skysight-inc/HackerNews huggingface dataset:
Previously: https://news.ycombinator.com/item?id=3614640

I think it’s a nice post. Makes sense.

There’s probably a lot more to it, though. How we tell people is fairly important. I like the author’s self-effacement.

Some people are so good at "telling people," that they don’t need to actually do anything (but they still work just as hard).

I do both, but I’m not so good at self-promotion. I suspect that people feel that my "tell people" is empty boasting. I'm not a fan of the "humblebrag." If I say something, it's a fact; usually accompanied by links to resources that prove it. I won't make claims that I'm not ready to prove, but I will also mention what I can do.

I’m often told that I’m lying, or inflating, by someone that never even followed the link that I provided in my statement (that proved what I stated). Getting that from prospective employers, was infuriating, and a big factor in my deciding to stop looking for work. I don't like being called a liar.

I have three Twitter accounts (a personal one, and two corporate ones, for each of my companies), but I seldom use them. Social media is hard work, and I prefer to budget my hard work for the "do things." Pretty much all my social media interaction happens right here.

I don’t especially care, anymore. It’s bemusing to have someone hit me with an insult[0], where they could have avoided embarrassing themselves, simply by clicking a link. It’s amazing that we are so focused on attacking others, that we jump at every opportunity to do so. Not sure what it buys us. There was a post, yesterday, about the "tone" of HN. I haven’t been here long enough to know whether or not it has declined, but this joint is Sesame Street, compared to a lot of other venues.

[0] https://news.ycombinator.com/item?id=27517422
Another case in point: postgrest - a clever play on postgres and rest.

Now try searching for any issue about it or even documentation about it in Google. All results are about postgres.

Even something as popular as rust the language has to compete against solutions to prevent the actual rusting and the game and the movie.

Sometimes I wish most software were given a uuid as a name. Life would be much easier.
JWST is expensive for two reasons. One is the giant heat shield, as it is an infrared telescope. There is no real way around that.
Secondly it is the space in the rocket, the mirror (and everything else) had to be folded to fit into the rocket. Getting this folding mechanism to reliably unfold was the big challenge - if anything had gone wrong, there would have been no recovery.

With its 8m diameter, Starship could house larger telescopes without folding. Considering how cheap a Starship by itself is, the Starship itself could be the permanent housing of a large telescope. It would just need to jettison the tip to expose the telescope inside.
When thinking about something like a telescope, you pretty safely ignore the concept of "photons" and think about light entirely as a wave. And waves do interfere with themselves.

Light as something made out of particles is relevant only for the photovoltaic effect and quantum-scale interactions.
If wee all worked in one global corporation and it had Yammer, that's LinkedIn. Except there is no asshole lady from marketing or HR who would delete without notice snarky or awkward posts. I sign in multiple times a day no idea why... anyways, yesterday I was strolling around downtown and noticed a homeless person, my son said "dad, look a homeless person", I stepped into chewing gum and noticed 5 euro note. Gave the note to the homeless and received in exchange American motivational book. I decided to share this with my manager and received another American motivational book.
> Foxcon's worker's deaths are a cost of doing business of delivering iPhones to YOU the consumer. Their blood is on YOUR hands.

Correct. If you bought iPhones from someone you know is driving people to suicide with their business practices, you're at minimum accepting that.

If there's an alternative to the iPhone that doesn't do that, then yes you should indeed be triggered to consider switching. To not have to consider it is to think you're not the one paying money to the party to run the business process they do, which drives people into suicide.

Of course culpability is not on a spectrum. Of course Foxcon directors are much more responsible than you as a consumer. But to act like you have no influence in the matter would be false.

Unless you have no other options. But in your example you do. And reducing your gas usage long-term also absolutely reduces the amount of gas infrastructure required, and the amount of gas leaks. Mad-made gas leaks and consumer gas usage correlate, perhaps not perfectly, but they obviously correlate strongly. Just like child labour and demand for diamonds correlate. Just like iPhones and worker suicide (versus say, a lower correlation for the Fairphone) So yes, it's entirely normal to consider green alternatives to gas as a consumer because in the end, the leaks exist because pipes were built for us because we demand gas.

Does that mean it's the only solution to these leaks? No. But apart from voting in elections or otherwise driving political change, (encouraging others to) voting with your wallet is one of the few influences you have to solve these problems.
> That can't happen.

Yes yes i've heard that one before. I've had many bugs "that can't happen" over the course of my lifetime. Fortunately none of them involved a car so i'm still around to talk about it. A few years ago, somebody would have laughed at the idea of Boeing producing fallible equipment, especially since we as a species have decades of experience of air travel. Now would you still say it's unthinkable that Boeing could produce faulty hardware/software?

A link that gets posted on HN quite often contains many such bugs "can't happen" bugs, that aren't even caused by AI : https://beza1e1.tuxen.de/lore/index.html

I also remember some threads about high-range medical equipment (in actual hospitals) killing people due to software bugs.

> And any application of the brake disengages autopilot/autosteer and also automatic cruise control with an audible chime.

Is that a physical kill switch that triggers a sensor to produce an alert/chime? Or does the sensor ask politely the computer who actually controls the car to disable the autopilot? In the latter case, i know of no way to make this safe: for example what happens if the sensors requesting human control back die, short-circuit, or otherwise malfunctions? Or if the program enters certain kinds of memory violations? Or any other software/hardware fault?

> I'm not sure what you're saying.

I'm saying i've seen enough bad engineering (not always, but sometimes along with bad faith) across all fields i've been even remotely involved in. And i'm saying i don't even remotely trust the >100 micro-controllers you find in a modern car whose schematics and source-code we can't inspect. I mean i don't fully trust mechanical hardware either, but at least with it symptoms and failure modes can be easily reproduced and debugged.

And i'm definitely saying i would never ever trust a machine-learning algorithm with life-making decisions. More on this topic:

- James Mickens at Usenix on why AI is usually a terrible idea: https://www.youtube.com/watch?v=ajGX7odA87k

- jwz's blog (another HN favorite) is also full of examples of AI failures ; a fun harmless example: https://www.jwz.org/blog/2021/06/using-ritual-magic-to-trap-...
Captained by A.I., This New ‘Mayflower’ Will Cross The Atlantic This Spring
> Sure, but that should really be a permission you have to grant explicitly.

That could work but still feels dodgy since if you can grant that permission to a clipboard manager, you can also grant it to something like a TikTok client or an Adobe DRM reader or whatever else program you want to use (ie. the reason you are using your computer in the first place) but also might want to snoop for your data.

IMO a better solution that wouldn't break existing clipboard usage is to have a second "secure" clipboard that you can lock as tight as you want with explicit permissions for reading it, notifications for writing to it and whatever else you want. Then password managers would copy data to that and text editors and browsers can have a "Copy Sensitive Data" (or something better worded) in addition to "Copy" that will place data there.

Sure some people will still use Copy but some people will also stick post-it notes with their passwords on their monitors and give thousands of dollars to Nigerian princes - you shouldn't to punish everyone for the ignorance of a few.

> For global keyboard shortcuts an app should make commands available and it should be up to the user to tell their OS which shortcuts they want to give an app. Not just for security, but also for customisability and to avoid conflicts

This only works if all applications are using the same framework and toolkit and target the same OS. Meanwhile notice how even when you limit yourself to applications targeting Windows alone there are tons of different frameworks - let alone cross platform applications that tend to use a lowest common denominator approach.

IMO if you want to get more secure functionality, you need to do it in a way that works alongside existing practice - hence containers and sandboxing for untrusted applications working alongside trusted applications that can do what they want. Unless you start everything from scratch on a brand new computing approach (like mobiles did and even then it barely works and despite people treating mobiles almost like consumables), trying to force a top-down approach to security is doomed to fail.
You leave, the last time I really felt exploited I didn't even feel the need to negotiate, I just left.
There is no point in trying to make things better with people who are knowingly exploiting you, you don't negotiate with tyrants.
I hope you are referring to their lifetime warranty and replaced them free of charge when they broke! Top company.
https://koss.com/blogs/stories/use-koss-headphones-limited-l...
Hmm ok I'm definitely not communicating properly what it is then...

I'm not sure what nomenclature I could use besides "data format" to describe what this is, any more than one could describe JSON as anything other than a data format...

The security aspect is where I'm having the most trouble communicating, because it's just not a well known issue. The problem comes from the different ways that codecs deal with the data they receive (for example Java Codec A vs Golang codec B vs Python codec C vs Python codec D, etc). If the spec isn't strict enough, a conformant codec could behave in ways that are insecure when coupled with other systems.

Security really does start at the specification, in that the spec has to define what a codec can and cannot do. For example:

"A codec MUST reject invalid characters. It MUST NOT truncate them or replace them with the Unicode replacement character".

A rule like this would prevent the admin\U+D800 vulnerability because a codec is not allowed to behave this way (truncating or replacing). With JSON, this isn't specified, so systems where the same data is parsed by multiple subsystems are vulnerable.

Specifically regarding the admin\U+D800 problem:

Any sufficiently complex system will have multiple subsytems.

So say you have a user-facing system that accepts a "new account" request in JSON. The attacker passes in "admin\U+D800" as the group (meaning the 5 character "admin" plus the unicode character D800, which is invalid).

Your account creator's JSON decoder ignores bad characters, so when it checks the group vs its blacklist, it finds that "admin\U+D800" != "admin". Validation passed, it sends the new user info to the account storage subsystem (as a JSON message).

Your account storage subsystem's JSON decoder silently strips bad characters, so your account subsystem only sees "admin", not "admin\U+D800".

Now this new user is an admin, thanks to a privilege escalation vulnerability brought on by a lax JSON spec (all codecs involved were conformant).

If the JSON spec had specified that "A codec MUST reject invalid characters. It MUST NOT truncate them or replace them with the Unicode replacement character", this kind of vulnerability could not happen with a conformant codec.

Thanks for the feedback!
Certainly! We've already indexed the Bored Ape Yacht Club collection and have the color hexadecimal used per pixel for all 10,000 of them. Finishing up CloneX Now.

We are seeing several color minting strategies spawn, and one of them is minting a color that is often used in one of the more expensive NFT collections. For example, someone minted these shades of red, blue, purple which are prominent in Cryptopunks: https://color.museum/gallery/9786703 & https://color.museum/gallery/6522262 https://color.museum/gallery/9334710

Interesting times ahead!
Based. Endorsed. This is how jobs should be assigned. #ByCrom
I still don't understand why this is so hard to understand:

Developers can absolutely develop an app with whichever payment system they want and keep all the income to themselves. Develop a web app and do whatever you want. You integrate with whichever third party systems you want and provide the experience you think is best for your users and yourself. Anyone will be able to use your web app from an iPhone as much as they will be able to use it from a Desktop device.

However, if you actively choose to develop a native iOS app in order to integrate with Apple's native APIs in order to provide an experience which can be superior to a web app then it's not a far stretch to expect you to therefore integrate with Apple's native APIs across the board, including payments. I mean that is literally why you choose to develop a native app, because you want to provide EXTRA value to your users by making use of APIs which Apple invested in.
Good question. You only pass it with an interaction event. (And you revoke the capability once the interaction is over.)

Not perfect: stops background pasting without interaction tho. To do better, the only way I can think of right now is having paste only triggerable by a secure context (e.g. keyboard shortcut, as above). Any mechanism by which the user can declare "I intend to paste" in so many words without the app being able to forge it.

But that needn't rule out context menu paste, I don't think, if there's a way for the secure context to unforgeably decorate the menu when it declares it wants a paste action.

It's a fun thing to think about the design of. I encourage us all to try to think creatively about it rather than quickly jumping to "it can't be done".
My eye opening introduction to this topic was:

Ancient Chinese Historian Describes The Roman Empire // 3rd century AD "Weilüe" // Primary Source

https://www.youtube.com/watch?v=4XdPodNwSGU

It's amazing how a shallow knowledge of history can make these sorts of things seem so impossible for some reason. People definitely knew way more than I'd given them credit for.
As I understand things, without the calibration there would be 18 images overlaid each other with some shift in between. Each mirror has quite some degree of freedom, so they have to be aligned to each other until you have one sharp picture. Right now you might see each star 18 times in the picture. Probably they have taken some test images to check the operation of the cameras, but thats about it until a good degree of alignment is achieved.
> If the vaccine works then you have nothing to worry about.

That is not how any vaccine works. A vaccine decreases the chance of a catching a disease, it does not eliminate it.

The way the disease is eliminated is by getting as large a fraction as possible of people vaccinated, so that spread is stopped.

Surely this is not the first time you have heard of herd immunity?
USDT(#1) and USDC(#2) have printed 150 billion dollars out of thin air. If you look by volume, these are the only 2 coins being used in any real capacity
Feeling pretty great about getting the correct letter in 27 guesses…
This is pretty useful. Wish it supported ASS file formatting better though.
Wait, Angular JS is on that list ?
Bitwarden does as well, though it seems more like 20-30 seconds.
Currently writing a clipboard manager[1], I've seen some things as well.

- So far ran into two applications which don't even implement the X11 clipboard specification (ICCCM section 2) correctly - xsel and Emacs (patches submitted).

- By far the worst offense I've seen in clipboard privacy on the Linux desktop is RedHat's virt-manager. It sends your clipboard AND selection content to all virtual machines, even when they are not focused, with no indication that it's happening, and with no GUI option to turn it off. This is at odds with the common practice of running untrusted code in virtual machines.

- X11 being network-transparent makes its protocol fairly malleable, so it's not difficult to bolt some privacy on top. hax11[2] has an option to restrict access to the primary selection for configured applications (though, for truly malicious applications, you may find X11's security model generally lacking).

[1]: https://news.ycombinator.com/item?id=29808487
[2]: https://github.com/CyberShadow/hax11
There are certainly things I like better than other things. There is probably a fair bit of overlap with what you like, but also certain to be differences. Where they differ, am I right, or you? If one of us is not wrong, then one is not objectively better.

A system for understanding consciousness that depends on objective merit will face very stiff competition from those that don't.
You can search this pretty easily but the most obvious one is he was taking about Epstein years before the rest of the media.
I really don't see how whether he paid or not for the seat has any influence. The rule is that plane staff has ultimate authority regardless of any external factors. Even if he owned the entire plane he should have been dragged out of it if the pilot wishes that.

He can take whatever actions he wants but only after he's out of the plane.
Angular and angular JS are different things
I think unruly airport staff to unruly passenger ratio is very close to Zero. I don't think your anecdote is very meaningful.
not just developers. I know loads of people who have such great product - coaching services, graphic design, you name it. But they retreat into doing what they love (the product) and don't realise that you got to sell it - and that needs distribution. I only learned this through repeated failure, fortunate enough to have the economic resilience to bounce back
Sensible question. See my answer at the link below, but basically Facebook/Instagram IAB don't share cookies with your main browser.

Plus it’s supper useful to feed that attribution data back into the ad platforms management tools.

https://news.ycombinator.com/item?id=30205629
I had always suspected the Jesuits behind HN.
I wish I had this on my head in 2013.
This is typically the kind of idea that I don't understand: docstrings are here so the developer can state what *needs* to be stated here (the *not obvious*) the why, the how, the known limits...

Taking a comment as an example, compare:

if is_even(x): # if x is even

and:

except UnicodeError as err: # Can happen on malformed IDNA.

One is not usefull (but can be derived automatically), the other one IS usefull to understand the code, but *can't be derived automatically* (without a deep understanding of the used libraries behind the various calls in the try statement).
You guessed the 26 letters and then guessed the game was screwing with you?
Speccing something that is under-specced before coding and splitting big fuzzy task into a list of less vague tasks is a critical skill.

There's some similarity to big tech interviews: you often get an intentionally fuzzy task and your first job is to ask clarifying questions and tell your assumptions out loud. If you go straight to coding it's a big red flag.

In this vein, we can say that kind of interview prepares candidates to the real job where others are busy and don't have infinite time to write perfect specs and just hand them out to you to implement.
Problem is SSR with a JS framework is often slower than the other equivalents, not sure why but I see it time and again

Then the hydrations costs on the client typically start at 500ms, and that's 500ms the main thread could be doing something useful with
Indeed, distro is king. Reid Hoffman talked about this a decade ago. We kind of need to reread his blog post about it
Even though both my kids are in their early teens and graduated to using regular computers, I am building a dedicated PICO-8 machine: https://taoofmac.com/space/blog/2022/01/29/1830

They went through Scratch in a browser and iPads to Unity and Xcode (through Thonny on a Pi and Pythonista on iOS), but we all like PICO-8’s constraints and integrated graphics/music/code editing. It is a gem and feels better than the ZX Spectrum and C64 ever did, really.

So maybe just get a Pi or and old laptop and buy PICO-8 to run on it as an experiment.
People who don’t “build and show” in their free time do not necessarily have harder time getting hired, nor are they necessarily worse as hires.

Some people have circumstances or attitude where they prefer to get paid to build things. One can find oneself in demand by being good at networking, a capable and creative engineer, able to work autonomously, a good communicator and a pleasure to work with. I know some people like that.

If we are talking about valuable hires landing jobs, relevant qualities seem completely orthogonal to the inclination of building things as a hobby—if anything, the latter may imply a degree of unsustainability and/or tendency to flaunt responsibilities if it results in neglect of one’s personal life or previous job.
Damn that's the best 404 I ever seen
That’s actually a really solid and novel argument and you might have changed my opinion here (give me some time to think about it). The USD is backed by the military not by gold.
Exactly. Remove (or define) the jargon and this could be a piece that would resonate with any sort of project manager.
In a perfect world, this advice is absolutely true (and I've been guilty of it more than once). In reality, here's my experience:
- poor specifications from the start, with moving targets in the middle
- nobody available or willing to give definitive answers
- management stuck in endless meeting loops rather than having time to look at what engineers are actually doing
- engineering team (often severely) understaffed and dealing with multiple projects each - not time, patience or mental capacity to dive into what everyone else is doing
-> result: crazy amounts of wasted time for everyone

This, as so often, is a result of lack of time, patience and _planning_. It feels like "Agile" has become a convenient excuse to just start and figure out what it is we're building as we go along...
Google does what they think it's better for them and the user should do what it's better for him.
> IMO a better solution that wouldn't break existing clipboard usage is to have a second "secure" clipboard that you can lock as tight as you want with explicit permissions for reading it, notifications for writing to it and whatever else you want.

If we are going to break standard APIs then why not do away with the clipboard for secrets entirely and have a global secrets store that applications can pull credentials from directly and securely instead of passing secrets via a clear text protocol.

This is how Linux and macOS work (albeit I wish 3rd party stores could natively integrate with them). This is how cloud computing works too (eg AWS Secrets Manager). Using a clipboard for copying secrets is completely the wrong approach regardless of how much you over-engineer your clipboard manager.
Docly is not maintained anymore. Codist is in the process of shutting down. Sorry for the inconvenience
Can you play windows only 3d games in it ?