skysight-inc/HackerNews huggingface dataset:
This seems to argue that accessing a web app (assuming an important piece of software that handles private encrypted data) is no less secure than loading software from a package repository, because a web server requesting the JavaScript and a software updater loading binary code from a server is structurally identical.

The obvious response to this is offline signatures: For package managers, app stores, updaters and the like, the integrity of the update server itself doesn't really matter, because the installer verifies a cryptographic signature from an offline key.

This argument is acknowledged, but seems to be dismissed without a real explanation:

> More astutely, there's also the distinction that either a file system compromise or a key compromise is required to serve malicious code to users with TLS, but software repositories can be architected such that a key compromise is required, through the implementation of offline keys. Despite this, though, there are several examples of secure software repositories that successfully use TLS. This isn't a grave concern (and they probably won't be converting soon) because the decision to use offline keys is palliative, at best, and only marginally increases a system's level of security.

> However, I openly concede that there are cases where a software repository can offer a higher level of security than a browser is currently capable of. I plan to discuss this later.

AFAICT, this "later" doesn't happen in this article, though I might have missed something. I really don't see why offline signatures are only "palliative". Web servers are hacked all the time, DNS misconfigurations happen, but organizations losing control of their software signature keys is comparatively rare. Why would you give up a very effective level of defense if it's so easily available?
It’s probably more of a confusion in the measurement - if you are not working full time, that’s a whole lot more time to spend around someone who may have only been tolerable to you in smaller intervals.
It would be great to have real high speed trains in Switzerland. Unfortunately it's just not possible though. A train can only go very fast if the tracks are very long and straight. In switzerland there just is no space for that. The non mountainous parts of the country are densely populated. Even if you have tracks where you could go very fast such as the Gotthard tunnel it's not worth it to buy trains that go that fast for the very few passages that actually allow them to make full use of their speed. Besides if not all trains on the network can go this fast you need to increase the interval between trains which you obviously don't want to.
This is why it's important to shame Amazon and other workplaces with ludicrous cultures that damage their tech employees mental health.
It become quite expensive for a few years, as it became popular at a greater rate than production increased. Bulk price seems to be down again now, though.
> but in the end, it's just a way to rank "fairly" to create cut-off, to look too deeply into it is not worth it, that's the job for your regular school education.

Except, presumably, when there are debates about how the tests benefit or not one particular cohort?
If I were an automated store that relied on a charged mobile phone I wouldn't sell charging cables either! :-)
> Soundness is a property of a single build of a program. You cannot generalize it.

I think it's important to be able to talk about sound functions, without needing to know anything about their callers, other than what's expressed in the function signature.
My steelman of what you're saying is that "this time it's different" because this will be a much bigger change than the normal yearly loss of 2-4% of all jobs.

I'd add that it's different in that it will hit us college educated professionals who are not at all used to this, instead of the usual blue collar industries. We as a group are not ready and will scream very very loudly if/when this happens :)

It's important to remember that a society consumes as much as it produces. This is how "rich" it is in aggregate. And job losses like this come from being able to produce as much as before with fewer people. So even if no one finds a new job, the society is as rich as before.

All experience is that those losing their jobs find/create new ones after an adjustment period. Maybe this adjustment period will be longer, but it will clear in time.

Unless, of course, Eliezer is right and AI kills us all.
Zoom had 8700 employees at the peak? Wow.
my personal experience as a consultant has been outright fear of touching the production servers. Fear as in actual fear response such as nervousness, agitation, facial expressions.

Other examples would be fear of altering any deeper parts of the system due to fear of punishment or war room style crisis.
The point of the paper is that there's more to it than that.
I think what this article (and the events it covers) highlights is that WinForms really does knock it out of the park for being a simple way to create forms over data for Windows desktop apps.
No from my understanding that's the old thinking with power plants like nuclear and coal that cannot be easily switched on and off.

Peaks in renewable generation would go into electrolysis to produce hydrogen which can "save" the surplus energy the same way we're heaping up natural gas to be used in times when the sun is not shining and when in addition there's no wind.
Plus there are industrial processes that cannot (yet) be based on electric energy and need to run based on hydrogen or derivatives.

In addition we can save surplus renewable energy locally, regionally and in neighbor countries (e.g. Norway with its pumped hydroelectric energy storage).

This has been backed by several studies but was critically dependent on scaling up renewables massively. With the latter we failed, for political reasons.
find a server with players in a different timezone
We need to do a better job at educating what data is accessible through platform.

You can find the core here: https://openbb.co/products/terminal#features

In any case, you are right. We rely on API keys because unlike BBT we don't own the data, and therefore, we are essentially a platform that aggregates investment research data - and that the user is allowed to customize their own feeds.
I noticed you didn't come close to answering the question. Complaining that people who aren't you are making money isn't a good look, and certainly isn't a sound basis for federal public policy.

You indicated a problem with the way federal funds are spent. What section of what federal statute should be changed? In what way should it be changed?
Here's the thing. If companies never collected and used email addresses in exchange for providing free webinars, reports, developer seminars, books, reports, etc. they'd do far less of those things because digital marketing would be much more just shouting out into the void with often difficult to measure results. And they'd generally be way out-marketed (and out-sold because marketing brings in leads).

You may be fine with all that but remember that selling pays for engineering salaries.
Given we're talking of After Dark times, don't forget to run park before turning the machine off :)
If I died tomorrow, how long would my webapp keep running?
The history of Eurasian Powers in the New World is highly negative and the US keeps those guys away.
Well 100% is more than 70%.
So we can if we want to assume that means 100%

A much more informative statement would be:

"We turn down about 25% of all requests"
Does anyone know if there is a straightforward way to implement logic for showing a screen saver like this in a basic website after X number of minutes without user interaction?
Self checkout is generally annoying in a few cases:

* You use reusable bags. In general most systems I've used dislike when you put a bag in the area with the weighing things, so now I have to spend double the time moving items around because they can't just go directly into the bag

* with fresh produce, the cashier will most likely have the most common items memorized and punch in the code without a hitch, whereas I have to navigate a clunky UI to figure out which kind of green onions to charge

* anything involving an ID check is much faster; a human is legally required to be there to verify, and the cashier is already conveniently there, as opposed to a self-checkout register where I have to wait for somebody to come to me
You’re right. And it’s lead us to a place where I mark most email I get as spam.
setTimeout to trigger the screensaver. Restart the timeout on mouse move.
This reads like satire, but looking through your comments make me believe you're sincere. This here is a great example of when propaganda gets its own life and spreads by itself. Like malware but infecting humans.

Snowden was a russian spy too right? Let's forget the US was breaking its own laws because Russia. So simple.
> I said we would either suspend or potentially permanently exclude anyone who took part in a protest

This is why the First Amendment in the US is so important. If the UK had it too, then this threat would be obviously empty.
This is perhaps an Italian problem? In the UK loyalty cards are generally free, even if you were required to have one for the scan-as-you-shop systems. This used to be only Waitrose before the other supermarkets (Sainsburys, Tesco, etc) adopted them.

Same goes for Switzerland. Both Migros and Coop offer this, and both require a loyalty card (and also a payment method, obviously), but those are free too.
How can any protection be safe, as long as the US company have to comply?

There is already a process now for Schrems III
Software containers also benefits from being small. It’s not critical if a container is a bit big, it will still work, but it’s faster to deploy small containers. And the images are compressed.
I'm getting wildly different citation counts for some of the listed AI papers.

For example, the paper "ColabFold: making protein folding accessible to all" is listed as having 1162 citations. I'm seeing that it was cited only by 899 publications on Scite: https://scite.ai/reports/colabfold-making-protein-folding-ac...

I'm wondering if Google Scholar is overestimating or Scite is underestimating.
It has not, although it has greatly changed how I program and learn. We are currently entering a period where "centaurs"[1] - humans using AI - will be the most effective agents for many tasks, including programming. With that in mind, I'm enthusiastic to embrace AI as a daily tool, knowing it will let me do things faster and better - but I don't expect this period to last forever and so it has put a sense of urgency in me to execute rather than just ideate, which I did not have before the dawn of things like ChatGPT.

[1]: https://www.parc.com/blog/half-human-half-computer-meet-the-...
According to Fig 3, Google was that most-cited problem domain. The most cited papers are for Google problems. You must have Google money and compute to achieve top-cited research.
> Knowing your interface boundary is an important part of writing unsafe code in Rust. For instance, suppose you have a data type with a method that unsafely makes a certain assumption about its fields. Then you have to be very careful to uphold this invariant in every other safe method that creates or modifies those fields. Furthermore, you have to ensure that no language-level operations on the object as a whole (e.g., swapping, dropping, forgetting, or covariant transformations) can break this invariant. But once you have locally checked all of those things, then you don't need to check any other part of the code base to know that your data type is sound.

This is simply incorrect. If it is possible to, in any safe code, invoke the invariants that can cause the undefined behavior then your code is unsound. UnSafe code _cannot_ rely on safe code invoking it correctly. ALL invariants must be covered at the boundary between safe and unsafe code, anything else is a soundness bug in the code.

> As another example, contrary to what some people say, it's not necessarily unsound to have a safe function that can cause UB on some inputs. You just have to ensure that external code cannot call that function (without having previously unsafely promised not to call it incorrectly), and no internal code calls it incorrectly. Here, the interface boundary is the entire section of your code that has access to the function.

This is again completely incorrect. If it is possible to invoke unsound behavior from safe code then the code is fundamentally unsound. This is the problem that the Actix developer kept trying to justify that got him in a lot of hot water with the community. Please never write code this way. If you have any public repositories please mention them so bugs can be filed against them.

Put another way, a bug in any piece of safe code must never cause any piece of unsafe code to commit undefined behavior. That’s the fundamental guarantee that the entire language is based on. Please don’t violate that by lying to developers that code is safe when it‘a not.
Appreciate this more than you know.

What we did was wrong, everyone knows it. We came out and apologized. We discussed this for days after it happened internally and with our investors/advisors. But there's nothing else we can do.
The companies trying to keep up with ChatGPT
I'd love to do this, and could afford it.

I'm old enough (40s) that I fear my career would never recover.
More than being proud of what you've learned: take the time to understand, catalog, and present what you've learned. If you're hoping to interview well, you should be an expert in explaining what you bring to the table. Giving that information as a concise explanation requires premeditation.

Interview questions make for a great synthesis exercise in considering your recent achievements, and doubly so if you're interviewing soon.
Sorry, I was reading the article from my phone and didn't notice that footnote. It definitely ties in to the point I'm making here, but I still feel that the distinction is important enough to elaborate on a bit.
I'm saying even for that case, you have to know how the implementation of that function was compiled, linked, and possibly even deployed. You cannot promise an interface is "sound". You can promise certain expectations were communicated clearly within some parameters (like object types and lifetimes assuming a coherent build process).
>Grading is extremely opaque, and seems to be largely based on teacher intuition.

Grading in certain subjects is just laughable. Can you objectively evaluate English essays so that 97/100 is "better" than 96/100? Why not add more significant digits: 96983/100000!
Be very careful who you waste your time working for.

So many companies are cesspools of mental trauma that are very inviting places for the unaware, and if you’re not strong of mind you get to subconsciously carry their issues with you for a long time after.
Nuclear risk is a contained problem. Access is extremely limited and controlled by low tech hardware locks. The technology is understood, we know what makes bombs explode and it is predictable by physics.

AI is the opposite of all these characteristics. Its access is nearly everyone. The technology is not understood and not predictable. It is a nuclear warhead that thinks for which we don't know what might make it explode.
Wonder if that's correlation, not causation, due to tactic behaviour regarding relationship ending. For example, divorcing a unemployed partner may entail a worse deal in terms of alimony or child support. Divorcing a partner that is fully employed probably makes harder for the defendant to claim plain lack of money.
Best comment I've read so far. Agree.
> So the bus might be late, but at least it's not standing idly while you're already in it, intentionally wasting everyone's time.

Padding actually makes those timings reliable.
Looks great, looking forward to trying it out!
Twitter refused to pay AWS bill, so Amazon refused to pay for ads
LLM-based dang clone? Hmm…
The issue I think is more that women have been fighting for rights while men aren't really allowed to do that in western society. There are countless examples. Women can wear mens clothing and no one bats an eye, but men can't wear womens clothing. It's now normal for women to work, but stay at home men are almost non-existent. Teenage boys kill themselves many times more often but the main thing you hear about in the news is how social media effects teenage girls.
How does one even know that message are being tagged as spam?
The Labor Market for Recent College Graduates
Hmm, while I've never bothered to use it (I'm happy with the self-checkouts) I'm 99% sure that the one at my local big Tesco doesn't require you to have the loyalty card; you just bring the scanner gadget to a special automatic checkout.
Bonus points if you can do some prompt engineering to instruct ChatGPT how to play the game.
Few worthwhile projects are ever successful on the first attempt.
I am not a fan of how et-book looks on windows, especially firefox.
People are saying that wpf was good forgetting that ms has botched it from the start.

First releases had god awful font rendering, that our (.net shop) enterprise customers hated. The things improved only when ms did some parts of visual studio in wpf, if I recall correctly. Also quite bad visual designer. (Even 2! Visual studio’s one and there was another software. Blend?)
The thing is, education doesn't scale infinitely like that. The bigger the class size the less attention you get from the professor, the less individualized the education is, the more generic it has to be, the lower the common denominator, etc.

And lots of colleges are known for their teachers. You can't always just hire another identical teacher: good ones are rare. At elite schools, they are often even famous and individually important in their field. You cannot scale that.
Ukraine war: Russian reservists fighting with shovels – UK defence ministry
I'm trying to cross this with Material for Mkdocs over at https://material-tufte.ale.sh/.

It's hacky right now, but the result is beautiful IMO. You can find some more examples in the documentation here: https://lunni.dev/
Sugar rush: how Mexico’s addiction to fizzy drinks fuelled its health crisis
This is a great idea! -- I'm going to take a stab at implementing this tonight
Suggestion of improvement: landing should only be successful if lateral velocity is inside a limit.
This is adorable.

Great game! I got a 95 point landing after a good few goes then I saw all the fun people were having with the crashes so I joined in. Great job!
From 92 different data sources.

It's not our data, it's their data. We just provide it under OpenBB terminal and API, in 1 place. So you don't need to read 10 different data sources documentations and it's all standardized by us
The point of spending this massive amount of money on an automated store is to recoup that investment by opening lots of automated stores and make money in volume, taking advantage of your lower labor costs.

If they don't actually open at least hundreds of these then they've thrown away massive amounts of money on R&D they'll never get back, and the data they did accumulate isn't even particularly useful as it's in the context of a type of store they're not running at scale.
So schools have subjective criteria that disproportionately impacts one group of students, but it’s fine because that’s the rules and they are following it?
In my old job I had to fake depression. I lived nice bachelor life, some coworkers were jealous and toxic. I lied that my gf left me. I nuked my social media and started posting cats for adoption...Latter got new girlfriend, 10 years older with two kids...

Work become easier. No stress and much less unpaid overtime.

Workplace culture influences people a lot.
Wish you the best; I am done replying to your responses as they clearly are upsetting your sense of what’s reasonable, which is not my intention.
Ask HN: Secure and simple way for secret/credential management in a startup?
What is a simple and secure tool to manage secrets and credentials for a small startup?

How do you do it?

This is not a core of the business. It should be easy to use and configure so a paid service would also be good.

Consider the the following typical situation:

1. Small startup with about 10 technical people.

2. One or two are responsible for the infrastructure in the cloud like AWS, Azure, ...

3. There are also other third party services like Cloudflare, Datadog, ...

4. Everything (AWS, Datadog, ...) is managed with IaC tools like Terraform, Pulumi, (Ansible). These tools need secrets to work. The simplest way for giving the secrets to the tools is via environment variables or .env files.

5. People work on their own devices. So security cannot be absolutely guaranteed. So I guess MFA and generated temporary tokens should be used if possible. To generate temporary tokens the secrets management service has to work e.g. with AWS.

6. Optional: It would be good if Terraform can also be run in the CI/CD pipeline but only after confirmation of one of the 2 infrastructure persons.

7. Optional: It would be good if developers get credentials to setup small test environments in AWS. You can create IAM roles that only allow to create these, but you still have to manage the secrets for these.

8. Bonus: How to manage non-technical secrets, e.g. credentials for web shops to order supplies? Multiple people would have to order something. Store it all on a confluence page?
> Americans interpret "Champagne" to be a claim about the style, while Europeans interpret it to additionally include where the product was made

This is because the style has a specific name. A Champagne is:

- a sparkling wine

- made using the « méthode traditionnelle champenoise » (literally « traditional method from the Champagne region »)

- from the Champagne region

- + a few other technicalities

We have a lot of sparkling wines (« mousseux ») made with the méthode traditionnelle and they can be marked as such, but they’re not champagne. And they do taste different from champagne (and I personally prefer most méthode traditionnelle other than champagne so good for me, less expensive).

For products like wine or cheese, the soil has a huge impact on the final taste, that’s why it’s so important to differentiate between the type of product and its origin.
> Not sure about that, I stop reading as whenever I encounter such lazy writing!

Lazy writing is an assumption, and I don't think it is a remotely safe one.

Keep in mind that there is a difference between the state of mind a person is in at the time they were writing a comment, and the state of mind they are in when they get called on what they say in their comment.
Hire a random sample of the candidates you were going to reject, and compare performance against the ones your process said to hire
No, you just turn up 20 minutes earlier and take the previous bus instead.
As others have alluded, the attack surface on a smartphone is too large to ever be secure against sophisticated and wealthy adversaries. The regimes most inclined to spy are the same ones who spend the most on point-and-shoot exploits to own your phone.

Best answer from a US perspective is Michael Bazzell's work, with product specific to mobile phones having just been released: https://inteltechniques.com/book7a.html
Perhaps people in NYC and SF are opting more for cash. I lived in both cities and would walk right past these and into the good old bodegas that prefer cash which is all I would ever pay with.
Your savings are impressive for your age, so good work there

You may be overestimating the time you need to "recover"...my guess is you will be fine after a couple of weeks of low stress and a change of scenery

As to living in a HCOL area...the stress won't end, look at relocating.