skysight-inc/HackerNews huggingface dataset:
I previously found solid work on Scope (https://scopeinc.com/). They have a somewhat interesting model. They build relationships with different SaaS platforms, and when people reach out to the SaaS platforms looking for custom work or professional services they get forwarded to Scope who then sends the leads to their partner network.

No affiliation, just found a bit of work on their platform in the past (although haven't gotten any offers lately, so IDK if the volume of available work has changed).
Not really, they are listed on NASDAQ, a US-based stock exchange regulated by the SEC (also US)
Get yer pointin' finger ready:

https://github.com/apache/logging-log4j2/blame/master/log4j-...
This post carries a lot of water for user-hating user-blaming anti-extensions.

I'm sorry that your family are... having such a hard time making reasonable choices for themselves. I have literally never seen this anywhere, or heard any coworker ever report their family rampantly adding shitty extensions. I tend to see pretty clear & obvious signals about what extensions are good & ok when I go to consume. Bad extensions seem to be discovered fairly quickly & taken down. I'm trying to imagine how folks even get to the Chrome Web Store in the first place if they have no idea what they are doing. The world to me seems no where near as grimdark as you project.

Alas I think it requires a paid Google Enterprise account, but your family sounds like their need external management of their browsers. That they should, like a school computer, have an administrator & a denylist or perhaps even allowlist of what extensions they can use.

This post spreads so much Fear Uncertainty and Doubt. Trying to justifying ending a good thing because some creative user keeps finding a way to misuse, to not listen to sense, to not make good judgement... I find it unfortunate that such heavy fearmongering, such terror at the world is allowed to sway us so heavily.

Ultimately I want 3rd party sites hosting extensions. Not Google. And I want moderation teams able to surface claims that some extensions are bad. We need more choice, more democracy, more ability to help each other. Sunlight is the best disinfectant. Simply giving in to the bed-wetting terror of, oh no, freedom & denying ourselves user-agency is intellectual suicide for the web.
Sort of. Processes on the same node (graceful restart) vs processes on different nodes (maglev).
> By the way. This only affect log4j 2.x (https://github.com/apache/logging-log4j2). the log4j 1.x (https://github.com/apache/log4j) is not affected.

That's not what https://github.com/apache/logging-log4j2/pull/608#issuecomme... says
Let me know if you need a place to crash in Sunnyvale
With ~195 countries unless you're ultra interested in the Polish why would you read these?

Why not read The Witcher? I assume it's popular at home and as such represents the real people.

This list [1] is not great, it's a mix or English and Polish readers, but it's a start.

It's also a community list, why do people still trust the opinion of one person. Especially with a book, it's not a 2 hour journey like a movie.

[1] https://www.goodreads.com/list/show/2023.Best_Polish_Books

If this was Radical Polish books to add to your Radical reading list I guess it might work as an article on HN. Within the journals context it works once you Google it "The Calvert Journal is a guide to the contemporary culture of the New East: Eastern Europe, the Balkans, Russia and Central Asia."
OK, thanks, didn't notice this when I read it.
"When using LDAP only references to the local host name or ip address are supported along with any hosts or ip addresses listed in the log4j2.allowedLdapHosts property."

Those config measures were put in place as part of the fix for this issue. I.e they didn't exist before the fix was released.
They are the definition of centralized.
My city just installed three roundabouts each about 500m from each. Three in a row on a four land (two each way) road. I'm all for roundabouts but it looks a mess. Some of the outer lanes end too without any sign to indicate that it ends. Stroads are designed by busybodies who are given too much money.

I used to be able to go over a small bridge that's over a small stream and turn left to get to my aunt's house. The bridge is now 10m higher has four lanes. Plus I have to drive 2km down the road go through two roundabouts come back the way I came just to get back to where I would have turned left in the old days.
Daniel Ellsberg's book "The Doomsday Machine: Confessions of a Nuclear War Planner" is a really good rundown of the systems the US had (he was involved in putting together war plans at RAND corporation). It's been a while since I read it, but as I recall from what he says, things were not as they were normally potrayed, such as ideas like "only the President can authorise a nuclear strike" - apparently at times there were actually several layers of 'delegated authority' (in case a first strike killed the president), so there were actually quite a few people who could authorise the use of nuclear weapons, and more than there were meant to be (because the next level wasn't meant to delegate to another, but did)! This was mostly before missiles so when it would have all been ordering bomber pilots, so it was a bit more decentralised.

The other thing is that there was an idea that the US wouldn't launch a first-strike but would only retaliate - but there were actually multiple times when generals tried to get the President to authorise a nuclear first strike, including in the Cuba missile crisis.
After having worked on software security for 20yrs+ I can tell you first hand that it is a long-term losing game. Libs, frameworks, and SDKs are written to provide functionality and interop. The more functionality/interop they have then the more popular they become and the more vulns they have.

The only winning move is not to code!

....OR learn to live in a state of constant vulns and put guardrails in place so that you can avoid shooting yourself in the foot as much as possible. In this case strict ngress/egress firewall rules in prod would prevent this from ever being exploited from what I've read on the vuln thus far.
In PDM, add command supports a `--unconstrained` option to relax the version constraints to find a solution. You don't need to edit the file manually.
Yes-- while never on a criminal level, I have seen it happen in places where I have worked before.
Mozilla is just as bad selling to the highest bidder.
Sybil attacks aren't possible in what was just described though since it requires a vote to create a new voter.
Is Programming “Experience” Important?
Zettelkasten Method – How to Organize Your Learning and Thoughts
Someone who's not comfortable is probably facing the decimation of their native currency already, as what's happening in several "modern" countries at the moment.

What would you pick? Sketchy native currency with a near guaranteed loss of 80%+ or a volatile crypto asset?
Clever Girl....
Kids can Teach Themselves (6y study) at 16:00 see evidence for Mob Programming
Two networks are less centralized than one. Why do people think centralization is binary?
I haven’t used log4j (or a JVM language) for several years but IIRC the most common usage was printf + agnostic but reliable output, commonly adapted to multiple SaaS solutions and usable in dev, and outputting formats that are searchable eg in Logstash. This is roughly the same as I’ve encountered on Node where I’ve also had to remind myself that it isn’t a simple printf -> stdout, even if it looks and feels like it is.

The complexity in logging libraries like this are much greater than they seem like they should be, specifically because they’re designed to abstract a lot of integration use cases in a way that feels like it just works. Marshaling data between even a few services introduces a lot of potential for mistakes.
Also, lockups are common. But not every company has a lockup.
Bounded loop plus 1M instruction limits in the 5.4 kernel (no record at hands about the exact version), gives a large range of supported headers. Also note that these BPF code are on the network level, which is subject to the MTU limit as well, which usually is 1500 and now can be 10s of KBs (65,525 bytes maxmial in theory accroding to https://www.lifewire.com/definition-of-mtu-817948, but my networking knownledge is poor). These makes it possible to effectively handle all possible headers.

HTTP is actually fine.

HTTP2 will be a bigger issue as it has HPACK, and Huffman coding, that would be very complicated to maintain inside BPF runtime. I haven't thought about it closely yet. But based on our experience at http://px.dev, I am not aware of any glaring technical obstacles.
Introducing Anyscale: The Future Is Distributed
Programmable editing of large DNA sequences with twin prime editing
There was definitely limited access to knowledge too. The Bible for example was a forbidden book for centuries in the Catholic church. Only accessible to the ordained, lest the peasants would ask difficult questions.

Of course most common folk were illiterate back then anyway.
I'm absolutely mystified to hear about such huge sorry sad sappy stupid problems occuring with blitzing regularity in your tribe. I cannot imagine how your people discover trouble so readily.

It doesn't sound like you think your family is at all educateable in any way, you seem to think this is a horrible lost cause & that we must withdraw power & good for the world to protect your vulnerable unfortunate tribe. You're using that as a weapon against the world, against good, against freedom, against capabilities.

This is extremely menacing a position you've made, using your own family's purported victimization a weapon against good.
Proven Way to Reliably Create Your Own Luck
The Data and Trust Alliance
It doesn't say it has to be your own kidney.
New Dune RTS game on the way from developer of Northgard
An example of a conclusion that follows from your claim is that all VCs have been equally profitable over the past three decades and that they are just as profitable as any other style of investing restricted to accredited investors over the same period. Any difference in outcomes between Stripe equity and Juicero equity is just noise. Do you seriously think these things?
APT for Advent of Code
I would believe this more if Mv3 didn’t allow extensions to inspect all web requests programmatically, just not block them. Want to exfiltrate your users’ data to attack or track them? Fine. Want to block ads. No way!
This is interesting and all, but I've also written bounded loop BPF code on 5.6 kernels, and it is not easy to get the verifier to accept seemingly obvious loops. I'm not saying it's impossible, I'm saying I'd like to see what this code actually looks like. I'd be a little shocked if it just looked exactly like Node's HTTP parser.
More than half of high-impact cancer lab studies could not be replicated
I wish HN was more professional. It used to be.
Not quite what you're asking but I got to senior swe level at a midsize company and just said I wanted to work 3 day weeks for pro-rata pay and they said ok.
Maybe not targeting your intents specifically, but what types of tools exist to help workers organize? BLE beacons or covert QR codes to help educate workers on their rights. Geofencing ads to warehouse/factories could be effective, but expensive. Maybe an anonymous app that helps recruit members, track violations, polls over workforce priorities or just explains worker rights and how to educate/engage coworkers. The space is ripe for innovation since there likely isn't much money to be made but lots of good can be done, but it will be hard to get past the anti-union sentiment that most Americans have.

There are a handful of organization apps mostly targeting Walmart that are kind of bland and low utility, maybe even integrating with Walmart HR, so not sure of the objectives there.
Eh. I think it's pretty reasonable that people assume their logging library doesn't have random RCE, and I think it's pretty reasonable people aren't going to be able to filter every parameter based on Log4J having a relatively obscure bug.
NY City Council passes bill to let non-citizens vote in municipal elections
I have no idea what this question is asking.

'Engineering,' like 'art,' is one of those hand-wavey words.

In fact, I have a feeling you're actually asking:

"What are the coolest brands, as perceived by engineers, and why?"

Which is about as substantial as asking what the _pinkest_ brands are, or what the most _geographically-distributed_ brands are.

Or perhaps less so -- at least we can characterize 'pink' and 'geographically distributed' as reducible terms.
Tokyo is not a small town by any measure, and neither is the most of Europe.
Does anyone in here know what url schemes are valid for JNDI and/or this bug in particular? The example is LDAP but is that the only one JNDI supports? Would HTTPS or even data urls work?
It’s also pretty rich that 1) this comes out during the Ghislaine Maxwell trial, and 2) the article doesn’t even mention her name.
Then there's this:
https://www.buzzfeednews.com/article/jasonleopold/cia-employ...
What? Practical addressability requires centralization by definition. How could it work otherwise?
I see this part:

key: yarn.lock

Is this going to make it start without a cache every time that yarn.lock changes? Isn't that a bit overkill? Normally `yarn install` only downloads updated packages.
This building has poor acoustics, lack of privacy, and is inconvenient to navigate. Rumors are that rank and file engineers do not like this space.
did you start these projects or did you just become an active maintainer of existing projects?

If the latter, how would you identify open source projects that may lead to freelance work?
Ah OK, I missed that this was MetalLB specific. Interesting that Cilium using Google's Maglev which amongst other things handles the issue of ECMP churn when nodes are taken out of service. I remember reading this in the white paper when it came out. I believe Facebook's Katran does similar. Thanks for the link.
What it takes to GC optimise a Java Microservice
I wonder if there are other templating engines out there that have similar plugins that load text from remote source, and could have similar bugs.
NotePlan3 … but also doing some testing of Mem.ai
> that any other CA could implement.

For reference, many CAs (even paid ones) have implemented it:

Digicert https://docs.digicert.com/certificate-tools/Certificate-life...

Sectigo (formerly Comodo) https://sectigo.com/resource-library/sectigo-adds-acme-proto...
for super small time work, karat might be useful.
Debian over HTTPS
Thanks for the kind words on PDM. At time of creating PDM I don't want it to be similar with any other package mangers, so I chose PEP 582, and I thought I can play more new stuff on it.

But as PDM becomes mature, it is acknowleged by the Python packaging people, I also work hard to make PDM fit more people's workflow, fortunately, it has a strong plugin system. You can add virtualenv support(pdm-venv), publish command(pdm-publish) and more. In the future, I would like to see it can eventually push the iteration of PEP 582 and make it finalized.
So a lot of people sound mad that the logging library is parsing the inputs, and maybe they should be, but the truly paranoid should also be aware that your terminal also parses every byte given to it (to find in-band signalling for colors, window titles, where the cursor should be, etc.). This means that if a malicious user can control log lines, they can also hide stuff if you're looking at the logs in a terminal. Something to be aware of!
Are ALB/NLB employed to handle traffic between pods in the same cluster? Or have I misunderstood the whole discussion?

My take on the 'eBPF will help solve service mesh' proposal is that it deals with not only ingress/egress traffic (where ALB/NLB are typically employed) but all traffic, including traffic between pods in a cluster. This is where my interests lay.
What Is Quantum Mechanics? Why It's Called Quantum? Matrix Mechanics?
The itty-bitty bits of America that have any kind of walkable community are incredibly expensive. It’s basically the equivalent of avoiding mediocre American factory food by doing all your shopping at Whole Foods. Why does it have to be a rare luxury to taste what the Europeans have in overflowing abundance?
Not really. ACF is defined as a convolution of signal X with itself: XX. But FFT turns a convolution into a dot product: FFT[XX] = FFT[X]·FFT[X], or just |FFT[X]|². But what is this really? If X is a sum of A·cos(2πwt+φ) waves, then FFT[X] is a set of A·exp(iφ) complex numbers. What does |FFT[X]|² do? It turns those complex numbers into A². Inversing this FFT gives a sum of A²·cos(2πwt) waves, so in effect ACF has dropped the phases and squared amplitudes. This is also why ACF have this bright vertical line - this is cos(x) functions piling up together.
I was referring to the much higher level of difficulty adblockers and the like will have in filling their intended purpose.

It seems like this is the clear interpretation of what I wrote and that you may be purposely misconstruing my comment in order to level a soft insult and condescending language at me over an opinion you don't agree with.

To give you a little benefit of the doubt though and assume you may just be passionate about the issue and don't intend to be insulting I will address your other point: Users giving away access to their web requests without realizing it is a problem. It is also one that can be addressed without making it much harder for privacy-minded users and the providers of those extensions to get what they want as well.
(More than) a replacement for Heroku, Vercel on your platform, any thoughts?
While PaaS providers such as Heroku and Vercel take a lot of the burden off programmers, they are very expensive (sometimes up to 50 times compared to cloud providers) and not very flexible. Plus they provide a very narrow and limited service.

We're soon releasing the beta version of our platform that does the same on your own cloud(s), adds your own CI/CD, integrates easily with your git provider and has out of the box monitoring, logging, alerting, incident management, integration with jira and sentry and much more. Any thoughts? Do you think a flat rate payment with multiple tiers makes sense for this service?
I highly recommend the film "Together we cycle" for those that are interested in learning about the Netherlands' struggle with car dependency in the 20th century.
I am currently hacking Twitter. Yes, as you read this
Yeah... I'm not too sure about those Danish winds blowing when the Belgian ones aren't. This last week would have been a major issue for example.
Go look. Start clicking with me. We bring it down.

(I don't really want to bring it down. Nor could we.)

((Unless it gets that hacker news effect.............))
I don’t trust anything reported about North Korea. For all we know, the authorities themselves smuggled it in simply to make an example of a few, to maintain the status quo of fearful obedience. There’s just no way to verify anything that’s reported about NK.
has gorhill really sold an extension to someone in the past?
In what way are the painted ladies on a stroad? Steiner is a 2 lane street with parking and I think like a <25 mph speed limit. Most of it has bike lanes (although the particular piece in front of the ladies doesn't, or at least didn't until recently). It's very much a street, although it could be a better street.
Matt Taibi was on Joe Rogan a few days ago and during the interview Joe related a story about one of his Israeli friends. Joe went over to his friend's home for dinner, and hung out with his family, and the entire time the friend and his wife and kids were dancing and singing and celebrating, for no particular reason.

Joe asked why are you Israeli's so happy? The friend said that when you live in Israel, you live under the perpetual notion that a rocket strike will kill you at any moment. So you don't need a momento mori, you have death hanging over your head at every moment, so every moment is imbued with a heightened preciousness, so you engage happiness as much as possible, whenever possible.

I wish the modern, globally-homogenized mass culture that washes over us enjoyed this kind of apocalyptic thinking, rather than the dour, annoying "omg the ghgs!" crap we've got.
Does Georgism Work? Part 2: Can Landlords Pass Land Value Tax on to Tenants?
> it seems moot to use it now

It's true that some features of Scala have made it to Java, but I am not sure the gap between the two languages has shrunk much. For example while Java has added first-class functions and closures, it is still clumsy to attempt any serious functional programming approach with Java; Scala's type system is still way ahead; Scala compile to the JVM, JavaScript, and now native via LLVM.

> having libs tied to what version of the compiler you're using

It's never been that. However libraries used to be tied to the major version of Scala (for example 2.11, 2.12, 2.13) as major versions were not binary-compatible with each other.

Scala 3 addresses this thanks to the TASTY format which creates a strong foundation for binary compatibility. [1] You can use Scala 3 libraries with Scala 2.13 and, more importantly, Scala 2.13 libraries with Scala 3.

In short, Scala is not standing still.

[1] https://docs.scala-lang.org/scala3/guides/tasty-overview.htm...
Haha that's super interesting and funny to think about.
I agree, 3 or 4 at a time is probably too much, I may have misremembered (I can't find the recommendation in any Weinberg book at my fingertips). But six months of solid work on 2, then six months of work on another two is an idea.
Oh I agree, to be clear I am not one of said raging fans.

I am a big fan of the series and think they've done a fantastic job with the game, aside from some rough edges. The open world campaign especially has been a really cool experience so far.

What bothered me though is I don't think those raging fans are totally off point. And the 343 and MS response rubs me the wrong way. Not only on Twitter, but this article is (to me) a naked PR attempt to control the narrative and do some damage control. As much as I enjoy the game, there are still flaws, it was massively delayed, they haven't released forge, and calling it a "triumph" without first establishing a record of success comes off as pompous.
Yes, PDM does some hacks to make it work with the familiar `python` executable. See the example at https://github.com/pdm-project/pdm/#quickstart. All you need is a fews lines to set up your shell.
Looks like https://requestbin.net/dns is what you want, no?

I set one up (free, no account) and then when I did an nslookup or curl I saw the DNS hits coming in
Trillions were spent on everyday people, without which there'd be much more economic disaster.
interesting. maybe I'm misremembering and comment flagging comes with downvotes, which I guess would make some sense.
HCL is the reason I moved from terraform to pulumi+terraform backend.
Latino civil rights organization drops 'Latinx' from official communication
Of course I will not have a full node. How do I discover the IP addresses of the nodes which maintain the data? How do I keep that set of IPs up to date?
> if you have one bad CA they can sign any domain even if they shouldn't -- but in this case it prevents what you're worried about.

This is why certificate transparency is a thing and most browsers require it for public internet domains[0,1].

0: https://chromium.googlesource.com/chromium/src/+/refs/heads/...

1: https://support.apple.com/en-us/HT205280
CF < CDK < HCL < Pulumi
Come on guys, their 3Q TTM net income was only up 97% YoY to $70 billion, they're obviously unable to pay any more to those pesky workers without impacting shareholder value.