skysight-inc/HackerNews huggingface dataset:
What are those very small creatures called that can live in extreme temperatures? I read about them here some years ago.
Cloud cover reflects infrared, which is why it causes warming.
If that is training data, then that is super creepy. If it isn't training data, then it is still super creepy.
Not sure how many people want to rearchitect their entire ML architecture to use ARM
> The precise improvement in scoring is undoubtedly present in the clinical trial paper, but isn't relevant to a FDA press release about their approval of the drug.

Exactly. If it isn’t harmful, it doesn’t have to be very helpful — the effect can be small and significant.
If there is no such law in Texas, then surely detaining random people who are not white enough and putting them in jail would be a significant topic of discussion rather than an offhand comment on HN. 40% of Texas are Hispanic — a demographic that would be under the most suspicion. That is a lot of people in jail for no reason and without any legal reasons. The whole state would probably get bankrupt after a few lawsuits by those unfairly arrested citizens.
Just in time for ever larger LLMs
> It says “pay package” which seems to fit pay + benefits.

It seems at best like it skirts the line of "technically not incorrect" for questionable reasons; compensation packages are not an uncommon topic of conversation here or in the tech industry generally and I've never once heard someone include the cost of benefits in their TC. Certainly if an employer quoted me a compensation package of $x and then revealed that 1/3rd of it was the cost of benefits I'd be quite livid.
I’d worry about the chlorine in the soil first.
> Ever since Google dropped WEI into our lives, I feel like they should not be allowed to be a part of any security efforts in any standards body or ecosystem. How long until carriers try to limit devices that don't support Google Play or Apple remote attestation of some kind?

Wait, so no Google or Apple employees involved in any standards body security efforts. What about TPM? Better ban employees from Intel, AMD, Qualcomm, Microsoft...who's left?

I mean, that's a take, but it seems like really the take away is that we should be skeptical of company motivations and security issues in standards bodies should be dealt with transparently, which all seems like a good take?
I see what you did there, hasttag-til lmao
The WEI discourse is just getting comical. it may be bad for the open internet, or for the browser ecosystem. but it's not a security flaw.

to say you don't trust google to be part of any security efforts because they tried to put security in a place you don't want it is silly. you're arguing the slippery slope fallacy here, there's no reason to think that carriers would even want any sort of device attestation, or be legally allowed to do that under the terms of their spectrum licenses.
I wouldn’t say a “no”, just a failed replication. Though it’s not encouraging
Pipedream probably
Have you ever run an open resource with significant traffic before? People are absolutely abusive with their use of public websites and APIs. “This is why we can’t have nice things” is as relevant as ever.

Cloudflare provides a vital service that solves a real problem that breaks non-pragmatists brains.
Thanks for your suggestion. There are a lot of things I don't know, but this subject is somewhat the exception to that. The US has made no nuclear threats, on the contrary, it has done everything to remind the Kremlin, which was and is threatening all kinds of countries with nuclear blackmail, that doing so is off limits.

I will assume you were unknowingly repeating Kremlin propaganda. Please don't.
Is server hardware vastly more powerful? If you use a hashing algorithm that isn't easily parallel, then you're dedicating a single CPU core for that exercise. Now a server may have more cores, but they are often slower per-core than a client machine. And dedicating server resources has a cost. You'd slow a brute force attack to a relative crawl, especially if the target has a large volume of pre-defined work and answers.

PBKDF2, as an example on 100k iterations can easily pin a CPU core for a few seconds. This is part of why I always have my authentication services separate from my applications, it reduces the DDoS vector. Now, you can shift work to the client as kind of an inverse-ddos rate limiter.

Combine that with a websocket connection, where the browser is sending user events like mouse movement, touch, scroll, focus/blur and input/paste... the two, combined with event timing analysis can give you a pretty good guess if something is a real user. And if it isn't, definitely slowing down bots.
2xx: Request succeeded

4xx: You screwed up

5xx: I screwed up

Easy!

More important, this is generally expected when calling any kind of API over HTTP.

Returning a 200 in an error situation makes it very difficult to diagnose errors. For example, the F12 debugging pane in my browser color-codes errors responses. Fiddler does the same thing too.

More important: Languages / libraries have built-in mechanisms for handling these errors, which make error situations easier to handle (or not handle.) For example, some C# libraries will always throw an exception on a 4xx or 5xx response. If your oddball API returns a 200 in an error situation, it breaks normal error handling patterns. (And could result in making situations where "success": false much harder to track down.)

And finally: Because error situations are unusual, they often aren't encountered in the normal day-to-day debugging of your APIs consumers. As a result, your oddball API's failure situation is probably untested in whoever is calling your API. When your API fails (because it will at some point,) there's a high chance your consumer won't check the success flag and parse the response as if it's successful. (Again, because you're not following normal HTTP semantics.) This will trigger unpredictable failures in your consumers.
No, it's not a yes. And it could easily stay that way.
Why? The regress is infinite, it's zero information. A malicious party can anticipate any public-information rational for dismissing their actions and pretend to be whatever flavor of fool you might accept.

"Now, a clever man would put the poison into his own goblet, because he would know that only a great fool would reach for what he was given. I am not a great fool, so I can clearly not choose the wine in front of you. But you must have known I was not a great fool, you would have counted on it, so I can clearly not choose the wine in front of me. ... Because iocane comes from Australia, as everyone knows, and Australia is entirely peopled with criminals, and criminals are used to having people not trust them, as you are not trusted by me, so I can clearly not choose the wine in front of you."
I weighed 4 sunflower seeds and got 170mg.
I have been to Deadhorse AK, it is a pretty cool oil rig town probably producing billions dollars worth of oil each year, more than many US towns. So Please dont compare it with rural areas.

Deadhorse also has a fully functioning commercial airport with Alaska Air flights that are "free" for the workers there.
> gold standard

Was an objectively awful system. The 19th century economy was on a permanent boom and bust cycle alternating between severe inflation and deflation. 2009, let alone what has happened over the last few years would've been very mild by gold standard standards.

> I feel like you are at an inflection point of understanding

It's funny that the edgy people who are so excited about the gold standard/bitcoin/deflation are so clueless about economic history.
Your numbers are way off. Mexico has a slightly lower GDP per capita ($10k) than China ($12k) as per 2021 according to the world bank [1]. Mexico has a median household income of $3.5K compared to China's $4.8K [2]. Mexico just fell behind China in both measures a couple of years ago.

The reason that Americans see Mexico as poor is that much of Mexico's wealth and higher standing of living is away from the border that Americans are more likely to visit. So we go by what we see in Tijuana and never make it to Mexico City. Its like if someone evaluated the USA based on Louisiana, Arkansas, Mississippi, and Alabama, they might have a wrong impression of the rest of the country also.

[1] https://datacommons.org/place/country/MEX/?utm_medium=explor...

[2] https://www.ceicdata.com/en/indicator/mexico/annual-househol...
Unfortunately there is good reason to think that memorability and low entropy (against a sufficiently advanced sequence generator) are highly related.
The working-from-home debate gets old
> trying to say that each rewards the already rich, which is true

However deflationary currencies reward them significantly more than inflationary ones.
Here's a thread on how bitcoin core generates entropy https://twitter.com/raw_avocado/status/1445024873382809604
"For example, bubbles of air in glacial ice trap tiny samples of Earth’s atmosphere, giving scientists a history of greenhouse gases that stretches back more than 800,000 years. The chemical make-up of the ice provides clues to the average global temperature." [1]

Is NASA incorrect about this?

This XKCD visualizes the historic rates of temperature change in a pretty compelling way: https://xkcd.com/1732/

> I cannot imagine what a pole reversal would look like today. The truly scary thing is contemplating just how many things depend on, or assume polar north is where it is today.

I would ask in response - do magnetic poles impact climate change? (I presume you are talking about the magnetic polar north & south).

According to NASA the magnetic poles have essentially no impact on climate change: "Some people have claimed that variations in Earth’s magnetic field are contributing to current global warming and can cause catastrophic climate change. However, the science doesn’t support that argument. In this blog, we’ll examine a number of proposed hypotheses regarding the effects of changes in Earth’s magnetic field on climate. We’ll also discuss physics-based reasons why changes in the magnetic field can’t impact climate." [2]

What other impacts do the magnetic poles have?

It is very interesting to me that the magnetic poles move by "34 miles (55 kilometers) per year" [2]. That is a pretty reasonably steady and fast rate of change. Seems like navigation equipment and anything else that relies on polar north should already be baking this in. After a decade, it's 340 miles of movement.

[1] https://earthobservatory.nasa.gov/features/GlobalWarming/pag...

[2] https://climate.nasa.gov/explore/ask-nasa-climate/3104/flip-...
Someone is building a systemd based kublet replacement.

Why? Because Kubernetes has some great ideas on self-healing and resiliency.

But if you are small, and can work with a single instance for availability, then probably should stick with systemd. You could also use podman to get a small bit of the kubernetes ideas for working with containers.

The next level of scale wouldn’t be the full k8s but more like k0s, or k3s.
It feels like folks reacting to WEI are just riding a wave of publicity and outlash. There are many reasons that WEI sounds like a good idea, but a reasonable debate can't even occur in the current climate. I would like the ability to improve websites' trust in me, and use services that are free of bots, but apparently giving me the ability to do that might somehow endanger folks rights to not do that so I am not going to be allowed to? What's next, people will be outraged that I show my state issued id before entering age restricted stores?
The films Grandma's Boy and Nacho Libre come to mind, too.

"Hack for Peace";
#GlobalGoals
https://en.wikipedia.org/wiki/Extremophile
> crypto is at least equally bad

It's objectively much worse. Especially bitcoin.

> government cannot simply mandate that everyone can read

To be fair they did and it turned out it's possible. It just took a while. More or less everyone can read nowadays.
When someone stores their MFA credential in a password manager, that only means that in the worst case, they are as insecure as someone with no MFA – right?

This doesn't seem like a big problem to me for two reasons:

1. if they're using a password manager, they are likely to be using a better password

2. it's much more likely that someone has intercepted a single static password for a single website than, say, your 1Password vault password AND username AND secret key
ASCII diagrams can easily be drawn and maintained directly. That's kind of the whole point! Generating them from some more primitive declaration language makes them harder to use, not easier. This kind of tool is frustrating.
At the back of the keys in a piano (and in a grand) there are lead weights that determine how much will be added to the weight of the hammer.

These are usually recessed in a hole in the side of the key.

Typically you'll be around 50 grams, no matter whether upright or grand. But the action is substantially different in construction and that can have all kinds of effects on key response once it is moving. You can test this for yourself with some reference weights.

A '60' would be on the heavy side, a 40 or even lower would feel very light.

Black keys tend to be a bit lighter (and are differently positioned on the cantilever) due to their shorter length of travel so it all works out roughly the same in the end. Treble keys tend to be weighted slightly lighter than bass keys.

I don't have an action in pieces right now so I can't make a picture of what the side of a key looks like, but I'll see if I can't find one online.
"Punch a hole" is a common idiom in the security and networking space which means "open a port in the firewall".
Nothing has changed which would invalidate the basic model, though.

“It’s old” isn’t a reason to throw out a working design.
If you want to try to go in another direction, the 3rd of December in the religious context seems to correspond to the Feast of Saint Francis Xavier, who was one of the founders of Jesuit order.
Drugs can be variously classified by their chemistry and/or by their effects. It's worth noting that GABA-A receptors have multiple allosteric sites, and different chemical classes of PAMs (positive allosteric modulators) may have differences in effects. (There certainly seems to be substantial overlap in effects, of course.)
Venmo is usable on the web again as of at least a year or so ago. Not sure what changed their mind.
Yeah, unfortunately the point of passkeys is to replace multi-factor authentication. Usually you have a username+password as the primary factor, and a secret that's hard to copy and replay as a second factor (TOTP, non-resident WebAuthn credential/FIDO, SMS code). Passkeys replace the primary factor with a signed challenge, but the second factor is up to the authenticator (such as biometrics). WebAuthn relying parties verify that the authenticator is locking the primary factor behind the second factor, and they do that with attestation.
With "kind" (kubernetes in docker) setting up a one node cluster is as easy as typing "kind create cluster"
> Once again it seems clear that running code from two security domains on the same physical processor cores is just not possible to get right, and we should probably just stop doing it.

I believe this is why OpenBSD disabled SMT by default in June of 2018. [0]

It can still be enabled with a simple 'sysctl', though.

[0] https://www.mail-archive.com/source-changes@openbsd.org/msg9...
Nevermind, AWS explicitly documents that all instance types, including burstable, never co-locate different tenants on the same physical core at the same time:

https://docs.aws.amazon.com/whitepapers/latest/security-desi...
Suicide of Richard Bilkszto
Aren't these archaic protocols more reliable than the many other messaging options on hand? Pretty much the only reliable one?
Everyone who says AI won't replace humans conveniently ignores the fact that Homo sapiens is the only member of the Homo genus left. Because we out-smarted, out-bred, and out-killed all the others.
I think there is already an entire Rube Goldberg machine like that in the kernel for spectre mitigation.
Good. If you cannot afford the price of doing business illegally, close up shop or leave. And then you will be charged as foreign company when you try to sneak your way back into doing business in the country you left with the much more fun threat of being declared illegal and your products and/or services pulled from the market.

While you thought you presented an argument against hefty fines, you actually gave the perfect reason for why they should be hefty. If illegal practices are affordable, they're not illegal. They're just the price of doing business. So make them hurt.
Oh, that's interesting. Was not the case in 2021 at least. Maybe now they're worried about the new competition that does have web apps?
You can still map it to QWERTY, you just have to remember where the special characters are. It's worth it.
My family got it from a brief, outdoor, masked exposure to a kid who was in public schools. My kids are all homeschooled but the public school still facilitated our infection and my long COVID. I don’t have much confidence in that study.
AI's going crazy is the funniest shit.
> Ever since Google dropped WEI into our lives, I feel like they should not be allowed to be a part of any security efforts in any standards body or ecosystem.

Excluding Apple and Google, the remaining bodies are MS, Amazon and Facebook which presence is close to non-existent in the mobile OS market. Good luck with them?
It's interesting to see all the tech experts (no sarcasm at all in that, this is the place) take into account the input to defuse the output.

Surely you have to appreciate the end user who will not comprehend the same outcome.

/added
As in, people in this space know how to discount nonsensical answers, but this is being released to the general population. It's pretty dangerous.
I think the whole premise of this article is wrong.

If a project is successful, it isn't 99% done; essentially it will never be done so long it is alive, supported, and/or used by anyone (I won't get into semantics here).

As others have pointed out, many of those things should be done way earlier as part of the development, AND as part of the ongoing development/maintenance after launch.

On another note I'm also skeptical that a project should ever be 100% done even if that was possible. I had the privilege of working on a project during the whole lifecycle, including when it was deprecated and eventually decommissioned. It was very pleasant to go through all of the open Jira tickets for this product and close them as Won't Fix forever. All of those features, bugfixes and enhancements were never implemented. The project launched, lived, and died without them, and it was fine.
Disabling UPnP makes your system more secure, but unless you also disable all NAT ALGs in your router, you're still exposed to its dangers.

I don't think most routers have a setting for that, so if infected devices are part of your security model, it would be wise to assume NAT is entirely non-functional because of [NAT slipstream attacks](https://samy.pl/slipstream/). An infected device can modify the router's NAT table to effectively act like UPnP, except they don't provide a user interface for you to audit.

If you're NAT free (i.e. only use IPv6) disabling UPnP can be a decent security measure if you're willing to manually do all of your firewall exclusions, but honestly host firewalls are the only reliable protection method for most people these days.
As long as people can write code, bugs will exist.
A deflationary currency does not encourage you took take risk. In fact the complete opposite, it's not quite the same a buying a house (not that there is anything particularly positive about growth in real estate prices outpacing inflation).

> It sounds like you have a problem with property in general

It sounds like you have a problem with economic growth and increasing productivity in general
There are app developers like that. There is a class of problems where you need to be able to do both application development and system work to be able to do well.

What a lot of people miss about larger k8s deployment is that you can create an internal platform team, like a micro-heroku within the company. The company would have to hire people who can create _products_ and also knowing how to work with infra in order to create a platform. It would be this rare combination of product, dev, ops, and focusing on supporting the rest of the engineering team and giving up on the glory of launching something for end users.
Porkbun? I buy under a dollar domains from them frequently
Which is so weird to me because I learned of him in the first place through WorldCoin, well before I learned of OpenAI. In fact, his involvement with OpenAI was what raised alarm bells for me and made me very skeptical of them.
Interestingly, neither of the prompts in my comment are reliably working for me any more.
+1 for Organic Maps, it's an amazing app (I still keep OsmAnd installed for some more advanced uses)
Am I too paranoid about bank security?
It seems that some smaller banks still follow outdated security practices. Is that a problem or am I just crazy.

My current bank doesn't seem to support SSO. Their mechanism for linking to external services is to have you store your username and password in the other service and then manually enter the MFA code on each sync.

My previous bank still had an archaic system that required regular password rotation, had weird "complexity requirements" but still wouldn't accept all the "special characters" from a password generated by a pw-manager.

Are these things actually no big deal or are we just waiting on a wave of crime against small banks?
Wow very neat, thanks! Happen to have any other similar suggestions? That one is backordered for months.
nah, this is just what LLM AIs do. You used to get this all the time when working with earlier versions like gpt2. Turns out when you really confuse an ai that predicts the next word, its goes off into its own little world, creating fragments of meaning that sound like lost parts of a larger conversation.
Of course it's a security flaw, but it's a security flaw for the end user, not google. It's google's security, like them putting their own lock on your door that they can a remotely activate on a whim. This is what most humans would call a security flaw, but it's a non traditional one for sure.
Define 'reliable'.

Yep, I'm all abroad the JMAP train, but if you need the things to be done than the IMAP is the only one you can rely to.
Kratom seemed like an amazing substance for a couple weeks, right up until it presented as jaundice and a hospital admission. Be careful with it, folks.
> Everyone who says AI won't replace humans conveniently ignores the fact that Homo sapiens is the only member of the Homo genus left. Because we out-smarted, out-bred, and out-killed all the others.

Everyone who says AI will replace humans conveniently ignores the fact that Homo sapiens is the only member of the Homo genus left because we out-smarted, out-bred, and, especially, out-killed all the others.

And we (collectively, at least, not individually) know where the AI’s power hookups are.
Indeed, I just run it (GPT-3.5-turbo) in a loop on increasingly long sequences of "b b b b ....", and it went off the rails somewhere around 200+ 'b's.
Right. In this example lambda does not capture i at all. You would need something like

funcs.append(lambda i=i: print(i))
It is also of interest because at least ~$1m of funds were stolen from thousands of wallets made by people that wanted a simple and seemingly reputable CLI tool to generate a mnemonic and derive addresses for various coins.
how would that help with building old code? is old code often unavailable upstream?
Twitter is where science is done now...
Malicious extensions can abuse VS Code flaw to steal auth tokens