skysight-inc/HackerNews huggingface dataset:
That's a flaw in dot-net's SslStream library. You don't get an opportunity to know what host the client is expecting before selecting the cert for this session. Reading discussions around this issue usually settle on reading and parsing the "ClientHello" to extract the SNI name, and then hacking the ClientHello back into the incoming stream so TLS code can read it.
Honestly, I've been working on it for two months and didn't reach this part of the roadmap yet. I was planning to use a 2captcha integration for the first approach.
> My house's front door lock is broadly the same interface as my great-grandparent's front door lock

True, but your house's front door lock is very likely to offer quite poor security. Most house locks are vulnerable to bumping attacks that are almost trivial to pull off. The only reason this is acceptable is the threat model you're dealing with when securing a physical house is very different from securing an internet-connected computer.

Moreover, while the threats against your front door have remained marginally the same as those against your great-grandparent's door, computers and the network they are operating in change extremely frequently. All the security recommendations you're naming were quite reasonable for their time but rapidly became outdated.
yeah - i wonder if uberduck has paid licenses to any of the rappers voices they have available on their site...

they're flouting a sample clip with eminem on their homepage.

this just seems like clever marketing to me.
So iPhone users are susceptible and ignorant who buy expensive items not based on whether it meets their needs but based on marketing and peer pressure.

Always a good approach to have in life. Thinking everyone is dumb except for you.
I wrote many thousands of lines of XSLT back in the day, converting XML into XSL:FO and pumping it through FOP. It worked remarkably well. It was my second experience with a declarative language (SQL being the first).

There were some great resources - libraries of code fragments, similar in spirit to tailwind ui - and people did crazy things with them.

We eventually abandoned it, after many years. It was indeed terribly difficult to work out how a document got transformed, and when returning to a transform after a long time working in other languages, you could easily spend a day just trying to work out how some trivial thing worked.

I remember it fondly, but I wouldn’t do it again.
Parent is pretty obviously referring to the 2022 Russian invasion of Ukraine, the single biggest (regarding media coverage) armed conflict right now.
Thanks, I will do one!
So that it doesn't get confused, I'm not the author. I've left original title :)
Oh yes, “being woke”, also known as being a decent human being.
Companies are slackening their enforcement of post-2010 norms and expectations on identity issues. For instance, they are growing less likely to rapidly terminate or suspend employees accused of sexual misconduct based purely on the word of accusers. At the same time, they are walking back their aggressive symbolic commitments to social justice and quietly defunding the financial pledges they made to various activist groups and causes. Many are also making aggressive cuts to the DEI-related positions that ballooned in recent years.

Rather than rapidly caving to employee “social-justice” demands, as they had for much of the last decade, managers at knowledge-economy institutions are increasingly trying to reassert their authority, firing employees who attempt smear campaigns against colleagues and the companies they work for, and imposing new rules on how internal workplace channels are used.

When workers at Netflix attempted to cancel Dave Chappelle in late 2021, the company didn’t respond by issuing apologies and promising more programming on LGBTQ topics, as it had in the past. Instead, executives issued a memo informing protesting employees that if they weren’t open to publishing content they disagree with, they should quit. When an insufficient number of activist employees took them up on this invitation, the company proceeded with aggressive cuts apparently targeting these employees and the programming they worked on.

At Disney, following the box office failures of a number of high-profile movies promoting LGBT relationships—alongside a series of p.r. controversies related to Disney’s advocacy for the LGBT cause that culminated in bids by lawmakers to strip the company of its special governing and tax-exempt status in Florida—CEO Bob Chapek was ousted. Reinstated, ex-CEO Bob Iger immediately struck a more conciliatory tone on the culture wars

Woke means broke.
Noted! I'll improve this
You've been downvoted, but of course it's reasonable to think 'not a coincidence'. But I'd actually say that it's not a particularly interesting observation given how many nation state backed intelligence (or even crime, assuming a difference) groups there are that do frequently hack large companies and government agencies. The pertinent thing here is that we simply don't know, and there are also plenty of boring criminal groups that also hack.
The only difference between the AGPL and the GPL is whether offering access to the software over a network is considered distribution or not by the license itself (AGPL says yes, GPL says no). Otherwise, they are both exactly as viral.

You are quite right to some extent about corporate policy differences. I think the status quo might be trending away from this extreme caution, but it's still there in many corps.
Why Sccache
This might be obvious but there are a lot of Europeans on tindie. You might want to reach out to some of them that make things you find interesting.
Yep. While I did fix the bug as soon as I found it, I consider myself fortunate I chose POP3 to write my first server.
I think the author should have started with a definition of "woke" first.

You know because it very much seems to just be a catch-all for "not right-wing".
I agree, ideally the entire workforce should "advance" under an united front (for lack of a better metaphor). I guess that's why lots of former military people get lucrative jobs in corporate consulting after they get out of the Armed Forces.
The reason why the author chose the term lossy compression was to make it seem like ChatGPT was nothing but a thing that makes things blurry. Do you see a single mention of ChatGPT being a reliable translator in that article or any sort of distinction made between the different kind of tasks that the model is used for?

So it is nothing like six vs a half dozen, because those mean the same thing, and lossy compression is a bad description of half of what ChatGPT does, which makes it a bad description and not at all equal to another more thoughtful, less emotional, description.
For those who are wondering what the Sequoia CLI (the sq command) experience is like:

https://sequoia-pgp.gitlab.io/sq-user-guide/#prelude-quick-s...
If the programs in question implement the XDG base directory spec properly, then putting `export XDG_CONFIG_HOME=$HOME/.program` in your .profile will make them put config files in .program, not .config.
One Man’s Trash Is Another Man’s Compute Cluster
I don't think this is true any more. At least, I've heard generated audio from the latest models that runs for well over a minute without obvious artifacts.
Depends how long your session cookie lasts for the site. Some high security sites are paranoid, but most of the time they last for like a year.

It also depends on how sophisticated the attacker is. Do they fake log you out so they could capture a second 2fa token in order to change the totp token to a new device and change your email?

And of course, for the most part damage can usually be done in minutes - copying confidential files does not need long term access.
GPT Prompt Injection
First you criticize that units will fill landfills, then you suggest they make 2 units for every 1 purchased?
How are Unions "organized Mafia" (btw, Mafia, by definition is "organized crime") yet organizations like the Chamber of Commerce and other "business associations" are not?

Why are businesses allowed to "organize" and "influence politics" (Citizens United decision anyone?) yet when a union does it, it's considered somehow theft from workers and "socialist".

If capitalism is about regulated free markets, then why is a regulated labor market not "free"? Unregulated markets are both anarchic and lead to oligarchic and monopolistic behavior, as can be seen in areas like big tech etc.

Capital "vs" labor is by definition about labor attempting to extract as much of the profit of their labor as they can, while capital will be working to achieve the opposite. To ensure that this is at least managed, a regulated market, with an impartial regulator and legitimate market laws is required.
> unreadable coding style

And, again, people talk about it as if it was a real thing and they knew how to measure it...

Also, C++ and Rust are very similar in appearance. So, I struggle to see how jumping ship here would be a big win.
Thanks for sharing your point of view!

I will rewrite the copy to make better statements. Thank you so much
Let's ask us the question: Should Framework claim that this SSD is compatible with their laptops? Personally, I think it would be misleading if Framework sold an SSD, claimed it was compatible with the Framework laptop, but you had to buy a third-party adapter to get the SSD to fit. That's the sense in which the SSD is not compatible with the laptop.

Luckily, Framework sees things as the same way as me, hence the compatibility warning.
Ten years ago, everyone got hacked all the time. Today, basically the only way to get you hacked is to hack the actual site you're using. I'd say that's progress.
Linux, MacOs and Windows are better environments if you want drop-in solutions. FreeBSD does not have a desktop environment (Use GhostBSD for that or add something custom). FreeBSD does not support Docker because it has better solutions in place.
It can be a headache to set things up when you are new to Unix. Don't expect that the latest version of some Jetbrains IDE is 2 commands away. Compiling and other solutions might be needed.
The community of FreeBSD is very helpful. The forum and several maillists are the best way to go with questions.
It's a good idea to make the prefix matching optional. I think it might be confusing to gate other features behind it though. I guess we'll get to this once we find flags that are important enough. So far, we haven't really had significant issues with this; compatibility remains our primary focus for now.
Kind of weird posting this here. Hacker News provides little ability to manage an account, much less setup 2FA.
I'd bet he got more lyrics than that from ChatGPT, but was unable to make Uberduck "rap" something that matches the rhythm in any meaningful capacity. So he ended up using just a short snippet of the output.

Even the real Eminem sounds horrible around that speed (~130 BPM), you're way more likely to hear a Drake mashup in that range (or up-until-recently Kanye). I know these sorts of famous AI voice generators don't have the notion of speed or rhythm, but I'd still bet AI-generated Drake would've been much easier to work with.
Paint doesn't drive a car. Execs do.

In this analogy the execs are autonomous humans and the engineers were just unthinking objects. I object!
Cloudflare is the opposite of de-centralization.
XSLT was also a terrible combination of two principles: Imperative coding + data pattern matching. For a novice beginner - and me at the time - I was never clear which pattern to use and how it best fit together.
You will not. Depending on how cynical you are, that was either a honest mistake because it was incorrectly thought the vaccines did prevent transmission, or just a made up false narrative pushed to promote vaccinations.

The only effect there is is the meager excuse that you could protect grandma because the temporary protection from severe illness might be saving medical resources she needs. But if you look into the numbers, you’ll see that for the not elderly without preexisting conditions, chances of severe illness are very low anyway.
In a way, it's similar to the actors selling their digital images in the movie The Congress. It's inevitable.
Completely agree! But I think you meant "XSD" here:

> you can find the XSL to ensure the validity of an XML document
And then history repeats and we call this now blockchain and the mess around it ;)
Owners aren't paid employees . . .
I had friends at the office and even a kind of crush. One month into the pandemic, we just didn't care about trying to keep the non-work banter going. It's a forced situation; romance as a result of shared stressors in particular is well documented, but not necessarily healthier than just meeting someone randomly.
Google finance used to be great and then it went to crap. Yahoo stayed the same. Also let's you export historical prices.
Another big step would be to give LLMs access to computational sandboxes (like wasm) to do some calculations based on what it deems worthwhile calculating. (without access to bash/aws)
Too much conspiracy theory.

AFAIK there definitely is a preference for Apache/MIT dual licence but this is probably because of the influence of the Rust compiler itself. Most of the initial Rust code was written by people involved with and in service of the Rust compiler. Since that’s licensed MIT/Apache, their code had to be as well if it wanted to be used in the compiler.

There were people who used funky licenses like WTFPL (whatever the fuck you want to) and Unlicense (public domain) but they came around and licensed to MIT/Apache for uniformity with the rest of the ecosystem.

Maybe if the compiler had been GPL the ecosystem might have been as well, but that’s a what if. We’ll never know if a hypothetical GPL Rust would have had the same path to success as the existing Rust.
HN has polls? Wow. This is a new info for me.
>It's not politics, it's discussing technical and economic tradeoffs to make the most secure credible neutral decentralized ledger possible.

Who decided which tradeoffs are best? How did they get other people on board? This certainly sounds like politics.
Slint (Rust gui library) for example is GPL.
This has a lot of issues on even a quick skim.

1. Uses plaintext private keys in memory and has no support for yubikeys, nitrokeys, or other smartcards

2. Binary/commits are not signed, so there is no supply chain integrity to build or install this. Readme recommends blind execution of crypto code off the internet that may or may not be what the authors actually wrote.

3. No code review seems to be happening per git history, at least no signed code review publicly accessible.

4. Breaks OpenPGP spec and conventions for seemingly no reasons at all?

5. Rightfully mentions that you should not put a plaintext password on the CLI, then proceeds to recommend you use pass in a way that puts the password back in plaintext on the CLI via a subshell which is still totally plaintext in the proc filesystem, in ps, etc, to all processes on the system running as any user. (Unless you mount /proc with hidepid=2 but this is never a default and almost no one does it)

6. No support for Git, ssh, etc so you still need to use Sequoia or GnuPG anyway (as readme points out)

This seems like a really fun and educational hobby project, but I would not seriously suggest anyone use this for anything actually security critical in its current state.

To anyone that wants this functionality best-effort safely today: Get a Yubikey 5 or Nitrokey 3, put an ECC PGP keychain on it, enable touch requirements for all slots, export your keys on keyoxide, then set it up with git, ssh, pass, your email client of choice, etc.

Today you can do all this with GnuPG though admittedly this is a rotting, buggy, and badly maintained c codebase. The well tested Rust replacement, Sequoia, is almost at feature parity now, so keep a close eye on that or try it today instead and see if it already meets your needs.
> we don't respect maintainers who leave in buffer overruns or x-site scripting, why should we respect maintainers who don't respect users?

Because they're the ones putting in the work. I could patch all the programs to use whatever paths I liked best if I really cared but the truth is I don't want to put in that much effort. So I just work with what I'm given instead.

Besides, dotfiles conventions are not even in the same category of technical decision as literal vulnerabilities. One puts people at actual risk, the other is just opinion on file system taxonomy.

I mean, I have opinions on proper file system organization too and they certainly don't match Unix "tradition" but I don't go to other people's issue trackers and shame other developers when they make "excuses" for not following whatever scheme I thought up. I have reasons and I can certainly try to convince others that I'm right but it's simply offensive to show up out of nowhere with an indignant tone demanding that others make changes of a subjective and frankly trivial nature and then criticizing them in other forums when they refuse.
> it's not available in a lot of Europe

Since they do sell to some parts of Europe you should have no trouble finding a reseller that ships to the rest.
I cut releases as I find bugs and commit fixes.
I would understand properly why S3 isn't a viable option before going down the rabbit hole of trying to roll your own distributed file store.

> I'd guess so there's no accidents where if one vigilant user decides to delete the contents or change them so the file could be compared by a hash

This risk can be easily mitigated using S3 permissions/access controls.
The setup 2FA advice is kind of weird. I mean its fine in general, but it was an employee who was breached not a user, and there is no indication that the attackers got account data.
If someone _really_ wants in, the windows are an even weaker point. Obvious at a glance breakage probably not even necessary... (those latches seem awfully flimsy).
I still find Yahoo finance the best in class since google finance upgraded itself out of usability a while back - admittedly, I haven't tried many alternatives.
While I understand your argument, and it has some legitimacy, particularly in relation to anti-trust regulation and moving back to actually enforcing the laws, as opposed to what has been happening since the late 1980s.

Low-skill workers only have the power to withdraw their labor (which is their only negotiating leverage) when their labor is required.

As for unions getting higher wages for their members, that's their job (by definition). It's not at the expense of unemployment for their non-members.

The "hard core" market solution you're proposing is what used to be implemented ever since the anti-trust laws and regulations were passed in the early 20th century. Standard Oil was broken up and the companies that exist as a result today (Mobil, Exxon, etc) have all done very well in spite of Standard Oil being split. The same applies to AT&T and IBM (less so, due to their own management) and Microsoft.
In my experience, segfaults are often a result of using C libraries in C++. In the project I work on, OpenSSL integration supplies a constant trickle of segfaults (it's not my general area, I'm just witnessing those and report to whoever works on it).

This is especially true if you are trying to use those libraries in multi-threaded environment.
You are still free to modify the code, patch or redistribute it under the terms of the SSPL. If you prefer the ESL, you may only modify the code, but not redistribute it.

Now, if you were distributing a GPL product that included ES, you will have significant problems, since the GPL and SSPL are not compatible - so you may in fact be unable to distribute the whole product anymore, which probably caused huge disruptions to some projects - so I'm not in any way saying that what they did is nice. But it was definitely not making it closed source, not in spirit and not in effect.
JSON is not a reinvention. It's two different things. XML is a markup language. It's for markup, so, do you need markup? Then don't use JSON. You don't need markup? Then don't use XML.
Eh, most web pages haven't been handcrafted since ~1996. Remember how ugly Dreamweaver's output was?
If any e-mail contains a link to a login webpage, I treat it as a Phishing attempt. Only ever log in on the page you have bookmarked.
That's a good idea and I've thought about it but I think many feel attached to their usernames and account history "15 yeas with.." site X. And sites often balk and say "username or email already has an account here".

It's a bit funny since alias was meant to hide who you were or at least make ire less formal than a person's full name. Then I go and use my name for an alias!
Thanks for reporting. I'll review this!
After you reach 15GB will you stop receiving new email or will your old mail just get deleted FIFO?
FAANG is what you make it. If you wanna coast and make 350k for 20 hours of actual work, it's doable. But if you wanna work on some super fancy team, make it to staff eng, make an impact etc... there's a path for that too.

Neither of them are wrong approaches to working at FAANG
Any thoughts on Timescale?
Nobody listens to techno!
I'm quite nooby in both Rust and C++, but for the little interactions I had, I felt like Rust had a much clearer path forward than C++ when I was in doubt, and "how to write in good style" was more obvious. This leads me to the assumption that building a Rust culture is probably easier than building a C++ culture, because it is easier to get junior developers and those coming from other languages up to speed.
> Parser speed is a functin of the input size. And XML inputs are quite big, too big

You don't have to parse the complete document to do something about it. You can use a streaming parser, and you can execute XSLT on the fly.
For applications where it really mattered, harware authenticators have long been established. Big companies use smart cards, and my bank has always offered the choice between the 2FA-du-jour (switching from pre-distributed TAN lists to SMS 2FA to various iterations of 2FA apps, currently push tan) or just getting a $20 reader for my existing bank card (which has a chip since forever in europe).

The list you are describing could as well be seen as every service trying to implement the simplest and least disruptive technology, only to find out two years later that it was insufficient and switching to the next best thing, only for the cycle to repeat each time.

Which of course from the users perspective doesn't make a difference, but it gives a different perspective on how to solve it for the future.
This answer is to "given that you want solar panels, why put tiles". I think the question is "given that you want tiles, why put solar panels".
He played it last month at Santiago de Chile.
Extremist influencers are generating millions for Twitter
> MongoDB is the only new database that managed to break through

Snowflake, Cassandra, DuckDB, Clickhouse, Redis, InfluxDB, DynamoDB, BigQuery etc.

There are many databases that have broken through they just are far more niche focused.

> but it would still regularly eat your data

No it didn't which is why it became so popular. The whole fsync saga was always overblown because (a) every client that shipped set it a safe default anyway and (b) it was fixed almost immediately.
> This isn't a standard, it's a convention at best.

So is, like, basically all of userland in a UNIX system. Maybe we need to start looking at that as a problem instead of an excuse.

It is within your power as a developer to delete the user's home directory if you want to as well, that doesn't mean you should do it!
I was recently in a Tesla taxi (not in FSD mode) and I was surprised how badly the detection works. It would recognize pedestrians as roadside bins, then change its mind. Scooters and push bikes would just pop up and disappear etc. Seems to me a lot more sensor fusion work is needed to make this reliable.