skysight-inc/HackerNews huggingface dataset:
python-tuf [1] back then assumed that everything was manipulated locally, yes, but a lot has changed since then: you can now read/write metadata entirely in memory, and integrate with different key management backend systems such as GCP.

More importantly, I should point out that while Sigstore's Fulcio will help with key management (think of it as a managed GPG, if you will), it will not help with securely mapping software projects to their respective OIDC identities. Without this, how will verifiers know in a secure yet scalable way which Fulcio keys _should_ be used? Otherwise, we would then be back to the GPG PKI problem with its web of trust.

This is where PEP 480 [2] can help: you can use TUF (especially after TAP 18 [3]) to do this secure mapping. Marina Moore has also written a proposal called Transparent TUF [4] for having Sigstore manage such a TUF repository for registries like PyPI. This is not to mention the other benefits that TUF can give you (e.g., protection from freeze, rollback, and mix-and-match attacks). We should definitely continue discussing this sometime.

[1] https://github.com/theupdateframework/python-tuf

[2] https://peps.python.org/pep-0480/

[3] https://github.com/theupdateframework/taps/blob/master/tap18...

[4] https://docs.google.com/document/d/1WPOXLMV1ASQryTRZJbdg3wWR...
OK, you've changed my mind and I've updated more towards "banning alone is likely to be net negative to our goals if we don't also subsidize alternatives"

I think given I don't use TikTok at all I am bad at intuiting how powerful its network stickiness is.
Purely for argument sake: would the above apply if peer kids were in gang, or into drugs or alcohol or whatever?

Social media is no different from those, IMHO of course.
> The metal panels have oil on them in stamping, and they MUST stay oiled right up to the point where the body takes it's first bath.

I toured an assembly line a few years ago. The guide told us that in the 1970s they had teams of people watching iron/steel prices, when they thought the prices where at the low they made a massive order of all iron that factory would need for the next few years. When the factory when to just-in-time (sometime in the 1980s or 1990s) they couldn't do that anymore - but they also got to get rid of all the equipment to de-rust all that stored iron: since every raw material was shipped out as a final assembly in a week there was no time for significant rust to form and so they avoided a lot of problems.
If this were the only option, I bet most people would realize how much of the web really doesn't benefit them in any meaningful way, but merely gets used because it's there, and can be removed from their lives with minimal grief
Paradigm Shift: Activity Based Data Modeling
Not everyone gets used to it.
If giphy was doing so amazing, how does that explain the enormous write down today? Sure you can argue Meta overpaid, and there are some bounds applied by the regulator on how they could sell it, but I don't think that accounts for the entire gap.
To be fair, it often seems like they've forgotten about all of their office apps outside of Keynote.
>That's not practically possible unless you choose to live alone in a controlled box.

You omit a wide variety of possibilities, and claim there is only one possible approach, and so construct a straw-man. Options range from introducing a protocol, to adding paid-speech disclosure.

People looking for signatures show the way: "Can I talk to you about X?" is perfectly workable offline. You can say "No" and be on your way. "Would you like to hear a presentation on a fantastic time-share investment?" again, you say no and be on your way.

One simple thing we can do is require disclosure for paid-for speech. Maybe wear a lapel pin or something on TV, and a hashtag on twitter. The details can be worked out, but "living alone in a box" is not a real or desirable possibility.
Social exclusion is harmful to the development and mental health of teenagers too.
Zelda remakes in general have been good enough that I would stand by your assessment, but it's also making me think about the how bad Pokemon's BDSP "remakes" were... in that case you really would be better off scrounging up an old copy of Pokemon Platinum.
If you want a challenge, implement a superheterodyne signal processing stack in GNUradio or python.
“A big draw” is really underselling it, piracy is the reason for 97% of CFW users.

The other 3% is things like rom hacks and save management, which Nintendo also wants to kill.

Then there is a tiny, tiny sliver in the pie chart for the .0001% of people that are doing it just for the “other cool stuff” like custom themes.
> The idea that WASM is the only sandboxed thing in the universe is just weird.

I don't know anyone who has ever said that.
The rehashed SNES maps are entirely new, they just have the same overhead layout as the SNES tracks. Saying they rely on nostalgia—yeah, that's true. Saying that it's laziness? No, it's no simpler than making a new track from scratch. Probably harder, given they have to make it work with the existing layout, despite the pace and physics being so different.
The west rediscovers yoga
> no one in their right mind is going to expose their database to untrusted users in the first place

I've seen projects do exactly this, with PostgreSQL row-level security.

https://www.graphile.org/postgraphile/

EDIT: Though to be clear, it does seem a terrible idea to me too....even when you prevent unauthorized access, there is always the issue of resource usage.
> Suggestions welcome.

So when I was a child, laser tag became a thing you could buy. Little kits that came with 2 or 4 sets of vests and guns that tried to simulate experiences like Q-Zar laser tag, but at home for kids.

We had a couple of sets, and one of the frustrating aspects was that firing the guns made a lot of noise - they had little speakers built in that played really, genuinely awful laser noises for about 5 seconds every time you pulled the trigger.

But... as curious kids, we found out that slipping a butter knife between the plastic grill over the speaker on the gun and giving the speaker membrane a good slashing solves the problem real quick. The speaker might vibrate, but without a membrane, no real noise is going to be made.

So I guess what I'm saying is that it would be a real shame if folks just slipped a pocket knife through the grill on those gas station pump speakers every now and then.
Landers don't impact hard - they fire rocket engines down, which may be much more efficient at kicking up dust than an impact.

(I still think this is overblowing the problem, because any lander that causes this big of an ejecta problem would also badly damage itself. All the designs will put a LOT of engineering work into minimizing debris, eg Starship putting separate landing engines high up on the vehicle.)
No. 2FA is a feature for pypi, and developers. The entire purpose of pgp sigs was external, it was for distributions to use.

Distributions don’t use it, therefore it’s worthless, just just overhead and technical debt.
NSA previously hosted the original UK-USA 1946 agreement[0] which was declassified in 2010 i.e. pre-Snowden (seems to 404 now). It is limited to sharing of "foreign communications" which is defined as those not being UK/USA.

The Snowden leaks included material acknowledging that this was the purpose of the agreement. The reason the incidental collection was controversial was _because_ it was against a strict reading of the agreement.

See this article[1] which I believe is quoting straight from Snowden leaks; "[The March 1946 UKUSA agreement] has evolved to include a common understanding that both governments will not target each other's citizens/persons. However, when it is in the best interest of each nation, each reserved the right to conduct unilateral Comint action against each other's citizens/persons.

"Under certain circumstances, it may be advisable and allowable to target second-party persons and second-party communications unilaterally when it is in the best interests of the US."

Note that this is saying that they reserve the right to do it unilaterally i.e. without the knowledge of the other, and this is considered against the purpose of the agreement.

I stand by the statement that the general understanding of the agreement - that it is a way for countries to request surveillance of their own citizens to skirt domestic law - is 180 degrees wrong. The agreement is the opposite.

[0] https://web.archive.org/web/20120202160554/https://www.nsa.g...

[1] https://amp.theguardian.com/world/2013/dec/02/history-of-5-e...
In France, people take fully electric high speed (150-200mph trains.
You don't know how old exactly OP's kids are. There is a big difference between 13 and 19.
Name some of those 'moderator list unknown' subs. I have never seen such a thing. Regardless, they are all accessible via API.
How a drought affects trees depends on what's been holding them back
I'm with you that these are major issues, and ones that impact my mental health as someone in my 30s, but I sort of doubt these problems are the main contributors to the mental health crises among young people. Social media and phones have had a huge negative impact on the amount of time young people spend together in person and have amplified the stakes of one's social life. Maybe I'm forgetting what it was like to be young but I'd guess these impacts are a lot more relevant to the mental health of children and teenagers.
New DocSend Report Reveals Hurdles Resurfacing for Underrepresented Founders
Dart/flutter can now target wasm (unstable), so better gc support is coming (e.g. not gc running from whatever you compiled, but rather the wasm vm would do for you)
Obviously I meant replacing the computer part with an iPad, not the controller.

> No one cares what CPU it has

Good luck running a dozen instances of Diva if you don't care about the CPU :)
I understand that. I am in a very similar position. I make time for my hobbies and it is often very difficult, especially as an active parent who makes a strong effort to be present regularly in my kids' lives. Sometimes, I don't get any time into my hobby projects for over a week at a time. Sometimes I get time in and it's unsatisfying because they're creative and intellectual hobbies and I'm already mentally drained, so I can't even appreciate them fully.

I wasn't making a judgment (though I wasn't explicitly not making one either), just saying that many people could use them. Hobbies are good identities, and many people feel a need to define themselves but struggle to do so.

That said, I do know people who complain about having very little time, but I know they spend 4 or 5 hours every day on television, video games, and social media. They don't own a home, they don't have kids, they get on the TV as soon as they get off their 40-hour-a-week job, and complain about how they can't afford the time to have hobbies. Excuses exist on a spectrum of reasonableness, and some excuses are more understandable than others.

The majority of people I know who really want to have fulfilling hobbies do have fulfilling hobbies. Many of them work long hours, also have kids, have to take care of their home, and the like. They'll still scrounge together a few hours a week to paint some Warhammer figurines and decompress.

Most people would also benefit from occasional therapy or a personal accountant. It's not accessible for everybody, but the fact remains.
I'm starting to question that idea too. It seems like, just as often, these supportive environments on the web like to spiral down into an attitude of "ONLY this group supports and likes you; the rest of the world is hostile to you. Literal Nazis lurk outside your door ready to murder you. Better just keep posting online, and be sure to warn any new members about the Nazis outside their doors."
did you notice any advantages of the kids that had delayed exposure to social media? ie smarter, better focus, better motivation, better emotional iq?

it would be HUGE news if this were the case, very curious about your reply
I replied to a comment on some other Nintendo-related post here the other day that began with something like ‘…Nintendo isn’t petty enough to…’ - to which I jokingly replied that I’d stopped reading after that.

Honestly - Nintendo is the pettiest and shittiest to its incredibly passionate fan base.

Where SEGA hires people who have created great fan content, for instance; Nintendo sends out C&D’s.

Nintendo shut off their own revenue stream by closing the 3DS store.

That was their choice. They could still be making at least a bit of money from the 3DS store, but they chose not to.

So…punish the homebrew devs for their own stupid decision? I have never been able to understand Nintendo’s behaviour, especially having grown up in the ROM hacking and fan gaming scene where SEGA and Nintendo could not be more parallel opposites.
Thanks for the reference.

"lightweight and efficient" is definitely not what comes to mind when talking about Electron.
"Pausing playback of a video or other processing in a background tab is useful to save energy. So only enable this add-on if you can afford it.

There are other ways to detect if a webpage is visible, e.g. onblur/onfocus. This add-on does not disable any of those other ways. So do not assume that this add-on will enhance your privacy."

From the Readme of the FF addon.
I'm a big fan of anything that's very Suffocation, I'd love to listen
I never meant for the iPad to replace the controller. Just the computer part.
Their track record shows if they can't tightly control a technology, they won't touch it. LLMs can be bent in different ways and Apple wouldn't allow that. I own Apple devices, but I just don't see Apple play in the Google/MS/ClosedAI's field by saying "Our model is 20% larger than the best models out there...".

Also, Apple should first fix Siri, or get rid of it for good. It's a joke at this point.
The wild bit about this is this: Imagine reading this comment 6 months ago. A person would probably spit their drink out..but it is true. Apple will spend WWDC talking about XR like it is a 2021 Facebook Earnings Call.
It's not related. The Florida move was to be Imagineering; these layoffs do not touch that group.
My son still has a a 3DS.

Does this update install automatically? Should I do something to prevent it?
As someone who loves my career as a researcher and scientist, but was denied admittance when I applied from 2003 - 2005, I'd be opposed to denying the career opportunity to those who want careers in research and to follow their dreams.

Academia isn't the only career path for those with a PhD (I worked in industry and at NASA as well), and I think students should be taught that early on. I think we deny the opportunity to learn how to conduct research to too many people due to limited resources.

Regarding student aptitude, that's hard to measure. Already we highly prioritize students who have already published as undergraduates. If we do more to ensure student aptitude, it would hurt those who may excel but were held back by a lack of mentorship during their undergraduates in how to get into a PhD program. This would also negatively impact efforts to increase diversity in science as well.
I don't like this argument. As if an indie shoemaker should be grateful to have the privilege to get in a bidding war against Nike for who can give Facebook more money to get noticed.
> The point is that they don't remain the same. Assuming that they do is an operational error.

How many projects are signing each release with a different PGP key each time?
And what are the odds that such projects will actually correct their practices as soon as pip implements key verification and make the problems more visible? A lot I guess?

It seems a lot of assumptions are being made...

But it is a self-fulfilling prophecy: the more you hide, hamper, and cripple the signature metadata, the more people will misuse it (without knowing it), which leads to these articles that argue for more crippling because people are misusing it.

The elephant in the room remains that pypi is a big target, and even though I highly appreciate the work done by maintainers (mostly volounteers?) I have a hard time believing they will always be able to keep skilled attackers away from its infra.
On paper, this just uses the same security model as javascript and obviously a lot of thought is going into security and sandboxing with this. What has been problematic historically was a lot of native code written in a hurry by dot com era companies being unleashed on browsers via a poorly thought out plugin model.

Flash, Silverlight, Java Applets, and loads more stuff existed while people were still OK serving stuff up without SSL, trying to figure out cookies and generally not putting a lot of thought into cross site scripting attacks. That was a security nightmare and all the obvious things happened. WASM does not seem like a repeat of that. Rather it builds on all the learning we've had since then.
Nice! I noticed that Bard allows you to see drafts it made prior to selecting its final response and I kind of wanted chatGPT to do the same.

This is not just useful to reduce hallucinations or improve reliability in general, but also you could get as precise and specific as you want with the criteria to select the winning draft, which is something you can't control with Bard either. You could also extend this idea by then having another model extract and combine the best aspects out of each draft and so on.

This seems like a pattern / approach that would also be particularly great for cases where the output from the LLM has to be precise to be useful, such as writing code.
AI-enhanced shell scripts for common developer tasks
Ask HN: How do you manage dotfiles and provision machines?
Hey HN,

=======

TL;DR -- I am looking for tool(s) that (1) will manage my configs / dotfiles and (2) will install software from a central recipe to any machine I have access to. Chezmoi and Ansible look to be good candidates on a first glace but I am open to other ideas.

=======

I'd like to setup several Linux machines at home, mostly because my main dev machine (Mac) doesn't allow me to tinker as much as I'd like (ZFS and Docker are a pain on macOS; and VMs I currently don't want to deal with). And because I want to be mobile for my programming work and other IT hobbies (I recently got told I am a fairly decent data analyst without me realizing it; I just enjoyed learning a ton of CLI tools and how to slice and dice data in the terminal).

I am a beginner at Chezmoi and I have a cursory knowledge in Ansible, Puppet and Chef. Let me describe what I am after and I'll hope that you would be kind enough to share your tips and tricks. I am looking for a solution where the following applies:

- Configurations / dotfiles are to be added explicitly. Zero automatic magic.

- Be OS-agnostic and account for OS specifics i.e. I have GNU tools installed on my Mac and their directory is added to $PATH and I know this directory will be different on my Linux machines. Writing that much shell scripting is fine but stuff beyond that I'd consider an annoyance. I'd like something more declarative that calculates what to do based on the declaration. I hate YAML but I'll write that if I have to.

- It should install any software that's missing from a central "recipe" when I run a command. I am OK with manually composing this global list of software packages once. After that I'll want to invoke one command and the machine being provisioned to start installing everything.

- OPTIONAL: Handle updating. I already have a very good script that goes through everything I want updated -- stuff via `homebrew`, `cargo install`, `go install`, `asdf` and others -- but I do wonder if there are better solutions than my 50-line tailor-made ad-hoc shell script?

---

Basically I want to invest in something that rids me of the manual work of managing N machines. The more declarative -- but easy to compose and edit! -- the better. The less automatic magic, the better. And if I can avoid hundreds of lines of shell scripts, even better.

Naively I'd say Chezmoi + Ansible so far but I am open to any other ideas.

Please share your wisdom. I am willing to read through every comment here and gauge the pros and cons. (I also would concede a bit from my position on super minimal shell scripting and more declarative syntax. Because hey, if it's easier and quicker to just shell script it then OK.)
… for one I would like one with a wider attention window.
I would expect it’s the sustained thrust prior to landing and at take off that is the difference.
They don't do it with the MacBooks either, just Mac Pros.
>requires outrageous hardware

Who is going to pay $20/mo other than professionals? You'd assume professionals have professional hardware. A mid-range GPU or a video editing laptop is not exactly breaking the bank.

>no tool required to see that it is generated

But again, that also applies to commercial generative images. They're easily discernible, if you just look. Midjourney is stable diffusion with a bunch of LoRA stacked on top. And it can't shed the "midjourney look" because of that. That's not in dispute by anyone.
Embrace the future or use linux.
Does the school allow cell phones in school? If so, why?

Relying on parents to somehow prevent their kids from doing what all their peers are doing, I'm not surprised this is a fight parents choose not to have, or don't know how to win, or don't have the energy for.

Can the school "be bothered" to try to do something at the school level, that will effect the entire peer group, instead of hoping that parents will find a way to swim against the stream? There might be other ways than simply prohibiting phones. Or maybe the school "can't be bothered" to try?
> Trusted News... the Murdoch family

This does not inspire confidence.

But it doesn't make the Daily Mail a bastion of anything worth having. It's just owned by a different reactionary billionaire.
It's easy enough to restore:

https://answers.microsoft.com/en-us/windows/forum/all/restor...
This is why regulation is useful even though it's imperfect. If it's against the law for under 18s to use social media, parents no longer need to justify allowing their kids access because all of their peers allow it. By necessity, more traditional means of socialization will reemerge.
I'm not sure how that can be a problem. If traffic couldn’t have any effect on your city, then why bother simulating it? The whole point is to make you think ahead and plan the capacity of your road network so that traffic jams are less likely and fixing them is easier.
The videos in the article are absolutely slick!
EU does no require a warrant for taking of data from residents [0] by LE. There is little legal protection from LE in Europe, "law enforcement agencies can access the personal data of citizens of any country as long as they are involved in investigating crimes related to the European Union."

[0]: https://law.yale.edu/sites/default/files/area/center/china/d...
Plastic panels are a whole bucket of issues in themselves. As far as I know, the color matching plastic panels are painted using a different process. That means the the front and rear fascia (bumper) of your vehicle are painted in a different plant (usually) from the rest of the vehicle. The colors have to match to a very high degree.

And yes, that's a big reason why they went with stainless. Stainless steel does corrode, just much less visibly than regular steel. It also has different physical properties like work hardening etc. It's also VERY expensive. Salty napkin math says $10,000 more for the Cybertruck.
As the author of the post noted above, the pypi maintainers have been wanting to get rid of pgp for awhile.

The post gave them excellent additional justification to.
https://www.qt.io/product/ui-design-tools

Depends on how much one actually bothers to look around.
I used to use ROS 1 for work. It is incredibly over-engineered. Somewhere in the code base there is a three level hierarchy wrapping a shared pointer to double. The actual address is configured using an xml file. The purpose? To “abstract” the commanded torque ultimately sent to a motor.