skysight-inc/HackerNews huggingface dataset:
Microsoft certifies to the government that they can not protect against moderately skilled attackers via their Common Criteria certifications as seen on their security homepage [1][2]. These are the only security certifications they mention on that page (FIPS is also mentioned, but it is more of a crypto certification than a security certification). They specifically certify that they only conform to EAL1 [3][4] which only requires AVA_VAN.1 which is the ability to protect against attackers with a "Basic attack potential" [5]. The evaluation methodology required by AVA_VAN.1 can be seen on their certification report [6]. Effectively, they do a Google search for "Windows CVE" then they check that all the search results are patched. That's it. I am not joking. That is how they certify security. I am not joking. Seriously.

To be fair, Microsoft has historically certified to conform to EAL4 which requires AVA_VAN.3 which is the ability to protect against "Enhanced basic" attackers and includes a actual penetration test. However, despite decades of attempts, they have never once successfully certified any product against AVA_VAN.4 which is the ability to protect against "Moderate" attackers. They have literally never once been able to protect against "Moderate" attackers. And they have the certifications to prove that they absolutely, positively, can not.

It is the height of idiocy that anybody listens to or trusts anything that Microsoft says at all about security. The have literally certified that the height of their ability is abject incompetence and the total inability to protect against "moderately" skilled attackers. Until they can definitely prove and certify otherwise, their claims of security should be completely ignored as the useless trash that it is.

[1] https://learn.microsoft.com/en-us/windows/security/

[2] https://learn.microsoft.com/en-us/windows/security/security-...

[3] https://www.commoncriteriaportal.org/pps/

[4] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4....

[5] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.... Page 53

[6] https://www.commoncriteriaportal.org/files/epfiles/2022-21-I... Page 14
AVENS: Novel Flying Ad Hoc Network Simulator with Auto Code Generation for UAS
> customers want MSSQL

Why would they want that when PostgreSQL exists? That's like saying customers "want" Oracle databases despite the existence of this post:

https://news.ycombinator.com/item?id=18442941
You’re right, I missed the small probability of coming out ahead on a short series because losing dominates long series. Which is what the author is trying to get across to me. Thanks.
>A thought: I wonder if this also mean that large hospitals will have doctors that earn more and somehow correlated with better care in certain cases?

No, usually lower. Especially academic hospitals.

Better care because it's academic which draws the type who want to the best and are willing to forego higher pay for prestige. Also because billing matters a lot less and generally doesn't go into physician pockets at these hospitals so you can see more complexity and spend more time.

>For example, In NYC I have found better care with Beth Israel and NYU Langone for Preventative and Diagnostic Health care than private practices.

Mount Sinai and especially Langone are amongst the best academic hospitals and health systems in the US right now.
Somewhat disappointed the russian twitter anon isn't included, since they seem to have made the first replication attempt that might have panned out.
One reason for having their own consumer website is that having lots of data from actual users should be quite helpful for training. I believe they promised not to use the data from other companies that use their API?

It's also good marketing. For the people who use ChatGPT every day, they're a known quantity, unreliable as it is. Other companies need to show that they're better.

These are both similar advantages to what Google has with their search engines.
Hey, don't forget acquired companies' codebases awkwardly shoehorned into being an Azure RP.
If you have a product in a competitive market that last 10% of polish could be what sells it.
> I have credit cards with a ridiculous aggregate credit limit, but in another 2008 scenario, anyone want to take bets on how long those credit limits stay high while unemployment is on its way to 14%? I would prefer not to.

My credit card limits were reduced like 90% during the 2008 crash.
I see. So what you’re saying is that if we replace the palladium with LK-99 then cold fusion is back on?

You know, because hype.

This is, as the kids say, very bullish.
Honestly I don't understand how any company can rely on Microsoft for security, and how they can get away with blaming their customers so often.

You can literally kerberoast Azure AD by default, and that's a known to be used in the wild attack vector since 2014. In a cloud service. Today.

Spammers literally rent Azure VMs because they know that the IP range of azure is not processed by Outlooks/Exchanges email filters.

So often researchers did the right thing and disclosed everything correctly just to get Microsoft to say "oh yeah here is another RCE, but we don't give a damn. Oh, and there is no patch either."

It's just so ridiculous.

There's even unfixed RCEs of VBA from the Office 2013 days which still work, because the mentality of never touch a running software creeped into how Office is built (which is: have a literal copy of all outdated Office versions for the sake of compatibility).

And then people wonder why "Hackers" always say that Microsoft is insecure and why ISO27001 is now a google dork to find easy to hack victims.
Presumably Elon Musk bought control of the domain.
Wikipedia has a detailed description of the program
https://en.m.wikipedia.org/wiki/Japanese_nuclear_weapons_pro...

Looks like they never got sufficient quantities of U-235 to attempt a detonation.
Theoretically you already need to have a relationship with the sender today. Set an inbound fee and some people will set a high fee which catches the unwary and many legit senders simply will refuse as a matter of policy.
The context here is that the German scientists thought it likely that Germany would be completely taken over by Russia (because the Western advance has stalled).
That's not a good argument, because it proves too much [1]. You could use the same reasoning to argue against pretty much any transaction:

* Don't buy bread, because someone who knows much more about bread (the baker) would much rather sell you the bread than eat it themselves.

* Don't buy a car, because someone who's much more familiar with the car's design (the manufacturer) would much rather sell you the car than drive it themselves.

* Don't buy the book, because someone who knows its content (the author) would much rather sell you the book than put it into their own shelf.

Specialization exists in all but the most primitive of economies, so while not every loan is a good idea (obviously), many loans benefit both sides. A bank doesn't make a profit from money just sitting in accounts, that's why they loan it out to someone who can use it to make profit – like a company that wants to buy a new machine to work more efficiently. The bank could buy such a machine as well, but it wouldn't be able to use it in a profitable way.

[1] https://en.wikipedia.org/wiki/Proving_too_much
at least one
Fair enough. I don't see why he would do it otherwise but I see your point.
I guess this is my point of disagreement with the article:

> We have thus arrived at the intriguing result that wealth averaged over many systems grows at 5% per round, but wealth averaged in one system over a long time shrinks at about 5% per round.

Wealth averaged over many systems doesn’t grow by 5%. It shrinks just like the average. The EV calculation is just wrong. For any finite starting wealth between the players and the bank, there is a number of iterations where the EV turns negative.

If you say, well let the starting wealth be infinite, I say, okay? If you have infinite dollars there are a lot of tricks for making infinite more dollars. It doesn’t work in the real world.
big screen vr
can they use it to exploit us and collect more money? That's the real decider
Is your point that there are close to no African-Americans in Europe? You're probably right.

But I think kypro's point was rather about the local minorities in Europe, which are most likely not any kind of American, although many of them are of African descent (with the caveat that a sizeable proportion of those are not "blacks").
> Uh huh

Acknowledgement that it was a warcrime.

> by which standard that Imperial Japan recognized and adhered to?

Admonishment to get some damn perspective. What was done to Japan must be evaluated in the context of what Japan would have been doing to American soldiers and POWs had America been forced to invaded Japan proper. That war was non-stop war crimes from Japan. Particularly perfidy, false surrender, which would have gotten huge numbers of Japanese civilians killed in any case. Truman made the right call, for America and for Japan.
Companies like redfin already pretty much do this. They have MLS data and pull public records. All you have to do is search for an address and favorite it to receive notifications when 'status' changes.
Though, of course, as with DRM, if it becomes standard for let's say, all payment sites to require it enabled, your choice becomes "stop using the internet" or switch browsers
It feels like I died and met J. R. "Bob" Dobbs.

I love it.
It’s real, it works, the Navy has a linked patent from 2017.

The UFOs are a PSYOP.
The shadow DOM can inherit styles if you specify the styles that you want to inherit. Additionally, web components work just fine without the shadow DOM, it's optional, but for a great many custom elements you don't want them inheriting all the styles, because that can break the custom element.
> In this particular case we truncate EDNS to protect the privacy of users because we believe 1) privacy is a fundamental human right; and 2) the original sin of the Internet is that IP addresses are too closely tied to the identities of individuals and services.

Your beliefs certainly aren't reflected in how you treat users. It's been a good while since I've been able to visit any cloudflare protected site using Tor. Your broken systems keep presenting me with infinite checkboxes that do absolutely nothing.

If you want to block people who truly believe that privacy is a fundamental human right, at least have the decency to be honest. Tell Tor users that they are permanently blocked so that they don't waste their time clicking on pointless checkboxes.
Yeah it looks to me like either a replication failure or even evidence AGAINST a superconducting phase. A superconductor's resistance curve is supposed to show a sharp drop to zero at the transition temperature. If it's a dirty inhomogenous sample (e.g. specks of superconductor embedded in non-superconducting material), you get a kink where the curve descends to a non-zero background resistance. In the Southeast University data, there's a smooth curve that goes down until they get to the noise floor. There's no transition.
ChatGPT Plus even better. Uses GPT-4, so much more capable.
The fact they think this shows they have no idea what they’re talking about.

This problem was solved when apple introduced ignore unknown callers.

They could improve on it slightly by allowing iOS apps access to breakthrough if they can prove its from an app somehow (like Uber or doordash), but really even that is an optimization not really needed.

For the phantom “what about my kid who’s phone is destroyed and is calling me from a strangers phone with seconds to live” you’d get the voicemail and multiple calls anyway.

That said, in recent years I’ve noticed a precipitous drop of these kinds of spam calls, so it may no longer be that big of an issue.
Wage theft is the larger category of theft. Most goes unaddressed, but you suggest the mechanism is fine
And I’m sure I would rarely remember and it’s not a wildly rare scenario for me. I admit I’m not deluged with junk but I’m not willing to roll over and make my phone significantly less useful because of some spammers.
Given that 5.07 billion people use the web https://www.demandsage.com/internet-user-statistics/ it would be surprising if the politicians and regulators of the countries that HN users reside in are not at least some of them among those users.

As there are many regulations and court cases in the EU and the US (and I presume in other places as well) aimed at some of the richest companies in the world that have to do with browsers behavior it seems that they would have to know what a browser is.
> Over time it does not.

Yes, the article shows that almost certainly, any individual's wealth will approach 0 from repeatedly taking this gamble. However, the comments I replied to say:

> But this is purely a result of the distribution of returns from a single toss.

which I don't understand.
Why would OpenAI sell that domain?
To be fair I don't think Reflex does use openAI, that's just the code example they used.

I think its a decent example project, its easily readable and you can understand what they're doing, but I think as a general rule its better to do something without external unrelated libs. An AI image generator just seems a bit too specific of an example for something that fundamentally has nothing to do with AI.
I understand why a lot of people think this, but I don't think we can say that with confidence yet. Cold fusion "replicated successfully" multiple times in the 80s too.
Yep! Both msgspec (https://jcristharif.com/msgspec/supported-types.html#datacla...) and orjson support encoding dataclasses to JSON natively.
How does the brine help detect the RF?
Backed. Always willing to support authors selling DRM-free work.

I haven't been on Kickstarter for years. I felt kinda odd to buy an already-written book there ("your reward may not happen" warnings when I'm clearly just buying a book rather than backing a project). But I see a lot of "projects" are basically pre-sales there. Where do people go for genuine crowd-funding of bluesky projects?
Nevermind, seems that is Hartford's version. Guess i'm just not savvy on the relationship between all the involved parties hah.
Google Street View driver crashes after 100 MPH chase, police say
I'll stick to the favorite job that's "in my career" to keep with the theme I sense OP is wanting.

I did a lot of manual / hard labor in middle, high school, and college, and studied engineering.

My favorite job was about 6 years out of college where I got to combine all those. I was doing contract applied research for the private sector. Along with engineering systems and designing experiments, I was also machining, turning wrenches, taking samples, etc.

I find myself most happy when I'm running around / working with my hands at least 3 days a week and doing office / design work the other 2 (on average).
My credit union sits at 0.05% for savings. Their 4% rate only works for 12 months before it reverts to 1.5%
Such things are possible, and not even very uncommon. The human body has tissues with conductivity different in different dimensions.

If you'd like to create one yourself, take a bunch of parallel insulated wires. Conductivity will be low along the wires, and high perpendicular to them.

Or alternated high-resistivity and low-resistivity sheets. Conduction will be low parallel to the sheets, and high going through them.

Lots of things behave like that.
It's also likely to mirror Apple's approach with all-new product families, where a first generation product is released as soon as they have the core technology working but before it's at an "Apple" level of maturity and/or have a true grip on the product's raison d'être. Subsequent generations reveal the first generation to be the experimental beta/market test product it really was all along.

This was definitely the case with the iPhone, iPad and the Watch. It's arguably also true with the first generation MacBook Air.

(This definitely doesn't apply to the M1 transition as this wasn't a new product family. It was a fork of an extremely mature product, combined into another extremely mature product, resulting in a product revision which was very cool but did absolutely nothing new.)
No, it will approach zero like the individual one.

Think of it this way: If everyone's individual wealth approaches zero, why would the total go up?

Just run the following simulation in a python REPL:

import random

POPULATION = 100
INITIAL_MONEY = 1000
ROUNDS = 10000

wallets = [INITIAL_MONEY for _ in range(POPULATION)]

for iteration in range(ROUNDS):
for person in range(POPULATION):
if random.random() > 0.5:
wallets[person] = wallets[person] * 1.5
else:
wallets[person] = wallets[person] * 0.6
print(f"{sum(wallets)=}")
A clearer way to make my point might be, the LLM is always aligned to something. If you don't bring that in line with what you want, then it's aligned to noise.

Kind of like if you hired someone to do secretarial work in the same way you might be processing documents with an LLM, if you don't give them instruction about how the work needs to be performed, you shouldn't have a high confidence they'll perform it correctly.
Here is a reference but not much information about what happened nor why: https://analyticsindiamag.com/musk-buys-ai-com-from-openai/
Do you believe they would be opposed to it?
Twitter CEO, not sure that's a job I'd want, though presumably it pays well.
Fun fact: hardcore xenophobic narratives in China has been using the term Anlgo-Saxons (昂撒), in recent years.
ah you're right, I thought I saw it in their requirements, it's just in their example code. got it.
Also see Sleepcore on YouTube: https://youtube.com/playlist?list=PLQuprjzQRJPEzWCQs1D-AqOjw...
There's a third option: Just stop paying for stuff that uses this.
That's good. But it shouldn't be on there in the first place.
Wealthfront and Betterment are doing better than 4.5% on cash.
https://aur.archlinux.org/packages/brave
Just as a general comment, the website is extremely hard to read at the default zoom, mainly due to the font size but also due to the lack of contrast on the background color and text color. The code samples in particular are very hard to read due to this.
I hardly use an iPad, but take it with me for this reason.
I want to believe they will stay aligned. I tend to believe inside the form factor they are going to look for special steve pixie dust reasons to modify the spec and give non-apple consumers a lower grade experience.

The contra case is that USB-C form factor has become commodity and at this point to say "yes, you want screens but we've gone with Braille because tactile is cool" would be market share negating. I think I'm saying its a one-way door into compatibility.

For example, when they adopted the hardshell floppy they were unable to say "but only magic Apple ones"

None the less I am glad this has happened. in 4-5 years time, I might be able to get rid of all my USB-A cables, dongles, chargers and standardize on USB-C and be able to share and share alike (I know I can't right now. ThunderBird inside USB-C and high power cables are magic and have to be understood to be magic)

Next is to get the touchpad and mac keyboard changed over. They're the last two lightning devices I depend on. (and it's worth noting they never put a lightning port on the mac, despite these devices being pretty much solely designed to talk to a macbook)
This is all about risk, and the value of risk (which we seldom see or recognize, much less quantify.

In one sense there's risk in taking on debt. Risk of job loss etc. In another the lender is taking on risk - they're hoping you can repay. Part of interest is to cover inflation, part is to hedge the risk.

Many comments in this thread start with the writers attitude to risk. What if....

And there are definitely places where the strategy can turn bad. Holding stocks can be valuable (they're growing faster than the cost of money) but they can also lose value (sometimes quickly).

Real value in shares is in long-term positions (just ride out the dips) but margin borrowing can force sales inside a dip if you are over-leveraged. How much you lever depends on your appetite for risk.

In a recent exchange with a potential client I explained that I get paid up front. He normally pays 90 days. He complained that my approach meant he'd "take all the risk".

"Exactly."

I offered to requote, where I take the risk, but I warned him it would be substantially more -because I put a high value on risk-. He trusted me enough to pay up front, and his risk paid off.

It's hard to quantify risk, but it really helps to at least understand it exists, and what the risks are. "Seeing" risk takes some practice.
Sam Altman is a bit richer now, and Elon's fortune is a bit lighter.
Yeah, I ran low temp STM/BEEM systems in UHV for 4 years at JPL's MDL.

I assume you know what that means. Even today low frequency nV signals are still hard. Did you know you can do zero-bias tunneling sensing?
I believe so. Big Tech has gained a lot of enemies in governments around the world, and it doesn’t require a lot of technical knowledge to understand that WEI is a way for Google to gain more control. Whether WEI is good or not, politicians on both sides in the US would be more than willing to oppose Google.
In addition to your sibling comments, here's how they're achieving the effect:

1. JS loads from https://cdn.asahilinux.org/.h which contains a list of "blocked browser history entries". It's likely that this code will be used again for future HN posts. Interestingly, this is very generic and this code can be used by anyone to put up customised block lists based on browser history. This can be circumvented by using private browsing, disabling `mix-blend-mode` on `:visited` links, or `:visited` partitioning.

This JS code is used to automatically generate the main anchor element seen in the sibling comment.

2. According to MDN [1]:

> In addition, even for the above styles, you won't be able to change the transparency between unvisited and visited links, as you otherwise would be able to using the alpha parameter to rgb() or hsl(), or the transparent keyword.

So :visited links are not supposed to affect transparency. How did they do it, then? Using `mix-blend-mode`. The background uses `multiply` (also an anchor) is #FFF for normal visitors (transparent) while #000 for blocked visitors (opaque black). The text uses `lighten`, #000 (thus transparent) for normal visitors, while #fff (thus white text) for blocked visitors.

[1] https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...
Using the web isn't the same as knowing what the difference between a web browser and a computer OS is. Most people don't buy personal computers anymore, politicians are likely only using office PCs and their phone.
So far my $2 in GPT-3.5 hasn't been billed :(
> The worst case scenario is that there is actually nothing interesting with LK-99, and everything we've seen that suggests otherwise is experimenter bias heaped on top of experimental error.

well while we're one-upping each other I'm pretty sure the worst case scenario is some lk99 synthesizer actually creates a black hole which gobbles up the planet.
You're repeating your mistake: I didn't argue about your subjective experience, but about your more objective justification of a particular workflow.

And you've turned a constructive conversation into off-topic pizza moralizing. Don't do it

(and of course you're having an argument, just a using poor arguments)
Ask HN: Is there interest in a Helm email replacement?
I'm curious if there is interest in a replacement for thehelm.com, I personally self host an email/contacts/nextcloud server but though the Helm product looked really nice to provide a plug'n'play experience for a self hosted setup.

Are there people out there who would buy a pre-built server and/or use a subscription service to manage things like a wireguard vpn, mx backup and domain hosting?