skysight-inc/HackerNews huggingface dataset:
100% conversion rate with those you can apply sufficient pressure on, perhaps. Who'd want to lose contact with a son, brother, father over something like that? But it's a hassle, even if you don't see it that way.

Over the years I myself have been converted to Signal, Telegram (encrypted chats), Threema, some kind of encrypted IRC and OTR on at least two other messengers, Google Wave, Google Talk, Viber, ... can't remember them all. I have no idea anymore what person prefers which app and since most of those people weren't the very best of friends, contact to almost all of them has effectively ceased (in part because those specific people don't often start conversations themselves), which is a pity, but it's simply really bothersome to cater to everyone's preferences, and I absolutely can't and won't switch to $other_app fully myself, because I really value being able to talk to all my acquaintances and friends and relatives and being able to stay in touch with new ones easily and frictionlessly, and pretty much everyone is on Whatsapp, and all I need is a phone number.

If some people categorically don't value other people who don't use their preferred app, that totally weirds me out. Their choice, but not one I'm willing to make, especially since that notion of freedom I gain feels like a very, very abstract kind of freedom in a world where billions use Whatsapp for next to anything and all sorts of devices, apps and websites from all sorts of brands and sources phone home lots and lots of data, which also means eschewing Whatsapp doesn't matter a thing unless I make dozens of other painfull choices like opting out of all mainstream social media, complex privacy-centric browser setups that need constant attention to not fall behind, no mainstream phone (possibly no smartphone at all), no smart devices at all, Linux exclusively, etc. pp., otherwise I'll just leak data like a sieve elsewhere. Given that I gain what feels like very little, life just feels too short for this.
Wirecutter just buys a popular brand name and says they like it.

They don't do any careful tests or write up details.
76. After a breakup, cease all contact as soon as practical. The potential for drama is endless, and the potential for a good friendship is negligible.

Lol. Or don't date people who you wouldn't be friends with if it weren't for the sexual attraction.
I'd be really interested where you can buy .org domains for $2 a year so that I can move my domains there. Please don't disappoint me!
You can make libraries runtime agnostic, but it requires a bit of design to get right. We tried our best with Tiberius[0], so you just need to provide an object implementing the AsyncRead and AsyncWrite traits from the futures crate, such as the TcpStream from async-std or tokio (using their compat module).

It is not perfect yet, and especially how tokio does not follow the rest of the ecosystem by implementing their own traits is kind of disappointing. We can work around that, but I was hoping they would fix this by version 1.0...

[0] https://github.com/prisma/tiberius
> there has to be a single source of session truth across the system. This gets to be complex in distributed systems.

This sounds like a database. Or if that's too slow for you, a Redis cache.

I try not to make blanket statements about software infrastructure, because we all work on a variety of systems. However, I'm having a hard time thinking of scenarios where session cookies are too hard or too slow.
Logitech Zeiss is a webcam you buy.
and tokio is pet of rust... I don’t see the value of this argument. Tokio is known as being THE async executor in rust. Asyncio being THE executor in Python. In other languages there’s a number of frameworks to choose from. In this comparison there really is only one.
I think it's rather that smol is "complete" and doesn't need much maintenance.
I don't think I've come back around to enjoying the lettuce in fast-food salads, but maybe I'll ascend to that level one day.
It's still fearless, as in you don't need to worry that you might create data races, but can be clunky to write in some cases.
You are describing a normal external webcam.
Well they've already solved the second problem - a certain political ideology has decided that they're fine with turning to violence and intimidation to get their way. If Amazon starts sacking workers trying to unionize they'll just burn down more buildings, cause millions more dollars in damage to major US cities, riot for a few more months, block traffic for months, fight with any law enforcement that tries to stop them, and essentially bully/coerce/intimidate the population and local governments into enacting laws and ordinances to give them what they want. (They then call themselves the good guys and use the media their political ideology has near complete control over to paint their actions in a good light).
I think the complete opposite. A shy, nerdy person who has trouble talking probably isn't truly listening when they're not talking.
This is the only article I could find that includes detailed information comparing the Whoops sensors to other devices: https://www.dcrainmaker.com/2020/05/whoop-3-platform-review....

Do you happen to know of others?
The Infinite Race
> you can also mlock/madvice/manually touch all the memory to get errors right away as well.

All this does is run the OOM killer, which doesn't necessarily kill your process. Maybe its a process you didn't care about, maybe its a process you actually are communicating with and suddenly you're now in a weird deadlock state. Etc. etc.

Even if YOU touch all your memory like you're supposed to, there's no guarantee that OTHER processes have touched their memory.

So you touch memory unnecessarily: which means you're now officially reserving RAM (wasting it). Then, some OTHER process touches their memory and runs the OOM-killer. That wouldn't have happened if you just didn't touch your RAM.

-----------

If Linux Overcommit is on default, you live with it and die with it. No point trying to fight OS-policy. Change the policy (aka: Overcommit to 2), and then carefully select applications to run with that follow the same overcommit policy as you.
My hot take is that Hacker News isn’t immune from having an online community status quo, it’s just a different one. The averaged out HN perspective is one of hyperbolic ridicule. And honestly it’s fine! You’ll never have an online community without this effect, or really any community. The same group also generates extremely useful content more often than not, I’m still thankful we have this :)
> it does not need to store any more public/private key pairs as the number of authenticating users increases

That's a good point. Thank you
+1 I do something similar. As a general rule, I prefer to listen to songs I don't already know while working. If I'm humming or singing along, I'm doing it wrong.
> For those that don’t know, on Linux there is^H^H was really no such thing as properly async file system access (eg libc faked it in a similar fashion for aio)

That's not quite right - there didn't use to be AIO for buffered filesystem IO and for most operations beyond read/write.

But unbuffered reads/writes have been doable asynchronously for quite a long time, via io_submit/libaio. Without falling back to threads.

The restrictions around that can be onerous (e.g. one needs to be careful to not extend file sizes, or risk falling back to synchronous operation).
hmm, you're right I got confused by the reference L. Evett and D. Brown. Text formats and web design for visually impaired and dyslexic readers-clear text for all. Interacting with Computers, 17:453–472, 2005. and took it to mean that they recommended Comic Sans for visually impaired readers with dyslexia as well, but it seems they don't have comic sans in the list of fonts they actually tested.
And once starting and stopping threads adds to much delay to your request processing, there could be a thread pool that grows as needed and which will reuse threads that haven't been closed yet.

This mechanism is implemented by Apache httpd, Tomcat and pretty much every classic application server.
The comment says "per month".
Coincidentally, just yesterday I was looking for the usual simple in-server form&session Web site authn functionality for a Rust Web framework (and, ideally, also client certs).

I was confused by what this page says is available, and what it didn't: https://www.arewewebyet.org/topics/auth/

I get why OAuth2/OpenID is popular, in a tech professional environment comfortable with leaking information about users, and also desensitized to the risks of a single Web site having numerous third-party service&CDN dynamic dependencies for a page load... but I still expected the basic default authn mechanism to be form&session, and then some of the other mechanisms to build upon some of the same authn (and perhaps autho) session&events&UX foundation.
Not sure it’s Britney.

Comic Sans has no ambition;
is chosen despite itself;
is hyper-ordinary.

It’s the supermarket’s-own-brand ramen noodles of typefaces.
The movie ends with Silvino Cubesare, one of the better runners, now 41, being shown video from back-when Christopher McDougall was on the late-night talk shows promoting his book and barefoot —

"People say that we Rarámuri are the best runners. Some say that it's the sandals or because we run barefoot. I don't believe that.

I don't know what they're [Christopher McDougall] thinking. Why do they do this? Why do they want to run barefoot?

It seems strange. Why do they want to suffer? I think they're crazy."
Really, I was just responding to the prior. They drove the pseudo-rationalist line. I do think there is a toxic culture in rationalism, but I tend to blame it on neoliberal economic reductionism, or libertarianism. I don't think rationalism per se is at the root of it, pseudo-rationalism, what would that even be? purported rationalism but actually.. over-arching asocialism? self interest? Anyway, I saw religiosity as the counter-case to rationalism.
> I can't think of any real world scenarios where a JWT is superior to cookie auth over HTTPS.

What if you aren't using a browser? What if you explicitly want to know that the contents of the auth token aren't modified? What if you want to work with a IdP that only provides JWTs to offer centralized authentication and user management?

> Cookie auth is much easier to implement without the need for a 3rd party library and is also more secure.

As long as you are in the browser, sure! In many cases you can use secure cookies and server side sessions and they work well. But as soon as you get into more distributed or larger systems, reaching out to multiple APIs, JWTs may make sense.
On the other hand, I go through months where half my job is devising ways to extract requirements from users who just want me to "make this problem go away"! I consider it very reasonable to test someone's ability to work out what problem they're meant to be solving.
> No charges were announced against the individuals behind the three VPN services

This is a little worrying. How can their service be shut down when there are no charges against them?
Why is your lens 3x the price of a pro-am Autofocus prime or zoomablr DSLR lens?
> all these companies who are better at marketing themselves well as experts are getting free lunches

Better than us, I presume? But unless you or I are prepared to do this work (to parse data from Signal and every other application out there), for the police, for other investigation agencies, for corporate and private investigators, for lawyers, for data protection officers etc., the vast majority of whom aren't programmers or reverse engineers, what's the problem if someone else is?
This is like saying "Whether people like it or not the King of France is sovereign." Why is the operation of the DNS a commercial endeavor, and what would go wrong if it were not be the case? There are a huge number of examples of successful internet infrastructure projects that are non-commercial, perhaps with commercial participants or sponsors but not commercial themselves. (The IETF, Let's Encrypt, and Linux all come to mind.)

https://www.potaroo.net/ispcol/2020-09/root.html (posted on HN a while ago) says that the DNS root servers get about 10^11 queries per day, or one million queries per second. Hitting 10K queries per second on a single server is entirely doable, so you would just need 100 cloud VMs to handle the entire root DNS load.

I realize the TLD servers are more loaded than the roots, but it's still not so much traffic that it's entirely out of the question to make it a community-run service on the basis of traffic / engineering effort. So what other reason is there that it must be commercial?

(Note that there are over 10 million .org domain names, and they charge fees of about $9. Even if you cut fees to $1, that's still plenty of money for both infrastructure and labor. You could hire a team of ten SREs at very-senior-FAANG salaries and still have a bunch of money left over.)
Most sites should just need one low-res (32px) and one high-res (192px) icon; re-use the high-res icon as an apple-touch-icon (it's supposed to be 180px, but 192px is close enough) and you're good to go.

It's important to remember that you're not just targeting browsers; lots of other software needs to parse site icons. Fancy messengers (Signal, Element, Discord, iMessage, WhatsApp), bookmarking clients, search engines, social media widgets, etc. all parse and display icons, and not all of them support SVG. Some RSS readers show thumbnails; they will only use `<link rel="icon">`, and select the higher-res icon if it's available.

Chromium DevTools has an "Application" pane that lets you preview your icon in the minimal safe clipping area; if it looks too crowded, you can specify an alternate maskable icon (unrelated to mask-icon) in your application's webmanifest with `purpose: maskable`.

I recently gave this a spin on my own site. Relevant 80-line commit message:
https://git.sr.ht/~seirdy/seirdy.one/commit/b9a307a8c16d7d20...

Since that commit, I added a monochrome icon (same as mask-icon) and 512px icon (since not all programs handle svg well). Although it isn't exactly an icon, I also added an Open Graph image for all the programs that use it.

My current webmanifest is generated from https://git.sr.ht/~seirdy/seirdy.one/tree/master/item/assets... by Hugo.
OpenBSD people have "weaponized" Comic Sans by confronting them about font bikeshedding instead of caring about what actually matters: https://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.ht...
A screen of brain organoids to study neurodevelopmental disease
While it might not be that hard to read, it can certainly be harder to reason about.
Other replies to my comment already mention it (and have sources).
There are “Know your customers” laws that require you to know identity of your customers.
Does your neighbor really need a domain, and does it have to be a .org? You can do web stuff with free or ultra-cheap domains. And most hosting services will cost much more than the $0.67 or $0.85 you pay per month for a .com or .org respectively (at CloudFlare Domains).
The biggest attacker for the past 70 plus years is the United States.

The below attack on the Soviet Union was officially acknowledged by Jody Westby at the 2009 First Worldwide Cybersecurity summit:

https://www.wired.com/2004/03/soviets-burned-by-cia-hackers/

This was the conference:

https://www.eastwest.ngo/events/first-worldwide-cybersecurit...

Jody Westby:

https://www.globalcyberrisk.com/our-team/jody-westby/
To me, the author's point seems more complicated than that. No, fascists didn't come up with certain techniques, like military parades. But those same techniques seem to be particularly effective when employed as tools of the fascist state in service of the fascist agenda. Can you separate the cultural relevance those techniques have for us from the work they have done in a fascist context? I don't know, but I don't think anyone is trying to "cancel" anything.
A new form of ice with potential transport applications
CAA records (which specify which CAs are allowed to issue certificates for a given domain) are intended to be enforced by CAs, not by browsers. This prevents unintentional misissuance of a certificate, but not deliberate MITM attempts if the CA is actively involved.

Their counterpart for browsers are TLSA records, which associate specific keys or certificates with a domain name. This is the part that actually prevents MITM attacks on the client side (assuming the client's getting a complete and accurate DNS response, which is a whole other issue), since it'll cause a compliant client to reject any other keys or certificates. (No idea how widespread the implementation of this is on the client side, though.)
Show HN: Shrinking Fractional Dimensions with Reinforcement Learning
> Time really is the most precious resource you have. Think hard before you trade it for anything else.

Including money!

I personally would much rather spend a sunny afternoon with my nephew transporting 2 tons of gravel and playing outside than sitting inside an office to earn the money to pay someone else to do it.
They have been improving the git plugin quite a bit in very recent times... adding a lot of functionality that was missing. I still go back to spacemacs when i needed to do more advanced workflows but the basic stuff in vscode is not bad anymore(though rebasing i am still way more comfortable in magit)

I am excited for this to be fleshed out and hope it's closer to a nice magit experience.
There are not enough professional firefighters in some places.
How do you usually format your searches to avoid all the SEO crap?
It’s funny that the article uses the term “Alt-Berlin” to denote a new Berlin, whereas ’alt-Berlin’ in Deutsch means “old-Berlin”.
>browsers download favicons in the background, so a bigger favicon image does not affect website performance;

I get what he's saying. He's saying the browser won't wait on it before displaying actual page elements. But bandwidth is bandwidth. And bandwidth used downloading a bunch of big favicons is bandwidth not used downloading something else.
Automatic Double Tracking
This comment demonstrates one if the #1 errors in assessing scientific statements: theories are fact based. Scientific literacy is so bad most people still don’t get that (and I’m not saying that to slander you, it just seems like an abundantly clear fact). There seems to be a large faction of the population that thinks something like global warming (a theory, derived from facts) is the intellectual equivalent to your kooky neighbor’s alien stories (delusional imaginations).

the•o•ry thē′ə-rē, thîr′ē►
n. A set of statements or principles devised to explain a group of facts or phenomena, especially one that has been repeatedly tested or is widely accepted and can be used to make predictions about natural phenomena.
n. The branch of a science or art consisting of its explanatory statements, accepted principles, and methods of analysis, as opposed to practice.
n. A set of theorems that constitute a systematic view of a branch of mathematics.
Whether it's kernel threads or green threads, the same patterns (locks, etc) are possible. Locks are supposed to be the borrow checker's bread and butter, because it can guarantee they are held before accessing shared state. But now you're saying "the borrow checker makes writing code without [async/await] difficult, inefficient, and unergonomic."

I'm not saying locks are better than async/await (although they are[1]). You're saying the borrow checker itself can't handle them in real world use?

[1] https://journal.stuffwithstuff.com/2015/02/01/what-color-is-...
There is consensus in some ecosystems. Javascript absolutely maintains that invariant. There are (almost) no blocking functions in the javascript / node standard libraries and we work hard to keep it that way. Go maintains similar discipline at the OS syscall level.

I feel like the "what color is your function" thing is incomplete. There are arguably 3 types of functions:

- Functions which do all their work synchronously and return without blocking

- Async functions which contain an internal state machine

- Functions which block on expensive IO or long computations

Mixing blocking functions and async functions in the same kernel thread leads to various performance disasters. Javascript is so meticulous about not having blocking IO in part because its basically impossible to tell from a function's signature whether it will block the thread. Lua has this problem - callback oriented lua feels like a natural fit for the language, but lots of 3rd party libraries are packed with blocking calls. Writing asyncronous lua feels like fighting a river. You have to constantly guard against calling blocking code, and most API docs won't tell you where they block.
Online Boustrophedon:

https://codepen.io/pouretrebelle/pen/pvOxvv

(you may need to reload if the text isn't justified properly)
Definitely agree with the sentiment of plain HTML+CSS being best for static blogs, but I've found value in using a static site generator for any "production" HTML site where the small overhead of a tool is justified because it provides some minor quality-of-life features.

A few things that I've encountered in the past that Hugo solves:

- Page links breaking and requiring rework if you change your site layout.

- Standardizing link formatting, including trailing slashes.

- Editing headers/footers.

- Dynamically deploying separate development & production environments, so teams can preview changes before releasing.

- "Draft" mode, to turn on/off pages without moving or deleting the file.

All of these things you could do by hand, but having them handled automatically makes it less likely that you'll make a mistake. That said, the way I've used Hugo on several projects is pretty similar to your philosophy: Most of the content (index page, styles) is hand-written HTML/CSS, and Hugo is just used to format generic pages and links.
Show HN: Phrenemies is a fun web game to play with family
Can you elaborate a bit what it is that you find difficult or undesirable about Tokio? Or async/await + some runtime in general?

So, I can relate to not wanting to pull in the dependency. But otherwise it seems pretty straightforward to me. You just macro-decorate the main function, sprinkle some async/await around, maybe add a join or a mutex somewhere, and then pretty much forget all about event loops, messaging, threads and whatnot. I feel like I must be missing something important here.
Your second point is a good one. Discipline is superior to motivation for getting things done, but not for deciding what to spend your time on (which is probably more important). Too much discipline can lead to putting up with bad situations that you hate.
We’re distributed, about 15 people now. 1/3 devs, 1/3 sales & 1/3 ops.

We get by with frequent and non-fussy use of screen sharing in slack or zoom calls.

If someone is leading on a project / bug / sale we expect some quick and dirty Looms or just Mac/iOS screen recordings into a shared drive for a simple knowledge base.

I record a LOT of our calls and will do at least brief readme write ups that often end up in our git repos with links to the resource.

I think the big cultural step is just being open to ask for advice on tooling and quick to share little finds.
> devices seized by law enforcement

Not exclusively[1].

[1] https://www.cellebrite.com/en/business-solutions/
In situations where I can control all responses for a host, I will probably start doing that as well.
Tech, business and science daily newsletter