skysight-inc/HackerNews huggingface dataset:
> Do you make any attempts to go further?

Yes.

At the moment we're targeting x86-64 servers with UEFI. On such platforms we aim to do the following:

1. UEFI does measurement and verification of stboot using UEFI Secure Boot

2. stboot does measurement and verification of stvmm

3. stvmm does measurement and verification of Guest VMs

4. Clients use STAM to verify Guest VMs when establishing a secure connection

* UEFI Secure Boot is 2048-bit RSA.

* Measurements are done assuming the platform has a TPM.

* stboot will do m/n signature verification for source release, reproducibility and build release, as well as verify Sigsum log inclusion. (Ed25519)

* Sigsum log inclusion is just another detached signature blob, containing an inclusion proof, and signatures on that proof from the log operator and m/n cosigning witnesses.

* stvmm will be Linux KVM + Firecracker, and an authenticated API for listing, starting and stopping VMs.

* STAM is the System Transparency Authentication Mechanism.

For more details, see my recent talk at OSFC, linked elsewhere in this thread. It's admittedly a bit all over the place.
are you writing Python code?
I wonder if this behavior just applies to Python as I recall code interpreter is Python only.
Project 2025
I’m a little perplexed at why you feel the need to refer to it in reductionist terms like this? It seems to provide a lot of value considering that it has 100 million weekly active users.

I regularly find myself using it a dozen times a day. I feel like the only reason someone wouldn’t find it useful is if they weren’t ever doing anything new.
If you think about how people use and perceive the technology, it’s not that dubious.
> So it doesn't really ever make sense to compare net worth, market cap etc to GDP.

another nitpick, stock-to-flow comparisons can indeed make sense, eg "return on X" measures. they are also fairly common in the context of GDP, e.g. debt-to-GDP ratio, total banking assets or mcap as a percent of GDP,...

it's just this particular comparison that might not make too much sense. but since many countries have a debt-to-GDP ratio in the ballpark of 50-100%, you could try to infer from that statement that he could have singlehandedly paid down the entire sovereign debt of some smaller nation states. or he could have funded their entire education or total government budgets for several years. which does give a sense of how much wealth this was (on paper)
The issue is i tried using these types of tools for a while and each response is inaccurate. It becomes annoying to constantly ask it to correct it or having to doubt the output. Works well for what is statistically likely to be abundant in information but you know that’s usually of little value.
It's a slow fantasy. Maybe. There are lots of different ways of reading a book. I err towards looking at the use of language, the turn of phrase, at least as much as I do the plot. Piranesi suits me, if you're more plot oriented, it might be quite a jarring story.
This is what it looks like on my phone. It's the same on Chrome, Vivaldi, and Firefox Mobile.

https://i.imgur.com/0ErpXFw.jpg
But free chatgpt or bard work good enough for most of such questions
> The rules are:

> Do not direct cyberattacks against civilian objects.

> Comply with these rules even if the enemy does not.

Surely these guys would immediately follow those rules, right?

IT-армія (Міністерство цифрової трансформації України): https://t.me/s/itarmyofukraine2022 linked directly at https://uk.wikipedia.org/wiki/%D0%92%D1%96%D0%BA%D1%96%D0%BF...
They're generated from a tonne of Python scripts, but feel free to get in contact and I can take you through how it works ! :)
at least for the terminal, I use kitty which has a "hint" mode https://sw.kovidgoyal.net/kitty/kittens/hints/

I use this with emacs and avy + firefox and vimium and don't need it anywhere else (works across OS too)
Next statement is

> But they did find that, among those infected, those with higher "serointensity" or a higher concentration of antibodies to the parasite, were significantly more likely to be frail.

which should be read as

> But they did find that, among those infected, those with higher "serointensity" (i.e., a higher concentration of antibodies to the parasite), were significantly more likely to be frail.

When they say serointensity, they specifically mean "Toxoplasma gondii IgG Serointensity" [1].

Serointensity is how strongly your immune system responds to the infection. Which is different from whether you get the infection or not (their original hypothesis).

Also, statement after the above quote is '"This paper is important because it provides, for the first time, evidence of the existence of a link between frailty in older adults and intensity of the response to T. gondii infection," said co-author Blanca Laffon [...]'.

[1] https://academic.oup.com/biomedgerontology/advance-article/d...
When will Apple put an m3 or a17 pro in an Apple TV?
Just ask it!
Would you mind sharing what kind of industry this was in?
Hints – Kitty
for me it’s really worth it, and use it as a starting point rather than spending time sifting through garbage google results. I am using it to study math, to ask about css frameworks, about api best practices, SQL dialects, and so many more things. Then i can drill in and go to source documents if I want to. It took me a while to see the value, however now i feel i have a “generalist” assistant and use it as much as i can.
Additive synthesis was a pain to configure. I had to model and estimate the behavior of each harmonic. It was too much effort.

Subtractive synthesis didn't work that well for me either. I believe my implementation of the variable cut off lowpass filter had something to do with it.

FM Synthesis worked reasonably well without much effort. Implementation was rather straightforward.
A better title for this would be "Asahi introduces advanced speaker DSP to Linux" as that is the real significance of this new development.

I imagine it will be incorporated into other distros soon as a result.
Are we going to prosecute all long-tail problems in any product? Often it takes years or decades to unveil a problem and changing a chip design is multi-year task. So even if Intel knew AVX could lead to attacks, a timely fix might not have been possible.
Curiosities may be plenty enough. I find the entertainment value of it to be worth $20 alone by now. A handy tool to ad-hoc generate coloring outlines for my kids based on whatever they're interested at the moment is a bonus.

(I used to do image searches for those, and there's plenty of images on any simple topic you can think of, but DALL-E 3 lets me quickly make ad-hoc images based on ideas like "child apprehensive about a robot vacuum coming into the room to eat its toys" or whatever they were joking about 10 minutes earlier.)
The problem is people hardcoding github.com in their go files.

https://www.digitalocean.com/community/tutorials/importing-p...

>import "github.com/google/uuid"

This should be just "google/uuid".
> a 'catalog' of all the features.

A “menu”, if you will ;)
What's the problem that your tests depends on lib C, if it's using it it makes sense that the main program depends on it. Go test are part of the main program, if you want them separated then create another module that import a and c for testing.
Thank you! We actually started prototyping an open-source hardware TPM but put that project on the shelf to focus on what became the TKey. As you may know, in order to use the TKey as a TPM we'd have to design hardware that can connect to the LPC bus. One of the essential features of a TCG TPM is that is it connected to the reset line of the x86 SoC.

Which reminds me, Tillitis is soliciting requests for what our next hardware product should be. :)
Your score isn't affected if you jay walk, so no.
And yet GitHub still send me six digit one time codes, with no spaces to help my brain with chunking.
“@rcastlebury's activity is private”
> The key is to surface errors in compiler diagnostics, so that the newbie coders know when they're getting it wrong.

That "key" is making Rust the complexity issue it is. Which is why it is considered so hard to pick up, both by newbies, and by experienced programmers. And yes, I know, there will be people who say "Rust is easy!". Well, show me people who learned most there is know of Rust over a weekend, or who understood a large Rust codebase while still learning the language. In Go, I personally know several people who did both. In Go I onboarded people who never before even saw any Go code, without an issue.

> Golang doesn't really solve the problems of newbies, it just punts the issues to runtime

These are not problems of newbies.

Yes, GCs are an adequate solution to the complex problem of memory management. Most real world production code written doesn't have performance constraints that prohibit the use of a GC.
Provenance artifacts via something like SigStore would go a long way, since it solves both key management and the linking of artifacts to their build process.

For Go where you're just publishing sources with a build necessarily, you could opt for SigStore git signing so you can at least validate the author via a 2FA auth provider's OIDC token.
I think it’s also worth considering what level of meat eating would be sustainable if we extrapolated out to everyone on earth doing it. I think we’re extremely fortunate that vegetarianism is so common in India
> making them even more stable

Not related to the topic but it seems this marketing blurb has become the norm: They can't say they fixed something without claiming that it was already very good. I've come to hate this. No, they are not now "even more stable", "we made them more stable" because honestly they weren't that stable to begin with.
In addition to what was already said: systemd exposes (some of?) the same isolation features that are used by podman et al. to it's services as well. This can go as far as making the services software see only its state directory and nothing else, for example. DynamicUser is also a pretty cool feature in that realm. Some of the NixOS modules use these features to provide isolation for the services they define. In my experience these features are used much more extensively in NixOS than in other distributions.
>Special kinds of addresses

You give one example (ULA) and I can raise you four: 192.168.0.0/16, 10.0.0.0/8, 172.12.0.0/12. You give one example (LLA) and I can raise you another: 169.254.0.0/16.

So come on now with the "complexity" talks. It's obvious that you are not even educated in IPv6 technologies, or else you will be talking about NDP and others, not mere addresses.

>Pre-existing ones don't need to be longer

We cannot do that even if we wanted to do so.

Think about this: computer A supports only the "shorter IPv4" and computer B supports both the "shorter" and "longer IPv4". Now computer B has the IP "1.2.3.4.5". How can computer A, which supports only the shorter IP address, connect to computer B? By the magic of having hindsight? No.

Therefore: Congratulations! You have just repeated the current IPv4-IPv6 pain point without being aware of it. Which is fine, but note that in your comments you have tended to act like your solution is better than IPv6's.
Mystic Mog's Monthly Musings for November
Have you used it? A GPT4 chatbot could convince 90% of people it was a human, right now. It could pass the majority of knowledge-based tests in all kinds of fields. 100 million people find it useful enough to use weekly.
I’m confused as to why you need to pay an AI service to normalize audio volume? Isn’t this something basic audio tools would do for free?
The Loch Ness monster and the story behind the mysterious water beast theories
Show HN: FlowTest – Drag and Drop GUI for OpenAI Function Calling
1. Drag & drop UI for openAI function calling.
2. Construct sharable flows that can act as end to end test in minutes.
3. Import your openAPI spec and use natural language to connect your openAPI components in a meaningful way
As someone who was a bit obsessed with Hamlet as a teen, it's hillarious that they named this Polonius. Polonius is Ophelia's father in the play, and they probably named it because of his famous line:

Neither a borrower nor a lender be,
For loan oft loses both itself and friend,
And borrowing dulls the edge of husbandry.

He's a tragic but somewhat foolish figure, prone to fretting and offering kind of annoyingly obvious advice of which the above is an example.
Site is performing a GET request every 2 seconds to get the most up-to-date stats, each time downloading the full list of 126kB. That hurts.
I use it constantly throughout the day. Queries that I would otherwise hit google for on esoteric topics. Software wise I like to use it when I am using a library I am very unfamiliar with. This tends to happen for me on FE work as I don’t typically do as much there. I can describe what I want and get a code example I can use on top.
> Which reminds me, Tillitis is soliciting requests for what our next hardware product should be. :)

An HSM. Please please let it be an HSM ! :)

There is the YubiHSM, which granted is cheaper than traditional HSMs, but still wildly over-priced at almost 1000EUR each.

The world really needs an HSM at a truly competitive price point.
Silicon Valley's Big, Bold Sci-Fi Bet on Device That Comes After the Smartphone
A fix, no. But a warning to customers would have been a matter of days even with lawyers involved.
Show HN: I built a tool for policy driven vetting of open source packages
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption.

https://github.com/safedep/vet

Looking forward to feedback and suggestions from HN :)
My point is that just about any justification for any business activity ends up being customer-related at some level.

Example:

Why do we want to spend money on Jetbrains licenses for developers? Because we want them to be happy, comfortable, and productive. And why do we want them to be happy, comfortable, and productive? Because they build stuff that customers want.
We have them at work too, like you said they are too floppy and you gotta be extremely careful not to touch anything, especially if the point you are testing is very tiny. Apart from that they are great but yeah, there needs to be a way to fix them in place.
Nah, you have to consider how much time it saves for you. If your rate is $30/hr and ChatGPT saves you 1 hours per month more than free alternatives then why not?

Cost is their business, not yours (unless you're a competitor to them).
Open, rigorous and reproducible research: A practitioner’s handbook (2021)
To be fair, the team itself wasn't planning on announcing this and still wanted to do more experiments and refining before publishing a paper. I believe it was one of the funders for the team got impatient and leaked it prematurely.
OpenAI less so, small community trained open source LLMs more so. We’re already seeing this on HF with community fine-tunes on Mistral and Llama2.

In the same way search transformed knowledge augmentation, LLMs will transform skills augmentation.

Forget about the things you know to do well, instead focus on all the new skills LLMs will unlock for you.
> go the DMV in person and put my thumb print on a biometric scanner which pulls up my picture

How does the state have your fingerprints on file?
Comparing any two things so you can clarify the differences. I have found it works well for abstractions.

It is very useful in providing similar examples too. It's way better than a thesaurus.
"hundreds of dollars per square meter" not true anymore.

https://allo.solar/panneau-solaire-410w-noir-mono-p-type-tw-...

104.08 EUR tax (20%) included for 410Wp gives 0.254 EUR/Wp

1722 x 1134 x 30 mm = 1.92 square meter gives 53.38 EUR/m2.

Some wooden floor are more expensive than PV per square meter.

People forget that PV, battey, wind costs are still decreasing.
The attack against Danish, critical infrastructure [pdf]
> Report about the largest cyber attack against Danish, critical infrastructure we know of.

The attack happened in May 2023. The publication is from November 2023.
"Nix ... is ... what ends up writhing out of a malfunctioning industrial mixer that someone accidentally dropped Haskell and Bash into"

Well said, lol
It already exists: It's called “debug” mode and it's what you get when you don't compile it in release mode. (The biggest problem with debug mode is how slow the unoptimized code is: for back-end stuff it doesn't matter, but for things like gamedev you want your dependencies to be compiled in release mode (fortunately the cargo allows you to specify that you want some deps to be compiled in release mode even when your project is compiled in debug mode).
Facebook is a garbage company. That probably explains it.
Thank you for the reference, not too surprised it's Satie, he's a bit of an odd fellow.

And this being HN, I feel obligated to reference a very interesting talk by Mouse Reeve about Erik Satie during a "Strange Loop" conference:

https://youtu.be/ANYMii3Sypg?si=S_-9Z98NlawiiLm9
The article is disingenuous
Do you know how Swiss financial privacy and credit reporting laws compare with countries in the EU?

> Around 36 percent of the Swiss own their homes or apartments, the lowest rate in the West and well below the 70 percent average in the European Union, and the 67 percent in the United States. [1]

I’m sure there are many factors, but I would be less willing to finance someone’s large purchase without more information about their creditworthiness.

[1] https://www.nytimes.com/2023/11/06/realestate/zurich-switzer...
Isn't this what draft PRs, CI/CD and automated integration tests are for?
I think this is the right mindset. As programmed, we need to be aware and able to distinguish between when two things look the same, and when two things are the same. Only one of those benefits from an abstraction.
Indeed, I didn't think much of the work until it dawned on me the effort needed to accomplish this behind the scenes. Interesting post.
It is used that way in Finland and a fair few other countries and works perfectly well.
I don’t think it has any knowledge that only it knows. That would be silly.

It is the accessibility. I can go and ask an esoteric question about economics and it an answer immediately. Along with that answer comes enough information that I can dig more myself if I want.
> Imagine a world where you don't have to trust online services blindly.

Most online services can be hardly trusted to use TLS between the frontend web servers and the database, or not to store sensitive credentials in git. These are: 1. far more serious issues than a trusted boot chain, 2. far easier to address, and 3. disproportionately more difficult to remotely attest.

Transparency would definitely help here as well, but transparency is an aspect of company culture, and presently so dominantly opt-in that unless we see some fundamental cultural shift, this will be an extremely niche feature to expect from a service provider.

> They do however complement each other nicely.

Yes I do agree, and I do believe that security is more about breadth than depth - raise the wall evenly around the fortress, so that no part of it is less tall than X. That does often require investment in hardware, but I think there is much more to gain e.g. by streamlining setting up FDE with interactive key input from initrd+dropbear, something I've always wanted to set up on my boxes but something that's too painful/tricky/brittle to do at medium scale (too many servers to do it by hand, not enough to invest in in-house automation).
As Neil Gaiman tells, Terry Pratchett had his hard drives steamrolled upon his death to prevent any half-done work from being released.
I was once unable to build some Go software because some random individual's personal git hosting website was down. It's sadly not only gitlab or gitlab; at least that would've limited the amount of single points of failure.
I use it for several purposes. I most recently used it to find a recèpe for Limecreate for some Ukrainian builders and translate the recipe to Ukrainian.

I also use it to be build multi linguistic tasks lists in English, Polish and Ukrainian for Google sheets.

I also just used it to help create crop planting plan for a farm in Kenya which has just had massive floods, with a constraint that local produce reaches the highest value in December and January. The other constraint is that some of the crops have survived but not all. It is an interesting yield management experiment
Haven't read either, but both sound interesting! Thanks!
I read the first few pages of Genesis many years ago and I was surprised that pretty much all the non-Jesusy bits I'd heard of were in the first few pages. It moves at a remarkably quick pace. Entire civilisations come and go in paragraphs. I had the impression all of this stuff was spread throughout like a novel. I was left wondering what the other 1000 pages are about (not enough to want to read them, though).
Thank You, Reviewer 3
> that's mastery

Sounds more like competence
> better yet create a document you can reference establishing your guidelines.

This. Remove as much ambiguity and grey area as possible.
Avid player here, I can only recommand :), especially if you leave in Europe you find them everywhere in big cities once you look around
> What things about our [market/customers] will never change? Are we investing enough in those?

A seemingly obvious question but one that isn’t posed often enough. Open your eyes and play the long game, don’t waste too much time or money chasing what won’t be around in 3, 6, 12 months unless you absolutely have to.

Loved the list, really has my gears turning thinking about my own business strategy.
What does dulling the husbandry mean in this context?
> Ms Maps? Who in the world uses anything else than Google Maps and Waze for navigation?

In the last at least 5 years I never used Google Maps or Waze for navigation.
The same way they do for people who aren’t from the US?

Some combination of name, address, birthdate, etc.

But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).
1. Astronomy

2. Chess

3. Programming
and google continues their efforts to convince me to never rely on one of their products :-/
I have seen people strive for cleanliness from the get go, but that has resulted in garbage outcomes and overabstraction.

The customers are unhappy. I am unhappy. Everyone is unhappy.

I prefer "messy" simple code that works and is easy to understand. Yeah sure I put too much logic into the controller. I could put it into a dozen different files. Fight me.
I fail to see how Intel deserves any benefit of the doubt after the speculative execution fiasco they engineered to make their CPUs faster.

Why do people conveniently forget even fairly recent history is beyond me.
The comment I replied to suggested the emails proved they got money from their son, not proved they knew anything illegal was going on.

To quote the comment I replied to: "From the emails that were released in court, it's clear that if they did not enable his crimes, they certainly profited from them and encouraged the continuance of the enterprise"

If they thought "the enterprise" was just a hugely successful startup, then why wouldn't they accept money from their newly rich son?