skysight-inc/HackerNews huggingface dataset:
Parts of this article appear to be AI-generated.

1. The section beginning with "If you are interested in the respective hashcat masks for the passwords cracked above," is most obviously AI-generated as it makes no sense. Quote:

> <Passw0rd1><Passw0rd2>
>
> Mask: ?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1
>
> Explanation: This mask is for a pattern that starts and ends with angle brackets. Inside, it follows a pattern of "Passw0rd" followed by a digit, repeated twice. However, Hashcat doesn't directly support angle brackets in its mask. An option would be to handle these characters separately or use a custom charset (?1) to represent them.

Angle brackets aren't special characters in masks: https://hashcat.net/wiki/doku.php?id=mask_attack

If angle brackets were special characters in masks and had to be represented by ?1 as a workaround, this mask is unrelated to the explanation, since it would match passwords consisting only of angle brackets.

"handle these characters separately" isn't a thing.

The mask doesn't have anything to do with matching "Passw0rd".

Several other masks from the page do not match their accompanying passwords.

Most of them are just showing the uppercase letters, lowercase letters and digits in the password. E.g. "We matched Hello123World with a mask matching 1 uppercase letter, 4 lowercase letters, 3 digits, 1 uppercase letter, and 4 lowercase letters." This doesn't explain why anyone should use that mask instead of, say, 1 uppercase letter, 4 lowercase letters, 2 digits, 1 uppercase letter, and 5 lowercase letters. This is obviously not the mask they used, but an AI working backwards from the password.

2. The password "Cloudy-Envelope-Rainbow-Dinosaur" is 32 characters long, including the hyphens, not 29 as the article says. The password "Sunset$Guitar$Puzzle$Journey" consists of 28 characters, including the dollar signs, not 27 as the article says.

3. The "Conclusion" section smells strongly of AI. Windows was only mentioned in passing, yet the conclusion says the whole article is about Windows. MFA wasn't mentioned at all until this point. Defence in depth wasn't mentioned.
Totally agree. Overall the author's arguments against sharding seem short-sighted, at best.

All large successful user-generated content applications eventually need to shard, and most of them are read-heavy just like gitlab.com. The two primary motivators for sharding in this case are database size and blast radius, rather than needing to scale writes.

For database size, even if your DB still can fit on one beefy server, operational activities like backup/restore and new replica cloning take an increasingly long time. This in turn becomes a major risk to the business -- for example he even discusses how long the restore took when he had to restore the prod DB from the staging DB.

For blast radius, it's the ability to have outages (e.g. hardware failure) only affect a small subset of users. Or for a more extreme situation, the massive difference between "I accidentally dropped the database" and "I accidentally dropped a database".

Sharding does indeed add terrible complexity to the application as well as operations. But in any case, eventually the data size motivator becomes unavoidable for user generated content: you eventually must shard, and the longer you wait, the more difficult it will become.
If you believe that egress prices are fake and pure profit, I encourage you (or someone else reading this with the same belief) to try running your own independent web hosting service ;)

I think what you will discover is that network bandwidth is a finite resource you have to pay for and ration out to your customers, and that the easiest way to finitize and ration something your customers expect (errantly) to be infinite is to charge for it, and charge exactly that price that will cap demand!
The argument is premised on grabby aliens being fast enough to explain why we don't see their expansion; grabby aliens that don't care about being fast would have showed up _long_ ago.
This sounds very interetsing -- would be great to see a setup like this in action / with an example.
I tried doing this with "forgot password?" reminders, and ended up getting locked out of an email account in high school, because of course I had no idea what the answer to "who is the girl you love most" was - I set it in middle school! Not only was that a few years ago, that answer probably changed on a weekly basis!
Not only they need that powerful a telescope, they need to be focused on exactly where the pyramids are/were because that that zoom, they could be scanning a whole lot of nothingness.
I've been building upon the LLMWare project - https://github.com/llmware-ai/llmware - for the past 3 months. The ability to run these models locally on standard consumer CPUs, along with the abstraction provided to chop and change between models and different processes is really cool.

I think these SLIM models are the start of something powerful for automating internal business processes and enhancing the use case of LLMs. Still kinda blows my mind that this is all running on my 3900X and also runs on a bog standard Hetzner server with no GPU.
You lose nonrepudiation if more than one person has knowledge of your employee's passwords. Typically, that's how it works though from what I've seen. An organization will set a users initial password and the user will have to change it on next login. There are some solutions that will look for known compromised hashes and weak combinations and alert on them or force the user to act, though.
Almost 50% of web pages infected with DOM-based XSS. Learn How it is exploited
Social networks are getting stingy with their data
If use of a password manager is encouraged, who is monitoring the security of the password manager?
Perhaps with some sort of score that rewarded accomplishing things more than just talking about them. Then you could look at someone's score and trust that they've accomplished more. Seems meritocratic, but also somewhat dystopian, honestly.
The latter is strictly superior to the former though. RlHF has been abandoned in the open source world.
Not paying location-based salary is arguably more unfair.

If you pay the global median salary to everyone, people in high cost areas are screwed and you’ll never be able to recruit there.

If you pay everyone in your company the highest salary, people in low cost areas live like kings while their peers in high cost areas live a more modest lifestyle.

As a company you’re not out to solve global inequity, you’re out to hire good talent effectively and efficiently. Like leaving a 40% tip at a restaurant, overpaying the going rate on salary doesn’t really get you anything but feel goods at a certain point.
It's basically a fork and spark dev was abandoned
One very noticeable effect it has on me is a reduction in anxiety. Lifting weights close to failure for weeks on end tends to put my brain into a state of calm, where things affect me less. When I'm living a more sedentary lifestyle, something as simple as a person not responding to a text message can send me into an anxiety spiral, where I promptly begin imagining all the things I may have done to upset them. When I'm exercising regularly, I'm much more likely to think "oh well, they must be busy", and go about my business.

I don't know the exact physical mechanism behind this effect, but I can say that the intensity of the exercise seems to be important. Before starting to lift weights, my primary forms of exercise were walking and casual cycling, and those didn't have anywhere near the same effect.
Piano tutors who want to give an engaging remote lesson will want the ability to show themselves playing as well as what notes they're playing. This requires expensive equipment and technical knowledge to set up using Skype/Zoom. I give a few typical setups on the landing page and compare it to Keyboard Connect, which requires just a MIDI controller and webcam.

This represents a challenge for tutors and could be discouraging for new pianists who just want to try lessons without committing to buying a digital/acoustic piano are supporting AV equipment.

Also, I'll add modules to Keyboard Connect that support tasks tutors/students would normally have to organize on their own (lesson planning, file sharing, practice tools)
That's incorrect, the Top 5 in econ are (in no particular order):

- Econometrica

- American Economic Review

- Quarterly Journal of Economics

- Journal of Political Economy

- Review of Economic Studies
> the youth in this country are seriously lost. It only takes one generation of poor parenting and poor civic policies to ruin a culture.

As opposed to previous generations that would murder with lynch mobs or would trash cities in riots after winning or losing a big sports championship?

This is one event, we have no information about age or motives of the perpetrators let alone enough information to slander hundreds of millions just for being young.

And scapegoating like this really shouldn't be allowed here.
Hmm, they say "apparent FTL", not "actual FTL", so it sounds like some form of cheating is involved.
My personal favorite method for passwords is come up with a passphrase I can remember, encode it to base 64, and use the encoded string as the password. If its not too long, the encoded version is usually not hard to memorize either.
Tsar bomba would certainly be visible if they were constantly watching. Anything else would be unlikely.

https://en.wikipedia.org/wiki/Tsar_Bomba#Analysis
The question is, why do you want people to agree on what is allowed in some kind of absolute fashion?

In the park example, the important is that most if not all users should be satisfied with the experience they live in the park most of the time. If your park is the sunny nudist Valley, probably the expectations of rules won't be the same than those who live on the demure cold hill. And as far as everyone is free to go live wherever the rules feets best to their own general tendencies, you don't structurally design your society to generate drama about mundane frivolous topics.

Of course if you want to be the platform that bind them all, for example because you think people are brainless cash cows, you are going to face soon or later the fact that rules for demure nudists doesn't grab a very large audience.

The article does mention a bit fediverse, but then conclude that if you can't have everyone in the same park, you failed. Having a single park with the same permanent rules for everyone will not satisfy even a single individual, because people have moods and interest that evolve over time. Yes it has a cost to go from one park to an other. Compare it with the cost it would imply to have a single park for everyone.
If you have any doubts about sleep quantity and quality, worth reading about the glymphatic nervous system, which is so newly discovered likely you didn’t learn about it in school.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4636982/

In short it explains, mechanistically, why poor sleep affects daily cognition, mental health, and age-related declines. Robust scientific theories explain more of the evidence. The glymphatic nervous system explains why sleep is so key to surviving and thriving. Maiken Nedergaard will end up winning the Nobel for its discovery.
How do we know aliens don’t destroy their environs too? Maybe it’s the mark of an “intelligent” species.
Fair, DPO is considered a fairly well established technique now that is far more stable in training than PPO, but also helps align LLMs from human feedback. The package also helps do PPO, so you can do traditional RLHF, but figured more people would be interested in seeing a DPO example, given how unstable PPO is.
DataDreamer: Prompt. Generate Synthetic Data. Train & Align Models.
I also had hell even with an Intel Macbook Pro. This whole just works thing Apple has been able to project is unfortunate. I have refused using Apple products from work because of how poorly their products integrate. It's not Dell. It's Apple. Any other monitor manufacturer will have the same issues.

Apple also refuses to implement a protocol that allows controlling the brightness and volume of a non-Apple monitor from the keyboard or even macOS itself. It's infuriating. The only monitors it works with are Apple's and the two overpriced Apple-sanctioned LG monitors sold in the Apple Store.
The universe isn't a rock concert, “we're here too early” is not the only possible reason why there's no band on the stage.
I am just saying the intro paragraphs are confusing.
Great suggestion! Thank you very much. I'll definitely keep this in mind when I make a proper demo video
made possible through their national digital ID connected to government services, relevant because the US wants to roll this out to other countries - https://www.usaid.gov/diiaindc

while you can make the case this is a valuable tool during a war, the same tech could be used to effectively destroy any dissent to the government under normal circumstances
I don't understand why people jump through so many hoops and complexities when it comes to passwords. Like "seasonal" passwords described in this article. Multiple friends have told me they have an "algorithm" they use to derive their password for any website (it's basically a manual mental hash of some base password and the website name). Other friends have told me they keep a rotation of 3-5 passwords and have a rule for which to use for certain types of websites.

Like, I really don't get it. Why not just use a password manager. I always tell these people to just sign up for a password manager and they always resist and say no. I must be missing something obvious.

Edit: And just as I posted this comment, another bizarre personal strategy for creating passwords: https://news.ycombinator.com/item?id=39335853

Just use a password manager! Basically all password managers will generate a random string for a password when you add a new credential. You never even have to look at it or know what it is.
UBS calls driving an outdated skill.
From a secrecy model of information security to a usage authentication model
I believe that's what therapy is. Trying to convince someone that he is able to process his trauma and continue his life without this burden. And we just know that's not easy. It's a process that can take years. I think you could compare that somehow to trying to convince religious person that the god does not exists.
I don't have any benchmark for these.

Some did some comparisons.

"Versus our initial moment-based implementation, in Chrome we see a 78% improvement (183.93ms to 39.69ms), in Firefox a 90% improvement (269.80ms to 24.88ms), and in Safari an 83% improvement (166.56ms to 27.98ms)."

Ref: https://engineering.widen.com/blog/A-Tale-of-Performance-Jav...

More related to rendering things:

https://www.reddit.com/r/rust/s/wOzuEzFdM5

Dom elements are expensive, so probably not down to v8 itself in that second comparison.

Generally one should expect significantly higher performance with Rust compiled into (optimised) Wasm. 2x, 10x. I don't have strong numbers in hands to share now.

But in some minority of cases, it might be slower than on v8 the latter has a few extremely highly optimised JS operations.
Yep, DPO is not technically “RL” and implicitly uses the LLM itself as a reward model, but training with DPO is far more stable for that reason.
Still faster than my monitor. It can take long enough to turn on that my laptop goes to sleep (from the password entry screen). And since I'm using the monitor as the KVM, I can't even mash the keyboard to keep it awake, I got to reach over and keep touching the laptop.
Thanks, appreciate the feedback, will update when I get a chance!
The API looks nice, congratulations. Will experiment with it. One small silly question: why did you choose to specify the dependencies inside the src dir with the requirements format - rather than inside the pyproject?
For another perspective, if you put 22.5lbs on each side of the bar, you wouldn't call that a "1 plate" lift even though both sides add up to 45 lbs. There are no plates involved in the lift, thus it's not a "1 plate" lift.

If you search "1 plate overhead press" or "1 plate ohp", you'll see many references to how that's a 135lb lift.
Ah, great point--I'm adding that to my to-do as another setup option for users. Thank you!
While it's true that acid rain is not caused by CO2 per se, it is generally caused by products of combustion. The context was specifically the other harmful effects of the root cause - burning fossil fuels - which a solar shield would not address. So it's wrong to narrowly focus on CO2.

As for ocean acidification, it's a pretty big deal: https://en.wikipedia.org/wiki/Ocean_acidification#Predicted_...

"Importantly, the rate of change in ocean acidification is much higher than in the geological past. This faster change prevents organisms from gradually adapting, and prevents climate cycle feedbacks from kicking in to mitigate ocean acidification. Ocean acidification is now on a path to reach lower pH levels than at any other point in the last 300 million years.[81][71] The rate of ocean acidification (i.e. the rate of change in pH value) is also estimated to be unprecedented over that same time scale.[82][14] These expected changes are considered unprecedented in the geological record.[83][84][85] In combination with other ocean biogeochemical changes, this drop in pH value could undermine the functioning of marine ecosystems and disrupt the provision of many goods and services associated with the ocean, beginning as early as 2100.[86]"

See also:
https://en.wikipedia.org/wiki/Ocean_acidification#Impacts_on...
https://en.wikipedia.org/wiki/Ocean_acidification#Other_impa...
https://en.wikipedia.org/wiki/Ocean_acidification#Impacts_on...
If anybody is curious about what the account commented, this is the other comment from the same account:

---

I created a portfolio with Mrs Marlena she has awesome trading strategy and it's been a life-changer for me! If you want to level up your trading game and start making right speculation on trading gains, sign up by following her on INSrTA g ram @** and we'll both get some sweet perks. Let's conquer the market together!
'Baby Bust': Why Fewer Young People Expect to Become Parents (2013)
A big factor for being productive is also not drinking, as drinking negatively affects sleep and, essentially, makes you dumber.
posted a comment with context a little bit ago, seems pretty relevant to HN with regards to discussions on data privacy, tech, crypto, etc.
You only need input source set. I think most mainstream brands support it - you don't need DDC directly, the easiest way is using the included driver which usually provides a utility console commands. Most common suggestion is something from Dell (with its Dell Display Manager).
For those wondering about “wow” - https://en.wikipedia.org/wiki/Wow!_signal

I learnt about this about a decade ago and was a nice read.
>I'd suggest the author thinks yet a bit more about this. "color of the skin", "gender", "location of living", I'm sure the author can figure out what differentiates the first two from the latter.

I suppose what you're getting at is that you can't change your race or skin colour, but you can change your location. That isn't really the case if you're Ukrainian, or just from a country with a weak passport.
Shameless self promotion: https://dicewordbook.com
Thanks! It makes it easier to run with the existing run scripts I have on our large university GPU cluster. :) no other reason
“CSS be weird, but it not be illogical.”

Off topic, is that the English subjunctive mood, but the whole phrase is written in it? I don’t think I’ve seen much content written like that! I have to agree that CSS be weird, but one’s use of the confusing subjunctive mood best be left aside.
Why did Taylor Swift switch planes in LAX? Most likely: cabotage rules.
At time of writing, 'PTSD' occurs in these comments fully an order of magnitude less often than 'trauma' (12 vs 178 instances). Even discounting for the biasing effect of the title, this seems remarkable given what is being discussed.

When did this distinction largely disappear from the discourse? It seems like it could have a great deal of clarifying power here.

I don't believe I've yet seen anyone from the 'it's trauma if you think it is' school attempt to fit the empirical fact of PTSD into their theoretical model. I would be interested to see that, if anyone's inclined to try it.
Pretty much everybody
I see where you're coming from, but in practice offering location-agnostic salaries means you're not competitive in areas that command higher salaries (notably, large tech hubs like the Bay Area, Seattle, New York). If anything, you're trading the talent pool near those hubs (and let's be honest, the rest of the US) for talent in other countries.

That's a trade-off you might be willing to make, but I hope you understand that not every company is willing to write off the entire talent pool of the US.

(As a point of reference, the only two countries that Google pays comparably to even the cheapest parts of the US are Switzerland and Israel.)
That's always been my take - a monkey can run a well oiled machine - but when it goes wrong ...
For backend work, why rust over Python?

I ask because C++ was never really a huge contender for me, just something I had to use to get some things working because they haven't been ported over. So I never understood the C++ vs Rust argument in that subdomain.
That's the food intake of what, 4 or 5 'regular' people?

And probably 25 in the poor part of the world. I'm not a vegetarian but I wonder if the people that do this sort of thing realize the impact of what they are doing, it's the equivalent of consuming 1000+ chickens on an annual basis and that's not all they eat. I get it that kids in their teenage years eat a lot because they grow so fast and really need it but this feels excessive to me.
A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm).

It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such thing.

The trade off is that pass mgnrs give more convenience, but have slightly more failure modes (not knowing the master password, not having access to the synchronization or master vault, not wanting to log into a pass mngr on a potentially compromised computer when you only need a single password you are willing to sacrifice) while the in-head approach has a single one: not remembering the derivation method.

ETA: both are sensitive to sites changing names or URLs. But password managers more so (requiring extra searching and clicks) while in a mental key derivation context, you would probably remember "oh, it's protonmail." without explicitly needing to distinguish "login.proton.me" from their old URL. But, that does make the key derivation approach slightly more susceptible to phishing. Not seeing the password autofill at least gives mental pause.
That’s totally valid and something we would even encourage! This project is for researchers so if there is a point where the abstraction is no longer useful, by all means configure, or subclass, or copy code.
We're using Dioxus on the backend with Axum for https://github.com/bionic-gpt/bionic-gpt

Very pleased with the result. It's great having the compiler help out with UI work.
Yeah, agreed. It can be true that SWAT is overused, that this guy shouldn't be able to get swatted 40+ times, that even when SWAT is used they're probably excessively aggressive and undertrained, and that "stop sending SWAT to extremely serious calls" is a ridiculously laughable solution to swatting.
On the other hand, if there was a big push for more sleep, some industries would take a nose dive. Live entertainment, bars, social media, gambling etc. Wonder if at the end GDP would be up or down. But I guess it’d be a win for the society as a whole.