skysight-inc/HackerNews huggingface dataset:
> Agreed, though partially. Those two technologies don't have to be mutually exclusive.

No, of course. I only objected using containers instead of SELinux / AppArmor. I don't consider containers as "Security Layer" per se. The situation is just a side effect in my eyes, and if you need proper security, you need proper hardening. Solely and blindly trusting secondary effects for security is wrong and dangerous.
> AppArmour assumes everything is allowed unless it is explicitly denied by policy

No, AppArmor uses a whitelist approach as well for its profiles. "Deny" rules are used in exceptional cases.

> SELinux also supports interesting things like applying security levels and contexts to data, so you can have data that is only accessible to appropriatly cleared users in one department but not to people with similar clearances in other departments.

AppArmor has subprofiles and variables that can be used for this approach.
Use of AGPL is generally considered a big red flag when a startup is undergoing due diligence to be acquired.
1. A prediction for 2023 I can use as evidence that I have traveled to the future. And provide trust to set me up for the next step:

2. An important message for people currently in power in 2020s. Devised by the 2050s wisest people to persuade to avoid the big mistake we made.

3. And, well hoverboards yet?
It seems like there's no reason for this use case for the speakers to be individually addressable, and that would probably add significant complexity.
Online resources are not very different than having access to good libraries.

Great libraries have existed for thousands of years but you won't find examples, anywhere in the world, where kids are just left at the library to learn.

One of the fundamental aspects of learning is practice. Teachers/coaches/guides and mentors play a big role in keeping kids on track. It's not just about the best quality content. Or getting them interested. It's about keeping ppl on track when the repetition and practice gets boring. This is easy to do with small groups.

But very hard as group size increases which is why I don't have too much faith in the online model.
Turning the question around (from someone who does write "raw" makefiles): What's the problem with writing "raw" makefiles?

If it works, it works. Haven't encountered any major issues with writing them in my years.
ZFS was designed for spinning disks - what is the performance meant to be like on modern NVMe SSDs? I have ZFS on my laptop and do not see very good numbers, but it's possible I misconfigured something.
I wish I was born 20 years later.
You can install the policy source. It ain't easy but it's there.
This is a nice brief write-up, thank you. i
It helps this non-full time web programmer contextualize recent changes, and lends credence to my decision to learn SvelteKit (skipping over the third gen view frameworks).

I would have liked to see some discussion of what is next. For example, where does WebAssembly fit in?

Lastly, a minor critique re.:

> That said, I can’t write about what I didn’t experience

Yes you can, it’s called historiography using primary and secondary sources. It’s a lot of work, but certainly doable, especially when so many of the participants of the history in question are still alive; you could interview them if need be.

Thanks again for a nice high-level write-up.
React is awesome, but there is a learning curve to using it well, moreso since hooks came out.

Being able to define your view as a pure function based on your state is a very powerful.l abstraction, but it took me about 2 years to learn to wield it well.
In one project we've been moving the tooling to Deno and it's remarkable how much easier it is to work with than the entire Nodejs ecosystem.
I love that it includes the “Portuguese” bit :-)
I would like to emphatically point out that: no, you can't. You can't use strace to get this information.

Let's say you want to use seccomp to whitelist allowed syscalls.
Your code opens a file, uses stat to get the file size, then mallocs that many bytes and reads the file contents into the buffer.

Trivial program, right?

glibc will turn open into openat, stat into statx, malloc can become either nothing, or sbrk, or mmap, and maybe also munmap. If you hit an error, it will also call write to output an error message to stderr.

dietlibc will do open, stat, mmap.

This is also libc version dependent!

But can you at least use strace to know which files will be opened? No, not even that! Because the code may open some files only under certain circumstances. For example, localtime will open /etc/localtime -- but then it will cache the result for a while. /etc/localtime may be a symlink. If you construct a container you would also need the thing it points to.

What if you use a malloc that has explicit hugepage support?

Also note that seccomp and landlock are very much different from pledge and unveil. I am particularly appalled by landlock as compared to unveil. Go look up the landlock API if you don't believe me, and compare it to the unveil man page. If you thought the hoops seccomp makes you jump through are ridiculous, you haven't seen anything yet.

OpenBSD is not all gold either. pledge is not transitive. If your process pledges something but is allowed to execve something else, the process you exec is not bound by your pledge.

There is MUCH room for improvement all around.

However, the persisting idea that you can use a "training mode" or observe via strace to construct a whitelist IS WRONG and dangerously so. Unless you have 100% test coverage (and if you had, why do you still need a sandbox then?) you will miss error handling and optional code paths that you didn't enable in the configuration, and handling code for circumstances you didn't trigger and didn't foresee.
I realize this community is extremely biased as it relates to this announcement, however, this looks like yet another unnecessary funneling and pipeline to force everyone into the exorbitant and group-think conditioning college system.

If they want to have an impact, focus on education for vocational and blue collar employment; from agricultural workers to general laborers and small business owners. Americas needs more people who can actually accomplish things, not spilled university students that are profit centers for universities that take all the profit and ensnare dim witted children into debt slavery at the public’s expense.

And seriously, ASU? Not LSU or FSU while they’re at it? Just alone the choice of university says something about the orientation, focus, and purpose of this effort.
some proportion of people were told there was no way to make money playing video games.

That there's a, and i quote, "careers" in video | computer gaming.

Isn't that enough?

- genewitch
> Numberphile, VSauce

I just looked at the video listing for these creators and there's nothing but pop-science.

I don't understand how it's at all comperable to KA?
For starters, ffmpeg does not use raw Makefile; it has to be generated by running configure. Historically configure (and autoconf etc.) was required due to the variety of platforms to support, which is increasingly less relevant today. The real "raw" Makefile---where you are supposed to run just `make` to build---is not as cumbersome as you may think; even the dependency among source files can be automatically generated.
So what does it mean? FFmpeg can now do what imagemagick does?
Very cool! Though it looks like it has the same problems DML has, in that it's hard to get good bass out of them.

If nothing else it would be quite useful for IoT applications, replacing ol' piezo buzzers, taking up less space and being more efficient.
Apple hates the GPL more generally, not just the GPL, and purged a number of packages from macOS (e.g. terminal-mode Emacs, which has been included since the days of NeXTsteo).
Are you looking to offer SSO to users of your SAAS app? Firebase does support SAML: https://medium.com/@tfalvo/single-sign-on-sso-for-your-fireb...

Both Microsoft Azure AD and JumpCloud have free plans you can use for testing.
> If you aren't using a public framework and you use any JavaScript in your app then you are creating your own framework.

Sorry but a “framework” used by one project (especially not broken out into a separate subproject) is not a framework. That’s just infra code.

I think your point still stands that the value is developers understanding a framework can more quickly get to work—I’m just triggered by your exceedingly liberal usage of the word “framework”.
Perhaps because they're not profit focussed. When people becry the evils of capitalism, this attitude is what they're talking about: that it is ok and expected to do the thing that maximises profit and that if we want people to not do something then we need to make it financially uninviting.

It is not possible to arrange the world so that the financial incentives are always aligned with what is the right thing to do. So if we want to "have nice things" and live in the sort of world that most people will want to live in then we need to have some kind of ethical system which guides our action independently of the profit motive.

This seems to be one of the bigger cultural differences between the US and Europe. In the US the attitude seems to be "if there's some situation you can exploit and it's not illegal then why would you not do so". In Europe there is much more emphasis on societal-level reciprocity: not just "will there be negative consequences to me if I do this", but "will this lead to the sort of society I want to live in if everybody does this". Of course there are still bad actors. There will always be bad actors. But the assumption is that most people won't be, rather than that most people will be.
Really cool stuff

> Used this way, the thin-film loudspeaker could provide active noise cancellation in clamorous environments, such as an airplane cockpit, by generating sound of the same amplitude but opposite phase; the two sounds cancel each other out.

Not mentioned here is that to achieve this you need to track heads in real time (i.e. with a camera) - the phases need to align at just the right spot - which might be worth the creepiness tradeoff or not idk.
US offers up to $10M for info on Russian military hackers accused of NotPetya
I def understand that and I'm interested in finding ways to support more nuanced discussion, but there's always going to be a place for traditional threaded comments and old school forums etc.
Prompt: fabrice bellard is

Response:

fabrice bellard is a French artist, born in 1957. He lives in Paris. He has been a painter for a long time and made a lot of drawings during his youth. In the years 1977-1981 he studied at the School of Art and Graphic in Paris. In 1977-1980 he was working for the magazine "Gigames" (as a graphic artist).

The artist now works mainly as a painter but has also realized a number of exhibitions in France and abroad. In 1987 he showed for the first time in a personal exhibition at the Gallery of Modern Art in Paris. From then on he has been exhibited in many galleries and museums in France and abroad. Some of his works are already in collections, museums, galleries and libraries in France and abroad.

The main focus of his works is a reflection on our society. To create his works he uses a variety of different media and techniques.

I'm surprised it doesn't mention ffmpeg or qemu :)
Better than no website!
It may not be an accurate summary, but GPLv3 makes extensive claims and none of that has been tested in court, so it is not unreasonable of them to be wary and not take any risks. They abandoned plans to incorporate ZFS in macOS and implemented the inferior APFS instead simply because of a patent troll lawsuit by NetApp against Sun.
If you think that your description is teaching, you never had a teacher or only very lousy ones.
> The whole container movement can be seen as putting the apps in a sarcophagus like Chernobyl

Reminder: containers are not meant to be security tools.

Fine-grained sandboxing (e.g. seccomp) is. And it can be layered upon OS-level VMs.

Additionally, bundling tons of stuff together with an application (like docker but also flatpak do) is not good for security. Same for static linking. They all increase the workload of updating vulnerable dependencies.
I hate JavaScript and everything about it in 2022. The whole ecosystem stinks and the fact that it’s so pervasive makes me lose hope. I blame the whole thing on Microsoft and the IE team.
Anti-trust doesn't care about monopolies, it cares about market power. Apple does have the market power, as evidenced by the 30% rent they extract from developers.
Quote1: "Though 26 is a remarkably young age at which to retire in traditional sports, in esports it’s the norm"

Quote2:"This stands in stark contrast to traditional sports. The NBA’s average player age is 26, according to a 2021 survey and even in the super-demanding NFL, the average player retires between age 26 and 27, per the NFL Players Association."

I don't know Washington Post (& Jonathan Lee, the article's author), seems you kind of dropped the ball here.
Not quite! If you have an attribute "onclick" and set the DOM property "onclick", the attribute value stays unchanged, but if you click, the function set by the property gets called. Set the attribute an both the attribute value and the DOM property change - the latter to a function as described in the original article.

Think of the actual function that gets called as residing in an internal slot on the element. Both the attribute and the property can set the slot's value, and setting and the DOM propertie's getter accesses the slot directly. Sort of, if i remember correctly.
That would be pretty nuts, sending out a digital signal and have a built-in DAC for each emitter. Probably way too much bandwidth for any of the standard busses though.
I wish there was a hall of fame of vendors who allow SSO for free or a low price. And I don’t mean “Sign-in with Google” - not everyone has company managed Google accounts.

Of the top of my head I can think of Mapbox and AWS where it’s free. Atlassian charges $4/month covering all their products (cheap if you use two or more).

Any more good examples?
Has nothing to do with hate. The viral nature of the license makes it a nonstarter.
And Time..ntp etc.... ;)
No. There definitely are others from that circle who have gone down the same path as me, but it’s a distinct minority. Most end up completely inured within that world, and reinforce and justify each other’s values and prejudices.
They're bleeding money and have no path to profitability. They have no competitive advantage over the various local competitors, so the moment they increase prices ( their only chance of increasing revenues enough) consumers will shift and use Bolt/Lyft/Freenow/Deliveroo/Glovo/whatever.
Uber does have the advantage of operating globally and having a single app that will get you a taxi almost anywhere in the world. Given that traditional taxi companies often only operate in a single town or city that's quite an advantage. They would easily have a sustainable business if they dramatically cut their costs. Whether they can do that having taken the amount of VC money they have is another question.
No, this is happening with apparmor on an Ubuntu 20.04 server.
A. You didn’t look very hard. B. Okay, try PBS space time, Dr PhysicsA, 3Blue1Brown, Strand’s MIT series, Red&Blue. There are so many wonderful resources online to learn from that just need to be meta-organized, KA is the bottom of every heap except for the meta-organization. (And, BTW, many of the others have internal meta-organization.)
GraphQL Subscriptions: Why We Use SSE/Fetch over WebSockets
Rich often mentions the RDF heritage. I think the separation of reads and writes through the transactor is also a significant innovation.
https://www.diva-portal.org/smash/get/diva2:1252694/FULLTEXT...

Also docker NAT will add significant latency if you don’t use host network mode.

When microseconds matter, everything matters. Any intermediate program would be suspect.
It is popular yes. But with NeoVim I feel so damn productive. VS Code feels sluggish compared to NeoVim. At least for me.
That was not the topic of OP's post or this really.
sign-in with Microsoft is indeed SSO.
This might hold true when the application in question does a lot of stuff covered by a framework. For example if it does routing, then it is nice to have common ground on how routing is done. If the application mostly does custom stuff, not covered by the framework, then the framework might harm more due to the added complexity.

That is why I proposed a discussion based on real life examples.

The other thing is that frameworks change. You picked React for your example. A currently popular framework. Chances are, the next developer will not come on in 5 years, but in 15 years. And does not know anything about React. Or about React as it is today. Then they might have a harder time understanding React than to understand a well written, minimalistic piece of Javascript.
Nice but we still need at least cameras, ideally also OSes' default picture viewers and major web browsers to support it OOTB or it will never become a thing.
Sounds perfect for a cellphone. Imagine theater sound - or even a decent loudspeaker conversation.
> It sounds like you were using the DynamicUser=, ProtectSystem=, or ProtectHome= settings which can greatly limit where a service is allowed to read from and write to

Thank you! I have DynamicUser set - I can't think why I added it here, perhaps no reason at all - and that is the difference to previous systemd services I've written. I did not know it had such an effect on behavior.
Iam not a native english speaker, but I read the topic as Echo process voice so Amazon can server better targeted ads.
Ask HN: How do you keep engineers happy in “Professional Services” teams?
We have a Product and a "Professional Services" (PS) team. PS builds custom projects for clients, one after another. Projects last few weeks to few months.

Project Managers in PS assign tasks to developers and they do the work and go to the next task. Their time is tracked and how much of it is billable is measured. Managers in PS has a target "billable utilisation" they are expected to hit. The target is almost all of developers' time other than company meetings.

We encourage developers to come up with side-projects, improvements, learning goals etc. and we make time for them when there is something tangible. We also come up with initatives and offer them to take these up which would also contribute to their career progression. There is some take up but not much.

We have been having turnover issues and the prominent feedback from exit polls is the work is not interesting or engaging.

We are seeking feedback from the team but would like to hear about how other companies are handling it. If your company has a similar team that only build custom client projects:

- Does your compnay have similar problems?

- Are developers assigned tasks in a similar way or do you have different ways of working?

- What are the things that are keeping them happy and engaged?
Paper: https://ieeexplore.ieee.org/document/9714188
> The obtuse part about github's linear view isn't that it's linear, it's that it's interleaved by time in ways that form a chaotic view even for a linear one. Like, picking a random large project for an example, take a look at swift's history on github[1].

> Because there's a bunch of PRs that were being operated on in parallel, and some probably that are even kind of old, the view you wind up with is likely a large streak of "PR merged" commits and then all the commits from those PRs jumbled together in an incoherent mess.

Oh yes, I've just run into this problem myself: I had to backport a large set of commits. While they're of course roughly chronological, they're not strictly so, and so the result in Github's UI is a giant mess.
Possibly not for "political" reasons, but it gets increasingly harder to be an independent mail operator. I've been running my own email cluster for over a decade, privately.

Some mail providers require you to contact them to get on an allowlist to even be able to deliver email at all. Others do not formally require that, but you may have to enroll in a postmaster programme in order to track your deliverability. Yet others there's no hope at all, except running after the most recent fad in spam fighting (like DKIM/DMARC/SPF etc.), only to find that even fully and correctly configured DKIM (which I don't like on my private email for many reasons) is by far no guarantee for not getting your email marked as spam (and thus, on some providers, hidden by default), even from IPs and domains which have had no spam emitted from them for many years.

So... Yeah. It's not heard of in the public media because those affected most by this don't have any leverage. The big mail service providers (MSPs) presumably have their agreements among one another to protect their business, but if you're just doing friends&family, good luck getting anything except an autoresponder when you run into troubles.

(To offset some of the criticism here, I have had very positive experiences with contacting postmasters of some large German email providers when issues happened, so there's that.)
I am, indeed, too young to have accurate memories there! Of course right after I posted this I started hearing about GWT and Closure, that's a bit of egg on my face. I mentioned Gmail as an important marker, everyone I talked to remembered it as the _moment_ which proved that JS could write full applications in the browser, but I assumed that it was written with an internal framework of some sort (none of my mentors who've been in the industry mentioned it when I brought up Gmail, and there's no mention of it on wikipedia: https://en.wikipedia.org/wiki/Gmail)

That said, I think it's an important landmark and I may end up revising this post to add a bit more discussion about it. Thanks for pointing it out!
That's a 10db difference in efficiency, which just means it's an efficient speaker, maybe not as efficient as a good horn-loaded speaker.
You can subscribe to Slack threads like you would a forum's.
Discord threads are a bit weird but they have the advantage that they appear on the sidebar so they don't get lost in a sea of messages.
But Chrome should be the only (inevitable) option?

Smartphones with ”Google Inside(tm)” should be (effectively) the only option?

As a consumer I care quite a lot about not requiring Google inside my phone, or on my desktop. The tendrils they have in sites are quite enough already, I don’t need them on both server and client…

Knowing Android gets me Google, I chose a device that couldn’t be consumed by the borg, and spoke with my money on that. And as a result, my bank, my airline, my social media, all have to support more than one browser engine if they want affluent customer share.

I have zero trust in this developer community clamoring for an open web simply so they stop having to test in any browser other than the one they install for dev.

This site^H^H^H^H app requires Chrome.

// Building websites since 1993 — none of this noise is new, just naive.
>criminal charges against corporate officers

Absolutely. The discussion is centered on fines to companies but the other side is personal punishment of the actual physical people who made the decision to break the law.