skysight-inc/HackerNews huggingface dataset:
I feel like the real bug here is just with the markdown rendering part. Adding arbitrary HTTP parameters to the hotlinked image URL allows obfuscated data exfiltration, which is invisible assuming the user doesn't look at the markdown source. If they weren't hotlinking random off-site images there would be no issue, there isn't any suggestion of privesc issues.

It's kind of annoying the blog post doesn't focus on this as the fix, but I guess their position is that the problem is that any sort of prompt injection is possible.
I'm going to deploy an ActivityPub server this weekend on the Threads news, probably a different implementation, but we'll see

I stopped using Twitter a few weeks back. I tried to give Elon the benefit of the doubt early on, turned out to be a mistake. The platform has become worse and worse. Eschewing moderation leads to hate, misinformation, bickering, and spam becoming the predominant content.

Federation seems like the right way to organize social media. Problem has always been the big servers each having their own protocol and not providing interoperability.

Also, I want way more control of my feed
A fly-by-night IT training/certification/voucher reseller I worked for around that time saved customer billing information as a convenience.

No joke-- credit card numbers, billing addresses, CVV codes, all stored in plaintext in an Access database. Tiny shop though; I don't know if they were big enough for PCI to even apply.
Microsecond Precision with the PTP and Hardware Clocks for Unikernels
having used azure after long stints with AWS and GCP. I found Resource Groups a much more logical bucket, moreso than anything on AWS/GCP
Why do companies do holiday layoffs?
I have a lot of concerns about how effective LLMs could be leveraged by powerful corporations to the detriment of society. But seeing the ham fisted approach most are taking to filtering/safety/etc has actually lowered my concern a fair amount. Even an AI that could be incredibly powerful will likely end up seriously hamstrung by these policies for the foreseeable future, greatly limiting how much damage it can do in practice.
They’re associated with Emacs now but at least some of them seem to go back to TENEX: http://unix-kb.cat-v.org/
i wish they hadn't abandoned swiftui compatibility. i don't want uikit-like apis. i will instead explore swiftwasm + tokamakui for porting to windows.
The same image rendered with different os/hardware will almost always look different.

Different operating systems and monitors have different default gamma curves for rendering brightness and black levels. Monitors are most likely either uncalibrated, or _can't be calibrated_ to render a greyscale with just 64 brightness levels distinctly.

TFA is calling attention to "posterization" in their portrait backgrounds. They expected the grey background to have a smooth gradient, but, depending on your monitor, you should see visual jagged stair-steps between different grey levels.

When an image uses a color palette that's insufficiently variable to render the original image colors with high fidelity, that's "posterization."

(I paid for my college doing high-end prepress and digital image services, and got to work with a ton of really talented photographers who helped me see what they were seeing)
A little off topic, but what possibilities are there to rip out the guts of a "smart tv" and just use the display as a dump monitor? I love my Samsung display for its visuals, but the OS is terrible.
Mistral LMMs: Multi Image, Speech, Audio, and Video
Memoirs are one thing, but archives of mundane daily business? No thanks.
ELI5: For any sufficiently complex enterprise system (e.g. LinkedIn, or Google), any plain vanilla architecture is infeasible for lift & shift. Moreover, the vanilla services may not comply with internal security requirements, or play nicely with internal CI/CD tools, or internal databases / data structures / data processing pipelines / analytics.
It's more like an LLM is making a GET request to a honey pot website, that GET request compromises the LLM (via prompt injection), which convinces the LLM to send a POST request with the customers data to the attacker (honey pot owner).

Of course, it's not actually a POST request (because they don't seem to allow it to make those), so instead they just exfil the data in the headers of a second GET.
Feels like we need a single command for that, I have two goals for my workflow (like maybe bininstall should be included in Cargo):

1) what’s the easiest way to give people access to a tool I just wrote, `cargo publish`

2) what’s the easiest way for someone to use it, as few steps as possible, right now it’s `install rust` && `cargo install`.

Once I get to three or more steps on 2 I tend to turn to just or make depending on the context.
Supports MDsveX
It's always circular, too. You knock down one argument, go through the discussion, and half way through they no longer realise they agreed that an earlier discussion point was invalid.

thingx disproved... they say "ok".

10 minutes later "but what about thingx!"

I've had to say "now you can never, ever mention thingx again, right?", but of course, they do, and look baffled when you say no.
Quantum computer designs heat-radiating window coating
Is that supposed to make it seem better?

If refactoring is too hard for a Microsoft owned company what am I to think about my tech stack?
As far as I know play-clj is a libgdx wrapper, play-cljc a quite low level cljs library and GDL aims to provide a simple API for 2D games without getting bigged down in details.
If those companies do not comply or break FDA regulations, they face US level fines and can even see valuations collapse [1]

Ohhh scary !!!

They circumvent this by simply setting up a privately held front company in New Jersey to be the importer of record.

If the fines are minimal, they just pay them and continue business as usual.

If the fines are too much or they run into PR issues that affect their business, they simply shut the front company down and start up a new one.

In one particular case I have seen, the name of new company was the same as the old one but spelled backwards.
Unless the food or drug contains an ingredient or precursor that was manufactured in a third country, and that precursor was not shipped directly to the US.

From the article quoting an FDA spokesperson: "We have limited authority over foreign ingredient suppliers that do not directly ship product to the US because their food undergoes further manufacturing/processing prior to export."
2018? Maybe in 1998.
I think this is an awkward way of saying they tried to add an abstraction on top of their AWS dependencies so that their services would work on Azure without a refactor.
Let me make sure I understand what you're saying.

You expect that once this is law, that a single adult picture on the site and a complaint to the CRTC will result in a website being blocked or forced to implement age verification?

So if someone links to or sneaks in a naked picture in the comment section of a tech site that and makes a complaint, then that site face serious consequences?

>googles unsafe search mode

That's not a teensy bit of adult content.
Did anyone else find the note regarding North Korean fertility extremely surprising? I guess I have no idea what daily life is like in NK - but I was under the impression under-educated women often had more children (not supporting this, just stating what I though was commonly understood).

Does NK have a better education system for women and better internet access than I thought?
There was an old macintosh application that had an interactive FFT. I remember seeing it at the Haus Der Musik in Vienna and have always looked for it.
Seemingly

https://v8.dev/blog/wasm-tail-call
Lead chromate brightens colors, so it can be used to make turmeric, cinnamon, chili powder “pop”.

https://inspection.canada.ca/food-safety-for-industry/food-c...
Little nitpick: ones that reproduce and their offspring survive are more fit.

Man is useful to protect the offspring but is not required.
Did Adobe hire AOL's Chief Retention Officer?
Unfortunately, resource groups seems to be the only thing going for it (imo of course). AWS does have resource groups but have not used them
My in-laws, who are not wealthy, absolutely love the concierge set-up they have with their doctor. They do utilize it often, which makes it worth it.
Resource groups are fine, but it is quite unclear why a group has a region when resources with in may be in other regions.
Interesting!

Many years ago, I drew the opposite conclusion: that people that cannot draw also cannot picture the image of what they want to draw. My informal quiz confirmed my suspicions, but it has one serious flaw that completely undermines it:

I am a decent (if untrained) artist. I can say I draw well. I can also picture things in my mind very vividly.

However, I cannot draw horses. I can see them in my mind clearly -- as I type this, a realistic brown horse popped in my mind -- but if I try to draw it, it will look like a badly drawn dog. Drawing horses requires a theoretical understanding of their anatomy, it would seem.

I still think most people who cannot draw also cannot imagine the subject. With exceptions.
Happy to hear your suggestions, of course, will ping you through your HN profile
For what its worth, the website itself also isn't great.
Had to turn off Enhanced Tracking Protection mode to not get text that scrolled off the screen, and then was met with weird fonts.
I think I am pretty similar to you. When I was younger I used to build all sorts of things with paper and cardboard and used to imagine the whole thing in 3D and design its cutout template all in my head. I learned about aphantasia a few years back and it sounds very inconvenient to me.

I also have a habit of playing around with imaginary worlds and stories in my head and I pretty much visualize whole scenes and sequences in as much detail as possible. I wouldn't be able to do that with aphantasia.
I can't believe this is true, they would expose themselves to huge lawsuits doing that. I store sensitive medical files there. What if someone stored their baby's bathing videos and those got leaked?
Really inspirational project. Does anyone know if there's an analog of this to the LLM space? I.e. can you take the embedding of two sentences and get a 'combined' sentence? Either by searching a corpus for the closest match or by feeding that combined embedding into an LLM that generates it.
True, that’s exactly what happened.
IANAE but the way CBT was explained to was that thought, emotions, and actions exist in a fully connected, bidirectional causal graph; not that any one particular node was primary over the others. The intention (I thought) was to try and take the "thought <> emotions" edge and apply some filtering to the "thoughts < emotions" flow, so that the relationship was less reactive and didn't lead to spiraling, ie. replacing:

"bad emotions -> negative thoughts -> worse emotions -> worse thoughts -> ..."

with:

"bad emotions -> reflective, moderated thoughts -> equally bad or slightly better emotions -> reflective, moderated thoughts -> ..."
Very cool! I love the icons, where did you source them from?

One suggestion: the pill shaped background, should probably add an option to make it resize dynamically or not, some people might want that or or a fixed size.
They don't use AWS, but primarily baremetal.
As someone that used Dental Insurance heavily after I didn't take good care of my teeth in my 20's and previously negotiated many different Dental policies as an agent for a large employer this really isn't true.

1. I found that different Dental Insurance companies have wildly different negotiated rates and there is no real standard. Delta Dental tends to have better negotiated rates in my experience and United Healthcare's dental plans seem like they don't negotiate at all and using a specialized Dental company results in the lowest rates overall as the large health insurers are simply profiting off the insurance and don't seem to care how much they pay, which sucks when you pay a percentage for a procedure.

2. The totally covered population for dental insurance is not big enough to control the market. Generally, I found that when I wasn't covered by dental insurance, dental costs were a lot higher and you do generally receive a savings from dental insurance and they really don't have enough market share to control the market.

3. The coverage for adverse events is mostly just limited, because if you go to the dentist regularly, you generally don't have tons of adverse events within one year. I think most people will find a decent dental insurance plan will mostly cover them. Even if you exceed the negotiated rate,

I just find that in general having dental insurance is beneficial to me as a person and not a scam like vision insurance where you are generally better off finding a coupon or deal, or ridiculous like health insurance where they have manipulated the networks and deductibles so that the average person has no idea what they are buying or how to evaluate it.

My criticism of dental insurance would simply be that I think that policy holders should benefit from company negotiated rates under a policy even when a particular item isn't covered under their policy. I find that is the one area where dental insurance in general is lacking, because dental insurance takes the negotiation out of pricing and gives you the benefit of the companies negotiated rates.
Drugmakers penalized for big price jumps, older Americans to pay less for some
It's actually pretty trivial. Eternal-september seems happy to peer with anyone who asks (just send an email), and there's a newsgroup specifically for asking for peers; everyone who posts there gets lots of offers pretty quick.
> Kind of a side bar but I wonder as AI generated images get better, it seems to me only a matter of time (if it hasn’t happened already) before images are generated to create “proof” of conspiracy theories.

Photographs have been manufactured for that purpose (and, even more simply, real undoctored photographs presented with false context for that purpose) for about as long as photography has existed.
Right. It's not hard in practice, just requires paying more money to grow the government and many people are against that.
which seems silly given today is December 15.....
And that's the consequence of giving the market leader a decade and a half head start. No one and I mean no one was preventing AMD or Intel from building a competitive hardware and software ecosystem other than themselves.
Toyota has four of the top ten selling cars and is worth $290B. Tesla has two and is worth $792B. Tesla the carmaker is a valuable company but not more than Toyota.

You could make the argument a few years ago that Tesla was only electric car maker and would capture the market as it grew. But now lots of companies make electric cars. Electric cars are booming, Tesla is growing fast, but they are losing market share.
I wonder how the GitHub to Azure migration is going
I liked Resource Groups too, but not so much that it changed my (extremely negative, painful) experience using Azure over AWS and GCP.
The headline notwithstanding, this doesn't seem like anything particularly Azure specific. They'd likely have had many of the same issues trying to mostly lift and shift to any of the big public cloud providers.
US Approves New Kind of Nuclear Reactor for First Time in 50 Years
To be clear, that is not a foundational principle of CBT, it is a quote from a book. Also, this article is certainly showing off distortions that CBT will teach, but is trying to apply it in ways that are different from CBT. CBT is focused on the idea that people recognize their emotions easier than their thoughts, so when they have emotions disrupt their lives, they can dig deeper to find the thoughts that brought those emotions up, recognize unhealthy patterns, and fix it.

CBT is just a tool. It works for some things. Not everything.
If you’re only thinking about it for long enough to come up with a single hypothesis, and then confidently declaring that you have the correct answer, I’d suggest maybe thinking about it for longer than a moment :)
No five year old is going to understand a single sentence of that.
100%. It would also be nice if parents didn't give their kids garbage like that.
Thanks! You just extended a few people's life spans
The logic may work via negation or inversion. Eg there is individual disincentive for both women and men to engage in high-risk behavior. But societies still needed a class of people to go out and hunt game, defend society from lions or opposing armies, or other higher-risk ventures, despite the individual disincentive to do so.

Women are not expendable and thus society did not incentivize them to do these high-risk things. But men are, so societies created various social incentives to facilitate high-risk endeavors - honor, social esteem, medals, hierarchical rank, wealth, fame, etc. Many died doing so, but the ones that succeeded and survived reaped these various rewards and got to mate, producing heirs with similar risk-taking characteristics and capabilities from both nature and nurture.
We're already half way there. Google Docs now utilizes an "assistive writing" AI that displays warnings for words or phrases that are considered "non-inclusive".
If you know vi, you pretty much know ed, as this jokey article glancingly points out.

There is a bug in the article: i" vi(1) does offer a distinctly visual interface that only became possible with the advent of the video terminal, affectionately known as the glass teletype."

The term "glass teletype" was coined specifically once there were terminals with addressable displays (that is, your program could place a character at any character position on the display at location X,Y). Until then displays drew at the bottom of the screen and scrolled the entire display upwards when receiving a line feed. Basically like a teletype!

The blog author has a white beard so could potentially be old enough to remember those days, but also is in Norway so the slang could have been shorn of its roots in the process of crossing the Atlantic.
You know what will make this stop? Actual consequences for not preventing data breaches, like jail time.
The article's main thrust is a focus on risks that have negligible gain. So in that context your argument reads, "they have more to gain from a risk that has negligible gain."
There was no invasion because Soviets removed Cuban missiles and Kennedy promised to remove U.S. missiles from Turkey (the missiles being there is the reason for the crisis in the first place).
The object has to be in a database in one of the regions I guess.
Or sign up with a free text provider like eternal september?
What I imagine it's like is if you can "replay" a song in your head, you don't literally hear it, but it's a very similar feeling as actually listening to the song.
A former White House scientist was scammed out of $655,000. Then came the IRS
Search for universal "TV scaler board", they do exist but I don't know how well they work.
I understand this is an April Fool's joke and is intended to be satire, but I don't think that's made clear enough in the text. There's risk that a junior engineer or student reading this will misunderstand it as sincere, and be dissuaded from technical work altogether.

Make no mistake, there are plenty of people in our industry who hold genuine opinions like this and are more than happy to bash less experienced people for trivial tool choices.
We went from mostly fearing vibrations in a mechanical world to harnessing them in a chemical and electrical world. It entirely reshaped our relationship to the world and perhaps so fast that our brains haven't entirely caught up yet. I wonder how many well controlled oscillations of mostly electrical charges happened between me swyping this and you hearing it in your head. We rely on them instead of fearing them now.
I think that has happened, a few times, in China. They can get pretty harsh, when it comes to punishments. Corruption (at least, the ones that get caught, or embarrass the Party) is also sometimes met with capital punishment.

Corruption is a huge problem, worldwide. We have plenty of it, in the US, but other nations almost have it in their constitution. Everyone just expects a little silver to cross their palms.

I had family that was very big on fighting corruption.
Also, this reminds me of the time Microsoft bought Hotmail, and couldn't port it to WinNT. They had to leave it on its BSD variant for a long time, NT couldn't handle it.
NixOS has one fatal flaw
Show HN: Bemi – context-aware data change tracking for Prisma
Hey HN, we’re Evgeny, Arjun, and Donna - we’re building automatic data change tracking for PostgreSQL and we’re releasing our Prisma integration! The repo is https://github.com/BemiHQ/prisma and our home page is https://bemi.io.

We've built robust data tracking systems before, for example at companies that hadn’t implemented an event-sourced architecture from the get-go and needed to scale with traditional transactional databases. We’ve since learned that the tech is useful to lots of others. We’ve gone full-time on Bemi now and have been following that demand to build a general-purpose tracking solution that can be used for a wide range of use cases such as reliable audit trails, surfacing data to customer support, reverting changes made in an API request, or testing different application states.

We’ve built Bemi to be lightweight and secure. It takes a practical approach to achieve the benefits of event sourcing without requiring rearchitecting existing code, switching to highly specialized databases, or using unnecessary git-like data versioning abstractions. We want your system to work the way it already does with PostgreSQL to allow keeping things as simple as possible.

We plug in at both the database and application levels, to get reliability, performance, and also a comprehensive understanding of every change.

On the database level, we ingest changes using change data capture (CDC). On the application level, our library allows passing application context and metadata to the write-ahead logs (WAL) automatically. We then stitch the change data together and store it in a structured format in a destination cloud PostgreSQL.

We plan to charge for compute if you’re a company storing >1M changes a month. If this is something that seems interesting to you feel free to play around with it or message us! We’re still early and it’d be amazing to get HN’s feedback.

What do you think HN?
I don't return always to the same one (that sounds boring) but certainly have a "portfolio" of daydreams and scenarios that I go back to. It started as a kid where I'd want to be a cowboy or a longbowman or whatever and just started playing those "movies" in my head. It's odd for me to accept that others don't do this. I would think that everyone can do it, but most people choose not to, the same way everyone can draw and learn how to draw and use that to day dream but most people don't.
That is not something I have encountered (I don't think), or if I did, I didn't absorb that detail. The words don't exist in my brain.
I spent a few days trying to configure systemd-oomd to work with my machine but I kept getting hangs when running out of memory. earlyoom is a lot simpler and thus more reliable. It only took ~5 minutes to install and test to make sure it worked and I've never had a hang since then.
Empty (total = 0) -> photon A -> charge battery element 1 & entangled battery element 2 where battery element is/are the atoms storing the charge.

One cannot assume the charge will be split 50/50 because its probabilistic and how the atoms are impacted by the photos may impact charge. Also, it may be the case that - probabilistically - the charge is no better or more efficient than a classic battery. Anyway, I think this explains how a lesser charge may result in a higher stored charge.
Still, it happens sometimes. It's how my hometown became world famous.

https://duckduckgo.com/?q=peanut+corporation+of+america+blak...

https://www.theguardian.com/us-news/2015/sep/22/peanut-corp-...