skysight-inc/HackerNews huggingface dataset:
One imagines an AI replacing an engineering company would not hold meetings, it'd produce plans, schematics and software.

I won't expect the robot manager to have a robot secretary, who complains to the RR department when manager makes inappropriate remarks.
It's supposed to show that all colors are supported. You can program it to what you like.
I think Wayland is a different beast because unlike SSH, it involves the kernel.
https://vi.aliexpress.com/i/1005003128735735.html
How will the regulations keep up with evolving security best practices?
You as a customer can already give the manufacturer that choice, and simple refuse to buy from any manufacturer that doesn't comply.
I wrote this is another post but it's not clear to me why caste discrimination isn't considered religious discrimination which is already protected so what exactly would adding a new protected class achieve?

There are more categories than just the ones you mentioned for a protected class. They also include race, gender identity, and ethnicity. I don't believe caste should be a protected group in the US. It opens the door to suing people, who are not even Hindu, arbitrarily for caste discrimination under legal concepts like disparate impact. It also opens the door to arguing that caste should be included in DEI efforts. I don't think it's a significant leap between these two things, it's inevitable even.
I don't think it has to be part of the network interface. You could have an ethernet-connected device that emits RF for some non-networking purpose and I think it would still qualify.
Yeah, but Textract uses OCR/computer vision even in PDFs with embedded text data and it can extract tables incredibly well. I believe there isn't an open source equivalent. Maybe some advanced usage of tesseract?
Windows has had regular CA updates for about two decade now. If anything, Android works more like Windows at this point.

Microsoft has also added tons of DRM to Windows (which they later broke). Remote attestation is built into the OS as well.

Google has inconvenienced Android developers by altering the Android internals you weren't supposed to rely on anyway; Microsoft does this all the time as well.

We may need to wait a few weeks for an updated Magisk module. Honestly, it's really notm that bad. Just don't click the update button on the five or six devices that will receive Android 14 before then.
We fought an entire war over "no taxation without representation".
Planned or unplanned obsolescence is good for business. You are proposing regulations counter to that, so should expect counter-pressure, even for IoT makers that want to do the right thing.

Great points. From one perspective, we can't afford to do this stuff; from another, we can't afford not to. If connectivity makes your life a little easier for little risk, that's one thing; if your dishwasher steals your identity and sells it online, that's another.

My concern would be low quality, usually cheaper, whack-a-mole mfrs that come and go on Amazon, eBay, etc. Even if they release a product that would fall under these guidelines, how are you going to go after a ghost?

Another great point, but that's a snapshot of the market as it is now. We expect certain standards from some things but not others, depending on how much you depend on them, how much is at risk, and what the costs would be. Right now, under the proposal, a company is 100% free to say "I will support this for 0 days and you expect it to ship broken from the factory" -- it's just that they actually have to say that out loud.

Also, what happens when an IoT mfr is acquired, does the acquirer assume all the IoT risks as well?

I expect this to be a hot topic on the record. We'll see what technologists, manufacturers, consumer advocates, etc. say and try to come up with a proposal addressing stated concerns.
Imagine paying the lowest bidder to deliver something and then complaining when it's late or in the wrong place. I can see the problems they face, but not hiring a professional to do the job .... isn't the solution.
Although not specifically about the PT requirement, some stuff on the helium shortage across healthcare, research, and business.

NBC: “The world is running out of helium. Here's why doctors are worried.” https://www.nbcnews.com/health/health-news/helium-shortage-d...

Radiological Society of North America: “Keeping An Eye on the Potential Shortage of Helium for MRIs” https://www.rsna.org/news/2023/january/helium-shortage-for-m...

The Harvard Crimson: “Helium Shortage Forces Harvard Physics Labs to Shut Down Equipment, Suspend Projects” https://www.thecrimson.com/article/2022/6/24/helium-shortage...

Marketplace: “Party City’s Bankruptcy partly due to high cost of helium” https://www.marketplace.org/2023/01/19/heliums-been-rising-i...
From my (USA American) viewpoint, caste discrimination seems very close to discrimination based on national (or group, e.g., Roma) origin. I would not be surprised (but do not know) were some instances of caste separation historically based on national origin.

How does caste discrimination differ from discrimination due to national origin (other than the fact that it obviously does not go away after multiple generations b/c inter-caste marriage is taboo)?
That's a good point. Still, I think that's different from an AI agent attending a meeting "for you" as a surrogate. If I were in a meeting where someone sent their personal AI assistant instead of attending, I would be insulted. I'd much rather someone send me a note explaining why they can't be there and letting me know anything they want from those of us in the meeting.
Thanks for this great observation. I encourage you to share it in an official comment. In a final rulemaking, perhaps we could make it clear that the purpose of the label is not only to protect the purchaser of the product but also anyone who might be injured by way of a compromised device. In an FCC enforcement proceeding, we have broad discretion in assessing damages. In contract, the third-party beneficiary doctrine could allow victims of such attacks to enforce label commitments. And in tort, statutory duties apply to anyone who is within the class of people that the law seeks to protect. So the law is flexible here, but it depends on what exactly our final rules say.
>building a CPU from scratch might not be a good idea for a young audience

It depends on the audience.
Perhaps such a person has been consuming too much marketing speak.
I have a lot of problems with getting the title of an URL. It worked, no longer does.
I personally haven't experienced the same, ChatGPT and GPT4 via API seems mostly the same as before. Here is an example system prompt I'm using for some programming tasks:

> Repeat what I've set as the requirements in other words to ensure you understand it. Describe concisely at least two different approaches you could take to solve the problem while explaining the reasoning for why it's a useful approach. Chose the best approach, then think through how the problem could be solved step-by-step. Finally implement each step and provide a full solution.

Yesterday I used that to build (iteratively) a Rust CLI that downloads the last X HN comments have group-counts them by domain. Ended up being ~100 lines that GPT wrote by itself without any errors along the way.
> If you want to make a difference, an FCC sticker won't do it. Consumers will go for the cheaper one without the sticker. You'll have to mandate whatever minimal level of support you want these companies to provide.

Or you could respect the customers' revealed preference?
Ask HN: Ex-FAANG dev managers, what's next?
Honestly looks terrible. I'll keep my Glove80.

https://www.moergo.com
There is a high degree of ignorance pertaining to cybersecurity among the general public. Stand next to the Geek Squad counter at Best Buy and you'll hear login credentials being freely exchanged all day.

Since this is "opt-in" on the part of the vendors, how will consumers be educated to care about the FCC cybersecurity label to make it worthwhile?

This also seems analogous to the USDA's Organic label.
Has much consideration been given to labeling when a third party cloud or paid service is required to use the device? As somebody who uses IoT devices "locally" on my private network, I want to know my data will stay local and protected. The recent issues with Eufy doorbells claiming to be under local control [and encrypting data], but actually sending data to the cloud stands out to me as an example where labeling and enforcement could help.

[0] https://arstechnica.com/gadgets/2022/11/eufys-no-clouds-came...
Launched My Tech Blog
My tech blog is your comprehensive guide to the digital realm. Dive into 8000+ posts filled with tutorials, examples, and insights to supercharge your tech journey. From common dilemmas to nuanced challenges, we've covered it all.

Excited to share my tech blog, a year's worth of dedication & learning. Every post is crafted to clarify, educate, and inspire. Hope it adds value to your tech endeavors. Can you provide me your feedbacks and things that worked and didn't work? Or even suggestions like filters or sections?
My first open-source project got 4K downloads in a week
Which is still not really like this case. Hence the author ultimately managing to get out of it without the services of an attorney and without any actual trial taking place.
Another great step would be a guarantee of making the firmware Open Source after no more than a certain amount of time, and having that guarantee known at compile time. Effectively, that means the device will always be supportable.

It's not inconceivable that this could be a requirement for getting a label (or some tier of label.) It depends how the advocacy comes out on the record.
I have a few Foveon sensor cameras and the DP1 and DP3 (equivalent of 28mm and 75mm focal lengths) fixed-lens cameras are beautiful to use, in the right lighting. They don't have the ISO range needed however, it is best to keep them at ISO 100; though for B&W you can go to I think 800 or 1600 and not have many quality issues. The Sigma provided software that allows for a great deal of color manipulation also has a convert to monochrome mode which is incredibly flexible.
> I hope that Android becoming more and more user-hostile (and more specifically in this case power-user-hostile) will move more and more people to custom ROMs.

I 100% share your desire but this is wishful thinking imo. People tend to comply when given no other options.
I think that IOT device manufacturers should be required to support their device for some minimum period of time AND be obligated to release the full source code for the device once they decide to end support. This also requires releasing the keys to any firmware signing mechanism or publishing a firmware update that removes such checks.

The core problem is that without control of the firmware, consumers don't really own these devices. The company can unilaterally decide one day to brick your device and force you to buy a new one. It should be obvious that this behavior is egregiously anti-consumer and anti-competitive.
It pretty much supports anything that React supports, but it's not possible to pass callback props in directly via Puck's authoring form.

However, you might be able to either wrap your component inside the `render` function and define your callback there, or use context to pass in a function from higher up the tree.

If you share your use case, I might be be able to help you out.
Lead with the pain reducing angle. Tell her it's better to be addicted to keyboards than painkillers!
You can install root certificates, though, and they'll work on almost any app you could need in the enterprise.
One thing that regulators need to be very careful about is how "security updates" are defined, and exactly what manufacturer obligations for issuing security updates should be. CVEs are a notoriously terrible representation of actual security risks, so a measure like "manufacturer must issue new releases that include any released patches for CVEs with a severity rating greater than 9" would be a clear non-starter.

There are also often practical issues related to security patching embedded devices: for example, a downstream supplier's driver can make it impossible to upgrade a kernel unless/until the supplier provides a fix. Of course, strong regulation here could help to drive bad practices like that out of the industry, but I'm not going to hold my breath on that one. The effect of regulation like this would make it harder for manufacturers who don't have the market power to lean on their suppliers to provide security patches.

Finally, it's important that any regulation that mandates or strongly encourages software updates also mandates that the update system itself be implemented in a secure way. This is my specific area of expertise, and I can tell you that it's very often done very badly. A bad update system is a gigantic, flashing red target for attack. So something like mandating signatures (and sig validation) on software update images would be a good start. Mandating the use of TUF-compliant repositories would be even better.
I love these puritanical notions. Gotta be good, hard-working, cold-hardened folk!

>Employed by the transcontinental railroads, influential writers like Charles Nordhoff contested eastern notions of Southern California as barren desert where “Anglo-Americans” would inevitably succumb to the “disease” of laziness.
Know who doesn't have these kinds of issues in the US for the most part? The employee delivery drivers at national pizza chains. These chains also charge a fraction of the fees that the big players do for delivery.
I'm still not convinced that you can explain your position beyond what I asserted.

My position is simple: both ISIS and PDF are violent, reactionary rebel gangs with delusions of grandeur but no real strategy for improving the lives of the people. Evidently, both are partly orchestrated/supported by foreign states. They exist solely to cause chaos in regions faraway from their sponsors.

For example, note that ISIS happens to ignore Western partner countries like Israel, Saudi Arabia, and Turkey, while focusing on Western enemy states. Note that the US Government openly assassinated Iranian General Soleimani, who's claim to fame was defeating ISIS. Note that US state media aired a puff piece of ISIS/AQ affiliate al-Jolani ("The Jihadist"), attempting to drum up public support for the new face of "ISIS". And so on and so forth.
Helium is critical for all sorts of things, not least IC fabrication and cooling MRI magnets.

This was one of the big issues at the start of the Ukraine invasion because they're one of the world's preeminent suppliers.

The big problem is that there's a finite supply - it comes mostly from natural gas wells - and it's running out. Being lighter than air it just goes up and into space. Once we're out, we're out.
> I have a lot of problems with getting the title of an URL. It worked, no longer does.

What do you mean exactly? Would be fun to try to replicate.

You give ChatGPT a URL and expect it to be able to get the <title> tag from the HTML? Or you're pasting the whole HTML document?
I expect that that’s what Apple would have done if they had adopted ZFS, sensible defaults for the common user.
I haven't heard of this being common (sorta surprisingly), but you can get a battery angle grinder for $40 these days and it'll go through literally any bike lock that exists in seconds.

Maybe it's not common because it is VERY loud and sparkly.
Subtitle: "A city’s density, the size of people’s homes and cultural norms are among the factors that affect hybrid work patterns."

Not surprised by that at all and interesting to see this article just after I posted this comment[1]

"Guess what, most of the knowledge workers live in dense cities with tiny apartments. Average flat sizes for various cities (sqft): Bangalore (1260), Singapore (667), Tokyo (710), Paris (520) etc. See this image for more details: https://files.buildworld.co.uk/average-home-size/03_Average-...
To make it permanent remote would involve a huge restructuring of those societies and that cost is much greater than maintaining office towers."

Now the article also has numbers to back up their finding: "Densely populated cities, particularly in Asia, have tended to see higher return-to-office rates, often because people struggled to be productive in small apartments shared with many family members."

[1] https://news.ycombinator.com/item?id=37387404
lets say you hav an div with contenteditable and an textarea. In both of them you add an unencoded string '<span style="color:red">bla</span>'.
the textarea displays the text, the div parses it an add it as an valid child element to the dom.
this means you can make an editor without much work with contenteditable, but not with textarea.
Direct Preference Optimization: Your Language Model Is Secretly A Reward Model
Well, you can't hold somebody accountable if there isn't even a label or information somewhere saying that what they are doing is dangerous.
I remember there is a study about the alignment cost. Basically the more restrictions and limit you put on a model, the worse its general performance becomes. Things like a ban on violence, race, or any other sensitive topics effectively throttle or change how the model "reason" or connect information within its network of parameters and result in degraded capacity.

I wonder if this is the reason behind all of this.

Edit: the study: https://arxiv.org/pdf/2308.13449.pdf
I don't get what you're saying here. What "offending behavior" are you referring to in this case that might be taxed to disincentivize it?
A counter-reference from a Jan 2023 newsletter from the Radiological Society of North America - https://www.rsna.org/news/2023/january/helium-shortage-for-m...

"Despite news reports in October that the world is running out of helium, clinical MRI units throughout the U.S. were and remain unaffected."

I wouldn't be surprised if some patients are given bad info by either clinic or insurer. Blaming a global shortage, real or perceived, points the patient's emotional response away from the provider.
Right, but given population statistics it's a pretty safe bet that the majority of individuals involved here are not disabled in any meaningful way and are making life difficult for their delivery drivers for their own personal convenience. It's interesting to me how quick folks in the comment section are to try to take cover behind some dude in a wheelchair.
Two issues come to mind immediately. The first is that the market might not be the most efficient mechanism for allocation for something like helium. Are party balloons more valuable than cryo coolant for particle accelerators, MRI machines, and science? Just because you can't cough up the market price doesn't mean your application isn't valuable [1]. The second is we've seen what happens with OPEC when a cartel controls the supply of energy. A for profit cornering the market for a non renewable resource could lead us to suboptimal stewardship of said resource (because humans are short sighted, near term driven, and fundamentally greedy).

In 1979, in the midst of one of the many energy crisis in the 70s, the Shah of Iran said “oil is too valuable to burn." We've lucked out that we haven't run out of helium yet, but there is no guarantee we will continue to be lucky. The subcomments of this comment [2] explain the very real peril and concern.

To your point "Your complaint is that you think for-profit hospitals should be gifted the helium rather than having to purchase it?", I would respond: Helium should be priced based on the end use as well as any systems in place to recover and recycle [3] [4], vs temporary use where it will quickly be vented to space, lost to us forever.

[1] https://en.wikipedia.org/wiki/Market_failure

[2] https://news.ycombinator.com/item?id=37393338

[3] https://www.chemistry.ucla.edu/news/new-liquid-helium-recycl...

[4] https://pharmacy.ucsf.edu/news/2021/06/helium-recycling-proj...
Are you still chasing the money or are you looking for an area more related to social impact?

Do you intend to continue working?
Ask HN: Do you work on projects solely for your own use?
In the past, I've built many projects just to make my life easier. E.g., a tool aggregating flight and accommodation data to help my travel planning.

However, I've noticed that building such "just-for-me" projects has become less frequent over the years.

Can anyone relate to this experience? What kinds of projects are you working on that you have no intention of sharing with others?
It is on my internet! https://arxiv.org/pdf/2307.09009.pdf
> It'd be like putting a "secure against bricks" sticker on a window.

I lived in a house that had such secure windows. I even witnessed someone trying and failing to smash a window with a brick.
And so pitch inequality gets ever larger. *shakes head•
I think retaining the number row and the outer pinky column makes it more accessible; but I find it odd the design then also removes the lower row of modifier keys, and only gives two thumb keys each.

It's good to use the thumbs more than the pinky fingers. -- But, I'd think an introductory keyboard would retain modifier keys for the pinky fingers to use.
I'll plug in my 2 cents.. and yes, I just created a new account to give a thumbs up because Brad and Scott have been awesome in helping me get a whole array of infrastructure stood up as we migrate away from a system that uses puppet. If you have ever needed to read thru the dizzying array of AWSs docs or blog posts about how to do this, then you will be relieved at how easy Nullstone makes it.

They have a full suite of modules that most application can use out of the box to standup your infrastructure in minutes. Now there may be some uptime on learning the UI and how to connect modules together but spinning up and tearing down is easy. I just built a module for deploying an aurora instance that was not available within their registry, but with their help, I was able to code one up in a few hours and have it deployed before the end of the day.
> do something other than dumb scaling up

This is exactly what people told OpenAI 8 years ago and look where we are now.
> To be fair to these authors that option was not really viable when they first wrote the book. Instead of 200 15 second reliable playwright tests run across 20 cloud based workers completing in 3 minutes you were faced with the possibility of 24-48 hour flaky test suites running on one Jenkins server.

The problem with integration and e2e tests is that they do not give you a measure of the "internal quality" of the system in the way unit tests do. Quoting again from "Growing Object Oriented Software, Guided by Tests:"

> Running end-to-end tests tells us about the external quality of our system, and writing them tells us something about how well we (the whole team) understand the domain, but end-to-end tests don’t tell us how well we’ve written the code. Writing unit tests gives us a lot of feedback about the quality of our code [...]

I don't think compute / test duration were the only motivations behind this approach.
This is amusing seeing this sentiment posted here while just north of Philadelphia, schools are closing early because it's too hot in school.

It's 85f right now.
We actually can't. Russia and in particular Stalin was also there. Russia absorbed more Polish acreage than the Germans. I'm happy to agree with the phrase, "Germany and Russia, acting together, started WWII."
Sure, but the question here seemed to be about security, specifically. What you're talking about is definitely a problem, but it seems like a different one.