skysight-inc/HackerNews huggingface dataset:
But if this deal follows a Capitalist system, if we have greater supply of "valuable" content, than the price should go down and we should view less ads over time. Instead the opposite is happening.

That's kind of the greater goal of the book - contextualizing our interactions with cloud companies within a larger macroeconomic picture. It is a compelling enough topic to consider. I don't really think it is fair to call it fan-fiction. It could be right or wrong, but it is a book about a macroeconomic theory that seeks to explain observable behaviors.
Couple things stood out:
13.4% of companies see themselves as leaders in AI. I think people are probably being a bit ambitious with how much of a "leader" they are.

79% are using some form of OpenAI GPT. I get that that is the easiest entry point, but are companies really that cavalier about putting their data and their customers data on someone else's hardware? I get the cloud use case, but this sounds more trusting than I would be with emerging technology.

only 26% are customizing base models in any way. To me that would be table-stakes for using LLMs in any way.

I guess the main takeaway is just how early we are in this movement, and how much work there is still to do.

(edited for formatting)
This could be very interesting, too (our query engine now with full JSON support -- using sophisticated set-oriented join and aggregate optimizations):

Separating Key Concerns in Query Processing - Set Orientation, Physical Data Independence, and Parallelism

http://wwwlgis.informatik.uni-kl.de/cms/fileadmin/publicatio...

I've also ported their indexing ideas regarding XML to JSON, such that we can easily index whole paths with typed values as described in the README :-) the indexes itself are also versioned, of course and always updated.

First AST index rewrite rules for the query engine Brackit have also been added (Brackit is regargetable, so other data stores can easily implement a couple of interfaces).
I think of WAFs as an extra safety net. Defense in depth.

The author complained about the performance cost of WAFs in general, but not all WAFs have be structured like ModSecurity. They could for example be based on something like https://github.com/intel/hyperscan and perf is at a very different level.
Almost by definition, junior engineers are incapable of distinguishing "this is the literal request from the stakeholder" and "this is what the stakeholder is actually trying to accomplish."
Agree with you fully. It's also a lot more easy to program behavior into an esp32 rather than rely on home assistant pre defined modules.
We have cybernetics today too, their aesthetic style is just more Medtronic than it is Blade Runner.
They email me at every upload telling me to stop sending them my archaic signature.

It seems the focus now is more to keep the secrets on github and authenticate with those.

https://discuss.python.org/t/2fa-usability-on-pypi-and-with-...
>The Inconvenient Truth about how to actually fix this

The security game is just too fast paced for a profitable business. Until we reach the point where it makes financial sense to move slowly and take extra time to ensure critical business systems are secure, nothing will be fixed.
Processing information is pretty vague and generic idea. You can label virtually anything as “processing information” and be more or less true.

But I doubt i find any neuroscientist worth anything who say “brain is doing computations almost like a computer”.
Would that really help? It would be continuously on for me (because of my phone listening for “Hey Siri” locally).

The OS-level “an app is using your microphone right now” indicator seems like the right trade off in most scenarios.
I'd wait until some longer term studies come out on the meat. Humans have no tradition of eating them (edit: looks like i was wrong on this point). I'm not conceived it's healthier and I'm totally convinced the people pushing it don't care about us.

I'd also like to see the ultra-wealthy social planners eat bugs, at least at the opulent summits where they plan it for our class of people. As long as they're eating steaks it's a bad look (same as them owning yachts, taking a private plane to an event then biking the last two blocks and talking about how private car ownership needs to be abolished).
Thermal Transistors Handle Heat with No Moving Parts
https://en.wikipedia.org/wiki/The_Food_Defect_Action_Levels
This is purely anecdotal. My experience, also anecdotal, is that I've used Macs for 30 years and have never had an OS update corrupt a computer and I've never had to do a "factory reset". I always transfer from computer to computer (either directly or via a Time Machine backup) and I buy a new MacBook at least every other year (I keep separate personal and work computers also). I've never had any problems that weren't fixed by a restart or that weren't specific to one piece of software.
> try using the default date/time picker and get back to me.

Building my first web application in react currently and this resonated with me on such a deep level.
What if I get a Cybertruck, find out it really is as shit as I imagined it was, and want to sell it right away and get a 2001 Tacoma? Should be able to do that, I think.
> its part of the stack. earlier detection and improved treatments is a very important area.

Earlier detection is important but mortality is a better metric than 5-year survival. People tend to conflate the two. If earlier detection doesn't decrease mortality then it's just goosing the 5-year numbers.

This is especially true in geriatric cancers, particularly for example prostate cancers, where most of them are slow growing and not particularly dangerous. You'll outlive the cancer, so knowing about it doesn't mean, well, anything, other than exposing you to risky tests with serious side-effects. Prostate biopsy is really not great.

No-treatment is a great choice in these cases, so really, the detection is all downside, no upside for asymptomatic cases. [1]

[1] https://newsroom.ucla.edu/releases/older-prostate-cancer-pat...
All other things aside, it will also make food less nutritious:

> Research led by Sam Myers, Director of the Planetary Health Alliance at the Harvard Chan School, found that when food crops like wheat, corn, rice and soy are exposed to CO2 at levels predicted for 2050, the plants lose as much as 10% of their zinc, 5% of their iron, and 8% of their protein content.

https://www.hsph.harvard.edu/c-change/subtopics/climate-chan...
I'd settle for a source analysis and reproducible builds for just our myriad open source dependencies. All it takes is a single developer to be compromised in the thousands throughout a typical stack..
This analogy is wrong. I have better ones.

1. Imagine a painter on the street, who made a quick painting of youand your partner in your natural state while being unaware of the process. Then he comes and asks if you are willing to pay and get it to yourself. No, you don't have the right to get it for free only because it was already painted.

2. Imagine that while you are on your walk, a guy comes to you and informs you that your bag was open and some stuff may have disappeared (dropped and/or stolen) from it. He went out of his way to detour and catch up to you (he had to run!) to report the issue. It was voluntary, but it is a good behavior. In physical world that alone should be rewarded (at least with sincere thanks). But if you are not willing to compensate, he has no duty to go spend even more of his time and energy in order to walk back, show you all the places where your stuff dropped and to stay and document all the details for your police/insurance application. He already did you a favor and is not required to put any more effort into it for free. It would be nice, but not a duty; especially because we are not talking about the private person or a hobby project, but about a company business. Discovering vulnerability is one thing, but properly writing and documenting it is a totally another expenditure of time, energy and opportunity cost. It is not free.
You can pre-generate them on the client though.
That's exactly the kind of thing I'm talking about. You could take those and plug them together and be basically ready to go, rather than "just" investing in a bunch of 3D printing and soldering and lord only knows what else. Maybe it costs a bit more, but that's fine - you get something that you can use somewhere besides sitting on your desk with a bunch of exposed wires.
What use cases do you see this happening, where extraction of confidential data is an actual risk? Most use I see involved LLMs primed with a users data, or context around that, without any secret sauce. Or, are people treating the prompt design as some secret sauce?
Not according to my morals!
I don't really agree that frontend framework components are meant to be replaced completely and are not composable. Maybe from the outside, but I use slots quite a lot in my components because they are very easy to do and they trivially work. Web Components on the other hand are usually demonstrated as insert <img-editor></img-editor> which basically inserts a ton of code to create some kind of an editor. Using slots in Web Components is a pain, a lot of appending nodes manually, templates as strings, for some more complicated things when I tried them I had to listen to the slotchange event etc. It's essentially the DOM api, which if it wasn't terrible, we wouldn't have switched to frontend frameworks like react etc.

Also disagree with the side note that XHTML failed because it didn't augment HTML. IMHO it failed because if forced the applications to be completely valid and it put the validation on the client/browser. If you'd really used real XHTML a small error in the markup would've crashed your page. So we all validated our XHTML to be future ready, but it was always utopia that a business would risk crashing their, well, business because a p tag was not properly closed.
Archive for when it is taken down: https://archive.is/2023.09.27-035717/https://www.cmglocalsol...
Can apps access the information whether a location based notification has been delivered even when the user does not click it?

In any case, this is quite visible to the user. I’d definitely be suspicious about apps showing me this kind of notification without asking for it.
Beef production (as well as meat produced from sheep and goats) is one of the most environmentally costly ways of producing food, because of methane emissions [0]. I don't imagine substituting bugs for grass would make much of a difference there.

I myself would quite happily try a bug-derived Beyond Meat burger or similar.

https://www.bbc.com/future/article/20221214-what-is-the-lowe...
There's a big difference between eating trace amounts of stuff you can't totally eliminate (at least not easily) and making it a component on purpose.
This sounds misguided. What do you mean, obsolete? It's largely 17th century maths, 19th century understanding was already pretty good. Have there been a pedagogical breakthrough allowing for igniting a spark in a brain much easier? I don't think so.

What do you mean, reduce to the minimum first order equations? I went to the best technical uni in my country (a country known for quite some orthodoxy in teaching), most people would have had some grasp of differential equations before they left high school. Having the most basic equations revisited with actual rigor was eye-opening to whoever I've spoken to about it.

What do you mean, concepts not tricks? Is looking for a solution in a suitable Fourier representation a trick? Certainly is if you ask me. A mother of all tricks hinting at the spectral fabric of the universe.

Last but not least, he sounds like he has some sort of metric on how well his students apply his enlightened teaching later in life vs orthodox inefficient professors'. I have some doubts on this.
Not sure about jfrog, but Sonatype does something similar. They basically hash all components/packages from a bunch of different repositories, and then tag the hash with various metadata you can use to create policies.

I started using this in my org a couple years back, and we've ended up using it to check commercial software as well just to get an overview of known components, vulnerabilities and things to watch out for.

I really wish the big repositories would invest more in useful mechanisms; when we looked into this before making our decision, the only repository with any kind of checking was Maven Central. Nuget had support for author signing and repository signing, and Pypi (at the time) author signing. As far as I remember none of the other repositories had any verification of anything including the git repo, so you couldn't even determine what commit hash the code was based on or who was behind it.
As mentioned in the description, there's an introductory video. What I probably should have mentioned in the description is that it's highly unlikely you'll recognize how awesome this thing is without watching the video: https://www.youtube.com/watch?v=WA_QNYOSn9g&list=PL69AQIjSnM...
Firebird Pascal API Guide
And related Firebird Pascal API package (fbintf)

The fbintf package provides the Firebird API in a format where all data types for SQL data, interface parameters and results are native Pascal types, including all parameter blocks and database information. The Pascal API is pitched at a similar level and purpose to the IBPP Firebird API provided to the C++ world. The package is intended to be suitable for use on any platform supported by the Free Pascal Compile, and Delphi Win32.

https://www.mwasoftware.co.uk/fb-pascal-api
This is not about cofounder.

It’s a general problem.

It’s always hard to find a decent X, no matter what X is.

Match making just a square of the original problem, because you both have to be good in the eyes of each other.
Is this fact--that the government has to print money to buy its own debt--an argument in favor of debt spending? Do you imagine that this is a free lunch?
Show me an alternative that I can deploy despite developers having both the lack of knowledge and complete indifference of security. They don't care and they aren't forced to conform to any security standards, so a WAF is literally the only thing I can do to try to improve things. I can't rewrite all their code for them. Management hears about a WAF and makes that a requirement and moves on.

If software development was a professional trade group, we could make membership require security training, and industry standards for ensuring security. But that'll never happen. It would mean them giving themselves more work to do, and we all know how lazy devs are.
I suspect that an overall rise in sea levels will lead to extremely difficulties in the infrastructure that loads and unloads ships. Again - it's not that this is "the problem" - it's that such huge systemic changes disrupt things in ways and at scales that we've never previously faced.
> so many Rails apps turn into an unmaintainable mess over years

Does this happen more often for Rails than for other frameworks?

There are many ways in which a Rails project can get derailed. But they seem not different from regular tech debt and I could imagine equivalent problems in other environments.

> AR (as an architecture and as how Rails implements it) is very unfit for a large category of applications

If you plan to build an application belonging to a category where AR is not a good fit, why use Rails?

I wouldn't claim that Rails is a good fit for all problems. Still, I'd say the structure and defaults of Rails are one of its strong benefits.

Or do you mean "application" as in "usage" - i.e. that over time you might notice a problem that's hard to solve with AR? Could you give an example? I'd guess you could use a different approach for a single task, or even move from Rails to a different tool if that becomes a big issue.
I know that some people run Arch on servers, why they do it is complete mystery to me. At least Gentoo and especially NixOS has some legitimate reasons to exist on servers.
Generally no. It's unfortunately extremely difficult to run a good experiment.

Say you want to compare two hiring methods. You'd need to hire a large group, for the same job role, using both methods, and ideally keep the people evaluating their performance from knowing which method was used for which people.

If you happen to find that one method works way better, it may not work in practice, as people leak the interview process and questions asked. Your proposal to see which questions are a good filter is fraught for this reason.
Putting all your eggs in one basket sure saves money as you don't need to buy extra baskets :P
"But efficiently simulating chemical and physical interactions"

Are there real chances, this is going to work reliable anytime soon?
I don't know much about quantum computing, but to me it seems, I rather would bet on GPUs for large simulations (as far as I know, currently they are mostly calculated on CPUs).
How does bringing comfort and peace mean that religion is not irrational? (I don't personally believe it is irrational, just that your logic is flawed.)
Grabcad Down
§23 PatG covers the case where the patent owner wants to use a general public licensing scheme offered by the patent office to avoid having to deal with every single licensee. That one is opt-in by the patent owner.

§24 PatG offers a compulsory licensing scheme, but it requires not only that the would-be licensee made an effort to find an agreement with the licensor, but also that such a compulsory license is in the public interest.

Since the public interest doesn't seem well-defined in PatG, you'd have to check older cases to see how that turns out, but I'm not sure if even "doing so reduces bandwidth use on the internet" is enough: you still have the option of using another codec and compensate the worse compression by going for lower resolution video, for example. 4K video is not a human right ;-)

(and "we hog internet resources" is the last thing Netflix et al want to say out loud anyway: ISPs are eager enough as-is to try to get them to pay up for access to their customers.)
They went through a spectacular system-wide crash a few years ago with Jeffree Starr cosmetics - similar circumstances (despite knowing it was coming, the sale took down storefront and admin for merchants across the platform) and probably learned a few things from that experience. There's some interesting* behind-the-scenes footage on YouTube from that crash: https://www.youtube.com/watch?v=OTCOoVApM_U&t=1811s

*arguable, but I think it's interesting if you've ever been involved in a high stakes ecommerce launch
> ... you could save a lot of trouble by just eating potatoes.

You can simulate visual effects. You can't simulate nutrition. So the analogy seems broken.
The sheer amount of eggs in the GitHub basket is absolutely terrifying to me. If something happens to that thing, the entire computing world will halt.

It reminds me a bit of what the journalism world did by becoming so reliant on Twitter for sourcing and communication, but in our case I think it's deeper and worse. We've hard coded GitHub into countless systems. I'd venture to say that most CI systems, package managers, build farms, etc. would break.
"So I patched hundreds of shaders to inject motion vectors in GTA5" [video]
That seems like Chromium is trying to do some hinting, which would ideally make the glyphs fit better to pixels, but it corrupts smooth transitions.
Vuélvete a Windows
At first I thought Tailwind actually rofl just glanced at html. Cool tool, good job!
> If we could agree on a good, standardized capabilities model for software and everyone starts using it, we will have reached security Nirvana.

I want to get there, but I also don't trust anyone except (maybe) myself to determine what capabilities are "good" versus "bad".

I literally just spent most of today messing with my 2018 Samsung TV trying to get rid of the bloatware they pre-installed. I had to do that because the apps took up 96% of the storage within. These apps cannot be deleted normally.

If we're heading towards a place where vendors are the ones deciding what users are allowed to do, as well as what the software is allowed to do, and at what level of granularity, I have no reason to trust them any more than I trust a russian state-sponsored hacker.
I cannot argue with this too much. A WAF will protect you from unsophisticated attackers - at great cost.

In my group, I am considered to be the WAF SME. Enough that I wrote a training course to get into ruleset tuning.

What I see a lot is customers who are security-focused demanding "OWASP Top 10" protection and then, somehow, not understanding that it is not 10 rules you enable on the WAF. These are people often with application security and other credentials.

Most people I have seen running WAF's are in "Set it and forget it" mode. Tune the rules until it no longer blocks legitimate traffic and call it a day. I think few really understand what it is, and the why of using them.

Another funny anecdote: I had one of these customers talk about how amazing Akamai WAF was, because it never had false positives. Never? Really? That looks like a red flag to me, but they were not concerned.
Seriously though if u think the implications of AI can be boiled to LLM cult hype you are seriously shortsighted.

It's weird since u have a public key on your profile you must be someone seriously into tech. Why are so many skilled tech veterans so naively bearish on AI? Is it pride in the primacy of their skills being threatened by artificial intelligence? Is it an inability to gauge general trends outside their field of narrow expertise?
Well, it all depends on what the "client" "wants".

The problem often lies with the client tantrums.

I was more talking about critical online services which have a duty of interop with Small Tech and must not force users into Big Tech engines only, that to keep the door open to alternatives of reasonable "size", and at the same time to lower significantly exit costs.

But that's smashing open doors, most are aware of those issues here on HN. The real issue is implementation: it has to happen in a regulatory framework, laws dealing with discrimination, and my lawer has been looking into other legal leverages (yeah, I have an open conflict with my administration). The regulatory framework is here, but lobby-ied heavily by Big Tech, making it ineffective and pointless.

A bit like what they have in the US with the "utilities" which then have much more regulatory duties than "non utilities". You also have anti-trust stuff: dominant corpos are much more tied to regulatory constraints, that to let alternatives to be viable (well, that does not seems to work very well in the US). In my country, anti-trust ultra-aggressive regulations did wonders in the telecom industry.

You can still have a web app with a rich GUI, an anonymous simple and stable in time public HTTP-based middleware protocol (which allows to develop Big Tech independent rich GUIs), etc, until the core functions are provided to noscript/basic (x)html browsers (if one thing must work, it is this one).