skysight-inc/HackerNews huggingface dataset:
This is empirically verifiable and, dare I say it, quite visible.

It is also a virtuous circle: you come in early, you are promoted because there is virtually no one else around, or you are chosen as the best among a group of fairly mediocre people--maybe they use a die to choose who will become the new "leader" of the group--and in a couple of months you go from being just another IC to a rising star.

You are quickly recognized as such and, in an environment with very loose feedback cycles such as management in the technology sector, you are free to fake your way up to the top. As soon as you are exposed, if ever, you can recycle yourself elsewhere as a true and proven leader of vast experience.

Or, assuming you are not very good at leadership in absolute terms, you do a good job anyway because most management is skirting responsibilities, taking advantage, in a good way, of colleagues and the machinery that makes the company work, and, most of all, going with the flow.
The original iPhone SE, I would say (same form factor).
Back in 2005 the idea that you shouldn't run every bit of executable code sent to you was drilled into people. Nowadays you can't use a commercial/institutional websites without doing the modern equivalent of opening random email attachments.
I agreed with much of the article and points made. Maybe I'm missing something (if so, would love to learn!) but I felt that the "Penetrate and Patch" section was a little naive.

e.g.

> Let me put it to you in different terms: if "Penetrate and Patch" was effective, we would have run out of security bugs in Internet Explorer by now. What has it been? 2 or 3 a month for 10 years?

I agree with the point that "Penetrate and Patch" shouldn't be the primary strategy, but the author seems to write it off entirely with a viewpoint like "you should just write software and build systems that don't have security bugs". Well yes, of course that would be nice, but that's not feasible. And some software is much more difficult to get right than other kinds.

"Penetrate and Patch" is a useful piece of security in that (a) it can catch what slips through the cracks, (b) it provides a sort of incentive mechanism to get it right in the first place, and (c) it simply isn't possible to build bug-free systems.

The author claims that "Penetrate and Patch" finding bugs every month as evidence that it's bad, but isn't it the opposite? You cannot be bug free, so in fact any incremental progress/fixes is in fact good.

All that said, I do agree that all of this starts with secure by design. "Penetrate and Patch" isn't a good primary strategy and cannot replace Doing It Right. But I think it complements it well.
Profiling. So much profiling.

Of course for that to be relevant you need to have tests that can actually hit the relevant code paths.

The fastest(hah!) way to get performance of something fixed is to provide a easy to run deterministic and vaguely realistic example where performance is significantly worse in one case vs another. Now that could be one JS engine vs another, but it could also be a piece of JS calling two functions doing the same thing, only one in JS and one in wasm, or say a switch vs a series of if/else
Of course the int overflows can cause safety issues. We're talking about Git CVE's regarding exactly that, after all. It's true that the int overflow checks incur overhead (has anyone measured it?). RISC-V missed the boat in not giving a hardware trap for it.
Until you add a flight to your calendar and have to look up the timezone.
> Hacking was huge on the 360

It was! I was a pre-teen then but I remember modded controllers and getting into modded lobbies. The only modding I did was USB modding my avatar and gamerscore, only to login a month or so later to the prompt that my account was banned forever.
Running everyday to escape stresses may lead to dependence not mental wellbeing
I mean, the fact that the writer has to do:

"...from N a N biological N point N of N view N..."

Where N = "I will be replacing spaces with the letter “N”, standing for “NOT TO BE TAKEN OUT OF CONTEXT”"

Because: "If I understand journalistic ethics correctly, they can’t edit the sentence to remove the Ns - and if they kept them, people would probably at least wonder what was up."

Seems tantamount to saying that "journalistic ethics" is an oxymoron anymore. As of 2021, apparently even the New York Times cannot be relied upon to quote accurately, if not always fairly.

Come soon, Sweet Meteor of Death.
Microsoft - microbes
Can you say the difference in the binary program size?
It's not naive so much as it is motivated by enmity for vulnerability research and vulnerability researchers, which was a thing from '98-'05 or so.
Can you name them? Even the academic/research ones or the barebones embedded kernels I'm familiar with use extensions to get things like context switching/multitasking/threading to work.
It seems like a seriously wrong default for a language whose story is supposed to be safety. People wanting unsafe languages already have C and C++ for that :/.
Are they podcast? I would call them informative videos if they are YouTube but they don’t publish them as an audio podcast.
Each probiotic is different and each person is different, so it's hard to make the recommendation actionable.

You'd have to know what's already in your intestines, and the best we have are poop tests, one of which (uBiome, YC S14) famously failed and is being prosecuted as insurance fraud, so doctors probably don't want to get into that. (There are still going ones like Viome that might give you interesting results.)

Fermented foods aren't all the same too; yogurt is milder than kimchi for sure.
Yep, SIEM is just a superset of Log Management as it needs to do things like alerting + correlation + detection etc. in addition to ingesting logs to be considered a SIEM.

It is a common use case to send application logs along with security logs to something like Matano or Splunk for analysis as well, so feel free to use Matano to analyze your non-security logs!

Do keep in mind this will be a better fit if you have structured logs (you can also use VRL transformation to parse them at ingest) as the query language will be SQL.
And then you introduce double entry accounting in your stock management and hell breaks loose.
They did write about the military angle in the article. It seems they saw it and either weren't paying attention or didn't bother to do anything. I guess it would be kind of a pain in the ass for a military primary radar to attempt to correlate every contact with known flights operating normally and to send up interceptors for anything that didn't seem to match. It's not clear if they would even have interceptors at a sufficient readiness level to actually catch a jetliner at cruising speed and altitude near the edge of their coverage.
But the client side code in a web-app is run within the browser sandbox, which is not equivalent to running a random exe... Unless you meant something else?
This confused me too, my interpretation is that the author is saying you should not invest time in learning how to use the exploit or scanner du jour.

Being aware of the new hacking techniques is ok, but I think this is arguing against vulnerability scanning tools.
> For other sensors, you mentioned zwave, curious what you're using.

I'm not using it for sensors, and probably won't; I like zwave because it lets me use commercially produced UL certified devices with wall current - I don't trust myself to DIY a smart plug and not burn down the building. Sensors are safer in my mind, so for those DIY ESP8266 projects win.
> GoTo said in an updated statement that the cyberattack impacted several of its products, including business communications tool Central; online meetings service Join.me; hosted VPN service Hamachi, and its Remotely Anywhere remote access tool.

^ relevant information about 'what's new' on this vs. the previously disclosed lastpass breach, emphasis added.

...and from the official statement:

> At this time, we have no evidence of exfiltration affecting any other GoTo products other than those referenced above or any of GoTo’s production systems.

> We appreciate your understanding while we continue to work expeditiously to complete our investigation.

i.e. 'we're still not 100% sure what else'.
For ipad, Capture One subscription is way costlier than Lr.
Generally it depends what you need to get from it. If it's a standard research paper with introduction, methodology, results, and discussion you can use the introduction to gauge your understanding of the essential background and then check the findings.

Discussion will usually tell you where the researchers see issues in their methodology and findings, as well as suggestions on where to go from there. Reading the methodology may be extraneous to you if you trust the researchers and results. It's good for attempting to reproduce or to critique findings, but you'll ideally get a sense of the methods from the other sections.

On the other hand, if you're reading Audre Lorde you'll have to break out a highlighter and gut it out.
I think it was substantially different because probably most of the things that the ancient Romans did in the bedroom would be highly illegal today.
> Frankly speaking, I don't believe in open-source projects without paid components

Can you clarify your scope here? I mean, there are thousands of of active projects out there maintained by their creators or communities and are not monetized. They contribute to open source because they get enjoyment from working on the project, participating in a community around it, or derive meaning from putting something nifty into the world.

Making money in relation to open source projects is not a new idea, but the notion that every good idea needs to be monetized certainly is pretty recent.
Amazon deepens healthcare push with $5 monthly subscription
Archive link:
https://archive.ph/Z5vh0
There is no viable anticompetitive case for VR as it is a nascent industry which barely exists. Furthermore, Meta is far from the only player in the VR space today - Valve, Pico, HTC, Samsung, and Microsoft amongst others all play a role in the VR ecosystem.
One good thing about the Court is that you can go ahead and just read what he writes and develop your own opinion on what he thinks and why. It’s all public and free.

A test I have for any article about the Court or its Justices is a really simple one: if the article does link to the Opinion, it’s pushing an agenda or a narrative. Once you do this you’ll probably discover that well over half of the articles about the Supreme Court are not worth reading.
The blog is cool.
I know a little Japanese. I really appreciate that all the technical terms are written in plain English instead of Japanese Katakana words.
1. Default deny is one of the oldest best practices in security engineering; it barely needed saying in 1995 (but Cheswick & Bellovin said exactly that in Firewalls & Internet Security).

2. "Enumerating badness" is simultaneously an attempt to connect vulnerability research to antivirus (security practitioners have had contempt, mostly justified, for AV since the late 1980s) and an endorsement of the heuristic detection scheme companies like NFR sold. Apart from the shade it throws at vulnerability research, it's fine.

3. "Penetrate and patch" has aged so poorly that Ranum's own career refutes it; he ended up Chief of Security at Tenable, one of the industry's great popularizers of the idea.

4. "Hacking is cool": literally, this is "get off my lawn".

5. Objecting to user education is an idea that is coming back into vogue, especially with authentication and phishing. It's the idea that has held up best here.

6. "Action is better than inaction" --- this is just a restatement of "something must be done, this is something", or the Underpants Gnome thesis. Is it true? Sure, I guess.

As a whole, this piece has not aged well at all.
I don't think I'd use those words to describe locked down hardware. You'd be stuck with a 5+ year old browser that you can't upgrade because Apple bans other browsers from running on iOS, you wouldn't be able to install modern apps because the App Store stopped distributing packages that are compatible with your phone and Apple won't let you install apps any other way, and you can't install a modern OS of your choosing to address either of the first two issues. You're also stuck with old or non-existent drivers for any hardware you might want to use.

Meanwhile, I have 12+ year old Macs that still work great, have up-to-date browsers, can install any app, and can run the same modern software that my 6 month old machine can.

iPhones make sense from a reduce and reuse (as an egg timer) standpoint. Apple can clearly build products that can stand the test of time and still be genuinely reusable, but those products aren't iPhones.
Yes. Our biggest problem in Queensland is that Labor aren't very good, but the opposition (LNP) is much worse and are basically just an absolute joke - they were a complete disaster last time they were in power (and voted out in a huge wipeout the very next election), have a lot of far-right crazies, are incompetent and extremely ideological. Minor parties like the Greens are getting more traction because of it, and there's been a big independent movement in the last few years across the country so perhaps that will dilute Labor's power somewhat. But we'll have to see next election...
Thanks! That really had nothing to do with what I asked tho... This bit of thread is literally about using it to write code, so saying "pretend you're a PM" is not really relevant at all
I care, because I think OpenAI is still endlessly fascinating.
That sounds great! I plan to build such a reminder service for myself with additional infos like the subscription costs.
How did you managed to show different categories/calendars and how did you do the repeating scheduling of events?
They might but also everyone is going to think you’re a bozo if you use “open source” and it’s not.
That's Samsung's "promise". Similarly Apple promises to provide 6 years of security updates. This update is an exception.
It is, but my point is referring to the time when there was no cloudfront.
The documentary is now screened in many college campuses across India.
Welcome to Maoism-Third Worldism comrade
> ideally, a list of papers that could take 2-5 hours each and a few hundred lines of code?

I think you are severely underestimating the time required, unless you are quite experienced, know exactly what to look for, or the paper is just a slight variation on previous work that you are already familiar with.

Even seasoned researchers can easily spend 30+ hours on trying to reproduce a paper, because papers almost never contain all the details that went into the experiments. You are left with a lot of fiddling and iteration. Of course, if you only care about roughly reproducing what the authors did, and don't care about getting the same results, the time can be much shorter. If the code is available that's even better, but looking at it is cheating since wrestling with issues yourself is a big part of the learning process.

A few people here mentioned Andrej's lectures, and I also think they are amazing, but they are not a replacement for getting stuck and solving problems yourself. You can easily watch these lectures and think "I get it!" because everything is so well explained, but you'll probably still be stuck when you run into your own problems trying to reproduce papers from scratch. There's no replacement for the experience you gain by struggling :)

It's like watching a math lecture and thinking you get it, but then getting stuck at the exercise problems. The real learning happens when you force yourself to struggle through the exercises.
Can you define a couple of hundred? Just to be clear I am a language descriptivist, and am looking for a timeline I can hang you on for being wrong. Also to preface, if you pick a timeline older then the phrase “the bees knees”I will think you are irrelevant, and if you can pick a younger phrase but I can show language evolution on top of that, I will also consider you irrelevant.
I also appreciated the post, however, I did not appreciate yours.
The consumer OS lockdown side does have a lot of interesting points. One I also thought of - I'd bet that, even if we reject web browsers, basically every user's "30 most used apps" has at least one that has a plugin system that loads unverified code, or runs macros in some kind of interpreter that is or may later be proved to be exploitable, or parses structured data from files that can't be trusted using non-memory-safe code, or some other thing I haven't thought of.
oh sweet! https://forum.rainmeter.net/viewtopic.php?f=27&t=34430#p1701... did the trick :) ty
But if the stock goes to zero and you are shorting it the trade was massively profitable. why would you then be at risk of a margin call?
Show HN: Make your product extendable via “Functions” like Shopify and others
Pressurization is relative, aircraft can end up pressurized on the ground. Next time you fly, note the warning beacons in the windows of all the doors. They indicate the cabin is pressurized alerting rescue crews that attempting to open said door will either A: not work or B: kill them, as has happened before with a G150 [1]

Also, there are other situations where you may be inclined to disable bleed air, such as in a fume event where an engine is releasing turbine oil into the bleed air stream due to a mechanical failure or fire.

[1] https://www.flightglobal.com/g150s-pressurised-door-fatally-...
wow this blog might be a gold mine for me rn? (also i feel like an idiot for trying to make another bookstore ecommerce platform (wip))
Medium Is the Message
Given how many of them leave their kids with the grandparents and move to Guangdong, etc. to work in the factories and live in bunk houses and send money back home, only seeing their kids once a year during Spring Festival, I think they might not be content. (On the other hand, I guess the ones still farming would be happier, by virtue of self-selection.)
wow. this is being downvoted like hell. why? you don't like views contrary to what the bug brother wants to project? fuck you
Year Using Obsidian
I haven’t heard one person say they want to go back to office everyday of the week. Let alone majority of the week. When asked in a group at work everyone feels pressured to say they miss in office work but I really doubt anyone would say that if they knew it wouldn’t make them look bad.
> benefits that can’t be replicated sitting at home on the computer.

Please cite your sources
You are correct. It is a “first initial draft,” where the first iteration of the article is acknowledged to have been generated by ChatGPT (https://en.wikipedia.org/w/index.php?title=Artwork_title&old...). I tried to indicate what you mean, but “first ... initial” exceeded the HN character limit and “first ... first” seemed too repetitive.
I've been living off of fixing misconfigured mailservers for 15 years. It's really not /that/ hard.
> This is kind of very obviously not true.

Who is competing with gmail? Please include market share and revenue in your analysis

>>and YouTube
Lots of companies operating in the video delivery space too.

This is more defensibile than the YouTube argument, there is Rumble and Vimeo for instance. But again,
What is the market share and revenue for YouTube vs these other “competitors”?
Wealth tax in California would make rich residents pay even after they leave
The same reason everyone wants the most mundane details of our lives and a multi-billion dollar a year industry has sprung up around the buying and selling of that data. Because they know they can use it to their own advantage, always at our expense.

Microsoft has decided to use their OS as a data collection and ad pushing platform. The amount of dirt they must have on the average windows user is disturbing enough, but with office they get unprecedented insight into the internals of damn near every company including their own competitors. When my own company gave me a windows 10 machine, it came with Microsoft's keylogger enabled. First thing I did was tell them they should probably update the image they're using on new workstations to disable telemetry or at least make sure that every password and keypress wasn't being collected, but we still leak a ton of data to MS. Company data, employee data, and customer data. It's amazing how every company accepts it.
This is pretty cool. They are outside of the US, but even if they paid typically higher US salaries, they would still have many years of runway.

It looks like there might be some funny business with MAU and Total Customers. MAU is only 3,500, but they somehow have 50k Total Customers? And they have a free tier? If only 7% of your paying customers use your product, they aren't going to renew. I expect that this doesn't include churn or is actually some kind of cumulative integral counting customer months or something.
> I understand that layoffs are a blunt instrument and it is unlikely that all of the “right” people were affected

Layoffs in this case are merely done to manipulate the metrics used by wall street analysts. That's the only reason they are being done.
Say more? Are you tired of it personally or is it troublesome at work?
From the review comments:

“The only con I can name is the casters do not roll as smoothly as better quality casters. In moving a ‘63 Galaxie 500 it takes 2 people to make it roll on a perfectly smooth and swept floor.”
Sounds like tech influencers even before ChatGPT existed :)

I swear if I see one more TODO app...
It definitely seems like it's gotten more robust since the 0.9.x/1.x/2.x days. And a lot of stuff that had to be done externally is starting to be baked into the service itself (rolling over indices, rolling up based on a query)

I'm a bit cautious using 8.x, because opensearch forked at 7.x. I don't really have any desire to keep track of any divergences between the two :-/ It's really unfortunate that there's so much bad blood between elastic and aws.
https://archive.is/XQMCe
Chinese farmer probably has higher data rates on his phone for less per month.
> 573 vs 605 are both very high risk

Those were just random numbers I made up. With only a little bit of imagination, you can consider the significance of other number discrepancies.
They often have special offers for new customers, in which case you could call back the next day and claim to be a person who just moved in to the address of the person who canceled yesterday.
> probably most of the things

Some examples here would help .. preferably tied back to actual Roman poractices and their frequency rather than some idealised and exaggerated notion drawn from watching the unexpurgated Caligula.

Bear in mind that Gaius Valerius Catullus in Catullus 16 is making a threatening statement of intent in a poem .. which is no more illegal today than rappers saying they intend to shoot other rappers for dissing them.

It's free speech until they follow through as stated.
The issue for Xbox is they need to push more subs to game pass, but they haven’t had the tent pole titles to support that consumer behavior. If they want subscribers they need 3-4 big games each year to come exclusively to game pass. They have struggled to release games and when they do release they are often in a less than stellar state.
What's the alternative? Wait for the CIA to arrange for him to have an "accident"? How is that any different than a lynch mob?

Note that I'd be taking a different tone if it didn't seem like he was actively evading governmental control.
Fordism