skysight-inc/HackerNews huggingface dataset:
Changing your password wouldn't help in this case. They used lastpass to store their crypto wallet seed phrase - this can't be changed. They would have to move to a new wallet and pay transfer fees in the process.
IIRC there was some memory leak issue in the custom rendering engine/language that was being used and for a time the solution was to reboot any VM that has taken more than $x requests. $x was a very small number
What are the modern / well-designed alternatives?
I wouldn’t see the problem with that. Tourists would still flock to NYC during the day and businesses need not worry from a drop in business, it’ll work out.
And if your dad was an entry level or journeyman cabinet maker today, he'd be making $25/hr no benefits.
On the 10th anniversary of the Snowden revelations
Can be, but isn’t. The most cost effective way of generating hydrogen is by cracking it out of petroleum. That won’t change anytime soon.
“Green hydrogen” is a lie created by the petroleum industry.
Stay away with your regulatory capture garbage. Software is free speech you have no power here.
I would expect as a baseline that some third party (maybe not necessarily Joe or Jane Public, but at the very least a subpoena-wielding lawyer) could require Canon to produce the original raw camera pixels, and check that they match the signature in the final publicly available JPEG. At that point, this third party would have access to the first and last stages of the image processing pipeline, which is likely enough to decide whether the edits were legit.
It's nice that this will theoretically lower rental prices, but in practice there's no way that will happen. Demand is just too high. I don't believe that the number of short-term rentals was the difference between supply matching demand. The real solution is to build more apartment units and crack down on people subletting rent-controlled apartments where they haven't lived for years.
Okay, they complete on quality but they are "close" to use your term.

My point was that paying to be the default is not enough. A challenger needs to also overcome the brand preference has built. A one-time investment of $20B (or even $3B) would be wasted. A true competitor would have to be in this for the long haul and willing to outbid Google for many years. Additionally they'd need to invest in building their brand image against Google which would be expensive and risky.

> Samsung was considering switching to Bing

Great case in point. Samsung (not Bing) backed out of this "over concerns of how it could affect its relationship with Google and the market’s perception of the move" [https://www.theverge.com/2023/5/19/23730368/samsung-google-b...]

Demonstrates that its not just money that is required to compete with Google.
Green hydrogen is made from water.
> but you're lucky you're a man because status is just as important

Am I lucky? I work in tech. I'd say about half of the women I talk to at bars in NYC end up turning away as soon as we shift to the discussion of what I do for work. I dress much better than most men but I am short, ugly, and not blessed with the high T that is required to gain lots of muscle mass even if I am in the gym obsessively.

Hate to break it to you but the market has changed.
It's a complex question. Without totally committing to the rabbit hole, one can say that the first order effect is that a Twitter bankruptcy would result in the creditors owning Twitter and the equity holders getting wiped out.
No such thing in Manhattan. Heck, even a mid-tier chain hotel on 5th Avenue is going to feel claustrophobic for one or two people, let alone a family.
> The best engineers and managers are great at adding value, getting the most out of the people around them, and helping the team see around corners even when they’re not there.

People keep repeating this dangerous advice. The truth is actual value is created by few people: new tech, new features, new markets. It usually starts off as an experiment, a hackathon etc and grows from there. The rest of the people exist to provide fodder but growth comes from surprisingly few people even in large organizations.

Try and see what the business needs and create step improvement features / tech / markets. You will feel happy. Too many people like the author is focused on just managing, being "thought leaders" and other nonsense. This is my problem with AI till the time we get AGI. Someone has to do the work. Someone had to write Redis before Ofer Bengal swooped in. Someone has to create the transformer model, someone has to write the original articles to train these models on.

The whole cottage industry around work is a festering wound at this point.
Strongly disagree this is a junior dev thing. Most of the terribly complex abstractions are, in my experience creates by people who have enough seniority that others can't easily question them. There are good devs and bad devs, and there are junior and senior devs, but it's the first axis that determines code quality.
https://www.wabe.org/georgias-warming-climate-leads-farmers-...
I don't know how your comment is in any way related to mine, as I was responding to the claim that 8-character master passwords were considered safe <some time in or after 2008>. TFA also doesn't mention any evidence of keylogging.
I don't think you want to get a floppy disk anywhere near an electron microscope if you care about the data on it.
My experience with NYC hotels is that rooms are really cramped, so I wouldn’t call it comfortable for four people. And not to mention prices of hotels aren’t exactly cheap, and this law clearly isn’t going to help lower hotel prices. But maybe fewer tourists is what NYC needs.
>Editors then work with the pictures, and each successive modification or edit creates a new record in a private database (ProvenDB) that is indexed to the original registration. This allows edit logs to be kept private, but these logs also have their authenticity records registered on the Hedera public ledger.

How exactly do you keep the edit log private without completely losing the chain of authenticity here? One of those edits might be to, say, double the size of a plume of smoke or change a signal flare into a set of missiles[0]. All you have is a promise that at some point, someone opened a real image in some kind of editing software.

The inclusion of a bunch of blockchain nonsense to store the verification also smacks of amateurism. You don't need a public chain with financial costs attached to secure photos you validate yourself. You can just publish a bunch of hashes and a hash of the prior block. Certificate Transparency does this and it works.

[0] https://en.wikipedia.org/wiki/Adnan_Hajj_photographs_controv...
You appear to be under a lot of mistaken assumptions.

And in any case, the default ideal is to have an option to update or reprogram devices in-person.

It's never an ideal, that I've ever seen expressed on HN, to have a remote actor capable of doing so, unless in a totally air gapped environment.
Node.js now includes built-in support for .env files
GPG is not good now? When did that happen?
Hi Jeremy, always a fan of your work! Just a technical note since it falls under my domain of expertise (astronomy) -- the example about MOND described here should actually have choice (E) as the correct answer!
Hey Jeremy, it seems like you could calculate exactly how much a model learns in a single step by calculating the loss for a batch a second time (with no_grad) after the loss is calculated the first time and gradients are updated. This seems like it could produce interesting outputs when graphing the difference of first and second losses at the batch or observation/question level.
only very big cities have trains and again they are only convenient if they are going in your direction. I lived in Montreal for six years without a car. I could walk to work in 45 minutes. It would take 1/12 hours to get to work by subway and or bus.
The underlying content provenance scheme here (C2PA) was presented at this year’s RWC[1].

[1]: https://iacr.org/submit/files/slides/2023/rwc/rwc2023/13/sli...
I haven’t downloaded RecipeUI yet to give it a try, but plan to. Does RecipeUI support importing OpenAPI specs in order to enforce type safety? I personally don’t like watching demos and prefer to read documentation. This information wasn’t available from the site.
Agreed, it's no better than using a fingerprint to secure a device.
> Recall that the GPL (non-affero) categorizes runtime linking to GPL’d binaries as a derived work.

Generally a bug tracker (SAAS or not) that uses a database does not need to link to the database unless the database is SQLite.
I don’t work in a startup so I am ok (and no plans to)
Is it really Cloudflare? There is no branding and all the other Cloudflare sites have stopped using Google's reCaptcha and switched to in-house solution.
The flip side of that is you can use control of all those high wattage devices to prevent power outages by shifting load to times when more energy is available.

Hopefully, that's how the impulse will be remembered.
http://web.archive.org/web/20230905224123/https://www.theatl...
I'll bite - so how do we get all those "air gapped"?

It's a leading question of course.
It is an electrochemical process. It is similar to other electrochemical processes, like charging batteries. The better question is how did people get convinced it wasn't efficient? Likely, this is the result of some kind of corporate FUD, possible from oil companies originally, but now more likely from battery companies.
Something that still hits me (hard) is how you suddenly have to be a model, or at least try. You can't take the easy road anymore, little eyes are watching your every move.

I started thinking over my generous way of giving ethical and generally grandiloquent advice when I started being held up to it by ever watchful little eyes... I find this being the hardest, either way: admitting I'm not so great in some respects, or bettering myself. Both are incredibly hard.
I work at a place that will pay for those types of licenses. That’s my point (but we don’t need to because their license doesn’t require anyone to pay for Enterprise or Cloud)
But any trickery employed is traceable back to that specific camera, meaning that the camera owner's reputation is on the line if it's discovered.

Will that reputational risk actually have any teeth? That's up to us (society at large).
I have a HiFive Unleashed, one of those used to demo them at the Embedded Linux Conference in Portland in March 2018. It was over a year after that before the ISA was ratified (and of course designed well before that) so, as I said, there was no guarantee that it would actually qualify as "RISC-V" long term.

With the HiFive Unleashed SiFive "shipped a draft spec", which is exactly the same thing they shit on Canaan (K210, priv arch 1.9.1, literally a snapshot of the Rocket repo) and THead (C906/C910 RVV 0.7.1) for. They just got lucky that no breaking changes were made, unlike the other guys.
It’s been about a decade[1]. You can find older links as well, but that’s a decently old one from an authoritative source.

[1]: https://blog.cryptographyengineering.com/2014/08/13/whats-ma...
except its not 0 index!
It’s hard to do direct comparisons when most of this isn’t public information, the job requirements are so different, and inflation plays such a big role in these comparisons. A dollar is nominally worth 1/2 what it was in 1995, but if you’re looking at housing etc the difference is much larger.

My understanding is adjusted for inflation the minimally skilled developer was actually better off on the mid to late 90’s. The median developer was in a roughly similar situation. The elite’s pay was comparable, but today we have a larger percentage of people in that elite category.

PS: IBM isn’t Silicon Valley. Many developers today are still making sub 120k, but that’s really not what we’re talking about.
Show HN: Trellis – open-source Python framework to build DAG-based LLM workflows
Hey HN! Trellis is an open-source framework for programmatically orchestrating LLM workflows as Directed Acyclic Graphs (DAGs) in Python.

My friend and I started working on this a few weeks ago after we tried building applications using mainstream LLM frameworks, and faced all the common complaints (too abstracted, hard to customize, bad docs/support). After talking to a few other people building with LLMs, we also noticed that these frameworks were not inherently built to support DAG-based LLM workflows.

We designed Trellis to be as minimal and flat as possible, so developers can have lower level control over their DAGs. Trellis is composed of only three abstractions: Node, DAG, and LLM.

Node: the atomic unit of Trellis. Nodes are chained together to form a DAG. Node is an abstract class with only one method required to implement.

DAG: a directed acyclic graph of Nodes. It is the primary abstraction for orchestrating LLM workflows. When you add edges between Nodes, you can specify a transformation function to reuse Nodes and connect any two Nodes. Trellis verifies the data flowing between Nodes in a DAG to ensure the flow of data is validated.

LLM: a wrapper around a large language model with simple catches for common OpenAI errors. Currently, the only provider that Trellis supports is OpenAI.

Check out our docs if this sounds interesting: https://interlocklabsinc.mintlify.app/documentation/introduc...

We'd love it if you tried hacking with it and give us any feedback you have! :)
That's very logical.
I so wish this were a modern/mass adopted paradigm with all these IoT and mobile devices.
Is it google summer of code or some similar event right now?

Looks like the most recent issues and PRs are just junk typo / grammar fixes
Actually I think that is a bad thing. Employee negotiating power is strictly capped under such a system. If every employer offers the same range, you’re screwed.
The GPG hate is, in my opinion, overblown.

But modern alternatives would be SSH signing, signify/minisign or cosign.
Many shipping (as in, the ships on the seas) use slave labor. If the cost of transporting goods raises far enough, including coast-to-coast domestic shipping, that will provide an economic incentive to produce things domestically.
It’s especially bad considering their target audience, of whom I am one.
Nope, that's not true.

It's a popular misconception, with a kernel of truth, but the kernel is very, very small: hydrogen and helium are light enough that they are not gravitationally bound to our planet. In other words, if you release some helium in the atmosphere, in time it will eventually escape to space.

While this is true, it's also irrelevant. Once you release a gas into the atmosphere, it's economically lost. It does not matter if it stays in the atmosphere forever, or it makes its way to the larger Universe. For example neon. Or kripton. Or chlorine for that matter.

Separately, there is plenty of helium in natural gas fields. We extract about 4 trillion cubic meters of gas per year. Natural gas contains between 0.01% and 7% helium. At the lower end, we pull out of the ground 400 million cubic meters of helium per year, but we simply don't bother to separate it. This is more than three times the entire Federal Helium reserve.

Now, if you read the article, you'll find out that this Federal Helium reserve is being sold as per a law enacted in 2013. Why did Congress pass such a law? I don't know, but presumably they have looked into the issue and determined that it's worth their time to bring it to the floor and hold a vote on it. The original helium reserve was instituted before WW2, when dirigibles were a thing, and the US was concerned with the Nazi Germany's lead in this particular technology. After WW2 though, dirigibles are only a curiosity here and there. Helium is not a strategic resource anymore.
And buying beer/wine/liquor at 90% of restaurants and retail stores.
What I do is use zx2c4 pass ( https://www.passwordstore.org/ ) where every password is encrypted by several gpg public keys, of which the secret ones are stored on several Yubikeys in openpgp mode.

This way there is no "master password". You need one of the keys and its PIN even if you have the encrypted passwords. Anyone with access to the encrypted files would need to brute force a truly random RSA2048 key which is NSA territory (and elliptic key can also be used now). Or steal one of the yubis and crack the hardware because the PIN is limited to 3 attempts just like on a bank card. Or attack the endpoint which is feasible with any password manager, in fact mine has extra protection because the yubis require a touch for every decode.

Clients are available on desktops (CLI and with GUI) and Android. iOS is sadly not possible because you need more access to the NFC chip to talk to OpenPGP smartcards than Apple allows. They only allow fido2 and basic tags. I wonder if this could be done with fido2 hardware backing but for now it's not possible.

This attack in the article uses the fact that the encryption key is directly derived from the master password using a key derivation algorithm. I'm surprised there is no commercial password vault that uses hardware-backed security like I do because it doesn't have this vulnerability which is clearly an issue in the real world.

With hardware backing there is no delicate balance between usability (waiting for the master password to go through the key derivation) and security (a feasible brute force attack) because these two items aren't directly related. This kind of breach shouldn't have happened.
The point of the whatabout tactic is that there’s always something to critique. You can never have a perfect society.

The story about Germany is very different which is they are expressing a concrete concern about a specific situation, not trying to equate one situation to other unrelated situations. There’s also the fact that the UK and Germany are largely allies with similar principles of government and human rights. And of course UK can talk about human rights if it’s explaining how it’s improving it’s prisons or talking about human rights unrelated to prisons.

None of this is true for Russia and China which equate trying to prosecute potentially illegal behavior on the part of Assange (potentially as a Russian asset) to jailing people who expose embarrassing secrets for members of the government or report information not favorable to the government’s perspective. The closest the US comes to that in recent memory that I can think of is what happened with Valarie Plame and her husband (although neither was a journalist nor did they go to jail).
Plywood furniture is garbage. Plywood cabinets, ok there is a good use for the material. It’s just a shortcut for not having to account for wood movement, but the veneer they put on modern plywood can be scraped through by looking at it wrong. It’s undersized (3/4” is not 3/4” thick) to save money, it’s only got a couple layers, and half the time the middle layer looks like pressed sawdust. Baltic Birch is the only decent stuff, but the cost of it is prohibitive.

The stores you mentioned, even when the furniture is $3000, is made a step up from IKEA in that it’s not pressboard, but it’s probably veneered or made to look “distressed” and dyed as a way to hide the wood it’s made from. You’ll see screws instead of mortise and tenon joints, you’ll see comically obvious grain mismatches, the stuff is just sloppy.

Find a local woodworker, pick timeless styles and get it made from a wood that isn’t that expensive but is beautiful and easy to work like cherry. It will cost something similar to what crate and barrel charges, and you’ll have it in 50 years.
when your scene has become so outdated that it's literally in a museum
I didn't learn much new information from this post. It could have as well been written by a content farm
I specifically said that you're not getting those kinds of movements in the $10/hr kinds of jobs.
If LastPass happened to use the exact same primitive as bitcoin this Asic hardware could still be used. Not sure if the case.
Yes, genius kids all around the world
I feel like those days are long past.
Does it come with a modal keyboard or the same static one?
Was this not sort of the clear implication of the fact that most LLMs are currently only being trained with one epoch?

ie. if they are only being trained from one epoch, there is clear overfitting concerns just by doing even a second pass in the data.

It does seem somewhat contrary to the findings of this paper [0] that found that old data was as good as new for at least 4 epochs.

[0]: https://arxiv.org/abs/2305.16264
Well... damn. Is there a framework like this (or this directly?) which can run object detection? People, car types, makes, animals, etc?
Criminals Rob Thousands of Dollars from ATMs Using Raspberry Pi
No doubt a publicity move agreed between Apple and ARM, ahead of ARM IPO.
>the most commonly cited rationale for institutionalization in those years was

>that neurotypical siblings would suffer—from shame, from attention starvation—

>if their disabled siblings were kept at home.

There is alternative perspective of "Young Carers" or "きょうだい児" in Japanese.

https://en.wikipedia.org/wiki/Young_carer

I don't think it was a easy choice then, or easy choice now.

Seems to be a relevant subreddit.
https://www.reddit.com/r/siblingsupport
> it took Apple 8 or so years to build ... likely relied a lot on what they learned

Apple doesn't build or learn anything. The people they employ to work there do. When those people go to another company ... e.g. a RISC-V company ... they take that learning with them.
M80K requests per seconds were doable in the 90's and you didn't need a super computer for it.
That test suite is such a great resource! And so many architectures.
Let a thousand HaaS startups bloom?
I'd say dunning kreuger but I saw something once that it didn't mean what the popular interpretation claims it means. And I also worry about social sciences reproducibility in general.
The two language problem is, indeed, awkward.

DOM bindings in WASM would be awesome. I would be a happy nerd if I could do all of my web dev in OCaml.

In the meantime, WASM has real, just not for front end dev.

The two language problem is hardly unique to web dev. It’s also ubiquitous in the machine learning/data science space with Python and C/C++/CUDA playing the roles of JS and WASM, respectively.
> The first problem is a non-issue. You don't need the voting machine to do the authentication if you let a human control the ballots that get stamped/marked/whatever.

The machine can register what was vote was cast at 13:42. From there, the whole idea of anonymity disapears.

> The second problem also isn't a problem

The impossibility to have the second criterion is a problem because it prevents the first criterion from being verifiable by anyone.
Being from Portland, I have many pieces from The Joinery. They are absolutely beautiful, and for the ones with a live edge I actually got to pick out the cut of wood.

One more on the list that gets sold through 3rd parties is Wood Castle https://www.woodcastle.com/. They are a bit down market from The Joinery, but not by much.
Really interesting! I wonder how well this syncs up with human intuition and general “information density”. If it’s a close match, maybe you could use this as a tool to help with skimming documents — the red (“hard to predict”) areas might be a good hint to slow down and read more carefully, while the green (“easy to predict”) areas might mean you could skim without losing too much unpredictable information.
I've always said over and over that password managers are a bad idea and kept getting down-voted each time. It centralizes the risk as it creates a large target for hackers to focus on. A good alternative is to use rules-based passwords; each website/app has a different password based on a common non-obvious rule which depends on the website, app or company you're using.