skysight-inc/HackerNews huggingface dataset:
You can compile a jar to include all dependencies (like statically compiling C code), then you can just run `java -jar myprogram.jar` and it will work as long as the Java runtime is the same major version or newer than the version you compiled for.
The idea of unnecessarily replacing nanosecond scale function calls with network communication that is five orders of magnitudes slower makes me shiver. Yeah, you can make a microservice that does one thing with a well-defined API and it's nice and clean. But you might as well make a module that does one thing with a well-defined API, and it will be so much faster because it's right there in memory with you.
Maybe it's time to move away from xz which has been criticized in the past as a not great format, has had maintainer issues for years, and now turns out to be infiltrated with security problems.
Moving to zstd seems worthwhile.
Tools in article:

- DryMerge
- Bardeen
- Zapier Central
I played with it, meanwhile, and it's not really 'it'. E.g. settings gives me 4 different options, all doing different things.

emacs and vscode treat this function as a primary entry to the functionality, and have tuned the names and namespacing to this kind of usage. E.g. vscode has micropython:configure project.

This is a search function for the existing gui with reuse of existing names. As the surrounding context is lost, it is hard to say what a name means.
It might be possible to do through the API, but there is no documentation available on what you need to do. There are only PowerShell examples, which you could look into and try to replicate on your own using the API.

The shit part about this:
- Can't do it through the Azure Portal
- Can't do it through Terraform
- Docs only give you PowerShell examples
- Docs don't explain you WHY you need to do this, they just expect you to suck it up
- Why is Application Gateway only supporting user-managed identities and not system-assigned identities for this feature?

Sorry, I don't really care about which part of the Azure ecosystem is at fault here. It's a shitty experience.
One interesting detail is that Mazda never designed a wankel after the 90s. They have claimed since then that computer design and simulation has allowed for dramatic performance gains.
xz is not worth using at medium levels. At its highest levels, it sometimes just barely has an edge over the highest levels of zstd, and it existed before zstd did.

These days, zstd is the obvious choice.
I might be a tool, but I certainly don’t make any mega bucks from anything ad or social at all, I left FB in 2018.

I did have a few extremely high-earning years (I think I broke 7 figures twice). And there’s a meme that I sort of partied it away or something (and in fairness, as a guy who grew up in the kinds of neighborhoods and houses sufficiently marginal that at 100x the legal limit for OSHA on factory workers, pediatric led poisoning probably wiped like, half my IQ off the board. I was lucky, I was just licking my fingers after touching walls, my brothers were young enough to be eating lead paint chips off the floor, so they had like 10x that, with that kind of background I went down one of the two routes poor kids go down after catching some cash and I blew easily a few hundred grand if not half a mill on pure conspicuous consumption. Easier than my kid brother, easily the greater natural talent, he drowned himself in a bathtub a couple years ago).

But most of it went to the 52.2% combined state and federal income tax that I told my CPA not to optimize at all. A modest but non-trivial amount went to a reasonable settlement around a failed marriage, and the lion’s share by far, like north of 75-80% went to misguided “support” of insolvent friends and family. My grandmother (may she rest) was a widow of an active duty US Navy submarine sonar operator in the Korean War, the mother of an active-duty Sidewinder tech on the USS Nimitz who saw action in Gulf One, and the country threw her to the wolves with like, 800 bucks a month in pension in San Diego (where I grew up, hence all the military stuff) that didn’t cover so much as rent: my grandfather’s deathbed request was that she would want for nothing, and she wanted for nothing. And really no one around me did.

Which makes me more than a little annoyed that people I’ve defended and continue to defend on e.g. HN like Bosworth or someone make shit up and spread it around, like that I got fired in 2018, and not quit in disgust at the cost of what would have been in today’s market like 7-12 million in RSUs. I gave 60 days notice and they asked for 90, I have this in writing. I increased Instagram’s revenue in 2017 personally by 10%, so, I don’t know, like well over a hundred billion by now and I’d done bigger launches. Seemed a pretty shitty send off, but this is the NFL, I get it.

I’m a pugnacious late-bloomer who would be at CERN if I had slightly different starting conditions and went into debt last year to KLA after the Nth round of coordinated wage fixing.

I appreciate that’s a bit of a biography, but it was a bit out of line with the Will Hunting thing about stepping outside. I felt I should explain myself.
Using TablePlus and I would wager it's not the SEO but the quality of the tool.
Something like 300-400 API requests per second is not a heavy load for any reasonably designed API. Something like 300-400 static files requests per seconds is less than peanuts.
zstd has a long-range mode, and is far more widely used.
Tell HN: I have so much to say, but no one is interested
Deleted.

Thank you to the people with thoughtful responses.

To the rest, you disappoint me.
I got fit after 40 and my fitness level keeps increasing now that I'm nearing 50, endurance sports are now part of my life.

Me ! The obese slob on a bunch of pills for heart and kidney conditions and getting ready to die.
All it took was to
accidentally meet the person who showed me the way.

After dozens of mountain peaks climbed, thousands of km ridden on the bike and buckets of sweat left in yoga classes, I now look like a model and I have women's eyes on me each time I look around. The most beautiful too, because they know what it takes.

Radical change is possible and from what I've seen, some people just take a bit longer to wake up to their true potential.

Believing that you have what it takes is all it takes :).
Bank of America supports user purchased TOTP devices.

https://www.bankofamerica.com/security-center/online-mobile-...
I generally agree, but:

>99.99% of the time a DoS is someone who is bored. Talking to them tends to work.

This is an overstatement. A great number are extortionists or state sponsored attackers. They're not interested in chit chat, except if it's to negotiate a price to stop the flood. Particularly not the ones commanding resources which are sufficient enough to make a dent in the operations of a substantial commercial entity.
> appears to have a Chinese name

Given the complexity of the attack, I'd assume the name is fake.
The thing is there are two possibilities:

1. An important project has an overburdened / burnt out maintainer, and that project is taken over by a persona who appears to help kindly, but is part of a campaign of a state actor.

2. A state actor is involved in setting up such a project from the start.

The first possibility is not only being an asshole to the original maintainer, but it is also more risky - that original maintainer surely feels responsible for his creation and could ring alarm bells. This is not unlikely because he knows the code. And alarm bells is something that state actors do not like.

The second possibility has the risk of the project not being successful, which would mean a serious investment in resources to fail. But that could be countered by having competent people working on that. And in that case, you don't have any real persons,just account names.

What happened here? I don't know.
Also those requests for the 200MB setup aren't even hitting your servers unless you have disabled caching for some reason, not that it'd be that hard to serve it directly.
They also require JavaScript to work unfortunately.
> the other actually wanted to chat and we emailed back and forward a bit

That sounds like a fascinating story. What did they want to chat about?
This rings a lot more true for me as well: a lot of the overly complicated decisions I've made haven't been because I wanted to try something interesting out (although occasionally it's been a factor), but more because I've ended up backed into a corner by previous decisions, factors outside my control, and limited time. Even when the simpler solution is obvious (which isn't always the case), it often takes a more complicated journey to get there. And balancing short term vs long term complexity is a challenge in its own right.
I don't think phishing is such an obscure scenario.

The point is also that you as an individual can make choices and assess risk. As a large service provider, you will always have people who reuse passwords, store them unencrypted, fall for phishing, etc. There is a percentage of users that will get their account compromised because of bad password handling which will cost you, and by enforcing MFA you can decrease that percentage, and if you mandate yubikeys or something similar the percentage will go to zero.
KeepassXC is working on supporting them natively in software, so you would not need to trust big tech companies, unless you are logging into a service that requires attestation to be enabled.
I plan to teach my I kids category theory as a condition of getting access to technology

Solve the problems in one chapter of mac lane, and as a reward, you get to read the next chapter of mac lane. Rinse and repeat, and you get a smartphone, laptop, and a military surplus drone with an anti tank laser! And I get an award for Best dad ever!

It's the perfect scam - once they know categories and drone warfare, they can intuitively transcend any technology or conflict!
This is just a static marketing site for a desktop app. They don’t even have a discussion forum — feedback is handled by GitHub issues. Bragging about how simple their deployment is for a static marketing site and how it’s able to handle a static file being downloaded millions of times a day is super weird. And Cloudflare is doing all the mitigation work here (if that’s even needed for such a puny amount of traffic), not them.

If I were to be hit by such an "attack" myself I probably wouldn't even notice until Cloudflare sends me that monthly "X TB of data transferred, something close to 100% bandwidth saved" email.

I like the app btw, can recommend.
How did you deal with these three customers, if that's not a secret?

RE: your tidbit on "don't threaten bad actors with good time", I disagree. If you can brag and demonstrate that their fleet of 10k machines can't touch a single service of yours and can't even make it pause then I'd say that sends pretty strong message to other potential bad actors.

Those bad actors have to be discouraged. I would get a very nice ego trip if I knew I can show the finger to a state actor, metaphorically speaking. But again, they should get the message that they are not as dangerous as they think they are.

Though I agree with other commenters that this traffic didn't seem as scary as the last 2-3 recorded attacks going through Cloudflare.
If you run around with your hands in your pockets, you'll have another problem soon.

No, gestures are just not good enough. I can make gestures on my already existing device.
Typing in the air feels just as bad as talking to your glasses.

It won't sell.
TLS Client Certs (aka mTLS) is an option for that, but the browser UI stuff for it is terrible and getting worse.
On paper a global 1 Ω power grid is only $265 billion of aluminium / 1.7 years of current global production.

I don't actually expect the whole world to do this because politics, but I won't be surprised if China makes a proof of concept in the form of a 100 Ω connection to both Africa and South America.

As for iron/steel specifically, I think people have only recently demonstrated that this can be electrified at scale, even without batteries.

Battery capacity is also in the early stages yet; what we need for fully electric transportation — which is probably around a decade of exponential growth away — is more than enough for balancing current (no pun intended) electrical demand, but I don't know if it's also enough once we electrify steel.

I think iron might be one of the cases where it makes sense to electrolyse hydrogen from water and use that as a direct chemical agent, but my chemistry knowledge is a mediocre GCSE from 24 years ago plus YouTube videos so I don't trust my own judgement on this regardless of what Wittgenstein says about 'to believe falsely' in the first person, present indicative.
> I suppose Figma might just be beyond the "let's find the fastest/cheapest way to get this working" point.

The article implies otherwise. E.g. it quotes Figma saying: “Given our very aggressive growth rate, we had only months of runway remaining.”
This kind of proposal is one I hadn't ever really considered. I would be fascinated to know if others here have had similar experiences when seeking contact with malicious attackers.
I’m not sure if there’s a been a study done, but it’s interesting to see some potential solutions to the intermittency problem and how close they’d get the world to a completely green grid.

Orientating solar panels differently than simply south facing to better match usage patterns: https://youtu.be/LqizLQDi9BM?si=4uqsRO3qEGfm4Yxr

Building out a “supergrid”, like what’s already happening across Europe. Balance intermittent supply across a wide geographical area. There’s always wind blowing somewhere, Iceland has massive, 24/7 geothermal that’s not yet connected to mainland Europe, Southern Europe has huge solar potential, and so on. The UK has a project to get 8% of its electric demand from a massive solar/wind/battery project built in Morocco linked via undersea cable to the UK.

Finally, batteries. Lifepo4 batteries are constantly dropping in price. We haven’t seen a huge deployment of Chinese sodium ion batteries for homes yet, but it’s coming.

And that’s not touching on some of the other possible solutions.
Blasting a site but sending no communication offering to make it stop doesn't sound like an extortionist.
Passkeys do have the option of attestation, but the way Apple at least do them means Apple users won't have attestation, so most services won't require attestation.
Feeding the trolls might be the worst idea in the world but it's certainly the best way to harden your infrastructure through extreme real-world testing :)
This is clearly a sly reference to an exclusionary in-joke, which makes it an in-joke itself, and thus also exclusionary.

Needless to say, I'm still offended. And I think we can all agree that no one should ever be offended.
KasmVNC – WASM Based VNC Server and Client
I agree that businesses that have unproductive assets become targets for PE takeover. Typically these are small businesses that have kept their assets and business together, without separating them. At some point the value of the asset exceeds the value of the business and it becomes ripe to be bought out, sold for parts, and closed.

Thus keeping them bound together makes things worse for employees and customers, not better.

Separating them makes it worse for creditors. Specifically creditors are less likely to institute bankruptcy if there are no juicy assets to liquidate. Most small businesses can survive a cash squeeze, at least for a short while, as long as creditors don't preemptively move to shut it down.

Equally, business owners are less tempted to over-extend if there is less "equity in the business". Obviously they can still borrow against the asset, but that's then a conscious decision.

Of course large companies know all this, and do it. Yhe way to protect small businesses from predatory buyouts or creditors is to educate small business owners.
If you are using pass to store those, check out pass-otp and browserpass, since GitHub still allows TOTP for MFA. pass-otp is based on oathtool, so you can do it more manually too if you don't use pass.
Dangerous enough to cause partial meltdown if they hit fissile material.

In theory hitting nukes with energetic neutrino ray would be enough to disarm them. By melting fissile material under normal circumstances.
I dunno; that sounds very hypothetical. Do you have a more specific example? I don't see why I'd be unhappy about, eg, working with a group of nurses with a fireman calendar in the lunch room [0]. Even though it is unprofessional, since that is active sexualisation, this is just a girl with a pretty face.

Very attractive people of both the equivalent and opposite gender exist. I can't speak to your instincts and interpretations, but objectively they are not a threat to my emotions.

[0] https://www.australianfirefighterscalendar.com/
I would think a Chinese state hacker would not assume a Chinese name, just in case he was discovered like now.
You'd have to be utterly incompetent to make a self-configured VPS have more attack surface.

I have a FreeBSD server, three open ports: SSH with cert-login only, and http/https that go to nginx. No extra ports or pages for potentially vulnerable config tools.
> don't find a blog or book would suit my needs. I feel I need a one-to-one with someone

How about recording podcasts?
On my car it works from behind other cars as well. There's a tree lined road near me, drive behind someone at night and there's a dark box around them, with the the trees being fully lit up.

And it also works with over-reflective road signs, they too get a dark box.
Courtesy of Brown Beaches, LLC :D
not really that interesting of a post. billions of requests per month is like low hundreds of requests per second. billion is a big number but so is a month when it comes to request throughput. all the grandstanding about monolith... for something that serves 2-3 requests per second, and is a static marketing site... this is so overblown.
However, this particular attack only works through libsystemd to compromise sshd and it is related to systemd's kitchen sink "design".
"At least in the past when we were cavemen, some member of the tribe would get mauled by a wild animal and the rest of the tribe would take note not to fuck around with those animals"

Yes they learned, but also most tribes would have taken pride in hunting that animal down. At least that was (and is) the case with indigenous tribes where we have detail knowldege. So the animals learned to stay away from the humans (to some extent).

But yes, we advanced a little bit, so we do have other options. The finns seem to do way better in this regard, than rumania. About the reasons why they do better, I lack detail knowledge.

"Especially when you see dumbfucks in Romania film themselves pulling over and get out of their cars so they can get close to bears to feed them biscuits and pet them as if they're stray cats/dogs"

But if this behavior is widespread, then yeah, this would be certainly a reason. And stray dogs can be quite dangerous as well btw.
The malware was hidden inside an opaque binary. If anything, this shows that we need more open source and more reproducibility.
I can buy your comment as an interesting and even credible hypothesis, but the absolutes which you deal in (“doesn’t pass even the most basic sniff test”) are damning. You are clearly lacking huge amounts of information and context and are passing your own assumptions as hard facts.

Also, I’m assuming Amazon or Google will sometimes roll their own solutions on problems of a scale in the same ballpark as Figma’s.

But anyhow, what’s the scale at which this becomes acceptable, exactly? Is there a magical number which serves as a universal threshold? Or is there - like in all engineering decisions - a very concrete economic case for which you and I both lack a lot of the requisite context and inputs?
Just pack up your whatever-else as an AppImage. Job done.
> “The law does not recognise such rights, nor does the law impose a duty on South West Water.”

Disgusting.

I'd like to see that reframed in some similes: I have no legal obligation to save this person in quicksand, so I walked on by _because I am a cunt_.
Considering the vast majority of exploits are at the application level (SQLi, XSS, etc), putting barriers between your various applications is a good thing to do. Sure, you could run 10 apps on 10+ VMs, but it's not cost efficient, and then you just have more servers to manage. If the choice is between run 10 "bare metal" apps on 1 VM or run 10 containers on 1 VM, I'll pick containers every time.

At that point, why are we making a distinction when we do run 1 app on one VM? Sure, containers have some overhead, but not enough for it to be a major concern for most apps, especially if you need more than 1 VM for the app anyway (horizontal scaling). The major attack vector added by containers is the possibility of container breakout, which is very real. But if you run that 1 app outside the container on that host, they don't have to break out of the container when they get RCE.
I doubt that people with established careers in top executive positions can't lead unless they read an article on someone having done that already.
What this has to do with AI?
It's worth noting that if each electrode is thin enough to be placed in extracellular medium getting signals from several neurons around it, you can do some fairly simple signal processing to separate the signals of individual neurons. This is called spike sorting [0] (a "spike" is an impulse transmitted by a single neuron).

So, continuing with the microphone analogy, with the right setup, recording a few voices is almost as good as recording each voice separately. It's not perfect because sometimes people talk over each other, and people distant from the mic may have muffed voices, and stuff like that. But generally speaking, we can roughly understand each individual people in a recording, because each people speak in a different way (and just like that, neurons spike in a different way).

Here's some academic code that does this [1] (it has accompanying articles [2] [3]) (Random article found in Google, no affiliation).

The first thing it does is removing the low frequency component of the signal (the LFP [4], that doesn't originate from any specific neuron), then it stores each individual spike waveform as a time series (a vector of N dimensions, where each dimension is the value of the signal at a moment in time), and then just does some k-means clustering to separate spikes in clusters, then assign each cluster to an individual neuron (by hypothesizing that each neuron likes to spike in a specific way which depends on its characteristics). This is all very vanilla / undergraduate stuff, and it's been done for more than 10 years [5] or perhaps even 20 years or more.

Trouble is, with EEG all you have is essentially an average of the LFP over a large area; you don't get single-neuron spikes. So EEG fundamentally can't listen to each neuron individually. However it isn't right to simply throw away LFP information, and you can still do stuff with it.

[0] http://www.scholarpedia.org/article/Spike_sorting

[1] https://github.com/akcarsten/spike_sorting

[2] https://towardsdatascience.com/using-signal-processing-to-ex...

[3] https://towardsdatascience.com/whos-talking-using-k-means-cl...

[4] https://en.wikipedia.org/wiki/Local_field_potential

[5] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3657693/
Auto-dim rear view mirrors have been around for ages.