skysight-inc/HackerNews huggingface dataset:
Show HN: Free open-source iOS/macOS transcription for the hearing impaired
Hi,
Hope this is ShowHN quality :) especially starting with the personal motivation for this.

A few years ago,
My grandmother hearing got worse. She was 95 years old at the time (she passed away a year ago), she used her iPad to text with us but having a conversation became impossible.
She didn't speak English at all.

Sadly,
Unlike Android's great Live Transcribe (https://www.android.com/accessibility/live-transcribe/),
iOS didn't seem to have equivalent that allows custom languages.
However, Apple does have SFSpeech API which is decent.

Looking on the AppStore, it was hard finding simple free app that has broad language support. So, I've ended up making this app for her (or mostly for us when we try to communicate with her).

It's not fancy, it's very simple "wrapper" with SwiftUI, but I think it ended up decent.

Also,
The social worker that visited my grandmother actually started suggesting it to her patients using Apple devices.

Thank you for your time.
The go board and the opposing player are an environment.

> then experimenting to validate that hypothesis.

Proves my point that scientists can't secrete science from their pure brains, the environment is our teacher. We are just prying at its secrets with our limited brains, and usually need many of us to tackle one field, a distributed search for discoveries.

None of us is smart enough to get even to Newtonian physics from scratch, we need to stand on the shoulders of previous generations to get anywhere. We're not smart enough to do it without the environment or without a large number of people working together.
I thought the pilot only offered “guidance” to avoid responsibility. I learned that from a documentary on the Panama Canal.

Is that just a Panama Canal thing? Or should I find better documentaries?
> just as secure today as it was yesterday.

Agreed but the gotcha is when a new issue comes out and there is no security fix available. It would be enough to say 'we are comfortable patching this if a CVE is found', but at that point they might as well start to maintain it.
Regardless of this point, why are 0 CVEs for Chrome also CVEs for Brave?
I expect to have a decent post-mortem for this major outage...
That timeline implies that there was only four minutes to respond. Is that correct? Where was the ship going? Does it travel under this bridge on its own power rather than a tug boat?

What I am wondering is: why couldn't the bridge have been blocked off preventing casualties? It seems like more than just the boat and operators' failing if there's no time or secondary precautions if such failures occur.

I wonder if it makes sense to protect bridges with pylons like they have in front of buildings to stop cars and trucks.
Debit cards exist and are very common in the US, more common than credit cards. They also largely use the Visa and Mastercard interchange networks though, but they are also tied directly to your bank account. So I am not sure if I am understanding your comment correctly.

In the US you basically always get a debit card with a bank account but not everyone gets a credit card, either because they are wary of credit or can't get a decent one.

US consumers have credit cards on top of debit cards because they really, really want access to credit. Even overdrafting is really common and a desirable feature for a large chunk of the US population.

You seemingly know much more about the backend than me, so I am still a little confused by your comment, about Interac, for example. The US system allows for consumer-to-merchant debit payments no problem, whatever fees there are are totally invisible to consumers. (I think it's lower than the credit interchange fee?) I can also transfer my money from bank to bank without fees, although sometimes it takes a couple days. Where it really falls down is peer-to-peer instantaneous transfers. There are different things becoming popular but I don't think any of them are particularly good, and reversibility is really important in the US market and systems like Zelle don't seem to appreciate that.
I don't see how. A user of a conforming protobuf library can assume, after a successful decode, that a string field contains valid UTF-8. That doesn't generalize to everything called "string".
How realistic is it? Asking for a friend
Currently, TapRefer only earns a commission from six featured affiliate programs. However, we only receive a commission if the user signs up for a paid subscription to use that product. If someone becomes an affiliate or refers a user, we do not earn any commission.
> In today’s article, I’m hoping to provide an introduction to radio that’s free of ham jargon and advanced math.

Sounds great! Let’s dig in.

> … the fundamental mirroring behavior is still present, but it’s usually managed pretty well. Accidental mirror images of unrelated transmissions can be mitigated choosing the IF wisely, by designing the antenna to have a narrow frequency response, or by putting an RF lowpass filter in front of the mixer if needs be

Mission failed. Ah well.
https://certisfy.com

PKI certificate based online information verification

Demo: https://youtu.be/92gu4mxHmTY

I am working on bootstrapping the trust chain (kinda "web of trust"), if you run an org (company,team,meetup,github repo...etc) email me if you're interested in a cert.
Honestly there's still things from CS3 that are missing in Designer V2! Being able to auto-trace sketches is still something that Designer can't do. There isn't really much that I'm doing now in a vector editor, that I wasn't doing 15 years ago. "feature complete" is a good way to put it.
This is super awesome. Do you develop your own models, or is this a wrapper around existing APIs? It would be great to have a way to introduce environment variables like my name, my preferences, and the topics I usually write about. I've actually written this comment using your service. Thank you. Looking forward to seeing what it becomes.
I think doing things like this shows that the police are unable to use discretion in their execution of warrants, so my solution would be to take it away.

Have the warrants specify where, when, and how the search should be executed. Whether they're allowed to break the door down, whether they're allowed to be fully SWATted up, etc. Make it clear that any actions taken outside of the warrant's directions are done as a citizen, not an officer.

Then penalize officers for poor execution of warrants, and judges for poor issuance of warrants.
Access to fine-grained, well-classified financial data costs money. The localhost option provides a way for you to integrate with providers of said data, e.g., using their "developer" api keys. As long as they support free personal use and you stay in their limits, the localhost option incurs no cost to you, and we have no reason (and no way!) to charge anything if you `git pull` and set up these integrations using our readme.md.

All storage will be encrypted w/ client side keys.

For SaaS, we do the integration automatically and pass hosting and fintech costs on as a monthly subscription. We provide automatic report options that also incur small charges, mostly to cover additional compute, hosting, and higher-tier integration with data providers. These reports can use transient data and/or pass encrypted payloads to client side report generation or display, e.g., SPA or CLI tools.
What I’m really unclear about is whether providers are required to use an actual ID to age verify. Does anyone know?

The bill summary on the Florida senate webpage says:

> Such commercial entities must verify, using either an anonymous or standard age verification method, that the age of a person attempting to access the material harmful to minors satisfies the bill’s age requirements.

It sounds to me like “anonymous age verification method” could just mean that the website asks how old you are? What constitutes verification here? That sentence makes it sound like they can choose to use whatever feeble method they want.

At face value this law seems like political points being scored by passing a widely popular law that changes very little in practice (bumping the minimum age from 13 to 14).
>Merchants jack prices up to account for credit card fees.

This is simply wrong. If it was true, then merchants would not care about credit card fees!
It was not all that easy to get a copy of Faces of Death back then, so it was something you might have saw once maybe twice but that violent real death before your eyes was not something that you ever became de-sensitized to because those visuals were exceedingly rare by the scarcity of the content at the time(at least in the US). So that morbid curiosity itch was scratched and then you moved on. Short of the few weird kids that watched that shit over and over, you probably never watched the whole thing. I know I think I watched 10 mins back in the day before it was turned off and we went out to find some beer instead. Now, real violence and death is a search term away and available every minute, hour, and day.

But agree…even that exposure to violence now pales in comparison to the amplification of the negative peer pressures that kids today experience due to social media. At least back in the day when you were away from your peers you could escape it and gain respite. Now its constant.
A deeper question might be is it reasonable to be able to take your name off in the first place after affirming it. In a contrived example we may imagine bob discovers he isn't the father while the ink is still wet after being deliberately deceived.

Less contrived examples are apt to be on average more complicated. The uterus isn't an egg timer. Exact date of conception is liable to be fuzzy. The person on the birth cert is more apt to be the long term boyfriend or spouse than the richer fellow. The failure to communicate uncertainty a function of shame not greed. Discovery might be years later after the obligation is deeper than a signature. At that point do you have a right to reject the child you asserted was yours. I don't think so. I think if you asserted that position you own that obligation for your life. Sometimes the law affirms what we as a society hold to be general true and is optimized for the general case not edge cases.
According to the OP's link, the credit card companies made $51 billion in interchange fees in 2020. That's mostly from what you call "deadbeats". That's a lot of money. Deadbeats are super-profitable.

Those paying interest & late fees are even more profitable than deadbeats. But make no mistake, the credit card companies love deadbeats too.
> He will easily win this case

You can't get any more naive than that :)
Ah I read that versions upto v6.6 were affected and didn't notice the caveats. Thanks
i dont think its honest of you to say that you think people who do manual labour are not being abused.

The next time you drive through a construction zone, let the construction workers know how you feel. I'm interested to hear their responses.

EDIT: Since HN doesn't permit me to respond to your response, I'll note here that I have worked plenty of manual labor jobs. I've been poor. Very poor. I'm better off today than I was then. But, I don't recall ever thinking that having a job involving manual labor was abuse. It was just a job. It's what you did to pay the rent, and hopefully buy some ramen and canned potatoes for the week.

I've done landscaping, and mucked out toilets, and cleaned out the pits of elevator shafts, hauled endless boxes from one end of a factory to the other, and I've always taken pride in my work. Perhaps I was just brought up differently than you were.
Yeah I wonder whether MTD has had the intended effect. I've used https://www.comsci.co.uk/100PcVatFreeBridge to submit VAT returns. It takes a spreadsheet as input, and there's no way to validate that the spreadsheet came from some accounting software or used any useful calculations. The user can just create a spreadsheet and enter numbers by hand.
(Render CEO) We're still investigating, but as of now, we don't think Cloudflare was responsible for this incident.
Oh I know it wasn't Saga. I own every Panzer Dragoon game(but not the remake of the original that came out on the Switch and Playstation 4 however).
How do I check if my Ubuntu kernel has already been patched?

And if it hasn’t, any tips on how to upgrade?
The only way someone can make money from content is if somebody else is willing to pay money for it. (No, companies don't actually get into black by "writing off taxes" of failed or cancelled shows, it doesn't work like that). I dislike a lot of modern content, too — to me, it feels like majority of shows on Netflix are made for people on heavy doses of anti-depressants. However, I just accept that there's a lot of these people who have different tastes than me instead of putting the blame on a corporate machine that just follows demand.
You can do that by abrogating your pid
I wouldn't call it awesome. It's just a big chip with lots of cache. You need hundreds of them to sufficiently load any decent model. At which point the cost has skyrocketed.
It's somewhat counterintuitive how much energy can be in something moving so slowly. I say somewhat, because when you're up close it's much more obvious, but you're right that on a video it doesn't look like much.
Thanks!

We had to make a bunch of breaking API changes over the last week and the Mac app isn't ready to go on it quite yet, but we'll bring it back as soon as we can, max two weeks, hopefully sooner.
Can I ask why you decided to disclose this exploit rather than sell it to a company like Zerodium? Is it a matter of ethics, or is the money not worth it for you?
This is a common joke in engineering.

It’s not meant to be an insult, but a compliment noting that engineers know what the essential parts of the bridge are
I was going to summarize the background to the EU's regulation limiting fees, but it's too long.

A couple of snippets relevant to points being discussed:

> (10) ... Competition between payment card schemes to convince payment service providers to issue their cards leads to higher rather than lower interchange fees on the market, in contrast with the usual price-disciplining effect of competition in a market economy. In addition to a consistent application of the competition rules to interchange fees, regulating such fees would improve the functioning of the internal market and contribute to reducing transaction costs for consumers.

> (11) The existing wide variety of interchange fees and their level prevent the emergence of new pan-Union players on the basis of business models with lower or no interchange fees, to the detriment of potential economies of scale and scope and their resulting efficiencies. This has a negative impact on merchants and consumers and prevents innovation.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32...
Merchants hate jacking up prices unless that jack-up puts money in their pockets. Jacking up prices drives away customers.
We will share a full incident report soon.
Chromes sandbox uses unprivileged namespaces but has a suid-root fallback.

Electron apps too (if sandboxing is enabled).

Bubblewrap (used by flatpack, idk. about snap) prefers user namespaces, too.

All of them could can have suid fallbacks they would prefer to not have.

Tbh. if Linux had a proper capability system it probably would make sense to attach a "user ns" capability to binaries which in the past used suid-root for namespaces and not allow "other" processes to use it.

> there's little point in enforcing a separation between users and root

I don't agree. But it is a different discussion. (And a complicated discussion too as Linux desktop is IMHO currently lacking in various security areas as security requirements have changed. So often when you argue they should do this you get non productive answers like "oh but you also could do [that other think which also need to change sooner or later]". Anyway it can make the difference between it being easily able to steal all password from your password manager and it only being able to steal the passwords you did use since infection. Or it being able to steel a early boot full disk encryption key. etc. etc.)
I have some questions for you wizard shellcode-flinging hackers out there.

with modern mitigations like ASLR and beyond, how are exploits like this even possible?

I took a course in college which provided us with a dozen binaries, to be run on a specific Ubuntu version. Each binary had a different bug, use-after-free, buffer overflow, both, or more, and our task was to exploit it.[0]

It was HARD. Finding the flaw was hard. Then, writing the exact correct shellcode to do something useful with the flaw was even harder. Especially when you only have the compiled binary and GDB to work with.

In harder levels, we had to do this with mitigations enabled like ASLR, stack canaries, etc.

And my takeaway was, this is nearly impossible, because you need to 1. discover an exploitable flaw (or multiple, and chain them together!!) 2. find the exact binary shellcode payload that will do something useful without simply crashing the executable. And this was in a controlled environment as students, not the real world which is even more difficult.

So my question is, with all these mitigations, how is it possible?!

[0] I googled for the exact project but could not find it, though it was very very similar to this: https://web.stanford.edu/class/archive/cs/cs107/cs107.1194/a...
This is a super simple IT problem to solve technically (ping a URL, provide a status HTML page, etc.) but really hard to get right, like your customer comment about a vendor. If done wrong, people will go to their "you had one job" card. How do you handle hosting of your own service and isolation from larger "cloud" or internet issues?
I think it is possible to build infrastructure that will allow entities to spread responsibility. They do it in other fields I think?

For example I can’t imagine Ford checks literally every single individual component that gets put in their cars, right? I assume they have contracts and standards with manufacturers that make the parts, probably including random spot checks, but at some point to handle complexity it is necessary to trust/offload responsibility on some suppliers.

I bet you could get those sort of guarantees from, like, Intel or IBM if people generally were willing to pay them enough (can you now? Not sure, probably depends on the specific package). But nobody would make that sort of promise for free. The transparency of the open source ecosystem is an alternative to that sort of thing, no promises but you can check everything.

Just to be explicit (since I’m sure this looks like needless pedantry), I think it is important to remember that the open source and free software ecosystems are an active rejection of that sort of liability management framework, because that’s the only way to get contributions from a community of volunteers.
Bob could have not fucked Alice without 2 forms of birth control
You're not necessarily wrong, although simply saying "Linux" isn't accurate either because it's in part a vuln exposed by a specific kconfig, which differs by distro. From the caveats section:

> The exploit does not work v6.4> kernels with kconfig CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y (including Ubuntu v6.5)

> The exploits requires user namespaces (kconfig CONFIG_USER_NS=y), that those user namespaces are unprivileged (sh command sysctl kernel.unprivileged_userns_clone = 1), and that nf_tables is enabled (kconfig CONFIG_NF_TABLES=y). By default, these are all enabled on Debian, Ubuntu, and KernelCTF. Other distro's have not been tested, but may work as well.

Also with other distros like Fedora and Arch, the kernel versions change frequently including new big versions (like 6.4 to 6.5, what in semver would be called "minor" but isn't super accurate for the linux kernel) so that list would be outdated very quickly if not immediately (for example my Fedora machine right now is on kernel 6.7.9, way beyond what is vulnerable). It's quite possible that Ubuntu is the only vulnerable distro given the way they manage kernel versions. That's not a criticism of Ubuntu, because there are pros and cons of each approach, but in this case it does probably make Ubuntu more vulnerable. RHEL and derivatives also tend to stick on a version long term, and it looks like RHEL 9.3 is on kernel 5.14 so could be vulnerable but it's at the very beginning of the range. That would be a useful thing to know.

I think it's also (generally) far more useful for most people to hear a descriptor that most closely aligns with something they can readily identify whether it affects them or not. Then people can look at the details themselves.

Edit: added a little more on other distros like Fedora and Arch
If this ability is important to you then you can break your pipeline into individual files that aren’t going to be read until they are executed, giving you time to edit.
> I think the only way to address this is to significantly reduce the "perceived authority" of any work that comes from using a LaTeX template, as well as authority that comes with the label "peer reviewed".

Opening up access unavoidably makes the signal to noise problem worse, not just for the reasons you note (fraud, exploits) but also average quality drops. Whatever changes are made, will need a more effective filter, not less effective.
Why Did Supersonic Airliners Fail?
Great work, really hope you'll be able to pierce into the medical market eventually. Dragon is still useless to anyone who can touch type.
I've been working on and off on several smallish apps I use in the kitchen, purely non-commercial.

I shared https://teig.pro a few months ago and it's made substantial improvements since then. It's a recipe builder that recalculates masses on-the-fly and supports adding/editing ingredients -- especially focused on breads. Unfortunately Fly.io seems to have flagged the project and is preventing me from deploying updates without upgrading my account (which is already paid). There are quite a few bugfixes which will be rolled out once that issue gets resolved, or I change hosting.

I also made https://pepcorn.pro quite a bit longer in a similar spirit, but much simpler. It uses your device's microphone to detect popcorn "pop"s, and measures the time between them -- done popcorn usually has ~5 seconds between pops.
>"Assange is a russian agent."

Wake me up when the court renders decision that he is.

And even if he is it should have no relation to this particular case.
No they should not port it to Linux. They should rewrite it so that it is platform independent.
if there's no difference in price, I'm paying card, simple as that
I'm just thinking the entire genetics community has to be gigantic, and they can't be the only ones with frustration about an auto-changing feature. Surely lots of somebodies in genetics know somebodies at Microsoft who might be arsed to surface a relatively simple toggle.
You put the slider all the way down to 0, which is then mapped the the range from 0-0 and then you move it back up?!
> don't sue in such situations. Rather, they just vote out the board

cf. with the shareholder suit against Tesla. Why did they sue instead of firing the board of directors?

To vote out the board, you need >50% of the shareholders to back you. To sue the board, all you need is 1 disgruntled investor.
https://sumi.news/
Even has an HN section