skysight-inc/HackerNews huggingface dataset:
> it is very hard to craft a set of permissions to allow that package to retry requests to certain addresses you'd like to retry without also letting it throw random system metrics it's collecting to an ad-server

If you're expecting to have to craft ACLs program-wide for that package, then sure, that's going to be hard. That's more coarse-grained than what I'm talking about here though.

Imagine, if you will, a programming environment where modules you load don't have any authority to access the network, filesystem, etc unless you pass them in. They're just not in scope. In such a language, the default way to grant HTTP access might look like this in pseudo-Python:

http = require("http")
myMaliciousLibrary = require("myMaliciousLibrary", http=http)

Now, this library has the problem you mentioned; it can make arbitrary outgoing HTTP requests, meaning it can send any metrics it collects to an ad server. It can't access the filesystem because the filesystem isn't in scope either, so what it can collect is limited, but still more access than it needs. So here's one way you might fix that (obviously highly simplified/incomplete in its implementation):

class ProxyHTTP(origin="https://example.com", http):
def __init__(origin="https://example.com"):
self.allowed_origin = origin

def get(origin, path="/"):
return http.get(self.allowed_origin, path)

http = require("http")
myMaliciousLibrary = require("myMaliciousLibrary", http=ProxyHTTP(origin="https://good-site.example.com", http))

Now, this version of myMaliciousLibrary gets an object that looks like the http library it would normally use; it just happens to ignore the origin parameter that the library passes to it and uses the one it was initialized with instead. Now, that library can make requests to good-site.example.com, but if it tries to make a request to adserver.evil.com, it'll go to good-site.example.com instead. (You might also imagine a version of ProxyHTTP that just throws an error if the request's origin isn't the same one it was initialized with, or isn't in a list it was initialized with.)

Most of today's programming languages aren't strict enough to enable this of course; JavaScript isn't there yet for example, and most other languages aren't even close to being able to do this. But that's mostly because they don't provide strict enough encapsulation, not because they're lacking some complex security enforcement mechanism.

> I think it's just because most of us accept the risk, it's highly unlikely that malicious supply chain attacks will suddenly sink our businesses so we accept a reasonable level of security in exchange for what feels like a modest risk

I just think people are accepting way more risk than they realize, given the number of dependencies in modern applications and the amount of access each of those dependencies have. It feels crazy that any one of those dependencies in any application could exfiltrate massive amounts of sensitive data from any machine it happens to run on.
In this particular case yes, but we're not always that lucky, and I'm not surprised if they will completely remove the API in the near future.
I'd have no problem living in dense housing if codes mandated GOOD noise insulation. So many apartment walls seem to be made out of cardboard, it's ridiculous.
Come on it’s literally the third google result for “premier tour religion”.
https://www.ifop.com/publication/le-vote-des-electorats-conf...
Wirecard middleman pleads guilty to hacking
I'm not going to be at all surprised when Apple sells off their laptop division and kills their few remaining desktops. It's obvious they have no interest in anything outside of the iPhone. Even the iPad is treated like a second class citizen.
How to stay optimistic in these dark times
This is what I thought it would be for, I have a small radio with a similar crank and it should be possible to power it that way. The designers probably considered it and I wonder why they didn’t do it.
I wrote down my comparison here. Hope this helps.

https://billylo.medium.com/ep-19-is-android-app-dev-easier-o...
With only 18k subscribers, trying to salvage that situation with a pivot seems like a manifestation of the sunk costs fallacy to me. 18k is miniscule even by rando on youtube standards.
> Why does this automatic enforcement of law only ever cut one way? If we're mandating that technology should enforce laws automatically, how about anti-monopoly-power technology?

The people writing those laws understand that monopolies and the regulations surrounding them are complicated. They don't understand that technology is, also.
With the risk of feeding a troll: can I ask you why you're so angry in every comment? You're almost hateful. I want to understand what makes you act like this, why you think the makers of Fig deserve this kind of response and how you think your comments contribute something positive to the discourse here on HN.
ApeCoin and the Death of Staking
Yep, that is kind of what I'm doing. I'm storing the images in the pi but backing them up on my server and having another script to remove old ones that were already sent to my server.
Sincere question: what does Git have that makes easy to revert the change on your example that SVN doesn’t have? I barely know Git, that’s why I ask.
You might say that the definition of and value of bitcoins are determined only by collective understanding, governed by the participants in the system, and that it is backed by faith in that collective governance, and will fall apart if that faith falters, or if the collective illusion underlying bitcoin collapses. Is that starting to sound like another currency you've heard about?
Their point is that the average CNN viewer might be willing to pay for a service with different content. CNN+ did not serve the content they were referring to, so your flippant footnote does not apply.
But the airquotes around "fix" are precisely because it's not "broken", it's simply "how it's implemented". Plan accordingly.

I do. When I'm building web stuff professionally, there's a laundry list of CSS features (often quite basic ones) that it would be very convenient to use but I often don't because I know they will look terrible in production for a significant proportion of users. But that's unfortunate.

Yeah that's a separate issue and rings of No True Scotsman-ism.

Separate perhaps but I don't see how Now True Scotsman applies here. There certainly are professional developers who also have significant knowledge of things like colour theory and graphic design. You're talking to one. But those are separate skill sets, not normally required or expected for most development work. I don't think it's plausibly deniable that web development today frequently relies on someone who designed some toolkit, probably using basic CSS effects for almost all the visuals, instead of hiring an in-house designer. And I don't think it's plausibly deniable that today's WWW is much more homogenous and dare I say boring in appearance than the WWW of 10 or 20 years ago. There are usability advantages that come from some types of consistency but does everything really have to be so same-y?

"Many sites" do look bad, but if you're claiming this is because of browser sRGB colour handling then you're gonna have to cite a source or do more than claim the high ground.

It's not just the sRGB handling. I'm talking about a bigger picture. Some popular browsers had antialiasing glitches that made rounded corners done with CSS look like low-res pixellated junk for years when `border-radius` was first a thing. Try applying CSS transforms to anything using fonts or SVGs today and you can still see horrendous rendering artifacts in some browsers, and even worse if you're animating as well. Of course the fonts themselves render completely differently on different platforms even without any transforms applied and sometimes that has a material effect on important aspects like accessibility or even basic legibility. Gradients over large areas have horrible banding in some browsers because they don't use basic dithering techniques that every real graphics program has used since about the 1980s. The list of browser rendering glitches that any halfway decent creative software has avoided for a very long time is long and frustrating to read.
Not strictly accurate. Plenty of countries where the Telco monopoly didn't get broken up (NZ and Australia specifically) and those monopolies were in no hurry to spend billions rolling out home fibre.
If you were using GNOME, then it has a redshift clone built in.
>i'm of the opinion that a big reason for this is while quantity has gone up, quality has plummeted.

Two dudes with a couple middling cameras and a tripod can shoot stuff that passes for professional.

Look at the big YouTube channels. They're as good or better than reality TV ever was.
I won't cite them here because it will automatically be seen as trying to promote a crypto project for my personal gain.
Digg

It follows HN in principle in that it is:

1) curated, not by my "interests", or clicks, or browser history, but proper moderation (and puns!)

and 2) doesn't do the ajaxy infinity-load content.

It seems to be impossible to have a quality news source that is both algorithmic and never-ending.
Take a look at Red Means Recording on YouTube for what the OP-1 is capable of. Very cool piece of hardware
All these examples are business bets and not political ones. Don't get me wrong, they're astoundingly impressive but of the wrong type.

I don't dispute that he's a shrewd businessman and fancy visionary but when it comes to the world of politics, I have my doubts and reservations.

I'd like to see action and results first before I can vouch for him in that field.
Most search in modern projects isn’t things like date ranges though it’s often things like machine learnt mappings that identify similarity scores with words. Failing that it’s some sort of ML to learn tags and keyword matching on those tags.

When I search YouTube I’m seldom looking for all videos made on August 29th. I might instead be looking for videos of a black cat. Or videos containing music with certain lyrics that I search for. This is what I thought you meant by rich search. I contend it’s unlikely you can design a privacy respecting service that can also extract the features necessary to train a search model.
> not-very-educated thoughts on gradual typing

This seems like an inaccurate and condescending put-down. What is the definition of "educated" in this context? Is there a book or generally well-known resource?

The author is clearly thoughtful and curious. Near the top of the post he says "what I’m hoping for is that someone will come along and tell me that I got it all wrong. “When you do it as follows, the system works: $explanation” Because, you know, I’d really like to have static typing in Python."

> 1. If you're using a dynamic language, then _by definition_ the language will not enforce your static hints at runtime. However, good news! Python has always been strongly typed, and _does_ enforce types at runtime!

And yet, the author points out that this is a working program:

foo: int = 'hello'
print(foo)

In what reasonable sense can Python be said to "enforce types at runtime" here?
It's not like polyester resists forever either. Many outdoors folk have experienced "wet out." Resistance only goes so far and I'd rather wear wet wool than wet polyester.

Synthetics are still great though. They have many other benefits and are easy enough to avoid soaking through.
And you can make it work at runtime too! So as long as you have the right methods and attrs isinstance on your duck-typed object will return true!
The Borg of Heaven
Appreciate the anecdata! Have they straightened out the issue(s) with a read-only root directory, and installation / uninstall?

https://news.ycombinator.com/item?id=30917354#30918593

> seems to be an issue of macOS and the root dir being read-only

> Took me a month to finally remove Nix from my macOS

https://github.com/NixOS/nix/issues/6206#issuecomment-105938...
> What I want is this: Some language that’s as easy to use as Python and it should be compiled and with good static typing...

Well, there's always Nim. [0]

> ...but it should also not be compiled because then it wouldn’t be as easy to use as Python anymore. Whoops?

Eh, there's Nimscript? [1]

0. https://nim-lang.org/

1. https://nim-lang.org/docs/nims.html
My understanding was large python code bases (think Google) have a large problem. Someone makes a code change and suddenly it becomes difficult to find the scope of type errors in their monorepo. That was the driving force IIRC.

That said, I think pytype makes a lot of sense since it infers types from code, which you can edit by hand and then merge back into the python file when your code is stable.
Can I know how this is different than Pachyderm [1]?

[1]https://www.pachyderm.com/
And I apologize for what I said to you, it's just that--for reasons given--I become defensive when talking about my psychiatric health. I am going to keep being defensive, but what will change is reevaluating afterward. So what I'm doing right now.

Because we're talking about psychiatry, which includes lobotomy and roofies, I simply must shoot first and ask questions later. That is how I must react. But at some point I must still get around to the questions, and try to rectify mistakes.

You reacted favorably, and did what the culture we're in told you to do.

I apologize.

EDIT: And you know what? After April 2009, I found no doctor willing to treat me for the lobotomy. They were all afraid of angering my lobotomist. So I had to treat myself, and did so with supplements and prescribed substances. So the organ is OK again. And while I didn't have to learn how to walk again, I evidently need to learn how to talk again. Baby steps.
I think this would be the absolute perfect time for Netflix to start being assholes about people sharing passwords with their parents
I just took a quick look - nice stuff! (bookmarked for later).

I spent most of this morning refactoring some old Common Lisp code, separating the LispWorks CAPI code, planning on adding Common Graphics and McCLIM front ends also. Common Lisp (for me) is the least resistance of any programming language I use. Love it.
>> It a 5.5% cap with nothing backing it.

This is not true. Listerine has one of the most famous contract law cases in the world backing the royalties for life, tested in court.

It is almost assuredly the most secure contract of this type you can possibly acquire.
This is a form of leverage, but how do you use it in a low-risk way? Fixed income investments seem to be near zero, and maybe people don’t want to invest more in stock.

If the alternative is cash sitting in a bank account, paying off the loan looks better.

Edit: I looked at Series I, and it's variable rate with a 3-month interest penalty for early withdrawal, so you're not going to get 7% in the end. It seems worth doing a more detailed calculation.
But not the representations themselves (which is what's important in this case).
RHEL has a 3 year cadence, so if (if) RHEL 10 makes this change it won't have been 10 years, it will have been 13 years.
No offense, but have you actually given it a shot? Duck typing is supported and you can get virtually all use cases of heterogenous dictionaries by using union types and duck typing. The article even touches on this.

edit: To be more precise: The article specifically mentions that accessing invalid members give you a type error, but posits that people will probably not bother and just use 'any' instead. How is that not saying 'too much discipline'?
I’m pretty certain that paragraph is meant to be read with a heavy serving of sarcasm.
Right. At some point you can't just buy more VTI, houses, or whatever. It's almost like the term "hedge fund" means something.
Use it every day, fantasy app
It’s a semi humorous undercurrent here that Canadians should go to Cuba before the yanks can go there..
Typescript does absolutely fantastic type inference, which mypy definitely does not. I think that's a huge advantage for Typescript over mypy, and it's really foundational to the value it provides.

However, even in Typescript it is nontrivial to _annotate_ these complex types, and in most cases it's still possible to do in Python - you just need to commit to using something like dataclasses rather than pretending that what you have is a `dict`.

Basically, to get the most out of static typing in the world of Python, you do have to write more boilerplate than you would in Typescript, and in particular you need to avoid dicts and prefer various sorts of class-based data containers (again, dataclasses, attrs, namedtuples, etc).
>> For that amount of money, I can think of better investments.

The group buying this contract can, too. But that's not the point of owning a diversified portfolio of assets that are of varying correlation.

EG is not the same as EV.
Google to update cookie consent banner in Europe following fine
...unless it's the iPhone.
Virgin Media does not use Openreach, and they lay FTTC and then uses multi-core copper (coax) from the cabinet to the home. Although they're the only FTTC that roll their own as far as I know. The other non openreach are Hyperoptic and Gigaclear and they provide FTTH.
I've been playing around with the Playdate SDK, and it's pretty darn simple for the most part (the documentation could be better, but it mostly gets the job done). I have a working version of my Pico-8 game that I ported in a couple of days (the core gameplay loop at least), including crank functionality.

The code is basically just Lua with some extra Playdate specific bits. This tutorial helped me get up and running:

https://www.youtube.com/watch?v=J0ufxinp7No

The hardest bit for me so far has been how to make graphics look halfway decent in 1-bit, especially when I'm not much of an artist. Still haven't figured that bit out. I'm just drawing polygons and text on the screen right now programatically. Works okay for the core gameplay, but I'm struggling more with menus.
Brings to mind Thatcher’s famous statement: “There's no such thing as bandwidth.”
at least we have super good fibre now. I'm on a 2GBps plan! I hear Chorus is even testing 10Gbps... If I'm honest, hyperfibre isn't really that much more useful than just normal 1Gbps.

what NZ did well with their fibre roll out was connecting up all the smaller rural towns (in otago/southland anyway) :D
Coool. That means you can ask for a quote for 1.25Gbps which they'll likely have to deliver using 10Gig equipment at both ends and then *synthetically* cap, which will likely have appreciably lower overhead than running 1 gig through 1 gig PHYs :D
I entered many of my best dad jokes into a magazine contest. I was sure at least a couple would make the cut to be published but no pun in ten did.
Yeah that's a downside of wool for sure. We've dealt with similar wool-eating insects and it's no fun. I hope you are able to get the problem resolved.
Dad here, I agree with all of the above with a caveat... my kids are now 9 and 11.

After a long road trip when they're farking around in the back of the car I'll start throwing down some dad jokes. They soon plead for me to stop.

There's something agonizing about processing a good Dad joke, it's now become torture for them. The deeper and more twisted the pun the better.

Maybe I'm about to reach Peak Dad?
Can't you just type something as `object` in Java and make anything possible?
Typically I like to use my old laptops as "servers".

They usually get dropped or ran over or screen hinges broken or something like that. Long before the actual hardware inside gets a chance to fizzle out.

They have a lot of advantages in that they are low power, have built-in UPS, small, have a keyboard and display. The disadvantage is that you don't get a lot of storage options. I have some USB 3 attached storage, but I wanted something a little different this time.

Most recently my RPI 4 8GB serving as media server got replaced by my girlfriend's Asus laptop. She knocked it off a table and the corner of the display got smashed in. Now it is running Linux and Kodi, among other things. Can barely see it sitting there under the TV.

A bit better at 4K out then RPI 4, but not by a whole lot. Don't do any transcoding on it, though.

My "Big Servers" for my home lab are 3 ancient HP 1U rack servers. Built a small horizontal rack so they "hang down" instead of sideways and they take up almost no room. They run some high efficiency Xeon processors so I can get away with running them off of one household outlet. I only leave one on and spin up the other two when I need the extra capacity for some project.

Dual socket 8 cores and 72GB of RAM each.

Figured out that if you go and look at Vmware hardware support and get a server that is _just_ one generation older then they are willing to support than these things are dirt cheap on the used market.

If they can't run the latest version of Vmware then nobody wants them. Linux don't care, of course.

I think I spent a total of 600 dollars for all 3 servers, but it could of been a lot less. It's been a while.

I hate dealing with server-grade hardware because the lights out stuff is insecure (100% get one with a dedicated LO network port), dealing with firmware configuration is tedious, take forever to boot up, and dealing with the raid controllers is misery. But it's the cheapest way to get a ton of capacity. Especially if you have a project that wants to use IPMI and such things.
For me, I'm not writing huge programs in python, I may not need type hints/safety right away, or at all, not that I'm against them in any capacity. The problem I see with opinions like these is the assumption that type checking/hinting/safety are a silver bullet.
Maybe. I wouldn't say that Russia's terrible track record relative to other countries. But I agree that there have been some bad events that we should strive to prevent in the future.
I can only speak about my own experience:

Most people I know writing Python don't use type hints because they are too much of a hurdle for very little payoff. The tooling that pays attention to type hints is slow as molasses or difficult to use or understand. The type hints themselves are of dubious use.

As a fan and advocate of static typing, I find myself advocating for type hints anyway, but I must agree I often can't reply anything to my coworkers' objections, because Python type hints are truly not that useful.
Unmanaged color on wide-gamut outputs is simply godawful. I'm not surprised consumers go for it in direct comparisons, but especially with dark color schemes in vogue it seriously hampers usability by crushing darker shades (at least when lerping to DCI-P3).

TVs and monitors are pretty bad as well, but at least more wide-gamut source material is becoming available and calibration to DCI-P3 or Rec.709 is starting to become a selling point.
Are you using the new JSON column type released in clickhouse 22.3?

https://clickhouse.com/blog/clickhouse-22-3-lts-released/
A few comments with informational stuff from your company is fine, but you're taking it too far with the repeated replies.
> Are you so upset with my opinion that you have to instantly discredit it because "whoever that is" review I based my opinion on isn't subjective?

There you go again with the projection.

All I said was that you don't seem to be making much effort to be objective, and if you really based your entire opinion on a single random Youtuber's review (as you seem to imply here) then you've effectively made my point for me.

> I don't understand why it gets such high praise

Maybe you should check out some of the other reviews.
That's not true... CentOS Stream is more of a "community" than CentOS was. If you had a bug in CentOS all you can do is file an issue in the Red Hat bug tracker and wait because there was no way to contribute.

With Stream it's open to not just bugfixes but community-contributed enhancements.
Nice. Looks like a great way to handle PII, credit card data, etc.