skysight-inc/HackerNews huggingface dataset:
The work of turning a technical document into something automated provers can work on is often revealing when it comes to logical flaws which is itself a valuable product.

However, even when this appears to be successful and the proof tool verifies your design has the properties you wanted, there can be hidden assumptions in the proof which do not match the human understanding of the technical document.

TLS 1.3 was proved this way before the RFC was signed off. We know TLS 1.3 does what it says on the tin, assuming the constituent elements work as specified (e.g. AES is a working block cipher, SHA256 is a working cryptographic hash function, Elliptic Curve Diffie Hellman is a working key agreement protocol). However, it turns out they proved something slightly different from what humans would have understood from the document.

The result is the Selfie attack. NB This applies specifically to Pre-shared Key authentication, stuff like your web browser isn't affected. Here's how it goes: Alice and Bob are using a PSK to communicate securely, but their Cat would like to manipulate them. Based on their understanding of the pre-errata RFC document, Alice and Bob agreed a single Pre-shared Key, let's call that ABA, which the Cat doesn't know, and they use TLS 1.3.

0. Bob feeds the cat before leaving for work

1. Alice wakes up, notices the Cat's food bowl is empty and sends an encrypted message to Bob, Encrypt(ABA, "Did you feed the cat?")

2. The Cat intercepts Alice's encrypted message and sends it back to her. The Cat can't read the message, nor tamper with it, but just sends it unaltered and trusts that will have the desired effect.

3. Alice receives an authentic message encrypted with the ABA key, which she presumes is from Bob, it says "Did you feed the cat?"

4. Alice sends an encrypted reply, Encrypt(ABA, "No")

5. The Cat intercepts this message too and sends it back to Alice again

6. Alice receives the reply, which she presumes is from Bob, it says "No".

7. Alice feeds the cat again. The cat has now been fed twice. Attack successful.

How did this attack sneak part the proof? Well, the proof says Alice and Bob should agree two keys, an Alice->Bob key (let's calls this AB1) and a Bob->Alice keys (call it BA1). When Alice receives her own message encrypted with AB1, she can see she sent it, not Bob, and so she detects the Cat's attack. So the proof is fine.

The person writing the proof assumed this is what was meant in the human readable document describing TLS 1.3, but the other humans working from this document assumed it would be fine for Alice and Bob to agree a single key ABA. It's certainly not highlighted in the original document that this is a concern and you must agree two keys.

[ There are also lots of other things you could do, if you're careful and know about this attack, but for some reason can't just agree twice as many keys. However the correct basic design to explain in the document is to just make separate keys for each direction ]
It's extremely easy to say what you say without having written a book. Harry Potter into public domain I'm prob OK with but some people put years of their life into technical books. My father did.

EDIT: ach, didn't read your post propely - first line says "
I'm also write technical writing (including academic publications)" so you have a strong position to hold your view - sorry

(deleted)
It easily could be - but it has to be cheaper and as well understood as water storage.

The expertise and knowledge of water reactivity, storage and pumping are built on centuries of engineering.
Something similar exists: iabackup[1][2]. It is designed to host an independent copy of (some of) the Internet Archive using git-annex. You tell it how much storage you want to donate and git-annex fills your disk with data from the least-seeded files IIRC. Its focus is on data backup, not data serving though.

[1]: https://git-annex.branchable.com/design/iabackup/
[2]: https://wiki.archiveteam.org/index.php/INTERNETARCHIVE.BAK/g...
This is why consumer protection institutions exist (SEC, FTC, FDA, etc.) so individuals don't need to sue.

These sorts of sales tactics should just be illegal and criminal. If your sales pipeline requires exploiting human cognitive failures (ie., "boiler room sales tactics") then you're scamming people. A business exists to provide a service people want, not to scam people into something they dont. The gov. provides limited liability protections to businesses, not to scams.

I think we're far enough into our understanding of human psych now to say "here are the fault lines", if your business principally (, systematically, essentially, ...) uses them to make money, it's illegal.
We try to limit the amount of languages we use, but we have high performance Computer Vision code that is written in C++, we're interfacing that with Python for simplicity, and a web app in JS. Right tool for the job!
Indeed - having used it for few years, I'd start the initial infra (for testing/playground/whatever) as small k8s on a local VM or similar solution so that we could prototype against the target abstractions from day one.

Much, much less work to then move the deployments elsewhere, including building and teardown of integration testing environments.
> Imagine spending a lot of time and money picking out the best possible gear for a hobby before actually starting the hobby.

Haha, this is exactly what “hobby” means to a lot of people. Less judgmental: thinking and dreaming about the right tools in disproportion to the need is something people do a lot, presumably because it is a source of joy.
Planet | Multiple roles | Full-time |hybrid or full remote in EU and UK
Planet is an innovative organization committed to changing the world through open access to daily images of the globe. We currently have the largest constellation of Earth-imaging Satellites, and are setting our eyes on the stars. You'd be joining a distributed globally team of world class engineers.

Stack: GCP, Python, JS

Website: https://www.planet.com/

Currently we are looking for:

SRE / Platform: https://boards.greenhouse.io/planetlabs/jobs/4075412 Space systems: https://boards.greenhouse.io/planetlabs/jobs/4235195

Direct contact: daria.malanowska@planet.com
> about 10% of what it requires in the winter

The structure doesn't appear to be that large for this claim. So I wonder if they will continue to scale it after this winter. I could easily see 8-10 of these sitting on an industrial outer edge of a city
You can't really tell for a Web App whether it'll be faster in JS or Python, but you can definitely expect a Computer Vision application with lots of heavy number crunching to be a lot faster in C++ than in Python. We have actually also made comparisons, and even if you use things like numpy and Python bindings for OpenCV, you won't reach the speed that a C++ application achieves easily without optimization.
"Discoverability online" is a perennial question. And it's a rabbit hole as well since there's more then one way of exploring, discovering and consuming information with the question of "relevancy" being entirely context-driven.

Back in the 90s and 00s, the Web/Internet was promoted as a break from traditional mainstream media e.g. flipping between a fixed set of television networks that curated the content you'd get to see that night. It was hailed as this new way of sharing information compared to "40 channels and nothing's on tonight".

"What is the Web supposed to be?" has always been a question. Push or pull? The age of curated feeds and algorithms hasn't answered that question definitively. On the contrary.

> how do they find new viewers that want to watch their content without resorting to traditional advertising, or hoping word-of-mouth (online forums, IRL, or otherwise) works?

The Web/Internet is a game changer when it comes to providing access to services and information anytime any place. But, I don't believe that the Web / Internet was ever going to definitively solve an essentially a challenge of interaction between humans: "How do I get noticed?"

Consider a traditional library. As far as authors are concerned, putting books together and providing catalogues or curated suggestions to patrons doesn't imply that every single one of them will ever see the same reach or get the same readership. Not unless their work gets actively promoted.

Putting your work online - whether self-hosted or via a platform - only moves that challenge from the analogue to a virtual space.

Your mentioning RSS readers is interesting because subscribing to RSS feeds implies that you went through a phase or process of discovery first. Maybe someone recommended someone else's blog. Maybe you stumbled upon a blog via a blogroll. Maybe it's a blog of a friend who gave you their domain at a social occasion. There's just more then one way for a feed to arrive in your RSS reader.

To my mind, some of the criticisms about the quality of content on platforms, or what platforms recommend in their feeds, today draw parallels to criticisms given regarding last century's TV networks. To an extent, I think it's because the recommendation feeds of these platforms work just the same way: as constant feed that's passively consumed, having consumers flicking through whatever is presented until something engaging passes along.
I have the ~10” pocketbook. You can use it as a file storage device, you can hack it and the battery life is amazing. It’s also painfully slow for anything else other than reading.
> That assumes it’s harder to build it in the other language though. Maybe if that language is C then that will the case, but building in say Go may be just as easy as building in JavaScript (or close enough that it doesn’t really matter)

The cases where Go is significantly faster than JavaScript are vanishingly small.

> whereas rewriting it later would be a massive undertaking.

This is vastly overstated IME. Porting existing code as-is between languages is actually pretty easy.

> This I very different to say starting a with a micro service architecture which imposes relatively high overheads,

Disagree. You're imposing a huge overhead on hiring (if you want people with both languages) or on people's ability to work on the whole system (if you're happy hiring people who only cover one side or the other). Debugging also gets a lot harder. There's essentially twice as many tools to learn.
That is true. But if you compare it to, for example, managed web hosting, then it is a very different managed experience.
What about standardisation that comes with using a framework like kubernetes , while not using k8s you end up with adhoc deployment methods, clunky work arounds of handling networking, policies, secrets etc, with Kubernetes or even ECS it signals that the team or the developer is looking to use fixed set of rules for infrastructure, also k8s scales well even for smaller apps
Some tangible solutions to the supposed issues proposed in this article: paid technical support for your free product, votes for new features, consulting with companies that have problems your software can solve, and commercial vs consumer licencing.
There are plenty of ways. Limit playback only to official DRM-locked devices and have those devices film the user. The moment a camera makes it into the picture you block their account for life. That's not even new tech, 3D face detection is standard part of many smartphones and laptops. And companies like Facebook have no problem locking you out forever from their services, for much milder infractions.

Or more practically, just look at cinemas. They already film the audience to prevent filming and with great success. While you still get illegal copies of a movie easily, it's only extremely low quality smartphone rubbish. The high quality piracy videos only shows up months later once the films hit streaming services or Bluray.

And all of that is just current tech, lets assume VR will become a success in the future. Now you have a device on your head that tracks every little one of your moves, including things like heart rate and eye-tracking. Furthermore, what streams to you isn't an easily ripable 2D copy of the movie, but the 3D view of sitting in a cinema. Good luck trying to rip that. And of course tamper proof hardware is a thing as well, so any attempt at opening it up will automatically self destruct it and phone home that you tampered with it.
One thing I liked about it is that it has no withdrawal fee. I was lucky enough to withdraw around 98% of my funds yesterday to my wallet. Thank God!
I am responding to this from a BOOX e-reader. It runs android and lets me install whatever I want.
No sd card on this model. It supports the listed formats. You can also install other reader programs.
> For packets that aren't part of an existing steam, NAT will simply not edit the packet.

A 1:1 NAT should generally just swap IP for IP and not know about streams or ports at all.

> Unless there's a separate firewall that chooses to drop it, the packet will get delivered to whatever IP was already in the destination field, which could be the IP of one of your LAN machines.

I would call that a routing rules error, even in the absence of a firewall.
> We blocked off all the windows in our apartment (outside and inside) with old bed sheets and towels

doesnt that mean your windows are leaking like sieves? to the point a ~10000 BTU unit couldnt keep up with one room? :o or was it one of those portable exhaust only ACs sucking cold air out of the apartment creating a negative pressure?
Not nessesarily, but it tends to be slower moving and each element in the thread tends to be larger and better thought through. I find this means they tend to end up shorter as a result when you skip all the email signatures. There's also less sense of urgency to reply as well meaning you can set aside some time rather than feeling like you're missing out on the slack thread which may still be moving.

Other tools can work as well like shared documents if the content/context is several pages or something.
> Right tool for the job!

Well said: this should be the only rule!
Seriously, I use k8s for the same reason I use docker: it's a standard language for deployment. Yeah I could do the same stuff manually for a small project.. but why?
This would be my pick for the same reason or perhaps a mathematics book with tons of proofs (preferably Analysis).
Maybe he's holding it wrong.
One design goal of Philips screw drive is to prevent stripping the screw head. The gradual taper allows the screw driver to cam out before excessive torque damages the work.

On good days.

Then there's Uncle Jimmy.
And isn’t Wasm supposed to (some day) free us from the need to pick JS for the front end?
“ The problem is this applies to any social media website with algorithmic recommendations.”

I genuinely see no problem with this. Mass scale so-called-social media increasingly overwhelmingly has no genuine value.

“How do you scale to a billion users?”

How about - don’t? Taking this as some obvious good reeks of Zuckerbergian “we’re connecting the globe.” Yeah, connecting, say, Jihadists around the globe. Facilitating Russian psyop units connecting to Joe 6-Pack in middle America. Connecting billions of $ in advertising to the hyper-specific data of users, to better sell them shit they overwhelmingly don’t need and would never want without being convinced their insufficient without it.
Want to work on the open source vector search engine Weaviate?

We are looking to hire multiple roles for our Weaviate Cloud Service team: one Senior Front-end Developer, one Full-stack Developer with front-end focus, and two Senior Software engineers.
Highlights: - contribute to build SeMI’s managed Weaviate offering.
More info: https://theorg.com/org/semi-technologies/teams/weaviate-clou...

Next to that we are looking to hire one Technical Curriculum Developer that will define, create and maintain educational content for Weaviate.
Highlights: - Work with open source vector search engine Weaviate (https://weaviate.io). - Shape the curriculum strategy and create a playbook for creating learning materials for our flagship product.
More info: https://theorg.com/org/semi-technologies/jobs/technical-curr...
No, I wanted four candles.
How so? `git clone` doesn't operate any differently here than it does on GitHub or any other git hosting service. Reading the `README.md` or other Markdown based project notes doesn't work any differently here from GitHub or any other git host. Reading a documentation wiki, or filing an issue in the bug tracker isn't any different here. Hell, you can even log in using your GitHub account on most other git hosting services, so creating an account there is pretty much totally "frictionless". So, what exactly is so "painful" about it?
The flipside of this philosophy is that you have to be able to revisit your decisions when your requirements change.

This is a superpower that you want to have individually as an engineer but you need organisationally as a culture too. If you have that power then you when you need to write some similar code you can copy and paste, because you can trust that when you have a third use you will actually refactor properly. It means that you can get the service up and running quickly on a box you've got, because you can trust that if the service actually gets used your org will allow you the time to put it on the cloud properly.

It's the most important part of agile - make the right decision for what you've got now, and then make a different one later.
Bullshit, the inability to properly optimize doesn't mean it's optimized well for huge deployments. It will need much more resource on huge deployments and still quite some RAM on small deployments too.

At this point, the code base is too big for them to fix the performance and they want to use their time on new features and bug fixes as that's what customers are asking more while customers may solve the performance problem by spending more money on the server.

It's just that the initial technical decisions sucked and it's no longer possible to fix it at this point.
> There is no single benefit to individuals or society from apps like these,

Then hopefully you make sure your kid is not using it, right? There are ways to restrict phones and make sure to communicate the dangers directly.

I think social media as it stands, is too dangerous for kids. You would need to have some kind of social media app that checks your real age somehow, and then it's exclusive for kids only. When you mix literally everyone in the same network, then kids are exposed to adult stuff (and I just mean more complex ideas and concepts that might be safe for adults but not kids). Until then, I think the only solution is to ban kids from using social media, which will be hard until the kids-only alternative happens.
From what I see, most Wayland aware applications have converged on using PipeWire (through XDG Portal) for screen sharing.

Personally I use PipeWire anyway but I'll admit telling people to replace more of their setup as a solution isn't very nice.

Also there might be oddballs like how Zoom used to use the GNOME screenshot API for a while.
That’s funny since when I ordered a Beyerdynamic headphone on Amazon they sent me the high impedance model I hadn’t asked for.

Although the best one I own is a Stax which needs an entire speaker amp.
The impression I've gotten from some of my co-workers is that in bootcamps and college they only learned one language, remember the time and effort that went into that, and assume learning another language will take the same time and effort. Because they haven't really put effort into a second one, they don't yet realize just how much conceptually transfers between the languages.
Last year I tried to "simplify" by doing things mostly the old way (though we used containers for a bunch of things later on).

The experience pushed me to decide "never again" and to plonk k3s or at least something like podman from the start on the server.
> I've just been doing some repairs on an old deck and all the hardware is square. I don't think I've ever seen a square screw/bolt before moving to North America...

This sounds like Robertson, which is uniquely Canadian. Are you in Canada by any chance?
But then mor commonly it gets damaged by repeated cam out.
Given some of the people here might run their own servers, the self-hosted alternative is to have something like Sonarr PVR for newsgroups and torrents, alongside a tracker indexer like Jackett, and then Plex for the frontend. In this combination, you "subscribe" to TV shows and select movies on the Sonarr system, and then the downloading is taken care for you even when new episodes arrive. These will then appear on Plex which is refreshed by the pipeline automatically. The system integrates with private trackers and is capable of maintaining your seed-ratio if that's important.

I recently fell into this rabbit-hole while trying to organise my music. For music there is Lidarr, which also ID3 tags your music and reorganizes it into folder structures. This is convenient since organizing anything using Plex is a nightmare.
Very hard not to see this as an "as you sow, you shall reap" moment. Generally I hate news organisations being in lawsuits, it's net chilling. When Fox started "this isn't news, it's opinion" I think they opened Pandora's box.

Dominion would have a strong case. Arguably, even with arguing Malice, if that's a "thing" in American libel law: Fox editorial staff evidently knew this was a non story and went ahead.

Am I wrong? Does Fox have some shield law or truth defence? I can't see it.
This is our world right now. A kubernetes cronjob sometimes fails and we have no idea why.
> This is vastly overstated IME. Porting existing code as-is between languages is actually pretty easy.

Yep. We always implemented (parts of) embedded software in Java first and later in JS and then port it. If no additional functionality is added, this is trivial and saves a lot of work and errors as you already tested, debugged and fixed the logic parts.
At least for our small use case, the web interface is snappy enough that it's just about spending more money to host it but I'd definitely like it to reduce its memory usage as I'll have to double the server size just for Sentry.
Now you're being deliberately obtuse. I can't engage further. Sorry.
You could be right about the US, but other places are geopolitically less stable. And, transmission lines have outages, and there are never quite as many as you would like. And, the US is getting less stable as we speak, with avowed insurrectionist election suppressors poised to take over Congress and Senate, and maybe the presidency again.

Coal plants are monstrous beasts that need a long time to fire up and a lot of expensive maintenance whenever down. Combined-cycle turbines start up in a few minutes, are cheap to maintain, and a little one makes as much economic sense as a big one. But storing LNG, long-term, is a nuisance. So you want to fire them on something readily stored, liquid unless you have a salt dome. So, ammonia, or synthetic methanol, metal hydride, or even mined and refined kerosene. Because it is just for emergencies anyway.
> pozidriv practically doesn't exist outside Europe.

I had to think for a while to remember the last time I saw a Phillips screw here in the UK. Then I remembered - it was about a year ago when I had to take something apart, and I cussed the thing out for having a screw that almost matches the screwdrivers that everyone has, and who even has Phillips screwdrivers these days anyway?
Couldn't you just put a safety on the footgun and let users decide if it's worth the risk to forgo safety checks.

Now only cloudflare workers and fly.io will have zero-effort distributed sqlite.