skysight-inc/HackerNews huggingface dataset:
I disagree, because it is 2023 now.

Twitter was not, well, Twitter without the users and developers. Hashtags, replies, threads…users and developers. Not the product managers.

And that’s relevant because: if you’re developing a product today, probably worth thinking about how so many features and practices are an emergent property of how it’s used, and not what you are narrowly planning for.
Anyone even tangentially involved in infosec knows shodan though... so in that context everything done in the article was trivial.
That's why one is advised not to invest what one cannot miss
> I've ever seen evidence that ad publishers, or anyone in that massive ecosystem, can inject arbitrary code, running in the browser's context, into websites who monetize through Google AdSense script tags alone.

It depends on what types of ads you allow. Sourcing a javascript from Google is always at risk of whatever Google wants to run, but some ad types include advertiser javascript in the creative [1]. There's controls in place to reduce the chance of malicious code, but that doesn't eliminate it. (Plus or minus when they serve ads from other exchanges, as others noted)

[1] https://support.google.com/admanager/answer/3180782?hl=en
that shit was crashing our machines a decade ago
There's no "one size fits all" answer here.

If someone has done something really bad (maybe murdered someone) then yes, directly blackmailing them to do something major might work.

But in general the things we are talking about are mostly things were someone lied on their clearance form and if they decided to they could get that cleared up and cause the foreign agent significant problems by reporting an approach.

So instead they escalate. They don't directly blackmail you - you just happen to meet a woman at a bar who happens to have pictures of you smoking weed at a party 5 years ago. So you are joking around about what a great party that was, and it just happens to turn out that this woman works at a defense contractor and they are waiting on this stupid proposal to be released so they can bid on it, and you don't happen to know when it will be released do you?

So you go look it up. It's not classified, maybe it's commercial-in-confidence at worst. But then this woman needs to know how long she should rent her apartment in town for, so exactly how big is the project? How many units are they ordering?

That's still not classified, but is need-to-know. But she's hot, so you tell her.

And now they have you. You might not actually realize yet you are being blackmailed, but as soon as they ask for classified info you realize she can ruin you.
The Lisa Was Apple’s Best Failure
Legit can't comprehend this comment
A bit offtopic but how does one actually become a CA? Anyone has any good write ups on the costs and timeline involved?
Ask any teenager today and they'll probably say they don't really care, because it's too expensive to own and operate a car, there's no place worth going (or it's too expensive unless it's fast food), and they can just stay at home with their phones instead. Teenagers today have very different values than in prior decades.
TSMC is making the best of a bad geopolitical situation
> After failing to understand an explanation, I feel I shouldn't ask again for fear being labelled "dumb"

What would be the worst thing that could happen if you did ask again? Would you get fired? What if you don't ask, and make a mistake for lack of knowledge?

> Has anyone felt like me?

I have. And I know what it feels like to be reluctant to ask for help. I struggled with it for years. I had the attitude that knowing all the answers was part of my job, and not knowing meant I wasn't qualified.

I was very wrong for a lot of years.

Here's how I think of things today: asking is honest, pretending to know when you don't is a lie.

Of course it's not as simple as that though.

You still need to do your part.

If someone says "The QOS process that the Triage team rolled out last week is broken and flooding the POC terminals with bleep blorp alerts," you need to find the balance of what's "askable" and what's "researchable."

How you find that balance takes practice, and probably depends on how you learn.

My rulebook:

If it's domain specific, I don't waste a second not asking. I'll interrupt executives in meetings asking for clarification and understanding. It'd be dangerous not to, since I trust that they know how to do their job as much as they trust me to do mine. If I don't ask, I risk delivering work that is based on whatever my imagination came up with to handle something I know nothing about. Asking someone who knows is always less expensive than trying to answer it myself. The answer I'll get is also much more likely to be accurate than if I draw my own conclusions.

If I need to know how to do my job better, it depends. As a programmer, there are things I must know that have nothing to do with the domain I'm working within. Stuff that I bring to the table as a programmer. Stuff that transfers to jobs in totally different domains. As an E8 staff engineer (think highest level senior engineer at a company), there aren't a lot of people I can talk to about my programming question though. For those kinds of questions, it's my job to find the answer on my own.

More junior? Ask every time.

Not senior but not junior? I'd want to compare what it costs me, in time and money, to find the answer on my own compared to what it costs in time and money for me to ask someone who knows. Almost always, it's better to ask.

The reason?

As an E8, it's also my job to answer questions from junior engineers. It's the best part of my job too, because it means I get to help someone grow as a person and in their career, but also be better at their job, which helps me and the company I have equity in.

My advice to you specifically: ask questions until you understand. When you do understand, immediately offer to give a presentation on what you learned so that others can learn too. There's no single thing that's more effective in helping yourself learn something then to agree to give a presentation on the topic.
If we could simply convince the entire world to speak either Persian or Bengali, we could avoid the whole problem.
Eccentric Training: What It Is, Benefits, and Exercises
A quick consultation with Dr. Google states caveats to what you are claiming (this is data from a carnivore advocate [1] btw.): you have to consume 2.2lbs of grass fed beef to get ~25mcg of Vitamin C. The daily recommended value is 75mg [almost double if you are pregnant] (you need 1000mcg to equal 1mg). The WHO recommends at least 45mg a day to prevent scurvy. 1 decently sized orange would cover the recommended daily value. Beef seems woefully inadequate to me at least.

The next fascinating question: how much does 2.2 lbs of grass fed beef cost? Just looking at the prices for fresh organic steak is almost $40 per pound at my local supermarket. That is an amazingly expensive diet! Imagine feeding a family of four on that! That is almost $400 per day, $2800 per week, $146,000 a year in just food costs. Yikes!

[1] https://www.doctorkiltz.com/vitamin-c-on-carnivore-diet/
I would be interested in reading more if you cared to elaborate or provide some link(s).
And also it's been confined to Switzerland for at least a couple years now; committing US federal crimes isn't a new circumstance for it.
That specific fault applied to LastPass, I used it as an example of a flaw in a system advertised as zero knowledge, to demonstrate that not all systems are created equal. It is true that BitWarden's Open Source nature helps prevent silly things like that.

You raise a good point that their open source clients are _verifiable_, but they're not often _verified_. I'm certain that you verify the checksums of all your updates or exclusively build from source, but the distribution channels on most platforms encourage users to trust updates from BitWarden inc. If those channels are compromised, most users are one unchecked automatic Play Store update away from a problem.

Not disagreeing, just noting that Open Source is not a silver bullet given BitWarden's default architecture is centralised web service with centralised client distribution channels.
Yeah. It's even better since you are starting with iron, don't have to wait billions of years for everything to burn first.
"Unstoppable" only as long as camera manufacturers don't add the stop. You cannot make a color photocopy of (at least European) paper currency. That sort of thinking could be pushed to cameras too.

(Though the original EURion was more about counterfeiting than about Hollywood studios.)

https://en.wikipedia.org/wiki/EURion_constellation
This is horribly frustrating and I'm sorry you are facing this.

The thing I have taken away from these continual Tell HN posts about Google acounts getting locked up because of 2FA is that the "something you have" factor needs redundancy. I now have my phone, and 4 yubikeys on my household's carkeys and a trusted friends and a family member's firesafe. These have also given me enough stress that when I visited home for the holidays I added to my aging parents' Google accounts with a handful of additional security keys to go with their SMS 2FA.

Personally I would rather have accounts which are secure and can be lost if I am not careful with my 2nd factors than one that has vulnerabilities that the whole internet can attempt to exploit, but I realize others do not have that same priority.
Wow, actual hacker news.

For once.

Meanwhile, another front page article is some genius asking why there aren’t any cars in 1984.
Remember the ancient times before chatgpt?
Still, it's the closest we're going to see... for now. It's definitely an interesting branch of research.
It’s readable via <nntp://news.gmane.io/gmane.comp.mozilla.devel.security-policy>
I was wondering if there is a possibility of obtaining an offline version of the service, in order to mitigate the inherent risks associated with transmitting proprietary code to external servers, thus ensuring optimal security and confidentiality of said code?
This is all conditioned on a concrete building. Forget about it in a typical North American stick construction.
Microsoft laying off 10k workers – about 5% of all staff
At least it got flagged! But since I can't reply to it and put some effort into typing a reply, I hope you don't mind me dropping it below.

---

What? I agree that for my tastes a lot of people take gender very seriously. But it seems wild to me to think this is somehow a new phenomenon.

For millennia in many societies one's society-assigned gender determined a great deal about one's status, including what work you could do, what work you could do, and what sort of violence against you was acceptable. And in a lot of times and places, misgendering somebody was used as a deliberate insult and could even be seen as "fighting words", legitimate legal cause for violence.

The only thing that has changed lately is a bit of individual freedom in picking that role for one's self. For those people, many consider it rude to ignore their choices, partly because of the history of gender, but partly because those people are targets of bigotry and violence. There's a whole list! https://en.wikipedia.org/wiki/List_of_people_killed_for_bein...

All moral codes have a "coercive" element to them, just like all legal codes do. If you're going to be rude, people may, gasp, say something about it. You trying to establish a different coercive moral code against that isn't somehow better. And getting all het up about it in this specific case, instead of all the other codes of politeness, suggests it's not really "coercive" morality you care about.

Personally, it seems to me that trans folks have a pretty hard role in life. They always did, but now at least they're getting to be open about it. I'm glad to support them in that; calling them how they want to be called seems like literally the least I could do. Indeed, as a thoroughgoing nerd, I spent a lot of my childhood getting shit on for being different, so I'm happy to help make space for different kinds of difference.
Anybody can become a CA; there’s no real cost.

If you mean becoming a CA that browsers list in their trust roots: you need to obey the CA/B baseline requirements[1], which are reasonably onerous given the position of extraordinary trust it affords you.

There are other requirements for other kinds of CAs as well (for example, codesigning in Windows).

[1]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...
More Chinese propaganda.
It's 200 BC now, it's not important how Carthage and Rome were founded.
Oh don’t. I spent several hours last week unfucking one of those.
The property that pronouns capture is essentially arbitrary. That's why Romance languages assign gender to stuff like telephones and sandwiches.

The point of gendered pronouns is that sentences very often have two nouns: a subject and object. If you have only a single pronoun, then any sentence can only use a pronoun to unambiguously refer to one of those. If you have two pronouns and you randomly and evenly distribute them across various subjects, then it's fairly likely that the subject and object will get difference ones and you can now unambiguously use pronouns for both.

Since a very large fraction of human speech pertains to other humans and since human sex is a roughly 50/50 distribution, it makes some sense that we used gender as our mostly arbitrary thing to assign a pair of pronouns too. We could have used, say handedness instead, but with only ~10% of people being left-handed, the odds of a sentence being about a righty and a lefty is much smaller.

Pronouns are basically like special variables in a REPL that let you refer to the most recent expression. It's nice if you can refer back to a couple of them.
Sure, but then I would need to fork all repos I work on. Also you still would need to commit and push it somewhere.

It’s possible, but it’s some steps you need to take. You can’t just get up from your pc, take your laptop and start working.

Local changes in gut feel like in the pre-Dropbox era, something you need to copy on your own.
Wouldn't the stock market chart for Russia have a rather sudden stop around 1917?
Good point. I’ll have to ask my mentees but I think you might be right.

But I guess to answer the question we’d have to explore it from the frame of when it was written. So… in the late 40s did teens get access to cars? I feel like that was an American 60s-00s thing. Was it big in the UK? Now I have to research this because I’m very curious.
The Complete Guide for Developing Ghost Themes with TailwindCSS
You can and it is well "documented":

https://www.howtogeek.com/224344/how-to-disable-spotlights-w...
The car is much too individualistic for 1984. The train is much more on-theme as it's very controllable by a central authority.
Can you help clarify where you're seeing glee, either now or in the early 90s?
"if you really really wanted a car, you could eventually get it"

Never in my life have I ever seen the word 'eventually' doing so much work.
I am not at all reassured by the suggestion that hiding to one side of a door will help.

I don't understand the details of the simulation, but I would have guessed incoming pressure waves would bounce off back walls and create a turbulent mess of forces in the areas hidden from the initial pulse.

Also ignored was the solidity of the walls. Concrete might survive, brick could possibly survive. But a partition wall with a couple of sheets of thin plasterboard nailed to weak wooden supports would be unlikely to offer much protection.
Scrum Masters are the answer to the question: “What if if we started with a philosophy of development team ownership of process, and then designated someone not otherwise part of the team to, um, act as if they owned the process.”

(Product Owners are the same thing, but for product instead of process.)
Complete proofs and programs are isomorphic. Many proofs while incomplete are perfectly legible to experienced practitioners who can fill in the details without getting bogged down in trite steps. Morevoer, isomorphisms are simply provable facts between two types of objects. Most isomorphisms are generally used to convert one object into another object which is more amenable to being used in a given proof. An isomorphism does not beg the conversion and there are many trivial isomorphisms of limited use.
Why did you add "other than in a metaphorical sense?"
you may also like: https://nicholas.carlini.com/writing/2019/javascript-doom-cl...
Yeah, I have trans friends and former colleagues, and can confirm all of this. I'd love to live in a world where it wasn't controversial or dangerous, but we are not in that world yet.
With EasyRSA, you can become your own CA for your own personal devices! (Though on Android, installing a custom CA does give you a perpetual warning notice.)

In combination with my PiHole setup at home, all my devices have names and SSL certificates, protecting them from being snooped on by things like my Chromecast!
They need light during the day.
If you look at the emails by Kathleen, she was very deliberate and professional in her phrasing. She only called Rachel out by name in a footnote, and never drew attention to the lie directly. I elided a whole lot of body text to put those two lines together, and even when combined Kathleen doesn't explicitly call her out for lying. That shows a lot of decorum and restraint on Kathleen's part, given the nonsense she was confronted with.

There were definitely some people on the mailing list who were less than professional (and of course on Reddit and HN), but the main decision makers were very careful and professional throughout. Rachel is the only one out of the core people involved who lapsed into immaturity.
It's Pascal but not UCSD. UCSD compiles to a virtual machine called p-code. Lisa's Pascal compiled down to the metal.

(I used to use a Lisa to write Mac programs. In the early days Macs didn't have enough RAM to run the Pascal compiler.)
I don't think you read my post. :) I offered an alternative option prior to the iPhone option - a new phone every year starts around $14 a month.

And that's before government subsidies, which can lower monthly service cost AND device cost to $0 - depending on state/income/age.
This whole thing has made me incredibly happy to see that somewhere, someone out there on the internet is pwning people for stupid vulnerabilities and posting about it on a site that looks like this one. I admit the flashing ACAB really did it for me.
I didn’t see that much glee in the thread. At most, maybe mild bemusement at how ridiculous the entire affair was, relative to how staid policy enforcement can be.
There’s a single maximally virulent system of “managerialism” that all of those options you list (and others including modern absolute monarchism and even modern theocratic states) follow. Other alternatives that were common historically were eliminated by these. Competitions between these variants of managerialism are mostly about finding an ideal balance rather than fundamental difference.
Not only could you that, you could also have program running on the disk drive send a text file to the printer. so you could print without the computer if you could write the small 6502 program you needed to install into the disk drive.
I'm happy to see this (though having read to the end, the author really doesn't say anything original and basically is a naive "AI" bull, but at least he asked the question)

There have always been two AIs, the same as there have always been two cryptos (three if you count cryptography).

The academic "crypto", distributed consensus etc. was always legit, and unfortunately didn't have many applications. The NFT, pooCoin, ponzi world crypto and the (to be charitable) naive VC investors s an pretended to understand the tech, was just a silly bubble and some bros having a moment (like those mortgage brokers in The Big Short.)

Anyway, AI is the same, and has all the second part, the VC bro bullshit from people pretending to be visionary, and no doubt the scammers and charlatans are moving in.

But there is so legitimate ML technology (not the current shiny stuff) that has economic value that will endure when the hype goes away.

So the difference is "crypto" is essentially worthless, AI/ML has a valuable baseline, it's just going through a silly bubble. When the dust settles, chatgpt8 will be the butt of some jokes, and we'll get on with the actual value of using gradient descent to find patterns in data
Stroustrup, et al.: DG Opinion on Safety for ISO C++ [pdf]
This looks wonderful, but I can't help but think the medium of a PDF is not optimal for something of this scope (24 coauthors! 700 references!) and potential impact - it's goal is not just to share a new discovery but get a bunch of people on board with a new way of thinking and working.

Feels like it'd be much better in wiki form where it can live & grow and its easier to navigate between discrete concepts.
They should just send the list to the New York Times and Fox News.
> you can’t use Twitter’s API or content to “create or attempt to create a substitute or similar service or product to the Twitter Applications

Elon is envious of Apple?
I don’t use search. I carefully put things where I will find them.
I think no place worth going is the fundamental thing.

Socialization can happen online to a great extent. Clubs are 21 and up. Restaurants are too expensive. Underground clubs and parties are rare to nonexistent, killed by a mix of helicopter parenting and disengagement driven by being online. Concerts are a bit of a thing but also expensive.

It’s just such a different world.

I was really into BBSes as a teen so I guess I was among the early adopters. I didn’t go out much until senior year of HS and college.

I was weird. So wild that I would be normal today.
And possibly not pay more for food either, given that there are often prices floors or other similar things. Remember that we usually have a vast surplus of food in the US.

The govt at one point was running massive warehouses to store cheese, as a way to keep up milk prices. This is the origin of “government cheese.”
What's artificial marble? Do you mean quartz countertops?
> Can these models feasibly be run locally?

Bluntly, no.

The models which are small enough to run locally perform so badly it’s not worth bothering.

To run inference on the large models the perform decently you need the equivalent of two or three top end graphics cards.

If you're serious about looking into it now, consider looking at this project that lets you run a bunch of independent machines as a cluster for inference using Bloom:

https://github.com/bigscience-workshop/petals/wiki/Launch-yo...

(You'll need around 200GB of GPU memory across the machines in the swarm)
It shells out to the EDITOR environment variable, which is controlled by the less privileged user.

In this example they inject running an editor against another file.

I'm guessing you can put arbitrary code in there or point it at a locally controlled executable too. But I'm not sure. Maybe sudoedit puts more scrutiny on that variable than most, non-security programs. At any rate many text editors have lots of modules and scripting and can presumably load and execute code as the privileged user.

The workaround is to change the sudo config file to remove the EDITOR environment variable and a few others.
Intel, AMD just created a headache for datacenters
I can't say I've got sympathy for the business and it's owners, but my sympathies to the employees impacted is best focused on why employees must get so screwed over by the business going under, not on preserving the bad business.

The business is the unimportant part
How would that work exactly? So args resolve into a protobuf struct? But how are human readable args parsed into a protobuf?
The Sims 4: Compression and then sudden fiery expansion pack.
Mathematicians Roll Dice and Get Rock Paper Scissors