skysight-inc/HackerNews huggingface dataset:
I love these. kens, nitpick on your first footnote:

In fact the Apple II was designed for 4k DRAMs with a whole-cycle time of 500ns, which was the low end of the range in 1977. The idea is that the machine double pumps a 2MHz memory bus, with cycles alternating between the 1 MHz 6502 and the video scan circuitry (which doubles as the refresh controller). By the advent of 4164 chips, DRAM cycle rates were pushing 4MHz. But Woz was stuck with more limited hardware.

Similarly the 8086 bus is multiplexed between address and data, a memory access is 4 cycles. So a 4.77 MHz IBM PC was actually cycling the DRAM at just 1.2MHz (though with no clever tricks, as MDA/CGA had physically separate framebuffers; there the extra bandwidth really was wasted).

Which isn't to say that the footnote is wrong, just that "DRAM was faster than CPUs" is only part of the story.
Some businesses just have no reason to interact with certain IP sets.

For example if you are running a SaaS website which only caters to customers in the US what is the advantage of letting IPs from China or Russia access your service? Those IPs are not going to utilize your service because you don’t offer services outside of the US; since the IPs cannot be used for legitimate actions they can therefore only be used for illegitimate actions and should be blocked.
>The second WTF was the centered start menu, killing my decade old reflex of going to the bottom left with the pointer and clicking. This at least has a toggle.

Why do people even mention this? As you said, it has a toggle. How did it “kill your decade old reflex” when it literally takes 5 seconds to fix it?
I would think consciousness, rather than intelligence, is the important component that should persist irrespective of humanity. Intelligence, curiousity, and creativity are important too, but on their own they don't hold moral significance. A universe of computers is not superior to a universe of atoms without something experiencing those abstractions and giving them meaning.
All KDE tools have terrible names IMO
Self-hosting seems somewhat at odds with the family-friendly requirement.
English as She Is Spoke (1884) [pdf]
Good for them. Not that much for ecological reasons, though.
The point of your parent was, I believe, that it's not your place to decide for others.
Hey Ken,

Always enjoy your posts!

> The much-reviled solution was to create a 4-megabyte (20-bit) address space consisting of 64K segments,

Did you mean 1-megabyte here? (and again later in the same “paragraph”, pun intended)
Canvas (The Spatial Computing Company) | Full-time | Onsite | Remote |

At Canvas, we’re working on spatial computing - using computer vision to 3D reconstruct and understand your surroundings so that software can operate over real-world spaces. We believe it will power the next generation of augmented reality and some of the key parts of virtual reality as well.

- Director, People Experience (Remote)
- Computer Vision Engineer (Portugal/Remote)
- Computer Vision Tech Lead (Portugal/Remote)
- Head of Computer Vision (Portugal/Remote)
- iOS Engineer (Portugal/Remote)
- Junior iOS Engineer (Portugal/Remote)
- SQA Full-Stack Engineer (Portugal/Remote)
- Web Backend Engineer (Portugal/Remote)
- Junior Web Backend Engineer (Portugal/Remote)
- WebGL Engineer (Portugal/Remote)
- WebGL Tech Lead (Portugal/Remote)

For detailed information check out https://canvas.io/jobs.

Keywords: 3D, computer vision, photogrammetry, geomatics, SLAM
Is there a guidance for the number of PBKDF rounds depending on the length of the password?

In particular I'm curious to what degree can the round count be reduced if I use a long pass phrase (say, 200+ characters long) instead of a password?
> Often the AirBnB people are wealthy tourists who spend a lot and stimulate the local economy, so kicking them out is a horrible idea.

Amsterdam specifically wants less tourists.

They have a load of initiatives and policies to try reduce what they call "negative tourism" that are will just have the net effect of reducing overall tourism - the actual goal.

Similar issues in Venice and some other European cities.

Over tourism makes places less liveable for the residents who live - and vote - there.
Fingerprinted/ID'ed by who? There is effectively no difference in security with tor when it comes to the end points. The main purpose of tor is to prevent anyone in the middle from getting any information.
You pay yourself a salary. That's the business investing revenue back into its employees. And yes, you'll pay income tax on that, but that may only be a small part of the value you've created.

Or you sell some shares, or borrow against your equity. Perhaps you can roll it forward indefinitely and you're in a jurisdiction where your heirs get favorable tax treatment by inheriting the business.
Colorado has had this since 2021 as well. Despite that I still see a lot of jobs from companies in Colorado without them posted. And as I understand it, it includes out of state companies if they are willing to hire remote employees that live in Colorado.

As far as I know these are now the locations with requirements to post salary ranges:

- Colorado (2021) - All job postings

- New York City (Nov 2022) - All job postings

- Washington (2023) - Any company with 15 or more employees

- California (2023) - Any company with 15 or more employees

Edit: Formatting
I'd love to hear your ideas about what could be more offensive than "Coastal Elite influence election results across state lines"

I edited some grammar. Blame HN for not showing edit history, if you'd like.
They’ve explicitly made it illegal for anything to go faster or wider, which is the core of the problem.

The ARRL is so incompetent, overly concerned with their own elections and never interested in pursuing changes that would actually allow for the hobby to grow into the 21st century. Proud non-member.
I believe this is actually the case

In e-commerce, doing “tax tables” is insanely complicated.

Most small companies don’t need to worry about it but large firms have to worry about “domicile”

I could be wrong here though, but a few years ago I did do a big project dealing with that
My father is an avid ham operator and unfortunately at his age, his health is declining.
Soon he will have to move from a remote location where he has all the antennas for various bands etc and I wonder if there’s some Internet to radio bridge so he could still use his equipment remotely?
Hum... People should not have to face prisoners dilemma situations against their coworkers. And there is an entire profession called "management" in charge of making sure of that.

People should be able to trust their coworkers on ways that the GP didn't capture. But those do not include adversarial situations. (And honestly, "Hey, how was your weekend?" can as easily add or remove all kinds of trust. None of this is simple.)
At least the low lunar orbit is usually unstable due to Moon being chunky:

https://en.wikipedia.org/wiki/Mass_concentration_(astronomy)...

But there are exception & Lagrange points should be generally safe.
You’ve never had to pay a cleaning fee?
Location: Southern California
Remote: Yes

Willing to relocate: Yes (with conditions)

Technologies: Laravel, React, Node.js, React Native, Android, IOS, Kubernetes

Resume/CV: https://materializelabs.com/work/

Contact: hello<at>materializelabs.com

Website: materializelabs.com

I am a software developer that builds complex web applications for businesses. I have a team of software engineers, QA analysts, UI/UX designers, business analysts, product, and project managers. Rates are $150/hr flat for all services. Willing to work on-site as well as provide staff augmentation.
"TITER" for one more pixel.
The threat model where someone is able to run malware on your machine, but not run a keylogger to grab your master key for your password manager seems sorta absurd.

Yes, if someone installs malware on your machine (in your user account), they can grab the Chrome password vault. But in that case, 99% of the time they will be grabbing the password vault of other providers as well.

Also, note that the Chrome password vault is encrypted on disk.
One of the problems is that you don't know what you're buying. You might end up with a reasonable HOA or a terrible one. Even if it looks reasonable today, it might change tomorrow.

Another problem is that HOAs are the worst possible size of a government. They're large enough that you're in the minority, but small enough that they don't have anything else to preoccupy themselves with but how you're using your own property.

I've heard that "just imagine what kinds of horrors happen without HOAs" argument many times over, but... I live in the Bay Area in a densely-packed but older neighborhood without a HOA, and I'm yet to witness the terrible consequences of my neighbors' supposed recklessness. Yeah, the houses are painted in different colors and picket fences have different styles and heights, but I think I can live with that.

Most people are reasonable. When you bump into people who are truly unreasonable, a HOA is unlikely to save you. How peaceful and pretty a neighborhood is depends largely on socioeconomic factors (not just wealth, but also the prevalence of problems such as addiction). It just so happens that many new and expensive neighborhoods have HOAs, but that doesn't mean that HOAs are to be credited for good outcomes - or that they will be able to prevent the decline of such communities if the economic climate changes.
My theory and personal opinion.

In the past, we didn't have complex UIs, we did, but we dealt with them differently. For example, in the era of forms and limited Ajax, keeping the DOM synced with the state took a lot of work.

The complexity we see today results from different ideas of how to deal with that _synchronicity_.

Keep in mind that there's no way to do it natively; the only way to do it is to manually keep the state in sync. The complexity we see today results from the abstractions people have created to accomplish that, e.g., jQuery, Sammy, Backbone, Knockout, Angular, Ember, React, Vue, Svelte, etc.

Enterprise and FAANG required optimizations for different reasons, scale, collaboration, distribution, etc. Programmers wanted to use paradigms to represent things and apply optimizations on the web, and JavaScript wasn't enough. So, they created CoffeeScript, Flow, TypeScript, ReasonML, etc. These tools became popular in the FAANG, wrote posts about them, then people of all industries adopted them.

To use all these cool tools, people created bundlers—each with its configurations, patterns, and philosophies—gulp, Rollup, Webpack, etc.

At this point, the web skyrocketed in complexity from the days of HTML, CSS, and JavaScript when one of the complex tasks was to make rounded corners with images and cool layouts with tables. Of course, you can still build complex UI without these tools and use JavaScript alone, but you will end up abstracting your patterns and paradigms into reusable bits.

Additionally, some developers attempt to use as little JavaScript as possible; one great example of a complex UI trying that is https://sourcehut.org.
On Standard Ebooks with an appropriate cover image:

https://standardebooks.org/ebooks/pedro-carolino_jose-da-fon...
Malthus's theory was indeed proven to be false.
Well, looks like it's not a problem then. And it doesn't look like they're for your „civil liberties“.

Unless you don't like them voicing their opinions and their choices?
The Apple employees at the nearby Apple campus are very open about working there when you meet them socially.
I bought a pair of Doc Martens shoes (the old classic ones) from amazon before discovering doc marteens had its own selling website. I bought a second pair there after 2 weeks not seeing the one I ordered on amazon, the very same model which made Doc Marteens famous around the world.

They both arrived the very same day.

From the seller addresses on the package, I could know which pair were coming from Doc Marteens website and which pair were coming from the amazon seller.

I put the pairs side by side to compare them.

At first sight, you couldn't tell the differences, but once you got close it was very clear there were not the sames :
- The laces were thinner on the fake one.
- The leather were thinner on the fake one.
- The sole were differents, with different markts and scripture.
- The logo at the back of the shoes was very badly reproduced.

The amazon seller had recorded an obviously fake address situated in New York city. The front of the address on google map was a store which has nothing to do with shoes or clothing business.

I posted a review telling the shoes were fake and the seller was selling counterfeit products and had posted a fake address.

Amazon informed me 24 hours later they had removed my review because I didn't stitch to only review the shoes.
Instead of being critical of the decisions of others, what do you suggest?

Arm chair critics are a dime a dozen, what are your ideas on how to address the housing problems?
Just want to note, Chrome's password manager solves (3) as well. The passwords are stored encrypted on disk.
> Again, if companies didn't treat password data carelessly

This is not a real solution. The real world is full of unreliable actors and byzantine generals. Any solution that depends on a perfect environment isn’t one.
Trial and sentencing of Robert H. Richards IV
>The problem with standardized tests as they are implemented in nearly every case is that they only test how well the students have been taught the test, not the topic the test is on. This makes them just as pointless as GPA at being an indicator of capability.

I'm hearing this argument very often, yet I don't see anyone easily scoring high score on advanced math exam in my country without being somewhat decent at those topics.

>This makes them just as pointless as GPA at being an indicator of capability.

I disagree. GPA is fundamentally flawed, test exams are flawed if it is just ABCD that you can guess
Qubes is not just an abstraction. Its isolation allows to overcome the problem of fundamentally insecure software. For example, my passwords are stored in an offline VM (where I don't run any apps) and my random internet browsing occurs in a disposable VM (which is reset every time).

Yes, Qubes does not solve the problems like Spectre and Meltdown. Yes, you must trust your hardware to use it. If you are looking to solve such problem, then you might be interested in a stateless laptop: https://blog.invisiblethings.org/papers/2015/state_harmful.p....

Apart from that, I believe, the best computing paradigm is free software and free hardware, but it does not seem too widespread now unfortunately. This would be the actual solution. The "behemoth companies" are not trying to solve computer security. They are trying to get as much profit as possible, and it goes against security of the users. This is why they are not supporting free software.

My current "good enough" solutions are disabled and neutralized ME in a laptop and Librem 5 phone.
I love Chrome's password manager but the flow is not good at all for iOS (because other dedicated password manager apps integrate with the os)
It comes down to how deep the type system of a language support this kind of operation. It'll work well with TS, Rust, but it doesn't add much to golang, C++.

But well, usually dynamicizing statically-known types yields premature abstraction
>It's like skipping 10 steps and trying to land on the 11th one without progressing naturally through all required evolutionary steps in the space tech development. It's like putting all your eggs in one basket in hopes that everything goes right from the first attempt.

So like Apollo, right ? :)
If the Chromium/Chrome browser is open source then anyone should able to edit the source code to change the headers to whatever case they prefer and re-compile.
Yep, I totally agree. I took a long break from C++ after I learned the basics at university. I got into it again one and a half years ago when I needed really fast code and I was pleasantly surprised how easy it is. I'm exclusively using smartpointers and I very rarely run into scenarios where I have problems with memory leakage, etc.

Since I had written the prototype in Java and now interface with Javascript/Typescript, I'm really amazed how clean and well-reasoned my C++ side of the program is. So yeah, I'm also really happy with the state C++ is in right now.
Given our demonstrated inability to act as responsible stewards for the limited resources available to us on this planet—not to mention one another in the face of this scarcity—perhaps we would stand a better chance of being a healthier and happier society as a population of 700 million rather than 7 billion?

To be clear, I understand that getting there will be undeniably painful given our economic systems’ expectations of and reliance upon indefinite and unlimited growth. But such an outcome may be unavoidable in any case and it’s one I’d rather see us plan for and soften the impact of than continue to rush blindly into.

I just don’t believe any more that the Earth can support the number of people we have at anything vaguely shaped like a modern Western lifestyle for much longer. We can and should continue to try to reduce our rate of consumption. But we’re too big at this point to have many good solutions left. I mean, for fuck’s sake, we’re running out of usable sand.
>Dash is the only one using Argon2d, the winner of the Password Hashing Competition held in 2015.

>Unfortunately, their choice of parameters is on the low side:

>We use Argon2d, by default, with the following parameters: iterations = 3, memory = 32Mo, parallelization = 2 We also support PBKDF2-SHA2 with 200,000 iterations. Then, the data is (en|de)crypted using AES CBC-HMAC mode.

>AES CBC-HMAC isn't a thing, what they're doing is AES-256-CBC then HMAC-SHA256 (and not CBC-MAC), which is perfectly acceptable, albeit using the same key for AES and HMAC feels shaky: an authenticated mode should be used like AES-GCM, or another key derivation to produce two subkeys, instead of using the same key for two different purposes.

>The intern who wrote their whitepaper had a confused understanding of how https works: OCSP doesn't replace trust stores, key exchanges are more complex than "the client encrypts a random number with the server’s public key and sends it to the server, the server decrypts this number, and both sides use this number to generate a symmetric key, used to encrypt and decrypt data.", …

>Worryingly, their "benchmark of attempts to decrypt AES files" is done on a "4 cores Xeon 1.87GHz", which doesn't make sense: cracking a password doesn't mean going through the whole keyspace of alphanumeric characters of a fixed length, and nobody uses CPU to crack passwords, let alone a 4 cores one. I would expect a firm in the business of protecting passwords to be up to date with the current state of the art of password cracking.

>They have a bug bounty with payouts up to USD 5,000 and no public reports. The gpg key that should be used to contact them is an RSA one of 1024 bits (worryingly small in 2023), and belongs to someone called "anish".

This is super concerning to me as a Dashlane consumer, so what are my options?It took me months to get my parents to figure out how to use it, and if I need to shift, it's gonna be even more difficult.
Usko Privacy | Miami, San Diego, REMOTE | Software Engineer ($120k)

Usko Privacy allows people to analyze, manage and monetize their personal data. We have Android and iOS apps showing analytics of your Amazon purchase history - all your data stays private, on your device. We are looking for help in executing the next parts of our roadmap.

https://uskoprivacy.com

This would be an opportunity to get in on the ground floor and leave your imprint on an early-stage, venture-funded company headed by experienced entrepreneurs and technologists.

We are looking for a generalist who can both write application code, and contribute to the operational aspects of our systems. The focus is mostly on the backend and related ops tooling, but the ideal candidate would be comfortable picking up front-end work where needed. Our stack is primarily made up of Node / Typescript and PostgreSQL, with [prod, staging, test, CI] infrastructure running on Linode + Docker Compose, wired together with Github Actions. Prometheus for metrics, Retool for internal dashboards, the works.

Candidates should be generally available during US East working hours. The interview process is:

1. Intro call

2. Choice of take-home coding exercise + call to discuss the exercise, or a live coding screen

3. Founder call

Some press around our recent launch: https://refreshmiami.com/furthering-data-privacy-mission-mik...

Contact josh@usko.app with the subject "HN: Software Engineer" along with a resume / LinkedIn
I remember some IoT switches that just had lamp and switch connector and outside of control did just that - worked as dumb switch so if all else failed lights still worked as usual.

It is still adding one extra component that could fail, but it was at least immune to "controller died, nothing works" problem.
Has there ever been a case when such movements successfully halted some technological progress?
"How often" is indeed a decent question, but the ranges aren't too wide. It'd either be once per C++ release (every couple of years) or in some of the C++ releases (every five years or so). It isn't like if the committee decides it is okay to increase the widest integer type every week.

The reasons why the ABI transition hasn't happened already is because C++ has a historical position of breaking the ABI only very very rarely. This is, in part, a legacy from a world where it really was going to be frustratingly difficult to get new builds of their libraries.
> But we must facilitate and celebrate childbearing as a society.

I know this is unpopular, but just an opinion without facts, and I strongly disagree. This agreed "it must be that way" is one of our main problems and turning this planet over, we should reconsider.
SEEKING WORK - Austin, Texas or Remote

I am an experienced engineer with a career spanning over a decade, working on a wide variety of commercial and open source projects in different industries.

In the past few years I have worked on real-time drone control and low latency video streaming, embedded linux OS deployment and maintenance, cross-platform mobile and desktop development, and I designed and implemented an encrypted cloud storage system for a company in Europe using the Rust language.

For several years I was the lead developer and maintainer of the OpenHD project[1] where I reorganized and modernized the development and release process, and created a cross platform touchscreen drone controller called QOpenHD[2].

I have real world experience with embedded Linux, Mac, and Windows systems programming (primarily C, C++, and Rust), iOS/iPhone and macOS development (Obj-C, Obj-C++, Swift, Rust FFI), and Windows desktop development (C# .NET/WPF, Rust FFI).

I have also used the Qt framework for several years and have in-depth knowledge of lower level platform-specific rendering and video handling APIs (OpenGL, Linux v4l2/dmabuf, GL texture/buffer sharing).

For personal projects I have designed my own FPGA IP cores, experience which gives me a much better understanding of how the hardware we run our software on actually works in practice.

Currently I am working on an animal safety monitoring system (embedded linux, Qt framework, C++ and Rust languages) designed to detect hazardous conditions and events that could be life threatening for a particular species (such as a baby tortoise flipping over directly under a heat lamp), using a combination of habitat sensors, thermal imaging, and computer vision. It integrates with common commercial streaming and notification systems such as the YouTube Live streaming platform, Twilio SMS notifications, and Apple HomeKit.

Email: steve@infincia.com

[1] https://openhd.gitbook.io/open-hd/

[2] https://github.com/OpenHD/QOpenHD
Please don't cross into personal attack or name-calling.

https://news.ycombinator.com/newsguidelines.html