skysight-inc/HackerNews huggingface dataset:
It's better to get the policies in place now and then complain about the lack of funding/enforcement. The mere threat of enforcement will cause some companies to design their products better and when a major security incident happens because of a bunch of insecure IoT devices and people are outraged it'll be a lot easier to motivate action if we can say "We already have rules that would have prevented this entirely, but the FCC wasn't provided the resources to enforce them."

That's a clear call to specific action as opposed to "We don't have rules that would have prevented this, and also many of the rules we do have across several agencies don't have enough funding to enforce rules designed to solve other problems."
Which Python, 2 or 3? How will you handle local versus global dependencies? Will you use pip, conda, virtualenv or something else? How will you package up the code and/or executable?

It's not as simple as shipping code to the user.
Really appreciate your kind words and the effort required in getting your arms around so much material so quickly.

it would be really useful if there were a TLDR version

I agree; I'm hoping that the tech press takes up this topic, but an "official" one would make engagement much faster.

I think the labeling should be simple - like a small discrete set of classes for compliance that can be extended over time with further rules. So 20 years security updates is “platinum” 10 years is “gold” 5 is “silver” or something. Then the classes of label can accrete meaning over time as you enhance your proposals.

This is how I'm thinking about it too -- not just for support term, but for all kinds of things, FOSS firmware in escrow, bankruptcy transition plan, responsibility to publish and implement fixes from public databases -- there's so much that might go into each tier, and while I have my own ideas, it would be great to see the tech community take up these questions.

in some ways a way to work best is right here in the HN comments and then lifting material up into your direct work via the proposal and statement

Also true, and my team will be doing a detailed after-action on this thread once it winds down.

To that end maybe reaching out earlier in the process to get feedback would work

That's one to grow on for next time. The good news is that the final rule (I'd expect end of Q2 2024) will also be subject to notice-and-comment.

Seriously, a huge thank you for your close engagement. I'm really excited about what the tech world can bring to this high-level proposal.
Oh man that leads me into an infinite Cloudflare captcha loop on my iPhone :-(
Show HN: Shell2 – Code Interpreter with API, Internet, Multiplayer, Open LLMs
It is sometimes used to refer to someone who has unusually high energy, speed, or productivity - to accuse them of using a stimulant.
Natural gas is running out?
No wonder humans seem to do their best when things are the worst
Anyone bisecting with a repo that uses merges should be aware of the `--first-parent` flag by this point.

Or if not: you're welcome!
You still had to set that toolchain up, which is my point.
I'm using 2 via a DisplayLink dock, but it's less than ideal, and comes with some compromises.
Plasmic.app works with vue - why not just use that?
Alternatively, people upvote things which are intellectually interesting. Discoveries like this are interesting to read about even if you're not a molecular scientist.
Retail FX Traders Made Money for Someone
I think it depends on the service you are providing, but the only way to tell if it is viable for you is to test it out. You could try two approaches to test it out.

1) reach out to old clients and see if they would be interested in the recurring fee

2) When you are negotiating with a new client, bring up that they could also just pay you X recurring fee instead.
As a government service, certifying drivers, the goal shouldn't be to earn money right but instead to maximize the number of humans who end up certified.
All fair statements
So this feels like an amazing idea...but do we really want to give the federal government the keys to update your equipment remotely and to be able to pinpoint weaknesses of the source? This feels like Edward Snowden's grimmest nightmare.
Is it "inflating the bid" or "charging a premium for fixed cost".

You are welcome to haggle on price or not hire them. As a freelancer or bussiness owner, not every prospective bussiness deal goes through. That is not a failure of their model, just the realities of commerce.
Installing on Linux and using as your primary OS font goes a very long way to making the system feel modern.
Not too many industries have such a shield. The nuclear industry comes to mind as an example of one that does.
Reading for pleasure will make your child a nerd. It happened to me. Have your son read for business- get him on the hustle grindset early.
I'll be the one to bring up the taboo:

It's totally possible that intelligent people have well paying careers and give birth to intelligence advantaged children. Mother nature loves bestowing fortune to the fortunate.

There is the pervasive "blank slate" approach to cognition, when there is plenty of evidence that your brain is not in fact a blank slate at birth. I mean people just passively accept that some people are just born physically stronger, or with a more athletic build. Especially if their parents are athletes, or it runs in the family.

But bring up intelligence along with genetic factors and everyone recoils and tenses up. It seems so plainly true, there is plenty of evidence to back it, yet its article after article, discussion after discussion of "Kids who read books end up being more successful" and never "Naturally smart kids enjoy reading books".
They could. They would lose, though
The OEM could be allowed to choose their recertification period, perhaps with slight differences in requirements. Perhaps even different options offered by company size. For example 1-5 employee companies might get a "no recertification, provided as-is" option which releases automatically 3 years after filing. Vendors who re-certify every 6 months could get an extra mark on their stamp or whatever. There are tons of possibilities honestly, and though I've been thinking about it for a long time writing it is much easier to come up with more.
Could you explain how and why Hashicorp "get the maintenance burden"?

Surely, if maintaining it was such a burden, Hashicorp could just stop maintaining it?
If by old fashioned you mean US 1950s conformism, OK. If by old fashioned you mean in the context of history to the best of our non-bowdlerized knowledge, then, no. It's just historically uninformed.
As a firmware engineer, I'm one of the people who actually writes the code that goes inside the IoT devices. I'm very interested in what the FCC might be able to do here.

How does the FCC define a security flaw? Would updates only be distributed when there is a flaw that needs fixing?

Remote update mechanisms can themselves present security problems in some domains. Thus, some devices should only be updatable if the owner has physical access to the device. Will the manufacturer be liable for damages caused by attacks on vulnerable devices that were not sufficiently updated by their owners?

IoT is making its way into defense and enterprise environments where reliability is a matter of national security. An update nearly always results in some downtime for the device, even if it's just a couple seconds. Sometimes, it may be in the best interest of a device's owner to defer an update indefinitely, until that device's continuous operation is no longer mission-critical. Even if the owner can't control exactly what is in an update, they absolutely MUST be able to control when an update occurs.
>So how are people with mobility issues or medical quarantine situations supposed to get their food if there isn’t a way to reliably arrange for delivery people to bring it to (at least outside) their door?

What did these people do before doordash? Can they not just call the restaurant and explain that going downstairs is a burden?
The other 19 commits are also not the current state of the code, and if the test suite is all currently passing, and nobody is using a version of the code in production from the other 19 commits, then none of that matters anyway. So I'm still confused why anyone should care.

The test suite did its job by alerting you to make changes before merging your work to the trunk branch, I don't see this as anything anybody could possibly pick a fight over.

And to be clear, I still use mainline terraform because I never really wanted a wrapper around terraform. It's just silly to me to take issue with the terraform wrappers for this non-issue.
> because now every foreign government is racing to break, steal or buy those keys

it's much easier and much cheaper to simply steal the phone (maybe phones?) containing the keys. Or hack it (them?).

And then calmly search through the phone's backup.

That's what I would try first if I was in charge of such a task.
It suggests they are reacting negatively because they are in a cult.
I don't deny at all that there are people in Chicago who are unhoused against their will. Presumably most of them are. It's my assumption when I see someone here living on the streets. But I pay attention to local government stuff, and I know for a fact that some of the people out on the streets here are choosing to stay on the street despite being directly offered long-term housing.

Our politics about housing and homelessness are probably very similar, but "you will not find a single person in Chicago who is currently unhoused by choice" is simply false. There may not be anything useful to do with that information! It may have no public policy implications at all! But it's still not a good idea to try to build arguments out of premises that can be quickly falsified.

The people I'm thinking about are not, like, schizophrenic and incapable of making the choices I'm talking about.

I'm certainly no fan of Emanuel's.

† (I edited this a bunch of little ways but also in one big way, to make it more clear that I'm not personally involved in any of the outreach stuff I'm talking about.)
this seems really expensive compared to a local nas, at least over the lifetime of your service. is there a reason you chose to go this route instead of local storage for media?
> A company that wants to make their own phone can do that and still use the same wireless providers.

Apple is not currently a vertically integrated wireless provider. Would you say that it's a problem if they were, so the only wireless carriers with widespread coverage are Apple and Google?

> A company that wants to make mostly their own phone can get ARM chips and cellular chips and all of the parts from plenty of places all the way up to getting contract manufacturers

Anybody can make a device that terminates phone calls. The issue is that you want to benefit the consumer by making something which is better than what already exists. And you have an improvement to contribute -- a better display or battery or form factor or app or a way to lower costs or whatever.

So what you want is to take the best available device, change it by only your own contribution, and get lots of customers because what you're selling is the same as what people already want, but better.

Which you can't do, because you can't get the rest of the phone people want. So instead of starting with an iPhone and making it 10% better, you have to start with a phone which is 25% worse, and then even when you make it 10% better it's still 15% worse and it's not competitive.

So then you don't even try, which is terrible for the consumer.

> So are you saying there is no competition in the phone market and people must buy iPhones even though 80% of the world buy Android phones?

There is very little competition for phone SoCs. It's basically Apple and Qualcomm, and Qualcomm sucks. OEMs buy from them because they can't buy from Apple. (Samsung keeps making an attempt but they're not that impressive even relative to Qualcomm and go predominantly into Samsung's own devices.)

Android phones have 70% of the world market because they cost less. They're only ~40% of the US market. That doesn't help you if you're trying to make a premium phone.
> So the first step is to have enough capital to design a state of the art microprocessor that can compete with the world's largest corporation.

> and I can’t create my own car either to compete with a Tesla that doesn’t mean Tesla is being anti competitive.

> If this is feasible, why hasn't anyone done it? Every other phone chip is slower.

Ask Microsoft, Google, Qualcomm etc. Microsoft in particular had a years limb head start on Apple in the phone market. And Apple was still basically coming out of near death at the time. The other companies incompetence doesn’t mean Apple is being anti competitive.

> The whole point of tying is to take away your choice. Instead of choosing which phone you want and which OS you want and which app store you want, all of these are forced into a single decision that can no longer accurately represent the customer's true preferences.

I can’t choose to get a Tesla battery and the Tesla infotainment system on a Ford Mustang. Is Ford being anticompetitive?

The entire point of leverage is that Apple has an integrated experience and people pay a premium for that. If you want a non integrated experience - you can buy an x86 computer or an Android phone - as most of the workd does.

> But if you want to talk about informed, why is the 30% cut hidden from the end user? Shouldn't it be on the statement when they buy something from the store?

Does any retailer show the customer the difference between wholesale price and retail price?

> Nobody wants to clone a console. They're sold at a loss in a dumping scheme to achieve a network effect so they can shake down video game producers.

There were at one point reference designs for consoles and the hardware was manufactured by others

https://en.m.wikipedia.org/wiki/3DO_Interactive_Multiplayer

> What they should not is be able to shake down video game producers. Xbox and PlayStation should have Steam and the Epic Games Store. Which would render the dumping scheme non-viable, as intended.

Instead of whining, Steam actually did come out with their console. That’s the same thing any large enough company can do and their are literally hundreds of companies selling their own phone
Awesome, please take my money!
> Twitter locked the account of a right-leaning parody site, The Babylon Bee, after it awarded Rachel Levine, the transgender Biden administration official, the title of “man of the year.”

https://nypost.com/2022/03/21/twitter-suspends-babylon-bee-o...

That’s pretty obviously a personal attack.

There’s a very obvious difference between holding and expressing a personal opinion on gender identity and launching a public attack against a specific person.

This is the way these complaints always go. “conservatives are being censored!” becomes “well sure, they were censored because they violated the terms and conditions of the site in a distasteful way but why is that important?!”
What does 230 have to do with this at all? 230 is pretty limited in regards to what it protects against anyway. and the ADL isn't threatening him with action, so what does 230 have to do with it?
I think the way to make this proposal work is to pass legislation to actually have meaningful financial liability for data breaches.

IFF companies have financial liability, then the market can be expected to find a cost-effective solution.

Without any selection pressure though, there is no reason tho think the market will spend resources to solve this. Users empirically don’t understand security, don’t price it appropriately in advance, and aren’t able to evaluate the security qualities even if they do want to pay more for a “secure” product.
No, it's pretty much all helium for clinical work.

Short of a quench (catastrophic heating, effectively) the most modern units hardly lose any, and often need less in the first place. An old machine might cost you near 6fig/year in helium refill, especially if out of spec. Some new magnets don't typically need any in a give year.
If I inherited a crappy code base I want to get to a place where I can safely refactor as quickly as possible.

I dont need indirect commentary on how crap the code base is in the form of tests that are annoying to write because they require 100 mock objects. It's not telling me anything new and it's annoying the hell out of me while it does it.

If the codebase is good, I also dont need that commentary. I can read.

Indeed maybe the real message that unit tests are sending by being intolerant of bad code is that they are also the bad code.
Where is it a cost-saving solution to pay for a quarantine room that will be unused for other purposes for up to 5 months, all so you can save a few hundred dollars by buying used furniture?
The author's third type of "no" refers to the technical feasibility of compliance. OP, on the other hand, is referring to the refusal of the idea itself. In the case of encryption, the technical side of things is insignificant compared to the Orwellian nightmare these sort of laws intend to create. It would still be a terrible idea even if technical drawbacks were absent, and one doesn't even have to be a nerd to see that.
I'm not sure you are following them. The UL was funded by the Insurance companies. Their point was that there was some organized, rich entity to pay for the costs of operation as they had a financial stake.
They want to convert more meat eaters, or at least get larger addressable markets to to try. Which is fine by me. Instead of meat industry bitching and legistlating vegetarian products co-opting meaty language, IMO meat products should just slap on MEAT BASED in big letters.
This situation exposes some arbitrary and capricious aspects of the CVE process, which in turn devalues the entire system. It makes me personally less likely to take any of their assessments at face value, and I imagine others will feel the same. That is a net loss for security.
I think they're talking about replacing the DOM entirely with a canvas based renderer through WASM, as Flutter and other WASM based UI frameworks like Slint do.
> Android becoming more and more user-hostile (and more specifically in this case power-user-hostile) will move more and more people to custom ROMs

I never owned a phone supported by any of the custom ROMs I investigated.

Samsung Galaxy S2, Sony Xperia X Compact, Samsung A40.

Except the first one, which was huge by the time and tiny nowadays, I buy the smallest phone I can find. Apparently no ROM developer is interested in those phones.
Almost everything from IKEA is particle board or MDF. If it's solid wood it will be priced higher - even pine. I have a couple of particle board items from them and they are definitely heavier compared to actual wood.
Most people don't spend this much time on PR before releasing their fork though.

If they had worked on this publicly from the start I'm sure a lot of the current PRs would have generally been of better quality as they could get community input earlier.
yeah common in Canada. Generally 5 year. House is amortized over 25 but you basically renew the loan every 5 years.

US-style 15 and 30 year are unheard of. Kinda glad I didn't buy during COVID cuz I'd be getting slammed now...
Yeah, I agree full DIY is not for everyone, but SMT assembly is pretty affordable even in small batches these days. I just placed an order for 5x of a 60% unibody ortho board and it came out to roughly $40 a piece before switches, case, etc.
Is there a video (or even just audio) demo? I'd be very reluctant to install (and pay for) this without hearing what it sounds like first.

EDIT: Oh! I see you can click on the little play buttons in the hero image to hear a preview. That's pretty subtle.
> These regulations put us on the path of trusting religious-like in government.

We don't need to have religious-like faith in government because we can vote for people who will do what we want them to and we can vote out the people who refuse to do their job. It doesn't happen without the people getting involved and holding their government accountable though. You don't have to pray when you can vote.

Without regulation you could only ever have religious-like faith in private corporations because they have zero incentive to act benevolently and you have zero power to replace a CEO who is acting against the interests of the public. You have no vote, so prayer is all you have left.
How does this compare to https://www.plasmic.app/?
> the, apparently erroneous :), assumption that no glass is brick-proof

That reminds me of:

> With sufficient thrust, pigs fly just fine.

https://www.rfc-editor.org/rfc/rfc1925
unfortunately the reality has become such that lawsuits and fines are just the cost of doing business, so long as the investor money keeps coming.
Well, I guess if we're going to just entertain fantasy "what if's", sure anything could happen. He might just dematerialize randomly while waiting for this extradition proceeding to happen. He might get elected president of the United States. Anything is possible if we just start playing random "what if's" not bound to reality. It sure is fun living in fantasy land.

What prevents that person who just got a traffic violation from getting some made up charge and then faces execution, or really anyone else? Probably evidence of a crime carrying that penalty being committed, and from things we've heard from the US government even the evidence for the max 170 year indictment is potentially little shaky and questionable. Apparently the Justice Department under the Obama administration was even wondering if they'd even bother pressing charges against him and actually take him to court. So if it'd be a hard time convicting him on an indictment that has a max penalty of 170 years, what are the odds he'll get convicted on something that carries execution? What crimes do you think he'll be indicted on which carry an execution charge? Considering the US has a hard time executing people who literally make bombs for terrorists I imagine it'd be a pretty dang high bar to cross to have him indicted and convicted of a crime which carries an execution penalty.

Continuing to harp on about how he faces likely execution in the US is just lies. You should really stop repeating them.
I recognize this argument exists, I do not agree with it, but it is logically sound. This is why I worded it as "Generally this is seen as ...", but I could have done a better job expressing that ambiguity. Not all anti-abortion arguments are anti-individualist but most are, almost all pro-choice arguments are based on individualism which is why it is phased as choice.
Note that, as mentioned later in the twitter thread, the executable in the screenshots (testapp.exe) is not used. It was briefly used like a decade ago but has since been replaced; they just haven't removed it from the distribution, for some reason.
I think the most valuable security feature for IoT devices is being able to work without contact with a central service.

If the value of a device is tied to opening a connection to and occasionally retrieving code from a third party it is inherently insecure. All I have to do is buy the company that owns the central server (or compromise it in some other less visible way) and I now have the ability to introduce malicious code to all devices that are receiving 'security updates.' You won't be able to make a rule to prevent asset transfer (correct me if I'm wrong) so you won't be able to close this hole. And this assumes the manufacturer isn't malicious in the first place.

For people to be able to protect themselves and to protect the value of the property they have purchased (e.g. the company tanks and the central service is lost) a rule should exist mandating minimum useful functionality in a disconnected and/or self-managed environment.
Any, you know, actual examples of things that happened?
NYtimes links are just an advertisement for a paywall.

Which wouldn’t be so bad if they didn’t also use dark patterns to prevent cancellation.