skysight-inc/HackerNews huggingface dataset:
Lately I feel like celebrity CEO & VCs (namely Elon Musk) are actively trolling workers. Emphasising that workers are inherently dead weight. I believe publicly stunt layoffs like Twitter have a far reaching negative impact on worker morale. Maybe in the short term you can use fear to squeeze out some overtime but ultimately I believe its creating dangerous worker/employer resentment.
PostgreSQL can create indexes on the results of expressions, so it's possible to accelerate queries that select against a nested value inside a JSON blob.
Uncorrected personality traits that seem whimsical in a child may prove to be ugly in a fully grown adult.
Ask HN: Is it still worth learning Kubernetes in 2023?
> I always thought the most important thing about home security alarms is calling the police

Having my house visited once while I was away and twice at night when I was there, I'm now prepared. The two times I was there, I make the bad guys run away but I still don't know if they knew I was there or not and what their plan was.

So now I take no risk and I've got an amazing alarm system.

To me the most important is that the alarm makes it physically impossible for the thieves to steal much. My alarm system gives the thieves 45 seconds to give a password (and they don't know it). If I'm under duress, there's a "I'm under duress" password and the security company will answer: "Fine, have a good night" while they actually call the police. So the thieves cannot know.

If no password is given, after 45 seconds a smoke fills the entire house. It already triggered, worked wonders. It leaves no trace once it dissipates.

With the smoke the thieves cannot steal anything. They certainly don't have the time to find the safe / open it.

The game becomes: "Without seeing anything (due to the smoke), find the door to flee the house before the police arrives".

That's what I love with this alarm system: it turns the thieves into preys.

It's communicating over several channels (as an anti-jamming system). It's got its own battery.

It also detect break-ins attempts, before the thieves are even in: the sensors detect the vibrations and it works (one day I let my hammer drop and that was sufficient to trigger one of the sensor).
> That make no sense. Those are big and doesn't fit all purposes.

It makes sense because Wayland was invented for the purpose of forcing hobbyists and power users into ecosystems that are 100% corporate controlled.
> Downsides? Dependency managment, tooling, speed

What's wrong with its tooling?
I might be wrong but it seems a little suspect to call Ia64 superscalar because of that. When I hear superscalar, I generally expect to see a processor dynamically checking data dependencies at runtime, and perhaps executing multiple instructions depending on those data dependencies. With out of order execution added on top, I'd additionally expect to see a structure like a reorder buffer to allow results to be written to RAM in the same order as the logical execution.

I think that encoding the parallelism into the instructions would generally not be considered as superscalar, it's an entirely different technique. Most texts I've read would explicitly separate out VLIW and EPIC from superscalar processors. There are plenty of ways of getting parallelism - for example one could probably view SIMD or even some CISC instructions as a form of this - as far as I know, VLIW and superscalar processors are just considered different from this perspective.
The negligent part is relying on npm. If you want reliability then pay for it. Corporations crying about morality is just a smokescreen for them to avoid paying.
The funny thing is, I work in finance and see these decisions up close.

The owners explaining their decisons to me while keeping a straight face.

Make no mistake, owners (no matter how progressive, with very few exceptions) will screw you over if it improves the bottom line or their remuneration.

It's one of the worst aspects of my role. Owners straight up lying to my face about why they do things.
Yeah, I feel spoiled by all the AI products that have come out in the past year. This one is underwhelming.
Much of that EUR/USD value loss was actually USD rising a lot compared to many other currencies.

Look at the US Dollar index, which compares it to a basket of 6 other globally influental currencies: https://finance.yahoo.com/quote/DX-Y.NYB?guccounter=1

This happened primarily due to the quick rise in US interest rates, making USD more attractive to hold.

Additionally, Euro slid down due to the energy crisis and a war on the EU's doorstep, not because Euro as a concept doesn't work.
> That's not what your quote says.

Yes it does. "No defined semantics" = "out of spec".

> I can roll out a service with endpoints that require GET with request bodies and it would still be valid HTTP.

You're out of the HTTP spec entirely.
Alex Birsan actually published his findings for this vulnerability in Feb 2021 [1], and collected a bunch of bug bounties from various companies (Apple, Microsoft, Paypal, Yelp, Tesla, Shopify, Uber, Netflix).

He was able to steal packages names for Python (PyPi), JS (npm), Ruby (Gem), where these various companies have their own private package repositories with private modules where they don't control the package names in the default repositories.

The main requirements for this attack are

1. Having private repositories, where the package names in the default repositories is not owned by the owner of the package.

2. Package manager allows downloading packages from multiple repositories (the default and private repositories) without being able to pin specific package to only be downloaded from the private repositories.

What's notable on his findings is the omission of Facebook and Google,
which I believe due to their usage of Buck/Bazel and monorepos for their internal codes.
Another thing to note was that Alex mainly target companies internal private packages,
while this particular instance affects an open source project which was providing package on their own repository and make use of a package (which I was not able to find any bug bounty program for).

There's another post by Kjäll et.al [2] that explains how this particular vulnerabilities affects other package managers (PHP, Java, .Net, ObjC/Swift, Docker), in what conditions it's vulnerable, and how to mitigate the risk.
Two notable language package managers that were not affected are

1. Rust, mainly because you have to explicitly select the private registry for each private packages.

2. Go, mentioned as unlikely, due to the use of FQDNs in the package names and hash verification by default.

I think anyone adding non default package repositories or providing one (their own private repo in enterprise setup, or 3rd party provided repositories), need to be aware of this particular class of vulnerability, and implement policy to mitigate it.
I would say, individual devs installing on their dev machines or CI/CD systems based on shell commands (rather than secured package manager setup) would be the main area of attacks mainly due to the relative difficulty of auditing those scenarios.

[1]. https://medium.com/@alex.birsan/dependency-confusion-4a5d60f...

[2]. https://schibsted.com/blog/dependency-confusion-how-we-prote...
Funny to hear this sentiment in a tech forum. If you do well in a programming career you can afford a house almost anywhere. I don't think you need to work more than 40h a week to achieve that either.
you haven't seen enough scandi noir films...
No. There are absolutely no problems with providing accidental native context menu elements or integration with menubar, etc.

BTW, I just tried this app on Android, it is broken, it is simply showing white blank screen. And on macOS, and it asks $90 a year for basic markdown features. Just no.

And then, there is this.

https://standardnotes.com/principles#negativity

https://standardnotes.com/longevity

We are complexity bigots. We don’t merely hate complexity in software—we detest it.

This is literally contradicting the technology stack that they chose.

In the end, it seems to me like a low effort, money making enterprise with some sprinkles and wishful thinking.
Best thing to do is cancel prime, it's a low key scam.

It's a joke. It's number one reason for existing is to ship products to you next day, it's a next day delivery service but now they take a week and they have increased the price not lowered it, because Amazon knows people are sheep and they are used to it now, they don't need to win new customers, they can simply lower the service and increase prices which equals more profits.

All the other services Amazon give you with prime are complete junk, they attach a bunch of extremely low quality services onto prime that have nothing to do with online shopping and are much worse than any alternative in order to make it feel like it's worth it.
It's great, you don't need to make it better. I was just saying you should lead with the open source aspect in your marketing / landing page.
> Food production (farming

You have obviously lived in cities your entire life.

Farms fail all the time. Ask any banker at a branch in an agricultural area.
This could be a good place https://create.t3.gg (understanding all the code generation would be useful, but also you can deep dive into any one of the type safe libraries).
The first hit I got from that search URL was of severe prison terms to people caught cheating on a national exam in a huge country. (Meanwhile, I read of rampant cheating by US college students, and professors bemoaning that administration won't even punish caught students.)

Also, I wouldn't know what to make of all the search hits I might read, especially since presumably there's cultural context I don't understand.

If you work with engineers from China, I suspect you'll notice many favorable qualities. Maybe including an implicit "No Jerks policy" (in American tech company terms).

You'll also notice that they're all distinct individuals (in American terms), and though it might be human to prejudge groups/labels of others, that's not fair to individuals, and we strive to be better than that.
No! The Wayland protocol provides no mechanisms for screen sharing and it is not intended that it ever will. Screen sharing has to be done by external protocols that are either compositor specific or using a somewhat standardized dbus protocol that is completely separate from Wayland.
Well, if it were in the same state as C++, that means it manages to let you get things right despite the historical baggage by embracing newer features in the standard.
> I'm not sure I follow.

They're saying that blocking UDP entirely is a very effective (and cheap) mitigation of DDOS.

Because QUIC is built on UDP, however, you can't just block it, you have to ingest it and dedicate resources to filtering between QUIC and other UDP traffic.
I do not buy the power argument. A modern chip is orders of magnitude more power efficient, especially at low voltage. You could easily have multiples of these within the same power budget.
SCNR https://youtu.be/WXhogm1C23Q

Happy new year to all of you. Live healthy and prosperous.
« provenance » would be a more accurate name than « supply », as it englobes both software that’s actually supplied, and software available « as is » that’s being picked up.
If you only have a single application in front of it, that's a valid approach. If you have multiple applications- maybe a separate reporting tool, for example- you now have the problem of maintaining and invalidating multiple caches.

Much easier to keep the cache located with the data since the cache changes when the data does.
> And if you look at Eurostat stats Eurozone countries have consistently lower GDP growth and higher unemployment than countries not in Eurozone.

Sorry but "if you look at Eurostat stats Eurozone countries" is not going to cut it as a source when you make such bold claims.

Playing around with World Bank data, you can see that out of a selection of non-Eurozone countries (Czechia, Serbia, Albania, Bulgaria, Romania), and Eurozone countries (Estonia, Slovakia, Lithuania, Slovenia, Latvia), and checking their PPP GDP per capita growth, it's a complete mixed bag. The only cluster that emerges is non-EU, non-Eurozone countries doing significantly worse than EU countries:

https://data.worldbank.org/indicator/NY.GDP.PCAP.PP.CD?end=2...

Very similar story about reported unemployment rates with the same selection:

https://data.worldbank.org/indicator/SL.UEM.TOTL.NE.ZS?end=2...
I just realized you may not know of all the different Gregorian calendar adoption dates:

https://en.m.wikipedia.org/wiki/List_of_adoption_dates_of_th...
> It will be years before I have the same experience watching sports on a streaming service as on digital cable

The experience watching sports on a streaming service is much better. You can see all games, you can make choices (commentary on/off) in how you see them. I watch a few different football (soccer) leagues, and by far the best experience is Ligue 1 on Amazon Prime. All the others it's a crapshoot if the broadcaster has chosen to broadcast the particular match I'm interested in, and in some cases the commentators are just painfully dumb and I'd love to be able to listen the game's noise without theirs.
$ python -m http.server

then connect to :8000
I wish Postgres had something like a "CHECK contraint" on a foreign key.

There is a hack of sorts. You create a duplicate of the primary key column, named e.g. id_active. You create a CHECK constraint which says something like "(status = 'Deleted' AND id_Active IS NULL) OR (status <> 'Deleted' AND id_active = id)". You create a unique index on "id_active", and point your foreign key to that. When you create a record, populate both id and id_active to same value; when you soft-delete it, set id_active to NULL. Actually, maybe a simpler solution is to make id_active a "GENERATED ALWAYS AS ... STORED" column–although I'm not sure if Postgres supports them for foreign keys? That's a relatively new Postgres feature and I haven't done much yet with the more recent versions in which that feature was added.
I think saying it "doesn't address" these threats is a bit extreme.

It significantly reduces the attack surface (Certificate Authorities vs every ISP), it makes it a lot harder for state actors to pull off those attacks deniably with a gag order, and it makes it a lot easier for an informed but non-expert consumer to pick a secure-by-default solution.
Don't really understand the purpose of this question. If you want it, you want it. If you don't, you don't.
Maybe they are just less ambitious about promotion within, and plan on leaving the company for any upward mobility.
“Workers unwilling to work hard at types of places where bosses willing to go talk to a national newspaper about how lazy their employees are” is my preferred headline.
I pretty much never use the HN website, fwiw. The UX is worse than the iOS app Hack.

I’d hate to use a web app for maps, notes, document writing, IDE, messaging, etc. I always prefer a good native app to a good website.
You are misunderstanding what immutable infrastructure is. You don't buy some SSD with a preinstalled OS and use it as it is for 10 years.

The point is in not making changes on the fly on live systems. You are perfectly able (and encouraged) to deploy new nodes with updated software and roll over the old nodes.
This book gave me a good push in the right direction when I was in the same situation as you many years ago. It gave me the tools I needed, and it is still very relevant today. "old but not obsolete" as they say in the terminator movie.

https://en.wikipedia.org/wiki/Code_Complete
he just deleted his package, where he screw them?
Which office do you work at?

And why would believing a random comment from someone who doesn’t even share which office they’re talking about be smarter?

Especially when we know for a fact that Twitternisnt paying its office rent and has fired its janitorial staff in at least 1 office?
Such stark difference in performance is really fishy and needs a deeper analysis. I just checked it with different compilers (all based on LLVM) and here are the results:

rustc 1.58 (LLVM 13): By-Copy: 10804, By-Borrow: 7198
rustc 1.64 (LLVM 14): By-Copy: 7385, By-Borrow: 7328
rustc 1.66 (LLVM 15): By-Copy: 2667, By-Borrow: 2777
clang++ (LLVM 14): By-Copy: 2439, By-Ref: 2589
clang++ (LLVM 15): By-Copy: 2473, By-Ref: 2556

When compared with the same LLVM version clang much better utilised LLVM-14 than rustc - C++ is 3x faster. With LLVM-15 they are much closer.
> Can you give some examples of such a pure language?

BPF and eBPF, though this feels unsatisfying.
New OSS Security Projects: cnquery and cnspec
Honestly, these days I'm doing closer to 20 hours of real work and that's fine in most gigs.
> Every application deals with some amount of sluggishness. Performance is not a mobile app only problem, it's not a new thing and it's not entirely clear, when it's going to be a big problem and when people will be okay with it.

So we're just throwing our hands up now and saying it's inevitable that a a notes app is just going to be slow? (In 2023!)

We are lost.

"Thou hast strayed far from the path of the Avatar. Seek now to renew a life of Virtue, lest thy soul pass finally beyond my reach!"
Those who want those protections can effectively already have them, but convenience (and modern CI/CD tooling) dictates that they will either be disabled or ignored completely.

If you try to fix a problem at the wrong layer all you will end up doing is create a bunch of false positives which will result in those protections being disabled. Then, by the time you need them they will no longer be active. A problem like this should be dealt with as close to the source as possible. A defense-in-depth strategy is a sound one but only if it does not add burdens that will lead to the defenses being disarmed in peaceful times.

Finally, I fail to see which finer grained permission would have stopped this, though maybe someone can make some suggestions. Not allowing the use of Node, Python, Go or Rust would seem to be a bit harsh and nothing short of that would seem to solve the problem without the OS having to gain massive awareness of what is going on at the application level.

Microsoft effectively fell for this by dragging everything and the kitchensink into the operating system layer, the only result of that was an even larger attack surface at a level where it mattered even more.

This is not an easy problem to solve. For starters you would have to review the way all of these dependency resolution mechanisms work and flag the ones that you think contain risk. Then you need to get the suppliers of those systems - and others like it - to agree on a standardized way of vetting the import process and finally you would have to make the OS aware of a set of signatures or certificates that would stop such an attack in its tracks.

The alternatives are doing away with easy dependency resolution or taking charge of the root cause and fixing it: the admission that decentralized source code control is a great thing to have but unsuitable for the distribution of packages for immediate introduction to production systems based on the say so of whoever controls the namespaces. The kind of centralized control that would require is something that the likes of Apple and Microsoft can provide, no Linux distribution is dominant enough to be able to solve this (nor are they wealthy enough). Distros have a hard enough time vetting their own output.
Searched nginx source. Seems like it's using aio_read() aio_write()

./src/os/unix/ngx_file_aio_read.c

API's doc
https://man7.org/linux/man-pages/man3/aio_read.3.html

Even though the source is there don't mean it's compiled or used though. Might or might not be. No idea about the details.
>Some devices coming out now from Google, etc. are IPv6-only and do not support 6rd tunnels at all.

I find this very, very hard to believe. I haven't found anything online. Can you give me some pointers?

>Possible further benefit, reaching India and China who certainly aren't issuing IPv4.

All Indian and Chinese websites have ipv4 addresses in case I wanted to reach them.

I think people should come to terms to the fact that everybody is moving to cgnat and the world is not falling apart as they said it would.
I still remember my university mini project from 20-25 years ago about the exhaustion of the IPv4 address space :-)
Nice poster/visualization, even with the small preview image.
VGA won't create that "full chain of trust" parent is talking about. The GPU essentially says if it's outputting to an HDCP (encrypted) output and if so is expecting encrypted input. As an example if you use an HDMI -> DVI adapter or similar you'll get a scrambled-ish looking picture which is essentially you viewing the ciphertext picture.
I would say it's a big misconception, when users want native app they don't want webview, native apps on each platform have a certain look and feel, as well as baseline performance, which they are used to. WebView will never be able to provide these key things, and it is prominently noticeable to most they are using one or another. So don't try to fool your users, then they want native they want native, and React Native is a perfect thing to build it using same technology as the Web, just with these crucial Native elements.
Disclaimer - been working on K8s in different capacities since 2017, so there’s definitely a lot of bias.

My take - Kubernetes isn’t perfect. It’s got a lot of moving parts, a lot of complexity. My work involves managing SRE for almost a hundred clusters daily, where clusters are running across different clouds with different levels of customisation. I’ll say this - K8s is to cloud native infrastructure engineering what ODBC was for databases 20 years ago. A consistent base standard for running workloads across public, private and hybrid clouds, without worrying _too much_ about how those apps will actually utilise the underlying infrastructure. I’ve worked on Docker Swarm, Rancher 1.0, Mesos, Nomad - nothing comes close.

Sure things may evolve and maybe in a decade we _may_ see a new standard, perhaps a new platform. But I don’t really see that happening. K8s is here to stay, and it’s now at a point where it’s stable and mature from a reliability standpoint; it just needs people like us to worry and fret about making it more accessible.
Not GP but may be helpful to someone: I wouldn't expose any home-net service to the Internet except Wireguard VPN. It listens on connection-less UDP and only responds to clients with recognized auth key. On the router you just forward UDP port to the machine with WG. There are clients for Windows, Mac, smartphones.
New on the internet casino site txt, Big games as well as benefits, sporting activities as well as esports wagering, Live dealers as well as far more on this site, come currently, all the best to everyone!!
Someone could create a Fitbit clock to do this too!
The system doesn't have to be completely fair for it to work. Of course being born rich means you are likely going to be rich. However, if you're trying to climb the ladder, the advice you reject as a platitude is fundamentally true. Being an employee you're accepting a limited compensation and getting certain benefits in return, including safety. If you have marketable skills, nothing stops you from building up a business to sell these skills directly, at greater risk but also increased compensation if it succeeds. This is true for an enormous variety of fields, but especially tech.
Same with swiss CHF. Euro looks just as unstable as the dollar from this perspective
I look forward to the blog post in 2 years where Standard Notes realizes that reinventing Cordova was not in fact the right solution to building a high quality, cross platform app!
Why? Does it really matter?