skysight-inc/HackerNews huggingface dataset:
> If you need to run native code, just do so.

Please read the paper; WALI already improves on running native code by being portable and having CFI built in.

> Don't sabotage the only decent chance at finally fixing computer security since Multics to do so.

Wasm has never been about fighting holy wars; I don't think it's productive to ruminate on obliterating all software that doesn't fit one's personal conception of how things should work, no matter how justified it may seem from the inside.

Core Wasm has always been a portable abstraction over hardware; a low-level, but sandboxable bytecode ISA as a compilation target. It's so useful because it's completely separate from the APIs you give Wasm code. It can be embedded into almost any environment by offering an API.

> Capability based security is the main feature of WASM.

The APIs that are exposed to a Wasm can be capability-based or not. It is not inherent to Wasm. The Web APIs are generally not--there are too many ways to circumvent any possible user-level access restrictions in JavaScript. Effectively, the entire JS API surface is available to a Wasm module. That's a property of the Web.

But it's never "game over" for a Wasm module to suddenly get access to the whole world.

What makes Wasm great is that the embedding environment gets to decide how to bind a module's requested bindings to actual bindings, even in an embedding with "dangerous" capabilities. The embedder can decide to interpose, emulate, or otherwise attenuate a module's requested imports, by deciding how to bind to actual implementations. In the case of WALI, because imports are statically named by the module, and bindings are supplied based on those names (rather than by dynamic syscall number), we can statically inspect modules and reject ones that request blacklisted syscalls (or make them nops or whatever you like). You're pretending like a module using one WALI syscall immediately means game over. That's just binary thinking.

Incidentally, there is nothing inherent about WASI that says that the file system has to be sandboxed and capability-based; it's only a convention, which of course can be circumvented by pre-opening the root directory, the proc filesystem, etc--i.e. it's always subject to operator error the embedder level. The embedder decides to do with API bindings; always has, always will.

Besides, this is a first step, a proof of concept.

Of course you wouldn't expose raw, unfiltered WALI calls to untrusted code. (Of course you wouldn't expose WALI to the Web, requiring all Web browsers to emulate Linux.) If you have untrusted code, you still only supply WALI functionality consistent with the capabilities you want it to have, sandboxing any module by limiting, interposing, or blacklisting WALI calls, or building a separate API like WASI on top of WALI and only exposing that. And you can further sandbox the engine itself using techniques for sandboxing processes.
Fighting the borrow checker, much like reaching the summit in Celeste, used to take me days, now takes mere hours
Mindful and Mindless Work
Just because there are some 'extreme' weirdos in the audiophile space, doesn't mean that there is no difference between cheap and expensive equipment.

While people might not be able to tell the difference between $50 and $5000 speaker cables, anybody will be able to the hear the difference between $50 and $5000 speakers.
Would be interesting to further study the relationship between maladaptive daydreaming and brain plasticity
True, but even that experiment has some of the same problems as the prison experiment. We all think we know what the Milgram experiment says -- that people generally follow orders even if the orders are unethical. Except the problem is that when Milgram (and others) repeated the experiment, sometimes they rebelled - in some cases more often than they obeyed. This rarely gets mentioned because it goes against the "meaning" of the experiment.
On Windows, my most common use of the start menu is to tap the windows key and start typing out some math. The issue is that Windows isn't actually solving that math locally, but showing you the Bing search results for the expression. This has annoying latency, means you need an internet connection, and doesn't work for expressions that look like legitimate searches (ex 12345-2345 looks more like a zip code than math). I ended up building a lightweight desktop app with Rust/Sciter/JS that listened on Win+` and gave instant solutions. Was more of a fun exploration of the windows apis, but I easily use this app several times a week.

https://github.com/jpnickolas/Algebrisk
It's very stylish and tasteful!

It looks like the house of someone who was very wealthy by at least today's standards, but I see that he came from a comfortable but not rich family.

Curious, wouldn't a home like that be considered wealthy? Certainly it looks like something that would need staff to keep up when it was a household.
> Is there a technical limitation that make it impractical?

Yes. Diffractive optics (which includes meta-lenses) have significant wavelength dependence. Visible light is 400-700nm, which are different by about a factor of 2. This means blue light will focus almost twice as far away as red light does.

The neat bit is this is actually the reverse of how refractive optics behave, which means you can use both together and cancel out a significant portion of chromatic aberration. If we can scale up the manufacturing (and ideally apply them to curved surfaces) they could improve performance and reduce complexity and weight of VR/AR optics.
> People who cannot see the differences or who only see them after taking a close look should realize something: there are many people for whom the differences are going to be immediately obvious.

That's one possible conclusion. Another is that some people are overstating how obvious it is. I don't mean this as an insult - there's plenty of cases where people's stated perceptions and preferences disappear when tested under strict conditions (hello Audiophiles).

So - it's not immediately obvious whether claims such as yours are trustworthy.

(for the record I can see the difference but it's fairly subtle on my screen)
That's all right if they are not integrated into an IDE. The typical scenario is: a file is edited by a human -> linter/formatters run -> 60 seconds delay -> the file is backed up. Therefore, debouncing has a handy side-effect of letting linters/formatters run before a version of the file is stored.
> I've noticed the same issue with WebP and have gone back to JPG/PNG for most things (jpg for photos, png for UI-type images)

Wait... I agree for JPG but if you use lossless WEBP instead of PNG, isn't it simply the same pixels, just with a file about 30% smaller than the corresponding PNG file? (and 15% smaller compared to already heavily optimized PNG files like when using zopfli/optipng/etc.).

Isn't the "lossless" in "lossless WEBP" actually lossless when converting a PNG file to WEBP?

FWIW when you convert losslessly a PNG to WEBP, then decompress the WEBP back to a PNG file, then convert again that PNG back to a WEBP file, you get the exact same lossless WEBP file. It's also the same WEBP you get when you encode losslessly from either a PNG or that same PNG but "crushed" with a PNG optimizer.
There's actually a few interesting articles out there about this: https://theconversation.com/the-art-of-aphantasia-how-mind-b...

"Edinburgh: “I can remember visual details,” he commented, “but I can’t see them”."

In this one, they show step by step how the artist does it: https://aphantasia.com/article/stories/visual-artist-with-ap...
It is not.

However the adaptability of character creators is still a hard problem.

Like, I’m not particularly concerned with character aesthetics but I still found myself reject every single god damned hair style for my male OC in Baldurs Gate 3.
100%. Target unaware templating is always a mistake. It is unfortunately common in our industry because it is easy and works most of the time. But this is also why SQL injections and XSS are one of the most common vulnerability. SQL injections are getting better because people are more often using parameterized queries which never need to actually encode the values into the "template" and XSS is getting better because most big frameworks now have target-aware templating that properly serializes values. But these are both hugely common issues. Look up a tutorial about how to use SQL or make your first website and more likely than not you will see examples that have vulnerabilities. Our whole industry is teaching the wrong thing by default, then hoping to fix it later.

String concatenation may have been a mistake. The concept of a string may have been a mistake. Every sequence of bytes has some structure, and in order to mash two "strings" together they need to be serialized in the correct way. Even when building error messages it would be nice if you can reliably identify the "chrome" from the "content".

Also look at terminal escape sequences. When we print text to a terminal we should probably be replacing non-printable characters with some sort of encoding so that the reader can understand that 1. these are from the content not the application and 2. Not do stuff like delete the output line to trick the reader.

Every time you put two strings together you should think about how you need to properly encode one into the other. Output unaware text templating almost always fails this because it relies on the user to do this for every single interpolation, and that is doomed to fail.

I wrote an even longer rant about this on my blog a while ago: https://kevincox.ca/2022/02/08/escape-everything/
The problem I've noticed is that scrolling numbers are way easier to implement than useful GUIs.

I have half-joked that GUIs are an unsolved problem. Someone called me out and said that so many GUI frameworks exist. I now think I am not joking. GUIs are an unsolved problem.
I also have aphantasia. I'm hoping that if they start running these tests on humans that they make sure they bring in people with aphantasia. Something like 1 in 20 of us have it. For example, when I daydream, I lose myself and come back to myself a short time later. It's kind of like highway hypnosis, but I do know what I was thinking about, it just happened "off-screen" so to speak and I become aware of it all at once. It would be interesting to know if the same regions of the brain are lighting up. Maybe we can figure out what aphantasia is, from an anatomical perspective.
The data was siphoned from Delta Dental, not sold by Delta Dental.
Absolutely, but I do wonder if I should belt and braces it. Just because it shouldn't contact a cloud doesn't mean it doesn't.
Huh. Didn't realise it was so large. Well, it is ruggedised so it still fits well in my pocket without a case.

Ok. I didn't realise that was your only requirement. There are a ton of phones out there.

https://www.gsmarena.com/results.php3?nYearMin=2021&fDisplay... here's everything with a screen of 5.1" or smaller. 30 android phones produced in last couple of years with that size.

Feel free to adjust the phone finder search to your preferences.

For example, here's the 14 phones with a screen size of 4.7" or smaller since you said your iphone was too big.

https://www.gsmarena.com/results.php3?nYearMin=2021&fDisplay...
It seems you've made up your mind without any evidence, but it's too embarrassing to admit you've been propagandized so you're making excuses and deflecting. Asking for a single bit of evidence isn't unreasonable.

For all that's been written about Trump, you'd think this should be easy to retrieve. I've personally looked and found nothing, but maybe my methodology was flawed which is why I asked.

If no evidence is provided, it's reasonable to conclude the claims are false.
I am defending no one. Grandparent comment was asking for OP assertions that I find biased. Deir Yassin quote was a one such assertion. Extremely well researched - books have been written about it - but presented in a very biased manner. Paul cherry-picked the worst description of the events.
In my mind, one of the most likely consumers of our data is insurance companies. It really exposes to me how messed up the idea of health insurance really is.

As an insurance company, you are incentivized to de-risk your pool as much as possible, and by spending a few dollars you're able to get to the earliest possible signals of who might be needing services very easily. Things like complaining about a sore throat on social media to friends, or even within private messages, are all things you might be interested in. Other signals, purchase history, location history, contact tracing, all of these provide potential ways to spot early risk and increase rates/push out the undesirable members of the pool.

Of all of the potential customers of our data, I keep coming back to insurance companies as having the most interest in these signals. When you can identify risks correctly, you can trim out or adjust rates to make things as safe as possible for your income stream.

This has a reactionary component to it that hurts us all. With most of our communication being digital now, I find myself thinking twice about putting out anything that could be taken as a signal to an insurance company. As an avid runner with most of our events organized online, this presents a social cost because I just won't engage in some conversations for fear of how companies will use whatever I might engage with against me.

Where does this type of behavior lead when practiced at scale?
My main driver is Safari. I recently switched from Brave as my main driver simply because of the Sonoma bug in Chrome-based browsers.
If I have three simultaneous/overlapping years of free credit monitoring from various breaches, am I triple-protected?
I looked at your comment history and found your pro-nazi comments to be extremely disturbing.

You’re welcome to have a different lifestyle, but please be respectful of others.
I don't think they went from one to the other, more like they expanded to include sets that adults would be interested in. The way I look at it, the higher end collectable pieces subsidize the lower cost sets and "brick boxes" for the younger generation.
I can fairly easily picture “something,” but it’s always extremely protean. During meditation for example I sometimes picture Calvary, but the forms are just constantly shifting around that theme. I certainly can’t just picture an apple and just hold it still in my mind’s eye. Although I do suspect if I spent around 10,000 hours at it I could get considerably better. The point of all that is I rather suspect aphantasia is very much a spectrum.

I’m really not a visual learner for the most part, and maybe that’s why? On the other hand I’m quite good at shape rotation and other such problems. That and there are times where I find the visual interpretation to clarify my understanding of the abstract concept. The standout example of that is the marvelous Visual Complex Analysis.
The reasoning is based on feelings, so changes with the wind and subjective.
Yes, but it is more nuanced than that. Not that great at LoL, but in rocket league, I have sort of a 6th sense for how people will play up to a certain level. Badminton as well actually. Sometimes it feels like I can read the future when I simply calculated 3-4 hits ahead of time, and like the GP, it is supremely satisfying.

You have to calculate the probability of them hitting, also account for misses, and explore your reaction to each possibility in this tree, it sounds easy but only comes after 1000 hours or so of play..

In the code example, with that level of exp you would also foresee the possibility of failure and account for that. The more times you get knifed, the less often it happens.
New Conductor Fork
tldr: > The FDA says it currently believes the adulteration is “economically motivated.” That generally refers to ingredients being altered in order to make products appear higher in value, often so companies can produce a cheaper item and sell it at an elevated price.

From the title it sounded like there was a supervillain poisoning children for the funsies.
TypeScript is still permissive because it has to maintain compatibility with JS.

We use eslint for formatting and other legal-but-likely-a-mistake behavior and it does catch bugs.
Title is kind of misleading. I honestly thought it would be like that Star Wars one (if someone could find the link that’d be great, I can’t remember where it is) where it’s playing directly in the terminal but this opens a separate window to watch. Still pretty cool, but is it legal?
Letter O vs zero is really bad indeed. Also the parentheses characters are very poorly done - far too similar to the square bracket characters.
Moments in history like these, now have a material place in history with exacting detail thanks to technological feat. May the cosmos bless those lost that day, heal those whom aided recovery, and may their memory never fade. And, may moments like these become exceedingly rare as we humans continue to evolve.
with Knuckles
NSFW: https://en.wikipedia.org/wiki/Cock_and_ball_torture
I see it like this:

- If the analytics don't change the way you write, then they are useless overhead.
- If they change the way you write (because you try to maximize the number of views), then they may be toxic.

IMO you should write what you have to say, not what you believe people will want to read (with the help of tracking).

When I realized that, I removed GoatCounter from my website, which is now a minimal, static, no-javascript, no-tracking personal blog. And it feels good.
That you cannot do those animations is a feature! Animations are useful in places, but they also make for hard to use user interfaces. Widgets where designed in a world where user interface experts sat real humans down behind on-way mirrors and watched how they used applications: those experts had long learned fancy animations look great but typically result in it being harder to use user interfaces.
As CS Lewis said, "Integrity is doing the right thing, even when no one is looking."
Down ballot races are more vulnerable. Especially since we no longer have local journalism to help interpret events.
As is standard, the headline is false.

“Breaks the intuitive notion of causality”, maybe.
Heh, a week ago I was wondering why ubicloud was a plat sponsor at pgconfeu. Makes sense now
Usually, when you buy things that are drop shipped they are also marked up a ridiculous amount.
I found the missing link to the emoji page on Barney Hill's Github in case anyone else was looking for it:

https://www.barneyhill.com/pages/emoji/index.html
Reminds me of this old talk by Tom Scott https://youtube.com/watch?v=y4GB_NDU43Q
Because correctly assigning blame does not solve any issue caused by the racism?
> intuition ... was looked down on as feminine and unreliable

Hate to be that guy, but, citation?

This strikes me as the casual reframing through the eyes of an imagined arch-misogynist that has become so commonplace when reflecting on the past (which was a very different time than the present, but which enabled the present [despite the also-popular idea that we've come to our present place in spite of the past]).

Happy to be shown to be incorrect.
Yes, you ask for an authorization token for recurring payments from your payment provider if you intend to make subsequent charges from that card. Then you store that token only (and maybe last 4 digits of the card for the customer’s convenience) and use the token without any other card information to make charges.
I too share dreams of that open web and want to re-create it. The first JS book I saw was the classic DHTML book with an attractive cover (can't find it now) in 2002 at Kinokuniya in Sydney. Good times.

i'm building a dev API on top of https://github.com/BrowserBox/BrowserBox that should provide the same functionality as a CORS-proxy / unrestricted iframe to be able to embed and interact with content across origins.
> France of all places

France is a notorious snooping hotspot. It was common, in the noughties, to require clean laptops on visits to Paris. Their security service's had a habit of imaging machines left in hotel rooms.
I feel like theres a potential for B2B solutions in this space. Especially for workers who want to bootstrap something quick, avoid something like Teams or other behemoths, create something for a one time survey, campaign, shorter process etc.

So much was lost transitioning from web 2.0 to whatever walled dystopian garbage we have now.

The concept of pipes are way back from the Unix days, and the idea of this modularity and later building stuff from a flow based interface like this somehow never translated into anything on the frontend side.

I've been met with simple specs that had to be built with custom web solutions a few times now where i've almost started building a generalised model like this that could scale because most apps could be defined like this, as entities related with filters between them in sequences related to each other and web views where people could interact.

The closest i found back then was something like Airtable/Zapier combinations that was extremely limited.
> there are only 2 that are relevant: 1. Transformers 2. Diffusion

I'd argue that there are plenty of less sexy, non-unicorn uses for AI/ML - particularly in industrial applications. SVMs, DNNs, etc are still very relevant. As is GOFAI in some domains.
Seems this is a common prompt vulnerability pattern:

1. Let Internet content become part of the prompt, and

2. Let the prompt create HTTP requests.

With those two prerequisites you are essentially inviting the Internet into the chat with you.
Solwind
Solwind was the first, possibly only, satellite downed by a manned fighter aircraft.

More on the story: https://www.smithsonianmag.com/air-space-magazine/first-spac...
LGPL3 on embedded is...tricky.
Apple is bad too, truthfully.

Old school BMW naming schemes were the bomb. The first digit was the chassis, then the second and third were displacement. 330, 525, 755, etc.

M2X, M2XL, M2XXL would have been cooler than the max/ultra shenanigans.
> Storing security codes at all is totally forbidden by PCI rules.

It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers.

Our payment system needs something like:

struct {
string credit_card_number;
string expiration_date;
string insecurity_code;
};

...to complete a credit card transaction. At some point that record is in a computer or in your restaurant waiter's brain, so it's vulnerable to exfiltration, regardless of what part of that record gets redacted for long term storage.

We are living in a world with bozos in charge who can't seem to develop a secure payment system, so we as users need to simply assume that all information required to make a purchase on our behalf is public knowledge, and instead diligently check our records for inaccuracies. I don't sweat these "breaches" because I freeze my credit and review all my bank and credit card transactions daily now.
Looks very inaccurate. When I go there I would have expected to be able to experience the house as James Clerk Maxwell would have, and therefore give me more of a sense of getting to know him by experiencing what he would have experienced on a daily basis.

Why would I go to his house to look at posters giving information, makes no sense I could look at that information from home no need to go all the way to his actual house.
I clicked with the illusion to see and illusion.
Now this is a double disillusion.
Reviving the Dragon Court Browser RPG with CheerpJ
Equally concerning should be the fact that a majority of pharmaceuticals are being produced in countries with lax regulatory controls.

And the regulatory controls elsewhere leave much to be desired.

It took the FDA years to figure out that widely used blood pressure medications were being contaminated with a carcinogen.

https://www.fda.gov/drugs/drug-safety-and-availability/fda-u...