skysight-inc/HackerNews huggingface dataset:
AIUI the embedding is itself not the issue. The issue is that you are leaking user data to a third party, and this needs to be handled with care, considering the degree of threat to the user data, your legitimate need to use a CDN, and any possible consent. If your CDN assures you that this data will only be used for legitimate purposes and conforming to GDPR, I think (but IANAL) that explicit user consent wouldn't be necessary, as site owners have a legitimate interest in using CDN services. After all, DDoS prevention is even explicitly listed as a legitimate interest, and fulfilling this legitimate interest is itself enough to allow processing of personal data, without further consent. With the Google fonts ruling, the issue seemed to be that there was no such agreement in place, Google is known for aggressively building user profiles, and the technical need for this was judged to be low, as fonts are rather small and the site could have operated with self-hosted fonts. This was considered to go beyond the scope of the legitimate interest - it's essentially selling user data to Google to save a little on bandwidth, and that would require consent.

(Then there is a separate issue with a human rights dispute between EU and US that makes things a bit more complicated)
> various workarounds

Such as?

Edit: looking at the source code, it seems to take your local system time so that would be one. Wonder if I can just go through each country in random order without repeating.

$ sudo date -s @$(($RANDOM*$RANDOM))
A good programmer knows to call out the bullshit task, but also do it anyway when needs must.
Geographical pay in any industry with a geographically stable product pricing is wage suppression. If the product is a SaaS offering and it is sold from state to state for the same price then employees in each of those states should get the same amount of money for their work. Companies should not get to hand $300k in RSU's plus a $200k salary to someone in Mountain View, CA and only offer $150k in cash benefits plus a dental plan to someone in Texas. This contributes to the problem that I colloquially call state-to-state income inequality.
This is a synopsis of allegations.

Made by an extremely large and powerful corporation with (apparently) connections in the FBI.

Unless proven beyond a reasonable doubt, there's no point at all to be made.

Stating this all as fact until proven is irresponsible.
Why not just something like basicauth (or mTLS for all i care) at the reverse proxy web server level, at least for relatively low value assets?

It seems like security related functionality always has flaws or there are other RCEs that pop their heads up every now and then, another one in recent memory was an exiftool problem in GitLab: https://nvd.nist.gov/vuln/detail/CVE-2021-22205

So why not introduce software with a better track record, like web servers as an additional security layer (at least against automated attacks). In my eyes, that's a good middle ground between needing a VPN and having everything open, because zero trust doesn't work well when you don't constantly keep track of CVEs for the software etc. and have the resources to mitigate those almost immediately.

So, why would that fail, apart from basicauth not being the best solution technically?
Exactly. The fact is that the government is infallible, and any criticism means you think all corporations are benevolent.

Comcast SHOULD have a government-enforced monopoly over internet service! If you think that is overregulation: "Yes, damn governments always after our benevolent corporations"
I can’t accept this argument. In a risk matrix the probability is low but impact is high, so it’s still high risk and doesnt justify dismissal.

I think it bolsters the need for anonymity and privacy, especially online. In FL you have the sunshine act which makes doxxing particularly easy.
> Literally a trap to hand over your encryption keys.

I let my keys sync to my MS account. I mainly want to protect against untargeted theft of my computer, so having recovery keys online makes more sense than a recovery key printout or USB key in a drawer.
This has really got me thinking about the hidden costs of having one high tech device that does everything.

Like, I wonder if someone is running ML models on all of our sleeping habits based on phone alarms. Would be interesting to get some of the telemetry/tracking output from the clocks app.
>> Running form probably plays into that as well, if you've got some kind of suboptimal gait or you're swinging your arms a lot or something like that.

Yep, my form is atrocious and inefficient due to bunions and Morton's toe which has evolved into hammer toe.

I'd argue that I burn calories more efficiently, however :)
They didn't mess up, they're executing their business plan which might be summarised as "find minor infringments of attributions and, instead of asking for said error to be fixed, fire off demand for loot under threat of legal action"
I love RSS, have my own instance of Miniflux [1] on my Raspberry Pi and I got it connected with Discord and Matrix to read articles on the go.

[1]: https://miniflux.app/
There are limits to your ability to do so that are non-obvious, and the lack of those limits in the crypto space is a problem.

For example, you might be able to make a large payment in cash, but it will be difficult -- theoretically [0] -- for someone to bank that payment in one go without triggering money-laundering concern in their bank.

And unless you hoard cash outside a bank, you would similarly trigger notification rules at your own bank.

None of these systems are perfect, which is precisely why governments are uneasy about an automated system that could be even better at evading those rules.

[0] https://www.theguardian.com/business/2021/dec/13/natwest-fin...
Running Debian (Mint / MATE) for about 8 years.

Biggest issue, running Teams natively (vs web app) and accepting calls. The VPN plays havoc.
The EU is becoming increasingly hostile towards cash as well (e.g. no more 200/500 euro bills, bank ATMs are disappearing, ban on 3000+ euro cash payments).
People use windows because Windows does the things they need it to do, easily. The fact that that surprises you surprises me.
Both things can be true. He can be a sociopath who knows what he is doing and naive true believer of his own abilities in alternating time slices. Most crazy people are several contradictory varieties of insane all at once.
I assume it's because the conversation is pretty tired at this point. Post anything musk related on reddit and maybe HN and you'll get comments about Musk calling that diver a pedo, musk got his wealth from his dad's mines, musk having aspergers, or that musk can do nothing wrong.

We've all seen it a thousand times and I'd rather just read about what SpaceX/Tesla/Musk is doing currently than past shit.
Frankly speaking, I don't support this fight.

There is absolutely no good reasons for electronic payments to be anonymous. They never were and they should not be.

I understand it serves (yes here we go) crime, oh sure. But this is not a hill to die on.

This is not about a lack of understanding or FUD. This is about not letting crime happen.

There is no problem to be solved here.
If you choose to send money to an anonymous wallet for goods or services that have not yet been delivered, that's on you. The government can't eliminate stupidity with legislation.
My error. I thought I had the premium service as an Xfinity customer, and the ads were just showing up because these were sports recorded live. I definitely would have done that knowing. Well, almost definitely. Streaming DVR is just a shadow of what local disk DVR is. I can seek instantly at distances I configure. I can fast forward and see what's happening. I can do 3x fast forward that's perfectly smooth, and 2x fast forward with pitch adjusted audio -- that's so nice for a lot of sports or for boring sections of certain sports.

So commercial free Peacock would only get so far, and downloading the stream and playing it locally is still better. If you do it right, you can even do standard DVR -- watch the stream while it is downloading, so you are only a short distance behind live, and avoid spoilers.
An easy-to-use app for generating Sankey Diagrams to visualize flows and budgets
I wonder how that affects activation.
And even then, controlling the package versions is only one of the problems. The bigger problem which isn’t solved with this (as far as I can tell) is not having the machines automatically update due to how the snap software works.
This would have been an ok article in 2013-2015. Nothing really has changed wrt. these two technologies since.
I bet you could find some science to back up that opinion because I deeply suspect that's by-design.
2016 was the third impact
See you on Monday.

PS - I’m kidding, good luck.
What would you have the maximum salary be (or total compensation, whichever metric you want), above which people are no longer entitled to unionize?
I see no correlation between ability to track and oppressiveness of regimes. Scandinavian countries are great at tracking their people and very much not oppressive for example.

> I just want to be left alone, to think and behave freely, including the ability to share my ideas without fear of reprisal.

That requires the government to behave nicely, as long as the government would attack you if they knew about these things you would have to live in fear regardless if they tracked you or not. Freedom doesn't come from hiding things from the government, it comes from ensuring that your government isn't behaving like shit, as otherwise you will always dread the government finding out about your stuff. A person who has to hide what he does from the government isn't free, he is basically a refugee in his own country.
Trying again with timers internal to the code (previously used `time node ray.js`), initial go is 190ms, then 170ms, 160ms, and after that hovers around 140-150ms for the remaining 97 runs.

If I remove the FS operations it's instead 160ms initially, then drops to 130ms by the third go and hovers around there.
How do you do this as a business?

I have to provision computers for users. I have to supply them with accounts and passwords. This becomes impossible.
I think it's really sad that there is no readily available LTE wireshark...

I should be able to put any phone into 'monitor mode' and dump all LTE cell data that flows past. And then I should be able to decrypt my own data by getting keys out of my test phone - which should be a thing any phone owner can do through a debug menu.

Why doesn't such tooling exist?
He is missing integration tests in CI pipelines, and his only idea to this problem is to sell Bazel. Whilst he should propose to fix the problem by doing proper integration tests.
if everyone did that they'd have to start injecting ads into your email feed
I have not.

I could say that I have spent a lot of time and energy in my life doing root cause analysis, how you can steer people away from self-sabotage, how you can empower people to help themselves instead of being reliant on you for everything, but that's only the book jacket version of the real story.

The real story is sadder and I'm still actively dealing with the consequences of feeling like I needed to become an autodidact at the age of 8 to ever have any success at anything. Which necessitated spending a lot of time thinking about thinking. Self-teaching morphed into self-mentoring, self-doctoring, and self-parenting. Me, me, me (what could go wrong?) I watched my parents (from my perspective) abandon Discipline almost entirely with my kid brother, who has struggled his entire adult life, and even at 14 I could see this road ahead of him. I wish I had been like some stories where the eldest child takes care of the younger ones, but unfortunately he spent most of his childhood finding ways to push my buttons and we were never close (something my mother has pointed out as a mistake that is playing out now between his own kids, to which I responded, "Tell him this is why I never call.")

That story about my friend's kid reminds me a lot of my little brother and as you can imagine by the length of that reply, was a little triggering.
looking at videos YT is suggesting, which are mostly about construction of underwater tunnels, it seems it's common
How to collect leads at idea stage
OP meant O(1) in time and space (forgot the space but it’s in the linked article). That solution is O(N) in space.
Or you know... $1 at a garage sale or goodwill.
OCaml is one of my favourite languages. It's such a sweet spot in terms of conciseness and performance - yes there are a few language more concise and a few that have faster implementations but I can't think of any that are both as fast and as concise.

Tooling has come a long way too - very impressed by dune, it lets me do my favourite thing in the world which is hit save and run my tests automatically.

I'd use it a lot more if the ecosystem was bigger. Just can't justify a better language when I'd have to implement my own, idk, mutable ordered dictionary.
Not every leader does things through the internet friend.
The real reason why, is making anon donation from anywhere, via in cash, which means so e level of physical exchange.

Canada went banana, because crypto was used for the protests. Had it been cash, it would be harder to donate from 1000s of miles away.

I think this is all about foreign influence, or at least, the scared perception of it being easier.

Imagine, your enemies funding the scariest parts of your soceity, an
all anonymously, and from the comfort of 100% remote.

This is the fear, I think.
How can a consumer possibly understand smart contracts to the point where they even know if there's any protection? It would be wiser to assume that the payment has gone into a black hole.
> It's that you trust yourself with the self-control to not to use the devices improperly or in ways that could be self-harmful, or, if so, to be able to bear the consequences.

This sounds like something an addict would say. Not calling you out as an individual but instead highlighting the dangers of “I can stop anytime I want”.
Some combination of market pressure and regulatory pressure. Market pressure: it'll be harder to attract people to a position without a listed salary band once they get used to listed salary bands. Regulatory pressure: the law in Colorado isn't being enforced too strictly, per bkjelden elsewhere in the comments, but the law does require "the hourly rate or salary compensation (or a range thereof) that the employer in good faith believes it may pay for the particular job"[0]. If you post a ridiculous range, you're playing with fire; one report and one pissed-off regulator later and you might end up being the poster child for the state's enforcement of the law. I would personally not want to be on the receiving end when they decide to make an example of someone.

[0]: https://www.skandslegal.com/sks-blog/2021/1/15/colorados-new...
> You're paid to create value for your employer.

This pretends that there isn't a market for labor, with its own supply curve.

For example, the relative value you generate is not enough to value your wages. Else Marketers and Sales teams would make MUCH more than engineers. But for a given level of quality, there are a lot more marketers that can do as good of a job, and the elasticity is low (e.g. skills are "easy to learn" or develop in a short time frame) - hence why marketers tend to be paid lower than the average engineer with same level or years of experience. In the latter case, engineers are in short supply and supply elasticity is high (you can't just move from barista to engineer overnight.)
I would say a strong majority don't. I don't know anyone personally with a land line other than my mother
Billionaire calls Apple ‘ungodly well-managed’
Buying a second thing to unnecessarily duplicate functionality seems like a waste, even if the thing by itself would otherwise be a solid deal.
Any specific-enough set of circumstances is inherently rare. Men stalking and using guns on women and girls isn't uncommon at all.
As a nitpick, cryptocurrency payments are pseudonymous, not anonymous. The current AML system is good enough and prevents cryptocurrency crime as efficiently as they prevent other crime. Also this is not about preventing crime, this is about setting a reporting requirement to an inpractical limit of zero euros. Nobody is going to do crime with 10 EUR PornHub or gay condom purchases.

What would you consider an accetable reporting requirement for all of your transactions?
Over HTTPS? I don't see how that's possible unless they are TLS-MITM proxies, in which case you've completely lost regardless of your authentication method.

Placing the username and password in the URL results in the same TLS-protected HTTP header as normal basic authentication:

$ curl -v https://user:pass@example.com/page
[...]
> GET /page HTTP/2
> Host: example.com
> authorization: Basic dXNlcjpwYXNz
> user-agent: curl/7.77.0
> accept: */*
>

Even over HTTP, a proxy that intentionally logs the URL accessed would not see the username and password in the initial "GET" line. It would have to go out of its way to extract it from the Authorization header, which is still present regardless of how the basic authentication was initiated.

If you meant user agents logging the username and password as part of the history, I suppose you could consider that a bug but it could also be considered a feature. Presumably if you're using a URL of that form your intent is in fact to be able to link or bookmark the URL including the credentials.
Microsoft will give them whatever they request. When you spend that much money you can just ask for a custom build. I would imagine that NSA TAO and other such parts of the USG are provided access to much of the Windows source already.

Microsoft and US intelligence and the US armed forces are practically vertically integrated at this point, they are the Lockheed of software.

"off the shelf" hasn't meant that for years.
You would never know it was on purpose , we blame in on the ISP. They just accept it as a fact of life and guess what it works, play less, going out with family and friends more. I just can never ever get caught or i ruin everything so i go to great lenghts not to get caught
JetBrains Fleet Below Deck
Good way to grossly simplify the Iraqi civil war and ROE!

I'd agree with "IIRC the USA invaded Iraq, which set of a decades-long civil war fueled by sectarian violence and incompetent application of various nation building and counter-insurgency strategies." But that's a less clean catchphrase.
> This will not stop criminals, at all.

Laws don't stop criminals at all, but we still have them and we still try to enforce them.

> They will continue to use privacy coins such as Monero

In the end you need an off-ramp where you convert Monero into actual currency and that's where you get fucked.

Frankly speaking, the $5 wrench XKCD comes to mind. There is no conspiracy here, except that we want to keep society functional and not be disrupted by tools that mostly cater to criminals.
yeah, cashless society is a terrifying phrase
No, that’s so sad! You’re my favorite writer at Anandtech! I was loading the main page of Anandtech every few days to see if you wrote a new article!
National Archives confirms Trump had classified material at Mar-a-Lago
Funny, everytime governments remove people's freedoms they do it for "security", even though most of these things aren't actually making us more secure.
But taking money out of the equation for only some, and not others, takes us even further from democratization of speech.
GStreamer is the top-level framework that allows you to connect the modules it offers to solve your problem, ffmpeg is a tool or library to invoke which may cover your case but is a bit harder to integrate and fit for arbitrary usecases, PipeWire is for live connecting input sources to output sinks at a lower level.
You're not wrong, but a private 747 could probably pose a similar threat to your stated targets, but who knows if they actually put in a worthwhile air defense after 9/11.
indeed, for all such victims, naturally.
and you can never be certain you've extracted the full amount. so you can never stop pounding
Hmm, I agree about the complaining publicly part. Doctors and layers who are partners in private clinics/firms tend to make even more (I've personally seen friends make $600k-$1MM+ a year cash), and the fact that we aren't talking about them at all makes me think that they just do a better job keeping compensation less public. Software engineering is a bit nouveau riche in the world of high compensation careers.
I had a huge argument in 2015 with a guy that wanted to move our every custom .deb package (100+) to Snap, because they had talked with Canonical and it would be the future, Docker would be obsolete. Main argument was to make distribution easier to worker/headless/server machines. Not that Docker is a direct replacement, but Snap is an abomination. They are mostly out of date, most of them requires system privilleges, unstable and the way they mount compressed rootfs is making starts very slow, even on a good machine.

That all being said, LXD is great way to run non-ephemeral containers that behave more like a VM. Also checkout multipass, by Canonical that also makes spinning up Ubuntu VMs as easy as Docker.
These morons at MS decided to force a very confusing and friction-ful Minecraft account migration from Mojang to MS just as all the kids are migrating from Minecraft to Roblox. I'm sure this is only accelerating Minecraft's demise.
Like Ada in 1983, or Modula-3 in 1990's, but I digress.
Forget across services, I somehow have at least three Microsoft accounts all tied to the same email address, with no way to know which account any particular service wants on any given day. Teams is particularly bad, signing me into one of the three seemingly at random so that I have to keep logging out and back in until it miraculously gets me into the correct account, guessing which password it wants each time. Any support avenue I’ve tried has no idea what I’m talking about and offers no fix. Thankfully I don’t much rely on my Microsoft accounts.
Ask HN: Do you currently have a side project that you make money with?
if no - why not?

if yes - what's your biggest pain right now?
That shouldn't be a surprise. At an old job with far smaller user base, we used to do something very similar and while the shadow profiles were not materialized in the form of actual profiles, the amount of data you can gather about someone just by having his/her number pop up in the contact list of several of your actual users is staggering: full name, workplace, city/neighborhood where they live, their partners, their hobbies and all sorts of things which you generally should not know. And we are not talking people who have their entire life published online, but people with little to no online visibility. Assuming that facebook is not doing something similar considering that their main business comes from profiling and modeling user behavior is just naive.
Ask HN: Is it wise to accept an intern position at Meta?
(Throwaway for obvious reasons)

I'm in the late rounds of interviewing at Meta/FB for an intern position. I was extremely lucky to get this opportunity, and the interviews so far have gone really well. I think I will get the position.

Because this would be my first position in industry, it's already difficult to get my foot in the door.

However, The news I keep seeing around Meta lead me to think the whole thing is a sinking ship. Should I actually accept the offer? I have no confidence in the Metaverse, and the "Metamates" stuff just comes off as delusional.

From my perspective, the Meta/Metaverse rebranding isn't a sign of growth but rather a sign of desperation. It seems a bit silly to work at a company you have no confidence in, and one that the average person seems to hate, but getting my foot in the door is hard enough as it is.

Is Meta a sinking ship? Should I actually continue with the offer and hope to pivot to something else in the future?