skysight-inc/HackerNews huggingface dataset:
No.

At the moment, there is (most likely) no exploit available in the wild. A fix for the vulnerability is basically going to be the blueprint for an exploit. This means an exploit is pretty much guaranteed to start circulating within hours of the vulnerability & fix being released.

A fix cannot immediately be applied to billions of machines. It takes time for distros to port the fixes and backport it to all the versions they still support, it takes time for admins to notice the vulnerability at all, and it takes time to schedule a support window and apply the fix to all your machines. From initial disclosure until significant numbers have been patched can easily take days - or even weeks. During that time, people will be actively exploiting the vulnerability.

On the other hand, by giving a pre-warning to the general public and coordinating the fix with distro maintainers in a closed mailing list, anyone who even remotely cares will be scheduling maintenance windows right when the deadline expires - and patches will be ready for immediate use. This significantly reduces the amount of time the vulnerability will be public without a patch being available for the general population.

It's of course a different story when it is a zero-day actively actively exploited in the wild already, but that doesn't seem to be the case here.
I had to ask it 3 times today what the command to export certificates from an Azure app service was. With nothing else other than me saying "that command doesn't exist" for the first two suggestions, it gave me exactly the right one. Though then of course it turned out I didn't need it anyway because there was a better way to solve the problem.
Interesting, I wasn't aware Google had actually stated "we don't use this data for tracking, and we only use it for link protection" (does it?).

Assuming true: you are right in that it's basically no-win. The fact that Google draws so much revenue from advertising makes it difficult to reconcile.

Nothing short of a third-party code audit of Google's code against their asserted privacy policy would appease everyone. And even then, there would be doubters.
That's using values to determine different types. What I'm talking about is true type validation where I can detect differences between the same data.

TypeA = number
TypeB = number

const myNumber = someFunctionThatReturnsTypeAorB()

I cannot tell which number I'm dealing with because TS doesn't know that type at runtime. I don't think this is about being pedantic. If the language forces you to change the data structure to allow you to differentiate types at runtime, then it's a very limited type system IMO.

If all of this came for free, I wouldn't argue with it. But people tend to disregard all of the cost that comes with it. I know I have lost countless hours simply changing code that already works to make TypeScript happy. If all that is to tell me I shouldn't use a string in a number argument, I don't know if the benefits outweigh the cost.
We developed this for Roam (https://ro.am/ [1]). Roam is a virtual office environment for real-time collaboration - audio, video, whiteboards, personal offices, team rooms, theaters and group chat with ML-enabled tools layered on top. It's based on Chromium & WebRTC so that we can ship a cross-platform app (Electron) as well as a nearly-parity Web client with a tiny team.

We've had a good experience with this approach, although it is far from plug-and-play. We do have to identity and patch items in Chromium/WebRTC & the server (Pion) interaction to get our video quality up to compete with Zoom/Teams/Meet. We are able to effectively compare video quality across these providers and expect to reach their video quality with this stack.

Disclaimer: I work on Roam's Chat, AI, and API.

[1] We are currently in closed beta so there's not much there at the moment.
Location: United Kingdom
Remote: Yes
Willing to relocate: Yes
Technologies: MERN stack with Next Js, I volunteer as Frontend dev for a green tech start-up, My true passion but my true passion is within sales.
Résumé/CV:https://drive.google.com/file/d/12FQbkFQr-zL3BcN-0OKORZU97kt...
Email: hamdi_367@hotmail.com
Of course. It's a risk that could easily be worth it depending on the actor and vulnerability
> right-click-copy a link, and send it to someone, without it being covered in tracking cruft.

That’s exactly the use case Google breaks, though: The link gets covered in tracking cruft and it gets very hard to tell where it even leads from just looking at it.
And it sold for an absolutely steal ($5B) a few years ago. I could see it eventually going public again.
The whole HTTP request/response cycle has led to a generation of developers that cannot conceive of how to handle continuous data streams, it's extraordinary.

I have seen teams of experienced seniors using websockets and then just sending requests/responses over them as every architecture choice and design pattern they were familiar with required this.

Then people project out from their view of the world and assume the problem is not with what they are doing but in the other parts of the stack they don't understand, such as blaming TCP for the problems with HTTP.
> that buzzed every phone and radio in the entire United States

Unless you turned that crap off.
They won't be able to cert wash an airframe back into the system. They might be able to falsely certify the engines and other parts
>"a conversation can't be faked"

It can. An examiner questions are gonna be parsed via covert Voice recognition,processed by ai and replies played back via a e. g. small headset(a magnet inside an ear cavity, accompanied by an induction loop wire around the neck(works fine,google "микронаушник магнит" in russian, it's popular here) , and it's not as hard as you may think.
And fantasy sports.
The Trailer for Ruby on Rails: The Documentary by Honeypot Is Out [video]
Prompt Hacking Is Oxygen
Just have rods similar to nuclear (well the opposite)

You can progressively sink them in as the sand cools/ you want more energy out.
Never worked on stuff getting into peoples boddies, but the reason propably is that yes, people inhale it. Hence the tracking, after all chips have lot numbers printed on the packaging.
Intetestingly (or rather not surprising at all?) http3 is eating away the http2 traffic, while http1 just stays on a very slow decline.

Since http1 webservers are usually stuck there for a (more or less) good reason, they won't be converting to http3 anytime soon, while already more modern webservers are easier to upgrade from http2 to 3.
You can actually slow down or speed up the planet's rotation with a big switch.

|_ open switch, slower
__ closed switch faster

You can also do it yourself by standing up or laying down
The term of “hallucination” referred to generative ML models have been used in the literature for years, at least since GANs.L
Seeing the same thing both in Firefox and Chrome, every response from blog.apnic.net comes over HTTP/2, none of the HTTP/3 ones are from any apnic.net requests.

Strange that a registry, who should have really good idea about what kind of infrastructure they run, would get which protocol they're using wrong.
Also what I consider is that who has insider access and how does that information leak... This fix must be known at least some members of curl developers. Will they leak it or not? Or anyone who receive it early...
That makes sense -- if a packet is lost, and it affected just one asset, but you're on TCP, then everything has to wait till the packet is re-requested and resent.
You would have to retrofit every residence to handle daily brownouts (circuits for lights, furnaces and medical equipment stay on, everything else off).

You would have to completely rebuild most of the manufacturing industry, as many plants have startup times measured in hours or days.

It'd be cheaper to just build nuclear.
But when we approximate we use appropriate language to make it clear that's what we're doing. ChatGPT will confidently give very precise answers based around completely fabricated "facts".
Krita fund has no corporate support
Then download and install F3D instead :)
If you don't make that distinction then your statement doesn't make sense "there's fundamentally no evidence our thoughts are the decisive events leading to behavior". You started making this separation here, not me, I just talk about intelligence. If you thought they were the same thing you wouldn't say things like that.
> To say war is not a fundamental part of American culture seems absurd.

Only because it’s in your social circle. Nobody in my family or my friends’ families has served since WW2. Voluntary military service is borderline genetic (kids serve because parent did) and service members tend to form social circles with other service members.

Being in the military is as much part of the culture as is being Jewish is. They have similar population counts.

You’re just fixating on your experiences and gripes and are assuming that equates to “American culture”.
In a world where everyone and their grandmother has a (on the surface) polished SaaS side-gig appearance does matter if you want to be taken seriously. It shouldn't be but it's the truth.

If time is an issue then you find a way to polish without spending much time. What does the login page need except for a logo, a form and a few links? Remove the bloat and keeping things polished becomes easier than fixing it after the fact. Less is more.
2023 State of DevOps Report: Culture is everything
I switched from web dev to data science some years ago, and surprisingly couldn't find a streaming parallelizer for Python -- every package assumes you loaded the whole dataset in memory. Had to write my own.
I’m gonna guess apple has considered the ROI on this, the negative publicity can’t be good for them but in the context of apple id somewhat agree. I consider iOS probably more secure than desktop operating systems, and it’s the Crown Jewels of my life.

Curl is maintained by a much smaller set of people, and is delivered for free.
Afterburner?

That wouldn't impact blade temp.
F3D rely on OCCT to open STEP and IGES file, just try it :)
I feel that we also lose a lot of options and choices: I choose a place to live because it is close to work. Maybe I will have a choice after I retire, maybe there won't be a choice.
This is correct (assuming the same facetiousness as the gp comment), and even extends to algorithmic oversights and hardware errors. Your threads not stepping on each other's toes and your memory boundaries being automatically checked doesn't make you invulnerable.

Please do explain the negative reception.
> then you can eventually think about your companies branding.

Not sure that I can find common ground with this statement.

Branding is something that tends to be poorly understood (or supported) by "doers," (usually the tech people that are implementing the product).

The thing is, no one really appreciates a brand, unless it is successful.

I worked for a company that was (possibly still is) one of the premier brands in the world.

They had no cohesive branding strategy for about 75 of their 100 years, and ended up "retrofitting" a cohesive branding strategy, in the 1990s (my boss, who eventually became the Chairman, was behind that).

It was quite painful. It ended up working out, but there was a lot of agita.

I think we shouldn't "bikeshed" branding, but we'd be well advised to keep it in mind, from Day One.
Why would it depend on free will?
Shameless plug.

The company I work for has a team developing CryptPad, which can be seen as an open source (AGPL) [a], E2EE alternative to Google Docs.

You can edit documents with multiple people in realtime, and the server does not have access to your content. You can self-host of course, but the team also provide an instance [1], and several other people also provide theirs.

It does not have such misfeatures. It has sheets, documents (using an ONLYOFFICE fork running in the browser), Diagrams (using Draw.io), forms, polls, a kanban module, pads, among other things. There's some storage too (a "drive").

It obviously does not provide all the features of Google Docs and its office suite is not as complete, but it can still be useful for a whole host of use cases.

(edit: btw CryptPad has been mentioned in several replies in this thread, it's not us so far but I've sent the link to our chat, they might chime in as well)

[1] https://cryptpad.fr/

[a] https://github.com/cryptpad/cryptpad
it builds on the experience gathered with the HTTP/2 HPACK header compression.
Yes! We are working on it! Please join the discord if you want to contribute to it.
Place your bets: a) logic bug b) memory bug (buffer overrun/use after free/etc) c) other
> I think any human who confuses smooth talking with making sense will be ruthlessly exploited in relatively near future

Versus the last thousand years?

Just wait until you learn about organized religion it’ll blow your mind.
Ad hominem is the last resort, so apparently you are forced to accept the truth but can't quite handle it. Relax, the news is good! The only problem here is that people aren't hearing about it from the sources they trust.
He walks smaller dogs and sells drinks that he makes at the football field near the house. The neighbour lets him pick lemons to sweeten the drinks. He worked for two years to buy the absolute least expensive phone available. I did buy him a case as a gift for achieving his goal, though: $3 on Aliexpress.

I should mention that he also managed to buy two goldfish during this time - also with his own money. So he learned very well to budget, and that each thing that he buys along the way pushed back his goal.
> "What we need is less regulation" source, UK government, HN comments, etc

We do have regulations, even quite strict ones in this case, yet it happened. Making already highly illegal actions more illegal is hardly going to help.

I do get that you dislike deregulation, but this comment completely misses the topic at hand.
Not really. Video game servers definitely don't want session oriented protocols, and don't really care about dropped packet. Lost the packet with the player position? It comes at a regular interval, so we'll get it anyways, and more up to date! All they care about is the best latency possible. As for the non-time sensitive stuff in games (scoreboard, nicknames, etc), there is no real benefit there either. It's not time sensitive, the connection get opened once at the start and that's it.

Where QUIC really shines if for fast connections and many streams, ie the web where a page will need 500 resources spread across 100 hosts. In this case session establishment speed and parallel streams are paramount.
> the customer doesn't value your product

> you don't have a product worth investing in

> your message isn't worth being executed on

Obviously, none of these are hurdles to playing the startup game. Appearances matter, regardless of whether you believe they should matter.
They can't win as a result of their own actions. Once you lose trust, it's hard to regain it.
It seems their chipset doesn't have the security features required by the GrapheneOS project such as hardware resistance to brute force attacks.
Yes. Pythagoras theorem holds up in non-euclidian space but the sum of the angles is 180 degree does not.
If I skimmed this[0] right, it looks like curl is moving towards rust, in a piecemeal fashion.

[0] https://daniel.haxx.se/blog/2022/02/01/curl-with-rust/

Edit: Just because it seems pertinent, I noticed the line """"50% of past curl vulnerabilities are "C mistakes"""" in the slides linked by the post above.
Wow, it can't even recognise obviously Japanese characters?
Did you fully read the post you blew up at? I didn’t doubt the usefulness of LLMs. It was a very specific complaint about posting LLM generated content on the Internet without specifying it as the off-the-cuff trash it usually is.
I have worked with Python for well over a decade and only time I have built my own is to test out the up coming version before it is readily available for my distro.

On Windows I just download from python.org and on Mac I get whatever homebrew gets me.

Never have I even thought about need to optimise my python executable.
“Free” markets are extremely efficient at what they’re intended to do. Which is finding a fair price for a goods/service.

But there are MANY nuances:
1. Are you making sure everything you value is being priced in? For example, a free market will find you a very efficient price for an assassin to get rid of your spouse. But without external regulation it won’t factor in whether or not getting rid of your spouse is actually a good thing for society or not.

2. Is all the information available to all participants? This is extremely difficult to achieve and in a sense the entire financial system is a hundreds of billions of dollar industry whose goal is to improve information transparency marginally.

3. The word “free” doesn’t mean what a lot of the people who go on and on about “free” markets think it means. It means markets where information is freely available and buyers and sellers can participate freely. The “free market” propagandists, on the other hand, insist free means free from government regulation, when in fact to achieve a real free market where buyers and sellers can bid freely and information is easily available to all, regulation is a prerequisite. And in a democracy the regulation is likely to be government regulation.
Because it's completely irrelevant to the discussion at hand whether or not the author is a furry or not.
Do what is sensible for your particular situation.
A cook is a bad analogy for the rank held by the people involved. It's more like "son of the estate owner" or "head guard", except it's both of them because it was multiple execs. So, yes, the estate owner should be held accountable. And in most civilized societies, he or she would be.
Former Wirecard CEO Accused of Leading Russian Spy Ring
Why would anyone believe that they aren't? Or that they won't start doing it?
That was my bad. I meant to say it didn't lean either way because the research is lacking.
RGBtoHDMI will convert the classic mac video to HDMI https://tinkerdifferent.com/threads/my-little-guide-on-rgbto...

It is also useful for several other kinds of machines such as the Amiga
An annual release cycle isn’t for people who bought the phone last year.

It’s for people who bought their phones 2 or 3 years (or even more) ago.

The question is how does this phone compare to the Pixel Pro 6 or 5, not how it compares the 7.
Ask HN: Prompt Engineering: A Skill or Role? Whats the Future?
I am seeking insights into the future of Prompt Engineering across different segments:

- Company Sizes: Small, Mid-Size, Large
- Roles: Tech, Product, Non-Tech

How much time do you foresee developers or companies dedicating to prompt engineering?

I understand this question is quite open-ended, but I'm eager to gather perspectives.
I have a corporate laptop which funnels all traffic through zscaler.

I was somewhat surprised when I was getting a different IP address on ipinfo.io (my home IP) compared with whatsmyip.org (a zscaler datacentre IP)

Curlling ipinfo.io though came back with the zscaler address.

Turns out they don't funnel UDP via zscaler, only TCP.

Looking into zscaler, https://help.zscaler.com/zia/managing-quic-protocol

> Zscaler best practice is to block QUIC. When it's blocked, QUIC has a failsafe to fall back to TCP. This enables SSL inspection without negatively impacting user experience.

Seems corporate IT is resurging after a decade of defeat
Well, here we are.
Bitmagnet: A self-hosted BitTorrent indexer, DHT crawler, and torrent search
Also: Bridges built by men tend to fall less.

My statement is as important as the one in the link above. Change my mind.
If I recall correctly in TCP a packet loss will cause a signifcant slowdown in the whole data stream since that packet needs to be retransmitted and you generally end up with a broken data stream until that happens (even tho TCP can continue to send more data in the meantime meaning it's more of a temporary hang than a block). Thus if you are sending multiple different data streams over the same TCP connection a packet loss will temporarily hang the processing of all data streams. A constrain that QUIC doesn't have.
This old problem.

It's the word "win" that bothers me in this context.

Until one sees that conflicting models can make "security" a zero sum
game, in which your security is my insecurity and vice versa, there is
only psychological splitting, posturing and clamour for the "moral
high ground".

Indeed, even using the word "security" as a bare noun is a mark of
presumptuousness. One must always ask; Security for whom? Security
against whom or what? Security to what end?

Unilaterally imposing a harm (leaking of data) upon others is
disdainful, but then offering "security" as your reason/excuse, is
condescending, since you do not know what my security needs are and
how they are prioritised.

When it comes to messing with my data or devices "for my own good" the
only proper response is "I'll be the judge of that!"

Many then respond that "people are too stupid and need a firm hand",
which is not a good look, and frankly cuts to the core of so many
problems in technology today.

Companies like Google need a better moral, sociological and
psychological map of reality before putting on their boots and
marching off down the road of good intentions in the direction of
Hell.
But that isn't relevant for this discussion. Humans can be intelligent in a fundamentally different way than LLMs even if sentience isn't special.
What is the best approach to handling a continuous stream of data? Is it just 'buffer till you have what you need and pass it off to be processed' approach? And then keep reading until end of stream/forever.
It’s a bit more complicated than that, it’s also a bit more complicated than what I’m about to say.

Functionally speaking when a company issues a dividend of $x the stock price S will drop to S-x on the ex dividend date. This makes sense as the company now has $x less per share. The shareholder is at a wash as well. They had S before and now they have S-x+x. No value was created, money was simply moved.

Given the above you can more or less value dividends using discounted cash flow. A ~3% dividend is CSCO’s case isn’t worth paying more (increasing the share price over) on its own because the cash used to buy the shares is worth ~5.5% today according to the risk free rate.

In fact if one were considering the dividend alone then the company should be worth less. Obviously factoring in future growth, etc… the market has landed on the current price.
> I'm pretty sure the stated intent of the redirect is to prevent phishing (that is, provide an opportunity for Google to warn users about visiting a known dodgy site). The ability to track is just an added bonus!

How do you know it's not the other way round?
But what does a “typical” attack on a libcurl vuln look like? Unlike a server process attack, wouldn’t curl be required to be directed to the attacker’s malicious content?

So the vulnerable systems are those where an attacker can craft an endpoint where curl downloads data?

Isn’t the lucky circumstance here that most systems with libcurl don’t use it and among those who do, an even tinier subset will allow an attacker to point it anywhere (e.g downloads from an url the attacker decides)?
People who aren't very familiar with that culture might just assume that the author likes cute cartoon pictures of animals...

I don't get why it matters?
Pretty sure it's this pyramid where they didn't know the whole hill the pyramid was on top of was actually part of the pyramid until recently

I wonder what other natural formations are man-made, but we don't realise it yet