skysight-inc/HackerNews huggingface dataset:
> LibreSSL is the drop-in replacement for openssl that everybody should have embraced back when heartbleed happened.

100% and 1000x times this. LibreSSL does have some minor incompatibilities, but those were mostly about removing obscure and very rarely useful APIs that were badly designed in the first place. It was quite likely that if your program used these APIs, it had security issues that OpenSSL couldn't solve with an update.

(Usability is security. If it's hard to use correctly, then it's easy to create a security hole.)

Remember folks, LibreSSL comes from the same people who made OpenSSH, and that "other" OS that had 2 remote holes in almost 30 years. You already trust them, you maybe just don't know it.
Not on human lifespans. But on species lifespans, we could probably establish contact.
Gentoo will never die, as long as users want to tinker (in ways that Arch can't)

OpenSSL 3.x is in Gentoo, but isn't marked stable for general use yet due to the number of packages still supported that break under it
why the hell is it that anyone who makes these "clever" demos provides the world's shittiest camera that adds unwelcome rolls.

late 90s bedroom me is shaking his head.
What about blacklists? I read that it is a huge problem with custom domains.
If you're hosting the email server yourself sure it can be problematic, but i've never had delivery/recieving problems with a service like Fastmail.
One of the things Prolog taught me was the importance of teachers who can put themselves in the shoes of the student.

At university we were largely taught Prolog by mathematicians who exclusively worked in such languages. Prolog was a very natural way of thinking for them, and many of them had never really used other non-logic/functional languages. For most of the students, who had worked mostly with procedural languages before, it was confusing and frustrating, we would all get tied up trying to use Prolog as if it were some other language.

It wasn't until my third or fourth course that used Prolog, and having studied the algorithm behind it, that I really got my head around how to use it well.

Later on I was helping an undergrad I knew was having problems with Prolog. It was mostly about how to change the way he thought about solving problems to fit in the Prolog world, rather than trying to make Prolog behave like all the other languages he'd used (he was a great developer in everything except Prolog). After quite a bit of discussion there was a real epiphany and he suddenly got it and he proceeded to nail the coursework.
SHA-256 has, well, 256 bits of entropy. What I took issue with was the claim that UUID's 128 bits (well, almost, anyway) are overkill with modern advances in randomness.
Huel.

Better than shovelling sugar down your neck all day, full of nutrients, saves money over snacking, saves time over making a pack up.

It's a small change that makes a big difference, or has to me.

I could put my referral code here, but I'm not shilling or trying to make money, I genuinely eat "hot and savoury" or "Instant Meals" as they rebranded to recently, most days.

https://huel.com or for me uk.huel.com.
... and then people chain it with a sandbox escape.

This bug is the initial vector of last week's NSO Group zero-click exploit for iPhones: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...
Ask HN: Looking for a dataset about startups/companies that have pivoted
Can someone help me find a dataset focused on start ups and companies, particularly those associated with Y Combinator, that have pivoted their ideas and products? I am specifically interested in knowing the original idea they pivoted from, the idea they pivoted to, and the year (batch in the case of YC). Also at the moment I am only interested in tech startups. Thanks for your time.
If getting access to your email is all it takes for someone to empty your bank account, you need to find a different bank.
Most people don't understand the point of microservices. They look at the idea and are attracted by the power of modular interfaces, customizable scalability and independent deployment, without really thinking of the additional engineering overhead that are required to unleash these capabilities.

I've seen ex-Netflix software engineers taking jobs elsewhere and proposing microservices for systems that would receive little to no benefit from them. In practice, the implementation of microservices in these contexts become a costly solution looking for a problem.
My mother in law’s bank account was drained within a week of her passing.

Evidently someone at the hospital had to have been involved, although we never learned the vector.

It’s really not a stretch to imagine a sophisticated attacker who specializes in identity theft paying off hospital staff for access to dead patient’s info, even phones. It’s the last thing on the families minds.

We already know that insiders at cell providers are working with SIM swappers to compromise SMS verification. Why is it unlikely for hospital staff to do the same?
Awesome "error message" from x.com:

y

That's it. Beautiful.

To reproduce

curl https://x.com/username

curl https://x.com

The second one gets a different "error message":

x

That's it.

How to get a "z".
> People rushed out to buy 3D TVs.

well, one of the problem is that they sorta didn't. 3D TV was pushed hard in the channel, but consumers didn't really go for it.
Why would you log an error for an expected path? That should just be an info or debug level log, not error. In any case, it's really easy to disable errors either by line, module or project if really necessary.
Reported by Apple “and the citizen lab at the UoT Munk School”, which is exactly who’s attributed on the page you link to. So yeah seems pretty likely, either Apple uses libwebp internally in ImageIO or they made a similar mistake.
I love caddy, I used to litter my docker-compose.yaml files with Traefik labels like:

labels:
- traefik.enable=true
- traefik.http.routers.foundryvtt-http.entrypoints=web
- traefik.http.routers.foundryvtt-http.rule=Host(`vtt.xxx.nl`)
- traefik.http.routers.foundryvtt-http.middlewares=foundryvtt-https
- traefik.http.middlewares.foundryvtt-https.redirectscheme.scheme=https
- traefik.http.routers.foundryvtt.middlewares=foundryvtt-auth
- traefik.http.middlewares.foundryvtt-auth.basicauth.users=${foundryvtt-BASIC_AUTH}
- traefik.http.routers.foundryvtt.entrypoints=websecure
- traefik.http.routers.foundryvtt.rule=Host(`vtt.xxx.nl`)
- traefik.http.routers.foundryvtt.tls=true
- traefik.http.routers.foundryvtt.tls.certresolver=mytlschallenge
- traefik.http.services.foundryvtt.loadbalancer.server.port=30000

Now I just add the containers (by name), no labels, and map Caddy to their port, like so (in the Caddyfile):

data.xxx.com {
reverse_proxy projectsend:80
}

or, this snippet refers to a WordPress container with BasicAuth in front of it:

restricted.xxxx.com {
root * /var/www/html/restricted.xxxx.com/wordpress
php_fastcgi wordpress-xxxx-restricted:9000 {
root /var/www/html
}
basicauth /* {
xxx $xx$x05xxxxxxxxx.xx
}
file_server
}

Here's just an index.html (from Hugo in this case) in some dir:

blog.xxx.nl {
# Set this path to your site's directory.
root * /var/www/html/blog.xxx.nl
# Enable the static file server.
file_server
}

I love the simplicity.
Yep, not following best practices was banned late 2022 so thankfully your fave outsourced shop is only shipping High Quality and Secure Code (tm)

Oh wait, that whole LLM thing...
SQLite as a Collaborative & Multiplayer Application File Format [video]
That highly depends on who is doing the rewriting and whether they were involved in writing the current system. If someone new starts rewriting the system in a memory safe language then it's quite likely they will make many of the same mistakes the original author did.
> You can see the mess and fix it.

The trouble is, you're often left unwinding a half-dozen layers of abstraction, and in many cases experiencing what looks like some sort of quantum code interaction, where changes in one part of the codebase seem to impact completely unrelated bits of code which now fail tests.

The polyrepo + microservices approach helps enforce boundaries. It also makes rapid iteration easier with more limited tooling, because my code can no longer blow up someone else's code -- a problem which can be solved with dev toolchains, but those toolchains take a non-trivial amount of resources to support.

I do agree, when you need to move boundaries, or need to refactor across multiple packages at once, a monorepo + monolith is great. (A monorepo + microservices can introduce many of the same problems as a polyrepo + microservices, though.)
The author of that tweet clearly has an issue with the arxiv being an open repository where everyone can upload anything. There is nothing about open access in the tweet. And arxiv is not same as the concept or movement of open access. Most articles on Arxiv doesn't even have a proper license to fulfill the definition of Open Access in the BOAI declaration.

Further proof that the authors tweet is not about or against open access is that she publishes open access herself:

https://jlm.ipipan.waw.pl/index.php/JLM/article/view/292

https://nejlt.ep.liu.se/article/view/4017

https://dl.acm.org/doi/10.1145/3498366.3505816
Quest 2 has sold 10+ million units with over a billion in app sales.

By far not mainstream, but it’s around the same as first generation iPhones, so over the coming years may be just crossing the threshold of entering to mainstream.

I’ll make a guess that Quest 3 will have sold 30 million units by 2026, and perhaps the next one after that will be mainstream (xbox, playstation level) territory.
Discord's key features are chat and VoIP. File sharing is barely meaningful, except that it means not needing to use external image hosts for gifs/memes/pet pics.

Discord's initial pull was from gamers who were using teamspeak/ventrilo/mumble + twitch chat and maybe IRC.

If it doesn't do VoIP then it's not a viable alternative to Discord.

It'd be like if LibreOffice couldn't save new files or if Firefox couldn't render images or video.
It's why I'm 100% it can't be advanced life: we can't find life anywhere in the galaxy but we find advanced life in our own backyard (I know 120 light years is quite a lot)?
Because I've been running from doctor to doctor for years without results - because they won't test for anything other than the regular stuff, like blood tests, heart issues, etc. My boss doesn't believe me since CFS or burnout couldn't possibly exist, you just need to focus on your work more. Everytime I say I can't go out since I'm too tired I get made fun of or have eyes rolled at me.

It's like denying someone has a broken arm and gets ridiculed for not wanting to play tennis.
Microsoft has sort-of used heat dissipating lids but that's because the lid itself contains the CPU (surface book, surface pro).
Single note triggered YouTube copyright notice [video]
> The only thing you should NOT do is attempt to host your own email server on a home internet connection.

You can tunnel the relevant ports through a VPS though.

There are quite a few more things that you shouldn't do.
It does make one wonder why adding diminishing returns is the usual way of software development.

Proof of concept -> early release -> stable release -> add feature -> add feature -> add feature, ..., repeat.

CPU cycles, RAM use, storage space, bugs, updates, managing complexity, manuals, adapting to newer standards, programmers understanding codebases, etc, etc, etc. It's not like incremental additions are 0-cost.

Kind of like inventory: of all the stuff (most) people have in their homes, only a small fraction is used regularly. The rest only sees use very rarely, or exists for "nice to have", decoration, or plain luggage / junk. Turning free living space into a junk bin, making it more difficult to move house, etc. People who think that junk in their attic costs nothing, can't do math.

The software fix would be to hunt aggressively for ways to simplify, reduce binary size & in-use memory footprint, remove lesser-used features, weigh any feature (present or potentially added) vs. its impact on maintainability, code size, etc.

In other words: maximize the bang-per-byte. Note this does NOT need to mean "feauture starved". Just very capable / useful given its footprint.

As opposed to maximize the feature list, or throw complex algorithms to squeeze every last % of performance.

Any projects out there that have bang-per-byte as #1 priority?
We are the self-replicating drones.

It's taking a few million years to get from violent confused simians to violent confused simians with autonomous AI. But we're getting there.
You can't expect a program in Go to compete with Rust or C++.

When they say it's "fast" they mean relative to something like Python.
If this is true, that does not sound like a successful implementation of an 'AI'. What would be the point of just parroting some existing content? There is not even an economic reason to doing this. The point is to train a model, some sort of neural net or similar structure, that does not store specific information, but can synthesize new unique content according to some prompt. If some crackhead or group of crackheads is trying to profit by creating an algorithm that regurgitates Sarah Silverman content, then yes, hire a bunch of lawyers and sue them. That sounds like a very stupid game. No legit engineer is actually trying to do that. I'm not cheerleading for some big corporate tech company. I am 100% in favor of open source, run my own little Linux+GPU cloudless experiments. I see the problem as reversed. It's corporations, copyright lawyers and other interests trying to gatekeep data and control who has access to what. I don't think it's healthy to have hyper vigilant copyright laws blocking access to data, so in the end, only huge corporations will be able to pay all the fees to make progress with A.I.
The First Rule of Programming: It's Always Your Fault (2008)
Something seems unusual about your system. Are you using an unusual profile or heavily customized make.conf? net-libs/nodejs-20.5.1 is satisfied with dev-libs/openssl-3.0.10 out of the box here.

I have a fully updated world with a KDE desktop, and don't have OpenSSL 1.1 installed at all.
Well, we're in 2017 (read the thread I posted above), and in that year Caddy was distributing[0] the binary as licensed product. Apache licence applied to its source-code only (e.g. when you build the server from source - which only few people did).

[0] https://web.archive.org/web/20180216153020/https://caddyserv...
The JWST is essentially “seeing” them the same you see all the molecules in front of you in your desk: from the light they scatter or absorb.
This looks really clean. It's amazing the progress Java is making recently; vastly improved async with Project Loom finally released, new FFI, and soon there'll finally be value types with Project Valhalla.
1. They may have found us and may have directed a communication beam at us.

2. The technology they use may be so advanced as to overcome any power problems.
AFIK all CS B.Sc./Ma.Sc. have logic (theory) in their curriculum often as a required curse, sometimes as part of other courses.

Many but not all do also have logic programming in some form. Through that might be just some side project of another course, or might not be done using Prolog.
Automatic Unit Testing for LLMs
I’m someone who uses Discord but (almost) never uses voice chat. To me it’s a text chat platform. This isn’t true for everyone but I feel like it is for a lot of people
Pay a reputable provider to host your domain and that is not a problem. I use protonmail and their sending reputation is fine.

You really don’t want to be self-hosting your own email in 2023 and all the headaches that entails anyway.
Cybersecurity issue prompts computer shutdowns at MGM Resorts properties
Cloud is here to stay, but customers are starting to question the cost
Lian Li has sued Phanteks for patent infringement
Only if you spam. That's why they're called "spam blacklists".

You can spam inadvertently, of course, e. g. if you (or someone else you gave an email on your domain) get pwned. That's problematic.

The issue is still overblown.
Elixir/Erlang is actually a really interesting case, because:

1. It has a garbage collector, and

2. It relies even more heavily on immutable data than Rust.

This means that the Beam VM can seamlessly move green threads around CPUs and preempt them at arbitrary points, all without breaking code. You never need to know who "owns" something, and you never need to worry about another process mutating it while you're looking at it. The Beam VM is amazing.

Tokio operates under different constraints: There's no garbage collector, ownership can be "lent" to other code, and mutable state exists in a carefully controlled fashion. Despite this, Tokio absolutely supports spreading green threads across all your CPUs and moving them as needed using a work-stealing scheduler (IIRC). But this only works if all your closures are `Send` (safe to move between CPUs). And any closure that outlives the creating code must generally be `'static` (it does not refer to references borrowed from its creator's scope).

Oh, and Rust keeps trying create and manage your async & multithreaded processes without trying to allocate heap memory at all. Unless you explicitly ask it to allocate memory. Which you often should.

It is totally possible to make your closures `Send + 'static`. I maintain several production Rust programs which do that, no problem. But doing so requires understanding a moderate amount of Rust and paying a "cognitive tax" by making a bunch of extra decisions about how to represent things. And I think that cognitive tax is a unwise tradeoff for many problems and teams. But I'm still very happy with my async Rust projects, because they get a lot of value out of fast, memory-efficient async code.
Getting permissions on a single website user context is already enough considering the vast amount of user uploaded images on the modern internet. It's a bit like XSS on steroids, because it is not limited to one site or frontend.
Better yet if it was always there.
I only read their homepage (https://asahilinux.org/) - it says "The Asahi Linux alpha release is out!". If there was another (more stable) release available, I assume they would mention it there.
Doesn't change the point. Also doesn't refute the point.
>Its a little bit more complicated than that, some drivers can handle direct line printing, some can handled the Window Meta File (WMF) and some can handle Enhanced Meta File (EMF) and now there is the new EMF+.

Most of what you said there is wrong.
Please report any incompatible packages or any that need updating. I don't happen to see any open/related bugs for nodejs.
Trick #1: car models are refreshed. Never buy the first 2 or 3 years after this happens.

Trick #2: many car platforms share engines. Try to buy a car with an engine that has been used for a few years.

These two things alone, will ensure you aren't a beta tester

NOTE: car manufacturers pay through the nose for warranty repair work. They quickly fix all things which can impact that bottom line, which is why later years in a car refresh are much more stable.

Which is why:

Trick #3: never buy any car without a bumper to bumper warranty, and never if 2 years. Be wary of anything less than 4.

Why? Someone with a 4 year warranty, will fix problems with a model generation of a car, to save issues even 4 years out. And this means that stability is ensured for years beyond that, typically.
Well. Without generic functions it is impossible to specify a "complete" API. I mention it in "Scope considerations" in the srfi document
Tor works on top of TCP so it can’t tunnel UDP traffic. Lots of P2P things (like torrents) support both UDP and TCP, some only UDP. If you try to torrent and only have TCP you won’t be able to connect to other peers using UDP.
I started with Delphi 5 and completely share the sentiment of OP, development experience (mainly when building GUIs) was way better back then. For anyone who feels similarly I can only recommend you to look into Anvil. It is a fantastic tool, under active development and with a helpful and supporting community. It allowed me to build web apps by myself that I previously thought about hiring someone for. Very enjoyable experience and of course the fact that I am building web apps instead of desktop apps is a big plus in many scenarios today.

Great to see you here, Merdedydd! I was thinking about sending this thread to you. I discovered Anvil in a similar thread years ago and am very happy I did.
If you want a slightly heavier but more robust solution, caddy-docker-proxy[0] is a plugin that listens to the Docker socket and automatically updates the Caddy configuration based on Docker labels you add to containers.

I.e. it makes Caddy act a bit more like Traefik. Most of the time, you'll just add the label `caddy.reverse_proxy={{upstreams http 8080}}` to your containers and the plugin will regenerate Caddy's configuration whenever the container is modified.

[0] https://github.com/lucaslorentz/caddy-docker-proxy
We won't be visiting any time soon. But news of (likely) life would increase funding for telescopes, and eventually we'd get some idea how common life is - which is an interesting little fact in itself.
The whole concept of "custom domain" is absurd - a domain is a domain... Or why does Google use that google.com custom domain instead of a respectable one like ibm.com ?
Go vs. Rust vs. Bun vs. Node, Simple HTTP Benchmark
Bun is the new runtime released the other day and I made a tiny test for Bun, Rust, Go and Node.
I thought at first that Gunther the Dog would meet those requirements but when I looked it up it turns out that entire story was just made up by the guy administering the fund.
I didn't talk about the peer review process (which is indeed not done by the journal and on top of that usually unpaid). I was talking about the journal taking all that money purely for editing and publishing - a service that has become next to worthless in the age of the internet.
I plan to move to Protonmail, but debate about creating custom domain or not. Even regular protommail domain is sometimes banned (read in the news about several cases of this, for now only in the authoritarian hellholes) which is bad for sych critical service as email.
Hacker news can be addictive
I love Cadd and I have been using it for a few years now.
The documentation is kinda crap, but I still use less time to get things done.
Most projects are just copy/paste of old config files.
Everytime I had a problem, I asked and got an answer within 2 days. And nice answers, not like Stackoverflow...
I assume it was just as bad in pre-industrial Africa as it was everywhere else, though it is reasonable question.
> You need 2FA.

I don't trust Microsoft with my phone, and I don't want logging into my account to become a pain where I need a key. I'll just take my code elsewhere.

> Passwords alone are not good enough security.

Security will only ever be as good as the weakest part - and I happen to find phones pretty weak.
Not all use-case requires both chat and VoIP though. I basically never use chat in my friends servers because we're on VoIP. Mumble is an alternative in that case. On the other hand I never use VoIP on servers I'm in for open sourced projects or other general hobby servers because it's a bunch of strangers and people asking for support.
Swift compiles to native code. C and C++ are well-supported userspace languages on iOS.