skysight-inc/HackerNews huggingface dataset:
Perhaps the answer is to make the software itself free and open, but charge for provenance information, to put at least some of the burden on the companies that want it
Climate Change of Culture – How Big Tech Fucked You
People who consistently deliver code and working features usually don't have a problem getting approved to work remotely. That's the case-by-case part. It's the people whose code is buggy or nonexistent and whose features don't work that are stuck in the office.
A few of big tech companies are doing things like this without publicizing it.
This is Chatroulette. Burn the matchmaking algorithms and keep it true random?

For example, if every dating site in existence did this the world would be a better place. Instead, we typically see layers of opaque algorithmic shit governing human interaction. The platform's interests are then in effect prioritized, not the user's.

Did anyone ever stop and think: "Is aggressively matching what we believe to be compatible or like-minded people actually a good thing for society? Is it possible that's actually a pretty terrible thing? Do we even know?"

There's a certain beauty to true randomness in a matchmaking context. It's a fair playing field for everyone. You start using highly imperfect and frankly arbitrary algorithms to govern who matches with who, and suddenly certain people aren't going to meet certain people for reasons they're probably not even aware of.

"Hey, this person could have been your significant other or best friend, but you never met them because some engineers at some tech company decided to get fancy. Fuck you." Or, in so many dating app cases: fancy and greedy.

Every time these algorithms are employed, there's always people that fall into the cracks; the dead zones. There they languish. Perhaps months or years later the algorithm is adjusted and affords them a reprieve. Perhaps never.

---

This isn't meant to be an indictment of Chatroulette. On the contrary, good on them for reporting negative results. Obviously some filtering must be done for a myriad of reasons, such as curbing abuse. Their stated mission is even to match people "At random." They've thought about this problem a lot more than I have.

That said, I thoroughly believe the road to hell is paved by matching users based on metrics such as projected compatibility or similar interests.
A @usairforce C-17 Globemaster III safely transported 823 Afghan citizens
Personally I find code with generics just as easy to read as (largely duplicated) implementations for each type. I might consider Golang again when this drops and there are things to be like about how low level it is…
And of course, AWS.
I wonder what the countermeasures to this are.

If you trained a model to predict the outcome purely from the protected class and it was successful (in terms of predictive power), does that mean fairness is efectively impossible?

e.g. if you trained an educational performance predictor on wealth of parents, then I'd guess it would do reasonably well. And there is the argument that your parents are rich because they're smart and you are genetically connected to them.

But there's obvious counterexamples, like children adopted by rich families or children of refugees (who may have been professors or surgeons in their home country).

So if we can't avoid the bias in that extreme example, then adding extra data is only going to bury that truth under confusion.

I'm not sure we're ready to admit that we disadvantage the children of the poor to ourselves, which will make this whole AI bias thing a tricky conversation to have.
The --cron flag is brilliant, I will definitely try it.
There's no way clicking on a headline would lead to your account being hijacked... Unless there's a browser 0-day which are extremely valuable and no one would waste that on your FB account. Or if clicking the link downloaded malware and you ran the malware.

Did you ever use the password of the FB account anywhere else? You getting phished is also much more likely than a browser 0-day. Did you have a security key on the FB account?
I think they said custom floating point?
I guess the installation via pip is only best effort in the sense that they can't support every platform that pip is able to run on. For example their dependency on the "cryptography" library might cause problems on platforms which can't get a pre-compiled version from PyPi and have to built it from source.

If you are on x86 and use a distribution with glibc I wouldn't expect any problems.
Because if you can do it, any rootkit will be able to do it too.
I don't blame the reporting rather than usual human understanding that never learned how statistics worked.

Someone peed in the ocean and they are draining the entire sea to "fix it". That's not the fault of the pee-er nor even the person who yelled "someone peed". It's the fault of people who didn't understand what that meant before draining some 20% of the matter on earth.

Until that happens, pretty much every single website with user generated content is at risk in some degree.

>Or that OF can't figure out how to verify their creators.

OG does in fact verify every creator. The problem is no company at that scale is going to site down and review every single piece of content they post after that verification which may or may not include other participants that they could not verify. That's what this policy change wants to enforce (which any webmaster would know is prohibitively expensive to do without being Google).
You make explicit that all data that people enter, they enter for purposes of sharing. At the same time, you ban creating profiles with data that has not been explicitly shared. IMO:

- Make a telefone-book style listing, or searching for "all metalheads < 25 near Chicago" where people entered that into their profiles -> OK

- Tracking users on your site -> OK

- Tracking users on third party sites, and then aggregating this data, so you can see "people who searched for baby carrages" or "people who bought diapers with their credit card" -> not OK

- Having some kind of database where people could concievably look up what user tqi purchased, searched, what their political affiliation is (when not made public) -> not OK (unless you have extreme auditibility, four-eye principle, and so on)
This 100%. I had the same thing happen to me (even though I have 2FA everywhere):

https://github.com/Niek/Niek/blob/master/facebook-scam/READM...
Fair enough, but often family members will go to you for advice. So based on your advice, you'll also get the support calls :-)
So there's two scenarios:

Scenario a) No authentication-y bits in the url. User goes to the url, site checks if the user is already logged in via a cookie. If so, does the POST request.

Typically in this case the urls are easily guessable, so that's an easy CSRF. In principle they could be made per-user (some sort of HMAC on a user+timestamp). In practise, I think its fairly common for websites not to do that in this sort of situation.

scenario b) The url contains some sort of nonce, or signed assertion that automatically logs the user in. I think this is fairly common in email urls, because web developers want people to be able to take an action just from clicking the link in the email, even if the device they read email on is not the same as the device they normally use to interact with the application. I also think this is the scenario that applies to this discussion, since it was started around talking about the issues caused by google auto following links, and in scenario A, google auto-following links would not be an issue.

Of course, in principle, its possible that the authentication bits in the url, just authenticate that action, and don't generally log the user in. In practise I think its really common to just generally log the user in, since most sites want people to stay on the site once the user does anything, and not just immediately exit after the email action is completed.

These urls are typically not guessable. A small percentage of users do tend to smatter these across the internet (e.g. https://urlscan.io/), but ignoring that, this is a login-CSRF. That is, an attacker can generate their own such url, and force their victim to log into the attacker's account.

The impact of a login-csrf tend to be very application specific. Sometimes its kind of minor, but I have definitely seen cases in major websites where a login-csrf can lead to a full account take-over of the victim's account.

> Actually if the page can open a popup I think it could also execute JavaScript within the context of the page and perform the user interaction right there.

This is only true if the pop-up has the same origin as the site that opened it. Otherwise there is just a very limited API (Basically, postMessage(). Also both sides can change the current url of the other side, which is a bit nuts). Also there is now a new http header, Cross-Origin-Opener-Policy that affects this.
They could be (and even seem) much more self-evident (and valuable as a tl;dr) if they were one-sentence summaries instead of a copy-paste of a paragraph from the beginning of the linked page.
You’re making it sound like these are the same group of people and they’re just really fickle, whiny and impossible to please. But my memory of these older go/generics threads were that commenters were split between “I love go, I wish it had generics” and “I love go, I don’t think it needs generics”. The former have no need to comment anymore, the latter will still want to express their feelings.
Another pattern I usually encounter is explaining the how but not the why.

Trying to understand how a complex mechanism works is hard, but it’s harder if you don’t know why the mechanism exists in the first place.

It would be madness to start studying how an airplane engine works without knowing it is used to impulse a flying machine.
For anyone who doesn’t get it, https://www.reddit.com/r/rust/comments/5penft/parallelizing_... was a pretty funny workaround.
I'm happy about this and I used to be for Prop 22. After I retired I drove for a year from Aug 2019 to Aug 2020 (I quit because Pandemic.) I didn't work full time, but maybe 20 - 25 hours a week. I did 2000 rides. I had a fun, met a lot of interesting people, and got to drive in many cities in California. I loved the flexibility of the job. However when I added it all up, I netted about $6,000, which works out to about $6/hr or $3 per ride. This includes tips. A lot of people don't tip since when Uber started up they said ppl didn't have to. Now I am of the opinion that the ride share companies should pay closer to a living wage so drivers don't have to practically live in their cars. Not everyone can be retired taking joy rides like I did.
Yeah, definitely some training is needed for that age group. It will be easier for you and me when we grow to be 100+ years old. She clicks on the green symbol that shows a video camera, maybe that helps to recognize. I am sure Google Duo would have an understandable icon as well, so you raise a good point.
I really wonder why typically the default policy is to convert a totp token to a longer lived token (keep browser authorized) defying the whole idea of totp. Used like this it seems like just two passwords or am I missing anything? Phishing seems really easy.
More here: https://news.ycombinator.com/item?id=28241884

Sorry to point out but this has nothing to do with the article which is about semiconductors.
While the article makes some good points, I find the quoting in the article highly problematic and I expect much better from an academic.

There are multiple examples were the sources actually do not say what they are being quoted for, for example the citations about the harmfulness of the perception of race, or the argument on the non exist ant connection between implicit and actual racism (the cited sources say that the test hasn't lived up to scientific standards, which does not necessarily mean that implicit racism doesn't exist). They also compare numbers in different studies to each other which really doesn't work.

I do agree that we need to have a discussion about how we deal with racism and be careful to ever expand its definition, but we should be have this discussion evidence based and not try to resort to strategies of selective quoting.
No way in hell I’m giving my genomic data through CLI to Amazon
Can you tldr it?
>that they can't afford to do the easily-automated paperwork?

if this tweet is true, that's the issue. they don't want just automated paperwork:

>, but review all posted content before publication, including real-time review of livestreams

It's virtually impossible to discriminate criminal content with an algorithm (and extremely hard to even with a human, but I disgress. This policy isn't rooted in logic to begin with), so any non-professional studio is basically being demanded to have some massive team pre-screen every single piece of content before it lands on site. The labor would either be massive and/or they'd have to massively delay how quickly the site can deliver content.

Imagine needing to wait in a queue for 1-4 weeks before a single post can be shown publicly. That's unacceptable in modern websites. And expesnsive in 2 ways.
>larp as mainframe administrator on their home pc

Look buddy i stop here you lack basic knowledge.

HINT: Solaris is not a Mainframe OS, and Haiku is a single user system (aka launch everything as "root/admin"), and now think about it why it's so easy to copy files from one system to another ;)
There's something broken in the American systems of government that seems to elevate shared ignorance to a virtue - voters seem to elect officials that are as ignorant as the voters themselves, trading charisma and confidence for competence.

This seems endemic to every level and branch of government. Some sort of mandatory education or training should be required, like 6 months of classes in civics and 6 months of domain relevant courses directly preceding the year before a candidate takes their office, and frequent refresher courses.

Too many of them aren't even qualified to select a competent advisor in a technical field, let alone make informed decisions.
> Strictly speaking, that's better than the minority opinion becoming law is it not?

There are important exceptions, see "tyranny of the majority."
Tried two times as phone for family member and suggest do not buy them. Garbage-level plastic, buggy software and dying fast battery.

Maybe 8110 4G & GerdaOS is a good choice, but I'll ignore KaiOS in general.
Could be more efficient than BF16?
WP says, "The second is defined as being equal to the time duration of 9,192,631,770 periods of the radiation corresponding to the transition between the two hyperfine levels of the fundamental unperturbed ground-state of the caesium-133 atom." I don't see an oscillation frequency in there; rather, I see a number of periods of a particular color of light.

Now, normally we do specify colors of light as frequencies in just the way you say, some number of oscillations per second (unless those frequencies are higher than about 10 GHz), but we can't do that in this case, because it would make the definition circular in just the way you say. Instead, the color of light in question is specified in terms of a quantum-physical phenomenon that produces a very precise color. The cesium-133 atom doesn't need to look at a clock to see how fast to resonate. If archaeologists from the planet Plarx land on Earth in the 37th century and are trying to figure out how our culture measured time, and this comment is all that remains from our society, well, all they need to do is build a cesium maser and hook it up to a circuit that counts to 9,192,631,770. (Actually, probably someone on Plarx has already published the spectrum of cesium, so they can just see that the oscillation period of its hyperfine transition corresponds to 0.000000038134825 of their zorps, and then they know that a "second" is 350.5594 zorps long.)

We used to do the same thing with the meter: "1650763.73 wavelengths of the orange-red emission line in the electromagnetic spectrum of the krypton-86 atom in a vacuum." Usually we give wavelengths in terms of the meter, but in this case we're giving the meter in terms of wavelengths. That's because the wavelength is a physically existing, objective phenomenon, which can be measured by anyone. Now, instead, the meter is defined in terms of the second: a meter is defined as the distance light travels in a vacuum 299,792,458 times in a second. So the Plarxian archaeologists will have to figure out what a "second" is first, if they're working from that definition.
But you disable SIP while booted in recover mode. Somehow Apple needs to do this anytime the system is updated.
> Go is still pretty “simple”. They didn’t introduce a while loop.

What are you talking about? There is already a while loop, it's just under a different name. I don't think reusing keywords for other purposes is an example of simplicity.
Which generally won't be noticed but it depends on the site. I'm not saying it isn't an issue just that I wouldn't call it a bug. Certainly not something so bad that it would turn you away from web dev. I mean we even have the tooling to track it down fairly easily
My employer has not moved on and it’s steadily encroaching more even on strong Scala/Java teams, so I’m glad to see the worst impediments start getting fixed.
> What do our apps do with all that compute? Detailed convincing AR, accurate real-time translation, identify almost any object in sight, turing-test passing answering machine. We'll be carrying around neural-net training hardware

Or more likely they'll spend the compute power on the latest JavaScript framework....
The thing about collective bargaining is that it's collective and a strategy to help yourself, and even when it's a stand to help some other union, it's to help strengthen unions in general, which helps your own Union, and those your own bargaining power.

Oh, and it's all done under a group to make help avoid consequences.

All sane choices to make, but not exactly what I meant to convey by taking a stand on moral or ethical convictions. I more meant being willing to deal with the consequences when you don't really have enough power to force that change. I wasn't trying to paint Google employees as overly noble, just somewhat that and also priveleged and naive. And of course that's just my perception from the outside.
That way you end up with the same issues as we have now with SIM swapping: Post Office employees are not more reliable and not necessarily more careful with their credentials than people who can give you a new SIM card.
Long time ago I saw an audio analog to digital converter where the resolution was 22 bits or something. But the accuracy was 0.5% or something.
Language flamewars on internet forums are... strange.

Why have we all so strongly coupled our identities as programmers to the language we use? Sense of community and a perceived need to defend it?

I don't think Go needs generics, but I'm not about to invent obscure edge cases to justify for/against the idea. That's a recurring theme in all defenses of any language. It's not helpful.

Use Go if you like the "clarity", stay away from it if you don't like the "verbosity".

These are both valid points, but they're subjective. Pushing it as fact is dishonest and self-serving, as well as eventually detrimental.
Don't they pass the costs of the charge back onto their merchants?
Why do you think models are neutral mirrors of the test data? That seems unlikely.

I thought they were arguing that models can be designed (intentionally or unintentionally) to amplify or dampen biased data.

The metaphor is like "overfitting". You can extract too much from the data and make it bad for data not in your test set.

So is an overfitted model a neutral mirror and also one that's not overfitted also a neutral mirror? That seems odd if they put emphasis on different parts of the data. And we generally try to avoid overfitting don't we? Isn't that an algorithmic choice 'biasing' towards data we haven't included in our initial data?
And kids under 12 not having access to vaccine. Once that is in place I personally think it’s time to go UK and figure out what this looks like long term.

I wonder if insurance companies will have different rates for people who choose to forgo essential vaccinations in the future.
Not many, but it just takes a few of the "right" people who know how to pull the strings: https://www.institutionalinvestor.com/article/b1s9f698vwhczr...
Data from Israel shows that a third pfeizer dose is highly effective against delta.
Google Pay is the most popular payment system in India, a country of 1,400,000,000 people.
Yesterday I spent 2 hours on the phone remotely installing my software on a user's machine.
That seems above-and-beyond expectations but, hey, it is easier than trying to debug through email. And I now have a very happy user.

But requiring a security review is a bit much. I did security reviews for a living. The consulting company was paid $250/hour for my work for the client. When open source pays me $250/hour I'll do a security review. They are hard, they are subtle, and they require you to be "up to speed" on the latest, greatest, CVE announcements. You did read, understand, and are able to find the Qualcomm hole, right?. You do know how to find an attack against your software that is embedded in the hard drive controller, right? Keeping up with the flood of attacks is REALLY a full time job. I don't have the time to keep up anymore.

As for "legal notice in every file"... no. The license is included with the source. If you choose to ignore it or copy single files (allowed by my license but...) or any other circumvention then that's your problem, not mine. I gave the code away.

As for legal issues... I've studied copyright and trademark issues. I've had discussions with an IP lawyer. I know "all the words". But being my own IP lawyer is a fools idea. IP law is at least as complex as my program and subject to a lot of side-conditions as well as site-issues (aka courtrooms). Did you remember to include a severability clause?
(In law, severability refers to a provision in a contract or piece of legislation which states that if some of the terms are held to be illegal or otherwise unenforceable, the remainder should still apply.) No? Well, then ANY part of your legal claim throws out ALL of your legal claim. Unless you have a law degree AND specialize in IP law, you don't know what you're talking about. Oh, and lawyers charge big bucks which you won't earn in open source. So, no, I'm not gonna be my own IP lawyer.

"Software does not live up to security review and legal standards"... issue closed. won't fix.
two points and no comments doesnt count as a duplicate on HN, so please don't point cases like that out. https://news.ycombinator.com/newsfaq.html
As for why the parent render tree invalidation is necessary, consider

<style>
main:only-child * { /* ... */ }
</style>
<body>
<main>lots of stuff </main>
</body>

When second node is appended to <body> our CSS selector no longer matches so the rule stops being applied and content of the <main> is no longer styled.

When there is (next) sibling wrapper present, anything what happens inside it cannot affect the <main> in our example: in CSS there simply is currently no way to target element according it's next sibling inner structure. (There is one for previous sibling: `prev:empty + next {}`: when prev stops being empty, rule stops to match.)