skysight-inc/HackerNews huggingface dataset:
> [..] I’m here to discuss security updates for IoT devices and how you can make a difference by filing comments with the FCC.

I'm obviously somewhat invested into the Hacker News platform, but please be sure to get opinions from other groups too. For example, hacker groups may have interesting comments on right to repair.

> I’ve advocated for the FCC to require device manufacturers to support their devices with security updates for a reasonable amount of time [1].

Either require updates, or open up the devices such that a community of open source developers can write updated software. The benefit of the second proposal is reducing e-waste after the update period elapses and encouraging up-cycling.

> If they meet certain criteria for the security of their product, manufacturers can put an FCC cybersecurity label on it.

It's only as good as you enforce it. It might be easier for somebody like Google to buy a small IoT company, fold it rather than invest in updates, then take the IP and employees.

The payment for the FCC sign-off could be large enough that the FCC could feasibly demand access to the internals and pay somebody to patch it on their behalf (like an insurance policy). Of course the preferable option is that the company addresses this themselves.

> I fought hard for one of these criteria to be the disclosure of how long the product will receive security updates.

Good, but not quite there. Providing some form of update is not the same as providing a comprehensive security update, or a timely one. There should be a window of something like 3 months (very generous) to make a good-faith effort to respond to an identified security issue (CVE?), either internally or externally.

The devices of course also need to demonstrate they are capable of receiving updates and that consumers are capable of applying an update, even if their infrastructure/company is down. For example, a signed patch could be applied reasonably easily via USB, or over a WiFi interface.
Are people outside of the U.S. eligible to apply?
https://news.ycombinator.com/item?id=37399187
IP reputation is absolutely a thing, as I understand it it's a large factor in Cloudflare deciding to put you in an infinite loop (or trigger the protection at all).
Answer to this mess is mass disorganized non-compliance.

Don't pay tax
Don't vote
Don't take admissions into school and colleges.
But, can't you commute to all those places from half an hour away?
I understand Google results are personalized but for a site I never visited before and a search term I never used until just now - that would be very impressive?
More efficient.

They could (incorrectly) call you a "bot" but that's simply not true. You are human.

The amount of server resources you deplete is actually less than a modern graphical browser from an ad-sponsored team of software developers.

However perhaps you are not looking at some ads or submitting yourself to tracking or telemetry. Under the W3C web ethics principles you can consume the data from the web in any way you like.

It is your right to decide what HTTP requests you make. XHR/fetch in someone else's Javascript could be well-intentioned but too often it tries to take away some of that agency and transfer it to a web developer.
I do both. I have gear thing anyway, but thankfully I’m about done with the hand tool acquisition. I bought a subset of the Lie-Nielsen catalog that I use (after trying out some other brands and not being impressed) and now I don’t really have any hand tools to buy. I’d love to have an antique jointer, a nice wide planer, a nice sawstop cabinet saw, and an antique bandsaw… but I’ve got the cheaper or modern analogs. The sawstop job site saw was a minimum requirement, I need my fingers.
So tourists still spend all their time/money in NYC, with the exception of paying for sleeping accommodations (and taking up beds) there? Isn't that the ideal goal of this legislation?
The one piece of Postman that only Hoppscotch (a Postman fork) seems replicate that I definitely want is scripting. Often requests depend upon data from another, and being able to put things into the environment as you run different requests is super useful (even if you just use it for otherwise unsupported auth methods).
Ask HN: Flutter or Tauri, which one is better for cross-platform audio app?
I need performant audio, so maybe WASM is a must, right?
I download the version from my distribution's package manager, which is compiled by independent volunteers.
Haxophone crowdfunding campaign has launched
After warm encouragement from this community (the Show HN post made it to #1 for a day!) I've decided to launch a crowdfunding campaign for fully-assembled haxophones. Wish me luck!
By default, no telemetry. NO DATA OUT OF MY HOUSE WITHOUT EXPLICIT PERMISSION.
> rather than reject the flight plan for an aircraft that may already be in the air

I wonder why they can't reject the flight plan for an aircraft that's already in the air? Presumably they have any number of reasons to reject a perfectly valid flight plan that's been submitted yet alone invalid ones there must be a rejection mechanism?

The explanation offered by the report (from a quick skim found this on page 9) is:

> Having found an entry and exit point, with the latter being the duplicate and therefore
geographically incorrect, the software could not extract a valid UK portion of flight plan between
these two points.
> ...
> In this case the software within the FPRSA-R subsystem was unable to establish a reasonable course of action that would preserve safety and so raised a critical exception

The failure is portrayed as a reasonable thing to do and yes it's good the system failed safe rather than continued with a bunch of corrupt data no-one knew about but it seems bizarre that a single dodgy flight plan resulting in the whole system having to shut-down was an intentional part of the system design. It does sound like they don't have strong isolation around individual flight plan processing so an exception thrown there just propagated up to bring the whole thing down.

More damningly the duplicated waypoint names with different positions is a known issue with work on-going to produce a globally unique set of names (from what the report says) so this is hardly unexpected. Surely any decent test plan would have included this scenario?
Yes. The OpenAPI ecosystem is in a shockingly shambolic state. I was charged with creating an API for my company's line of network-enabled products, so I defined it in OAS 3.1.

But years after the ratification of this standard, pretty much no tools fully support it, and the code-generation toolchain is a pathetic joke. When I explored it further, I found that this state was well-known in the development community, and that even mentioning an attempt to use the OpenAPI tools was a professional liability... as in nobody who knows WTF they're doing would use this shit.

The best OpenAPI-definition tool I found was Stoplight Studio, which never supported OAS 3.1 and has since been pulled from the "market." They have a Github repo that claims to be the app, but contains none of the source and is only... the documentation? I called them out on it and got only an attitude, and the repo is still up and claiming to be the whole tool. Assholes.
> because "meat" has meant one thing for thousands of years.

That's super funny that you wrote that because actually "meat" comes from Old English "mete" which referred to food in general.
Mastering iterative upward failure.

Boris was a lovable clown who self imploded so badly that surely no one could be worse --> internally 'elected' replacement Liz Truss who lasted less time than a shelf cabbage after tanking economy --> Rishi Sunak.

I can't see as how anything has been done right since the UK started down the distracting BREXIT path that nobody particularly wanted in the first instance save for some kind of confounded "No, I double, double, dare you!" trigger moment.
Adyen

https://www.adyen.com/pricing
Android allows you to swap the virtual keyboard. I use unexpected keyboard which is also free software. It's excellent for programming. Before that I used Hacker's Keyboard which has actual arrow keys.

Termux also has a configurable bar at the bottom where you can map any keys you want. I use it for function and arrow keys plus a bunch of common symbols.

Here's an example from my dotfiles:

https://github.com/matheusmoreira/.files/blob/38565320fefb92...
I can see the point here. Ad companies will track your browsing history. Google doesn't want to rely on cookies and fingerprints and probably wants to nuke tracking capabilities as well, but doing so in their browser while they still sell ads would be regulatory suicide.

Providing an open API for advertisers that doesn't require endless digital stalking is the only way Google will ever be able to enforce stricter anti tracking features. Their announcement that they were working on ending third party cookie tracking was met with threats of lawsuits and antitrust.

A locally classified list of topics that can be spoofed by the user agent is an excellent privacy measure. Nobody wants ads, but I'd rather have Chrome enable site isolation than the current status quo.

Honestly, I don't see the problem here. Your browsing history isn't submitted to Google according to the spec. There are aboit 8 bits of entropy for fingerprinting, but who cares when WebGPU and the canvas APIs provide ten times that already.

The privacy invasion argument seems to be "but it's based on my browsing history" which is exactly how all major advertisers have been doing it for the last ten years.

If this gets cancelled, Google isn't going to implement any anti tracking features in Chrome. They legally can't because of advertisers as scummy as them. They can choose between dropping their main source of income (lol), leaving Microsoft in charge of Chromium and killing Chrome (lol), do nothing against the current atate of the web amd tracking, or work with advertisers in a way that doesn't get them sued to hell over antitrust.
When I hear of the Black Arts I think of the German 'Schwarze Kunst'.

Despite what the literal translation might make you think, the German term does not refer to the occult. It relates to the art and craft of printing.

'Weiße Kunst', the white arts, apparently refers to paper making.
Her Twitter bio read, "It is the true teacher who leaves the class knowing they have learned the most."

Such a mesmerising human being!
Which is false BTW, unless you are using some Google services optimized for Chrome, such as Google Sheets.
Sure there is, as always: load all the code into the running SBCL, then call (SB-EXT:SAVE-LISP-AND-DIE :EXECUTABLE T :TOPLEVEL your-entry-point). The downside, as always, is that this kills the Lisp process, and the resulting binary weighs tens of megabytes even for a simple hello world. I guess one of these disqualifies it as not hassle-free.
Yeah, please don't compare ads with actual murdering, raping and civilan massacres.
To be fair this kind of work to put old games into Steam is probably farmed to 3rd party company that just took the path of least resistance. Is the Rockstart liable (legally) or the company? I would imagine them farming it out to 3rd party is, in part, to keep legal deniability

Just like when some old Mario game got ported to the 3DS store and it turned out was a rom from the internet
Location: Anywhere in the US
Remote: No preference
Willing to relocate: Yes
Technologies: Python, R, ML libraries, Data Analysis
Résumé/CV: https://dropover.cloud/3aed4e
Email: avi.seth8@gmail.com

I’m an MS in CS graduate from Virginia Tech, May 2023. I did my thesis on Data Sharing in Manufacturing and although I’m not at the liberty to discuss the details of it until the thesis becomes publicly available, my paper sheds some light on the work that I did. I have a fair bit of experience with Data Science and ML, and did a variety of work in the field – Data Science for Public Good, internships at an M&E firm (Arqaam) and for an F&B flavor prediction company (Gastrograph AFS). At DSPG, I also build dashboards to portray the analyses we did. I believe my strongest skillset is my ability to look at numbers and patterns and be excited to unearth whatever I can with them. I am an excellent person to work with because I love talking about anything under the sun, and I maintain a lot of interests outside my field of occupation. I am also a home Barista and enjoy discussing coffee brewing – always happy to make a cup for you and tell you all about it!
Because it's a nonsense argument repeated ad nauseum by people in technical fields (and, to be fair, sometimes in other fields; but I see it more often in technical fields). Most of us don't understand the work being done by the people we claim don't understand our work; that's fine, it's normal, people on both sides have spent years and decades learning how to do their jobs, and it's unreasonable to expect someone in another field to fully understand your job.

The problem is that we often think that if we don't understand something, it must not be valuable; and I think this problem is exacerbated by high levels of education and/or intelligence, because we usually understand things, which must mean the things we don't intuitively understand are obviously not valuable.

The reality is, there is some bloat which gets introduced as businesses grow. But it's not as much as we often think.
Out of interest, how did you format those tables? They look really nice.
I just remembered many old analog electrical ovens had this already , the only way to turn on the oven is by setting a timer (and when you needed it on for many hours you had to set another timer for yourself to remember to extend the oven timer ).
Is any other major browser vendor planning to remove 3rd party cookies as well?
Yeah, I like Vivaldi too. It's been a string of largely pleasant surprises since I started using it a few months back, along the lines of "I had no idea I needed this until now". The only downside has been the occasional crash, perhaps because I've gone overboard with workspaces relative to the specs of my old PC.
There is an end in sight: Firefox's. Mozilla has billion dollars and is cutting back on Firefox software development to focus on paying executives and pushing agendas.
Around 70%, if it's a owner-driver (so includes fuel and maintenance) in UK.
That is sad. She was with the web from its early days (her first book on the subject is from 1996), taught a lot of people, and bridged several communities: design, web standards, and accessability
No, I mean the dumped image depends on system glibc (not portable)
It has been used in the context of firewalls forever.

https://en.m.wikipedia.org/wiki/DMZ_(computing)
Did you not even read the posts?

This has nothing to do with shorts lol.

It's a video series by Google that showcases latest apps and games on the Play Store.
I think it is necessary for being really successful in most fields that you neglect a lot of other stuff. I've had to deal with quite a few successful scientists, and it is striking how otherwise very intelligent people can show an almost shocking naiveté in regards to, e.g., politics (outside faculty, I might have to add).
A far-less-dangerous option would be to make it an educational requirement in schools. Focus on increasing the qualifications of the citizenry without making it a hard-requirement to vote.

Anecdotally, my school had a 1-semester Specific History Of This State that all freshmen had to take and probably forgot, plus an seemingly-inordinate amount of time spent on the exact dates and locations of Civil War battles.

Instead, imagine if some of that time/instruction was set aside for practical civics, including tricks like wrecking amendments [0] or weaknesses of plurality voting like the spoiler effect. [1]

[0] https://en.wikipedia.org/wiki/Wrecking_amendment

[1] https://en.wikipedia.org/wiki/Vote_splitting
You can feed websites fake topics to mislead them, or even allow the user to pick their interests if they do want ads. That's a lot easier than sending your browser through random websites to shake off trackers and analysers.

Cookies are hard because other browsers do isolation based on top-level domains. Fingerprinting is the only way to track non-Chrome browsers.

Google wants to do cookie isolation as well, but ad companies threatened to sue them over it, so they can't for now, not until there's a viable alternative.
So next time you are purchasing something, do you promise not to look for the cheapest option, but the one that pays a good wage to the supply chain? As long as people make purchase decisions based on price, they will be part of the problem.
I cringe when I see statements like that. Replace $OS with anything else and you should be able to see what I mean. This wasn't built exclusively for anything, it's a monetized side project, and this submission is an advert.
The backend has to search through TBs of data per request
Some employers ask this at the start. Then, you'll go through $x interview rounds.

If you say 100 quatloos, then go through 3 rounds of interviews, discussions, and they offer your 100 quatloos, you'd be an asshat to complain about salary.

And the employer would have every reason to think you're a dumbass.

Note that refusing to answer is fine, but being entirely dishonest (a random number, eg "any response"), would make me believe you are utterly untrustworthy.
> That's a 91% hit rate of solved challenges which is great. That remaining 9% is either humans with a false positive or... bots getting rejected

If I meet a "human check", I quickly decide whether it is worth me solving it, or just close the tab. I could imagine 9% of people just giving up. Some of these CAPTCHAs require you to find 20 fire hydrants on 3 different rounds of tiles, just to fail you anyway. We have loads of data on websites keeping user's attention [1], this also seems to apply to CAPTCHAs.

Besides, I think it is now well known that AI is fully capable of solving CAPTCHAs.

[1] https://www.nngroup.com/articles/response-times-3-important-...
That would be one of the uses AI could excel at: reading license agreements, contracts, etc, to find changes and hidden traps in general then report them to the user.
Anyone can translate any video to their language and expand viewer base inserting just an YOUTUBE LINK. It is FREE, period.

Please try out clicking on Dashboard on top-left and let us know how you liked. No Credit Cards, no lock ins!

https://autodubber.neurals.ai/?y=2
> Let me rephrase the question then: how often would a normal person need 10+ hours battery life?

This isn't some hypothetical debate about what "the average person" needs to determine how important a given aspect is.

It's one specific person who wants a specific thing. You don't need to question how often they need something - they've told you a specific thing they want and the reason.

The "real world" tests from Laptop Mag suggest M2-series Macs have 16-18 hours of battery life doing exactly what OP asked for: browsing (and light coding). Of the 10 laptops they tested, 7 were ARM based, and the "best" non-ARM was #6 in terms of battery life, the other two were #9 and #10.

Regardless of whether you want/like Macs specifically, I think arguing against the common wisdom that modern Arm devices are typically get better battery life than x86 competitors is kind of bizarre. It's like arguing that 64bit was a mistake or the Internet is just a fad.
Hi from across the pond...

This is a great initiative and will be crucial for keeping a free and open society running smoothly in a more hostile information security environment.

My suggestion is to have a look at the work done in the European Union with Cyber Resillience Act. Much can be said about what EU is doing and the competence of the legislators there, but CRA is actually quite decent. If an upcoming FCC regulation would be somewhat aligned with what is required for CE-compliance, the life for us working with developing IoT-products with a global footprint will be much easier!
If you're still using Chrome, then this is the shit you deserve, period.
> Misogyny is supposedly rampant in modern society, but where, exactly, does it lurk?

In every word in this article and the bullshit worldview that underlies it, for one.
In Germany, there is an account people can donate money to, to reduce state debt ("Schuldentilgungskonto"), without any personal benefit. It's not even tax deductible. I think that would qualify to refute your last paragraph. It's not used a lot, though. 1.33M in 16 years.
Where are you from ?
What's your occupation and nature of contract?
Thanks! Judicious use of the space bar and back-space keys. :)
I see. Thanks for the clarifications.

And these DB migrations, did your team keep a history of them? If so, did you manage them yourselves, or did you use some tools like flyway?

I'm asking because I'm starting a project where we will manage the persistence SQL layer without any ORM (always did it so far with Django's migrations), but might consider some third party tools for DB migrations.
Great article. Thanks!
Why were you looking for a Postman alternative? I thought it was open-source.

I'm using Thunder Client in VS Code at the moment, but if my needs become more complicated I don't want to invest in anything douchey.
I made a VST plugin that makes modular synthesis fun and user friendly
Download as VST3/AU/Standalone for macOS/Windows at https://www.soonth.com/
> Is it really just the money?

I hope so. I can at least understand that. People have principles but they also have prices.

It would be a completely different matter if they actually believed what they're doing is moral though.
They likely don't change a lot, so the AI called diff would suffice
1. The argument that "it's been happening for the last ten years" is not a valid justification for the continuation of a practice that infringes on user privacy. Progress in digital privacy rights should aim at enhancing user control over their data, not maintaining status quo.

2. The suggestion that Google has only a limited choice between maintaining its main source of income or facing antitrust lawsuits is an oversimplification. Google, as one of the most influential tech companies, has the power and resources to innovate and find alternative models that respect user privacy while also providing value to their advertisers.

3. The idea that an API to track browsing history is a "privacy measure" because it can be "spoofed" by the user is flawed because it assumes all users have the technical knowledge and time to do so. This should not be a user's responsibility; privacy should be a default setting, not an option for the tech-savvy.

4. Lastly, just because the browsing history isn't directly submitted to Google does not mean it cannot be misused. Even if Google uses this data responsibly, the potential for abuse still exists with third parties
The guy was regurgitating Russian propaganda talking points on twitter just days before the invasion and then accepted Russian citizenship after the fact. At this point considering him a Russian asset seems reasonable IMO.
How to Write a Secure JWT Library If You Must
Everyone probably knew, this was coming.
Excited and waiting for the code release!
This is so incredibly cool. It's such an amazing acknowledgement of this style of music, making it easier to create and consumer chip-styled music - it is also incredibly important that we all continue to support this by creating software so that we can access the legacy music in its original form.

*
How Vercel shipped a cron jobs feature using AWS EventBridge Scheduler