skysight-inc/HackerNews huggingface dataset:
> Analytical skills were overrated, for the simple reason that clients usually didn’t know why they had hired us. They sent us vague requests for proposal, we returned vague case proposals, and by the time we were hired, no one was the wiser as to why exactly we were there.

Achieving this zen state is a primary goal of consulting firms working with public sector. After winning an initial brutal low balling battle with competitors, the goal is to transition to a model of a steady conveyor belt of non-competitive fluffy proposals for changes going one way to the client, and money flowing back the other way back to the firm.
Does DCO prevent this kind of thing from happening? I think moves like this demotivated and discourages a lot of potential contributors and spreads fear. That's not a good thing.

Imagine a contributor who's first contribution to Open Source was this project. I am not sure he'd be very happy about a move such as this (or maybe he won't care).
> Then it doesn't matter if the domain expires and someone re-registers it, since they don't have the developer's private keys.

That's a good point in terms of invalidation, but a new domain registrant should be able to claim the namespace and start using it.

I think one possible solution to that would be to assume namespaces can have their ownership changed and build something that works with that assumption.

Think along the lines of having 'pypi.org/example.com' be a redirect to an immutable organization; 'pypi.org/abcd1234'. If a new domain owner wants to take over the namespace they won't have access to the existing account and re-validating to take ownership would force them to use a different immutable organization; 'pypi.org/ef567890'.

If you have a package locking system (like NPM), it would lock to the immutable organization and any updates that resolve to a new organization could throw a warning and require explicit approval. If you think of it like an organization lock:

v1:

pypi.org/example.com --> pypi.org/abcd1234

v2:

pypi.org/example.com --> pypi.org/ef123456

If you go from v1 to v2 you know there was an ownership change or, at the very least, an event that you need to investigate.

Losing control of a domain would be recoverable because existing artifacts wouldn't be impacted and you could use the immutable organization to publish the change since that's technically the source of truth for the artifacts. Put another way, the immutable organization has a pointer back the current domain validated namespace:

v1:

pypi.org/abcd1234 --> example.com

v2:

pypi.org/abcd1234 --> example.net

If you go from v1 to v2 you know the owner of the artifacts you want has moved from the domain example.com to example.net. The package manager could give a warning about this and let an artifact consumer approve it, but it's less risky than the change above because the owner of 'abcd1234' hasn't changed and you're already trusting them.

I think that's a reasonably effective way of solving attacks that rely on registering expired domains to take over a namespace and it also makes it fairly trivial for namespace owners to point artifact consumers to a new domain if needed.

Think of the validated domain as more of a vanity pointer than an actual artifact repository. In fact, thinking about it like that, you don't actually need any cooperation or buy in from the domain registries.

> The hard part is how to issue a new key if you lose the old one, since that probably requires social vouching and a reputation system.

It's actually really hard because as you increase the value of a key, I think you decrease the security practices around handling them. For example, some people will simply drop their keys into OneDrive if there's any inconvenience associated with losing them.

I would really like to have something where I can use a key generated on a tamper proof device like a YubiKey and not have to worry about losing it. Ideally, I could register a new key without any friction.
For the American's that don't know. In Canada our banks won't give you a 25 or 30 rate.

We typically renew our rates every 5 years, while still amortizing our mortgages over 25-30 years. So rate adjustments tend to hurt more than they do in the US.

Our overnight rate is now 3.25% so we're a bit ahead of our neighbor to the south.

And our equivalent to the dot plot suggests no more rate raises this year, though we do have a chance for one more in December, but unless our inflation rate jumps again, we're probably done until the US catches up to us.

I guess I should note that the new 3.25% rate is 25bps above what the BOC considers to be the neutral rate.

Our two year rate( the one I tend to think is the most important) is currently trading around 3.62% which is up, while the 10 year hasn't really budged, indicating that the markets think we may be close to the end of rate hikes.

Our inflation rate "falling" to 7.6% in July from 8.4% in June also suggests that rate hikes are starting to work.

We're in a weird not often seen situation where we are seemingly heading into a recession with full employment and high inflation and already high interest rates(by recent memory) while also having high debt levels for both individuals and businesses.

The BOC( and US FED) have been pretty clear which side they'll come done as they have constantly said inflation is job #1, so people with debt will be feeling pain for along time to come
Both.

"We will continue to support Manifest v2 to the extent that we can"

"Brave's adblocker (Brave Shields) is not an extension, and is natively implemented. So, it will be totally unaffected."

Source: https://www.reddit.com/r/brave_browser/comments/rdab12/how_w...
That would be a hell of a feature. I am not sure Bluetooth is up to the task, though, I don’t think it handles simultaneous connexions to a single device very well.
It's frustrating, because this likely won't be usable on Desktop, Windows, or the majority of workspaces. I actually don't mind the Reminders app, but like iMessage, I can't use it on my main Windows desktop, so I don't.

I can count on one hand the amount of times I've FaceTimed someone because of fragmentation in my network with Android.
Can’t remember the last time I thought about app launch speed outside of network access issues.
> people can allocate money better than governments

(Full disclosure: we live in Europe) and my OH - who earns way more than I do - has been moaning about her taxes and deductions since, well, forever.

However in the last few years - and as an entire family - we have hit the state healthcare system pretty hard, including every single member of the family, for a whole variety of reasons. Trips to the ER, accidents, stays in hospital, operations, you name it.

Got some more somewhat frustrating news this morning from our family doctor meaning yet more appointments at the hospital, this time for two more family members, including - but not limited to - an MRI and a gastroscopy.

I was pretty down on the way home from the doctor, but on the plus side, there's basically no cost to us at all for all this additional medical care, other than from having paid the contributions to the state up-front through the taxation system.

Q: You'd prefer to roll the dice that you'll stay healthy?
> there are most definitively some people that know at least roughly

"At least roughly" is doing a lot of work here. I think what you're getting at is that there are people who know which storage systems are likely to hold that data, but knowing exactly which objects do is far more challenging. Copies get made while data pipelines are tweaked, and then forgotten. Copies get made internally on storage systems as disks/machines fail and get repaired, as rebalancing occurs, and in other cases that typically only one or two members of the team understand at all. (I worked on one of Facebook's largest storage systems for two years BTW.) Copies get made for AI training, experiments, shadow-traffic generation, etc.

Could they do better? Should they do better? Yes and yes. But it's not a lie to say nobody knows how to find every last orphan and fragment. They can pretty reliably delete everything they could find to sell, but that's a very different thing and you're conflating the two.
I have seven devices that I use my AirPods with - an iPhone, iPad, Watch, computer, and two AppleTVs. Once I paired them with one device, they are automatically paired with every device connected to my AppleID. They switch seamlessly without me having to do a thing.

I also don’t have to decipher beeps to change settings. I can change anything about them visually from any of my devices.
That is strangely surprisingly way too realistic tbh. ;-)
That one is actually third party, originally Intuit, now `On-LineTaxes, Inc`.

The system that IRS was charged with creating would basically amount to this, and it might be that they simply buy the system and make it an offical IRS product. They already had sufficent control over FFFF to force Intuit to divest after Intuit exited the free file alliance.

I unlike many people who seem to be hoping for basically ISR Turbotax or nicer, I really cannot see the IRS offing a more guided walkthough style system instead, since that is far more complicated than maintaining basically digital versions of the paper forms. In some areas TurboTax and the others get into more or less the business of offering tax advice, which may even be incorrect.

Those businesses can afford to reimburse you if their wizards result in incorrect totals due to a misunderstanding. The IRS on the other hand would need to make sure that the wizards never accidentally misclassify anything, even for incredibly rare esoteric cases. This could be done by possibly asking many extra seemingly irreleavnt questions to rule out all these edge cases, or to dumb the whole system down making it closer to just electronic versions of the forms. The result the IRS would pick is pretty obvious, go with the simpler almost-identical to the paper forms options.
My "sleep headphones" start chanting "battery low" every 20 seconds when the battery drops too low, which inevitably happens after I'm asleep. Who thought that was a good idea?
> I can see the POV that it's buyer beware.

On the other hands, lots of buyers are not aware that it's an issue, and more frustratingly there are regex engines which are very resilient to it... but are not widely used.

Python's stdlib will fall over on any exponential backtracking pattern, but last time I tried to make postgres fall over I didn't succeed. Even though it does have lookahead, lookbehind, and backrefs, so should be sensible to the issue (aka it's not a pure DFA).
We all want to be the kind of person that needs that kind of a watch. But we'll buy it anyway.
You can buy a satellite beacon and pay no monthly fees but you'll be paying up front.
> Web3 means I have all the rights to my data, and ideally, applications can live on beyond their creators.

Thanks for this, I agree. For those of us working on the application stack, web3 is about human rights, and building global scale utilities that are run by networks not companies.

If this view of web3 is alien to you, I suggest starting some place like this blog post: https://jaygraber.medium.com/web3-is-self-certifying-9dad77f...
Who will maintain it though? It's true that Lightbend is doing almost all of the development. There is no one else who knows the code base and no one willing to learn it, since Akka is pretty uncool nowadays.
Brave has committed to retaining support for all of the APIs that were removed by Manifest v3 https://github.com/brave/brave-browser/issues/20059#issuecom... (There are other mentions in the wiki and other places)
I'll be damned, that appears to be a huge bloody loophole.

https://www.legaltranscriptionservice.com/wire-tap-transcrip...
A review of my time at Remix
Really hope that this will be compatible with iDrive 8 on my upcoming BMW.
well, schools become irrelevant once kids grow up (that is, if you have any). A lack of shopping is good for the wallet, when you grow accustomed to buying in bulk and stacking food. the rest is all about your lifestyle preferences
It’s customizable.

https://support.apple.com/guide/airpods/customize-transparen...
Brendan Eich has committed to supporting the Manifest V2 version of uBlock Origin in Brave [1].

Brave's built-in native adblocker also definitely won't be affected, as it doesn't use any webextension APIs at all.

[1]: https://github.com/uBlockOrigin/uAssets/discussions/14544#di...
Weirdly, I'm fairly confident Damon didn't accept his $X million payment for the commercial in crypto.
Well, even today, if the attacker modifies the permissions it will require a re-acknowledgement. Google can also do things there, like if the extension is tied to a key (as it should be), tell developers that they are required to not provide that key to anyone else, even if they sell / transfer ownership of the extension. Instead, the new owner should register a new key, which can trigger review/ scrutiny.

Key + 2FA means the attacker has to have code execution on a developer's machine in order to publish an update (via the local session token, which you should make short lived). And Google could require a FIDO2 token if you want to bypass the "alert users that this thing uses lots of permissions".

There's a lot of stuff I'd be working on to avoid having to remove developer power.

edit: K I've been rate limited by HN so I can no longer reply for today, but them's my thoughts.
For the three-odd backpacking trips I take a year, it's perfect.
Currently dealing with Flask and it makes me sad from the endless decision fatigue. Enormous variations in quality of code, documentation, SO answers, etc. To not even consider the potential for supply side attacks.

With Django there is a happy path answer for most everything. If I run into a problem, I know I'm not the first.
Curl, even compiled against all of its optional dependencies to support every possible kind of auth, encryption scheme, compression, etc. is nowhere 140 dependencies, even transitively. All of Linux from Scratch is only 75 packages.

In contrast, when I tried to add a token-replacement library to mdbook, Cargo installed 187 crates.

There is a real and legitimate difference in the size and functionality scope of older C and C++ libraries with the type of single-function packages you see from NPM and Cargo that has made full supply-chain audits far more difficult. To get functionality equivalent to something like Boost, you might need to vet a thousand separate vendors, the majority of which are pseudonymous Github accounts with no physical address or backing organization.

I'm not just speculating about this, either. I used to be a platform lead on fully-disconnected, classified information systems where we needed to bring in and compile every dependency from source via DVDs hand-carried to a classified workstation. Somewhere around 2015 or so, this stopped being even a remotely feasible job and created multi-year backlogs of teams that had something fully working in their unclassified development environment with Internet access suddenly finding themselves staring at a minimum 6-month, more likely indefinite wait to get to production when they discovered security teams needed to individually approve every package and every developer they wanted to bring onto a classified system.
You may be right, but I think the general news stuff comes after people have gotten value from the met need.

It could be that a wave of similar sites will emerge for a bunch of niche topics and it just so happens that hackers were on the internet first. That hypothesis matches the data too.
Maybe you should switch to the Unlicense. I'm so much happier not giving a damn or punishing my users with pettiness.
They also developed Slick, which has been abandoned for a while now, unfortunately.
I would still recommend the docs from MDN and Google.

If you're relatively familiar with web development in general - you can just peruse the APIs that are available for extensions

Chromium based:
https://developer.chrome.com/docs/extensions/reference/

Or for Firefox:
https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Then hit the MDN "My first extension page" to get a mostly functional manifest file: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Get familiar with `about:debugging` in firefox, and `chrome://extensions` in chrome - you'll need them to load your test extensions.

Finally - It's very worth it to read and understand the "core concepts" as outlined here, starting with the content_scripts: https://developer.chrome.com/docs/extensions/mv3/content_scr...
Not that intuitive imo. I had to show my sister in law who is in her 50's that she needs to leave the case open with the airpods in it, then press the button on the back, in order to make them discoverable.

Like all apple products they do sacrifice some discoverability in favor of a sexier minimalist look
What name would you suggest? That was my 5 min of thought version.

cc prefix for concatenate because that word is very long and it seemed likely that strings may have a large number of different concatenation focused functions that could all share the prefix.

Clone as the type of concatenation operation to perform.
The killer app of the Internet was email, not the WWW as a whole. ISPs would provide a free inbox, and by 1997 Hotmail made free email available globally.

Email was what got people to sign up for dial-up internet in the first place. Prior to that, you'd have to schlep over to a copy shop to fax things over. Only businesses could afford the cost of a fax line.

The fallacy is in thinking that Web3 needs to achieve a critical mass of users that the WWW did. That's incorrect. Consumers adopted email, not WWW. That was just something that took off after the core adoption already happened. Same way Instagram took off after enough people bought camera-enabled smartphones.
Passkeys gonna be fire. Goodbye password managers, credential stuffing, and phishing attacks!

(photo deduplication is nice too btw, been a long time coming)
I only worked with the Akka ecosystem a little, but if I had made a major career or business investment in it I'd be pretty unhappy about this. There's nothing wrong with closed source software and I want the authors to make money. It's changing the terms on users that pulls the rug out from under people.
If you are using poetry you can add something to the pyproject.toml to handle the indexes, though I am not sure if they are ordered or not

[[tool.poetry.source]]
name = "my-pypi"
url = "https://my-pypi-index.wherever"
secondary = true
Or hedge their bets by buying a right of first refusal option from Globalstar should anyone else try to acquire them while leaving Apple free to look for other options and partners.
I'd argue there's something to be gained though for directly helping your neighbor vs. donating to charity. When you directly help your neighbor (anonymously or not), there's a human element there that uplifts and enriches the lives of both parties that is largely absent when the help is in the form of an impersonal check in the mail from some organization. When I've done this (personally gone out of my way to help an individual monetarily or otherwise) I've found it increases my empathy and desire to serve others more than having money auto withdrawn from my bank account annually to a charitable organization (which I also do).

So I guess what I'm saying is... why not both? Donate to charitable organizations, but not exclusively. Also go out of your way to (anonymously or not) do charitable things to individuals.
Using Ratatool to Rank Tennis Players
> If they changed their mind later to make the project proprietary, still full respect.

If "they" doesn't include all previous contributors, I can see an argument to the contrary.
I love my samsung pods and they dont look like retarded white bars spilling out of my head holes
I’m not, either. The general principle is that cyberattacks are equivalent to kinetic attacks. If they happen in a conflict where both sides are kinetically attacking each other anyway, the question of response is irrelevant, and the only question is the relative justification of either party to the overall conflict to begin with.
I was fully in the Google world prior to gorhill's posts on manifest v3

as a direct result the only thing I have left is a pixel phone, which will be going with the new iPhone

(and in the meantime my entire family has been 'helpfully' migrated too)

I may be up the extreme end of the distribution, but this sort of grassroots push is what dethroned IE, and the resultant loss of control of the web eliminated Microsoft's near total influence over the computing industry
Podcast: H-1B Trends with Robert Bouchard, The H-1B Guy
Rust uses `repeat()`, which sounds much more descriptive to me. The types in the function signature make the "clone" part of the name redundant.
This really depends. If someone is trying to operate with small user defined generic functions on a large array of user defined defined classes in Common Lisp in a tight loop (i.e. what Michael was doing) then performance is very very hard to recover.

Of course, performance claims about Common Lisp are very slippery because one can always say "well, __ implementation using ___ library can avoid ____ specific performance problem", but I think it's fair to say that in general, generic code and CLOS features can land you in very serious performance trouble quite quickly, especially if you're trying to make reasonably portable code.
How do these compare to something like Sennheiser Momentum 3?
str.__mul__ is just a conveniently short way to demonstrate the issue, the target is pretty much any parsing routine exposed to outside users e.g. any JSON API.
phones that will roam into satellite coverage in rural areas

That's not what Apple announced. Satellite service is only for emergencies and is cumbersome to use.
Should PyPI kick my project off because it don't support MS Windows?

My package uses C and Cython extensions. While I support macOS and Linux-based OSes, I don't know how to develop on or support MS Windows.

I've tried to be careful about the ILP32 vs LP64 differences, but I suspect there's going to be many places where I missed up.

I also use "/dev/stdin" to work-around my use of a third-party library that has no way to read from stdin. As far as I can tell, there's no equivalent in Windows, so I'll have to raise an exception for that case, and modify my tests cases.
I look forward to EU landfills receiving tonnes of Lightning cables. And 10 years from now, receiving more tonnes of USB-C cables once the next USB standard makes the current set of cables obsolete (even assuming they share the same port shape).
So you mean everyone that contributed when the project was FOSS should be paid for their labor when this ceases to be FOSS?
You can blame their competition for not beating them out at longterm support on that front. Apple is already leading the market supporting iOS this long. I used my last iPhone for 7 years, unfathomable on any other platform than iOS.

I hope their competitors step it up and beat Apple out on grade A support. I'm seeing them fall further behind in every metric. My iPhone 12 mini that I bought on launch day "just works".
Why do you need an init process inside your Docker container (PID 1)
Man, this is so disappointing.

Sure, there are probably businesses out there whose entire livelihood is built on akka, and I get that the creators might be upset that they're not contributing to the project. But there are a lot of other businesses out there where this might be a great solution for a very small part of the problem space, and they are just never going to use this tech now. A few years ago I used akka at my current gig for a project that ended up fizzling, and had always hoped to re-introduce it if another appropriate opportunity emerged. This change makes that a non-starter.

I also think this is a big blow in terms of the future of computing. The actor model is so useful, and it's taken so long to come close to mainstream. And now the biggest implementation shoves a giant stick in its own spoke.