skysight-inc/HackerNews huggingface dataset:
I mean i did just put it on the calendar with a note to update and deploy... so yeah kinda a digital finger ready to push the button as a result of this post...
Macs mostly do it, unless it's STEP, nobody can reasonably open a STEP file, even scihub doesn't have the specification.
I think current way is better

This way admins and ppl can prepare.

If you release fix and cve at the same time then race between bad actors and ppl starts
An HTML file is all you need.
Hundreds of malicious Python packages found stealing sensitive data
I'll take a second look at it :) Thanks for pointing that out
You make two statements that you seem to think that are at odds with each other, but I don’t think that’s the case.

> The hypothesis is that the patient generates information as a compensatory mechanism to fill holes in one’s memories. It functions for self-coherence, integration of memories, and self-relevance.

> The LLM is choosing a statistically relevant next token, which is wrong because its missed some context.

The reason, both cases, is that there is a lack of context. The reason why the next statistically probable token is chosen is because that is the one that provides coherence. It seems like a similar process.
Patients treated by female surgeons are less likely to die
Privacy Is Hard and Seven Other Myths
I'm not sure what YIMBYism is beyond giving cash away to developers, tbh, nor what it has to do with laws being enforced. They seem like orthogonal concepts at first blush.
Find Updated Covid‑19 Vaccine
Ask HN: If lawyer fight each other with the help of ChatGPT, what is the ending?
Is winning side would the best prompt ? What is the technical solution to such problems.
You’d be amazed how much livestock goes direct to landfill due to disease caused by overcrowding and poor practice - and of course the meat you throw out because you let it spoil at home. It’s over a third of all animal product - a significantly worse rate than neuralink and other trials - never mind the absolute numbers, which come to hundreds of millions of mammals, and billions of birds, and tens of billions of fish, every year - just in the US.

A dozen, even a hundred, or a thousand monkeys are insignificant in comparison.

Where’s your outrage for the side-product of your usefully slaughtered hog?

https://www.vox.com/future-perfect/22890292/food-waste-meat-...
Imagine for a moment that the people who created the tablet used a different number system than us, and also imagine that we knew that number system and could convert it.

Then those “bunch of numbers” becomes something else entirely. Specifically, they become a bunch of numbers that highly relate to the Pythagorean theorem.
"The perfectionist dilemma is when a creator values the quality of a finished product such to the extent that it inhibits their ability to iterate, change, and even produce." - Adam Miller

I agree that this is a hard truth, especially among us developers, but I believe it has roots that can't be easily ignored. The amount of fear of failure when thinking about releasing a software product to the public (whether it's a website, a mobile/desktop app, or a game) is big and scary, not because your product stinks [0], but because you got afraid that there is something wrong out there that will push-back the user in his first 500ms of trying your product, hence, you Start Customizing Your Startup's Login Page again 'n' again..

_______________

0. https://news.ycombinator.com/item?id=37596513
Interesting read, albeit the comments seem to suggest it's clickbait and a thought exercise, rather than a PoC or working solution. I was thinking more about an MCU that supplements the LM1881, not replaces it.
>The interesting question is of course if that applies to LLMs or not. Are they actually intelligent or do they just look intelligent (and do we even have the means to answer those questions)?

It's not an interesting question. It's pretty meaningless.

Are birds really flying or do they look like they are flying (perspective of the bee)?. Are planes really flying or do they look like they're flying ?

"Mimic Intelligence" is not a real distinction.
It really is insane how much you have to tip toe around tech circles just to say anything that isn't part of the colloquial circle jerk.

What you're saying is the approach any competent software company takes to managing vulnerabilities. There's zero reason to write a prior notice that there's a flaw because it would cause panic and allow opportunities to exploit the flaw (((before there's a fix.))) This is the whole premise around 'responsible disclosure' and why every company wants security researchers to abide by it.

The only logical conclusion I can draw here is curls notice is not responsible.
Cool!

Caddy support incoming. https://github.com/caddyserver/caddy/pull/5852
I'm pretty confused. How do you think an average 8 year old would feel?
This is a nugget of something useful wrapped up in a way that turns it into naive advice that feels like a contrarian talking point.

The biggest risk to your funded startup is opportunity cost. You can (hopefully) find more funding and that can give you more time, but you cannot rewrite the time lost on the wrong thing.

This idea that your first cohort should be religious believers regardless of the public image of your startup is a nonsense bubble dream. If you need customers then your time is best spent on the details that could favour acquiring them. If you're running a B2B and you're spending resources on granular refinement of your public image, then yes that may well be highly inefficient vs going out to network and get LOIs / deals signed.

The summary of what was a good point is:

Really actually understand your business, your customer and your success criteria and chart as close to a straight line to that point as possible with minimal diversions.
> I mostly buy products direct from the manufacturer these days and virtually all manufacturers have high quality websites with solid ordering experiences.

I can’t say I agree. I’m not defending Amazon here but shipping is a nightmare with literally every other business. You aren’t going to get 2-day and you’re lucky if it ships within a week of ordering. In most cases there aren’t even options for faster processing/shipping for an increased cost.

I was recently at my parents at they have Bartesian (think Keurig for alcoholic drinks). I wanted to try some drinks they didn’t have so I went to the official site and started adding some stuff to my cart. IIRC the free shipping minimum was higher than Amazon (without prime) and there was _zero_ information on when I could expect the stuff to ship or the shipping time. I did some googling and found people complaining about how long it took to ship and I was only going to be at my parents for a little under a week. I went to Amazon and while there was a significant markup (20-30% IIRC) I was able to get it next day or 2 day depending on what I got. I bit the bullet and ordered from Amazon.

Not everything has to come in 2 days or less but some things absolutely do and I rarely see fast shipping from even big names like Apple that that rival Amazon (I just bought a mouse and keyboard from them and it took 4 days vs same day with Amazon, same price). In a number of cases you have literally no information on processing or shipping time to make an informed decision.

Again, not defending Amazon, I wish there were better alternatives, but it’s not as easy as “just order from the manufacturer”. I’ve been burned so many times doing that.
How does the fact that most links aren’t phishing links play into anything? Maybe we don’t need AV because most files aren’t viruses? You had enough of a point without this.
Ask HN: How complex is your org’s procurement process for new software?
Humans are the only thing capable of reasoning, AI isn't capable of it and its very rare that an animal other than a human is capable of even the most basic reasoning.

Animals act on instinct that is hard coded based on the probability of survival AI essentially does the same thing it follows hardcoded probabilities not reason.
There's a reason we wear tuxedos to weddings. Not because it's intrinsically better than a tracksuit, but because it sends a specific message. Social conventions have meaning whether you like it or not, and a nice landing page or PowerPoint have meaning too. Also, as van der Rohe used to say "God is in the details"
or daily depending on the climate ;)
Four Ways the Role of Marketing AI Prompt Engineers Can Improve Copy
I went to a talk by forest ecologist Suzanna Simard last year. One interesting point she made is that the carbon sequestration abilities of a woodland depends on more variables than simply the coverage. If I remember rightly, mature woodlands with a diverse ecology and rich soil environment (with plenty of fungal matter) are much better at capturing CO2. Chopping down an ancient forest cannot simply be compenstated by a huge monoculture plantation somewhere else.
Forgive me if I didn't use the right terminology too. What I mean by type checking bugs are the kinds of bugs shown in the article: I have an argument that should be a number but someone accidentally uses it with a string instead.

That's the most basic bug that typed languages catch. But for me, those are extremely simplistic. I don't need a type checker to know that. If you follow the code path you already know the types you're dealing with.

What strongly typed languages can provide are types with constraints. E.g. an age is not only a number, but a valid number greater than zero (maybe with an upper bound?) that is attached to a person. That kind of strong guarantee will definitely catch runtime bugs if you pass in some other numeric value that is not a representation of an age.

Languages like TypeScript can't do that. Take the example below. It compiles as if there's nothing wrong:

type Age = number

type Person = {
age: Age
}

const person = { age: 10 } as Person
const someRandomNumber = 10

function printAge(age: Age) {
return console.log(age)
}

printAge(person.age)
printAge(someRandomNumber)

This is the kind of bug that a good type system would be extremely helpful with. In my entire career it's definitely a lot more common than passing a string by mistake. This can be extended for having a type that differentiates an `Email` from a `ValidEmail`, an `ActiveUser` from an `User` and so on. Those are, in my view, where a type system can truly help us catch bugs. But even if you have a type system that supports that, nothing stops someone from simply using `number` instead of `Age`.

In any case, that's why I don't think it's as clear cut as people put it. Yes, in very rare occasions TS will tell me I accidentally allowed something that can be undefined pass (excluding the many times it gets it wrong). However that doesn't come for free and that is what makes absolutist claims for either side unhelpful.
The best way to be sure is to fly in planes used by the US military. They don’t fuck around with their supply chains.

But then again, they also buy direct from factory and keep parts on hand for decades.
Dynamic PDF API with visual template designer
As does modern Australian English for the most part (I would typically say "my bank is awful". But I'd just as likely use "they" as a pronoun for it, especially if describing actions that were clearly carried out by those working there). I'd guess the same of NZ and Canadian English?
I own a MagSafe charger and unless the author added a third party black case (?) around the puck, then that’s not a real MagSafe charger. I haven’t heard of cases for it but that doesn’t mean they’re not common, of course.
The AS 9100 standard (which is an aviation-specialized version of ISO 9001) has specific standards about training people to catch suspect parts, launching investigations, and clearing the suspect parts out of the supply chain. Interestingly, AS 9100 requires that you DO NOT return the counterfeit parts to the supplier, but destroy them yourself, to avoid that they get resent to some other customer.
> (..) but just infrequent enough almost everyone can ignore it ...

If it's only a problem for the experts, then it isn't really a problem, right?

The experts can decide for themselves how hard they work on solving self-invented problems.
I found that to be such an on the fence presentation about most facets of the problem.
And some of the information presented conflicted with other information presented later on in the video.
I don’t see it as deceitful and I’d eat my hat if most other users didn’t agree with me.
I expect that when I click a search result link, that Google will be tracking that I’ve done this.
I also appreciate being able to search for something, right-click-copy a link, and send it to someone, without it being covered in tracking cruft.
The term “confabulation” is a label for observed actions. You’ve pivoted to a hypothesis about the cause of the behavior in humans, which is likely, to put it mildly, to be different in detail from the cause of the behavior in current-day LLMs, but the behavior itself is still similar enough to share a moniker, in my opinion.
Nobel Prize in Literature 2023 Awarded to Jon Fosse
Overchoice and How to Avoid It
And now the race has started with admins not being able to do anything. Anyone that knows of this vulnerability has enough time for a last hurray to exploit it as much as possible.
> However, the Hexagon DSPs are notoriously hard to program. While the Snapdragon CPU and GPU can be targeted using OpenMP and OpenCL, respectively, no such model exists for the DSP.

That’s ultimately the downfall of NPUs. If it’s not accessible it may as well not exist.
Yeah, otherwise we can't know whether to laugh with or laugh at
I don’t have any friends of any type, and have no memory of my childhood, so I don’t know if I ever had imaginary friends. Perhaps they fit those categories.
type MyPolymorphicType = { type: 'A', value: number } | { type: 'B', value: string }

There you have types at runtime. If you really want to be pedantic about it you can use classes and instanceof as well

In fact even Java removes types at runtime for code that uses generics, so often you need to do something like that as well

Types as a static analysis tool is great, types tied to the underlying hardware and memory structures have their values (usually performance benefits). Conflating both together usually leaves you with a very weak (unsafe) type system.
Yeah, which is a shame. Because I truly wanted to be confident that the costs of these don't outweigh the benefits.

Regardless if it's no meaningful difference or no good research, the point remains: we simply don't know, so these discussions are about opinions for either side, not facts.
Do you have that bookmarked, or just really good at searching?
It’s highly relevant.

https://www.vox.com/future-perfect/22890292/food-waste-meat-...
User interface design and polish is a proxy measure of the quality of the entire product.
Both of those things are true. Many CVEs are unimportant, but serious security vulnerabilities do exist, and are very hard to avoid entirely when writing C.
funny you say that. Google is upfront about their intentions, but nobody believes them that they are not data mining this for behaviour tracking.

Can't win in that scenario
Posting food pictures to your Facebook/snapchat/whatever is one thing, but texting them to people individually multiple times per day is bizarre.
You could just as easily get the opposite effect: if the login page is polished and snazzy, the user may well have the same expectation of the product itself, and every sharp edge will be that much more visible.

If the login page is simple and generic, the message is way toned down. Similar to the advice of not polishing the front-end too much if the backend barely works because clients will expect that a finished interface means a finished product.
I imagine back then things like number systems and methods of proving were just made up as they go.
These people didn't die in a freak accident of an unknown issue. The issue was know, it was engineered around using software, corners were cut left and right and then even after one crashed it was not taken out of service.

Any properly working oversight that wasn't heavy influenced by conflicts of interest between the FAA and Boeing would have prevent the second plane from flying.

The first crash was an accident that could have been prevented the second is proof of what de-regulation and "free market capitalism" looks like.
I’m gonna start referring to these types of comments as ‘drive by rust evangelists’

Go write your own memory safe curl if one _actual_ vuln in 10 years is not within your risk appetite.
Wow that’s really wanting to make a good impression.
Is the sand flowing or stationary?

Flowing sand has issues with blockages and erosion.

Stationary sand has pretty low conductivity, so getting all the energy out of your 200 yard cube of hot sand might be a challenge.
Several of the links there need to be updated. I just emailed them to let them know, so you don't have to.
Actually, the approach taken by curl is the best of all worlds: they give minimal information to attackers ("there is a bug"), and they maximize the amount of people that know a critical fix will be required, with a specific date for when the fix will be there.

The more traditional way of releasing the fix and the detailed description of the vulnerability at the same time is strictly worse. It's a very slight improvement for people who monitor these news (attackers don't get to find out there is some issue they could look for), but at a massive cost to those who don't monitor these news as often (attackers know exactly how and what to exploit before they find out).
Everyone still uses log4j after the fix. There aren't many full-featured alternatives... and the one that exist probably contain unfixed bugs.
Hopefully it dissolves the studios. The emperor no longer has clothes in Hollywood. More Indy Barbenheimer, but in one movie. Less repackaged superhero BS.
Fair point! I was basing it more on this definition:

> to grossly mislead or deceive (someone) especially for one's own advantage

But even that doesn’t fit ideally, so I edited the post.
Adobe teases new AI photo editing tool that will ‘revolutionize’ its products
Really like this idea. I think anything that might increase awareness and adoption of PWA's is great.

I'm curious why you chose to trigger a vibration every time to switch categories when browsing.
"In fact, the blog post you’re reading right now was probably loaded over HTTP/3!"

It actually isn't. But some of the 3rd party resources like a captcha script are loaded over HTTP3
That's a pretty dangerous thing to do. In Switzerland it used to be that if you were caught 'coasting' that would be severely punished. Not sure what the state of that is today but it is asking for an accident. Vacuum is one thing, then there is the powersteering which at some point will fail and if you're going to want to do a hairpin turn down a mountainside without assist you better be ready for it.
The OCCT library can read STEP pretty well, but there's nothing small or light about leveraging that ;-)
(The details of the following depend on the nature of the flaw/exploit.)

I think a pre-announcement gives much more advantage to the population of defenders than to the population of attackers.

Attackers can move faster than most defenders, and they only need to find one weak link. Also there are a lot more defenders with various states of readiness, and only one attacker with the resources to spray the internet with the exploit needs to find it in order for there to already be a big problem.

How much faster will attackers be able to do anything because they know it's coming? Mostly only as long as it would have taken them to hear about it.

How much faster will defenders be able to do anything because they know it's coming? They can spend the next week making a list of things that need to be done and places that they'll need to deploy updates, so that when it's available they can act immediately and efficiently.

The risk that attackers will suddenly find the flaw after years because they were told "there's a flaw in cURL" seems low.

There is a risk that the details leak to attackers in advance of the release.
Including mine once the security team sees the CVE warning, even though our image literally never uses curl or libcurl and only ever communicates with other internal systems, within our private network.

Not that we shouldn't patch it! But unless the nasal demons are going to start a process and make unwanted HTTP connections, I'm not worried.
Not all of that research was done with public code. But they had other flaws.

I should have prefaced that with "IMO". That particular sentence comes from my experience/career, so YMMV.

When I'm reading code, I know what types I'm dealing with. Even more so if I'm creating that code. But then again, I worked with dynamic languages for a long time and this could be a skill I picked up because of it.
> There is no time for polishing your slide deck.

Horrible horrible advice. Agree on the login page etc.. but your sales stuff needs to be on point. I see this from the other perspective, working at a big company. The smaller players never get their foot in the door because they don't know how to talk to us. And they don't optimize their decks toward the audience.

If the talk is not about they customer, why should your customer care?
Maybe start banning alcohol in somewhere it's already pretty much undesired?
Besides moving goalposts, Notepad++ still isn't on the same league as Borland's IDEs.
But thats still a malware vector right?, especially if you can get the victim to export it themselves?
Not only is the comment more nuanced and helpful than the original article, it also quite easily holds up against ye olde yOu dOnT kNoW sTufF argument.
> Parts coming off the same line are sold with a -M (“this bolt was individually magnaflux tested and can go on an aircraft”) or not (“this part can go on a tractor”). I think most practical engineers would agree that the parts are physically identical.

Wait, of course they are identical… unless there is a defect!

But that's the point of testing: when you can tolerate 1% defect then you can just sample your production line, but if your “safety demonstration”[1] relies on the fact that no screw is going to fail catastrophically under load because there's a defect, then you have to check them all. It's not “That’s paperwork and an ink stamp as the only difference”, exhaustive testing vs statistical testing. The work needed for the testing process is actual work, it's not about filling the paperwork.

[1]: not sure this terminology exists in English, I'm just doing a literal translation of a nuclear Engineering concept I know in French only.
Hmm. The worst case I can think of is if the vulnerability is exploitable before (or during) verification of TLS certificates for http(s).

That would mean that someone in a MITM position would be able to inject the payload when libcurl make requests.

But even that seems less messy than log4j? It can't possibly be as common that libcurl makes connections to arbitrary user entered urls, compared to log4j logging user entered text.
Windows 10 came with an application to view 3D models in obj and other formats, but it's no longer included in Windows 11. You have to download it separately now (it's still free).
This seems like bad advice... It maybe works this way if you really have some absolutely amazing product idea.
Growing from 0 to ~27% of traffic in 2 years is great, but the graph from TFA shows that it was not a gradual increase but rather two big jumps in adoption:

- One in mid 2021, to ~20%.

- A second one in July 2022, to ~29%.

Since then the traffic share has been pretty flat. I don't think that counts as "eating the world" at all tbh.
Limited Audience Jokes