skysight-inc/HackerNews huggingface dataset:
This is a much needed area for development, most of my extension projects are held together by glue. However, I'm not entirely sure what Bedframe does at first glance. The docs page says coming soon and just 404s, the homepage is just a splash page with an email form (that does not actually seem to submit!) I'll read through the code at some point, and it looks like the individual project READMEs are more fleshed out, but definitely needs a better upfront explanation of what aspects of extension development it's trying to solve.

EDIT: It's also very unclear what state this project is in. The README has instructions for getting started with the CLI, but also says that I should sign up to join early access? Is this ready to use? What aspect of this project requires membership? Is there a hosted component or subscription model hidden in here?
Seconding this thread. There is no reason why a device shouldn't be servicable in 30 years regardless of whether the vendor is still in business.

There might be a way to integrate these IoT regulations with e-waste regulations, where the liability for disposal, recycling, and cleanup is related to servicability.
My metahobby is collecting hobbies.

No really, I realized years ago that I had to embrace the change and I try to dip my toe into any hobby that appeals at the time with as minimal monetary outlay as possible. I find interests tend to resurface after a while, and the skills/tools/materials for one can generally be used somewhere else down the road.
Tbh, I think this will add unnnecessary regulatory burden for start-up companies.

Take for example general IoT cloud connected equipment: it will get security upgrades more often than one that is completely offline. That was a big selling point of the Meraki cloud offering that is now part of Cisco. There would be millions of unpatched networking equipment, but Meraki could force upgrades onto networks without them managing the patching. The result being they would have secure products, and the non-cloud providers would have to rely on their customers to update their phone. The meraki solution was by definition a better upgrade path than the standalone solution. Why would you burden them with regulatory hoops that non-cloud devices do not require?

When you buy an IoT device, you're taking on a risk on anything not open source, and betting that a product/company will succeed. For example, I bought some cube sensors to monitor my home air quality. These sensors are now garbage because they connect to a closed cloud that has been shut down. They don't even function let alone get security upgrades.

If anything, non-cloud connected IoT devices are more likely to cause problems.
I would think that tort law already achieves this - unless some law was passed that shields manufacturers from lawsuits. If that's the case, then the easy fix is removal of such shields instead of trying to create new regulations. Same applies to nearly all aspects of product liability.
I could not agree more. What I would love is the Microsoft sculpt keyboard but with low profile mechanical switches and a wired connection.

The closest I've found is the Perixx PERIBOARD which I have not yet tried in person. If anyone has other suggestions, it would be much appreciated.
I am trying to think through this from a neutral standpoint. After all, some of the tech world has put in significant effort to silence conservatives on platforms at scale. It's somewhat painful to see even if I am not a conservative.

Personally, I only follow things I like on Twitter which means I don't see any hate speech. It's hard for me to anecdotally say if things have changed. But it's not hard to imagine that chronically-online groups who have hate for Elon and his companies would try to crumble his social network because they don't agree with his approach.

This feels like a really slippery slope. Hard to weigh in honestly.
I like this approach, it doesn't necessarily need to be just the "market" performing the audits however. The FDA handles audits of medical software companies just fine. Focusing on the Quality Management System and their Risk Assessment/Security practices seems like a solid approach, and of course centralize this data and make it easily searchable as much as possible, and provide API access to it in case vendors like Amazon want to integrate it and display certifications/grades for products/manufacturers automatically.

All that being said, I have no idea how much manpower or money it would take to do audits at that scale, or even what the scale of IoT Devices vs. Medical Devices is.
I can see it being useful for audiences who know what they're looking for. As an average retail consumer, if I saw such a label I would either have no idea what it means or have to do my own research about what UL is - not to mention the impossibility of them enforcing anything. I guess they could remove the label but how would I know a product I'm using has violated their commitment - routinely check a UL website?
I've been a consultant for 15+ years and have often come to this conclusion that hourly billing is not ideal for various reasons. I haven't found a great alternative, and the problem is I'd want a great alternative I could enthusiastically sell to my clients. "Always do fixed price" doesn't seem feasible when scope is not fixed, fixing it would necessitate time-consuming research and waterfall style project management, and clients often don't know scope until they have tangibles in hand. (ie "this looks great, but can you do this "little" thing we invision in scope, but you invision out-of-scope-but-not-worth-arguing-about"")

I feel like a retainer of sorts may make sense, but that seems a hard sell for some projects. "Make us this 5 page app that does XYZ". "Ok, pay me X/mo forever". Both consultant and client would need an exit that I'm not clear on. Also, to be honest about it, the consultant should limit their clients to some reasonable number so that they can serve them in reasonable time.
What's interesting is that her suit doesn't seem to counter the accusation of fraudulent data in her research, but rather that they can't prove it was her that actually did it. She seems to be expecting a former lab manager that worked for her to take the fall, even though she was the lead named author of the research.
In software, all problems are research and development problems. (If it wasn't, it would already be solved now.)
They are also (arguably) selling software written/designed/intended for the express purpose of bypassing copyright protections, which as I understand is in and of itself a no-no under the DMCA regardless of underlying ownership.

I ANAL of course.

edit: per the sibling comment the crack might not be included, so this might not apply.
Fake vegan meat sometimes manage to mimick the appearance from far away but it never taste like meat.

I am not vegan (and yes I accept we are predators and kill other animal to eat their cadavers), but I also do like some of the vegan substitutes...but for the very reason they taste differently. They don't even taste close, they are all very far and taste closer to a lix of lentils and chickpeas than any meat.

And I don't need them to be named like meat, I am buying them because they are not.
The essential read: https://sino-platonic.org/complete/spp171_chinese_writing_re...
Side note: arbitration solves this. It costs less than open litigation and resolves faster. If you can bind a wealthier counterparty to arbitration, in general, do it.

Some groups have led a terrific PR campaign against arbitration, and it’s led consumers to blindly give up a good tool. But anyone who has litigated or been sued will appreciate its value.
I think this sub-thread is getting a bit confused.

Firstly, nothing I've proposed demands unhackable organizations. That appears to be a requirement you invented. No security system presumes that! The so-called E2E encryption systems are hackable via several different organizations today: you could hack Meta client teams and insert code into the next releases, you could hack Google/Apple and tamper with the code as it gets shipped via the store, you could hack a phone OEM and insert a backdoor into the devices themselves.

Secondly, if you think government agencies would get hacked more often than tech firms then you may be right, but that's also irrelevant to any points being made here. The goal here isn't to design a perfect system, it's just to point out that the claim that no system can exist at all isn't true. Responding to that with "but your comment doesn't contain a full design doc for a system I personally judge as perfect" isn't going to get us far. Governments don't care if the system is perfect, right? They're OK with some leaks from hacked police departments.

Thirdly, I haven't even been making concrete proposals! Just pointing out how cryptography works as examples. If I was hired to implement these requirements tomorrow I wouldn't do things directly in those ways, they're oversimplified, hence the references to textbooks.

Finally, the point about mass leaks was about "every other form of electronic communication" so responding with a staff database that was stolen by China and never leaked onto the internet isn't a great counter-example (not a leak from a police department, not private citizen communications). Police investigations are targeted anyway, so there's not much to leak. NSA isn't targeted but they apparently can keep their metadata databases secure enough, even if they've sometimes lost control of PowerPoints or malware caught in the wild.
Should have factored out the project name into a build step to make things easier for the next fork
My version of the test was to have each candidate pick 3 issues and provide their desired solution (where solutions may be vague: negotiate X, investigate X etc) Each voter must be able to pick names of the candidates and which issues they chose in a multiple choice test. (I would also like it if people got some money for passing the test as I suspect the people not voting and the most uninformed voters could really use some money.)

The point is simple, if we need you to chose you need to know which choices you have. It is not more but less democratic if you chose randomly.
I work in an adjacent area, and this is the most useful and information-dense summary I've read in any forum in at least a week.

Word!
Web Captioner will sunset and be open sourced on October 31, 2023
> and the fact that things are breaking the test suite left, and right

Branch protection doesn't allow merging without a passing test-suite.

> The squash merge is not going to solve the lack of proper commit messages

Could you expand? You choose a sensible commit message on squash, while the PR's commits become fairly irrelevant at that point.
Yes it's inference only (and usually pretty slow at that).
Pretty cool.

I haven't really explored WASM hands-on (I'll give this guide a try) but, given that it's already been a few years, I think it's been hugely beneficial for web development.

Not the "JavaScript killer" some where hoping for, though it was never meant to be one. Instead it integrates pretty nicely within the existing ecosystem, optimizing existing use-cases and allowing new ones when heavy computations are required. Net benefit for all web devs - faster libraries, impressive dev tools and more portable node binaries.
I think that's exactly it, a 'straightforward rename' shouldn't consist of 20 commits with crap messages including 'missed that' (+ merge commit).

But tonnes of people don't care about git hygiene or using tools well in general, GP's in for an exhausting time caring about it much in projects they're not in control of.
> getting 3 or 5 times the energy

What do you mean '3 to 5 times the energy'? By what measure? How does that work? What's the cost? What are the risks?
A regulation that would force companies to release source code in case they go out of business. A form of escrow maybe?
I have several paperweights that used to be "smart". And several others that still work but will never get another update.
If legacy systems weren't designed to be tested then it can very well be that they're very difficult to test. I've never seen anyone try to apply TDD to projects modifying those systems. Seems like it'd be an exercise in frustration!
Date Me Doc Directory
The client is happy because you solved their problem. Now they can take that solution and earn money on it, or reduce their ongoing costs, etc.

If your bid is more than the problem is costing them, they won't accept the bid.

If your business model is "inflating fixed price bids" rather than "solving problems for clients" then sure, you won't do very well in the long term.
Incline Village is the closest you can be to the Bay Area and still live in Nevada. It's where a lot of tech folks go after they exit or if they get a remote gig because then they don't have to pay income tax, but are only a 3-4 hour drive to SF if they have to go in.

It also has great schools.

So you end up with a lot of moneyed California ex-pats there.
"As far as I am aware, in US law, there is no subject code specifically for and simply for possessing/receiving pirated material"

You have to look at the case law.

This article on contributory infringement seems relevant and states:

"One who knowingly induces, causes or materially contributes to copyright infringement, by another but who has not committed or participated in the infringing acts themselves, may be held liable as a contributory infringer if they had knowledge, or reason to know, of the infringement. See, e.g., Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 545 U.S. 913 (2005); Sony Corp. v. Universal City Studios, Inc., 464 U.S. 417 (1984)."

https://www.law.cornell.edu/wex/contributory_infringement#:~....

"This is why, during the MPAA/RIAA war against p2p, they specifically targeted the fact that all users were mesh sharing files."

They probably did that because they wanted to make an example of someone, so they went with whoever would be easiest to win a large judgement against. If someone merely downloaded a copy, the judgment against them would be smaller.

I certainly don't see how someone downloading pirated content isn't a contributory infringer at the very least.
FAA issues nationwide ground stop for United Airlines flights (lifted)
I have a similar arrangement but I look at it much differently than you.

The retainer allows a client the freedom to contact me over what they think is nothing, because it is nothing, but 9/10 times that nothing will lead me to discover some issue that did need my attention, and I can give it that attention when it's still a nothing and not a barn-on-fire problem in their business. It also means I can log a trivial amount of hours doing the monthly maintenance that most clients gripe and piss and moan about you charging for: they already paid me. If a retainer hasn't been used up by the end of the month (and it usually hasn't) that's when I go do housekeeping for them.

Client gets a consistent-ish expense in their books, I get paid, everyone's happy.

> If you bill by the hour, first they fight you over the hourly rate. Then they want to argue over how many hours it will take to do the work. Then they want to argue over you billing them for all the project management and planning hours you are spending with them, they only want you to bill them for "the work." Then when they get the bill they want to argue over the hours you bill them.

I mean this is just the game, dude. I personally just do not have these arguments, I'm not open to these discussions. This is the price of my time, this is how much time it took, this is the bill. If people don't pay then I don't perform services and anything I have access to goes down until I will, but I've only had to do that once so far, and they got the point very quickly.

If you don't want to do this then yeah freelancing/contracting isn't going to be your bag. I don't judge you for it but like, that's just how it goes when you're in business for yourself.

Also worth noting: I absolutely charge for time spent haggling. Any time I'm doing thinking work for you, that's time I will be compensated for. I outline this very clearly from the off, and if people drag it out over hours, then they pay for those hours. Simple as. I'll never inflate my hours or make something take longer than it does, but also, I demand compensation for what's spent on their whatever.
IANACellularBiologist, but while that vaccine doesn't use mRNA (it uses a crippled version of another virus) the goal is still to get some cells calmly exposing spike proteins on its outer membrane... so I'd still group it together in the "should be easier for your body to find and dispose of the spike proteins" category.
That quote alone is why I am glad I did not read the article in full.
It's really slow. YouTube works but browsing is really slow overall. I installed Manjaro with KDE on mine and quickly changed to i3 because the trackpad isn't that good so moving windows around wasn't really fun. When I got the graphics drivers to work, Alacritty ran pretty good and I used it for coding. I wouldn't recommend it for any serious work.
> I would love it if the lawmakers considered this scenario.

You're building on quicksand, and you're asking for us to give you leeway when the building collapses.

Either do the work of making all of those security fixes yourself, or pick a better platform to build on top of.
I am not a fan of this idea as it would only contribute to eWaste, but I think one aspect I can get onboard with is a clearly defined expiration for updates.

I think we would be getting too far into the weeds to specify what "security updates" means as there will always be ways to work around the language, but the fact that a manufacturer will guarantee a certain expiration of updates would be better than where we are now. If a vulnerability is discovered before expiration, presumably it would give the market and consumers leverage to hold the manufacturer's feet to the fire.

I think no nonsense update expiration dates is a very easy win.

Bricking the device after expiration or if it can't communicate is just a non-starter for me. Many devices can find a second life if manufactures were incentivized to open their hardware vs close it. Under a brick after expiration scenario I worry manufactures will be incentivized to lock down or prevent tampering to avoid exposure to torts that this rule might open up.
My genuine reaction to this was "holy shit! this cannot be real!".

After that I had to read your post carefully to notice that it has happened in 90s. But still, I was alive back then, it is not that long.

Thank you for this info, we still live very close to the Middle Age...
Robbing a bank is more likely to set you back substantially (infinitely?) via a stay in prison, which is not likely to average out in your favor. But in some cases, ethics aside, it could conceivably be the rational choice, and that doesn't seem so surprising.
Good question. The Notice of Proposed Rulemaking has a Legal Authority section that discusses this issue https://www.fcc.gov/document/fcc-proposes-cybersecurity-labe.... I also touch on it here https://news.ycombinator.com/item?id=37393316
> * Devops engineers with Ruby experience.

You have a Sr. Platform Engineer[0] listing that is looking specifically for Rails, and not just Ruby. Was this the position you're referring to, and is Ruby experience sufficient, or is Rails a hard requirement?

0: https://www.aha.io/company/careers/current-openings/sr-platf...
I think at this point my hypothesis is definitely erring towards them being hopeless goons.
Piracy Warning in Xenia
If Amazon etc. was partially responsible for checking the database for you and ensuring listings are properly updated in a reasonable timeframe then it would be more accessible for the average consumer. Even if a consumer doesn't know what UL certification means, if product A has it and product B doesn't and they are similar enough in price, the consumer may opt for product A.

Edit: Reasonable timeframe should probably be dependent on the size/scale/competency of the marketplace platform. In other words, Amazon should be held to a higher standard than a low traffic web store.
The main issue these days is the 5GHz band that might interfere with radar. That's mostly an issue outside near an airport, that is, it affects practically nobody, so the solution is to snoop the problematic bands and disable them when detecting radar signals, and use them otherwise for a bandwidth boost.

These days this seems to be mostly done in wifi chip firmware (that is then signed and under lock and wrap to make it tamper proof), but back in the day it was too easy to circumvent the mechanism.
its an ugly way to frame it, not disagreeing.. but there is more nuance.. and that is, the naming of the offence, the context, MOTIVE and EVIDENCE are all malleable to the skilled barrister..

it is ironic that the English did pride themselves on the law as a basis of civilization, yet in modern times we see this
I think you make a very valid point, so thanks for raising it. This isn't the first time today I've received this feedback.

I've historically used github pages and found it kind of lacking. Many repos will have a completely separate branch for the static site -- which feels awkward and hidden. Further, not every static site needs an associated GH repo, especially for prototyping. There's friction there and doesn't perfectly line up with use cases I've had on previous projects.

For example, I can create an unlimited number of different static sites using a single repo with pgs.sh. Things like monorepos with many static sites are comfortably in our wheelhouse.

Especially when it comes to prototyping, I want something that I can spin up very quickly, without the ceremony of creating a repo, creating a static site project, installing tools, setting up CI, etc. pgs.sh doesn't need any tooling or external services to be fully usable on its own.

For example, I'm building a static site generator for git (https://pgit.pico.sh). When I was prototyping, I didn't want to immediately setup static site hosting through traditional means. I just wanted my prototypes published so I can see how it looked.

The north star here is: what is required to publish a static site? With pgs, it's just an SSH key-pair. Having said all that, ease-of-use with GH Pages is right up there with pgs.sh and I see how we are competing with that excellent service.