skysight-inc/HackerNews huggingface dataset:
> It doesn't matter how many years their interests have aligned with mine; if our interests diverge tomorrow, then, not only will they go with theirs, they won't even consider mine.

If you think the small companies are any different, you’re delusional. Everybody’s in it for themselves.

But, that’s fine with me. I just think the odds of that are low based on Apple’s track record of 20+ years.
They shared the ring too! Maximum efficiency.
Yes the number is quite high for brute forcing, even a pool of 300 common words the number of brute force variations sits around 10 ^32 - and a pool of 1000 words it's sitting a little under 10^39.

I actually have no idea how big a pool of words such places use, or how random they are.
Loki is over. Both as a show, and as a character. Tom Hiddleston bid a heartfelt goodbye to the conclusion of "fourteen years of my life" through the finale:

https://youtu.be/fFRl9sacyEQ?t=229
He probably doesn't include stock compensation which is a huge part of compensation for workers in tech.
On the “old internet” someone would just deface your website for lulz instead of asking for bounty
I've been married 17 years, and we got a mined diamond engagement ring in a quality setting and quality wedding bands, and I don't really regret it. But for various reasons, we stopped wearing the rings, and that's not uncommon. It is kind of silly to spend so much money on pretty symbolism, especially if it ends up on a ring holder or in a drawer.

If the alternatives look tacky and cheap, which I'm willing to admit they might, even if I can't tell... the rational choice is to skip the symbols all together, or maybe just simple, quality, not terribly expensive wedding bands.
> Even more useless than gold.

Diamonds are excellent heat sinks and that's increasingly often used for electronics:

- https://www.powerwaywafer.com/diamond-heat-sink.html

- https://www.coherent.com/news/blog/diamond-heat-spreaders

Not to mention that gold is one of the most useful metals out there, just several orders of magnitude too expensive.
Show HN: Tango – TypeScript Django Rest Framework
Ask that about small houses and it’s not even a bad list:

1. Jacques Selosse Initial Brut

2. Franck Pascal Harmonie Demi-Sec

3. Gaston Chiquet Demi-Sec Tradition

4. Larmandier-Bernier Terre de Vertus Premier Cru Extra Sec

Maybe throw in some Gimmonet, Laherte and Bedel there, but still!
This whole dichotomy stops us from having productive conversations. Organic price setting is better and more effective than central price setting, monetary coercion is the lesser of two evils compared to coercion by force, which as long as there are shit dangerous jobs like mining and being an electrical lineman to do will there WILL be some kind of coercion. These are good things about "capitalism". But capitalism is organic, it's amoral, it's also vulnerable to systemic disease like all organic systems. If we can do medicine on our bodies, we can and should do medicine on the economy. Our moral definition of "thriving" should be allowed to trump the natural outcomes of the free market. To think the outcomes of the free-market are automatically desirable is to make the naturalistic fallacy.
Wow, this is a “holy shit” moment for Rust in AI applications if this works as described. Also, so long Mojo!

EDIT:

Looks like I’m wrong, but I appreciate getting schooled by all the HNers with low-level expertise. Lots to go and learn about now.
Some people say that only programmer skills matter, and that languages like PHP are not intrinsically bad. Or that past-PHP was bad, and the modern PHP is a a fine language. But the language defaults still matter, as this case shows: Look at the official Flarum install instructions [0]

> The user that Flarum is running as MUST have read + write access to: The root install directory, so Flarum can edit config.php. The storage subdirectory, so Flarum can edit logs and store cached data.

Bam! Instant persistence for malware.. Any remote execution bug is instantly and trivially elevated to permanent remote shell, which also survives code updates and server restarts. Many common security practices are defeated by PHP's common habits:

- Can you run the thing in docker read-only mode? nope, need to edit config.php, and upload files into "storage", right next to the main code.

- Can you at least check for unexpected changes? Nope, see that config.php again.

- Maybe at least sandbox the webapp, so it does not have access to the random backups? Nope, while it's possible in PHP this is super uncommon, and impossible in common case (apache's mod_php).

In most other languages/ecosystems, saying "let's give our webapp user access to modify program files" will be rejected as horribly insecure. Attacker could still exfiltrate data via code injection, or achieve persistence but they'll have to work hard for this. Not so in the "modern" PHP apps.

Stay away from PHP, folks, if you value security at all.

[0] https://docs.flarum.org/install#folder-ownership
Conversations about capitalism have become pointless... I'd rather eat mud. When people start arguing one way or the other about the goods or ills of capitalism, both sides inject definitional or theoretical aspects that include an entire mountain of pre-supposition, that I barely understand what anyone is talking about. It would take hours to unpick what the hell they mean by the term... which I thought generally should be quite simple: the right to own property, and to trade it without coercion.

So when someone claims that capitalism is dead - what the hell do they actually mean? I can still own property and trade it. The vast majority of people in Western countries can.

No - they think capitalism is something more, some ideal that we had and lost presumably. What that ideal is I have no clue.
You are making unjustified assumptions.

I am a person who doesn't wish to spend $20,000 on a rock so that my wife won't be embarrassed in front of her friends. And that is why I chose to marry a woman who thinks that spending $20,000 on a rock is a silly thing to do.
I'm moving the opposite direction: Altair -> Plotly. I find altair to be too "grammar of graphics" for its own good. And the vega backend makes it hard to hack around. Saving to pdf or high-quality also takes extra steps with additional dependencies.
Someone hacked my old personal site when I was a kid and posted it to zone-h for the street hahaha
e: I just noticed, this post was from 2 years ago. It should have (2021) in the header.

---

I help run a bug bounty program, we get a lot of submissions. Way too many of them are zero or low effort. The SPF meme one definitely resonates with me, we get it a whole lot.

Occasionally we will get someone who submits a half dozen variations of the same zero/low-effort report. When we turn around and deny them all (because there's no actual exploitable issue). There's a good chance they will then spend the next week replying to our emails asking for money because they put a lot of effort into it, and/or disputing our evaluation.

It's frustrating dealing with that, and I can certainly sympathise with wanting to reply to someone who's begging you for money with a "no, go away".

Perhaps Troy just needed to blow off some steam, but I think he'd be better having a saved reply in his email saying he doesn't pay bug bounties for personal projects/sites, and just send that.

I think it'd go over better than having what seems to be an overly aggressive post.
The overall sentiment of this approach is valid, but there are some tweaks to it that I've found effective.

Rather than using Tailwind, applying BEM syntax to styles in an inverted-triangle style has been good for existing websites where using Tailwind isn't an option. Especially if the code has very clearly defined components.

Instead of inlining the JS, I'll still keep that all pretty separate from the HTML. That's probably the thing I disagree with the most here. Maybe very simple things could be used this way-Might be a case-by-case decision there. It's also nice to write a few JSDoc comments to help bring some TypeScript-ness to the table.

I like the push for being more View-Source friendly. My work pushes for squeezing out as much performance as possible on a site, but even we have found that build steps for things like minifying/concatenating has diminishing returns compared to the overall workflow overhead when there is probably an image on the page that could be trimmed down.

Like what a lot of people have said here, I think much of it comes down to what you are building, too.
Justice? Who did they harm?
Oh. Did not think that was even a goal.
Ahhh... he's trying to sell a book. Now the headline makes sense.
I've decided that I won't pay Google any more money. But I do like their phones... So I'll be buying used. :)
I disagree. Mistral actually being open source, as well as the new criteria for how open source models are, is pretty worth being aware of.

Plus, if they make a larger Mistral model that's the same level of performance but much larger, it'll be the be one of the very best open source models.

It's also pretty insulting that Meta is calling their models "open source" when that's really debatable.
I know it’s after US-40 but I like that it’s a local shibboleth like “Missouree” (St. Louis) vs “Missouruh” (rest of Missouri) and BreadCo vs Panera. We used to say the geographic dividers between those two pairs were identical.

I had one professor who was an unironic “fardy” speaker. I think it’s not common under 50 anymore. But I also haven’t been in town for a long time.
He makes a mistake equating Hamas with the broader concept of Gazan freedom. That is embarrassing. However, I agree with what I think his point is, that you put a pressure cooker on the stove long enough and it will pop. Likud and the Israeli hard right are second in line for responsibility of Oct 7 behind Hamas.

All that aside, he is a thoughtful economist and I look forward to reading the article.
“But I already washed your window while sitting at the stop light”

It’s one thing to go begging, it’s another when they feel entitled to some sort of payout. I never asked for their “services” - and in my limited experience, they lash out at you too, when you explain you’re not paying.
It is easier to imagine the end of the world than the end of JavaScript
After I experienced ARM chips in macbooks x86 laptops are no more for me.
Whoa! Great work. To other folks checking it out, it still requires downloading the weights, which are pretty large. But they essentially made a fully portable, no-dependency llama.cpp, in 2mb.

If you're an app developer this might be the easiest way to package an inference engine in a distributable file (the weights are already portable and can be downloaded on-demand — the inference engine is really the part you want to lock down).
> Covering up legit vulnerabilities is dangerous

It is incredibly hard to prove someone else knew about something you didn’t/don’t know about though.
This conversation has me thinking that I could go a step further and replace the hashes with only enough characters to make them unique:

> Baltimore=>0x01a1...1ef7=>01a

> Aaron=>0x17bf...86f1=>17bf

>{"Foo":”Bar"}=>0x19f4...9af2"=>19f

This would create lots of false positives if one attempted to reverse it, but it's still a 1:1 map, so data which satisfies unique and foreign key constraints would still do so after the transformation. As for the utility, it makes it so that you can run the app and see what the user sees--except their data is hidden from you. So suppose the user's complaint is:

> two weeks ago, workflow xyz stopped reaching its final state, but never explicitly changed status to 'failed' so we weren't alerted to the problem.

I can hash "xyz" and get its handle and then go clicking around in he app to see what stands out about it compared to its neighbors. Perhaps there's some should-never-happen scenario like an input is declared but has no value, or there's a cyclic dependency.

I don't need to know the actual names of the depended upon things to identify a cycle in them. The bugs are typically structural, it's not very common that things break only when the string says "Balitmore" and not when it says "1ef7".

Privacy wise, the goal is to be as supportive as possible without having to ask them to share their screen or create a user for us so we can poke around. And when it's a bug, to have something to test with so we can say "It's fixed now." instead of "Try it again, is it fixed now? How about now?"

I'm the third party here, and I'm trying to prevent my users from sharing their users' data with me. Maybe it's not strictly "anonymization" because I'm not sure that this data references people. Remaining unsure is kind of the point.
> Diamonds are worthless, but reject them at your own peril. When my friend proposed to his girlfriend of 3 years, because the ring didn’t have a diamond she said no.

Sounds like your friend dodged a bullet there.

(I proposed to my now-wife without a ring. After she said yes, we went shopping for one).
he could be pro Nazi, but that is not an argument against his reasoning around capitalism. That's an interesting sidenote, but doesn't mean he's wrong. I think its better if we just discuss why he's wrong or right on this topic.
There are more options than those two. Pebble watches were built open enough to allow Rebble to get developed and let Pebble watches be used to this day, despite being officially unsupported. A lot of mainstream Android phones support LineageOS. A lot of older iPhones with older iOS versions can be jailbroken and used to this day with tweaks.
Don't forget that those who sit at the top of what capitalism has provided are also able to thoroughly define the narrative that's applied to the rest of society.

For example, many of the paths you've rightfully pointed out are, have been, and will be tarred with the socialism brush which, in (too) many corners of the US, is a synonym for communism.

and maybe I just don't have a good enough imagination, but I can't see anything other than extreme violence being able to solve the concentration of power. I'm not promoting it at all, but my knowledge of humanity and history is such that that's where I think the percentages point towards. Those with power seem to be increasingly doubling-down on positions that my logic would deem untenable, and their calling to account by those aspects of society responsible for calling power to account seem to be increasingly failing.
> Be honest, do you really think a phrase meaning "keeping your husband happy and satisfied would make your life better" is not harmful?

No, why would it be harmful? The whole point of loving someone is caring about them and wanting them to be happy.
> We choose to go to the (X) in this decade and do the other things, not because they are easy, but because they are hard
We've had a handful of these that we've paid out for small issues over the years.

Things that are _technically_ security issues, but not something that affect us or are exploitable in a meaningful way. $50 a few times a year is stupid cheap to build a reputation of actually paying out security researchers.

Among the junk, we've had a few legit bounties submitted. That alone is worth the noise these "beg bounties" create.

----

Security is a never ending game of cat and mouse. If you can pay out a small amount to people who might, just might, catch something all of your other processes miss, it's a pretty easy decision.
We must have a Rust Apple IIe target, damnit! :) But will Hello, World fit on a floppy or will it be all stacktrace symbols even with no_std?
Solar panels that blend in with white roofs now available
There are a few reasons.

1. The first is literally the first example of the article: real/important vulnerability disclosures get confused with beg bounties which dont need to be acted on / are not serious (most of the time). That can cause real harm.

2. The second reason is the approach that the beg bounty uses: that of fearmongering. If the beg-bountier disclosed the vuln and asked for the bounty that would be ok, but withholding the vuln until payment is assured is a scam.

3. How can one even properly valuate how much the vuln should be worth without knowing what it is / capable of doing?
After which publication they usually reassure their users that security is their utmost priority, fix the one leak, and go back to doing nothing till the next breach.
There's a couple lawsuits going around aimed at hotels and apartment rental companies using centralized software to effectively engage in legalized price fixing.

Probably happening in many industries and we don't know about it at all. Would generally agree that antithetical to free market capitalism and an example of how capitalism is not really capitalism.
Thanks for this! IMHO it's a bit wall-of-text (or maybe that's the weakened attention span). Ever considered present just headlines like a certain tech news site?
Can I run this offline on my iPhone? That would be like having basic internet search regardless of reception. Could come in handy when camping
Walmart.com is another seller marketplace that does big volumes and works similarly to Amazon.

Still, I think Amazon is doing some pretty anticompetitive things, and the FTC lawsuit against them seems like it has merit in my layperson’s eyes.

Nobody else besides Amazon can get a random product to my door in under 12 hours for any reasonable cost. If I buy the product direct from the manufacturer I often get charged shipping. That situation could be easily argued to be a monopoly.

Apple vs. Google isn’t that much of a choice, either. There used to be so many smartphone options: BlackBerry, Windows Mobile, Palm, and Symbian all existed at the same time as the iPhone and Android.

Now it’s just two, and most governments don’t seem all that interested in curtailing some of their most anticompetitive practices.

You don’t have to be a pure monopoly be in a small group of “lords” with a position of power that cannot possibly be overturned.
> With the right lab equipment you might be able to tell the difference through some fluorescence or other very hard to perceive property.

With the right lab equipment, you can read the brand mark DeBeers puts on their mined diamonds, if nothing else.
Bitcoin's Lowest Block Hash Values
I've seen this site pop up a lot in SERPs too; its content is quite mundane and almost looks like it was LLM-generated.
capitalism is private ownership of property and the exchange of labor for wage to produce commodities with said capital.

capitalism is not just "free market economy," where the natural opposite as you supoose being "centrally planned economies"

this is essential to understand what varoufakis presents as a new relation to production: technofeudalism.
Bottom feeding villains, who tirelessly work to subvert the massive effort put forward (AV1) to finally escape the clutches of this madness.
> I don't know how many disclosures I've done ... (100+, surely), but I have never, ever - not even once - asked for money. But Hammad isn't me

I agree with everything in this post except this line. It's nice that the author doesn't need the money, but some people do. To me, the problem is not sharing after the answer is no, or not asking up front, not the fact someone is asking for money.
I guess making it portable is still quite important?
And also the origin is from Warhammer 40k

"The Trope Namer is Warhammer 40,000, where it is the Ork onomatopoeia for machine gun firing, and their general term for rapid fire capacity: "dakka-dakka-dakka-dakka...""
It's "just" a port of GGML (written in C++) to wasm with some additional Rust code.
"Google said it wanted to align the Fitbit hardware portfolio to more closely match the Pixel line’s regional availability. "

Wow... this must be the most brain damaged thing I've read today.

Imagine the google algorithm applied to orchestration. I am running a service that needs a Redis instance per webserver. I have 5 web servers and 3 Redis instances. I run `k8s deploy` or whatever. Google deletes 2 web servers.. see we're all aligned now! There must already be a classic fable or story about this scenario.
An important addendum is that the government/finance revolving door must end, because what is sitting at the confluence of the rent-seeking you describe and the regulatory capture I just alluded to is our current paradigm, where the public is constantly forced to bail out "wealthy" entities in the wake of their bad bets blowing up and taking out an institutional pillar of our economy or two. It has happened multiple times just this year, almost silently (on top of the high likelihood of a few additional instances happening completely out of view of the public, both here and abroad).
Most of the reasons real money gambling is regulated is to do with stopping money laundering, not protecting gamblers.

The incentives for the govt to regulate virtual gambling sims(that don't pay out) arent as strong, especially when these companies pay tax on that VIP revenue.
EU CRA and the Open Source Ecosystem: A Suggestion
Political Quiz
Lying to your spouse is wrong even if you can't think of a way you would get caught.
Show HN: ORM Without the Need for SQL
Programming languages support for OO have been properly implemented, the gap is OO database that unfortunately never take off.
If you have 5x orders-of-magnitude more computing power to stumble into constraints optimization solutions versus very good constraints optimizers. Go ahead and build it while being 10^5 slower and more expensive for no value.
Why can’t Google sell hardware in more than a handful of countries? Samsung and Apple reach almost 200.
Leftist thinks (=wishes) capitalism is dead. Here's Jeff with the weather.

Nothing new: this has been a thing since socialism was invented.

Perhaps they should try to work within the system that has been shown to work better than any pther system, instead of advocating its mindless destruction.
Right, but if the port achieves performance gains over GGML, which is already highly performant, that’s a. Wild b. a signal to move further GGML development into Rust, no?
I’m confused, isn’t this post a tweet?
It seems better to have a shape which loses accuracy as you truncate characters, just like other geohash points.
Sure, if it's as good as you say! Let's make a deal :)
it's available on Amazon =)
yeah excited to see how this will evolve. BTW, maybe give it a try on your Mac and see how it performs.
Tell me you don't play poker without telling me you don't play poker?