skysight-inc/HackerNews huggingface dataset:
Congrats on topping HN with your blog's first post, lol.

This is something I actually worry about future generations missing. My core love of computers came from being able to tamper with them. Being able to poke around in the operating system, figure out how to do neat things, etc.

Today, students are given either an iPad or a Chromebook, and generally locked into using some horrific privacy nightmare like Gmail, and have very little ability to actually experiment with computers.

I suppose this means we have better security, but people like me born more recently may not end up in the field because of it.
GPT and other similar technology will be the new IDE soon. Command line gpt tools are already out there and they will write bash scripts in seconds.
Rosetta Stone only works well with romance languages. Anything with alien grammar isn't going to be picked up without some explanation.
How good is browser addon in comparison to lastpass? This and vaultwarden being mature enough might be final push to make us move
> the chore of writing code

It's only a chore when you can't envision the end result when everything falls into place and everything just works with zero/minimal bugs and the program behaves just as you imagined. This is the payoff moment we all should anticipate when coding, not seeing it as a 'chore' but as a sort of delayed gratification exercise where we reap what we sow.
Just curious: Imagine two people took the 1Password white paper and created two separate implementations. The only information you have on the two implementations is the background of the people who implemented them. One is a first year CS student; the other is a seasoned security researcher with multiple published vulnerability discoveries. Which would you choose and why?
With some effort they're close to ChatGPT in terms of quality. More of one off input output as opposed to a conversation though.
That's why I added --explain, so no matter what it is perfectly clear what the suggested command will do.
> 2. It offers me to extend pro support 5 years after I stopped paying for it. What I need to do for it to stop ffs.

Simply stop using LP and it should stop;P
It's writing. A text file. Archive it yourself.

Or do you mean archive it but leave it visible? That seems to not be the point of the website.
> Sure it is: an appeal to authority is not a valid step in a deductive logical argument

Technically, unless you reinvented logic on your own, this in an argument of authority with extra steps.
Ricky Gates did a similar project in San Francisco in 45 days. http://www.rickeygates.com/everysinglestreet

During the start of covid I tried to walk every street within a distance of my house, since it started from home and it was more about seeing what was near me the range became more arbitrary over time. Cool to see he stuck with this.
Yup, that's a fair criticism. Also feels kinda sorta true, given origin countries can revoke passports? But I'm not confident about how any of that works in practice.

Part of why I think the term "rights" is unhelpful, it comes with moral associations that makes people (me included) feel unclean when peering behind the metaphorical curtain and examining how such things function in practice.
As someone who lived in the Netherlands until 2018, I lived a very different experience than you. While those two models aren't perfect matches, they are quite familiar—at least in North and South Holland.

Rotterdam, The Hague, and Utrecht (ok, not Holland...) had mass amounts of people from surrounding villages (essentially suburbs) with longer commutes to work in the city (model 1). I knew several people who worked in these cities and had a daily commute of 40 to 60 minutes one way for university or work.

A lot of Amsterdam can be seen as a densely populated area facilitating moving people from residential areas to commercial for work (essentially model 2). It absolutely has a rush hour of people commuting from both the surrounding areas and different neighborhoods; this is seen in both car traffic, trams, taxis, and trains. Many other large cities in neighboring countries (e.g. Brussels) would also fit this description.

These might not be a 2-hour commutes, but it's far from living, working, and shopping in your neighborhood.
Pelé, who became the world’s greatest soccer player, dies at 82
> everyone who isn't them needs to butt. out.

Exceptions:

• if somebody asks for advice.

• if somebody mentions they're about to try an arsenic-, lead- and powdered asbestos-based nasal spray on their kid.

The capacity of the parents is also a bottleneck: time spent paying attention to your uninformed advice is time spent not paying attention to the child(ren). Unsolicited advice is not relaxing, and doesn't help put food on the table; it probably doesn't help.

Though, I think posting on an internet forum might fall into the "if they're asking for advice"; most people visiting such websites are there because they've looked something up, and they expect to be wading through anecdotes.
That's great news. Alzheimer's and dementia are so such terrifyingly difficult conditions to try and help someone with. Glad we're finding atleast some possibilities to help. Does anyone know of anything others like this?
> Personally, I could easily see switching away from Plex to Jellyfin or Enby, but I can't imagine switching back to a serverless media setup.

I do not understand that part: how is Jellyfin serverless?

I used to use Kodi for a few years and switched to Jellyfin because it is headless and allows me to playback on a web browser.
> good luck as an engineer explaining how and when exactly your investment in developer tooling is going to make the company $10M in Q2.

My experience is that most engineers don't try, because they don't tend to speak finance. A lot of developer tooling is roughly quantifiable; this tool saves X minutes while doing Y, do a little survey to see how often people do Y, multiply Y and X to get time saved per year. Divide X*Y by the number of work minutes in a year, and you have the number of man-years saved. Multiply that by the average salary of an engineer, and that's very roughly how much the dev tooling is "worth". It's not a precise answer, because 50 employees saving a couple hours of time a week isn't the same as having another employee, but it's a workable approximation.

> the solution was to invest in the problem proactively starting 2 years earlier, and now that you're so late it's going to take 4 years to solve the problem because you have to first deal with all the debt you accrued.

This can also be roughly quantified. Get rough numbers on the resources required to fix the problem now. Look at what's coming for the next year or two in terms of projects and infrastructure that will exacerbate the issue, figure up roughly how much effort it will take to fix those. Convert that effort number into salaries, and you have a rough idea of what the cost of delaying the fix is.

If you're worried about tech debt causing a catastrophic failure, figure out what that scenario looks like, calculate up the concrete costs of the failure (SLA violations, refunds, etc), then have another column for potential costs like regulatory fines, and a third column for things that have costs that the finance people are better suited to handle (what's the cost of reputation loss?). Again, it's unlikely to be completely accurate, but it gives you a data-based platform to speak from.

Even better is to engage the finance department to help draw up those numbers. Money is their forte, and calling them in to help with money questions is the same as calling in the frontend people to help with React or whatever.

I think sometimes we engineers spend too much time around other engineers and get too comfortable speaking in terms of engineering priorities. Those don't extrapolate; finance and legal don't give 2 shits about "flaky unit tests". We have to convert those engineering priorities into other teams' priorities if we want them to care. Finance cares about money, so rephrase the engineering problem into a money one. Legal cares about liability, so rephrase the problem into a liability.
When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astroturfing in this community. But 1Password claims are the same claims as LastPass used to have. (zero trust, secure, …) And now we're discovering that LastPass was totally lying. We have no way of knowing whether 1Password is telling the truth.

For me, my password manager is the one absolute thing I want to be auditable. 1Password with its follower "who know people who designed it" reminds me of "trust me bro", "funds are SAFU" in cryptocurrency projects. Leaving LastPass in order to sign up for 1Password feels like out of the pan into the fire.

I've always use and will always recommend FOSS for password manager. I install Bitwarden on my technology-illeterate friends and family and I use KeepassxXC personally. I've looked briefly how vaults are encrypted in both software. The security is sound. Bitwarden was audited by Cure53[1] which is one of my favourite security auditing firm. (I highly recommend to read their audit of dovecot[2])

Anyway, you know what they say "fool me once…". I'll be eating popcorn when some claim will turn out to be false for 1Password…

[1] https://cure53.de/pentest-report_bitwarden.pdf

[2] https://cure53.de/pentest-report_dovecot.pdf
Wondering how Enpass Performs
Similar story; bet with a friend to hack and change his password at university. Accidentally changing all user passwords to some profanity including his name, luckily didn’t get caught.
they don't know when it's going to be freed, but they do know when they're not going to need it anymore and can overwrite it exactly like in C. or am I missing something?
Now explain how it could affect Alzheimers
Have had the exact same experience. It’s been worth every penny!
I think the point the previous poster was trying to make is that people have wildly different personalities, and that any observation with a sample size of 2 is basically useless to draw any conclusions from.

I'll also add that different people respond very different to things; maybe for some babies sleep training might have long-term effects, and for some it doesn't. Certainly if I look at my own shitty childhood, me and my brother responded quite differently. He was affected much less than I was.
> Madison Avenue may disagree about the statement about creative people.

It was a joke :)

I don't think any reasonable person believes that NYC is devoid of good-looking and creative people.
Yes. There's a recent Not Just Bikes video[1] about third places (think UK pubs) and how they are largely missing the US and Canada. For more about the reason for that (Euclidean zoning), which is touched on in that video, this City Beautiful video is good [2]

[1] https://www.youtube.com/watch?v=VvdQ381K5xg&t=8s

[2] U.S. and European Zoning, Compared https://www.youtube.com/watch?v=WNe9C866I2s
I’d agree that ReDoS is a repeat offender in having overblown severity in vulnerability reports, and prototype pollution reports have contributed to a fair bit of noise when popping up in dev-tools and such, but prototype pollution can be quite significant.

Java has its “gadget chain” class of vulnerabilities, where the presence of certain jars can turn object deserialisation into RCEs. I’d argue that Javascript has “pollution gadgets”.

Some years ago I struggled making lodash – which almost any non-trivially sized Javascript project has at least a transitive dependency on (possibly multiple versions of) – fix its “gadget” in its template function. It’s since been patched, and the conversation unfortunately deleted - https://github.com/lodash/lodash/pull/4518

Here’s two real world examples of turning a prototype pollution into an RCE: https://hackerone.com/reports/852613 and https://hackerone.com/reports/861744

(If you’re unfamiliar with prototype pollution: This is possibly a security bug in Javascript: `obj[a][b] = c` if a user controls a, b and c.)
Here's what I'm going to try instead - beyond URLs:

Ask HN: Full-text browser history search forever?
https://news.ycombinator.com/item?id=30696451

I.e. store the full text content of the websites I visit, and easily search it.
That gives you a list of all the commands, no something short and sweet about exactly what the command you have written will do.

If --explain is part of the argument parser then it would be relatively easy to implement.
Can we not simply overwrite the the data when we're "done" with it and then not worry about when it's actually unallocated by the GC?
question for those who know: for those of us in apple ecosystem, is just relying on their keychain an acceptable alternative to a third-party password manager company?
> Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it.

If you are worried, you can store the password in a byte array and zero that out.

But further, a buffer overflow is practically impossible with a GCed language (especially a popular one). A programmer using a GCed language cannot write code which has a buffer overflow. That must come from a bug in the runtime itself. Not likely.

As far as I'm aware, every gced language has bounds checks on arrays. Certainly all the popular ones.

> the last thread dying will release the memory for this variable.

Really not how GCed languages work. Memory lifetime is not bound by thread lifetime except in the rare case when memory is bound to a thread (static/global variables).

The majority of GCs on the market are tracing collectors. Memory is periodically collected when it is not longer referenced (mark and sweep). What triggers that collection is a whole host of potentials interactions. How frequently and deep it runs also depends on a lot of application characteristics.
>What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag

How did you add the tag, or is it obvious in the UI? I've never used 1Password before but think I'm gonna land there instead of Bitwarden, and I like this idea.
I think employers should strive for flexibility. My employer allows full remote, but flies us in twice a year for what mostly boils down to “team building.” More local employees have the option to go into the office as much/little as they would like. It seems to be a good balance and I feel like I have decent relationship with the entire team even though I live across the country.
In retirement you either find a hobby or fade away.
On top of that, they’ve made their client software prettier and slower, but not really more usable IMHO. I migrated to BitWarden and don’t think the user experience is any worse.
I made these slides on Linux Terminal Tools that might also be handy alongside the book: https://github.com/ketancmaheshwari/lisa19/blob/master/LPT_L...
Everything sounds bad and there's nothing we can do about it
Do we think that mere inflammation-reduction alone is the explanation here?
Sometimes? Yeah. And random advice spamming doesn't help, and just makes it worse. MDs tend to be the worst at this, but there are exceptions.

However, sometimes the parents are doing things that are unintentionally dangerous, or are so sleep deprived and exhausted they're being abusive and can't process that and get themselves to a better place on their own.

It's more common than not, from what I've seen. As is denial and avoidance on the topic.

Ideally, they would have experienced parents who know them (grandparents) who would be intimately involved and give breaks, intervene in important situations, help them with known working parenting techniques in the situation, etc.

But 1) a lot of folks don't have grandparents who could positively contribute here no matter what anyway, and 2) socioeconomics means it's nearly impossible for this setup to coincide with HN demographics except for certain specific ethnicities, and 3) a lot of boomer parents - the demographics involved - are explicitly not interested in that kind of thing, and a lot of current folks in the child rearing age range have been left adrift with nothing but pop-sci articles to guide them.

It's a shitshow, but I guess that's always been the case.
Agreed! Kids vary significantly, and much advice I’ve read about sleep doesn’t apply to our kid.

You’ve just gotta do what is best for your family, not what is best for some internet stranger’s child.
I made my cash by flipping TSLA stock a while back. I wouldn't actually buy one as I don't believe in their product.
Right, I don't think we really disagree about anything. "That's an appeal to authority" is not a useful objection, because appealing to authority is often a great idea. "That's not a good authority" is a good objection and often very relevant.

It's sort of like seeing a lot of arguments that rely on false or misleading evidence and deciding that "appeal to evidence" is a fallacy. The choice of authority or evidence is the issue, not the act of appealing.
I’m glad you like SSSS! I’ve always loved it and was sad when it ended. Absolutely amazing art and story.
> When you need to support a claim, it can be tempting to support it with a statement from an authority figure. But if done improperly, this could be a logical fallacy—the appeal to authority fallacy.

The key words are: “if done improperly, this could be…” The article goes on the give non-fallacious examples of an appeal to authority. The quality of an implantation will be correlated to experience, so this is an example of a non-fallacious appeal to authority.
Most US zoning is pretty similar. There are exceptions like Houston, but by and large, zoning codes aren't that different from place to place. A lot of the model codes were derived from similar sources, IIRC

https://islandpress.org/books/arbitrary-lines has some good, if brief history of all of it.
https://github.com/bigscience-workshop/petals

Since my other account is shadow banned for some unexplained reason, I just wanted to mention the petal project. It's an attempt to bittorrent style distribute the load of running these large models. Good luck!
Not sure about 1Password, but I am using Bitwarden free and there's no authenticator app. I just use Authy on Android, though, it works great
I thought I read somewhere that it's easy to overdose on hydroxychloroquine? If so I'd be worried about a forgetful senior accidentally taking a double or triple dose.
Annoyed at... Google, rght? Because my older phones don't explode when they get relegated to being a Kodi remote, and this is 100% on Google.
Stock and futures markets market should be lower.
Well, those two aren't quite the same, otherwise they'd be adding them to EVERYTHING they make. I was reacting to the duplicity of claiming something was free of an ingredient that would never be present, where choosing to add an allergen because it's cheaper than paying to prove it isn't present is a perverse outcome of well-intentioned regulations + cut-throat corporations.
In a sense, this is a “process” film, devoted to the nuts and bolts of creation, and thus one of Cronenberg’s densest and most pedantic outings. Yet it’s somehow also among his most immediate works—a kind of intellectual road map for the contemplation of existential questions of such overwhelming scale and urgency that few artists dare to confront them so directly.

Does anyone know what a process film is, or what it means for a movie to be pedantic?

I can’t make heads or tails of this, but I’m glad (sincerely and unsarcastically) that Cronenberg is around to make movies for people who can!
And more “badass” to machine than 304, too. Not for amateurs or flimsy machines.
- Affinity Photo

- DTrace (surprisingly on Windows)
AB 2011 purports to address this. I don’t have confidence it will move the needle.
The arguments people are giving about being able to explicitly call `free` make a lot of sense to me for getting rid of some attack vectors, but it still seems like the security risks of using a memory-unsafe language would heavily outweigh the risks of the garbage collector not clearing strings fast enough?

I know that's not an either-or proposition, there are memory safe languages that aren't garbage collected. But if people aren't talking about those languages, if they're just bringing up C or something...

I am not an expert, I might not know what I'm talking about here at all -- but my instinct is that I would rather see security-critical code written in a garbage collected language than in C. Frankly, I don't trust developers not to make memory errors in C.

Maybe I'm underestimating the risk of the garbage collector not zeroing out variables? Or maybe I'm over-complicating it and the answer is just the obligatory "write it in Rust" refrain so you can avoid both problems?

But I'm also a little surprised to see this line, my impression was that security advice was starting to trend towards recommending GC languages, not away from them.
The Ghosts of Kennan
Brazilian soccer legend Pelé dies at 82
While you do disclaim that no stealing occurs when pirating at the start of your post, you do not internalize what that means throughout the rest of your comment. This is evident throughout the rest of your comment through your continued choice of using the word "take". No "taking" occurs by making a copy of a file.

Stealing is bad for a specific reason: it's a zero sum game. If you are to benefit from stealing somebody else has to lose something. Stealing is parasitism (benefiting while harming someone else) on other people / society. But if I could magically create a copy of something you own (e.g. your TV), and we both keep our own copy, there is nothing morally wrong with that, even if there are arbitrary laws that make it illegal.

Piracy is closer to the second case. Me making a copy of a file does not limit others from using that file. It is not a zero sum game. It's commensalism (benefiting without harming or benefiting anyone else), not parasitism. Morally it is at worst neutral.

Not to mention that copyright hasn't been a thing for the wast majority of human history and we did just fine. Standing up to arbitrary, unjust laws is a moral good.
> In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern

This is the key point. Properly implemented, you should feel very relaxed if your encrypted data is leaked.

I'm using BitWarden, but 1Password's "secret key" concept is smart, it means your data is still very secure even if your password sucks.
I began taking GIS seriously this year so QGIS, GDAL, Shapely + GEOS, PostGIS & Valhalla.

As for video editing, I'm using DiVinci Resolve for all my videos now.
I feel like you could probably roll your own decently well here with a scraper plus a topic modeling library.
You can with the JVM.

https://docs.oracle.com/javase/9/docs/api/java/lang/ref/Clea...

However, the issue isn't so much that doing that, rather it's that GC will potentially never collect the memory. In the JVM, the GC primarily runs when enough allocations happen. It's not on some timer.

So the concern would then be having a password sitting in memory for hours (or even days) on end.
Thanks for the product tip!

I bought a couple of multi-connector cables similar to the ones you have, but from a different manufacturer and no real specs on the packaging a couple of years ago.

They both charge whatever is connected extremely slowly, no matter what power supply or device. They can barely charge a phone overnight, and charging is so weak that if my phone is used while plugged in, battery net-drains instead of charging. Would've been better to buy cheap, separate charging cables and more power supplies to keep the different device-end connectors powered.

But to be fair, there were no specs when I bought them in a store, just claims that they can be used to charge different devices from USB, which they do, just surprisingly badly.