skysight-inc/HackerNews huggingface dataset:
I wrote an extension that did something similar for Twitter, back when Twitter had "So-and-so liked this" tweet, which was inevitably something awful. It's archived now, because it's no longer relevant. But you might find something useful in the code.

I tried polling, but it was against the Chrome extension guidelines at the time, so I used a "mutationObserver" on page load and then a "scrollListener". I don't remember if I ever tried an "intersectionObserver" but that might be worth looking at.

https://github.com/rendall/twitter-like-hider/blob/master/co...
Interesting. I don't work on VTE but just landed dozens of patches with no issue at all from pleasant maintainers.
That's damn tall bar. If it were that polished they wouldn't need the money!
> A good bit of today's fraud is conducted on cloudflare

How are people using Cloudflare for fraud / how does Cloudflare enable fraud? Genuine question :)
I checked again and it's still full of adult entertainment with sexual images. During signup you agree that you're 18 years old. I don't believe this is HN ontopic material.
Toxic masculinity at play.
I hope you don't actually believe that providing health care is exorbitantly expensive. Providing health care is absolutely not exorbitantly expensive. It just isn't. Paying the prices that our hospitals, insurance companies, and drug companies charge is exorbitantly expensive.
Is there a DUO on prem? Or are there five solutions I need to deploy and master to get most of their features kinda-sorta for my domain?
There is no bit of information on the planet that is corroborated by all relevant sources. There will always be some percentage of people critical of the prevailing theory, and if you want to go for 100% consensus for every article then there would be no Wikipedia.
The most wanted man in history, Waldo has gone into hiding again
OpenMP and GCD solve different problems. You'd not want to use GCD to parallelize the same tasks you're parallelizing with OpenMP in most cases. GCD is more suited for the one-off cases (toss this task into the queue, toss that task into the queue; or "as we get new items from the user toss the processing into the queue" but we don't know the rate of new items coming in so batching doesn't make as much sense), vice OpenMP which is targeting things like scientific computing/simulations where you know you have a million objects you want to perform a computation on. The GCD version of the same would be slower by a large measure if you spawned a task per work item or you'd recreate parts of OpenMP to divide the work across a smaller number of tasks. And you wouldn't want to use OpenMP for parallelizing the kind of things you toss into a work queue model like GCD offers.
You can still share most of the memory if you load everything before the fork so why is having multiple processes a problem?
Suppose I better start learning about Azure.
LOL, almost all of China's oil supply runs through the Straits of Malacca which the US Navy could blockade with a carrier fleet and a few submarines. Why do you think they've been so heavily focussed on building relationships (and pipelines) with Kyrgyzstan, Turkmenistan and Russia and building up their deep water navy in the South China Sea?
I find I can't really tell the difference beyond ~90fps outside of artificial tests (like moving a hard edge and "counting" the edges visible, you can normally do this with a mouse cursor) in non-interactive content.

But beyond that the latency improvement is still noticeable - most games still tend to handle input and game update in terms of frames - so if you have 3-4 frames of input->visible result latency that's 30-40ms at 100fps, but 15-20ms at 200, and you can tell the difference in some situations. This is very dependent on the style of game though - many have sluggish movement and slow direction changes as part of the design, so is less noticeable than some super slide-y shooter like Doom.

But much of that is solvable by the app outside of higher FPS, with GPU submission timing and delaying input processing you can get pretty much the same latency at any FPS, just many games don't do that (yet?)
> Communism involves a class-less society

People keep saying that, but every society that's ever been called "communist" has had classes. I suppose, then, that the distinction between corporatocracy and communism is that the former is more honest?
vsync off has better latency than gsync

https://blurbusters.com/gsync/gsync101-input-lag-tests-and-s...
> Publicly chastising another company you do business with? Unnecessary.

I think this makes more sense for strategic business partners. In the Cloudflare-Okta case I'd wager that their relationship is fairly transactional.
It's really not that bold. Ask anyone who works for a CA, or an ISP, or a registrar, or a mail hoster, or a browser manufacturer, or DNS provider... If you just read up on how PKI works, on how certificates get issued, how the network protocols work, etc, it's all just right there. The holes are very well known and understood and not fixed because they're in the design. Every so often somebody comes up with another mitigation, which of course you have to opt into, and still doesn't solve all the holes.

It's like SS7, or SWIFT. It's not bold to claim that all public phone networks and bank transfers are insecure, it's just a fact. People who know what they are know they're vulnerable.

As an aside to the design issues, social engineering any of the thousands of organizations involved with issuing certs (not just CAs) is trivial. A bored teenager could get certs issued for most domains by using nothing more than a telephone or e-mail. But that's cheating, so I don't count it.
They point out that "CT is optional", but isn't that ultimately a decision by the XMPP clients? What stops them from requiring CT now that browsers effectively do? What trust store would they be relying on that issues certificates that don't work in the browser?
This twitter account tracks updates to Python Enhancement Proposals (PEPs)
links to somewhere:

Hummingbird Moths https://www.hummingbirdsplus.org/hummingbird-moth-facts/

Why Hummingbirds Are Evil Procrastination, Laziness and Play https://sonnet.io/posts/hummingbirds

Humming birds suffer if they move uphill to escape the warming climate https://news.ucr.edu/articles/2021/09/06/hummingbirds-can-sm...

Hummingbirds see colors we can’t even imagine https://www.nationalgeographic.com/animals/article/hummingbi...

Ecuadorian hummingbirds chirp ultrasonic songs of seduction https://phys.org/news/2020-07-ecuadorian-hummingbirds-chirp-...

Hummingbirds Can See Colors We Can’t Even Imagine https://www.wired.com/story/hummingbirds-can-see-colors-we-c...
secure boot + virtualized memory encryption is supposed to prevent that, you'll have to trust intel/amd though.
I found Netflix to be getting worse and worse till I finally cancelled 1-2 years ago. The interface was doing weird stuff, more and more autoplay, weird suggestions, search results turning to shit.

They were working towards being as bad as prime, but prime was "free" if you subscribed to at least one twitch channel, and Netflix kept raising prices.
> VTE based terminals, Kitty and WezTerm are some of the few terminals that accept C1 controls by default, within UTF-8 encoded data. My recommendation would be to not use these terminals with untrusted data.

It seems the author didn't look at the code because in VTE, bytes enter UTF-8 decoder first and therefore the parser is already dealing with 32-bit unichars.
Creating contrast between the ugly real world, with all its pain, suffering and grotesque details, and the spiritual world of gods where everybody is rewarded with an inner glow in their perfect skins. An universally employed narrative
Wow, strange stuff, indeed.
Should all gov websites move to the recreation.gov model where the contractor is incentivized disproportionately on a percentage basis ? It seems that customers get shafted no matter what; the latter at least creates a better product.
I think it depends on the definition of “exorbitantly”. US healthcare costs are absolutely extreme but even European countries with universal healthcare still struggle with healthcare expenditure.

> The report shows that global spending on health continually rose between 2000 and 2018 and reached US$ 8.3 trillion or 10% of global GDP

https://www.who.int/publications-detail-redirect/97892400177...
Corrected the comment to reflect that SSL cert infrastructure is ridiculously easy to hack.
That sounds like it could be my next favorite book, or I'll drop it out of cringe, depending entirely on the style.
We are in strong agreement, and the phrasing and measure of your post made it pretty obvious you are knowledgeable (another inverse correlation: absolute opinions launched with violence also seemed to be the realm of newbies; and yours was eminently not).

> I very rarely used hints in my more database'y days

evidence thereof!

> I'm not sure where you got the notion that hints were something noobs would be working with? At least, that certainly wasn't my experience.

It's been very, very much my experience. I worked in one place where nolock hints were applied everywhere, without them realising that READ UNCOMMITTED trans iso even existed, so had to show them that, and show them it could be specified at the application layer (not in the SQL). In another recent case I came across their use and I'm damn sure the person who used it didn't actually know what it did. Yeah, I've seen far too much hinting in my career.
Posted this on Reddit:

This is a legit problem. They pose as American citizens or permanent residents. Sometimes even using a VPN into the US. HR folks would not catch on.

I’ve actually interviewed two of these people over the years. They somehow got through the initial screenings.

It’s a bizarre experience. Most of the time there is a significant delay with silence between your question and their answer. It’s as if they’re being fed the perfect answer. Problem is they could never answer or pretended to not understand any follow-up questions.

You could always hear others in the background. One time I was given an answer that I had heard someone else in the room give just 2 minutes before.

The question that really solidified my hunch was about their location. The applicants would always claim to be from a very small town. In my two experiences I happened to know a lot about those towns. The first said they “really enjoyed the mountains” when I asked what brought them to a Houston suburb. When I asked the other applicant if they had any damage from the hurricane that went through St. Augustine, FL, they replied “What hurricane?”

Now, neither of these people would have been hired even if they had stellar interviews as we do make use of background checks and verification services. This scheme really only works for third-party dev shops or desperate small companies.

I’m glad this problem is getting more attention.
Your example is a consultancy. Not really a good example. Most likely they are already skirting the law in the first place.

Gross margin is a bad metrics. It doesn't cover overhead costs or R&D. Take for example J&J whose net profit margin is 13% while Apple is 24%. Or abbvie is also 13% vs Msft 34%.

Also why did you not put in the net income for those big 3 tech companies in the bottom?
It didn't find mine using YYYYMMDD format.
we’ll explore six common budget mistakes you can’t afford to make and how to avoid them.
> the 15sec difference is due to the physique of runners optimized for different distances.

I think the 15sec difference is due to the fact that no person can run at 86-second 800 pace for 86 seconds.
Let's say you are blue-pilled and what you see as your eth0 interface is actually a virtual interface controlled by the rootkit.

In that case, where the redirection happened is no longer something you would be able to tell, right?
It's now called Entra ID btw.
Honestly, really good idea for work machines. I need to go to YT sometimes but I'd be lying if I said those feeds don't get me to click.
Many terminal emulators do do this.
not at all, since there were no Internet-visible routing changes.

atlas would be good for detecting the time Pakistan announced 0/0 or whatever.
A couple of points.

First, Okta should get credit for publicly acknowledging the compromise.

Second, expecting any company or organization to never get hacked is unrealistic. Organizations which are transparent and acknowledge their security breaches should get credit for it. Organizations which cover things up should be avoided.

Third, no one knows how to build secure software or services. The closest anyone has gotten is Open BSD but it can still be hacked once you install software on it.

Forth, the number of publicly acknowledged breaches does not tell us anything about Okta’s security. Here is why:

- We do not know how many breaches each authentication provider has had

- We do not know how many breaches were never detected by the authentication provider

- We do not know why the breaches occurred. Breach causes can range from gross incompetence to “WOW, that attacker was really clever and found a new class of security bugs”.

- We do not know how Okta responded to the breach. We also don’t know how its competitors respond to their breaches.

My main point is security is hard and measuring security is also hard. We cannot use simple metrics to determine if an organization is a good organization or a bad one.
YouTube has a setting to turn this off already.
The organization conducting the MitM likely has physical access to the machine already. The original post indicates the link on the network interface went down for 19 seconds, indicating a device was placed in front of the server.
(Author of the original paper here.)

Bracketed paste mode is good and ideally it just works(tm) and therefore people don't need to know about it. It does just work in recent versions bash (readline) and Zsh.

Unfortunately there is still poor handling of it in some terminals. I posted[1] yesterday on oss-security that ^C for example can be placed on the clipboard and may end bracketed paste mode in some circumstances.

For xterm that can be mitigated by adding "ETX" to disallowedPasteControls[2]:

disallowedPasteControls: BS,DEL,ENQ,EOT,ETX,ESC,NUL

That still isn't enough (e.g. ^\ or ^Z can be used too in some contexts). Other terminals are looking at this currently (e.g. kitty[3]). I suspect there will be some other patches coming out.

[1]: https://www.openwall.com/lists/oss-security/2023/10/20/2
[2]: https://www.openwall.com/lists/oss-security/2023/10/20/4
[3]: https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd13...
DataFrames are just SQL. There will be no performance difference.

RDDs will be worse, so it shouldn't matter. No vectorization, no column processing, lots of serialization and de-serialization. They're basically always slower than DataFrames barring some strange use case.
> It's basically "Schroedinger's strings", you don't need to know if some data is valid string data until you actually need it as a string, and often this isn't needed at all

Then you can pass around an untyped value, which is the default in all versions of Python. With type annotations, one can spell this typing.Any.

When you finally do need your value to be a string, you need to decide whether it’s a runtime error when it needs to be a string or whether it’s a runtime error way up the call stack. Especially if databases are involved (or network calls, etc), this decision matters.

> e.g. the standard string type should always only be UTF-8

It almost kind of sounds like you’re arguing in favor of Python 3’s design, where str is indistinguishable from UTF-8 except insofar as you need to actually ask for bytes (e.g. call encode()) to get the UTF-8 bytes.

> Also, file operations should always work on bytestreams

So how do you read a line from a text file?

> (same in the IO functions of the C stdlib btw).

Are we talking about the same C? The language where calling gets() at all is a severe security bug, where fgets returns int, and where fgetwc exists?
Sure sure, if you don't care about tearing or you're rendering at an absurd framerate. In real world situations where your framerates are not 2x your monitor's refresh rate and you care about tearing g-sync is very helpful.
Reasonably sure, yeah. Not only am I somewhat sure that you can indeed always tell by the packaging (at least here in Germany), I also check the list of companies every 6 to 12 months.

And yeah, the most boycotted company (assuming it is true) means there is barely any effect. People don't boycott, many people don't even care enough to talk, far fewer want to walk.
The EFF followed a Baltimore case of government surveillance by airplane conducted in 2020 [1] and ruled on by the Fourth Circuit Court of Appeals in 2021 [2]. According to the Fourth Circuit, the information that plane surveillance can gather about individuals is, with respect to privacy, comparable to cell site location information (CLSI), at issue in Carpenter v. United States (2018) [3]. Helicopters offer at least the surveillance capabilities that planes do.

[1] https://www.eff.org/deeplinks/2021/03/officials-baltimore-an...

[2] https://www.eff.org/deeplinks/2021/07/victory-fourth-circuit...

[3] https://en.wikipedia.org/wiki/Carpenter_v._United_States
Yes, that would make some sense at least. Otherwise he shouldn't be there. I've seen people that actually were that naive in politics. It didn't end well.
Those are some very optimistic hopes!
What football will look like in the future (keep scrolling)
But isn’t it a quick way to determine their fitness to not do the job you hire for?
EU has started a general fight with all tech. US and European alike. Most countries would generally avoid that, in order to not kill its own tech sector. EU on the other hand seems to have no such qualms. But sure, the EU commission has gotten quite a lot of money out of fighting privacy intrusion by big US tech, but as is apparent from the suggested proposal, clearly not for the benefit of the EU citizens.

On the other hand it's clear that many large US and European corporations has a huge amount of influence in specific legislation being passed. Forbidding certain types of goods (like e.g. incandescent light bulbs and plastic straws and much, much more) and forcing the use of certain alternatives. This type of random acts of lobby legislation is seen a lot less often in national legislation around the world.
Not surprised in the least about Element unfortunately, it really screamed for a rewrite (one of the biggest problems was the horrible choice of database, which unfortunately was very hard to replace)
I never played Alone in the Dark, but I loved Twinsen’s Little Big Adventure.
120.6 MiB for a entire Elisp development environment that casually happens to have a text editor built-in is pretty small to me.

For a alternative development environment example, the The Glasgow Haskell Compiler is 191.4 MiB by itself and it doesn't have a text editor.

For example Visual Studio Code is 89.6 MiB, but then you have electron25 as a dependency and that is 212.7 MiB extra.

As a somewhat larger example JetBrains bundle it's own customized Jetbrains Runtime JRE with it's 3.5 GiB IDEA IDE.

It's for sure no vim-minimal, but it's pretty lightweight as far as "IDEs" go.
Wow

First, CloudFlare is not responsible for people misusing its service. It is not feasible for ANY cloud provider (or company) to determine which customers are legitimate and which are crooks.

Second, reports of fraud do not mean there is any fraud going on. Remember, not every report is legitimate or correct. Lots of people file false reports because they dislike a person or group (sad but true).
> This shows that Let's Encrypt security is a joke because now any large national ISP can use same MiTM to issue a certificate for any site hosted within a country. The SSL infrastructure is completely compromised.

the information available right now are too vague to come to a conclusion this bold.

Instead, I find it something like the following more plausible:

jabber.ru and xmpp.ru seem to use "exotic" DNS servers (at least as I checked right now).

https://uk.godaddy.com/whois/results.aspx?itc=dlp_domain_who...

All it then takes is an exploit there in the DNS server, or a badly set-up ACME DNS-01 there, in order for Let's Encrypt to grant an SSL certificate.

https://letsencrypt.org/docs/challenge-types/#dns-01-challen...

The moment you're able to write a (TXT) record for some domain name, you have proven to be eligible for getting an SSL certificate for that domain name.
the artist might have been working with a male model
> How would you do certificate pinning if you don't control the clients?

Well you cannot. If you were paranoid, you would perhaps supply a hash through some out-of-band mechanism, which would require manually updating for each new cert.

Obviously most people wouldn't ever want to do that.
Great callout:

> Don't use Cloudflare or similar services. See my article here for an explanation on why. If you use a service like this, you're basically already MitMing yourself.

I wish more people would realize that when arguing on the internet about CAA, DNSSEC, NSA, etc. that none of it really matters. We willingly allow a government aligned entity to unwrap 20% of all TLS connections on the internet and peak inside.
no, they are actual locations.
The Holmdel Horn, a cosmic shrine in New Jersey, stays put
I am not sure I would call CloudFlare a “winner” in this case. They did not win anything by getting hacked.
Zig is now also a Windows resource compiler
Right, they could do this and this seems like a good idea to me. The problem this require-CT behaviour isn't switched on by default for basically any TLS library, so an XMPP client developer would have to go out of their way to switch this on, and I assume most or all (currently) don't. That can change of course.
In my experience, there are way too many ideas and no where near enough time.
The shortest papers ever published (2016)
>Is there a term for people who aren’t especially sensitive to refresh rates?

Normal people.

>I feel like I’m a freak or something for not being able to instantly perceive high refresh rates.

I feel like I am the freak when I am the only one who constantly wants to push for higher refresh rate and lower latency. I mean the latency of 240Hz display is 4.2ms alone. So in the worst case scenario that could be up to 8ms delay between frame and input assuming zero latency in the system which we know will never be the case.

I think most people would perceive it if you use an Apple Pencil on iPad. The difference between old iPad and newer iPad. Just that most dont care enough about it.
Sorry if this is self-explanatory to most, but what does `BYO(OAAK)` mean? Thanks!
You made me look. Older HP z220. Four SATA at 3Gbs and two at 6Gbs.
December of '41. Two and a half years. All of '42, all of '43, not quite half of '44.
> Saying “responsibility will be with whoever hooked it up…” cashes out to “everybody is responsible”.

Not unless you think everybody is involved with hooking up every single instance of an AI.

> Why would a system simulating HAL honor your shutdown request?

How would it be able to stop me from cutting off its power? Remember in this scenario I'm not some random user, I'm the person who set up the thing.

If your argument is that some humans will be stupid enough to not set up such things in a way that can be shut down, well, that's an argument for not letting stupid humans play around with dangerous toys. Which would mean that open sourcing AI code is tantamount to spewing toxic waste randomly out into the world, and should be stopped immediately. Is that your position?
Astronauts and Area 51: the Skylab Incident (2006)
Unless it's copyrighted/trademarked, in which case you have legal ground to stand on (assuming both are proprietary services, which may not apply here).