skysight-inc/HackerNews huggingface dataset:
> I find it a bit sad that a tech literate group is bashing a non-literate group fo people.

Creating a software bill of materials is a technical task. Managing software security risk is a technical task. These need to be performed by a technically literate person.

A Fortune-500 company has the resources to pay for such technical competence. They are not a mom-and-pop shop.

No Fortune-500 CEO would get their teeth done by a fly-by-night "dentist", nor would they hire "builders" who can't nail two planks together. They would pay for the expertise. If they don't know how to find the expert they would pay for the expertise of finding the expert first and then they would pay for the expertise.

But this is not what they did. They found someone who is both lacking the necessary technical common sense and is terribly arrogant. That is worthy of ridicule. And I'm not ridiculing the individual employee but the whole company.

> The premise that when the less educated and informed try to question something they don't understand only to be left with pandering and jabs is disingenuous.

That idea flies when a student is lost in the woods. When an economic juggernaut combines technical illiteracy with a lack of tack they can get the sharp ends of our tongues.

> The entire reason your salary is much larger than many other career paths is because of your ability to deal with technology.

Won't be for long if we silently support huge companies to employ muppets. Which is why asking for a support contract is the right answer here.
Not that I agree with it, but here's the FBI view:

"Not only can the violation of intellectual property rights damage the economy, it also poses serious health and safety risks to consumers, and often times, it fuels global organized crime."

https://www.fbi.gov/investigate/white-collar-crime/piracy-ip...

No helpful detail on why it's not safe.
Thanks! I also have to say that you have a very accessible writing style for what is a rather convoluted topic and that the interactive schematic tool is a great aid.
Or XOR
True, the status quo benefited them. But also, when the status quo did get shaken up, it resulted in half a million dead. A leader with any foresight would hesitate to open that particular Pandora's Box.
Indeed, it’s essentially a single player game, but we’re talking about which bot a player would want to use which is inherently a notion of bots competing against each other.
All builtins functions can how render doc with `:doc` in the `nix repl`. I think there's work to make this possible with any arbitrary function.
It's not like it was different from pretty much any modern post-war fuckups. Exit strategies never make it past any paper they were ever written. It's not like after hostilities the feelings, beliefs, etc of people on either side have suddenly changed. In fact, I would venture a guess that they feel even stronger.

This is why I feel like the people were told to wipe out every man, woman, and child in stories from biblical times. If you're going to do it, do it. Otherwise, people are left with sentiments that will fester and eventually boil over again. However, even in the biblical stories, that doesn't happen, and the two sides are bitter ever since.

Regardless, the only winning move (to any war) is not to play.
> Then if you're running on a server/VM/cloud, it seems to me that you should be treating your systems as cattle instead of pets. I never update packages on servers, I build a new image/instance, test it, and replace the server.

I have six or so servers, all of them configured differently. Not completely differently; they share some configuration. But not very similarly either.

They're pets. They have a lot of state. Backups are running, but I certainly don't want to reinstall them.

Despite being pets, I still want to do as little work to manage them as I possibly can. NixOS is great in this scenario.
Wait, they had Cheetos lip balm and I missed it?
hey, are you me? :-)
Fresh Concern over Google's Alleged Ad Auction Rigging
MIT App Inventor is more than a decade old, https://appinventor.mit.edu/
Unfortunately, water isn't as simple as electricity.

Pipes almost always end up having turbulent flow inside, in which case, pressure drop is proportional to flow rate squared. Whereas for electricity, voltage drop is always proportional to current. This leads to problems when trying to use circuit analogies when trying to solve for pressure drop in a system of pipes.
Title is misleading. They didn't really suggest to delete the tweet because of the fact it shows their data collection, but because it contains some PII like the user's address.

I don't want to side with Amazon on this, but I genuinely believe there is nothing strange here: Amazon collects all that data, and under GDPR they have to provide all the data they have on your profile. Seems pretty standard. Google provides the same amount of data (or more) if you ask :)
In network hospitals usually can't charge a facility fee, but it will depend on your plan. Honestly, Congress needs to act on this. Most hospitals get Federal funding.
> Easy example is a chimney - they're only trying to get rid of the exhaust gasses we don't want inside, and DGAF if it is cold or hot. In fact, heat exchangers are often installed to attempt to capture some of the lost heat and minimize losses.

Good example, except that you need a certain amount of heat to carry away the water (steam). I believe the rule of thumb for old-style furnaces is 80% efficiency with the 20% carrying away the water vapor.
I am a little sceptical. So you pay the same at all equivalent restaurants, the same for all cars, etc.? So if you were going to buy a thing at price $x, and someone were to tell you "Hey, here's a discount available if you use this coupon!" then (since you were going to buy it at $x it provided commensurate value) so you don't use the discount to bring it down to $(x-d)? I don't think that sounds right.

There is some value in the firm having a culture of unity, etc. but bigger companies are going to just negotiate with individuals as buyers in a labour market similar to you buying a car warranty contract.
No idea. I was just trying to guess at why it might flag a single byte file as a copyright infringement.
> The configuration.nix "defines" the whole system, but obviously doesn't touch anything in /home

https://github.com/nix-community/home-manager

> or /var, so that's on you to back up, migrate, whatever.

https://grahamc.com/blog/erase-your-darlings

https://github.com/nix-community/impermanence
All humans don't think alike though do they? I'd sum up my unintentional journey from OO to FP as the realization that I'm not smart enough to do non-FP. Not saying OO is "wrong", but that maybe it maps better to your mental model than it does mine.

I can easily jump into a more functional oriented codebase and reason about functions with clear input/output and no side-effects. The realtime REPL compiler in my brain can track the private state of functions. And while not all functions can be 'pure', most can be. With OO? Forget about it. Side-effects everywhere, that often aren't obvious when you are new to a codebase.

And when I say "new" I mean it as in "not currently very familiar with". Which includes code I had written myself - years ago - that I have to relearn.
Global video game market value from 2020 to 2025 (in billion U.S. dollars)
This is indeed not very good. Note there is a reason that overridePythonAttrs exists: it overrides the call to buildPythonPackage instead of mkDerivation. There is/was an RFC on standardizing overriding in Nixpkgs but it got stuck. I think for these things to improve what is really necessary is funding to improve Nixpkgs. These kind of issues are fairly hard to solve as they span multiple ecosystems and require coordination.
So... lie to someone who is making an effort to protect customer data in order to steal money?
What kind of ecommerce damage is php's fault?
I don't know if they would lie in this case or not. Probably not about the exact wording but when it comes to context, well, they've certainly published bizarre and untrue claims in the past on other topics.

Re: other outlets. I don't think any outlets are reliable on those topics because the whole idea this is really happening at scale seems to be made up.

Re: on what basis. Having read them. See the paper this thread is about. Also, having worked on bot fighting professionally before at Google.
> (e.g. infrastructure as code)

Terraform configuration for AWS is AWS-specific. It cannot be ported to other stacks. Of course, you could design your terraform code such that you only use modules that abstract away the cloud provider (presumably you'd have to write them yourself), but I'm not sure if anybody does that, and if so, it probably suffers from the same downside as "database-agnostic code", i.e. lots of potential for optimising for a specific hoster and/or for using specific features exclusive to them goes to waste.
It’s really up to the user to determine whether it’s worth it for them. I work in security, so I eat my own caviar in my personal set up and like to test things out.

All hardware dies, but I also have different keys from different vendors (not just yubico), purchased at different times. The likelihood that all 3 die at the same time is very low. Whether it prevents an attack that would be successful without the physical key (e.g. SIM takeover) is something I won’t ever know. Both of those scenarios are very low likelihood.

But to have this level of security requires extra work, and part of that work is regularly testing that the keys still work. With the increasing account lockouts, this thread is showing me that physical keys may have another advantage.

Most people are set up so that their email account is a “Jesus Nut” [0], so this extra level of security is well worth it as it protects banking, personal files (g drive & photos), password resets / password manager, and purchasing capabilities.

An approach I like is using one’s birthday as a reminder to reset important things - check security keys, check batteries in critical items, test security system, etc.

[0] https://en.wikipedia.org/wiki/Jesus_nut
I meant more the aspect that with TypeScript people would prefer to write in it and then compile to JavaScript because there is a benefit. With a PRQL with an SQL compilation target we would reap the benefit of a more practical and better syntax. In both cases they bring benefits but not in the same way.
Never said knives were less dangerous than guns just that an assailant swinging a knife can do damage, but if your argument is that if get rid of guns we can get rid of mass killings, then may I direct your attention to the 86 people who were killed by a truck.

https://en.m.wikipedia.org/wiki/2016_Nice_truck_attack
The images, attributed to the auction house, are a little funny. It seems like they cleaned it up, but perhaps the 'found in a field' story is so cute, they hope it might actually contribute value and chose to photograph it back in dirt?
At a past employer, this was a lot of the reason for a lot of the things we did. If we looked, we were accountable. If we were ignorant, that was sufficient defence to our bosses and their bosses.
"The cloud" also includes massive time sinks like Kubernetes or lambdas with a million of AWS services that can also become a huge distraction to building the product.

It's perfectly possible to build a MVP using a single VM and rsynched PHP code. The iteration speed (when solo) and amount of control is probably higher than anything you're referencing to.

In the end what matters the most if what technologies you're already familiar with.
I agree. The only reason these "stakeholders" have any leverage at all with which to push this is the fact semiconductor fabrication currently costs billions of dollars. So while it is possible for us to make our own freedom-respecting software, freedom-respecting hardware is out of our reach. Hardware manufacturing is concentrated in the hands of few corporations and those are friendly towards the copyright industry and good targets for government regulation and intervention.

Some kind of innovation that lets people fabricate at home is necessary. Just like the free software compiler changed the software world, the free as in freedom fab must do the same for computer hardware. Access to fabrication must somehow be democratized or we'll never be free.
Yeah. I guess different people have different expectations. As long as I'm entertained in some way I'm usually happy with nearly any movie.
I'm one of the authors of the YAML specification. https://yaml.org/spec/1.2.2/

To date we honestly have not identified a case where where valid JSON is not valid YAML 1.2.

If anyone can point out a case where this is true, please file an issue here: https://github.com/yaml/yaml-spec/issues/
Annoying their home page tries to break the back button in my browser.
If it's a safety issue and you're a professional engineer, this is absolutely untrue and a dereliction of duty. See: https://www.nspe.org/resources/ethics/code-ethics

> 1. Engineers shall hold paramount the safety, health,
and welfare of the public.

> a. If engineers’ judgment is overruled under circumstances that endanger life or property, they shall notify their employer or client and such other authority as may be appropriate.
At least they're smart for putting most of their population on the inactive islands like Oahu.
Those two sentences that you wrote are precisely the hydraulic analogy. If it weren't, instead of electrons it would be charge (that can be positive or negative), or field strength (if you explain the transitory period of a capacitor or non-DC), and voltage would become not the force, but a number that applies to conservative fields that allows to calculate the capacity to do work relative to another such number...
I don't know about "we," but I try look at the explanations and evidence provided for each argument.
Hmm, is it error, value or value, error? In this situation, I'd prefer something like std::optional or std::variant, which you can't get wrong as easily as swapping two variables in a structured bind.

Those have their problems too, though, and I'd never claim std::variant is "nice" to use.
Though there's been an uptick in its usage recently, people have been talking about "web3" for several years as well, and so far as I can tell, it basically just means "blockchain and cryptocurrency, but we try to build them into a new kind of WWW".

What's so special about the upcoming year?
Yep, it can/will happen. My assumption is that this is related to Curl, which has a pretty well documented license. Responding to emails like this with an automated email pointing to the license at https://github.com/curl/curl/blob/master/COPYING seems like an obvious thing to have setup.

Namely: THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN
NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
OR OTHER DEALINGS IN THE SOFTWARE.
Agreed, I don't understand why there'd be any long term benefits with building a brand at a company. The only one I can think of is that one is able to latch onto the popularity of the brand and present at conferences in an official capacity, and then once one leaves the company, their followers can still follow them.
to be honest i find this makes it just more complex and less readable then normal sql
If you shut down the exchanges that give dollars for crypto, it would be de facto illegal.
Bitcoin will hover between 10-100 million USD, yes.
Worse, diet soda can trick your body into releasing insulin to process glucose, but since there isn't any glucose, you glucose level falls off, or you develop insulin resistance. It's better to drink less regular soda than a lot of diet soda.
Lava will likely flow there again the next time Shasta erupts.
Read research papers on a topic of interest to you.

As of now I try to limit the time I spend on HN. I skim through articles very quickly. OTOH I recently reorganized my collection of research papers, most of them obtained thanks to that Kazakhstani heroïcal woman. I pick one and read it from start to finish, over the course of a week, a month, whatever. I often do not understand what I read. Little by little, reading again after a few months the same article, I understand one paragraph more :)

The two golden rules:

- stick to the most important, breakthrough papers

- read a paper from start to finish, even if you do not understand it. Do not block, just keep reading.
cities like Indianapolis and the ability for all Hoosiers to live freely without the fear of what lies on the other side of the Ohio River.

Whoo, boy, someone needs to go read about Indianapolis and its relation to the Ku Klux Klan. What a black person needed to fear up until at least the 1980s was firmly north of the Ohio river (the Indiana side). Need gas? Stop somewhere other than Martinsville (to the south) or Elwood (to the north).

I grew up in Indiana, and it was no bastion of civil rights. In fact, one of the motivating factors to moving the hell out of there was when the county prosecutor for Indianapolis' county said that a car full of black young men was probable cause for a traffic stop (Stephen Goldsmith, circa 1990 or so). The day after our wedding in the early 90s, it took a little longer to get out of Indianapolis for our honeymoon because there was a KKK rally downtown clogging up the works. (Granted, it was probably half dozen pathetic old men in Halloween costumes, but still...)

So let's not glamorize Indiana as this safe haven for black folks. Maybe it is now, 25 years after we moved (EDIT: ya know, my classmates still live there, so no, it probably isn't), but within my lifetime it has been anything but.
NFT as in “No Fucking Thanks" sounds about right.

Reminds me of the "Pet Rock" phenomenon of the 70's.

https://en.wikipedia.org/wiki/Pet_Rock
Also charge $1/page for the printing. Then ship it to them, in triplicate, and charge for the overnight shipping (it's an urgent bug after all).
The Truth on the Blockchain
I've switched to Backlaze B2, which has a bandwidth alliance with Cloudflare. Even without it, B2 egress is something like 1/5th of S3, so may be worth thinking about.
Four attorneys general sue Google for allegedly tracking you without permission
I don't know if Dunning Kruger effects on Facebook posts are anything new/wonderful/strange.

This thread reads like somebody who just heard about the Collatz conjecture, and after half an hour are sure they have a solution.
JPMorgan Chase closes Uniswap founder's bank accounts
One could easily argue that true reconstruction was not really tried in the Democrat-dominated South until well after the 20th-c. Civil Rights Era. It was only with radical Republicans' reform efforts culminating in the 1980s that the formerly backward, socially archaic "South" was turned into the free-wheeling and economically successful 'Sunbelt' of the present day.

This is often overlooked by many political commentators who look at the otherwise unexplained, sudden popularity of Republicanism in the Sunbelt, and make up weird theories such as "the parties must have switched", or something. The reality is of course far subtler and more interesting than that!
apologies then! i dont understand how a tui app is necessarily get-able or installable or distributable. system package managers are more than capable of managing GUI apps, and a GUI can be distributed by uploading a zip to gh releases, just as a TUI app can be.
Yeah what is this? Immediately turns me away from anything they offer
I've seen people make the argument that the Constitution is inherently corrupted because it was written by white slave owners, and that it doesn't represent all people because there was a time when it didn't represent all people (slaves).

It's obviously horrible that slavery happened, but what would add insult to injury would be to throw out a brilliant set of ideas because the flawed human founders didn't follow them in totality.
This looks like a fantastic resource. Thanks for sharing!

I really enjoy the Bayesian side of ML, but it's definitely not the most accessible. Erik Bernhardsson cites latent dirichlet allocation as a big inspiration behind the music recommendation system he originally designed for Spotify, which is apparently still in use today[1]. I still struggle with
grokking latent factor models, but it can be so rewarding to build your own
and watch it work (even with only moderate success!).

Kevin Murphy has been working on a new edition of MLaPP that is now two volumes, with the last volume on advanced topics slated for release next year. However, both the old edition and the drafts for the new edition are available on his website here[2].

The University of Tübingen has a course on probabilistic ml which probably has one of the most thorough walkthroughs of a latent factor model I've found on the Internet. You can find the full playlist of lectures for free here on YouTube[3].

In terms of other resources for deep study on fastinating topics which require some command over stats and probability:

- David Silverman's lectures on reinforcement learning are fantastic [4]

- The Machine Learning Summer School lectures are often quite good, with exceptionally talented researchers / practictioners being invited to provide
multi-hour lectures on their domain of expertise with the intended audience being
a bunch of graduate students with intermediate backgrounds in general ML topics. [5]

1: https://www.slideshare.net/erikbern/music-recommendations-ml...
2: https://probml.github.io/pml-book/
3: https://www.youtube.com/playlist?list=PL05umP7R6ij1tHaOFY96m...
4: https://www.youtube.com/playlist?list=PLqYmG7hTraZDM-OYHWgPe...
5: http://mlss.cc
Agree 100%. I often get frustrated by things in GCP IAM that seem overly complicated (i.e. it's not at all easy to get a simple view of "show me all the resources this identity has access to").

But that said, at the end of the day you WILL need the concept of users, roles, permissions, and restricted access to resources based on those permissions. That's a ton of work if you're doing by yourself, and you're likely to get it wrong.
As the other replies, I also agree with you, I've been a bit upset by Canonical for their support to Microsoft in making WSL, I'm not sure Linux has anything to gain from the thing, if not a bad advertising due to the suboptimal experience, but also it is a Linux system that has to exist under the government of microsoft which is a bit scary for me, but yeah I agree with you, I also see them working together for WSL, and at some point I see M$ buying Canonical
This is great.

Probably most HN users know that, of course, if someone buys an Alexa and keeps it in their home, it is going to have a bunch of audio recordings of them. And all of the Whole Foods transactions will be logged as well. And even a silly amount info about how they use the Kindle.

But I don't think most Twitter users know.

I also enjoy that there is a tweet about how to request your data from Amazon, here: https://twitter.com/AlinaUtrata/status/1485196120997478404

Next I wonder if Amazon will badger Twitter to take down the tweet on the basis it has some PII (which I'm not even sure it does, but if it does, it is the users own information. And afaik you can't dox yourself.)
This is the purpose of the contract. You have to spend $200B, so you go to several large customers and sign contracts contingent on your ability to supply which will guarantee you $300B in future revenue. Now you can raise funding against the guaranteed revenue and the dumping can't change that because the contracts are already signed.

To prevent this the incumbents could go in and undercut you before you actually build anything, but that's not much of a cartel anymore then. Anyone could "compete with them" just by threatening to raise funding.