skysight-inc/HackerNews huggingface dataset:
People always talk about how asymmetrical the attack surface is, and I don't disagree with this in principle. However, most companies don't do a lot of the basics: Segment networks, keeps applications and software up to date, keep admin or management interfaces unavailable.

The biggest step that I think most companies could benefit from without drastically increasing their cybersecurity spending would simply be to attempt to deploy and use less software and fewer services. Each new piece of software is just waiting to be exploited, waiting to be out of date and forgotten. It'll become part of someone's "necessary" workflow, but it will never be important enough that it's simply kept up to date and managed well. If that software were never there in the first place, the business would simply use some other workflow process, and there would be nothing to be forgotten and exploited.
My sample size of three large companies, two use Slack. Boom.

(I did move the goalposts from "deployment size" to "quality").
Considering fraud is a crime, yes.
but security is associated with free and open source software. i think this is a common position of a vast majority of security experts. to make your claim that FSF deceives or misleads people you need to do a LOT more. for example, can you provide an example where someone claims that GNU Guix is secure by design[0]

i think that taking a position that free software supports security and also that free software principles come before security considerations is not contradictory let alone deceptive

[0]EDIT: i just searched the RYF site and did not obtain a signle result for the term 'security'

https://ryf.fsf.org/search/node?keys=security
I can see the argument, but we didn't like it for humans either.
My ground floor apartment has thin laminate flooring over low quality planks over the freezing void below. This floor is very cold in the winter. Noise from above isn't great either. Not recommended.
Experts tend to be specialists, focused on silos and deep dives into specific domains.

The world is instead getting radically interconnected as "everything" is represented - more or less faithfully - by fungible bits. We are going through an "anti-specialization" phase, where everything is in principle connected to everything.

This amorphous digital ocean phase will probably not last, but it might be decades before a new landscape has settled.
Does your Samsung TV handle DTS audio? Mine doesn't, just curious.
Where is the function is_halting() ?
This is like carrying a thick wallet with every card you might ever need. It's logistically advantageous, but most of the time it just gives you back pain (thick wallets in back pockets mess up posture). You can do what works for you! But I like to stash fail-safe keys in strategic places, like a house key in the car, and a car key in the house.

By "physical, metal key" I'm just disambiguating between key fobs, key cards, phone-keys, and tumbler keys.
You still have to look at the screen to change them, which is especially ridiculous considering you're likely only to use wipers during inclement conditions when your eyes need to be on the road the most.

From my experience, most Tesla apologists do not have a good frame of reference for what other manufacturers offer in the same price point. It's usually their first car that was not an economy car/base model. Of course a Model S is going to feel like the greatest car on the planet if you've only been driving Camry's or whatever. There are so many nuances of experiencing a car that they just don't understand and have no interest in, because when it comes down to it they like the tech experience Tesla provides, not the experience of driving a car.
I think your first paragraph is bogus for two reasons, which I’ll leave at the end[1] because I’d rather respond to you main point than the silly reactionary thing you wrote at the top.

I feel like you aren’t really responding to the claim that having good security is extremely hard and expensive and that it seems bad for every company to have to spend a lot of money on a problem which is likely far from their core competency.

The thing you’re actually asking for is for a lot of businesses to go bankrupt trying to be perfect at something that is not their traditional domain and then you make some claim that they have the audacity to try to create value for their shareholders instead? Isn’t it outrageous that companies might try to do literally the thing companies are meant to do instead of being experts in computer security.

I suppose you would counter that it is easy or cheap or imperative for them to be secure but, in the world where hacking is relatively easy, cheap, and profitable ($1-10mm sounds like a lot to a person but not to a country or reasonably sized business) and there are myriad ways to make trivial-seeming configuration errors in software that leave you open to attack, I think it is neither easy nor cheap. And frankly I think it is not imperative for businesses either because their purpose is to make money and while cybersecurity is an important risk to worry about, they can only invest in it so long as they are making money from the thing they are actually meant to be good at.

[1] regarding the first graf:

1. Mostly small errors by engineers or doctors or pilots are… small errors. Bridges won’t collapse if the concrete was mixed slightly too wet, and bigger cracks are usually noticed and mitigated in good time. Doctors get dosages wrong all the time (which is why there are attempts to train nurses to question everything the doctors say) and while malpractice is definitely a thing, there are lots of cases where things go wrong at a small scale and are either fixed or unnoticed. If you ever ask a doctor about this in a social setting they will probably have plenty of examples. And if you get something wrong in a plane you are unlikely to immediately crash. Even landings can be aborted quite late. Big planes crash very infrequently and I think it is silly to therefore assume that the pilots are generally infallible. So I claim that your direct statement that these are not allowed is false.

2. I also claim the analogy is bad because the examples you give are not adversarial. The patients are generally not trying to trick their doctor into making the wrong prescription and Athena geography isn’t going to shift and change to try to exploit weaknesses in the bridge built across it. The pilot flies high above the ground with separation from other planes and various safety systems. Even in an unlikely event like an engine stall, there are possibilities to recover. In computer security the threats are fast and numerous so any small error can be quickly magnified.
Serious question:
How was the drive? I'm in Texas and I like to drive to Orlando. Did you have to change your driving style much from do it in an EV?
> “Don’t buy stocks when the P/E ratio is over 20” was a good lesson to learn from the 1970s when interest rates were 7%, the Fed hadn’t yet learned what it’s capable of, and most businesses were cyclical manufacturing companies vs. asset-light digital services. Is it relevant today? At a broad, philosophical level, yes. In practical terms, probably not. In the same sense, buying stocks at all seemed like nothing but speculation in the 1920s because corporate disclosures were so opaque. By the 1970s that had changed, and you could begin to make rational, calculated long-term decisions that put the odds in your favor.

The funny thing is that exactly this kind of talk was all the rage leading up to both the 2000 and 2008 crashes. The boom makes it impossible to imagine what the bust will look like, and vice versa. Most people are utterly incapable of seeing 180 degrees through the business cycle. They simply can't do it and rather extrapolate current conditions to infinity.

This is a big part of boom/bust cycles. They are spaced out by just enough to entice a new group of greenhorns who ever more loudly beat the new paradigm drum. Then this new class learns that the business cycle is in fact immortal. But for many, it's a short-lived lesson.

And that part about making "rational, calculated long-term decisions" is amusing. Because it's during the boom that companies start to engage in accounting shenanigans. The book-cooking will all come out in the next bust, just like it always has. 100x + price-to-earnings multiples will cover a multitude of sins.

As Warren Buffet allegedly said, it's only when the tide goes out that you find out who's been swimming naked.
I was going to make the same point, more generally about electronic music gear.

People greatly favor knob-per-function and minimal menu diving. Having some kind of screen and minimal menus for rarely used features is fine, too, but anything that’s about playability and something you want to tweak in real time needs a knob or slider interface.
Visualising the 300M instructions of Hello World
It feels like they're really desperate to make their services ecosystem a thing, despite no one ever asking for it. But then services are the one area where it's possible to make shitloads of money out of thin air via recurring payments in a way that doesn't offend the users ("I'm using disk space on their servers and it needs to be paid for"). Locking people into these kinds of walled-garden services must also help somewhat with hardware sales.

Regarding the ports on macbooks, IMO it's just that Ive left and so everyone was allowed to design practical devices again, instead of admirable but impractical art pieces.
Milton Friedman was a supporter of taxes on pollutants. He recognized that negative externalities are a case where government intervention is needed, and thought Pigovian taxes were the best way for government to do that. Were he alive today he'd be advocating carbon taxes.
We’ve already made computer systems so complex we don’t know precisely how they work. Alpha Zero or GPT-3 for example.
Apparently their next version will be ready for desktop use, they just need to add some super basic features (pin-to-top?) to their WM and they're there. Next year could finally be the year they're ready for Windows to be good on desktops!
Although many people are laughing, I believe the function works ok. The only complicated part is to find a way to call it when the computer is not on.
?

Yes, being ordered and gagged by the US government is coercion. Are you familiar with the article you linked to?
in time spent charging. it is in the article
Teslas require AC when parked in some year ranges because they didn't use automotive-grade touchscreens (which began delaminating). This then apparently started making some accumulate mold in the AC system somehow.
> Most people don’t see the large impact differences of actions they undertake in they everyday life (North)

Anyone ever used the app Joro [1]? It calculates your carbon footprint based on your credit card transactions (via Plaid integration) and provides convenient ways to offset. I've been on it for a few months and it's had a huge impact by way of behavioral nudges. Also, the carbon calculations are surprisingly solid.

[1] https://www.joro.app/
This will take care of those pesky yardsticks that provide evidence of admissions scandals. They can justify admitting anyone.
I know it's not as common anymore but if the computer is in a "hold and catch fire" incident it won't report temperature sensor readings. What happens? Is it considered off?
Probably because of how incredibly unimportant it is to the vast majority of people?
PSD2 only took effect in 2019, and for many countries the enforcement was delayed for card payments up to a full year due to lack of issuer readiness.

2FA is absolutely the future and I believe globally payments should move in this direction… I’m just pointing out that even in Europe, this has not been the standard for all that long. That said I hope other countries/regions follow the example — the EEA seems to lead the charge on major online issues, e.g. payments and privacy.
Odd they have a TI 99/4a platform but no TMS990 CPU.
NFT would be better explained if they used the older word: certificate.

But if we called NFT's 'certificates,' then less would buy into the Tulip mania.

NFT's are just a digest of certificates, public/private key pairs, and a chain of hashes.

If Lebron James put out a limited run digital model of himself, a set of hashes and schema describing the signatures, and released the certificates for purchase on Nike.com,then all the legal, authorized implementers, such as Fortnite, CS:Go, Roblox, and Halo:Infinite could all render the model, respect the ownership (or lack therof) by validating the account and object's cryptographic digest (comparing against a global ownership ledger), and allow free, unrestricted, cross-domain/platform/Intellectual property boundary transfership and use, aligning with meatspace laws...

...all without calling it an NFT.
>A teenager can do these attacks. Quit using boogeyman as excuses.

This is exactly the kind of propaganda I'm referring to.

We all know that sophisticated attacks exist, the attack surface is vast, and it is extraordinarily difficult to indefinitely secure that attack surface against determined adversaries.

We also know that foreign adversaries, and not "teenagers", are responsible for the overwhelming number of these attacks.

But, here we have an apologist for those actors who blames the victims and calls the simple identification of the criminals "using boogeymen as excuses".

It's gaslighting propaganda that has a consistent quality, and its origin is not organic.
Firefox threw their hat in with the "it's our browser and we're kindly letting you use it" crowd a couple of years ago. Shame.
If the supply gets artificially limited isn't it then logical that they can charge whatever they want?
How to publish a simple resume to GitHub pages. No coding skills required
Right? Especially since the implementation is so simple, and even runs in O(1) time:) https://xkcd.com/1266/
Edge does tend to have far better battery usage, however. Just because it shares the same base does not mean there have not been optimisations along the way.
In that case that's not even what the old ride was trying to minimize, which was apparently total trip time (driving+charging). Apples and oranges here.
Not author, but TBH I don't see the advantage of his multi-stack proposal compared to local variables as in Factor; I think they are equivalent actually.

If Factor had full stack type inference, you could look between any two words and ask what the state the stack is in. Then if you wanted to split the word definition inside the local binding at that point (assuming this is something useful to do, I am not convinced), then automatic algorithm to do that would be just: Put the required locals to the stack manually at the end of the last word, and then define the next word as having that stack as input. As a special case, you could extract any sub-sequence that doesn't really manipulate the stack into a word.

I am also not clear what the advantage of multistacks is for side effect control. In Factor, there is already an implicit set of globals that are available at any point, i.e. all the words in the vocabulary. And there already is, on top of that, a mechanism how to restrict all callees from using certain words (for example, restrict only to pure subset, or subset with certain capabilities); this can also be formally verified. I just think that simply restricting the used vocabulary is a more powerful mechanism for restricting effects.

But I guess I will learn this in the next blogpost, looking forward to it!
You're correct. My last care was a 6 month old second hand. Depreciation is the reason I go second hand. The EV costs are still too high though for a 6 month second hand. I'm also worried about the battery. To be fair my only knowledge of lithium batterys is smartphones. So from that how long does an EV battery last? How much is it to replace? And the nonsense that is buying the car but renting the battery?
> but things with moving parts that stick out from the surface are not as reliable in population terms.

I would be really delighted to know if auto manufacturers in particular really have data on this, and what they count as a failure.

I've seen a lot more electronics failures than I have mechanical failures in cars and appliances, and the trend seems to stick with displays and knobs. For example, the first thing to break on my car was a display, which I still haven't fixed because it would be hundreds of dollars. I have an old truck with some broken knobs, but the posts they sat on still work, so they're still usable. If I did need to fix them I suspect it'd be a lot cheaper.

Color me skeptical that increasingly fancy touchscreen displays are going to have any staying power. This has always kind of smelled like it was simply based on a logical axiom that "less moving parts is better and more reliable" rather than practical reality in the late 2010s-2020s.
Sounds like GP still has their thermostat turned to 19 - but now they are aware that it almost never results in the heater turning on.
>Drivetrain failures on modern cars are much less common

Unless you drive a Chevy, Nissan, or Ford!
Er, I was being glib.

Terminator style robots would be a pretty inefficient way to wipe out humanity.

Wrt motive, I would assume that if we are someday killed off by our own machines, it will most likely be something akin to an accidental nuclear holocaust.
not in US yet, practically speaking
Were knobs ever gone in this context though?
Did you actually drove one? Or you just read somewhere about build quality?
Did the weapons go through an xray? Did the humans looking at the xray just... ignore what they saw? How do you explain an AK-47 slipping through?
I used pf + carp on OpenBSD in 2004. It was really awesome to failover from 1 firewall to the other without losing tcp + udp states for all the servers and clients behind the cluster. pf is really powerful. pf on OpenBSD even more! Another nice features is to tweak some tcp options per rules. Let's say you want to fast expires tcp port 443 connections to your cdn servers but, still keep normal tcp timeouts for the rest. Nice article
But the OS partition being shared with Windows isn't buying you these advantages. That is, you can still do all this with installing your Linux-based OS into a fixed size, well-known in advance size (40GiB).

The things that grow over time aren't part of the OS, they are user data, which can be shared without doing anything special -- just mount it up.
I was expecting this to be about using IPMI on a BMC to see if the motherboard is powered on.
>I would be amazed if we were talking Firefox, but Google pushes Chrome down your throat pretty hard.

Exactly. IIRC, every time you use Google, Gmail or Youtube, from any non-Chrome browser, you get ads like "Everything works better on Chrome, wanna try it?" shoved in your face every step of the way.

So no surprise Chrome owns the web when Google owns the most visited websites in the world.

IIRC Google intentionally had a weird non-standard <div> placed in Youtube that would break rendering under old non-chromium Edge to hurt user experience and to force Edge users to Chrome which AFAIK was the straw that broke the camel's back and forced Microsoft to throw in the towel and move new Edge onto Chromium as it is today.
> The debate around this is pretty somewhat tiresome. Yes, you have to buy into the believe that the token represents the media

This is fine. There is no problem with a club of people who choose to play a game in which they agree that a token has a particular meaning.

The rest of us can point out that it doesn’t mean the same thing outside that club of believers.
The best description I've ever read:
NFTs are a postmodern absurdity asset that you buy/sell independent of the underlying art, the NFT is given value by the fact the art was made in a way that anoints the NFT as canonical.
yeah I figured someone would misread that no matter how many ways I tried to write it.

hm yeah I can see that filter, and its also probably self-reinforcing across generations now as abused alumni take the same roles and continue the cycle
Right, and the entry in any particular star register's registry is the same thing. They have provenance over their registry, nothing more, nothing less.
Right. I avoid airports as often as possible
Or Twitter. Lots of fake tweets with scam support numbers pretending to be the official support
Only if you rely on only the app for unlocking. Whether you think it sounds unlikely or not, it's documented and people have run into this before with the S/X when data was unavailable.

You should always keep the fob or keycard around for safety.
Right, I don’t really believe the narrative about foreign countries carrying out these attacks. I think they are sufficiently cheap that they can be done by criminals In countries where it is relatively safe for them to act.
It's a marketing half-truth. "You'll pay a fixed fee instead of interest." is the real truth, the "zero interest" is to trick people to think there is nothing else to pay. I know people will turn their noses up and say "trick people, that's unpossible" but it really is a trick, very popular in marketing terms, using psychology against people to separate their money from them.
Kids trying to figure out how to use a rotary phone [video]
oh not at all, just reinforcing how little the crypto asset existence matters in creating this reality. they would be perfectly fine with using Western Union as they don't care about the investigation. crypto does reduce friction though in acquiring and sending arbitrary amounts, but people still just can't imagine that recipients simply want crypto for the sake of having crypto instead of their local currency.
Knowing many keyboard shortcuts in your IDE (or other tools) is very useful. I advocate to create your own cheat sheets. I've written about it here, also covering PyCharm: https://www.augmentedmind.de/2020/04/26/boost-development-pr...
I examined mine carefully after reading your comments and.. did you buy it directly from HHKB? Maybe you have some counterfeit?

But you may be right, I'm not such a keyboard aficionado, I only had a few mechanical keyboards and maybe my standards are too low (or rather, at level which keeps me happy).

But as somebody else noted if you found the holy grail please share.
Harry Potter 20th anniversary: The UK film locations
I’d like to see the unit tests for the non-true return state.
> Plus the entire thing is in flux right now between flakes, home-manager, and a desire to kill nix-env.

This is my big gripe with Nix. There are so many things that are almost ready, or almost integrated, and advanced users are typically already using them. It makes it feel like next year will always be a better time to recommend Nix to newbies.

And a lot of the more ambitious contributions to Nix and Nixpkgs that are really, really exciting as a user tend to sit in pull request limbo for a very long time, sometimes dying on the vine. Guix doesn't seem to have that problem yet, but I don't follow it as closely.

It's painful to feel sort of totally married to it but also like I can't whole-heartedly recommend picking it up to most people I know who might enjoy it once they got going.
Do they account for where they went to school? I went to a fairly rural high school. Pretty much everyone who turned out to be gay went to university, because it's a good choice if you want to go move to the city.

A lot of poor / undereducated groups are more likely to be a little homophobic, so moving to go to university is a way out. If you don't go to university (or join the military) you're choosing to stay with your existing connections, and if you're poor or rural and gay this may be less desirable.
I'm 60, and also a software developer. Are you still working full time as an employee?
I honestly don't know if this comment is a joke or not.
While demonstrating that autism influence the microbiome seems not especially tricky, demonstrating that the microbiome does not also influence autism seems next to impossible.