skysight-inc/HackerNews huggingface dataset:
Isn't that a usability vs security trade-off? Asking naively as a non-expert here.

In some systems, a password reset lets you bypass MFA. On Gitlab, however, you might be able to reset the password, but it will not let you bypass MFA (which was a nice mitigation for this CVE).

I often wonder about this, because people's email should have fairly good security (MFA, detect new devices, suspicious IPs, alerts, etc), and MFA on the other service lets them have similar protections. Both services might not be bullet-proof, but an attacker will likely generate alerts in one or the other.

Most of my users are very non-technical, and might not have access to their MFA (MFA reset requests are fairly frequent), so to be able to access using a one-time-secret sent by email seems like an acceptable compromise, especially if it means that more users will enable MFA. In systems I administer, less than 20% of users tend to enable MFA (it depends on org policy, and it's often optional).

Speaking of, I wish services would do auth by: login -> MFA -> pass, instead of login -> reCaptcha -> pass -> MFA. Especially for scenarios where MFA is mandatory. Having reCaptcha is really annoying considering I went the extra step of enabling MFA (ex: Stripe, Quickbooks).
Ah but it's "confirmed".
Never heard of them before ¯\_(ツ)_/¯
There Are No Customers Inside Your Office
What do you call sneaking into a movie theater or a magic show or other live performance? What do you call not paying for your ticket and still obtaining the value of the experience created?

I make videos, they cost me real money to make. When you steal views, you are costing me the money I should have been paid for your view to help cover those costs associated with entertaining you.

This isn't some moral puzzle, you are a thief.
> There is currently no way to measure bad code that fails under load until it does so in production.

FWIW, techniques to perform such measures have existed for ~30 years in PL research (some of Rust's type system comes from this kind of research), but I don't know of any industrial code that makes use of it.
Higher precision isn’t always available. IEEE 754 is an unusually well-thought-through standard (thanks to some smart people with a lot of painful experience) and is pretty good at justifying its decisions, some of which are surprising (far from obvious) to anyone not steeped in it.
If this is true why does Americans keep saying that socialised medicine is bad because you wait forever to see a doctor?
Maybe. I'm not very concerned from an x-risk point of view about the output of people who would put in the minimum amount of effort to get on the radar, get offered the deal, then take it immediately and never work in AI again. This would be a good argument to keep the bar for getting the deal offered (and getting fined once you're in the States) pretty low.
Also see the pure brutality that is the early Microsoft Office DOC file. :)
Just dumping the memory IIRC.
Wasn't medical diagnosis also a goal of IBM Watson? I was honestly hoping to see real applications for that system but in the end it seems all we got was a robot that was pretty good at Jeopardy.
Apple tops Samsung for first time in global smartphone shipments
One thing I don't understand is the argument you're trying to make here. A condition being heritable doesn't make it 51% likely to be genetically determined. For instance, people's environments are heritable, so the "heritability" of "IQ" doesn't say anything about how society should deal with the distribution of ability. It doesn't say we should allocate resources to improving ability and it doesn't not say that. It literally begs the question. Given that: what do you take the parent comment to mean?

So far as I can tell, we've never spoken before, so I'm not sure I follow the "repeating" thing, either.
Tesla owners in deep freeze discover the cold, hard truth about EVs
Sounds like you've got some unusual configuration options turned on or something.

The most glaring odd thing here is that you apparently don't have your password vault available on the same machine you're shopping from, which seems odd to me. Even so, if I went that route it'd still be easy b/c with the Apple ecosystem, the clipboard is shared between devices. One can copy a password from the phone and paste it on the Mac.

The tl;dr here is that I really don't understand why you had to retype your password. I never type my strong passwords. Why would you put yourself in a position where that's required?

Finally, when I pay via Paypal using my Amex, I never have to re-auth to Amex. It just flows through. So it sounds like that's something you've chosen to set up, not something inherent to the process.
> have a good chance of using "synchronized" instead of other kinds of locks; and "synchronized" can be more robust than other kinds of locks (no risk of forgetting to release the lock, and on older JVMs, no risk of an out-of-memory while within the lock implementation breaking things),

I haven't professionally written Java in years, however from what I remember synchronized was considered evil from day one. You can't forget to release it, but you better got out of your way to allocate an internal object just for locking because you have no control who else might synchronize on your object and at that point you are only a bit of syntactic sugar away from a try { lock.lock();}finally{lock.unlock();} .
Isn’t there an issue with them detecting self-reported race when no visible correlates are present in the data
Yes, people at staff+ level are routinely hired. But these are typically very senior positions and you are expected to be in some way transformative. Staff engineers are roughly equivalent seniority to a manager of 6-12 people and should bring significant domain expertise. Principal is an end-career role a small fraction of people reach after 30 years in the industry. They’re roughly equivalent to a director, who in the FAANG model leads 50-500 people.

It’s not surprising that the requirements are very high. These roles exist to fill a specific business need.

Caveat: this all applies to FAANG and adjacent. Other industries use different titles, but the use of the word “staff” usually indicates that you’ve adapted the Google career ladder.
> Of course you can: password + email access = two factors = multi-factor

No, you're resetting an unknown password, bypassing one of those factors.
Both can be true: thieves are scum and modern society exacerbates the problem.

Sure, we should punish crime but never solving the root problem and taking a "hardline" approach towards the symptoms feels good. But, it puts us in a perpetual state of law enforcement and anxiety about crime.
Exactly. A lot of times the vulnerability exists in something you’re not using, but it still shows up in reports.

Sifting through that and writing up why that vulnerability doesn’t actually apply to your environment and showing evidence of such is an incredibly time consuming process. It’s honestly easier to just patch it, a lot of times.
The SG2380 is a bit weird though. Four of the P670 cores are clocked lower than the others.

The X280 cores are not RVA22 compliant. They are only RV64GCV, so they can't run the same code as the P670 cores.
SophGo's datasheet lists these cores under "AI accelerator", paired with a "TPU", so they were never intended to run general purpose code.
Distribution packages are nice but:

- they require different instructions for each platform: one for each distribution: it's not possible to give a one liner that will work for all supported OS/architecture combinations,
- distributions are not all updated at the speed of upstream. Sometimes users do not want to wait several years to use a recently released feature.
So is Storj and Sia.

It raises the question, though: I can pay Storj S3 with STORJ tokens, and I can also pay for renterd space with Sia tokens, and I can also pay for IPFS with Filecoin, and all of them still work with good old credit cards. What "intrinsic" value is there for any of these tokens, if they can only be used on their own internal economies?

And before the "but permissionless, so I can pay with crypto!", why not just use DAI?
Hydrocarbon-air mixtures are also "EXPLOSIVE". See, e.g thermobaric weapons.

Possibly what you're trying to say is that it's easier to get the air in? Or that it's stored under pressure?
That’s true when the doctor is a human, I want humans to acknowledge my humanity and (ideally) be able to put themselves in my shoes and empathize with how I’m feeling. But a robot cannot do that. A robot has no feeling, and will never be able to understand my feelings. The best it can do is parrot its authorized “authentic compassion” markov chains. Perhaps to some that’s enough, but I’d prefer to just get the data I need and leave.
Thanks for using us! We ended up selling the service to private equity, hence the slowdown in features and support. Was an awesome and fun business to build but running a 24/7/365 service just as all the cloud providers were adding similar products was a slog.
Why hiding enterprise pricing is damaging your conversion rates
It depends. For example for Kitchenware (not electronics), I’m very happy with German company Rösle. Usually the most expensive, but always high quality.
It's interesting how in 2024, managers still believe that building software is simply the act of pushing random buttons on a keyboard while moving a mouse.

If the developer stops typing for a minute, or a few hours in order to use his brain to think about a hard problem, then the developer doesn't deserve to get paid because he's not actively using his computer?

If you really want to track developer hours accurately, you need to invent a microchip that will be implanted in the developer's brain.

This chip will track all electrical activity related to building your software, so that you get the best bang for the hourly rate you're paying the developer.
I'm generally afraid of major changes and this one has the potential to massively affect me. I've jumped through several distributions over the years - red hat back when it wasn't enterprise, ubuntu, then fedora, then debian, then eventually ended up with OpenSUSE back in ~2017 and I fell in love with it. It's been my daily driver ever since - work, home and laptop. I still run debian on all my servers at my home lab but for a daily driver, OpenSUSE ticked all my boxes: you can get almost anything to run on it, even if it's not officially supported, flexible, frequent updates and all the good stuff. The only downside has been dealing with Nvidia (quadro's specifically) but that applies to pretty much any distro. I'm really hoping I won't have to jump trains again. Time will tell I guess
The branches in this example are not 50/50.

Given a few million calls of clamp, most would be no-ops in practice. Modern CPUs are very good at dynamically observing this.
Antirez, I respect you immensely. I know you know what you are talking about. I do think that there's too much hype around rust.

That said, I also think that we live in a world where a little bit of clickbait or hype-riding is admissible. The economics of the thing make it almost mandatory. I would just acknowledge the hype, nod in disagreement, and move on. At the end o the day this is about someone tinkering with a language they enjoy. Let them have that.
Singapore's Locofy launches its one-click design-to-code tool
I know the GP used "thieves" as a comparison, but I think it took the conversation here a different direction than intended.

You can justify some thievery due to social problems - stealing for food is one thing.

But if you eliminate "fairytale concepts" like "bad actors", how do you explain the people constantly attacking managed services and trying to gain access to other people's accounts? These surely aren't the guy on the street looking for their next meal.
A much more interesting link is between crime and atmospheric lead emissions, which looks similar to this but conforms much more tightly. I'm more inclined to buy that than interest rates considering we have more direct evidence between lead exposure and violent tendencies.

https://en.wikipedia.org/wiki/Lead%E2%80%93crime_hypothesis

https://www.forbes.com/sites/alexknapp/2013/01/03/how-lead-c...

https://www.luc.edu/media/lucedu/hhhci/pdf/FactSheetDelinque...
Well, I meant that nodejs exists since long ago...
You are right, worth fixing.
I don't know why you added "Try again", especially because I intentionally specified "Individual contributors". Your response also highlights what I was talking about: unions do not hold back their highest paid members while bringing up the bottom for their lowest paid members, just as is the case for SAG.
Are the requirements to become a doctor the same in those foreign jurisdictions?
> The regulation doesn’t allow you to mmap w^x willy-nilly

Yesn’t; I don’t think the regulators would look kindly upon Apple restricting third-party JITs, since it’d give Safari/WebKit an unfair competitive advantage over other browser engines on iOS (something I believe the DMA is also meant to open up.)
Microsoft Unveils Copilot Pro Subscription with GPT-4 Turbo, Copilot in Office
Public companies have to file a lot of documents with the SEC, and often contracts get disclosed. Paid services such as Bloomberg Law are essentially glorified search engines on this free public dataset.
> why are they open at the top?

Because of convection, heat rises, and allows the non-toasting part of the frame, etc., to remain safe to the touch. It would be very bad to take an existing toaster and try to operate it on its side.

Plus, the simplest way to get even toasting is even heat on both sides of the bread (except when you do Bagels).
You can have both. Esc on tap, ctrl on hold.
Quite possibly, especially if I'd be born into poverty. I gather you are quite sure you wouldn't?
>My toaster runs Android, has a touch screen, WiFi and an app, and a camera for the AI to identify what you put in it and so you can watch a live stream of your toast or play back recordings from the cloud.

You—you're kidding, right? Right?
When YouTube first launched without ads it was $9.99/mo. Today, I pay $11.67/mo for my whole family. In real dollars, that's a decline in price.
Funny that it stopped being the case for a while around 2006. AMD64 became widespread while also being very new, closing the gap between "default" and "native".
Well yeah, but that one is dishonest. Probably covering itself as one of the ones I mentioned.
Yes.
On platform - most modern cpus are happier with predictable branches than exotic instructions.

On surrounding code - for sure.
Seriously want. Few questions if I may:

- Have tried a Linux distro on it?

- What is battery life like (especially under Linux)?

- How is the keyboard generally? (Not expecting miracles but is it usable)
Magical Shell History
Substitute software for standard accountancy practices or a filing system that led to lost files, giving the incorrect impression that postmasters were stealing, and the result would have been the same. The core issue is an organisiation that values avoiding blame at all costs over transparency and accountability.
So I can get paid for all the time I spend thinking about the problem while I'm sleeping and in the shower? Sign me up!
See also: the Parsley Massacre in the Dominican Republic, which preyed on Haitians' inability to pronounce the word "perejil" as a native Spanish speaker would:

> The Haitian languages, French and Haitian Creole, pronounce the r as a uvular approximant or a voiced velar fricative, respectively so their speakers can have difficulty pronouncing the alveolar tap or the alveolar trill of Spanish, the language of the Dominican Republic. Also, only Spanish but not French or Haitian Creole pronounces the j as the voiceless velar fricative. If they could pronounce it the Spanish way the soldiers considered them Dominican and let them live, but if they pronounced it the French or Creole way they considered them Haitian and murdered them.

https://en.wikipedia.org/wiki/Parsley_massacre
Running IPFS at scale is horrible. Try to download a few dozen TBs of small files. Its garbage collection is rubbish (ended up nuking the ZFS dataset every couple of days instead), it is very CPU and IOPS hungry, and it has bad network throttling support.

I would claim it has failed the test of time as it has very little adoption.
I would like to take this opportunity to thank pron and the amazing jdk developers for working on a state of the art runtime and language ecosystem and providing it for free. Please ignore the entitled, there are many many happy Dev's who can't thank you all enough.
I have run into similar problems with unattended sign-in logs.

So you arrive somewhere like a reception desk, a church, a funeral, and there's a sign-in log with, say, five columns labeled at the top, and a long list of people who've already logged in there.

So I politely try not to scrutinize the other personal info which people have left, but I also try to figure out how to sign in on my own, and I read the column headings, but then in some of the columns, people have sort of invented their own conventions on the data entry. So, do I go with a strict interpretation of the host's intentions, or do I follow suit with previous visitors and imitate their usage?
> Since an AI has produced the latter from the former, there is no meaningful transformation.

In law, in the eyes of those that want AI to "win", or in the eyes of those who want AI to "lose"? For all three can be different. (Now I'm remembering a Babylon 5 quote: "Understanding is a three-edged sword: your side, their side, and the truth.")
Ask HN: Why are resume gaps frowned upon?
A23 – How long do I have?
1500 sq mi is a lot of real estate. Sure the weather is lousy, but it seems pretty flat, and so, ignoring the practicalities of basic existence, how long do I have before it is no longer possible?
>> What techniques do people use to profile code where the core path takes <<1ms?

Make a loop that runs the code 5000 times and time that. What do you mean by "diffuse hot spots"? If a piece of code taking 1ms is called infrequently then optimizing it is not going to have a meaningful impact on your overall execution time.

You can measure the time for longer running higher level functions that do a lot. If you then optimize some small function that's a leaf in the call graph, you can see the impact on the larger function - and it probably won't be much.

One thing that can happen when nobody cares about performance is that every part of the code gets little inefficiencies and fixing any one of them has very little impact, but fixing ALL of them can be really significant. In that case you should start by profiling or timing the higher level functions and finding ones that have relatively small call trees that you can work on. Once you optimize one piece, the effects of optimizing others are a bit more significant because they are a larger part of overall execution time.
At worst it will make it slower, and at best it will make it faster[0]. The only way to know is to measure with an input that's representative, and this case is exactly why you measure.

[0] https://stackoverflow.com/questions/48535727/why-are-c-stl-v...
I think there is a bit of confusion about how the health care system works in the US.

I don't like it any more than anyone else, but the reality is that the most likely thing to happen in the US is an explosion in the number of nurse practitioners and PA's.

Why? Because insurance companies will reimburse for them. Usually due to a myriad of reasons like standard of care, the insurance company having someone to lay hands on in the event things go off the rails, and a galaxy of other issues too byzantine to go into in a single post.

Until we wrest some control away from the payer, we'll see more and more NP's and PA's in the medium term. Fewer MD's. And AI's will struggle to gain acceptance as an arbiter.

In the far future, assuming the payers remain all powerful, you can see things going to a really natural looking place for the US, but a place that is dystopian in the extreme if you take a step out of the system and look at the big picture. Think of it this way, What happens in a far future where payers decide which AI's they reimburse for in the manner they currently decide which providers they reimburse for?
According to wikipedia you're right (about Reagan) but it's also a Russion proverb.
https://github.com/rust-windowing/softbuffer

That gives you a simple software framebuffer, and it builds as a native app or for the web. You'd set up a window (or web canvas) using winit, then pass that to softbuffer so it can render to it.

https://trunkrs.dev

I think Trunk is the most streamlined way of building for the web at the moment, superseding wasm-pack.
Why the torrents didn’t move to IPFS already? I think it looks more like DoA than standing the test of time.

From my experience it’s a “heavy tech”/resource hog hog that does not appeal neither to developers nor to end users(it has no killer app)
There’s also the experimental https://developer.mozilla.org/en-US/docs/Web/API/Barcode_Det... — already live in Chrome.
This could be a stretch here, but it could reduce the amount of repetitive strain injury caused by having to needlessly press 'shift' all the time with your weakest finger?
What's ATS?
Rust allows for higher stakes in terms of risk/reward while guaranteeing many aspects of safety. I'm not sure for this case if the scheduler would benefit from more complex/risky structures but if it did, that'd be a valid example of Rust making things "easier".

Rust definitely makes some easy things more difficult but on the flip side it arguably makes very difficult things easier (to get right with fewer guinea pigs).
You can do the same thing on Mac with built-in tools

```
# Setup pipe
sudo dnctl pipe 1 config bw 1Kbit/s delay 800

# Setup matching pf rule
echo "dummynet out proto tcp from any to 127.0.0.1 port 11211 pipe 1" | sudo pfctl -f -

# Turn on firewall
sudo pfctl -e

# Test
time nc -vz 127.0.0.1 11211
Connection to 127.0.0.1 port 11211 [tcp/*] succeeded!
nc -vz 127.0.0.1 11211 0.01s user 0.00s system 0% cpu 1.333 total
```
Excellent idea! You'll have a mature, open standard protocol under the hood, with no vendor lock-in, excellent extensibility, and great modern frontends like The Lounge (https://thelounge.chat/) or Convos (https://convos.chat/) to choose from (and you can choose).
I guess that a service like GitLab might need to take this seriously, but ones with a lesser attack surface, might not care.

This is the case for the service that I am about to release. It makes it very convenient for users that forget their passwords. I know many instances of users not using services, because they forgot the passwords, and the services make it difficult to reclaim their accounts (Google, for instance).

Too much security can be a killer, for many applications. We don't need Fort Knox security for many apps.

In our case, we make sure that we don't require any user data, beyond a simple email address (and have Apple's private relay enabled, for those that want a bit more security). For many app developers, keeping so little user data is anathema, as they are actually PID harvesters.
>A downside of not buying from a real company: The drivers for the device are emailed to you in a .zip file from the seller. So that is pretty sketchy, but it's the same for any of these Aliexpress devices.

Have fun hosting a CCP exit node
With random test cases, branch prediction can't help.
Especially when the hype is added by a third party. This is an article about a hobby project written in a few weeks and yet the headline suggests it is somehow a serious contender for being added to Linux (right now at least. Maybe something grows out of this, most likely not)
Only if it doesn't harm your cause, which it does.