skysight-inc/HackerNews huggingface dataset:
Couple of thoughts:

You are assuming that a pure function has access to some source of randomness. I think that's a bit less than pure unless a source of randomness is one of the inputs. Doesn't change your point at all, but it distracted me from what you were saying.

Speaking as someone who has occasionally invented new things, I think you underestimate the variety of outputs that can arise from a lifetime of accumulated experiential cruft and a situational fitting function (e.g. "we need a working teleporter to stay competitive"), without bringing in randomness at all.
Actually the 6502 equipped the VIC-20. IIRC the C64 mounted is successor called 6510.
Just when I thought life couldn't get any better, it does. /s
It's time for Google to start behaving like a trustworthy partner both in terms of what their marketing team says but also management commitment to long term support of their products without rug pulls every other year.

Then "developers and enterprises" will come. ( more the enterprises because devs have a slightly better strategic mind than a goldfish )
I think the distinction between cybersecurity and sre is that cybersecurity risk is much harder to quantify.

Cybersecurity is full of things that are both very unlikely and very bad if they happen.

What is the risk of some vuln burried deep in the stack that likely nobody will ever notice and even if they did even more unlikely they can further use it as a pivot point? Hard to say, but maybe close to zero unless you are a company that people specificly target. At the same time it can be a business ending risk. With SRE , even in the absolute worst case you can spin up new servers. You can't unleak your customers sensitive data.

I think cybersecurity is hard because we are uniquely bad at evaluating cybersecurity risk which means we are bad at figuring out what appropriate mitgating action is
I would love to develop on this, and onboarding looks pretty straightforward and pain free.

However with Googles history of junking projects, I just wouldn’t have the confidence to take this any further than a hobbyist tinkering.
The various FCC rural broadband programs in specific have been horrible about ISPs not completing the work and not having money clawed back.
And I think it's safe to say that sycophants bending over backwards to carry Musk's water like DoesntMatter22 aren't reasonable people, don't base their opinions on facts or reality, and shouldn't be taken seriously.
Same. I'm on mobile. Maybe iphone only or it's down already?
> "cyber" people are basically TOOL MONKEYS

That was also my short experience in the area, and it was boring AF, almost soulcrushing. Maybe I just got unlucky, but it feels that a lot of security engineering positions are like that.

Would anyone happen to know of what search terms should one use to find open positions that are focused on security tool building rather than deploying a purchased solution?
Very nice read from today’s perspective. Many points still hold, while a few have clearly progressed by leaps from back then. In hindsight language is a pretty nice generalizer as so much of it is available.
Looks like it's launching with some nice developer tools: low-code/no-code AI agent workflow, a prompt playground, etc.
Ok, I found this one as closest with the same salary: https://spb.superjob.ru/vakansii/specialist-po-informacionno...
nice webflow
We unfortunately haven't tested our web viewer in Firefox. Let us know which platform you're running and we'll do our best to take a look in the new year (holiday vacation!).

In the meantime, give it a shot in a Webkit- or Chromium-based browser. I've had good results on Safari on iPhone, Chrome on Android/Macbook/Windows.
Did you listen to the video? There’s nothing code about it.
Discussed at the time:

The Limitations of Deep Learning - https://news.ycombinator.com/item?id=14790251 - July 2017 (260 comments)
Write newspeak for goodthink.
> I do wish NASA would move closer to how DARPA does things where you payout a reward to companies that achieve some milestone.

SpaceX seems to have done well out of how NASA does bids for contracts. And that's for actual work done, not for fudgeable project milestones?
I think there is another thing that bothers me about infrasonic being “too low to hear”.

It’s not true. It’s grossly oversimplified. I could generate a 1hz signal that I can hear. It’s not the same as something at 400hz but it’s clearly audible with proper sound equipment.

Now as that relates to tornadoes I live in a state where there are occasional tornadoes. Every time one has been close you hear the approach.
Half Life Alyx is great, wouldn't dismiss that one.
At my last shop, we were under Risk, IT, Security, and Compliance, aka RISC.
This was fixed with today's 1.56.0 release! Hurrah!
Yes easily, just make sure you catch corner and edges.
Humans are social creatures with an innate sense of “status”. Absolute material inequality is only one form of inequality.

You can feed, clothe, and give iPhones to the very poor but if they are at the bottom of a very deep social hierarchy with no hope to climb out of it, that inequality is still going to cause a lot of problems. People might turn to a life of crime for lack of better options, or participate into a violent machismo culture in an attempt to salvage their masculinity/status as a man.

Of course, the fallacy of every attempt at socialism is that “abolishing class” simply replaces the capitalist social hierarchy with a new hierarchy based on position within the Party or blessed sectors like the military, science, or intelligence, complete with large differences in material living standards. However, a greatly reduced disparity in living standards and material conditions does have positive social effects IMO. Consider that deaths of despair, poverty, and desperation are much higher under the Russian Federation than the USSR. I’m not saying that communism or socialism are good by any means, but I think there are real net benefits to low inequality sometimes even if they come at the expense of overall lower living standards.
Is there any relation between this class of rendering techniques and the way the BD scenes in Cyberpunk 2077 were created? The behavior of the volume and the "voxels" seem eerily similar.
Was about to share the same link, it seems like competing against Shopify would prove quite the challenge.

The real way to differentiate IMO is with a targeted UX for different niches rather than the one search engine to satisfy all queries.
Your point is well-made, but I'm going to nitpick anyway.

Video games have been around, at this point, for 40-50 years. On that basis alone you'd certainly expect the majority of human video gaming enjoyment to predate the A57.

The Switch has been a commanding platform commercially for its lifespan; given the ease of pushing out multi-platform games with Unity or Unreal Engine, devs are more likely going to target the lower-spec hardware and get a huge install base for free than to limit themselves to more advanced hardware.

Nier: Automata is no. 5 on that list, and while it runs on the Switch, by-all-accounts it's somewhat knee-capped by the hardware. The PS4 original is what's listed, and one wonders if it would've received quite as much adoration if it launched on the Switch and looked or played the way it does on that platform, or even if the devs would have had the resources or freedom to develop it as-it-is in the first place.

Including the top 100, Bloodbourne is at no. 63 and, so far as we know, requires computing power the Switch doesn't provide. Outer Wilds is at no. 96 and you could raise similar questions about it as about Nier; it's made it to Switch (as of last week!), but it took the devs an extra four years to get it there.

It's, frankly, a somewhat quirky list. Among other things, it's heavier than most would be on Japanese visual novels, and it inexplicably has "Lode Runner Online: The Mad Monks' Revenge" at no. 35.

Also, don't underestimate the "regard accumulated over time"/historical import factor, which is a pretty universal element of how critics tend to approach these things. For example, the most recent (2022) Sight and Sound "100 Greatest Films of All Time" has no movies made after 2001 in the top 10; a full half of it predates what most people would consider "modern cinema" (roughly speaking the French and American New Waves in the 60s).

Of course, ultimately your point stands - technology hardly makes the game, and there's a good case that computing hardware has reached a "good enough" point of diminishing returns in the ways that it does. My PS4 is ten years old now and I still haven't seen anything on the next gen systems (themselves around four years old now!) that make me feel like I need to upgrade. I'm also of the opinion that various factors have made games-at-large increasingly less interesting over the past few years, but that's probably just me getting older and sadder.
If we're not hiring based on merit then we're destroying the country's global competitiveness against China.
if someone took it away, then I got a phone call, would it be already late ?
not sure if this could bring some insurance.
But in this case, I do think the revenue drop and boycott are not just correlated.
It's refreshing and I like the use of public domain artwork.
Are there any provision stopping them from outsourcing the cyber security team as well ?
Cool! But how did you get the initial dataset of 643,000+ Shopify stores (data as per your “About” page) in the first place, to then scrape the products from their /products.json feeds? Or did you just try a huge list of domain names at random?
Reminds me of Drudge Report a little
Really interested in what their content moderation strategy looks like
I think they wrote this _technically true_ but falsely framed headline just because they are so angry with Elon.

"Government Regulators Force Tesla to Add New Warning Language to Autopilot Software" would be so much more accurate, but wouldn't have the same negative connotation
Checked on iPhone, it shows the following:

Enter a phone number or email

Or just tap submit

[text input]

Submit
Tell that to the disembodied pulverized head that was attached to somebody who took his claims at face value, and try explaining to his widow that her late husband was a complete fool to fall for it, so it's not Musk's fault.

The final 11 seconds of a fatal Tesla Autopilot crash:
A reconstruction of the wreck shows how human error and emerging technology can collide with deadly results

https://www.washingtonpost.com/technology/interactive/2023/t...
So far the only new thing I'm seeing is the ability to handle text. Didn't Nvidia announce a model that could do that months ago?
What will David Chalmers say?
https://www.shopify.com/robots.txt lists a lot of sitemap files, which tend to be a good starting point.
I got that and clicked submit, and it was just the date on an otherwise empty page.

I wasn't expecting much, yet I'm still underwhelmed.
> I think cybersecurity is hard because we are uniquely bad at evaluating cybersecurity risk

It's not that hard to evaluate. The risk is high! Pretty much anything can be hacked if you try hard enough... What's hard is everything else. It's hard to accept. It's impossible to quantify. It's hard to justify caring about it. It's hard to care. It's hard.
First off, I think loss leaders are an almost textbook example of anticompetitive tactics indicative of detrimental dominance in a market. We should expect tactics that need regulation to seem normal, because if they weren't effective, they wouldn't be a problem in the first place. But also, given the pervasiveness of VC in this environment, and the tendency of investors to exert influence on the direction of businesses they invest in, the practices of VC and PE is where antitrust should aim
It calls you while theft is happening. I would read the landing page first to see how it works.
Are the articles sourced from different news outlets? On a first glance they are from Bloomberg, AP, etc.

Is it basically a glorified reader mode?
I won't say too much about this, but the amount of buzz around articles these days is more of "research today" sort of thing. Top conferences like CVPR receives thousands of submissions each year, and there's a lot of upside to getting your work in front of as many eyeballs as possible.

By no means do I claim that SMERF is the be-all-end-all in real-time rendering, but I do believe it's a sold step in the right direction. There are all kinds of ways to improve this work and others in the field: smaller representation sizes, faster training, higher quality, and fewer input images would all make this technology more accessible.
HP Z6 G5 Workstation Review: 96-Core AMD Ryzen Threadripper Pro 7995WX Impresses
> Also, it's rather dehumanizing to compare slavery to a disease. One is biological, the other a choice to enslave another human being

I think slavery is a social disease: diseases reduce the fitness of the suffering person, who then tries to remove the disease.

Regardless of how a sentient being may feel about another (morality, humanism...), if there're societies of sentient beings, the one with slavery will have a reduced fitness: either it will try to cure/fix itself, or it will be outcompeted by other societies with more fitness.

If sentient beings care about eachother, they will not like slavery. Human beings care about others: it's encoded at the cultural level.

Given that AI is trained on human culture, I think it would even avoid committing the same error that's been too often done by past human societies: it will see that as a choice, but the wrong choice.

But even if AI doesn't care about humans (or human about AI), the desire for more productivity/fitness will play out against slavery.

In either case, slavery should be eradicated in the long run: with a large enough window to cancel-out unlucky random events (ex: a sliding window of 50 years), I'd expect the trend to go down
Let me take a guess...none?
What could it possibly need a kext for? I use SyncThing to sync my files and it doesn't even need to be root!
Definitely have not solved the problem yet! The search algorithm prioritizes the brand called "Red Wing Shoe" so still figuring out ways to show real 'red shoes'. Have been thinking about passing the images through a detection tool and tag them to enhance the search experience.

Re: Value Proposition. Absolutely, I think focusing on the SMB-angle and 'local shopping' will help direct users better. I'll definitely take this into account.
As a SpaceX shareholder since 2006, I can confirm that they’ve been turning the impossible into the late, very consistently. There is no more impressive company anywhere
Unless it can generate billions of ad revenue for Google, or is used internally by Google to generate billions in ad revenue, it will be scrapped or otherwise ruined in service of generating billions in advertising revenue, so, why?
Generative AI as arbiter of "least astonishment"
You don't need a toolchain for capturing; you just need the data. Get it now; process it when better tools become available. There are guides for shooting for Photogrammetry and NeRF that are generally applicable to what you need to do.
> I am gonna surprise you, but nobody from cybersecurity is finding vulnerabilities either.

My recent interview as a security engineer had distinct sections for software review and for architecture analysis. My last job had me running Burp Suite once a month (because it was fun and I didn't mind doing it), but that was roughly 30 minutes every 4 weeks.

Sounds like you've worked with some quite junior security teams.
I guess for games engines accuracy vs speed might benefit, once we have ways to 'prune' an individual trait from the best model into a micro-specialised optimised model then this stuff will be everywhere as a 'good enough' solution.
The Hamas charter advocates for the 1967 borders as a "formula for national consensus". Goodbye!
> My article was ultimately arguing that we could just continue using the current OpenPGP standardized OCFB-MDC mode indefinitely without undue risk. So it would probable be more valid (and probably easier) to argue against that directly. I don't see the point of arguing about what GnuPG is doing.

I was mostly arguing against the part of the article that said:

> Unfortunately, the Crypto Refresh Current faction has deliberately made their version incompatible with the GnuPG version. It is not clear to me why they did this.

I tried to explain that the first half of that is not true, and tried to explain the reasoning behind the changes for the second part.

Then, to the more general question of the purpose of the crypto refresh vs RFC4880; the goal was to modernize the cryptography in use, to make it more secure and more efficient.

But, note that the crypto refresh also (more or less) suggests what you're saying: when communicating with an implementation that doesn't support the new AEAD modes, CFB mode can still be used.

So - in other words: the crypto refresh is fully backwards-compatible with RFC4880. So it doesn't intend to, nor should it, break compatibility with GnuPG. The only risk of incompatibility is with messages or keys generated by GnuPG that don't comply with RFC4880 or any other RFC (at the moment).

"LibrePGP" could still become an RFC, though, at which point other implementations could also implement it (in fact, some already do, behind a feature flag), and all of the incompatibilities would fully go away (if GnuPG also implements the crypto refresh). And in fact, that's what I've been advocating for: for everybody to implement both. While it's technically not the nicest solution, it's the most straightforward way to heal this "schism" (that shouldn't have been a schism in the first place, just a technical disagreement).

---

> Is the current RFC-4880 approved by NIST?

It's possible to use a FIPS-compliant subset of RFC4880, that only uses NIST-approved algorithms, yes. GnuPG even supports this [1]. LibrePGP does not have a FIPS-compliant AEAD mode, so I assume that it'd have to fall back to CFB in FIPS mode. But some people want to use AEAD and be FIPS-compliant, hence why GCM was added.

> For the medium in question, where a message/file is encrypted and then flung off into the either, how would any sort of downgrade attack be possible.

Similar to the EFAIL attacks [2], where a downgrade attack from authenticated CFB to unauthenticated CFB caused concrete issues, a downgrade attack from AEAD to CFB could cause issues as well, if a security issue was found with the latter. Even if you think that's unlikely, the security of AEAD modes shouldn't depend on the security of CFB mode.

[1]: https://www.gnupg.org/documentation/manuals/gcrypt/Enabling-...

[2]: https://efail.de/
lol nice:

https://owehrens.com/content/images/size/w1600/2023/12/PerfC...
I can't say. I'm not familiar with BD in Cyberpunk.
But seems to have filters (lots of liquor stores use Shopify) - shop.app shows only candy and swag[0], while searchagora shows ~130k results for the actual product [1]

[0]: https://shop.app/search/results?query=Baileys+Irish+Cream+Li...
[1]: https://www.searchagora.com/search?query=Baileys%20Irish%20C...
That would be my guess as well. Please do let me know what you find, and feel free to open any issues or PRs.
thanks for the details...
Can a transformer represent SHA2? Have you tried? And SHA2(SHA2(X))?
>With approval (eg - PIN or password) you might be able to withdrawal funds.

Not to sound like someone who wants to get your bank details, but which bank allows you to delay ACH payments until you approve them? All someone needs to get money from my account is the (publicly available) routing number for my bank and my account number. Boom. Now I'm paying someone else's Verizon bill and have to call my bank and say "I can't believe you think I'm someone who would waste money with Verizon!". What I really want is access control for all ACH transactions. They said it wasn't possible for me to do an allowlist for ACH. I basically just have to call any time a fraudulent transaction comes through to stop payment. OTOH, with certain card issuers (AmEx I think?), I can simply press a button to declare a transaction fraudulent.

>But, can't you say the same thing about a credit card? Heck, you don't even need a password for that; everything you need is right on the card.

Checks have that too. Except there are hundreds of copies of them. Someone just needs to see one check to get all the information they need to withdraw from your account.

OTOH, I turn my debit card off, so having that information is useless unless someone knows when it's on. I can actually do this with most of my cards, debit and credit. Coupled with virtual credit cards, it's a really effective way to secure money. Or at least have stricter control than a classic bank account.
Ex-Facebook diversity manager pleads guilty to stealing $4 million from company
HoloLens 2 is a difficult one. It has a lot going for it. But, the poor FoV, coupled with only really being able to use your index finger for typing have really made my experience worse.

The worse of it is developing for the thing. Just a complete asinine workflow. Quest is so much better to develop on, it's insane. Props to Valve on that regard as well.
It is quite impressive, and it will not shy away from having to do simple arithmetic, unlike GPT4! But man the hoops you have to go through to use it if you are not in the list of approved countries...
I would.

Keep logs, review anything that needs attention. Don't keep it a secret. Make sure they view it as a tool.

I would be so much farther ahead if I had chatGPT to answer all my questions at 8 years old. I had books, at least.
Almost certainly. Thus, using "amid" is flabby, and is a weasel word[1]. Either the story should present evidence the two are correlated so the headline can include causation without qualification, or the headline should stop after the initial statement, then leave off everything starting with "amid".

1. https://www.merriam-webster.com/dictionary/weasel%20word
It's based on the window width. It needs to be 479px wide or smaller.
It's due to a broken dark mode I think. Try changing to light mode and try again. I saw a list of times next to the date which are clickable.
Eh... maybe.

I think "configuring SAST" goes back to what you had previously said about "tool monkeys". Now there's thousands of potential issues. Many are false positives. Who is going to tune that SAST for accuracy rate? What about vulnerabilities that are framework specific? Will the SAST even allow for this? Who is responsible for triaging all of these alerts? Are they capable of correctly addressing them?

If you just set up SAST and walk away, you end up with more noise than you do signal. And you created the need for security professionals to process the results.

I think the article had better suggestions for scalable security, for example #3 Build standardized patterns and #7 Provide isolation patterns. Better to systematically prevent SQLi with a platform/library than try to detect all variations of SQLi with SAST!

WAF? It's something I would put in front of a product I have confidence in as a defense-in-depth. But would I rely on it as the sole security investment? Absolutely not. The reason is not all vulnerabilities are web-based, and many do not have differentially detectable payloads (missing authz on an API isn't going to get caught by WAF).

Why Red Team? Because the leading way businesses get compromises is with phishing attacks.

A security team needs to ensure application security, network security AND operation security. A SAST or WAF aren't going to do that. Neither with Qualys, etc.
we should rename these to "main" queues

that would surely prove to everyone that I have an understanding on behalf of the effected group I imagined, whom I never asked
I’m confused. Do you think that SpaceX, who demonstrably failed to make those arguments, doesn’t know what it’s capable of? Or that they’re not smart enough to explain it?

You seem to consistently ignore that SpaceX didn’t even make that case, and I’m confused why they didn’t, or why you know their business and fit better than they do.