skysight-inc/HackerNews huggingface dataset:
If it is just a regular rounds increase, why force an immediate re-auth on all users? It would be way more user-friendly to just wait 6 months or so for natural re-auths to occur, and only do a forced re-auth on the few remaining users afterwards.
Unrelated, but did anyone notice how the 'ff' ligature in "Warren Buffett" overrode the capitalization. What a weird edge case I've never thought of.

EDIT: Ahh, it looks like it uses a font-variant: all-small-caps without setting font-ligatures: none
But if the fundamental issue is that the JS code that runs in your browser is provided by the same entity providing the back-end, couldn't we have a different entity that -on a different domain- serves JS code that interacts with the backend of the original service? I know this is not the case now, but this is theoretically a possibility, right?
Yep - last order was 8 days for me to the UK.
We have functionality similar to this in our product. It's a pretty important feature of the product, since it allows customers to monitor and debug workflows that are being executed remotely.
That’s why I like Air Matters. You can choose your scale
Where did I say anything about "their own civilians"?
> not the devs they manage

This is a big part of the problem; PMs should be managing the product, not managing developers, though it almost always ends up being the latter. The same goes for project managers, who should be managing the project, not the developers.

Though PMs should be working closely with developers, the idea that developers are subordinate to them is pretty silly when, ultimately, their incentives are heavily weighed towards siding with product owners and upper management in general. The role of PM doesn't suggest any sort of qualification for managing developers, thus it makes more sense for developers to be managed by lead or staff developers who report to directors of technology or product owners. Unfortunately, this can be dysfunctional because roles like "lead" are often given to those who don't have good leadership or management skills. However, it still makes more sense that developers are lead by developers who answer to whomever owns the product. When you add a PM in the middle, they often act more as a blame-diffuser when their actual job should be like an interface between developers and the business, and to provide some amount of defense for the developers they supposedly manage.
Currently, following the latest updates are a Sophie's choice. Because if your software is a month old, it may have one or two known vulnerabilities, which may or may not be disclosed, may or may not have a POC, and may or may not be actively exploited in the wild. But if you download and install the latest update, then you may receive mitigations for known exploits, but now you very likely have an unknown number of new zero-day vulnerabilities.

So update decisions could have a calculus like, "it's already working; I don't need any feature updates; I'll stick with the stable version" and then attempting to evaluate each CVE on its merits vs. the mitigations offered in each update. (Of course, the way developers like KeePassXC are fighting with the NVD shows that CVE descriptions can't even be trusted these days.)

I foolishly disabled automatic updates for my consumer-grade WiFi router, and I didn't have a plan for manual updates, so it got pwned. I read a few CVEs and I'm fairly sure I know how it was pwned remotely. Thankfully it didn't seem to be making lateral moves into my computing devices, or acting against me personally, and I was able to disinfect the router and put it back into service. The vulnerabilities that enabled the pwnage were fixed by an update which was released about a month before the pwnage, so if I'd been on automatic updates, I probably would've been safe. And that's what the hackers count on.
Going to have to call bollocks there. I first did this as a kid, with my dad when I was 8. I joined a bunch of folks at a movie theatre on Bloor, in Toronto, in 1993, right after I moved there in August. Though, where I grew up we called it the Dark Side of Oz.
TruTime is, in Google Spanner, using atomic clocks
That happened to me only because I imported the file twice or three times, thinking records would be overwritten when they completely matched. Oh, and because it also imported deleted (but not flush/emptied out) entries, which in hindsight I found it to be a good practise. Aside from that, importing was straightforward and categorizing the many uncategorized entries a breeze compared to LastPass.
The Little Book of Deep Learning
The popular VLC alternative MPV is very guilty of this. I got shut down when I tried to discuss it in a Github issue
That just means that you have such a small number of passwords that you are much more unsafe that someone using a compromised password manager. I guarantee you your passwords have been leaked in individual website's breaches and that has exposed all your other accounts using the same credentials.
But I guess that isn't ideal for things other then coding and doesn't offer any kind of integration, like autocomplete.
No, I don’t think it’s just a question of recall accuracy. They issue really hinges on whether or not the AI itself is a derivative work of the training data, as I think that would trigger certain requirements in the original source licenses. Lots of folks seem to think that it is not a derivative work because (a) the model is just a bunch of numeric weights, it doesn’t contain any explicit code; and (b) it’s possible for the model to output original code in some cases. But that’s flawed reasoning because it’s quite clear that the model weights do contain perfect copies of at least some training code, and the models can produce that code perfectly (without the original license) when prompted. Thus it seems clear that the model itself should be treated as a derivative work, whereas a human is not—even if they memorize the code they read.
The Wikipedia article mentions that these plans have been canceled.
It entirely depends on who you're talking to if they are entitled to grace and style.

Although I would like to think that I treat everyone with grace and style. If I'm polite with my "no", and it still doesn't work and the person isn't entitled to grace and style then I make it very clear and abrupt. "I said no, do you understand what that means?"
This is an all-American problem; the rest of the world says «no» just fine
> always run the latest updates, to protect against 0-days

How does running the latest updates protect against 0-days? Wouldn't the latest updates be bundling the latest 0-days? The latest updates mitigate known vulnerabilities, not 0-days.
The subject here is end-to-end encryption (where content is encrypted all the way from one client device to another client device), which makes big promises of inviolability. But in order to avoid the Starbucks snooper, you only need transport encryption (where content is encrypted from your client device to the WhatsApp or whatever server, normally with TLS in the form of HTTPS).
If you look on loopnet, the cost of office versus warehouse per sq ft is staggering. It's a large visual indicator of a bubble.

I've been looking for 1500-3000 sq ft for a light manufacturing space for around two years. In my area warehouse $/sqft is $5-7 a year. Office space is $13 for old and dated layouts. I have no use for that dotcom era conference room. I need 10 ft dock doors, tall ceilings, and reliable 3 phase power.

Buying land outside my metro area and building new is becoming the only option for me until this crash actually happens. Sprawling out of the metro would only bite me down the line because the labor market is even tighter in rural areas.
I use these paths to take it down

* Report to https://safebrowsing.google.com/safebrowsing/report_phish/

* Report to https://www.phishtank.com (account required)

* Use a WHOIS lookup service for the hostname, find who's the registrar and submit an abuse report to them.
So, you want them to target BMW, Mercedes and other EU brands rather than to address all of the car manufacturers in the same way?

That's exactly the kind of thing they don't do, and for good reasons.

As you can see from the link posted above they do a lot to ensure right to repair, but it isn't perfect. Give it some time.
Related discussion two days ago: https://news.ycombinator.com/item?id=36441054
I still don't like that solution.

What if your parents earn they much but don't want to pay for college for whatever reason, let's say just not getting together? Why be punished for what is not your fault? (Okay, in this case it could be if you're the reason parents don't want to talk to you, but you get the case)
That's fair, there are legitimate reasons for much of the complexities we deal with today. How far can that body of knowledge grow before a human can't actually understand it? Similar to maths, at what point do they advance so much that no one person, without bionic assistance, can learn it all? Consider the fact we call small pants "shorts" and current events "news"; the sophistication of our language is indeed lacking - jumping ship to a completely different language is inappropriate considering we have the ability to create whole new words and taxonomies to deal with that complexity.

Oddly enough, AI is great solution to this problem, but it is currently being gutted in favor of established institutions of power. Highlighting the actual problem - control and elitism.
> At most that's 1,790 students per year taking the class each year

Anyone in the world can take CS50 for credit via Harvard Extension [1], and if you happen to be in the Boston area you are welcome to come to campus and attend lectures, sections, office hours, etc (but they also have everything you need fully online).

Like other large classes at Harvard (Stat 110, etc), these operate just like the weed-out courses at the big state schools. Unlike the state schools the deadline to drop a course without it showing up on your transcript or affecting your GPA is really, really late in the semester. So it's not uncommon for 50+% of the kids to be gone by the final exam/project.

[1] https://cs50.harvard.edu/extension/2023/fall/
It sounds like an artificial hurdle to pass to get to the genuine article to reduce support/teaching costs.

The only difference is that this hurdle is actually helpful some of the time.
And yet the comments on the thread I saw were quite useful — many from Russian speaking people confirming that the same news was being shown in Russia, etc.
> In many agile teams

Ah, you used the A-word here. Why do you think the process you described in your article — especially this part: "Because PMs are most active at the start and end of projects - handing the steering wheel to engineers to execute and picking it back up when code is complete to deliver downstream" — is agile?
TIL carbon fiber has a shelf life
I don't see how this lines up. the shifts in the music don't correspond to the scene changes.
This is exactly why I buy everything I can off of AliExpress. The question of "will I still want this in 4-12 weeks?" really takes the impulse out of impulse buying.
1Password is probably the best kept secret when it comes to password managers. I don’t understand why not more IT professionals advocate this software.
Repairing a $25K HP Workstation from 1981 to Run Pac-Man
I hope you list "extraordinary attention to detail" on your CV!

Nice find. I'm guessing it's a bug in the font?
Orson Welles voice "Do you have a favorite kind of cardboard?"
Fine by me, turn them into homes if possible. Or would that lead to yet another devaluation now on the residential housing market as well? Do we need another bailout soon or what?

It seems to me that one big reason why companies want their employees to return from home office so badly is to secure their investments in real estate. The benefits of having leaner office spaces are in conflict with the investment made into these office spaces.

That's one issue with parking your capital into speculative assets, it ties down your freedom of action tremendously.
My last contact with the educational system as a learner was around 2009, so I missed pretty much the whole YouTube / Khan Academy revolution. It would be very interesting to see what it's like to learn today, what resources I'd find most effective.
I had to look up what a dunkelflaute is... but the last bit you said:

> i.e. dunkelflauts in winter which neither batteries or nuclear particularly help with.

doesn't make a lot of sense to me. Wikipedia defines a dunkelflaute as "a period of time in which little or no energy can be generated with wind and solar power". Isn't that precisely where you have to fall back to nuclear, battery, or fossil fuels?

Also:

> Batteries have already solved baseload for most of the planet

this runs contrary to a lot of what I've read about the topic (which doesn't mean I lot, I know -- I'm not an expert). Do you have a source I could have a look at?
>since most people agree the PS5 is an ugly monstrosity

[citation needed]

PS5 is really the only one of the two with any kind of a design identity to it. The Xbox Series is just a box.
3D graphics.
It is not just the brand, there is also the environment.

A good university will be full of smart people, student and teachers alike. You essentially learn by contact. There are also rich and influential people, who can provide you with great job opportunities.

It all goes hand in hand: the brand, teachers quality, student quality, the infrastructures,...

Worse teacher may affect the brand negatively, the smartest students may want to go elsewhere, the rich, who want to be with the smart will leave too, which will affect funding, meaning less infrastructure and be less attractive to the best teachers and researchers. It is all connected.
I wouldn't read too much into it: https://www.youtube.com/watch?v=zjdpz05u2DY
Since you can stuff a 2 feet long urn in your sleeve as you somehow fishout a ticket for the museum guard, yes. Journalism is one profession, telling gripping yarns is another.
Here in Memphis Tennessee (and perhaps more widely in the South) the following response to a request is equivalent to a hard no:

“Let me get back to you on that.”
LastPass hasn't been doing proper cryptography, so that part may be a fair bet.

If you use Django's default hasher, for example, you get more hashing rounds in the default config and they increase those periodically (the latter part that LastPass is struggling with, per the article).

https://github.com/django/django/blob/650ce967825aa192222391...
> Everywhere I have been a PM

Out of curiosity, did the P in your role stand for "product" or "project"?
When the other fills in the void of an awkward pause, it tends to be to try to further convince you to say yes, which can be really annoying. I usually just say sorry, no by default, then I can change mind after if necessary.
Not related to the post content itself, but I really like this blog’s theme. It makes me prefer reading the actual page instead of the “reader mode” from my browser.
It took me 30 minutes to do this process as well. Then it took days and weeks to find a bunch of corner cases that Bitwarden missed. At the same time it took me a few weeks to realize that I just don't like Bitwarden's UX. Their mobile app is just bad. Its slower than competitors, common actions take more button clicks, and the UI doesn't look good (it looks like it was built by programmers for programmers). Combining that altogether meant I couldn't move my family onto Bitwarden and my migration was a wasted effort.
In academia, it’s almost impossible to say “no” to a senior faculty. I’ve had situations where a coauthor requested something that was just infeasible, but pushing back against that made them not trust me with future projects because they thought I was justifying my incompetence, whereas they were the ones who wouldn’t even listen to my detailed reasoning.

This environment forces you to just give them the results that they like to see, even if the results are not scientifically accurate. It’s as if the goal is not to do science, but to publish and tell an interesting story in your papers.

You might say: “well, just ignore them and do your own thing”, but unfortunately in academia so much depends on how people like you. Without good recommendation letters, citations, and networking, you can’t really go far in your academic career. I’ve seen people who couldn’t get their tenure after several years because of this.

It makes me sad but unfortunately this is the truth I discovered only recently. Had I had known about it, I’d stick to industry jobs.

I can remind myself that almost no one will ever read academic papers in my field, but at the end of the day, I’m still struggling with this dilemma: do the right and scientific thing and ruin my future in academia, or do what my peers are doing and make senior faculty like me.
> And for the record, rumbling cave bears are mostly peaceful herbivores.

For the record, all members of the Genus Ursus belong to the Order Carnivora, which literally translates to "Meat Eaters". And that includes Ursus spelaeus, aka. the Cave Bear.

And while it most likely, like many modern bears, was an Omnivore, that "Omni" very much included small, hairless monkey-esque creatures with no natural defenses other than ridiculously small teeth and pathetic excuses for claws, if they happened to stumble into their cave.

> The concept of truth is notoriously hard for humans to grapple with.

I am not talking about the philosophical questions of what truth is as a concept, nor am I talking about the many capabilities of humans to purposefully reshape others perceptions of truth for their own ends.

I am talking about truth as the observable state of the objective reality, aka. the Universe we exist in and interact with. A meter is longer than a centimeter, and boiling water is warmer than frozen water at the same pressure, whether any given philosophy or fabrication agrees with that or not, is irrelevant.
You missed the part of where you quoted me where I said "feels like" and invented a part where I said "have empirical evidence"

Though to answer a softer form of your question which is based in my feelings, I would say through a combination of my experience writing AI's, coursework in my AI specialized computer science degree, and through reading the patch notes which often state explicitly the tunings I mentioned.
I'll add my favorite:

> don't start with "that shouldn't take much time, right?"

Unless you are a PM that is also making non-trivial code contributions, let the people who are actually getting their hands dirty on a daily basis provide you the estimate. What seems simple can be complex to implement or vice versa. Asking presumptive questions like this only insults the engineers knowledge of the system and usually they are smart enough to see such underhanded pressure tactics from a mile so it only diminishes respect for you in their eyes.

Just ask it straight: "how long do you think this will take?" You'll get plenty of time to question the estimate and the engineer would be more than happy to take you though the code/config to explain why what seemed simple isn't so, assuming you are genuinely interested in understanding the rationale.
I just updated Zotero from the AUR and, during the build process, the pdf.js dependency reported 25 vulnerabilities, of which 5 being critical. Given that we sometimes pull pdf from questionable sources/websites, should that not be a priority to fix? Or is there a standard mitigation process that I am not aware of?
I'm from a state with a long history of manufacturing and aerospace. The people who make F-35s are paid at least 75k without any qualifications and can take home much more than that if they choose to work OT. Definitely no need for low income housing for that crowd.
+1 Made the switch this quarter. It's practically the same price, incredibly easy to switch, comfortably similar if you've used lastpass before... And as I went through this process I also discovered despite breaches and insecurity, my LP account actually had some hardening issues remaining that they fixed for new signups, but failed to do so for long time customers. So fuck them. (I've since rolled many of the most important credentials btw)

1. Comb through your last pass, and delete cruft

2. Signup for 1password https://1password.com/switch/

3. use their auto import tool to pull from lastpass

4. Profit for ~3 months just for safety

5. Delete each item in last pass (who know if they do hard or soft delete?)

6. Request account deletion https://lastpass.com/delete_account.php
Time.

Password managers have a stickyness to them. Moving is hard. There are import/export functions, but I found all of them have issues.

Moving needs to be fast and seamless enough that I can move my entire family without hassle. Thats why I'm stuck.
They're a random string of text unique to each site, I wouldn't even class them as 'my' passwords, just a derirative. Password Managers are a godsend (happy 1password user).
Cattle raised in an environment suited to them have a lower carbon footprint than raising them on former rainforest pasture, and by outsourcing cattle production to Brazil, who are actively clear-cutting the Amazon for the purpose of expanding the cattle industry, we also lose our carbon sink. Young trees are nowhere as effective at taking carbon out of the air as older trees, so replanting trees where there is current pasture is losing sight of the target, because we're busy turning old-growth-forest into pasture elsewhere in the world.

https://sustainablefoodtrust.org/news-views/defras-plans-for...
It's not our responsibility to maintain their unethical business models.
There are a lot of restrictions when using multiple threads in the browser. You need to spawn workers and they can only share certain things in memory between the threads (transferable objects and SharedArrayBuffer for generic data). For everything else you need to pass messages back and forth between the workers.

Another problem is that SharedArrayBuffer was disabled by default after Spectre and in order to enable it you need to send certain headers from the server (Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy). I don't know if itch.io has support for that, but maybe.

I haven't used Godot but I'm thinking that the multithreaded models game engines are using don't convert very well to SharedArrayBuffers. It's a very crippled form if you're used to say C#.
inb4: Don't get me wrong OP, I don't think there's an issue with your article, just I do believe that "the testing theory industry" is full of bullshit and bullshitters.

_____________

That's quite a lot of fancy names for such a short concept:

Ensuring that software matches the specification.

What are even the differences between those 3?

1: Branch coverage testing

2: Control flow testing

3: Statement Coverage Testing

I'd say they are basically the same thing.

>Smoke testing

>This form of software testing evaluates the functionality of the essential or core features of a software application, verifies their expected behavior, and determines the stability of the application for subsequent testing phases. Performing this type of testing helps to avoid spending time and resources on an unstable or broken state, ensuring a more efficient use of resources.

??

seems like just yet another test, but just for the most important things in the system

why is this even relevant that this is worth mentioning it as yet another testing technique?

Sure, your tests may be expensive: e.g take 10 hours all, where core takes just 10min, but still is there a need for a name for a concept of running just limited scope of tests for the sake of faster feedback loop?