skysight-inc/HackerNews huggingface dataset:
There is no key that gets handed out all over the place. Numerous people are trying to explain that on this thread. Even a purely textbook cryptography setup would involve the private keys being generated inside an HSM and never leaving it. Only the public key would be widely distributed. A public key lets you encrypt a message but not decrypt it.

The hard part here isn't key leaks. System critical keys are commonplace in our society and virtually never leak, exactly because they don't tend to leave dedicated hardware. For example e-Passports are signed with long term government keys, they don't leak all the time. The US DoD runs a large scale private PKI, no problem. Our society has even got pretty good at physically giving people private keys in such a way that they still can't access them: credit cards, SIM cards, games consoles. The hard part is the workflows around them. Ensuring the HSM only decrypts messages for authorized users and things.

Even if you assume HSMs are constantly getting ransacked, governments don't care. They don't even necessarily want to have their own key management to deal with at all. A web portal that employees log in to, type in a phone number and then see the logs is perfect for them. Make it be dedicated hardware supplied by Facebook itself if you want, with login systems as secure as they use for their own employees. Governments just do not care about these details. Type 1 Nos, to use your lingo.

The hard part of such a system is defining your precise security goals and then implementing it in ways that all the goals are met simultaneously. So called "E2E encryption" isn't really, we all know that, so there's lots of flex to define systems that meet the same goals in different ways especially if you're willing to roll with good-enough type solutions e.g. assume a trusted client (which e2e messengers do already for things like their forwarding counters).
You've gotten a little lost. Adventure is not just a synonym for "something fun to do". Sex, in the most vanilla sense of the word, isn't an adventure. It's not particularly risky, and it's not novel at all. Holding a baby is not an adventure at all.

The "global novelty" aspect of adventure (aside from the "personal novelty") comes from the fact that you're entering the unknown. The adventurous nature of an activity is diminished if it's already common knowledge what you can expect from the experience.
One fun theory is that layout purposefully included letters for the word "Typewriter" in the top row (even when fingers are on the home row). This made it an easy selling point: "see how easy it is to type the name of the object?"
To each their own I suppose. In my personal opinion, hourly billing is economically aligned to better product-stakeholder fit. Without economic cost, stakeholders seem to tend toward over requesting / flip flopping resulting in a worse product. I've experienced this in larger B2B projects where those customers who paid monthly where incentivized to filter out the things they don't need and focus on the high value functionality.
Nullstone does support this use case, all applications are private by default. In order to make them public, you would add a Load Balancer, CDN, or Api Gateway. In your case, just don't add this and your application will remain private.

We don't currently support the automatic pause of applications due to inactivity. However, we do support starting/stopping your app via the UI, API, or CLI.
>In general, why do individuals and companies appear (to an outsider) to have so much influence in the USA to 'press charges'?

They don't. Individuals and companies cannot bring charges against someone. They can report a crime (like Comcast did in this case) and then the government can determine if they want to prosecute. Someone saying they want to press charges is just signaling that they are willing to cooperate with the prosecution. Likewise saying that you wont press charges is just signalling that you won't cooperate with the persecution. In either case they don't actually have to listen to you.

>since a large company like Comcast could churn out hundreds of vaguely plausible but socially inconsequential claims of fraud

Filing a false police report is a crime. If Comcast actually testified in court then it would be perjury. They'd also likely be subject to lawsuits from everyone they falsely accused once this was all discovered.
I can't speak for many of their products, but I thought the compiler tooling (back in the 90s) was great. Either cross-develop from PC (OS/2, Win NT) targeting mainframe emulation, or compile natively running even Win32 GUI apps with recursive calls. Ignoring that COBOL syntax is verbose, it seemed almost like a normal runtime.
> We're consulting with a couple of legal experts regarding the name, and it seems that even OpenTF won't be the final name due to use of "TF" in it.

Interesting that having "TF" in the name could cause issues.

Source: https://github.com/opentffoundation/opentf/issues/273#issuec...
https://www.isopentfopenyet.dev/ is out of date! You had one job!
This is something we support as well. You're correct that most of our documentation (including quickstarts) focuses primarily on web-facing apps.

Our current modules support running Python jobs using Fargate/ECS and Lambda (using Docker containers or packaged zip files).

Today, it is possible to pause workloads by destroying the app (nullstone down --app=<app>). Obviously, that's not ideal and we do have plans to support pausing workloads to reduce costs.
During the worst of Covid we were making $herb $meat, following the pok pok thai basil chicken recipe using whatever herbs we could get at the farmer's market and whatever meat showed up in our weekly grocery box. The best was shiso lamb, though I don't think people who can source Thai basil will have better luck with shiso
Performance and Compensation (For Eng Execs)
It was maybe 5 minutes late, but that is pretty decent seeing as most status pages are never updated ... ever.
Here's the challenge I ran into, so I'm curious how you handle it...

If you bill by the hour, first they fight you over the hourly rate. Then they want to argue over how many hours it will take to do the work. Then they want to argue over you billing them for all the project management and planning hours you are spending with them, they only want you to bill them for "the work." Then when they get the bill they want to argue over the hours you bill them.

And before anyone says "find better clients" I found this in everything from Fortune 500 to mom and pop. And Fortune 500 is net-180 regardless of what's in the contract.

I was spending so much time in this kind of BS that I went to a monthly retainer model. You get access to me, but you are doing so in a way that we can both set aside haggling over hours. For the smart clients it was a great deal and it saved me a whole lot of accounting overhead.
OpenTF core member here. If you're comfortable opting into an ecosystem where most of the key products are offered and supported by a single vendor (in this case, Hashicorp), then yes, there are no licensing issues to worry about and basically nothing needs to change for now.

But our philosophy at OpenTF is that users would rather participate in an open ecosystem where multiple vendors compete for their business. If you're not happy with one vendor, you can easily switch to another; competition works to make all vendors better.

When we look back at this comment a year from now, I'll wonder how your company will feel about the responsiveness and new features they're getting from Terraform Cloud when the primary incentive to stay is not because you think it's the best product available, but because switching costs are so painful.
GPT-4 vision finally rolling out to Be my Eyes users
aside from the examples in the thread, He was taking requests and i thought these were impressive

https://twitter.com/j_stonemountain/status/16987819625744466... (describing each panel of multiple comic book page accurately incl text)

recognizing English cursive

https://twitter.com/j_stonemountain/status/16990947849404212...
Here are the concerns I care about at this time:

1. If Device Attestation/WEI takes off, and if it takes this new time-limited support lifetime into its attestation signature, then we'll see more physically healthy devices sent to the landfill. Devices that are reasonably fine for grandpa to play Mahjong on, but Google won't let her visit Facebook because WEI can't guarantee them their ad dollars, then it'll go to the landfill. I don't want to see this waste. I want the "support lifecycle" of a product to be the FULL lifecycle, including mandating a recycling program or something of the sort.

2. I want guarantees that I can keep using an old device after its support window closes. When Google decides to sunset the Nest Doorbell, I want to own it and be able to run it myself.
If you ask an average consumer about their IoT devices' security updates their eyes will glaze over. I imagine the average car buyer in the 1950s would react the same way to talk of "crumple zones." Consumers absolutely need to be protected from corporate negligence here.
I don't think the one who's seen "hundreds" of examples could have done so without being an "Agile coach" or something, maybe a temporary contractor at most, either way getting a pretty arms-length look at how a team is operating or is starting to adopt a new procedure.
That's hilariously off, much like how the "market value" of rare earth asteroids is in the $trillions... due to a shortage that wouldn't exist if we could mine said asteroids... the value of the helium is much, much higher than $100M.
The proposal in question is a voluntary labeling program. If a company did not want to participate they would not have to.
Solution to this is to leave it in a quarantine room for up to 5 months (if you have the space).

Though and I say this anecdotally, when I moved back to the States I ended up refurnishing most of my house using street finds. We're talking like 10 different furniture finds include a futon frame (we bought a new mattress). Only 1 of those was upolsteres but was in great condition.

No bed bugs, I got lucky.
Exactly. I've been looking for bookshelves and wanted something that wasn't just Ikea's Billy. The price jump to something from Pottery Barn is 3-4x the Ikea price, but from the quality you see at the showroom, it should be closer to 1.5-2x the price. I also feel a bit jaded from the mid-tier furniture showrooms, which offer Wayfair quality at 2x the price. I just want something that will survive a move while not having to look at payment plan!
I am not clear how "all the points you brought forward also apply to the manufacturer firmware"
Yes. Earlier in life, especially before having kids, my job required me to be up closer to 5:00 and then on weekends my wife and I would sleep until maybe 8:00. That back-and-forth every week, trying to get back into the routine on Sunday night into Monday morning, was terrible. Now I'll get up at 6:00 and run even on holidays.

Starting to get up early will just suck for the first couple of days. I think there's no way around that.
Thank you, I'll enjoy watching this
Remembering user preferences are very different; I didn't bring them up and don't disagree there.

My claim is that many things users might expect to be retained are not automatically ok to retain, and that shopping carts as typically implemented are one of these.
Harvard should have their lawyers counter sue once this lawsuit is thrown out of court. Their reputation as a premier Ivy League university is permanently stained because of her actions.

Probably won’t happen but would be a satisfying end to this saga.

Also, I wonder why nobody is selling a liability insurance policy for journalists and researchers. Too expensive? Too niche?

Underwriters can find the litigations against certain orgs and individual journalists/researchers and determine risk and premiums.

As a researcher, have costs of premiums covered as part of grant or story. Much better to pay a couple thousand in premiums rather than $600K in legal fees.
We appreciate the honesty, but more importantly, we appreciate the willingness to try another one out. We welcome your feedback to see where we're doing things right or wrong.
Pair programming a game with GitHub Copilot and a human
Lovely! Thank you so much
I remapped the left spacebar to cmd for my Mac. Makes keybaord shortcuts much easier on the hands.
I picked up the Miryoku layout a year or two ago and the home row mods (Ctrl, alt, shift...) make all the difference. Adding a thumb key into the shortcut to hit a key on a layer doesn't take much extra mental energy and it becomes muscle memory for certain shortcuts. It's a little like playing different chords on the piano. I added some customization for Vim arrow keys and now I don't think I'll ever go back.
there are many parts of this problem, I have particular thoughts on two.

one concrete recommendation I would make is mandatory third party pen tests. software companies have to do this for soc2, etc. Companies putting live mics in living rooms across the country should deal with the same. This is all to raising the level of initial security on devices, including the update process.

the other consideration is about updates, and its much more nuanced against what's viable for a business. there is no security without updates, but the ability to produce those on any schedule is unclear. even more so when the originating company goes out of business. Ideally there would be a threat matrix here against a CVE list (remote access to hot mic/camera), would require a manufacturer to issue an update within x days.
Well, on Wikipedia you can read "Random process independent of past history" and "a stochastic model describing a sequence of possible events in which the probability of each event depends only on the state attained in the previous event." honestly I would not consider the entire context window to be part of a single event, since the model generates tokens one at a time, separately.
Life in hot and humid client is definitely possible without air conditioning, but the mass migration of Americans to Florida and the southwest shows their expressed preference is to live in climate controlled homes in sunny places. https://www.nytimes.com/2017/08/04/upshot/the-all-conquering...
Users update their phones, there's no reason they can't be educated to update their other devices
> If consumers actually cared about their IoT devices receiving security updates, companies would be doing it.

This seems like a crazy response to me.

The _entire_ program is _voluntary_. If a manufacture doesn't want to jump through any hoops the only downside is that they don't get an "FCC cybersecurity" label on it. So if the customers _actually_ don't care, then don't do the program and don't get the sticker on the box.

The _only_ reason for anyone to complain about this program is that customers _DO_ fucking care, and _want_ to be informed. Customers _want_ to purchase more secure products but do not have the option, and do not have the information required to do so.

It's not even a mandate that they have X years of security updates. They just have to _disclose_ how many years of security updates they are providing. They could disclose that they provide 3 months of security updates if they want to. If that hurts sales, it's only because PEOPLE ACTUALLY CARE about this.

If your theory is accurate, then this proposed rulemaking would have 0 effect on industry at all.

> As a consumer, I do not want the FCC mandating what features will be included in my IoT devices.

That's not the proposal. The proposal is the FCC mandates what features are included in your IoT devices that have an "FCC cybersecurity" label on it.

> If they meet certain criteria for the security of their product, manufacturers can put an FCC cybersecurity label on it. I fought hard for one of these criteria to be the disclosure of how long the product will receive security updates
Show HN: Atticus AI – Negotiate consulting contracts faster using GPT-4
Hi HN,

My name is Darlin and along with @controtie we’ve been working on an app to make contract negotiations easier for consultants, freelancers and other individuals.

Earlier this year we began consulting and found it exhausting negotiating contracts back and forth, especially when we were starting out and didn’t know what we didn’t know.

Coincidentally, we were building a bunch of LLM apps and thought LLMs would be a great tool to build an app that parses and makes working with contracts easier.

So far Atticus does the following:

(1) Pulls out the most important terms so you don’t have to waste time.

(2) Explain legal terms in simple language.

(3) Highlights potential red flags.

(4) Helps adjust terms in your favor.

We’re still a long way from where we want to take Atticus but would love your feedback!
> the response was it never goes down.

Seems those folks maybe have never used GitHub in any larger capacity. They've been having issues constantly for a long time now.

September - 7 incidents

August - 17 incidents

July - 11 incidents

June - 13 incidents

And so on. Last time they had less than 10 "incidents" was December 2022.
A500 has broadest compatibility of those listed. A1200 is the most capable of those listed (A1200 and A4000 had the upgraded "AGA" graphics chipset) but for emulation it doesn't matter so much as the emulators tends to offer expansions (like e.g. emulated "Picasso" graphics cards for something closer to modern resolutions and colours).
Helium too [1] although definitely also neon.

[1] https://cen.acs.org/business/specialty-chemicals/War-Ukraine...
The person who actually did the hacking and leaking of classified documents were only charged with 35 years and was out in 7. The maximum penalty he faces is 170 years in prison, not execution and technically not a life sentence, and depending on the facts of the case it could be significantly less than that or even none at all. Saying he's facing execution is a lie.

He holed himself up and has been sitting in extradition proceedings because of his own choices. In the timeframe of his fighting against ever seeing an actual courtroom for the espionage act indictment, his fellow alleged co-conspirator who probably did more of an actual crime already had a trial, served a prison sentence, and is now a free person again. Its quite possible if he didn't hole himself up for nearly a decade and continue fighting extradition he'd already be a free person.
>Please do not propose this regulation. If consumers actually cared about their IoT devices receiving security updates, companies would be doing it. The fact that companies are not already doing this is evidence it's not important to consumers. People may express frustration, but their purchasing behavior speaks louder than their words.

In 1980 11% of American adults used automobile seat belts.
Yeah, and they must have some personal responsibility to resist that pressure
> They don't know these things because they don't care to know

Or they don't have the time or wherewithal to study for a test for whatever reason. This is the problem with trying to apply a standard to 300 million people - if 0.5% of people are the corner cases, there are 1.5 million corner cases. There are actually 14 million households in the US without internet access.[0]

> I don't see that as 'not letting' them vote. It's more 'if you really care about voting you'll do some basic due diligence first

The fact is that in order to implement this, you would have to turn away people who show up to the polls having fulfilled their end of the social contract (paying taxes, following laws, etc.). You lose the consent of the governed. And even that ignores the question of who would write and grade the test in the first place - the US has a sordid history of literacy tests being used to intentionally exclude certain groups from the franchise, and you'd have to find someone (definitely not Vivek) who could be trusted to do that job. Having the best of intentions doesn't matter when the choice of which questions to include/excluded can swing elections and disenfranchise millions.

[0]https://www.lendingtree.com/home/mortgage/internet-access-st...
Developing on and for Chromebooks is a terrible experience
I frankly don't understand how the acquisition of Bucherer (retailer) aligns with Rolex being a non-profit.
An NY Times article about Claremont quoted one of Jaffa's sons as saying that the institute wanted to put a robe on Ayn Rand and call her Aristotle or a top hat on Jefferson Davis and call him Lincoln.
First and foremost I applaud the effort. I think this is a worthwhile concept. However, I think this is something that would be better if the FCC delivered a report asking for specific things to congress. Because while we can look at this just through the IOT lens I think that's very shortsighted. There are CNC shops still running DOS and Windows95. So what happens when the new fancy CNC they are buying today running Windows 11 embedded goes out of support from MS? These are things that are intended to be in use for 30+ years.

So to me there needs to be a formal process in the law for dealing with abandonment, and minimum support duration.

1. Minimum support duration: This needs to be in federal law and enforced by private right of action, and more specifically one that cannot be waived or arbitrated. This cannot be something that the FCC or FTC must enforce. This must also be binding with valid legal remedies if the company fails to comply or no longer exists. Which leads me to my next point.

2. Abandonment: The law must require that if an OEM abandons a device that sufficient information (including PCB schematics and PCB BOMs!) are made public that both individuals and third party commercial operations can supply support. Again, this must have legal remedy to enforce. My preferred remedy if a company completely fails to provide anything is loss of copyrights to that specific software. Thus negating all the digital locks provisions of the DMCA in regards to that specific hardware. If the company provides the necessary information under an appropriate free software and/or documentation license then they maintain all copyrights. They only need submit the information to the library of congress and a third party such as archive.org; they do not need to host it themselves. Nor would they be required to provide any support after that point. Furthermore, any components not currently in production would have to be made available until such stocks are depleted.

Having a formal abandonment process for a device including a formal notice of termination of support, and releasing appropriate documentation and necessary information to the public provides a massive boost to both ongoing security but also to reducing waste.
Game development adds another dimension. A musician I know helps small indie artists with music as a side business. His contract states a fixed number of hours producing the music and effects is free, until earning some 100k revenue / month, when it starts costing 0.1% of revenue royalties / month. He has fun with it, it's usually free, but if someone makes the new Minecraft with his music, he will get his share.
Rockstar is selling cracked game copies on Steam
Which is why you have clear boxes on that fixed-rate, and stepping over those bounds means you're back into T&M billable. The legalese on these contracts needs to be quite tight, but it's a one-time expense to set that up, and it's best done properly (and updated as new edge cases show up).
Framer is a design tool, but Puck is a content tool. We're focused on allowing content teams to create pages using existing on-brand components. Like a WYSIWYG with guard-rails.

We built it because we couldn't find something that would let our clients' content teams produce content for their sites without 1) either going off-brand or 2) pestering their devs for layout changes.