skysight-inc/HackerNews huggingface dataset:
EDIT: The article linked by qqii [1] is much better and actually answers all these questions. In short, the smart contracts to allow the loan and to allow the 5x leverage position were totally buggy.

[1] - https://news.ycombinator.com/item?id=25806183

I used to do some work on Bitcoin, but this all reads like some Cirque du Soleil fever dream.

These market making smart contracts will trade at 50% swings within a single block?

> The core of this trade utilises a margin trade on a DEX (bZx) to increase the price of WBTC/ETH on another DEX (Uniswap) and thus creates an arbitrage opportunity. The trader then borrows WBTC using ETH as collateral (on Compound), and then purchases ETH at a “cheaper” price on the distorted (Uniswap) DEX market. To maximise the profit, the adversary then converts the “cheap” ETH to purchase WBTC at a non-manipulated market price over a period of two days after the flash loan.

So we start with a flash loan of ETH, go through two smart contracts to end up holding 112 “WBTC” against their borrowed 5,500 ETH.

> In steps 4 , the trader opens a short position for ETH against WBTC (on bZx), with a 5× leverage.

I’m having trouble parsing this sentence. What exactly does this mean?

> Upon receiving this request, bZx transacts 5,637.62 ETH on an exchange (Uniswap) for only 51.35 WBTC (at 109.79 ETH/WBTC).

What does ‘transacts’ mean in this sentence? And bZx is offering an anonymous trader 5x leverage... based on what?

I think they are selling ETH to buy WBTC which blows out the order book and ends up crashing the price of ETH from 30ETH/WBTC to 100ETH/WBTC?

> Note that at the start of block 9484688, Uniswap has a total supply of 2,817.77 ETH and 77.09 WBTC (at 36.55 ETH/WBTC).

I’m not sure why the total supply on Uniswap of each token is expressed as a price?

The trader then converts 112.00 WBTC to 6,871.41 ETH at 61.35 ETH/WBTC on Uniswap. Recall they started off by getting 112 WBTC for 5,500 ETH.

> In step 6 the trader pays back the loan, paying a 1×10^11 Wei fee. Note that dYdX only requires a fee of 1 Wei.

No idea what Wei are or what the significance is of why they would pay 100 billion of them instead of 1, where they come from or how they are accounted for in the profitability.

> After the flash loan transaction (i.e. the first part of this pump and arbitrage trade), the trader gained 71.41 ETH...

Wait, I thought they had netted ~1,209 ETH, where does this 71.41 come from?

> ...and has an over-collateralized loan of 5,500 ETH for 112 WBTC (49.10 ETH/WBTC).

What happened to the 5x leveraged short position?

And how in the world did they coordinate all of these separate and interlinked orders to execute in multiple transactions all in the same block in an atomic fashion?

Anyway, in the end they need to give back the WBTC by buying WBTC with the ETH they netted;

> In total, the adversarial trader exchanged 4, 377.72 ETH for 112 WBTC (at 39.08 ETH/WBTC) to redeem 5, 500.00 ETH. (over the following two days)

Look... whatever people are out there building on these networks, this is just bizarre.
Well known public DoH resolvers are going to have well known IPs and will be easy to block.

eSNI and the encrypted TLS handshake proposal that was floated recently rely on fetching keys via DNS, so that's not applicable for DoH, and the handshake for a DoH client will probably be easy to distinguish from an HTTPS client.

It will be easy to block, if you want to.
Only cases I've seen that when the stats are out of whack, because the vacuum strategy is not right.
I'm happy with the article overall.

>there are also a decent number of other bugs that come from cURL doing ad-hoc inline character-by-character parsing of just about everything, whereas in Rust you would probably use a library to fully parse things.

cURL is the library to fully parse these things,
There are so many things that bother me about contemporary UI in general, I ranted on here the other day: https://news.ycombinator.com/item?id=24965293

I sincerely feel that the discipline of building user interfaces is long lost and perhaps never to come back. From car dashboards to loud typography, the whole field is regressing. Minimalism, too much white space, infantilization of users, design trends, loss of predictability, etc. are all symptoms of this.

There are still some gems that I find here and there: https://neil.computer/notes/the-design-of-diskprices-com/
>But definitely no transactions: just grab a connection, insert/update some data

Inserts/updates require transactions. How did you escape having transactions?
Hypersonic Superweapons Are a Mirage, New Analysis Says
I'd say that the = is one of the most annoying abuses of notation that I know of, if not the most. Apart from not symmetric, which is a problem in its own right, for small o and small omega it's not even reflexive, which does not prevent the = users from using it also for those. Which amounts to using an equals sign to highlight how two functions differ.

And what do people gain with that? It's not as if a set membership symbol, which works just fine because big O, small o, the omegas and their ilk define sets of functions, doesn't work just fine and take the same space without being confusing.
What about those do you think should be illegal?
I agree about "note taking apps" (I use Notion nearly every day) but that's not actually what a Zettelkasten is. It's really a workflow that facilitates thinking and creativity.

Notion is a place I keep tidbits of information... for example a database of my videogame collection, a history of all my previous addresses (I've globe trotted my entire life) or a repository of highly detailed professional notes on complex topics. Even then I'm still not sure that Notion is really a good long term solution since their staff could theoretically access all my private information without me knowing (I've had this confirmed to me via a support ticket).

So, while Notion has extremely good problem solution fit for a lot of my use cases, Notion however doesn't actually help me develop my thoughts on philosophy or help structure my thoughts on how to approach questions I have in my fields of enquiry or help me create content from original ideas. My physical Zettelkasten does.
Really?
https://melix.github.io/blog/2021/01/the-problem-with-gradle...
We wouldn't have modern civilization without IP law. Curious how you make a living; if it's like anything like the vast majority of the people on this site, or society in general for that matter, it's rooted in laws protecting theft of intellectual property.
- Make is a standard utility, so anyone that has used make before will know what 'make', 'make clean', etc will do without having to read any documentation.

- Make has the ability built-in to only run certain commands based on the files that have changed, which can be handy.

- Makefiles usually have a lot of handy variables for configuring the project like $CC or $DESTDIR. While you could have these in a bash script as well, there's a standard convention for variables in Make[1].

In my experience, Makefiles are usually better documented and follow more conventions than scripts. There are of course many exceptions to every rule.

Make files are very similar to bash scripts, and while I would prefer a Makefile any day, it's really a matter of preference.

[1]: https://www.gnu.org/prep/standards/html_node/Makefile-Conven...
The problem is, if a mainstream browser goes against the flow, it becomes "The Nazi Browser." Its market share was already less than Chrome's, and now it's getting all these new users who are outcasts.

This whole problem only started because browsers stopped being neutral to the content and basically adopted the harmful "if you're not with us, you're against us" stance that seems to be propagating through everything these days. None of the "smaller" browsers (and I mean smaller than Firefox - the Dillos, Netsurfs, and Lynxes) do anything like this.
> What works instead is voting with feet/dollars.

So I both agree and disagree. On one hand, yes, one person voting with feet/dollars has a relatively large impact compared to one person raising a complaint. But if we look at the entire ecology of users, the story is different.

Many of the people who end up voting with their feet do so after being exposed to people raising complaints. And on the flip side, people who see their friends voting with their feet may then seek out the explanations and complaints leading to that action.

Just uninstalling an app is very low information density as a signal. It doesn't provide any reason why, it's just a single bit. It's value is more as an action rather than a statement.

I think the ideal is somewhere in between, and we need both concrete action (voting with your feet) as well as public discourse (raising complaints). The former without the latter is inscrutable, the latter without the former is toothless.
Yea, different personalities have different motivations. I find that if I receive positive feedback, it doesn't motivate me it only encourages me to take it easier. If I receive negative feedback, I will double down to fix the issue, but my morale will suffer.

What's most important is that the feedback is IMMEDIATE. Tell me after a presentation what I flubbed. Don't tell me after a quarter that my presentation skills are lacking.
I agree with OP as well with hosting rights so I don't see why not. Otherwise it's a kind of enforced slavery. People shouldn't have to do work for people they refuse to do work for. Force a man to do such a thing and his will for civility can take a dive.
He can’t he has no evidence
> People don't eat a low carb diet by accident, when they do they often follow the horrible advice given by the many misguided keto diet proponents: eat low carb, high fat, medium protein.

This is not remotely my anecdotal experience. The overwhelming majority of those I know that I have dabbled with low carb ran the bunless burger, chicken wings, bacon, and steak game and I would guess that their macro intake was high protein, medium fat (if that), low carb. The textbook versions are high fat, medium protein, low carb. And seemingly pretty hard to pull off without eating a lot of stuff like salads with a cup of olive oil.
I 100% agree with what you're saying but I think it's still possible to make it compelling for users.
I learned the hard way that other companies than Google also contribute to the blacklist. A site I was working on got falsely flagged by netcraft.com (which they admitted after I spent a week explaining it to them). They do some kind of active AI cyber defence bollocks and have netflix as a customer. Their Automated Idiot classified our login page as trying to phish netflix.

The fun part of this is that I could have prevented this if I had seen the warning email that Google sent me, but since Gmail classified it as an email phishing attempt, I never saw it (straight to spam folder). How ironic.

Consequences:

- Our website was blocked in all major browsers, not just chrome

- AWS, who also look at the blacklist and were contacted by netcraft automatically, threatened to delete our account. I had to convince both parties that we did nothing wrong

- One week offline
This is a huge security hole. The modified script can be used as a backdoor for all your data and 100% control your computer, because AppleScript can do anything. Probably a legal NSA backdoor that hackers have taken over and a lot of people are in danger. It is not necessary to install pirated software, the download can happen through a hole in the browser. I an old school security researcher, once saw how hacker control a Mac and could turn on/off Wi-Fi, modify files, paint over windows, etc. AppleScript can install new backdoors on the target system with manual control, which allows the hacker to hide his activities by playing along with the victim. Be careful, stay safe.
I think they’re talking about a certain kind of “brutalist UI” that used to exist because it was the only possible UI for very simple systems (e.g. switches to bang bytes into registers to bootstrap a machine; character-oriented VRAM you wrote to directly; two-character Unix commands to save line-printer ink; etc.) and then was carried forward as a sort of tradition by people used to that restrictive minimalism (e.g. modern uses of Forth; C for application programming; shell commands that are non-interactive even when run directly from a PTY; essential config files in arcane formats that aren’t easily machine-generated, under the expectation that people are doing system bring-up by hand, Linux-From-Scratch style; etc.)
For that we have cluster management like kubernetes
"This tool will generate one parity file (plus a file for the recovery blocks) per file that you protect."

Maybe I used it differently: I'd have a collection of dozens or hundreds of files, and if some small portion of those files were missing or corrupt, the recovery would draw on the overall parity files.

With this tool, I might be misreading, but I think if a single file went missing, the recovery files would only be for that single file, so recovery would be impossible.
> Europeans are overly sensitive about "micro-friendliness". I've heard people complain that the cashier at the grocery store asks "How are you doing?". "They don't really care, why do they ask!"

This is more of an expectations thing; certainly in Dutch, asking "how are you doing" is something you do when you ask when you really want to start a conversation, and you expect a somewhat serious reply in return, whereas in some other cultures it essentially just means "hi" with no expectation of a real answer beyond "good" or some such.

When I worked for an Irish company I had some coworkers say "how are ya" when meeting in the hallway or some such; I started replying serious ("yeah, I'm good, last night I [..]") but they didn't really expect an answer so continued walking leaving us both confused; me as they didn't stop, and them as I started a conversation. It led to some awkward-y situations before I figured this out haha

At any rate, I don't think it's "sensitivity", it's just that these words are taken to have a different meaning. These are the kind of subtle things about learning a language; you can know all the words and grammar, but you also need to learn what's meant with them, and that can actually be pretty hard. Translating a simple sentence such as this is easy, but really understanding what's intended (which may differ on the tone of voice, location, context, etc.) is really hard, and even Europeans who speak good English but haven't spent a lot of time in English-speaking countries tend to fail at this (I certainly did) as it's not really something you can learn from communicating in English over text either.
Fujitsu's previous "K" supercomputer was #1 on TOP500 and GREEN500 when it came out. Heck, it was #1 on Green500 for many, many years after its release. K held #1 on HPCG from 2011 through 2018.

Fujitsu just has good tech. Its kind of mysterious since its aimed at the Japanese market instead of the US market, so we don't hear much about it. But its clearly a world-class processor company.
Anyone knows what happens if you include resource from a banned domain? Is the resource blocked, or will the user get red screen too?
No there isn’t.
Yes, it's good to remember that complexity analysis is only a theoretical topic that motivates certain approaches. When performance matters, you measure your program/system and use that as the ultimate guide for your work. Cache locality and branch prediction are two examples of practical issues that the theoretical approach will often ignore.
[I work at Elastic]

can you shoot me an email at markw at elastic dot co and I will see what I can assist with
The biggest problem wouldn't be breaking the chain but the final step of cashing out. A regular exchange requires KYC for large amounts.
Although P2P Crypto/Cash exchanges exist (local{bitcoins, monero}) most simply don't have the volume and still leaves the question of where the money came from.
That makes me wonder if someone has ever written a scientific paper proving that the bureaucratic processes in place at their company are Turing Complete. You can imagine some sort of Rule 110 cellular automaton being implemented in TPS reports.
How do I do GUI in Rust? User interface dialogs.

Can I do linked lists in Rust?

Can I define classes such that:

cInches in1, in2, in3; // basically a float
cCm cm; // basically a float
in1 = in2 + in3; // OK
in1 == 2.f * in2; // OK
in1 = in2 / in3; // compilation error
cm = in1; // compilation error

void foo(cInches in);
foo(cm); // compilation error
from the mod makers pov, circa after they launched in 1999:

https://medium.com/super-jump/building-a-popular-half-life-m...

Mod making was a digital cabal concept, with local leads forming fiefdoms. They were opinionated to a design/delivery. Sometimes straying to other mods, but mostly focusing on one concept at a time.
Obelisk.js: Build pixel isometric graphics with HTML5 canvas
Say you think Tether USD (USDT) is worthless and is being printed willy nilly to prop up the price of Bitcoin. As a corollary, you are basically forced to assume that large exchange owners are aware of this fact because quite simply there is no other way for fraud to happen at such a large scale without their knowledge, since exchanges KYC their customers and are aware of their balances and trade volumes.

So you find an exchange that will allow you to short the BTC/USD (not USDT) pair and take a position. The liquidation price of your short is known to the exchange operators. If your position is large enough to create a problem for the whole scheme, the exchange owners can inform the Tether printers of your liquidation price, which they can use to squeeze you out, because they know exactly how high the price has to be to trigger your margin call.
When the notion of adding walkable spaces and separated cycling lanes to NA cities comes up there's a reflexive brushing aside of the idea, that NA is "not europe" and that cycling simply can't work here.

It's really important to see that the cycling capitals in Europe didn't appear as such fully formed, but it was tough activism that created them from a rejection of the already established status quo of automobile oriented infrastructure.

Accordingly it's clear that it is of course quite possible for NA cities to follow the path of these European cities and create safe cycling and walking infrastructure too.
I wonder when smart TV manufacturers will begin using DNS-over-HTTPS to make it harder for PiHole et al to block their ads.
Ask HN: How to control Alexa devices from a wireless button?
I would like a wireless button to control lights. Ideas?
It's really quite simple. I've been using PCs since Windows 3.1. With "good software", I intuitively know how to use it and how it will behave. Of course, new concepts arrive every now and then, like ribbons or the hamburger menu or whatever. However, what's behind them is in the end still the same.

When I am faced with the challenge of designing an interaction in software, I always try to make it fit established patterns.

Now I'm working with a UX expert. The interaction designs I receive are just not right. They are not intuitive. I am rather disappointed. My impression is that this expert is simply not an expert PC user. Of course, that's N=1 as far as my professional work is concerned.

Furthermore, in the last… 12-15 years, more and more software seems to change just for the sake of change. My personal opinion is that this is because of designers trying to justify their existence.
> completely unable to hear while composing his masterpieces

I'm not sure how true those stories are, but as someone with only some musical experience, I don't find an experienced composer who continued to compose after going deaf that crazy. I can "hear" songs in my head easy enough, and composers are pretty good at transcribing what they hear onto paper.
I keep screenshot of QR Codes, & phrases itself in a separate keypass database.
Could you please help me understand the basis for your point of view? Precisely what evidence are you referring to? For example, the subreddit on it seems quite small... and many of the people I know could benefit from it have never heard of it before.
Can this import from Google Authenticator?
An actor can fail for reasons other than infrastructure issues. i.e.: unhandled exceptions.

In fact, unhandled exceptions are encouraged (i.e.: "let it crash" approach to fault tolerance).
Ethereum is an astoundingly interesting sandbox for blockchain projects and smart contract experimentation.

How it ever got moved to prod is beyond me.
Nice demo. A few things you could add to make this more realistic to something that gets shipped:

-CORS support. Deploy this to a non-local domain and try to reach it from a web browser and it will fail. I like https://github.com/rs/cors. I had rolled my own but then moved to that library.

- input validation. I like go-playground/validator.

The other big issue is the locking by hand around the task store. In reality usually there would be a database to handle concurrent read/writes. I use SQLite in production. I know this is just a demo and you want to use just stdlib, but serializing all data access is sort of unacceptable as a solution in a concurrent language like Go. When I'm not handling concurrency with SQLite I like to implement The actor pattern, having a persistent goroutine listen and respond to "taskstore" requests via channels.
Darrell's one of the most informed voices in SF about transit and housing, too! Just following him on Twitter has been one of the best things I've done in terms of acclimating to local politics in California.
I use it without trouble on mac, windows, and linux. If you are having trouble today or yesterday it might be related to the outage.
I didn't know, thanks!
For us, the choice is time-off award or cash award. To me it's a no-brainer because in terms of hourly pay, the time-off translates to significantly more money. But others struggle to find reasons to take time-off.

Good management knows what people want. Even better management recognizes that someone is burning out and gives the time-off even when they'd prefer cash.

There's a third minor option. Gift certificates for company swag. It's almost never used, because people find it insulting.
While looking up for ZFS ncopies option to see what it actually does I stumbled onto this blog post:

https://jrs-s.net/2016/05/02/zfs-copies-equals-n/

"zfs: copies=n is not a substitute for device redundancy!"
NPCs in Half-Life 2 mentioned a number of times that Gordon doesn’t say much and is a “man of few words.” I’m sure this is a nod to his silence in the first game as much as it’s a storytelling device.

I’ve always liked that his character never said anything—feels like Gordon can be anyone. Same goes for the lack of cutscenes that take control of the player’s camera. You always feel like you’re looking from your own POV vs. being pulled out of the immersion.
> Am I completely misreading this?

I don't think so. If it actually did anything on its face, it would violate the Constitution and and also the explicit safe harbor for moderation in Section 230. It's seems to have been written specifically to avoid hitting the Section 230 moderation safe harbor, so it does nothing. But it provides the sponsor the ability to pretend to be doing something, and to xpoint to having sponsored a bill on the issue in campaign material, while conveniently ignoring that the bill would do nothing at all.

Oh, wait, reading it myself, it gets a bit worse on the “intentionally does nothing" front in Section 1, para. 2: “This section only applies if the
interactive computer service provider:
a. Is immune from civil liability under federal law;”

“We are going to make them civilly liable under state law only if the feds have expressly preempted our ability to do that.” Oh, okay then.

This legislation is purely performative.
Yeah the paper is surprisingly difficult to follow. I had a muncher easier time with this article (https://www.palkeo.com/en/projets/ethereum/bzx.html) and just following the call stack for details.