skysight-inc/HackerNews huggingface dataset:
i mean of course, because of ridiculous regulation and process.
In the Play store it is possible to see what permissions are required and data is collected.
Foreign keys are often the best (and only) documentation of the data model, and the only one guaranteed not to decay, so this is an important consideration when rethinking them.

That said, I quite like this post and the way the author is thinking critically about software decisions most of us take for granted. Even if you decide that foreign keys are always best, this type of thinking is a great way to improve your understanding.
that's ridiculous. I live in SF now and the driving situation is seriously challenging.

Even the straight, flat, streets can be nuts - like Polk St: pedestrians can jump out anywhere, slalom of delivery trucks, delivery scooters, ride-hail cars, double parallel-parked, with bike lanes - its a major cyclist route also busses and those little tourist scooters - oh and the electric unicycles that are always blowing stop-signs! the type, shape, size, and behavior is all over the map. go two blocks over and you have to deal with cable-pulled trolleys having the right of way across the 12% grade intersection. last week there were hundreds of drunken santa-clauses jay-walking between bars. oh and the line of tourist cars (who knows what traffic behavior they might follow!) heading up to see the crooked street - as the high school is getting out.

LOL get your memory checked, memory checked, if you recall driving in SF as unproblematic.
You can see this stuff often even in test workloads. But even if you disregard that kind of issue, you still have stuff like needing to integrate networked database connections into e.g. event loops, which you don't really need to do for things like sqlite.
This is good news. LA Fitness should be next. Is super-easy to become a member online. Enter CC ... click on agree ... done.

Want to cancel your memebership?? ... well, please drive to the nearest LA Fitness and try to find a manager ... not a rep taking new members but an actual manager, the reps can't help you to cancel. I went twice to my neighborhood LA Fitness to try to cancel my membership and the manager was 'not available at the moment'.
I wouldn't really call this a bug, more like an unfortunate side effect of combining these particular components: domain names that can change ownership, BYO email (as backup email & email provenance), the liberal allowance of plus-aliases (which I'm sure someone somewhere is claiming a business need or they would have killed it long ago), and service implementers not reading the documentation (or largely copying solutions from a video or example with cut corners for brevity/simplicity, likely to facilitate its easy consumption).

If I were designing a circuit with a few PCB components and needed to introduce resistors and transistors as appropriate for the voltage and current needs of the device .. would you expect me to read the data sheet or just guess it from a simpler example and run with it? In a lot of cases the circuit would still work, or it would after a few bench tests and a bit of probing. But maybe it wouldn't be as efficient and a component would short out leading to low MTF and sad customers. Worst case scenario maybe combusting batteries and real harm. Now ask yourself, is it really the PCB modules' manufacturers fault that the device fails prematurely? Or is the device manufacturer the one responsible for reading the data sheet?

I don't typically hold all software to such rigorous expectations but when it deals with authentication and authorization I would expect service owners to be thorough.

TFA even says that the issue doesn't exist if the docs are followed. Alphabet did at least acknowledge there's a weakness there by granting the bounty, maybe they'll provide some controls for company administrators to allowlist/rejectlist plus-aliases or nonexistent roles, or maybe restrict the migration of Apps-affiliated emails to non-org claims? (My guess is they're measuring the impact of this, or prioritizing the measurement of impact, where priority is low because it is a problem with clients that assume email claims are more authoritative and permanent than they actually are).

I suppose the definition of "bug" depends a lot on the definition of "expected" and who's expecting, but I would assert it is not a deviation from intended behavior, at least, and not unexpected to those who grokked the docs.
If you're not familiar with different types of social etiquette, then you simply don't know enough to participate in discussions.

In this case, educate. Let's assume that you're correct... you have specific knowledge that could change the way the OP thinks about plastic. What exactly is your goal of participating in this conversation if it isn't to have a back and forth and learn from each other?

Maybe, by actually having a conversation with this person, you could better understand what misconceptions exist and how to combat them?
Good article. Some smaller changes you could make to the final function: In the last line `as.data.frame(do.call(cbind, out_list))` is used to convert the list to a data.frame. Passing it to `cbind` converts the list to a matrix (i.e. combines it into one long vector internally), and then `as.data.frame` converts it back to a list (as noted in the article data frames are lists). Instead, you can use `as.data.frame(out_list)` to make your list a data frame directly, to avoid converting the list to a matrix and back to a list again. The `unlist(lapply(split(cvec, groups), aggfun))` is also doing a lot of work, if you don't mind using an external package*, `collapse::BY(cvec, groups, aggfun)` is much faster (doesn't require converting `groups` to factor, doesn't copy `cvec`'s contents like `split`).

Here's some completely not-the-point of the article code review since I can't help myself. If you can set up earlier steps give you a named list for `col_grouping`, and use `lapply`, the code is a little more concise:

efficient_flow_agg <- function(dat, col_grouping, gpcol_name="GroupMembership") {
make_postproc <- function(gp, groups) {
gp$preproc(dat[gp$which_cols]) |>
lapply(collapse::BY, groups, gp$aggfun) |>
gp$postproc()
}
col_grouping |>
lapply(make_postproc, groups = dat[[gpcol_name]]) |>
as.data.frame()
}

* I had previously written here that `tapply` is probably faster, but apparently `tapply` does exactly `unlist(lapply(split(x, g), f)))` anyway? wtf R. Strange there's not something like `collapse::BY` in base R.
It’s not straightforward. What is your “X”? Duck curve shifting within the day? Or seasonal storage to account for a no-sun / no- wind black swan week like they had in Germany recently?

If you are just interested in intra-day shift, then battery+solar is already being widely deployed (in a pretty under-reported way IMO). Seasonal is way harder, I think smart grid / demand-side automation could actually be the key to resolving outlier events rather than building mostly-unused peaker plants.
William Steinway Diary Project
View, upload, and delete Blob files in the dashboard
> I’m simply saying that factors unrelated to driving skill should be excluded. Things like being inebriated, purposely breaking driving laws, looking at a cell phone.

What is driving skill if not knowing not to do these things?
also known in industry as Account Takover
That sentence is not talking about the headline hacker (Kurtaj).
Seemingly this individual is highly skilled (in technology) yet managed to fail at opsec. Anyone know how police managed to find/grab him?
How much would that get someone on the street committing the same crimes? Maybe probation or a couple years of jail at most? That's what I'm comparing it to.

If we were routinely jailing people that had trouble controlling their emotions and had propensity for violent outbursts we'd have a lot more people in jail, so I don't believe this alleged violence was really what got him this sentence.

Similarly, how much would someone get for scamming/hacking/social engineering a small company or individual? Well that one is easy to answer: nothing - this behavior has effectively been decriminalized in the UK.

So neither his crimes add up to such a sentence.
Show HN: FXYT – Tiny, stack-based, postfix, colouring language with 36 commands
Restrict access with IP blocking by CIDR range
Wikimedia Russia has been dissolved
Memory Safety Is a Red Herring
Chargeback time...
What would be the advantage of implementing it in the application?

I only see disadvantages:

- no data integrity check in the database

- more complicated definition of foreign relation, or none at all, leaving possibility for deviant data

- scatteted schema. Cant look at the db table and understand the entire model. Have to hunt in code an potentially across a lot of code.

It just seems like a data integrity issue that needs to be enforced at the db level.
Using an intermediate client would go against many of the claimed performance benefits of not using the FK. One would also likely lose the ACI from ACID. Replicating those features in the intermediate client sure is risky; it would require significant expertise. I'd imagine the implementation would leverage transactions, which would be 'round-trip' to the database server and thus the lock contention would still exist and also be substantially worse (due to the round-trip latency).
I agree. The team at Isovalent is extraordinary and should continue to be strong champions of BPF for network and security use cases. With Cisco footing the bill, I think we will see even more expansion into XDP traffic processing that is native to hardware vs. the current overlay model.

First Splunk, now Isovalent. Cisco has been busy this year!
There is a major difference: VR can't work the way sci-fi enthusiasts envision it for fundamental physical reasons.

You can't have a pair of glasses that is simultaneously opaque enough to give you the illusion you are in another place AND breezy enough so that your eyes won't sweat. Air is just much bigger than light, so you can't block light but allow air to pass through. So a VR headset will always be sweaty on the face. AR will never be able to create realistic opaque backgrounds.

You also can't have a holo-deck-like experience with glasses. The only reason the holo deck captures our imaginations is because it had space, smells, sounds, touch. All of those things are impossible to achieve with physical devices of any kind, or at least very close to it. The only thing that may create a holo-deck like experience would be based on brain-computer interfaces, if those are even truly possible.

Finally, to get many of the claimed benefits, even if the headsets were good enough to deliver them, you also need complex recording software that actually handles all of this. You can't have a nice realistic image of all of your colleagues in a VR meeting unless they each have a 3D camera setup, and everyone has enough bandwidth to actually receive and send all of the 3D videos, and do so with latency similar to audio traffic.

These are at least three fundamental problems that make the whole VR/AR craze just certain to fail. Again.
I mean, we could be spending effort on making human driving safer, but where is the monopoly in that?
Added text input instead of voice as an option today.
It seems like you're saying "IP claims" are a hammer.

So, yes, I favor destroying all hammers.
See also McDonald’s being allowed to gate app functionality behind background location access
> This guy is as much of a "cyber security threat" as your typical socially-awkward gamer teenager, of which we have plenty of

The following quote seems to indicate that the skills of this individual is much sharper than "typical socially-awkward gamer teenager":

> Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone
I have friends at Bayer, so I am well aware. I got the joke, I just ... decided to ignore it because you've been doing this odd mixture of wildly-uninformed and vaguely hostile bits like "I suppose you're going to college because you don't already have the basic life skills to figure that out." for most of the conversation rather than engaging with the article or the rest of us.
Yeah, you really don't _have_ to be insufferable. I use emacs and evil/vim mode, have done for years, and it's not like I bring it up all the time or whatever, or shame people for using vscode.

It is just a tradeoff, like anything else. Using a niche tool means that those not in the niche are alienated, but those in the niche are drawn to you/familiar.

Any time someone brings it up, I basically say "yeah, I use this tool, but it really is just a tool that I personally choose, and can see how someone would pick another one. Not everyone wants to fuss with their environment all the time to get their job done." etc. I both genuinely believe this and think its a disarming POV.

Really, at this point in my career, I have a massive quantity of legacy knowledge that informs my choices. Since I know emacs lisp, and have already expended the effort to learn and use it, it continues to be worth my while to work in this environment. For someone who doesn't have this legacy knowledge, their value calculations won't work out in the same way.
> Which open standard is implemented?

I never said anything about the protocol needing to be a standard.

https://en.m.wikipedia.org/wiki/Straw_man

> iMessage does have an API as well, it’s just not publicly available.

That’s a hell of a “just” ;)
But as long as consumers keep buying them with the software, because they want to watch Hulu and YouTube and Netflix directly without purchasing an extra device (not unreasonable for the average consumer), TVs will come with the software.

You can argue all you want but the market always wins.
FWIW - you can enable Apple's built-in text message forwarding to proxy those SMSes via your iPhone to your Mac - it's pretty seamless.

See: https://support.apple.com/en-ca/guide/messages/icht8a28bb9a/...
Presumably the same distance that gives the calculations uncertainty allows time to adopt a wait and see approach, refine the data and calculations and then make a decision based off of stronger inputs and still avert disaster if necessary?
Added the text input option today.
Exactly! This is a huge pet peeve of mine. I feel like I'm going crazy when I read articles like this one (that is, any of the similar "how to escape containers" blog posts). With the exception of a rare few that actually describe 0-days, the overwhelming majority seem to be exactly like this.

It confuses the heck out of me because red-team-type people will shout from the mountaintops about how insecure containers are and how absolutely trivial it is to break out of them, but when I go look for an example of that trivialness, all I find is stuff like this. Not that these aren't at all useful techniques - there are plenty of containers with --privileged, or a Docker socket mount, etc. But surely this doesn't apply to >90% of containers out there, especially ones that are exposed to the Internet. Your average Redis or Nginx container, or some container running a Python or Node webapp, is not going to have Docker mounted or some weird capability added. Sure, misconfigs happen, us sysadmins get lazy, but this is really common-sense stuff. It feels almost unfair to "blame" it on the container.

Of course, as mentioned, there are 0-days that allow for container breakout, and those are the truly scary stuff. But they seem to be few and far between, and they get publicized semi-widely and patched pretty quickly when they are found.

So to this day I don't really understand all the security folks who act like they (as in any decent attacker, not just a nation-state with 0days up the wazoo) could break out of a container with their eyes closed, while the only material I can find on the open Internet is stuff like this. Am I just looking in the wrong places?
I didn't realize what GT stood for until I came across this thread, I was confused why they weren't providing it's render time results, hahaha
We've heard complaints that this title is overstated, and I'd be happy to replace it with a better (i.e. more accurate and neutral) one, if anyone has a suggestion?
We have some poor soul in Puerto Rico who has a MacBook Pro that is tied to our MDM system and, for whatever reason, it cannot be removed.

The closest we can tell is that he sent his MBP off to Apple for repair and they swapped the logic board with a refurb unit that was swapped from one of our machines. There is some internal tool that rewrites the serial number and apparently nobody ever overwrote the serial number on the removed unit.

So anyway, there's two legitimate MBPs out there with the same serial number, although ours is probably decommissioned by now (I believe it was a 2015).

Was a funny journey figuring out what the hell was going on, though.
Agreed on all points, though I would say that 'home' has very different meanings, for very different people.
>Are we now saying a central authority can simply brick or forcefully install software on any mac at any time given only the serial number?

Apple can brick or install an update to your computer even without MDM. For MDM you can not be spontaneously enrolled. In the article the user didn't notice this had been done until he reformatted his device.
You can manually assign MacBooks to your Apple Business account.

Just install Apple Configurator on an iPhone and hold the phone close to the laptop at initial boot. It will show a sort of QR code and when you scan it it’s attached.

The initial detection will only trigger when it is in the “choose locale” screen, just after the very first “choose language” screen.

If you go beyond “choose locale” it will not work, even if you go back a step, and even if you reboot.

Then in ABM change the MDM platform to whatever you want (your Jamf instance) and Bob’s your uncle
Because the government knows IR would be a pivotal tool in a civilian guerrilla uprising, and they want to keep such things out of the hands of the proletariat?
The title of this post is manifestly wrong. Being locked up for an indefinite period is not the same as being locked up for life since he can be released at any time.

But having said that, being locked up "at His Majesty's pleasure" as this is called is s scary sentence, since you can indeed end up in prison for you whole life if you do not have the support of the relevant doctors.

The conspiracy theorists here should remember he was convicted by a jury and can appeal his sentence like anyone else. If that's insufficient come up with a better system.
You can send them a letter. Way more painful than it should be, but worked for me.
Since Android 12, there is the option to choose between providing "precise" and "approximate" location data to an app. I have found it quite nice, even if it sometimes breaks a random app if a developer hasn't planned to use it.

https://www.howtogeek.com/763227/what-are-precise-and-approx...
> The comments in here are weird. HN is normally an advocate for open protocols (like Mastodon, XMPP)

> It’s weird how open source has taken over the world and yet our messaging protocols have gotten more proprietary than ever.
Of course that works. But only as long as everything is always hardcoded as Send. Which is a known limitation, so no complaints.

Edit: also the problem is about the method async returned future trait bounds, not the Self.
> I've always presumed email was the most stable global identifier for a user, but that assumption appears to be wrong.

It might be the most stable, but that doesn't mean you can assume that it's at all stable.

Also, email addresses can't be assumed to uniquely identify a single person -- lots of people share email accounts with others.
How they define "violent", "injury", and "property damage" is very much important though. It could be as light as knocking a mug off a desk and breaking it or them accidentally tripping someone and causing them to get a minor bruise, or it could be to the extreme of assaulting someone or arson.

Curious to know what their definitions and their examples of this behavior are regarding this person.
The BBC regularly updates headlines after publication (A/B testing for clicks) so it's possible it was the BBC, not the poster.
There are no practical alternatives.

It's just simultaneously true that people are sad about the inevitable loss of a previously open source project, and that people are happy the devs are now getting paid for their efforts.

Imo HN tends to show both once the comments settle.
The federal government is currently running a program where they will give you a $7500 tax break for buying a qualifying electric vehicle. Tesla, being the go-to for electric vehicles at the moment, is obviously a large beneficiary of this, even going so far as to adjust the pricing on one of its vehicles to meet the program's requirements.
Open platforms can be reviewed and fixed more easily and faster
All this focus on Waymo supposedly acting "unexpectedly" but I don't see that word in the original article, and the statistics here implies the opposite -- Waymo gets in fewer accidents overall!

Also, only the 2nd item is even consistent with Waymo behaving unexpectedly (we're not given enough info to know why it stopped). In the first item, the "unexpected" thing is the branch, not the behavior (stopping), and in the third Waymo's behavior didn't contribute to the accident at all -- instead it nearly avoided it despite the other car's bad driving.
Finding folks 10x better than the _worst_ programmers isn't terribly hard. That's probably 2-3x better than your median programmer. Lots of folks like that out there, but it's not always easy to identify them in the interview stage and often they're only that much better than the median in certain contexts.
The article suggests that dextromethorphan (which is a cough suppressant, not a decongestant) might be ineffective as well.
>> We can only extrapolate the "goodness" of a driver by expanding the time we spend observing their driving. 2-3 hours of evaluation will be quite solid.

Millions of miles driven with extensive telemetry for every instant in time and you do not think it amounts to a meaningful level of observation?
how so? firefox exists ... and you can't run (real) chrome on ios
> I’d hope it would be bricked, since that’s the point of this feature.

I wouldn't. A previous owner or manufacturer should never be able to brick hardware against the current owner's wishes.
The sentence doesn't seem just.

Why not just restrict him from electronic devices like what happened to ZeroCool? Surely there are better solutions that putting him in a psych ward for life or until he is 'cured'.
Actually if you poke around at it a little more closely you'll find there's also a version of Llamafile that just ships llama.cpp, enabling you to supply a model of your choosing.

Also the point of a tool like this to make the ecosystem more accessible to everyone, not just software developers.
iMessage supports attachments up to 100Mb and groups of 32 participants. It’s certainly more resource intensive than 140 byte SMS.
You're missing nothing. Other than the fact that we've systematically decided that the average person is too lay to actively care about privacy and interoperability, and thus we all have to embrace the Stockholm Syndrome of acting like iMessage is respectable, at all.

My friend sent me the Beeper Mini article the other week and said "Look, you can have blue bubbles now!". I immediately scoffed - even if it wasn't going to break in a few days, I will never lift a finger to support what Apple is doing with iMessage. Absolutely absurd, even more so absurd the way folks talk about it.