skysight-inc/HackerNews huggingface dataset:
Wow. This attitude is exactly why I don’t post software anymore.

I’m not delusional; I know that the world might be better off without my creations littering it. But if I were an attorney advising $Bigcorp, messages just like this one are why I would advise against posting any free software unless there is a business case for how the benefit outweighs the risk.

And a disclaimer does not eliminate risk, not even the heightened disclaimer you suggest (why isn’t the disclaimer in the license enough?) The instant I have to defend a lawsuit, I’ve lost. It doesn’t matter if the suit is meritless and I “win.” Then instant someone sues me, the only winner is my lawyer.

I guess this was all inevitable when people started relying on free software. They somehow think people who have given them something for free owe them something. I guess this works fine when the giver is $Bigcorp doing it for profit-seeking reasons. But this attitude is going to strangle the old small-time hobbyists who really were just scratching an itch.

Now I know why some software is posted under pseudonyms.
I have nothing to add other than I'm happy to see so many synth geeks on HN :)
Yes, sometimes you would need to read java code but nothing extreme. Kotlin really is just a better Java
That's outdated terminology from a time where physical media was needed. Or perhaps we could say that it's in a store's best interest to go beyond that into curation. Just like physical stores do. Consumer protection demands that we don't get OpenerOffice, EasyWords, LetterWriter, etc. as paid forks with no differentiation, generated in bulk by spammers in poorer countries. Meaningful code improvements should be required.
> Yes, TOTP adds very little advantage when you have an already safe password. But there is no way for PyPI to know if you're doing that or not.

But there is! Pre-generate a password for the user, instead of letting them supply one. This adds no extra inconvenience if you're already using a password manager, but it makes password reuse impossible.
How is that? Popular parties would split to express a wider array of views.

Of course first-past the post voting systems won't work here, but that doesn't make it undemocratic.
The true goal of this tech is right there in the second paragraph of the story: to ultimately stop people from having free movement by taking away their access to useful transportation.
> The guy is pretty contemptuous of legal authority; he thinks he is above the law and he might be right

Of all the funny things I have read this week this takes the cake, Biden will not allow him to get away with it, not a joke.
Not quite. When a package is submitted to PyPi, there’s legalese that says people can download and use it.

> If I upload Content other than under an Included License, then I grant the PSF and all other users of the web site an irrevocable, worldwide, royalty-free, nonexclusive license to reproduce, distribute, transmit, display, perform, and publish the Content, including in digital form.

https://pypi.org/policy/terms-of-use/
This week in KDE: big things
I have asked about these options, and I am pushing for something; but the company was recently acquired by PE so they are tight with every dollar.
> still has his [security clearance] because of "reasons".

Does he? I don't remember any resolution to that, but I thought they "temporarily" suspended it pending an investigation and then never completed the investigation.
You could hack that together with huginn pretty easily

https://github.com/huginn/huginn
This is why Levine's is one of a very few newsletters I subscribe to, and I read it immediately when it arrives. He's both entertaining and educational. I know a great deal more about finance now than I did a year ago, and that's because of Matt Levine.
If you were damaged enough for long term side-effects it is likely to an extent an irreversible process, as it trends to be for many diseases.

That's not to say you can't have some recovery and adapt, just that what you were before is never coming back.

I developed diastolic dysfunction and severe sensitivities and food intolerances after Cipro and other antibiotics in 2014. The only way there could be a persistent diastolic dysfunction is if there has been permanent damage to the cells of the heart.

If he has input as to things which helped him I'd love to see, but as far as I understand, if the mechanism is indeed mtdna depletion and mutagenesis from excessive ROS then I don't really see how you actually cure that.
They absolutely should, but that's why we need to retain the ability to download and install outside of the store. As long as we have that ability, this isn't a concern.
Disagree. Have you ever use Kotlin? Because it's such a wonderful and simplified experience compared to Java
One of my colleagues, a young and smart man 100% relies on Auto Pilot for a certain routine 400+ mile commute between cities. We have talked to him about it, his experience of never seeing it fail IMO creates a false sense of security in relation to Auto Pilot for him. I doubt he is alone in this kind of thinking.
Street Foodle – a Wordle for street food
Hillary Clinton had a super PAC that did so openly:

"In April 2016, Correct the Record announced that it would be spending $1 million to find and confront social media users who post unflattering messages about Clinton in a "task force" called "Barrier Breakers 2016".[1][5] In addition to this, the task force aimed to encourage Sanders supporters to support Clinton and to thank both "prominent supporters and committed superdelegates".[6] The organization's president, Brad Woodhouse, said they had "about a dozen people engaged in [producing] nothing but positive content on Hillary Clinton" and had a team distributing information "particularly of interest to women".[7]"

https://en.m.wikipedia.org/wiki/Correct_the_Record

If you watched r/politics and political humor back that it went from organic looking to the consent manufacturing factories they are today.
It emphasises the negative effect Putin has on the country. And he does. He's plunging the country and the world into an unnecessary war just to feed his pride, and he does so in a clear break from his predecessor. Putin's Russia is significantly different from Yeltsin's Russia that it's worth pointing out the difference, especially since that difference is all him.

And while you could certainly argue that for example Bush plunged his country into an unnecessary war to feed his pride, you're arguing that he's not that much of a break from his predecessors. And the American people as a whole definitely carry more of that responsibility. That's still a reason to call out Putin specifically, instead of the country as a whole.
Great context, discussion: https://www.genengnews.com/topics/drug-discovery/therapeutic...

> Higher intensities of the same sounds had no effect on animals’ pain responses. “In mice, we found that sound-induced analgesia depended on its low SNR rather than harmony, which is supported by a previous hypothesis that music-induced analgesia is attributable to contextual factors of the treatment, not only to the music per se,” they wrote. “We were really surprised that the intensity of sound, and not the category or perceived pleasantness of sound would matter,” Liu said.

…

> The authors further stated that the observed low-SNR sound–induced analgesia is “unlikely to result from some reduction in anxiety or stress, and it probably does not directly involve attention-distraction in affecting pain perception, given that the analgesic effects persisted for at least two days after sound withdrawal.”
Elon’s going to get away with this. Even though he shouldn’t.

The rich play by different rules and the law lets them.

If the rest of us did the same we would have to pay ridiculous fines and/or spent time behind bars.
I also work from home. I only use my laptop when I travel once or twice a year. I much prefer my desktop computer.
If I’m an experienced programmer who is fascinated by molecular biology and would love to transition from e-commerce to biotech, what sorts of jobs would I look for or what would I do to prepare for such a switch?
Note that the new lines are not TTC lines, they are Metrolinx lines. And Metrolinx is also building LRT systems in other cities that use standard gauge, so it definitely makes the most sense to stick with standard gauge instead of switching to the TTC's unique gauge.

Now imagine that Metrolinx's GO trains also used a non-standard gauge? Not only could they not share track with freight trains, or even Via Rail, but simply delivering the train cars from where they are manufactured in Thunder Bay would be a nightmare. As it is, they're just attached to a freight train and pulled along like any other car, and I've even seen them on a CP freight train.
https://en.wikipedia.org/wiki/DSM-5
That's not the symmetrical position. PyPI demands nothing of anyone. It provides a free service with terms of use.
Or could be that similar accidents happen fairly frequently with other cars but links are not posted to HN because they won’t result in a discussion. Tesla posts, on the other hand, lead to a never ending heated criticism.
“No locations in the last three hours. Check back soon.”

:(
Exactly this. The mask slipped for a moment.
Apologies for the ambiguity. I meant backlight bleeding, i.e. some bright spots on the edge of the screen. It's a very common issue.
US law obviously works in favor of billionaires. I doubt even Musk would want to expose it further, and the other parties involved in this deal surely don't.

They will set their lawyers at it and come to a settlement. The super rich know better than to be at each others throats, that sort of behavior is for the poor...
I drive at the limit almost always. What makes it less useful? I would prefer this compared to the system of fees and irregular enforcement most countries have now.
Well based on the termination letter it looks like they are claiming it is deliberate since the number of known-spam accounts (blocked accounts) were not subtracted from the reported total user count.
At the time of posting, the extension actually allows you to export either jsx (which you can directly place in a react file) or html. That detail just isn't shown in the video, which shows an earlier version of the feature. Will update video.
> They could seize and sell at auction the real property of any of his businesses. SpaceX rockets? Office chairs? Servers? Anything.

They could not, because he does not own those businesses outright. Doing so would violate the other owners rights. They can seize his shares in SpaceX, but not SpaceX property.
PDF exploits are not new.

I am really amazed at this business of PDFs running code. Only Adobe and Microsoft could come up with this kind of crap.

Documents are not supposed to be executable, plain and simple.

Any person in control of crypto keys who opens a PDF file, in fact any kind of executable coming from an email is an idiot.

1. They are supposed to come only from trusted authorized staff of business partners.

2. They are supposed to be scanned and vetted by in-house security on separate secure machines, even if they are from trusted business partners before being run on any end user machine, even those of admins and security admins.

3. There must be a clear cut case for files being executable in any case.

4. If you are to run any documented it should be checked on a remotely accessed system, ie over Remote Desktop, VNC if necessary, and purged of any code before being run on an enduser machine.

This is why I consider most crypto companies to be snake oil scams. If they don't have the discipline to secure their computer systems properly, why should they be trusted with other people's money.

It is so stupid it makes you wonder if said employee was a part of the scam.
The world has no shortage of “I don’t understand this so it couldn’t be important” in daily life, let alone online.
I believe he was sincere, but found out quickly that a lot of people had strong feelings about his plans for the platform. It's possible he was in danger of losing people he really needs for his other businesses. I don't blame him for bailing out on a lose/lose situation.
Shouldn't the trailer barrier have kept the vehicle from going under like that?
I just read the entire Twitter thread. What a Kafkaesque nightmare.
As stated, Shopify has no recurring subscription system (which is astounding since it seems basic enough for them to offer, but I guess they're getting profits either way). I've experimented with a few popular recurrence "apps" and I can say that one of the most popular ones was awful to setup and maintain. I chose a more indie option (Seal Subscriptions, if you're a Shopify store go check them out) and got much better results.
Funny, the word "loosing" is not in the body of the article and the HN title seems to be completely made up.
Could you include a link to the new podcastified Twitter space in the footer of https://oxide.computer/ ?

And maybe do an addendum 5 minute announcement episode on the “on the metal” podcast?

Love your excellent work, thank you all
You're talking about Musk pressuring Cooley to fire a lawyer who previously worked against him at the SEC. But the result was that Cooley told Musk no. Hardly a success story for Musk.

There's no shortage of law firms willing to go up against billionaires. Hell, there's no shortage of firms willing to go up against criminal enterprises like drug cartels.

The idea that Musk is somehow more threatening than the types that the US court system regularly puts under their thumb is simply laughable.
Also, people who are eating too many pre-made/processed/frozen foods might not be eating enough fresh, organic fruits and vegetables, which are a great source of helpful bacteria and the prebiotic fibers that keep them alive.
Link for European users:
https://archive.ph/Giqfp
Btw, job ads get queued long in advance and then the software picks the next one when it's time for a job ad. After 8 hours of being down, the software thought it was time for a job ad.
Could they do this for legal documents too?

I'd hate to see just the programmers put out of work by GPT-3.
Tell HN: Information security audit / consulting is largely a scam industry
In light of a recent thread about SOC 2 certification (https://news.ycombinator.com/item?id=32018066), I wanted to share my perspective as an auditor/consultant on the other side of the table and inform people just how grim it looks from the inside. Before I get dunked on, yes - there are probably smaller niche firms worth every penny.

Shortly after starting in this line of work, it became clear that the services we sell are disingenuous. Here are some examples of why:

* My main argument: there is a HIGH likelihood that information security consulting is the first job out of college for the auditor leading you through the engagement. Beyond surface-level knowledge about multi-factor authentication being important and knowing that “Splunk is where the logs go,” your assessor is probably just nodding their head, asking canned questions from a spreadsheet, and not fully comprehending what you are telling them.

* We are told to describe ourselves as information security experts. I am not an expert. Every time I have to describe myself as the expert, I die a little inside. If I am the expert in the room yet still a recent college graduate, there is a glaring problem here.

* The middle manager of my department did not know the difference between a public and a private IP address when we reviewed DRL evidence together.

* The person leading your engagement may have a slight idea about what is going on, but they probably are tied to five other engagements and are not genuinely motivated to find problems because they are already underwater.

I can’t say that information security consulting is all bad. On several occasions, I have helped companies remove the clueless CEO from Domain Admins or explain why adding MFA to Cisco AnyConnect was a good idea for them. I should also mention that these types of positions are great for learning the inner workings of large companies that you might want to work at later on, how to passably write a report, and how to present information to executives.

Maybe I am preaching to the choir here. Interested to hear others' perspectives.
I think the key here is to see using the Python language as an engineering discipline like any other, and just take the classes, read the literature, learn from more Senior Engineers, and projects, before attempting to develop these types of systems on your own.

I don't think anybody expects a recent graduate from computing science, with maybe 4 or 5 classes that used python under their belt (and maybe a co-op or two) to be writing robust code (perhaps in any language).

But, after working with Sr. Engineers who do so, and understanding how to catch your exceptions and respond appropriately, how to fail (and restart) various modules in the face of unexpected issues (memory, disk failures, etc...) - then a python system is just as robust as any other language. I speak from the experience of running them in factories all over the planet and never once (outside of power outages - and even there it was just downtime, not data loss) in 2+ years seeing a single system go down or in any way lose or distort data. And if you want more performance? Make good use of numpy/pandas and throw more cores/processes at the problem.

Just being aware of every exception you can throw (and catching it) and making robust use of type hinting takes you a long way.

Also - and this may be more appropriate to Python than other languages that are a bit more stable, an insane amount of unit and regression testing helps defend quite a bit from underlying libraries like pandas changing the rules from under you. The test code on these project always seemed to outweigh the actual code by 3-5x. "Every line of code is a liability, Every test is a golden asset." was kind of the mantra.

I think that what makes python different from other languages, is that it doesn't enforce guardrails/type checking/etc... As a result, it makes it trivial for anyone who isn't an engineers to start blasting out code that does useful stuff. But, because those guardrails aren't enforced in the language, it's the responsibility of the engineer to add them in to ensure robustness of the developed system.

That's the tradeoff.
> The instruction manual required is absurd: https://wiki.servarr.com/radarr/installation

There exists a Docker image: https://hotio.dev/containers/radarr/. It does not appear to be absurd: https://github.com/hotio/radarr/blob/release/linux-amd64.Doc....
If I have to do one thing to monitor a simple website I'm probably going to use something that takes a screenshot periodically and checks it for changes. There are open source solutions but I just prefer to pay a bit for a managed service to do it.

I think it covers quite a lot of things - the servers are up, DNS is OK, assets are OK. It can also be a safety net in case of other, more sophisticated monitoring fails to detect an unusual state.

This doesn't work well for website with too much javascript, ads or widgets.
Us too.
By someone on HN there is also pianojacq : https://pianojacq.com/
Nicely done. Though I have to say - I gave courses on vi in the 80's but then IDE's and GUI's came along and I moved on. I will never understand why anyone still uses vi in the 21st century, except for occasionally editing a config file on a *nix box.
> Enabling 2FA on PyPI controls access to PyPI’s web interface, not publishing workflows.

Kinda feel like it should. (I also own packages that are critical.)
I really don't understand why US news websites do this to EU up addresses rather than not using privacy-obliterating ad-tech -- surely some revenue is better than none plus ill will? When I tried to read the article I am confronted by:

>Unfortunately, our website is currently unavailable in your country. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to your market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism.
Numbers are per route. There are around 15.
It’s fascinating. Not only that is fact free, but it’s based on an assumption that the purpose of the government is to collect maximum tax value from the citizens. Is it thought?
Did you read the last sentence of my post? I literally said the executive was bullshitting when he said he could drink it…
Let's say that I agree that abortion is wrong (which is true enough).

Under what circumstances should a miscarriage be investigated as a criminal matter? In this question I include any involved parties. Prosecuting a woman's relatives or loved ones is tantamount to prosecuting her.

Under what circumstances should a healthcare decision be investigated as a criminal matter?

If it is about an innocent life, then which states added funding for healthcare and child care as a part of their abortion trigger laws? Which states restored planned parenthood funding?

I don't think abortion is GOOD. I also don't think it's any of the government's business. Making abortion illegal does not make anyone any more moral. Making abortion illegal does not change anyone's mind about the morality of abortion. Making abortion illegal will not save anyone's soul from damnation. Making abortion illegal WILL increase the number of kids born to mothers in poverty.
Your situation isn't really a question about job hopping; it's about a bird in the hand vs two in the bush.

Either way, you need a good story: if you're just looking for better money or newer tech, you look opportunistic. If you have a plan that builds to something based on tech and domain, you look serious.

The story is most important for you. It's what you tell yourself to justify and orient yourself in your working life, to give you the patience to wade through crap and the vision to go in one direction.

So if you're tempted by opportunity, it's likely you have a weak story -- which means you're reduced to being useful to others. (Which can be fine.)

The best stories create value: bringing electric power to transportation, making a corner of biomedical research possible. If you commit to these stories, you might find a community of like-minded people, whom you can trust with your work-life.

And who won't leave at the next opportunity.
Will These Algorithms Save You from Quantum Threats?
I prefer to have some separation between my home life and work life. It isn't about the amount of space, but being able to achieve that mental separation for my own mental health. Previously that was achieved by having a company provided office space that I commuted to.

The company decided unilaterally that they no longer want to provide that space and are now altering our existing deal to force that cost on to me.
This is why going behind on a mortgage can absolutely ruin a regular person.
If you just have a need for isolating Windows applications have you tried the Windows Sandbox functionality built-in to Windows 10 Pro and Enterprise version?
https://docs.microsoft.com/en-us/windows/security/threat-pro...
My point was that a personal project that you have on github could still be put onto PyPI by someone else, without you knowing. Even if you actively want to avoid PyPI.

What you want to do about it is a different topic.

Unlike most spam, I can't figure out how to select interesting email about my projects that I want to answer, from emails I don't want to read at all because they make my blood boil, like those asserting that because the project is on PyPI I'm obligated to help them.

It's rather moot now as I haven't gotten emails about it for 8-10 years.

Huh. As a supply-chain issue, is it important to PyPI that the person in charge of the PyPI entry be affiliated with the project, and share reputational risks should the PyPI packager add malware?

That seems like an interesting vector. Find a potentially useful Python package which isn't distributed via PyPI, add an entry using a new account which looks like it's part of the project, add malware, and upload.