skysight-inc/HackerNews huggingface dataset:
yeah the initial standard was dropped by tls-wg. RFC9102 is more recent/an independent submission.

> 3. An attacker with a valid certificate can strip dnssec-chain-extension out of a TLS handshake.

That's true but decentralized namespaces are at least starting with a clean slate they could require this extension no CA is issuing names for those anyway.

For names that rely on WebPKI this standard could be less strict about pinning initially (treating DNSSEC as just another CA). Once there's more adoption in a few years browsers should look for it and fallback to querying the DNSSEC chain (could be included with an edns option RFC7901).
This is entirely wrong.
This produces exactly the same code than

auto f = fopen("foo", "r");
if(f)
fclose(f);

check for yourself: https://gcc.godbolt.org/z/YxaPqYGez
> Part of the benefit of vaccination is that it prevents spread and so vaccinating young and healthy people helps insulate unwell, old and immunocompromised folks.

Does the evidence really support this though?

Kids are generally not hanging out around older people or groups of at risk individuals. Most infections (~99%) that result in mortality happen in hospitals, long term care facilities, and prisons.

Further, this doesn't align with my understanding of how the vaccine "slows the spread".

Spreading covid is like a game of catch. Someone has to throw the ball, and someone else has to catch it.

For ex. we know masks are a mechanism that reduces your ability to "throw the ball".

And we know the vaccine reduces your ability to "catch the ball", but once you've caught it you will spread the disease just like anyone else.

Therefore, slowing the spread means that everyone gets exposed to covid a little bit at a time, not all at once. Good for managing hospital capacity. But everyone gets exposed nonetheless.

So as far as targeting demographics goes, I'm not aware of any evidence that increased vaccination among young people corresponds to a reduced likelihood of the elderly getting exposed to the disease, though I'd love to see said evidence to the contrary.
Yes. The security wins of being opensource are really only there if the project is being engaged with and reviewed by security conscious developers, improvements are being merged in, and the new improvements are being distributed. Otherwise it's usually going to lower your security by some degree.
>> I’m taking them all at face value, unless there is evidence to the contrary.

> Statements like these remind me of the old saying from a bygone age "only a fool would take anything posted here as fact." Anonymous internet posts have no bar for entry and as such, should be treated with extreme skepticism.

Sure but then you have to take literally every post with extreme skepticism. If you pick and choose, then you are simply deluding yourself. If you don’t pick and choose but assume everyone is lying, then you end up in a uselessly paranoid position.

This is why I take the statements at face value for the purpose of the conversation.

And as I have said elsewhere - people sharing their actual experiences is very different from a distant person saying it’s all a GOP plot.

For what it’s worth, I have lived in SF, and the East bay, as well as Europe, and SF is not as bad as the GOP would like to claim, but frankly who cares. Nothing is as bad as the GOP claims.

What does seem true to me is that SF and the Bay Area in general does have serious problems and some things have been getting worse for a while. E.g. homelessness. There simply weren’t the same tent cities all over the bay 20 years ago.

My point is that this has nothing to do with the GOP meme. Introducing that is literally a way to distract from what is actually going on.
What you call CEO speak is more or less part of normal human communication. Normal in the sense, that when you communicate towards a group, you anticipate the effect your words will have and choose them accordingly. The actual content becomes secondary.

In order to achieve the same desired effect for all recipients, the words have to be crafted very carefully and certain things are being described in ways that might look very different in retrospect. Sometimes you even have to lie, but if you are good, you can avoid that.

Politicians do this non-stop.
I doubt this will get done on Xorg any time soon, there is very little incentive for anyone to do it when it's already working much better on Wayland. The problem is in finding someone who will do it, it's not really a problem to figure out how it could be done because we already know that: just copy the Wayland API back into X. A good way to start would probably be to get scaling working in XWayland applications and then backport from there; amazingly, we're finally at the point where Xorg is playing catch up to Wayland in terms of features. I can't understate how huge that achievement is for the Linux display stack.
I have like 6 phone numbers listed in my phone contact list for my sister alone, because she changes numbers every time she job hops and gets a new work phone, so I really question how well phone numbers work either. Most of those numbers are no longer hers, but I've lost track of which ones.

I feel like there's a bubble of people for whom phone numbers are perhaps a useful, durable identity token, but I really think it's very much a bubble. Most people's phone numbers change fairly frequently.
God I wish Ableton would support Linux, but I don't think it'll happen.
It would be nice to have a uniform standardized basic command lines on all platform to get the information of the command like 'help'. Annoyingly when I tried to find the command options in the terminal like help, h, -help, --help, -h, and it variants. Can we just have a standardized basic command to make it easier for everyone to expect certain things than making the users to check the manual or the documentations (sometime they don't even list it in there). Don't make it a pain for the end-users.
Cloud DB with encrypted columns is not enough?

( Other options exist)
Oftentimes the answer to "when can I do X on Apple hardware?" is "when it's ready".

I'm far from an apple fanboy, but I strongly respect and appreciate that stance, especially in a culture that promotes its antithesis.
We don’t use that kind of reasoning with other service providers.

If, for example, your bank changes their terms, your electricity provider increases prices, landlords increase rent, etc. they will inform you and often silently enrol you in the new scheme. Cancelling the agreement always (and maybe not even that) is an option, but that is opt-out, not opt-in.

So, why would cloud providers be different?
Mixed - it's my personal favorite language to work with but it's like it's torn between two sides. First it's finally working on most systems, Windows & Linux and even a few old versions of MacOS, probably some more niche systems too but those are the ones I know for sure.

Vapor is still very good for back-end work and I've heard a lot of success stories for lowering costs due to less cycles being used so a lower power consumption. But even with all that Apple seems to be pushing their own direction with SwiftUI, their support for other operating systems is minimal, support for editors other than Xcode, and having separate frameworks like Metal aren't helping either.

In short I want to use swift for everything, as a Rust or C++ replacement, and I don't think I'm alone in this, but it will never have the momentum within Apple to actually get out of the Apple stratosphere enough to be it's own thing. This is probably exactly what they want, but it's a shame.
Well this was like learning aliens exist.
Thanks for the feedback! Will add it shortly
I'm guessing you don't live in a country whose politics he manipulates and whose tax he avoids.
I'm surprised the `gensym` machinery is so "naive" as in it could actually be possible to craft a symbol that can refer to a `gensym`ed symbol.

I am not very familiar with other languages that implement (un)hygienic macros, is that a common problem in things like Scheme, Lisp, or even Rust, or do they all circumvent that issue with actually private/un-nameable symbols?
This is awesome.

But I wish a service existed that made domain names easy enough to use that the average person could manage them. IMO you shouldn't have to learn DNS and TLS in order to securely use a domain name. If I want to sign up to have Fastmail host my email, why do I have to manually copy and paste a bunch of DNS records? Fastmail already knows exactly what records need to be set. I should be able to OAuth redirect over to my domain registrar and approve giving Fastmail control over a subdomain of my choosing, and Fastmail should be able to use a simple open protocol to update the records.
Assuming you’re talking about patch data and not schéma migration, the most effective way to me is direct write access to the database, and transaction usage.

Whenever I need to patch data on a Postgres, the first thing I type is ˋbegin;ˋ to start my transaction. After that I just run my updates safely and check that the impacted data matches what I expected. Then I just need to commit or rollback the changes.

2 things to do before that:

- have the queries reviewed by members of the team knowledgeable about the db
- try the query on a dev environment (ideally a preprod with a replica of the data)
Not necessarily, when everything is standardized and mass market it become nearly impossible to find options that don’t follow the “norms”. New housing developers have little incentive to do anything beyond look like their competitors, which as also bland and standard and not designed for actual living. People don’t have any other options due to the housing shortages.
> [Apple's Website] revolutionary app

I thought that the Apple "claiming inventorship of unoriginal ideas" meme was over.
Great Britain sized Antarctic Thwaites Glacier heading for dramatic change
Yes absolutely.

There’s definitely a bit of a cult of open source. Just because I can look at your code does not inherently, magically make it more secure. Especially in a world where the black market pays better than bug bounty programs.

Not necessarily advocating for closed source approaches, but it’s something to bear in mind.
>>but they also just saw you reset it, what do you tell them?

That you're not a computer expert and have no idea why your computer wasn't keeping logs correctly?
Are you using "clap" because the "built-in" one in rust is not good? :P
That's an agreement that's made by the participant though. I support fan efforts generally speaking to expand the reach of whatever artistic interest they have, but if someone is making money off it that changes things. If I was a photographer, and someone was using my photography without my permission and not paying me ostensibly because their free advertising is sufficient to pay my bills, I'd be pretty pissed. That said, my only argument is for their hypothetical right to be pissed, not necessarily that they should or are.

I'd be even more pissed if someone made money off my work and subsequently made that argument, refusing to pay me because I should be grateful for the exposure.
I find their stick vacuums are complete junk. I'll never buy a Dyson again. They get clogged almost every time you use them (you gotta either jam a butter knife down the main intake or take apart the filter, both susceptible to blockage). The max button gets stuck in the on position, the battery only lasts a few months. I don't understand the appeal at all.
Thanks for the advice! I'll try this out
Same here. Might be good travel laptop with Linux on board.
As someone who only knows frontend / React, I’ve been curious about Django vs Rails vs Laravel literally for years.

One day I intend to take one of these for an extended spin and see how it contrasts with gluing things together in JavaScript land.
Why is new regulation the answer here? Let everyone move to Azure, if they care that much about status pages and SLAs.
This case is easy. No need to rewrite: deleted code is even safer than Rust.

Apart from Rust, Wuffs is also a good candidate for codecs: https://github.com/google/wuffs/blob/main/doc/wuffs-the-lang...

Too bad that Swift isn't that good for low-level codecs, so a Swift rewrite of Messages couldn't remove C dependencies.
"I found a 3rd party library that uses eval, so we just send it code we want to run and...boom. We're in."

"I found a popular chat app that after install leaves a tool with full sudo privileages behind for us to take advantage of located clickityclickity... here. We're in."

Sometimes, it can be even more pedestrian sounding. Hackers don't always have to be clever if other people are absolutely dumbasses before their arrival.
If I'm going to do it, I want it in a way where it's encrypted per-user, using something not stored in the database like a client side hash of their password or something.

I don't want the possibility a miswritten SELECT potentially revealing anything.

I don't want to be able to read their data, at all.
The Indian government used it to spy on opposition politicians

https://theprint.in/opinion/only-15-indians-know-about-pegas...
I'd imagine there is a fair share of amazing developers that have no interest in flaunting or broadcasting their talent, for at some level it just isn't necessary to advance their career.
can we stop using python for web sites in 2022
> They want to do things their way... Hard to wrangle them

This can happen when the software group is seen as incapable, unresponsive, or even just slower than "business speed". I'd suggest talking to the individuals and their leadership (separately) to learn more about why they adopted X without talking to your department. You may well uncover missing or broken lines of communication, entrenched negative expectations ("it takes a month to get a simple DB query run, why would anything else be faster?"), and/or find processes so onerous that everyone tries to avoid them.
Thunderbolt is made by Intel and fairly expensive to implement.
So no surprises why it shows up on the expensive Intel based board and nothing else.
That's a fair criticism, I think C++ blurs a lot of lines that make these things difficult to talk about in isolation, and I'm still working on being more rigorous about picking them apart correctly. The very specific complexity at the core of it all is the fact that you need something like placement new to begin a lifetime in memory that is already allocated. Copying the object representation of an initialization template is insufficient in general, you have to use a specific tag to say "the life of a new object starts here", which has no direct analogy to anything the hardware does. It's not necessarily important that the programmer can hook into this like a C++ constructor, but the tag needs to be there. This is something that can be very difficult for programmers to get right in languages that aren't Rust, because the compiler does no verification of it. If you do it wrong, everything works in debug, but then things may break in release because the optimizer performed incorrect alias analysis or detected unconditional UB. But they might work correctly, you may not notice for years until a more powerful optimizer comes along. Since we don't plan to validate lifetimes (Rust is a great language that already does that if it's important to your goals), we would like to avoid this sort of strict object model as much as possible.

When you add RAII on top of lifetimes as a language feature, it creates the need for language support for moves and specialized copies. Or a need to say that types cannot be copied. But you need some sort of tag that says "memcpy doesn't cut it anymore", which is what I mean by overridable copy behavior.
nah man, it's never the digger that's the idiot. it's always the project manager that told the digger where to dig. just like it's never the dev's fault as the PM made them do it. /s
I have been quite happy with some of my SFU code on top of the Rust wrapper for Mediasoup[0] which I understand from this post doesn't have congestion control. I would love to give this a try, but I fear including a library w/ AGPL license. The license choice is not worth hashing out here, and I'm sure Signal's goal isn't necessarily developer adoption compared to openness, but it will hurt adoption.

0 - https://docs.rs/mediasoup/latest/mediasoup/
I really don't think work is on Maslow's hierarchy.

Work can sometimes provide you with Esteem, Belonging and Self-actualization, but often it's a poor and unreliable mechanism to fill those.

Working on interesting things with other people you like and feeling accomplished and useful and respected in that way is great, but you can do that without it being a Job.

If I had an infinite stream of money, I'd still be working on interesting things when I need too, and it be easy enough to find those.

In my opinion the work as we've defined it today is accidental, a necessity to provide the lower things on the hierarchy like food and shelter, and in some cases can also be fulfilling and interesting, but rarely in a sustainable way and often it's not at all.
I don't have any familiarity with the other apps in this space, but I am a heavy (and happy) user of OurPact. OurPact adds a lot of parental management features (including a remote kill) which the Apple controls are desperately missing.

The backup is taken at install time and it's perfectly reasonable to do so. The backup is stored local on your computer using the standard backup mechanisms, it's not uploaded to the cloud.

The installation process is actually opting the device into an enterprise management profile, not a custom OS. That custom OS blurb sounds like some goofy marketing speak or misunderstanding how this process works. The management profile allows OurPact to manage the device on your behalf using the same APIs any enterprise device management vendor would use.

Once the device is opted into the management profile, it's quite obvious it's under control and you have a lot of options including setting time limits on app, enabling various child protection features, preventing apps from being deleted, and most importantly choosing what apps are available and creating schedules for the device (i.e. disabling games during school hours/night).

Nothing about this process hides the fact that the device is managed. There is an OurPact Jr app that can be installed which gives the owner visibility into the schedule. I highly recommend reading the reviews by upset children for the OurPact Jr app on the app store. They are hilarious.

Anyway, my point is as a parent with a tech background and 3 children, OurPact has been a very useful and positive addition to our home life. They've been a good steward. They are limited in what they can do by Apple, but what they have done they have been very transparent and communicative.
> Maybe he should explain his Brexit position?

Do you also think Freeman Dyson should explain his position on climate change to your satisfaction?
The matching happens on-device. The targeting is done by the browser and it is the browser that decides what ads to show, based on the inventory that is downloaded periodically, by everyone.

This is why there is the need to confirmation, so that Brave (and the publisher) can have a way to count how many ads were served and how much BAT is owed to each participant. At no moment it means that Brave or the publishers get any of your information.

(Is there any more false misconception that you would like to have debunked, or are you just trying to earn the reputation for your username?)
>My pet hate is the 100x added friction between the retractable bristles and my plush carpet. It's costing me extra in time and energy to push this thing around.

we had the same issue, there should be a slider on the front to turn down the vacuum power. We turn it to about 50% on the deep pile carpets
indeed: http://www.fruitcake.plus.com/Sinclair/ZX80/FlickerFree/ZX80...
No complaints from me
Not only that, but how can I use Signal on desktop without it? Can I do that? Plus every single citizen here who has a phone number has it tied to their identity, even if they buy the SIM card at the gas station, for example. They have to verify and confirm their identity once a year. Its purpose is to keep track of who uses what number.
For completions, as part of the Oil shell design space exploration, Andy C. (https://news.ycombinator.com/user?id=chubot) proposed a protocol he called Shellac, see: https://github.com/oilshell/oil/wiki/Shellac-Protocol-Propos...
Gotta love the `clear` command. Started with zero options and still has zero.
Does one thing well. Would you want an option to clear half the screen ;)
Newbies should check out r/anarchychess for tips
And in particular, there's a whole section that reads "With Truple, you can virtually "peek" over your child's shoulder & course-correct as needed."

So right there it's admitting that the intended use is to spy on someone else (in this case, "your kids"). I'm with you here. I just don't believe OP on this one.

Apple thinks this is a spying app, and they don't want it on their platform.
For chess analysis, I recommend SCID vs PC.

It turns out that chess-playing programs have standardized upon UCI (Universal Chess Interface), meaning any chess-playing program, (IE: Stockfish and Leela Chess) can interface with any UCI program (in this case, SCID vs PC).

SCID vs PC can then be tuned to whatever you think is appropriate for review. Add the tablebases if you want perfect endgame analysis, or favor faster reviews with less analysis (if you're going for speed). Or you can run analysis overnight, if you want the computer to spend 20+ minutes per position.

--------

With an actual analysis program like SCID vs PC, you can try variations and deeper studies than what either chess.com or lichess.org can offer. There's no replacement to just running these calculations on your own very capable computers... rather than leveraging the limited compute abilities of a shared server with a thousand players on it. (Or in the case of lichess, I think its a Javascript program instead of a proper x86-assembly tuned high-speed analysis bot).

Stockfish in particular has a nifty quirk: most of its analysis is done in a giant hash table of positions. Meaning variations / transpositions are very quick for Stockfish to analyze (or more like, Stockfish probably has a variation already partially-analyzed before you even decided to think about it yourself. The hash table stores this partial analysis, and allows Stockfish to have a leg-up on analyzing the position when you decide upon exploring that variation).

--------

The equivalent for Go is Lizzie, which is easier since Lizzie comes with LeelaZero and KataGo already. (KataGo is the superior analysis engine IMO. Both are superhuman, but KataGo's score-based analysis is more useful for finding endgame mistakes).
I used to just leave my car unlocked and empty like the post describes, saves you an expensive repair bill.

Reported break ins a few times to LAPD and they made it pretty clear they could not give less of a fuck.
The utility company using their scale to build their own cheap utility scale solar farms and give everyone bargain energy at sunny times? Thus making microgeneration uneconomic and restoring the communal system?
For those cases there is GeforceNow, Stadia, Xcloud
Geoff Foster on the art of sound engineering
Whilst I'm all for ragging on Facebook's missteps, their vision seems pretty good if I was in Zuc's shoes.

They want to be vertically integrated, discount Apple in this space.

They're deploying cost effective hardware combined with vertically integrated software stacks that "just work."

And they are leveraging things Facebook does extremely well, targeting extreme volume for cost amortization, UX and building microtransaction loops.

Like it or not those are things you can't say Facebook is bad at that stuff generally speaking.

Everything about the Facebook metaverse vision is cynical from a societal aspect.

But the business case is fine.

They won't make any money for about 10 years, but after 10-15 years of Quest like products, they will be doing well for themselves.