skysight-inc/HackerNews huggingface dataset:
You seem to read what you want to read. I was agreeing with you on the benefits of Java/Spring while still disliking it, citing my experience with go and python.

Your only argument is that if this stack makes problems, you just haven't read enough and must be an idiot winging it. The truth is that this whole thing, especially the standard spring stack including hibernate, is just one big footgun. You can't isolate any of these, as this stack intertwines to achieve this level of footgun concentration. Some faults are hibernate, some spring's, some is due to DI, and some are due to java. And I'm fed up with the level of trickery we need to have to work with this without issues. I'd like to focus on the bugs and shitty architecture I introduce instead of others.

> (1) monkeypatching all over the place to achieve the same goals, or else (2) just static hardcoding everything and not writing unit tests with any mocks. I mean, plenty of people utilize one of those approaches. They just usually don't do so while discussing safety and security with a straight face.

These are both stupid things to do in general. If you do proper hexagonal architecture you need neither of these hacks.
Yeah, I know, though for awhile on certain parts of the internet, whenever people asked for the best place to learn OpenGL, you'd inevitably get some comment like "OpenGL is deprecated, learn Vulkan", and I just wanted to strangle them and say "These are different things! It's like telling them to learn machine code instead of C".

My most recent stuff has been playing with FNA, which more or less works across platforms and wasn't even terribly difficult to get working on Mac with F#.

Still, a guy can dream about a world where Metal was the new standard.
> the planes already were in Russia, foreign lenders can't seize them. But fines for non-delivery can still be taken in by seizing assets of the Russian companies in Western countries.

You can do the same thing to compensate the owners of the planes.
I watched the series of this on Netflix! It was definitely a very good watch
Hex 3.0
This doesn't make sense to me. Land values have skyrocketed in the last two years. If prices fall, I don't know, thirty percent, what percentage of owners would be underwater? 10%? 20? That doesn't seem like any sort of feedback loop, it seems like a correction.
Strong disagree.

The barrier you presume is that OpenAPI specs are hard to write. Raw oAPI in yaml is indeed a pain, but there are good DSL's out there.

I personally love Zod->OpenAPI, via https://ts-rest.com which uses https://www.npmjs.com/package/@anatine/zod-openapi. https://github.com/asteasolutions/zod-to-openapi is another alternative for Zod.

> The big bonus of the human documentation approaches today is that time is somewhat combined with building the client.

This is wild to me; human documentation is absurdly error-prone and it's almost always and immediately out of date. (Zod or other DSL) -> OpenAPI -> generated docs (and types! and clients! and mocks!) are always going to be better; always accurate, and faster. The upfront cost is slightly higher, but the ROI is _significant_.

OpenAPI specs lend themselves to excellent docs, ala Mintify or Docusaurus. Even interactive ones, like Swagger UI. The vast majority of API browsers & tooling understands OAPI, so why re-create (an often incomplete) version of the truth when using those tools?

> Whatever is overall fastest and gets me on to the problems I'm really trying to solve.

You may start (slightly) faster, but you'll incur significant cost when you move past the "trivial implementation" stage.

For instance:

- Do you do request & response validation on the server? That'll often need duplication on the client (e.g, error messages, and once out of sync, client-side validation mismatches server-side response)

- Typescript on client & server? Then you're already doing the manual work (often more than once) that oAPI->types would get you for free.

- Implementing client-side XHR calls manually, and getting typing right, is a pretty significant undertaking. Multiply that by the number of client-side stacks the API will be consumed by. Or, just generate them via OAPI (or real-time infer via something like ts-rest)

- TS on client, but another BE stack? OpenAPI, when used right, ensures the "contract" is 1:1. When BE changes, client needs changing -- or it breaks. You want this safety.

- Manually mocking API responses is wasteful; write good oAPI specs and auto-generate mocks (e.g, MSW).

- Do you test the real API implementation? OpenAPI specs can help you do that automatically.

At this stage of my career, I would turn down a job offer from a company/team that wasn't willing to use OpenAPI or equivalent single-source-of-truth (*unless I'm in a truly desperate situation)
As most companies aren't pure tech, usually the core competency isn't the software itself. Sometimes when it is, it's hidden away (for instance, background processing of data) and the best thing you can do is keep as easy to reason about as possible.
'Super-shoes', tumbling world records and the race for a sub two-hour marathon
"Destroyed" is far too strong. Their economy is doing fine all things considered.
`ls` has definitely had changes and fixes in the last 15 years.

The quoting fix I definitely remember. I vaguely recall maybe some sort/time thing? No doubt there is more I don't remember.
> Who is going to be doing the work in 2043?

ChatGPT. It won't matter anyway since we won't be around to worry about this question.
This brand is pretty good for an appropriate dosage: https://www.amazon.com/gp/product/B01HFN5NVU?psc=1
Food for Thought: The Potential Ripple Effect of GLP1s
Thank you! May I keep you in mind once I have something? My email is in my profile, so maybe send me a note. (I don't see yours.)
Only in a VM, I think.

But of course you can use ancient Hackintosh methods to hack SL onto a PC. The snag is that they can only run a handful of specialist browsers, making them very limited.

And of course quite a lot of security holes...
I happily pay it for $10 a month, but I won’t pay $20. My company could pay it for me though.
Why the New York Times is looking to shorten stories
He's not a random dude. He's a renowned and one of our best investigative reporters who has uncovered government wrongdoing. He's got a pretty good record.
They do increasingly have an inherently changeable feature set. That's the point.
I've generally been quite negative on Mac's prospect throughout this thread, but even I would expect a M1 mini to wipe the floor with an 8th gen i5 (or whatever businesses are currently retiring) and RX 6400 for the games that are supported.
This is not margin question. This is question, of extreme energy ineffectiveness of current AI, so even most energy-effective GPUs spent their cost to energy in less than year (if used 100% of time).

FPGAs and ASICs are better on energy effectiveness, for 3-4 times, but cost per installed FLOP also larger for 3-4 times.

And money are expensive now, so we cannot consider, $200B investments will be returned with low rates for example 20 years, now much more real scenario, interests about 20%, so need to have much higher margin, to pay debt within 4-5 years maximum.
I mean yes, much as http1 allows for people to be ddosed.
The real question is, what are they going to do with Xilinx.
The Product Manager's Guide to Managing Technical Debt
What do you propose as an alternative? Something like Micronaut trades more compile time for stricter checks and faster runtime. Do you use something like that?
Quick question regarding the scalability and support of multiple vector databases under a single cloud service. Suppose an enterprise Saas product served multiple customers with each requiring a unique RAG vector knowledge-base for product and company info. Do any of these solutions allow for a large number (dozens or hundreds) of small distinct Knowledge bases? Do any offer easily integrated automated pipelines for documents to be parsed and ingested?
You don't happen to know how someone could get access to some amazing research, do you? They released Autoconnect, and it blew my mind. I needed it just yesterday, but I couldn't find it.
https://la.disneyresearch.com/publication/autoconnect/
Scott alexander made this argument and it was responded to here https://www.econlib.org/why-scott-alexander-is-wrong/
Judge throws out $32.5M Sonos win against Google
"it is very easy use, I wrote it in a week"
Craig, you really made me feel welcome in the Postgres community. Maybe people have. It's such an amazing group. Thanks for all the pg advocacy you've done!
Disagree. Accessing my phone will only get you so far. If you manage to crack my password manager then you'll have many, but not all the keys to my kingdom. For instance, there's a lot of randomly generated passwords in there, but you won't have access to my disk encryption keys for instance. Those are also different by machine.

Security will never be automated to be fool proof; there is a modicum of thought the user needs to put into their security profile.
A lot of people use GraphQL. Like everything else, there's pros and cons. If you've invested highly into a certain tool you're going to see all of the pains.
I've seen Judge Dredd paperbacks in stores, so it's possible. Not all series might have been reprinted at this time, though.
Most likely Google has more than one computer.
Because REST works, and I just wanna get on with solving actual business problems that make money, NOT play around with GraphQL
Perhaps also allergy to assistants?
Define major incident. Defines update.
Oh, they "only" need to get access to the phone which is already logged into a Google account, shows all the emails, personal photos, contacts, messages and everything else? Including personal notes?
Iirc spring was invented as a response to the j2ee madness.
I built that feature for Japanese: https://reader.manabi.io will bring to more languages soon and more platforms beyond iOS/macOS
> He's a renowned and one of our best investigative reporters who has uncovered government wrongdoing. He's got a pretty good record.

From the Vietnam and Iraq wars. He went off the deep end recently [1][2].

[1] https://www.theguardian.com/commentisfree/2014/apr/22/allega...

[2] https://www.snopes.com/news/2023/02/10/hersh-nord-stream-sab...
> If the device is unlocked, you have guaranteed access to pretty much everything that matters.

Some applications support requiring a login with either a dedicated PIN, password or biometrics upon each activity launch (e.g. Telegram, Signal). The only way for an attacker to breach that is to either scrape the phone for credential stuffing or to force me to unlock the app.

Unfortunately, at least for Telegram and Signal neither support a "duress PIN", and iPhones and Android don't as well. Basically, a PIN code that when supplied to any app leads the device to lock itself down completely - force-close all applications immediately, wipe all encryption keys from RAM to prohibit a "freeze" attack, and shut down the device. Ideally it would also distribute a trigger to all other devices and services one owns that these lock themselves down as well, and only let themselves unlock after being supplied with a dedicated password.
WSJ has a new top editor... https://www.nytimes.com/2023/10/05/business/media/emma-tucke...

> At least 15 veteran editors and writers have left the paper in recent months. Long-held stylistic practices, such as the use of courtesy titles in articles, were disposed of overnight.

EDIT: for fun I asked GPT4 for a headline "in the style of the WSJ": "Ireland Capitalizes on U.S. Tech and Pharma Profits, Establishes €100 Billion Rainy-Day Fund Amid Global Tax Shifts"
CUDA and OpenCl are not a graphics APIs, they're designed for computing only.
Funnily enough, you can finally turn off mouse acceleration in macOS Sonoma without jumping through any weird hoops that may or may not work anymore. It's a checkbox in the Mouse preferences pane now.

If Apple really wants games to bother supporting their platform of questionable financial viability, they may need to learn a lesson that other platforms figured out a long time ago: you can pay a developer a bunch of money and they'll make their game run on your system. I know that's a big ask for a small company with $166 billion of cash sitting around, so I don't expect it to happen.

Sad to see Mac development shops bailing on the platform as it finally comes around to having useful GPUs in all of their computers. Blizzard used to have all their games cross platform up until Overwatch and now Diablo 4, but apparently it just wasn't worth doing anymore.

I think it's just been decades of the Mac mostly sucking for gaming, people don't even think about buying games on it. If you want to play games you already own something that's better for that.
Does the Great Pyramid of Cheops consist of 8 sides, not 4?
Or famous philanthropist Monty Burns: https://en.m.wikipedia.org/wiki/Mr._Burns
don't forget "backup codes" - where exactly are you supposed to store them, say, while traveling ???

it would be great if backup codes were NOT usable except under <conditions> and/or use of a backup code permitted access only after <N day delay>.
How much bigger (in lines of code) is Postgres now versus the one from 15 years ago?

Maybe it was more approachable for a 22yo then, you could figure out more of it.

Also, C was a standard language back then, today the kids are more likely to program in Rust than in C.
I remember when this guy[1] launched TranslateAudio a few months ago. For those unfamiliar, it's the first tool that launched the voice translation. It was built by an Indiehacker.

[1] - https://twitter.com/mehulsharmamat

[2] - https://www.translateaudio.com/
I think a big reason for the resistance of acknowledging trauma as injury is, arguably, because culturally so many of us are injured that we behave in a clearly traumatized manner towards actions of healing, ie. rejection/denial/lashing out. If we acknowledged all forms of trauma as trauma we would have a radically different society…

After all, beating children into bruising was normal just a generation ago. In many states it’s still legal to beat your children.
It doesn't look like "Swimming in Money" from inside. The country is wealthy but not extremely wealthy.
The healthcare system is so-so, the public transport is far from perfect as well. Many countries, like Switzerland and Australia have lot better public infrastructure.
This entire conversation is taking place in the context of desktop/laptop PC gaming, where ARM is definitely obscure.
I like to think about it like R&D in a company. You do not spend all of the budget on it but just some part, like 15%. Similarly you try out new things and spend some time on it, like 15%.
No. You can't go and seize a random oligarch's assets to compensate the lenders of airplanes, and Aeroflot takes great care to avoid airspace where Western sanctions could hit them - the exception being Turkey, but they won't do anything that endangers their sort-of "neutrality".
What about silencers/suppressors?

Haven't looked for a while, but it used to be fairly common to be able to find them on both Amazon and eBay, usually listed as "lawnmower mufflers", with pretty un-subtle hints:

"This lawnmower muffler fits a 9mm exhaust and you can bang around your back yard all morning without disturbing your neighbor."
I’m right there with you. The constant attempt to be relevant and jump in on every situation is obnoxious. We can see right through you that you’re trying to manipulate us.
This! If they pown your phone, they've got all your passwords that you've stored on it. Passwords, passkeys, it doesn't matter.

I hate all the resistance to even small improvements over passwords (like passkeys). The only question we should be asking is, "does this improve on passwords?" In this case, yes it does. With passkeys, it's only the person who powns your phone that gets to log into all your accounts. With passwords, it's the person that powns your phone, or gets your password through phishing, or hacks one the the many websites that also has a copy of your password. This is an improvement! Let's do it!
Start earlier/younger. (I'm 33, just started building my own)
Chain-of-Thought → Tree-of-Thought
This seems like just a rant from someone who doesn't provide any grounds, argumentation or information about supposed security flaw. What's the value of posting this?

It's even fundamentally misguided - passkeys behave the same as random passwords stored in a password managers (they're... pretty much the same without the copy/pasting). What's the flaw here?
Spoilers! Also, they had very complex “ensemble behavior” that resisted analysis. I once wrote some code that I was almost not clever enough to debug, so I can believe it.
Devopsprojects – a job board for DevOps jobs
Fundamentally, I think the real trouble with the Monty Hall problem is that the assumptions of the game are not clearly stated. Because of this, people come up with different models.
Find cool devops, sre, infrastructure, cloud engineering or platform engineering jobs.
Having my phone shouldn’t be game over. This mindset can be pushed too far.

In general "game over devices" tend to be a bad idea. I’ve seen people type in their passcodes. People may have seen me type in mine when FaceID gives me trouble on my iPad. I’m not at all comfortable with the idea that someone jacking my iPad will have root access to my life.
Sending and Filtering Logs with OpenTelemetry
Same thing in finnish, but a bit less worse. Starts almost sounding like a poorly translated scam email with some europatriotism mixed in.
Maybe they could have used more marketable terms like "1-time password", or "barely a password", or "mini-password" (to denote minimal expected usage of your password), etc.?
In fairness to Vinge, that wasn’t a direct quote :)
I think any further back would be unsubstantiated.
It's due to the higher interest rates

A higher risk-free rate of return from e.g. Government bonds entails higher 'required rate of return' for all other investments in the economy

Suddenly, all companies need to increase their profits by 3-5 percentage points, while their costs are increasing across the board. So they need to increase sales (hard/expensive), reduce costs (might not be possible), or raise prices ('easy' to do, but customers might not accept it)
The whole point of a 'D'DoS is that there are numerous compromised IP addresses, which only need to make maybe one connection each.

You can't simply blacklist weird connections entirely, since legitimate clients can use those features.
What happens when all your services won't fit on a single box, or you need X more of a specific service?
> This is total nonsense.

Of course it is. Hirsch is a well-known Kremlin puppet.
I can no longer edit the previous message, but I must mention that, as pointed by another poster, some time during the last couple of months AMD has changed the specifications of all their mobile Ryzen CPUs.

While during at least one year and a half all the laptop CPU specifications for Ryzen 6000 and Ryzen 7000 specifications have included a clear statement that ECC is supported, in the very recent past this statement has been removed from all AMD mobile CPU (non-PRO) specifications, for unknown reasons.
How popular is German?

It's quite difficult to get attention just off flashcards. Anecdotally my flashcard app gets 1/10 the traffic/interest of my "learn by reading native texts" app which integrates with the flashcard app but also lets people use their preference; a lot of people like to avoid using more than one flashcard app and might already have settled on one, but may be open to other learning techniques besides flashcards or that can extend their existing flashcards system/data

It's also hard to charge money just for flashcards when there are so many free options and the paid options can be pretty good already
No, the article is arguing that nobody knows for sure what the reason is. What was suggested could very well still be the reason, just nobody knows "for sure".
> Some applications support requiring a login with either a dedicated PIN, password or biometrics upon each activity launch (e.g. Telegram, Signal). The only way for an attacker to breach that is to either scrape the phone for credential stuffing or to force me to unlock the app.

And this is how applications storing passkeys behave (e.g. 1Password). Where's the security issue here?
The biggest hurdle I see is that it is a C project, unfortunately something we can do nothing about. It is so much harder to trust a random code not have to have serious implications for the database. It will take ages for someone to get comfortable with the pg-code-base way of handling errors, basic string manipulation, memory alloc/free etc.

I want to highlight the difference in "making a non-core contribution" to "understanding database internals". I am highlighting it is not the latter, but the former that is the first hurdle.

I wanted to reuse builtin pg code to parse the printed statements from logs - I ended up writing a parser (in a non-C language) myself which was faster.
I am not sure this is true or not, but I feel the companies are moving away from web services toward smartphone apps, in the name of security. It's not going to be good for consumers, because these are closed ecosystems.
Anticipatory Thinking – Open Access
Special issue
A virus checker is incredibly unlikely to flag a commercial game, even if the game does in fact contain malware. Virus companies whitelist binaries from commercial entities every day.
This system is problematic in high inequality societies. A rich person may decide to kick you out of your home if they're feeling petty. Many people do not want to move, forcing them to sell against their will is incredibly politically unpopular.
Hersh's narrative has been thoroughly debunked:

https://oalexanderdk.substack.com/p/blowing-holes-in-seymour...

Russia benefits from infighting among the allies of Ukraine. That gives them a pretty big incentive.
> maybe we could instead just announce another serious arms package for Ukraine instead?!

I've never met a real human with this take.

And I have friends on both sides of the aisle, sat staunchly in their respective parties.
Once you have a vetted corpus large enough to train an LLM on, I don't think there's any need to generate even more text with the LLM, since you can use the corpus directly.
Neovim and Extensibility: Talk from Jane Street [video]
whats wrong with passwords?
> can't go and seize a random oligarch's assets to compensate the lenders of airplanes

You said "assets of the Russian companies." I'd curtail that to assets of the Russian state. Aeroflot is state owned. (It's why Aeroflot settled [1].)

[1] https://www.reuters.com/business/aerospace-defense/aircraft-...
> And this is how applications storing passkeys behave (e.g. 1Password). Where's the security issue here?

Most apps don't, an attacker can do a lot of damage as long as they manage to keep the phone from activating screen lock.
For the non-US and uninitiated, are these at fault for these coal burner people?
And yet almost everybody has one, whereas almost nobody has a yubikey.
As far as I understand, this is not a viable mechanism.

Consider a shared computer in a university laboratory or at a public library. Or maybe an iPad that is shared by a family.

As a service provider, you usually can not assume that someone using your service will log in with a dedicated device or with a device that has their primary google or apple accounts setup on it. (Some rare exceptions might exist).

I don’t think anyone wants to deal with customer support problems of “oh, I’m stuck in a different country when on a holiday and my phone got stolen, can you please recreate this key exchange process for me on this untrusted device logged in from public wifi at a coffee shop?”

Like with ssh certificates, you create more problems than you solve if you use passkeys as the primary authentication mechanism.

To answer your question, yes it would be primary authentication if you used it that way. But no sane person would. Hopefully.