skysight-inc/HackerNews huggingface dataset:
> Note you do not have to do it yourself you can rely on someone to do it for you (there is no monopoly here)

Which is why the "but but but you can access the source" argument the FOSS people put up is such bullshit.

I mean:

a) Let's be honest, with most FOSS projects, security is an afterthought, assuming it was ever thought of at all. Very few go to the extents of OpenBSD or, indeed, anywhere remotely near it. Most don't even have any security bods on the team to start with.
b) If you're relying on someone else to audit it, then its no different to employing someone to blackbox fuzz test some closed source software and attach some monitors to your network to watch for undocumented exfiltration.
c) If you're relying on someone else to audit it, then that "someone else" with sufficient skills will come with $$$ attached.
d) If you're reviewing it yourself, assuming you can speak the relevant programming language in the first place, there are few people who can speak a programming language well enough for the purposes of security auditing.
e) If you're relying on "the community" to review it, then well, we all know how your average open source community is ... lots of infighting, lots of egos amongst the core maintainers, and occasionally some work gets done in the middle.

Don't get me wrong, I'm not suggesting closed-source is some panacea. But I am also equally enlightened enough to know that FOSS is not the panacea either.

Both have their strengths, both have their weaknesses. And certainly in terms of code security, neither is perfect by any means.
Doubting this will help show whether e^pi or pi^e is transcendental.
Sure. I skimmed the article and only really looked at the code for the deno one so I missed that they pretty much all had some special way to declare the deps that needed to be fetched.
Ok, keep beating that strawmen. Just a few more hits and it will be dead for sure.
Simple: I don't.

It is most likely compromised and I behave accordingly.
With your approach I'm sure you'll get back to normal traffic very soon.

I think your conclusion is right. It's not one thing that cause the drop but a combination of things.

Let's forget one sec about the traffic you had before and focus on the current situation.

- Page speed: It's one of the most important ranking factor. You don't have to get 100 score, but passing the core web vitals score and having higher score on mobile is recommended.

https://pagespeed.web.dev/report?url=https%3A%2F%2Fjohnnyrei...

A cool trick to improve the result fast is by removing the lazy load effect from the LCP:
https://i.imgur.com/rOOWm91.png

- Add a robots.txt You have plenty of pages in the site, it might be good to make sure only things you want to be indexed are getting crawled.
https://i.imgur.com/ONSiQjQ.png

- Add bio (one liner) here: https://i.imgur.com/SXbWVwU.jpg
Great smile. The bio should show your readers your expertise in the topic. If you want to take it to the next level, Quora is a great inspiration. In every Quora answer you can write a different On-liner/byline.

- Internal linking: I love your blog archive. It's a great idea. Try to make more strategic articles stronger. More internal links to the article will signal search engines this page is indeed important.

- Add Privacy policy & Terms of use pages

I can help you with analyzing the traffic drop if I'll understand which pages were your largest traffic generators.
Let's try to understand what happened to those pages, and how it's possible to make them stronger.

I worked with several large companies who had traffic drop after migration. Sometimes companies spend so much time and effort looking for the reason for the drop instead of just focus on recovering.

I'm up for analyzing the drop but if the reason is not obvious (Google Penalty for example), I recommend to focus on the future rather than the past.

I would love to help you (As a case study) with analyzing what caused the issue, and to give tips on how to move forward and get more traffic.

Edit:
We wrote a SaaS SEO guide that cover several related topics:
https://growtika.com/saas-seo/
The issue is more other members of your household. Your roommate, kids, spouse, etc. Policy and regulatory requirements don’t allow incidental disclosure to people like that, and the company has no relationship with them.

I dealt with this as a policy issue recently. Controls like aggressive screen lockouts are one of the few options available to allow some categories of workers to work outside of a company controlled premises.

The argument that you live alone etc is irrelevant as I have no idea (and don’t want to know) whether that’s true. I can tell you that people have done shockingly dumb things with remote work and the company has to try to control risk as best it can.
Everything I’ve seen is unconfirmed hearsay. /shrug
Just to be clear, the question of whether it's a backdoor or not doesn't matter for whether bad actors use it. The capabilities are rather well known. Its vulnerabilities aren't, but vulnrabilities do not a backdoor make.
What a bunch of backwood savages. Still living in the stone ange. Kept alive thanks to the oil money
The company makes nearly all of its money on short-term trades, but short-term trades have a much higher tax rate than long-term gains. Since short- and long-term taxes are calculated in separate buckets, if you create losses in the short-term bucket then you can drastically reduce your tax burden. These aren't really losses though, since they're balanced by opposite long-term bets
It's definitely still possible to use without cloud now, what I meant by "started down the path" is that it seems like the direction of the company is not aligned with what I want.

I was in the market for more hardware and I had to decide whether to increase my investment in Ubiquity or make a change, and I chose the latter.
In Android you at least have the choice to run a fully open source OS and open source apps, albeit with some driver blobs.

With the exception of the blobs, everything on Android is auditable.

Meanwhile very little of MacOS or iOS is auditable.

Personally I do not use or trust any of the above, but if forced to choose Android is worlds ahead of iOS in terms of publicly auditable privacy and security.

You cannot form reasonable confidence something is secure unless it can be readily audited by yourself or capable unbiased third parties of your choosing. This means source code availability is a hard requirement for any security claims. Even if you had teams de-compile everything you could never keep up with updates.

Not all open source code is secure, but all secure code is open source.
I'm the author of the mentioned blog post. The situation changed a little bit since I published the post, which is that wlroots finally gained upstream the scene graph API, which abstracts away a lot of the painful parts of compositor development, mostly the parts about rendering windows and damage tracking.

It is hard to quantify how much buggy, or less buggy, are "amateur" Wayland compositors compared to their X11 counterparts. While it is true that a Wayland compositor programmer has to code by hand a lot of boilerplate as I explained in the article, now that the absolute ugliest yet-still-essential parts have been abstracted away in the scene graph API (before, if you didn't implement damage tracking, you had to basically say goodbye to your laptop's battery), besides the other ugly yet-still-essential parts that are already the entirety of wlroots, now compositor writers have the sweet-spot where they can integrate the special behaviour their compositor is all about with nicer graphics, rendering, input handling etc. IMO, this actually leaves room for less bugs, and all around a much better, and stable, experience, than what one would get with an X11 WM + a X11 compositor on top.

And, looking at this compositor, Hyprland, it looks like just that. It's a nice dynamic tiling compositor, but it also has some very slick graphics, animations, config system. Looks like nothing I've seen before in the ricing space. And by quickly looking through its source code, it looks like it benefited massively from wlroots and from the scene graph API, plus all the other Wayland protocol extensions that are implemented ready-to-use in wlroots. Great work from the community!
The Past and Future of the Head-Up Display (2019)
Thanks for the links. The science study seems to be looking at the tipple vaccinated. There seems to be some indication, that this might influence the risk of reinfection as well.

https://www.medrxiv.org/content/10.1101/2022.12.17.22283625v...

See Figure 2 (end of the paper). Preprint, but pretty straightforward census of hospital staff.
TLDR; you don't.

Best advice I have, for what it's worth is to wipe and reformat from a known clean image regularly. If you haven't been hacked yet, stands to reason you wont be hacked going forward.

That said, I often install packages I don't fully vet, and grant permissions I probably shouldn't, either in the name of curiosity (how else do we learn and experiment), or necessity.
Assuming that you have no other option but to use a computer, there's some good advice here[1] for securing a Linux system. Then you can run regular scans using security tools like the ones listed here[2].

[1]: https://wiki.archlinux.org/title/security

[2]: https://wiki.archlinux.org/title/List_of_applications/Securi...
He finds the competition legitimately engaging on the proper sim racing 'games'. We're not talking Gran Turismo, Forza, the F1 games, etc but the more 'serious' ones like iRacing, rFactor, etc.

He spends a lot of time on them, as do some of the other younger pro racers these days.

Article here on how he believes it helps him become a better driver and how the sim racers are closer to real world racers than many people expect.

https://racingnews365.com/how-verstappen-uses-sim-racing-to-...
It's not that hard to write "we keep none of your personal data" as your privacy policy, if you want to track me on a personal blog you better get your legal story straight...
> nobody wants to keep gitmo open, the issue is that the remaining prisoners have nowhere to go.

nobody is not really nobody then. clearly the prisoners want it closed.

closing gitmo it admitting error: those who do not want to admit error are the ones who want to keep it open. apart from them, it's really nobody.
Ask HN: How did you become a “good enough” programmer?
By "good enough" programmer I mean someone who can get the job done in a not so messy way i.e. the programmer knows what their code does and how to decompose a problem.

To reach the above mentioned stage what did you do? And what kind of mental model helped in achieving this state?
I mean maybe, but he also just legitimately does it for his own enjoyment and training regardless of the big races he participates in.
Generally, if you make good changes, you'll see a short-term dip before a long-term increase. The challenge is differentiating between bad changes that have caused long-term harm, vs. good changes that are experiencing the natural short-term dip.

A website may build good reputation with a search engine which has ranking benefits but at the core of search engine ranking is individual pages: you must protect your well ranking pages at all costs. That means never break any links. If you break links, your pages will drop out of search engines, and it can take years to rebuild the lost reputation for those pages. The model for thinking about SEO should be page-based, not website-based.

The good news is that if your website was able to rank well once, it'll rank well again, because as much as we might tinker with the structure of a website, what matters most is the content, and you're still distributing that same content... you just might have set yourself back a year by breaking a bunch of links. Easy mistake, c'est la vie.

The ideal strategy for experimenting with SEO is to do it page by page, experiment with different changes on different pages and measure the impact. Don't make wholesale changes to the structure of every page until you're confident that you're doing something that works.
Replication isn’t backup though?
In Tsoding’s streams Porth started out hosted via Python before he eventually wrote Porth in Porth.
> Possibly not, though as a provider, they are entitled to make a profit.

The big thing people seem to disagree with is Apple forcing themselves to be a provider (and thereby forcing their entitlement to a profit). Apple is certainly entitled to compensation when people use their service, but no computer should force it's services on the user. Regulators seem to really hate that bit, and it will be interesting to see how Apple responds to the Digital Markets act.
> I wish this was less of a "team sport" where my guy who is "conservative" or "liberal" has to win and people would be willing to fire a senator or a representative for just one term

I think you should consider that this is something that can be manipulated to achieve the end goals of people like Yass. Current political strategy is to appeal to the extremes rather than the centers. Culture wars and the like are used to exploit people’s biases in social issues and help wedge apart the center.
-How Epidemics End
knocks on wood

Until the day we get sandboxing, well-defined interfacing with user data and stuff in desktop computing...

Imagine the desktop's security model, if you can call it that, on mobile. It would be madness.
If anything I think this underscores the parent comment - open source is not inherently more secure than closed, it just adds another potential avenue (source code audit) to ensure security.

If nobody actually audits the source, and the closed-source binary has had other types of testing done on it, it's likely that the closed source binary will be more secure.
On GrapheneOS you can choose specifc storage scopes, even if the app is requesting full user storage access.

And you can deny the file access permission like any normal permission, most modern apps request music or videos and photos, rarley an app requests full file access.
I think you’re confusing proving with understanding. The two are almost orthogonal.
I’m not convinced because my point still stands - a vaccine sounds like the worst possible way to achieve ethnic cleansing, especially considering the same vaccine is distributed to everyone regardless of race. Why not put the poison in the water supply, or food, cigarettes or alcohol supply chains which nobody thinks twice about consuming?
I understand where you are coming from but comparing things to the state of third party/library usage for c++ will turn people off. It is in a really bad state which is why things get checked in.
I got that part. But look at the quote: The article is attempting to explain the benefit of the tax scheme by saying that it reduces into components that are valuable in themselves -- "valuable commodities".

The scheme works as a whole, but the dynamics of it have nothing to do with losses being valuable commodities. It's just an over-clever writer trying to jazz up the explanation without realizing they're saying nonsense in the process and introducing a bad model.
here you go:

n => Math.PI.toString()[n+2]
I don't think most people are fascist, at least not to this extent.
The person doing this has made some really bad resolution/contrast tradeoffs
~~Keep in mind that making a file immutable doesn't prevent it from being unlinked. That can be removed and modified all the same~~

If this is a real concern, I'd be more mindful of what's being given privilege. It's atypical to chase - going as far to remove bad actors

edit: Wrote this while still half asleep, tested - wrong lol. Keeping to prevent more folly
A gain of X minus a loss of X is 0, but if you claim the loss at the 40% tax rate and the gain at the 20% tax rate you've suddenly reduced your taxes by 20% of X, which is significantly valuable.
Please don't post unsubstantive and/or flamebait comments to HN. You may not owe Putin better, but you owe this community better if you're participating in it.

https://news.ycombinator.com/newsguidelines.html
Both are one the same level at this point.
Depends if there's more of an economic downturn in 2023 (a recession even, perhaps?)

Real estate / housing is a lagging indicator. Could even take a couple of years for the market to bottom out in case of a recession event.

Edit: Obligatory "this is not investment advise" mention.
> Your point is not valid.

Which point? That we didn't have solar panels, cellphones, etc? Because I'm pretty sure we didn't.

Or that "off grid" living with children isn't necessarily "child endangerment"? We had much fewer amenities than most of the current "off grid" people and yet my childhood was perfectly safe, loving, and I developed into an adult with an Ivy League degree and good career in technology. I turned out better than a lot of kids whose parents had high paying jobs and used money to replace actual affection and time spent with them.

Where do you draw the line on "raising your child without best chances in life"? If you don't buy them the absolute latest iPhone and fashionable clothes so they can be popular in their schools is that child endangerment? If you don't take a second job so you can get them into a more expensive private school, is that child endangerment?

You said that you "want a story like this from a family with children". It seems like what you meant was that you want a story like this from a family with children that supports your own conclusions, not one that might refute them.
Disclaimer: I work for AWS in Professional Services. All opinions are my own.

The beauty about CodeBuild is that there is no “lock-in”. All it is fundamentally is a Linux or Windows Docker container with popular language runtimes and a shell script that processes a yaml file or you can supply your own Docker container.

You just put a bunch of bash commands or PowerShell commands in the yaml file and it runs anything.

The Docker container and the shell scripts are all open source and you can quite easily run them locally.

I could see outside of AWS keeping your Docker containers for your specific build environments in a local repository and doing all of your builds inside them using Jenkins using a self hosted CodeBuild like environment.

https://github.com/aws/aws-codebuild-docker-images

https://docs.aws.amazon.com/codebuild/latest/userguide/use-c...

For a “batteries included” approach though, I really like Microsoft Azure DevOps Pipelines.

I’ve even done a couple of integrations between Azure DevOps and AWS when we had clients that are Microsoft shops.

https://aws.amazon.com/vsts/

For AWS, if you use CodeCommit (AWS git service), all access is via IAM and granular permissions. If you integrate with Azure DevOps, the AWS credentials do have to be stored in a separate MS hosted credential storage.

CodeBuild also supports at least Github natively.

I’m not shilling for AWS. I have an MS development background (.Net) and only have “DevOps” experience using AWS and Microsoft tooling.
Checks clipboard

Apple still makes a 40-50% margin on every iPhone sold. The iPhone could be the cheapest smartphone around, and it would still be generally agreeable that Apple has enormous profit margins.
From the privacy perspective, ChromeOS is no different than Windows and MacOS.

From the security perspective, it's much better, because every single app is running in a sandbox.

I don't even use Chrome for web browsing on ChromeOS, since Firefox works just fine with flatpak[1].

[1] https://support.google.com/chromebook/answer/9145439?hl=en
Thanks for the tips!

> A cool trick to improve the result fast is by removing the lazy load effect from the LCP: https://i.imgur.com/rOOWm91.png

Haha, ironically I'm responsible for wholesale lazy loading of images in Docusaurus:

https://github.com/facebook/docusaurus/pull/6598

Generally that's a good thing, but it's not good for title images that appear "above the fold". I wonder if there's something we could do to determine whether an image is "above the fold" and so not apply lazy. Something to ponder.

> Try to make more strategic articles stronger.

Not sure I follow your meaning here, do you literally mean applying bold to certain articles? Or something else?
> Donors don't write the laws.

You’ve said that multiple times, as if you can just will it to be true through repetition. Of course, the statement is categorically false.

https://www.nytimes.com/2022/04/10/us/politics/crypto-indust...

https://www.nytimes.com/2012/04/22/us/alec-a-tax-exempt-grou...

https://archive.nytimes.com/dealbook.nytimes.com/2013/05/23/...
> For example IT enforces that your screen becomes locked after 15 minutes of inactivity

If you're on windows, there's a powertoy[1] called "Awake" that can keep your screen on indefinitely despite IT rules. I liberally use this on machines I'm remotely connected to because there's 0 reason why a remote session should lock if I'm active on the computer looking at a different window.

[1] https://learn.microsoft.com/en-us/windows/powertoys/
I was watching some other streamer racing in it and at one point 7 racers at once got booted off server. Maybe they shouldn't be doing 24h races if they don't get their server stability up to par, some people complained that if they were using iRacing instead of rFactor2 it wouldn't been a problem.
I’d much prefer to run this locally on my own. Any chance you’re willing to share code (or suggestions / links since it looks like you might be trying to monetize this per your Twitter posts)?
Security and privacy are two separate things and not always aligned.
Thanks.

I think you're right, this style of discussion can appear confrontational and focusing on scoring points.

I didn't see it at first - I was just parsing the words without imagining how it might be perceived.
Maybe so, but please don't post unsubstantive comments to HN.

If you know more than other people, that's great, and one option is to share some of what you know (in a neutral, respectful way) so the rest of us can learn. Another option is simply not to post. But please don't do putdowns or flamewar. It's not what this site is for, and destroys what it is for.

https://news.ycombinator.com/newsguidelines.html
Yea, that’s the issue. You also need some more time to pay interest and make a profit.
How I understood it, extremely simplified:

Suppose during 2023, you make $1B from short-term trading. If that's all that happened, you'd be taxed for short-term capital gains on it. But also, this happens:

July 1, 2022: Place a large bet "A" on S&P 500, and a separate large bet "B" against the S&P 500.

July 1, 2023 (365 days later): Suppose S&P500 is up. Sell your bet B. You lose $1B in short-term gains.

July 2, 2023 (366 days later): Sell your bet A. You make essentially the same amount that you lost yesterday, $1B, but in long-term gains.

Total for 2023: $0B net short-term gains, $1B net long-term gains, taxed at a low rate.
What We Know About Goldman Sachs Credit Card Portfolio Card
Veritasium has an explainer of the Fast Fourier Transform on youtube.

From how it's used and an interest history.

https://www.youtube.com/watch?v=nmgFG7PUHfo
How My First Investment Cost Me Most of My Savings
This is one of many ways by which NVIDIA actively sabotages the open source driver effort.

They were catching up at some point, and NVIDIA started doing that.
This was the MacBook strategy
I might be wrong but I think they are suggesting that Max's game could be pause. The time the bug is fixed. And then resumed.