skysight-inc/HackerNews huggingface dataset:
I really like the simplicity of this proposal, and how Adrian compares it to X-Frame-Options: DENY which has been in place for a decade now and has solved the problem of clickjacking and unauthorized framing for regular websites.

My hunch is that having X-Frame-Options: DENY start applying to native mobile apps wouldn't be feasible because it would break too much existing stuff that didn't intend to opt-out of native embedding, but having different syntax (X-Frame-App-Options: DENY for example) would solve this need very effectively.

It's interesting to note that Google have already taken steps in this direction: Google sign-in now detects if it is running in an in-app embedded browser and shows you an error telling you to use the native browser instead: https://developers.googleblog.com/2021/06/upcoming-security-...
Would you mind sharing some side hussle ideas?

C++ programmer by trade.
pathfinder is dead -- pcwalton works at Meta now, and not on graphics.
I've had bad results with dry lube in the rainy winter for commuting
For cotton, wouldn't it be fine to dump them in the ocean?
Yes, it all leads back to the park.

The only problem now, is the park isn't big enough! Imagine the amount of money a third park in America would make. (And cost)
I guess that's going to be a sign that Excel is dead
Pathfinder 1 was a scanline approach. Pathfinder 2 was a tess-based approach. Pathfinder 3 is a tiles approach.
Unlike sibling comments, I completely agree.

$300k is (around here) over 7x the mode of income [1]. That's a significant amount (basically the yearly income of 7 "regular joes") and raises (to me) the ethical question of whether I'd deserve it. For a full 40-hour workload, perhaps a case could be made.

But for a 4-hour workload? The only way I'm getting that sort of compensation for so little work is if I'm a parasite on society. And that's not something I would want.

Note: this, by itself, does not imply no one would deserve that sort of compensation. It simply raises the bar - perhaps to a level that is beyond human reach, perhaps not.

[1] https://en.wikipedia.org/wiki/Mode_(statistics)
Can the universe be infinite? Whatever layer of contingent substrate one finds, can't there be another one lurking behind it, just as contingent?
I have never worked for Google and likely never will.
Stories like these make me wonder why we put X-Googlers on such a high pedestal.
I don't mean that personally in an offence to anyone. It's just a general observation.
I spent about a year and a half being dead weight. I was so completely burned after working months of 70 to 90 hour weeks I just couldn't do anything. Things that used to take me an hour to code now took me days. Complete mental block. Luckily I had built up such a good reputation prior I was able to coast and it was a weird project. In a new job / role now and it's better. Only work 40 hours max. Still not back to normal but 75% of the way there.
The traditional VM-per-developer approach is indeed prohibitively expensive.

Since developer workloads are bursty, we encourage resource sharing when possible. We've seen a Coder pattern where developers share a box, through Kubernetes or Docker, to cut costs by an order of magnitude.

The Coder team dogfoods on a single 32-core dedicated machine that costs us $40/m per developer while building our code 40% faster than my M1 MacBook Pro.
His does sadly.
Us humans are all just meaning machines.

We are on a constant quest of meaning. Quiet tiring to be honest.

Somehow the question keeps arising in human mind, what does it all mean? (Especially if we have too much time to think)

Yet us modern folks keep trying to solve it outside of our mind in which it arises, biology, physics, whatever.

Maybe the answer is more straightforward?
You get back at corporate america by being a mindless corporate drone?
Turns out it’s much faster for a content producer to spin up a Netflix clone than vice-versa.

Some of this is not realizing just how much technology has advanced since Netflix was first mover - second mover often has much less problems in the area (especially as someone has already done the heavy work of showing it can be done).
Keys tied to users -- during registration, an authenticator generated a new ECDSA key locally, and offloads it to the PC, to be sent to the server. The public component is exported in plaintext and is the verifier data. The private component is sealed by symmetric encryption using a key held only on your device. Part of the sealing includes the canonical representation of the domain, protocol and port for the site in question.

Origin binding -- When you visit a site you used before, the site sends you the encrypted blob offloaded private key. Your token verifies it and decrypts it, and signs a challenge using the key and sends that back to the server as a response, to be verified using the stored public key. Part of this unsealing process ties it to the domain, protocol and port of the origin site making the request, so if a phishing site acts as a relay, your token won't generate a valid response, since the phishing site origin differs and the offloaded private key won't decrypt.

If you look at the threat model here, if your token and its implantations of crypto are secure, you really need to get rogue software onto the client device, which can send arbitrary requests over USB to your security token device, and trick the user into proceeding. At that point it's "game over" as you have code execution on the endpoint and there's other ways to achieve your goals from there.
I agree 100%.

once upone a time I asked myself what the heck do we mean by 'nothing' when asking "why is there something rather than nothing?"?

from wondering that, I concluded the same thing you did. that nothing is a made up concept; and I agree, it's super useful and it's ideal instead of real.

later on, I started to ponder what the heck does 'everything' really mean, and for now I think that 'everything' is just as made up as 'nothing'. hence, 'everything' doesn't exist in the same way 'something' (anything) exist. it's also just a very valuable made up concept.

there is no instance of everything, it's also an assumption.

then again, maybe I got stuck in the trip
> If your 3-hour-could-be-8 made adequate contribution, whatever that is, that's enough. If it takes them 8 to get to where the other is, incentives will push them to do so.

This works great until you PIP an underperforming female, minority, or person over 40.

The discrimination lawsuits will make the company regret their progressive stances.

You wouldn’t believe how many times I have seen this happen.

The median outcome is a settlement with no admission of guilt (usually because it’s cheaper than the alternatives), and the person now has a job for life or is given severance until they get a comparable position elsewhere (and they won’t be rushing).
A million names? Can you point me to evidence that this terrorist watch list is this large?
Oh sweet summer child, they aren't saying that they are going to get rid of the poor performers. They've said they are going to turn up the heat. That means that the people, like yourself, who actually do the work, are going to face the heat. The poor performers have a skill: and that skill is keeping their jobs without doing any work. So you're the one that is going to have to do more work, and it is people like you who are going to get a clue and go work somewhere else. If you stay, you'll have an even bigger portion of the work to do.
Interesting approach on passing data between steps and constructing the overall graph - it will be interesting to see what the take rate is between the two approaches (of sematic and metaflow). On the UI front, Metaflow generates viz for all objects by default in @card; but how does Sematic package up PyTorch referenced in the example (https://docs.sematic.dev/real-example) for execution on the cloud? IIRC, Metaflow packages the cwd (in addition to @conda, @pip etc.) and relies on existing packages for local execution?

Edit: Digging deeper, Sematic relies on Bazel (https://docs.sematic.dev/execution-modes#dependency-packagin...) and needs a BUILD file to specify all the dependencies for cloud execution. It seems that the entire pipeline will execute as a single (or multiple) k8s pod(s) using the same environment?

I am quite interested in trying out Sematic. Any guidelines on what kind of scale Sematic can support today (and the near future)?
I understand your slippery slope argument and can agree on some level, however the law often does litigate on these grey areas based on intent.

The intent of the attacker in this case was extremely evident- the page served at that domain clearly used cloudflare’s trademarked logo in an attempt to fool the user into thinking this was an official cloudflare page. The intent to deceive is clear.

In your case, I would imagine your page would avoid making itself appear as official cloudflare marketing material. In fact, I would imagine you would take pains not to be confused with the official cloudflare site. So it would be pretty clear the intent is not to deceive and you would have a very good leg to stand on if they tried to take down your domain.
I wish I could retroactively apply it.
An amoeba is not asking questions. We are asking questions and we get answers all time. We are on the way to understand everything. Maybe we need to evolve to a different entity like an AI or something, but we are most definitely going into that direction. There are so many great discoveries made every day. We are not sitting still.
Ah, polar stroking, a really clever tick to sample a curves vertices where it matters and guarantee a uniform tangent angle in between the samples.

I actually implemented that (but using complex numbers instead of angles) in my renderer.
Why would the array get sparser? Isn't the point of an array to use more antennas, not fewer?
Twitter by default lets you compose, but not send, a direct message to someone who doesn't follow you. Then Twitter leans on you to give them your phone number, and won't send it unless you do.
Every app and or website steals your wallet and when you point this out to people in tech who code this shit they respond with "just following orders".

Installed system wide ad blockers ages ago and got on with my life.
My vehicle’s onstar’s cell antenna is shorted to ground via a 50ohm resistor inside a small metal grounded can. There’s a reason for that.
Intel is no stranger to that practice:

https://www.mobygames.com/images/covers/l/51358-pod-windows-...

https://www.hardware.fr/articles/95-5/jeux-optimises.html

https://news.ycombinator.com/item?id=28237085 "I can tell you that Intel gave companies $1 million for "Optimized" games for marketing such."
>And then nobody wants to throw code away that turned out to be not what we need.

I once spent two months trying to get my technical lead to do a code review for a PR I raised. Eventually the business informed us they didn't actually need the feature that the PR implemented. At that point, my technical lead immediately approved the PR so it wouldn't be (seen as) a waste.
I agree. I would argue that a large portion of those meeting the "dead weight" definition are just truly burnt out.
Maybe. Have you checked the new Web Whatsapp, it can work without your phone being on.

So this is not clear cut now.
Dead weight would be people doing nothing. After those come the negative contributors: they do stuff but is all politicking and scheming, or just waste others time. Doing strictly what you are really paid for is bad now?
Poor performers are demotivating, yep. The challenge of a manager, and really, the whole management system, is making reasonable efforts to get employees back on track, if that's possible. I mentioned the life events thing because it's real. Sometimes a PIP (performance improvement plan) gives people a jolt and gets them back on track, sometimes not. It's the job of management to separate true under-performers from temporary ones and to find the best roles for members of the team.

What Zuck wrote had none of the nuance or understanding that one would expect of someone with even a moderate amount of experience managing people. It's true that firing people is hard, which is probably why these companies should not have focused on eating the world so voraciously for the past N years.
Slightly off-topic: I wonder if we'll ever get to the point with AI where we can input the linked article and get usable code out.

I'll be up front: you can't give me that article as input and expect usable code as an output.
https://www.crunchydata.com/ This group deals in enterprise grade postgres only. Why would someone even consider replacing them with Supabase?

The main problem with adoption, I suspect, is that their self-hosting story is not great and their per-app pricing is not that friendly beyond a handful of apps. Might be one of the reasons their growth is no longer accelerating. They seem more focused on adding product lines than in making one really great.

Also, their main interfaces are "click buttons in a UI" or "write SQL". Why is this something a Rails, Django, or devs who code should consider changing too?
Maybe it is a good thing to mix our bubbles, I hope I won't be too harsh.

From an European point of view and with a climate catastrophe in mind the solution you are proposing is a disaster (or a joke?). We would be much better off living smaller, closer to each other, with less energy needs. The car-centric culture in America is something I cannot fully grasp. I think the idea of suburbian life with long distance travel each day has been very damaging [1].

I hope that when (if) self driving level 5 ever happens, it would be mainly to auto-steer buses and cheap car rental for driving where public transport does not go.

[1] https://www.youtube.com/watch?v=s19okTYl8MA
I went through a similar struggle to how I read your story. I had a cushy job that paid more than ever, my manager was great, and the work was easy, but I was struggling with depression. I ended up quitting and crashing on a friend's couch for a while, and despite making that change to be able to pursue more meaningful work, my depression didn't abate. I ended up crashing and burning in a pretty significant way, and it was rough.

The point I wanted to make in sharing this story is that I wish I had taken the depression more seriously by itself and hadn't assumed that it was solely or maybe even largely caused by my job situation. Both from my experience with mental illness and from the scientific literature I've read, sometimes the big external issues are masks or plausible excuses for your body & mind to go into a depression because it makes sense that you have a big change outside, and so you get a big change inside. Sometimes those external changes do definitely cause big psychological struggles, but other times the depression kind of comes out because your psychological defenses feel comfortable enough that you will avoid addressing the root of the problem, and only address the external circumstances which you are able to reasonably enough blame your depression on. It's like a release valve in some way, but whose function is to avoid real psychological change at all costs, because the status quo is the safest place to be for our psyches.

I'm not a scientist and you might describe this as some kind of "just so" explanation or too much into psychoanalysis, and that's certainly a possibility. But with this stuff I've found that often times our psyches are very cagey and difficult to really understand in a straightforward way. If my explaining this pattern I've observed in my own history is beneficial to you or anyone else reading this, or at the very least interesting, that's good enough for me.
I honestly suspect they believed that nobody else could build what they had because of how hard it was for them to build it.

But technology advanced fast and if your differentiator is tech you’d better watch out.
Oh my bad, I must’ve read the parent incorrectly. Rereading it now, I see my error. Yes I agree with you. It is a pretty simple concept. Any mechanism that reduces the amount of money in circulation has a deflationary effect.
Disney owns Marvel Comics, and still pretty important for feeding ideas and promotions.
"As of 2017, there were about 1.16 million people on the TSDB; the great majority are foreigners, but the list also includes approximately 4,600 U.S. persons." [1]

[1] https://en.wikipedia.org/wiki/Terrorist_Screening_Database
Second hit on google: https://www.thetrace.org/2016/06/fbi-terrorist-watch-list-gu...

"The FBI’s Terrorist Screening Database is the U.S. government’s primary watch list, and what people usually mean when they refer to the terrorist watch list. It contains about 1 million records. About 5,000 of those records — 0.5 percent — are about Americans."
>Why does this happen? Of course I don't know.

Let me make an observation... eventually every manager gets to a point where the only way to get promoted is to grow their reports. So they beg for additional headcount for their team with little (but important) work, hire a bunch of people who are better suited working in other areas, and repeat for 10+ years until the CEO notices.
I received no less than four Amazon refund scam phone calls today. If only we could have this accelerated timeline for “run of the mill” phishing scams, they would be so uneconomical to run and the volume would decrease significantly… sigh.

As it is I reported the two that didn’t use spoofed numbers to the owner of the number (onvoy/inteliquent as usual). Response time from them is basically infinite, as abuse reports basically go into a black hole.
I mean - someone can probably get it running on a Commodore 64 eventually. But I wonder how well it's going to run. If it runs on the GPU then it might be plausible but don't models like this have a 100x or so slowdown on CPU?

Someone else said GPU PyTorch on the M1 is far from ready so I'm wondering if this will be CPU instead.
I agree that gamma correction helps, but we're not talking about gamma, we're talking about color. Here's a version of the page I shared earlier with ITU REC BT.701 gamma correction applied: https://justine.lol/color-gamma.html It still has the same color problems. In fact they should be easier to see now that the white/dark issue is fixed.

Could you explain how linear interpolation is different from sRGB interpolation? I would have thought they were the same thing. If by sRGB you mean interpolating but being lazy about gamma, I'll be the first to admit that's just plain old incorrect, even though laziness is sometimes a virtue.

Also are you one of the demo authors? If so we could probably move this conversation to Discord or email and we could try some more blending methods!
It’s ESPN2 though, the annual Corgi Race in Seattle also aired on ESPN2 again last week.
Founder led companies or where the staff includes some product visionary seems to solve that. It’s not common though at all and not long lasting. In my experience when the non technical or accountant types inevitably start calling the shots effort can get grossly misallocated but utilisation will be high.
Always this was a contagious but meaningless gimmick. Thanks for the explanation.
Productivity is limited by the scope of your products. If you have 100 Work years of work available to do but have 500 employees then each employee can only do 0.2 work years worth of work per year. People want to be productive but if there's not enough productive work do then people start doing unproductive work because it's all that is available.

Solution:
You need to either increase the scope of products: get into new industrys like Tesla and Amazon are doing OR cut head count massively.
I vote with my wallet, and my time.

If Facebook is shoving things in my face that I do not like, then I stop using Facebook. I haven't logged-in for over two years because of that.

If a company I buy products from is spending that money on things I vehemently disapprove of, then I am well within my rights to stop being their customer.

This isn't "cancel culture", this is me choosing how I spend my time and money. What I find onerous are all the people telling me that I'm a bad person for exercising these liberties.
You could have maybe said "284 lines of code plus weights" to avoid all this criticism that misses the point of the project.
One show wonders aren’t a bad way to go - and I think this is how Apple+ is going to come in submarine. Price it cheap enough that no matter who you have as #1, you have them as #2.
The OS should apply a domain whitelist to apps, in coordination with the app developer and the device "owner". (Like uBlock Matrix)
His slides to his talk have been posted. I'll like the video to the talk when it's up.

https://tobtu.com/blackhat2022/
Looks like I'm a little bit late to this article about mailing list discussion about adding ~CVE search to pip.

The broader trend here is to identify the names, versions, and hashes of all software installed packages in all languages and present an SBOM [1][2]. Does/would `pip audit` also lookup CVE vulns for extension modules written in other programming languages like C, Go, and Rust; or do existing tools that also already lookup vulns for Python packages

[1] https://westurner.github.io/hnlog/ ; Ctrl-F "SBOM"

[2] "Existing artifact vuln scanners, databases, and specs?" https://github.com/google/osv.dev/issues/55#issue-802542447

FWIW, from the OSV README https://github.com/google/osv.dev:

> This is an ongoing project. We encourage open source ecosystems to adopt the OpenSSF Vulnerability format to enable open source users to easily aggregate and consume vulnerabilities across all ecosystesm. See our blog post for more details.

> The following ecosystems have vulnerabilities encoded in this format:

> GitHub Advisory Database (CC-BY 4.0), PyPI Advisory Database (CC-BY 4.0), Go Vulnerability Database (CC-BY 4.0), Rust Advisory Database (CC0 1.0), Global Security Database (CC0 1.0)
OSS-Fuzz (CC-BY 4.0)

> Together, these include vulnerabilities from:

> npm, Maven, Go, NuGet, PyPI, RubyGems, crates.io, Packagist, Linux, OSS-Fuzz
It's great that the code is open source. However, the magic is in the models. I wouldn't be so sure that model access won't have the same restrictions as OpenAI.

From the repo:

"To prevent misuse and harm, we currently provide access to the checkpoints only for academic research purposes upon request. This is an experiment in safe and community-driven publication of a capable and general text-to-image model. We are working on a public release with a more permissive license that also incorporates ethical considerations."
I’m not sure what gives you the confidence to make absolute statements like this. It might be unlikely, but code golfers, demo sceners and the like regularly do crazy stuff with ridiculously little code.
It’s other components too…

In the UK and elsewhere they put Salt on the roads during winter!

Which gets into everything from the underside of the car and slowly destroys things!

YMMV :-)
Wear them down, then we make mops/rags to clean the house with them!
Same in Australia. We don't get Hulu and ESPN+ but they launched a new section within the Disney+ service, called "Star", that includes more "adult oriented" movies and shows.
I must say that some of my favourite images are ones that I generated in VQGAN. Don't dismiss older/smaller models. Some have a very specific quality that is perfect for some things. (Heck, I'm still fond of Aphantasia and it's weird tiling)
Apple TV doesn’t have to surpass. They’re pricing themselves low enough to be everyone’s second choice, and low enough that you won’t bother to cancel. It’ll grow.
“Enough” is not in the vocabulary of corporate vampires. Doing your job to the requirements should be acceptable, and that only works if your org is run by empathetic, reasonable leadership, you don’t tolerate the abuse of being squeezed, or you have a union. If the bar is never enough, you’re being gaslit, and that’s psychological abuse.