skysight-inc/HackerNews huggingface dataset:
The '-c' is not a mitigation to this CVE. It is a mitigation to a malicious remote silently opening further ssh connections to other servers you have access to.

My parent claimed that using agent forwarding is always insecure. Judging by their response to my comments elsewhere in this discussion, they seem to be under the impression that a forwarded agent will always silently and automatically sign auth requests. And yes, if you forward an agent with a key in it that's missing the '-c' flag, it will. Ignorance of the confirmation feature is classifiable under 'you don't know what you're doing'.

The same parent has also been beating their drum of 'create keypairs on remote servers' pretty heavily in many places in this discussion. That _is_ less secure than a forwarded agent that confirms each use.

----

I do not claim anywhere that the '-c' flag prevents this CVE from being exploited. It's just that the agent I happened to be using — gpg-agent instead of ssh-agent — just happened to be immune to this CVE by doing what OpenSSH has decided to do in response to this CVE. I.e., I blindly relied on gpg-agent to be secure and it paid off here.

----

> ... the forwarding has already taken place, -c couldn't really help, right? The decision was made to allow it.

It's not a confirmation of "Do you want to forward this agent?". It's a confirmation of "Do you want to sign a request using this key?". That happens in every auth request.

So if you ssh into foo, you'd get a dialog to confirm the use of your private key for this initial ssh. This is not added security, just an extra step in the initial ssh process.

But if you try to ssh into bar from foo, then you'd get another dialog on your local machine to confirm the use of your private key for the auth request by bar. _This_ is the added security vs. malicious code on foo ssh-ing into bar as you without your knowledge.
Afaict none of those spies were caught during the first or second Red Scare
Account creation happens on your device without an internet connection. Just the encryption key is generated. Anytype does not have a central registry of users. So i think you are misinterpreting it. We have no central registry where you create an account
I find Go bizarre... 90% of the code written in it seems to consist of checking for errors and passing them around. And yet, every time I've had to interoperate with somebody's Go code, it falls apart immediately because of significant processing errors that it seems like somebody should've caught, like a null-pointer dereference, or a wrong lookup into a map, or a (de)serialization error.

_Every time_ the programmer responsible seems blissfully unaware of the possibility of said error and I need to provide a test case for them to reproduce it. Their mental model of the code they think they wrote is wrong compared to the actual code.

The culprit is usually something like an `interface{}`, granted, which people then excuse as being un-Go-like... but if all the language's supposed ease and robustness fails as soon as it encounters anything outside of its own ecosystem, then it's not worth much. All the busywork around errors starts to look like a cargo cult to make the juniors feel like they're accomplishing things when they're just glueing things together.

No other language I've seen has it so bad. Rust is particularly good in this area, and seems to view it as its own responsibility to interoperate cleanly, providing sane and powerful ways to opt-in/out of Rust's semantics at the edges. Even TypeScript makes it easy to partially or gradually type when you need to, and this seems much safer in practice to me.
Sure, but in any hard graft manual labour industry that's why you have young guns.

Anybody that stays in such an industry for 20+ years has (generally) worked smarter and not destroyed their body - they're still in the industry but moved onto machine operations, management, supervision, health and safety, etc.
Leading AI companies commit to outside testing of AI systems
It is specifically:

#15 Unit spacing

There is a space between the numerical value and unit symbol, even when the value is used in an adjectival sense, except in the case of superscript units for plane angle.
You can just use their templating library lit-html (I have in several projects now) and manage events and state yourself. It's extremely convenient and lightweight.
That's crazy. I never would've thought that either. These small facts which you can barely read in "mainstream media" are what makes the LHC absolutely fascinating and impressive.

I was always like "Yeah that's just a small beam and the magnets are to navigate it in circles". In retrospect it does make sense now why people were concerned about the collision of such beams.
Safari seems to have a caveat.
Yeah, filmmakers put extra effort I hiding a brand if it is not paying (eg. laptop stickers)
Is this also available in the US?
Tell HN: Upgrade your Metabase installation
I work in safety-critical embedded software.

I live in a log cabin in the back woods with no thermostat, no doorbell (or even locks). No smart TV. Everything is as low-tech as possible. I have seen how the sausage is made.
Yeah, it has the energy of a semi truck going at a few hundred mph but in something that is about 1nanogram of mass (about that of the average human cell).
The competitor of DO, Vultr does this IIRC, yet it is not really cheaper
>I’ve noticed that in nearly every skill tree I’ve climbed, there comes a point where you begin to notice certain nuances of skill that novices not only don’t notice, but that you cannot articulate using the commonly accepted vocabulary of the skill.

I've encountered this, and what works is re-framing it in terms they'll understand. Things that are universally understood are: time, money, and competition.

In this case, the "micro" and "milli" pitch is technical minutiae and is not what I'm referring to when I say "time". These are more effective frames:

>If we do this, it will save/cost us months/years/dollars...

>If we do this, the performance hit will knock out our competitive advantage, which we'll have to make up for it with something else, which will cost time/money...

>This thing is insufficient for our customer's needs, which will cause our customers to seek out competitors, which will cause us to lose money...

>This thing is too complex and will require additional training and is error-prone, which will cost us time and money...

In addition to those, for every decision you refute, recommend a superior alternative, and again, frame it in terms of time and money.

Now, this won't be a one-sided thing, you'll likely get into a conversation, and a lot of "why's" will try to extract that technical minutiae answer from you, which you might want to mention at some point in the exchange, but don't give it up easily, and do not emphasize it. Make sure you continue to emphasize the more convincing frames: time and money.
> JPEG XL uses the ISOBMFF container, with an option to skip the container completely and just use a raw codestream

Hey, thanks for the clarification! I was basing my info on Wikipedia (my bad), ISO BMFF page doesn't mention JXL at all, and even JPEG XL page has only small print in infobox saying that its "based on" ISO BMFF but the main article text doesn't mention that at all.

> But for JPEG XL this is not needed since JPEG XL already does have native support for all of these things — it was designed to be a still image codec after all

I suppose that is bit the thing grand-parent comment was complaining about, format not designed for general-purpose containers but rather as an standalone thing. I suppose it could be fun thought experiment to imagine what JXL would look like if it were specifically designed to be used in HEIF.

Of course it is well understandable that making tailored purpose-built format ends up better in many ways vs trying to fit into some existing generic thing.

> It would be possible to define a JPEG XL payload for the HEIF container but it would not really bring anything except a few hundred bytes of extra header overhead and possibly some risk of patent infringement since the IP situation of HEIF is not super clear (Nokia claims it has relevant patents on it, and those are not expired yet).

I suppose JXL-in-HEIF would allow some image management tools to have common code path for handling JXL and HEIC/AVIF files, grabbing metadata etc, and possibly would not need any specific JXL support. But that is probably not a practical concern in reality.
Hey I was referring to accepting payments online on my website. So this is the payment processing fees I was referring to
Were those shootings by immigrants?
Full disclosure, I work for Stripe. The question you want to ask is why are these alternatives cheaper than Stripe? What is the tradeoff.
I’m a big fan of this approach. Even funded (small donation) one study that was started as a single person studying self, then he replicated on relatives, then online community, and then decided to get a defendable study done and raised funds from the community. It’s truly amazing we can do this. We don’t need to wait for some bureaucrat to approve a study or a donor to give to feel-good cause. It’s like a direct democracy of science funding :)
Refuting the points in (a) and (b) still concedes that it was made private. Care to actually mention _why_ it was made private?
I can't believe anyone would buy cloud encumbered IoT or many of the things people do today in modern society where they pick convenience and/or instant gratification over all else

Amazon and other Tech companies are Huge because they provide people what they desire instantly with no friction.

Why setup a HA instance and learn to manage things yourself when you can just outsource it
Essentially everyone my age and down? I'm a late millennial.

If the number in your name is your birth year I'm not too surprised, but don't assume you can project from your own experience onto others 1:1.
Russia constantly shares footage of their Ka-52 helicopters striking land vehicles, so clearly air vehicles are still able to operate in important areas.
https://archive.is/yd60r
Slacks API uses straight nanoseconds for the IDs of their messages which I always found very curious but figured they must have some sort of way on the backend of resolving collisions.
> It's just HTML and CSS.

It's not, and hasn't been for a long time. It's its own DSL with unexpected constraints on what you can use with it.

`<some-component
attribute="string only"
?boolean=${boolean}
.property=${any_js_variable}
@event_name=${callback_function}>
none of this is "just html"
</some-component>
`
Wanna tell us more...?
I wonder if an amateur hydrography could be accessible to people who spend a lot of time on the water? I'm a sailor and I've flirted with the idea of sending down off-the-shelf camera drones to shipwrecks that aren't regularly dived for example, I wonder if sonar imaging is something that's DIYable? I bet even just recording regular depth measurements as you sail along might be useful if enough people were doing it.
Show HN: Hntop – Get top Hacker News posts in terminal or by email
Reheating food and defrosting things are much faster in a microwave.
Sp, 2 wrongs make a right? From what I remember, immigration is federal jurisdiction and not state. States have no standing in enforcing immigration laws and the supreme court judgement agrees with that viewpoint.

And you are talking about the same state that asked the rangers to push people into the Rio and not to give water to the immigrants? At some point, you would think those are your fellow people.

Preventing laws from being humane is the real tragedy.
Probably not the best comparison, as a carpenter or craftsmen can't tell a LLM something to build X out of wood and have it come out mostly OK (yet?). Anyone can tell ChatGPT to write some code to do X, not just expert programmers. It may not be perfect, but it's only going to get better, no?
Thank you that is quite useful.

Three is confusing to me. When somebody make a Mona Lisa with a mustache, they've used the entirety. It's how much they modified that's important? Whether it can be mistaken for the original.

Nobody is going to mistake an AI-ingested corpus for the original. It seems quite debatable.
And - tangential to this topic but maybe of interest to folks here - their stack is heavily Haskell-based.

https://juspay.in/tech
You can't create a black hole in LHC. Although sometimes when I read social media I wish they could.
Ask HN: What Is the MRSK of Databases?
MRSK is an opinionated deployment tool for web apps that takes departure from cluster orchestrators like k8s but retains all the goodness of containers.

There's one such thing dokku as well. Is there anything such just for databases?

I'd be looking for Postgres, MySQL at the minimum but ElasticSearch/Redis would be good too.
But is this really the point of the article? The article argues that it is difficult to identify expertise. However, the situation you describe is one where (if I read you correctly) not your expertise was questioned but your recommendation. If there wasn’t any tangible difference between the CTO’s and your suggested course of action on a metric that he as a customer cared about, then maybe his proposal was indeed the better one? And yes, probably he didn’t care about the exact latencies in the system, but he would probably care about customer retention, system availability, etc.?
If the government has to step in and fix your industry, you have failed.

I'm fine with an alternative that's also free. No need to pay me when I use the service.

Should I be feeling sorry for the poor banks that were too greedy to come up with this new payment solution? I'll try.
Helium leaks are a nightmare. During my PhD I worked with a self-built dilution cryostat that would often have leaks in the custom-built Indium seals. To find the leaks you'd have to pump the cryostat to high vacuum, hook up a portable mass spectrometer tuned to Helium to the pump circuit and then spray different parts of the cryostat with Helium from a regular gas canister. The He would then get sucked in through the leak and show up on the mass spectrometer, which was coupled to a loudspeaker so it would cause a sound whose pitch increased with the measured He density. Once you found the leak you had to vent the entire system, remove the faulty seal and replace it with a new one. All seals were handmade, i.e. you took a small filament of Indium, placed it between the flange and the housing (after carefully cleaning everything with Acetone) and carefully screwed it shut, turning each screw only a tiny bit at each turn and going around all the screws until you could see the Indium squeeze out of the edges.

Even worse, some leaks would only show up when the system got cooled down to liquid Helium temperature. When that happened you were out of luck as you can't cool the system down to 4K before spraying it with Helium, so you had to just guess where the leak might be and replace all seals in that area until you found the right one. Going even deeper in temperature would eventually turn the He4 suprafluid, which means that it loses all internal friction. In that state it would squeeze through even the tiniest molecular cracks, so again if that happened you just had to redo all the seals and hope they would hold.
It is never RICO damn it!
> usually the filename and an image preview are the only pieces of information you get about an image no matter where you are

that's obviously false, it entirely depends on "where you are"

> ignorant of the literal entire world not doing this

The entire world is ignorant enough to not know that png is lossless

Also, don't hide behind the entire world, this conversation is about you "i don't look at dialogs before i download, save, or pick a file from a directory listing"

> fail to understand how windows explorer is not relevant when you can't just set the image viewer for save/open dialogs on windows, that's just not a thing that's possible to do

(by the way, it'd be entierly possible to add metadata even in Windows Explorer when this https://github.com/saschanaz/jxl-winthumb/issues/26 is added)

but you're not forced to just the save/open dialogs of the default file manager. You can even use a more convenient workflow of navigating in your file manager and making the open dialog switch there, and within your file manager you would have more info vs WinExplorer
The "save" dialog is worse, so that would require implementation of the feature mentioned above

> when you see .png you know that it's always lossless.

that's also obviously false, lossless is a feature of the workflow (your note conveys some familiarity with this simple fact), not just the file format, and since you don't know how much loss there was before you get to download the final PNG, you can't say that it's lossless
Yes, that's a useful heuristic, but then it's just that, not "always"

Likewise
> and even then, do i want to know the quality level of an image only after saving it manually? also no

For the same reason, you actually don't know the quality level of an image for any format

> it's not hard to understand how png will stay relevant for at least this reason

it't not hard to understand, yet you don't. PNG will stay relevant simply because widespread formats are sticky and it takes a while to switch even to a strictly superior alternative like JXL
No we can not, mainly because there was no due process on that at all. No Corroboration, no investigation before taking action.

One driver, made one accusation, and bam instant termination of the account. I can not support that as being the "correct action". Far too much room for abuse in such a system

in this case the person had to submit evidence of their innocence to amazon by way of other Camera's. what if no evidence had existed to refute the drivers claim? I will never a support a "Guilty until proven innocent" standard for anything
You have never seen a comment that helpfully explains that getUsername() returns a string with the username of the user that the method is invoked on?
A Next.js app, powered by OpenAI GPT, helps you make money
Nothing that advanced I’m afraid - I eyeballed layering different colors until it looked right.
The Fed has been using IBM MQ for connectivity for over 20 years for their outward facing services such as Fedwire and National Net Settlement.
You are rude enough that I'm tempted to say "OK Boomer" because you clearly are a different generation with no insight into mine.
> For example one could easily do the coin toss and write down the actual 1s and 0s coming out of the tosses

This is a really common teaching activity for the topic.

It's not that maths is 'never an experiment', but that people make uninformed assumptions about what maths education involves.
You attach for example a PDF file with the invoice, including bank account number etc. The person receiving the invoice logs into his or her online bank and pays it.

Since decent online banks will let you save the details of recipients, in practice it is very smooth and uncomplicated.

You could also receive and send invoices by fax, and there's nothing wrong with that.
https://archive.is/uH7yy
Vendors yes you're right but what about hackers? It'll be absolutely amazing for criminals and enemies of all kind. Imagine the next war in a country where everyone has a smarthome. It'd be a widespread humanitarian crisis within hours.
Ask HN: Clients of Merge.dev, why tho?
So like, I can't wrap my head around what makes any company pay $65/integration/mo, or $39,000 per year for 50 integrations. So I'm asking, users of Merge.dev, what made you choose to pay that pricing when OSS products that are just as good exist?
Sibelius crashed.
I love their high value content about dev ops, I have learned most of what I know in this field tinkering with a VPS with their great tutorials on how to set up stuff.
Sometimes it's not a love letter, sometimes it is a note saying "yeah, I don't like this anymore than you do, let's just get this over with so we can go take a coffee break and come back to something more interesting".

Code works. Not all work is fun and beautiful, some work is not even worth doing. But making something work because it needs to work is also worth doing.
I'm confused by this insistence on visual programming. Why not teach students javascript and SQL?
They can be revoked though.
> My body is very good at incorporating the substances that it finds useful and ignoring (or killing) the ones that it doesn't

What are you basing this off of? From my perspective, the body is decidedly not good at ignoring substances. There are thousands of poisonous or cancerous chemicals. Things like mercury or lead build up in the body to the point of causing severe harm. Anything that can be made small enough will enter your body, and the body was only “designed” to tolerate a narrow band of substances that are encountered in the natural world.
> Unfortunately as a customer you don't have the level of protection with these services a CC or a specialised top up "virtual" debit card has.

Generally, you'd have to have your bank account hacked to have a reason to reverse a charge on these types of systems. It happens, but very, very rarely and the banks have a lot of reasons to make sure it doesn't happen. That or you gave money to a scammer and that's your own fault (but they'll still help you).

This is why the fees are much, much lower. Often these systems even verify that you actually have the money and can transfer the amount to your business bank account on the same day. You can't do that with credit cards.
> Idealized deterministic computing systems are the only thing that can be Turing complete

That’s not true. My computer is for all practical purposes Turing complete - it’s tape is not the RAM, but due to side effecting, being connected to the internet, the whole universe. So while the universe itself is finite, nothing material can be mathematically infinite, Turing completeness fails “lazily”. Unless you hit the limits, it is as good as infinite.

As for the current topic, prompting problems are after a while just memoization to some limit with some strange encoding.
I've seen comments that basically amount to "here we set the variable to 5". Comments also come with a maintenance burden, it's easy to forget to update them when the code changes.
I've seen people just add butter to ramen as well for the same effect.
Or the classic result of updating the code but not updating the comment:

//Returns the user's full name
return user.email;
So it seems that a concentration of microplastics that's 50 million times higher than a toddler would get still leaves 20% of cells alive? To me this implies that normal exposure levels to microplastics are likely completely harmless.
Other answers are good but keep in mind that other brands can be pretty expensive. If you are B2B but most of your business is using a credit card, Visa and Mastercard business card and government purchase card transactions are more costly than American Express.

I don't think Stripe loses any money on a transaction. All interchange rates are less than 2.99%, but some are very close. For very low volume/low ticket price, stripe is a pretty good deal. But if high volume, there's bound to be a better option that pays off considerably the sooner you implement it.

Now, if you can get most of your customers using debit cards or ACH-type transactions, you can really achieve a low cost if you use a processor with interchange-based pricing.

Why support American Express? Their members tend to be better customers in my experience, and they appreciate that you support their preference.
Got it, thanks. I've used ElephantSQL as well and I've been happy with them.
I don’t think they had famines around 1986. Long before that - yes.
They will fill the void with gossip.
Where do you find the data saying that semi manufacturing is low margin?