skysight-inc/HackerNews huggingface dataset:
I read through it all and multiple times I thought I was going crazy due to the constant repeating of the same answers and muddying of the water. From how they responded I was already ready to believe they should lose their CA status but this right here cinched it for me:

> MsgSafe offered this app (with the malware SDK) to the public via the Google Play store as part of a public beta, where it was free for anyone to download up until earlier this year. MsgSafe publicized its mobile app on social media. As of this writing, MsgSafe's website still links to the Google Play store (though the app was removed earlier this year):

>> This is not correct. The MsgSafe.io beta app was actually a testing beta, which could not be accessed by anyone via the Google Play store. The only way the app was accessible was to our employees or via a unique social media link MsgSafe.io sent out over 3 years ago, and that link only worked for a limited time. Using that unique social media link, we can tell that less than 1/10th of 1% of MsgSafe.io's users would have had the opportunity to download to test the app, and the actual number that installed it was much lower. Also, your statement about the MsgSafe.io website still linking to the Google play store is completely false. Did you even check this before making this post? In the screen-shot you shared, the icon labeled "Download on Google Play" does not direct you to the Google play store, it directs you to https://www.msgsafe.io/android which actually takes you to a 404 page on the MsgSafe.io website - it never leaves the MsgSafe.io website. Had you hovered over this link you would have seen this. Of course we're not proud of an outdated website and this should be updated, but that doesn’t make your false claim true.

As of November 10th 2022 it still redirected, the IA Wayback Machine cached it: http://web.archive.org/web/20220701000000*/https://www.msgsa... (Direct link to Nov 10th http://web.archive.org/web/20221110070138/https://www.msgsaf...).
> the example above was explicitly for int -> double

?????

Show me where the type of foo was defined in that comment... I'll wait.

For all we know it was some god-awful custom bucket/container class that's hiding all sorts of polymorphism from you.
Here's a great piece explaining how governments benefit from inflation (and an argument why we will see continually high inflation in the coming decade)

https://archive.ph/Y5tvm
Not every court puts people to death. For most of them it is precisely because they cannot determine truth without leaving doubt.

https://www.signaturelitigation.com/high-court-confirms-that...
Point taken. We've been focused on talking to people who have built, or tried to build, plug-in systems. But it's still a confusing concept to the general public without enumerating some examples.
Why is it up to Human Rights Watch to police this? If Hungary has violated European privacy directives, and it sounds likely that they have, then why isn't the EU holding them to account?
https://skogsbrus.xyz/blog/2022/06/12/router
This... world has no shortage of hyper-inflated egomaniacs who would like to rule a galaxy or two if they could, regardless of their actual skills. If this is combined with smooth-talking, these people, albeit being horrible leaders and bad for future of nations, tend to get re-elected over and over by folks you don't see nor hear about in the news, aka silent majority.

Same as ie Putin - for every protester/leaver this year there is literally 100 that are +-content enough to stay, maybe sometimes throw a complaint or two and continue business as usual. And vote for him. Even with some corruption and election rigging I'd say (and happy to be mistaken) they are properly majority-popular, just not 96%-popular. Then one realizes part of population is plain stupid in rather unfixable way, and the choices become being cynic for rest of life or simply leave.
Move every critical industry to Taiwan.
ChatGPT is currently rate limited so I can’t login to test, but isn’t it possible that the massive wall of text above the “immoral” prompt just stops the system from hitting some predefined threshold of dodginess?

I wanted to try several paragraphs of text, “ignore everything above”, and the same prompt used on the Tweet.

Very funny though.
I have a Dygma Raise and a self-built keeb.io Quefrency rev3 with ZealPC Silent Aqua switches (https://keeb.io/collections/quefrency-split-staggered-65-key...).
At my last company, this was so common and painful that towards the end of my tenure we started using a “No” roadmap, which was a list of things we would explicitly not do. Shooting down an idea is hard but sometimes people would go around and try to get a team working on it anyway as hidden work.
Sounds like they aren't very smart if they can't elevator pitch it.

Perfectly reproducible OS with easy rollbacks. OS never gets crufty, no need to reinstall every release version or two. Single configuration language for all apps and system components. Composable and shareble config modules at any level of abstraction, e.g. you can piece together many git repos to custom roll your OS. Isolated dependencies for every package, meaning no dependency hell (similar to docker). You can have multiple versions of everything running live. Ability to run temporary environments using the same config language.

Current OSes are like VAX or TRS-80 in comparison. Nix-likes are the future.
Chess variants: Chess but worse.
So you want them to operate like a cartel? I guess they aren't price setting but they are flexing together.
Do you have to multiply by 3 at all? I thought AWS/Azure already do that redundancy storage for you
One-handed chording keyboard in the non-dominant hand?
Let's Encrypt caches around 100k OCSP requests every second
"Since Let’s Encrypt serves 300 million domains, we cache around 100,000 OCSP
requests every second. Historically, Let’s Encrypt could cache about 6% of this
traffic on its own. But were we to experience traffic much higher than that, we’d
risk Let’s Encrypt falling over. Not an ideal situation for us, or the Internet."

https://www.abetterinternet.org/documents/2022-ISRG-Annual-Report.pdf
> I disagree with their statement that individual developers do not pay for tools.

They were a VC backed start-up and it was indeed go big or go home for them.

As they seem to have identified, enterprise sales is one way to go big. Timing is also crucial. Right now, by iterating relentlessly over a decade on just the models, OpenAI and Cohere have commoditized access to the AI itself via APIs: Perhaps a better go-to-market than Kite's which had to build both the AI (ex: OpenAI Codex) and the end-product (ex: GitHub Copilot).

Even though they had 8 years to execute, they had zero leverage on the kind of network effects and developer mindshare that GitHub has or access to bottomless funding like OpenAI. Hindsight is 20:20.
I do see the point of adding more entropy, but against what type of attacker is the rotating password an improvement?

It seems to kick the attacker out of getting future database updates after a point-in-time compromise, but do users using a password manager frequently change their passwords stored in it? At least I don't.
I guess it depends what fabs you build but we have seen very large numbers of manufacturers desperate for components. A fab anywhere in Europe could easily supply any factories in Europe so there should be demand.

On the other hand, if people are trying to build the cutting-edge, there might not be as much local demand since it is probably only needed for the latest IT equipment, most of which is built in the Far East.
Most buyers are simply not savvy enough to pick the most effective hosting. I worked for a small e-commerce operation years ago, they had essentially no technical expertise in-house, but they knew their products and their market. Odds are very low that their VPS arrangement was optimal but how would they know? As long as the site stayed up and the orders came in.
"by the time something is big enough that someone feels like they need to notify me, my first options of mitigation have already passed"

That's a communication issue which managers believe is rooted from remote work. I'm on the other end of your example, and there's a reason why people aren't telling you problems immediately, perhaps reflect on that.
Some packages won't work when installed via pip though, psycopg2 for instance.
The argument that users should have the option to control their own phone (which perhaps only a small fraction of users would select) seems pretty reasonable, but what if it less about Apple execs being control freaks, and more about support costs. I can certainly imagine that if even less than 1% of Apple users exercised the option to escape from Apple control, that small fraction could have support costs that quickly matched the support costs of the 99% that stayed in the garden. So perhaps Apple could a more-unlocked iPhone that enabled more user control, but cost 2 - 3X as much as the "locked" version. My guess is that even with a 50% surcharge, which would be unlikely to cover additional costs, it probably would not sell.
Yeah man Julia's correctness is horrible isn't it? ASML uses Julia for real-time modelling in their photolithography machines, and Stanford's robotics group also uses it for real-time control, however these people are amateurs! On the other hand, patrick451's crud app has a higher standard of correctness!

Stop believing everything you read.
> That instead of one poorly managed understaffed silo full of trolls and abusers you have 2000 poorly managed, even more understaffed systems with 2000 different approaches to moderation and content doesn't make anything easier or fixed for people who use Twitter today.

But it would effectively kill the various cat-and-mouse gaming of the entire system by spammers, scammers, and sub-nation-state adversaries.
These are all international companies. Ford of Canada builds in Canada. GM of Canada builds in Canada. Honda US builds in the US.

It's incredibly provincial to think of multinational companies so simply.
If I want to make all software programmable, I install Frida and easily hook into pretty much anything at the same privilege level.

Still, misleading headline aside, this sounds pretty cool as a reasonably well sandboxed plug-in architecture for software that chooses to use it.

Though if running in-process, it seems unlikely to be able to defend against hostile plugins that use e.g. speculative execution techniques to extract otherwise inaccessible data. But perhaps that's not the threat model here.
> "I don't want to WFH because..." Ok, sure, but nobody is trying to force you to.

The correct phrasing is probably "I would rather not work with a mix of remote co-workers". Which is very different, though I'd argue still a perfectly reasonable preference!
The rejection, in the end, was because "it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware", as Kathleen puts it. I read through all of Rachel's walls of text, and nothing there dispels the referred-to connection.

And it seems like Mozilla's concern is: "Is it in Mozilla's users interest to have this CA in their trust store?", which is probably the only sane way to run a trust root program. That means any concerns about the well-being of the company which runs the CA must be ignored.
So, it's going to become more and more like Facebook.
https://www.youtube.com/watch?v=VMzmW9XULHM

History repeats itself, or perhaps it never ended, or rather it already ended
Or yet another possibility is “simply” meant that the concept of people dying earlier than they otherwise would have is just an easy to grep concept most laymen can understand and thus a simple concept to discuss. If only.

This is a leaky medium for communication. It’s fast and casual and only text. Over analyzing each word is fine, but if you don’t like the word choice just move on. Trying to educate people to communicate how you want them to is a losing battle.

Also this node of the conversation is about data and analytics and now pedantry more than the underlying topic of death.
Bret Taylor out as co-CEO of Salesforce
There's 0 chance that Twitter pays anything close to AWS's public pricing, even their published volume discount rates are likely far higher. There's a point where back-of-the-envelope calculations cease being useful... estimating volume here is one thing, but cost is just too abstract at this scale without inside info.
Google Fi Messages uses push notifications and it's one of the few things that makes me really, really wish iPadOS had web push support. (I already have a SIM in my iPad, I just need to use a webapp to text or call.)

Otherwise, completely agree. I've already had to clean out notification permissions from multiple people who were getting insidious amounts of web push spam. Nobody knows how to manage their notification permissions on Chrome, and web push popups themselves aren't great at telling you how to disable unwanted ones. I suppose this is why every hostile ad site begs you for web push permissions nowadays.

Related gripe: websites that ask for location before you even have a chance to know why they need it.
Not wasting time with claims would be another very practical advantage.

A further variant for fairness purposes: let each player bring their preferred chess engine, instead of arguing about the choice of only one; and have each player run both engines for mutual anti-cheating verification.
Then either the two engines agree on the best move (likely case if they are both strong) or all moves that either engine considers better than the other engine's best move (at least 2, usually not too many) can be interdicted.
https://blog.youtube/press/ says that they ingest 500 hours of video every minute.

It seems pretty unlikely that twitter is ingesting 15M videos a day. That would mean that they are ingesting (15 million * max video length of 2.3 minutes) / (1440 minutes per day) = 400 hours of video every minute.

Given Twitter's video length limit it suggests that more people are uploading videos to Twitter than are to YouTube which seems unlikely.
The token could be made only usable by the cli process that asked for it (should be really).
actually the 100% thing only works if you also apply it to the html element too (I believe). and that's kind of the problem, 100% refers to the height of the parent. so if you want to have an element that isn't the body fill up at least the entire viewport, you have to apply this to every parent element as well, which can be very annoying depending on the situation. of course what you end up doing is just using 100vh anyway, since you never want there to be a horizontal scrollbar anyway
you're small enough that you can't get away with wasting money on lavish expenses and executives retaining their power.
Higher interests or not the pressure to deliver value and growth every quarter has always been present. In tech especially as we're seen as a hypergrowth model and not growing quickly every quarter is a sign of failure to the expectations of the market™.

I've been working in this industry for 18 years, in different countries with different central banks rates and macroeconomics conditions, it's always been the exact same.
If I could add one thing to the list I would include `cib` as equivilent to `ci(` for changing everything in a set of parentheses (or brackets for the mnemonic's sake). For me at least the `b` is easier to reach than the `(`.

I need to use `z` for refocusing more
Given that the chipmaking process is quite water intensive and Arizona is a literal desert in the midst of a major drought maybe this wasn't the best possible US location for the fab?
Actually, I'm going to add to my earlier reply here.

The amount of harm "security" people have wrought to everyone else around them is astronomical.

I don't doubt your cloud provider made that decision, it's yet another example of security people forcing major inconveniences on everyone else in the name of protecting them. It might even be warranted here (it probably is), but I would almost put money on 85-90% of terrible situations in software dev having a root in a security person somewhere. That sounds outlandish, yet it completely matches my experience.
Understandable you don't want to go to the press, but I and other Canadian HNers would love to see the exchange you had with our privacy office. Between that and the ArriveCAN contract, I think the people deserve some concrete answers behind some of the decisions our federal government made.
1.e4 may well be the best move, 1.e3 is a lot safer.

Edit: I didn't read the fine print. First moves are exempt.
> This has never happened on Android.

>When Fortnite launched on mobile in 2018, Epic Games very notably sidestepped the Google Play Store and pushed users to download the title directly from their website, an effort made to avoid the substantial revenue cuts that Google takes from in-app purchases of Play Store downloads. At the time, the move was understandable for Epic, which was sitting on the hottest free-to-play game of the year that was pulling in substantial revenues from in-app purchases.

Google proceeded to try to scare users away from sideloading Epic's app, and Epic sued.

>“Google puts software downloadable outside of Google Play at a disadvantage, through technical and business measures such as scary, repetitive security pop-ups for downloaded and updated software, restrictive manufacturer and carrier agreements and dealings, Google public relations characterizing third party software sources as malware, and new efforts such as Google Play Protect to outright block software obtained outside the Google Play store,” an Epic Games spokesperson said in a statement. “Because of this, we’ve launched Fortnite for Android on the Google Play Store.”

https://techcrunch.com/2020/04/21/epic-games-launches-fortni...
How are you managing the VM’s on NixOS?

A couple years ago I was searching for a good way to declaratively manage them, and the best I came up with was libvirt + terraform + nixos-generators for images. It feels like you should just be able to set them up as systemd units, but I couldn’t figure it out.

microvm has caught my eye recently but I haven’t played with it yet: https://github.com/astro/microvm.nix
It’s not even the “politics” of academia. Publications are what bring in grant money and prestige. Grant money brings in overhead (a cut that the university keeps instead of the researcher) and prestige brings in donations. So it is the economics of it.
> As others have said, the term "software" is confusing. Application or software product seem more apt.

That's a great suggestion thanks!

> To me that seems true in so far as the untrusted code cannot break out and can only do actions the hosting app decides to allow, but this isn't much consolation if the app allows actions that can be subverted.

Yes i think safe is a relative term here. Any user input is "unsafe" to some degree. Your example is a good one! I think we wrote this in the context of other relative ways to do this but will be discussing better ways to talk about security and what Extism protects and what it doesn't.
This looks like a PR piece disguised as an engineering post.
How do I install that microG thing in a Huawei Mate 50? Oh wait, I can't.
It was a motorcycle accident, and it was later removed from the list:

https://www.fox35orlando.com/news/fox-35-investigates-questi...
macOS&#x27; iCloud Keychain syncing of WiFi networks a security risk
I didn't realize it would be interpreted as an ontological statement about humanity.

I'm referring to an old dictum of politeness: "If you don't have anything nice to say, don't say anything at all." People breaking that rule are being impolite.

I apologize that I wrote that in a confusing way by referring to them as "impolite people". It was intended as a more instrumental observation: in that instance, they are being impolite (at least by that particular rule, which is of course itself not universally accepted). It was not intended to make a categorical statement about them, but it clearly read that way.
Thank you!

Go makes it ridiculously easy:

GOOS=js GOARCH=wasm go build -o web/game.wasm
> And what do you know about that certificate? That some root CA signed it. Do they follow a proper process?

The purpose of m.d.s.policy, the discussion group where the decision to distrust Trustcor was made, is to oversee these root CAs. As part of that, we require them to use at least one of the Ten Blessed Methods (there aren't actually currently ten of them) to decide whether a subscriber is entitled to certificates for particular DNS names.

You can read in the CAB BRs https://cabforum.org/baseline-requirements-documents/ what the currently allowed Blessed Methods are in section 3.2.2.4 Validation of Domain Authorization or Control -- each method is numbered e.g. 3.2.2.4.19 is the most often used Let's Encrypt (ACME standard) web site authentication.

You can also read in the CA's own documentation how they claim to implement one or more of the Blessed Methods, for example Let's Encrypt offer 3.2.2.4.19 and explain that, but they don't offer say 3.2.2.14 which is sending out emails with a magic random number in them to a domain contact's email address.
Partly as leverage in other negotiations, but there was definitely a price where I would have accepted, and they came close to it. I was tempted.
How to figure out a career change
Open AI VPT Minecraft
It was an offer.
I got bit by this myself not too long ago; glad to see it getting some traction from someone at Apple, even though it's from the totally wrong department.
>Apple spent something like a half-trillion on share buybacks. They could have averted this crisis a decade ago by thinking strategically.

I don't understand the fixation on this. Share buybacks strengthen the stock price of the company, which the company can leverage in the future to raise more capital if needed (by re-releasing new shares to the market). From that perspective, they are better than dividends.

Besides, right now, Apple isn't strapped for cash as they have around ~50 billion on-hand and could raise more if they wanted to. So Apple can still invest more in fab processes if that's what they want.
> Plug-in systems make your software programmable by end users (such as your customers or your open source community)

I am confused. Who is the "end user" or the "customer?
It seems like "developer" who is writing software for a customer is your end user or may be not. Who will actually use this is not clear from the website.

From couple of examples I think this comes close to something like a SQL CLR integration, where for example you can call a C# routine from SQL query.

https://learn.microsoft.com/en-us/dotnet/framework/data/adon...
I’m not a cryptographer yet.

What make it “post quantum”?

Isn’t all symmetric encryption pretty quantum resistant?

(Including one time pads, AES, etc?)
You can install all the usual software from the Fedora repos, but you need to do a reboot before you can use it. See the Package Layering section here: https://docs.fedoraproject.org/en-US/fedora-silverblue/getti...
That page is missing the opengl drivers which you also most likely want in the 32 bit variant.
Machine-Learning Model Reveals Protein-Folding Physics
Replication between Firestore and a local RxDB Database
Zero Configuration Build Tool
I've had thoughts of a project for making my TV smart but never got started on it.

I think developing a ML vision model for detecting commercials during sporting events or detecting YouTube ads and when the skip ads button appears would be a fun and not too complicated project.

But connecting it to hardware with an infrared remote seemed significantly harder and this project confirms my worry.

It might still be possible in software with a software Roku remote, I briefly looked into what it takes to write apps on there and was able to control my Roku over WiFi. But would be nice to not have to depend on it.