skysight-inc/HackerNews huggingface dataset:
Perhaps this illustrates the importance of defaults. Consider which defaults favour advertising.

Search Wikipedia for "exmaple.com", a common error when typing the string "example.com". By default, the results are the pages that contain this exact string.

https://en.wikipedia.org/w/index.php?limit=500&profile=all&s...

Now try the same query with Google. To get pages with this exact string, one needs to enclose the string in quotes. By default the results will not be pages that contain the string.

"Tech" companies want people to believe "search" and "suggestions" (non-objective ranking, insertion of "popular" items, insertion of the search provider's own web properties, etc.) are the same thing. I have no issue with suggestions. Sometimes, but not all times, suggestions are helpful. However I do have an issue with people believing search and suggestions are the same thing.

IIRC, there was a point in the past where Google was ignoring quotes and there were some HN threads about the subject.
Rust Magazine – Issue 2
Anything that someone complains could have been summed up with just two bullet points shouldn't be a youtube or tiktok video. What visual element would have helped here? Do you really need to see the switch? Leave video for things where eyeballs are required. Instructional videos that could have been communicated clearly over text are obnoxious.
I’m a college teacher in a union. I don’t know much about what happens in k-12 but I do know my union is not responsible for our low pay in my system. What evidence do you have for your claim?

Police unions are far more powerful that public k-12 teacher unions.
While I was living in San Diego in 2000, I got talking to some policemen in La Jolla. They told me that having a criminal record is considered a plus when applying for the job, as it shows you understand the criminal mind.

They were probably pulling my leg (or so I thought at the time), but now I wonder...
I think the point the previous commentator was trying to make was, why can't they let them expire and issue new options/RSUs of equivalent value to the same people.
Covid-19 infection linked to lower brain oxygen levels
Most people who use React don't understand idempotency, in my experience. Without understanding that fundamental concept, and that that React will blow away the tree and recreate it (albeit efficiently), one will not understand React.
36 states and DC have strict liability for dog bites. For most the only exceptions are if the person was trespassing when they were bitten, if they were provoking the dog, or it's a police/military dog doing its job. Some of those states have carve outs where they only have liability for expenses if they didn't know the dog was dangerous (I'm presuming that means no emotional/punitive damages).

Doesn't matter what precautions the person took, if the dog gets out and bites another person, they're liable in most states.
Maybe take a photo with the new device of the small screened old device displaying the QR code and zoom that photo, and then move the zoomed photo to somewhere that the new device's camera can try to scan it?

If you can get a copy of that QR code off of the small device using the photo trick, besides using it to import your accounts to Google Authenticator (GA) on your new device you might consider extracting the codes from the backup so you can store them someplace secure separately. That way you can use them to set up TOTP apps other than GA.

Here's how you could do that. First, you need to get the QR code from GA to something that can read the QR code and display its contents. The text in the GA code is otpauth-migration://offline?data=... where the ... part is apparently a base64 encoded Google protocol buffer.

Once you've got that otpauth-migration URL this program that showed up when searching for information on those URLs can help: otpauth [1].

otpauth --link otpauth-migration://offline?data=...

will decode it and give you the otpauth://totp URLs that were in the original QR codes that you originally set up your accounts with.

otpauth -qr --link otpauth-migration://offline?data=...

will generate a PNG file for each account, name after the account name and site name, and containing the QR code for the account.

Going forward, save those PNGs somewhere secure (I use an encrypted tar file). Any new accounts you set up save the QR codes for those as PNGs and add them to your collection. If you keep that collection up to date you will be able to readily handle any device updates or replacements readily or adding new TOTP apps.

[1] https://github.com/dim13/otpauth
In Washington the teachers union is the most powerful special interest group bar none
Clenching my crappy Dell laptop until Asahi looks relatively idiot proof...
How would you measure “power” in this case if teachers are famously underpaid by such a terrible amount?
Much longer than this substack
Ask Elon Musk.

https://www.businessinsider.com/elon-musk-tesla-worth-basica...
One thing I find interesting is that teacher pay in California varies from district to district MUCH more than overall budgets do. LAUSD has an awful pay scale, but is close to districts like Redondo or Manhattan Beach who pay much better. Even though Manhattan Beach is a super rich area, because of how California allocates school funding the district isn't any richer than LAUSD* MBUSD has $17.4k of revenue per student compared to LAUSD's $20k.

If LAUSD gets around 15% more money per student, why is their pay so much worse? More administrators? Higher rate of special ed students? Lawsuit payouts? Buying bitcoin for ransomware authors?

* California's school funding is kinda complicated and a whole topic in and off itsf. Mostly the extra complexity is for a good reason, there's a gnarly formula to avoid the problem where quality of education is directly proportional to local property tax revenue. Richer parts of California often actually have less money in their schools, because schools with more economically disadvantaged students get more money in the formula. When schools have high local revenue, the state uses an offset to balance things out. The only exception I know of to that general rule is Beverly Hills. The BH property tax is so obscenely high that it doesn't matter that they get less money from the state+feds, especially taking into account that the area has relatively few children per capita.
But not from ten years ago. Initially everyone was on options (ISOs) then moved to double trigger RSUs, around 2017 iirc
If you believe that there's a way to become root, why don't you believe there's a way to become some other non-root user? Possibly by using the same exploit you'd use to get root, or possibly by using the permissions root has?
Today it would be possible to use e.g. a Raspberry Pi Pico (~6€ including VAT, the CAN module would be more expensive than that) and make it identify as USB input device directly instead of connecting a full single-board computer via network.
You're right that there is difference in degree. But I don't think that changes the fact that we should already accept that what people post to Instagram are the highlights of their lives and not the drudgery.
This will be worth billions of dollars in a post war apocalypse when electricity no longer exists.
Did it succeed in that regard? Gödel said that first-order logic powerful enough to capture Peano Arithmetic does not have a sound proof theory (incompleteness = not onto = unsound), meaning human imagination is still the limiting reactant.
What, no bailout? Guess they don't know the right people.
This is very cool.

Would love to try it on The Rest is History podcast.
Why would performance and correctness be in opposition to each other? Is chrome more buggy because its fast?
> I'm just trying to put meat on the bones of your argument,

If you were uncertain about something, why not just ask?

> I think "an insecure PHP app" qualifies as third party software,

mod_php would be, not the php app itself.

> and it sounds like unveil/pledge/chroot mitigates the scenario you're describing. Can you explain why that's a bad example, and do you have a better one?

It's a bad example because it's not really a separate app so much as it is a slight extension to httpd that might introduce some insecurities.

A better example would be running an actual app...a database for example, maybe an irc server, a jabba server, anything that listens on it's own port and accepts network connections.

unveil/pledge/chroot won't mitigate any scenario where an attacker has remote root to satisfaction.

> In fairness, this isn't unlike your claim that you can bit-twiddle raw devices in a chroot to find a filesystem

It's radically different. You would have to leverage root to gain access to another user that isn't managed by the system, and where you have no real access despite being root. There is no pathway to do what you suggest. At all.

> in a chroot you don't have access to the raw devices

We're not going to agree on this at all lol. chroot as protection is just fundamentally weaker and it should ONLY be part of defense in depth, while you and other people seem to be happy with it as almost a final solution.

chroots can be escaped, the openbsd team even warn of this on the manpage for their own chroot.

> SELinux has a huge attack surface, and has had a lot of privilege escalation and code execution bugs

Sure, but none of which can be utilized in the way you suggest is possible. Got an example that shows otherwise?

> but hard to not call it a rootkit at this point.

Well that's ridiculous.

> I think OpenBSD deciding to not build something like it is a pretty good security choice.

And that's flat out wrong. You're not keen on selinux because of the complexity, but not all implementations have to be that complex. Look at things like rsbac and apparmor.

> so in the wake of those vulns that design choice doesn't buy you very much.

This just doesn't make sense, period. On an SELinux system, you won't be able to simply switch to the policy administrator and give yourself whatever access you want. That shows IMO a fundamental misunderstanding of how SELinux works.

> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=selinux

So which of these allow for a restricted root to switch a user with a role that can administer SELinux policies, and how would the attacker find out which user that is?
Which is worse when working on production databases? Being drunk or tired?
So are companies incentivizing to not let RSUs expire for employees? Otherwise they face a large tax bill?
I'd still use React, purely to be able to use JSX without another templating language, and I think in its functional paradigm as well.
This is the only real usecase for cryptocurrencies: Evasion of capital controls.
What is the point of REST API for the database? Why can't an application go directly to the database and run SQL?
Yes, and they’re a distinct minority. Polling shows that even if they had the opportunity to go somewhere else, overwhelming majorities of people in Asia and Africa wouldn’t leave their homeland. Even in sub-Saharan Africa just a third of the population would leave if they could: https://news.gallup.com/poll/245255/750-million-worldwide-mi.... In east and south Asia it’s under 10%.

This is, in my view, one of the reasons america is so culturally weird. It’s generation after generation of the most antisocial families from other countries.
I was involved in a Nissan advertisement project connecting Playstation 4 with a cars as controllers[1]. They did a convention tour with 4 cars playing the same football game in front of a projector.

I did everything except front end and CAN interface though, $20 USB CAN reader device + python. I remember it took a while for my colleague to figure out the right input signals as the bus was quite chatty/high output, like tailing android logcat on verbose. We didn't use any factory unlock codes or anything to get more data.

As a gamer it was not really up to par - big deadzone when turning the wheel from one side to the other as we did not have time to get analogue movement read correctly.

On that particular car model you had to interact with the touch display every 15 minutes or else the whole car went into power saving mode and the CAN bus stopped sending messages.

[1] Nissan Project Driving Controller 2016: https://www.youtube.com/watch?v=QM958yUbr0Y
You also lose a lot of fucks from people who know things but it isn't their job title either.

After big cuts everyone is covering their asses.
Edit: Let me rephrase to be less strict, and express this as my personal belief rather than an absolute truth.

Edit 2: Genuinely appreciate the discussions on this. (Besides the one or two comments that got moderated away) I think many of the responses here are emblematic of what HN can be, where people who disagree can still come together and talk through their different lenses.

I believe we need to decommodify housing and provide additional support for tenants, as well as build more housing stock. IME, it's not as simple as 'build more', because the interests and incentives don't align -- adding new housing stock devalues existing stock, so there's pressure to keep the commodity cost high.

Some combination of the following would achieve my goal of chipping away at the power of landlords, and reduce the power of landlords over tenants.

1) Build more housing stock

2) Remove single family zoning and allow density (congrats to Washington state for pursuing this)

3) Rent control

4) Guaranteed legal support for tenants

5) Affordable foreclosure insurance

6) Funded community land trusts

7) Social housing, specifically distributed low rise, well maintained

8) Cooperative ownership of apartment buildings

9) Vacancy taxes

10) Good cause eviction laws

11) Stiffer penalties for failure to keep apartments in livable condition

12) Right of first refusal laws (tenant opportunity to purchase)

Teachers are not the only ones impacted by this -- all the members of our communities are unable to live in them. My barista, bookshop worker, teacher, and firefighter don't live in my neighborhood. We then need to invest huge effort into getting people in and out of this community.
That is honestly hilarious, I took a look at their other comment (singular), and this person waited literally over ten years just to post this comment. Wow.
Why are people always in a debate mode?

Don't you think I already know what you just wrote?
Linked article / brief mentions interleaving of text and images as essential for certain kinds of learning; that particular intersection reminds me of the profoundly compelling multimodal book by Nick Sousanis, "Unflattening". Highest possible recommendation.

https://en.m.wikipedia.org/wiki/Unflattening
This reduces to making discrimination and prejudice acceptable for certain groups.

A better analogy would be the smaller kid finding yet another, even smaller kid to beat down.

Then avoiding any mention of the smaller bully, because they were being bullied by someone larger. Nothing positive or nuanced about this position.
It’s fair because otherwise you could compensate people for zero tax. For example, you have a CEO that can either be paid:

1) $1m in cash

2) $1m in stock

3) an option grant to buy 1m shares at $0.000001. Each share has a FMV of $1.

Without AMT, you could always take (3) and they would get $1m of stock for $1. Tax free.
> Police unions are far more powerful that public k-12 teacher unions.

There are about 5 teachers per police officer, so teachers unions should typically be much stronger than police unions.
I'm not advocating anybody commit a crime, but since everybody is equal under the law and the police and ruling class are permitted to get away with conveniently losing evidence, "I don't recall", etc., then it is not morally wrong to avail oneself of the same strategies, nor is it wrong in the spirit of the law, although ruling class judges and prosecutors would naturally think otherwise.
Then use your back button.
It bugs me sometimes too, but I'd rather listen to a thousand wet tongues and smacking lips than a single sentence from Ayesha Rascoe. I don't have a voice for radio either, but (with rare exception) I've been kind enough to stay off of it.

She doesn't always seem as bad off radio, I don't know if other places EQ her differently or what, but you can get a pretty good idea from this video around 5:35 https://www.youtube.com/watch?v=84_fptorOso

On NPR it somehow seems even more nasally, and even screamy at times. I can't last more than a few minutes without muting.
Google Ads is too aggressive for this sort of product that requires knowledge of many things. The product is niche and would need a simple youtube video series to explain it, with a descriptive title and description text.

Ideally, in the video(s) you can talk about how the viewer can setup the solution themselves, breaking it down into components, why each is important and how it all works.

Also introduce how the viewer can buy the entire solution from you directly, where’ll they’ll get some custom support/troubleshooting or they may just hire you for consulting.

This will function as your funnel to let your target customers find your solution as they search for ways to problems they have self-identified.

If you’d like you can also do retargeting ads on the viewers of your video, as they’d be more likely to buy your solution vs the avg joe.
Pledge means YOU HAVE NO SYSCALLS. There is no amount of root magic that can allow the code you've exploited to do IO.
Your comment is misleading. Yes, the union has the ability to decide how the pie is allocated within teachers, but if the teachers are underfunded there's a systemic problem about making sure the teachers get a big enough pie.
Agreed. They just released their V11 FSD revision and it's amazing. Yet instead of seeing a post about it here people are talking about a 2014 Model S crash.

Don't sleep on FSD. I've had it for a year and a half and it's improved dramatically in that time.
Then why is it being investigated?
https://www.bloomberg.com/news/articles/2023-02-02/silvergat...
I’m inclined to agree, especially because teachers also receive pensions for the rest of their lives after retiring, in average before the age of 60 according to a quick google search. Young teachers make less to support these pensions.

I would be interested to hear an argument that refutes your claim.
When did HN get taken over by commies, or has it always been like this? It’s like a couple of these news per day. I thought this was a “hackers” site.
Hello! I was very happy to see this project, it is close to my heart. I had a similar dream years ago, an ultra-low power e-paper laptop. (I noticed people mention such a desire on HN every time something e-ink related comes up! There are dozens of us!)

I also looked into transflective / reflective LCDs as an alternative to e-paper. I haven't built anything though, for various reasons (mostly excuses, if I'm honest! Life is hard, I am busy, but I guess that's true for everyone..).

Are there any other similar devices (or projects actively being developed) with a battery life measured in years?

My current understanding is that I would need to study electrical engineering to have the skills to build something like this, is that true? I have been making some slow progress towards that (learned C, studying assembly, brushing up on my math, studying calculus etc).

But a full EE degree does seem like overkill: I looked at the coursework at a university near me, and it has you learning about optics and quantum physics... so it really seems like most of the work is unrelated to the actual goal of building tiny computers.

Is there a way to find or create a curriculum focused specifically on the things you actually want to build? (If not, I expect there will be in a year or two, at the rate AI is developing ;)

Or perhaps I'm looking at it backwards, has this tech progressed to the point where it is possible to just start building without really knowing what you are doing, and learn as you go along?
Sure, but a police officer has much (much) more power than 5 teachers. I can't remember the last time teachers benefited from qualified immunity or civil forfeiture.
Sure, reasonable inference except due to related reading I'm 100% sure a module exists. And works. What is it?
I'm not being smug or insulting when I ask this, but are you familiar with SELinux at all, or have you administered any systems?

> If you believe that there's a way to become root, why don't you believe there's a way to become some other non-root user?

SELinux maintains it's own set of users that map to unix user. SELinux users have their own roles and capabilities that are very granular. It's frequently configured to make root 'just another user' as much as possible, and remove any access root doesn't need.

So if you 'get root' on a properly configured SELinux system, you don't actually 'have root', you just have a user with a user id of 0 but no real access.

You can switch to whatever user administers SELinux policies, but you will only be switching in the unix sense, not the SELinux sense, so you won't actually be able to do anything.

To do what you are suggesting would require a kernel exploit, but even if you get root you won't have any access to run it.

What you suggest simply is not possible barring very specific vulnerabilities being found, which afaik, have not been.
The 3 most recent ones:

1. Reason: "Duplicate", they spent $40 to get into the festival (4x$10) then spent $40 to purchase food tickets (which they used) - I explained the situation, showed they clearly bought entry then bought food tickets and used them, I lost the dispute

2. Reason: "General", they bought 2 weekend passes and 3 day passes ($60 total) - I explained the situation, they updated the dispute to only be for $40, I maintained they bought the tickets and used them, I lost the dispute

3. Reason: "Duplicate", they spent $20 on food tickets after spending $20 to get into the festival - Once again I explained the situation and showed they bought entry, then bought food tickets shortly after entering the festival. This one actually went in our favor but under the new rules we'd still be out $15 since Stripe won't return the dispute fee even if we win.

I had actually forgotten that we did win one after those other two, which were legitimate, were lost.

All of the chargebacks happened from in-person payments, we didn't have a single chargeback from online purchases. All in-person payments were given an option to get an email receipt, all 3 of these chargebacks declined to get a receipt.

The two duplicates I can almost forgive, they bought entry then food tickets for the same amount (though again, all they had to do was reach out and I would have responded in <15min, often less than 5), but instead they just issued chargebacks.

However this all gets way grosser under Stripe's new policy. Not only do I have to put together the information to dispute it but we will be out $15 no matter what. Our transaction average is somewhere around $40 so right off the bat almost 40% is lost with zero recourse and then we have to fight to keep from losing 140%.
There is also no need for them to do it. Being a public market has downsides. They've been consistent with this message that they may well stay private forever. They never misled anyone. All the folks involved in this are grown adults. If people wanted to work a company which promised to go public, they'd have worked somewhere else. Again, the employees knew it, know it, and Stripe is now doing the right thing, again. Every step.
Does he have a reputation for being a prick? Because man, that guy seems adversarial in all of his replies.
This post was a great read and it's exciting to see companies prove that hardware design can be done remotely. The real gem here though is the silkscreen on those boards, that was great to explore and laugh!