skysight-inc/HackerNews huggingface dataset:
I feel like part of the productivity is just moved to reviewers. Every once in a while, I have to review large PRs and find out which comment is AI-generated nonsense.

LLMs are really good at fooling us into thinking that code comments make sense.

That's why I prefer if devs don't use copilot, but instead cherry pick good output from ChatGPT.
From what I can tell, people were talking about reset flooding that was dated back in July. Not as a novel thing, either. It's just one of several known vulnerabilities, suggesting they've known about this kind of thing for awhile.

https://pentestmag.com/good-bad-and-the-ugly-of-http-2/

I genuinely don't know if this is real a zero day, or if it's a known protocol vulnerability that nobody was mitigating.
>> "The only time that’s true is if your revenues are flat year over year."

That also makes a lot of assumptions on its own. Baseline is: profits matter. Capitalists want their cut. Profits is the extraction of the "thing". If capitalists can't put the "thing" in their pockets then why even bother?
Back when vaping was still legal, a vaper surfaced on this site asserting that there was no way vaping would ever be banned, obviously, at least outdoors, e.g., while waiting for a bus, and guess what? At least where I live (Bay Area) vaping is illegal while standing outside waiting for a bus.

So don't assume that your appreciation of woodsmoke is widespread enough prevent its becoming illegal some day.
The status page became political.
I think blockbusters got too expensive to make (relative to economic conditions) so now the money men don't want to take any chances when funding a movie. Everything needs to be designed by committee and run through a hundred focus groups; this kind of process can never produce true art, only soulless LCD slop. But it maximizes the chance of a movie not being a commercial flop, and that's what's important to the movie industry right now. This is the same reason we barely get anything besides remakes, reboots, adaptations and "cinematic universes". The movie industry in recent years is very averse to risk.

People who reject qualitative artistic appraisal of movies will reject that any such trend exists, and will say that everything is fine by the empirical metric of box office returns. They're missing the point; the reason movies are being made like this is because it's the least risky way to make a movie. Of course box office returns are going to look good, that's the point.
Conditional grace is not grace. The human experience of grace is so much larger than what you describe.
i've taught c and c++ extensively commercially, and i really can't remember anyone having real problems with understanding pointers, despite some trepidations they might have had when the topic was first introduced.
nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacti...

caddy: https://github.com/caddyserver/caddy/issues/5877
Don't get lost in the tools.

I would just go with Google Docs as if you are working with an editor this will make your life a lot easier than trying to teach someone how to send you diff patches of changes and discussing them inline in on GitHub PRs.
The docs are available after getting the early access (which is not ideal and I'm aware of that). You can check the basic example here: https://github.com/semanser/jsongenius
Agree with you there. I find it pretty useful especially for the price and where it might evolve in the future.

I am not sure why so many people have hard time getting value out of it.
The pipelines remained pressurized, that's all.
> I think the problem is that they aren’t mind-blowing, but an improvement.

You seem to be doing what GP is pointing out.

GP's claim is that the relative improvement itself is mind-blowing, not that the tech is mind-blowing in an absolute sense.

I tend to agree: much of the detraction hangs on current-state rather than a probable potential-state informed by recent relative advancements.

In other words, many proponents are chuffed because of that potential; not because actuality. Likewise, skeptics are reserved because of the actuality, and not because of potential, for whatever reason (there are at least a few main ones, I think).
You don’t even need the suica app. You can create a suica card within apple wallet and fund it immediately.
> I really fail to see what people see even in Nvidia/Cuda, it won't take long until others catch up, and they'll likely move back to margins closer to the industry, which are extremely low

I thought that would happen by now too, in 2016, so I started slowly selling much of my NVDA stake after a few years. This was wrong. It turns out they have created an ecosystem effect where everyone makes their papers and code work in CUDA and everything else is best effort. AMD hasn’t even really been seriously trying from my point of view, but once they do they’re still trying to bail water with a leaky bucket - new models come out every day where the researchers have run and tested on CUDA only.
I disagree, in the shopper view the full price would better reflect it’s own reality.
Can we put the AI in hAIku?
The challenges of getting an LLM to produce poetry.
HN's privacy-minded crowd and HN's AI-obsessed crowd don't have much crossover, I don't think.
This coupled with current events reminds me of the Marx quote:

> “The tradition of all dead generations weighs like a nightmare on the brains of the living.”

Hope someday we can move on from whatever team we were born into
The cost comes from initiating the request to some backend which presumably starts working on it.
I'm using sphynx and restructured text. More poweful than markdown. I've never tried laTex, but that is the goto for math. I use mermaid for various charts, it is more limiting than other tools, but the format is more git friendly.
I don't think so. It helps increase productivity but it's just too inaccurate and generates too much stupid output.
Not that I could do better but it's just not good enough yet.
It does and most people that used Nomad were very positive about it. But with the turn that Hashicorp have taken I'm not sure that it now stands much of a chance.
Google is making passkeys the default option
I think for this audience a good clarification is:

* HTTP/1.1: 1 request per RTT per connection

* HTTP/2 multiplexing: 100 requests per RTT per connection

* HTTP/2 rapid reset: indefinite requests per connection

In each case attackers are grinding down a performance limitation they had with previous generations of the attack over HTTP. It is a request flood; the thing people need to keep in mind is that HTTP made these floods annoying to generate.
This makes me want to play Mini Metro again!

https://store.steampowered.com/app/287980/Mini_Metro/
I personally like the flexibility of i3's keybinding config.[1] For each binding it lets you choose either:

- a keysym (the letter Z, wherever it happens to be in your current layout)

- or a keycode/scancode (the physical button under your pinky, no matter the current layout)

I use both methods for different bindings. For example I've bound the vim keys (hjkl) by scancode, and the layout keys ("S"tack, "F"ullscreen, "R"esize, etc) by symbol.

[1]: https://i3wm.org/docs/userguide.html#keybindings
This seems like a hyperbolic misuse of both “vulnerability” and “zero-day”.
From what I read the goal would be to pulverize it into pieces small enough that the majority would burn up or at least be significantly attenuated by the atmosphere, as well as impart enough delta-V to send some fraction of the mass on a new trajectory that would miss Earth.
There is certain terrain legged robot will struggle with too
Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it worthwhile. Can anyone help me understand?
This is a bit off topic, but I'm running Home Assistant on a system that doesn't have any ECC.

I'll reboot it occasionally. Every once in awhile it will exhibit odd behavior that seems to resolve on reboot.

Is it worth getting something that has ECC?
I think I'm running like a Sandy Bridge i7 for reference.
Building an Anomaly Detection System with Recurrent Neural Networks
technically the issue is speculative execution, not superscalar execution (ie. "allowing things to be sent/processed out-of-order!"). Most high performance processors have both, but you can have one without the other.
Do you remember the pre-DDoS mitigation days? Botnets could easily bring down major, important sites and make them unavailable to users. This caused monetary loss and could even cause life loss depending on the site. How is the previous state better than, well, not suffering from these problems?
That’s amusing. Although, Monster had explosive growth in its first few years (starting from nothing). Do it over 17 years and NVidia wins.
The results don't seem great.
Trust me when I say that you don't want the ISP's to inspect web traffic. That is not how to solve this. That is costly for the ISP and will drive up costs. It also makes supporting a website impossible. The ISP is assumed by all parties to be impartial. That assumption is required for the internet to be operational. Sure it might function your way, but it would be impossible to support.

And maybe Facebook and Google are big enough to push around the ISP's, but they are the only ones. Nobody will bat an eyelash if 15,000 Comcast users in Phoenix AZ can access your hokey-pokey website. Comcast doesn't care. The users won't blame their ISP. They will blame you, or whoever owns the hokey-pokey website. If you want traffic, you need to be equipped to handle traffic. You are the one with the internet facing infrastructure.

You are the one blocking traffic. Not the ISP. That is how it should be. The ISP should be impartial. You pay for connectivity. Consider yourself connected. For better or for worse. You are responsible for what you put onto that connection.
Yep! There are probably issues with this setup, but I wrote a small plugin to allow them to work in the same repo, sharing the same express instance: https://github.com/coxmi/astro-payload-plugin

Because of various ES module/CJS issues I had to bundle payload with esbuild and change the extension to cjs. The config wasn't being properly found/parsed by their webpack/ts-node setup, and because payload loads its own config in dev mode, it's all a bit complicated. This was the easiest fix I could find.

My example repo can be found here:
https://github.com/coxmi/astro-payload-example

Which was sort-of based on Payload's own custom server example here:
https://github.com/payloadcms/payload/tree/main/examples/cus...
Yes, a great article! It was no bigger surprise to see that the article was written by an Oxide employee - it has been a joyful signature that they've managed to attract curious people with an engineering approach to investigate problems and look up how the things work. I'm probably biased, but it seem like a dream company to me.
We tailored our design services to startups
Design subscription for startups. Essentially an in-house designer, with the flexibility of a freelancer.
Interesting, no mention of Scala at all. Did Netflix say goodbye to Scala altogether?
If the source field in a packet reliably indicated the source of the packet and a given IP was sending you a lot of unwanted traffic, you'd ask their ISP to turn them off and the problem would be solved. Maybe one day BCP38 will be fully deployed and that will work. I also dream of a day where chargen servers are only a memory. Some newer protocols are designed to limit the potential of reflected responses.

Null routing is available in some situations, but of course it's not very specific: hey upstreams (and maybe their upstreams), drop all packets to my specific IP. My understanding is null routing is often done via BGP, so all the things (nice and not) that come with that.

Asking for deeper packet inspection than looking at the destination is asking for router ASICs to change their programing; it's unlikely to happen. Anyway, the distributed nature of DDoS means you'd need hundreds of thousands of rules, and nobody will be willing to add that.

Null routing is effective, but of course it takes you IP offline. Often real traffic can be encouraged to move faster than attack traffic. Otherwise, the only solution is to have more input bandwidth than the attack and suck it up. Content networks are in a great position here, because they deliver a lot of traffic over symetric connections, they have a lot of spare inbound capacity.
Six Bananas – this site ranks everything out of 6 bananas
Yeah this happens a lot when the DOM changes and the app loses the track of the tooltip so it can no longer dispose of it when you navigate away from the target.
Same in Eu: those that don't pay the taxes present their trade number and get the tax knocked off - often at the register (seen it often where a tradesperson just needs some quick items).
Prices for the rest of us are visible and are what we pay.
No guessing involved.
If you want to do that, try gRPC and Proto.

But I feel like REST and OpenAPI are fine especially if you start from the backend. I think with .NET Web APIs, the story is particularly good since it has out-of-the-box tooling for OpenAPI spec generation based on your exposed endpoints and models and then the option to customize that as needed.

I've recently been working with it trying to get hot reload working on the frontend client generation and it's a fantastic DX with minimal wiring: https://chrlschn.dev/blog/2023/10/end-to-end-type-safety-wit...
For me it is very different use cases. Copilot often prevents me from needing to write mundane blocks of code, as it will often fill in what I'm looking for after I write the function name.

If I'm still unsure how I might approach a certain problem, or if it isn't immediately clear to me how I'd write the function I want, I might type in a prompt to ChatGPT and see what it comes up with. But it would really slow down my workflow if I had to prompt ChatGPT for every mundane function I plan to write.
HA k3s?
GraphQL is more future proof than rest.

Rest is tied to HTTP forever - GraphQL can be separated, easily.

Rest communicates inputs and outputs in too many ways for my liking any more:
headers, paths, bodies, query params, and dare I say method.

One complaint for GQL is that potentially they had a chance to standardize paging, filtering, etc... instead every schema is customized.

I guess we'll have to create a new standard at some point. We'll never get this shit right.
"by the 3rd or 4th century AD" - that early?!
Ask HN: Are there any open source windows ChatGPT API clients out there?
Maybe the guys doing DDoS attack on Google should give MS/Github a go?
The Russian electrical grid decoupling is mostly standing behind in building enought Synchronous condensers to keep the Baltic grid stable.

Estonias first SysCon was turned on this summer https://news.err.ee/1608976037/elering-launches-estonia-s-fi...
> click 'get started'

> i can't get started

> my face: grumpy

I don't think I like this kind of bait-y submission. Post a workable service or a repo with code, but don't come begging to collect our email addresses.
Fundamentally, the trouble with the Monty Hall problem isn't that analysis comes to the wrong answer, it's that people often come to the wrong model when reasoning about it informally.

It's not any harder to do the "correct" analysis than to write up a simulation. It's mostly just easier to convince yourself that the simulation matches the problem description when it reaches the unintuitive result.
This 100%. Make sure you spend no more than 20% of you time in tools. For most people 10% is better,but since you are doing math plain text isn't good and so I give you a little more time. But always focus on content first.
The live webcams are cool. You can see the trains passing. Not quite in sync though
Out of curiosity, could you clarify what you think is a good email? I feel like I have this skill but since I've never really been taught it, I don't really know.
Note that the lazy DFA and its lower level APIs exists now and threads this needle.
It’s a prisoner dilemma! The only way to win is for both service providers and “bad people” to not escalate. That’s not going to happen.
At the time of the attack, Russia had spent months giving multiple fake excuses as to why they weren’t sending gas through the pipeline[1]. Interesting bit:

> Russian officials and Gazprom representatives continue to insist that Germany could easily solve the problem by simply agreeing to certify the Nord Stream 2 pipeline and accept deliveries via it.

What’s interesting is that Nord Stream 2 wasn’t needed when Russia first started saying that certifying it would bring gas back, and European governments said as much. After the explosion, however, the previous Russian claim became a reality, and Putin pushed for certifying Nord Stream 2 as a solution[2].

It’s still unclear who was responsible for the attack, but the claims that Russia would have no motive ignore what was actually happen in the lead up to the explosion.

[1] https://carnegieendowment.org/politika/87837
[2] https://www.dw.com/en/putin-offers-europe-gas-through-nord-s...
Disclaimer: I work at HashiCorp, but have been of this opinion since before joining (source: https://atodorov.me/2021/02/27/why-you-should-take-a-look-at...)

HashiCorp Nomad is a perfectly easy and flexible orchestrator (not only containers, also VMs, random binaries, Firecracker, WASM, etc.) that is production grade. It has a number of advantages over Kubernetes (being drastically easier to deploy, use and maintain; having integrated native templating with logic; being much nimbler but also being able to scale much more, etc. etc.) and it's a very good choice in many scenarios. Of course there's also disadvantages, most notably ecosystem size, but often that doesn't matter. Kubernetes is great and extremely powerful, but also very complex and straight up overkill for many organisations.
For me, "intelligence"[0] is a real-valued vector rather than a boolean.

If it was a boolean, the limits you describe would certainly exclude some of the human programmers whose nonsense I have had to fix.

[0] and "generality", though "AGI when?" is a separate topic
Also, that is assuming that the group willing to pay $60/month includes many who use the service less than average. It's possible that only heavy users would stick around after a 6x price increase.
Given that the entire web typically sees only between 1–3 billion requests per second - any data to back that up?
Entirely up to the company.
What would you change to make it less likely that individual behaviour would impact society in a negative way?

It's easy to point the finger at a cohort and label them, stupid in this case. It is constructive to identify a trend and suggest something to improve the current state.
Intro to Semantic Kernel – Part Three
Seems easy enough to require (i.e. regulate) end-customer ISPs to drop any traffic with a source IP that isn't assigned to the modem it's coming from. This would at least prevent spoofing from e.g. compromised residential IoT devices. Are they not already doing that filtering? Is there any legitimate use-case to allow that kind of traffic?
Impact Market Mini-Grants Results
> If the speed of improvement stays anywhere near the level it was the last two years, then over the next two decades, it will lead to massive changes in how we work and which skills are valuable.

That's a big assumption to make. You can't assume that the rate of improvement will stay the same, especially over a period of 2 decades, which is a very long time. Every advance in technology hits diminishing returns at some point.
Having worked in the GT/GSU center, it's worth noting that that mock scanner (and indeed the MRI itself) are research-only, but yes the attention my forebears put into the experience particularly for children. Back then there were just a handful of us supporting labs from all 3 schools!
Don’t worry, we’ll learn how to
kill the fuck out of robots too…
Seconded. Hashicorp Nomad has been a breath of fresh air for doing HA deployments for my workloads. Getting a small cluster setup to self host Nomad is so easier than Kubernetes and defining workloads is much easier to understand too IMO.

The only negatives about Nomad is the Hashicorp license drama that has happened recently and persistent storage can be a pain in the ass.
Congratulations to you and the Polar Signals team!

Wishing you all the best with your launch and looking forward to seeing this product help countless developers and businesses!
If you need a website version of your book, I would check out Quarto.

It generates ePubs (and other e-formats), a website version, and a PDF.

If you just want a print book, I wouldn't bother with something like this.

https://quarto.org
Hard to move on when other people will kill you for it. Maybe the perpetrators of violence can move on first?
How freemium almost broke our business
Hey HN, Bobby here, ceo of equals (equals.com). In the spirit of being open and sharing learnings with the community, wanted to share one of the riskiest changes I made to our business (almost broke it). There's such a pull in the startup ecosystem to have a free version of your product, to minimize friction in onboarding, to get as many people using your product as possible, and to figure out how to monetize later. I followed that thought process and it almost wrecked our business. Here's a pretty open view into our attempt at freemium, why it didn't work, and what we learned from it. Hope it's helpful and relevant.
It is not an ISPs job to analyze traffic patterns and attempt to stop the bad ones. Thats like saying its the job of the road crews to stop speeders
> The story of Abraham begins in “Ur of the Chaldees.”

You're presuming some historicity there that I don't think is warranted. A lot of the stories in Genesis had their origin in stories from Mesopotamia, and I wouldn't read much more into that than you'd read into the Aenead claiming that the Romans originated in Troy. They're just borrowing legitimacy from an older historical tradition.
In addition to concentrating on the writing, just keep the content simple with minimal markup if possible so that it's easy to rejig later if needs be.

People rag on Amazon, but as a book buyer it's nice to have all your books in one place on a platform that's likely to be around next year, rather than random PDF's that end up who knows where. It's also nice that the book is subjected to reviews. Those can be capricious and unfair at times, but if there are enough, you get a better sense of the book than "Buy it! Trust me!".