skysight-inc/HackerNews huggingface dataset:
The normal thing is to have integration test PRs and other CI actions (which may require access tokens to APIs, inherently or due to naive design) be defined by the incoming branch, creating a vector for an attacker to get access to privileged resources.

For certain parts of integration and testing jobs that are operating on untrusted code, it'd therefore be desired to not allow incoming PRs to change certain parts of the CI configuration (not only including .github/workflows, which can be protected using branch protection rules, but the testing framework).

It's possible to achieve this by splitting up your workflows and using workflow_run but it's non-obvious and finicky enough that I very rarely see it done.

GitHub could make this easier and propose better patterns than they do in their attempt to address the problem[0], which I think could use a 2023 follow-up.

[0]: https://securitylab.github.com/research/github-actions-preve...

---

In this context, an iMessage message <> a GitHub PR, I guess.
Hose derives from clothing -- "hose" were leg coverings, and in German, Hosen means "trousers". So a tube of cloth, or based around cloth (e.g., firehose). Garden hoses are typically fabricated from cloth and rubber or plastic.

A few sources sugggest that tubes tend to be structural, where pipes tend to be functional. E.g., <https://www.appmfg.com/blog/what-is-the-difference-between-t...>

(I suspect that's general trade copy as I'm finding it on several suppliers' sites.)

A distinction that occurs to me is that both pipes and hoses may be high-pressure, though typically tubes are not.

Pipes are often classified by the material used in fabrication: wood, copper, clay, steel.

Hose is almost always flexible, and often used for temporary or mobile applications (air hose, fire hose, garden hose, dryer hose).

Another related term is duct, which comes from Latin ducere, "to lead", which is what ducts do: they lead somewhere. <https://www.etymonline.com/word/duct>

I'm not sure that pipes must be circular or rounded, as "square pipe" is in fact a thing (though a minority thing).

Another distinction between pipes and tubes is that pipes are specific to transport, that is, something flows through a pipe. A tube however describes a shape and there can be structural tubes, either hollow or filled, through which there is no flow. One example is sleeves used to form concrete support columns: these are tubes (often of paperboard), into which structural steel and cement mix are poured, resulting in solid, static columns. That's discussed here:

<https://www.eng-tips.com/viewthread.cfm?qid=455180>

We also talk of "speaking tubes", which were used for communications, especially on ships or in factories. There are containers which are tubes, which hold and emit their contents, but contents don't flow through them, transiting end-to-end: toothpaste tube, tube of caulk, grease tube.

Some animals have tubular bones, most notably birds.

Putting this together, I'd argue that a tube is a general shape which may apply to a usually rigid pipe or a flexible hose, which are often used to duct fluids (gasses or liquids) from some source to a destination.
Thank you.

This blog post is responsible for more toil than anything else I can think of.

> It seems to have only caught on because a lot of people felt adrift when it comes to Git and this was written far too authoritatively for what it is.

I think "Git Flow" was successful for the same reason that Javascript "Standard" linter was: misleading branding that lends credibility.
New to this and learning, thanks for sharing
Congratulations to everybody who's been working overtime to simp for Chrome for so long.

Firefox has had its ups and downs, but it and its progenitors have been great daily drivers for me over 20 years now. It's not too late. The best time to switch was, well, forever ago -- but today is also a great time to switch. Get on the fucking bus.
Unfortunately, looks like it did.

...which while admirable from one perspective, also effectively destroys the evidence.

I prefer the warning instead.
the bitcoin mines stimulated power infrastructure investment so that texas was able to withstand the heat wave without doing blackouts
I don't remember how I first installed it, but for the update, I downloaded the .deb file they offered by default, couldn't do anything with it. Don't remember how I solved the problem.

Edit: actually, I think I installed it via Snap Store. And the current Snap Store version is .28, but the new update is .29. So the .28 client is just in a loop of "there is a new update and I am out of date, so now I am just a modal that downloads the packages at these URLs". Not sure where my other installation came from, if I somehow did a fresh install or what.

I don't really get why there isn't just one obvious reliable and centralized way to install software on this thing. My Slack, VSCode, and other apps auto-update without my having to manually do anything, which, IMO, is how it should be by default.

I'm on Ubuntu--is there benefit to using Pacman on there? My understanding is that people do.
This is especially true for psychedelics. Psychedelics are very useful, but really should not be sold by some anonymous person in a park or alley who isn't providing any guard rails or guidance.
What code auditing? Are you claiming NSO has access to iMessage and iOS source code?

NSO seems to be finding more and more bugs by poking a black-box alone, while Apple cannot seem to be able to fix by looking at the source code with all the fuzzing and verification tools, and much more $$$ at their disposal.
But it is a lexical utterance. The form of the filler is specific to the language you're speaking. I'm having a really hard time trying to imagine what about it you think isn't lexicalized.
Not supported in Australia yet, do we know when this will be available?
Indeed...life is about tradeoffs
It's extremely easy to sneak backdoors in open-source code that contains automatic update functionality.
> Non-Americans may not realize that the Ivy League too is a sporting designation, not an academic one.

The Ivy League is absolutely a sports division. But in practice, it's honestly more of a set of "arms reduction treaties", where the schools have decided to limit the expense and effort put into their football programs. They still want to maintain the image of "well-rounded student athletes." And, you know, beat their rivals. But the the student-athlete image thing is important.
It won't exclude anything. Loanwords can only be expressed in the phonemic structure of the language, because the speaker isn't capable of doing anything else.
Yup. It's none of their business. They can't discriminate against us if they don't know anything about us.
Many jr devs cite this model to me. Every new hire after on boarding looking to make an impact cites this. And I’m getting tired of explaining why this model is not always a good idea.

And we’re building apps that have multiple versions in the wild.
Management that refuses to fund or mandate any common infrastructure.

Jack likes running his companies like "an economy of startups" but in practice this means nobody is allowed to do things without fast returns. Teams are encouraged to use whatever programming language and infrastructure they think fits them. It is the fast track of tragedy of the commons problems.
If the user account is only supposed to have file transfer capabilities/no shell access, add it a to a specific group e.g. `sftponly`, and only allow this group to use the `internal-sftp` command in `/etc/ssh/sshd_config`

Match Group sftponly
ForceCommand internal-sftp -l INFO -f LOCAL6
AllowTcpForwarding no
AllowAgentForwarding no
GatewayPorts no
X11Forwarding no
A huge amount of this IMO has to do with driving. Autonomous vehicles are a game changer in many respects, but one of them is making it safer for the "Common Idiot" to use mind altering substances more safely.
One thing I always wonder is how people throughout history, on famous historic codebases etc, can indent things.... 90% the way, and then out of dozes of things correct there will be 3 things that are painfully off. Man, just indent them all the way if youre going to do it halfway

Ive seen this in dennis richie code, doom code, etc

Am i the only person who sees these things stand out like a sore thumb? It would drive me mad. They either all have to be not aligned, or aligned, but not 90%
I've always advocated for feature detection. If you test for typeof Object.assign !== 'function' you can be sure you have a reasonably recent browser. If you want fetch, test for window.fetch.

This sort of thing always feels like it's going against the grain, with someone always asking "why wouldn't you do this properly. You know, build an allow list of user agents and match against them". I fully support people being forced into detecting the features they want and doing away with this nonsense,
Agreed. It's the very definition of a dead planet, and there is even a high probability that it had life before Earth.
> this has already happened

is by far the worst possible response to a thread detailing an extinction event, with the closest equivalent being the mycologist self-immolation in _The Last Of Us_. But… thank you for the reference. I missed that. I'm happy we are not dead.
Show HN: Study hack using AI powered article-to-podcast tool
It's a really hard thing to get addicts off drugs when it's their environment that's addicted, and they're not in a position to exit that environment.

The same complication prevents obese people from losing weight, even when employing perfectly effective methods given a cooperative environment.
It's not hard if your feature set is limited and you have proper testing.

I maintain PKI and Yubikey-val at home.

It's not rocket science and it's job security for those special folks who enjoy it. :)
I do not understand how this is from "first principles"?
I bet WOTC would find this very useful!
I did, and on the rare occasion that I need to use a downloaded binary today, still open it in a text editor and scroll through it for a cursory look. Packed -> reject. Bigger than expected -> reject. URLs or other strings, especially obfuscated, not related to expected functionality -> reject. Online AV multiscanners offer a reasonable alternative for those who aren't familiar with this sort of quick-glance RE, although they do have false positives too.
I don’t think I’ve ever heard of Square having an outage let alone a total one.
If true, I did not know that. You have a source on that?
Another 30 years of wage stagnation, rising income inequality, and shared prosperity running on empty and the average Joe will be willing to give much shadier characters than "the party" a try.
As of right now they don't turn off 3rd party cookies when you enable this, so no. This objectively decreases your privacy.
On Brave many of their ads can be permanently disabled in various settings menus. I use Brave on my phone and laptop and can't recall the last Brave ad I've seen.
> I guess someone out there has a use case where they need to run this over an SSH session?

Raises hand.

I write a lot of internal tools for musicians (primarily film composers), many of which are primarily local but will be web-based once I put together the rest of the pieces of the pipeline. Being able to run the same interface as a local desktop app, or as a web app, or over an SSH connection, is a huge selling point to me.

Plus, I just honestly love the look. It's clean and simple with high information density. Totally my cup of tea.

IMO Textual/Rich is one of the coolest projects to come out in recent years.
I recently started learning Elixir and find it super interesting (along with Erlang.) The paradigm is so different. Mostly I am looking at it for hobby projects. It reminds me a bit of OpenVMS, where the OS had built in clustering facilities, processes had mailboxes, etc.

I've done a bit of Go in the past and it definitely has its place, too. It feels more mainstream. We converted a Python app to Go a few jobs back and the performance increase was incredible.
Nah. You do this kind of dirty work at Google for a few years. Then you say that "after working at Google, you have decided to fight for users" or some other noble goal.

Now you have it both ways. You have the resume prestige of working at Google and the faux prestige of being a "virtuous person" who is willing to forgo the comfy Google life to "do what is right."
Lots of people would be blocked iMessaging each other TIF images.
Ritual mass murder was a yoga class
Legal requirements are there for N jurisdictions; it's just few companies implement compliance with them, and too often shift the critical thinking about their implementation to an unreliable or expensive third-party.
The privacy preserving ads tech has been around a while and a lot developed outside of Google and Meta. I made a stab at it while an intern at Mozilla, and we basically succeeded at the very easy part of accounting. Training the bandit is a lot harder.

Also the adtech industry in it's current form is harmful to users. First of it exploits tracking vectors. Secondly it's a malware distribution technique second to none.
Daniel Mendler (minad on GitHub) et al. have some seriously awesome packages. The latest one I’ve fallen in love with that I haven’t yet added to bedrock is Jinx [1]: a fast spell-checker that supports multiple languages in the same buffer, checks spelling of words based off of font-lock class (read: spell checking in doc strings and comments but not in actual code) and a slick interface that makes correcting words a breeze.

I’m so happy to hear you’ve found some helpful things from bedrock! Happy hacking!
It sounds like it would be very unsafe to drive on a truck-priority road (especially since, as the other comment points out: there's a good reason trucks are given priority)...

Then again, in general, the interstate highway system in the US was scary, when my family used it for a road trip. I left the experience thinking: "I wish there were more train tracks than roads..."
Jokes on you, I don’t use Windows
Hey guys, please stop giving market share to Chrome. Firefox is not only an objectively better browser but you're supporting an open web instead of a terrifying data behemoth.
> Didn't work that way for 2 out of 2 of my family members.

Set & Setting, dosage is important.

https://pubmed.ncbi.nlm.nih.gov/25586396/

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4286320/

Personally for me, it helped me quit alcohol, cannabis, and even alleviated my diagnosed ADHD permanently so I quit taking my prescribed stimulant medications. I used it in a therapeutic environment, not with friends or at a party.

After numerous Ayahuasca ceremonies, turns out my traumas/upbringing led to the addictions in the first place.
I don't see hype they outlined a roadmap and are working on it.
Not sure what fancy means in this context.
Swift Objective-C story is pretty much inline with this work.
Come to think of it I don't really remember Chris not delivering on a project.
If fancy means people who created and delivered on multiple very challenging projects I guess they are fancy.
and/or make it illegal to gather consumer information without explicit, periodic consent. Make it doubly-illegal to sell data or rent it. (If "rent" doesn't cover it, also outlaw whatever thing google claims it does when it monetizes user profiles for ads.)
Perhaps more users?
Thank you for trying it out and the feedback.

1) I have increased the spacing between stories. Also, have you tried the Mobile view?

2) Looks like some websites are harder to parse than others. Some users have also reported similar issues with GitHub/Gists. Will investigate.

3) I've removed the rating for now. Will add filters to the roadmap.

4) I'm currently showing all 30 articles from the HN frontpage. Would you prefer fewer articles, but paginated?
The claim is likely not false just like a horse pulling a buggy is several orders of magnitude faster than a snail.
I think this comment exemplifies the attitude that leads Linux to be this mostly niche thing that even most devs don't want to deal with.

> Your discord problems are almost certainly caused by you doing it wrong. Linux is not a magic solver of problems, you know your way around windows, but if you invested same time into learning linux as you did windows, you'd know how to do things there aswell.

No bro, it requires zero investment of time to "know your way around windows" for basic stuff like installing consumer programs--that's the thing. Not sure how you're missing that. I don't think I've ever installed anything incorrectly on Windows. I'm not sure that's even possible.

The issue is not that I expect Linux to be a "magic solver of problems"--it's that there are a lot of problems it has which are ridiculous in the first place and don't exist on other operating systems.
And honestly also from the cops perspective. It’s a way in.
Now lower taxes, start picking up poop, and enforcing property rights, and I might move back!
I don't know why you so-called experts and self proclaimed intelligent people never shares the complete steps, requirement info to test, debug any code for new comers. Do you really feels that new comers and less knowledge person never can good inputs? I myself struggled to install web ui of oobabooga, downloaded two models i.e. one from main branch which hanged the pc and second 4bit-32g-actorder, which failed by 'AsyncRequest' object has no attribute '_json_response_data'. Now I am clueless and disappointed by un-human behavior of you people.
Lockdown mode disables shared albums, which I use a lot.

I would rathe have a full app firewall with configurable profiles instead of lockdown mode.
More often, that's just a narrative invented / promulgated by people who won't/can't admit that their movie stinks. Instead of admitting they failed, they go looking for excuses. If you search social media you can find instances of wackjobs saying anything about anybody, so worthless anecdotal evidence for any review-bombing narrative is always easy to find. If your movie had lots of black people, say that it failed because audiences/reviewers are racist (and ignore the existence of movies with similar casts that were very well received). If your movie has lots of women, say that the audiences are sexist. If your movie mostly has white dudes in it, then fall back on some generic insult like...

> *“The studios didn’t invent Rotten Tomatoes, and most of them don’t like it,” says the filmmaker Paul Schrader. “But the system is broken. Audiences are dumber. Normal people don’t go through reviews like they used to. Rotten Tomatoes is something the studios can game. So they do.”

...calling the audiences dumb. There are plenty of smart movies that manage to find smart audiences, but for some reason those smart audiences just don't exist when considering his movie. He can't admit to himself that he doesn't make very good movies, so he prefers to think that everybody else is stupid. Blaming audiences is a coping mechanism for bad artists.
Switching to Word2Vec embeddings led to a substantial improvement in my cosine similarity evaluations for text similarity, but granted I was looking for actual similarity, not relevance. I tried many different methods and had lots of mediocre results initially.

code:
https://github.com/jimmc414/document_intelligence/blob/main/...
https://github.com/jimmc414/document_intelligence
Lenat and Cyc
n 1984 Doug Lenat began the Cyc Project with encouragement from Marvin Minsky. John McCarthy, Ed Feigenbaum, and other AI pioneers. In 1990, Lenat and Guha published a revised version of the Five-year report on Cyc: Building Large Knowledge-Based Systems: Representation and Reasoning in the Cyc Project.

In 1993, the AI Journal published a special issue with several reviews of that book. Doug sent me a note, saying that my review was the fairest and the most painful. The reason why it was painful is that I pointed out all the unsolved problems they were still working on. They have spent 32 more years working on those problems, and they have made some progress. For a copy of the review, see https://jfsowa.com/pubs/CycRev93.pdf

In June, Doug sent me an article he was working on. and I asked him about giving a talk in the fall (via ZOOM) about ways of connecting Cyc to GPT systems. He said that he was in the hospital for some chemo treatments, and he was enthusiastic about the idea.

In July, I sent him a note about making arrangements, but he didn't replu.
Chris Lattner: Future of Programming and AI [video]
> enough money to work for 4 years and retire anywhere that’s not the Bay Area

Four years is probably optimistic, unless you got lucky with stock growth.

I searched for "average cost of living map" and found a site[1] that says cost of living at Santa Clara County is $138K. I then did a search for "average salary at Google" and one website[2] says it's $124K, which suggests saving enough money in 4 years on salary alone would be difficult.

You might think that working for Google while living somewhere outside of Bay Area would be a good way to save, but because compensation is dependent on where you live, this doesn't always work out.

[1] https://www.epi.org/resources/budget/budget-map/

[2] https://www.payscale.com/research/US/Employer=Google%2C_Inc....
> I have also found the obsession with reducing time to first plot incredibly aggravating. It is finally down to a pretty good level, which is a nice quality of life improvement

For the target users of Julia, which are academics that are currently using Matlab or Python, time to first plot is one of the primary reasons that they are not willing to switch to Julia. Especially if their current workflow is writing a script then pressing run button in Matlab or calling python my_script.py, then they do julia my_script.jl and they expect it to work the same way as Python or Matlab do. This is why in all the user & developer survey TTFP is consistently ranked highest.

As a research software engineer, I've seen PhDs and postdocs that are downright scared of programming and any kind of low level technical work in general, even if their problem domain requires high performance languages. They just want their project or thesis to finish within their probably unrealistic deadlines. You throw them to a language with strict type checking or traits and interfaces and they will just give up. Unfortunately if the language users are filled with these kind of user then it results to this kind of problems, which you did mentioned in your second paragraph.

> It is incredibly hard to reason about this language if every developer is not willing to commit to understanding and writing Julia code the right way (e.g. type stable, dispatch via the type system, actually defining interfaces). Given the target demographic of academics, the proportion of people interested in grokking Julia is vastly smaller than the number of academics who hear "walks like Python runs like C" and decide this is their new, free, hip MATLAB/SciPy replacement.

Thinking about it, to solve this Julia problem we need to solve academics scared of programming problem. I don't have a solution to this either, I've been trying to think about it after seeing several people keep asking me for help in programming
I don't think web developers should be able to detect stuff like that either. Their ability to detect stuff provides identifying bits for fingerprinting. As far as I'm concerned, all the browsers should normalize the return values of those typeofs and all related functions so that Javascript can figure out exactly zero bits of information about the environment it's running on. Just like browsers will lie to Javascript when it tries to figure out your browsing history by checking the color of links.

The web platform gave web developers way too much freedom and they're abusing it. God giveth and god taketh away.
> For many, gaining knowledge about the universe is its own reward

But is putting humans in a low Earth orbit really gaining knowledge about the universe at this point? Surely we've hit the point of diminishing returns by now.