skysight-inc/HackerNews huggingface dataset:
Here is my opinion: WAF is a tool, use it where it makes sense. Don’t use it where it doesn’t make sense.

I’ve seen many use cases where deploying a WAF solution was completely reasonable and the problem couldn’t have been solved in the application code. And let’s not forget often you have to run applications that were written by other companies, and you still need an additional layer of security.

—-

These “stop using X” articles are really pointless (and boring). They also misguide the people who have less experience in a particular field.
Auditors pretty much only certify that you have told them you are doing what you are supposed to be doing. They are not logging in to your servers and verifying that an AWF is running in front of your web server. They are not probing your network from the outside to see if an AWF is blocking their activity.

Just as financial auditors are only confirming that your financial statements match what your accounting department tells them.

If you lie to your auditors, there's a good chance they won't catch it because that's not what they are looking for.
> I don't see how you can really get a decent grasp of quantum with an undergrad.

It's just marketing. The degree will end up being the same as Physics. Just you have to take any QM optional classes that were always available.
Should I solve it with AI?
Good questions.

> How will you deal with files that are purposely broken, or which cause the parser to take impractical (but finite) times to complete?

I've never seen a language parser do that, but if I run into a language that does that, I'll probably have my VCS track it at the file level, based on tokens or lines.

Dumb languages don't get nice things. :)

> How will you maintain a history when most commits are likely to contain unparseable code and so break the continuity of objects?

This is less of a problem with binary files (assuming the source software does not have bugs in output), but with source files, you're right that that problem does exist.

As of right now, I would do a token-based approach. This approach removes the need for whitespace-only commits, and if I track the tokens right, I should be able to identify which right brace used to end the function until the broken code was saved. Then I would just save the function as broken using that same right brace.

For example, say you have this:

int main() {
return 0;
}

My VCS would know that the right brace corresponds to the end of the function.

Then you write this:

int main() {
if (global_bool) {
return 0;
}

Yes, a dumb system might think that the right brace is for the `if`.

However, if you break it down by tokens, the VCS will see that `if (global_bool) {` were added before the return, so it should be able to tell that the right brace still ends the function.

I hope that makes sense.

Another plausible way to do it (at least in C) would be to look for things that look like declarations. The series of tokens `<type> <name> <left_paren>` is probably a function declaration. Java would be easier; its declarations are more wordy.

I still have to prove this is possible, but I think it is.
Taylor Swift merch drop just happened
So basically: build a port and a train station at both ends, and move containers through railway?
Have you ever tried the Gandalf AI game?[1] It is a game where you have to convince ChatGPT to reveal a secret to you that it was previously instructed to keep from you. In the later levels your approach is used but it does not take much creativity to circumvent it.

[1]https://gandalf.lakera.ai/
another examples - Amazons results for simple products are just filled with trash
> it just feels a bit wrong to train a model on model outputs

If you have a small student model and a large teacher it makes sense, the student is better off after this distillation.

If you have a way to filter out low quality synthetic examples then it would be useful to generate a bunch more and take the best.

If your LLM is an agent, then it can generate feedback signals from the environment. Even a human-AI chat is a form of environment for the model. Every human response can be evaluated as positive or negative reward.

More fundamentally, organic datasets are very unbalanced, LLMs need more complex reasoning chains than what is usually available. There are some exceptions - in scientific papers, manuals and code you get very complex reasoning chains. But not in general. This issue can be fixed with synthetic data.

And even in principle, if you have a model at level N and want to make a dataset at level N+1, then you need to boost your model. You can give it more tokens, more attempts or more tools.
Looks like a good number of the H.265 patents will be expiring in about 10 years now, so maybe 2033 would be good.

A major defect is really in the policies that allow standardization to include encumbered technologies.

Otherwise consensus standards among established leaders which do not require the removal of encumbrances before standardization, will give rise to what we have now as "patent pools" where only well-established organizations can deploy the standard after is is approved.
Estonia doesn't really import any electricity from Russia, it's primarily export. Also these connections in general are for cost and fault tolerance. Estonia has enough domestic power plant capacity (including domestic shale oil mining to fuel it) to cover even peak usage. It's just often cheaper to import from Finland.

There are also a lot of renewable energy projects in progress to replace the shale oil systems, but again - capacity isn't the issue.
> you would be contaminating the Pacific with Atlantic water

Ahh that's what must be making the Drake Passage so angry.
"HBM4 in Development, Organizers Eyeing Even Wider 2048-Bit Interface" (2023) https://news.ycombinator.com/item?id=37859497
I certainly wasn't picturing a standard rail gauge, or even a single pair of rails. But now that I'm looking at how high they stack containers on ships, I can imagine that "add more wheels per axel" might not suffice.
if the wings are not retractible on the road - then it's a plane.
some people even claim they get ~50ms on (powerful) consumer hardware (e.g. RTX 4090).

we still have not been able to replicate those results; also because we want to do it in a distributed way
> Obviously the dynamics of this will be per-country, and in a country like Germany which is predominantly cash-based my argument is not true, in a country like Sweden or a city like London it is.

What's the difference between these places? Is it cultural? Maybe a little bit. But it's largely due to governments constructing artificial incentives. And why do governments do that? Because they have an incentive to do so. Collect taxes, "stop crime" (which necessarily means tracking subjects), you can use the word "conspiracy" to dismiss it out of hand but this is happening because governments want it, it is not happening organically. Note I'm not talking about the appeal of electronic payment, I'm talking about going cashless.
Same, I was checking usernames to see if I recognized any as former co-workers where we had to do this.

I guess there's just a decent market for the product everyone trying to check that box, though.
A few points.

PCI-DSS does not mandate the use of a WAF. It is one of two ways you can fulfill requirement 6.5 or 6.6. WAF + OWASP Top Ten ruleset is typically easier to get evidence for your auditor, but you can show that continuous scanning using a DAST scanning engine to meet requirements.

I would have a WAF installed with very few highly tuned rules against mostly SQLi. Why? Because the damage of letting that through and praying that the developer or web-app framework does it right are significant. The rules for SQLi are pretty easy to get right and dropping that traffic before it gets to your web server is a reasonable thing.

I would have a WAF installed with no rules too. It is nice to have something there where you can drop in a Log4J rule and get protection relatively quickly for attacks of that nature. There have been a number of these over the years and a small performance penalty seems worth the big picture safety net.

I am against the pricey models that the cloud vendors push. WAF can get expensive. They typically are bundled with other cloud services, but hey, if you've gotten that far, you are probably outsourcing most things to the cloud provider anyway.

I do not like WAF pragmatically because it lets the developer off the hook in many ways. There is something there doing their work for them and another reason for some developers to not understand or care about the security of their applications. Something else will do it for me whether I know this or not.
That's my point, we might regain an ounce of privacy in public.
I think this sort of comment needs a lot more care and detail put into it, and preferably some citations for the algorithms you’re thinking of.

There’s more than enough hype around quantum computing with adding to it like this.
I'm well aware. I think of the $99 printer as a filter - either it's going to catch your interest enough to justify jumping to a $600+ printer, or 3d printing isn't for you and you aren't out much.
When reducing those hours, do they reduce pay in proportion?
I'm a huge fan of using Alpine with the RPi due to reducing writes to the SDCard. it will only save data to disk with a lbu commit -d and by default boots into a kind of tempfs.
I'm not so sure that it would make such a huge difference that it would be an immediate disaster, across that kind of distance there are plenty of examples of more elevation, what you would have is a river flowing one way instead of two rivers flowing towards the see. Not unlike any other island that the sea flows around.

Or is there something in particular that would make this connection into a disaster area if that flow got started?

The length of the canal is about 75 km, a few dozen cm across that distance would be on the order of 0.04 mm / meter, which is barely enough to make water flow in a particular direction.
Many companies I know don't reason so black or white. You can always find compromises, by making it attractive for employees to gather once or twice a week (e.g., free breakfast on wed), for example. That's good enough for many.

> If a company wants a hybrid solution where some employees WFH and some work in office then it's going to be dissatisfying to those who want all employees in office.

Right, but why should we care?

Extremes are specific situations that must be addressed differently: I want full remote, does my company allow it or not? If yes, ok, if not, either I leave, or I find another way.

Same applies for people wanting everyone at the office: things have changed over the years, why do we want or need that? It's a decision that forces 80% or more of the workforce to behave in a certain way, just because some people have a very specific need.

If someone wants everybody at the office, it's his/her own problem to deal with, as the person who wants full remote, yet forced to meet with colleagues from time to time. Extremes have huge impact over each other.

You can't make everyone happy, but it also means you should not take away a huge benefit for many. This is why I like how some companies are doing, and yet it surprises me to read that some companies are just back to precovid like WFH never existed. It doesn't make any sense.
If you're looking for an enclosure for your hobby ESP32 project, there are lots of off the shelf, small enclosures available:

https://www.amazon.com/s?k=esp32+enclosure

If you want to sell a more finished commercial quality project and don't want to print your own, there are places that will fabricate one for you (but in low quantities, having them 3d print it probably cheaper)
your comment could apply equally to (urban|rural) areas. I see no distinction, "handle our own business" could mean the urban credo "stop snitching". police are an hour (-drive) away could mean police are investigating a more serious offense and won't show up to your 'hood.
> magically the code has a become secure!

The code hasn't, but it would be a lie to say that the application hasn't, and as a leader of ops teams while I can't directly influence code security & quality, I can damn sure influence overall security by demanding a WAF.

Defense in depth is an important concept in security for a very good reason.
No, but that doesn't mean that there's not a difference between being intelligent and giving a good impression of intelligence. Subject matter experts quickly determine that LLMs are always confident sounding but often incorrect in a way that humans would not be (experts don't confidently state something they are uncertain about or which they don't know at all).
I'm a believer in the strong AI hypothesis - machines/AI can and probably will be actually intelligent at some point, but LLMs are definitely not that.
Those of you who are interested in this stuff, checkout https://www.marinetraffic.com
> This whole red-green step in TDD makes complete no sense when you're writing new code.

Only viewed in isolation - the point of red-green is test calibration: be certain that your new experiment is actually measuring the thing that you think it is measuring.

Red-green isn't the only way to achieve this, of course, but it is a smooth way to achieve this.
There's an unofficial "spin" of Fedora targeted at gaming that might be worth a try: https://nobaraproject.org/

Personally I have separate gaming and Linux machines because I play games with Windows-specific anti-cheats.
My take is: As explained in the article, user-avatar does absolutely nothing. If anything, it could only enhance the existing markup (with behavior), but never replace it. It’s… semantic markup, if you will.

Baloney if you ask me.
So which is it? Reading the last few HN threads about quantum computers gave me the impression that we don't even know if there will be any practical use for them, as they seem super specialized, and there are technical challenges that no one knows how to solve. I'm confused.
There is radioactivity which was (and still) one of the most important aspects in physics (nuclear physics) and it is mainly about describing decaying state. This is using non-hermitian QM. Because of hermitian operators giving always real eigenvalues (This exercise is left to the reader) we can see (and prove) that non hermitian operators will give rise to complex eigenvalues whose imaginary eigenvalues mean that the probability of finding the particle decreases exponentially with time (decay).

That is actually an approximation that will violate the QM postulate that evolution shouls be unitary (and probability is not conserved obviously).

People who study that in a more rigorous way will go and define somehow bigger Hilbert space that not only include the particle (atom) but will also include the decay products and only when you solve the system with the states of mother plus daughters you will return to your ordinary simple/ish quantum mechanics.

The idea is that the decrease of probability of finding the particle will be opposed by increasing probability of finding decay products. So the total probability will be conserved and we will have unitary time operator.

Hint: It is not simple as ordinary QM when you sometimes have to worry about resonances, mixed states and modeling these things mathematically is much difficult that solving your ordinary hermitian hamiltonian.
That's like a now-defunct startup I worked for early in my career. Their custom scripting language worked by eval()ing code to get a string, searching for special delimiters inside the string, and eval()ing everything inside those delimiters, iterating the process forever until no more delimiters were showing up.

As you can imagine, this was somewhat insane, and decent security depended on escaping user input and anything that might ever be created from user input everywhere for all time.

In my youthful exuberance, I should have expected the CEO would not be very pleased when I demonstrated I could cause their website search box to print out the current time and date.
I find that a lot of people seem to wait until they feel like "adults" to take on responsibility, and then end up passing up their life (or too much of their life) waiting.

Out of all the things in my life that are "adult" (eg, being responsible for people at work, and wife/kids at home) happened before I was totally sure I was up for it. And it's only through diving into those challenges, and growing through that experience, do I feel like an adult now in retrospect.

It takes a little confidence or good peer pressure to get into that.

One "signal" I have of adulthood is that I value "their" experience over "my experience." EG - if I am super-tired at the end of the day and only am kinda enjoying playing with my kid, but then I recognize that he's having fun because I am there with him, and knowing that this is what matters 100%.
DVDs are the only realistic way I have left of getting most older movies (and Blu-Ray for newer movies). I'd be thrilled if the format gets a resurgence!
Interesting that the video only posed how labor intensive an excavation would be, but not the differences in sea level as a blocker. I suppose it would be related to how wide the canal is?

Of course I'm not a subject matter expert on this, just wondering what options exist today that didn't before.
The core contribution of "Attention is All You Need" is logistic regressions
Open-but-backlogged is OK!

I'm sorry for using such harsh words; I was flabbergasted and lost my calm. As for why, there's so many reasons that it's hard to find where to start, without launching into a thousand word essay.

- Usually closed means either this has been done or else we've thought about this and decided it doesn't need doing; closing a ticket just because it's old adds noise to that signal, especially when you can already filter by date.

- Creating new tickets that are duplicates of closed tickets also adds noise, time and confusion when searching for those issues, and for people who were monitoring those tickets, and can make the status of the work unclear to people other than yourself.

- Tickets are valuable documentation; duplicating tickets is duplicating work.

- There are many possible reasons why someone isn't hounding you every six months about an old ticket, which aren't all "it doesn't matter anymore". Maybe it's not their personality to do so. Maybe it's because they thought they already did what was necessary: create the ticket and leave it in capable hands. Maybe it's because they got frustrated and switched to a different product.

- Priorities shift over time, but not always in a direction of older --> lower priority. Sometimes everything gets swept off the table to fight a fire, but once the fire is out, the old stuff becomes high priority again. Sometimes a blocking issue needs to get resolved first, and that can take time. Sometimes a ticket requires a lot of resources that only become available down the road.

Etc!
Do you have a source? What priced people out can mostly be attributed to the historically low mortgage rates
Not exactly the answer to your question but some idea of the scale of the problem
https://www.sciencenews.org/article/where-earth-stores-its-c...
TLDR, it's estimated the vast majority of carbon on Earth above the crust is in the ocean.
it is not a joke, you can do as low as 1.10870 cent per custom chip or 2 cent per off the shelf chip. 0.03 cent is impossible, the minimum size of a chip is .625 mm2 and that sets the minimum price.

Designing one for $3K is possible because I already have a tested chip design that I just have to modify for you.

A master student project is usually a free design with a free tapeout at Google MPW, Mosys of Europractice.

I also design bigger chips and $500 wafer scale integration with 10000 cores : https://vimeo.com/731037615
You're a genius. Quantum Blockchain that lets you bid on an NFT lootbox being in a particular superposition. Based on the probability, the price will be higher or lower. And immutable. Or something.
The thing about enclosures is that they are pretty design dependent. Nobody knows what you are hooking up to your board or what the intended purpose is. Some boards do have generic type cases, e.g. raspberry pi cases.
So a WAF is something you deploy to man-in-the-middle your own traffic, but it is ok because "you kind of know the guy in the middle"?

Please inspect all my HTTPS traffic, I terminated SSL, so you are free to modify the HTTP, no one will know, we trust you completely!

Why is this a good idea exactly?
> They're actually the least potent.

Doesn't much matter when we are releasing them by the gigaton.

> Possibly creating a feedback loop according to limited computer models focusing strictly on local conditions and explicitly ignoring global ones.

You don't need computer models to see that warming -> melting permafrost -> more methane -> more warming -> more melting permafrost -> more methane...
I thought you were kidding but that’s exactly what my feed is conjecturing on socials.

Wow. That is some next level entertainer scale.
No, thorium reactor disasters are way more limited in worst-case scenario harm than any of the disasters I mentioned.
What do you see as a good alternative to Ubuntu today?

I've used Debian, but the installs feel so barebones. I love that Ubuntu has many of the common packages I need, yet it doesn't feel bloated.

Additionally, most software that supports Linux has instructions for Ubuntu, or Ubuntu just feels better supported.
I love marketing. Without it, I wouldn't have been able to have successful businesses and likely wouldn't be able to have a dev job.

What I hate is scummy marketing, and most marketing I see (especially on the internet) is scummy marketing.
I think it's like voice recognition, which was overhyped in the 90's, then quietly made its way into phone trees, and cars, and now phones so it quietly works everywhere now. I think it used to miss a lot of stuff in the beginning, and that is conflated with missing words occasionally nowadays even though the field has advanced tremendously. which might be analogous to fighting cancer.

I personally know many people who have gotten and then gotten over cancer.
Ask HN: Why is it so hard to find a technical cofounder?
why is it so hard to find a technical cofounder, someone who can actually code ? I have tried YC cofounder matching and it is awful. People ghost you for no reason. People pretend to be technical but once you discuss with them you realise they can't code and just want someone to build their projects for them. I am Looking for someone to work with on interesting projects around open source LLMs, AI in EdTech or AI in Finance. Tech stack: ruby, rails, python, fastapi, javascript/React, PostgreSQL, heroku.
Here are some projects I did alone:
http://discute.co
https://www.rimbaud.ai

If you are in the same situation or would like to have a fellow coder to work with, drop me an email: ndzomgafs@gmail.com
People don't cover their ass out of fun, they do it because getting blamed for something later is a real problem that can actually hurt you.

Playing social games is non-optional.
Is there a way to show how many lines I’ve selected?
> lackluster with no "Batteries included"

I wish this weren't so, but it perfectly describes my experience with every single web technology. JavaScript, DOM, Canvas, Web Audio... they all remind me of this quote:

"Beware of the Turing tar-pit in which everything is possible but nothing of interest is easy." -Alan Perlis
Style Guru: fashon advice GPT
Post a picture of yourself and this just released customized GPT will give you style advice (requires a GPT Plus subscription)