skysight-inc/HackerNews huggingface dataset:
Yes, and although likely a scam, here's another datapoint:

Coinbase, an Y combinator unicorn, is behind Centre/Circle and the USDC stable coin. And there are now $41.5 bn USDC circulating.

At one point it was billion of USDT circulating and USDC didn't exist yet.

Then USDC began to took off and there were, out of memory, $5 bn USDC and $23 bn USDT.

But, overall, the trajectory is clear: USDC is growing faster than USDT.

It's $41.5 bn vs $76 bn today.

Maybe in a few months USDC shall catch up, then maybe even surpass USDT.

Do we all believe Coinbase and its Centre/USDC stable coin is a scam? It's an american company, with real people behind it. It's not some scammy thing in the Bahamas.

Now here's an intriguing question: if we believe Coinbase isn't a scam and that these $41.5 bn USDC are really mostly or all backed, does tether's $76 bn really look that unthinkable?
What is missing in that explanation for me is the increase in value from perceived artificial scarcity.

Like paint on paper costs almost nothing until it has the right artificially scarce provenance and becomes a work of art, some cryptocurrencies can become valuable to hold and trade in and of themselves thanks to perceived scarcity.
From the Wiki:

> "The bacterial flagellum is driven by a rotary engine (Mot complex) made up of protein, located at the flagellum's anchor point on the inner cell membrane. The engine is powered by proton motive force, i.e., by the flow of protons (hydrogen ions) across the bacterial cell membrane... The rotor transports protons across the membrane, and is turned in the process. *The rotor alone can operate at 6,000 to 17,000 rpm*[!], but with the flagellar filament attached usually only reaches 200 to 1000 rpm."

Nature never ceases to amaze.
Is this some sort of weird hint that Russia is not violating anything? Or some weird hint that the US is not violating its commitment? "The memorandum included security assurances against threats or use of force against the territorial integrity or political independence of Ukraine, Belarus and Kazakhstan."
If you haven't worked at a place that entirely runs from a giant Excel file created by Janice who worked there for 2 years back in the 90s, then you just haven't lived.
Miroverse
Daleks. They have wheels and are considerably more efficient than cybermen.
From a game theory perspective, I believe that dishonest players are always a net negative for all other players. It might seem that it's good when capital transfers from stupid to smart people, but actually it moves from honest to dishonest people, which results in less efficiency. All this capital is now used to perpetrate more scams, which means that more capital will be allocated to these scammers instead of something honest. And because of these scammers, all honest people have now less capital to work with.
To feel shame is an emotional reaction to violating standards of morality. If you have no morality, you have no shame.
That's head on. People adjust their behaviour to the one they see in their peers, including public figures.

This is quite likely a slow moving change going on unnoticed for decades, until it crosses a threshold were it starts to become quite visible. And possibly a major danger to society as we know it.

The big question is are we before or after the threshold, and can we reverse the process anyway?
This is the piece of art being sold:

https://mma.prnewswire.com/media/1711194/MelaniasVisionNFT_F...

Never noticed that Melania had "Venus strabismus"
Good!

She does deserve death! FUCK THAT BITCH!
looks like somebody never heard of 𝚒𝚖𝚙𝚘𝚛𝚝 𝚜𝚝𝚊𝚝𝚒𝚌
Slow and expensive is relative… try transferring money internationally.
Hah, linking to OWASP is a good point. I have now put some more thought into "how would I EXACTLY classify this, if I had to list it as a finding for a customer".

Now, I think format string is not entirely right, either. That's more related to `printf`, which splits code (the format string) and data (the varargs). But log4j actually mixes code and data into one string. In the OWASP frame work, I think the more generic variant of format string attacks would be https://owasp.org/www-community/attacks/Code_Injection (that's actually linked under "related" for the format string attacks).

OWASP lives mostly in the web world, but links to CWE-77 (Command Injection, https://cwe.mitre.org/data/definitions/77.html), which is pretty generic. And log4shell matches the description just nice: 1. Data from untrusted source: yes; 2. data is part of a string that's executed: interpreted, which I think qualifies as a yes; 3. the execution gives capabilities the attacker would not have other wise: oh yes!

So it's probably safe to claim that this could fall under CWE-77 (too bad CVEs rarely use CWEs).

Now, CWE-77 (Command Injection) is a child of "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" https://cwe.mitre.org/data/definitions/74.html. Which states "The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities." - that's probably why the both of us thought of the the two of these! :) And even if CWE-77 is to specialized (this could be argued) CWE-74 should be a good match, quoting CWE-74: "The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component" [end quote].

Funnily, CWE-74 is a child of https://cwe.mitre.org/data/definitions/707.html - "Improper Neutralization". Which says neutralization can be done by (among others): "[...] transformation of the input/output to be "safe" using techniques such as filtering, encoding/decoding, escaping/unescaping, quoting/unquoting, or canonicalization [...]"

:) Thanks for triggering me on this.
His point is that Facebooks new take on AOL isn't going to be that future, not that that future isn't coming.
In a previous sentence they mentioned TTP, then they mentioned P-n-s. I thought this was another acronym of sorts. Like "Posts not sexy" or whatever. I spent a couple seconds to figure out what it meant, failed, and just moved on.

Figured out what it was supposed to mean from the replies.
Maybe "inelastic resource tax" or "squatting tax"?
That's not true. In a free market, the initiation of force is barred by the government, so there is no slavery.

There is no point in arguing against a false representation of someone's view. This is childish and intellectually unhygenic. It's noise.

Snake oil is always legal. It's legal now.
Show HN: I made an app that tracks your devices' batteries from your Mac
Technical hacks against the protocol and implementations are fair game, and is the implicit incentive that balances the market.

Social engineering and financial hacks are not fair game, and are "illicit" in the sense that crypto is obviously an international martial zone.

Exhaustively brute forcing a keyspace is valid, making your username an XSS to steal funds from an insecure page/downstream app is not valid.

Finding and leveraging an exploit in a contract is valid, both a paper/legal contract and a literal codified Eutherem contract. Flashing incorrect token prices on CoinMarketCap.com to take advantage of (unauthorized? grey) downstream screenscrapers and rugpulling affected tokens is NOT valid, but, admittedly murkier.
That's the easy thing to say, but unfortunately a lot of well-intentioned people are losing money, like they did with GameStop. That's not to say I'm shedding tears for everyone losing money, but the ones that should lose it are typically not the ones it's happening to.
your bank fraud protection doesn't prevent the bank from losing money. banks lose a lot of money to fraud and nobody is prosecuted.

from my perspective, you are comparing a user experience that has nothing to do with the technology.

a bank is a third party service providing custody to bearer instruments.

a future financial institution will be a third party service providing custody or other protections to your crypto bearer instruments.

> If trillion dollar market caps and god-knows-how-many billions of investment couldn't figure out how to protect consumers after 13 years...

there are DeFi insurance protocols, many people get paid back after being scammed, rug pulled, exploited. Look at the source, it is convenient for this to not be mentioned as all chainanalysis does is sell fear to governments to land contracts.
Nigeria’s eNaira: Litmus test for crypto innovation in Africa
What Rails has done with HotWire and the Laravel community has done with Livewire is the sweet spot for me. Everything is in one place, very little doing things twice -- like validation -- in the front-end and back-end, one router, HTML over the wire, a single auth layer, cost-effective and straightforward infrastructure (db, cache, queue, load balancer, app), and well-defined idioms/conventions to do just about everything. Never looking back.
You've summarized a human pattern that I sort of intuitively guessed at, but didn't really synthesize and integrate.

All power seems to behave like this. Republicans, Democrats, Communists, corporate titans, office politickers.
Why is it that every platform seems to need to rediscover the same problems? It's not 1995. If you open a space, it's going to attract trolls, spammers, hackers, etc. You've known this for a quarter century.

Security people say, over and over, that you have to put security first. You can't layer it on after the fact. You have to make it a fundamental part of every interaction.

It does no good to say "the beta tester should have used a tool called 'Safe Zone'". It shouldn't be up to the beta tester to remember that. If that's the route you want to go, you turn it on by default -- and then start figuring out how people are going to circumvent it.

That sounds like a half-assed non-solution that comes from not taking the problem seriously. There's a million things they should be doing, and doing them from the design stage, rather than treating harassment as an unforeseeable consequence to be sloppily patched. They come with trade-offs, but so does not taking harassment seriously. If people feel uncomfortable they won't go. You can fill the space up with people with thicker skins, and sacrifice a large chunk of your market. Or you can start by looking to design a place where people live together and smoothing the friction between them, and maybe get really rich off of it.
Pretty tame compared to some stories out there, but I recently worked for a company that had the most amazing process for importing customer data when customers migrated to our SaaS from a competitor.

First the data dump provided by the customer is run through a VB6 conversion program that imports the data to an Access97 database. Then the Access db gets opened using a legacy VB6 version of our product from roughly the year 2000 where they verify that everything was converted and imported correctly. Then they run the Access database through a second VB6 conversion program to migrate it into SQL Server so it could be used with the current SaaS product.

The source for the legacy product was at least in source control, but only one engineer still working for the company had ever touched that application at all. From what I was told the source for both of the conversion programs was lost years before I joined. The company's ability to import data for new customers was 100% dependent on this rickety pipeline.
Today, many many things in online video related "things" rely on code released by the beeb, so at least they gave back!
San Francisco is a complete shithole.
Yeah you're right, not my best take. But I guess the point I wanted to get across is that we shouldn't let our natural desires dictate what is legal or not, time and time throughout history.
In an era of HFT, 45 days might as well be 10 years.
Yes, making society worse off, knowingly: that means harming others: yes, be ashamed.

If you're no longer convinced of that, it's because you are looking for justifications for defect in the prisoner's dilemma, rather than cooperate.
Even your link does not say what you say.

It says US secretary of state James Baker told Gorbachev NATO forces would not move east from Germany. Then it goes into that there is a lack of formal, legal enforcement of these promises, and how the US changed its mind later. So even this source with its leanings does not say what you say.
Though the distances are smaller/closer, I think that typical 70mph freeway driving is more likely to need a fast reaction than stop-and-go traffic (and certainly the stakes are much higher). The likely worst outcome from an error in stop-n-go traffic is an inconvenience.
Lessons in Trust From us-east-1
log4j-api isn't actually a problem (directly). It's the usage of log4j-core that has the JndiManager class that's the injection point for RCE.

In the case of the transient dependency, it's further complicated because we've seen that some packages repackage the JARs they depend on... that means that statically analyzing for log4j is very difficult because you can't use hashes (even if you unzip the jar and hash class files directly).

I've been working on a scanner for this stuff on GitHub[0], and it's a real pain in the neck lol. Especially for Vendor software that you don't control.

0: https://github.com/lunasec-io/lunasec/tree/master/tools/log4...
> as a solo developer

MVC all the way, because otherwise you're never going to finish it. Doing a separate backend + SPA is an insane amount of work compared to a traditional full stack framework. Just thinking about validations (both server and client) make my brain hurt. Also you'll have to rewrite the frontend before even finishing it given how fast the landscape changes.

And even being a small team and not just yourself, I'd only think of an SPA if 1) You need an offline first experience, or 2) You don't have full stack engineers at hand and you only have backend people which don't want to touch JavaScript and frontend people which only want to work with JavaScript..... but this is more of a people problem than technical one.

I've done a lot of Django in the past, then a lot of SPAs for the last 6 ~ 8 years, and now I'm back to Laravel + Livewire and I'm living in a dream right now. Everything is so easy that I feel I've been cheated the last few years.... so much time and money (from my employers) wasted...
This isn't mere power seeking. This violates the principle of 'equality under the law,' since the law has this specific exclusion. The problem isn't that Pelosi is exploiting the loophole, it's that Pelosi both _controls_ AND exploits the loophole. Royalty isn't exercising 'freedom' when they exploit advantages over the citizenry.
If you think the python ecosystem is a mess I trust you have never used matlab and its toolboxes.

Also in the context of numerical/scientific programming I don't understand what is the issue with the packaging system. It's been working fine for myself and many others I know of.
Aren't you already perfectly aware this is not open source? From your profile I must assume you are.
SQL Draw
> What evidence is there that vouchers are helpful?

> Who benefits? (the answer here isn't "everybody")

In areas that have done charter schools, the result is that poor-performing school administrations/companies (in terms of standardized tests) lose their charter and effectively "close down." Better performing ones are allowed to replace them.

The students benefit because they end up with better quality educations. They're no longer forced to go to terrible schools that keep getting money thrown at them despite having deeply-rooted problems: problems that the school has no incentive to fix due to the way the current public schooling system works.
Average lifespan has increased because of changes on the low end. Fewer people are dying young. There has been very little movement on the upper end of lifespan. The current trend of improvement has a natural wall at about 100-110 average lifespan.

Having said that, I suspect that once we crack aging, we may blow past the current limit and see a relativly sudden jump in lifespan
Do you disagree with something I said in my comment? I cannot see that you do.

Also, frankly, I don't appreciate the sass. It isn't necessary.
"Regulation isn't necessarily opposed to a free market"

Free market is like the shroudinger's cat, everyone has a different idea of where it is. In the other thread people were claiming that having a central bank is anti-free-market, but it's unclear how interest rate should be set and money supply be created and regulated.
Windows Terminal to Replace Command Prompt in Windows 11
A model of GPT-3's scale is not going to be trained or run on a laptop. OpenAI's restrictions are significant because not many people can run a model that large.
I'm not sure I follow. Adding a secret is done with your public key, so no need to even touch the yubikey to do that. And the idea is each one is a separate file. So, adding does not impact any other file.

Edit: oh. Adding a new key, not password. I see how I misread.
> salaries havent gone up because they've opted to decline the increase for themselves

Well, sure; why would the wealthy incumbents want to make it easier for new, not-independently-wealthy candidates to break in? You probably limit the AOC-style folks a bit by not adjusting for inflation.

> they can easily pass a bill to fund lodgings for congress critters in DC if they wanted

I kinda like that idea; a little Versailles-y.
Sure it does, it’s a “no” to the quoted question.
There is a reason Twitter deleted the NancyTracker twitter account. This was one of the only few blogs I could find which explains what happened: https://reclaimthenet.org/twitter-bans-nancy-pelosi-stock-tr...
> It's amazing these people keep getting voted back in too.

It's a two-party system, you have to vote for one of them!

https://www.youtube.com/watch?v=AuYsZUMuj0M, The Simpsons S8E1 - Treehouse of Horror VII - Kang and Kodos

Or more accurately, they've gotten really good at getting people to focus on hating the other guy or getting wrapped up in partisan BS.
Yes, there's stuff that you can't get just from parsing the man page too, but it's a huge help. I know it's not done every startup, I have running that as part of my "update everything" script.

https://github.com/aclough/dotfiles/blob/master/mupdate.sh
doesn't android auto also depend on BT? not clear to me why, but I believe it has to be on.

in any case, I find Android auto just trades one set of issues for another. voice control is kinda iffy for all but the most unambiguous commands. I also experience deadlocks at least once a week that require restarting the head unit, phone, or both. I've had this issue with two different phones in two different cars. not sure what the root cause is, but it is really distracting when navigation freezes halfway through a trip through an unfamiliar area.
It's not an Amiga scene without Eric Schwartz's yiffy animations.
That's a bit circular though. I mean, to be clear I don't agree with the upthread point that we should deemphasize crypto crimes. But that said... the trust in the DeFi economy is being eroded right now, and for some very rational reasons.

It's certainly not the government's job to jump in and prop up financial systems in which it's not involved. Its interest is in protecting its own citizens from criminality, not in the level of "trust" in "DeFi".
Facebook's new Meta logo looks like the first example Lissajous Curve...
> and have the same tiring conversations about naming conventions, logging, data consistency, validation, build scripts, etc.

Sounds like bike-shedding to me. Eg. You start with solving trivial problems instead of the hard problems.

Usually the first thing that is decided is what framework to use, often by a non technical person that herd from a friend that is was good. Rather then having the engineers sit down and think about what are the biggest challenges, and what is the best framework suited to solve the hardest problems.
valued at $2B. whats their business model? corporate support?
i always think of microservices as a product an organization offers to itself. If you don't have the team including managers and even marketing to run an internal product then you probably shouldn't be doing the microservice thing.
because if you have to report it ahead of time, it neutralizes any advantage you might have from the insider information.
It’s outsourced to strangers anyway once children to to school.
Django is good only if you're building a backend.

Its frontend solution is a 90s monty python's joke.

Rails, Laravel, etc are real full stack frameworks.
No, the old Nazis became the leaders of western Germany and their science was rolled into planned parenthood and other groups, and the pro vaccine crowd are the Nazis
Thats not what he was talking about.
IMO regulation is not necessary.

We need more free speech. We need to be building 3rd party moderation. We need rights to have speech & interoperability atop online systems. So we can build our own defensive tools, build our own regulation, so we can moderate & rate users as we want. We need more ability to build overlay networks, and let progress & change shake out.

Currently we're just at this stalemate because we're fully dependent on these entities. Rather than regulate & further restrict the system, we need to open things up & get out of this horrible rut.
> trust in the DeFi economy

I thought the whole point was to be trustless?
How Much Does App Development Cost in 2022?
It depends what you mean by 'need'.

From the perspective of eudaemonia, yes, the surviving population needs goods and services to continue. With a sub-replacement birthrate, there are fewer 'new' people to provide the goods and services for the remaining. This creates inflationary pressure and deprivation.

From the perspective of 'will the world end?' no- the Earth will continue to exist even without any people at all.
> Because I was taught at a young age to assume everyone is fallible and question assumptions

It is generally a good idea to have some familiarity (or better still, expertise) with a topic and knowing what the actual assumptions are before questioning them.

I was very surprised that you had that kind of expertise in high school. For eg, did you know about the electromagnetic field theory and Maxwell's introduction/invention of displacement current in high school? Or reimannian geometry?
No, cryptocurrencies are reduced to "mailing cash to an anonymous postbox", which has a lot fewer guarantees. I'm happy giving cold hard cash to buy something from a brick-and-mortar store to be delivered in the future.

I'd never mail cash for that purpose.
Former Netflix engineer and manager here. My advice:

Start a greenfield project using what you know (unless your main goal is learning) keeping things as simple as possible.

Microservices is more often an organization hack than a scaling hack.

Refactor to separate microservices when either:
1) the team is growing and needs to split into multiple teams, or
2) high traffic forces you to scale horizontally.

#1 is more likely to happen first. At 35-50 people a common limiting factor is coordination between engineers. A set of teams with each team developing 1 or more services is a great way to keep all teams unblocked because each team can deploy separately. You can also partition the business complexity into those separate teams to further reduce the coordination burden.
In the 1960s we looked ahead and worried about the population bomb, what would happened with unfettered population growth: https://www.smithsonianmag.com/innovation/book-incited-world...

Those worst case scenarios didn't end up happening because of changes that occurred.

Now we are looking ahead and seeing the opposite. That will motivate change as well -- but we need to have change.
Dead things have an unfortunate tendency to break, and cannot self-repair.
Was there no way to do this in Apache Arrow, or with some modifications to Arrow?