skysight-inc/HackerNews huggingface dataset:
I don't think you can ever get Nix as simple as PNPM, simply because native libraries are sometimes annoying, need to be configured at build time to a greater degree and because the problem space it attacks is so much larger than PNPM, which only deals with the JS/Node.js ecosystem.

However, I do think that there exist reasonable levels of abstraction that sacrifice some expressive power for simplicity and such systems could maybe expose a PNPM-like CLI. One example that comes to mind is devenv.nix [1]. While it doesn't yet have a CLI, its configuration file is YAML and relatively simple. I think there's more to be done in this space and I hope for tools that are easier to grasp in the future.

> Nix package files evaluate down to configuration for the Nix package manager, but I haven’t ever seen a good explanation for the basic essentials underneath all the abstraction. Every guide I’ve learned from and all the package defs I’ve read seem to cargo cult many layers of mysterious config composing config. Without easy to learn essentials it’s difficult to grok the system as a whole.

To me it sounds like the essential that you're referring to is the 'derivation' primitive, which is almost always hidden behind the mkDerivation abstraction from nixpkgs. This [2] blog post is an exploration of what exactly that means.

I'd also love for the documentation situation to be much better, in particular in terms of official, curated resources. But I'm not convinced that you actually need to know the difference between derivation and mkDerivation to make effective use of Nix, because in practice you would always use the latter. That said, mkDerivation and the whole of nixpkgs is essentially a huge DSL (I believe this is what you meant when you said 'config composing config') that you do need to know and is woefully underdocumented.

> I would love to adopt Nix for developer tooling for Notion’s engineers, but today it’s about infinity times easier to work around the limitations mentioned of Docker+Ubuntu+NPM than to work around the limitations of Nix.

One approach I have taken to is to specify the environment in Nix, but then generate Docker devcontainers from it, so most people don't come into contact with Nix if they don't want to.

[1] https://devenv.sh

[2] https://ianthehenry.com/posts/how-to-learn-nix/derivations/
Lighting a Fire Using Friction
And that you throw a thousand or two dollars their way in your will. Pay it forward.
So $25 per month/DB and then usage based?

Is bandwidth also paid considering it will be only used in the internal Fly network?
I think we take it for granted that if your planet simply doesn’t have the right resources available, you’ll never truly have an Industrial Revolution. If there is life, it’s more probable it is stuck in some crude Stone Age state rather than high tech.
I've never understood why hacker news needs to feature every outage that ever happens
still happens for some of us who remain on IRC
I realize this is a contentious topic, but I don't think it necessarily deserves to be flagged.
Service will resume in about 15 minutes.
No threat model given.

> Adds per-network MAC randomization

Where the heck is this thing being used?

> Setting more restrictive file permissions (Based on recommendations from lynis)

Often results in more code being run privileged...

> Brute force protection by locking user accounts for 24 hours after 50 failed login attempts, hardened password encryption and password quality suggestions

Introduces a serious DoS vulnerability.

> Disabling unprivileged user namespaces

> Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces

Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege. And flatpak is a lot of attack surface no matter how you run it, and the packages have a bad security reputation.

> Installing Chromium into the base image (Why chromium?) (Why not flatpak chromium?)

Just more attack surface if you didn't remove Firefox.

> Including a hardened chromium config (disabling JIT javascript)

... and pushing everybody into a less tested code path.

Again, what is this trying to solve?
Ask HN: How does a "cracker" do transaction?
"Crackers" means people who write and sell malwares, who steals non-public data and sells online, who finds exploitations and sell it to brokers.

I'm super interested in knowing how these guys do transactions. Specifically, how do they cash out? There are not a lot of things that can be purchased by Bitcoins so they have to cash out somewhere. But then the fiat money ia going to be tracked. Individuals usually won't be able to laundry the $$ so how do they avoid getting marked and caught?
We can expect countries that don't give a damn about patents and IP will mass produce this and flood the global market to the same degree they have for boner-pills.
Saudi Arabia seemly is trying to have peace with Yemen and there are rumors that US is not bombing Yemen because of this too. Seemly is better to ignore Yemen despite their attacks than risk Yemen bombing Saudi oil operations again.
> "degoogling" is nice in theory but I've rarely seen it done well in practice. There are either severe UX tradeoffs, or security pitfalls where maintainers mess with configs they don't actually understand.

As heuristics go that's how I feel about many "security" respins
Don’t push to prod on friday
Yep, they've had that feature for quite a while, too.

I've always had the impression that - although obviously there is pressure within the company to monetize - they seem to have a lot of developer focus on 'just doing the obvious things that clients want'. Almost every major complaint or feature request I can think of from the last decade or so of using Discord has been addressed in some way, which is really cool to see from software... even if they do somewhat irritating things sometimes.
What is the logical fallacy here?
Also taking notes to bridge the time gap, physically or even just in the mind, can help improve understanding. Could be described as rubber-ducking with a future self.
Alright, good to hear. I'll wait.
If like Andrew you find yourself in a situation where a GPT-generated text adventure sounds exciting, let me urge you NOT to do it and browse ifdb.org instead. There are thousands of super creative text adventures there made by a super-active community that are just begging to be played. You could live 10 lives and still find something new to play every day.
On the developer side they call them "guilds," fortunately. Interestingly it's somewhat common for failures like this to only affect a few guilds at a time (though there are of course catastrophic failures from time to time).
but CD
Q1: yes, it does. LLMs can’t cleanly separate instructions from data, so if a user says “retrieve this document and use that information to generate your response,” the document in question can contain more instructions which the LLM will follow.

Q2: the LLM, following the instructions in the hostile URL, generates Markdown which includes an image located at an arbitrary URL. That second URL can contain any data the LLM has access to, including the proprietary data the target user uploaded.
we are on it
> As a professional computer scientist I am familiar with all the major programming paradigms and all the general syntactic modes, whether that be C-like, Python-like, Ml-like, prolog-like, lisp-like, etc.

This is an overly pretentious opening for a comment even for HN.

It certainly makes me feel the need to point out that the majority of people on HN (including myself) are most certainly not "professional computer scientists." Neither are users of Docker nor system administrators. Opening your comment this way is implicitly excluding those people from using Nix.

> Nix is entirely unsurprising to anyone who is familiar with lambda calculus which should be all computer programmers really. It's fundamental. It'd be like a linguist not knowing what a preposition is.

I took my computer science classes from a department that was probably slightly more math-focused than the median CS program. Among those classes was a (optional to non-honors students) 400 level theory of computation class. I don't believe there were more than 2 hours of lecture regarding the lambda calculus, just as an aside that it was an alternate model to Turing Machines and was fully equivalent. We had a single weekly assignment that involved it.

I encountered the lambda calculus more in my philosophy classes than in my Computer Science classes.

On top of all of that, I know I am not alone in finding many forms of mathematical notation, including the lambda calculus, to be poor notation for writing software.
See also https://wiki.c2.com/?ScheduleChicken
A Scientist Says Humans Were Meant to Live So Much Longer; Dinosaurs Ruined It
I always felt wikipedia embodied the original idea of the two way web.
You are assuming it is sudden on the inside, because it was looks that way from the outside. It usually isn't.
Yes I am very bad at arguing. But it doesn't change the facts which is that Tesla FSD is vastly better at driving than anything else out there.
As I understand it, it is just browsers enforcing it, with Safari [1] doing so first, then Chromium [2] doing the same, both doing so in 2020.

[1] https://support.apple.com/en-us/102028

[2] https://chromium.googlesource.com/chromium/src/+/master/net/...
The author's point is deeply stupid. As he admits:

> WebP re-encoding of an already lossy compressed JPEG

So... all this shows nothing. Is webp worse than jpeg? Not addressed. He re-encoded jpeg to webp and it somehow didn't magically cure the compression artifacts he's seeing! Who coulda thunk!

Any comparison starts with taking the originals, encoding to jpeg and webp, and comparing that. Or he could repeatedly encode original -> jpeg -> jpeg and compare that to what he has, which is original -> jpeg -> webp
> Suppose Pence went along with Trump's plan, and refused to count the electoral votes of certain states, and declared Trump the winner. Biden surely would have challenged Pence's act in the Supreme Court. What if the conservative majority upheld Pence and declared Trump the legitimate winner?

To make this hypothetical even more fun, imagine this decision is reached using the same legal reasoning as in Roe. What could six conservatives unconstrained by the constitutional text do? I wonder what’s lurking in the penumbras of the tenth amendment?
Because they weren’t aware apparently. There’s a update, OpenAI banned their account.

https://x.com/alexeheath/status/1735805122104680675?s=20
Not exactly what I was thinking of, because that's more on a local system than at web scale. Something else, I'm sure it's related though, kinda like a crowd crush?
If only NixOS supported isolating packages/devshells
In gaming terminology, those users got taunted. [1] https://leagueoflegends.fandom.com/wiki/Types_of_Crowd_Contr... or [2] https://wowpedia.fandom.com/wiki/Taunt
A couple hours to block unauthorized iMessage clients, but a couple months to fix a vulnerability that can be triggered over the frigging ether. Stay classy, Apple.
It seems extraordinarily unlikely that the inevitable fall of the US hegemony will be at the hands of present-day Iran.
At one of the early Nazi Party Congresses, the League of German Girls delegation was camping in the same spot as the Hitler Youth delegation. Several dozen of them got knocked up; this turned into a large enough scandal that the camps were separated in future years.

Why was it such a big deal? Because the Nazis had banned abortion just a year or two earlier.
But what if translate everything to LinearB or Klingon pig-Latin and then encrypt. Am I required to provide a Rosetta Stone to investigators?
Totally fair point! We're planning to add a feature where you can record yourself doing some task and then [name redacted] can repeat it for you. Would that you give you more confidence that the AI will do the right thing? We're thinking this feature will useful for automating repetitive actions reliably.
> To me, it only communicates that the issues were embarrassing, inconvenient, or otherwise do not shine a good light.

> Am I reading too much into this, or does this kind of pithy announcement usually hide skeletons? Genuinely curious here.

This line of thinking bothers me. It reads as if you feel like you're owed something from the company. Why does it matter?

If it's fundraising issues, lack of product market fit, founder disputes, team member stole the entire bank account, the end result is the same. They can't run the business. As long as there's a clear message and a path to EOL for active customers, what possible reason could help?

To me, it actually highlights the praise of the team and the products they built together instead of focusing on the details of why they're no longer operable. And reading the other threads here, they did a great job but there simply wasn't large enough captive market.
nice! loved the summary
> Interestingly it's somewhat common for failures like this to only affect a few guilds at a time (though there are of course catastrophic failures from time to time).

In fairness, if I was running a service like this, guilds or whatever would map to actual servers striped across multiple failure domains (albeit not 1:1).
It's an interesting area, the 5th is actually really narrow (and of course other jurisdictions have something else). It's not obvious what can be compelled; e.g. it wouldn't seem like a court ordering you to defeat such a measure would run afoul of 5th, but maybe something else.
Interesting, I'll have to get a copy of that book. It goes to show how difficult succession planning and keeping a culture is, once the founders retire or leave.

I'm reminded of the "HP Origins" video from 2006. There's a clip of Bill Hewlett towards the end, talking about the HP Way:

> "We hope that the people that'll follow us will have the same ideas...I don't think that a lot of these fundamental positions are going to change very much; they're too ingrained in the organisation." [0]

Sadly, this didn't come to pass.

[0] https://youtu.be/Iqv6DhtLay4?t=1327
Matthew Perry's Cause of Death Revealed as 'Acute Effects of Ketamine'
s/USAians/Americans/
As mentioned, Qubes would be ideal for this. A new VM for each development project (or same attack levels - for example, VM for professional software dev, VM for side projects, VM for playing around with random interesting GH projects, etc). Requires a ton of RAM though - also a good CPU. And forget about gaming!
old school solid state with modern 3d printed techniques :
rotational / motion dependencies only!

https://hackaday.com/2019/03/02/3d-printing-logic-gates/

https://hackaday.com/2017/01/03/make-logic-gates-out-of-almo...

https://www.nature.com/articles/s41467-019-08678-0

https://www.youtube.com/watch?v=unzNxzKcAGY
The Forge helped Bethesda out on Starfield’s rendering. I find this a little worrying considering how badly that game performs with mediocre graphics
In the UK you have to hand your password over on command
Lead Levels in Children's Applesauce May Be Traced to Cinnamon Additive
Concern about the poisoning cases, affecting as many as 125 children, has highlighted a broader gap in F.D.A. food oversight. There is no federal requirement to test for lead in food made domestically or imported into the United States. In this case, a North Carolina health department investigation pinpointed the source of contamination after receiving reports of high levels of lead readings in children’s blood tests
They definitely aren’t channels. They’re more like a namespace. You can have multiple actual channels within a server namespace.

And this design, despite technical SPOF risks, provides a massively better UI/UX than Slack for communities. Honestly discord is the best thing since IRC for non critical communication.
One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc).

Security is always a trade off with convenience. Nobody will be installing this distro by accident, so your "who's this for? what is it trying to solve" is a bit misdirected.

With that said - immutable is clearly the future for all operating systems, not just Linux Distros. It doesn't have much to do with security, although that is a side-effect. It mostly has to do with system stability, testability and repeatability.

Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system.

After you setup your traditional machine, you install various drivers, updates, software, tweak some settings, remove some things - now your environment is unique to only you. This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Immutable solves that.
Fly.io employee here. Go with Supabase if you want a managed database. Fly.io Postgres is unmanaged. This is the key difference, yes.
The fall of US hegemony is much more likely going to be the result of the US government abdicating its responsibilities to the world than the result of some other hegemon materially overcoming the US. This is as good an opportunity as any for that to happen.
From the FAQ: "iOS doesn’t support running services in the background, so running a UnifiedPush distributor won’t be possible without jailbreaking or Apple’s approval for the foreseeable future."
In some ways I think this is a tricky problem since you want users to get deeper into some topics, but not ones that are considered "problematic", but defining those is inherently political.

It seems like you could define some idea of "depth" into a topic (based on how far out of normal viewer's patterns it is), and only generate recommendations for items that aren't far outside of the norm, but this would lead to a lack of depth for recommendations in niches.

Maybe a middle ground would be to treat sensitive topics differently in terms of "vertical" recommendations, by e.g., explicitly marking some categories as safe and enabling recommendations to go deeper, but only allowing "horizontal" recommendations for unknown topics, and maybe preventing recommendations "into" that topic from the outside.

So... if you're watching train videos you might get to see even more niche ones, but welding won't recommend for you fox news, and watching fox news won't show you Alex Jones recommendations.

I pick on the right here since it's in the topic (and I'm left leaning myself), but I think radicalization is an issue on the left as well (though frankly my political opinions make me think it is less impactful there, mostly because of the way people radicalize on the left I believe tends to impact less marginalized people or be in terms of policy rather than affecting people that are already beaten down).
"The exact method of intake in Mr. Perry's case is unknown. There were trace amounts of ketamine detected in the stomach contents. He was reported to be receiving ketamine infusion therapy for depression and anxiety. Per the Medical Examiner Investigator’s report, his last known treatment was 1 w weeks Prior to death, and the ketamine in his system at death could | not be from that infusion therapy, since ketamine’s half-life is | 3 to 4 hours, or less."

"Toxicology testing reveals ketamine levels at 3540 ng/ml (3.54 microgram/ml or mg/L) in a peripheral blood source, and | 3271 ng/ml (3.27 microgram/ml or mg/L) in a central blood source | in Mr. Perry's system. For context, in monitored surgical- | anesthesiologic care, levels for general anesthesia are typically in the 1000-6000 ng/ml ranges"
It's not accurate that every company that is acquired is non-viable. For example sometimes it's more about timelines because building your viable business into a different kind of business will take a lot longer than you are up for. Sometimes it's because the principals are more interested in doing something else, etc.
I learned about RDC engines from this great video https://youtu.be/fRMMSyCcTDI?si=ccXeWtJ7N3oibyuH
Uptake of perfluoroalkyl substances, pharmaceuticals by oyster mushrooms
Yeah. I believe they can look in your phone.
> With just a few missile attacks, most of them failed, the Houthis have disrupted global trade.

The Houthis have repeatedly stated they are only targeting ships heading to/from Israeli ports. Everyone else SHOULD be able to proceed on their merry way, but I understand the rationale of risk avoidance by simply avoiding the whole region.

> I wonder why we don't see Egypt's and Saudi Arabia's navy sending ships to the coast of Yemen.

Hmmmm, Saudi Arabia is in an awkward position. They've been at war with the Houthis partly because they are Iranian proxies. But now they are starting to repair relations with Iran. Also the Saudis need to maintain credibility with the Islamic world as a whole, and it would be a very bad look if they were interdicting Yemeni efforts to support the struggle for Palestinian liberation.

Egypt might be similarly passive, but more for domestic reasons. Western-leaning government prefers relatively normal relations with Israel (and booming Suez Canal traffic), but likely large portions of their population doesn't. "Do nothing" is an easy middle ground.
About aborted landing.

Regulations considering all such things, because of this, decision to make landing, taken by captain, considering weather conditions, technical state of aircraft, and physical state of crew.

So, in ideal conditions, many such planes could make landing on just some 200m, but in reality, they flight only on strips approx 1500m or longer, for safety considerations.
Umm... Are you sure you don't have aphantasia?

When I've asked a room full of people "close your eyes. Think of an elephant. What do you see?", 80% of the people say "I see a rough elephant". I've asked "do you really see it? Like, there are proportions, colors, etc.?" Most people say yes.

When I close my eyes and I do this, I see... nothing but dark eyelids with sparkles.

Are the other people I've asked this of lying? Or are you mistaken that normal people don't have a mind's eye which actually reproduces images?

EDIT: OK, I'm curious. I've created an HN poll. Obviously our readership isn't an unbiased sample, but I'm very interested to learn how different people experience this experiment.

https://news.ycombinator.com/item?id=38660632
Show HN: 132 Website Builders
I've been collecting websites builders in my bookmarks for years.
Later I even built and shipped my own.
Which pushed me to go out and collect even more website builders to see the state of the market.

Long story short: pretty much all websites builders in one list. Use it, if you wanna get stuff done faster.
Is this supposed to just be a 2 page PDF, am I missing something? Kind of ironic to call out bad research with such a sparse paper.
Messenger supported XMPP clients but didn't federate with other servers.
that paper is now considered to be a psyop fwiw - but in the direction of too little data, not too many layers
> one shouldn't use biometrics.

How else do you protect against the exploit of security cameras, anywhere you unlock your phone, recording your passcode?
IBM used to have a bunch of songs they'd get together to sing

Here's a fun Christmas themed one

https://www.youtube.com/watch?v=AxFMV6tAg64
It's pathetic to call them ghetto cars, rez wagons or whatever racist term you want to use.
>> big data

> fat geordi

massive worf
ye olde net.split
I think I've seen somewhere years ago an article claiming size is needed for training. Which means probably that after training model can be optimized to minimize the size. Purging? However, smaller model cannot be trained that well. From my experience with image processing the bigger the better, and, they all have their limits. Nothing new here.
I’d pay for it if I felt the need to at this point. So far, all of the features offered are things I don’t need. I’d pay a base $2/month (or similar) fee at this point to avoid changing shoot-the-shit-with-friends providers every few years.