skysight-inc/HackerNews huggingface dataset:
Off-topic: Substack's dark pattern attempts to maximize traction using intrusive pop-ups, text hiding, etc, is really awful. Such a text-hostile platform.
It's a feature of capitalism.

They're worried you might be working two jobs, or might make/join a startup and compete with them, or generally not feel enslaved to your employer.

At at the very top, at the big shareholder level, they don't want the middle class having too much freedom, because they do pose a potential threat to them.
Software and web standards are quasi extensions of business policy as of late. It seems that the ones who require you access said sites via https+cert will gladly pivot foot and sell you said certificate when you realize you need it to unlock the full potential of the browser and thus your users eyeballs. Similar locked gardens lately can be seen in the form of Apple's app store.
Not to say that secure, encrypted sites are not preferable but the lengths that unnamed parties have gone through to cripple things is not just circumstantial.
Celebrate Vue.js with us. Support devs and projects, and win cool stuff.
Not to be confused with related but different “OTF” which is the open source version of Terraform Enterprise:

https://github.com/leg100/otf
https://news.ycombinator.com/item?id=34536663
> That's such an incredible amount of money.

For reference, Huawei reported a revenue of $92 billion last year.

I might be biased by my time there but I never got the impression that Huawei particularly cared about anything beyond business. Sure, the ownership structure meant management could take a more long term view but finally it was still about the bottomline.
Cotton kills, don’t wear that outdoors in anything serious.
The fact that yborg's comment below got flagged and immediately downvoted to death might be some proof of their claim that there might be some astroturfing going on even here.
A Tassie tiger brain sample survived two world wars and made it to our lab
Let's Encrypt isn't exactly hiding that it's only practical in the context of automation

From their FAQ (https://letsencrypt.org/docs/faq/):

What is the lifetime for Let’s Encrypt certificates? For how long are they valid?

Our certificates are valid for 90 days. You can read about why here.

There is no way to adjust this, there are no exceptions. We recommend automatically renewing your certificates every 60 days.
OP keeps repeating tha Google is making money from certificates. I don't think Google sells certificates, and even if they do the revenue is insignificant for them.
Does anybody know what OP may be referring to?
thats great for tape

only marginally slower than your average SSD
Blocking Entire Countries from Your Website for Better Traffic – Opinion
Great question, the US intelligence community is not in the business of covering for the CCP generally, it’s also worth pointing out that Sky News is the Fox News of Australia and the evidence they seem to be quoting seems to be leaving a lot to be desired.

Edit: I just saw who the author was on the story. She is a well known low quality source for what it’s worth and not thought of well amongst her peers.
I have to agree. HTTPS everywhere is security circus...
I tried SeaBlock, but aborted my playthrough before long because it was too boring. I'm enjoying K2, though.

Don't think I'll want to try Space Exploration if it's even worse than SeaBlock.
So do you or don't you think that Russia should be obligated to abide by its international agreements such as the Budapest Memorandum that it signed in 1994?.

If you don't think they should be obligated to follow there agreements then why should you expect Ukraine to follow any of theres?.

> Merkel indicated the West 2016 Minsk agreement was never going to upheld and was to buy time to arm Ukraine. Now who would trust the West?
https://ho1.us/2022/12/ukraine-war-merkels-confession-about-...

If you're going to make claims like this please use credible sources. "ho1.us"?
At minimum:

- Spacelift

- env0

- Digger

Pulumi is not targeted, since the licenses of the providers are not changed.
“ We are currently working on a highly experimental implementation of hardware-backed full disk encryption”

Why does Canonical always reinvent the wheel. Just ship ZFS or BTRFS please.
This brings up a potentially huge optimization waiting to happen. When you have a Rust dependency, you compile the whole crate before you can even start compiling your code. But because of the depth of the ecosystem, there is a lot of code packaged into crates that may not need to be compiled...the crate might only used for a single function. There are probably dozens of ways to do this, but a quick parse and analysis of the target code could eliminate a large amount of dependency compilation.
No, he's specifically referencing the initial setup step of Let's Encrypt, where you don't have a valid HTTPS cert so Let's Encrypt has to connect to your server over HTTP, see here: https://letsencrypt.org/docs/challenge-types/

And yes, technically he's not wrong. Well, technically he is wrong, in that it wouldn't be a MITM attack, exactly, but if an attacker can intercept requests sent to your domain by LE and respond however they want, they can generate an LE cert for your domain, even if you're not using Let's Encrypt. That said, they can't intercept generation of the LE certificate - the HTTP request is just to prove that you've got enough control over the domain to justify issuing one.

Using HTTPS wouldn't prevent that. I'm actually not sure how you would prevent that, short of removing HTTP-01 from the spec and requiring DNSSEC and so on. EDIT: I see a sibling comment pointed out that Let's Encrypt are aware of this, and are using "multi-perspective validation" to make requests from multiple regions, making this attack much harder to pull off (but never impossible, I suspect): https://letsencrypt.org/2020/02/19/multi-perspective-validat...
for those complaining about the video quality, lets see the still/flash photography photos & their quality that helicopters take during flight as well. theres your detail.
Sure, nothing fundamentally prevents us from repairing it from a physical standpoint. The practicality of it is the key question. While the machine analogy is partially useful, genes/proteins/cells are dynamic, adaptive, and can exhibit stochastic traits. This fundamentally contrasts them from traditional machines, and is the reason (imo) we suck at making effective therapies to even treat diseases where we think we know what is going on.
This is basically it, the NIAID under Dr. Fauchi pushed research money into CIA created front companies who then doled the money out to the Wuhan laboratory.

This research was at one time done in the US and deemed to dangerous, but because of the relentless pursuit of science it was passed off to a foreign facility.

Knowing that it’s a bad look to have helped create this virus and see it’s accidental spillover, the US is naturally hesitant to admit it’s involvement in wrecking the world for a couple of years.

The question I have is, what about the omicron variant; it had more mutations than time could possibly allow... my bet is it was released on purpose to act as a less deadly “vaccination”. There just so happens to be a US funded BSL facility in Africa too.
I think this should be addressed sooner rather than later. A lot of core plugins (e.g. AWS) are written by HashiCorp themselves and the license could be changed at any time, putting OpenTF users in danger of violating the license. Furthermore, to publish a provider one needs a HashiCorp account and agree to their Terms of Service.
> I keep hearing everyone talk about how Erlang/Elixir gives everything out of the box and you don't need to worry about Queues, RPC or whatever...

Many companies are using Distributed Erlang but not the way you described: they are using it to exchange messages between nodes running the same version of the software. Imagine that you are building a web application, you can directly exchange live messages between nodes without Redis/RabbitMQ [1]. If you are deploying a machine learning model, you can route requests through multiple nodes and GPUs without additional deps [2]. If you want to see which users are connected to your app, you can exchange this information directly between nodes [3].

In other words, there is a subset of distributed problems that Distributed Erlang solves very well out of the box: homogeneous systems working on ephemeral data. And some of the scenarios above are very common.

If you need to communicate between different systems or you need to persist data, then I 100% agree with you, I would not use Distributed Erlang (at best it would be one part of the solution). I think this distinction gets lost in many conversations and sometimes it leads to false dichotomies: "why Erlang when I have k8s/grpc/redis?" while in practice there is not a lot of overlap. I have written about Erlang/Elixir vs Redis [4] and vs k8s [5] for those interested.

[1]: https://hexdocs.pm/phoenix_pubsub/Phoenix.PubSub.html
[2]: https://news.livebook.dev/distributed2-machine-learning-note...
[3]: https://hexdocs.pm/phoenix/Phoenix.Presence.html

[4]: https://dashbit.co/blog/you-may-not-need-redis-with-elixir
[5]: https://dashbit.co/blog/kubernetes-and-the-erlang-vm-orchest...
certbot doesn't need root, it just writes to directories that are usually limited to root by default (`/etc/`, `/var/log/`, `/var/lib/`). And it needs some interaction with the web server to actually complete the challenge.

You can absolutely provide it with alternative paths and configure your web server to forward `/.well-known/acme-challenge/` to a non-root location.
When I read articles like this I can't help but question my own intuitions since they are so opposed to this author's thinking.

Firstly, his suggestion on the worker shortage and the anecdotal $1000 sign on bonus at some local McDonalds. These seem more tailored to a narrative interpretation of the state of the world that is formed to the author's own bias. I look at my own small town homeless and drug addicted population and consider the changes in the last 5-10 years on that front. I consider the insane rise in the cost of home ownership and the massive rise in rental costs locally. I just don't see $1000 signing bonuses at fast food restaurants as a sign of some latent demand for labor. It feels like the author is using a single anecdote and a narrow reading of a few graphs to support a world view that I don't see existing in my own experience.

Then he says: "We are quickly reaching the limits of current AI". You mean the AI that surpassed most informed peoples expectations on AI capability less than one year ago? I feel like I'm in 1996 reading an article about the Internet where someone gives some list of reasons why the Internet is reaching its limits.

And just as an aside, this author uses the term "explosive" especially in the context of "explosive growth" over and over. It may be that his target market just isn't me. The narrative and analysis probably hits home for a particular set of capitalist minded investor class individuals. Perhaps they really do see North America as having a huge labor shortage and that we just need the "right" kinds of automation so we don't all feel so bad about the continuing displacement of workers. As long as they keep seeing "explosive growth" in the value of their assets.
"a different definition of "work"

Playing golf. Talking about work over lavish lunches. Having flexibility in your days to go to the gym, run errands, these things all extend the "work" week.

:)
If they still plann to add more transistors to RT: AMD must get its 100% hardware BHV. At the same time, since the release of the open source NVIDIA vulkan driver on linux, it seems NVIDIA hardware programing is much simpler than AMD one. If true they have to seriously move towards the same simplicity.
> Truth is, if you want to protect yourself, you need to build in a VM, AND run the binary in a VM. Regardless of the language, that's not specific to Rust.

I have been in the practice of running build scripts/package installers in a container for projects that I don't explicitly trust for a while now. I wish more people saw the value in doing so.

I used to build everything in my homedir as well until about 6-7 years ago when there was a big outbreak of malware scripts on NPM. Quickly realized the folly of running so much untrusted code with the same privileges that I use to do everything short of administrating my machine.
How about the opportunity cost of people dying because they don’t have access to any treatment? It can be very challenging to find a qualified professional, even if you have the necessary funds, insurance, and determination.

LLM mental health treatment can’t come soon enough.
404's growth hackers making waves right out of the gate.

This media company was launched like a month ago and they're already taking the spotlight by doing censor-worthy or ban-worthy stuff.

Take notes. This is how it's done these days. You want attention? You want to grow your anything? Start fights, call names, and make sure you get kicked out, censored. It's like the Streisand Effect or something.
If a hotel you are planning on staying at for a business trip is offering free rooms for people affected by a natural disaster, do you take the free room?
There's a lot of nonsense in TFA.
I went to 4.5m - the rings did not slide easily any more as we paused for a year. If you work on it right away, you can go much further

I went with an inner diameter of 1m, this is fine for a small shovel, a pump, a small jackhammer.

Concrete rings are used all the time in road construction work. I don't see a risk of collapse with those when stacking carefully. Even if one ring were to get a crack, where should it go? I felt safe in this regard
Regarding the Language Server, terraform-ls: does anyone know if that will also be forked?

Gah, this is frustrating! I am learning Python but TF and tf-ls are written in Go. I need to figure out how best to contribute.
My experience is that Angel's isn't all that grindy in itself--its main problem is instead that it feels excessively matrix-driven in development by itself. And there's a subsidiary problem that a lot of it ends up feeling kinda pointless (especially bioprocessing), so some of the interesting challenges it presents ends up being ignored because there's no reason to actually engage with them.

The other issue is that Angel's is kind of an incomplete mod by itself, it relies on something else to actually use all the new things it makes, and that other one is Bob's [1]... and Bob's is very much complexity for complexity's sake. Most of the vanilla items in the games are instead have extra dragged out production chains for seemingly no reason other than to make things more complex, and the modpack has evolved by finding one of the few things that hasn't been touched yet and complexifying that yet further.

[1] To be clear, Bob's predates Angel's by a lot, and Angel's was largely developed to create more interesting ways to make the things that Bob's added.
Imminent Death of ChatGPT [and Generative AI] Is Greatly Exaggerated
We have the tooling in place to ensure full equivalence of the most important parts, especially the statefile. We will also take great care to not introduce DSL changes that would make it hard to switch back and forth between OpenTF and the legacy Terraform. Looking at the codebase for the last week, and the list of PRs on the original repo ignored to oblivion I believe there's a lot of space for innovation that does not break the interop guarantee.

[Marcin, co-founder of Spacelift, one of the members of the OpenTF initiative]
I had no idea solar panels was more than 100 years old.
I disagree that they’re the same.

When you have motivation, you don’t need discipline. The work comes naturally because you want to do it. When that fades, and it will, discipline is the only thing keeping you from quiting.
It seems like you're using a different definition of overbid here. You didn't bid higher than what you value the house at, presumably, otherwise you wouldn't do it again.
Anthony Doerr's New Novel Spans Centuries, yet Fits Together Like Clockwork
I have an ongoing joke with my wife that GoreTex is a myth. We both spend a lot of time on trail and once I splurged for GoreTex trail runners. The first time I wore them on snow I was amazed. My socks stayed dry. Three outings later they were no different than non-GoreTex trail runners. Anecdotal evidence but there seems to be a huge spectrum of GoreTex effectiveness across garments. I'm not sure how these items are manufactured. Is it possible some items have "more" Goretex or have it applied in a specific way to make them last longer than others?
I recommend the book for the psychological/emotional tips.

Otherwise, it's a pretty poor book:

https://news.ycombinator.com/item?id=27335076
There’s parallels but it’s not the same. Red Hat’s projects are still all fully open source. And it’s not clear it’s a mistake yet.(I work for red hat but this is my personal opinion).
Custom input map with extensive radial menus and layers.
Cheese and chips: parmesan producers fight fakes with microtransponders
I might bat an eye at "2 tbsp arsenic"
Has there been any known successful MITM attack with forged certificates since the introduction of CT? I am not aware of any.
... but more research is required, give me money.
While some of this article makes sense, it is full of exaggerations and outright lies.

If you want longer-lived certificates manually, don't use Let's Encrypt. Why pretend that no other issuer exists?

> You don't have to use certbot (...) you can renew certificates manually

Or use a different client? Do we pretend these don't exist, too? https://letsencrypt.org/docs/client-options/

> If you have a hundred websites, then on average that's four hundred renewals a year—more than one every day. Every single day. For the rest of your life.

Right, because you can't renew more than one on the same day? You can't do your 100 renewals and go on vacation for 90 days? Why not? That's just not how averages work.

> Normally, when a site changes URLs, you can use a redirect to send visitors to the new address. But, if the old address is HTTPS, that doesn't work: the old address will display a misleading security warning instead of redirecting.

That too is an outright fabrication. I just tried a 301 redirect from HTTPS to HTTP and it worked fine, on up-to-date Firefox, no security warning. Maybe the author promised to never get rid of TLS with a `Strict-Transport-Security` header? Don't do that?

> When you install a certificate with a three-month expiration date, you're saying “I want my website to break in three months unless I show up and tell it not to.”

Is that how you feel about permits, licenses, subscriptions? Fixed-time contractors? A "real engineer" wouldn't use anything time-limited?

> save the certificate permanently the first time you connect

That's the final recommendation? After the author concluded that "certificates provide no security" in the second paragraph because they might man-in-the-middle the challenge? Are we supposed to ignore that they might man-in-the-middle that first connection?
It really depends on the setting.

Local city allows chickens (just a few) and out by me some towns allow a lot more, but there's also proper space to do those things.

Pig farm guy was right on the border and he did NOT have enough space for a bunch of pigs. Thankfully the town already had rules about pigs. Pig farms STINK.
Less people = Good!
That's a very verbose akshually you have there
How did Hashicorp "take the right approach"? They wanted $$money$$, they didn't want Terraform to be bigger or better or to cede control of it to anyone else.

Having seen Spacelift, Pulumi, etc. over the last few years, I have little trouble envisioning them jumping to help with some alacrity if a Hashicorp that did want improvements did the work to move it to a software foundation themselves. But again: $$money$$.
> But if someone is able to perform a man-in-the-middle attack against your website, then he can intercept the certificate verification, too. In other words, Let's Encrypt certificates don't stop the one thing they're supposed to stop.

I guess? But they later state that SSH's trust on first use is the solution... which has the same problem. Am I connecting to the real bank website or a fake one? Who knows! But I'm going to trust it forever.

Additionally, most man-in-the-middle attacks occur on the client side (ex. some local network is compromised), which is still prevented here. You would need to man-in-the-middle from LE's perspective.

> “But you don't have to use certbot,” say the people who haven't thought very hard about it. And they're right: you always have options. You can renew certificates manually, but

Why the fuck did they link to the Youtube HQ shooting here? Anyway, they also link to a bunch of clients that don't do manual renewal.

> The entire certificate authority system is a for-profit scam. It imparts no security whatsoever. But Google gets its money, so it's happy.

I'm sorry, how is Google getting money from PKI? In the previous section they actually implied that Google might drop Let's Encrypt in order to have their own CA make money. So which one is it?

I know this was written in 2019, but since then Google has entered the market (https://pki.goog/), but they didn't boot Let's Encrypt. In fact, they adopted ACME and provide certificates for free as well. So they're still not making money from it.

> what to do about it
> Not this time. The technical problems are easy to solve. For decades, users of SSH have had a system (save the certificate permanently the first time you connect, and warn if it ever changes) that is optimal in a sense: it works at least as well as any other solution. It's trivial to implement, is completely free, involves no third parties, and lasts forever. To the surprise of absolutely no one, web browsers don't support it.

This author has no concept of the real-world. Prompting users to accept a certificate on first use is just going to cause them to always click "trust" since the other option will always break what they're trying to do. A website can then never rotate that certificate without breaking every user that visited their site before. So if the certificate does leak, someone now how boundless ability to MITM everyone that has visited the site, and anyone not MITM'd will now get a security error.

Overall this article constantly contradicts itself and merely presents out a poorly thought-out solution as the answer.
In what way, and by what mechanism, does cotton kill?
It's shocking how many people still give weight to astrology.
Can't have the law get in the way of turning a buck.
I think this is referring to using an encryption key from the TPM so that you can get to a login screen without having to type in your encryption password. (And your login credentials would then unlock your encrypted home directory).
AD is just a Cartesian lens of Jacobians and total derivatives in the category of smooth functions, what's the problem? https://www.youtube.com/watch?v=ne99laPUxN4
The really annoying thing is how browsers treat self-signed certificates as some dangerous thing, when it's really much safer (no MITM or eavesdropping) than http.
C – Transparent Aliases Proposal
It took them years to move away from Unity and unitD. They always reinvent.

Also Snap push is huge tun off for me. My next install will be Debian.
If there’s no intention of ever changing the license, then there is no need for a CLA.

A CLA is required when the repo owner wants the ability to change the license down the road without contacting N contributors.
Well now you've proven yourself as a nutcase, trying to prove the vaccine is safety tested by showing me how many doses were given AFTER they called it safe.

Goodbye.
Better than dictation used to be on MacOS. I tried some whisper-based stuff, but it lacks the integration that the built-in dictation has (so I don't have to dictate somewhere else and copy/paste). It seems in the same ballpark as whisper, but I haven't done a comparison.