skysight-inc/HackerNews huggingface dataset:
“If you look back at when CODIS was established, it was originally for violent or sexual offenders,” Anna Lewis, a Harvard researcher who specializes in the ethical implications of genetics research, told The Intercept. “The ACLU warned that this was going to be a slippery slope, and that’s indeed what we’ve seen.”

Just like the CSAM scanning people are still promoting...
As Wikipedia puts it:
Most registrants in the U.S. have registered for .com, .net, .org and other gTLDs, instead of .us, which has primarily been used by state and local governments, even though private entities may also register .us domains.

This makes .us a prime target for attackers because victims tend to trust .us more than .com. Nothing GoDaddy can do will change that.
> > Probably HN is already part of The Pile

Everybody smile for the camera, or we could just moon them, or both!
This might be fair if this was a rewrite in a vacuum (or took anywhere close to 8 months) but it wasn't. We were also undergoing a large design refresh for the site, which was going to require a ton of work on the existing site anyway. Using the opportunity to also update to the newest version of the technology we were using wasn't nothing, but I'd argue it was also probably a pretty small marginal increase.
Does advocating for revolution or "burning the system to the ground" count?
> I am just having a conversation about trust

It all comes down to trust, I think, not source code. How many of the "open source only" proponents have read and analyzed the source code? How many of them have verified that the shipping product is exactly the same as the source? Almost nobody, I suspect.

A relatively small number of people actually work on open source, even with the biggest, most popular projects. The number of eyeballs on the source is a lot smaller than you might expect.

> the vast majority of big players have demonstrated that they shouldn't be trusted

I'm not a big player, just an indie dev.
It has been a closely held belief of mine that we waste our time wondering about more intelligent life in the far reaches of space than right here on earth.
Lots of correlations should exist with your chemical, and I don't see them, so if it floats it's a witch.
Any research focusing on subjective terms such as 'extremist' or 'misinformation' is likely to be contaminated by an element of activism.
Neither, I just want a usable alternative to Twitter that isn't Facebook and has a chance of not being used only by techies.
To this day I don't understand people saying this. Can you describe a project or instance where it was tough? I never had any issues even in complicated projects with thousands of lines of JS.
Could you share a source? I'll immediately switch off my gmail onto one of my google workspace domains, if so.
I love that structs can be strictly non-copyable.

This way I don't need to heap allocate objects to ensure their uniqueness. I can still modify them in place without worrying there will be any out-of-date copies that weren't updated. Or I can give out simple ints or even zero-sized structs that can be handles/tokens that grant exclusive or single-use access.
If you've got a user who can enter a long passphrase, you don't need a TPM, so this TPM bypass is moot.

The evil maid attack on an encrypted disk with a passphrase is that the attacker installs a hardware keylogger, then comes back the next day and snatches your laptop, which the keylogger tells them the password for.

If you've got highly sensitive chassis intrusion detection that wipes your secrets at the drop of a hat, the evil maid triggers it in a way that looks like a false alarm, and uses a hidden camera in the ceiling to watch your recovery procedure.

And if you would never be so naive as to have a recovery procedure, the attack is to laugh their ass off because you needed that laptop to give the conference talk / client demo you came to this city for, and it also had your boarding pass on it, and now you're fired and you're stranded.
that should also apply to vscode extensions and most other plugin systems. and this seems to get worse? one area where apple's strategy of copying the functionality of smaller extensions/apps makes sense security-wise..
Recall that Google as a company doesn't care about making people's lives easier and better, they care about inserting themselves as a middleman in aspects of your daily life and then trying to sell ads about it. They might invent a "talk to your grandma anytime" app and tell you it's because they love your sweet grandma, but the only things that will get attention and dev work are the bits that figure out how to sell you more stuff.
I maintain an open source extension with just a few thousand users and have been receiving these offers every month for years. These people will eventually find someone desperate enough for money to do it, which is unnerving and a good reason to use something like pihole, as ad blockers can't inspect traffic from other extensions.
Just take an aggregate of every news article written in the top 100 newspapers.

That's high quality content, timestamped and about current events.

There is very little content on Twitter that compared in quality to one will written news article.
> The context was "densification if done right could even make things quieter", and Copenhagen — at least the centre and inner districts — is generally considered to be doing things right.

Which is precisely why their traffic composition is different than that of American cities. I absolutely believe that the lowest-hanging fruit in many of Copenhagen’s streets are diesel delivery trucks. I do not believe that American cities have adopted the kind of forward-thinking policies that would have reduced other sources of traffic noise to the point where those are the largest contributors.
The YouTube one doesn't, but Cloud to Butt does -- its purpose is altering text on any web site you visit, and that requires access to those sites.
Due to some recently revealed corruption issues in the USA that the fbi was covering up, there’s more drama than usual regarding funding. Expect to see lots of fbi fluff pieces until their funding is secured.
I just have a cheap tester. I've been contemplating getting a better one that can do signal testing. Maybe this is a good excuse to get one.
If you can't leave USA, you got to just get your bag and understand that you need a lot, more than what people think is normal. You can pay for private medical care it's just expensive. Like it's too expensive for people who don't inherit wealth and aren't lucky or hustlers of some kind.
Are you guys willing to overlook if a candidate does not have experience working at a UGC company before?
Threads is really nice, has a web version now, and text search coming very soon. No need to help fund insurrection at twitter.
This is HN so let's go beyond shallow outrage and actually think about what a solution would look like. I'm sure some here are involved in KYC and fraud prevention. What could GoDaddy do to prevent this kind of abuse?
Open-source projects plagued by rash of fake or disputed CVEs
Yup. And that's not the only reason.
That would seem a little rude wouldn't it?

Taking content from another site, maybe that has ads, and then displaying it in Reader next to your own ads instead?

I think it would have caused some issues in the RSS world that such a big player was using everyone's content for themselves.

I used Reader daily back then. It's strange to think my current method of manually checking sites for updates was solved so long ago.
> Twitter LLM that accurately represents the sum total of the Twitter firehose,

We need an xkcd showing a conversation between twitter, reddit, and hacker news based LLMs. Political rage meets memes meets pedantry.
Generally good as long as you target all layers.
Facebook groups has, weirdly enough, had a bunch of quality discussions similar to Reddit. Can't speak for Instagram, but FB groups are worth peeking into to follow your favorite software projects.
Wish I could create an automation, which would notify me when battery level in either of my AirPods drops bellow 10%... because sometimes when I put them in, they don't start charging. But nope, I cannot do it.
Ask HN: Living and working abroad without citizenship?
I was thinking today about the idea of moving out of the US and living abroad. I was thinking that if I made a life out of working while traveling, do I still need to be a citizen of a country? Saying this seems like a stupid question, but I was thinking that if I was abroad long enough, am I still a citizen of my home country?

Does anyone have any information about how to look at this? I guess it would be really difficult to live and work abroad without a country affiliation. Has anyone that frequents HN live abroad and if so can you share how its working for you and any points that are important?
SCOTUS should:

Limit the ability to charge unincorporated property. The government can charge persons: natural and artificial. But random property? no.

Expand constitutional protections to property based on being owned by a natural or artificial person.

Expand the 5th amendment right to just compensation, making the government pay for property is seizes and not considering civil asset forfeiture to fit the due process exemption.

And this is all for the consideration that random municipalities will try to find a way around any outright ban on civil asset forfeiture

I think the lack of seizures from financial institutions merely suspected of a crime is a damning enough indictment of the practice
is this a FAANG interview?
Additional prior art: https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition/
Only some vendors did that, most didn't. And that was back in the days when we though SSL would be useful for ID verification, which it never was meant to be used for.
The problem in that situation wouldn't be funding, it would be personnel. NYPD is nauseatingly over funded and could do their job with half their current budget, but you can't just pull thirty thousand private security contractors out of your ass.
One of the big reasons why I went with Proton Mail for whitelabeled email service when I stopped hosting my own. Nothing to scrape on the server side.
These steps above should get you on the right track with MoCA.

Specific to the goCoax adapters - are you connecting the MoCA adapters to 2.5GigE devices? If so, the goCoax adapters have an (unfortunately) not well-known-enough issue where you need to disable EEE/Green Ethernet to get a stable connection with some devices.

Screenbeam makes a MoCA adapter that doesn't have this issue, the ECB7250S02, and goCoax claims to have a firmware without EEE enabled on the adapter side if you email their support email as well.
Nest Aware Price Hikes
Announced in a Friday-before-holiday email. The dollar amount isn't likely to break the bank for many users, but as a percentage it's just taking advantage of a captive user base.

Regardless of the functionality and (IMO) great engineering of the products, it's amazing that the biz side has never seemed to care much for its community of users.
Sampling is a standard technique that produces good results
I‘m not a fan of the government running businesses but in the case of rental eScooters:

Why not let public transit have the single license to operate a rental eScooter service or at least assign that single license to one private operator (as a public private partnership)?

On the one hand the e-scooter network could (should) have a way larger service area, could be more tightly, better integrated into public infrastructure and get utilized by a way larger customer base.

On the other hand it could alleviate some deadlocked budget discussions about public transport (eg. more bicycle garages vs. a new subway line) by providing an alternative.

PS: And then rinse and repeat for bike- and carsharing.
The spec is very detailed and allows a lot of granularity. Unfortunately, real businesses often don't have set holiday schedules but rather play it by ear each year. OSM has no way to add "this business will be closed on these holidays this year, next year might be different". When lots of businesses introduced modified hours during the Covid lockdowns, there was no concept of temporary opening hours so a "opening_hours:covid19" was introduced. Older data consumers simply ignored that tag. More generally OSM is only for data that is (mostly) permanent. Adding "this business will be closed for Christmas this year" is not OSM data. "This business is closed on Christmas" can be added on OSM. But many businesses don't plan that far ahead as to have set announced holiday hours that can be written in the OSM opening_hours syntax.
Also, making change for cash transactions is also not trivial. I've been on both sides as a vendor and a buyer where this has been an issue. As a vendor, i've tried rounding down to be advantageous for the buyer for the inconvenience, but it's annoying. as a seller, if it's a craft fair or some sort of thing with small artisans, i've rounded up for a tip. either way, it's a painful part of a business that going cashless avoids altogether.
Yes, just draw some cat6 between the locations and either connect to it directly/through a switch or hang an access point off the work room end. In the latter case you configure the access point to the same SSID and password/certificate as the one in the living room while using a different set of channels so your equipment will not need to be reconfigured (you may have to manually toggle wifi to get it to connect to the nearest AP since hand-off is not part of the standard). In nearly all cases you'll be able to find some path for the cat6 which makes it close to invisible - ventilation ducts, along central heating pipes, through old conduits meant for copper phone lines, along base boards, etc. Do not use power line conduits for this purpose, that is against a number of regulations and also can cause interference and stray current flows through induction.

Why cat6? Because it is hardly more expensive than cat5 and more future proof. If you don't care about the latter and have some cat5 lying around, by all means use it but if you have to buy the stuff anyway you may as well choose the 'better' option.
the open and freely available documentation of anything is being taken down.

it is expected that we pay to know things, this is what is ultimately being reasserted.

this comes with the same techniques that all piracy, DRM, IPTV takedowns, and dynamic dns seizures and traffic blocking... because it's all the same on the computer level.

the erosion of our purported freedoms is but collateral; maybe we should forget what the internet could have been and embrace the pay-to-click world that is incoming.

it's strange that we will be able to pay with likes 'reddit karma points' and Retweets/boosts that we receive.
> You may be right that Linux is a security disaster

How so? If you run a program that you trust, like "ls", "vim", "firefox", "cat" or "rm", then you absolutely want it to be able to access all your data. That's the whole point of running a program: to read/write your data.

If, for some reason, you want to run a program that you don't trust, you can run it easily inside a container or a virtual machine.

I fail to see how this is a "security disaster". It seems very sane to me. How could it be even better?
I truly believe that the increasingly growing awareness around "supply chain" security presents a fantastic opportunity for FOSS maintainers to gain financial independence and sustain their projects by selling security assurance to the consumers on software contents, packaging, etc. I'm building this marketplace. Would love to get feedback/recommendations from my fellow FOSS devs here.
So I've been building of one of the nostr web clients ( https://satellite.earth ) full time since December last year - I agree partially with all these points and will try to add something from my perspective of being perhaps a bit too close to this.

1) With regard to message replication/ordering, the relays are supposed to reject messages that are received with a timestamp that deviates from the server clock beyond some max delta, but it's not clear they always do this. Nostr in its current state (multiple relays hosting everything and letting clients sort it out) is optimizing for redundancy over efficiency — as the ecosystem matures I think this will get sorted out. I have one idea in particular that I think could really help, but it's beyond the scope of this comment.

2) In the very early days you had to copy/paste your key into some clients, but this is not the case anymore. There are several web extensions now that hold your key securely and expose a limited interface for clients to sign messages.

3) You're right - there are too many NIPS (that's "nostr implementation possibility" for those unaware). But fortunately the only required NIP is NIP-01 which is basically just a standard for how to sign and exchange json between clients and relays. I don't think any client implements all the NIPs. In fact, there has been a lot of talk on nostr about 'microapps' (apps that specialize in a narrow use case) and that's fine — maybe because nostr was birthed in the context of being a Twitter alternative we've been thinking that all clients need to support the whole protocol, but I don't really think it will turn out that way. Since all apps are interoperable with a shared user identity, it's possible for clients to be complementary to each other in a way that hasn't previously been incentivized.

4) Regrading blob storage — that's what NIP-94 was created for. You can in principle create a "file" message containing whatever metadata you want. This can be a torrent magnet link or IPFS cid or whatever.

For what it's worth, I've personally never had as much coding anything than I have working on nostr. There's a core group of people that are very excited about this, and it's really motivating to get immediate feedback every time I push an update. No doubt the whole thing is very messy compared to a corporate-sponsored project like (for example) Bluesky. My bias is toward ecological systems tending to win in the long term. We'll find out.
Exactly this. I'm sent down Sacramento or San Pablo regularly, instead of the California or King st boulevards. Most people who ride around don't need the directions, but now and then you see someone you can tell is following them, not realizing there's a far safer option around the block.
Enjoyed it at first. The dialog and situations have gotten very unreal though.
How do you request your Zaps balance to send it somewhere else (like to a Bitcoin wallet)? Maybe this is a Lightning thing and not a Nostr thing.

I guess I assumed it was based on the private key you generated when you got started on Nostr and if that private key became compromised then the Zaps could go to whoever had the private key.

Perhaps there is a document somewhere that explains this.
yes, just like the communists. the state can seize anything with no compensation. private property assurances were masqueraded as a distinctive tenet between the systems but they’ve both converged on a discretionary ownership reality.
Gonna need some graphs that show "phishing volume per domain" here, because just saying that this is "according to The Interisle Consulting Group, which gathers phishing data from multiple industry sources and publishes an annual report on the latest trends" doesn't actually anyone anything, it's just an appeal to authority when no one has any reason to trust a consulting group to actually be authoritative.

Show the numbers.
lots of datapoints for model training?
There is no such way to define strictly correct through logic alone in English. It's really just whatever people say.

After all, we have a ton of words that mix latin and greek roots/-fixes. Eg bioluminescence, bigamy, homophobic, etc.
The bike profile in OSM routers will prioritize bike paths, bike lanes, and small streets over big highways, but there's always a balance since you're unlikely to want to bike 10 miles out of your way to avoid a busy street. That balance is always in flux and can only ever be as good as the OSM data underlying it (road classification and bike tagging etc)

If you bookmark streets that it's sending you down or avoiding inaccurately and check them out later on a computer, I bet you'll find that there's some OSM tagging issue. https://osm.org has a routing tool you can compare with as well. The OM Telegram channel is always willing to take reports on where OM routes are worse than OSM.org routes, and OSM channels are happy to help figure out what tagging issues there may be.

Cheers!
The operation was performed in concert with other governments. See https://www.justice.gov/opa/pr/qakbot-malware-disrupted-inte.... I’ve worked with some of the partners involved on previous operations and they are top notch - while like I said I think this is a legitimate argument either way (should governments have the ability to actively disrupt malicious activity), I am on the side of taking action as has been done here.
Does anyone know how much Bankman-Fried's company paid for those shares? Does this represent a good deal for Robinhood, or are they paying a premium to get them back?
Portuguese too!
Raylu | Full-Stack Engineer, Product Engineer | AI Chat Assistants (using LLMs) | Seed stage ($4M raised) | NYC Onsite only | $130K-180K + equity + generous benefits

Raylu makes it incredibly easy for software teams to build and integrate powerful AI assistants that far surpass the functionality of traditional chatbots or ChatGPT. Raylu’s AI assistants make it possible for software to be a partner that can accomplish what you ask of it, making the idea of “doing work” in software obsolete.

What it’s like working at Raylu:
- We are a small team of 4 (soon to be 6) all based out of NYC working out of our office in midtown manhattan everyday (with WFH flexibility when needed).

- Everyday we tackle new unsolved challenges (e.g. how the heck do you we make this LLM released yesterday solve our problem? how can we innovate on chat UX?)

- We work hard. We don’t believe in hustle culture, toxic workplaces, and sacrificing balance, but startups are really hard - so we put in the time and effort needed to succeed.

- We are courageous yet humble with our work. Everyday we sprint into unknown territory courageously building what we think is the thing everyone wants, but we have the humility to hear feedback, fail gracefully, and rebuild quickly.

Learn more about us, the role, and link to apply at https://careers.raylu.dev/
Russian censorship agency Roskomnadzor added "LGBT" to its report form today.

https://eais.rkn.gov.ru/en/feedback/

At the same time, there's not only a website form, but Android and iOS apps in Google's and Apple's stores (they are only linked on Russian version of reporting form)

https://play.google.com/store/apps/details?id=org.rkn.ermp

https://apps.apple.com/ru/app/%D1%80%D0%BA%D0%BD/id151197061...

Just curious, if it's OK for Google and Apple to support Russian censorship, especially anti-LGBT one.
Ask HN: Volunteering Opportunities SF Bay Area
I am interested in using some portion of my time to volunteer in organizations that could make leveraged use of Engineering or Infrastructure skills. Curious if there are some great organizations out there that can disproportionately benefit from tech skills.
As a nation we should be vigilant that we have the best and the next best tech. Acting on the implicit faith that our nation monopolizes this niche in all federally funded defense companies is maybe misplaced particularly when we begin to lose global trade power and comparative wealth.
Data pipelines was also a perennial shit show behind the scenes. Turns out integration is a lot of complexity even if the service is "simple" in concept and doesn't need to be so real time.

I feel like data pipelines and swf have been replaced by step functions+event bus+lambdas/fargate. We've furthered abstractions over time, and that's a good thing.

Edit that said no idea how they scale in comparison