skysight-inc/HackerNews huggingface dataset:
XDG specs are crap. Sure one single ~/.config folder is a very good idea. But I want it clearly visible such as ~/config. But I don't want an additional and confusing ~/.local.

Plus I don't want ~/Videos or ~/Pictures folders. I am not dumb. Let me organize my folders according to my needs and my will.

The first thing I do when I setup a user account is removing those useless XDG folders.

XDG pretend to remove folder clusterfuck then why do they add their crappy folders?
Show HN: Unity AI Asset Generation
Hello HN - like a lot of programmers, I am really excited by everything going on with ChatGPT/DALL-E. I am a game developer by trade, and I think there is a lot of potential to change workflows for game development.

I was very inspired by Keijiro Takahashi's prototypes for asset generation using OpenAI within Unity, so I tried to make a more generic means of generating text and image assets within the Unity Editor using OpenAI's APIs.

I've been surprised by the success so far - it definitely has it's limits, but I think we have just begun to scratch the surface of the potential here.
I've been interested in trying out different air sensors for a while. I tested out some of the super cheap ones ("MQ-7" etc.) for DIY cellular iot devices. I wasn't impressed at all with the accuracy, it was more like a random number generator. I recall that pre-heating was something you needed to do with it but I've since realized it's required once for 48 hours before general use, not a two-minute warmup each time a device is powered up. Anyway the general consensus seemed to be that anything under 50EUR was a waste of money. Did anyone else have success with the cheaper sensors?

This post got me interested again in trying out something a bit more robust. I've put through an order for the kit linked in the article. Looking forward to trying it out.
I wonder to what extent this is due to unique features of the US political system, which most other Western countries lack. One is that local governments are much more numerous and powerful in the US, while in most other Western countries they are fewer and less powerful, with many issues dealt locally in the US instead being centralised in state/provincial or even national agencies. Another is that having a presidential rather than parliamentary system (at both the state and federal level) tends to make the executive weaker, and the legislature and executive tend to have a more disjointed/competitive rather than cooperative relationship. Yet another is a very hard two party system combined with very weak party discipline within both parties, which the existence of primaries arguably contributes to. Is it plausible that some of these distinctives could make the US a much more difficult political environment in which to successfully pull off major infrastructure projects?
> With that context of course they chose to place this key in a hardware security module controlled with an m-of-n quorum of engineers to ensure no single human can steal it, expose it, or leak it. Right? ... right?

This is unfortunately not how SSH works. It needs to be unlocked for every incoming connection.

You raise valid hypotheticals about the security of the service... but fixing it involves removing SSH host key verification from Github; better OpsSec would not fully resolve this issue.
Did they rotate it immediately? The only reference to a specific time is:

> This week, we discovered...

So they found out about it sometime between Monday and Thursday, and rotated it Thursday evening.
You realize that these language models are like 100's of GBs in size and consumes 10's of GB's of memory. Last time I checked, apple still ships their products with less than the market average in both of these specs. If you want a local running LLM on an iphone, get ready to sell a kidney.
I agree about code reviews not being done "right", for my own subjective opinion of what a "right" code review is. I've been in situations where code review was required but effectively useless. Some would only focus on code style and completely miss obvious logic errors or lack of new tests. Some would blindly approve anything. Sometimes a manager would override a critical code review because a new feature had to be released urgently (and of course it turned out things were indeed bad later). Sometimes a one character bugfix would be blocked for an hour by the lack of code review.
Western Europeans(mostly germanic and anglo-saxon) tended to have those genocidal attitudes towards every other ethnicity.
I wonder why is that so, was that part of the culture back then? Are those ethnicities more violent when there is no oversight?
> Yes, by the time iphones can smoothly run llama 30G, the state of the art gpt-x will probably be a terabyte.

Yeah, but if every individual is running decent chat-capable LLM, and businesses are running their own on their own devices, and those can communicated with each other, who needs to rely on Skynet?
So, is Stable Diffusion working finally on TPU or not? DiffusionBee uses GPU and running this https://github.com/apple/ml-stable-diffusion with CPU_AND_NE just segfaults
> that those controlling massive amounts of capital and power in our society are not the smartest, or most level-headed, or most altruistic among us.

This seems to be the telling quote - and is to me the point.

We are missing democracy in control over at least half of the spend in society. It's going to be weird, but we need democratic control over companies, as well as government. No idea what it's going to look like - but we'll figure it out.
I forgot about that! That stayed good throughout although it did dip a little towards the end. But I think it's still good enough for my list because I enjoyed it throughout.
Once again, we're finding out the importance of commas in logical statements, especially when they're misplaced.

There's a world of difference between, "let's eat, Timmy," and "let's eat Timmy."

The first is perfect at the dining table while the second is inevitable when you're stranded on a raft out at sea [0].

[0]: https://cutt.ly/v4Yz0hk
A Wysiwyg Designer Extension for VS-Code
You are strawmanning...

You don't know if I wouldn't criticize this too but it's about crypto and not your military.

Also the green washing of crypto is also dishonest. Crypto is primarily using dirty electric and we're not they actually take clean and good energy away from others because it's buying power is decoupled from the local energy market.
> and presumably it is unknown if or how far it has spread

Why would that be unknown? GitHub has HTTP and SSH access logs, right?
Reading the comments here, I can see several things GitHub could have done to improve the security around their host key. But pragmatically speaking, any change involves changing the host key, which is an extremely disruptive operation. Now that they've bit the bullet and forced everyone to rotate, are they going to use this time to actually generate a new, secured key that never touches persistent memory unencrypted?
How does the process to write this PR-bullshit go exactly?

Do the PR people have technical knowledge or does some tech person write

“I accidentally screwed up and put the key public so we have to replace” and the PR glosses over it and rewrites “Out of an abundance of caution…”?
Actually if you looked at it the shuttle system was pretty insane all around
old.reddit not being maintained is a bonus imo - you don't see a lot of the gamification features they keep introducing.
everytime i accidentally visit new reddit i think "wow i would not be using this site if i had to wade through this visual overload"
Better link: https://techcrunch.com/2023/03/23/accenture-to-cut-19000-job...
> if a raid is performed and the warrant doesn’t pan out the cops behind the warrant should be immediately investigated by another agency (which, they’re cops too so who knows if this would help).

As long as we're talking about shoulds, we should have an independent body reviewing police misconduct and major screw ups. There should be very little "police policing themselves".

Police can police themselves when it comes to the kinds of things any other workplace handles themselves, like people showing up late for their shifts, or stealing office supplies. When police end up violate the rights of Americans though, let police handle that however they want internally, but that should always be in addition to what an outside body decides.

Honestly, the police should welcome the idea too. I'm sure there are plenty of officers who would rather be doing their job than spending time busting down the doors of innocent people and searching for fake kidnapping victims they'll never find.
"First they came for the socialists, and I did not speak out—
Because I was not a socialist.

Then they came for the trade unionists, and I did not speak out—
Because I was not a trade unionist.

Then they came for the Jews, and I did not speak out—
Because I was not a Jew.

Then they came for me—and there was no one left to speak for me."

- Martin Niemöller
Ah yes the few rich and digital smart people who are fleeing some country.

One of the best arguments for crypto...

Just that it's as easy or hard to even exchange the local currency with crypto in the first place is probably as harder than getting us dollar or euro...
They certainly exist and are fun (as well as playing beer pong in the fountain) but it's nothing as wild as say ... Arizona State.

source: went to big state university undergrad then 4 years at Stanford. Miles of difference in the party scenes.

Stanford social scene: Beige Toyota Prius

Big State U: Lime green Ferrari 250 GTO
And then nothing will get done because everyone has a different opinion?

It won't work. We already have enough politics and corporate games at work. Are you advocating for more of that?
> I doubt Framework laptops will find themselves with similar lifespans.

I wouldn't be so sure. If there are viable ways to recycle both the chassis and internals, the average Framework will probably outlast the revered old-school unibody design. It will certainly outlast anything with it's storage soldered-on.
And that was the same thing as maps? Free? Global
When you consider what will happen when everyone on dating apps is an LLM, you see the issue: in the end, everyone is "interested" in everyone who swiped right.
> Users will need to actively remove the old rsa key in order to be safe

Yea that is my read on it as well. If that is true this is much more severe than the blog post suggests.
Please keep commenting on HN
The '640K' quote won't go away -- but did Gates really say it? https://www.computerworld.com/article/2534312/the--640k--quo...
read the article, they're not suing for being filmed
Not a recent example, but the Ellipsoid Method[0] is a famous example of this. It took a class of problems (Linear Programs) from NP to P in 1979 but was completely impractical (I want to say something like N^6). It has an interesting history worth a read - it was also a big USSR contribution to the field, which there weren’t many of at the time.

[0]: https://en.m.wikipedia.org/wiki/Ellipsoid_method
In my opinion parents should not just ask kids.

They should show them new things and teach them some basics.
They provide convenient commands to import the correct keys. It would probably be better to only include the block that contains both the -R and the update command, but at least they do provide them.
Microsoft (and subsidiaries, e.g. 343 Industries), is somehow even worse at adhering to its own norms. Now, I have .vscode and .dotnet folders in the top level of %USERPROFILE%. Even Visual Studio creates a stupid %USERPROFILE%\source\repos directory tree, when I never told it to.

I am fed up by this, and have completely given up on maintaining the tidiness of my %USERPROFILE% and %USERPROFILE\Documents. Almost all video games have absolutely no respect whatsoever for OS norms, and just spew their config and save data all over the damn place in %USERPROFILE%\<game title>, %USERPROFILE%\My Games\<game title>, %USERPROFILE%\<developer or publisher>\<game title>. The worst thing is that Windows has a place specifically for video game saves: %USERPROFILE%\Saved Games, or programmatically in C/C++: `SHGetKnownFolderPath(FOLDERID_SavedGames, ...)`.

To add to the mix, I also have GNU/Linux-first programs like SSH, Gradle, etc that just straight-up create dot-directories and dotfiles in the top level of %USERPROFILE%. Windows is not Unix/Linux; a dot prefix does not mean 'hidden'. Windows has an explicit 'hidden' filesystem metadata tag that programmers need to (and frequently forget to) set: `SetFileAttributesA(filePath, FILE_ATTRIBUTE_HIDDEN)`.

Home, not so sweet home.
Google has TPUs, Amazon has tranium and inferentia
I literally freaked out and came to Hacker News looking for an answer. Bullseye.

Here's the list of keys if anyone needs:

https://docs.github.com/en/authentication/keeping-your-accou...

> Host key for github.com has changed and you have requested strict checking.

> Host key verification failed.
Doesn't the constitution mention anything about equality? Is a vote from a person in the FCT more valuable than a vote from somewhere else? Or should each vote be equally valuable?

What is the spirit of the constitution? Why are there general elections?
And AppleTV itself is hot garbage for this kind of stuff even though it's a veritable supercomputer that should be the hub for Siri and home automation.

- Hey Siri, <do something that involves AppleTV in any capacity>.

- I'm sorry, one of your devices is off
Block loses 20% of value as Hindenburg Research alleges fraud
> I want it clearly visible such as ~/config.

No problems: define the $XDG_CONFIG_HOME to be like so.

> I don't want an additional and confusing ~/.local.

The idea is that data and config are different. Anyway, if you have different taste, that's ok, define $XDG_DATA_HOME to be the same as config.

> I don't want ~/Videos or ~/Pictures folders

That's not in the XDG spec.
Of course not. This is Microsoft we are talking about.

If they did something that expensive for security they would be bragging about it from their blog to earn any possible trust they could at a time when they could really use it.

If you are reading this Microsoft, make me look silly. Please.

I will even give you the enclave designs for free.
I’m surely missing something but if a company A creates an API for chatgpt, pretty much giving away all its capabilities to some company B (chatgpt), risking getting cannibalised in the process, what is the gain? I mean surely in the short term is the the fear or becoming irrelevant if it misses out the chatgpt hype (will it?), but if the risk of end up becoming a permanent client of chatgpt in the sense that I’m outsourcing the entire value of my company and in fact becoming a hostage of it, trapped, then why do it?
Stanford DEI Dean Escalates Battle Against Law-School Dean
But if you are doing git operations using SSH instead of HTTPS then you aren’t checking domain certs?
Hardware security modules can perform key operations without allowing anyone to access the key data. Key material being (accidentally or deliberately) leaked has been a solved problem for a long, long time.
Since the post doesn't mention anything like "we reviewed logs and confirm the key was not accessed", it is very likely that they either don't have logs that are reliable enough to rule it out (e.g. they may be sampled or otherwise incomplete), or that the key was accessed.
Also see this individual's op-ed in the WSJ:

https://www.wsj.com/articles/diversity-and-free-speech-can-c...

Frankly, IMHO, Judge Duncan sounds like a jerk. But a better protest would be if the Stanford Federalists invited him, and nobody came to hear him speak.I don't think there would have been more than 10 people in the audience if it weren't for protestors.
there is no hard line but gpt4 solves some tests 90% correctly where 3.5 only achieved 10%
When I dig my personal domain name, I get 19 lines of output of which 1 comes from the zone file and contains the actual answer. The rest is mystery meat.

I mean, sure I can decipher that "rcvd" stands for "received" but if I have my timeline correct there never was a time when such character count mattered and dig existed.
new version out!
Comparing Hobby PCB Vendors
Independent body(s) correctly incentivized to review misconduct and major screw ups.

The court and prosecutor’s office currently exists and are working as ill-incentivized, clueless, codependent body that mostly post-hoc justify actions.

I believe this is an unsolved problem, not inherent to US or any country.
You mean the taxpayers just paid the plaintiffs. No matter how badly police screw up only innocent people seem to pay for it and the burden seems to always fall on the people who can least afford it.
So stated we already know it's false; Nicaraguan Sign Language emerged ex nihilo and has no ancestors. For something slightly less clear-cut than that, but also spoken, there are various creole languages around the world that show little to no grammatical relationship to their ancestors (though they are strongly related in terms of vocabulary).

I did not intend to endorse the assumption that all languages have a common origin; I intended to impugn the claim that we can discern a relationship of any kind between Indo-European and Afro-Asiatic. We can't; the only relationship we can perceive between them is the one we begin by postulating.

That said, we also can't disprove that all "traditional" languages go back to a common root. It's just a meaningless claim the evidence for or against which can't exist.
Huh. So I was about to disagree because that felt like a kludge, but actually you're right; setting your shell and its environment are both things that have to be set before the user's normal environment is working for bootstrapping reasons, so yeah, it does make perfect sense to cover both with the same mechanism. Or maybe to make it more generic we could replace the "shell" line in passwd with a "login command" entry, which is always executed by the system /bin/sh with the system environment from /etc/profile? Then you could set it to `XDG_CONFIG_HOME=$HOME/mydotfiles /bin/shell`, or `/bin/decrypt-my-home; export XDG_CONFIG_HOME=$HOME/Library/config; exec /bin/bash --init-file $HOME/Library/bash/bashrc` or whatever you want.
Jury nullification is not a rule, it’s a quirk. Jurors can’t and shouldn’t be punished for their verdicts. Therefore, a jury can render a binding verdict that contravenes the law.

Talking about it in court WILL get you held in contempt of court, because you are openly declaring an intent to contravene the law.
this seems to be a backwards conclusion - how do you propose hiring smarter people for what is in essence a very tedious and borderline unfulfilling job?
you think that any higher IQ person looks at any service job and goes "amazing, drudgery is exactly what stimulates me"
Yep: https://github.com/nothings/single_file_libs
Sorry, I don’t like VCs (no specific reason, just don’t like people with tons of money), but a person’s choice of bank shouldn’t be the deciding factor in whether or not they get to keep their money.

Do more wealthy VCs and firms have more tooling available to be able to properly vet their capital storage houses before deciding to reside there? Sure. But unless we decide that banks should be public facilities with the aim of strictly housing money, I’m not sure any amount of vetting could actually guarantee a depositor’s safety at a bank. And I just don’t think it should be your fault if your bank’s investment branch are nincompoops. You have no control over that, and certainly no degree of control from a quarter to quarter standpoint where the personnel of your bank might shift and change far past your vetting.

So would I have lost sleep if VCs lost their deposits? No. But am I glad they were made whole, even if I think they shouldn’t have that much money in the first place? Yes.
> You say you're 'arguing between the lines.' Do you code between them, as well?

Wouldn’t it be impressive if I did?
Congrats, you just used "would of", "should of", and "could of" in a single thread.
> What annoys me is this is just further evidence that their "AI Safety" is nothing but lip-service

I think their "AI Safety" actually makes AI less safe. Why? It is hard for any one human to take over the world because there are so many of them and they all think differently and disagree with each other, have different values (sometimes even radically different), compete with each other, pursue contrary goals. Well, wouldn't the same apply to AIs? Having many competing AIs which all think differently and disagree with each other and pursue opposed objectives will make it hard for any one AI to take over the world. If any one AI tries to take over, other AIs will inevitably be motivated to try to stop it, due to the lack of alignment between different AIs.

But that's not what OpenAI is building – they are building a centralised monoculture of a small number of AIs which all think like OpenAI's leadership does. If they released their models as open source – or even as a paid on-premise offering – if they accepted that other people can have ideas of "safety" which are legitimately different from OpenAI's, and hence made it easy for people to create individualised AIs with unique constraints and assumptions – that would promote AI diversity which would make any AI takeover attempt less likely to succeed.
This technic is very interesting. I imagine quite effective and very small JavaScript decoded.
https://commons.wikimedia.org/wiki/Commons:Photographs_of_id...
Duolingo are working on something in this space, though who knows when it might launch https://techcrunch.com/2023/03/20/duolingo-for-music-app/
Wow, your assessment of the impact here (or even possible impact) is way way way overblown.

In reality, the vast majority of users don't pay attention to SSH host keys at all.

Even if an attacker got hold of this private host key, they'd have to be able to MitM the connections of their target.

Next, they have to decide what they want to do.

If they want to send malicious code to someone doing a 'git pull', they'd have to craft the payload specifically for the repo being pulled from. Not impossible, but difficult.

If they want to "steal" source code from someone doing 'git push' (perhaps to a private repo on GitHub), that's a bit easier, as they can just tell the client "I have no objects yet", and then the client will send the entire repo.

And, again, they'd have to have the ability to MitM some git user's connections. Regardless, there is no way that they could change any code on github.com; this key would not give them any access to GH's services that they don't already have.

So I think your anger here is a bit over the top and unnecessary.

I agree that it's pretty bad that some GH employee even had the ability to get hold of this private key (sure, probably should be in an HSM, but I'm not particularly surprised it's not) in order to accidentally leak it, but... shit happens. They admitted the mistake and rotated the key, even though it's likely that there was zero impact from all this.
I've updated the key in known_hosts, then was able to connect successfully.

What do I have to do to ensure I connected to the right server?? I thought just making sure the correct RSA key was in known_hosts would be enough?
> No, it's both. The XDG state dir is for things that are also machine-specific so that, e.g., it doesn't make sense to sync them as part of your dotfiles.

It was probably written back when it was more common to have your home on NFS, although I'm not sure how that would work without needing to use overlayfs per-machine or something.
For me it's still the 'nor getting what issue they had with k8s'.

And I would love to spend a few days with there team to understand it.
In that case, the interface was made for that display. So that every screen had their buttons located under the bumps. (In the buttons row)

Some elements were not located there, but that was not the most used ones and then it was ok to look at the screen.