skysight-inc/HackerNews huggingface dataset:
One example that is in my wheelhouse was illustrative of the not-always-clever attitude of OpenBSD to security.

If you need certificates from the Web PKI (for your SMTP server, or your IRC server, or any other TLS server, but most obviously your web server) you likely want to talk ACME to Let's Encrypt or another CA.

The popular way to do this is Certbot, a program written in Python. Clearly that's a lot of dependencies and thus potential attack surface area so not ideal.

A popular alternative is acme.sh which is Unix shell code. So this is potentially a far smaller attack surface but shell is hardly the most auditable or secure language by default...

OpenBSD ships acme-client which is written in C.

Now, acme-client uses lots of OpenBSD flavour tooling to improve on its security, components of acme-client are sandboxed off from themselves and the rest of the system using pledge() and so on such that components with access to your private keys are not also doing TCP/IP. On the surface then although it's written in an unsafe language this looks like a good trade and it exactly fits OpenBSD's approach.

However, the thing about ACME is it's built out of existing standard components such as Certificate Signing Requests. So instead of attack surface in Python, or Bash, or C, and trying to mitigate it with local sandboxing, you can choose to hand the CSRs to a completely separate system and so to literally airgap your private keys and all the TLS server code from your ACME implementation if you want.

You can use CSRs with Certbot, you can use CSRs with acme.sh, but, they aren't an option with OpenBSD's acme-client at all.

acme-client is the Beast so that a US President can be driven somewhere very dangerous and most likely get out of there alive - but just using CSRs is having him just make a video call and never leave the safety of the Oval Office.
Sorry, I mean antibiotics. Specifically Azithromycin.
Your example matches the _text_, semgrep matches _the language_

given:

if 1 \
== \
1:
pass

then

$ semgrep -e '$X == $X' -l python
1:if 1 \
2: == \
3: 1:
ran 1 rules on 1 files: 1 findings

to follow myself up, one can also check for expressions like what I used as an example and say "don't do that", but without regard to what is inside the if

semgrep -e $'if ...:\n pass\n' -l python
On the flip side, there are plenty of countries that do just have a national police force, or a handful of regional departments, and don't have tens of thousands of independent police forces like America does. They tend to do just fine.
Informix has its "push data" feature - except it appears to be limited to a single table, not complex queries - I suspect you're right, it's hard to do safely and efficiently.

https://www.ibm.com/docs/en/informix-servers/14.10/14.10?top...
That’s true but when you host a website, you can decide what types of files can be uploaded. With this sort of decentralized storage network, people will include whatever files they want. And to put a finer point on it, no doubt some significant portion of the file content will be horrifying video content, some of which will be illegal. My question is more around the liability for that, even if it is encrypted and the miner doesn’t know what it is.

A small filecoin operation would not have the legal funds to defend against an aggressive prosecutor trying to “take down a network of dangerous pornographers” and would get little sympathy from a general public that doesn’t understand the tech.

Until there is strong legal precedent, I wouldn’t entertain a mining operation. Maybe I’m paranoid but it just doesn’t seem worth the risk.
Yes simtel20 just said that. Hopefully it is what they meant.

Either way I am now responsible for protecting GitHub's CI resources and I don't particularly like it; I'll do it if I must (after all GitHub is generously providing them for free) but I think the post's title is a bit dishonest.
Wouldn't have minded seeing a verbal battering either. In my mind it's just a poor (and unethically done) choice of research project in any case. From what I gleaned it amounted to testing their QA process/response, which doesn't seem like a particularly interesting research project. NSA have probably thoroughly tested that out anyway.
Easy Ways to Reduce Your Carbon Footprint with Technology
Yes, this is fairly normal.

I work for a big company that has a reputation for doing the right thing, which might have been true in the past but doesn't seem to apply now. I have seen them change grade structures, change promotion amounts, and change the pay/bonus structure all to the employees detriment. They always try to put some positive spin on it. I remember I brought up the topic of a raise with one boss because I was low in the pay scale for that grade. His response was that this was a good thing because it gave me room to grow. Seriously? I'd rather be near the top of the scale and not grow very much. Same thing for when we used to be able to count on 3 10% promotions but then they changed it to 4 7% promotions to get to similar compensation (it's actually below because the bonus isn't as good, not to mention it takes years longer to hit that 4th level).
I am not familiar with The Hill, but the segment posted here did not seem to me to be biased one way or the other. Did you find there was something that leaned right/conservative in this specific video?
> A builder also doesn't get paid directly to maintain his toolset, that cost is included in how he charges for his services

Of course. That's not a problem, because the toolset isn't the builder's product. Their customers don't care about the toolset, they actually want the service. Conversely, most consumer software users don't want or need your services, they just need the software.

Moreover, that toolset you mentioned belongs to that builder only. It's not a resource shared by all the builders in the world, unlike open source software.

It's not surprising that people pontificating about the morality of copyleft vs proprietary don't even seem to understand the basic economic effects of shared ownership like the tragedy of the commons.
I was referring to the claim made in the README's section: "Every file that could possibly exist?", which is written as if it's a proven statement:

> That's right! Every file you've ever created, or anyone else has created or will create! Copyright infringement? It's just a few digits of π! They were always there!

But yes, after you mentioned it, I see that the conjecture disclaimer is mentioned in a section at top ("What does π have to do with my data?") and afterwards the fact is assumed as true in rest of the README.
I see. But how do I verify that 99.9%? Aren't the distributed services anonymous?
Instead, you'll have the pleasure of living under what amounts to a ubiquitous-surveillance dictatorship.

What, you think surviving under those conditions will work like a Heinlein novel?
HN despises the truth.
The "little tokyo" neighborhood of a large North American city would probably be a comfortable place.
The canonical (-C) output for BSD hexdump(1) formats data like this:

00000000 54 68 65 20 71 75 69 63 6b 20 62 72 6f 77 6e 20 |The quick brown |
00000010 66 6f 78 20 6a 75 6d 70 73 20 6f 76 65 72 20 74 |fox jumps over t|
00000020 68 65 20 6c 61 7a 79 20 64 6f 67 |he lazy dog|

This is also a common default format for many hex editors.

The visual representation columns--which display all isgraph(3) ASCII values as their ASCII character, and every other 8-bit value as "."--could be interpreted by lay readers as a margin that decodes the octal and hexadecimal values which take up the 4/5ths of the 78-column display.
The Ars headline is: “Consumer Reports shows Tesla Autopilot works with no one in the driver’s seat”

That is misinformation. Facebook and Twitter have flagged articles for much less, because they felt the headlines were misleading or incomplete.
They're like the raspberry pi's of OS's, great to tinker with and great to use if you have a use case that fits it. The main focus of OpenBSD's security seems to be a low attack surface and slower adoption of certain things. The network stack is still single-threaded for example. It's great for a home firewall but their philosophy is pretty paranoid and slow moving to the point where they're great for what they are but not very useful in any actual commercial data centers.
replicators tho. makes a huge difference.

we're headed away from UFP and more towards DOOP.
Digg: Six Feet Under [video]
Haskell (Warp HTTP server w/ WAI middleware, Selda with SQLite or Postgresql, blaze-html for templating).

I try and avoid JavaScript but if I use it I usually write vanilla JS and avoid package managers and build pipelines.
> But then you trust other people to even accept your Dai. There are literally thousands of cryptocurrencies. How many of them are at all viable (for any definition of viable)?

Dai can be exchanged 24/7 without a counter-party, with deep liquidity, on a variety of decentralized exchanges and mechanisms: Uniswap, Curve, Sushiswap, 0x, 1inch, and others. You can see and understand liquidity, volatility, emission schedules, and code transparently on-chain. You can't do this in the traditional system.

> Just like you have to trust the gazillion bitcoin exchanges.

It sounds like you might be impressed by the decentralized exchanges I mentioned earlier.

You can exchange any crypto asset — "viable" or not — for any other, at a market rate, without a counter-party, and then liquidate the "more viable" asset via one of many exchanges or off-ramps. You have a lot of control over the risks you take.
Some other details from spelunking the code base...

The exposed console functionality interface can be found via `hl_console`, `usesys` & `usegl` references:

* https://github.com/HaxeFoundation/hashlink/search?q=hl_conso...

* https://github.com/HeapsIO/heaps/search?q=usesys&type=code

* https://github.com/HeapsIO/heaps/search?q=usegl&type=code

The "interesting" pieces are all in some other codebase, e.g.:

* https://github.com/HaxeFoundation/hashlink/blob/4c4de37d49cf...

* https://github.com/HaxeFoundation/hashlink/blob/4c4de37d49cf...

And, if you're a weirdo like me that likes trawling for small console development details (e.g. they treated as ~BSD system) in the code base check out these:

* https://github.com/HeapsIO/heaps/pull/491 (fixes for Nintendo "NVN")

* https://github.com/HaxeFoundation/hashlink/commit/7af111a38f... (PlayStation related naming becomes generic "console" naming)

* https://github.com/HeapsIO/heaps/commit/0daba3517a7193566cd0... (More specific console -> generic changes)

* https://github.com/HaxeFoundation/hashlink/blob/4c4de37d49cf... (Console brand specific defines)

* https://github.com/HeapsIO/heaps/pull/349

I guess it's all sufficiently vague to not break any NDAs. :)

I think my curiosity is now satisfied. :D
At some point I imagine the best thing we could do, besides ignorethem, is to send weapons. Have the CIA arrange gun and bomb smuggling operations; airdrop rifles and ammunition and rations if needed. Give the people an opportunity to revolt and if they choose not to then let them live the life they want.
The woman sounds remarkable. The biography should be called The Devil in Miss Jones.
It's actually possible that the NK hackers are taking blame on behalf of CCP. Would take too long to explain fully. Just imagine NK as a "blame proxy" for CCP when it comes to the edgiest operations
There was the timber hauling truck converted into an ICBM launcher. With the deforestation apparently happening in North Korea it probably wasn't the best thing to sell them regardless.

https://www.reuters.com/article/us-northkorea-missiles-china...
Life in prison is already a threat of force. The force is that they're forced to stay in prison.
This kind of justification for the North Korean embargo is disgusting. The world is inflicting poverty upon this people to punish the government for the grave sin of not bowing to US hegemony.
Materialize definitely looks interesting. I'd have a few questions regarding the current product:

Does Materialize provide a commercial non-cloud version where workers can run on multiple nodes in a cluster? On the website I only see references to the BSL-licensed single-node version and to the cloud version that is hosted at Materialize. Would a company be able to run Materialize on their own Kubernetes cluster?

Also is it possible to add custom code for data sources (for example Kafka, but with a different format than what Materialize currently expects) or is Materialize limited to the pre-defined sources?
No worries dang, mistakes happen :P.
I am. The price target is in-line with the Flow Hive.
You might be interested in this for your M1 MBA: https://github.com/apple/tensorflow_macos
Mario 64 in the Browser
The last time this came up I noticed and commented on the same thing. It's a bad sign that it's still unresolved...
It's interesting that OpenBSD's security reputation is such an article of faith that this comment is light-grey now. I get that it's not supremely substantive, but "OpenBSD's security is overrated" is not a controversial statement in the software security community. They built their reputation on the 1990s OpenBSD security audit, which was a real innovation, but one that every other mainstream operating system has since picked up. Linux probably gets substantially more audit attention now than OpenBSD does, and is quicker and more open to deploying kernel countermeasures. I'd probably trust a minimal Linux distro with a decent kernel configuration more than I trust OpenBSD.

Later

The comment I'm responding to isn't light grey anymore; the perils of flouting the guidelines and talking about downvotes! I wasn't objecting to the votes, though, just noting that the C.W. on HN seems different than in specialized security communities.
I hope so, and appreciate the advice and kind words!
https://github.com/returntocorp/ocaml-tree-sitter/blob/maste... appears to be the general answer to your question, but navigating to the tree-sitter docs shows that tree-sitter has one in progress: https://github.com/tree-sitter/tree-sitter-swift so hopefully the machinery to incorporate it into semgrep will not be horrific
This has been happening very frequently since end of 2020, see https://news.ycombinator.com/item?id=26357047
Mumbai is a great city, no doubt. Actually, I was staying there for some time to enjoy the views, but it became boring quick. This made me read https://www.beyondthecharter.com/luvcougar-review.html and learn about dating websites to find some hot ladies I could spend some time with. I ended up using them even for finding real relationships after the success I had during my first experience.
If you beat the market it is by luck. If there was a system everyone would use it, and then that would be the market.
> It is very tricky to define art. But we're better off engaging with the people who tried to answer that question and building on their work instead of the people who refused to answer at all

I’m not sure that’s true, because I’m really of the belief that trying to find a strict classification is a mistake — even if we find something that works 90% of the time, we haven’t actually learned anything, and we can’t use it for anything useful anyways. Like finding the definition of a chair, it’s only useful for, well, classification systems, and things that depend on classification systems (eg taxes). But this is largely self-serving, and meaningless to us as non-users of those systems. At best, it helps us in conversation, but I’m not of the belief that the definition of “art” does even that much.

When a urinal can take on all the same “artistic” properties of a painting (including value, meaning, etc) it should be immediately clear there is no strict, solid definition to find. Especially when we consider that it does clearly change over time, and things considered art today (say abstract art) where not considered art yesterday (eg to the Greeks, or even the artistic community of its time)

As such, the question itself is wrong — and those who attempt a strict definition are inevitably struggling with a futile endeavor.

It’s not simply tricky to define art — it is both meaningless and impossible. Perhaps at best, it can be defined within a context — [ object-instance under question + time + (sub)culture ] together may produce something of substance.

> I can use my shoe to hammer a nail into a wall but my shoe is a shoe, not a hammer

A rock is a rock, but when I put a sufficiently large rock next to a dining table and sit on it, it’s also a chair. A rock is a rock, until I beat you over the head with it, and now it’s a deadly weapon in the court of law; in another conversation it remains a humble rock; in yet another, a particular composition of minerals; in one more, an art installation [0].

And notably, all of these things can be true of our simple rock simultaneously

From a programming perspective: OOP modeling can get awkward, because it models objects as having certain properties and capabilities. When those definitions change, everything goes with it.

Relational databases tends be more consistent, because it takes the inverse view: a set of properties exist. The composition of those properties happens to produce an object. A different composition produces a different object. These compositions give rise to the set of capabilities

That is, there are many ways to interpret the underlying data. Your business logic is just making various choices with how to do so

[0] https://d7hftxdivxxvm.cloudfront.net/?resize_to=width&src=ht...
Is your RSU being swapped for cash?
Contrary to other replies, this is not remotely normal. Make sure you aren't misunderstanding the terms of your offer: some companies will say $x dollars worth of stock, with stock price determined by e.g. a 90-day running average. If there's a clause like that, and the stock went up so much since you joined (or signed the offer letter, depending on the terms) that the average price over the last 90 (or whatever) days is 2x higher than it was initially, then there's nothing shady going on.

If they didn't specify how they're determining a stock price to derive a # of shares from, or if they actually specified a number of shares rather than a dollar amount, then no, that's not normal. Get out and go somewhere else that doesn't play stupid games.
Yeah, a lot of people have been saying that on the pinned mega-issue re the future of TypeORM - but the maintainer doesn't seem to have done much to fundraise nor pass on leadership to others. This seems to be moving slightly - some contributions are slowly trickling in. But at this point I think alternatives like Prisma will just eat the pie.
I hope this is stopped. If not, after-school programs like Russian School of Math will see increased enrollment from parents who are not satisfied with public school math. My 3 children attended RSM.
So they are building LISP inside Excel.... It is now a corollary of Greenspun's Tenth Rule of Programming...
I’m not sure how you’d distinguish the conclusions drawn from this paper from the hypothesis that the newer languages implement newer concepts in a more useful/ergonomic fashion.
RSUs are a way for companies to mitigate compensation risk. When times are bad and the stock is down, so is your pay. It comes as the cost of higher compensation when times are good.

I do not think this is normal and appropriate. The board would have no problem paying you less if the stock declined.

Management that goes back on its agreements is not a management that you want to work for.
The terms were very clear..30 day avg for $x worth of stock so it was very easy to calculate what it shuld have been..

they changed the avg in their favor afterwards bc we joined on covid dip..
Does incompetence and failure bear on intent? I don't think that usually flies in court.
PipelineDB might be of interest. https://github.com/pipelinedb/pipelinedb
I think you meant from TypeORM to Prisma
I have a BS in Computer Science and whenever I help people pick up programming I notice scope is always one of the toughest concepts for them to grasp.

It could of course be a reflection of my teaching ability, but it always seems to be a tough one.
> If you crushed an acorn did you destroy a tree?

you destroyed something that had the potential of becoming a tree. Not really sure why you want to separate these out into two distinct entities. What would you consider an acron that sprouted a stem and a leaf? A tree or an acron?
I think most people would see that an acron is still the same living being, just a different configuration of cells in a transitionary state to becoming a tree.

You are a distinct collection of cells.
As opposed to your neighbour, who is also a distinct collection of cells, which is different from you. Every one of your cells is different than his cells, for one, because they all have different DNA than your cell's DNA.

Its fine to claim that you only exist in the present moment. But to deny that your past self also existed for you to exist now, seems a little discontinuous and meta physical.

Also at what time scale does your past self not exist. Since your perceptions are time delayed. You might stub your toe, but it will take a split second for your brain to notice.
no..essentially it magically disappeared in the name of "fairness"..I wasnt the only one effected..
The fact it is integrated and insulated with seals, is inline with studies that show the benefits of an insulated hive with the added value of real time statistics through the sensors direct to your phone or computer via a cellular connection on each hive. When we were considering the development of the product, I reverse engineered the cost to benefit ratio with a Cost of Ownership that considers all aspects of a hive and the HH comes in less expensive after 2 years than a standard uninsulated hive.
> the only thing you really need to worry about is the correct student taking the exam

Which is the hard problem these solutions try to address, because even if the correct student is sitting in front of the computer, that doesn't mean he isn't just proxying the questions and answers to someone else (possibly paid).
I'll bite :) No people don't celebrate it, but many recognise it as a meaningful opportunity to engage with conservation efforts. No bureaucrats, taxation or red tape to see here.
I'm not sure I would call this relatively easy even without joins. Without joins Google Cloud Firestore does exactly what you're describing. The initial query runs against the DB then the client gets a filtered stream of updates to only that query. Its distributed and scales logarithmically with the number of queries, as it doesn't need to keep the query results in memory/materialized.

The fun part of this problem is that it's really inverted from most traditional database literature out there. Mostly the problem is you have a query and need to find the matching rows. To make updates efficient you need to do this the other way around - if there is a row (that has changed) find all the matching queries.

With joins (or any data dependant query where you can't tell a row is in the result set without looking at other data) you need to keep the query results materialized otherwise you can't have enough information without going back to disk or keeping everything in memory, which isn't really feasible in most cases.

Source: I worked on Google Cloud Firestore from it's launch until 2020 and was the on responsible for the current implementation and data structures of how changes get broadcasted to subscribed queries.
Thank you much for this incredibly detailed and thoughtful answer!
Exactly. How come the sins of all US allies are washed away but ruin is imposed upon countries that don't join the US-Europe political block. First you impose sanctions to make people suffer and then point to this and say how cruel their leaders are. Saddam was an ally and did nothing wrong, then he was not and he became a tyrant.