skysight-inc/HackerNews huggingface dataset:
This is more OAuth's mistake than Grammarly's.

OAuth is frankly one of the very worst specs that I've tried to learn. Not just in the conceptual flaw of having so many types of flows (each with their own caveats), but in the opacity of the documentation (why use words like resource-owner/client/resource-server/authorization-server when user/browser/server/third-party would be more precise and reduce the learning curve), the reliance on the user to learn nearly the entirety of the spec just to use it properly (the main red flag of any framework or standard), and the way it ignores how it might be compromised in the implicit flow or via untrusted Javascript running in <script> tags (in fairness that makes most SPA grants security theater). All of this to replace the easily understandable concept of, say, a browser's session cookie.

I feel that there's too much wrong with OAuth to be fixed, that any new spec derived from it will also be terrible, and that any design-by-committee substitute will be just as bad. Leaving me no choice but to give OAuth a vote of no confidence.

Kind of ok but still terrible documentation:

https://www.digitalocean.com/community/tutorials/an-introduc...

You call this documentation?

https://auth0.com/docs/get-started/authentication-and-author...

A good replacement would handle all use cases without leaking any details about the implementation. Loosely that would look like the standard way of obtaining a security key and/or secret from the third party social provider and storing it in the backend server to access user details, filtered by whatever details the user chooses to share from the third party. If an SPA wants to be serverless, then a similar process must happen within, say, a P2P virtual server running a consensus algorithm like Raft or maybe borrowing blockchain concepts. IMHO this last part is still an open problem involving circles of trust, and is what has put this complexity on the shoulders of developers since roughly the mobile/social revolution that happened around 2007. All serverless stuff is either pretend (AWS Lambda) or a pipe dream without real P2P.

I also feel comfortable blaming OAuth for any factual mistakes I just made writing this.
A curious assertion? I don't know that many pilots anymore, but I don't recall that being an anti car crowd. They were usually mechanical enthusiast of all types.
I’m sure even if they break even it’s worth it because it keeps the ad inventory rolling and performing which means less for other competitors
Not sure if it's what you're asking for, but in lean, you can put `sorry` to skip a proof. It's `believe_me` in Idris2, and I think the Agda version is `trustMe`.

You can also use stuff like ! when you don't want to prove your array indices (it might crash or substitute a dummy value if you're wrong).
If you use Hydrogen Peroxide, it will often also take some pigment with it from the clothing if that’s what your are getting the blood out from. So be careful not to inadvertently bleach something.
This doesn't seem to add much over the finder's blog post "Oh-Auth – Abusing OAuth to take over millions of accounts" (222 points, 110 comments, 3 days ago)[0] and the HN discussion (referenced in article), other than "use our software". As Salt Labs reasonably said "It's important to recognize that security vulnerabilities can arise (...) It’s the response that matters".

[0]: https://news.ycombinator.com/item?id=38009291
I appreciate the double pedantry.

I should've known intuitively that a turboprop isn't a jet engine because the thrust comes from the prop not the exhaust.
Or, if you prefer to write with sweaty palms and the gun of permanent literary destruction against your head, there’s the Most Dangerous Writing App of course.
https://maebert.github.io/themostdangerouswritingapp
I remember a science radio program from years ago (might have been https://www.cbc.ca/radio/quirks) summing up an explanation of how soap works with the summary: "Soap makes water wetter."

It's obviously an over-simplification for the purposes of education, but it works, as it has stuck with me.
If you love your wife, show her this article. I have no remaining commentary on the matter otherwise
I don't understand why more device don't have ambient light sensors built into them. Phones have been doing this amazingly for 15+ years but almost no displays do.

I think I saw a TV a while back that did, but that's 1 out of the 10 billion models out there.
Kubernetes and Kernel Panics
> Not a solid guarantee

How so? Are you saying that sqlite would ignore the connection string?
Speaking in Tongues: On Don DeLillo
There's two ways to look at this problem.

One is that you're sacrificing something when you're not your authentic self.

The other is that communication is a two-way street, and people who invest the resources in finding their audience closer to where they are are making their audiences' lives easier, and the attention economy rewards them for that.

I note that most of the YouTube science educators I watch wear makeup, for example (unless they don't show their face at all). And they space their updates to make for a regular-ish pulse of content.
Sometimes it's OK to reconsider.

Those 15 years of architectural norms started at a time where a multi-core 2GB server was an expensive luxury!

We know a LOT more today about building web applications than we did 15 years ago. That's why some of us are ready to say that for a lot of applications, a single server running SQLite (with streaming backups to S3 via Litestream) is actually a pretty great option.
Yeah, of all the appliances in my own home, the microwave is the one I never complain about. I press the +30s button a few times, and the food is hot after a minute or two.

Yes, there are ten other buttons I never use. Yes, they could conceivably be “better” in small ways. Yes, modern ones can break like every other appliance does, but the ones from the 80s and 90s broke, too.
Fair! :)

But interesting nevertheless.
Ashby's book "Introduction to Cybernetics" (2003)
Because we live in the real world and no system is truly in a bubble if it's connected to a network. But mostly because seeing oom-killer messages in dmesg makes me sad :).
This is a massive issue with newer builds. They often look sleek and impressive, which is what moves units, but they completely cheap out on soundproofing and insulation.

I think there's going to be greater awareness about noise pollution in the coming decade or so (it's hugely detrimental to human health), and it's worth paying attention to if you're looking to buy a place.
The key point is that most software don't need correctness to the level formal verification provides. There's a subset of software however, for which there's no substitute for a formal verification process.
Did you think people wanted to bulldoze suburbs and not replace them with anything? What did you think was meant by dismantle? I always assumed it meant dismantling the rules that prevent the very natural market-driven densification process.

Suburbs as they exist in the US do not exist because they are the best X for any X that exists; but because of top-down central planning. Remove those rules, and the apartments all but build themselves.
Can you provide some back up on that? I can't seem to find anything.
It's encrypted directly on your browser, you can download the encryption key after file is uploaded. Not content-based (because the header is randomly generated & you keep the encryption key) but you can share to secret file to others and they will be able to download the file.

Files are pinned mainly by NFTStorage.

Currently it's free because NFTStorage is free. If things change I would allow buying storage using Filecoin (~$0.2/TB/month).
They haven’t figured out how to monetize bard yet without pommeling their original search, so they are in a tight bind
Yes. If a pharmaceutical company's article (with better expertise in this area than the average HNer) isn't enough to convince someone here's an article from UNESCO:

https://www.unesco.org/en/articles/how-soap-kills-covid-19-h...
You could use that same logic to justify a $30 power cable, though.
As with all things, it's a tradeoff. HBM on servers is similar to Apple's choice, and Xeon, EPYC, Nvidia H100, and some other designs incorporate it. There are good things (performance) and bad things (price/non-upgradeability) about it. Best of both worlds would he chip on module plus expansion slots, so the fast RAM is like L4 cache.
I'm unclear of who will own it, considering that it's mostly being funded by the Aus govt
Libc is really a conflation of at least three different notional libraries. The first library is what its name suggests it is, a standard library for C. Another part of the library is in providing the userspace portion of system services--things like handling static initializers, dynamic loading, or the userspace side of things like creating new threads (not to mention, the actual raw functions you call to get the kernel to do something). The final part of the library is a collection of userspace services which are language agnostic, you might choose different implementations, but you'll always assume are somehow present--libm and malloc are the goto examples here.

As for why the userspace system service library is part of libc instead of being a separate libsyscall or libkernel, that probably is due to Unix being a C operating system--written at a time when most operating systems also came with their own system language. It's definitely not the case for all OS's that the C runtime library is the same as the libsyscall/libkernel--most notably, on Windows, the former is MSVCRT*.dll and the latter is kernel32.dll (or ntdll.dll if you're looking very specifically at syscalls themselves, but ntdll.dll is largely an unstable interface).
Some people get eyestrain from regular monitors, https://ledstrain.org/
I think the argument is that it's exactly the same, so why learn both? I've definitely lost seconds (maybe even minutes) to refactoring if statements into case statements and vice versa in Haskell.
It's too bad Crypto isn't blockchain-based. It would have scaled up much more slowly to fewer people.
I commute into Manhattan daily via public transit.

However when I go into Manhattan for non work related activities, my wife and I (and nearly all my friends) always drive.

The NYC transit situation is decent and tolerable, but still very unpleasant. If I want to enjoy a night in the city, the last thing I want to do is deal with the transit system.

Dealing with mild to moderate traffic within the confines of my (admittedly pretty nice) car is not very painful at all.

We look at the traffic situation before going in. If it's terrible, we just cancel our plans in Manhattan and do something else.
As a US citizen, I will be as derogatory to the US government as I wish. And I expect the same right for any citizen of the world, and any would-be citizen of the US. Why else would they be applying for US citizenship if not to secure the right to free speech?
If they know you used this to generate it, yes.

Also, the default of only 20 bits of entropy is not nearly enough, IMO. That's only ~1M options. If you're using this to generate a password that foolishly gets hashed using something like SHA-256, even a mobile phone from 15 years ago could have it cracked in seconds. A modern CPU would crack it before your finger even let go of the Enter key.

Again though, the information above does require that the attacker knows you used this to generate your password. Without that knowledge, the 20+ character passwords it generates are quite secure, especially if you modify them.
I shudder to think of what happens to Mozilla and Firefox if Google is banned from doing this.
"When people come across the border, we have 108,000 cities and villages — we should spread them out across the entire country, and not just New York, Chicago, Chicago..."

Is there another Chicago I missed?
Simple fix at personal level: bike, local & mostly vegetal diet, simple life style, 5% of the average footprint, heath benefits, financial benefits & environmental benefits
Heads up that the link you sent seems to only work if you're already signed into Kagi.
>Also, "illegal alien" is an outdated term because implies an individual's entire existence as "illegal," which is dehumanizing.

The phrase "illegal alien" appears in federal law. <https://www.law.cornell.edu/uscode/text/8/1365>
Then another trick will be surviving the attempts of stores and food manufactures to screw with this system as it becomes popular, because individuals empowered to make good choices for themselves hurt everyone's bottom line.
You really think that, in this case specifically, knowing the prosecution's case would make a difference?
Just bit the bullet and paid for a kagi account 2 days ago. It is nice to have a simple, easily configured, non seo-borked, search engine again. I do worry if it becomes popular seo will start to target it. But at least my incentives align with kagi regarding seo, since I'm paying them rather than the advertisers.
It’s literally a textfield with a fade-off effect on top.

But your take is also correct in most cases, I just felt that this one hits a particularly strange balance here.
You'd maybe end up with a system where one member of the upper house was preventing any senior military appointments - https://www.defenseone.com/policy/2023/08/army-now-2nd-servi...
Land Value Tax should help reflect the opportunity cost for the community as well as the benefit to cashing out of a property.
You misunderstand what a language model is. What a human can or cannot do is frankly irrelevant.

A GPT (Generative pretrained Transformer) is not a simulator nor an imitator. It is a predictor.

Predictors try to reverse engineer the computation that could have led to a certain output so they don't just grok what is explicitly stated in a dataset but also what is implied by its structure.

As an example, In a language model trained on protein sequences alone and nothing else, you will find biological structure and function emerge in the inner layers.

https://www.pnas.org/doi/full/10.1073/pnas.2016239118

In fact, with a capable enough architecture and sufficient data (quantity, qualit, variance), there is nothing a predictor couldn't divine with enough training.

You assert

>Actually generating a recipe is obviously much harder, and should be effectively impossible unless you include a humanoid robot that can cook and taste.

In the pursuit of recipe prediction, a predictor will learn to internally model taste because taste is implicit in the data.

You don't need the hypothetical perfect predictor to demonstrate your assertion as false because a capable predictor already does.

>If you're wondering whether a task is theoretically possible for an AI, I think a good rule of thumb is to ask "could a human domain expert do this given a few days and as much research material as they need".

You are wrong. Train a language model on descriptions of the functions of proteins and an equivalent protein sequence and you get a language model that can predict novel functioning sequences from function descriptions alone.

https://www.nature.com/articles/s41587-022-01618-2

Not only is this not something a human expert can achieve in a couple days, It's not something a human expert can achieve at all. It is a Super-Human ability.
Which lawsuit are you referring to? I'm pretty sure GP is referring to the US Copyright Office guidance on copyrighting AI output in the US:

https://copyright.gov/ai/
Content Credentials is just one/the latest standard.

Canon (maybe others) offered a similar feature from the very early days of digital, with a module for the 1Dx at least that would cryptographically sign files the camera generated to say "this is what the sensor saw". Typically it was marketed to law enforcement, because there was a wariness around digital photography as evidence even in the early days.
Paying to be the default is anti-competitive. Things like this, which directly and blatantly hinder competition, should be legislated away. I can conceive of a smaller but better product which just doesn't have the war chest to pay for positioning. That smaller but better product will have a much harder time growing if by default it is never exposed to the user. That pretty clearly has the potential to harm consumers.

You can argue "defaults can be changed", sure. However, we know from years of study on consumer behavior they don't. The activation energy just isn't there for users to switch defaults, and they likely don't even know they can. Rarely are defaults left because they're just so darn good.

I'd prefer things like this have a pop up during set up with a randomly ordered set of choices. To get on that list of choices might have a token fee (small sums of money are effective at weeding out garbage) required.
The model is an encoder-decoder, which encodes some text into a latent embedding, and can then decode it back into text. It’s a feature of the model itself.
Hey I've been interested in starting a similar kind of agency. I've worked and talked with many non-profits who've been screwed over by tech and marketing agencies (especially in the mobile space).

When you got started did you just start approaching schools directly and asking what they needed built?
So just add bacon fat?
Petition by CS and Math Laureates: Freedom for Kidnapped Children
That's demonstrably not true, and not a useful comparison.

A growing number of real-world production apps are running on SQLite these days, precisely because it's so mature, robust and performant at this point - and, unlike Microsoft Access, is very actively maintained.
Hmm, I can't think of any other folk art which is dependent upon the largess of multinational corporations to exist, but maybe I'm just not that familiar with what folk art is.
But according to Governor Hochul and Eric Adams, they were a "Sanctuary city." What happened?
glibc actually goes through quite a bit of effort to remain backwards compatible. There have been times when mistakes were made here, but the extent to which glibc does not have a stable ABI is overstated. The only annoying thing about glibc and ABI stability is that the way it achieves that is via symbol versioning which makes it annoying to target an old glibc on a system with a new er glibc.
> why should „all americans“ be insightful, sufficient or relevant?

It's an American antitrust action. The predominant recipient of Google's largesse, Apple, is an American company whose products are the predominant devices in America.

Given all that, it's notable that Google is spending what is essentially a lower bound on Kagi's domestic TAM on keeping the likes of them down.
> British Power?

That would be BTUs - British Thermal Units ;)
58% of traffic acquisition costs and 24% of all cost of revenue. Um, wow.
It's not like they are exactly thriving even with this...
I don't think that helps much. OpenBSD already only allows syscalls originating out of the libc .text section, so whether the trap itself comes from a syscall instruction or some other trap mechanism doesn't really improve security AFAICT.
It's Israel destroying crucial civilian infrastructure. There was heavy bombing about an hour ago https://www.youtube.com/watch?v=r2a5TsMF0Uo
I'm waiting for the day that people's thoughts on how things work on Twitter are about as relevant to their thoughts on how things work on Digg.

At current trajectory, that won't take long.
It may be hard to define, and sometimes you'll get tricked, but it doesn't make it less real.

You know it when you see it. Everyone does.
The overhead rate for R1s is closer to 70%.
Benchmark it with WAL mode turned on. You may be pleasantly surprised.
Implantation details will depend on your stack, but 3 main things I’d keep in mind:

1. Keep it simple. No elaborate logic. No complex data stores. Just a simple checking of the flag.

2. Do it as close to the source as possible, but have limited trust in your clients - you may have old versions, things not propagating, bugs, etc. So best to have option to degrade both in the client and on the server. If you can do only one, so the server side.

3. Real world test! And test often. Don’t trust test environment. Test on real world traffic. Do periodic tests at small scale (like 0.1% of traffic) but also do more full scale tests on a schedule. If you didn’t test it, it won’t work when you need it. If it worked a year ago, it will likely not work now. If it’s not tested, it’ll likely cause more damage than it’ll solve.
There's an argument that Shakespeare didn't coin (all or some of) those phrases or words, that they were in common everyday use at the time but never written down because the type of people who used them couldn't write.

That would still be valuable in disseminating those neologisms further and giving them staying power, but it's less discovery and more documenting.
> What people are afraid of now is a monopoly on the new fuel leading to higher prices

If you can afford private aviation, the price of the fuel is not going to be a big concern. It's already $7-10/gallon and that is a pretty small component in the all-in hourly costs of operating an aircraft.
Most monitors do in fact support this via DDC, but in general the OS doesn’t expose that to the user.
Little use if you’re not on the JVM but I’ve had great success with Embedded Postgres:

https://github.com/zonkyio/embedded-postgres

Each test just copies a template database so it’s ultra fast and avoids the need for complicated reset logic.
That, plus:

> this article uses GPT3.5

Which alone disqualifies it from opining on what LLMs can or can't be used for.
It's shocking how many people in our line of work aren't comfortable admitting they don't know something, so you're already on your way to a better-than-average understanding if you keep reading
> did I just roughly describe a "mirror" without even knowing it from the spirit of what I said?

Yeap, you just did. :)
Pirate bay, software downloads, that sort of thing I reckon. Given the username.
"You appear to have an incredibly superficial understanding of how money supply works, and you appear to be just regurgitating tropes you've memorized."

The irony is off the charts.
Like I mentioned it's been a long time since I touched this stuff. I do think I set up my (underpowered) system aggressively with ARC now that you mention it. Probably was experimenting with dedup as well. I'm sure some of those things have had improvements over the years.
Videochat, nein danke!
All women, 2 had a child less than 2 years old. Two very healthy in diet exercise, one average health
> restaurants that have QR-code menus that download a PDF

Oh yes, about half of the time when a restaurant requires me to scan their QR Code to read their online menu, it's a 20 MB PDF - not a responsive web page. And the PDF usually has multiple columns of text, which means I need to zoom and horizontally scroll (generally a big no-no in web design). I'm a technologist at heart and I find this implementation so needlessly bad, and an extremely poor use of technology. I would prefer a no-bullshit paper menu instead.
Super specific question, but when using the chat interface does pressing 'return' submit the prompt?

When I use the ChatGPT web interface I'm always nervous that I'm going to accidentally submit too early when I'm just wanting to go to the next line in my prompt.
It's the same thing, power is heat with talking about chips
are we in the 1700s? being a PhD does not mean I have to use your honorific every time you are mentioned
It is both internet and mobile phone networks [1]

[1] https://www.theguardian.com/world/live/2023/oct/27/israel-ha...