couldn't figure out why. I remember it was working better decades ago over 10Mbit/s connections, running on 80486 machines...
Maybe between 2 Linux machines running the same Xorg versions would work better?
How does this relate to "multi-level marketing" or "deception for financial gain?"
These are promising answers so far, thank you. I look forward to the round-trip results
Fertilizer Made from Urine Could Enable Space Agriculture
Payment for order flow trade never helps the consumer. RH accepted unusually large amounts of it. They harmed the consumers to the tune of $34m relative to normal practices. They lied about what they were doing.
Can DevOps honestly release daily cycles?
You may enjoy the book called The Logic of Failure
Nbautoexport: Automatically export Jupyter notebooks to various file formats
Ummm...

You make your own images, if you really care. You involve your "ops" people in that.

They manage the base images that are then used by your dev team. They're responsible for updating the base images.

Your dev team provides a CI/CD pipeline which the ops team can use to check that security updates don't break functionality.

It's not rocket science.
Even if the internal reviews aren't anonymous, if you send your manager a letter demanding something or you're leaving, they're probably not going to give you it regardless.
I know I France short term vacation rentals is way older than airBnB, we have an entire infrastructure, vocabulary and legal framework around it.

Americans are always baffled when they come here and start getting away from AirBnB.
Financing a 10k car is "cheap" if you have decent credit and aren't rolling negative equity from another car into that. Using average rates it represents a 10-15% additional cost over the principal, and you end up with a car worth about half that. With a 60 month loan you "spent" $6-7k to have a car for those 5 years, if you keep it another 5 years the numbers look better.
Zstandard is great indeed. Performance is excellent, but in my experience its killer feature is the user definable dictionary. My search engine software stores its documents in an archive to which I need random access. Lots of small documents, random access: bad for compression. Use of zstd with a tuned dictionary improved compression fivefold(!) when compared to the older zlib solution.
I've noticed a trend where toxic people hide behind a veneer of a righteous cause, usually something related to social justice. It's effective and usually short circuits the public's willingness to see the nuance of the issue.
Google, Gmail, and YouTube are having issues again, for third day this week
That sounds like a somewhat torturous and navel-gazing way of seeing things, although I have definitely felt a form of what you describe here so please don't take it as a personal attack. In my case, it was correlated with a lack of stimulus and worthwhile things to do in my life at the time.
Yeah, but you're making a legal, not moral, argument. I argue that we often consider it unethical for government to silence its citizens, regardless of the law governing that country. Why we accept this in private companies? Should that be the nature of the ownership and why?
If you're talking about the general concept of using js to spoof another protocol: that exploit involves middleboxes sniffing TCP connections at the packet level, rather than at connection/stream level. It certainly won't work for connections with a TCP server.

If you're talking about using that exploit to allow access to the victim's machine from the internet: that won't work because listening interface for the x11 server is localhost, not the LAN interface.
I've noticed a trend in the final episodes of some shows being cancelled where the primary actors will suddenly start wearing outfits that are much more form fitting (flattering) than their clothing from prior episodes. Not sure if it is driven by a desire to line up future work for themselves or if it is an effort by the director to increase ratings...
The paper was submitted on time, other papers at Google were submitted for review after they were released. By Jeff Dean's own admission the paper was approved for release.

The demand for retraction was initially given while refusing to state what the reason(s) for the demand were. Only after the meeting where they demanded she retract the paper did they belatedly agree to read her the feedback that they stated as the reason. They wouldn't even let her read it first hand.

Ultimately it seems like Google could have plainly stated their issues with the paper from the start, and that said issues were not so serious that they merited a demand for retraction.

There are a number of things that just don't add up. Even if you take it at face value that Gebru's ultimatum demands were unreasonable, there are several problems with how the situation got to that point in the first place.
Wsl 2 is really cool, right up until you want/need to do anything with the underlying hardware. No usb passthrough, no hardware acceleration, gpu passthrough is there but it's still early stages as performance is about half of native and vendor tooling is absent, etc

It's getting better all the time though - they tease usb passthrough might be doable as it's already supported with remote desktop
Not only that, but she threatened Google with a lawsuit _before_ any of the current drama happened (excerpt from her email with regards to the recent firing/resignation):

> I’m always amazed at how people can continue to do thing after thing like this and then turn around and ask me for some sort of extra DEI work or input. This happened to me last year. I was in the middle of a potential lawsuit for which Kat Herller and I hired feminist lawyers who threatened to sue Google (which is when they backed off--before that Google lawyers were prepared to throw us under the bus and our leaders were following as instructed) and the next day I get some random “impact award.” Pure gaslighting.
Finnish sauna was chosen to the Unesco Intangible Cultural Heritage list
> Or did the trading firms treat order flow from RH differently than from other sources?

I'm not well versed in financial language by any stretch, but i believe it's this.

Matt Taibbi did a piece on them last week and goes into this. https://taibbi.substack.com/p/pandemic-villains-robinhood
You probably have some conditioning that discourages use of '-9', but that's generally totally fine to use with zstd in terms of speed.

I've been a zstd convert for a few years now and haven't settled on any particular ideal setting. Sometimes the very high compression levels (-19) produce a worse result, sometimes they kill it. I think most of the time I'm using -9.

I've seen cases where '--ultra --long -22' was bringing size down by 10% or more compared to the normal settings, and also cases where changing the defaults at all produced significantly lower compression.
Docker really is a power tool for developers, especially for freelancers needing to hop customer environments on their own notebook, and excels at that. The problem is the leap of pushing this guerilla tactics into running containers in prod. It's a result of the "move fast and break shit", web-scale, startup, and other agile narrative of the 2010s. And the industry has sure catered for these consumerisation of IT, with outlandish complexity in k8s, depressing oligopolization, and younger developers demanding such technologies to pad their resumes.
In my darker moments, I wonder if it is not a subconscious attempt to simplify an entity so that they do not enter our Dunbar's Number-sized cohort. Spend too much time (just how many hours are these series?) with "too real" of a character with too many moving parts and they're suddenly closer than one would like.
Since I started looking at images I've seen a lot of issues.

Artifact Hub (which lets you find Helm charts, OLM operators, etc) will show scan details when it has enough information. If we look at the operators (and these are available in openshift today and considered curated by Red Hat) we can see a lot of operators with images that have issues... https://artifacthub.io/packages/search?page=1&ts_query_web=d...

I know this doesn't directly deal with Docker Hub but does highlight the cultural problem with addressing security.
This. A country is governed by its leaders for its people. The leaders have a responsibility to the people to act on their behalf in their benefit.

Companies are managed by an executive team on behalf of, and for the benefit of, the shareholders. Not the employees.

Shareholders can, and do, criticise management and demand they do things differently/better, because management is ultimately responsible to them. Likewise the people can, and do, criticse governments because the government is responsible to them.

Management are not responsible to employees. Though it makes sense to not annoy them too much. But if it's a question of shareholder or employee satisfaction, then legally there's no choice.
True, but inventing a new language for asynchronous hardware wouldn't be as big of a job as reinventing an industry standard like VHDL. Something
like a small lightweight concurrent process description formalism with a Petri net based
operational semantics would do nicely, and such things have been well
understood for decades. The hard part is for it to gain traction.
Google: “phasing out 3rd party cookies the right thing to do for the industry”