skysight-inc/HackerNews huggingface dataset:
And WAF isn't the only design option for webhooks. WAF = define what to block. Another options is to define what to accept (block all else by default).

OpenZiti approach (1) for example:

a. enroll each side of the webhook w/ X.509 identity

b. X.509 gates a network overlay between the servers

c. each server initiates outbound sessions to the overlay

d. block everything else (deny-all inbound on both servers)

(1) disclosure: i am a maintainer of the openziti foss, and you can only (fully) use the technique above if you have enough control of both sides, e.g. use a Lambda function: https://blog.openziti.io/my-intern-assignment-call-a-dark-we...
My layman observation was always that being intelligent and being rational are two completely different things. It's how you get people who have high technical achievement but still hold on to odd beliefs or get sucked into conspiracies.
NAT between identical networks using VRF
Microsoft Regional Director is effectively someone who is an advisor to Microsoft - https://rd.microsoft.com/en-us/about/ .
I had a similar issue a few years ago.

After a lot of running around taking to doctors and getting tested, a psychiatrist nailed it down as being chronic anxiety leading to executive function shutdown, medicated me for a few weeks, and sent me to therapy.

This helped a lot. I also improved my life in general and it's slowly coming back, though I still need to be on vacation for a few weeks to be whole.

Tl;Dr: anxiety and burnout. Fix your life and get therapy. You can't run from stress, but you can reframe it productively and that turns it from bad stress to good stress. Might need a change of manager.
People Who Are Working Multiple Full-Time Jobs from Home
Would it still do DDOS even without the WAF?
i was actually thinking about that, could be even more cool now with modern text to speech and whisper and some funky word based encoding with huge dictionary like:

teacher: 0b00010010101001, school: ...

and then the website can encode the data as a sentence and just text to speech it and the receiver can use whisper to speech to text and decode

will be the most creepy thing because it can be very steganographic and sound like a real sentence
I've read that we can typically reconstruct any complex wave form from other periodic waves. So it doesn't seem like sines are something special.

But apparently, mass on a spring behaves in a sinusoidal motion
https://youtu.be/n2y7n6jw5d0?t=968

And sines are also an approximation of harmonic motion of a pendulum.
https://youtu.be/p_di4Zn4wz4?t=370

Many physical systems resonate or oscillate produce quasi-sinusoidal motion.

https://ccrma.stanford.edu/~jos/mdft/Why_Sinusoids_Important...
Well, I've been using "hard" lists for months now. I only see what I want to see. Works like magic. The day Elon fanboys get "god mode" and lists go away, call the time of death on the whole thing.
This is why I really like HN...

(IMO there is not enough of these posts, and getting less over time.)

A refreshing "actual hacker" project that makes me look anew at the tools I always use...

So, my coffee maker is sending data to the net - maybe I can use that for backup, and have it replicated both in the fridge and in the living room lights...

But how would I retrieve that? Hmm. I assume that both Alexa and Google assistant are tracking everything that goes through my IoT devices. I'll ask GPT how to hack my Nest device to pull back data on demand, that oughta work, surely?! :D
Those kinds of boxes I always ask for permission to poke at a little more and see what they really can be cracked with. Its good fun poking old shit on the network and seeing how it falls over!
I wonder what is actually causing the error here. Looking at the 2 payloads diff on the site I can't spot anything. It's a weird one that's for sure.
There's a big problem here. MrBeast does what drug dealers do, in a less obvious way: they change the apparent value of the thing they're selling. Essentially a trick: use this product and your desire to use this product increases.

That is not how the conventional free market is supposed to work. I'm happy to give that the market wants weird things, but the basic thing that's missing here is a feedback loop: you go and eat at a restaurant, you like the meal, you come back because your guess about the subjective value of the meal to you was correct.

The market for addictive experiences breaks this loop. You snort some drugs, and you feel you need to break into people's houses to get money to buy more. Ask any recovered drug addict whether they think it's actually worth it, and they will tell you of course not but the addiction is so compelling. People in this situation are robbed of their freedom, the essential ingredient in a free market.

Now I don't know a heck of a lot about Mr Beast, but a lot of internet influencers do the same thing as candy salesmen. It's bad for you to eat loads of candy, you don't want to be fat and get diabetes, but in the moment you make the wrong decision. Influencers do the same, it's a cheap thrill designed to make you forget you're in control of yourself.

Shakespeare is the opposite. You're supposed to be thinking about human nature, but you don't get your dose of satisfaction without quite the mental strain. You can't overdose on Shakespeare; you'll fall asleep first. People can and have overdosed on silly internet videos, staying up until 3am.
>"you just need to hire the /good/ PMs"

No, you need to hire good EMs to provide checks and balances. Any system without checks and balances will go off the rails at any moderate scale no matter what you do.
This is like saying "who raised their hand and asked for a language where any number of trivial mistakes allowed by the compiler will lead to massive security holes?"

No one, and yet we have C and people use it. No one "asks" for the disadvantages of a given language, they are just trade-offs in exchange for some advantages.
It looks like "WAF - add exceptions" supports Wireshark style expressions, so there's things like:

(http.request.uri.query contains "some-string")

Or similar for checking headers, post body content, etc.
> I’m not sure if product managers at small companies and startups act this way.

Ten years of experience at various startups, and it is absolutely this way.
That's so interesting. Thanks for sharing.
For further reading - Derelict Places (UK-centric)

https://www.derelictplaces.co.uk
> Real ADHD, not some self-diagnosed or casual self-deprecation.

How would you know?

This number is totally unrealistic when the prevalence in the adult population is 2-4%.

Unless you work with 3 people, one of which has ADHD.
for many people cars are a luxurious convenience. they also enable bad behavior and come at a terrible cost for everyone, including non-drivers. the reasons for this are manifold, but the problem is, that often there are no practical alternatives because we build our society around car dependency. this creates a dependency spiral: it's hard to quit cars, so people don't (even try), and because everyone has cars, we build infrastructure for it.

it is possible to get out of it in certain areas, usually cities - but even if one manages, they still have to pay the cost: not just the financial burden, the health problems, but also the reduction in safety (especially for kids) and quality of living. vienna has excellent public transport and the car ownership rate is less than 400 per 1000 inhabitants. of those 400, how many are necessary and how many are just out of convenience?

as for my (austrian) country-dwelling extended family: every adult owns their own car, but i'd estimate at least every second car is not strictly necessary.
In a way, the limitations of those machines made the data representation so cool.

These days everything is a flat raster buffer with every pixel being independently settable. It's incomparably more convenient but also more "boring".

Same thing with music and audio, we have enough RAM to waste to let Nyquist-Shannon take care of the problem.

I guess the lesson is boring = better?
if only somebody wrote client for personal backblaze backup (which is also unlimited), can't easily store terabytes from my linux PCs
Until you realize that part of you is a black box to others and only you have access to some of your internal state.

So, yes and no. That's why self awareness, perhaps via proper meditation, although I thought it was some hippy shit at first, is actually valuable.
I think the audience is different. I would wager that the intersection between people who consume mindless celebrity TV and listen to informative podcasts is almost non-existent.
Temu: The online shopping upstart that's become the most downloaded app in US
Until Google bans your account completely across all services with no means for appeal.
> The call must include the Product champion and may also include Stage Leaders

I was not familiar with these roles before this article. Are they more colloquially known in the M&A world ?
I honestly don't trust people of the modern age, who would be in the actual position of making that happen, to do it without corrupting it even further than they already have through decades of bad law and bad judgment. Would you want today's politicians writing the Constitution?
This goes in the right direction. Still it's not 100% reliable (e.g. S3 isn't logged by default to cloudtrail, probably due to volume). Also, not really interactive. I'm talking mostly about ergonomics. Obviously we can solve the issue and create the right policy - but it's not as easy as it could be. That in turn leads to some people skipping the process and staying with too powerful keys.
I think it would help the conversation along a bit if those who are against static type checking could articulate exactly how type checking gets in the way of writing correct programs.

Isn't making sure the types flowing in and out of your functions match, at some point, something you will eventually need to do anyway? Or are we trying to say the type system doesn't allow for perfectly safe things that should be allowed?

I'm not sure I understand it.

Then again, I'm also the person who wonders if the restrictions Rust puts on "valid" code aren't also too restrictive, so maybe we all exist on a gradient?
I hope some of open solutions for policy management will prevail soon,like OPA, and all public cloud providers give support for it.

I did not expect from AWS to simply support OPA in this phase of problem/market fit for the complex system Auth. Still, not happy with yet another siloed solution which is proprietary to one cloud.
Traceo is now open source
I have used a few different WAFs to date, AWS WAF, CloudFlare WAF and Akamai WAF. I have had issues with all but usually the frequent issue is an unexpected blocking of request. Would be interesting to benchmark a set of WAFs to see which ones block threats vs which block valid traffic.
John McFall, the person chosen for the parastronaut study, probably is one of the very fittest humans we can send. Participated in paralympics and all that. He probably runs faster than many of the other astronauts that made the selection.

Additionally, when in weightlessness, a missing leg is not that much of a hindrance.
"Nazis killing Russian invaders.."

I am talking about Russians who live in Ukraine! They get murdered! Actually, there are very many of them, but for you these people do not exist. They don't have a right for their own identity, according to the west.
I like the novelty of this project, but if you value your Google account I wouldn't try this out.

Google has been known to close accounts and "related" accounts for abuse (as defined by them). So even if you create another account, don't expect your main account to survive if there's any possible link between them.

They are the judge, jury and executor, so eff around at your own peril.
> For example Microsoft's compiler, does not support the C99 standard at all.

...in the meantime, restrict is supported in MSVC as regular C keyword, but it took them until VS2019 (specifically compiler version v19.27) - (20 years after the C99 standard was released, and 13 years after this article was written!) while most other important C99 features were "already" (/s) implemented between VS2015 and VS2017.
Perhaps "life coaching" here means something similar to a thing we have in the UK called the Citizens Advice Bureau which basically helps you navigate bureaucracy, as opposed to charlatans with shiny teeth teaching 10 simple tricks to get rich
Nice! It's such a neat way to transfer information :)

This guy extended the idea using fountain codes, which allows you to miss arbitrary frames and still recover the full message without waiting for the missed frames to re-appear:

https://divan.dev/posts/fountaincodes/
Dots Will Be Connected
Uh, nice, but the demo page is not loading. Anyway looks quite similar to Grafana!
Yes - more of this please :)

Tangentially related and discussed in the past on HN: File transfer via color barcodes and a phone camera

[0] https://news.ycombinator.com/item?id=25459501

[1] https://github.com/sz3/libcimbar

[2] https://cimbar.org
As the bumper sticker says: "No shit." Intelligence in one domain does not necessarily translate to all areas. There are uncountable millions of gifted people who are low functioning in other domains.

Contrary to this are the individual fallacies of overconfidence and the collective fallacy of the genius halo effect.

There is also a tendency to failure aversion by avoid domains outside of performant ones.

The safest assumption is: 1. Your areas outside of performant ones are lacking until proven otherwise with feedback. 2. Don't worry about not being an omnipotent polyglot, polymath. Seek excellence, just don't go crazy or drive everyone else nuts. Theory of mind and frame taking by considering putting yourself in others' proverbial shoes isn't necessarily something people are born with, it has to be taught and learned. Some people do have harder times because they have to intellectualize it if they are emotionally disconnected from others and/or themselves, or have a neurotype that doesn't lend itself to smooth observation of social and situational state of others.
Well why single out Russia then? Since the end of WW2, which countries have invaded other countries the most? And what was the outcome of those invasions?

Get answers to these questions and you will know what I mean. All wars that have happened since WW2 are proxy wars. The west never learn the lesson after WW1 that humiliating a defeated country gives rise to characters like Hitler. After the fall of the USSR, if the west had put in an effort to mainstream Russia rather than make a scene out of it(remember that famous Bill Clinton and Boris Yeltsin press conference outside White House?) Even after that, Russia tried to guage the seriousness of the west (most notably NATO, because that is where the problem lies) to accommodate Russia. The Russians (Gorbachev himself had said this many times in interviews) that there was a promise from NATO to not expand eastwards because NATO was after all formed as a military alliance against Russia. Realising that is not going to happen, Russia used another track, of applying to NATO. The argument the Russians made was that if NATO is not an anti-Russian alliance then it should be allowed to join NATO too. This was the bonhomie period between Russia and the west(remember Putin being welcomed both at Downing Street by the UK prime minister and by the US President at his ranch?) In fact Russia was also very instrumental in providing logistical and intelligence support to NATO in the very early days of the "war on terror". Russia also expedited boundary resolution with some of its neighbours as that was one of the conditions put by NATO for Russia to be included in NATO. Having realised that NATO was not going to induct Russia, the Russians declared the now famous redline to NATO that it will not tolerate NATO missiles at its borders (the same way US did not tolerate USSR missiles in Cuba). Ukraine became a red flag for Russia because not only it would have bought NATO missiles to its doorsteps but it would have choked them in the black sea.

Watch Adam Curtis documentary on this subject and the background to this geopolitical chess game.

Having said all this, I am a believer in what Mahatma Gandhi said "an eye for an eye makes the whole world blind". But I am also a realist. I know that the world is not rational. As the US reacted to the Cuban missile crisis, Russia is reacting to the NATO expansion. And no one really cares about the "pawn states". That is why I will urge you to watch Naftali Bennett's podcast interview.

What surprises me is that had NATO expedited Russian inclusion into NATO, it would have to concentrate only on "containing" China. Now, not only has that pushed Russia into China's orbit, it has opened a two front "war" in Europe and Asia!
Meanwhile, some American stores were pouring motor oil over discarded food to prevent foraging, until exposure and a public outcry.
The same thing that happens when you let Stockfish play itself or another chess bot. Except instead of trying to win a game, the objective is to append text with more characters.

In fact stockfish and alpha zero can be thought of as appending chess moves to a sequence by sampling from the space of legal moves by sampling from some policy. No one thinks stockfish is alive or worries that it will break out and start WW3.
> it's more there as a "petrol stations

Which makes very little sense from a delta V standpoint. I’ve yet to see a good justification for the gateway, especially after NASA selected Starship (which contains more useable living space than the proposed gateway) as its lander for Artemis.
"Laughable" seems a little strong (as well as slightly rude).

I certainly think it's plausible that there's certain sectors that see a prevalence well in excess of the general population. And there's enough variance between companies that some will be even higher.

30% does sound rather high but "laughable" implies the person you are replying to has stated something so far beyond that that mockery is the only appropriate response.
Not if you use open source and self-host it yourself. For example, I work on the OpenZiti project which makes it easy to embed zero trust networking principles into (almost) anything - https://docs.openziti.io/
for that to happen, the comments have to be visible in public.

but others can't see the comments, these comments are from the pending approval list from admin view
A propos of [1]

1. Item 3: The ocean is full of floating objects, and it would be hard to see the duck among them?
2. Item 2: is structured as non sequitur, takes a long time because there are many hazards?

I am impressed that you find it impressive. It is plausible-sounding, and I find that disturbing, but it is not useful (and the text prediction paradigm seems a dead end in terms of formulating anything more than plausible sounding)
I have a pet theory that the role of old school sysadmins (what we refer to as DevOps today; yes Sysadmins coded, or the good ones did, I will die on this hill) was strangely attractive to those who would assuredly be diagnosed with ADHD.

You have endless areas to noodle on solutions to avoid issues; you work hard to avoid working hard (strong ADHD trait) and interruptions are either fine and they fuel you completely: or you cannot work with interruptions at all.

Anecdotally: I was a sysadmin (that coded) and I got pretty close to an ADHD diagnosis but was warned off of it by the Swedish health authority (I've talked about it before on HN; basically that my insurances would increase and it could affect mortgages, cannot hold certain vehicle licenses etc;).
I assume user produce emails, payment information, potentially other PII, behavioral data, how long each user reads each post, etc that adtech companies will gladly pay for.

If the system were open source, decentralized, and/or if user PII was end to end encrypted then you could prove you literally lack the technical means to collect or sell data.

All data that is valuable and technically able to be sold, will eventually be sold.
Introduction to Autoencoders
Something real subtle probably, like enough of the redacted areas accidentally containing something like looks like SQL. Like WALTER contains ALTER, CASEY contains CASE, etc...enough to add up the score to fail.

Hopefully more convoluted than simple substring matches like that, but I've seen WAFS do that. If it is adding up substring matches, there is stuff like "subscription_update", "null", "created", "discountable", "total_count", etc, that would set a high floor.
And Ericsson didn’t hire lots of people during the Covid 19, seems like that some companies are taking advantage of the “big tech” layoffs to do the same. I hope this is really needed and not only a way to have more profits for the board.
Hitchens's razor: "what can be asserted without evidence can also be dismissed without evidence."
Though mentions enterprise space (B2B), should mention that in hardware and software consumer product companies the product manager roles does not show much value.

Investing in Design+Engg gives maximum return. These two disciplines have other ones around them like project management, overall product owner (PO, General Manager), etc.

It is really weird when one sees PMs being mentioned as the one who talks to customers or users.

Usually designers were doing that right from beginning, going back to half a century or more..
Hell of a flip for him. He sold on March 15th, 2022 and was laid-off on Feb 15th, 2023. I sure hope he negotiated his exit payout optimally.
Email verification raises the cost of making a fake account, IP filtering raises the cost of making a fake account, SMS verification raises the cost of making a fake account, random algorithmic banning of new accounts raises the cost of making a fake account ...
I think there might be a misunderstanding here:
The analogy works precisely in that you can't plug in anything dangerous because the electrical codes make it so that dangerous things don't exist, and because circuit breakers protect you from malfunctioning stuff.

You can't plug a device that pulls 10kW into a plug and have it work, because the circuit breaker stops you from overloading your circuits.
You can't plug in a device that attaches the live to your left hand and the neutral to your right, immediately stopping your heart, because such a device is forbidden by electrical codes, and everyone who makes electrical devices has to follow these.
Demo linked in the "about" section on GitHub would be more inviting with a TLS cert.
probably because in many enterprises people are incentivized to optimize for personal profit (pay grade, promotion, increasing team size, launching new (often unnecessary) features/products etc) which leads to waste and bureaucracies... iow optimizing in the small which leads to the opposite in the large.
I understand that the goal is to make the data survive video compression, but wouldn't it make sense to use at least some color information instead of entirely black and white pixels?
Of course, but those contributions are more often to the edge of our knowledge and done by a large professional research team, as opposed to a smart aristocrat in their spare time. That's the difference.

The closest equivalent I can think of these days is Satoshi Nakamoto - assuming it's one person. But even their discovery is in a subfield of a subfield.
Cryptic Google Doc Studied, Helplessly Ignored by Those Who Survive Layoff
I already changed to "totally unrealistic" before you commented, but yes, I believe that 30% when the prevalence is at 5% for high estimates is so far beyond reality that it can be laughed at.