skysight-inc/HackerNews huggingface dataset:
ANY session expiration does not help security. Authentication should not involve time. If I logged in, I should stay logged in until I explicitly log out. That's it. The session should live forever or at least several years from the last time I used it.

Speaking of internet cafes and other shared computers, they usually are secure enough. All internet cafes I've ever been to run specialized management software on their computers and everything gets wiped the moment your paid-for time expires. In places like universities and schools, people usually have their own domain accounts that reside somewhere on a central server, including their home directory that stores all the cookies and tokens.
> But "open source" itself is an offshoot of a more foundational movement, the Free Software movement, whose goal is to promote freedom, and whose method is openness.

Yeah, no. Free Software is a subset of open source software, and "Open Source" (as written) is yet another subset of open source software. No wonder people have gotten all this mixed up...

Ultimately, people are right to be mad at this, but they're choosing the wrong stones to lob. It's not "FreeAI" or "FOSSAI", it's "OpenAI". Open can mean anything, and doesn't even need to correlate with the qualities of their products.

> The paper's authors start by suggesting that the "open" in "open AI" is meant to imply that an "open AI" can be scratch-built by competitors (or even hobbyists), but that this isn't true. Not only is the material that "open AI" companies publish insufficient for reproducing their products, even if those gaps were plugged, the resource burden required to do so is so intense that only the largest companies could do so.

This is pretty wrong too! Even "Free Software" like GPL-licensed programs don't demand a non-existent resource burden for the end-user. If you cannot run the GNU Compiler, you cannot demand the upstream send you a custom binary. That's not what Open Source means, or open source, or Free Software.

> like Meta's PyTorch and Google's TensorFlow. These tools are indeed "open source," licensed under real OSS terms. But they are designed and maintained by the companies that sponsor them, and optimize for the proprietary back-ends each company offers in its own cloud. When programmers train themselves to develop in these environments, they are gaining expertise in adding value to a monopolist's ecosystem, locking themselves in with their own expertise.

Sorry, you had 50+ years to cry foul over proprietary API interfaces and now we are here. Even as a FOSS super-advocate I cannot feel empathy for this author.
I think you're projecting your own personal issues and insecurities on the whole world and of course find evidence to support them (as you'd find for any POV).

This is a dangerous mistake people like doing these days — to generalize and over simplify extremely complex matters.

In my perspective, I find today as much stupidity and lack of professionalism, attitude towards any job as it was 20 years ago. With some fluctuations in specific areas, niches presumably correlated to covid, wars, economy issues and other general sources of chaos.
Google used to do this for low volume emails I was literally sending to myself by authenticating with my google smtp account credentials. I could find no rhyme or reason to it. It would claim to accept emails and they would never show up in my inbox or in spam. Sometimes they would get delivered to spam. Sometimes to my inbox like expected.

It most often involved security log snippets which would include ip addresses and hostnames that were likely already on "is a known bad actor" list.

Bug on their end? Intentional thing to disrupt spammers? I don't know.
How about Verizon and ATT give us the fiber connections they promised us 30 years ago. We've already paid them for it.
The germ of not-stupid was that artists wanted a way to be able to prove their ownership of art. If somebody was using their art they could point to the NFT (which can contain a hash of the artwork) and say, "I own this and I can prove it."

It's still up to courts to enforce it, but at least you had genuine proof. And it meant that when they sold the art, they could transfer the NFT, and now you truly own the art -- in a legal sense. That's good for the artist, when the buyer has more confidence that the transaction is binding.

The artists were kinda excited for the automated contracts. They wanted to be able to sell a piece and retain a right to a share of future sales. That way if the $10 commission piece blew up like Banksy and sold for $5 million, they could automatically get a piece when the NFT sold. (In Ethereum rather than cash.)

That all evaporated really quickly. Partly because of the scams, but also because NFTs aren't free. If you get a $10 commission and you have to pay $10 to make the NFT, you're not making any money. Maybe that wouldn't apply if it were done with a proof-of-stake rather than proof-of-work blockchain, but the entire thing became ridiculous before anybody could begin to work out the actual technical kinks.

Plus, the idea of using the courts to enforce your copyright is a waste of time and money. Maybe some day you'd find that some corporation had grabbed your work and used it as a stock photo, but even with crypto-grade proof, it's an uphill battle. Again, it became ridiculous long before an actual enforcement opportunity presented itself.

So... the idea wasn't initially completely stupid, just unrealistic. And then completely stupid.
The Bad and the Ugly on Building on Cloudflare Workers
> another good one is regularly changing passwords

I believe someone stuck forced password changes in legal banking regulations at least in the EU. In spite of all having hardware or mobile based tokens.

Needless to say, I just increment a number 10 times, because they "prevent password reuse" as well.
And some people trust the software authors more than some random repo maintainers who don't have enough time to even make sure the packages they update are actually still compatible with each other.
How many heavily-NDA'd Broadcom chips are in those things? Good luck getting working drivers, even if you manage to jailbreak it: https://projectsandcastle.org/status
What I find so frustrating is that Windows, under the hood, is so solid.

It's just the UI with Bing/Ads/telemetrics/etc integration is so crap, like they've ruined a solid OS with crappy surface level stuff.
Very doubtful.

Probably a Web site, and, in one that I read, actual verbal assurance, by sales person.
Scientists May Have Unraveled the Secret of Aging-Resistance in Naked Mole-Rats
The result shouldn't be all that surprising considering the TypeScript compiler is written in...TypeScript. So TypeScript as a ML is already battle tested and is in heavy production use every day.
As a 100 hour, thrice restarted student pilot it is the perfect mix of physical, mental, math and procedures. The actual flying of small aircraft is physical coordination and task saturation at times. Lots of procedures and optimizations. The navigation, especially the dying radio navigation (with paper charts, too) and flight calculators is lots of geography and math and tools.

Drumming is some of that but other than motorcycles I've not found anything else that comes close to flying. I've never tried sailing but maybe that too?
While I think it's invaluable for tech people to have contact with their end-users, I could be much easier convinced if there were at least a couple of successful projects listed that were created with EDD, and is not a horrible mess from UX perspective.

Developers are great at creating fantastic software used by other developers. Developers hate to pay for software they are using. And unfortunately in my experience developers are pretty bad and creating software on their own, for which normal people are willing to shell out money - usually because they are pretty much unusable by mortals.
Web pages share browser with other web pages, desktop apps don't.
I'm the CTO of a popular Secrets Management platform. It's fair to say that I personally have a lot of experience with secrets and requirements around them, based on conversations with customers.

The primary missing feature here seems to be multiline support. That's super common for keys, certificates, and other JSON configuration. Based on the Node PR, they appear open to adding that later (big +1 on shipping incrementally).

The other missing feature that folks tend to heavily rely on is variable expansion. For that to truly work well, I recommend using a holistic platform like Doppler. That allows for expansion/referencing across environments and projects, like when you have multiple independent services that need access to the same set of secrets (e.g. database creds, error reporting tool, stripe key, etc). You can then update the secret once and have the change propagate to all the places it's used.

Lastly, I'd be remiss if I didn't mention the Doppler CLI and our own fairly unique support for .env files. We've traditionally taken a dim view of .env files because they represent a static, long-lived collection of sensitive information that lives offline. Often, these get checked into a git repo. This is probably fine for personal projects, but a major issue for companies and the security aware. However, .env files are a pseudo standard and folks want a way of continuing to consume their secrets via them. Our CLI's approach is to mount a named pipe that we can write secrets to when a reader attaches. That allows us to limit the amount of times the "file" can be read (e.g. once), it guarantees that the file's contents are unavailable once the application process dies, and it uses the same open/read interface as a standard file.

In all, this is an exciting development for Node. I'm glad to see more standard features make it into core and hope that multiline support is a fast follow.
I spent about 6 years writing Go at $dayjob, and while what you're saying is technically true, idiomatically you also generally wanted to avoid scenarios where you would _want_ to observe them independently. The standard behavior is is if `err != nil`, the result should be ignored.
I'm very happy that Uber broke the law that protected the cab cartel. Now I can conveniently get a ride wherever I want and never have to deal with a sleazy incompetent cab company ever again. When I travel to other countries I never have to deal with their shitty taxi scams.
Forgive me if I think you're offensive. If it would please you to ignore my writings and refrain from commenting from now on that would help to reduce the discomfort.

Unbelievable.
Same. Writing completions for various shells is tedious and sometimes very complicated, so it's always a relief when there's a tool that can generate them from some kind of specification.
Sure, but that's still seems quite mix and match, anything goes, choose your own adventure. There are many positives about this approach, but as a learner a little more common ground between codebases would certainly be appreciated.
Yeah it's difficult, bodyshaming is too much of a thing. Even something as simple as MSG makes you want to eat much more.

MSG occurs naturally in some foods but they tended to be really expensive (e.g. highly matured cheeses) so it was not such a big deal. But now it's added to everything.
I believe you could have a Protocol that requires the property and that the object is Callable.
https://srag.jsc.nasa.gov/spaceradiation/What/What.cfm

https://www.cdc.gov/niosh/topics/aircrew/cosmicionizingradia...

Sounds like there is enough to evidence to perform a longitudinal cancer study across air transport workers to better understand the potentially increased cancer risk.

EDIT: Is hazard pay warranted? Also, perhaps airlines should have to provide estimated cumulative exposure to employees based on their flight trip logs. Estimation should be straightforward based on flight track logs combined with cosmic radiation satellite data.
Disregarding moral or sustainability reasons and taking a more cynical view, I can understand taking a long-term bet on the technology improving enough for lab-grown to become a cheaper alternative.

If we ever reach that point, whoever's in the market to capitalize on the opportunity is going to be very well off.
You'd think simple log in/log out test would be trivial to automate...
https://news.ycombinator.com/showhn.html

Which part, specifically?
I am quite sure that there was never anything binding.
This is the laptop 90's me would have wanted.
Obesity is a major problem across Europe increasingly [0]. Britain is nearly as obese as the US now for example.

Australia and New Zealand have similar obesity problems as the US and Canada.

Europe is just catching up to the mistakes the US has made since the 1980s. Some nations are faring better due to their culture (strongly ingrained behaviors) holding back the mistakes, such as eg France.

[0] WHO report: Europe can reverse its obesity “epidemic” | https://www.who.int/europe/news/item/03-05-2022-new-who-repo...

"The report, launched at a press event on 3 May and presented at the European Congress on Obesity, reveals that in the European Region, 59% of adults and almost 1 in 3 children (29% of boys and 27% of girls) are overweight or living with obesity. Obesity prevalence for adults in the European Region is higher than in any other WHO region except for the Americas."
The US military after using 37 different shell companies to purchase hundreds of gotek floppy emulators and 5.25" to 3.5" drive brackets:

> Damn I'm good at modernization
Finetuning should never be the first step; it's slow, expensive, and indeterminant. Until you are maxing out that context window, you can just keep layering in more information into the prompt.
Good to see Devuan is still alive and has some solutions to systemd plague.
I would recommend you learn Python or JavaScript first and use an interactive coding environment like a Jupyter Notebook, because it will allow you to try different inputs and see the outputs (or errors) immediately. Learning/exploring through trial and error is very powerful.

For learning Python, you can check out this blog post I wrote recently, which makes an analogy between Python prompt and a regular calculator you are already familiar with. I go over some basic topics like assignment + for-loops + functions: https://minireference.com/blog/python-for-stats/ There is a lot more to programming than this, but if you learn these three concepts you'll have done a big chunk!

There are A LOT of good resources for Python beginners. I think you should try a few of them out and see which ones you like best. Here is one example https://www.youtube.com/playlist?list=PLbFHh-ZjYFwGeYhQ2yIQF...

Good luck with your learning. Remember that seeing errors every few seconds is normal... this is how everyone learns, and even advanced programmer run into errors all the time. It's part of the game, so don't be discouraged.
Well, story time. Because I went through this process.

I purchased a condo in a building that Comcast (A cable internet ISP) claimed to service. I even called ahead before putting an offer on the unit to verify I'd have them as an option, since they were the only high speed internet option available besides slow DSL or 4G. Sure enough, Comcast told me they service that address.

Fast forward to near the move-in date, I call Comcast to transfer my service to this location. They tell me sorry, we can't do that, we don't service this address. I tell them this is impossible, because not only am I on your coverage map, but I called a month ago and you told me you service it. They said sorry, nothing they could do, and that I should try Comcast business or pay something like $4000 for a build-out.

Well, I was desperate and called Comcast business to see if I could get a business line in my very residential condo. Weirdly, they allowed it. But I had to pay $200 for a setup fee and then roughly $100/month for what was basically 50mbps internet, locked in a 2 year contract. I had no choice, so I ate the cost - which looked much better than the $4000 option. But then Comcast said "Hey, we want to install a distribution box in your building, can we do that?" and I had to wrangle with the condo board to get that thing installed. About 3 months later I finally had Comcast internet, locked into an expensive contract. But because Comcast had installed a distribution box in the building, at least my neighbors could now actually get the service Comcast claimed they offered on the map (even for regular home internet). After 2 years my contract was up and I was able to switch to residential internet at a lower rate.

I suspect if this was a SFH rather than a single unit in a 28-unit condo building I'd be screwed and have to shell out the $4K.
Technically true, but most software developers in Canada aren't P. Engs, and tons of Canadian software companies use a "Software Engineer" title with no repercussions, so I'm not sure you can point at that as a success.
Unfortunate, thank you
When I drink Diet Coke, I choose to drink it to avoid ingesting 40g+ of sugar. And I also prefer its taste to compared to sugar. And I am the opposite of fat.
This is an insane take; if your session token is buried somewhere in a log and gets discovered after a few hours, it shouldn't even be remotely possible that it's still valid.
Unfortunately, obesity trends in Europe are catching up with the US (in many countries, at least): https://www.obesityevidencehub.org.au/collections/trends/adu...
For the Maui sirens, there’s actually an argument for not activating them. From my understanding, the sole purpose of the sirens is to warn residents of a tsunami. Residents are trained to run into the forest in the mountains when they hear the sirens… the exact spot where they needed to keep people away from because the fire was raging. If that’s accurate, it might have done more harm than good to use them.
It also sounds like the mayor didn’t bother to answer a request for temporarily rerouting streams to let the fire department have enough water to respond. Because it wouldn’t be equitable to the other people on the island to let that small group have so much of the limited resource. I might be missing some details, but that’s what I got out of a quick news article yesterday. I’d apply the avoiding work argument here more than the sirens. First guy made a hard decision. Second guy sat on it until it didn’t matter anymore.

(Edited to fix a few words Siri felt should be changed after I typed them)
those were 16-bit machines so perhaps they have to find aging flash drives smaller than 2GB?
It's not meaningless.

Knowing there is good novel-feature coverage of patents and knowing you have permission for those patents is better.

Webp is encumbered. Google owns many patents that cover Webp features. Google grants permission to use them (not that it needs them in its own product).

That is all to say that it's not hard why someone at Google might prefer a technology they have explicit rights over.
> Driving in a major city, based on intuition, social cues, and the ability to drop a plan and make a new one, is the definition of too complicated for a computer.

It's also too complicated for humans, though. They get into accidents all the time.

I feel like we're holding computer drivers to a higher standard than the humans we already allow to drive. The computers are absolutely going to make mistakes, and some of them will have catastrophic results, but, uh...
That is what makes micro so easy to use. It uses widespread hotkeys.
>people will ask you how you are doing, but they don't actually mean it,

it is common to hear a reply as "oh, you know" an an equally un-engaged response. i remember the first time an uncle responed "well, no, I don't. that's why I asked." i had never realized how i had become desensitized to the question that i gave an equally meaningless response. so now, if it's a stranger, it's just a simple "doing good" or "just fine" followed by a "thanks". if it's someone i am familiar with like family or friend, but not coworkers, then i might stop to provide a more truthful response
Isn't this just a manifestation of high-context versus low-context cultures? https://en.m.wikipedia.org/wiki/High-context_and_low-context...
I think this is basically just the default state of human beings, and it’s only the rare cultural movement that manages to align action, rewards, and values in a way that actually gets stuff done, whether that be “conquer the world on horseback” or “build a rocket that goes to the moon.”
> the lawbreakers sooner or later end up running into the limits, be they SBF, Thiel, Musk or any other of the ethically challenged individuals that the tech world puts on a pedestal.

That's quite the accusation. What laws have Musk and Thiel broken?
> This recent disclosure proves, in a Groundhog Day-like fashion, that the FBI is not going to suddenly become good at self-control when it comes to access to our data. If the privacy of our communications—including communications with people abroad—is going to actually matter, Section 702 must be irrevocably changed or jettisoned entirely.

Section 702 looks to be expiring at the end of this year, although the Biden admin has expressed intention to renew it[1][2].

[1]: https://www.eff.org/deeplinks/2023/03/section-702s-unconstit...

[2]: https://www.npr.org/2023/03/23/1164724089/in-fight-over-key-...
Ask HN: What's your experience with stored procedures-heavy systems?
I vaguely remember my first-hand experience of dealing with a system that was using a lot of stored procedures, perhaps in the late 1990s, and I am pretty sure it was Oracle. Much of this was shrouded in mystery and incantations produced by our lovely DBA.

I am now gathering first-hand accounts of companies and teams that have built a lot of logic in their databases (stored procedures and such). This would help build a more comprehensive understanding of people's experiences with this approach. My goal is to be able to write a few in-depth articles that will be beneficial for others to understand the domain better.

All experiences are welcome. Strictly negative, positive, mixed bag: all matter.
Consider how joyless the designer of the unreadable keycaps must be, their sad life as they remember all the times they willfully damaged their even more clueless customers in pursuit of pseudo-style, looking at life in all its diverse forms, shapes, textures, activities and choosing bad ones for the lulz.

Technical constraints do exist, and if you shit on them you are a pretentious bad designer of products that cannot be taken seriously.
I wonder how much this feeds into the negative image many people have of "working remotely" as barely working. It might fall into a pattern where framing something as nicer than it is makes it less likely that we as a society continue to permit the thing. A similar case would be all new housing being positioned by developers as "luxury housing".