skysight-inc/HackerNews huggingface dataset:
> I can't afford to operate a datacenter to cater to traffic that isn't even human. This spam traffic is all from botnets with IPs all over the world.

In our experience (we don't have a forum), almost all of our bot traffic has been SEO spiders (or claiming to be so).
Slightly off topic, but the phrase "We miss you" in an email is a surefire way of making me click the unsubscribe link.

I wonder what makes techie types so ornery?
It will, or zombies.
I have a (not really serious, but kind of) theory that metrics driven organizations stumble into various dark patterns through software bugs. In this case, that would look like:

1. You want to convert people to "pro" users so you try to show them all the money they can save by doing so.

2. Because of a bug in the code somewhere, you end up showing the discounted price in the cart until checkout.

3. Because some number of people don't pay attention and don't realize the switcheroo happens at the end this bug actually increases conversion.

4. Someone eventually notices the bug (after customers like you complain about it!).

5. When they fix it the metrics are adversely impacted.

6. The bug is now a "feature".

This is of course all very shortsighted since you are essentially burning customer trust for a short-term gain in conversion so it's bad for the medium/long term business. But the team has to hit its KPIs, which are tracked on a daily/weekly basis!
What do you prefer the most, online shopping or offline shopping?
No, but they also don't actively help protect pages organising SWATing. It's your choice who to do business with.
Obviously not the same thing, but Simplisafe offers most of that for like $500. A pair of cheap cameras is less than $80.
If the change isn't too large/frequent you could send it over an encrypted transport (ssh/vpn/whatever).
Yep, Tabula Peutingeriana is easily the best known example and the tip of my tongue that I failed to mention by name :-)

There are others that I have seen in the British Library collection and some in Rome but I'd be struggling to name them - I had a lot of exposure to experts in History of Maps back in the 1980s|1990s when I was working bridging wet film photogrammetry and digital mapping, sadly my main focus was programming, mathematics, lens geometry, unification of existing maps under WGS84.

All the examples I've seen have that subway diagram look, albeit freehanded, and clearly were all part of a tradition of road maps in that related style.
Twitter Account Hacked? Even Security Companies Have Trouble Getting Back In
Love letters are a dying art. I only wrote and received them during my time in boot camp in 2009.

I've been watching the Ken Burns doc about the Roosevelts and it is incredible how much we can know about people from physical letters they leave behind. What will survive us in 100 years? Almost all of my creative output is in digital form.
Sequoia-backed Hmlet's Employees stripped of stock options after distressed sale
Northern/eastern European spotted!
Regrets are real because there is nothing more clarifying about life than when it’s about to end.
Cooling a LOT significantly reduces humidity. Some places do this to avoid damage to goods.
Human and Machine Consciousness
It's possible this post may be a significant embellishment of the truth, rather than being entirely true or made up.

He could well be a spammer, perhaps a small time one, that romanticises being the big-fish criminal living an implausible life on a boat in the Caribbean.

Perhaps the life of a spammer is more mundane, and those parts of his AMA are true, but he felt the need to jazz it up a bit.
For cold storage, the appeal of ZFS is the usual features of a backup software, primarily, checksums and snapshots (and to some extent ZFS recv, compression and integration with ZFS live systems).

In particular, with ext4+LUKS, there is no way to know if there are silent bit errors.
You could generate a CSRF token or something similar in a hidden filed based on a JWT token (yes I know) on the server side. The JWT token can either contain some timestamp after which it's valid or the time it was created.
They’re still people though.

Is punishing spammers for what they’ve done a helpful thing to do? Sure. Are spammers deserving of having their whole digital lives compromised? I don’t know.
A paddy wagon is now speeding to your home.
It’s nice unless your family is awful.
I think this is a step in the right direction.

I remember years ago I had to answer strange tech questions from a relative when their Windows app crashed with an "Illegal Exception" message and they thought someone/thing had broken the law.

This language is effective in communicating "we fucked up" to ordinary people I think.
Achieving something is hence a source of joy. But so is eating food.
Why did you stop going to estate sales?
This is good if you have time to change cars
Yes, this feels like an ANTI-CAPTCHA. It's a task that computers can perform dramatically better than humans.
Confidence Intervals vs. Bayesian Intervals (1976) [pdf]
I’m the co-founder of Friendly Captcha [0], we offer a proof of work-based captcha since two years or so. Happy to answer any questions.

A big part of what makes our captcha successful in fighting abuse is that we scale the difficulty of the proof-of-work puzzle based on the user’s previous behavior and other signals (e.g. minus points if their IP address is a known datacenter IP).

The nice thing about a scaling PoW setup is that it’s not all-or-nothing unlike other captcha’s. Most captcha’s can be solved by “most” humans, but that means that there is still some subset of all humans that you are excluding. In our case if we do get it wrong and wrongly think the user is a bot, the user may have to solve a puzzle for a while, but after that they are accepted nonetheless.

[0]: https://friendlycaptcha.com
I think you wrote an entire article here based on a small semantic issue. When people say "buy vs. build," they know they're not usually acquiring a software company or a bundle of source code.

"Buy" in this case is synonymous with "pay someone else who already built it".
I taught myself coding Win32 API in C as a young teenager, nothing magic about it. And Notepad is a very basic app.
> I appreciate the effort towards better UX, but there are already "invisible" CAPTCHAs like Botpoison that discriminate better than this.

Interesting project, thank you for sharing! From Botpoison's website[0] under FAQ:

> Botpoison combines:
> - Hashcash , a cryptographic hash-based proof-of-work algorithm.
> - IP reputation checks, cross-referencing proprietary and 3rd party data sets.
> - IP rate-limits.
> - Session and request analysis.

Seems like it is PoW + IP rate-limits. IP rate-limits. though very effective at immediately identifying spam, it hurts folks using Tor and those behind CG-NAT[1].

And as for invisibility, CAPTCHA solves in mCaptcha have a lifetime, beyond which they are invalid. So generating PoW when the checkbox is ticked gives optimum results. But should the webmaster choose to hide, the widget, they can always choose to hook the widget to a form submit event.

[0]: https://botpoison.com/
[1]: https://en.wikipedia.org/wiki/Carrier-grade_NAT

full disclosure: I'm the author of mCaptcha
Even in 2009 the internet was full of liars.
This will come in handy for when someone finally cracks time travel. Time to brush up on the old Latin. And divest from all holdings in Pompeii.
It's true, if none of the books were rare, it might have only been thousands of dollars.
a) Starting all your services and shims and mocks inside a CI/CD tests container is not "doing it wrong"; in fact, it's the only correct way to do it.

b) systemd is the only thing that can start services cleanly and correctly. Every other solution is in various states of brokenness.
Legitimate interest would totally cover you here. The fear-mongering and misinformation about the GDPR is getting really annoying by now.
High deviance opinion to follow. I hope I'm very, very wrong about this. I've just ingested a large dose of Peter Zeihan's work, so I may be de-ranged.

Russian gas infrastructure has a high chance of collapse within the next 12 months.

China has a high chance of societal collapse within the next 60 months

It is likely 500,000,000+ people will see food scarcity before then end of 2022.

Go back and read the prediction threads here from December 2019 about the oncoming 2020 decade. There's NO hint of the pandemic.
> letsencrypt emails don't have an Unsubscribe

Technically, this is not true. You can "unsubscribe" (read "remove") your email via the Certbot client.

Nevertheless, I agree that this is far too complicated, and I do not understand why there is no form on their website. I wonder if this behavior is compliant with the GDPR.
You don't really need new TUI framework, when you can extend existing real GUI framework to just work in console https://github.com/jinek/Consolonia
Use embed from C23 today with the Cedro pre-processor
> “C23 is around the corner and we already know which features it will add to the C language.”

> “One of them is the new pre-processor directive #embed, which allows including binary files as byte arrays.”

One year ago I presented my C preprocessor Cedro (https://news.ycombinator.com/item?id=28166125, https://news.ycombinator.com/item?id=31193138), and today I wrote this brief note about how you can use it to play with the #embed directive from C23 today.
When posting on international forum as this, it is important to highlight that German language is a must for this role. Could save time for everyone involved.
Given the fact that the root cause of the problem with current CC algorithms is inability to discriminate between congestion and jitter provoked delays the obvious solution will be to implement some kind of method to report jitter state to the source. Maybe some kind of ICMP packet or IP option.
This is amazing. I've been exactly thinking recently about the state of computing we're in: we keep using programming languages to build full solutions, which barely derive from something that already does the same but with a different color. How many times do we need to reinvent a forum ? Synchronous and asynchronous communication ? Social networks ?

I want to have a better, synchronized feed reader. I can install one of the many choices of full-stack solutions, with integrated clients, open protocols, etc. Or I can use my existing IMAP server to store it all, and have it already synchronized for free. Not only is the protocol open, but it is already widely known and is generic enough that it can be used for many usecases.

I want my RSS feeds in my IMAP. I want my Pleroma discussions in my IMAP. I want my HN discussions in my IMAP. Building upon existing solutions and interconnect them rather than taking the programming language and create something from scratch.
Not sure I can see art critics musing over whether a particular novel's prose was influenced by the structure of 15 year olds fantasising about what it would be like to have a boss and then outsmart them (the 'Antiwork' school of Redditry of the early 21st century) in quite the same way they might suggest architecture or typography is influenced by design principles taught by the Bauhaus school...

Then again, you'll inevitably see Reddit memes and copypastas and prevailing sentiments all over GPT type model outputs in certain niches, simply because it'll be so much of the input
Remove roadblocks. Sometimes it's the dev motivation, and in this case help him find the problem (lack of understanding for the final product, too much meetings, or plain burnout), sometimes it's just that he dev isn't a fit, most of the time (imho, i could be wrong, I'm not a manager) it's external to the dev: issues within the team, issues with admin or with sec, issue with clients or issue with other teams
Glad you ask!

There are protections against replay attacks within mCaptcha: tokens are single use also have a lifetime beyond which they are invalid.

Disclosure: author of mCaptcha
"anklebyters"! I learned a useful new word today. Thanks.
Yes, it started with Barrett but became painfully obvious under Otellini. When Steve Jobs asked Intel to build a chip for future iPhone Otellini said no -- one of the biggest strategic blunders. Also in 2005 Intel paid Dell not to use superior AMD offering instead of putting all hands on deck fixing their own (they did achieve parity eventually).
this is way too general. There should be at least a few examples to understand the merit of this 'activity based management'
This reads more like Microsoft content marketing than a serious attempt to do anything of value.
In a similar vein, when you try to send a long message, Microsoft Teams says something along the lines of "You're gonna need to make that shorter!"

No explanation for the limitation, no apology, no workaround, and no mention of what the damn limit is! Infuriating.

Don't patronize your users.
"Virtual kitchens" (ghost kitchens) are encouraged by doordash as a way to diversify and boost revenue and stuff:

https://get.doordash.com/en-us/blog/virtual-restaurant-brand

They seem to be used frequently as decoys to allow restaurants to drop bad reviews though.
How does the program verify passports?
I think these kinds of people have just gotten more sophisticated. How much money did Sky Mavis raise? How much money did the Luna guy walk away with?
1. Stage Performance

I was made to perform on-stage since I was 3/3.5. I kept liking it, and keep doing it. It makes all kinds of public speaking a walk in the park. You face much smaller amounts of anxiety before giving a talk, writing a test. And it gave me a general practice to subdue anxiety in all anxiety inducing tasks.

2. Writing

I learnt writing in school from my humanities teachers. Literature, History, and Geography. Also from a Science teacher. They taught me how to write, how to present facts, how to make an airtight argument with everything I have. I have met many interesting people through my writings- both technical and non-technical. I write good documentations, good proposals and reports.

3. Discussing

This doesn't come in the list when one talks about skills. But being a better listener, and also being able to communicate your points well are good skills together. I often discuss stuff with people. Better ideas emerge from such discussions, and I gain newer knowledge and even newer perspectives. This is priceless. Being approachable, being able to admit my mistakes and wrong concepts also helps big time.

4. Reading

Is reading for a long time a skill? If yes, it had paid me well. It helped me escape reality, introduced me to new cultures, perspectives and gave me good times. I have met a bunch of interesting people through talking about and writing about books.

5. Open Mind

I have an open mind and not stringent, and not prone to quickly reach conclusions and live happily with more entropy in my brain. I am eager to learn newer things, challenge my own beliefs. This is what drives my growth.

6. Meditation

I just got started with "The Mind Illuminated" by Yates from an HN comment. It has given me much more than I ever expected. Much more focus and longer periods of focus. And everything I do for pleasure gives me more pleasure. I am much more calm and take decisions better. I am also able to decide much more quickly because I know myself better, and can predict myself better.

7. Journaling

I just write my heart out, no barrier between me and my diary. I take snapshots of some parts that turns into blog posts or topics of discussion or future actions in general. I destroy my journal periodically because it is too bare, and nothing is held back from it.
To the best of my recollection…

If you stream your ZFS data from one host to another then the encrypted filesystem remains encrypted at the destination.

If your encryption is done outside of ZFS then the data on the destination is in plaintext.

This might seem obvious to those experienced but to a newcomer it caught me off guard and the interaction between recursive send/receive and encryption was more complicated than I had expected.

I should add that I haven’t looked into this for a while and could be completely wrong but it’s worth researching, at least, because my spideysense is definitely tingling to the tune of something about this was odd and worth knowing about.

This post might give a better hint to the actual details: https://www.truenas.com/community/threads/cant-zfs-send-betw...

Sorry to not be more authoritative. Bottom line: if you are going to use send/receive, spend some time to build a run book for your use case sooner rather than later.
Magnifico Lavoro!!! Would love to see the exact street map and not direct line from point to point.
The feature to see mountain/river crossing on the direction tab is fantastic.
This is the first of these kind of articles I see in a long time that actually has a tangible number for "calories allowed on a 'fasting' day", my main point usually being: does the milk in my coffee count against the fasting, or something like diet coke.

No, I really don't want to start a discussion on this - I just find it funny that most of them seem to imply fasting as 0.0 calories per day, without explicitly mentioning it. And then the discussion about the coffee follows...
in my case, i'm the youngest of the family (and mid 30's) and lost many many many relatives already. i'm aware that people will die one day and so I try to enjoy my family while they still alive
Stop Searching for Shared Libraries
I looked into doing something like this once and decided it wasn't going to be very effective, for a few different reasons.

JS engines (or even WASM) aren't going to be as fast at this kind of work as native machine code would be. Especially when you consider that libraries like OpenSSL have heavily tuned implementations of the SHA algorithms. Any bot solving a SHA-based challenge would be able to extract the challenge from the page and execute it using native machine code faster than any legitimate user's browser could. And if you increase the difficulty of the challenge, it's just going to punish real users running the challenge in their browser more than it would the bots.

It's also based on the assumption that proof-of-work is going to increase the cost of doing business for the bots in some way and discourage their behavior. Many of the bots I was dealing with in my case were either using cloud compute services fraudulently or were running on compromised machines of unknowing people. And they tended not to care about how long it took or how high-effort the challenge was, they were very dedicated at getting past it and continuing their malicious behavior.

There's also the risk that any challenge that's sufficiently difficult may also make the user's browser angry that a script is either going unresponsive or eating tons of CPU, which isn't much different from cryptocurrency miner behavior.
There was a trend called 'bulletproof coffee' that went around SV and the startup world about a decade ago, where you were supposed to drink coffee with two spoons of butter and some 'brain enhancing' MCT oil in it. Lots of CEOs went mad for it. I don't think I've heard of anyone still drinking it for a long time.

https://www.bulletproof.com/recipes/bulletproof-diet-recipes...
There are a few of these delivery firms now, has at least one realized the best niche to use should be “trustworthy”?

E.g require any restaurant to have a brick and mortar restaurant with actual customers in it, or it’s banned. And requiring each such restaurant to have only one listed name in the app - which must be the same as the name on the sign of the physical restaurant. And clearly highlighting the age of the physical restaurant (under the current name) in the listings.

Basically: I want to use services that aren’t trying to grow quickly by inflating anything. I don’t want VC funded startups operating at a loss for growth for anything. I want to pay the true price of the service and only use services that aren’t “disrupting” by using legal loopholes or pricing to a loss to drive established actors out of markets.
Mirai was in Lisp (ahh the repl on every error), but I'm not sure that Nendo was in Lisp.

Mirai was a descendant of your work? Nice. It was a great (at the time) software. Too bad Izware has dissapeared!
The name is horrible.

This is the reward you seek for accomplishing something. It’s the ticking of a to-do item, except the items are kind of useless, they just want to be ticked.

This is the same as smoking a cigarette, getting a quick fix, taking the phone with you to the toilet, watching TV at night instead of sleeping, just to finish an internal to-do because you feel like you didn’t accomplish it yet.

The solution I have to it is to exit the house without a phone, and to have something to do. Without the phone you can’t give yourself the quick to-do fixes and you’re more present. And when you have something to do, you don’t want to give yourself the quick fixes.
No, not really. I'll give you an example that's not really secure, but should illustrate one possible method:

1. You produce an "authentication hash" X = hash(normalize(your_username) + your_password) and send X to the server.

2. The server computes Y = hash(X) and checks Y against the stored hash.

Now you're not sending the plaintext password to the service (e.g. steam), and steam is also not storing the "raw" authentication hash X on the server either. Yes, a manipulated client can send a stolen X instead of a stolen password (but in reality it's a reused password that's been stolen, not X). The advantage is that a compromised server will then not be able to log the plaintext password for credential stuffing.

In case anyone thinks about using the above scheme: Don't. It's merely an illustration for one specific property. Other than that it is PAINFULLY flawed in many ways.
An old wise man once said: For some problems like getting screwed over by people there is no absolute technical solution.
It is, thanks.

Actually I had found it apparently but convinced myself that it was not the correct one, I deeply misremembered the setting.
Oh yeah, I was soaked in the rain in Singapore once and took the bus home, I was basically sure I'd catch a cold, it was like stepping outside in the winter at home after taking a shower...
This is my goto filter for "Is it journalism?"

https://kottke.org/20/01/jim-lehrers-rules-of-journalism-1

The unfortunate nature of modern journalism is its "rebranded" itself (in an Orwellian) sort of way. What used to be rare and shunned is now standard best practices.

If that profession wants to be sloppy, lazy, etc. that's fine. But that's not journalism and the people doing it aren't journalists. It's obvious at this point they're not going to police themselves. It's up to the rest of us to call out what we see, when we see it.
Really glad to see someone finally talking about this.

Does anyone know what's going on with that "Duke de Montosier" spam botnet? It accounts for more than half of the botspam attacks on my sites, and I can't find anyone talking about it online anywhere, except one tweet dating back to mid-2021. It's identifiable by several short phrases that it posts:

Duke de Montosier

for Countess Louise of Savoy

Testaru. Best known

And cryptic short posts that can assemble into creepy sequences:

Europe, and in Ancient Russia

Century to a kind of destruction:

Western Europe also formed

and was erased, and on cleaned

only a few survived

number of surviving European

55 thousand Greek, 30 thousand Armenian

Many of the IPs involved seemed to be in Russia, China and Hong Kong, though they're coming from all over (eg European & US VPNs, Tor exit nodes). From tracking the IPs on AbuseIPDB, the weird spam posts seem to be just one layer, while behind the scenes it also attempts SMTP Auth and IMAP attacks on the server.

I'm eager to know more if anyone knows, and especially if anyone is trying to shut this thing down. But I can't find anyone even talking about it. (Maybe there's a reason for that?)