skysight-inc/HackerNews huggingface dataset:
My prior employer was really worried about source code leaks.

I was more like, giving the direct competitor the code would more be like industrial sabotage for their sake. What could they possibly do with it. They would waste fte years dechiffering it instead of doing something useful.

But nah, rather keep your own engineers in the dark about secret plans and road maps.

I worked out quite well though, since the engineers did their thing withoit knowing what the higher ups wanted.
And overriding Ctrl+K without even being so good as to give way when you type it a second time. Assholes.
I hope the business model is actually sustainable, because I've been using it since the app was shared here and I really like the free tier, especially because my main phone number is basically prepaid, so this is a massive upgrade!

Here's hoping for a long and bright future!
why would they? if we're talking about sophisticated espionage, that's more of a job for infosec. if we're talking about AFK time, being secretive defeats the purpose.
seems like an unmaintained fork of the less provocative, https://github.com/jswanner/DontF-WithPaste
The book I have my eye on is Nonparametric Statistical Process Control [1] by Chakraborti and Graham.

In the past I've also tried the trick of taking the logarithm of values to convert a power distribution into a more normal-ish distribution. My project was to see if I could alert on an increased rate of uploads to RubyGems, signaling a possible malware campaign. Time between uploads follows a power law. I used the logarithm trick to convert it -- though not successfully. There are actually multiple distributions -- the "random" one which is prominent, but also other peaks centered around 1 second, 2 seconds, 3 seconds etc. Basically the detection was made difficult because of mass uploads being rate-limited on the uploader's side.

[1] https://www.amazon.com/dp/1118456033/
"I read a lot of Taleb in my early 20s, and he'd call this iatrogenics in a non-medical context, and I'd agree. One of the ex-Pivotal guys I spoke to mentioned that most of the highest-performing teams emerged from "benign neglect" from management - i.e, they got busy and left the team alone. Could be a recipe for disaster, certainly, but there's also compelling anecdata out there that it could be the grounds for great things with the right people."

Alan Eustace, who was Google's SVP of engineering forever, used say he would deliberately put enough on director's plates that they couldn't pay attention to everything, in the hopes that exactly this would happen.
> How the fuck you name a diary as helpful for humanity?

Tell me you've never read Anne Frank's diary, without telling me you've never read Anne Frank's diary.
We temporarily renamed some fast food that wasn’t even correctly named after them, and made a bunch of juvenile jokes about their performance in WW2 for a couple decades. I dunno, I was just a kid at the time, but I didn’t get the impression that we were taking their complaints very seriously.
I mean of course the idea was to put it in a form that is sent using POST, but even then, it's a single-use reset code so once it shows in the log it's worthless.
Mostly it seems to be a countermeasure against mistyping your email/password and then copy/pasting that bad value into the “confirm email/password” box.

Nowadays it’s a (hopefully accidental) countermeasure against password managers!
I just wanted to chime back in here and say that I am finding this discussion absolutely fascinating and enlightening. This is HN at its best. Thank you.

FWIW, as someone who is interested in science pedagogy, and specifically as someone who actively engages with anti-science propaganda like young-earth creationism, I want to contribute this:

> In my opinion knowing how to use the Schrodinger equation to get the "spectrum of the hydrogen atom" is essentially a matter of historical interest but really not relevant to understanding things.

IMHO this is more than historical interest. It's a dramatic illustration of how science actually works, and specifically, that it does not rely on any appeal to authority, despite the superficial appearance of occasionally hearing people say things like, "Einstein teaches us that X" with the implication that X is therefore unquestionable gospel because Einstein said it. Here is an example of a calculation that anyone can do (with enough effort) and compare to the results of experiments that they can likewise do themselves (with enough effort). Of course, most people won't bother to put in this effort, but just knowing that they could if they wanted to is very powerful because it provides an actual reason why other people's results are generally trustworthy: even if you don't do the experiment, someone else might, and if the result turns out to be wrong then it will eventually be called out.

Also...

> this approach emphatically does not generalise to more complicated systems

This is spot on. Speaking from first-hand experience of my own intellectual journey into QM, focusing on single-particle systems and slogans like "any attempt to measure the position of the particle destroys the interference in the two-slit experiment" is extremely misleading. It leads to conceptual dead-ends that make it much harder to wrap your brain around entanglement than it should be. IMHO, QM pedagogy should start with entanglement and decoherence. In this respect, I think Aaronson gets it right.

But mainly I just wanted to thank you both for the privilege of being a fly on the wall while you discuss these things. It has generated a long reading list for me.
> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read all the code to see how this extension works, and what it's [not] doing with your data.

The problem is that even if I read the code, or more likely chose to trust that someone has, it's not guaranteed to remain true for future updates. The author's scruples may weaken with time, or they might sell the extension, etc. (I think Chrome's extensions auto-update, but even if they didn't I'd still have to remember that this extension is one that I can't assume it's safe to update.)
Stripe docs do that and it annoys me to no end. They let you use the native search if you press ctrl+f a second time but since there is a delay it causes chaos.
They are places of scholarship and they grant degrees. What is missing from them that makes them not universities?
> i assume by 'windows' you mean 'microsoft windows'

Yes of course he did, and you don't have to guess, because the phrase "Windows for example uses" makes Windows a singular noun, compare with "windows for example use". There is no possible ambiguity in the post you replied to.
This is both a non-sequitur and grammatically very strange--especially when compared to the quite clear grammar in submissions from more than 5 years ago as opposed to relatively new comments.

Has this "mistermann" account been compromised? Is there a way to flag it for review?
I mean it doesn’t really offend me but it would be difficult to say recommend it to my mom. I guess it’s just me.
Win32 does allow you to change a top-level window into a child window of another process. You just get terrible performance if you actually attempt to do this.

For a more practical way to simulate a top-level window being a child window of another program, you make the top-level window Borderless, and perform all the necessary window management to maintain position, dimensions, and Z-order.
Too much gets justified with vague, handwavey "because security" excuses. We can't do this because... uh... because security, yea, that's it! It should be "Specific vulnerability or GTFO."
My father was an artist, also suffering from some dementia, and towards the end he went through huge stacks of his work and put much of it aside and told me to throw those away.

But I noticed that a number of the ones he wanted me to throw away were works he had signed. So when he made them, he had been proud of them. My thinking was similar to Marquez's sons: why should I trust his opinion now rather than his opinion then?

So I put them aside and labeled them as "rejected" rather than throwing them away. They will always be listed as "rejected" but I still think they were worth keeping.
IMO the very act of disabling paste is far more offensive but I get it. Not my project to change unfortunately.
Cheapest 1-2tb fast cloud database question
I am trying to build a system that includes a 1-2b time series database with quick insertion and search. What do I do? I was checking oracle and the most basic version of this was looking to be hundreds of dollars per month.

What is the best cloud service to use to build quality infra without getting screwed by expensive cost? Dont have cash flow on this project yet.
Yes, please!!! ^^^
> Which to say that, imo, "restoring the free market" isn't a useful action in this mess. State controlled medicine is essentially the only solution to the already partly collapsed US health care system.

That's a wild claim that is not only completely unprovable, but self-inconsistent. We're in this mess because of the failure of the state to create (and enforce) good regulation to begin with, and you're proposing that we move the healthcare system into the state? Pure insanity.
Hell just hijacking any standard browser controls is infuriating when it catches you out when you're just not paying complete attention.

Edit: Apparently Firefox has the `permissions.default.shortcuts` config option

UNKNOWN: Services.perms.UNKNOWN_ACTION [0]

ALLOW: Services.perms.ALLOW_ACTION [1]

BLOCK: Services.perms.DENY_ACTION [2]

PROMPT: Services.perms.PROMPT_ACTION [3]

And in the site information panel you can disable the Override keyboard shortcuts permission on a per-site basis. Neat, doesn't solve the paste override issue though. Source: https://support.mozilla.org/en-US/questions/1241294#answer-1...
Ah yes, because I want to support the development of an Adolf Hitler AI...

https://gab.ai/start/hitler

Maybe there's a middle ground between puritan BS and literal Nazis?

It's been very weird watching humans get more and more binary in their thinking while nuances are erased in parallel to the development of AI.
There are quite a few if you’re willing to run it yourself. There are also several good services out there that let you run open source models with OpenAI-like pricing and billing.
I meant in the context of writing code - you’ll never hear anyone refer to their “bindings”.

It breaks down with the simple `let a = 22; let b = a` example where the tentacle/binding metaphor can lead to wrong intuition of why a change to the value of a is not reflected in b.
Do you need to plot all 10k points? If the goal is to illustrate a trend I would aggregate the data to make it more usable.

Otherwise, maybe it changed, but using canvas is a lot faster than SVGs
Comments are very important, but I wouldn't call them "code" because they're not checked. This is one area I predict will be very important in the future, possibly with the help of LLMs: comment checkers. They'll not only ensure the comment isn't factually incorrect, but that there aren't sneaky edge cases (or not-so-sneaky, not-so-edge "oh I forgot to mention [the most important part]...") missing from the comment.
> When you have a confirmation field, like signups that require you to type your email and then verify your email, blocking paste stops the user from typing a typo and then copy-pasting the typo into the confirmation field.

This argument is indefensible. Browsers have had autocomplete for over a decade, Contact book applications that store email addresses have existed over a decade, password managers that also handle email addresses over a decade.
> It is a proven solution that effectively addresses fundamental LLM challenges such as hallucinations and lacking domain-specific knowledge.

mm.

> While RAG has proven beneficial in reducing LLM hallucinations, it does have limitations.

mhm.

> [good models] support 32k-token-long contexts, showcasing a substantial improvement in embedding capabilities. This enhancement in embedding unstructured data also elevates RAG’s understanding of long contexts.

mmmmhmmm.

So, let me get this straight.

A model with a long context makes RAG significantly more effective because you can put more context into the input.

...but a model with a really massive context window won't be significantly better?

??

> Vector databases, one of the cutting-edge AI technologies, are a core component in the RAG pipeline. Opting for a more mature and advanced vector database, such as Milvus,

> Conclusion: RAG Remains a Linchpin for the Sustained Success of AI Applications.

Aha! So, this is a sales pitch. Right.

No. You're wrong.

RAG, as it currently exists, is a dead end technology. It exists because models don't have a large enough context window.

If models get a significantly larger context window, it will become mostly irrelevant.

Obviously, there always going to be some technical / compute limitations on the window size, and at some level, you'll always need to filter down to the relevant context to put into the input, so yes, technically the approach will always be around in some form.

However, RAG in it's current form, where you have a tiny context window and you put little vector db located snippets in it, well.... lets just say, if I was a vendor for a vector database product, I'd also be worried and also be producing opinion pieces like this.

An open model with a massive context would solve these problems trivially for most people, and make most 'vector db' products unnecessary for most uses.
My primary YouTube experience is:

a) Browse when I have a few minutes, and add interesting videos to Watch Later

b) Watch them in the evening when my family has gone to bed.

I don't watch everything the same day, so over time it builds up. Sometimes I have more time, so I catch up then. I try to keep it less than 50 items, and if it ever goes over I'll prune it.

I rarely watch movies or TV shows - I watch YouTube.
Not sure why OP linked to a fork instead of the original. But the original has a bookmarklet version if you would prefer an alternative.

https://github.com/jswanner/DontF-WithPaste?tab=readme-ov-fi...
A classic “save the children” argument of security. I know you aren’t making it but i have heard people argue this too many times over the years.
I consider it a reduction in security because it makes entering proper random passwords more difficult - either I have to paste it somewhere else first (and leave it in plaintext on my screen) OR I have to use a more memorable/shorter password. When I can paste passwords, they can be as long as possible and never are actually visible in any way.
> An average conversation with Pi lasts 33 minutes and one in ten lasts over an hour each day.

This is an incredible claim. When I use Gemini/ChatGPT it’s usually a few minutes at a time. Quick query, and move on. Rarely revisit past chats.

What about this product elicits such a different response? Is this supposed to be an AI friend? Therapist?
Quora too.
Apple really trying to be the asshole here. Imagine installing work apps that disappear after 30 days.. Also what happens if the user chooses not to share their live location with apple?
Nikon Is Acquiring Red
> Software development is not a stable process.

This causes confusion in my experience. "Stable" doesn't mean what it does in casual usage. It means that you have a mean and variance that are not varying over time (and there are ways to alert if they are). A stable process can lurch around like a drunken sailor and still be considered stable for SPC purposes.

I think bugs should be stable if you normalize it by a size metric. So bugs/SLOC or bugs/story points.
Apple seems keen on demonstrating their dominance over government.
> But wait! The comments will get out of sync with the code! Well, they shouldn’t. When we perform our code reviews, we need to review the comments as well as the code. Comments should be correct, understandable, and valuable; we need to keep these points in mind during our reviews.

Problem solved, apparently.
RAII All the Things
This is one of my favorite introductions to this topic area, especially since it gets away from the dominance of manufacturing applications for SPC.
No, but I’m also not sure what your point has to do with what I was saying
In the free version, that would certainly be how it gets monetized. But a lot of interest is on markets that will pay for the service, such as businesses. I would fully expect this to be a differentiator between Microsoft Co-Pilot on Windows Home vs Windows Professional, or default Co-Pilot vs Office 365 subscription Co-Pilot.
It's funny that article mentions Luntz. I should have known he was involved. But as it turns out, this time he unintentionally got it wrong.

For me, those who don't believe in climate change use the term global warming. The reason is simple. If they stick to that narrative, anytime there's extreme cold they're able to say, "See, global warming is nonsense." On the other hand, extreme cold in the context of climate change makes perfect sense. There's no room for pushback.
> Whether or not that will be something the European Commission takes issue with, remains to be seen. After all, an EU citizen is an EU citizen even after they leave the EU.

I fail to see how this is in any way relevant. Cannabis is legal in Canada, and Canadians remain Canadian citizens abroad. If they're caught with cannabis in a country where it's illegal, they will be prosecuted for breaking the law. Laws don't follow people around like this.
They don't lose access to the apps. I suspect the phone itself is what disables it, not sending the location to Apple.
For Safari you can get Don't Fuck with Paste (and lots of other Don't Fuck with X options) with the Stop The Madness extension.

https://underpassapp.com/StopTheMadness/
This one is the version linked by the Firefox addon [0]. Honestly can't tell if one or the other is better but I like having it automatically enabled. Considering it hasn't been updated for years (but still works) I'm not particularly worried.

[0] https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
might just consider caching them to a thrash-drive with yt-dlp and one of those browser-exntensions that caches a webpage for offline use; then watch later without linkrot, ect
can even throw that behing something as simple as darkhttp and serve it to your tablets easier too

but of course the downside is the required regular spring cleaning

having an AIO system for that would be pretty nice though
> Really shocking to see so many comments here arguing we have a right to see/read/hear private, unpublished work that a deceased artist left clear instructions to destroy in the event of their death.

What's so shocking about it? When you are dead, you have no rights or property. It all belongs to whomever you left it to.

If marquez didn't want his work published, he should have destroyed it himself rather than leaving up to someone else. As others have mentioned, kafka did the same thing. Left instructions for his publisher to destroy his works after his death.

> Do we get to look at your personal journals, browser history and hidden photo gallery once you kick the bucket?

Who cares? If you are so paranoid about it, destroy your personal journal while you are alive. Otherwise, whoever gets it after your death can do whatever they want with it.
I could be wrong. That's one thing I'm trying to figure out. Setting that aside, like I said I don't really know that community, being mostly a Java developer. What're the go to database libraries? Is it sequelize, or something else?
How generous of them not to brick your phone once you install any unapproved software

It's almost like monopolies are bad for society
For me, CVSS and the people who use it lost all credibility when they asked my team for a urgent update to patch… a pcmcia bug in the kernel of our EC2 instances.
The benchmarks are pretty impressive, but the release of a fixed MT-Bench and the Physics GRE exams is a very nice touch https://github.com/InflectionAI/Inflection-Benchmarks.

I tried asking the Pi model some questions and it has gotten much, much better since I last tried it a few months ago. Night and day.
That just takes the argument from bad to worse. “How will I condescend to my users without breaking their browser functionality?”

Zero times have I been saved by this feature
No, it's just load management. They run a full matrix home server for all their users and a bunch of bridges.
On the other hand, if you do something in a foreign country which is legal in that place but illegal in your home country, you can be prosecuted back home for it.
Another thing we hoped for when we started writing Certbot was that there would be official ACME client support in web servers. Caddy does that. There's also an experimental Apache module that does that.

https://httpd.apache.org/docs/2.4/mod/mod_md.html

So another path toward making Certbot more obsolete would be having stuff like mod_md be officially supported in web server applications by default.

Maybe we could also imagine someone making a distribution of nginx that bundles Traefik or another reverse proxy and configures both via the same configuration file (!?!?!).
Well, I'm pretty sure I didn't say that nobody wrote node backends.
The DMVs in many states have been inefficient for decades. As has the VA.

Most inefficiency is completely non-partisan.
Has any one in this thread actually evaluated all ~320 CVEs since Feb 20? Because I have. And I literally just finished writing a filter script for MITRE's cve.org API output.

1. Most of the new CVEs have potential security concerns. At the very least, they would have been assigned a CVE if they were reported by an external researcher.

2. Many of them don't affect the older LTS branches.

3. I found 1 (1!) CVE that has a remote exploitation possibility. The rest are mostly local privilege exploit or DoS or crashes.

4. This Greg dude (heh) is backtracking to 2021 to flag bugs that have since been fixed. If your kernel repository is even semi up to date, you would have cut down the CVE count by 1/3.

In my company, the majority consensus amongst the kernel developers is 'patch your shit and do rolling release. We are too busy to evaluate all the CVEs.' On the opposite end, are embedded hardware kernel developers who barely had their kernels working on existing hardware. Both sides make good arguments and I don't have any opinion I'd share.

There are other ways to lessen the CVE workload.

1. Disable unused components with defconf or make menuconfig.

2. Don't stay on the bleeding edge branch (ie. 6.x)

3. Implement automatic minor version commit merges

Your mileage may vary, but with these implemented, the workload is managable imo.
Or worse, imagine realizing you forgot one important app when reaching your destination. Uber doesn't exist in the country you went to? You can now only install this country's taxi app through the App Store since your alternative app marketplace lost its ability to install apps...

> However, you must be in the European Union to install alternative app marketplaces and new apps from alternative app marketplaces
Linus (of Linus Tech Tips) said pretty much that. They do the "OMG" face for a day or two, and then switch to a less annoying thumbnail.
the phone disables itself without sharing to apple
unknown time and space complexity

True in general but for the basic datatypes sent through hardware regusters your processor architecture has fixed precision. So the time and space complexity is O(1)