skysight-inc/HackerNews huggingface dataset:
> Security protocols have a short list of moving parts and trade offs and where to attack them. RNGs, key storage, key derivation, counters, and access modes, to name a few. They're only completely different to people who don't understand them.

Funny, I would have said that they only look very similar to one another to people who aren't deep enough in the weeds of a particular one.

Yes, they're ultimately all built out of the same building blocks. But just with these few you've mentioned, together with possibly having more than two actors in your system and corresponding privileged keys, the complexity of the aggregate protocol hockey sticks very quickly, and you absolutely can't reduce all problems to one another anymore.

Humans are made of atoms, yet when you're sick you go to a physician, not to a physicist.

> If you are using symmetric secrets in smart cards, you're using something within a degree of EMV

Oh, absolutely not. Sorry, but with this statement you show that you aren't familiar with other protocols in this space. There are so many smartcard (and adjacent, e.g. stored-value cards like MIFARE) protocols that use symmetric keys, yet don't share any of EMVs historical problems. I mean, even GlobalPlatform itself uses symmetric cryptography!

That's like saying that SSH and TLS are very similar protocols, since they both use asymmetric key exchanges to secure and authenticate a symmetrically-encrypted application layer channel.
For work maybe? As a gamer I never used 3.1 for anything. Even the gui apps I used were dos based. Seemingly a lot of them were ported from amiga. Trying to imagine a modern os with no window manager, just applications that all used gl or vulkan directly with some unmaskable keyboard combos to allow switching.
There is poop stuff too ? Isn't it more disgusting?
I have not just imagination, I also know basically everything that exists in this space. Foot stuff is still the most disgusting.
Interesting!

Here are some features that I will find useful.

1 - Option to customize the model parameters.

2 - Selective model comparison, once you extend the supported models it can be inefficient to run all the models all the time, selective execution can give more control to users to execute only required comparison models.

3 - Share option.
The design, look and feel is great. Authenticating / proving your identity on the other hand is lacking: https://www.gov.uk/using-your-gov-uk-one-login/proving-your-...

Meanwhile, at least in some EU countries, you can authenticate using your identity card and USB smartcard reader.
I disagree that Google sets a good example with their "clings" that pop up and point out UI changes. (That's what they're called internally.) Clings are annoying and disruptive, and nearly all of them alert the user to an unwanted new feature. Visualize them as a pop-up ad placed for free by a promotion candidate who needs usage numbers artificially spiked to demonstrate impact, and you'll share my negative feelings about clings.

While I'm here, will the person at Spotify who writes the Tesla app's frontend please get the networking code reviewed by the app's backend team? The backend code reconnects immediately when the network changes (for example, when a car backs out of a driveway and switches from WiFi to cell), so the current song keeps playing and can sometimes even skip to the next song. But the UX is frozen, except for the spinning circle, for minutes, until it says something went wrong and waits for me to press play again. Every other part of the car handles network changes gracefully, except the Spotify app, and it's had this problem since the very first version. How can this be so broken for so many years?
I see that they have an lspace.org address. That host doesn't go anywhere, but the much more interesting wiki.lspace.org does - the Discworld and Terry Pratchett Wiki!
X formerly Twitter seems to be quite good at limiting certain account's visibility and reach. Not sure if that's intentional or the result of some heuristics.

Her account exists since 2011!
Hahaha awesome.
When our performance reviews (read: raises and promotion) and, sometimes, whether or not we get RIF'd if the company needs to shed workers, depends on us making our metrics look good, you bet your ass we're gonna play the game, even though it's stupid.
^ This is what lack of unfiltered internet access in their teens does to people
TFA doesn't exactly strike me as doing a good job of promoting the chatbot... it reminds me more of that Microsoft "Tay" AI.
Easy statement to make when one's code has no value.
This is actually the right answer AND imo the most horrifying aspect of it.
This! Why should the corporate shareholders take a hit when there is money to be made? After all these AIs are controlled entirely by the corporation, enough giving away frameworks and weights, gift economies don’t profit the owners

The best part is when you have a very “captive audience” in the metaverse. If all your coworkers are using Meta for Work (serious stuff) and for the distributed happy hours, can you afford not to? Say hi to the AI robot bartender, and buy something cool for yourself. Here are some credits

Also, when no one is around, why not pop in and talk to your friend’s avatar, who your friend willingly trained on his conversations, shares and likes to become “more efficient”. That surrogate can now respond to tons of queries from other friends’ surrogates as they wish them Happy Birthday in increasingly creative ways.

And then you can mix and match your friends to create virtual friends you invite to metaverse parties and video calls — they are trained to gradually maximize revenue and may encourage your group to buy some digital assets or rent a dating venue that you don’t really own :) Or maybe be invited by members of your group and gradually shift the individual members’ thinking to one that is more acceptable to the corporation, never backing down or permanently changing their point of view from any arguments from humans. Simply play some friends against other friends and you can make them all purchase something together, get in line or be ostracized!

Imagine how much money can be made by leveraging social capital and hacking people’s relationships. Facebook already cheapened words like “like”, “friend” and birthday wishes. Why not continue to innovate, move fast and break things.
The ancients thought that space was filled with giant balls of glowing gas. What fools they were.
Our school's PDP-11/34 ( 16 bit, 128K RAM, 5 + 5 Megabyte disk drives) supported about 20 interactive users at a time.

We did reduce the baud rate on the ADM-3 terminals to 1200 so the I/O buffering would smooth over some of the swapping.
Web Development in Assembly x86_64
Everyone who has worked with sharding at scale knows the pain when there's this one terrible key (your biggest customer, hottest key, largest blob) that just ruins load-balancing of the shards.
I imagine the near future will be launching a swarm of agents to accomplish a complex task and come back later when done. Right now, it is just doing the basics.
It can be done without an ID card and card reader too. BankID is what we use in Norway.
DuckDB shuns VC breadcrumbs so support isn't all it's quacked up to be
> more for fighting against an anti-American, anti-Western government

"[t]he recipient is selected by the Norwegian Nobel Committee, a five-member committee appointed by the Parliament of Norway. Since 2020 the prize is awarded in the Atrium of the University of Oslo" [0]

The winners are basically selected by a subset of retired Norwegian MPs, and even Alfred Nobel's living heir has become opposed to the politicization of the Nobel Peace Price [1]. So it's reflecting the values of a subset of the Norwegian elite

The comment above should NOT be viewed as a rejection of Narges Mohammadi's work.

[0] - https://en.wikipedia.org/wiki/Nobel_Peace_Prize

[1] - https://www.aftenposten.no/meninger/i/wP6y1/i-strid-med-nobe...
The Vela pulsar is also quite famous for being one of six known optical pulsars (the most famous being the Crab).

https://en.wikipedia.org/wiki/Optical_pulsar

"It has the third-brightest optical component of all known pulsars (V = 23.6 mag) which pulses twice for every single radio pulse. The Vela pulsar is the brightest persistent object in the high-energy gamma-ray sky...

"Glitches are sudden spin-ups in the rotation of pulsars. Vela is the best known of all the glitching pulsars, with glitches occurring on average every three years.

https://en.wikipedia.org/wiki/Vela_Pulsar
“Nobody goes there anymore, it’s too crowded.”
> My current non-compete is in the finance industry and uses paid salary during garden leave as a way of avoiding non-compete laws

More often than not they will quite happily waive the non-compete and the pay - a sensible arrangement for all concerned.
>today’s nation-state attacker’s vulnerability could become part of tomorrow’s everyday cybercriminal’s arsenal

While theoretically true, I can't find recent examples of this happening with zero-click exploits on iOS or Android. Without evidence of this being a common infection vector it's not, in my opinion, enough reason to encourage people to get rid of a working phone just because the security backports might be a bit lacking.

The more important security reason to keep up with the latest OS version is the sandboxing improvements that iOS and Android make with each update. If you assume the device will be compromised with a malicious app at some point, you want to have more protections against the malware stealing data from other apps. This is (for now) a bigger deal on Android, where malware routinely makes it into the official app store and malicious APKs are floating around all over the place. But it's worth considering on iOS too, especially if you run a lot of apps from companies that hate privacy or if iOS later allows some form of sideloading.
“This is an avoidable problem,” Ruskin said. “It would be far better for public health if they picked experts with no conflict of interest. They can do that but they don’t.”

This is naive. It's saying that politics would work better if you remove politics from it. Possibly true, but like saying bridges would be cheaper if the gravitational constant was smaller.

IMHO the better approach is to avoid centralized decision making particularly for such difficult subjects. And learn from the resulting massive parallelism we sometimes call liberty.
Something else to note. The code merges data from WDI and OECD. If these sources have different methodologies for collecting or reporting data, it could introduce inconsistencies.
Diversity goes beyond skin color.
Are you sure Goodreads did not received updates because of Rails?

Here is a competitor build with Rails https://thestorygraph.com/

Seems kinda cool. So I think Rails is not the problem here.
This is one of the few sad side effects of CA's noncompete laws: it's very hard to run a business like Voleon where there's genuinely valuable IP. It's why we have like 2 quant hedge funds here, despite all the available engineering talent
> IdPs can rotate keys arbitrarily frequently.

Yeah, that problem still remains, of course. But you could align the package update cadence to the rotation cadence. If in practice this happens to be a anything beyond a few weeks, I'd say that's not a bad tradeoff.

You go from trusting a central signing server, to somewhat auditable (and probably reproducible) package publishing infrastructure.

We will have to see how OpenPubKey tackles this and whether IdP key rotation ends up becoming a problem in practice, and how they do key distribution. Time will tell but I'm rooting for both.
Ask HN: Degree Finished, What Now?
This time next year I will have finish a computer science degree, provided I pass I'm looking at a First Class honors.

I don't work in the software industry (public sector currently), though I utilize my programming skills at work for data analysis and visualization. I have completed this degree part-time (due to interest in computing) whilst working full time around busy family life. I don't mind the work I am doing currently and live within my means, but am told I could be making more money in the software/cyber security industry based on this degree/other skills/current work.

So where do I go from here? I'm not sure I'm cut out for the cutthroat private sector with the corporate non-sense I read about here and elsewhere, and I hate networking.
REXX interpreter.
Monktalks
Compared to many alternatives, it is better. The devices with longer support don’t have the basic features I need like a headphone jack & too many thing require a mobile device to function anymore, like Signal which doesn’t work without an Android/iOS primary device.
Do you think it might simply be that the subset of Europeans that interact with international clients tend to be well-educated and highly effective.

As a scientist, I interact with a number of Europeans. That happened less frequently when I was waiting tables.
That exists in some sectors, e.g. the City of London.

Also, UK doctors are compensated at internationally competitive rates when compared to average national income, especially so if they work in private practice in London with international clients.
Can one write installable apps for this OS that Llama can call out to?

We need to go deeper!
The latest version of Rails 7 works out of the box with importmaps so no node (nor yarn or any other version manager) is required.
Brutal ending. Let me kick the tires on Elm types stored in Postgres!
If I remember correctly, Saudi Arabia and Iran struck a peace deal this year, brokered with Chinese help. We haven't heard about Yemen since.

Surely Xi Jinping, MBS and Khamenei deserve the award for actual peace?

Yeah, that is three people we are told to hate. But they achieved actual peace.

Instead we get this Iranian woman that nobody had heard of before today.

Something is not right.
I agree! What people don't realize are the lucrative parts of a govt contract is the follow on contracts to support. You don't make money on the initial design of a plane, you make money on adding weapons and fixing bugs for the next 25+ years of the planes life.
By having the development be a subscription, you also incentivize more continuous development and improvement of the product. For example, instead of designing the system, deploying it, and then have to negotiate a ton of PRs to fix the system after the fact, you can have a more continuous dev cycle, fixing the issues as they come up because you're on contract already to fix them.
At some time we learned about delete locks in Azure and promptly created those for all production resources. Have had/heard of enough actual/almost "killed production" stories to understand their value. A bit cumbersome when you actually need to delete something but so worth it for the mental health of the team.
That's not a subscription, that's amortization.

The critical difference is that amortization decreases your cost per unit time with use. More use, better value.

Subscriptions do not work that way. Having to pay $50/year for a 5 year old laptop doesn't excite.
>It takes 100s of thousands years travelling at the speed of light to get from one end of the galaxy to the other.

The crazy thing is that at a constant 1g acceleration you could get to the Andromeda galaxy in your lifetime. Andromeda might be 4 million light years away, but relativistic effects mean that only about 30 years would pass for you.

Of course, constant 1g acceleration would require an unimaginable amount of energy (and something to thrust with).

At 1.5g-s you could make it in 20.
Al Jazeera clearly doesn’t know the first thing about journalism.

Good journalists verify sources of information to ensure the authenticity of the news.

Doxxing the individuals that help you along the way is decidedly not good journalism.

Moreover, Al Jazeera reveals two admissions about their own practices.

First, that they too often rely on second hand and witness accounts. When you’re merely reporting on things people said, it becomes important to know who said it. That’s a lower quality than getting the original evidence.

Second, Al Jazeera emphasizes that they do not intend to be faithful to the truth. They call true information propaganda merely because it may come from individuals they don’t like. This willingness to suppress valuable stories is despicable.
Scatman says otherwise
This is so that search can work, they index service start pages so they have results for services that are hosted on other domains.
There is also something about having a consistance UX, at least to the point of handoff to the service (which might not have been updated yet).
The start pages also provide the user with guidance were say the service might be only avalible at certain times, or if you need documentation ready before you use it.
I wonder if they ever found a sysadmin willing to work around the clock for $100/hr.
Was it really ever good though? I came to dos after us having an amiga and it mostly seemed like garbage except that there was more software. Having to jave different autoexec.bat and config.sys files for every game I wanted to play, and laboriously solving the knapsack problem forneach one to get all the drivers I needed into ram.
Some, like the Millennium Tower in SF, do suffer from problems that risk flattening entire neighborhoods.
DEC was a big part of my life in the 90s.

My first internship was working on a SCADA system on Vaxstations running VMS. My mom had to help me learn FORTRAN for this. (we were all unix/c at school).

My first job was as a sysadmin starting in 93 for an academic stats dept that used DECstations and were getting their first DEC alphas running OSF/1. A lot of my job at first consisted of getting the open source applications they needed running in 64 bit mode (you would not believe how many int/pointer conversions I had to fix). I remember adding a memory kit to a 3000/500 in the first month of working there. That memory kit had a retail value higher than my annual salary at the time & it was terrifying.

My next job was as research staff at at a comp sci dept doing OS research. I wrote drivers for Myricom NICs for DEC OSF/1. (and had the funniest bug.. we had to use GCC to compile the drivers, and I missed the no-fp-reg directive, so every time the driver was active, it was using floating point registers as general registers and corrupting users fp state.. You'd see applications crashing left and right with FP exceptions).

A few years later, the same dept paid me full time to help port FreeBSD to the DEC alpha, and I maintained FreeBSD/alpha until alpha was walking dead, and we killed the FreeBSD/alpha port. I got one of the first API UP1000s (one of the 3rd party alphas that used the irongate chipset from AMD), and it was my workstation running FreeBSD/alpha for years.
The UK has very few empty homes compared to peer countries, though. We have very little spare capacity, we need to actually build more homes.
That's because there's no recorded metric for every time a dev working in plaint JS mis-spells a property, or accesses one at the wrong level, calls a function that doesn't exist on that particular version of the library, etc, etc.

For the most part, the resistance to Typescript from devs who prefer to write plain Javascript is purely borne out of adding the types being "too much effort to be worth it". Sure you gotta wrestle with the type system now and then but there's often a reason you have to + once it works it usually works very well. Which I find kind of funny bc those devs don't mind putting the effort into writing unit tests, but adding types (think of them as just lower level tests) is somehow an insult to the way they do things.

But nah they'll still just rawdog their JS and just make mistakes/misspell stuff now & then as we all do. Let's just hope tests/CI pipeline is enough to pick it up before it gets to prod.
I disagree that both are necessarily at odds.

Practicing BDSM in a long term relationship is actually a good way to make it healthier, and many of the things that are good for one (communication, boundaries, self-knowledge) are good for the other.

Even if you're trying to maximize orgasm, you're generally better off with one (or maybe a couple if you're lucky) of really good partners who know you well and who you have excellent chemistry with than a bunch of randos. Conversely, a long term relationship without any sexual chemistry is very likely to end badly.
I tried to post this to r/Replika and r/ChatGPT but both posts were instantly deleted by the mods. Glad to see that at least HN isn't censoring important news.

People really need to get to grips with the reality of the dangers of AI. That includes realizing how emotionally dependent on and manipulable by AI's people can become.

These AI's are still relatively primitive and already we can see their influence. It'll probably become even worse as the AI's get more intelligent and more persuasive.
LLVM Merges Initial Support for OpenMP Kernel Language
> Judeo-Christian westerners, in a western country

No. Only a handful of elite Norwegians, as the committee is 5 former MPs selected by the Norwegian parliament.

Apartheid South Africa's leaders were Judeo-Christian westerners as well, but the award was given to their foe Nelson Mandela
Of course I can.
That the provider will go out of business.

That I'll tell management that the provider will go out of business and they'll blow me off and the provider goes out of business anyway. (You know how many eng managers I told I'd never put my personal passwords in LastPass because it would get breached?)

That the provider's end game is to get acquired and... go out of business.

---

There are times when I think people are just 'fricken sheep. Circa 2001 I developed a user management framework that was designed for easy integration into the web applications people were building back then with PHP, Perl, ColdFusion, whatever. It took about 70 lines of code to create an “authentication module” for a new language. For my own account and for customers I used it on numerous sites, some of which got 500,000+ users.

As an open source release it got no traction, just got "security reviews" from sketchy people who never told me the results.

Then all of a sudden "we're going to go out of business someday" 3-rd party auth solutions became really fashionable and it was like a lightning bolt, the idea that you were depending on some provider that could go out of business was the part of the value proposition that I was missing back then.
"What they mean by IO bound is actually that their system doesn’t use enough work to saturate a single core when written in Rust: if that’s the case, of course write a single threaded system."

Many of the applications I write are like this, a daemon sitting in the background reacting to events. Making them single threaded means I can get rid of all the Arc and Mutex overhead (which is mostly syntactic at that point, but makes debugging and maintenance easier). Being able to do this is one of the things I love about Rust: only pay for what you need.

The article that this one is responding to calls out tokio and other async libraries for making it harder to get back to a simple single threaded architecture. Sure there is some hyperbole but I generally agree with the criticism.

Making everything more complex by default because its better for high throughput applications seems to be opposite of Rust's ideals.
Having a routine and being intentional with downtime probably matter the most. You can even do a thing you absolutely hate with that while feeling lonely and not understood. Many people do. It's called a job.
Given how much we use them to talk to each other, I'm surprised you're not counting the microphone; likewise video calls and the camera.

And given how phones and tablets are so much more common than laptops and desktops, touch screens.

Arguably there's also passive continuous inputs like GPS and heart rate sensors, accelerometers, etc. — mainstream, but I doubt it was the category you had in mind.