skysight-inc/HackerNews huggingface dataset:
It has been covered here on HN several times, but to summarize:

Budget cloud hosting on a credit card allows scammers to use stolen CC numbers to spin up VMs to mine crypto.

Essentially the hosting company is offering a cash equivalent for unreliable credit.

This kind of abuse occurs at enormous scale, because it can be worth it for an attacker to use botnets to throw tens of thousands of credit cards at hosting companies. If you never actually expect to pay any money (especially your own!), then even thirty minutes of free compute is worthwhile to chase. There have been similar attacks against GitHub Actions, because they're also free and general-purpose.

This is also why the free-tier, dev-only, education, or similar MSDN or VS Subscriber type cloud subscriptions never permit the use of GPU instances. Too tempting a target!

The large providers like Azure and AWS are basically printing money, so they don't care about the small-fry scammers. They're too busy trying to hold on to the firehose of cash.

Smaller, budget providers like Digital Ocean are running too lean to tolerate scammers, but also can't afford to have humans in the loop from the sheer scale of the attacks.

So they use heuristics that are 99.99% accurate (or whatever), which means one in ten thousand legit customers gets axed along with the scammers. Oops.

Essentially, as a customer of these small providers you are taking on some of their risk in exchange for the discount over the big-name vendors. This is especially true if you pay them with a credit card, irrespective of past payment history. Like I said, they simply can't afford to keep a human in the loop.[1]

An example that came up here was a startup that had an account "ticking along" with a handful of dev stuff, went "live" with a big launch, and so almost all of their servers was loaded to nearly 100% capacity thanks to efficient containerisation and auto-scale.

Good job devs... except that looks identical to a hacked account that has suddenly started to mine crypto on every machine.

Axed.

[1] It's even more complex than you think. Employees can and have been bribed to let the scammers through! The employees themselves might be mining crypto. The scammers can trick them, lie, beg, or just figure out the system from repeat conversations. The only recourse is to take the human out of the loop entirely, nothing else works for them. If you get to be the 0.01%, you generally have no recourse.
We're heavy k8s users at work. We used to use GKE, now we use a mixture of EKS and bare metal after migrating most stuff away from GCP. Honestly, GKE isn't better than k8s anywhere else in any meaningful way at all.
> billing works extremely well for me

I suppose billing works extremely well for most GCP customers as well.

As for me, I hosted a side project on Hetzner a few years back for some European presence. IIRC I used PayPal for payment and they didn't support PayPal recurring payment, so I had to settle an invoice each month. Used them for about two years without problem, then missed payment for two months during a chaotic period when I didn't notice their monthly invoice emails. I got exactly one email reminder about missed payment titled "Reminder" (yes, that's all, I got all their correspondence in front of me right now) before the final "Cancellation of Contract" email and termination of my account. At that point, politely pleading with them to reinstate the account was useless, I only got a threatening letter back demanding a wire transfer of the ~€60 I owed within three business days or risk being sent to collections.

Was I in the wrong? Sure. Were they friendly or patient? No.
Makes me think of Dune (2021) that was written on MS-DOS [1], also of GRRM who still uses Wordstar for writing too [2].

One thing GRRM notes about wanting to use Wordstar is how modern word processors nowadays will auto-correct as you write, either inserting a capital letter, or correcting a typo. Which no doubt can be annoying. The few times I've had to use a word processor I always end up gnashing my teeth at the "useful" features they have on offer.

I'm of the opinion that software should make the fewest assumptions as possible about what the user wants to do, ideally, software should be dumb not smart.

[1] - https://www.vice.com/en/article/wxdeay/the-dune-screenplay-w...

[2] - https://techcrunch.com/2014/05/14/george-r-r-martin-writes-e...
> we won't allow you to sell any cloud-related services anymore until you don't have proper customer service

Yeah, and shut down everything that everyone has running on Google's servers on the process. Killing millions of small to large businesses in the process. That does make sense. The way to enforce food regulations is to shut down the food stores even at the cost of leaving people hungry.
Or https://twitter.com/unconed for the full experience. I used to follow him for gfx stuff, until he lost his marbles during covid. The world at large has moved on with their life but from a cursory scroll he's still living in 2020.
Very long refresh rate.
Doing it on a ATTiny85 is a lot more impressing than doing it on a "larger" microcontroller :)
I'm looking at these CVEs thinking "How could curl have a CVE", and to be fair, some of these do seem theoretically significant if combined with other software bugs.

But some of these just look like regular bugs. For example, https://curl.se/docs/CVE-2022-27778.html

curl might remove the wrong file when --no-clobber is used together with --remove-on-error.
The --remove-on-error option tells curl to remove the output file when it returns an error, and not leave a partial file behind. The --no-clobber option prevents curl from overwriting a file if it already exists, and instead appends a number to the name to create a new unused file name.
If curl adds a number to not "clobber" the output and an error occurs during transfer, the remove on error logic would remove the original file name without the added number.

Which seems like at worst it deletes a previous version of a file fetched with curl, and leaves a partial file, rather than deleting the partial file. I understand there's perhaps a very unlikely scenario in which this could lead to a system being compromised, but it depends on too many other factors that are also increasingly unlikely, it seems on the order of likelihood of reversing SHA-256
WordStar?

I can imagine Logopolis in just this setting.
> privilege escalation tends to be easy on Windows anyway

Well, Crowdstrike is supposed to catch and prevent that...
Have you never noticed that a panning camera in a movie is much more juddery than a decent side-scrolling video game? Or that action scenes often lack clarity due to camera shake and related motion blur?

Or that the move from HD to 4K is near-worthless without a framerate increase?

Maybe it's not bad enough to match your personal definition of 'choppy', but 24fps is an unfortunate compromise made in the days when you had to feed costly physical film into movie cameras.

And now everyone is so familiar with 'the cinematic look', we're stuck with 'movies should look like that, as that's how they've always looked', anything different is assumed to be worse, and we're never going to learn how to do high-framerate filmmaking well as the early attempts were so quickly rejected.
I have almost never thought about the gender of a single user on this site either. That's because I assume they're a white guy like me until indicated otherwise. That's because most of the people I see in most tech spaces are white guys like me, so I'm probably right (and when I'm not it's usually because they're a Asian rather than white).

That's what it's like to be the default character model. That's not what it's like not being that.

Heck, for the longest time as a white guy in tech I thought simply treating people who aren't white guys as if they were was good enough. That only changed when I listened to a woman talk about her experience of being on the receiving end of that, with her colleagues being so comfortable treating her as "one of the boys" that they'd openly be misogynist about other women in her presence ("but you're not like them of course").

Not being the default character model sucks. Having a community with a default character model closer to your own is an improvement. Of course even better still would be not having any single default character model but "pink HN" might still be better than nothing.
Asking "is there an HN for women" is like asking "is there a Github for lesbians". It's implying women aren't welcome. On a website where if you don't explicitly say it yourself, nobody will ever know if you're a man or a woman.
A Small Town in Southern Japan Wants to Be Asia's Silicon Valley
Searched 'dragonball' and the memories came flooding back of using dreamweaver to make a website in grade 6. I don't remember what the site was about, I just know dragonball gifs were a critical part of it.
> Which you never seem to respond constructively to. Care to comment on this?

It's impossible to respond -- it just makes assertions that are impossible to verify, and without throwing any sources.

The only thing I can verify myself is that waveform data from e-ink is overzealously copyrighted and protected, to the detriment of OSS projects, but this exclusively applies to e-Ink technology itself, not competitors.

I don't work in the display industry, but I do think that e-ink just sucks enough by itself that one does not need to invent any type of outlandish conspiracy about how a company would boycott itself in order to limit their market share.

Every single time I have ever seen a color e-Ink display it has been absolutely disappointing. Both Triton and Kaleido were low-contrast, gray-ish blurry messes (and Kaleido is so little an improvement over Triton it makes me wonder what exactly has improved in the last decade). ACeP is the only color technology which really stands out somewhat (this panel, by the way), but it is limited by the extremely low refresh rate and color resolution (we are talking multiple tens of seconds to refresh). And as for the core grayscale market, most people would be better served by a memory reflective LCD, since it is visually indistinguishable from e-Ink, similar or even better contrast, much faster refresh rate, and actually better in average power consumption for most applications except maybe price tags (since e-Ink sucks a lot of power when refreshing).

The fact that not only e-Ink really fails to thrive but that they do have competition which thrives (e.g. smartwatches like Garmin use transflective LCDs that are color & exactly as viewable in sunlight as e-Ink, perhaps more) should also put an stop to the idea that they somehow exert control over the low-power, daylight-viewable display market.
> Animals live a life of leisure without much work, and they don't have the infrastructure that we as humans have. They don't collapse.

^ This claim doesn't really sound like it has a lot of evidence to back it up.

As i see this problem I can break it down in 2 parts:
- systems (including animals & humans) evolve or decline
- our species doesn't have a central decision system

So, as I see it, animals live a life of constant pressure where the strong survive and the weak are culled out. No judgement here on the implications of striving for strength.

Suppose humans stop advancing our way to creating supporting tools that enable our weak to live. In my view this means those tools will decline and tend to disappear. Thus as a species we would be heading to the type of life animals live - I described above.

So, I argue that all work is essential work because when the outskirts of the bell curve of essential work are cut off, then the height of the bell curve drops as well.
Challenging unsourced assumptions and combating misinformation is a noble goal. Is there any actual proof that companies other than e-Ink are unable to develop technology like this 7-colour display due to patents?
Living with the Rohloff Speedhub
> we won't allow you to sell any cloud-related services anymore until you don't have proper customer service

No, they attract and select people who see the world only from an engineering perspective. Combined with Google's cultural roots that come from MIT, where projects and services are things that are funded by the government, military or megacorporations in which you can pull the plug whenever and the other side would not flinch, this makes them totally blind to the existence of humans on the other side of their services. Resulting in an false reality in which you, me and the millions of other people who depend on their services do not exist.

So you see things like this happen. Things like 'deprecating' products in people's faces. Things like 'combining and merging and unmerging products because it makes more engineering sense' and creating messes like "Google Gmail Hangouts Chat Rooms Meet" or whatever they are calling the frankenstein they made by combining all those.
Yes, because the beast grew to a behemoth. But the fundamental issue is the same: code with unknown/issues with licensing.

There is absolutely no reason to take that lightly. Yes it might turn into absolutely nothing.

What happens if years down the line someone like Oracle acquires code that 1000s of projects depend on?
The story has some interesting vignettes about a couple of Japanese startups. I was also impressed by the discussion of civic duty being a driver behind a lot of the things people do.
Virtual Machine Manager takes the cake IMO
> Is a micro-controller able to broadcast through an ethernet port something remarkable?

Many microcontrollers, especially higher-end ones, have built-in dedicated hardware, called peripherals[1], to handle complex and/or high-speed interfaces like Ethernet.

The Pico does not have an Ethernet peripheral, so this project relies on bit-banging[2], a brute-force approach to IO. However, the Pico does have the PIO[3], which is a general-purpose IO peripheral, so it's not pure bit-banging in the traditional sense.

While it's cute, it's not super remarkable. People have done bit-banged HDMI[4] on the Pico for example. However, Ethernet access can be very useful in a Pico project.

[1]: https://electronicguidebook.com/what-are-microcontroller-per...

[2]: https://en.wikipedia.org/wiki/Bit_banging

[3]: https://hackspace.raspberrypi.com/articles/what-is-programma...

[4]: https://github.com/Wren6991/PicoDVI
It's quite unfortunate that your parents decided to call you dvfjsdhgfv.
Had a friend who owned an expensive plasma (think it was Panasonic) and seeing him refuse to use it to watch tv channels with logos in the corner or having to run it with static on the screen for an hour after playing video games on it because the ui elements burnt in so fast just made me think this tech was pretty useless as a general purpose screen unless you don’t mind image burn in.
> Private property proceeds the existence of the modern state.

Stop intimating that private and personal property are the same. Private property is enforcable only by coordinated violence. Its manifestations in the past (serfdom, slavery etc) have been universally agreed to be negative.

> Both s public and private property proceed modern states, and can have their origin in customary law as much as legal statutes.

You're still conflating personal and private property here.
unions are one of the reasons nobody likes teachers
In the UK (and plenty of other countries, I'm sure) I get a notification for every payment from my banking app and/or Google Wallet (usually both, since I use GPay a lot).
All of crypto is basically HN for crypto. HN's biggest historical influence is VC culture (heck, look at the domain name) and crypto mostly runs on VC money (especially a16z). HN's disregard for crypto despite of this is probably one of its most redeeming traits.
Tesla want to offer FSD on their whole lineup, not just in their high end models
There are more players now but I don't think the cold war Soviets were as stable as you're arguing here.

We've had mad men with nuke since we've had nukes. The more time we spend in that situation the higher the chances someone uses them but I think we're far safer now than times such as the Cuban missile crisis. The Soviets had their nukes on a dead man switch. That was insane and could have killed billions accidentally.
I think people get this slightly wrong - he was more regarded as a performer and improvisor, and the pieces published during his lifetime were mostly keyboard/organ pieces that were considered educational. He was a pretty obscure composer but (mostly) well regarded by those in the know, if a bit too intricate for some. After he died he wasn't immediately very influential, instead he was considered very old fashioned.

From Wikipedia:
https://en.wikipedia.org/wiki/Reception_of_Johann_Sebastian_...
After his death, Bach's reputation as a composer at first declined: his work was regarded as old-fashioned compared to the emerging galant style.[a] Initially, he was remembered more as a virtuoso player of the organ and as a teacher. The bulk of the music that had been printed during the composer's lifetime, at least the part that was remembered, was for the organ and the harpsichord. Thus, his reputation as a composer was initially mostly limited to his keyboard music, and that even fairly limited to its value in music education.
Does it improve that economy by at least as much as the cost of the transfers? It seems like a lot of economic benefits can be created by injections of money from outside the system under study.
"[Graham] previously won the award in 2016 with the gag: “My dad suggested I register for a donor card. He’s a man after my own heart.” The day after winning the award, Graham suffered a mild heart attack."

Talk about timing! Comedy!
Surprisingly, a friend of mine actually won the car from a sweepstakes, a couple of years ago. He lives in Poland though (and that's where the sweepstakes took place)
> Why should a business relationship with Google (or any other cloud service) be any different?

Because google choose to make this as difficult as possible. A couple of years ago I worked on a third party IAAS database cloud product (think Atlas or Elastic Cloud, but for a different database), and while Azure had the worst tech overall, Google were ultimately the hardest to deal with by a VERY long way because they don’t acknowledge the existence of people as anything other than ad targets.
> drinking alone in a club (who does that?)

Every single drinking person who has a club to go to and needs to do some thinking, for starters.
Hetzner also has a customer service phone number that you can call. I've never seen anything like that from Google.
Can you expand more on those new storage solutions?
I think the problem is that replication alone isn't enough. You also need to support snapshots for backups because you don't want to replay years worth of replication logs to do a restore.

And when you support snapshots in your backup software, it's very tempting to then drop support for replication...

Replication logs also have another problem - since they include every data change, certain types of database updates, for example a large field that changes hundreds of times per second, can work out far less bandwidth to just snapshot periodically.

Overall, all this stuff is a lot of complexity most businesses don't want to have. They just want to have a simple backup solution and get back to building their product. And that usually involves using some managed database where backups are just an option in the control panel. Or a self-managed database where backups are disk snapshots. Or a script that copies a database dump to S3 every day. But it hardly ever involves streaming change logs...
You only need a single part to calculate a specific offset, assuming you have part sizes stored in metadata already (a good idea).

Each part can be max 5GiB as per S3 spec. 5120 * 4 = 20KiB.

Even if you unpack to 8*2 bytes in memory when decoding, you are still not talking a huge amount of memory.

The on-disk space is ~0.0004% as blibble calculated, and should easily be offset by the compression achieved. In MinIO we don't store indexes for files < 8MiB, so for small files there is no overhead.

If the added metadata is a problem for whatever system you are looking at, then that is a characteristic of that system and not a general problem.
My flat is colorful my car is black.

Any other car color would have cost extra which I was not willing to pay.

60-80 were weirdly colorful too bright for no particular reason.

I don't think there is much to interpret into this.
Not your dad’s consulting firm
Indeed. If a customer tries to backup a petabyte of data on the base plan (because it’s “unlimited”) and they get the boot, they really shouldn’t be that surprised. Wouldn’t really compare it to OP’s situation, where they got an assurance in writing they were in good standing, and didn’t appear to be blocked for violating ToS.
Can Types Replace Validation?
I'm not really familiar with this market but I'll just quote one article from last week suggesting it's a bit more lopsided than that; things can change quickly obviously.

"Tesla accounts for more than two-thirds of all-electric car registrations (almost 68%), which is a dominant position, but the non-Tesla electric vehicle sales are growing at a similar rate and potentially might outpace Tesla later this year."

If youre outselling everyone else _combined_ that suggests a clear current market winner.

https://insideevs.com/news/604580/us-bev-premium-car-sales-2...
I read this as "the particles differ in size and charge" then somehow through some fiddly electrical impulse magic they are separated and can be sorted to be deposited on the front somehow.
Ask HN: Is Cloudflare a good domain registrar?
Recently I was considering moving some important domains I have to Cloudflare, however after reading this thread:

https://news.ycombinator.com/item?id=31576353

I became rather skeptical and cautious. Is pending delete still an issue? Curious what other people's experiences have been like a few months out from this original thread. Thank you!
Automattic (WordPress' parent company) has their engineers do customer support 1 month a year. Helps them understand people and their problems. And so far WordPress has come to become ~50% of all websites on the Internet, 30% of all ecommerce sites (through WooCommerce). And individuals, small and large businesses alike run things on WordPress without disruption and backwards compatibility problems for a decade and more now. Leave aside any evil like the "We are just 'deprecating' this on your face" that comes from the likes of Google and kills people's businesses.

So it can be done. Engineering cant exist for the sake of itself - if there is no one or nothing using the engineered system, than the system is meaningless. And without understanding those who use the system, engineering fails.