skysight-inc/HackerNews huggingface dataset:
> TOTP + password manager is more convenient (and more online) than yubikey, in my opinion. Especially convenient with a browser plugin.

More convenient than yubikey webauthn, or just yubikey TOTP? Personally I find tapping my yubikey much easier than any 'enter the code' 2FA.

Also it should be noted that storing your TOTP secret in the same place as your password means you're one malware attack away from losing access to that account. While this risk may be acceptable for many accounts, it should at least be considered.
They support standard hardware keys now, which have worked pretty well for me. Just can’t use them if you have devices which aren’t on one of the later OS updates since the OS won’t support signing in with a yubikey.
> Only schools of value at NYU is medical, law, and film. So roughly 3,000 students.

NYU has 26,000 undergraduate students--is this not of value? Seems like a very broad brush with which to paint the largest university in New York.
We just made it available on OpenRouter:

https://openrouter.ai/models/fireworks/mixtral-8x7b-fw-chat

Chat playground:

https://openrouter.ai/playground?models=fireworks/mixtral-8x...
The vast majority of workers commute on public transportation. NYC is extremely accessible via public transportation. Catering the city to cars isn't scalable.
The 200K finetunes are also quite good at understanding their huge context.
Oh wow, you’re right. I wonder what’s up with that.
And a double pox on those sites that disallow "paste" in their passwords fields.
what a sick project to be able to attract a billionaire programmer [0] and c royalty.

[0]: https://github.com/ggerganov/llama.cpp/issues/4216#issuecomm...
> the great British bake off is a wildly popular show and yet almost none of the people I know who are fans care to even try to learn baking themselves.

You're missing the point of teaching anything. Teaching is (literally) the act of grooming someone to be receptive to an idea. It's different from training, which is the act of coaching someone into doing something.

When the day comes where one of those fans does try to bake something, everything they saw on the show is going to resonate in a way it wouldn't for someone without the exposure.

I don't bake, but I now know two ways in which greasy meat leads to a soggy bottom.
No FUD intended, was genuinely asking.

I recalled this 2018 article[0] titled, "The default OpenSSH key encryption is worse than plaintext" and was wondering if it is still true. Safe practices are a moving target. One on which I am not qualified to answer, hence my queries.

Good to know that OpenSSH is improving, but is the future uniformly distributed? If you are running a Redhat LTS release, are you getting a secure by default private key protection, or do you have to invoke the correct command?

I default to Github's keygen recommendations, but I can believe that others will run ssh-keygen without arguments.

[0] https://latacora.github.io/blog/2018/08/03/the-default-opens...
Unlikely. Some people archive every page they visit.
Only if you don't hash and salt
Maybe not $1 billion, but you'd want quite a few million.

According to [1] a 70B model needs $1.7 million of GPU time.

And when you spend that - you don't know if your model will be a damp squib like Bard's original release. Or if you've scraped the wrong stuff from the internet, and you'll get shitty results because you didn't train on a million pirated ebooks. Or if your competitors have a multimodal model, and you really ought to be training on images too.

So you'd want to be ready to spend $1.7 million more than once.

You'll also probably want $$$$ to pay a bunch of humans to choose between responses for human feedback to fine-tune the results. And you can't use the cheapest workers for that, if you need great english language skills and want them to evaluate long responses.

And if you become successful, maybe you'll also want $$$$ for lawyers after you trained on all those pirated ebooks.

And of course you'll need employees - the kind of employees who are very much in demand right now.

You might not need billions, but $10M would be a shoestring budget.

[1] https://twitter.com/moinnadeem/status/1681371166999707648
Yes! In my bubble, we just need "code snapshots" or versioning, but not for the whole repo, more for each function / file. It's surprisingly hard to get juniors into git, there are so many crazy situations all the time.
I've never had any of my accounts hacked and my password practices are not great. And for most accounts I don't really care that much if somebody does.

I loathe MFA and all this security theatre that makes everything janky.
If I'm beginning to recall the story correctly, it's that your suggested route would involve more time, paperwork, and this particular op might not be important enough to get the big guns authorized by the higher-ups. Hence, "oh, this will be (relatively) easy..."
Is metal working?
I concur, Yi 34B and Mistral 7B are fantastic.

But you need to run the top Yi finetunes instead of the vanilla chat model. They are far better. I would recommend Xaboros/Cybertron, or my own merge of several models on huggingface if you want the long context Yi.
Depends on the rubric. Kundera was a much better writer.
Yeah, that's how I thought it should be. Sounds like a lot of models you're building.

Do you tune each one separately as well or do you find a base tuning and go w/ that?
None of that is new, it's been the way PyInstaller always worked.

However on Linux things kinda suck because PyInstaller will package your current interpreter, so if it's linked against things that are different on another Linux (eg no glibc) it will often crap itself. But so is the joy of distributing compiled software to Linux users :).
In other news: Why I ignore TikTok

Seriously, I just don't have the time. Maybe that is a good thing.
You expect them to host your secrets, protect your secrets, maintain multiple extensions and clients, and provide you with a low friction flow for free?

If it's a budget thing, self hosted bitwarden/vaultwarden with premium features has been a thing for a while now.
Sorry, why would I pay 20/year bucks for this when I have my own website/infra?
I already think it should be used in zero places. They lie with statistics to make it seem much safer than it really is [0], and Autopilot has a habit of disengaging 1-2 seconds before a crash, which lets it escape blame [1]. Frankly it's a regulatory failure that let Musk sell vaporware for years.

[0] https://www.forbes.com/sites/bradtempleton/2023/04/26/tesla-...

[1]
https://futurism.com/tesla-nhtsa-autopilot-report
I'm not saying that either of your concerns are invalid. The LLM space is just the wrong place to be for investors who are worried about cash-flow positivity this early in the game. These models are crazy expensive to develop _currently_, but they is getting cheaper to train all the time. Meaning Mistral spent a fraction of what OpenAI did on GPT-3 to train their debut model, and that companies started one year from now will be spending a fraction of what both are spending presently to train their debut models.
This is a fable. Many people reached old age in the empire and even the middle ages. A low "Life expectancy" doesnt mean people didnt grow old. It just means that many people die prematurely of (now) preventable things.

Death of the mother in childbirth ( 1 in 10)
Death as a child because of unsafe surroundings
Death as a child because of childlabour
Death because of infectious wounds
Death because of plagues and sickness
Death because of random violence
Death because of war
Death by famine
Death by accidents like fire in the house, occupational hazzard or hunting. Or the sinking of a ship.

All these things lower Life expectancy. But with luck and a good physique many of them could be avoided.
Thank you for pointing out to cargo-expand
Most people go to college for training; they could not care less about receptivity to ideas. There is this myth that college is about expanding one's mind and worldview. It is not. It is about improving and ensuring one's economic class. Only professors forsake a job in the real world for these ideals. Everybody else is there to secure their spot in the middle class, and they don't care about superfluous information
A terminal that streams telemetry. Just what we needed.

Get this BS out of here.
Any pics?
Ctrl-click works as well (just like ctrl-click works to open tabs in new windows. This is useful for laptops where the middle button can be harder to use/access.

It also works for history items, and I think other things as well. Basically if it could be opened in a new tab, then try middle/ctrl clicking it.
Malware requires propagation vectors. Computers don't work by magic, instead when thinking about security you should think about your threat model. What are you protecting and from whom, and what is the attack surface you are exposing which would allow them to get prize?

On Linux, the attack surface may not be non-existent, but by default it is smaller than some other operating systems. Any halfway competent Linux sysadmin can configure iptables or some other firewall to block all network traffic except what is specifically permitted. Even when something is exposed, it usually only allows access to specific user accounts (including system service accounts.) Once access is granted to an account, you are then constrained by discretionary access controls (DAC) (i.e. POSIX users + groups + file permission modes), and, for the paranoid, by mandatory access control (MAC) (eg AppArmor or SELinux) as well.

As others have said, such access could theoretically allow bootstrapping to greater privilege escalation, especially if you only have DAC and no MAC, but in practice it's harder than it sounds.

I have seen plenty of publicly-exposed Linux VMs compromized over the years. They were always compromized via one of two methods: the admin user explicitly enabled password authentication to ssh instead of adhering to keypairs (which we enforce by default); or, they opened up a vulnerable service such as a database to the public internet. It was never via some virus.

You hear people saying dumb stuff like, oh no one uses Linux and that's why there are no viruses. To that, I say our Linux server farms have a vast amount of highly valuable compute power and research data. If it were possible to infect these machines with a virus, any halfway competent nation state, ransomware group or bitcoin mining conglomerate would very much consider it a worthwhile investment to develop such a virus.
Yes this is weird and also may be exactly what we need to do.

Here’s a few politicians from various countries explaining, basically, ”Look we need to develop. If you need us not to cut down the jungle, you should pay. The economic activity needs to come from somewhere. We can’t live in poverty forever”

https://time.com/6233998/brazil-indonesia-rainforests-climat...

https://news.mongabay.com/2022/11/where-is-the-money-brazil-...

Think of it as money paid for conservation. Then it all makes sense.
Are you sure? A quick review of the budget over time shows that the biggest outlays are on food and drugs, which seems correct? In fact the medical drug industry is what, $300B and food is around $1.2T? The FDA is around $8B or .5% of the industry. Seems lowish for proper oversite of 2 really important parts of our lives.
There’s probably a better place to ask this highly specific technical question, but I’m avoiding Reddit these days so just throwing it out I guess. I’ve been trying to run these in a container but it’s verrrry slow, I believe, because of the lack of gpu help. All the instructions I find are for nvidia gpus and my server is a qnap tvs-473e with an embedded amd cpu/gpu (I know, I know). The only good news is that I’ve upgraded the ram to 32gb, and I have a 1TB ssd. Any idea of how I can get my own self-hosted LLM/chat service on this funky hardware? The nvidia/docker option requires installing the nvidia runtime alongside docker, but I can’t find an amd equivalent.
Thanks. Sorry for the wall of text nobody cares about.
Thank you. Just bought it as it looks one and partially because my initials were available. Kind of a sign :D. Otherwise it will be one of many domains I’ll have to manage for a year ;)
Have you thought of recording everything with space ASCII cinema?
Is it true that it is cheaper to ship a car from China to to Europe or the States than for a local manufacturer to ship internally in either?

I know for a long time the rest of the developed world was paying all of China's shipping costs, which massively helped them along. Don't know if that is also a factor.
To be entirely fair (in my situation), what I do at work and what I find fun to do with computers are two different things :P
> Transistors used to cost a billion times more than they do now

However you would still need billions of dollars if you want state of the art chips today, say 3nm.

Similarly, LLM may at some point not require a billion dollars, you may be able to get one, on par or surpass GPT4, easily for cheap. The state of the art AI will still require substantial investment.
> IMO if you're worried about the NSA, I assume they have access to root certificates and your package manager that uses TLS would be vulnerable. Wouldn't have to compromise any system or mirror to do so.

Debian-derived systems use GPG signing so that wouldn't be enough, there's no central authority in the first place. There are hundreds of Debian developers, and most likely they could find one with poor opsec (or straight-up send a National Security Letter), but they would pretty much be burning that specific individual.

(Do distro package managers use Certificate Transparency? That would be the hope on the TLS-based side)
Let's get to advanced vertical farming first since it's yummier and see if we need to get beyond that, but I like how you think. ;)
No argument here, and I've been using emacs since around 1983. It's a hobby and a way of life. But like any way of life, it's for those who like that sort of thing.
I happily pay $20/year so I don't need to worry about it. Not everyone can or wants to run their own infra.
Type //? for the manual
> there's not as much 'tough guy' cred from sticking to the CLI.

That’s probably really all there is to these discussions, good old technocratic chauvinism :)
Army Is Looking for Hybrid Drivetrains for Its Strykers
From their website:

>Borders are a great way to distinguish two elements from one another, but using too many of them can make your design feel busy and cluttered.

>Instead, try adding a box shadow, using contrasting background colors, or simply adding more space between elements.

Emphasis mine. The above may be reasonable advice if you're building a low information density app for nonproductive content consumption... Or a touchscreen only app where all interactive elements must be at least a finger tall and wide... But it drives me absolutely batty when extra white space appears in software that I want to use to process/analyze a lot of information and actually get stuff done. And numerous examples on the website just make things... Farther apart and/or bigger.

I still rue the day Spotify fattened up its row height for all lists in the app. It's less readable than it was if I can't read as many song names as before without scrolling.

I don't want to rag on the book overall without reading it, especially given how many in this thread seem to love it and the table of contents does hint at good ideas within, but that seems like a terrible set of examples to lead with. 'More white space' is not universally good design advice. Give me design in the school of TMUX and Bloomberg Terminal any day over extra white space for the sake of 'readability.' As much information as it is possible to present clearly on a given screen.
and IIRC, datatype conversion made through excel formatting options. change cell display to get decimal :) fun
Then it's not really about investments, but about loans becoming income, which would be a huge change.
I mean, you just had a basis reset. If the asset is later sold, you still have taxes on that 150M - 50k difference defined from the basis set by the appraisal.

It's like if you sold and immediately re-bought them from a capital gains perspective.
> But then what?

Presumably you could use techniques for discouraging pests we (the public) understand better. You can do this for any class of substance, though this isn't always possible (e.g. good luck replacing cancer medications with something over the counter). We've been farming for thousands of years; it's a little ridiculous to suggest there's no alternative to a chemical developed in the last century.

Hell, just off the top of my head you can spray the plants with narrowly-targeted substances that are known to be human safe specifically tested against pollinators (e.g. you might use capsacin to discourage mammal consumption).
You could also use natural predators to groom the crops. This is a well-documented and ancient technique, although I'm sure it's much more difficult to scale and has a lot of externalities. I.e. lean into the existing ecological web rather than trying to make our own emaciated one which evidently isn't self sufficient. And maybe we just use too many pesticides—we certainly produce far more food than we consume, even if we're not great at distributing it, perhaps taking some loss in the short term will prevent a catastrophic loss in the long term (I know, literally unimaginable to quarterly-oriented individuals).

Ultimately, without some known alternative there's not much you can do aside from calling your representative to complain that we need our agencies to be more skeptical and to mandate making the production process public.
First off. It's really not nice throwing out terms like "it's something you've made up". But anyway here are some pointers why I think that Nitrous oxide is worse then cocaine, these are stats from the Netherlands because that's where I did the research:

A single dose shows traceable, but reverseable, neurotoxic effects in rats:

https://www.sciencedirect.com/science/article/abs/pii/S03064...

> Our findings demonstrate that short-term exposure of adult rats to N2O causes injury to PC/RSC neurons that is rapidly reversible, and prolonged N2O exposure causes neuronal cell death.

In the Netherlands the lower bound of people with paralysis, such as beeing unable to walk due to the effects of using Nitrous oxide is 64 in 2020. And that is by querying a subset of hospitals. These are indeed extreme usage cases. You also don't get a heart attack from snorting a few lines of coke.

https://nos.nl/artikel/2338520-64-mensen-met-gedeeltelijke-d...

This is much more then the yearly reported deaths for cocaine in the Netherlands. Which is reported to be 38 https://www.jellinek.nl/vraag-antwoord/hoe-vaak-gaat-er-iema....

If you compare the number of users in the netherlands you can see the picture how bad it actually is:

- Cocaine had 230k users in 2020

- Nitrous oxide had 290k users in 2020

https://www.trimbos.nl/actueel/nieuws/dit-zijn-de-opvallends....

This means you are much more likely to get paralysed by Nitrous oxide usage then you are to die from cocaine.

It's definitely not a good idea to label NO2 as a safe drug.
> Somehow I doubt the migrant workers live in excessively AC’d mansions

Your suspicions might be true: https://duckduckgo.com/?hps=1&q=%22united+arab+emirates%22+m...
s/priority/proprietary/
So that you don't have to worry about outages, updates, bugfixes, certs, permissions, vulnerabilities, ... like you do on your own website/infra?
> Yes, people who can't afford spending $15. Anyone else will continue as they do, as private transport is safer, quicker and more convenient - plus there will be better traffic, as the poor will be taken off the road.

This isn't true most of the time is quicker to take public transportation due to the congestion issues. Cars don't scale.

> How is that going to do that? If someone is affluent, I don't think they are going to think twice about spending $15 extra. It will discourage people who cannot afford it.

Yes the point is to discourage people from driving into Lower Manhattan. Lower Manhattan is easily accessible by public transportation.

> Poverty is relative. Someone may be compensated well enough to afford rent, parking and all that, but after paying everything they have little money left for themselves. That $15 may eat into this meaning you may reconsider whatever arrangement you have - effectively pricing you out.

The poverty rate for NYC is $35,000 if someone can afford to pay $24,000 yearly in parking I doubt they're in poverty, especially when public transportation is available and is quicker due to the high congestion. This wouldn't be implemented if there wasn't an alternative.
Waiting for ChatGPT to approve this link... not sure it is public yet
> You really do want a native image, so why not get one that you can also right-click and "save as...".

This sounds great!

At least, nowadays you can take a screenshot of the terminal and crop it as you want. Not sure what would you want the "right-click" to do in a terminal... terminal graphics can be overlaid with text and with other images; where does your image actually begin? Screenshoting and cropping is exactly what you need. The only evident case for right-click+save is when the image comes from a png file. But in that case, why do you want to save it again? You already have the file.

> Instead of showing a table with dashes and pipes, why not show an HTML table that you can interact with and can copy/paste directly into excel or google sheets?

That would be an amazing feature! Selecting rectangular regions of text in your terminal, instead of whole lines. On the other hand, I feel that excel and google sheets could easily understand a simple table written with dashes and pipes and paste it the right way.

There is a huge room for improvement in terminals. However, it is mostly boring compatibility stuff, to implement protocols in other terminals that they were developed in. There are many existing protocols for nice things, like sub-character mouse interaction and image/video support. Sadly, they are not universally implemented along the terminal space.
I will make a GPT version... ChatGPT has to approve it for some reason....
Talk about things I’d want to bring back if I were suddenly a mega millionaire or billionaire.
And storing my TOTP code in the same password manager I use to store my GitHub password is not more of an MFA than using the password alone. They may hope I'm using my phone, but they can't know. And they shouldn't. My security, my business.

Overall there are 2 cases to consider: one where a compromised users screws the user, and one where a compromised user screws the service.

In the first case, which is most online services, the only reason the service cares about the security of an account is to protect the user. They have no business policing how said user handles their own security. Propose and nudge, sure, but verify? That goes one step too far.

In the second case, which would be most enterprise networks, I would recommend that the company issues a security key to each employee, and ensures (with some form of remote attestation if need be) that employees log in with that key.
I have heard of the reverse occurring as well, EU cars which need modification to be road legal and not from "steering wheel on the wrong side" issues. I believe one example were smartcars ironically failing emissions tests. The point being incompatibility may be mutual.
Good idea. We could use a way to restrict visibility of the entine filesystem and only unveil the parts of it that every program declares/needs.
All of your complaints are specific to Syncthing which, admittedly, doesn't have great defaults (but the fans will be quick to defend it).

A webui for a desktop app can be made perfectly securely, though.

For example it can bind to 127.0.0.1, not do external network requests, and require a token (generated by a systray menu utility or an app shortcut for example) that will prevent automated exploits from accessing it as well as other users on a multi-user system.