skysight-inc/HackerNews huggingface dataset:
> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated

I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-)

It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser extensions is due to the difficulty in monetizing extensions directly. If you're making nothing from an extension, and someone offers you a nice check to acquire the extension, it can be difficult to turn down that money, especially if the extension is a support burdern for the developer. Of course I have my price too, as almost everyone does, but at this point the price would have to be 7 figures (maybe 8??), which I don't think anyone would ever pay for my extension. My user base is relatively small, and thus doesn't provide a huge opportunity for data collection or other nefarious schemes, precisely because the extension is paid rather than free.
It's similar with NixOS, patching a package is just adding a few lines in a persistent (and generally short) config file. You "only" pay for that patch by having to update it for newer versions and by compile time.

The developer experience isn't as good as browser extensions yet, though. Iterating on a patch means downloading that package to a local directory and building it there, which won't be enough for, say, patches to system libraries. You have to actually apply the system configuration for that, which means recompiling.
> This game is one of the tests for the pilot to demonstrate the Eye-hand coordination. As a pilot, you are controlling a missile / flighter aircraft to pass through the obstacles as much as you can. Generally a qualified pilot can survive in level 9 up to 100 obstacles.

Doesn't answer *why* it starts at level 9, but level 9 appears to have some significance.
It’s… 1%. How are you getting 4%?
It's really not easy for me to compute how many times each of my canvas bags has been used. But it's probably about 200 on average, since I've been doing this for over a decade and I've only had one canvas bag fail to death.

I'd bet 1000 uses is within the realm of possibility, but you'll probably need to do some repairs along the way.
Where does it say it was Zoom?
No need to apologize, plus, I think energy is always a political issue, though not always involving more than one country, much less countries at war.

I feel you did politicize this when editing your quote from the article, which prompted my response.

I am well aware Wikipedia is open to moderation abuse, but I stand by my use of it as a reference for the demographical distribution of population in that area.

For what it’s worth, I think this conflict is yet another leftover from the collapse of the Soviet empire and I suspect things may have turned out better for both sides if that enclave has been split into its own republic once the USSR no longer existed.
Just curious....what else have you always wondered about?
Your mistake was not bringing an envelope full of USD as evidence to be submitted to the relevant authority to expedite the service. Guess why it costs over $2k? Additional administrative taxes included. Also, you are supposed to do this through somebody that knows somebody that works somewhere.
Phalanx is the US CIWS based on the 20mm Vulcan gun. in other words, Phalanx is the “last line of defense machine guns” to which you are referring.

You may be thinking of Aegis, the integrated combat control system. We don’t yet know why the Gravely was unable to intercept the missile further out. Could have been human error, could have been a sea skimmer getting too close before being detected. To date, Aegis has been extremely effective against ballistic missiles and old cruise missiles. But given enough time an enemy can test your potential weak spots.
Android does, at least.
That’s not true. A film’s tax write off value decreases with time. As long as the present tax write off value exceeds the present value of all future film revenue, then it makes sense to deliberately not sell it and leverage the tax credit.
Anthem Insurance staff just following their Claims Manual, Section U.
I should have said “No need to feel guilty” instead of “No need to apologize”, hopefully the message stays mostly the same.
On-Demand Design for Tech Companies
Netflix Style subscription for Graphic Design Work
But does that fix the problem or just slow it down a bit?

If you can deepfake one guy with the checkbook, can’t you deepfake the guy with the checkbook and the guy who enters the POs into the system? Lower odds, but far from zero.
This is where those 'security researchers' are helping to make such fraud easier. If you release these tools into the wild you are enabling criminals who by themselves would have no way to create these tools.
Cool extension. I love when devs open source stuff that makes their lives easier.
I prefer bookmarklets because they

- Are easy to edit

- Are inactive until clicked

- Work in all browsers

- Work on mobile

- Integrate nicely into the UI. I can move them around, put them into any bookmark folder, assign shortcuts.

I wrote this bookmarlet editor which makes it easy to convert between clean code and a bookmarklet:

https://www.gibney.org/bookmarklet_editor
Every Honda, even the cheap ones, do active noise cancelling in a whole car cabin. It’s definitely possible.
From what I’ve read, panels are sometimes only a quarter of the price of a residential solar installation. In that case, if the panel cost twice the price for only 25% more power, it might be worth it.
I came from the much cleaner, simpler type system of AS3, but I don't really see a problem with the complexity of TS. There are a lot of aspects of its type system I will probably never use... but I don't have to. I've written a lot of fairly complex business and game software for the web, and never found myself reaching for a conditional type. Meanwhile, keyof and union types are handy for autocomplete hints. And to me that's all TS is really about. It's just there to make large scale javascript less of a dynamic, chaotic, untyped mess.
What evidence is there for that?
Don't repeat yourself / single-point-of-truth. Config files can be full of repetition, from values, to sections/objects. Defining a value or object once, dramatically reduces search+replace errors for example.
Empirical failures of the claim that autistic people lack a theory of mind
But to be fair, multiple studies have suggested (for benchmark psychology experiments) a replication rate of less that 50% (https://royalsocietypublishing.org/doi/10.1098/rsos.231240).

I think the quality of psychology research is actually a bimodal distribution. In one mode, you have solid, replicable, serious science. In the other mode (like the priming studies), 90% trash might actually be a generous estimate
Y'all just realizing this now? Dudes, this was bloody obvious before the first AI winter not the one that's about to nuke the new idiots.
> I don’t even understand what this comment means in this context.

Not OP, but it means you should expect beta software to be broken and incomplete.

How would you know this isn't due to a bug introduced in the beta? Seems as likely an explanation as anything else at this point, unless you have some inside information.

A lot of things use a "plugin" organization, and if a certain plugin was missing -- say, due to bug leading to a failed compile, the tool would work fine but the functionality provided by the plugin would simply be missing. Not that I have any insight into this particular case, but just pointing out there are perfectly reasonable ways a bug could cause this.

Also, I've personally disabled features in a beta release when I knew the feature was broken and it would cause long term issues if someone tried to use the broken feature (like data corruption). So it could be deliberately removed but only temporarily.

Or maybe Apple just removed this to be dicks, IDK... But I don't think you do either, do you?

If you do have inside info, can you let us know whyx this was removed?
Our Grocery Outlet does this, as does CostCo.
I use containerization, but it’s not perfect. Also on the front page today: https://news.ycombinator.com/item?id=39250975
I've wondered many times why a radar-directed machine gun isn't used to protect against drone attacks. The drones the terrorists used are rather slow moving, so the gun doesn't have to be that sophisticated. And it should be relatively cheap.
I use Void btw.
Certainly in Canada where one time use plastic bags are banned the supermarkets do not provide paper bags. They will sell you reusable bags which are larger (and therefore more resource intensive to produce) which are often not reused. I have a huge collection of them at home.
For normal services namespaces are enough (make sure to set no_new_privs, one of the best Linux features). Run it with the bare minimum of mounts required, no shared /tmp, etc. For all its faults, systemd actually gets this right, by allowing to easily harden services.

Note that this exploit relies on being able to run as root (typically through setuid). If you don't fully trust a service, don't let it ever talk to code running as root in the first place. No opening sockets in /tmp, no listing processes in /proc, no dbus shenanigans, no sudo or su. One of this issues with this was that some programs require setuid for bad reasons (IIRC historically ping was setuid to be able to send ICMP packets). From a quick check (find -type f -perm -4000) most of these problems have been eliminated, via linux capabilities or otherwise.

These tactics successfully saved me from log4shell.
After Adobe and Apple, also Samsung has recently started support (with S24): https://news.ycombinator.com/item?id=39064820
Also: https://wiki.debian.org/InstallingDebianOn/Apple/M1
The trouble with text is that it often does not have implied intent. There is no sarcasm font. And when people respond with “can’t you take a joke?” It comes off as dismissive at best, and trolling at worst. Not to mention that “it was just a joke” feels like a hail-Mary attempt to justify a comment that was poorly received.
In some cases artwork where no child was harmed counts as CSAM. Is that execution worthy?
> devs don't want to distribute their apps as PWAs because Apple deletes saved data at unpredictable intervals

Does anybody know what the current situation in iOS looks like? I researched this recently and the information is conflicting. The OPFS data (Origin Private File System, which is the new storage API for PWAs and is supported in Safari) is supposed to not be deleted without explicit user confirmation, but what this confirmation looks like is unknown (is it just the usual delete Safari history button?) and I didn't run any experiments. However I've seen someone claiming Apple separates a website and it's installed PWA's storages. This is reinforced by the fact that I can see the storage space each PWA takes in Settings (which was oddly not updated when a PWA using OPFS used some more storage). However I just deleted that PWA but there were no special prompts, just the usual native app deletion prompt, absent of the usual phrase "Deleting this app will delete its data.", only the phrase "Do you want to delete this bookmark." was present.
It's actually questionable. The vulnerable code is described really well in the Qualys report: https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt

Basically: the code was an optimization trying to avoid a heap allocation by using a stack buffer instead, but its fallback for "it doesn't fit in 1k of stack memory" wasn't tested and didn't work right.

Rust struggles with alloca-style code too, to the extent that users who want to do this kind of trickery usually resort to unsafe. There's a link elsewhere in this topic to a Rust library vulnerability that looks similar.

The upshot is that if the code had been written idiomatically and just used the heap like it was supposed to, it probably would have worked fine. The glibc authors got fancy, loaded a footgun, and it went off, something that Rust is equally capable of.
here’s one… https://apnews.com/article/google-incognito-mode-tracking-la...
Percentage increase is 4.16667%
Definitely not the minority, anyone who needs secure isolation for a container should be wrapping it in a single tenant VM
To avoid relying in Wikipedia, here’s another source claiming Armenians are a minority in Azerbaijan but (were) a majority in this conflict region: https://www.cia.gov/the-world-factbook/countries/azerbaijan/
> Of course, Apple's lackluster support or PWAs doesn't help.

Holding the web back is entirely intentional and makes strategic sense from Apple's point of view. They're well aware that a majority of apps would work perfectly fine as web apps -- but that also removes Apple from the equation. Only allowing Safari on iOS and intentionally gimping it solves the problem.

I mean, I can't even blame them. Can't lose out on that sweet 30% cut, y'know?

I'm only disappointed that legislation took this long to catch up to their shenanigans, and only in the EU.
> definitely don't have the skills of someone who practices either daily

And that is exactly the premise of one proposed mechanism by which serious accident rates (and insured losses) may have increased during a period when a great many people who previously practiced something daily then did not do so: https://news.ycombinator.com/item?id=39247101
Talking about how bad Google is limiting ad blocker, then going ahead and saying "I use Chrome extensions" I am assuming that means in Chrome. Its your fault then. Move to Brave (has ad Blocker without limitations build in, you can use all Chrome extensions) or Firefox or whatever browser but if you continue to use Googles shit then you are helping them kill what makes extensions great. They do not even support extensions on mobiles, obviously with the excuse of performance but its so most people who are actually on mobile can't block ads and otherwise remove commercial toxicity from the web.
It may be a little paranoid, but I use a separate local user account for those kinds of things.

Perhaps not convenient, but it certainly helps keep me on task when I'm in official-paperwork mode. :p
One percentage point is a four relative percent increase here: (25/24) = 1.041
The "read and change all your data" permission is a huge hurdle for our shopping extension, especially since we only need to identify shopping pages. What I've tried to build trust is to open source our tracking analytics (e.g. https://github.com/Score-Extension/score-extension-analytics...).

Hopefully transparency is one way to overcome this trust barrier.
You are correct of course. The main point of research like this is to drive development of panels forward. That helps to drive the cost of the panel down as well.

A similar argument can be made for almost any good, over the lifetime of the good, within an application category, second hand will often be better. However, in general, it is still useful better technology, so that newer models can be more efficient, which eventually trickle down to older models becoming more efficient.
> How locked down are desktop apps now on Mac, Windows and Linux?

It’s hit or miss. There have been advancements on macOS and Linux where there are mobile-style permissions and sandboxing in some cases, but one needs to be aware of how apps are packaged to be able to leverage these advancements. Adobe stuff and Chrome on macOS for example have basically free reign still as they have specifically opted out of OS sandboxing, while a lot of small indie apps are sandboxed. Chrome I think can be put in a sandbox on Linux by way of Flatpak.

Windows has done practically nothing and is the same as it’s always been where desktop apps can do basically whatever they please, especially if given privileges with UAC (which seemingly every other Windows app needs for some reason).
Why don't you try googling "lithium ion battery history prices" and find out?

Top results: "lithium-ion battery prices hit historical low of $140/KWHr"
The linked glibc code was likewise being fancy trying to use a stack buffer to avoid a heap allocation. Idiomatic C would have worked just fine too. The point is that Rust is also (though not as severely) subject to developers playing tricks and hurting themselves.
I'm fortunate enough to afford to buy my machines out of pocket. Just trying to obtain a machine the insurance way was taking weeks (before covid even) and I got pissed off and figured out with my Perscription I could buy one on cpap.com with Amazon like service. However, obtaining the equipment was just the first hurdle for me. Thereafter, I approached finding the right settings as a search problem and eventually got some relief. Since I was not a severe case - at least by the "average of bad events" metric from the machine - I wasn't able to get much attention after trying several providers. I eventually bought a bipap machine after reading forums and hoping that more knobs to turn on the machine could yield better results. This helped a lot and again I'm lucky to be able to afford a new one without insurance. There's a lot of opportunity for improvement in this medical tech space.
That works sometimes, but you could still get screwed if that out of pocket care is wildly expensive. A friend of mine needed a drug that costs about $85k total but was the only effective treatment at the time, and Kaiser doctors told him they wouldn't prescribe it until his condition started giving him organ failure(!), so he had to switch insurance to get it and luckily the timing worked out.
Homo sapiens reached the higher latitudes of Europe by 45,000 years ago
> I sell a browser extension where the permission I really want to ask for is "can only observe the network traffic it sends/receives in its own tabs" but I'm lumped with having to ask for the "read and write all your data" permission

Yeah it would be nice there were a way to limit the entire scope of an addon's permissions to a whitelist of domains. Chromium has a way of whitelisting domains an addon can run on[1] but I've assumed it doesn't affects the broader permissions you mention (general history, etc).

[1] Click 'Details' of the addon and switch the 'Allow this extension to read and change all your data on websites you visit' option to 'On specific sites' then add the sites to the whitelist.
I'm not sure why you think MAUI is a great choice considering its current status. There is a huge lack of learning resources, a very tiny community, and very few-to-none successful applications built entirely using MAUI at this point. There isn't any strong guidance or opinionated advice for how to architect or scale your app from Microsoft, either. Avalonia is a much better choice if you must use .NET, but outside of people who really, really like C# or have legacy apps they want to migrate, I don't think either will be very good choices for new greenfield apps. If anything, Microsoft has been signaling that Blazor Hybrid is what you should be using, and while it does use the same core technology under the hood, it is much more at home for C# developers who have been doing ASP.NET which has far more developers than WPF or Xamarin ever did.
> Has an anti-piracy campaign targeting the public in the last 40+ years ever actually worked?

A nasty consideration: if these anti-piracy campaigns did work, the anti-piracy organizations would go out of business because the problem is then solved - this is against their incentives. Instead these organizations' incentive is to put on a big anti-piracy show to make an impression an the customers from the media industry. But this show must not be too successful to reduce piracy, since there are no subsequent contracts if the piracy "problem" disappears.
>Not affiliated, just happy user

Just a quick question, do you know if you will be charged 2TB / $12 per month if you have 1.1TB of Data?
How did you know that he was refused admission because he called it a laptop? This all sounds very strange to me.
It's not necessarily irrational. For example, for some people if they ever have any extra money, someone else will immediately spend it for them. If the earner wants to make a larger purchase, perhaps something that will cost short term but pay off in the long term, they need some mechanism to save, outside of the regular controls that apply to daily life.

You may think this situation is still irrational, that the other person is being irrational. But again, there are many life situations out there. Perhaps they have lived in situations where they had to fight for what they needed. Perhaps they lived with an earner who would spend their money on drugs if it wasn't taken away, and yet if the non-earner saved it up themselves, the earner would find it and spend it.

The supposedly rational thing may depend on everyone around you to also be rational, and everyone around them, etc. And given that we are human, and humans are not fully rational...
Social engineering is substantially about appealing to someone who can do all the steps you cannot perform from outside.

From what I understand of the literature, it’s often several interactions to gather enough information from several employees to learn to sound like you belong there, then using it all against someone with “keys” who escorts you the rest of the way.
Show HN: I built the first commercial local LLM app
I've been playing with local LLMs for a while now, and I decided to build the first commercial local LLM app that's easy to use for normal humans. I needed a simple, but useful task, and to scratch my own itch: grammar checker. This is my first product trying to use local LLMs to solve real problems in a simple manner. I expect to launch more soon. Feedback is appreciated.
I think their point is that the c in glibc stands for C, as in the language. A glibc rewrite in Rust wouldn't be glibc anymore!
I ended up just buying a CPAP. Ultimately, its not easy to sleep with one. I use a MAD now and my experience has been substantially better in terms of persistence in using it and less snoring. However, it has caused my teeth to move which is a tradeoff I can deal with.
I honestly can't imagine not using extensions. I'm 39 and have been on the web since Netscape etc in the early 90s and I honestly care more about the extensions than I do anything the browser actually does. Like, if there were no extensions I don't think I'd care at all if I used Firefox, Chrome, Opera, etc. But Chrome and Firefox have this massive, massive ecosystem of productitivy improving extensions.

I'll give an example since I'm tooting so loudly about this, my job entails a lot of R&D and distributing knowledge to other engineers in a concise manner. I use an app called hypothesis- https://web.hypothes.is/ which is very popular in research groups.

What it does is it lets me essentially annotate websites. So for instance I have an application with a front end UI, instead of writing readmes with no interaction to the front end UI I can actually annotate each page like a how-to, or a help doc. You go to that specific URL and get notified that there's a hypothesis doc on it to read.

When I used to work at a k8s distro company I used it to help teach people how to deploy clusters, etc.

Another one is Dark Reader that makes every single website dark mode.. Ublock I can't even remember a time of my life not using to block ads.. I do have null stuff via cloudflare dns as well but still use ublock everywhere since it's also a massive security improvement blocking chaotic javascript.

It's amazing for training situations.

https://web.hypothes.is/
I don't see any proof that time exists. For all I can tell, only the present moment exists. You say I "observe it again". But how do I know I observed something in the past? The memory is just an experience I have in the present moment.
Are you looking for material that helps you understand the process open source developers use to create and maintain their projects?
Ok well then long lived isn’t the only context that matters either