skysight-inc/HackerNews huggingface dataset:
“Less likely” doesn’t help if you may get arbitrary (user) input. If you can use a byte sequence as the key, a better strategy is to UTF-8-encode the pieces and use 0xFF as the separator byte, which can never occur in UTF-8.
Show HN: Drop SSH private keys in exchange for keygen via PRNG and Ed25519
(tldr; visit https://jsr.io/@key/gen-ssh-ed25519 for details)

I have a hot take: the ~/.ssh folder should NOT contain private keys.

A private key is generated on the first day of computer setup and remains there permanently. It will have mode 600 if not misconfigured, and may also have a passphrase for protection (you do ... do you?). So, what's the catch?

During its entire lifespan, which can be months or even years, those private keys can be compromised in just a matter of seconds. This could happen if someone types "curl -d" in the command line on your behalf during a coffee break, or if an NPM package with numerous intermediate dependencies' postinstall scripts to send it elsewhere, even if guarded by a passphrase, ask yourself how confident you are that phrase you have will survive offline brute-force attacks?

ssh-agent to the rescue.

If you've enabled AddKeysToAgent and UseKeychain in your ~/.ssh/config file, you can safely remove your private key from the disk after it's automatically added to the ssh-agent (verify by ssh-add -L). This protects against all kinds of attacks, however, if you reboot your system, you'll need to set everything up again.

Thus the reproducible keygen comes into play, in a nutshell, instead of relying on entropy taken from /dev/random and letting the end user hold on to it safely forever (how?), let's use well-configured PRNG (i.e. PBKDF2 - SHA512 - 400,000 rounds in 2024 from native webcrypto in this case) with better algos (Ed25519 instead of RSA), to generate the same private key on demand on-the-fly, once the private key added onto ssh-agent, then just delete it from the disk, this greatly reduced the attack surface of the private key, no private key left means nothing to leak at the first place.

The last piece of the puzzle is coming up with a manageable salt/passphrase for PRNG, this can vary depending on your threat modeling, I will provide a few examples for inspiration, but you should choose what works best for you:

- UUID generated from system entropy, put into ~/.ssh/config as a vague comment yet you can retrieve it later on

- a strong password generated by password managers and safely stored across multiple devices

- any git commit hash that is unrelated whatsoever, this can come from one of your side projects or even some opensource project, as long as you don't lose the trace from your mental memory

- Merkle tree root hash from any given height of the blockchain

- specific version of any pkg (i.e. npm or crates) tarball's checksum

- your favorite number multiplied by the year of choice and cubed, i.e. (42 * 2024) ^ 3

- chunk of pi digits

etc...

The program is released on JSR (https://jsr.io/@key/gen-ssh-ed25519) and designed to be executed by Deno which is secure by default, it reads from command args and emits to stdout, without any file, network, or environment access.

Credit to Paul Miller by his NPM package (https://www.npmjs.com/package/ed25519-keygen) for the heavy lifting.

What is your opinion? Do you have any other suggestions or did you notice any oversights?
A superior race (AI or aliens) might also see some purely aesthetic value in individual humans, like butterfly collectors.
Everything is memory safe if your only datatype is uint8_t /s
Akin to alchemy, spring up the UI to solve the user's problem. When timelines are shortened from weeks to hours, what can we build?

Can a user just talk to a computer and solve their problem regardless of the platform?
Where I Stand on Libertarianism
What happens when any company fails to pay the government? Their bank accounts are frozen and assets are seized, at a minimum.
$72.3B in sales, but given they get less than 30% of that, their cut is less than 21.7B. Put that in perspective of their total revenue of 294B that year the app store represents only ~7% of their total revenue. And I suspect the app store is actually a fairly costly business to run - a lot of effort goes into the decor of the walls around garden. I'm thinking app review, even content serving.

Not arguing that it's not a profit center - but in perspective, I suspect apple's reasons for defending it are not primarily the direct financial benefits of it - it's probably mostly about the indirect benefits.
OpenAI: The Board Expands
> You're not born knowing how to interact with others socially; it is learned.

I disagree. As I've grown older, it has startled me to observe the degree to which personality is innate, or inherited. I used to believe we were born tabula rasa, but since raising children and burying my parents, I see that my earlier opinions were absurd.

Do you have children?
It’s so interesting to see the full circle of acquisition PR.
Yes, I agree that is some component of it as I have felt the same vibe from some.
Like the "Coffee, coffee, coffee" scene from "Moscow on the Hudson", I guess. And also very lonely with all their friends and family left behind.
> It’s clear you have so little knowledge of the area you’re trying to talk about there’s not really a point in continuing.

I am developing for Windows, MacOS, Android and iOS. Please continue explaining me how I know nothing about it.
The problem is that you still need a human in the loop to determine if you're in the 13% success bucket, or 87% failure bucket, and the time it takes to make that determination is still a significant fraction of just solving the problem.

So the actual value here is not "13% of all issues fixed for the cost of compute," but more like "a discount on human time for 13% of the issues". But you also have to factor in the time taken on the 87% of issues where leading you down a wrong path can be adding time versus human only. It's not clear to me how it all shakes out, and would require large-sample experiments with humans to determine. I would bet the final margins are small though.
I am pleased how X/Twitter responded to this request.

X/Twitter notified the person, sent a copy of the the subpoena, suggested legal representation, provided recommendations, and defied the NYPD order of silence.
I'd forgotten how many they had killed off. Adobe actually ended up abandoning their Figma acquisition https://news.ycombinator.com/item?id=38681861

You could add Lightroom to your list of survivors.

Autodesk employed a similar acquire, absorb some features and then retire strategy, in the CAD 2D/3D space.
In the same way that CSV supports fields that contain nested CSV documents: cumbersomely / painfully, with lots of escaping of the delimiter characters.
Full Text Search vs. Semantic Search when to use what?
The NYPD is well known for taking attempts at oversight personally[1][2], overstepping both regulatory and legal limits in the process.

[1]: https://nyc.streetsblog.org/2022/08/29/cop-left-creepy-voice...

[2]: https://gothamist.com/news/nypd-officer-poses-as-311-operato...
GitLab's free plan is pretty limited; one of the nice things about GitHub is that the free/open source plan is actually sufficient for the vast majority of projects. And with the cheapest plan being $29/user per month that's not really an option for personal accounts or open source projects. GitLab's pricing strategy has been discussed on HN extensively before, and very few people seemed willing to pay that. It's strongly focused on business cases (and even for that, it's actually quite expensive).

Other than that, I think it's "viable" in the sense of "it works", but I hate using it. The UI is SLOW and overly complex. And lots of things don't work well if you zoom things to make text larger. So even without all the pricing plan woes I wouldn't want to use it.
>Yet competition can and does better, much better re safety currently.

Oh wow I had no idea. Can you compare hull losses / fatalities of the 787 to the A350?
> Does a Mcdonalds burger look like the picture?

Sometimes? But I don't go to McDonalds for the loss function between the picture and actual product. I go for the fast food and good taste (YMMV).

> If you go in with a healthy dose of cynicism IMO LLMs can impress.

I use them everyday in one way or another. But they're not replacing me coding today. Maybe tomorrow. And I go in with a healthy dose of optimism when I say this.

> I’d call it a better google search and autocomplete on steroids.

Sure, but this particular discussion is not about its ability to replace Google Search and / or Autocomplete.
Ozone UI: web interface for atproto labeling services
https://chrome.google.com/webstore/detail/extensions-update-...
A lot of the optimisation at this level is getting data into the right place at the right time, without killing the network.

Its also a group effort to provide simple to use primitives that "normal" ML people can use, even if they've never used hyper scale clusters before.

So you need a good scheduler, that understand dependencies (no, the k8s scheduler(s) are shit for this, plus it wont scale past 1k nodes without eating all of your network bandwidth), then you need a dataloader that can provide the dataset access, then you need the IPC that allows sharing/joining of GPUs together.

all of that needs to be wrapped up into a python interface that fairly simple to use.

Oh and it needs to be secure, pass an FCC audit (ie you need to prove that no user data is being used) have a high utilisation efficiency and uptime.

the model stuff is the cherry on the top
> and the gust triggered a short in some electronics that caused the screens to go blank

That is a hilariously complex first guess.
"warrantless subpoena" is a nonsense phrase.
I am trying to understand use case as to when to use FTS vs Semantic Search. Is there any scenario where Semantic Search cannot be used ? Is FTS dead ?
People write movies about scummy, murdering, thieving, amoral gangsters too, going into great detail about their "humanity". So?

This doesn't mean they're good people, and that 120+ years ago they wouldn't be put to death. Anyone killing a murdering, scummy gangster would be a hero.

Just because someone writes a nice fictional comedy story about a scum of the Earth group of pirates, doesn't mean that all pirates are OK. Ask the villagers that get raped, murdered, and killed by pirates what they think.

And yes, that's in parts of the world today too.
They are accused and indeed 2 charged with running essentially outposts for the ccp gestapo to spy on citizens and former citizens living abroad and critics.

https://www.pbs.org/newshour/politics/what-are-chinas-allege...

Its not hysteria at all.
It was Grateful Dead then turned into then turned into The Matrix
I dunno mate. If I were a brake pad salesman I'd prefer they last less not more.
If you need AI to help you program an algorithm, then you shouldn't be using it because you can't tell if AI's solution is correct.

If you can tell if a solution is correct or not --- well, then you don't need to have AI write it for you.

I think AI programming can only work when the industry begin to treat "almost working" systems backed by human customer service as acceptable.
You missed the point.

Those chart graphics (colors, symbology, everything) are an industry and legal standard, even if you don’t think they are aesthetically pleasing or intuitive. Any trained mariner can get onboard and understand the information regardless of brand. They aren’t meant to be intuitive and beautiful, they are meant to match extensive training and expectations of professionals. They are meant to be the digital evolution of a product with centuries of development. Nothing about nautical charts is a mistake. By comparison googles maps are extremely faddish, the look of their maps has changed quite a bit since launch their launch 19 years ago.

As far as the UI outside of the charts, that works the same as any iDevice or app.

The fact that I can think back over my work history and not remember the brand of the instruments and displays I’ve used is a feature not a bug.
> Sure, competitors could have started in 2009, too bad it's 2024 though now.

You may be missing the point, which is that today's Apple and Google are as "permanently" entrenched as Nokia, Blackberry, and Palm were back in the day. That is to say, not at all.

> Yes, that's why we need open standards to lower the barrier of competition.

Many open-source alternatives to iOS and Android have tried and failed to compete. For better or worse, this doesn't appear to matter to mainstream buyers.
It goes both ways my friend.
However, you should ask Gruber if he is willing to bless your your name if you include a hint towards “markdown” in it (referencing Commonmark), or else there’ll be a big kerfuffle. (funny example to use)
It’s often forgotten now, but just a few years NVidia was cancelled production batches and writing down inventory when the GPU shortage cleared. No one needed more GPUs. It also happens to be when Meta first announced they were going to increase CapEx spending on compute.

I’m guessing that Meta got a sweetheart deal to help take a lot of inventory for NVidia and make commitments for future purchases.
I agree, and I think that is partly my problem to some degree -- a problem that stems from luxury.

Modern technology is kind of the root of most of my issues. I could survive like most people because the expectation of sitting in an office for 8+ hours a day would vanish. My deficits might be reduced, nonexistent, and/or potentially beneficial. I guess in some sense, I would imagine I might feel more "capable" in the world of a muddy fight for our survival. Then again, I could just die in childhood from a deep cut.

Of course, modern life is too good to give up. Despite its comforts, it's clear modern life benefits some more than others (or any lifestyle for that matter).

Thanks for reminding me to be thankful for what I do have. :)
Autocomplete for CLI apps, gui for directory changes, just quality of life things.
Boeing Whistleblower, John Barnett, dies of suicide during AIR 21 lawsuit
North Charleston, South Carolina engineer, who worked for Boeing for 32 years before retiring in 2017.

Whistleblower concerns were upheld by FAA with '50 "non-conforming" plane components in the facility considered missing'

Died of what appears to be "self inflicted gunshot wound" during what would have been “day three of his deposition here in Charleston on his AIR21 case" [1]

Reason I believe a crime cases is relevant.

- Major business with three recent mishaps, major open investigation, and dropping stock price that affects the entire world airline market with engineer directly relevant to mentioned mishap cases.

- Boeing in the midst of talks for $2B acquisition of Spirit Aerosystems [2] to address almost the exact concerns addressed by the whistleblower who committed suicide.

- Possible effects on markets, and acquisition, from response and subsequent investigation.

[1] https://en.wikipedia.org/wiki/John_Barnett_(Boeing_employee)

[2] https://en.wikipedia.org/wiki/Spirit_AeroSystems
Too late for that, I am in a decision making position at a quant firm with very strict engineering standards and I absolutely stand by my decision that businesses that write code that compares booleans together like that should not be in a position to hold back other businesses that don't.

They can continue using 20 year old compilers and quit making the language worse for the rest of us who have put in the effort and cost of writing modern software.
I'm not pushing what to talk about so much as pushing the point not to talk about stuff that is obsolete and starting to smell.

It's that hype-churn marketing that is a motivating factor for the groups to innovate, much like Formula 1. It might be distasteful, but that doesn't mean it isn't working.
They call these "launch weeks"
the other reason is that if canadian traffic can come into the US as domestic pre-cleared, then travelers are free to transfer within the US much more easily. this makes things much easier for places that do not have direct connections to Canadian airports.

(in the US, even if transiting to another country you are required to clear US customs.)
TIL that Istio was a Google product!
it might be twine:
https://www.usenix.org/system/files/osdi20-tang.pdf

but I suspect its not that, because Twine is optimised for services rather than batch processing, and doesn't really have the concept of priorities.
How much code out there does stuff to the effect of

union MyObject {
void* ptr;
unsigned long data;
}
(...)
MyObject obj;
obj.ptr = (void*)some_function;
(...)
store_context(obj.data);

And what would happen to such code if pointers are suddenly fat?
https://archive.is/kul0c
What really annoys me in all these discussions is how no one's tested what happens if they wait until 2050 and try GPT-19.
Many YouTube Poops are artistic expression (e.g. https://redirect.invidious.io/watch?v=dO4eIEvHjSw). Skibidi Toilet is definitely artistic expression: it's a full-on epic. (Reactions from one ≈50-year-old: “baffling” “how did they do that?” “why would anyone make this?”)

If you think the Luddites were defeatist, you don't know much about the Luddites.

> On the contrary - every budding film student will soon [1] be able to execute on their entire visions straight out of the gates. […] Creatives have more ways of building brands and followings for themselves than ever before.

Yet, we have no shortage of starving artists. Will AI provide them food and shelter?

This is unequivocally a win for creative expression for hobbyists, but it stands to harm professionals – at least in the short term, perhaps longer-term. It's not happening in a vacuum: the greedy are revoking livelihoods because they think AI can do it faster and cheaper (laundering appropriated hobbyist and increasingly-cheap professional labour).

> The studio system. Not the industry.

Huh, the word 'industry' has a specialised meaning in economics. Didn't know that.
Functional foundations is a set of functional programming concepts that we have found helpful in everyday programming, even for programmers not trained in functional programming.
I think it's worth reporting on because this particular issue is known to everyone... you need to cycle the power on the planes every 3 days or else the reset themselves. it's crazy that a modern plane needs to have that happen but it does. the most likely situation is that the plane didn't get shutdown and happened to occur at a level flying situation and the pilots probably freaked out and overflew the plane which got it into upset territory. the plane was trimmed and would have been fine if the pilots(likely) didn't do what they did.
"What's not going to change in the next ten years?"
I love it.

It forces me to think about how my programs can fail and what I should do when they fail.
NVidia also invests in their AI customers.
> Almost all claims any serious scientist makes concern the observable universe.

One last thought on this.. I understand these sorts of understood meanings work fine when speaking with professional peers, as they'd understand the assumption. But if you continue to do this when speaking to people outside your field, you will not be saying what you mean to say and will be teaching people incorrect ideas.
Checklist
- open source. This I would do my self too, but only because I am a technical person
- version control. Agree, but in my case only API will be available for you to version (versions are of course in backend too)
- testing. Agree and this is important. But what kind of testing? Would end-to-end tests be enough i.e. separated env with data set and Postman?
- self-hosting. Private SaaS anyone?
- functionality: thanks for reminding me of the importance of loops, variables, and conditions. These can be implemented.
- authentication and authorization. Definitely required for mature software!
>DMA doesn't apply to infotainment systems.

Gee, I wonder why. Maybe you should re-examine this statement:

>This is has nothing to do with the companies being European.
To be fair, I don’t quite get those graphic characters, because the original characters should already be displayed that way, shouldn’t they? Now when I see such a character, I have no idea if it’s the real character or just it’s graphic-character counterpart.
Would be nice if all phones were supported and not locked (just like on pci can install Linux or Windows in version / distribution I choose)...
Ironic that the last two letters in the tittle are truncated, "Mandelbr".

Must be a floating point rounding error.
Steve Wozniak's Ed Tech Startup
Bug Reports (GitHub Issues) Quality Checker
They don't?!
Familiar with asbestos? Its pretty widely regarded as a bad time

https://www.asbestos.com/exposure/automobiles/
Granular Convection
Well, not really. Usually people have all their personal data on their PC, rather than mobile phone.

Maybe this is changing for young people, but on my parents hard drive (for example) there is 30+ years of all sort of personal data, documents of every kind, emails, documents, etc. Not counting all the password and access saved in the browser itself.

If we talk about businesses, public administrations, hospitals basically everything is inside computers, including very sensitive data.
Great point. I have no idea. What are your banking use cases?

For me, it's mostly information I want. I don't really need a full app for that. I want to know:

1) How much money do I have?
2) Did a check I cashed clear yet?
3) Are there any unusual charges? How is my spending this month?
4) Anything I should look into?

For actions I'd want to take:

1) Deposit check
2) Transfer money from account to account
3) Make a payment / authenticate with new EFT payee

All of that could be done conversationally, with a flexible level of detail. The data could be shown on any number of shared interfaces (messaging app, dedicated companion app, etc).

It doesn't obviate the need for software, and there are a ton of software ideas that exist today that will still be useful, as well as ideas that have yet to be discovered that will be useful. But...I expect the LOB app to go extinct in the next couple of decades.
I keep my private keys stored in my password manager.
the biggest cost at meta is infra.

> In contrast, Microsoft is spending over $10b per quarter capex on cloud.

to service other people's work load. Its a different business.
This is a very good question! One of the big reasons we partnered with Turso was for their edge network, so replicas are available close to your origin server. Being able to host anywhere is something that's important to Astro, so this felt like the right balance. Turso is known for its speed and one of the main thing that attracts people to use it.
Nigeria invited, then detained Binance's compliance head and Africa manager
"Generally speaking, the golden rule of product development is to identify the problem first, then figure out what will solve it. " You got me there, but it all started as a hobby project which got out of my hands :)
Apparently Fig was a terminal enhancement that provided a fancy autocomplete system.
>because meta sucks at software

Google started a cloud and their user-facing software is atrocious. Compared e.g. Angular to React, Tensorflow to Pytorch.
https://github.com/SixArm/usv/blob/main/doc/criticisms/index...
Why Is Defunctionalization Good?
Although Bevy says it's an engine, I think that's a bit of an overstatement. It's more of a library/framework. There's a lot you need to do from scratch.

If you are looking for a more full featured game engine-- I recommend Godot.

I have been using Godot lately and it's refreshing how nicely it flows and how the experience mirrors other OSes (from a Linux user's perspective). If you haven't tried Godot lately, give it a try.

Plus, the whole thing is a single binary (~100mb).
Or I guess just not responding to any of the technical questions that have been brought to you. That's an option too.