skysight-inc/HackerNews huggingface dataset:
2FA attempts to assert "the person who is publishing the package to the registry is someone that the registry expects"

As a user installing from a registry, you are trusting both the publisher AND the distributor.

Consider an attack where the distributor is adding malicious code to 1% of installs. The publisher is not involved in the process and (unless code signing is involved) has no influence.

But if code signing is involved, why is 2FA even needed? The signatures themselves should be sufficient proof.

So 2FA overall is a solution in the lens that the distributor intermediates the relationship. This need not happen. People can chuck tarballs and post signatures, establishing more direct trust compared to the indirect solution.
I got them mixed up, thanks for the correction.
Specially at the end of the day, 2FA really means auth by your phone as you can always reset your password.

It’s like remembering a password, make it strong, and keep is safe has no value.
Who knows, the academic research is often focused on finding out new physics and relies on hero samples. The many failed attempts to solve the engineering challenge of scalability and reliability in graphene are not very visible to the world.
The more I understand about biology, the more bizarre it is that people try to beat it down to simple, obvious, narrow, and globally consistent binaries to serve their ideological purposes.
USDA regulates that, at least for products with its seal.

https://www.ams.usda.gov/rules-regulations/organic/organic-s...
Disclaimer: I don't know if the theory presented in this video is true or not...

However, in my opinion, Dr. Thomas Dykstra does make a very compelling case for it.

That being said, I still do not know if the theory presented in this video is true or not.

But if (key word, "if"!) his theory is true -- then it would be a rather revolutionary theory -- at least as far as modern-day agricultural practices go!

Perhaps there might be some things here that may be worthwhile to investigate further -- for those that have an interest in agriculture...
To be more specific, "git log arraymodule.c" reports:

commit 778983b48165da25ee11fb97f6855af7c67f4ff2
Author: Guido van Rossum <guido@python.org>
Date: Fri Feb 19 15:55:02 1993 +0000

Added new module "array" (for now optional) defining array objects.
I am in almost the same state as you (age, num companies etc). In my latest job switch interviewing, a company did actually reject me for this reason. I think it is important to not do it too much. In my infinite wisdom I took a chance this time by leaving Google for a startup before a recession, and feel I might have to stick it out to not have another short stint. I like my job/co so far, but I would recommend being careful with your choices and not switch unless you're more sure than usual because you can't as easily hop next time to a great co. Another option is to switch teams within big co if your current team isn't fun. I know that it is tricky to find a team and company that just hits it right in terms of your interests, passion etc. but one can only make switches at a high frequency so often. Raise the bar for what it'd take to switch is my thought on this.
The whole globe? No. But the berne convention does have 179 signatory countries. It's not just "western".

https://en.m.wikipedia.org/wiki/Berne_Convention
How many report have you see to discredit the same idea. My guess is that it’s probably 10 to 1.

How many false accusation have you seen against Trump?
It was a constant barrage of attack. Even humorists where no longer funny by hitting Trump so many times it got boring.

Anyway, you are free to believe that the media is unbiased.
Not sure it's faster. I worked as a cashier for awhile at a grocery store. A 2 person team, one scanning/keying in items and one bagging, is a ton faster then you doing it all yourself. Customers who would do this were great. The worst ones were the ones who just sorta stared at you as you rang up then bagged their groceries for them while complaining about long lines.

The other big speed enhancement is memorization of common PLUs. Seeing bananas and just knowing the code (4011 or 94011 for non organic/ organic respectively) Is a lot faster than trying to navigate through the menus. It's on the label but most people don't seem to realize that.

That said I still think it should be self check out all the way, letting one person run 6 self checkouts at midnight so I don't get caught behind the person buying two shopping carts of misc stuff while I'm just trying to grab an orange juice is miserable.
autosave makes programming feel more interactive like a video game.
Maybe Fedora with Xen is the route I should try, assuming I can give the Windows VM full GPU pass-through and use it as a "primary" machine. I need to be able to screenshare almost daily via Zoom.
I just do not agree that one party is more extreme than the other, sorry. I also don't believe you are being honest with yourself over the situation either. It's clear you have dug your heels into a particular set of beliefs and have no interest in discussing real solutions (instead just want to play the blame game). Frankly it is just not interesting discussion.
Show HN: React Native Elements v4
Not belittling anybody.

But any grandpa or granny who can use YouTube, can do it simply by following instructions shown there.

People should at least be willing to do that.
Feel free to just... not publish to pypi.org. You can run your own pypi if you'd like, it's pretty trivial. Or you can just put your code on github. Or pastebin. Or nowhere.

As for cargo-vet vs 2fa, as the article mentions (but I think bears emphasis), they solve different problems.

Sorry but I just do not care at all about this "burden" that you may feel because you've been asked to enable 2FA for a site that hosts your code for free.

A lot of this article also seems to boil down to some sort of slippery slope. 2FA today, package signing tomorrow, the end of the world next week? I'm unconvinced.

Ultimately,

> I think as an Open Source developer who is using the index for free, I can't demand much from it.

I feel like the article could have been this one line, and then there could have been a separate post discussing the merits of 2fa vs vet.
Open-Source CaiT Implementation
An open-source implementation of the Going deeper with Image Transformers research paper in Google's JAX and Flax.

The paper also notes difficulty in training vision transformers at greater depths and proposes two solutions. First it proposes to do per-channel multiplication of the output of the residual block. Second, it proposes to have the patches attend to one another, and only allow the CLS token to attend to the patches in the last few layers.

CaiT Research Paper: https://arxiv.org/abs/2103.17239

Official Github repository: https://github.com/rwightman/pytorch-image-models

Developer updates can be found on: https://twitter.com/EnricoShippole
Just type "vimtutor". If you have vim you should also have vimtutor.
One of those is not like the other. Prostitution is illegal in most places, so I don't have any beef with them avoiding it.

Porn is legal, and should not be discriminated against, but that's beside the point. The business in question was providing 100% legal services for adults, but nothing to do with either porn or prostitution.

Are you saying it is ok to discriminate against a business just because their services are oriented towards adults and not children? If that is the case, then Stripe should also discriminate against "straight" bars and pubs, which is not the case.
I believe for Apple's rescaling to work properly, it needs to be able to render at 2x resolution on both axes (4x resolution total). So for this 2560 x 2880, it needs a GPU to render internally at 5210x5760. That is 30MP. Can your GPU actually do this?
> learning Vim has nothing to do with muscle memory

See this definition for muscle memory from Wikipedia:

"Muscle memory is a form of procedural memory that involves consolidating a specific motor task into memory through repetition, which has been used synonymously with motor learning. When a movement is repeated over time, the brain creates a long-term muscle memory for that task, eventually allowing it to be performed with little to no conscious effort. This process decreases the need for attention and creates maximum efficiency within the motor and memory systems. Muscle memory is found in many everyday activities that become automatic and improve with practice, such as riding bicycles, driving motor vehicles, playing ball sports, typing on keyboards, entering PINs, playing musical instruments, poker, martial arts, and dancing."

I don't see why Vim commands would be any different from typing on keyboards, or playing a musical instrument. They are tactile, and rely on motor control.

> and doing it outside of Vim is pointless

I see no reason at all why this should be true. Does the tool let the learner use keyboard to practice memorizing the commands, and they produce the exact same effects as inside Vim? If yes, then by what claim do you say it is pointless? A claim that this tool isn't "the real Vim" feels like a "no true Scotsman" fallacy.

This whole comment reads like sour grapes. Are you mad that it isn't free? Just come out and say that. Perhaps reference Socrates, and how he was angry at the suggestion he charged money for education. Or just point out the free resources and leave it at that. No need to attack him so strongly.

And before someone else says it, yes, I wrote a book about Vim, and no, it isn't free ;)
> limited supply

You can build 8-15 new houses in about a month for what it costs for one outside of LA.
> Coal, oil and gas. What other fossil fuels are out there?

peat
https://reactnativeelements.com/blog/2022/05/15/rneui-migrat...
fairly normal if somebody is buying like, a $5000 camera
If you’re asking about Musk I think you’re mistaking ego, hubris, and narcissism for sincere concern about our species. His Mars plans are scams, not something a sensible person thinks will happen anytime soon, if ever.
>You can indeed yank all versions, delete the package, make a new package with the same name.

I'm sorry, what? At the very least it should prevent a package with the same name
They solve different problems. Given a signed package I can say "this is signed by that key". I can't say how that key was registered, or who registered it, etc. 2FA would be where that key registration actually happens.
That would explain why urinotherapy may work. Expose your immune system to pathogens that are in place unreachable to it, to mount response (multiply antigens that work on them) and voila. Just that whole idea is rather hard to swallow...
Sounds like calculus is going to become an integral part of the author's life. Hope they make continuous small changes that will push them to their mathematical limits.
Absolutely! I’m sure they analyzed for that, but backflow to the opposite direction of the nozzle is quite unintuitive but normal in rarefied flow, with propellant deposition next to the nozzle possible and documented [1]. Just because you point it away from the sensitive stuff does not mean it won’t get there and leave nasty traces.

[1] https://apps.dtic.mil/dtic/tr/fulltext/u2/a588174.pdf
There's a few in the store near me that are basically just normal lanes with the cashier area flipped around. They're great other then the fact you just halved the amount of scanning/bagging work power you have.
AWS Outposts are tragically limiting in so many ways. If you are a small shop they are great but if you don’t fit their model exactly you are SOL.

Same problem with Anthos.

You can work around the limitations by having a million points of presence with them and splitting up your workloads but there’s real costs associated with that model. Running 1 rack in 100 DCs is a lot harder than 10 racks in 10 DCs.
There are certain impossibilities in the world, like the halting problem, and DRM: "As the author, I wish to sell my work. But I don't want anyone to copy my work, and redistribute it without my permission -- or use it in a way that I disagree with."

Such a thing is an impossible ask. No technological means can prevent this from happening -- though many have tried and failed. It always results in a repressive and totalitarian ecosystem.

I think that pypi is trying to accomplish is in this category. It results in things like the leftpad.js incident.

The goal is always some specious form of "harm reduction", trust, and safety. These can't be obtained by technological means, but they can be produced.
I got the Audible version and it works very well, given its talkative style
Another fine book along those lines is "Rocket Manual For Amateurs" by Brinley.

https://www.amazon.com/Rocket-Manual-Amateurs-Bertrand-Brinl...

Unfortunately, it's rare and expensive.

The first page:

"If your answer to the first question is that you are thrilled and fascinated by things that burn and explode, and you love to watch fireworks displays, or you simply want to send a rocket higher than the boy next door, then this book is not written for you, and you had better find something less dangerous to amuse you."

I encountered that book when I was 9. Naturally, I had to read the rest of it! What boy could resist?
Wikipedia says that hyperconverged infrastructure typically uses commercial off-the-shelf computers. So that's likely why they're allergic to it. As they're designing their own computers so the term isn't accurate.

https://en.wikipedia.org/wiki/Hyper-converged_infrastructure

Oxide racks won't be able to use anything other than Oxide computers (or maybe eventually third party computers that follow Oxide standards).
What is missing is a middle ground: an improvement over the IPMI broken-state-of-things that is aimed for automated deployments, without demanding a certain network environment for PXE booting and configuration of IP addresses for management.

I haven't used RedFish but it seems it does not address the problems of IPMI in this regard: To be fully automatable there shouldn't be an assumption about the network environment - rather I would like that to have an L2-based protocol (one has to use the MAC address as identifier anyway) or if IPv4/v6 is used then at least demand mandatory link-local auto-addressing by default.
However, RedFish seems to support emulating a CD-ROM drive for booting an installation media, this is a nice idea but what I really would like to see is directly writing an image to the hard disk. Then of coure the hardware manufacturers would need to write high-quality firmware and not the regular quirk- and bug-ridden stuff that we know from IPMI implementations.
Footage of Sri Lanka's President fleeing on military ship from Colombo harbor
> This is so good it almost makes me not want to throw up in my mouth when I hear that Kate Bush song for the 90th time in a day because of Stranger Things.

I love this song, but I wonder if I'm the only one who thought it was really out of place in that scene, even kind of forced in.

It too me out of the scene rather than keeping me in.
I don't get the distinction between type 1 and type 2.

E.g. xen is type 1 and KVM is type 2. But at the end of the day it's a Linux kernel in both cases that runs the virtual machines, so what's the point of distinction?
Where is the paper proving that conciousness is material in origin?
“in mice”
Exactly, I'm in the same boat as the author and you, where the 2FA is just a mild inconvenience (I travel a lot, no fixed sms, have lost too many yubikeys). However indexes forcing authors to use 2FA has open my eyes to how much control they have; if they required tomorrow to identify with a national ID, or pay $10/year for the top 1% of authors they could easily do so (e.g. any action not "too" drastic to have a massive backlash, meaning it's draconian but only for very few). This could go virtually in any direction and they have a massive amount power, and that feels very scary indeed.

I've invested 10s of thousands of hours in writing open source, which I'm very happy to share with the world, and while I have multiple backups being banned or unable to use npm would def be a tragedy for me.
There were animations of DNA -> protein translation, it felt very much like good old (map f list) :)
I am of the age of these kinds of devices and I don't think, A.I. was really a concept in how it is these days. I remember robot after robot in popular sci fi but outside of the Asimov stories my Dad read, I don't remember thinking about robots as intelligent in the way we think of A.I. now, as being autonomously able to think without being specifically programmed. I think I thought they were kind of clever logic.
It's all Greek to me. It seems we're always warned that the Law can't be reduced to a simple formula. Scott Galloway seemed to indicate in his gleeful "Elon pulls out" emergency podcast episode that one valid reason to go to the $1B penalty could have been that Musk couldn't get the right financing together. Would it be so hard for him to get some I-banker on the stand to tell that tale? Why would any of the big banks care about the feelings of Twitter execs?
That's not even the point of the blog post to begin debating it here. If the the author believes that then he can write a blog post about how 2FA is bad. That's not what we have here though. In fact, he instead says "it's a sensible thing" and his complaint is that it's a slippery slope: "More importantly though is what could come next. There is a hypothetical future where the rules tighten."
> Fellow IBS-sufferer here. Runs in my family.

I see what you did there.
To tack on, they're actually giving away those tokens for free for those who request one.

https://pypi.org/security-key-giveaway

They're being beyond reasonable. This is outright kind.
The question isn't whether they can think, it's if they can feel
That's such a shame. I've tried listening to those recordings and it's hard to follow without the context of the "Twitter Space" which I'm not even sure what is because I don't use Twitter. The audio quality is also quite grating to listen to.

Would love recommendations for in depth, tech related podcasts that stand on their on, like On The Metal.
When we write software as part of a job, we have all kinds of staff who support the project —- project managers, product managers, QA, marketing and sales, security etc etc.

It really seems that, for open source projects, the author is expected to be responsible for everything.

I think it would be a great benefit to all of us if people who wanted to open up code but didn’t want to add responsibility to their own world felt welcome to do so. I think it’s a problem worth solving.
I see self-checkout as a useful ADDITION to the cashier operated one.

It's primary purpose? Fast lane for a couple of items purchased.

If I buy a full cart of groceries, detergent, power tools and what else, I'll go to the human operated checkout. Also although not illegal, I think it's grossly morraly offensive and deep ashholeness when people go to self checkout. 100% of the times they'll fuck up something, require assistance and take 5 times as much time as if the experienced cashier would have operated checkout.

But when I storm in the mall and buy me a toothpaste and a can of soda, I use self checkout. Expecting it to be largely available and not all 10 desks blocked by idiots with full carts.
> doesn't mean that the application of that understanding to implementation humans will take a liking to is well understood.

I really like how ML implements it, does that make me somehow less human?
Just ask me out already, I’m an easy lay.
So what? Users can do that if the maintainer chooses to move hosting.
What’s causing all of these logos to look the same?
This is pretty cool. Are you worried about copyright at all though? Especially if this get used in a commercial context?
Perhaps your ad blocker or something else blocked out the paragraphs of the article where OP specifically addresses this point. I will paste it below. It is quite clear this is not just about 2FA but instead about a line being drawn which makes a new, special class of package that didn't originally exist when the author started work.

> There is a hypothetical future where the rules tighten. One could imagine that an index would like to enforce cryptographic signing of newly released packages. Or the index wants to enable reclaiming of critical packages if the author does not respond or do bad things with the package. For instance a critical package being unpublished is a problem for the ecosystem. One could imagine a situation where in that case the Index maintainers take over the record of that package on the index to undo the damage. Likewise it's more than imaginable that an index of the future will require packages to enforce a minimum standard for critical packages such as a certain SLO for responding to critical incoming requests (security, trademark laws etc.).
... it'll be fun if you start from what happens when the enter key is pressed- the mechanics and electronics involved in submitting that URL (and some chemistry and physics behind what your eyes see on the screen), the physical transmission of the signal from your computer to through the interwebs and some error correction protocols to ensure your signals are still useful.

Maybe toss a line or two in about the complexities of running a large data center and how your response time varies based on some sorcery.

Then you go the extra mile and weave a tale of electrons wrestling with their universe of invisible electromagnetic wave overlords that determine their fate while they embark on a treacherous journey to convey information thousands of kilometers across with blistering speed. Tell them of the aged electron saw a family member get attacked by a stray cosmic ray and the fright of the pack when one simply tunneled out of existence...
Firefox with uBO [0] and Auto Tab Discard [1] is pretty good on the battery. I often go 10h without a charge on my M1 Air and usually there's still a bit to spare.

[0] https://ublockorigin.com/
[1] https://addons.mozilla.org/en-US/firefox/addon/auto-tab-disc...
What makes this song special (by Rick Beato): https://www.youtube.com/watch?v=pwZysZPIrYI
I was reading about Device Isolation but there's still something I'm not clear on:

Does the OS claim to prevent partially-trusted PCI devices linked to one VM from accessing memory of another VM? If so, how's that done?

I understand by default the hypervisor resets a device when it's moved from one VM to another, which would mitigate an evil device driver in the former from impacting the latter. But that doesn't protect from isolation breaches caused by evil [persistent] firmware.

I thought PCI cards have DMA access to all the system's memory space, unless you happen to have a server-type motherboard with a "smart PCIe bridge that can be programmed to perform address translation and access restrictions" (https://superuser.com/a/988179). Is such hardware more common now? Or does Qubes rely on all hardware you plug into it being trustworthy?
Google Sheets API v4 Integration Guide
No, the issue yesterday is that people had to go in manually to fix their CI builds, etc. That's simply not necessary if you don't update the version and yanking is disallowed (which it should be).

After that, if people want to at some point update to a newer version of the package, yes, they will have to adjust.
I would prefer higher dpi too. If someone would make a hidpi square (ish) screen I would buy it in a heartbeat. The Huawei Mateview looks great but can't swivel to portrait, unfortunately.
Federated / self-service responsibilities are the only way things like this ever scale. In your example, it makes sense the index wants to push the responsibility out broadly, there’s no way the index can develop the breadth and depth of expertise necessary to write high quality man pages for every package - they’re too busy using their limited resources on maintaining the index (their “vertical”).
> Not sure about which ratio is really better.

That is going to depend entirely on requirements. Fast delivery, fast execution, correctness and others. No tool for everything :)