skysight-inc/HackerNews huggingface dataset:
Discord is the place to go. All CF Devs are there.

I got on particular fix one time in just a few minutes, and scalated pretty quickly. I got a recomendation fix on my side (a code change on my deployment that cover the problem) and a permanent fix on CF side 4h latter (time that took to changes propagate to all colos)
* Data leaks are not prevented by MITM attack. A sufficiently determined data leaker will easily find easier or elaborate ways to circumvent it.
* Malware scanning can be done very efficiently at the end user workstation. ( But always done inefficiently )
* How domain blocking requires a MITM?
* C2 scanning can efficiently done at the end user workstation.
* Audits does not require "full contents of communication"

Is MITM ever the answer?

Stealing a valid communication channel and identity theft of remote servers is in fact break basic internet security practices.
Agreed. Panic is the rational reaction [edited from "response"] to a near term extinction level threat that not enough people are taking seriously.

People advocating half measures or not panicking are incredibly irrational. It's a human cognitive bias to try to arrive at intermediate outcomes between extremes (regardless of truth). Extremeness aversion.

edit: for instance, IPCC/NCA5 author Zeke Hausfather said, "This month was, in my professional opinion as a climate scientist – absolutely gobsmackingly bananas" (https://twitter.com/hausfath/status/1709217151452954998)

Everyone should be rioting in the streets. If you are not scared for the lives of your children then you simply don't realize the severity of this problem.
I could reproduce on HTML ZIP export but not PDF.
DeepMind shows Promptbreeder, an AI that self-improves via recursive prompts
Show HN: Open-Source Alternative to Chatbase
My take on this which inevitably steps on toes in these parts:

Software Engineering is real engineering.

Far fewer software engineers exist than software developers who call themselves software engineers.

I have never called myself a software engineer.

Like most titles of prestige, "engineer" has been massively devalued of late by the constant marketing machine.
American and European companies supplying parts for Russian rockets are paid in dollars and euros, not in crypto, I can assure you.
What makes “real engineering” the correct paradigm (and legal framework) for a profession isn’t the method of delivery, it’s the failure mode and how that aligns with cultural values.

In the simplest example: if you ship a car with a bug in its RTOS, people could die. It doesn't matter how easy it is to update. As a culture we’re generally opposed to preventable deaths. In other professions we have set up a regime of legal liability and professional licensing as guardrails and incentives to prevent that failure mode. We should treat software engineering the same, at a minimum in applications where lives are at stake.

Other non-lethal failure modes should also be considered (Experian, anyone?). We may have culturally decided by default or accident that data leaks are no big deal. If we actually did think they were important, it would make sense to have licensing and liability frameworks to reflect that.

The fact that software has fewer practical constraints than building structures is an excuse masquerading as a reason for not having even the most basic controls in place.
A note to anyone wondering why there are so many flagged comments in this post:

Drew DeVault has a thread on Mastodon where he's invited people to reply with links to posts and comments here that they believe are examples of HN's users and moderators "censoring progressive voices or discussions, or tolerating hate".

This post was linked from one of the replies, https://fosstodon.org/@adrienne@treehouse.systems/1111726693..., and is likely being brigaded by readers of that thread, who are also posting judgemental opinions such as:

> holy fuck that thread is shockingly vile, and I’ve seen a lot of vile shit on the orange site

And:

> looks like the item got flagkilled off the front page, so at least it's not getting much new traffic, but the comments are an absolute cesspool

Seems that they would prefer people with views that dissent from their own to be censored, rather than to engage in open discussion.
> settled knowledge today can have a renewed impact tomorrow

We need to move away from the idea that there is such a thing as 'settled knowledge', because as you suggest there is always something else to uncover. Our knowledge is fallible, never settled, there is always the possibility to find and correct errors.
I've been toying with an idea of some kind of "Spotify for OSS" kinda thing - where software authors can make their binaries available, provided you have an active subscription (with the Spotify for OSS service).

Funds are then distributed based on usage (trackable at the package registry).

The idea being corporates buy a single license per head, rather than dealing with lots of donations etc.

Probably lots of reasons it wouldn't work, but it's a fun thought experiment.
I'm not saying that I agree with it and neither that it works though ;)
Most of these companies are regional version of companies that also exist in the west.

Iono but seems like apps focusing on Shopping, delivery, ride-hailing, and payment apps being built by regional companies makes sense and isn’t that remarkable. They’re best suited to navigate the region’s particular laws and culture whether it’s an American company dominating the American market or a Indian company dominating the Indian market or wherever
I'm pretty sure that Netflix operates a decent amount of servers in South America which would result in low latency connections.

HTTP/3 really starts to shine once high latency and/or packetloss are involved.
I just mean, it’s so easy to ignore inquiries and I’ve found that if you ever get ignored and need to be heard, a lawyer’s letterhead attracts attention.

I agree with the legal issue you put forth.
A HTML file exported from google docs is not a google doc and I don't see how or why a firewall would see it as one?

The URL to download the export can't be shared as far as I can tell.

edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems.
Indeed. In many cases it backfires.
Where in the world would this event take place? In the hottest parts of the US the temperature gets to 46ºC regularly during the summer and people have lived there for hundreds of years. Do people die of heat stoke? Sure, at a rate of hundreds per year. Elsewhere in the world there are places where people love in the same heat with less means of cooking and less access to water.

Millions of people may have to adapt. Fortunately, people are good at that.
Banning corporate ownership of single family homes, including forced sale of existing portfolios, occupancy requirements, mandated development on state-owned landed, direct state construction vs. subsidies.
The point is that from a UX perspective, people want to be able to specify loose dependencies, and then for a constraint solver to then provide an overall set of dependencies where all of these holds.

You're saying "just use nix". Nix does not provide this. This is a fundamental feature of programming language package managers. I would love for Nix to have an interesting answer to this problem, but I think that if nixpkgs continues to exist in its current form (following more of an apt model), it will be hard for the Nix community to come up with an answer that fits well. Nixpkgs is mostly about distributing compiled assets, while programming language package managers are mostly about distributing source code. The important parts are different!
Decades of optimism along the lines of "something bad is coming, but we can still fix it" did way too little.

Perhaps now that it's actually bad something might happen.

At this point, geo engineering is probably the safer option compared to letting the planet spiral into an uninhabitable waste land. Of course, it should be combined with cheap and abundant renewable/nuclear energy.

Now that things are bad, there might actually be popular support for this, though we may still have to wait for the current political class to retire.
I use my phone to access work stuff. That's a huge reason to need security updates.
In fact, I would go even further and predict that all cause mortality will be under baseline for countries most affected by climate change in the next 10 years vs 10 years prior, and life expectancy will go up. I absolutely believe that climate change is happening, I think tech and other improvements will outpace the damage it does. I'm very serious about betting on this.
Kosmos-G: Generating Images in Context with Multimodal Large Language Models
The more infrastructure built to fund a cause, the lower the percentage of the money actually funding people on the ground doing the work. This is often true of charities. OTOH there will be more money, and maybe some of the people actually doing the work can actually make a living doing so.
LLMs can read from images. Should we stop teaching reading?
Even George Rombio agreed climate change is positive for northern climates. The desserts are retreating and the earth re-greening. The climate winners enjoy longer growing seasons and more arable land. If see levels rise, we can build sea walls and levies. But if you choose to rebuild after disasters, instead of relocating, which used to be the norm, then each time you rebuild you increase your risk from severe weather events. Naturally insurers take a dimm view of that. It is U.S. policy causing your biggest problems.
Why does it say "5 developers $ 17k / month"?

Is that 1 developer of $17k / month? (So a $204k annual salary?)

Or, does it mean 5 developers for $17k / month (i.e. a $40k annual salary?)

If it's the latter, I'm highly concerned.

Even in countries like India salaries like $60k USD (INR 50 lakh) has become a bare minimum for software engineers who are even the least bit talented...

For a really good software developer in India, you'd have to pay circa $180k USD (INR 1.5 cr), which is still a massive discount compared to the US, since in the US that person would probably make around $350k.

Where are they hiring people?
I am a pro artist. Most of my artist friends who don't use Photoshop either use Clip Studio or Procreate. In general the Clip/Procreate split corresponds strongly to whether or not they do a lot of comics.

There's a handful of other programs that one or two of my friends use but absolutely zero of my friends have talked about using Affinity Photo.
The Spaniards even built a Church on the top
The link you have here is 'attacking' by directly changing the meta data in C with pointer offsets and doesn't mention musl anywhere.
if you don't have to have any qualifications, certifications or licenses to practice it, it's not real engineering
> in the early '00s

The customer was probably talking on their landline phone for the hour.
According to the article, whoever is behind this is using some web site that lets anybody with an email address spoof a US phone number to send fraudulent messages. The phone system badly needs to be upgraded so that people can't make calls or send text messages from somebody else's phone number. Doing that would not only stop the shady service that people are using to send these hoaxes to schools but would also stop the spam calls that come from people with the same first 6 digits as your number.

There aren't really legitimate use cases for phone number spoofing and even hiding your number so it shows up as unknown on caller ID is a good way to ensure the person you're calling won't answer the phone. When somebody makes a phone call, you should be able to trust that the caller ID shows the actual phone number that is calling you.
Who made you the Grand High Arbiter of language use?
Khara threw a bag of pachinko money in Blender's face to make the last Evangelion film work, and it was fine. I guess that was a rare occurrence that they desperately and so purely needed a tool they can hand to broke freelancers without frantically searching for keygens, but it can totally happen when incentives are right.
> Asking people to have less, experience less, and do less isn’t an argument that can ever win.

Yes and no. I agree that if your approach is to ask people to do this, you aren't going to win the argument.

But instead you can reframe the argument.

Does that $70,000 truck that you have to make payments on while you do back-breaking or soul-crushing work to afford it really make you happy? Do you really get use out of that or are people scamming you with clever marketing?

Do you really enjoy glamping or do you just like the idea and you sit around on your phone posting pictures about how much you like it while not really doing much. Are you honest with yourself?

Etc.

> Cramped trains will rarely win politically but electric cars that go fast and look cool do win.

We don't even have trains, let alone cramped trains. This one is funny though because everyone "loves how walkable XYZ area is" but then they get their mind completely wiped once they leave not realizing they can live like that too if they demanded it or if we had a good market mechanic in place that allows for choice.

For some bewildering reason we don't build more of the most loved homes and neighborhoods and transit experience like we do for every single other product.
Yea IMO it’s more useful to think of AI from a purely tech pov like this. The important thing is that brains resemble tech not that tech resembles a brain.
First of all, you need to separate an activity's direct, real externalities from those created by draconian, stupid laws that make consuming and buying those drugs into something much harsher and costly than it need be.

Secondly, everything we do has externalities in some variably extrapolated way and that by itself is a bad, hazy-logic reason to blanket ban it. Instead, you create reasonable checks and try to ascertain motives (as we do for so many other potentially dangerous activities without banning them). If one's motive is to get high in their own private context but they can't do so without becoming a burden on the criminal justice system (because their otherwise personal activity suddenly became a public cost and the target of some bullshit moral crusade), then maybe your anti-drug laws are the bigger problem, not that individual's personal choices and their artificially constructed effects on "the community".

Yes, I know that some people high on meth, cocaine, PCP, etc can become mentally unstable and commit violent acts or crimes, but people in all kinds of reasonably, widely legal situations can also do the exact same things without whole categories of consumption and behavior and activity being banned in a heavy handed push for social purity.
Thanks for reminding, I was about to edit: "settled knowledge (if there is such a thing [...] )"
CF Workers (that runs WebAssembly) are all over place. They may not run the main logic (not the actual Ngix, or DNSEC code) but they are used for several maintaince tasks.
https://huggingface.co/papers/2310.02992
Almost nobody uses science and mathematics to prove a design before coding. The closest I came was the glacial waterfall environment of defense software that I now realize wasn't so bad.
That's inconvenient, but it's definitely expected.

From https://en.wikipedia.org/wiki/ISM_radio_band :

> The ISM radio bands are portions of the radio spectrum reserved internationally for industrial, scientific, and medical (ISM) purposes, excluding applications in telecommunications. Examples of applications for the use of radio frequency (RF) energy in these bands include radio-frequency process heating, microwave ovens, and medical diathermy machines. The powerful emissions of these devices can create electromagnetic interference and disrupt radio communication using the same frequency, so these devices are limited to certain bands of frequencies. In general, communications equipment operating in ISM bands must tolerate any interference generated by ISM applications, and users have no regulatory protection from ISM device operation in these bands.

> Despite the intent of the original allocations, in recent years the fastest-growing use of these bands has been for short-range, low-power wireless communications systems, since these bands are often approved for such devices, which can be used without a government license, as would otherwise be required for transmitters; ISM frequencies are often chosen for this purpose as they already must tolerate interference issues. Cordless phones, Bluetooth devices, near-field communication (NFC) devices, garage door openers, baby monitors, and wireless computer networks (Wi-Fi) may all use the ISM frequencies, although these low-power transmitters are not considered to be ISM devices.

So basically the microwave oven's Faraday cage needs to block enough for safety. There are regulations about the radio spectrum, but they allow it to emit some.
NextRadio doesn't work in Android 11, and it isn't being updated because the group behind it crashed and burned.

Since there isn't a universal way to access the FM chip, your only hope is a vendor-specific app, which has its own problems, such as FM receivers being illegal in some of Europe: https://itigic.com/in-2021-fm-radio-is-removed-from-all-mobi... and https://radioinfo.asia/news/europe-mandates-compulsory-digit... (France requires that digital radio be included in a receiver, so a device that is only capable of receiving FM is illegal)
That doesn’t make sense to me. If a software bug can cause a death, like in a car, then the failure modes and legal consequences are the same as traditional engineering. What’s the difference?
Every visitor would have to manually trust them; provided they're using a browser that still allows them to do so.
I think it’s worth separating the question of “do software engineers actually carry professional liability or have their designs independently reviewed” from the question of “is software development work sufficiently consequential and verifiable to warrant professional liability and certification requirements?"

To me, the answer to the first is obviously no and the second is obviously yes.
My SPOT has a pretty significant failure rate at getting tracking messages out (~20% of my tracking dots are unsuccessful), and has no feedback mechanism to indicate whether it was successfully sent. Unless emergency messages are sent using a different technique than tracking messages I’m not sure I trust the spot much either.
You're addressing a straw man, I never claimed it was "exclusively" trained on GitHub. I said "primarily", though I should have been specific and said "primarily fine-tuned".

In the context of the person I replied to, the point is that it isn't made up primarily of a bunch of communications between programmers.
Keep in mind that this is also the country that fined shops selling chewing gum up to S$2,000.

Incentives uses to nudge our behaviours... Why not — to the max.

https://en.wikipedia.org/wiki/Chewing_gum_sales_ban_in_Singa...
There are some safeties built in (fuses/circuit breakers) but ultimately it’s not so different than safeguards in software. Hence why the electric grid often has issues.
I think computer scientists work in a “parallel universe of perfect logic” but sadly I strongly disagree that the vast majority of software engineers get that privilege.

IMO, contemporary SWE involves a lot of black box treatment, learning complex systems on the fly, and untested large code bases. All of that leads to similar dynamics as more direct physical dynamics in other engineering disciplines do: unexplained behavior, doing things by spec, debugging by process of elimination, etc.

And that’s before mentioning the direct problem of device and network issues; I understand this to be a certainty for those doing things on a global scale.
I've thought about this a lot as a dev. IMHO, no, and the main reason is a strong resistance to standardization: in OS platforms that we work on, software libraries to do basic things that we include, education credentials, and QA. We simply can't agree on a practical knowledge base as a profession that beyond the 1st and 2nd year CS fundamentals. There are some best practices that we've seem to coalesce around, but even those are somewhat ill-defined.

OTOH, I'd also be lying if I said that there weren't real world benefits to working a little more "fast and loose", and I'm at a point in my career where I can accept that the varying level of rigor and standardization in the more profitable software companies is the best balance in today's world, and I try to pick my battles.

But I don't think this is any more "engineering" than an MBA using spreadsheets and accounting statements to decide where to allocate human or capital resources to maximize profit. We just use a fancier set of tools and have a different domain to optimize.

And I know this doesn't reflect every dev job. But it sure does a heck of a lot of them.
When i was in grade school some 20 years ago now we had the same issue but it was bomb threats back then.
That's wild.

So now everyone is more scared, is there any evidence they are safer though?
If it makes you feel any better, this September may have been the hottest of the past 100 years, but it will probably be the coldest of the next 100 years.
Not to diminish the legacy of curl, but wget exists as well, right? Pretty sure a lot of machines use wget instead of curl.
>Is it just a freak weather event? Can we attribute it to climate change? Can't we accept digging up carbon/methane and burning it creates an atmosphere/planet that slowly becomes inhospitable to humans?

I think it's all 3. The problem is that, like anything remotely political in our current environment, one side says it's 100% one source, and the other says it's 0%.

The transition is going to be very expensive, and normal people (hardly getting by) aren't willing to get even poorer when they can't be sure it will help in the grand scheme. Our leaders are doing nothing but talk, they're the worst individual offenders. And globally, there's a "tragedy of the commons issue" at the Nation level, where those who continue to burn fossil fuels are going to get ahead.

Until these things are addressed, telling us repeatedly that it's getting warmer falls on deaf ears.
> The amount of effort to create a forgery of a Louis Vuitton bag seems to have so much less effort/payoff ratio than create a fake IC or create parts with low grade steel.

> Specially considering that you are risking lives and will most likely be chased for liability

I read an interesting book about this once: Poorly Made in China. Author tells stories of chinese factories manipulating the quality of products such as steel. The factories would gradually reduce the amount of each steel component. They'd use a little bit less iron than they need to, then a little bit less chromium... They'd gradually cut costs by manipulating quality, pocket the difference, become wealthier, all while passing the risk down to their western buyers. Nothing happened immediately, nobody even noticed until some steel scaffolding collapsed, workers fell to their deaths, someone tried to figure out what was going on and noticed the steel chemistry was all over the place.

People sociopathic enough to do stuff like this could not care less about lives or deaths. What matters is rising in life, getting rich. Life, death, safety, risk? Somebody else's problems.
There are absolutely legitimate use cases for phone number spoofing, especially for businesses (many locations but single contact number as an identifier), but that doesn’t mean it can’t be made a lot more resilient to bad actors.