skysight-inc/HackerNews huggingface dataset:
I don't dispute it's a philosophy, but it's an extremist version. It's like having the choice between asceticism, living alone in the desert eating critters, versus extreme hedonism, gluttony and materialism. But most people reject both.

What I'm pointing out is that we could imagine a happy compromise where 99% of the goals of free software are achieved, that would not only allow developers to make a comfortable living, but also benefit the vast majority of people who use software without understanding technical complexities.

If the software:

- has source available, and anyone can study it and audit it;

- allows anyone to create, for their own use, derived or custom versions;

- allows anyone to make a business selling derived versions within the license terms (for example, in the time-bomb period the users of your patch must be licensees of the original owner);

- guarantees that the vendor cannot lock you in, and the software will become completely free after a certain date;

- generates resources for software development that would otherwise not be available, so that functionality could only exist in proprietary, closed source form,

... then, I belive, the loss, for a limited span of time, of the ability to use it gratis is a very good overall compromise. We all understand and accept the idea that work must be paid and that a price tag designates something valuable, that is worth making and paying for. Don't castigate money ideologically, use them to achieve the philosophic goals.

Somewhere, somebody pulled a dirty trick on OSS developers and moved the goalposts to "and you must now renounce all material possessions and live on pure ether".
Zoom used to translate "Quote" (as in "quote this message") in their German app to "Kostenvoranschlag" ("estimate of cost").
I trust “experts” like I trust China
If you abandon your drug addict friends and bums that only shows that somebody with a stronger character wouldn't fear aquiring their attributes nor would aquire them.
We have all the data about everyone in the registers, but god forbid we use them to lower friction in case of emergencies! Good to hear that some got it right.
Thank you for your detailed response, you raise some very interesting and valid points!

> JS engines (or even WASM) aren't going to be as fast at this kind of work as native machine code would be

You are right. mCaptcha has a WASM and a JS polyfill implementations. Native code will definitely be faster than WASM but in an experiment I ran for fun[0], I discovered that the WASM was roughly 2s slower than native implementation.

> It's also based on the assumption that proof-of-work is going to increase the cost of doing business

mCaptcha is basically a rate-limiter. If an expensive endpoint(say registration: hashing + other validation is expensive) can handle 4k requests/seconds and has mCaptcha installed, then the webmaster can force the attacker to slow down to 1 request/second, significantly reducing the load on their server. That isn't to say that the webmaster will be able to protect themselves against sufficiently motivated attacker who has botnets. :)

> There's also the risk that any challenge that's sufficiently difficult may also make the user's browser angry that a script is either going unresponsive or eating tons of CPU, which isn't much different from cryptocurrency miner behavior.

Also correct. The trick is in finding optimum difficulty which will work for the majority of the devices. A survey to benchmark PoW performance of devices in the wild is WIP[1], which will help webmasters configure their CAPTCHA better.

[0]: https://mcaptcha.org/blog/pow-performance Benchmarking platforms weren't optimised for running benchmarks, kindly take it with a grain of salt. It was a bored Sunday afternoon experiment.

[1]: https://github.com/mcaptcha/survey

Full disclosure: I'm the author of mCaptcha
Anonymous proof of stake?
Thinking about it a bit more, systems like mCaptcha and Botpoison aren't really CAPTCHA in the strict sense - they solve a somewhat different problem than telling if there's a human at the other end, and IMO that's an important distinction to make (and doesn't necessarily make them inferior to other solutions.)

I still think PoW alone is not enough as it can be automated, albeit at a slower rate. Most of the time I worry more about low-volume automated submissions than high-frequency garbage. The real value is in the combination of factors, especially what BP call the "session and request analysis" and other fingerprinting solutions.
There recently was an issue where the deprecation of a kernel header (with version 5) lead to ZFS losing access to hardware accelerated (vectorized) checksums [1].

As far as I know, the issue is now resolved, but I haven't followed this closely.

[1] https://github.com/openzfs/zfs/issues/8259
The "first hit's free, kid" period is over.

"They" (including GitHub) will have to discourage self-hosting soon so as to keep their users, I wonder if the "software BoM" crap is enough or will there be further efforts that way.
The Great Rehash, Part Two: The Future’s Cold Eyes
As a computer professional (I assume), you have a firm understanding of where the text of those messages actually comes from, and that any specific emotional wording can be ignored. Thus, "commiserating" messages feel patronizing.

However, to someone for whom computers are mysterious and capricious black boxes which seem to have been put on this Earth solely to test their patience, "friendly" messages may carry tonal information which you take for granted:

* You did nothing wrong

* This is unintended and regrettable behavior, and we apologize

* Nothing is catastrophically broken

Consider that your mild irritation with a patronizing message is possibly preferable to some poor grandma hurling her computer out the window because "This program has performed an illegal operation and will be shut down."
I feel stupid for just now realizing there's a link and OP is not just asking HN.
> Microsoft forums

"Just run dism and sfc /scannow. It will surely fix your problem. Kindly mark my response as the answer."
People will be able to write programs that circumvent the feature but that's also true for the javascript solution. The point of it was that it gets rid of most spam because most bots fill in the form faster than 4 seconds and are not made to circumvent this feature.
> - Rate-limit everything, absolutely everything. Set sane limits.

This breaks when multiple users are behind the same IP. I've seen services fail even in classroom, because the prof did something and a few tens of students followed (captchas everywhere).
re: someone was unable to get past that captcha - this reminded me a story I heard back in ICQ times about some human who couldn't pass anti-bot question: "What planet do we live on?"
Version control - not GIT, which is a tool, but the discipline to version control whatever you can.
When I was in the uni I was writing software for my end of studies project on a computer whose hard drive died. Of course, I had backups, etc. but I was able to keep working in less than 2 days because of good old CVS.
Years later, I put an obscure Netcool event manipulation under version control - and added tags for version - and discovered (months later) some events were kept forever in memory before a certain version - I don't know how many $$$ it saved, but at least we needed double the RAM (in 2008-2010) and that meant switching from Sun to Fujitsu servers...
projects could be saved on federated instance, as far as i know gitlab enterprise is available for free for individuals
Bots can also circumvent this JS thing, so it's the same either way.

<?php echo '<input type=hidden name=starttime value='.time().'>';

On submit:

<?php if (time() - $_POST['starttime'] < 4) die('2fast4me');

Revealing the error condition (that it was submitted too fast) is nice for users and bots alike, of course. Up to you.

I've had websites where I was too fast in submitting a form before. Not any kind of anti-spam, just their server was so fricking slow that I had input the date (iirc it was a reservation system) and clicked next before the JS blobs had finished triggering each other and fully loaded. It would break the page somehow with no visual indication. I found out by looking in the dev console and noticing stuff was still loading in the background. How normal people are able to use the Internet with how often I need the dev console to do entirely ordinary things is a mystery to me.
Only recently, yes. WASM performance is tricky. A memory-heavy algorithm will DoS visitors.

That said, there are protections within mCaptcha to protect against ASICS(PoW result has expiry and variable difficulty scaling), but they are yet to be validated. If they should prove to be insufficient, then I'll try a different approach with memory-heavy algorithms.

disclosure: author of mcaptcha
> The "legitimate interest" GDPR strawman

In the past three and a half years I have witnessed four cases in which this exact method (cross-linking remote IP addresses to detect spammers/attackers/bots/etc.) has been an issue with GDPR, but I am sure those downvotes and the general tech-centered HN'y wave-off as misinformation have a better standing in EU courts these days since the fear-mongering GDPR hype is mostly over as it seems.
Unfortunately, the hotels I spend around 40 days a year at don’t have full kitchens.

There are dozens of things I would rather do in my limited time than spend time cooking.
It can't be that old considering they even have pf.
Spoiler: they have only shown that existing algorithms can't always avoid starvation, not that such algorithms don't exist.
They aren't mutually exclusive. The cutesy message also provides useful information (this is our fault, unintended behavior etc). Why not have both?
Last year I bought a copy of The Structure and Interpretation of Computer Programs, first edition. Inside was a folded piece of paper printed in really coarse old dot-matrix that had

(I
(BE
(NOT
(RATHER
(WOULD))))
(PROGRAMMING
(LISP IN)))

If only they'd stuck with it until evaluation order was introduced.
Interesting. You think this can affect making carbonara sauce(yolks, possibly some whites, black pepper and pecorino)?

I always did it in a porcelain bowl, seems to work fine.
Would have been nice to include the forts and settlements in Scotland around the lowlands.

All in all a cool idea though!
I'm in a small town just outside Barcelona and although it's not widespread because we don't have many restaurants here there is one place which does this which is particularly frustrating...

One restaurant which serves burgers, tacos and pizza. None of it particularly great but nice if you're feeling lazy. Problem is they split across three brands on Glovo for each food category even though it all comes from the same place.

If one of us feels like burger and the other fancies tacos you gotta pay two deliveries. That is unless you pay for a subscription of course. Someone mentioned elsewhere in this thread that Doordash officially endorses these "virtual restaurants". I wouldn't be surprised if they like the idea that it might push people to premium subscriptions to access free delivery so they get a diversity of food options.
Or use one of the Monero miners typically injected by malicious ads!
Yep,i hate this a lot too...

"a recent study by german scientists" .. when is recent? Which german scientists? Atleast name the institution and main authors ("a recent study by John Smith et al., from the institute of biochemistry in Berlin..."), but nope, not even that.
On point. Hyundai can bitch and posture all they want but those chips aren't some commodity parts they can multi source or make themselves not matter how much money they throw at the problem. You can't bring up decades of analog microelectronics design experience overnight.

So they have to deal with whatever issues Infineon has. It's part of the risks of being on the bleeding edge. That's why even luxury German car companies usually stay on older tech.
If it's smaller and not connected to the US intelligence agencies, it certainly would. But if you use CloudFlare to begin with then there is no absolute notion of security and privacy, but this is of course a viable option if one doesn't do critical, important stuff.
In my country, it is mandatory to add 'by Reuters' in small print near the title. I thought it was a EU convention (i dislike ordo liberalism as much as anyone, but i recognize that the emphasis on transparency is great.)
We only need to plant 1T trees
Who are you quoting? I didn't say that.
>asking random acquaintances at a local cafe for prompts and showed them the generated pictures. All but one person was totally unimpressed.

I think this is because people reason this way: the computer has many pictures in its archive, saved as "dog.jpg" and "hat.jpg". If your prompt is "dog with hat", the computer just combines them. I think this is what people think is happening, so they are less impressed.
I have not seen any arguments yet, why Satoshi is not Adam.

I did say "crypto currency, that is suitable for mining in the browser" for exactly this reason: That Bitcoin is not well suited for it.

One would have to look at what typical consumer hardware is good at. Maybe an algorithm that saturates one CPU core with serial calculations that need fast access to exactly 1GB of RAM. I think consumer hardware is pretty good when it comes to single core performance and RAM access.
It also seems to be missing part of Ermine Street from London up to Royston and then to Peterborough
Why just focus on cooking? Do you give up other creature comforts that you can afford just because “people in poorer countries do”? Do you also farm or is that “beneath you”?
Singapore Hot Fashion Startup Zilingo Imploded After CEO Ankiti Bose Struggle
At least in TCP can't jitter be detected and measured using ACKs?

I thought some algorithms even do that already
> 40 was off the charts.

FTFY
One the smartest people I know employed this technique when he was in grad school and working as a TA for a subject he didn't know.

"How did you manage to teach something you didn't know" I asked.

"It actually wasn't that hard, I just made sure to always be 2 weeks ahead of what the students were learning. It actually made for a good forcing function to learn the content well." i recall him saying.

After reading this article, I wonder if he was born with gifted intelligence and intuitively employed this method, or if he BECOME so smart by employing this method...
PSD2 certification - you must have some way to implement 2FA and a lot of banks prefer using an app for this that they can also use to gather information about customers than using strong authentication methods.

I know a bank that makes you type your credit card PIN key after receiving an SMS in a mobile site... (cannot disclose which one).
If you wanted to set up a static site backed by a CDN in your own cloud account, check out withcoherence.com (I’m a cofounder). We also offer a built in Cloud IDE. Should be very simple to migrate from netlify and there won’t be any surprise bills since it’s your own cloud billing directly!
Very good point!

Accessibility is a critical to mCaptcha. In fact, Codeberg is trying out mCaptcha purely because of its more accessible[0]. That said, it is possible to choose a difficulty factor very high to deny access to folks with older, slower devices. A survey to benchmark mCaptcha performance on devices in the wild is WIP[1]. I hope it will provide insights to help webmasters integrating mCaptcha to select difficulty factors that work for their visitors.

[0]: https://codeberg.org/Codeberg/Community/issues/479#issuecomm...

[1]: https://github.com/mCaptcha/survey
In many debates... i mean arguments on the internet, especially political ones, if you post a link with something the other person disagrees with, their "comeback" will be, that the media in question is "right-wing russian propaganda" (or some combo of that). Guardian links are one of the few, where they can't claim that.
There seems to be a lot of disagreement on this. I would appreciate a correction very much, if that's possible.
It's still off the charts up here!
Going to try your approach. I think prioritisation and measuring impact are awesome skills to cultivate.
> There has been upwards of 15 queries per second from bots. There is just no way to deal with that sort of traffic, barely even to reject it.

If the queries are not a megabit each, you're doing way too much processing before applying rate limiting. Rejecting traffic ought not to take more than 1-2 milliseconds, even if you need to look up an api key or IP address in the database.

I, too, host services on a residential connection: 50 mbps shared with other users. My domains must host hundreds of separate scripts, a few of which have a database attached (I can think of six off the top of my head, but there's over a hundred databases in mariadb so I'm sure there's more that I've forgotten about). This is a ten-year-old laptop with a regular "apt install mariadb", no special configs.

Yes, most traffic is bots, and yes sometimes they submit more than 1 q/s. But it comes nowhere near to exhausting resources to a noticeable extent. Load average is about 0.15, main peaks come from my own cronjobs. If you're having this much trouble rejecting traffic, you might want to spend some time looking at bottlenecks. You'll also notice the bots knock it off if it's unsuccessful.
I don't think you need bugs for that:

1. You (as a product owner/manager) want to convert people to "pro" users so you try to show them all the money they can save by doing so.

2. You don't care about the the experience of the non-pro users, because that's not the metric you're optimizing, so you never specify to developers what should happen when lower-class users shop, except that at the end they have to pay the full price

3. Developers build something that works like the dark pattern described above (they are incentivized by keeping their sprint goals, not by making non-pro users happy).
I don't see how that's relevant here though. And I especially don't see how that's relevant to Spain - Spanish people don't vote for or elect politicians in Germany, which is the country most in trouble right now due to its idiotic energy policies

>>have made enemies of everybody who could sell us gas, etc.

I hope you don't mean Russia by this.
Isn’t this already somewhat there, the ECN bit of TCP?
Yes it's been resolved. It was around the time kernel 5.16 came out, but it took a while for the fix to land in stable.

I actually followed this closely, since that's when I had got a new Laptop with a new SSD and when I tried to benchmark it, I was going crazy trying to find the culprit. Because an older PC with a slower ssd (and older kernel at the time of benchmarking) was something like 25 times faster.
I do! I usually have it connected to a Raspberry Pi and use it mostly for IRC, but also for retroprogramming projects.
SHAs of entire IPv4 space can be easily precalculated. Include a nonce, that is rotated periodically, to solve this.
A "sane limit" wouldn't be "one person one IP", such a global limit should rather stop one IP (even if it's a nasty CGNAT) from having a negative impact on the entire service.

If such a limit would hinder classroom usage, but that's your target audience then other solutions should be found, fairly logical.
While your service is of high quality, the pricing is completely unreasonable for private use cases, many times higher than hosting the site in the first place.
Just an FYI: YCombinator backed food delivery services…

https://www.ycombinator.com/companies/zoomer

https://www.ycombinator.com/companies/racer
Unity Developer

Location: Brazil, SC

Remote: Yes

Willing to relocate: Yes (can work in US legally, no sponsorship required)

Technologies: Unity, C#, Game development, Mobile development

Résumé/CV: https://my.indeed.com/p/sergeis-l82zknr

Email: p0d04Va@gmail.com

Looking for a next project I can dedicate myself to
Spain can solve all those problems by ourselves. If the EU doesn’t let us, then Spain must leave the EU.

Yes I mean Russia. I don’t give a shit what they are doing. What’s the alternative, buying liquefied gas from the USA? Have you been paying attention to what they’ve done the past decades? Lol
> E.g require any restaurant to have a brick and mortar restaurant with actual customers in it, or it’s banned.

Why on earth would it matter to me as a delivery app user if I'm ordering from an ordinary restaurant or a dark kitchen? The only thing I care about is the food being good. And ordinary restaurants with actual customers in it often treat deliveries as something not really important.
That's true for most versions but I just tested on Monterey and bs=nM now works. Since this is a M1 specific we just need to check if Big Sur behaves the same.
You'd expect atleast some decency in such mainstream media, especially in areas where they should be competent at.

https://www.theguardian.com/world/gallery/2022/may/17/evacua...

This for example, from the title, the word "evacuation" and even the headline image are a clear example of something that a "prestige" newspapar such as The Guardian should never do.
Huh. Downdooted without explanation for correctly explaining how percentages work. Not something I expected on HN. Never change, interwebs!
The to field should be replaced with a single option, Roma.
Looks great!

I couldn't help noticing that it tests every pixel on the "screen" to see whether it's inside a face. Back in the software renderer days we'd run the inner loop just for the pixels that fell inside a triangle. But then you'd need to explicitly handle polygon clipping and it would greatly complicate the code. I guess 320*240 tests is nothing these days.

Anyway, great job!
If anyone on this thread is looking for an alternative, I’m a cofounder of Coherence (withcoherence.com).

We offer a netlify-like experience (managed CI, preview environments) built on top of your own cloud account. And we also offer an integrated Cloud IDE for use as a development environment. Today we support GCP but AWS is coming soon. To address one comment I’ve seen here with other alternatives, we don’t have the DNS/custom domain limitations of Cloudflare pages.

For a static site, migration should be very straightforward and we are happy to help if you run into any issues. Feel free to ping hn@withcoherence.com!
Does anyone have a link to the paper? I’ve been working with various congestion control / QoS algorithms over the past two years as a hobby, and there are plenty of new developments going on in recent years. I’m curious which algorithms they studied, and what the actual roadblock is, because I’m sceptical they weren’t just looking for a great punch line for an article (e.g. perhaps the problem is more theoretical than practical).
Well I'm far from an expert on physics, to be fair, so apologies for misrepresenting how phycisists see their field.

I think what you're saying is that it may be impossible to fully understand the world in the same way that we have tried to, in all of science, until now. I agree, in fact I suspect we probably can't, because it's obvious to me our intelligence is limited (as a species) and we're going to hit our limit sooner or later, if we haven't indeed hit it already.

But that's not for me a reason to stop trying to understand as much as we can, neither is it a good reason to replace understanding with ... something else. Because the day when we finally hit our limit of understanding is the day our civilisation stops dead in its tracks.

I for one am not prepared to go gently into that good night, any time soon.
The free lunch era of SaaS products is coming to an end. I expect to see a lot more of this stuff coming up over the next few years.
Amazon does this bullshit all the time with VAT.