skysight-inc/HackerNews huggingface dataset:
Only using privileged containers, or else you don’t have visibility into signal from other containers.

But, say you had such a container, there’s an important distinction between “you captured a log showing the smoking gun evidence of the supply chain attack”, and “you successfully picked that log out of all of the log data you generated and classified it with high confidence as an attack”.

Speaking from experience, the second problem is the hard problem for a multitude of reasons. So while you would have the data, you’d probably have trouble getting good precision/recall on when to actually sound the alarms vs. when it’s some SRE who needed to troubleshoot some network connectivity issues.
Engineer the act of querying a trusted party to be a paid operation and the problem is solved. It doesn’t really matter if the verification is subjective, you pay 5 people you trust, only accept it if 4 say it’s good, and stop paying the 5th if they consistently disagree and/or vouch for disagreeable content.
> You could just as well say that men shoulder an unequal amount of wage earning responsibilities.

You could say that, but I think most people would raise their eyebrow at you.
One more thing to tidy up: your full screen hamburger menu in notes on android chrome/Firefox can't be dismissed with a back button press. Instead that closes the entire app, because apparently you're also missing a navigation stack?
Why the weak words? "reading", "looking" is not "understanding".
Software exists outside of USA.

I mean, I'm in Canada, friendly as it gets, and still - is NSA certifying a piece of software a good thing, from my perspective? From my company's perspective? From my Canadian sovereign government's perspective? There may be second order effects at play here.
Netflix doesn’t block HD on Linux
> the more asinine it sounds.

HN is better without personal attacks and insults.
From my experience Amazon has terrible customer service. I'm trying to get them to reimburse me for a fraudulent charge and multiple times I got the boilerplate reply that the charges look right to them. No-reply email address of course those bastards.

> After reviewing your Amazon account, we did not find any unauthorized activity. As a result, we did not make any changes to your account.

Now I have to do a credit card dispute which means a new card which means more work. All because no one thought it would be a good idea to cross reference identical credit cards across different accounts. Probably counting on people not noticing. Anything to increase revenue I guess.
> The code is usually just glue, and you aren’t hiring software engineers at crazy tech salaries to do that.

And the result is that there is no other software category that ships so extremely buggy code.

The code quality of games is the lowest I've ever seen.

Dynamic scripting languages only add to this overall mess…

The other problem is: Building a proper language and runtime is a full time job already. Adding this as a "side project" to a game engine (which is a very complex piece of code by itself!) is a big error imho.

I hope we see soon some strongly typed static language with very good type inference and a nice, clean, and simple syntax in Godot.

Would be than nice if Godot would concentrate on the game engine (and the editor) instead of trying to invent a language on the side also, as Godot as such is really great! One of the nicest programs I've ever used. (Especially compared with the incredibly buggy and terribly "documented" shit show that Unity is).
Neurodiverse, that’s just leftist propaganda. It’s like calling someone “vertically challenged” or something equally silly. People use the word “crazy” in this context and we all know what it means unless we are very pedantic or completely unaware of words having meanings other than the most literal, dry definitions. But if you read English in that way then articles like this are not for you, really, which is not an attack. It’s just there for most people, we want to read more engaging content that something that reads like a 1970s instruction manual.
People rarely factor in those fees or the HD technology fee or fee for equipment rental that most people get conned into getting.
Publishing to Maven Central is a bit of a pain, but the manual effort, doc jars, signed jars, etc. help with security and keep away low-effort packages.
Use-Click-Away (React hook)
I ended up in a hospital in Urumqi China. It was the most capitalist thing I have ever experienced. You put money on a card and pay for services individually… the nurses all had a card reader. $35 for a CT, $6 IV penicillin, (repeat 6 times), $20 see an ENT, $5 for Augmentin. Government matches the amount paid, and poor people get a card that is very discounted.

Family members typically moved the patient since orderlies were an additional charge.
I always wondered why some New Age "Religions" went with Runes as opposed to Ogham. I believe those are based on what is believed to be Old Celtic Myths.
Not as small as you're looking for, but Basecamp has fewer than 50 employees and generates millions in revenue per employee.
I’ve created Packj sandbox [1] for “safe installation” of PyPI/NPM/Rubygems packages

1. https://github.com/ossillate-inc/packj

It DOES NOT require a VM/Container; uses strace. It shows you a preview of file system changes that installation will make and can also block arbitrary network communication during installation (uses an allow-list).
Why do you say they are always male? That just sounds like leftist propaganda as well. I’m not sure yet the rest means other than I think you deny the reality of this phenomena described.
The money comes from folks who want verified software and are willing to pay for it. The greatest failure of crypto thus far is convincing people it’s a speculators market. This had to happen when the only outcome of a mine was “a hash starting with a lot of 0’s and a couple hundred bytes we can all agree on”. Make mining produce something legitimately valuable and that is no longer necessary.
There was an article posted here recently that argued quite well for the wave-only view, avoiding the wave-particle duality by accepting that particles don't exist:

https://news.ycombinator.com/item?id=33937900
This brings me back to EE in college as a CS student just trying to make logic work and hitting race conditions left and right (and adding workaround after workarounds), versus the environment I was used to where a program is executed sequentially.
The quality that you want to bring to programming is basically handmade special purpose programs. Game dev comes to mind. Flappy bird was unique as was the very first version of Minecraft. There are no guarantees that people will play the game that you build though. As per Apps most are Web Apps and they all look roughly the same and I don't think that there's much creativity there. Diving into modern web development will sure as hell siphon your joy out of programming though.
Homie, the things your parents did to you was abuse. The things you did to your kids, because your parents did them, was abuse. Your parents were probably self medicating with alcohol. What ever fault you have with the younger generation is on you and your generations behaviors.

You need to get out and actually listen to some people younger than you. It's clear you've never had an emotionally present conversation with a young person.
For a dynamic DSL GDScript is OK-ish.

But dynamic languages are a big horror when it comes to bigger projects. Especially when things get "reworked" heavily the whole time (as not uncommon with especially games).
> What's wrong with losing money?

It creates the incessant need to offset those losses. This turns housing into an investment and prices everyone out.

> After a certain point, personal wealth is nothing more than a highscore showing how good you are at the capitalism game.

What? No. Money is a form of power. It's hard for mere mortals like us to even comprehend the extent of the power wielded by the truly rich individuals and corporations.

With enough money, you can buy laws by lobbying the government. If that doesn't work, you can often just ignore laws and buy yourself out of trouble once it catches up with you. Fines? They're nothing.

Want to see something happen? Just invest some money into it and things will start happening immediately. Want to change things in the world? Just buy whatever you want to change and remake it as you see fit. Use money to incentivize the behavior you desire.

There is no point after which it's enough. The more you have, the more powerful you are. You're limited only by your dreams and ambition. There are rich people out there who bought military fighter jets just to fly around in a highly maneuverable aircraft. How many children out there dream of doing that?

> It's not like you are going to need it when you inevitably die.

My children will. My parents worked hard to give me a good life. I consider it my personal responsibility to honor that effort by going even further in life than they did. I want my children to be even more successful than me.
It’s funny, 15 years ago I made 30 percent of what I make today and I could afford a home in the same area I’m in today, but today I would need to make about 1.5x more to afford a home here. Capitalism isn’t “free markets”, it’s “the power goes to the people with capital” and that’s only the top one percent of one percent, for the most part.
The implicit assumption here seems to be that the husband/father unilaterally allocates working hours and childcare hours, and that working more hours outside the home is a privilege everyone will go for given the opportunity.
This article was a really interesting read, because I've been thinking lately that companies tend to succeed off the back of people caring a lot and putting in extra hours but I haven't seen this verbalized before.

I think the young guy they interviewed whose dad makes barely more than he will summed it up perfectly. You realize that if you put in all that extra work you get paid fuck all extra. It doesn't make any sense to work so hard for so little reward in most fields.

I feel like tech, finance and maybe law are the only corporate careers where it makes sense to work really hard because there are outsized rewards for high competence, but even then it doesn't always make sense.

Millenials kind of realized this Zoomers have fully realized this. Probably related to most fields stagnating heavily career-wise and having relatively poor pay.

It's interesting to see a lot of Millenials and Zoomers cottoning onto the fact that tech pays well. It's surprisingly common on social media and IRL to see something along the lines of "someone is making a lot of money = most likely works in tech", and vice versa.
It's not like I was claiming it exists. I'm asking, if you did observe one tomorrow, what would be the theory's best prediction of what would happen next?

And yes, I get the whole Fourier transform uncertainty making the math inconsistent, but that's not an answer for me here. Like if you asked Newton "if gravity didn't travel instantaneously, what would be your theory's best prediction?", he would probably be able to give you a better answer of what he expects the consequences would be than "that's impossible, the math would be inconsistent".
Just noting that one instance of Firefox (110.0a1) consistently gives me 403 Forbidden. Brave works okay. Firefox 109.0b7 works okay.
Do you rent the condo out for the remainder of the year?
>Unfortunately ssh does not have the PKI infrastructure of ssl to revoke keys.

It does, but very few people use it.
Reinventing standard database features like audit tables, sql server has such out of the box, same for any major databases.
I don’t know about all of the industry but tech is definitely not in the same boat. The looming threat of recession and layoffs has handed companies back the leverage that workers had in the last couple of years. Less pay and more work is becoming the norm, unlike say two years ago where everywhere you go, companies were trying to entice you with a ridiculous pay or a great amount of flexibility.
Someone should write a DevTools extension that uppercases the headers, if such a thing is possible. :)
If the code is treated like that the result it that there is no value at all. Because nobody wants to buy buggy crap.
The markets have been detached from reality for quite a while. Cheap money has distorted market incentives completely.

So who even gives a crap if you win this rigged game?
Create the keys with a password, then store the password in an SSH agent (which is built into many keychain managers such as Seahorse). That way, you can use your key without entering the password, yet the key file is still encrypted on disk. Keys are decrypted automatically on login and stored in memory only, protected by the secrets daemon.
Good reason to get a Yubikey or similar, and use it to generate WebAuthn‐based SSH keys that can’t be used once exfiltrated. (“ssh-keygen -t ed25519_sk”)
I wonder how long a comfortable life of us based purely remote work will be feasible. Will these types of jobs be taken by a global workforce? Will systems improve enough that cloud consulting will no longer be needed?
yeah sure english is not my primary language, but what i found when asking people what religion means to them, i always find deep interpretation holes, even if they motif is something broadly common... like Christian interpretations etc.

but yeah, psychodelics always invoke a sense of unity in higher doses, and maybe that is a spectrum of feeling a 'holy' experience in a religious context.
but what i perceive is; every person has an unique idea of it! even if they all say the same thing, my inner interpretation always perceive as a new thing or at least an addition to what i define as a religious interpretation of what life is or why we are here etc.
> fuel is cheap, electricity is cheap, food is cheap.

And you're saying the industries with government intervention are the expensive ones? What's going on with fuel, electricity, and food; all of which have heavy government interference
> Git isn't relying on collision-resistance, it's relying on second-preimage[0] resistance, which is to say: in order to sneak a hash collision in to a git repository, you have to sneak _something else_ that's already trusted (e.g. via code review) into the repository; collisions can't (yet) be generated for arbitrary hashes.

Yes, I know. I was arguing the more general point that 'The use of SHA-1 in Git is not for security purposes,'.

Of course, for anything crypto related we go by the maxim 'guilty, until proven innocent'. MD5 might not have a published second-preimage attack, yet; but its broken enough, that you shouldn't rely on it for anything anymore: it's not a acceptable crypto-hash, and if you don't need a crypto-hash, you can use something simpler like a CRC instead.
A woman in PA school probably has an easier time finding a doctor than a fellow student to marry. When my wife attended 6 years ago, there were 5 or 6 men in the class of 80. I suspect more of those women are married to doctors than classmates; I can't report comprehensively, but I know of two married to doctors and none married to classmates.

An MD is just a really shortsighted decision for many women who would like to have and spend time with multiple kids. If you're hitting all wickets in ideal timing (assuming HS grad at 18), you could finish med school at 26, then residency sometime around 30, which is already feeling quite late to have your first child. And the residencies I hear about don't sound like great environments for a healthy pregnancy, so maybe make conception at 30, baby probably at 31. And now you have loans to pay off and high earning potential, just as you're wanting to spend time with young children. As this is only baby #1. And hopefully these women already have husbands lined up, despite that being a significant difficulty for woman doctors.

It gets much worse when you talk to women who, for various reasons, are still applying and hoping to get in at age 25 or 26. And then I've heard 20-something men talk about applying for medical school in the same conversation where they ask coworkers about part time work schedules and allude to wanting not to work very much; it's like their perceptions of life have a single scalar parameter of success, years of medical education, and they can't see all the stuff off the sides of that grind of a narrow track.
Someone has to make you your nuggies at McDonald's homie. It's going to be someone, it might even be you. Half the workers at any McDonald's I've ever been to are elders who should be retired.

The level of isolation you are suffering from is profound and I hope you find a way out of it.
Honestly I don't think browsers will drop HTTP/1 anytime soon because it's inconvenient/impossible to do HTTPS on a local network. I mean, Chrome shows Not Secure on http connections, but not on localhost, and it doesn't mean much anyway. Which is FINE. I mean, maybe input[type=password] gets an alert on HTTP? Just a thought.
it is frankly amazing that you took the reality of the government paying for half of all medical coverage, paying for most of it for poor people, and regulating low prices for such care (well below America from your examples) as “capitalism works!”

What the hell?
As someone in the article explains, she was happy working hard (and getting pay rises) until she spent time on TikTok, which quickly convicted her to work less hours and demand higher pay.

TikTok, a Chinese app, is not allowed to show you such content in China and must instead show pro-work, pro-family messaging.

Coincidence?
> All it means is that you put your signature over a particular state of the repo (and, by extensions, its parent states).

That's technically true. Though in practice I think the implied social contract is that signing of a commit means you signal some kind of approval for the diff between the signed commit and its immediate predecessor(s).
I think a (N, D) array can be used as a lookup table.
Here, N is the number of emojies and D is the dimensionality of the color space (say 3 for RGB).
Each emoji is converted to a D-dimensional vector by computing the dominant color.
Then, we can take a D-dimensional vector from an input image and compute the closest emoji by using cosine similarity.
To minimize the loss function, we can increase the number of dominant colors, so the table would be (N, DxM).
In this case, each emoji is represented by M D-dimensional vectors, each one encoding a dominant color.
I'm in pretty much the same boat as you(at least, for the first 4 paragraphs). I'm definitely under-leveled at a FANG. But I'm making hundreds of thousands of dollars per year, and working maybe 25-30 hours/week. Why would I go for promo to get a 20% raise and then have to put in more of my free time, when I have absolutely no need for another $75k or whatever? It just doesn't make sense from a cost/benefit perspective.
Here's my helpful little time thingy (not a live clock, but let's you set arbitrary dates): https://www.masswerk.at/time/convert/
I’m a security engineer at a big technology company. I’ve been a security engineer at several of these. I’m speaking for myself here, not for current or previous employers.

When I say “software supply chain security”, I am reducing a complex concept to jargon, and am using terms that will evoke specific concepts in the people I work with. I’m not really talking to you; I’m talking to my leaders who are extremely business savvy but may not have the software development chops to understand how code we didn’t write got mixed in with code that we did write.

I am NOT implying nor assuming that the original creator or maintainer of said software has any obligation to me.

The 90% case for me, when I bring up this term in a software security discussion, is that I’m trying to impress upon an engineering manager that if they choose to use software that they didn’t write, that THEY own it from a security perspective. Depending on risk we might discuss monitoring for notifications of vulnerabilities in the code, or we might discuss first-party or third-party security code reviews, and/or forking depending on the security support level of the maintainer, and/or contributing back security patches that we develop in house. Or I might try to convince them not to take the dependency and write the code they need themselves. Or I might propose mitigations like isolation. Or all of the above. “Software we use but didn’t write ourselves” just doesn’t look professional or compelling in reports and documents and doesn’t lend itself to being reduced to an acronym like SSCS.

As a security engineer, I depend a lot on the goodwill of folks like you who write and maintain open source software, and I most definitely do not take your work for granted.

Best regards and Happy New Year!
Pretty sure, yes. What companies are "not allowed to fail"? Boeing? Maybe some big banks? Maybe Oracle, Microsoft, Apple, Intel? All right, what fraction of GDP are they?
I guess that depends on what "HD" means. As far as I know, unless you are running a dedicated streaming device (Chromecast, Roku, etc), Windows in IE, or the Windows Netflix app, you can only watch in 720p.
> The analogous scenario for git repositories would be to have a malicious actor make a commit (or blob, tree, etc.) that could be swapped out for another. But if you already have malicious actors able to make commits in your repository, then the hash function doesn't matter: they can cause damage in many, many other ways.

The malicious actor can pose as a good-faith contributor and submit Pull Requests to your repository.

You review the code in the PR, and perhaps even prove it correct. Later on, the malicious actor can do the swapping trick. (Eg by running a mirroring service for your repository.)
> The more predictable a work process becomes, the quicker people can do it too.

The most highly-voted question on Stack Overflow[1] relates to branch predictability. There's an almost 10× speed-up when the branch predictor of the asker's CPU is fully engaged.

Modern branch predictors are extremely powerful, with TAGE and perceptrons achieving 99.5%+ prediction accuracy.

https://stackoverflow.com/questions/11227809/why-is-processi...
I'd reckon there's probably room for about 2x2 subpixels' worth of "antialiasing", making the search space 4x3=12 dimensional (probably in Lab colorspace). Is that doable? If yes I'd expect the approach to be close to optimal possible.
Agree completely with the author.

Even in the situations where there is a supplier-buyer relationship there is the maxim of caveat emptor, subject to terms of an explicit commercial contract.

It is 100% the responsibility of the user of a library or FOSS artefact to do their due diligence before adding it as a dependency in their project.

It is bonkers to demand the developer of an open source library to dance to my tune just because I am using their library gratis. It is open source! Create a pull request, fix the bug (or add the enhancement), compile, test and write to the devs with your solution, if you really care. People sitting on their pedestal and whining solves nothing (for themselves or the community).

I am just thankful there are so many people who work for providing high quality FOSS software. Donate (or support those projects in other ways) if you are able to do so. Don't just be an entitled jerk.
Sorry for offtopicness: I've unbanned this and what I believe to be one of your other accounts, because they've been posting within the site guidelines lately. It's not great to use multiple accounts to comment regularly, but I'd rather see good comments unkilled. If you feel like merging the accounts, let us know at hn@ycombinator.com and we can do that for you.
I think the more relevant part is that people have realized that harder work does not necessarily pay better or lead to advancement. Companies can win markets while not paying their employees top dollar, and this fact is now clear to most if not all.
Do you have any good(preferably light on dry math) resources on these kinds of multidimensional search problems?