skysight-inc/HackerNews huggingface dataset:
No, it's not just time-reversal; it's charge, parity and time reversal. You can't just time-reverse an electron neutrino and obtain an electron anti-neutrino, because the parity will be wrong, and so will the weak isospin charge and lepton number ("lepton charge").

https://en.wikipedia.org/wiki/CPT_symmetry

Worse, the symmetries of the Standard Model are pretty complicated, especially when one goes from the local Lorentz or Poincaré symmetries x SU(3) x SU(2) x U(1) to the global continuous symmetries that capture https://en.wikipedia.org/wiki/Custodial_symmetry, (particlularly QCD) flavour symmetry, and scale symmetry. There are some further long-range approximate symmetries too, and those get worse with spacetime curvature. These all may have to be accounted for if one is time-reversing a region of the spacetime-filling fields of the Standard Model.

> So where did all our antimatter go?

Good question. Nobody can really tell you right now. Maybe there are galaxy clusters totally dominated by antimatter, maybe the antimatter is in a different Hubble volume, maybe it all annihilated into the cosmic microwave background and other ultra-low-energy relic fields (e.g. the cosmic (anti-)neutrino background) we haven't detected or discovered yet, maybe into primordial black holes, maybe in an extension of the Standard model to extremely high energies there isn't a matter-antimatter balance in the first place. One can write down an enormous number of different theories, and relax knowing that there is presently no evidence to favour or disfavour it, provided it's compatible with the experimental and astrophysical evidence we have today.

(I do like the idea, building on an idea arising from Wheeler's one-electron universe, that anti-electrons (in this case more than one) are screened within pion condensates ("maybe they're hiding in neutrons", vaguely), because that makes the symmetries even crazier, and particle physicists deserve that).
That makes sense. I was thinking about the case of using a TPM to unlock full disk encryption as long as secure boot hashes checked out.
You don't need a "ec2" user. A backdoor can just allow root login even when that is disabled for people not using the backdoor.

It just requires the SSH port to be reachable unless there is also a callout function (which is risky as people might see the traffic).
And with Debian and Fedora covered and the change eventually making its way into Ubuntu and RHEL pretty much everything would have this backdoor.
Subsidized loans, healthcare, and education - the three most expensive aspects of trying to live in America today. Hardly seems like the perks are lacking.

Here[0] is the 59 page document of medical issues that are disqualifying. I'm 6.18.d.11. I suppose it's 7 year old me's fault for getting a rare disorder.

[0]https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/do...
It's like how bash and .bat scripts are C-free: they're written in C so you don't have to write any C.

Same with htmx: it's written in JS so that you don't have to write any JS.
> In other words, it's not "a new use" the EPA determines is significant. Nor is it "a significant use" that the EPA determines is new. It's just a use of a chemical that the Administrator determines meets certain criteria, and the statute just happens to call that a "significant new use."

Well, you didn't mention the criteria. The terminology might be clearer after looking at them:

> §2604(a)(2) A determination by the Administrator that a use of a chemical substance is a significant new use with respect to which notification is required under paragraph (1) shall be made by a rule promulgated after a consideration of all relevant factors, including—

> (A) the projected volume of manufacturing and processing of a chemical substance,

> (B) the extent to which a use changes the type or form of exposure of human beings or the environment to a chemical substance,

> (C) the extent to which a use increases the magnitude and duration of exposure of human beings or the environment to a chemical substance, and

> (D) the reasonably anticipated manner and methods of manufacturing, processing, distribution in commerce, and disposal of a chemical substance.

Factor (A) asks whether the use is significant. (And, at the very least, strongly implies that the use must be new - the inquiry is into "projected volume", not realized volume.) Factors (B) and (C) ask whether it's new - if you're considering a process that has been going on for decades, it cannot change the type or form, or increase the duration or magnitude, of exposure to the output of that process, because people (and the environment, etc...) already have the type and level of exposure that is the result of that process. [They also ask whether it's significant, by considering relative levels of exposure ("change in magnitude or duration") as opposed to absolute levels of manufacturing.]

This tends to imply that an insignificant new use could grow into a significant old use over time (as manufacturing volume ramps up), and that in such a case, the EPA should have the option to deem that growth a "significant new use" (relying on factors (A) and (C)), but I don't get the impression that that was the argument here?
The objection I have to this paper is that I keep seeing SQL forced onto streaming workflows when the functional programming operations provided by the non-SQL APIs of systems like Flink and Spark are a lot easier to think about in this context: SQL stream joins often have very surprising performance properties and it can take a long time to figure out the tunables needed to make them perform at scale.
Presumably there are other ways to tunnel encrypted traffic (SSH, VPN protocols, etc.?) that don't necessarily rely on TLS?
Great idea, I'd love it to be yes, I do a bit of 3d work on my tablet and love it using shapr, although expensive.
Hadrius (YC W23) – Founding Engineer for fastest growing compliance software
Outside HN bubble, jQuery is quite an active project.
Are you referring to Scheme or to wasm/wasi? The sandboxing would be one of the the biggest benefits with a wasm-based plugin system, but they were waiting for the component model spec to be finalised last time I had a look.

edit: looks like the plugin work is being done here https://github.com/helix-editor/helix/pull/8675
Probably mincing words but I guess I consider cloudfare part of the architecture and not part of their infrastructure and it seems like you’re conflating the two?

I do get that the volume of data and requests they are handling hardly constitutes the claim of ddos.
I like your perspective
In José Manuel, Manuel would be the middle name, just like in English. It's not a "two-words-long first name". Sometimes first and middle names are coupled like a whole, like it's usual for José Manuel. Also for José-something or Juan-something in general. Other times, the middle name is never used, like in Nicolás Antonio, being the Antonio part extra annoying, because the SS personnel, for some reason, insists in calling me that when it's my turn.
Are medical studies being written with ChatGPT?
It’s also the case that you take basically no risk picking a shitty tool as long as it’s popular (in enterprise).

10 problems with that, you catch no heat. 1 problem with the just-outside-the-norm thing you pushed for? That’s your fault.
> Your password is useless when it comes to hardware keyloggers.

You are of course correct.

This is where threat modeling comes in. To really say if something is more secure or less secure or a wash, threat modeling needs to be done, carefully considering which threats you want to cover and not cover.

I this thread I'm talking from the perspective of an average individual with a personal machine and who is not interesting enough to be targeted by corporate espionage or worse.

Thus, the threat of operatives breaking into my house and installing hardware keyloggers on my machines is not part of my threat model. I don't care about that at all, for my personal use.

For sensitive company machines or known CxOs and such, yes, but that's a whole different discussion and threat model exercise.
Definitely get a job
If this is true, it’s a sad day for software. Not sure why some actors are intent on ruining it for the rest of us.
This factoid about web dev misses the fact that the JS developers today are often the same people who were writing CGI, Perl and PHP, some of us also ASP and later ASP.NET, or some Java. We always knew there are good parts about the old ways and merging the two was always the goal - it just takes some time to get the client side right and then to get the merging right.

This especially applies to React core devs. Remember XHP?
Further, security of a marketing site tends to be lower priority than the product itself, and an install script should generally be secured similar to the product.
> That is exactly what is happening, but our sense is that this language will be no more complicated than C itself, and will to a large extent parallel it.

The point of interfaces is usually to hide underlying complexity. What's the point of interfaces that are just as complicated as their implementation?

> The question is really what is more effective, working under one set of constraints imposed universally (like the ownership semantics in Rust), or taking upon yourself the responsibility of defining such constraints within each program.

One of the things I personally like about Rust is that its rules are very simple and still capture 95% of all situations I find myself in. Adding the complexity of having to write your own formal specifications for the remaining 5% doesn't seem like it's worth the effort.

> So our point is that Rust precludes many kinds of programming that can be safe in relevant contexts, and this is what is so limiting.

Xr0 will also either 1) reject programs that are safe or 2) accept programs that are unsafe. An (computable) algorithm that decides for every C program whether it is safe or not is mathematically impossible. Start implementing loops and you'll quickly see why the idea of provable correctness without any restrictions is doomed to fail.

Not that similar projects don't exist: CBMC, Frama-C, ... How does Xr0 differ from those existing projects?
I don't know what OP meant, but https://k3s.io/ also fits the context.
One of the reasons for Medicare for all is that these sorts of bans would have a direct financial benefit for health coverage.

So would better cities, better biking infrastructure, etc etc.

Our inability to regulate toxic materials entering our bodies is going to be the downfall of this country.
When I Became a Birder, Almost Everything Else Fell into Place
As long as you make the house your primary residence for like 2 years and then you're free to rent it out with your super low tax rate
Anyone using htmz unironically?

[EDIT: for the people down voting, I did not mistype, I meant htmz, as opposed to htmx. Htmz was done as a funny PoC.]
90 day renewal is frequent enough in my book. It's not so often as to be easy to miss, but often enough that the person setting it up can witness the first renewal cycle (if they so choose, which in this case they apparently did not).
Is 5.2.2 safe? Just 5.6.0 and 5.6.1 are bad?
Helix's modal editing is based on Kakoune's modal editing which is like an evolution to Vim's modal editing. You can think of it as being always in selection (visual) mode. https://github.com/mawww/kakoune?tab=readme-ov-file#selectio...
I'd probably spend the effort adding ssl expiration to the monitoring system for all the certs in use. Trigger then a month/week whatever before they're due to expire.
Meta's oversight board urges Facebook, Instagram to lift ban on 'shaheed'
The Vercel IPv6 feature request & surrounding discussion makes for frustrating reading: https://github.com/orgs/vercel/discussions/47
> does the particular pile of trash generate any interesting discussion?

Then, trash created by a celebrity, is art?

Because knowing that that person did that ugly thing, generates discussions (like "wow what did s/he think!? Is that the best they can do?")
What do you mean by "If you're not launching dumb stuff"?
"...and you keep trying at some point something sticks" this part makes sense to me
Rust is more similar to C++, in that the compiler inserts calls to free as variables exit scope. Runtime reference counting is limited to those objects wrapped with Rc or Arc.

I agree with pron’s larger point. GC is fine for most applications. It’s just factually inaccurate to compare Rust’s memory management with languages like Python and PHP.
Use some software input fuzzer against it like SQL fuzzer etc.

Never trust your frontend data ever!

Always assume the attacker can talk to your API.

Don't do auth or login yourself. Use known libs, workflows asks.

Have unit tests to verify your endpoints need auth (valid user not just a anonymous user)
Yep. A few years ago I used my credentials in some in-house back-office app that a coworker wrote. Later I was able to see my http calls in the company-wide logging system, with my username and password 'hidden' in a jwt.
Yes, and from what I understand there was plenty of discussion and they carefully analyzed different options. The discussion seems to be is closed now.

I respect that, you cannot ponder these things forever and sometimes any decision is better than none. It's just that, unfortunately, my priorities are different from those of the Helix devs in that respect.
Assigning blame isn’t going to solve the problem.
AT&T confirms data for 73M customers leaked on hacker forum
We both got the downdoot simultaneously, someone didn't like our contributions. :^)
>20-30%

Your total guess is orders of magnitude off.

Most software today is in the ballpark of 10,000x slower than it should be.
Made a more detailed write-up on this: https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...
It looks like Locality of Behavior was a driving principle, one which I am completely on board with.

https://htmx.org/essays/locality-of-behaviour/

I tend to agree with the author that "Don't Repeat Yourself" and "Separation of Concerns" have their place but make understanding more difficult when taken to extremes. Sometimes clarity is worth a little repetition.
Below shows the shortsightedness of government programs. They decided almost 40 years ago that the technologies were "not remotely ready for use", and stopped working on them

Obviously we should have started anyway, and by now we'd be 40 years further along. But apparently they can only think in election cycles (quote from the Wikipedia article on Brilliant Pebbles)

> Teller and Wood initially proposed their own BMD system, Project Excalibur. This used an X-ray laser driven by a nuclear warhead that could attack dozens of ICBMs at once. In 1986, Excalibur failed several critical tests. Soon after, the American Physical Society published a report stating that none of the directed-energy weapons being studied by SDI were remotely ready for use.
Maintainers of Zitadel and Ory discuss their tradeoffs as identity platforms
I think you’re somewhere off base here. Yes, you understand React very well, but many don’t. And HTMX gives you a lot of leverage without needing to (1) deal with learning React, (2) deal with all the extra baggage that comes with it (oodles of extra complexity and code)
AT&T confirms data breach and resets customer passcodes
Semen microbiota are dramatically altered in men with abnormal sperm parameters
TLDR: a study of how the semen microbiome correlates to male fertility, and how concentrations of some types of bacteria in the microbiome are correlated with low sperm motility.
Sure :) (this is all publically available, fyi, no trade secrets here)

8 channel headband with individual gel packets for each electrode. You pop the gel packets and then you have wet electrodes!

The company is called Ceribell; Happy to answer more questions if you have them. We do not sell to individuals, but if you're in the research space, I'm happy to get in touch.
Yet, a point that tends to get lost when criticising GC languages, is that most of them have features for deterministic resource management, that many keep failing to learn.

- Some do have RAII

- Some do offer keywords

- Some do arena like management, lambdas with implicit management

- Some have a little help from the type system

- Some do a bit of everything listed above

Additionally, just like system developers have to rely on static analysers, the static analysers for those languages can also provide validation when something is forgotten, when the type system alone isn't enough.
What are you concerned about when using .NET?
It makes me wonder. Is it possible to develop a robust Open Source ecosystem without destroying the mental health of the contributors? Reading his posting really made me feel for him. There are exceedingly few people who are willing do dedicate themselves to developing critical system in the first place. Now there is the burden of extensively vetting every volunteer contributor who helps out. This does not seem sustainable. Perhaps users of open source need to contribute more resources/money to the software that makes their products possible.
Not sure if it's exactly what you're looking for but see this paper: https://ceur-ws.org/Vol-2785/paper9.pdf ( A Language for Timeline-based Planning )
about:preferences#privacy, scroll down a bit, it's under "Permissions". You can also adjust it when on the site, using the icon at the left of the URL bar.
Personally I wouldn't use base64 these days. Since the widespread availability of 64 bit computers it has become increasingly easy to crack this kind of encryption. I recommend using at least base256.
I thought you still need a sysadmin or whoever is needed to set up and maintain kubernetes.
My ideas are fleshed out just fine, you are being needlessly pedantic. Noone needs to enumerate every contingency to agree with a law passing or being enforced.

You live in a fantasy world.
That was mostly a joke. You know we're going to fix it properly, Nelson :)

(But super short term, yes.)
Use Roslyn analysis that errors when using is forgotten in an IDisposable type, for example.

By the way, in modern .NET, using makes use of structural typing. Any class or struct, with a Dispose() method can be referred to, no need to implement the interface, and can also be retrofitted via extension methods.
AT&T Says Personal Information from 73M Customers Leaked on the Dark Web
I've been intrigued by this approach. On a more highly optimized (but harder to program) take is the GA144[1] from Chuck Moore, the inventor of Forth. It's a grid of 144 F18 Forth based processors in a cartesian grid. These processors are far more limited, but then again they take far less power as well.

[1] https://www.greenarraychips.com/
Is an active search UI non-trivial?

https://htmx.org/examples/active-search/

How about infinite scroll?

https://htmx.org/examples/infinite-scroll/

Inline editing of a row in a table?

https://htmx.org/examples/edit-row/
What incentive would a tech company have to help with that?
Please open a bug at https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&comp... if that's the case, and CC padenot@mozilla.com, I'll have a look next week.
That man deserves a Nobel Prize
The evergreen: "Keep doing what you're doing, except better this time"
good for augmenting riot shields; crime suppression/police intelligence.

https://www.youtube.com/watch?v=qAriX1ebx3I [VIDEO]

https://www.amazon.com/Invisibility-Shield-Lenticular-Transp...
Agreed, it was a really nice read. Even simply in the role of an educator I've taken a liking to his blog posts. There is a certain combination of both breadth and depth that I've not found anywhere else. His overview of how LLMs work from last year was on of the first really good pieces describing them truly from first principles. And still shapes how I describe their workings to people outside of tech.
Suffice it to say neither their lack of IPv6 nor its importance to us was evenly understood throughout the company.
Type Inference Was a Mistake
I thought cloudfare would only cache web files like html and images and not actual files? This caused problems with some of their users as seen previously on HN

Or is that only with the free tier?
>The relationship with commercial vendors isn’t always healthy, but many major OSS projects are supported to a significant extent.

Almost always the so called "community" supporting a OSS project is an employee of a commercial vendor who is only interested as long as he is assigned to the project or task.

The solution is to have a full time owners and maintainers for all the critical projects and the government has to foot the bill. The govt can setup a division to identify such projects.
That's not how it works. You show me where in the Constitution the government is granted sovereignty over private reproductive choices.
An example that worried me was this Linux kernel bug [0], which in hindsight turned out to be a severe vulnerability, but didn't get a Debian-stable security update for three months. The vulnerability aspect wasn't obvious in the initial reports.

Is this common? Is it more common in software that has lower profile than the Linux kernel—software with fewer maintainers and fewer eyeballs, and fewer security-focused people flagging the right issues in the right ways to downstream?

[0] https://news.ycombinator.com/item?id=28926426
Web tooling on the browser side is amazing, but until relatively recently the build tooling was so bad I'd easily put it on par with C/C++. Not as bad mind you, since package management is better, but otherwise I'd rank both as from the same layer of hell and in the same ballpark in terms of suffering. The only thing that rose to the level of debugging webpack configs for me recently is debugging the build for a QT app that linked against non-system KDE libs.

Now if you know what you're doing it's much better now that everyone has converged on ES6 modules and with the latest generation of build tools like Vite, all you need to do is npm install some packages to provide zero-config support for frameworks like React, Svelte, etc. But it used to be so much worse.
In the US, you only send a physical copy to the LoC if you're registering a copyright so you can collect damages in the case of a copyright infringement. Not sure how common that is outside of maybe major publishers.
As contrasting experience, I did that (a simple math problem) on our contact form and it did NOT drop spam to zero; our spammers were too smart for that. Even an actual reCAPTCHA didn't completely eliminate it (although it mostly did, enough that it's fine for us).
Off-Topic: Most stories about politics, or crime, or sports, or celebrities, unless they're evidence of some interesting new phenomenon. Videos of pratfalls or disasters, or cute animal pictures. If they'd cover it on TV news, it's probably off-topic.
https://news.ycombinator.com/newsguidelines.html
So... you're complaining about what could happen in a Rust build if you include a library without examining that library first? How do you think that is different from doing the same in any other language?
In Windows it's still faster than anything else if you've copied an image to clipboard to open irfanview -> paste -> save, or to do a quick crop or whatever.
irfanview for images, vlc for videos, foobar for audio - so much better than anything bundled with windows since forever
Postgres has extensions to make HTTP requests, to write JS (etc) code, and so on. Check out Supabase, the goal is exactly this - use Postgres as your whole application layer, Supabase as the access point.
Windows was good for shareware developers because people had to buy utilities to like Irfanview to basically replace all the junk the OS shipped with. I eventually drop-kicked the whole OS and now life is good.
Handling a hotel booking call.

- Negotiates with the customer.
- Generates Payment link in realtime.
- Sends payment link to whatsapp
- Handles technical glitches.
Are there any resources going into detail about why the big players prefer JAX? I've heard this before but have never seen explanations of why/how this happened.