skysight-inc/HackerNews huggingface dataset:
The suggestion in the article was simply that his 386 was a crappy early one that may also be slightly defective seems plausible. IIRC the 387 was a full 386 plus the floating point logic, and when you installed it the coprocessor took over most of the processing and the 386 was reduced to being a data broker.
Google's own Chromecast with Google TV 4K that is still their higher end Chromecast doesn't support AV1.
Most people who utilize this hardware aren't programming kernels directly for the GPU, they're using abstraction layers like pytorch, tensorflow, etc. For the developers of those type of frameworks, cuda itself offers a lot of libraries like cublas.

There's relatively few people capable of implementing these frameworks without a solid cuda-like foundation, and those that do exist would need a very strong incentive to do it.
Whether it's LLMs some other new groundbreaking architecture the trends and underlying principles are undeniable. To think it's just another hype cycle at this point is silly, and it's crazy how many people look at crypto and AI and think they're remotely similar.
Balancing GPT-3.5 and GPT-4 for cost vs. performance in game dev
Is there no way to contest such a warrant? What about compensation for the loss of utility caused by the confiscation?
Leverage in Chaotic Systems
Keccak is my preference. Keccak is substantially easier to implement in hardware: fewer operations and no carry propagation delay issue because there's no addition.
Data I can get back, but I'm concerned about how this could have happened?

Very good that you have backups, it could have been worse. Were any ports from your app or PG itself exposed to the web and are there associated web application access logs enabled that were relayed somewhere off-host? e.g. port 5432 for postgres.

Do I have some virus on my computer?

Yes, that is ransomware. [1]

[1] - https://www.imperva.com/blog/postgresql-database-ransomware-...
Fragment identifiers are not sent to the server.

query example should have both ? and & like

?foo=1&bar=2&baz=3

Perhaps behind the path/to/whatever have a /filename.XXX

Also, the story on the www "subdomain" is missing.
Usually a black abs box will do
Feels like you could replace WAF with DLP, EDR or most any other 3 letter abbreviation... Or indeed bike helmets. Vendor push + industry ‘best practice’ tribal knowledge is tough to resist.
Why are these just blobs?

Ferrofluid should be able to visualize all kinds of field lines, no? Why aren't these showing Lissajous-like patterns?
This ad brings out the inner kid in me (I'm 44 so, feeling a bit middle-aged here). I so want one badly but can't afford it and there's no way I'd be able to justify the purchase. Sad.
Yep. A few years ago, I pulled an old HT out of my junk drawer and one of my old Linux laptops, and copied an SSTV transmission from ISS.

https://i.imgur.com/Mc8pOkH.png
are you trying to make the argument that all mining that involves human labor is unethical?
All military technology in the us is built by the private sector, and much of it is operated by the private sector, like the military communications.

One of the major problems in Ukraine’s case is they depended on the private sector _without a contract_ leaving them up to the pro bono will of the owner.
Humans could travel through time
Not someone's head. The heads of the people permitted to make and enforce rules.
> From what I can see, BLAKE3 has 256 bits of security, and extended output doesn't provide any extra security.

128 bits of collision resistance but otherwise correct. As a result of that we usually just call it 128 bits across the board, but yes in an HMAC-like use case you would generally expect 256 bits of security from the 256 bit output. Extended outputs don't change that, because the internal chaining values are 256 bits even when the output is larger.

> extending by re-hashing the previous output and appending it to the previous output

It's not quite that simple, because you don't want later parts of your output to be predictable from earlier parts (which might be published, depending on the use case). You also want it to be parallelizable.

You could compute H(m) as a "pre-hash" and then make an extended output something like H(H(m)|1)|H(H(m)|2)|... That's basically what BLAKE3 is doing in the inside. The advantage of having the algorithm do it for you is that 1) it's an "off the shelf" feature that doesn't require users to roll their own crypto and 2) it's slightly faster when the input is short, because you don't have to spend an extra block operation computing the pre-hash.

> what's the point of extended output?

It's kind of niche, but for example Ed25519 needs a 512 bit hash output internally to "stretch" its secret seed into two 256-bit keys. You could also use a BLAKE3 output reader as a stream cipher or a random byte generator. (These sorts of use cases are why it's nice not to make the caller tell you the output length in advance.)
F is a forcing function, not the resultant force. It’s often arranged this way with all the derivatives on one side (as opposed to having the resultant force, ma, on one side of the equality by itself) so that it matches the general form of a non-homogeneous second-order linear differential equation.

(At least I assume this is what the original commenter meant!).
People here testing out the example on this page and reporting errors seem to be missing the fact that this demo is "trained" on one example. The linked paper[0] goes into error rates, and they get better pretty quickly with a few more examples.

[0]https://faculty.washington.edu/wobbrock/pubs/uist-07.01.pdf , page 8
Ruby is much more straightforward than Python or JS IMO. But Ruby devs tend to love metaprogramming a lot more (IMO) which can seem obtuse.
And this is also how we got Walmart and Amazon.
Or even do what what CloudFlare did [1] and transpile all the slow ModSecurity rules to Lua and deploy OpenResty at the edge. Run them in nginx+luajit.

[1] https://blog.cloudflare.com/cloudflares-new-waf-compiling-to...
Magic: The Gathering Black Lotus card sells for a record $540k
To me this blog post doesn't fully make its case, though has many good points and is a good read.

I think my main logical objection is that the alternative best practices at the end of the article were all security best practices before WAFs existed. Which makes me ask the question, why did WAFs come into existence in the first place? Did the founders of those companies convince customers they needed them without those customers actually need them?

I think not. In the years before WAFs existed, I was in the position more than once of being in an organization whose web application security footprint had grown to the point where we ended up writing a home-grown version of a WAF. E.g. adding an interception layer that would analyze inputs and outputs for typical security violations.

Why? Well, first because it started to give us a sense of the types of attacks that people were trying to use. Second, because the types of mitigations mentioned by the author of this blog post aren't the whole story. You can audit that your entire system avoids SQL injection attacks via stored procedures, then your company buys another company with a code base that fails such audits. Or someone attacks by leveraging your caching layer which stores and sends back unaudited key-value pairs. Perhaps (this has happened to me) a bug gets introduced into the deployment system, and the code that forces authentication is not shipped, and the calling code doesn't properly fail when the auth checking code isn't in there. A real head slapper in hindsight.

I do like the best practice of process isolation around APIs, and only allowing APIs to have the privileges they require, but in practice, if there are hundreds of APIs undergoing frequent changes, the complexity of managing that becomes a security risk in and of itself, because the ACL rules are deeply complicated.

Relying solely on a WAF seems like a bad practice. But also relying only on secure design philosophy is a practice with plenty of historical failures.

So if the point of the article is that WAFs breed complacency, I agree with that! But if a WAF is used as an analysis, auditing, and fast-response layer, alongside following secure design principles, then I'd say that based on personal experience, if WAFs didn't exist, people would write home grown ones with their own sets of flaws.
Yes. There’s plenty of YouTube channels exploring this if you’re interested.

https://youtu.be/nZ3Zc1DJOgY
This happens to me when I’m away at a convention or some vacation, and then the last two days arrive. For several days, one has no thoughts of home, nor travel arrangements, nor often, of driving. And then the day comes when you have to clear out of your hotel room, and attend sessions while the staff are trying to stack up the chairs. And then someone plays some airs on a bagpipe (YMMV).

Or on a cruise, on embarkation day, when you are just getting accustomed to relaxing, and they put the Port Valet [1] form in front of you, bringing to mind all the chaos of disembarkation and airline travel.

One must enthuse as much as possible when the days are good.

[1] You put your packed bags out for baggage handlers on the last night and you expect to see them at your destination’s baggage carousel.
> Even failure within the warranty period is acceptable in the consumer market because integrators have it down to a science exhausting people on the customer support side.

This has been true for at least decades. It's why I completely ignore all warranties when I'm deciding what to purchase -- they tend to be essentially worthless, once you factor in the cost of trying to make a warranty claim.
The least controversial movie ever
It is such an absolute overhyped nightmare of a distro. If there were a shame corner for Linux distributions, Manjaro should be one of the biggest offenders.
Suddenly San Francisco is cleaned up [video]
Roundup of Events for Bootstrappers in November 2023
There are fundamentally two kinds of attacks, preimage which splits into two:

In a first-preimage attack, you know a hash value but not the message that created it, and you want to discover any message with the known hash value; in the second-preimage attack, you have a message and you want to find a second message that has the same hash. Attacks that can find one type of preimage can often find the other as well. A weak algorithm allows this to be done in less than 2^(hash length) attempts.

And then there is collision: two messages which produce the same hash. A weak algorithm allows this to be done in less than 2^(half of hash length) attempts.

Source: https://www.rfc-editor.org/rfc/rfc4270
> Sure, the article is incomplete in the sense that it doesn't fully commit to the idea of HTML Web component

What is that, exactly?

> By putting all your templates in the backend you can render them as a whole document or in parts in one go and send them wherever,

All frameworks can do that. Web Components cannot.

> If you always start with a JavaScript function, and all that comes with that, you need a programmer to be able to create the web, but with HTML (and CSS) first you can have other categories of people do that, like designers.

Web components quite literally don't work without Javascript. And they need Javascript to be able to do trivial things like form participation.
Duospace fonts are limitedly proportional, but still with no upsides of monospace fonts. Rather than that, I recommend something more proportional like iA Writer Quattro, Input Sans and Recursive Sans.
https://input.djr.com/
https://www.recursive.design/
Using Databases Inside GitHub Actions
"I literally just spent most of today messing with my 2018 Samsung TV trying to get rid of the bloatware they pre-installed removed."

Can you elaborate?
I think you have an unrealistic and unfair set of expectations here.

Most climate change models are designed to try and predict certain events over others - i.e. sea level rise, overall temperature change, etc. It doesn't really make sense to expect the IPCC to produce a model that accurately predicts drought in Panama (and no one is claiming they have?).

There are a bunch of broad-stroke descriptions about climate change. Generalizations about what it may change. Those are what I invoked. We expect droughts to get worse. Specifically, though it's hard to say how or where or what, we should expect to see more 'rare' events (that are probably not 'rare' anymore but we kind of lack the data to check).

I guess I would ask you if you apply this level of skepticism to any other predictive practice. Pairing general predictions ("more drought") with targeted models (estimates for sea level rise) is a pretty common practice.
Good point. But there are questions around the long-term safety of seaweed additives. And how many farmers would pay for seaweed while methane is free to emit?
Making a phone call doesn't require the phone to "listen" to you, i.e., to understand what you're saying. It's just encoding an analog signal from your microphone so it can be reproduced for the person you're calling. Our laws make a big distinction between this, and having a third party listen in on what's presumed to be a private conversation.
We actually can and should hold people and companies responsible for doing unethical stuff.
> Maybe you come back saying "it's somewhere in this eldritch spaghetti, and when I stared into it the abyss starting back at me sent chills up my spine and the pictures on my walls wept blood, please don't send me back there" and it's clear it's not worth pursuing any further and we drop it.

I wish I could give my status updates like this.
I wouldn't use those crusader stat points in my personal life. Unless other character incompatibilities are already apparent.
Absolutely this, knowing what's _important_ at the end of the day. Must haves, nice to haves, not needed. We all only have limited lifespans.
It could only handle so much traffic.
Nothing wrong with that wish, I am just giving the answer to the question posed in the title, and to the first sentence of the text ("why should you use Lazarus in the first place")

(I used to program in Delphi back in high school, and so I am interested in the FPC/Lazarus news.. maybe it's finally time for me to go back to basics? But at least this article's main argument does not sound very compelling to me.)
They're grown in factory conditions much like how we grow fish in closed synthetic systems.

Your concern isn't so much about how they do it, it's about the regulations and how well they end up being enforced.

Admittedly, humans have a poor track record for getting that stuff right the first go-'round
It might be a non-issue but it was certainly interesting to discover that an app can have "only in-use" permissions yet trigger location based events while closed.
only if you don't like documenting your APIs
> Clarify the expected time investment: “Please look into this for me. Do not, DO NOT, spend more than 20 minutes on this. Please come back with whatever you have after 20 minutes.”

For someone like me, this also adds a lot of stress (which over time turns into demoralization and inefficiency). I gotta watch the clock while I'm doing the thing, and maybe optimize my approach for time as I'm going. What if I'm a little distracted that day? Did I get so few results because I'm bad at this or because it was actually complicated? Do I turn it in half done or spend another ten minutes and not tell him?
How does ArchLinux + OpenBox (e.g. ArcoLinux OpenBox) compare to these Desktop Environment?
You'd think that, but I had an auditor that had guidance requesting confirmation of security cameras on the servers. They wanted to drive to the AWS data center to see the cameras. If the drives got stolen, you'd better make sure AWS shares that video with you.
Not a lot of money compared to the burden of carrying a ship-lod of valuable cargo for the extra period.

Cargo insurance, carrying cost of the capital tied up in the cargo, running cost for the ship, opportunity cost of doing another cargo run in that time…
Coronary calcium scores highly effective in identifying heart disease
I believe the 387 was an actual coprocessor; the _487_ may be what you're thinking of -- the 487SX contained a whole 486DX inside and just disabled the host processor [1].

[1] https://en.wikipedia.org/wiki/X87#80487
Windows packages usually also require strange and disparate updates to the registry database.
> I would try to fix this first. You're putting constraints/feelings onto email that other people don't. Just fire off an email with your question(s). Unless you're emailing the CEO or something, just type your questions stream-of-consciousness and hit send.

Hard, HARD disagree from me. The point is not at all about formality or appearing bad towards your boss, it's about avoiding misunderstandings, confusion, and endless followups that multiply the latency and further increase misunderstanding and confusion.
I don't agree, what you call "back-and-forth" is not negative, actually it appears more like "consistency" to me... and in the end, more than enough for a bazillions of online services and that at a ridicule technical cost compared to the one from Big Tech (not to mention all the corollary issues).

Of course, it is a trade-off, bells-and-whistles from rich GUIs are sexy, but the technical cost of such bells-and-whistles in a web context is grostesquely and absurdely unbalanced compared to what can be achieved with simple and consistent noscript/basic (x)html portals for any pertinent goal of a bazillions of online services.
AliExpress has a number of companies selling the "generic black rectangle" that looks a bit like an Apple TV now. I've been meaning to buy a couple and see what they're like to work with, because that's the overall effect I really want - something that looks like a router or generic company product.
...we need to invest into those countries and build them up much like we built up some countries

I find investment like this quite a problematic. It makes places, that would be naturally inhabited, artificially alive with huge cost. It's not sustainable approach.

i agree that there are problematic investments, but the statement as it is is way to generic. consider some african megacities, like kampala in uganda that i was able to visit recently. the city has literally no public transport infrastructure, roads are in a bad shape and growth is uncontrolled.

it will take a massive investment to make that city livable. ideally, that investment comes from local sources. i am not suggesting that foreign funds should just swoop in and spend money without cooperating with locals to consider their needs. but a better infrastructure is definitely needed.

i am also not talking about grants. that's charity. an investment is something that has the expectation of a return of some form. i agree that learning how to obtain capital is important. what i was thinking of is to do more trade with those countries. fair trade, not the kind of exploitative trade that i referenced as example.

They will serve to power. Because being elected in democracy means being a populist. It's not about serving to people at first place. You cannot win elections with this in democratic system.

that is something that we need to change. the only way i see that this can be achieved is education. it will take decades, but it is not out of reach to teach us how to build a society that fosters unity and cooperation instead of competition.

If you grow up in pathological environment, later you spread same behavior.

this too can only be counteracted with better education.

I prefer dialogue, going out from comfort zone and cultivation of mind by active socialization.

i agree. this is part of it.

giving one vote to someone, who is chosen by party or promoted by public opinion polls is just an illusion of free vote

exactly that is how i see it too. which is why i conclude that the current systems are not democratic.

more dangerous is a thinking, that we have perfect democratic system and there are no other options

very much so.
I get it and the points made here are valid but, the reality is that the teams deploying the WAF + infra and the team writing the insecure/secure code are different teams with different roadmaps. We have to deploy a WAF because the developers are not writing this magical unicorn code that follows all security best practices and gets refactored once a week. There are vulnerabilities, issues etc. that need to be addressed just like any app. SO yes, WAF is necessary.
It definitely can, depending on what you are looking at. Something like a fully analog, polyphonic Jupiter-8 that still works 40 years after launch? Easily $20k+. A simple monophonic "learner" synth usually has one knob per function so it's easier to learn how synthesis works at a fundamental level, so a lot of people start there.

These are usually also priced for beginners, more or less, where a used Arturia Microbrute is about $200 and a used Korg Monologue is about $250. Then you can start getting into a lot of different design philosophies for everything in the middle. There are also a lot of digital hardware synths which tend to use frequency modulation so they can make some pretty crazy digital sounds.

If you go completely mad with the power, people love building eurorack modular synths one module at a time. It can end up being a really custom rig you can kind of "play" but of course, this is on the expensive end as well.
According to another poster about 2 weeks at ~ $285k per day, so about $3,990,000 extra. Depending on the cargo and late penalties $4.5 mil is in the range of acceptable charges.
The Problem of West Bank Settlements
> had a 33% chance of living for five more years if you were diagnosed with prostate cancer.

This is patently false. Only late stage prostate cancers are killers. In most cases you catch them early on.
I would imagine that opportunistic, omnivorous eaters have a higher likelihood of passing a parasite over some insect that only feeds on live/fresh plant materials.
You mean we should make companies pay hefty fines
North west passage...
A simple "WAF" can be implemented without hardware or anything overly complex by doing just a three things that will eliminate most malicious traffic.

• Block all traffic from AWS, Azure, etc. yeah, you'll loose some traffic from some VPNs and maybe you care and if so, this suggestion isn't for you.

• Verify the traffic saying it's GoogleBot, BingBot or DuckBot are really from those sources. All three provide a list of valid IPs accessible via a REST endpoint to match incoming IPs against. Block Yandex etc. There is likely no good for you coming from a Russian or Chinese search engine indexing you.

• Make sure the browser versions in the User Agent aren't like 5 years old. That's a great indicator of a bot.
I'm not a consistent machine though. I may be having an off day. If I don't pull it off in 20 minutes I'm not sure if it's just me, or me that day, etc.
Or the ever annoying "learning" instead of "lesson".

"Key learnings this quarter"...
I would quibble with one line: protesters "saying that they ' hold the Israeli regime entirely responsible for all unfolding violence' is not "blam[ing] Jewish victims for their own deaths". It is rather drawing a distinction between the conservative (and I think one can fairly say "colonialist", given their actions and stated aims in the West Bank) government, and the Israelis who have vigorously opposed its regressive actions.
Can you expand upon why you think it is likely to be rejected?
At the very least, you'd think more people would be willing to, say, keep a consistent meat consumption of 50% their current level.
> We're out there using drones to fight crime

They will be used in anything but to fighting crimes.