skysight-inc/HackerNews huggingface dataset:
I asked ChatGPT how the browser plug-in works recently (so, take this with a grain of salt) and it claimed there is no actual web connected search engine in use, instead it has a “simulated browser” connected to something like a vector database of a recent snapshot of large parts of the web captured by OpenAI. Seems odd when the Bing bot already connects to the real internet, but also seems like a weirdly contradictory thing for it to hallucinate.
Nope. Case in point, Pegasus was used to attack the French Minister of Armies on her iPhone. Hard to attack someone more valuable than that. Zerodium doesn't blow zero days on showing ads to you, they are used for nation-state level attacks.
C# does. It's not exactly a scripting language and authoring a native dependency NuGet package isn't exactly an obvious task, but when you learn how, it's a straighforward solution:

- a NuGet package with native deps (win, linux, osx) cross join (x86, arm)
- a P/Invoke package that depends on the native one
- actual software that uses the dependency

When you publish the actual software, it pulls the deps and includes the correct native build.
I think you forgot "not" there before "an acceptable approach in 2023".

These are all fair and reasonable opinions to have, and to some degree I even agree with it, but none of that is captured in the rather simplistic benchmark. Everyone understands that even with the best of efforts it's hard to capture everything in a benchmark, but in this case it's just missing a very obvious way to run Redis.

It's like benchmarking PostgreSQL connections and coming to the conclusion there is no way PostgreSQL can handle more than n connections and that OtherSQL is much better. Is this true? Yes. But it's also true that half the world is running pg_bouncer and that this is widely seen as the way to run PostgreSQL if you need loads of connections. Is it a pain you need to run this and something that should be addressed in PostgreSQL? Absolutely. Such a benchmark would be correct in a strict narrow technical sense, but at the same time also misrepresentative of the real-world situation.
This is good for GnuCash. It could bring enough visibility and interest to bring in more skilled developers to contribute a little work into adding or polishing some of the features the article mentions are lacking.
Rewrite it in Rust?
> Aside from tofu causing me intolerable heartburn, I also wouldn't eat it because of the phytoestrogens.

Would you be against coffee and tea as well, or is the dose low enough to not worry about?

https://www.researchgate.net/publication/23141692_Phytoestro...
The Lathe of Heaven Ursula K. Le Guin
Age inappropriate instructional materials don’t serve as a shield against harm from pornography.

Is there any research that increasing the level of explicitness and detail for younger ages increases benefit or mitigates harm?
Same, I love it! Having done ruby, javascript, python, I'm allowed one niche language (although I really hope it grows in popularity!)
I'm a 15 year kinesis advantage user, I will also get the advantage360 but it's >180 days wait from their partner to solder customer switches and the defaults are way too heavy for me. I'll put ~20-25g switches in from upgradekeyboards.

glove80 downside is bottoming out. upside is mountability (my chair arms, or flanking my LC4 chaise longue, etc.), better tenting ability, maybe portability, and more immediate availability. the choc switches are also interesting because they're more compactly placed. not as much pinky stretch.

I don't have a glove80 yet but will probably get one before figuring out which advantage80 model to get / if the wireless is still crap. I currently use an advantage and a sofle choc with gchocs and mkb poms and magsafe mounting.
Thanks, hopefully violating copyright in Japan doesn't come with draconian prison sentences.
I think we're more or less on the same page.

And honestly, flagging a comment based on disagreement is a pretty shitty move. I've noticed that happening more often here.
We each do what works for us.

> That said, of course, I wouldn’t be caught dead using nano :P

ISTR that Rachel by the Bay uses nano. No shame in that!
Because as humans, we know we have something we call minds and mental representations, since we experience having such things as we go about our lives. How the nervous system produces those and how exactly we should understand mental is unclear. But since LLMs aren't brains and don't work the same way, we can't say they have anything like minds right now. The solution isn't to get rid of the mental in humans, it's to better understand the differences and similarities between machine learning models and biological nervous systems.
The rumor mill has been consistent for over a year that the “mass market” iteration is coming in 12–18 months (I’d guess they’re targeting holiday season 2024).

I think people are underestimating how effective a “cost-almost-no-object” version is going to be at generating interest. There will be lines at Apple Stores as soon as it’s available to try.

The model is iPod / iPod mini|nano. Everyone wanted the former, everyone bought the latter.
In the end it's all supply and demand, there is no causal connection between low pay and dangerous/disgusting work, quite the opposite. If a job is dangerous or disgusting and still low paid, it just means that the barrier to entry is even lower. Anyone with two arms and legs can be a janitor.
The real web available in your pocket. If you weren’t using the mobile web before then, it was a decidedly second-class experience until mobile Safari launched. It took Google 2-3 years after the iPhone to get Android to be comparable and by then the App Store was booming, which basically doomed all of the old phones. Previously selling apps required paying off each carrier and giving huge percentages of the sales, so there were almost no apps of decent quality available. At WWDC 2008, there was spontaneous applause when it launched with much better terms, hard as that may be to believe now.
How do I know if activating private mode in the Quest web browser is not equivalent to sending a signal to Meta that "now extra juicy information is coming in"?
Yes, the things people do for investment money...
He wasn't making it up. I work with a nonprofit and we needed 40 cheap tablets to run some custom app that we wrote. I had tight control over what was installed and clicked on.

After 9 months of using the tablets, they all would have an ad pop-up on the lock screen. I'm guessing that they came with malware that activated after X months of use.

Anyway, we wiped the tablets and reinstalled our app from scratch. It wasn't too hard because the tablets were single-purpose, but if those tablets were personal tablets with all of my favorite things, it would suck.
The Demon Core and the Strange Death of Louis Slotin (2016)
I think it would make app development much more complex to have to find & use a midi stack, versus having midi devices well handled & a nice standard interface available.

We could all be using user land networking stacks too over raw sockets but we don't do that either. Yeah, it too is simpler for the kernel.

One of the key roles of the OS is to abstract access to resources. Turns out that's kind of useful.
The iPhone worked as an iPod and a phone. It didn’t need to do anything else to already “win” for a few bucks more than both combined.
No point in suing them unless you have more cash for lawyers than HP does. And you probably don’t.
Around 300 at this point, sans any deleted ones. I don't think I know a single password anymore, since they're all randomized and separate for each site.

> Obviously, anything with OAuth is "bundled" into my Google account.

Maybe it's just me, but I try to never use centralized identity providers (outside of things that I really don't care about) and use separate e-mail auth whenever possible, across multiple e-mail accounts (some self-hosted). Same with considering separate Google accounts for phones, services like e-mail, a separate one for any content creation on YouTube and so on (ideally without any of them coming in contact with one another).

The idea is that one account getting closed/suspended shouldn't result in ALL of the linked stuff becoming inaccessible. I don't even do anything weird online, it's just that nowadays you hear lots of stories about people getting banned based on some heuristics by automated systems, with no ways of getting in contact with the support. Even something like a VPN might trip those systems up. Similar things have happened to me before (a SaaS provider didn't want to do business with me) for no good reason even without a VPN, but trying a year later with the same credit card didn't result in the other account being auto-suspended. How odd.

I guess the next step would be to have usernames, phone numbers and even payment methods (apparently virtual credit cards sometimes work) also be more randomized and more compartmentalized, though something tells me it'd be a pain to do that. That said, I largely believe that privacy online is mostly dead due to how much fingerprinting there is, though one can still protect themselves from automated systems acting weird, because nobody genuinely cares about that, at least at the scale where they're needed.
Every individual struggle is unique and personal, but if we zoom out, there seems to be an interesting emerging pattern in startup comms. I've recently seen many similar "public vulnerability" essays come from similar elite business school-graduated, McKinsey-trained, YC-backed, VC-funded young founders framing their experience as an "underdog". I'm genuinely curious about the origin of this style - they are almost pitch-perfect and frequently follow the same playbook echoing the "trauma essay" that overtook college applications in the last decade (eloquently and succinctly described by a practitioner at https://www.youtube.com/watch?v=MyD0m7JXgjA).
1. We removed the FAQ page
2. You are right, I need to shut the fuck up and let self-righteous hn crowd with torches do what they do best - find a weakness, and push it until they get bored and switch to beat another builder. You asked me about my perspectives and priorities? These are my priorities: https://github.com/dragonflydb/dragonfly/graphs/contributors
3. The first thing I did was on this thread was to apologize for having FAQ with such content.
You can store the first 2^53 integers with either sign, and if you need accurate integer values beyond that size you can stringify them and parse as big ints.

It’s not ideal, but 2^64 integers is also finite.
Okay, then Android can be unix-like too.
>These malicious updates collect data about the users that the threat actor, which Trend Micro calls the Lemon Group, can sell to advertisers.

Sorry but this sounds like Google or FB, I expected way worse unless Google and FB services are considered as malware as well
> Are getting good marks that much more valuable than the actual education you would receive if you didn’t cheat?

The problem here is the incentive structure. The nature of grades is that some people will get As and some people will get Cs. If you get Cs, you might like to get As, but maybe you can't for some reason, from lack of intelligence to other time commitments to alcoholism.

Then your choice is to get a C on your own or maybe get a B+ by cheating. Given the same amount of learning, getting a better grade is better, so the only real incentive not to do it is the risk of getting caught. Some of the old methods for this were pretty unambiguous. If you submit the exact same essay as another student, or one that has been on the internet for ten years, what other explanation is there?

Rich kids would avoid this by paying someone else to do it for them. That has always been a problem. But now the cost of getting "someone else" to do it is approaching zero when the someone else is AI, so the problem spreads. But attempting to detect it with methods that have false positives is worthless.

On the other hand, testing students on their ability to do something that ChatGPT can do just as well? Maybe that's worthless too, because that's no longer a marketable skill when your future boss can get ChatGPT to do it too. So what they need to do is change the test to test for the thing the student is expected to be able to do better than the AI.
It's some tiny Twitter (blue) user posting some nebulous list. Seems pretty BS to me, and it's surprising HN falls for this. Okay, it actually isn't surprising.

It's actually funny how a confirmation bias works: In other posts people say "this tracks with other rumors..."...yeah, that's what people who make stuff up tend to do.
How far has society fallen if people who make a point of pissing off other people don't deserve a beatdown?

We're getting soft!
It might be “Tom OR Martin's Language”.
You have two options:

1. Pay and support this small developer. A password manager is a critical tool that needs to be constantly updated to support the latest OS. This isn't Adobe, it's a bootstrapped indie developer making an app for a small audience. I think the free version is already quite generous. Plus Strongbox includes a one time purchase for all platforms, no subscription unlike 1Password or Bitwarden.

2. Compile and build from source. It's an open source app, you are free to sideload the app if you want to.
I'm given to understand that OpenPGP as such is not vile per se; it is a standard on which you can build a secure and flexible system that can evolve as ciphers evolve, etc. It's GnuPG that gave it all bad fame.

It's also where I tend to agree with he-who-shouldn't-be-named-on-hn-lest-a-shitfest-begins: "never ever roll your own cryptography" stigmatized the field such that anyone who would like to actually try to do something is first discouraged by their peer crabs in the bucket repeating "never ever roll your own cryptography" mantra, and those who get past that are discouraged by the old boys' club of Those Doing Cryptography for Decades who seem to imply that you need to have at least a Nobel Prize in Mathematics to join the club — even though those are the same folks who also gave us a plethora of cutely named OpenSSL vulnerabilities and made GnuPG an unscalable cabinet of morbid curiosities (where the curiosities are all those wonderful workarounds that put GUIs on GPG, integrate it with other systems, etc).

I wish People Doing Cryptography for Decades had enough humility to admit that they don't know everything, and that maybe while they may be algorithm demigods (although all those sweet named vulnerabilities would make some question that status), there also exist folks who do API and UX design better. If only people could talk to one another...
And that belief is a concern if he is wrong. AFAIK, he is wrong, so I am concerned. AFAICT his "data" is the same fabricated "MMR causes autism" data as the other anti-vaxers. If you know of something he's been pushing that's not downstream of Wakefield (or even evidence of his meaningfully revising his opinion around the Lancet's retraction) I'll give it consideration, but there's a limit to how many times I'm interested in relitigating the same questions without meaningful new data.
> NordPass

I haven't seen a website this aggresive if you dare to open it in uBo in quite some time. Scroll down one screen and it constantly reloads.

I'll stay with 1p.
Or source-based distros (and equivalently source-based distros with reproducible builds & a binary cache of build artifacts with a package manager that checks the resulting hash matches the expected value).

Of course source can still be compromised, say by malicious dependencies. But it's better than source and binaries being compromisable.
What do you mean about Apple Pay? Ever since it came out I've seen it absolutely everywhere.
That would be true except that we see the same thing across school districts. (There’s no evidence that teacher ability predicts district-level outcomes, either.)
Whoa this is crazy high tech. Sigstore signing? Nice.
I disable all auto updates on my mum's phones and my own as well - the pain of dealing with features being removed/moved/renamed, interfaces being redesigned and unexpected changes is far greater than the absolutely miniscule risk of being hacked. I hate with absolute passion how an "update" to my phone can change its entire interface to the point where I have to re-learn common usage patterns. Google apps especially are the worst at this. It should be exactly like the day I bought it, I used to think that OTA updates are the best thing ever - now I've grown to loathe them.
> I am really struggling to see how this can succeed.

People seem to forget this every time, but this version of the tech is aimed at developers and early adopters, just like version one of Hololens was. It's also priced like Hololens was.

The consumer focused version in a thick sunglasses form factor comes later.
I thought the approved by apple line of thinking was that the app store is a mecca of safe and trustworthy apps?
Ask HN: Friend stole my IP, started company and raised money
Dear HN,

A friend of mine came to me with a business idea and wanted me to join him as a technical co-founder. I wasn’t sure I wanted to commit to that but offered to help him build a prototype so he could raise some money and start a company. I told him I might potentially consider joining the company later, but gave no binding promise.

He didn’t have any money at the time to pay me for working on the prototype so we came up with a deal where I would charge my normal hourly consulting rate, but if he hadn’t managed to incorporate and raise money after 3 months, then he wouldn’t have to pay me anything. But all the IP would revert to me and I would essentially own everything.

At the time I considered the deal to be fair and pretty low risk for both of us. He claimed to already have investors interested in his idea and I didn’t have any other consulting gig at the moment anyway. I also wanted to help him out starting his company. If he managed to raise some money, which seemed likely, it would be a fairly good payout for me at the end of the 3 months.

I worked hard and built the prototype for him. I probably worked harder than needed, but I wanted him to succeed. At the end of the 3 months he claimed that he was on the verge of signing an investment with several angels. But he needed me as a co-founder to close the deal. I told him I would consider it if we split ownership 50/50. Seemed fair, since I basically had built the product all on my own and he had contributed almost nothing, beside the original idea. But he refused to give me anything above 20%, which was a big red flag for me. So the deal with the investor never happened and ownership of all the IP defaulted to me… or so I thought.

I obviously dropped the project and went on working on other things. But the other day I read a news article about how my “friend” had just raised a large sum of money from several prominent investors and had been running his company for more than a year with IP that I was the legal owner of. I was shocked by the audacity and emailed the guy telling him that he could please pay me what he owed me, and I would not pursue any legal action. But haven’t gotten any response. crickets

So what should I do? The amount he owes me is quite a considerable sum for me, but not unreasonable. I have a contract that we both signed listing everything in detail. So shouldn’t be any problem to prove. I never gave him the code I wrote for the product, but a lot of the work was on architecture and product design that I did share with him, so I don’t think it should matter. He is still using my IP.

Contacting a lawyer seems like an obvious next step. But that costs a lot of money. I am considering emailing his investors as a next step. But don’t want to screw things up for him. Just want to get payed. He will need to raise a seed round at some point, which would be impossible unless he lies to his investors.

Any suggestions on what I should do?
> it's not really the best source to quote.

Sure. I presumed people could parse out the emotion from such an obviously biased source and focus on the claims. But yes, cherry-picked quotes have a higher likelihood from such a source.

The purpose of a source doesn't matter. Whether or not they are misrepresenting (and what they are misrepresenting) does. ProPublica exists solely "To expose abuses of power and betrayals of the public trust by government, business, and other institutions, using the moral force of investigative journalism to spur reform through the sustained spotlighting of wrongdoing." Yet it does it right, earning a very highly-placed spot on the Ad Fontes Media Bias Chart.
I'm with you.

Last week, my favourite German lawyer Udo Vetter made a blog post [1] about parents reporting questionable media in group chats to the police.

He warns urgently to never do this.

If you're in a large telegram group, discord, WhatsApp or whatever, and your phone downloads the questionable media automatically, you're already doing a crime (the mere possession of such media is illegal). In Germany, the minimum punishment for the possession of child porn is one year; a monetary fine is not possible and a dismissal of the case due to insignificance isn't possible either.

According to Udo Vetter there have been cases where "concerned parents have brought printouts of the chat messages to the police so that the things are not distributed further. Criminal proceedings for possession of child pornography were the result."

Further down in the blog post how there were funny cases like the police seizing a mobile phone of a drug dealer, and then finding group chats with thousands of users where questionable images were shared. Which will then start a mass investigation on thousands of innocent people, who weren't even looking at that stuff. No one looks at group chats 24/7, especially in fast-moving chats with like 10 messages/minute.

The issue isn't even new. I remember many times when IRC networks were flooded with such media by troll collectives like myg0t, 4chan and whatnot.

[1] https://www.lawblog.de/archives/2023/05/12/lustiger-gruppenc...
This is why I put devices I do not trust (like these kinds of boxes) on a separate VLAN. My access points advertise a WiFi network with client isolation that can only access this VLAN. There is one hole in the firewall from it's subnet to my Jellyfin server. The DNS server for that subnet has a whitelist for some of the streaming services on my TV and internet radio, and nothing else.
Deco – Delimiter Collision Free Format
I built a TOTEM[1] (same creator) and it looks stunning. Was a breeze to get manufactured (both PCB and resin printer case from jlcpcb, in my case) and assemble too!

The build guide is very informative and quirky, it has everything from tips in how to solder smd diodes to "use a sharpie to paint the PCB sides black so it looks nicer", way better than some expensive kits I've bought in the last few years!

1. https://github.com/GEIGEIGEIST/TOTEM
This should be the default mode or thinking for anything that stores your data. Databases need to be bullet proof. And that armor for me is successful Jepsen tests.
But then apple couldn't gouge every app developer for an additional 2k. Right now you must buy a Mac to have the privilege of building and uploading iOS apps.
Could you elaborate your statement? How? My experience says otherwise. I am interested to know your viewpoint and experience.
This has been a problem with so many cryptographic systems over the years. For various reasons they prefer to be backwards compatible over being secure. As the best practices shift, the default values of these applications stay the same.

I understand why, to a certain extent. If your defaults change and people are expecting the old values it could break existing scripts and tool chains. For most applications this argument makes sense, but for security focused tools I think this is a mistake. Defaults should always represent best practices, and people who want specific flags should specify them.
Serenity: A song written by AI, performed by humans [video]