skysight-inc/HackerNews huggingface dataset:
Exactly! Prior to 2020 "infectious diseases" wouldn't even have make it to the list as explicit inclusion. Everyone would have thought it is silly to single the mundane topic out like this. It is as ridiculous now as it was back then, but serves as a perfect giveaway of their agenda. See, they bolted it on as a "fifth" to their "list of four", but couldn't be bothered to fix the numerical :)
As soon as you are out of what they care about, your support will become abysmal. And they don't care about modern desktop use case (such as they didn't have Wayland support for decades).

So if you are a Linux user - simply avoid Nvidia. They don't care about you.
I guess we're in agreement. It's terrifying because we're not making reasonable decisions to mitigate the risks.

I'm a rock climber and I've gotten into enough tricky situations on the cliffs. So long as you can take action the fear is manageable. It's when there is seemingly no viable action to take that the bad fear sets in.

Thing is, the risks I take personally as a climber aren't as big as the risk were taking collectively as a civilization by not acting on climate change, even though the risks I take go well beyond what most people would accept if they understand what they were in for.
That is fascinating. Is that true of toxins that accumulate in the body generally, or specific known classes?

It never occurred to me that blood removal would be an effective method, but there is a certain logic to it. Although it also seems like you'd have to do it an awful number of times to make a difference.
You want to have all of that toxicity--if it must exist--concentrated in a single place. Every new service shouldn't create a new namespace with its own hoard of asshats squatting usernames, and every time I join a new service I shouldn't have to jostle to get a username compatible with the ones I already have. If you use a hostname, you figure out your hostname once and then know that all subsequent services you ever use will have a single correct username.
Long time namecheap user without any autorenew problems, even with insufficient funds forcing them to retry.

You can also add funds to your account in advance, just got an email suggesting that for an upcoming renewal.
IMO the jury is still out. Twitter was always more than just a UI format, Twitter-shaped text posts with my Instagram friends doesn’t scratch the same itch.
This makes it a tiny bit more like app.net. Not in terms of control but in terms of floating the idea of paying an annual subscription fee.
> Take GrubHub and DoorDash for example. Is a delivery app that is basically a glorified basic ordering system really worth 30% of the transaction?

While I agree with the sentiment, it is worth noting that the 30% helps cover the delivery-person’s cut. Ideally, there should be a fixed cost courier charge, but that’s tangential to the point here.
I love the Fall of Civilizations podcast. Here's their episode on the Mayans: https://youtu.be/SnFaRXeep5Y
I thought that I should mention a book because it got talked a lot under Nvidia's "lucky success". The book is titled: Why Greatness Cannot Be Planned: The Myth of the Objective (https://link.springer.com/book/10.1007/978-3-319-15524-1#toc).

I don't really think Nvidia's luck is really just a luck. After all, they has the vision for CUDA, bet money on it, and succeeded. They CAN stop the effort at any point during the adventure, but they choose to continue. That's not luck, that's a vision.

BTW, the same book got picked up by some Chinese talk heads as an perfect demonstration showing the good side of capitalism, which I totally agreed. After all, if Nvidia was a Chinese company, they'll probably instead put their efforts into developing some massive-spying citizen-incriminating policewrongs-neverseening camera with funding provided by the government, thus almost guaranteed "success". I'm really glad that Nvidia is operating in a country where "making hardware so everyday people can use their computers to play games" is not something to be mocked at by it's (abusive)parents-acting government. Now, look who's paying smugglers for those A100 chips at double the price while crying? A well deserved fate on my book.

So again, "lucky success" maybe not just luck.
ANAC doesn't fuck around. And they're great with e-mailing in English. So formal though :-)

I've had a similar issue with KLM, and once ANAC is involved, it's over.
It's easy to handle 100 users. It's difficult to make it (timeline, search, and other stuff) work for 10e7 users (though Meta already do).
Well, only one person is going to get @mark, so this certainly isn't any worse for normal users than "every service forces you to get a bespoke username" as in practice you end up being mark_h.23 or something ridiculous like that.
That doesn’t sound right. It surely can’t be any worse than Instagram which works fine in the EU. I believe it hasn’t launched there yet because the lawyers haven’t cleared it.
Thanks for that. I was able to see the thread but kept getting timeouts trying to load the last 15 tweets.

Side note: I thought blue checkmark users could post tweets of 4000 chars? And if so, why did he made the deliberate decision to split it into so many chunks that it's barely readable? Legacy client support maybe?
> Being compliant within any of those frameworks does not make an organization secure.

I've gotten into breathless arguments with "cyber experts" who really don't understand this simple point. I've met people in industry who literally think that "filling out the paperwork and having a risk committee accept risks or prioritize a schedule to get into compliance" equals "our systems are now secure".

It's a massive self-serving industry incentivized to enrich itself and not secure systems. If they were successful at designing, deploying, and maintaining secure systems, there wouldn't be an industry.
I blows my mind how people who make any random thing see it as something worthy of a subscription. Really $8/month there have been free products doing this since the early 90s.
The argument that a law "would help workers more than help them" is a political argument not a legal argument. The legislature has the right to pass dumb laws so long as those laws are within their constitutional powers and do not infringe or abridge any constitutional rights. Judges have no business legislating on political questions.

I take no position on whether or not the law is actually dumb but the delivery apps need to find a better legal argument if they want to argue this law is unconstitutional. This argument that "the law is unconstitutional because it is dumb" is basically just asking judges to legislate from the bench which is exactly what everybody who pays attention to Supreme Court confirmation hearings knows judges aren't supposed to do.
> They swore up and down in Paris that I’d be compensated for the hotel stay, but I couldn’t get them to commit in writing

IMO that's a kind of life-skill that I wish was more often taught and attempted, even if actual success is rare:

A: "I see what you mean, yes, the contract does say we could royally screw you over, but trust me, we would NEVER do something like that to you, valued customer and/or business-partner."

B: "Great! Sounds like we're in total agreement about what we each expect. Just go ahead and tack on a little paragraph saying that to this document, since this process is all about ensuring mutual understanding."

A: "Oh, uh... gee, I dunno..."
> All three companies sued the city, maintaining that the law would hurt delivery workers more than help them.

Assuming that is really the premise of the lawsuit, could it be thrown out because the drivers aren't employees, and therefore the companies aren't the ones being harmed? Can they sue on the driver's behalf when the drivers are contractors?
Oh. Found it. It's because I wasn't using strlen and had been passing over the length of the buffer instead of the length of the string. Only my code had the off by 1.
Welcome to the government.
I've been using Tailwind since its release. I think it is fantastic and I'm so grateful for it. We're also happy customers of TailwindUI. I just launched a new product and we could not have gotten to market as quickly without Tailwind.
Not what I meant at all. You're deciding to interpret things as bad faith.
Uhhh... what do you think business people do?
You really can, and the ways to do it are "theorized" by the OP's blog post.

https://webapps.stackexchange.com/a/170880

tl;dr

For this answer, let's consider an example where:

You want to subscribe to https://lemmy.ml/c/cryptography
Your local instance is https://lemmy.ca

Either search in lemmy.ml for https://lemmy.ml/c/cryptography or
search in lemmy.ml for !cryptography@lemmy.ml or
go to https://lemmy.ca/c/cryptography@lemmy.ml
This is inevitable , happens with all domains.
For the past 20 years there has been shortage of developers but now after various
building tools, almost everyone running to tech , chat GPT coming into play...there'll be soon excessive developers + they will be more efficient , thus demand supply gap would decrease and wages would ultimately go down.
Sure. "We think that info may put someone on our security team at risk, can you please take it down?"
I read the Wikipedia plot summary and have been putting it off.
This is actually really messy.

It’s unclear to me who is the registrant in this scenario.

If blue sky then you don’t own anything and there is no portability.

If you are the registrant that’s great but namecheap is going to need contact information that’s verifiable which may turn people off who would like a bit more separation on their social profiles. I also wonder does blue sky see that registrant data? Can’t say I like that very much.
I am not a fan of ORMs personally, so haven’t tried lots of them. But even in Python, SQLAlchemy is way better than Django ORM.

Django ORM is tolerable on small projects, and quickly gets in the way on anything a bit more complicated.
I say something similar to my friends and colleagues all the time regarding my “professional” software projects. It takes 20% of the time to do 80% of the work. But that last 20% of the work takes 80% of the time.

Essentially the core functionality doesn’t take very long to build out. But the final polishing, details, edge cases, and bug fixes soak up a huge amount of time.
Not the context I was replying to.
The fact that North America and Europe enjoy the best climate is predicated on the Gulf Stream and the Jet Stream. Given that climate change may destabilize both, both Europe and North America may experience the effects from climate change very quickly.
Yeah, I'd like to know, too. I've done laravel + TDD for almost a decade and I can't think of anything you can't test or mock. Emails, Queues, Guzzle requests, AWS SDK, events, grammers, sessions, etc.. You name it, I've probably done extreme TDD to it.
Cool name and nice looking site! Looking forward for the signup to recover.
Two at symbols still seems awkward to me, and I haven't got a chance to try to adapt to BlueSky yet. So that's a no from me, as a developer.
I don't think that gives them all the avenues to express things that may be important.
My argument is that they're lower than the floor, which makes using them to try to detect the floor dangerous.
did you look at the repo, there are several binaries that don't require anything more than download and install.
I was hoping for a more nuanced take from you, @tptacek. However, this deserves more thought than “no, no to all of this.”

Speaking from experience

1.) At their worst - many industry-prescribed standards act to move liability from the poor Visa of the world onto smaller businesses. For example, being visa in this scenario - Why should I develop a better solution to credit card/identity theft? We have PCI!! I can even help sell training out of the goodness of my heart! This, of course, stagnates the industry, both through lost leaders thinking this piece of paper will protect them or to the parasitic cottage industries that capitalize on the fact nobody knows better and takes what could have been an investment in solving fundamental security problems. Ultimately accountability goes back to Visa / SWIFT and whatever body that cba’d on fixing the problem they created.

HOWEVER

2.) At their best many of these standards invite operational rigor required when you want to move past the “3 people in a basement” stages of your startup and have to make grown-up decisions if someone is hit by a train. Furthermore, security is often considered a cost center; attaining specific certifications can be one of the few indirect ways to attribute as a measurable product differentiator in whatever space you’re in.

The author's argument that these frameworks are a decent place to start to work on the comprehensive “cyber security” strategy is excellent for the neophyte looking to understand better one of the many elements that go into running a security program, but it’s far from comprehensive. It’s sad to think, but sometimes these compliance-driven certifications often become one of the few forcing functions you have as a security engineer/leader to get someone to do something that closely resembles the right thing. I’m sure many roll their eyes reading this comment, but - I’ve had countless interactions with engineers who could give less of a shit if their product is insecure just as long as they can ship it on time and be offline by 4, and my only option is to get the legal department to chase them because we will fail an audit if they don’t change course.

Either way. I’d recommend anyone reading the article to have an open mind to understanding many of these frameworks, what they are used for, and how you might use them effectively until we figure out something better. Don’t just cargo cult “standards r bad”, “Jira is dumb”. Try to ask the broader question of why they are needed in the first place.
Not as good as chatgpt 4 unfortunately, and they do have a moat. You could argue the most will fall in time but I’m not seeing chatgpt4 equivalents at the moment
NIST CSF = The encyclopedia which breaks security down into as many areas/steps/sections as possible. If you are planning a 500-person security department, this is how you give them all something to do. The idea is to accomplish the task with manpower rather than elegance. CSF itself is mostly just a pointer to NIST 800-53. For truly large-scale operations it can be an ok fit, but for most organizations it is overkill that your cyber-insurance vendor will still expect you to do. Otherwise, best used as a reference not a guide.

ISO 27001 = Not super familiar with this one.

COBIT = The management/process focused version of NIST CSF. Great if you have an executive suite CTO, CISO, CRiskO, CPrivacyO, and want to coordinate their efforts in a program that divides responsibilities among them and associated committees. Includes maturity modeling, which gives it a +1, but it is distant from anything technology related. Instead, it is all about which committees should be formed to decide on risk management strategies etc...

PCI-DSS = You'll do this one because VISA makes you do it. Much more actionable than NIST or COBIT, but it depends on the third-party auditor who is issuing your attestation of compliance. "Your label maker has it's default password?" = audit finding.

CIS18 Controls = The most actionable/lightweight framework now that they have incorporated maturity levels (aka implementation groups). Not as thorough as NIST or COBIT. Well implemented, CIS18 is enough for most organizations provided they do not have a specific security standard or requirement in their industry.
What if he moves Twitter to Texas?
He could say you told him you had a gun, and brandished what looked like a gun. No reason to admit that it's really about the camera.
I don't think so. For example, if there is info on twitter that puts a government employee at risk, I think it's appropriate for someone to point that out to twitter.
I am sure there's no problem signing off on stuff that makes them less likely to attract antitrust scrutiny.
I run a similar setup: unprivileged LXC for hosting web applications. It works great, and has been way more stable and reliable than Docker.

I had planned to migrate to LXD now that current Debian has a package for it, but now ... nah, unfortunately. I was really looking forward to the live migration feature.
Even that is false. Companies that follow these frameworks are performing security, at the expensive actually building security.
So basically tame compared to ShitTok?
Strongly agree!

Unfortunately, the system is WAI in the US.
Threads is federating with Mastodon, which is good for both of them.
Freexian offers a support contract for Debian ELTS.
Before a child sets foot in kindergarten many inputs have already been happened. Did their mother abuse alcohol or drugs during the pregnancy? Does their household have domestic violence? Did their parents read to them on a regular basis? Did their parents teach them how to interact with other kids? Were their parents able to pass along the English language?

A school is not just faculty and a building. While public schools will enroll any resident children their parents must be able to afford the area. This has a high correlation with the average quality of students at the time of enrollment. The selection effect is the most powerful force in educational institutions. Parental involvement can vary from helicopter parents down to parent teacher conferences that are a ghost town because the crowd of parents is stuck at their second job or they decided they have better things to do.

Transforming an under-performing school district or neighborhood takes many years and is far beyond the capability of a single person. Calling the police on drug dealers carries personal risk.
All this means is that the legal costs are less than their expected loss if the legislation goes into effect.
The Bluesky infra would not be able to handle scale without invite-only clownshow. Meta can open the floodgates without breaking a sweat.
Agree with author and the quote...after trying it, it really was like drinking the kool aid
Running an LLM locally and paying for access to OpenAI are two separate concerns.

But to address both: is it very relevant what LLM you use right now? Local or hosted, openAI or other?

It seems like the interface has converged around chat-based prompts.

New ideas for tuning or improving the efficiency of foundational models are published almost every week.

If one wants to build a product on top of of generative AI, why not simply start with what’s free or works with one’s dev environment?

Presumably, the interaction with or API to text-based gen AI will be very similar no matter what engine is best for your use case at any given time.

This would imply these backends will be swappable, the way web services are that copy AWS S3 APIs.

So, to return to the point, can’t people just build their product with openAI or other and plan to move away based on the cost and fit for their circumstances?

Couldn’t someone say prototype the entire product on some lower-quality LLM and occasionally pass requests to GPT4 to validate behavior?

It seems far-fetched to believe this tech can be constrained by legislation.

OpenAI can lobby all they want, it won’t necessarily buy them anything. Look what happened with FTX.

Since LLMs can be run locally and the engines be black boxes to the user, how could a legislative act really prevent them from being everywhere—-especially given the public utility.
Pretty cool idea
Absolutely.

I mean, some countries are worse than others. I have yet to come home from Mexico without my locks being cut off and bag pillaged, but other international flights have been fine.

Other who place GPS trackers on their luggage have watched it leave the airport and go to a random persons house.

Theft of checked in bags is common, and rummaging through bags is expected.
The arsenic is no longer true:

"since Oct. 15, 2009, no company is allowed to manufacture, distribute, ship or sell any products that leach arsenic in concentrations greater than 5 parts per billion (ppb)" [1]

And bacteria growth is solved by following the manufacturer's directions. For example, Brita filters in use need to be kept in the fridge and changed every 2 or 3 months.

[1] https://www.wqpmag.com/water-testing/testing-services/articl...
In the end, everything is written in asm.
Improve your C code with this one neat trick!

#define fuck if
#define shit else
#define ass return
MS killed my Hotmail account randomly, could not get it reactivated. Probably because I never logged in as well. Unclear...

It was tied to my leftover MSDN account from when I worked at MS, so at that point it was no more free legal MS downloads for me :(
If you can state that with such confidence, can you also elaborate as to what they’re caused by and how their severity is unrelated to elevated temperatures?
I travel internationally on about 3 R/T flights a year to Europe and Asia (mostly Delta and United alliances). I fly in the US about 12 flights a year (Delta and Southwest). I always check a bag.

My bag was delayed by a day one time in 2018 when Thai Airways hustled me to a connection through BKK, but my luggage wasn’t so lucky. That’s the only time I’ve had a problem. (knock wood)

Of course, my evidence is anecdotal. But so is that of folks who are outraged (outraged!) by their lost luggage.

I reserve my outrage for the people who prolong the boarding process finding bin space for their duffel bag, roller bag, and backpack.
That made me think of one of my favorite scenes from Labyrinth with the hear no, speak no knockers--"no good, can't hear you!"
I believe you should create a separate Threads account even though it uses your Instagram account. It's like OAuth2 single sign-on, but technically you still sign up for a different service.
Clockwise gets the closest I've seen to the travel time piece specifically.
Additional color commentary:

27001 is Euro-SOC2. Technically, 27001 is a certification, and SOC2 is just an attestation --- there is an external ground truth that 27001 is matching security programs to, where SOC2 is just validating internal consistency. But the subject matter is the same and they're generally thought of as equivalents for each other, with 27001 being the more rigorous.

Ironically, COBIT is the IT-focused equivalent of COSO --- in other words, it's the ostensibly more technical set of controls. But SOC2 keys off of COSO, and is audited by accountants, so practitioners are more likely to have experience with the fuzzier COSO controls.

PCI-DSS is an industrywide joke; it's a checklist audit performed by race-to-the-bottom consultancies, which have invariably PCI-certified all of the most egregious payment card breach shops since PCI was standardized. Ironically, as bad as PCI is, it's the controls standard that has probably had the most practical impact, because of how prescriptive it is, and how rote the audits have become. Its impact is still malign!
I would imagine a majority of hours on this were product managers doing evaluation rather than engineers writing code. Even if those PMs came from Twitter I can't imagine their insights being particularly proprietary.
> I am skeptical of the "destruction" part

you only need to look in the past to see how collectivization in communist countries have fared to see what sort of results could be expected when you confiscate wealth from people.
Uhhh... the GP was written in a kinda funny way, so it just seemed fitting to plug a reference to the movie. If you want to keep sets together, power to you. My kids have a mixture of both (sets they want to keep as is and a mountain of pieces from other sets) and... that's just fine.
Also BSIMM and SAMM

https://owaspsamm.org/blog/2020/10/29/comparing-bsimm-and-sa...
Tailwind is fantastic, changed the whole game for me.

I've built all my projects with Tailwind and I'm never going back to writing all the UI in regular CSS or SASS. CSS is still needed of course, but the 95% Tailwind + 5% CSS rule makes my life easier and happier.
Nokia and Red Hat collaborate for enhanced telecommunications solutions