skysight-inc/HackerNews huggingface dataset:
People that write articles like that never had that jerk friend that would connect to their LAN and arp flood to take over an IP or setup a pineapple to capture wifi then run a proxy to turn all their images upside down.

The way we run public certificates may have 100 holes in it, but the entire thing isn't open for easy attack for anyone that's clever enough to see and modify a packet to whatever they want.
You are, of course, free to run your website however you chose. But if those are the first objections you have, I'd be happy to read and address your full list.

> Clock sync would be a requirement for access.

If you're on the Internet, then unless you have a religious reason against the NTP protocol, setting the time accurately is not a problem.

> A recent device would be a requirement for access (not everyone can afford a new one).

It's a fair point to raise, but if we target TLS 1.2 (1.0 and 1.1's been deprecated, and 1.3 support still isn't everywhere.) then all Android phones with Lollipop, which was released in 2014, and up support TLS 1.2. (The shittiness of cheap Android devices means phones from back then don't work anymore, so low end phones from a few generations back are more accessible than a Nexus 6 (Google's launch pre-Pixel phone for Lollipop) would be.

If you're on a laptop/desktop, there are no released versions of Chrome on Windows that are so old they don't support TLS 1.2. This includes the now-unsupported XP SP2+ and Vista. That dates back to 2007. On Apple desktop/laptops, Mac OS X Snow Leopard (10.6) and greater have Chrome support for TLS 1.2. I'm away from my 2012 Macbook Pro right now, but it's on something newer than 10.6.

So if your audience would have to be on 9+ year old Android phones, 16+ year old Windows computers, or a similarly old Apple computers (which is entirely possible), but they've already been excluded from the running any credit card transactions on the Internet (and have been since June 2018 due to PCI forcing the deprecation of TLS 1.0 and 1.1).

> Site admin keeping up with certificate registration would be a requirement.
> Approval from the centralized certificate authority would be a requirement.

Let's Encrypt, which has been around since 2014 just handles all that nonsense, with automated support for most of the popular web servers. It's free (gratis) even for commercial and for-profit purposes, and is sponsored by the EFF, among other organizations.

> Server's self domain name matching accessed domain name would be a requirement.

That's not the case, unless you're using bespoke web server software. Name-based virtual hosting is quite common, even in the TLS world, and lets the client specify which service it would like to connect to. The web server is then configured to reply with the hostname that was asked for, and multiple services, (with different names) can be run on the same server on the same IP address.

Regardless though, if the primary failure mode you're worried about is users being denied access to your site, they can always just click through the warning to access underlying site. They'll be used to it from using the rest of the web (eg Wikipedia switched over to be exclusively HTTPS in 2015, and Chrome started labeling HTTP as insecure Jan 2017).

As for speed, I was in South East Asia recently, and found that cities had LTE and 4G, but while there were stretches of no service (which exists even in a rich nation like the USA), what surprised me was finding EDGE cell data. If you're that constrained then sure.
Can someone explain why this is being downvoted?
I thought the custom message would generate a custom level that replayed those letters lol
> Vulkan is a Standard. It uses standardese language to define things.

As a counter example, the "D3D Engineering Specs" do the same job, but are much more readable:

https://microsoft.github.io/DirectX-Specs/

PS:

> You can use newer OpenGL versions for this, but the code becomes much like something you would write using Vulkan API anyway.

Ironically, a lot of "modern" Vulkan might end up looking like old-school OpenGL again by using this new extension ;)

https://registry.khronos.org/vulkan/specs/1.3-extensions/man...
https://twitter.com/Foone/status/1572263752346796033

In reference to the above tweet, it might surprise you to know that at times in the past (and per Wikipedia, even in some cultures today[0]) March has been considered the first Month, meaning that the new year would start on March 1, the leap day would be the last day of the year, and September, October, November and December would in fact be the seventh, eighth, ninth and tenth months of the year.

https://en.wikipedia.org/wiki/March#Origin
> passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes.

What is the scenario in which SMS one-time codes are prone to fishing, but passkeys are not?
> without data or references

Can you clarify what you mean? There are almost two dozen footnotes pointing to references and papers.
> accurate estimates are unwanted

In my career I've learned that estimating usually boils down to a game involving guessing what the customer will accept, while the customer tries to figure out what they want. Dig deep enough, and there's usually a dependency like "it needs to be done before X", but when X will be done is also imperfectly known, so it's a tangle of dependencies.

The cases of hard dates usually involve businesses dependent on seasonal, holiday revenue or scheduled events like sports or entertainment touring schedules. Estimating for those is much easier, because the game becomes one of figuring what can be delivered by the date(s) in question.

Regulatory changes or fiscal timelines are usually not as fixed as they are believed, because there's lots of ways to paper a path over delays, although its costs money and business don't like that.
Nothing prevents anyone from creating an open-source implementation of the FIDO server/services.

For example:
https://github.com/StrongKey/fido2
Actually I'd see a future where some of those password killers might replace passwords, even for some of the under-funded, under-manned applications out there.

What is necessary is a robust, simple-to-integrate standard for authentication, authorization and sessions built into HTTP. Such that all the "hard work" is integrated into common HTTP server software or load balancers, transparently. From an application perspective it should just look like your request getting HTTP_USER=someone HTTP_PERMISSIONS="stuff,foo,bar" HTTP_SESSION="0xdeadbeef", similar to what you get from HTTP basic or negotiate auth, but with a few more necessary features such as session, login/out and a permission model. Browsers would have to provide some proper UI for that, not utter crap like they currently do for HTTP basic or negotiate auth.

Then your centralized auth application can just talk to any old application in a very simple way, no need to deal with huge integration headaches like OAuth or stuff. And the centralized auth application can do all the fancy password killer, 2FA, magic or whatever special auth you need.
As often, the guessing about historical reasoning could be all over the place. And not just about WebGPU (oh that never ending “why not SPIRV?” discussion). Claiming that Vulkan and D3D12 were kicked off by a GDC talk about AZDO sounds ridiculous to me. These APIs are about explicit control, they allowed to talk to the driver more and better, which is the opposite of AZDO approach in a way.

Anyway, congratulations to WebGPU release on stable Chrome on some of the platforms! Looking forward to see it widely available.
Markets price an 84% chance of the Fed raising rates today https://www.cmegroup.com/markets/interest-rates/cme-fedwatch... , but the old saying is that the Fed would raise rates until something breaks, and we already have several banks being broken because of outflows from their low-interest checking accounts. The markets are pricing in 50bp of cuts by year-end. Why should the Fed take an action that it will soon have to reverse? I think the Fed should have been raising rates in 2021, but that ship has sailed.
Linux desktop is such small fish to Microsoft it would be ridiculous for them to focus on it as competitor right now.

If experience gets degraded it’s because of limited testing, not malicious intent.

It’s like Oracle suddenly deciding that their greatest competitor is sqlite. The two live in different worlds.
"To forestall having a “dasvidaniya comrade” moment where a self-aware GPT-5 shoves an icepick into their ear, Trotsky-style, they put together a ‘red team’ that tested whether GPT-4 was capable of ‘escaping’ or turning on its masters in some way"

You can agree with the author, you can disagree with the author, but he has a Style.
Hmm interesting. Just looked it up. Seems to be that BPA/BPS is the problem with it. It seems like phenol free thermal paper is the answer to that issue, although there isn't a lot of information on what is used instead.

https://www.possupply.com/blog-the-phenol-paper-rundown
> The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate surveillance.

Please provide evidence that biometric data has ever been extracted from a major platform (IE Apple/enclave). Absence of evidence != evidence of absence, I know, but you’re selling it as the only use case so surely you have proof.
Unity to lay off 8% of its workforce
ChatGPT scams are the new crypto scams, Meta warns
> And I have high confidence they will do just that.

Let us put your confidence to the litmus test:

1. What is the legal status of Puerto Rico?

2. Is it a State in USA or a Colony of USA?

3. Are Constitutional Rights defined in US Constitution applicable to residents of Puerto Rico?

4. Do they have voting representation in the US Congress?

> We can ask USA to leave and take their soldiers with them.

Good luck with that!
Someone needs to start a campaign going to make that the next Christmas Number 1 somewhere.
Anyone tried installing Chrome on Windows recently? I got at least 3 "warnings" about how I didn't need chrome when I could just use Edge. Honestly, I imagine a lot of people who are less competent with computers just assume they are doing something wrong and give up.
https://archive.is/GwzSC
I use Tablerone, which is really good but takes some concentration to use effectively. It also is among the worst things to find help about, bc there is very little and most of it relates to chocolate.

https://tabler.one/
Can't wait to see some performance reviews on these new Framework laptops
The area of statistically sane software for regular users is so underexploited that there are many instances of X you can plug into "X but with ranges instead of numbers" and carve out a niche for yourself.

I myself am hoping someone will pick up X=spreadsheets at some point soon.
I love this approach.
And to see if the “bio-identical” anabolic steroids (or other performance enhancing drugs) in your body were created in your (or someone’s…) body, or in a lab.

(Basically radio carbon dating, but against a subset of a molecule rather than the whole thing).
> they will _never_ land any developers using their browser

I honestly don't think they care. They get the benefit of all the work devs do to support Chrome for free and get the much more lucrative "regular user" market.
> Is C++ going away soon? Or is it holding steady and even growing? How can someone objectively know either way?

No. It's not going away anytime soon, but you can look at high-performance languages that are gaining in popularity, and that may point to change in the future. TIOBE isn't perfect, but it's a good indicator of interest, and Rust and Go seem to continue to gain popularity.

Interestingly, and related to this article, Fortran has moved up from #31 to #20 on TIOBE's index, which really does speak to the importance of a math-optimized, high performance, compiled language. Another interesting change is MATLAB moving up from #20 to #14.
A playbook for managing any production incident
https://en.wikipedia.org/wiki/SIM_swap_scam
Thank you, that makes sense. I had no idea that there was such a dramatic difference in memory bandwidth between desktop and server CPUs.
This is more secure, passwords can't be stolen from the site. Sure, let's go with the assumption that your phone can be stolen. It would be only your phone. If a site has 100 million users, an attacker could steal 100 million passwords. With this approach, the attacker would have to steal 100 million phones. No matter what password manager you use, with a password length of 100 characters. The entire password list (encrypted) can be stolen.
Yep. China is quite capitalist. The largest thing that's left of communism there is the absolute centralized power.
I'm sure that's right. If there's one thing US CEOs are focused on, it's making certain their pay increases track the inflation rate precisely.
Sounds really cool, but I can't find any videos of these bubble curtains.
I was honestly expecting AI generated porn to be a bigger thing right now. But I guess it’s still early.
Show HN: Generative AI Tools Directory
App that makes you a Naruto character
All you need to know about estimates is Hofstadter’s law.
No they aren't, despite the superficial similarity, and I think you know it. At best you haven't actually thought about the difference between a measurable field defined by math and a mystical "field" ultimately defined by feelings.
You have a point. I'm actually thinking about it. Helping other people is probably the only thing that made me happy throughout life. Unlike others such as gaming that only keep me happy when I was younger.
ChatGPT real-time meetings assistant for Job Interviews
Run our extension during your Zoom, Google Meet, or Teams call, and it will answer any technical questions in real-time.
The difficulty here is figuring out a definition of "significant news" enough people agree on.

For example, you've missed my definition for the same reason many mainstream outlets do: I don't care about the Russian/Ukrainian conflict. That alone is 4 out of 14 of your front page stories.

It's a good idea, but it will be difficult to execute in a way useful to a significant number of people.
The US has a different history than Europe. One aspect of that history being the strong influence of religious puritans who were among the earliest colonizers, and whose impact has and can still be seen today in various aspects of American society and culture.
Is there any reasonable Linux support for a laptop with ARM right now? Asahi and Apple are one thing, but qualcomm's offerings haven't looked enticing at all.
Passkeys sign a web origin. If you try to phish one, the token you get won’t be valid for the origin you’re trying to authenticate to.

Eg you’ll get:

Token{domain:hax0r.net username:bob}
If you disable lazy evaluation, you would not be able to write arbitrary "where" sections, with definitions ordered as you want them, including tying-the-knot definitions, which are not exceptionally rare.

So no one disables lazy evaluation.

It is strict evaluation that is selectively enabled.

I also have to say that focusing on the types in the compiler development was the right thing, but what was not right is not focusing on the automatic analysis and removal of thunk creation for lazy evaluation. There is a project now to implement GRIN (graph reductin intermediate notation) [1] which supports such analysis and GRIN is early 90-th.

[1] https://grin-compiler.github.io/

GRIN also automatically gives you many benefits of supercompilation.

We could have a much better Haskell code now if ghc decided to support several backends back then, not only STG/C--.
> GPU in other ways, such as training ML models and then using them via an inference engine all powered by your local GPU?

Have a look at wonnix https://github.com/webonnx/wonnx

A WebGPU-accelerated ONNX inference run-time written 100% in Rust, ready for native and the web
1. You're tricked into visiting evil.example and don't realize it.

2. evil.example: confirm 2fa code to log in.

3. evil.example starts logging into good.example as you, triggering good.example to send the 2fa code.

4. You see the 2fa code and enter it into evil.example.

5. evil.example has phished your 2fa code.

This doesn't work with passkeys (or 2fa tokens) because those verify the domain matches.
> low marketability going forward.

I'm not so sure that will continue to be the case. Fortran has moved up substantially in TIOBE (to #20), so there's clearly growing interest.
Don't pick fights.
There's still a "default", at least on my PC.

But yeah, using the uefi works fine to choose between windows and linux, even if you only have a single /efi partition (I use efistub for linux, not a dedicated bootloader).

If you add custom boot options, they won't be removed after a windows install, it only adds itself to the list and sets itself as the first in line. Afterwards, it doesn't seem to touch that anymore, but YMMV with "big" updates.
> biometrics are usernames, they are not passwords

While I see where you're coming from, they really aren't just usernames. It's not like I can log into your e-mail account by typing VoodooJuJu and pressing Enter.
More pressure to keep profits high due ongoing financial shenanigans. Add consumers with little to no options, and the expectation that the common good is more important than profits.

It turned out profits were more important, and now people are angry about the new 230g mayonaise tube costing the same as the 275g one did last year. But at least the new tube required 17% less plastic.

Something's got to give if we expect inflation to drop. _Many_ people expect businesses to take the hit. After all, many raised prices due to things like energy costs last winter, but very few lower them again now that production costs go down again.
That's one of the coolest tutorials I've ever seen, just from a pure formatting and writing perspective.

I'd still recommend FreeCAD if you actually want a CAD rather than a tool to record a design you made yourself with very little Computer Aid, but if I ever have a use case for FreeCAD this will probably be where I go for a refresher.
nap,
ride bicycle,
go to a park,
explore some space in VR if you cannot physically go somewhere.
that is what the parent said.
I'm so happy to see someone who has actually read some of these studies on here.

There are only 2 reasons to do the translation behind peoples' backs AFAIK:

1) also from kahneman et al we know that humans are bad at estimating time, and much more consistent and accurate about measuring effort. And consistency is required for the law of large numbers to apply. By estimating in consistent non time units you avoid those cognitive biases.

2) humans will very quickly start to unconsciously bias the units if they feel pressure. Speaking in terms of time puts one very close to a lot of pressure points for a lot of people.

Ideally engineers are concerned with doing things Right, and PMs are using past performance to predict how long that will take.
Writing parsers and tokenizers probably.
That is also an issue with 2fa sms, but it's not phishing.
It appears I succeeded incorrectly, and "I C U".
This was cute. It reminded me of The Looker, a parody of The Witness. It's available free on Steam: https://store.steampowered.com/app/1985690/The_Looker/
> Don't you see how absurd that is in 2023?

I understand that POV, but I should temper my "serious work" statement by saying that the Office web apps are pretty great and keep getting better. However, the native desktop apps are just better.

It's hard to make a direct comparison with Google's web-app-only strategy since the Workspace apps are toys in comparison, more akin to Apple's iWork suite.
"100 highest paid CEOs" means this is a flawed study.

It's not the same CEOs year to year, it's just the highest paid, and since CEO pay is mostly equity, it's probably the CEOs of the top performing companies last year.

So if CEO #1 was on the list last year, and the company did worse this year, they likely aren't on the list, saw a compensation drop, but hey, that doesn't make headlines to say "Top paid CEOs from 2022 saw a compensation drop of 10% this year".
I used to do this a lot as a kid. Ascribing high meaning to tiny things like words or patterns. Some of it was just plain magical thinking. Later I learned it's called the "Hindsight Bias" usually mixed in with a little grandiosity and juvenile narcissism. I never understood why no-one could see my genius! Being a teenager is so cringey in retrospect...

Although, as a buddhist I like to think of the meaning of life as tearing down walls that never existed anywhere but our own minds. Of realizing interconnectedness. But at the same time I'm always aware that I'm not THAT far from the cringey know-it-all teenager!
> Seems relevant to note that these charges failed..

As USA lives in post law age it only means that relevant corporations carpet bombed regulator with lawyers, paid politicians, lobbyists, job offers for key bureaucrats(after they retire/leave) to make it go away. And to prosecute corporation regulator needs money, money they have is finite so they need to choose their fights. And they need don't know if around the corner some corporation doesn't produce fentanyl out of baby skulls. On top of that fixing plight of chicken producers won't translate into them spending money on lobbyists, hiring retired bureaucrats or financing PACs, everything corporations that gain from it will definitely do.
You only have to look at what you’re ignoring in order to hold that view

> actually provide services… need

You’re valuing entertainment at zero (nobody needs that), vice at zero (nobody needs that), financial services at zero, and a perpetual bug bounty at zero, those are the major components of the crypto space

and you simultaneously hold every participant in any of those sectors as both representative of the whole thing, and equally as relevant as the next participant

persuasion is not the word I would go for, the disingenuous nature of that perception is the main observation
Prey and Deathloop were great games. Fortunately, the online game mode was not mandatory in Deathloop -- it made the game a lot worse.

Redfall sounds like an alpha release that might get good if they manage to release an actual version some day. Thanks to everyone who gave those beggars $70 for the privilege of becoming their testers. I guess we couldn't get the final version without you guys.
> Even using recursion is rarely a good idea as you loose control with your memory layout.

Used recursion at tons of Codeforces / ICPC problems with some caching(commonly known as "dynamic programming")
Amnesty International accused Ukrainian armed forces of endangering Ukrainian civilians with their defense tactics. And then they (A.I.) covered up the report that found significant problems with their reasoning. So... no, they aren't very concerned with accuracy or truth.

https://eeditionnytimes.pressreader.com/article/281814288181...
Safari has:

(0) Favorites, which can have icons turned off and be text menus with nesting across your browser bar horizontally,

(1) Tab Groups, which persist and live in the side bar vertically with lists under each, and

(2) ephemeral tabs (transient, today, etc.) that live above the tab groups, and can disappear when you quit/rerun browser or be restored (I use that mode). And, just for fun, it also has

(3) "Pinned Tabs" that stay pinned at the left of your tab row. Both (1) Tab Groups and (2) ephemeral tabs have their own unique (3) Pinned tabs.

Certainly favorites are bookmarks while tab groups are tabs, but there's little difference in practical use as you can right click a favorites hierarchy and "open in tab group".

The ephemeral class are unique per Apple device, while the Tab Groups are shared across devices. Both are synced across devices, you can browse to the ephemeral class on other Apple devices using the "iCloud Tabs" button at bottom of sidebar.