skysight-inc/HackerNews huggingface dataset:
Customer credentials as in this example? I'll be totally frank, I'm having some trouble reconciling that with Article 34 of the GDPR and 1798.150 of the CCPA. Do none of these organizations have EU/CA customers or is the approach they take to laws the same as the one they employ for database security?
Yeah, what happened to the "Hacker" in Hacker News. (responding to people blaming the 'hacker', not the sites).

This guy just grabbed publicly available information, and by 'public' I mean put out onto the web un-protected, just put out there. If you can just basically browse to something, is it really his fault for finding it.

It's like if I have a front door on my house, and just in the front hallway I have a huge naked picture of my wife. If I leave the door open, can I get mad at pedestrians walking by, for seeing the picture. Maybe they walkup to ring the door bell just to get closer look, walking up to the door, but not going in, is allowed.
They can’t because most of the people firing will also be held accountable and fired
All that plastic must have some taste, right?
One of 2023’s biggest trends for web tooling was rewriting existing tooling in Rust. Rust is a wonderful programming language that allows for shockingly fast binaries which still interop well with other web tools courtesy of WebAssembly. The speedups seen in tools such as swc and Turbopack are very exciting for fast development experiences.

But! It’s a misconception to think that Rust-based linters are a complete and total replacement for ESLint today. There are always tradeoffs when switching tooling. In this case, the positive performance advantages come with a negative feature gap: type-checked linting.
Exactly. Why be a vegetarian, or watch your weight if your also going to drink occasionally? Why avoid heroin if your going to overeat once in awhile.
AI and high-performance computing are speeding up scientific discovery
I'm equating this to condition-less coding, where you're trying to eliminate branching logic with bitwise operators or other math.
Glass is usually harmless, if you don't use lead or uranium glass. But breakage will lead to harmful shards, which is why many locations such as some schools or party places ban glass bottles.

For storage, use glass bottles. The material of the seal is usually not a problem if there is no contact to the liquid and the seal doesn't crumble. When reusing bottles, make sure to only use fresh or at least good-looking caps. And sterilize things properly (taking into account what the seal is suitable for), because mold and bacteria are far more harmful than common metal or plastic contamination.
i have been looking into that too and faced the same problem.

where i live, cheese shops do not exist. european style cheese has to be imported and is way to expensive. local options are barely useful for pizza.

i learned how to make yoghurt (from my chinese wife, surprisingly) and a few times turned milk going bad into a cheese experiment that sometimes worked out.

now i am making kefir which turns out to be a lot easier than yoghurt because it works at room temperature, whereas yoghurt needs milk slightly heated.
Sounds like he's using it as a site-to-site VPN
Wow. I was not aware.
I'd imagine genetically driven behavior would be probabilistic and involve many overlapping duration/threshold "checks"
I bet there is way more quantum phenomena reasons involved in why that system was selected for being less fragile and having better stability/survaibability for a wider range of cases.

Thinking in classical compute terms there is like asking for robots that inevitably break without the slightest chance of self repair, much less do it at minimal effort.
I 100% saw it as MM/DD and was wondering why it took them three months to write up the vulnerability and a month to patch it.

Thanks for the clarification
>the developers writing the feature use Chrome.

To write the code? It was only mobile Firefox that was broken. I don't think most developers write code using mobile Chrome.
Shady is a small intermediate shading language and compiler for research
I used wpoison back then: https://www.gsp.com/support/virtual/web/cgi/lib/wpoison/
SQLite works great as the database engine for most low to medium traffic websites (which is to say, most websites). The amount of web traffic that SQLite can handle depends on how heavily the website uses its database. Generally speaking, any site that gets fewer than 100K hits/day should work fine with SQLite. The 100K hits/day figure is a conservative estimate, not a hard upper bound. SQLite has been demonstrated to work with 10 times that amount of traffic.

(Taken from https://www.sqlite.org/whentouse.html)

A toy that can serve the vast majority of DB use cases. I get it, you can't build a massive-scale project with SQLite, but that doesn't exactly make it a toy DB...
AnyDSL: Partial Evaluation Framework for Programming High-Performance Libraries
Logging into another machine just to get a long command resonated with me and is enough that I've decided to give it a try. That, and I'm a sucker for tools written in Rust :)
Impala is an imperative and functional programming language
The problem is people don't know how to quantify the risk, including myself.

However there a number of people who panic! And the panicky people have loud voices. They treat everything like DDT or asbestos. That's not to say that caution is not warranted. It is, but take it easy, the frogs aren't turning gay and people are living longer, so long as they don't get hooked on addictive drugs, including tobacco, alcohol, MJ, amphetamines, etc.
> Plenty of other safe and effective treatments have made it through the “excessive” red tape because actually the red tape isn’t the issue. Dismissiveness and fear of psychoactivity is.

Probably money is the issue. None of these compounds can be patented now.
Aurora Postgres is an interesting product where AWS made significant changes to Postgres storage architecture, however it has a fairly high fixed cost.

It seems in many cases RDS Postgres is cheaper and even when using Aurora, using fixed-size instance classes instead of "serverless" autoscaling classes (with ACUs) is a lot cheaper. Fixed Aurora on-demand instances are roughly 17% the cost of ACUs. Fixed instances are usually >= 30% cheaper on top of that if you reserve.

Aurora heavily favors performance and availability over cost.
No mention of Unicode or UTF-8. Another incorrect implementation proliferates.

You need to be handling LLM output as partial UTF-8 encoded sequences, not as complete UTF-8 encoded strings.

In this case, this means you create one TextDecoder for the entire response, then call `decode` for each streamed token, with the `stream` option set to `true` [0]. That way, incomplete UTF-8 codepoints can be completed by future tokens, and not discarded.

If you do not do this, most languages other than English will not output properly. They will be interspersed with garbage, characters will be missing. Certainly anything using Chinese, Japanese, or Korean characters. It can become entirely unreadable and unusable.

This issue is present in the vast majority of scripts and interfaces that handle streaming responses from LLMs, and it's a huge pet peeve of mine.

I've also forwarded this concern to the author over email.

[0]: https://developer.mozilla.org/en-US/docs/Web/API/TextDecoder...
That book's a reference encyclopedia, not an intro/primer.
Unsubscribe links make me nervous. Such an obvious attack vector.
"small study finds" has happened before, in the context of mental health cures, for everything from LSD to yoga to going 48 hours without sleep. Many other things that can induce altered states of consciousness have probably been studied at small scale too (like you say, Psilocybin). For each one, there's always some subgroup that responds to it.

"small study finds" is also how we landed ourselves with a replication crisis, so your comment about putting it into context is very appropriate.
The term "serverless" is so confusing if to me.

I had settled on "scale to zero" as my chosen definition for it, because it was the only definition that truly made sense to me and that I very strongly valued.

Apparently AWS don't think it means that.

I guess it just means "you'll never have to SSH in and upgrade anything"?

The other thing that surprises me here is that one of AWS's biggest selling points is how rarely they break existing apps by turning off services developers depend on.
As a French Minister of Education, Gabriel Attal (currently French Prime Minister) presented the book “Ada & #Zangemann” to the #APFA parliamentarians meeting in the old Bonn parliament at the beginning of December.
Afterwards he gifted the book to Anke Rehlinger, Minister-President of the Saarland (Germany).
What did you think of my idea of treating eyewitness claims with a Kalman filter (after quantizing the elements of the claims)?
> Capitalism gave rise to a value system that teaches us to find meaning in our work; yet millions are employed in low-paying, soul-crushing jobs.

Many philosophies throughout history emphasize finding meaning in your work:

- Ikigai: discover your reason for being, which is at the intersection of passion, mission, vocation, and profession. It is not just about yourself, but contributing to the world and bringing joy to others

- Stoicism: while not solely focused on work, Stoicism emphasizes finding purpose and virtue in whatever situation you find yourself in, including approaching work with a sense of duty and striving to contribute to a greater good, even if the task itself is mundane

- Confucianism: stresses the importance of hard work, diligence, and skill in all aspects of life, incl. work. Emphasizes fulfilling your roles and responsibilities in society with excellence, finding meaning and respect through well-performed work

- Protestant work ethic: sees work as a moral obligation and way to glorify the Christian god. Encourages hard work, diligience, and productivity, finding meaning through creation & contribution to society through labor

- Existentialism: encourages individuals to create own meaning in life, incl. through their work. Involves taking responsibility for your choices, pursuing authentic goals, and engaging authentically with your work.
But we can't be sure unless we know the actual stats. A lot of news operates by driving sensational stories, the more hysteria and doom they invoke, the more views they get. Are we talking 1% more likely or 0.00000001% more likely to get in an accident?
Difference from what? Even different municipalities have vastly different tastes from each other.

(That said, it's never bothered me to drink tap water wherever I go, and acclimate quickly. I think the bottled water trend is insane.)
I got most of the way through this and found many things to disagree with. I started to write a reply and then I read this part:

> Expertise is, in a certain sense, a bourgeois concept, a by-product of the ideological imperative to organize our lives and activities in a rational way.

God help anyone who takes this shit seriously.

I don't know when, if ever, austerity is called for (even Paul Krugman has called for deficit reduction in certain circumstances: https://www.nytimes.com/2023/10/10/opinion/us-budget-deficit...). But this review is dripping with ideology to the point that it's genuinely disconcerting.
Would this be new physics, or would this be because, as they get further apart, there's more dark matter between them, and so there's a larger acceleration than the masses of the stars alone would predict?
That's indeed very useful, and very easy to use.

But is it really not possible to do the same with a petrol/diesel car? How many hours of dialysis can be provided by the EV as opposed to a running petrol/diesel car?

And what about a dedicated petrol electricity generator?
https://linux.die.net/man/3/stderr

Notes

The stream stderr is unbuffered. The stream stdout is line-buffered when it points to a terminal. Partial lines will not appear until fflush(3) or exit(3) is called, or a newline is printed. This can produce unexpected results, especially with debugging output. The buffering mode of the standard streams (or any other stream) can be changed using the setbuf(3) or setvbuf(3) call. Note that in case stdin is associated with a terminal, there may also be input buffering in the terminal driver, entirely unrelated to stdio buffering. (Indeed, normally terminal input is line buffered in the kernel.) This kernel input handling can be modified using calls like tcsetattr(3); see also stty(1), and termios(3).
Yeah, this is a huge ongoing scandal, and you'd only know about it if you were in tech or a politics nerd. 750 victims, including bankruptcies, prison sentences and suicides, and just one week after a TV drama something is actually being done about it. (That it can be used to attack Starmer and Davey is, I'm sure, unrelated.)

Heads need to roll over this. Can you believe the woman responsible nearly became a bishop?
No "compiler assistance" doesn't mean no assistance at all. There is a growing set of linters based on the community-accepted analysis package [0] that prevent this and other gotchas that Go devs may be prone to.

It isn't a perfect solution, but it works at community level without needing to wait for the Go team to take care of or changing the language/toolchain.

0: https://pkg.go.dev/golang.org/x/tools/go/analysis
You could have put Google in early ‘00s on this pedestal. But the Google today is not worthy of this.

G is like any other Fortune 500 company now. The amount of products in their graveyard grows every year. Maintenance of “legacy” apps is handed off to offshore teams who have objectives to just keep it running until it’s 86’d.

Google has also made plenty of mistakes with web: look at PWAs, AMP, and Chrome just to start.
One can do even simpler: install a Linux host and run tcpdump / wireshark to capture its own traffic on an interface. If you time the start of capturing with the moment you connect, you can see the DHCP, and probably DAD and DHCPv6 and/or SLAAC. Then mDNS, as well as high chance for HTTP/HTTPS. Running “sudo ntpdate time.apple.com” will give you a taste of NTP. (ARP/ND will be necessarily somewhere there as well).
I guess if they want to go whole hog, they can get cork seals.
Nice X-Header :)
Ask HN: Would a SaaS control plane scaffolding tool be useful?
I've been working on a tool that auto generates the control plane and parts of the application plane for SAAS apps. It aims to provide a huge chunk of the control plane (authorization, tenancy etc) and simplify the initial build of a saas app or platform. Users input basic details about their SaaS app, such as the name, organization and customer tiers. CloudMural then generates an architecture diagram using standard AWS symbols, providing a clear visual of the proposed infrastructure. Initial architecture diagram represents the control plane for the selected tenancy model (siloed, pooled, hybrid) and business type (b2c, b2b, b2b2c). The user can then drag supported aws services into the work area to represent things like ECS services, database tables etc. Once the user is done, the tool scaffolds out the entire infrastructure in AWS. For user specified services, it also scaffolds out github repositories. I'm planning on adding github actions support for CI/CD as well. I'm also going to add support for scaffolding a react-native app, landing page and an admin dashboard. The UI will come in set up with auth & auth via cognito.
Please see pictures here: https://docs.google.com/document/d/e/2PACX-1vQbCZN2QclCE9CcSt2LHM4SVChlxPOXhyHSlGTZXzBYHmSGjmoMdLfm-XO5oHpnMZ0DSCmG8-VD-lx9/pub

Question to the community is, would y'all find this tool useful? I do have plans to publish it and maybe sell it as a SAAS product/platform bootstrapper, but I'd like to get feedback from the community as to its usefulness. I'd also appreciate any thoughts/changes/feedback.

Thanks and much appreciated!
A lot of words. Is it because of line buffering?

coreutils has a very hairy program called stdbuf which can change the line buffering of an existing program. It uses LD_PRELOAD(!) to preload a library which overrides the program's defaults.
I do, quite a few of my roommates in the past had as well.

We use desktop machines that consume a bit of juice. SSDs are fast, why not save the electricity/heat?

I feel this seems odd because of laptops and phones being overwhelmingly popular
https://www.reddit.com/r/NDE/comments/188i98i/ndes_with_conf...
Kagi for iOS was working great for the first month I had it but the last two weeks the extension seems to only work half the time. Glad to hear I’m not the only one.
But Arista only has switching hardware and a few other specialty devices (L1 switches from their Metamako purchase). Vendors like Juniper offer load balancers, firewalls and everything else you need for managing a data center or company.
Yes, I understand, but that’s my point: In my experience, the detailed write-ups that external pentesters sent us could have been replaced by a 1-2 paragraph email for our engineers to read and fix ASAP.
I don't know if this is still the case, but I recall needing to run LaTeX twice before it would produce the correct output. Something like this might make it easier to generate documents in one pass.
Did you not see the part where applicants info was exposed? Make a few bucks by selling their data to <whoever> is 10000x worse than the chatr dev not securing the files.
If you’re on an iPad use Reader view by tapping “AA” in the address bar and selecting Show Reader. You’ll get just the article’s text and images.
some recent comments, https://news.ycombinator.com/item?id=38827599
How do you they didn't provide a mix of families and felons and are banking on your exact opinion (my political opponents will use this to gain power) as the actual end goal? To me it seems like a strategy of stoking internal conflicts with actions to small to qualify as a declaration of war.
And sometimes they revert it - pretty much every data lake is a bunch of files on disk and a database/file reference to those files.
So the hacker worked for free?
Yes it is a bit like that except that bitcoin's importance is based on time-proven monetary theory and game theory, rather than make believe. It certainly is self-organising, but it's not a scam. Unfortunately you likely won't figure out why until after another couple of halving epochs.
Aren't Brita filters gonna have the same problem as the nanoplastics discussed in this article? The article specifically says that the plastic isn't from the bottles themselves.
I think according to the law and related suits based on accessing publically available URLs without authorization is still technically prosecutable - I’m not a CFAA expert but I’d double check there
It does not have 0 performance impact, it's not rare, and in applications that are in the hot path, error handling is also in the hot path.
I'm mostly with you on that one, but private prosecutors still have to get the case past a judge (and often a jury too), and convince them beyond reasonable doubt. In this particular case that clearly wasn't a sufficient safeguard, but in general, private prosecutions have their place.
Yeah, except you can only change one line at a time and you lose all of your changes if it doesn't compile at any point.
> At Vulkanised 2023 discussion round Khronos admited that they aren't going to improve GLSL any further, and ironicly rely on Microsoft's HLSL work as the main shader language to go alongside Vulkan.

That sounds intriguing, but I haven't been able of finding any references to it(I guess it was discussed in the panel but the video of it is private) do you have any reference of more information into it?

is it related to adding hlsl support to clang?
Then just say people are stupid and abolish voting. If the public doesn't have the mental tools to evaluate the simplest of electoral programs then what's democracy even good for?
Alternative splicing is another way of including IF statements. Depending on many conditions some parts of the RNA might be added/removed before the translation
To give a concrete examples

1. The HOXD gene cluster adopts a mutually exclusive conformation. IF it "folds" to the left if results in the formation of digit bones ELIF it folds to the right of arm bones ELSE no bones etc. (very very roughly speaking): https://www.science.org/doi/10.1126/science.1234167

2. Another example are olefactory receptors, each olefactory sensory neuron (the cell that "smells") chooses to activate one out of a long array of possible receptors each specific to some smells. So somehow, somewhere a XOR logical operation is "computed" to "pick" https://europepmc.org/article/pmc/4882762
Sex changes many lines at a time. But you do die if it doesn’t compile.
This is not in any way shape or form true.

When you go into the internal “phone tool” if you work for Amazon, AWS, Twitch etc you still eventually get to the same CEO.

(Former AWS employer)
But the research says that the plastic isn't coming from the bottles. I wonder if tap has the same plastic contamination from filters that bottled water has.
My $100 brother laser printer I bought 6 months ago has printed everything I asked (dozens and dozens of pages) from Windows, Linux (well supported linux drivers!) and our families mix of apple and android phones.
NASA's Webb Finds Signs of Possible Aurorae on Isolated Brown Dwarf
There was also that whole Brexit and "let's give those billions to the NHS" kerfuffle. Maybe that had something more to do with the recession.
In a college poetry class, I learned that literary analysis isn't about being "right" (what did the author actually intend to say?), but instead, being "interesting" (what's a cool way of framing this?). Any subjective interpretation is valid if it's thought-provoking.

I think that is the mental framework with ideology-saturated economic opinion pieces like this one. I don't think they care about being right. Instead, the goal is to make cool, edgy, story-book-good-vs-evil narratives independent of empirical validity ("any subjective interpretation is valid if it's thought-provoking")
Why is it common for senior developers to drop out of coding interviews?
IMO you're best off avoiding products from any company that sells garbage at any tier, whenever possible. They're taking advantage of people and creating large amounts of e-waste.
Yeah I think there's a paper about how brains most likely represent some things with quantum states which may explain why we don't understand them yet.
From the press release[0]:

"The combination is expected to achieve operating efficiencies and run-rate annual cost synergies of $450 million within 36 months post close."

Not that such layoffs are unexpected.

0: https://newsroom.juniper.net/news/news-details/2024/HPE-to-A...
I've never been to an autox where you could run as many times as you like. Most people getting into autox should expect to be there all day, run about 5 times, and work the track for a bit.

That said, autox is a lot of fun and I highly recommend it to any driving enthusiast
> When you turn actual, creative and exhausting work (vulnerability research) into some kind of high stakes gig job you deserve this problem.

You don’t make HackerOne your primary source of security testing. It’s a fun thing you do in addition to your formal security work internally.

The reason people do it is because so many people expect or even demand payment and public recognition for submitting security issues they found. Just look at how many comments in this thread are insisting that they pay the author various amounts of money. The blog post even has a line about how they have not provided recognition (despite being posted exactly on the day it was fixed, giving the company almost no time to actually do so).

HackerOne style programs provide a way to formalize this, publicize the rules (e.g we pay $25K for privilege escalation or something) and give recognition to people finding the bugs.

Pentesters like it not only because they get paid, but now they can point to their record on a public website.

This isn’t a “gig economy bad” situation.