skysight-inc/HackerNews huggingface dataset:
All that looks good on paper, but a lot of apps require full disk access and can easily run in the background, so how "trustable" can that really be in practice?

With iOS at least I know that apps really are sandboxed and cannot access anything unless I grant permission. No app can ever attempt to access my photos unless I explicitly pick a photo or grant partial/total access. Even then it's read-only or "write with confirmation, every time"
Am I missing something? Why are they playing a game?
As far as I know, flake.nix is hardcoded, so you’re going to use a separate directory for every script anyway. And then there’s flake.lock, which you have to go out of your way to avoid creating, and you’ll be spammed with obnoxious warnings if you still do.

So would you want to fit everything into just flake.nix? I don’t see why. Could you? Yeah, sure: http://ix.io/4ll5 is an example for a single shell script.
Why is Chat GPT so expensive to operate?
Altman has said "it's a few cents per chat", which probably means it closer to high single digit cents per chat. Does that estimate include amortization of upfront development costs, or is it actually the marginal cost of a chat?
Nope. Still wrong. I understand there is some way it feels like that from your perspective but DDG and Bing don't own your feed. So they are hiding nothing from you. They are 100% ~up-front~ (edit) consistent about not choosing to show your site (ban it) and the fact that they don't control your feed doesn't make it any more accurate to apply the word "shadow" to their ban.
True. I wondered the same for the canaries. But they did mention why they didn't want to go with the 100% rollout option.

> We could set some very important machines to only get updates when packages reach 100% and stop being phased updates, but Ubuntu has a good record of not blowing things up with eg OpenSSH updates.
I don't.

That is... I don't trust my machine.

I take reasonable precautions, but at a certain point you have to just live your life and deal with people who violate your boundaries in meatspace.
Presumably there’s a payday involved.
Herman Wrice’s War on Drugs
Well they should be accepted into US then.
The article is the most mixed of mixed bags. The salient bits are mixed with fluff an uninformed speculation:

First, while there's a lot of noise about price drops harming the residual value for people who recently bought expensive Teslas, this happens all the time. Everyone who bought a used car recently is screwed out of some residual value because prices have come down sharply.

The important part is that suddenly - not "in the long run" - Tesla is a car maker with ordinary margins that are likely to come in under those for Porsche and other luxury brands. That's an abrupt change that doesn't comport with a gradual response to competitors learning how to make EVs efficiently. What's up with that?

People who have the money to splash out for a Tesla can absorb price drops and battery replacement costs, or they are kidding themselves about being able to afford a Tesla.

Musk has an interesting chain of interlocking bets: Tesla valuation has to be high because he has borrowed some pretty stupendous sums on margin. That money pays for SpaceX, which depends on Starlink for valuation, which, in turn, depends on generation 2 satellites that depend on Starship and an incredible launch cadence to build and maintain a constellation of tens of thousands of 5X heavier satellites. Holy Jenga tower, Batman! That's the real story of how it could all come crashing down.
Donors don't write the laws. They don't take an oath to serve WTP. And so on. They are a symptom. They are not the root problem.
Spoiler: it's zero, recurring.
This is not a compromised supply chain, but fake packages.

See my earlier comment here https://news.ycombinator.com/item?id=34390100

The fake packages are not part of any supply chain and are quite easy to detect. More serious attack would be rigging an existing widely used OSS package, but this is not what the post is about and its title is somewhat misleading.
Of the things on the list, the redirects jumped out to me as the most likely culprit. Second guess would be the algorithm change. You could look at individual pages before & after - mainly the top performing few, looking at what queries they ranked for before and now, and what their average position was. Hopefully the fix to the redirects will kick in soon!
>>You’ve found a risk-free way to generate two valuable commodities: short-term losses and long-term gains.

A loss is not valuable.

Edit: see my follow-up comment before you make another post re-explaining the scheme. The point is it's bad explanation because the merits have nothing to with "losses" being generally "valuable commodities".

https://news.ycombinator.com/item?id=34390221
These packages are not part of any build chain. Please see my earlier comment here

https://news.ycombinator.com/item?id=34390100
Did they even have a fair trial? I always saw gitmo as a modern US gulag.
> Android and ChromiumOS are likely the most trustable computing platforms out there

I talked to a security researcher specializing on Android at a conference and he didn't sound like he'd agree.

While I personally think ChromiumOS does a good job, I think a huge problem is that the issue is in how liberally complexity is added. And complexity is typically where security issues lurk. This has been seen again and again.

It's also why I think projects such as OpenBSD do such a great job. Their main focus seems to be reducing complexity (which they are sometimes are criticized for). A lot of the security seems to come from the reduced attack surface you get. And then the security mechanisms build, which typically are more easily implemented, because of said simplicity are the next layer.

And I think OpenBSD has reached a sweet spot there, where it's not some obscure research OS, but an OS that you can install on your server or desktop, run actual work loads, heck, even play Stardew Valley, or a shooter on, but have all the benefits in terms of security or simplicity that you can from research OSs, Plan 9, etc.

So maybe not mainstream, but mainstream enough to actually work with it. There's sadly many projects that completely ignore reality around them, also because their goal is to simply be research projects and nothing more. Then we have those papers that rarely everyone ever looks at on how in a perfect world all those big security topics could be solved. Unless some big company comes along and puts it into some milestone.

ChromiumOS seems like the limitations you get are similar, probably even more severe than what you get compared to OpenBSD's flexibility. That's something many de-google projects struggle with as well. At the same time the complexity remains a whole lot bigger. Of course goals and target groups are hugely different.

I think both Android and ChromiumOS used to put more emphasis on simplicity, but gave it up at some point. I am not sure why, but would assume that many decisions are simply company decisions. After all the eventual goal is economic growth.

That locking down on mobile devices is not just to increase security, but has the beneficial side effect of controlling the platform. This might not even be directly intended by the security focused developers, but it is a side effect.

So "most trustable" in that scenario comes with "most gate-keeping", "least ownership", etc., which we are kind of used to on smartphones, tablets and Chromebooks. So I think comparing it with other kinds of mainstream OSs isn't really leading to much.
Five unanswered questions about Biden’s classified documents
IME explanations of the Fourier transform focus far too much on the specific mechanics of it without motivating the reason. I find people often don't even realize the time space and frequency space functions are the same function! I dive in like so

"There are many different ways to write down the number 5. Tally marks, the sigil 5, 4+1, 2.5 times 2, 10/2. Each of them is more or less useful in different circumstances. The same is true of functions! There are many different ways to write the same function. The mechanics of taking a function in one form and writing it in a new form is called a transformation."

Above needs to be said a hundred times. Then you talk about why a frequency space function can be useful. Then you talk about how to transform a time space function to the frequency space representation.
Yeah, colleagues have happened once, then never again.
I use a Laptop with a Dockingstation for work and take the Laptop home with me every time I leave so I would have noticed if this would have happened.

When home, I always have to lock or my cat would typeeeeeeeeawww
A "posterior probability for p" for a Bernoulli distribution is meaningless because it's equivalent to a single Bernoulli distribution.
> Please try babysitting young kids first, ideally overnight if you can, and with your SO.

I don't personally plan on having kids but this wouldn't help at all. It's like test driving a car by doing the oil and tire change. Everybody knows taking care of a kid is hard/dirty/&c. that's the only part you'll get by babysitting one.

You'll get all the nasty and annoying stuff without any of the positive/long term/meaningful things
Custom laptop hardware made in China then ME neutered and flashed with open firmware in the US.
Give your problem statement requirements and context and see what chatGPT thinks bout your design. It’s halfway decent from what I’ve seen on open source projects.
Indeed. The title of that 3Blue1Brown video is, “What is Euler’s Formula actually saying?”

That “easy to remember” formula had been presented to me countless times. It only made sense once I stopped thinking about it in terms of repeated multiplication.
It's nice to see Deno recognized here. The ability of scripts written for Deno to import their dependencies by full URL instead of being dependent on a separate package.json + package manager install step being done first helps a surprising amount with certain tasks. It becomes possible to post a complete working block of code that uses arbitrary libraries into a single immediately executable code block online for example. Compare to Node or Python where any code block casually posted online to be really complete needs to be paired with an explanation to first npm install some specific packages (with specific version numbers, if the code snippet is meant to be useful in the future). There's a difference between posting code that's usable on an end user's machine with a few manual often-implicit steps done separately vs one that's immediately executable with exactly the intended environment as-is.
I've set it up myself. The APIs I saw didn't seem suitable for this real-time inference thing.
> What bugs me is when this is applied to remote workers in a way that seems optimized for in-office environments.

> For example IT enforces that your screen becomes locked after 15 minutes of inactivity

If your OS is MS-Win, try playing an audio file when you don't want the auto-lock to go off. Provided IT's "checkbox security" parameters [1] did not include turning this off, MS-Win does not timeout lock the system if an audio file is playing, which makes playback of an audio file a way to prevent the timeout auto-lock from happening. Note that this won't help with any 'presence' indicators that go "idle" or "away" with no activity for some time.

If this works, then you can create an audio file of 'silence' with sox to use to play back when you don't want the auto-lock to trigger:

sox -n silence.wav trim 0 10:0.0

Creates a ten minute long wav of 'silence'. If you want it smaller, compress the wav with lame into an mp3 or fdkaac into an aac file. Then launch playback of the silence file, and set windows media player to "loop" when it reaches the end of the file.

[1] Much corporate/govt. IT "security" is "checkbox security". It is the equivalent of IT having a "compliance form" with a long list of "configured settings" with check-boxes next to each, and so long as they can go down the form and "check all the boxes" they deem their setup "secure". Whether it is actually secure is not important, just that it "checks all the boxes" on the "compliance form".
Max just loves racing including on computers. Most of the young racing drivers are the same.

He owns/manages his own esports racing team.
I think I recognize the type.

It's even harder to work with these engineers if, like me, you don't have a lot of experience (or are not that smart).

Are these the type of engineers that will tell you "don't do this" when they review your PRs and then you will find "this" in all of their implementations?

It's not easy to work with them but I was hoping that with more experience I'd be able to challenge their ideas with more confidence... Now I think that will never happen..

Usually reviewing their PRs would take me at least half a day of work... Maybe even more
it's on the landing page directly. You can also check https://twitter.com/neuralframes
> No. They are not the problem. They don't makes the laws. They don't accept the donations. They don't take an oath to serve The People. Etc. These people are a symptoms. To believe otherwise is simply a false mental model.

They donate money to the people who do take the oath to serve and make the laws. If you hire a hitman, you’re still guilty of murder. If you pay to get bad politicians elected, you’re still responsible for the outcome.
>Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious.

What I am looking for is an easy way to run something like a LiveCD OS in a VM for browsing. The problem is that I have never found a decent LiveCD that has Firefox with all of the mandatory extensions (uBlock Origin, etc...). I guess I could customize my own LiveCD, but last I looked into it, doing so seemed complex and too time consuming to figure out.

Posting this in the hopes of being steered towards a simple solution or to inspire someone to create one.
It is when it's offset by an identical gain, at a different tax rate.
> Also no mention of changes in the orbit of the pair around the sun

It would be worrying if there were as that's not what the test was supposed to achieve nor measure
this is a great motivating example for the definition of Kolmogorov complexity.
I am missing the python? This seems self hosting,
https://replit.com/bounties could be similar to what you're looking for.
Well. I think that takes the cake for both the most incomprehensible, and sensational, comparison of quantity I've seen so far this year.

Now, are we talking Davy Crockett or Tsar Bomba? I mean an atom bomb is an atom bomb but that's still six orders of magnitude difference. Ah, Hiroshima. Cliche. If we upgrade to Tsar Bomba we could say "like detonating the largest nuclear device every 8 minutes" but that doesn't sound as impressive as five every second.

Coincidentally, it's around the peak power of one large hurricane. Hmm. That might have been a better thing to compare to. And still make the point, too. It's like the energy of an entire hurricane going 24/7/365. Of course, almost no one, except weirdos like me, has an ability to contextualize how much energy that is (and only very barely; I've never experienced either an atom bomb or a hurricane). So I guess we should go with the one that sounds scarier? Atomic climate apocalypse!
Preventing Hacking with Quantum Computing and Other InfoSec Topics [audio]
I used it. As Desktop, daily driver, and on servers. The same way I used Gentoo.
The thing is, if you compile from source, and don't need proprietary apps which assume linuxisms, anything which is compiled from source runs just the same way, as it would under Linux, or even(slightly) better. But that seems to be an almost lost art, nowadays? (Assuming you have fully supported hardware, drivers, and such, which was the case for a while with some systems) Meanwhile they also have a package manager for binaries, but I've never used that because I've been used to using sources :-)

http://netbsd.org/docs/pkgsrc/using.html

( https://pkgsrc.se/ is like FreshPorts for FreeBSD )

However, I've got lazy, too, and now use some ready made distro booted from USB-keychain, running from RAM.

Besides that, what would be the usecase? The base system is small, lean & mean, and in my experience rock solid, as in UNKAPUTTBAR. The organization and style of source was more understandable to me, as was the framework to recompile the base via build.sh (make world in FreeBSD terminology), and applications from their 'Ports/Portage/AUR' which is called PKGSRC there.

The same goes for the filesystem layout, /etc, init, and so on. It's just really nice, all in all.

Thinking about it, the question is like what would be the usecase for Alpine-Linux? Some people are using that as desktop, too, for probably similar reasons, but enjoying better hardware driver support.

I think the highest hurdle for people has been the 'strange concept' of using 'slices' and 'BSD-Disklabels' to further split apart MBR-style partitions.

Like explained here: http://netbsd.org/docs/guide/en/chap-inst.html#chap-inst-ins... & https://en.wikipedia.org/wiki/BSD_disklabel

I don't know how that applies to UEFI/GPT-partitioning and secure-boot actually.
Haven't tried that, so far. Seems to be another hurdle, though I know from others that it runs, at least without secure-boot. Seems to be that 'The Guide' and FAQs are lagging behind reality. As often is the case, need to read mailing lists then, sigh...

Or simply searching for UEFI and GPT on their wiki, which leads to:

https://wiki.netbsd.org/Installation_on_UEFI_systems/ &
https://wiki.netbsd.org/users/spz/moderndisk/

Furthermore: different device names.
And an INIT which is neither SysV, nor systemd.

http://www.mewburn.net/luke/talks/auug-2003/ &
https://www.netbsd.org/docs/guide/en/chap-rc.html

Which wasn't even mentioned in all the (mainstream) discussions of SysV vs. systemd because NIH?

I don't know exactly how to say this, but IMO you've missed out on an experience, if you don't know it. No matter how inconvenient initial installation or hardware support is.

This belongs under your belt.
I think a good test of whether this application of the term makes any sense is: Could any search engine ban ever not be a shadow ban? We already have a term: ban. Let's just use that one and stop conflating things and being unnecessary imprecise and incendiary. It helps certain parties' (edit plural possessive) agenda but does not help us clearly communicate.
I hate being forced off enums by lack of proper management being implemented. This is not an unsolvable problem.
I agree with the sentiment, but if a personal blog tracks users and sends data on them to someone else, as with GA, then it absolutely needs a privacy policy.
That seems a bit backwards to me. You apply a force to a spring, and it moves until the spring's back-force balances it; you apply a voltage to a capacitor and current flows until the capacitor's back-voltage balances it. A flywheel speeds up as long as you apply a force to it; an inductor's current increases as long as you apply a voltage to it.

And, current and velocity are both motions, while force and voltage are both pressures.
Quote:

a significant number of U.S. police instructors have ties to a constellation of armed right-wing militias and white supremacist hate groups, a report that adds to a fast-growing body of evidence showing a deadly threat inside U.S. police departments.

The analysis found that some of the instructional information presented by police trainers was explicitly racist, and that some instructors endorsed and interacted with white supremacist criminal groups such as the Proud Boys.

https://www.reuters.com/legal/government/prevalence-white-su...
There are ~10 million illegal immigrants in the US [1], and it is the policy of many "sanctuary" state and city governments to sabotage any federal deportation efforts. But immigration law is suddenly strict and implacable for these 35?

[1] https://www.pewresearch.org/fact-tank/2019/06/12/us-unauthor...
Does "blog post learning" ever really work?

I have taught these kind of undergraduate subjects and, in the context of a course, the Fourier transform never struck me as something very complicated. First, it feels completely natural to write down a Fourier decomposition for periodic functions; the inverse transform to determine the coefficient is just (real or complex) calculus; and all that is left is to convince the audience of completeness which is best done through a few examples as well as the time-honoured method of "proof by intimidation". (Note that the blog post does not do a better job here.)

By contrast, these posts seem to fulfil a demand where people look for an isolated explanation of concept X, like Fourier transforms, matrix determinants, monoids, etc. But they are necessarily too isolated to really convey the subject. For example, one does not normally teach (complex) Fourier transforms without first dedicating significant time to topics like complex exponentials and integrals of trig functions, and likewise one normally teaches monoids only after introducing functors and applicatives.

In other words, without having the necessary background at your fingertips it is hard to really grasp the core concepts. That is why, IMHO, reading these blog posts may feel good but will rarely make things really stick.
If one only had such an estimate for a single example, this would be true, but in aggregate over many predictions, the uncertainty bands can useful for decision making. This is an active area of research.
I toured a couple old (early 2000s era) data centers that had similar flywheel backup power systems. Apparently it was a giant pain in the ass in practice as they had to regularly test it was still working by flipping the whole DC over to it briefly, and it was quite a nerve-wracking "this cannot fail, we have no other backup" moment every time. The thing needed constant maintenance as it's a mechanical beast with heavy load on bearings and such that eventually fail. The whole thing was eventually scrapped and newer DCs are just pure battery backup (+diesel generator) as I understand.
>The goal is simply isolation to prevent recidivism.

Simply? The goals is to have a prison outside of the US where the US (i think mainly CIA) can do things that it cannot when in the US. The goal is clearly to subvert the "rules based order" they so vocally claim to uphold.
Because it it were obvious, you had already found it.
I disagree here - these could be targeted and just because we haven't seen impact yet doesn't mean there wasn't any. All it takes is one download from the right person then it can be pivoted into a supply chain attack.
That's the first time I'm hearing of suggestions that Google will downrank sites without it. Do you have a source?
If you were rewinding everyone, instead of having 1 player complain you'd be having N-1 players complain...
All professional racing drivers use simulation racing training in some way. So its obvious to do off-season e-racing. It also synergises well with building a personal brand.