skysight-inc/HackerNews huggingface dataset:
It's probably the colors and button designs that really resemble the design of Mediafire and other download sites that are used for suspicious purposes?
That part I agree with - If Apple is willing to create an API, they shouldn't be allowed to use it anticompetitively. Apple is just going to have to learn how to cope with third-parties having access to their APIs.

Nothing is stopping Apple from creating a more secure runtime for iOS apps. They are doing it right now with MacOS; I haven't heard a single legitimate excuse as to why iOS is different. Apple could be (and frankly SHOULD be) building a comprehensive user-controlled security menu that even lets them protect against Apple themselves.
Been saying this the whole day now, GitHub really needs an automated diff / A/B check-up on tarballs against the actual repo, flag everything with at least a warning (+[insert additional scrutiny steps here]) when the tarball isn't matching the repo.
It's the modern day 1984 in action in our lifetime. Gaslighting by execs who are dumb as two bricks.
Thanks for your work!

First time hearing about hyperscript, was curious why a new DSL instead of just using JS:

https://hyperscript.org/docs/#history
The above post is somewhere between flat out wrong and malicious misinformation.

One can easily reinforce the pries of the bridge to ensure that any ship is deflected. The Francis Scott Key Bridge didn't implement these because it was deemed too expensive.
Definitely feel this way too. Sometimes I think to myself that it'd be really great to have an LLM give me a well researched report on say like, recent trends on undisclosed marketing online, wished that we supported that on Lumona, but realized that we'll have to do it eventually, but pretty tough with the current infrastructure
I need to access RDP servers, period. Web apps are not even a consideration in many environments.
I had the same reaction to Rothko. Doesn’t make sense until you experience it in person; the color and scale creates a totally different experience than what I was able to imagine looking at photos.
Map of US Foreign Assistance
It even cuts up to four carrots. Crazy. Shown here: https://youtu.be/xNE-NyaYBcg?si=j2nZpMCsmos_b2vB&t=1742
Apart from bringing the USSR to its financial knees you mean, thereby hastening its demise and with that ending (that phase of...?) the cold war?
The book Eccentric Orbits makes the point that the Iridium satellite constellation relies heavily on the basic technologies which were devloped, in some fledgling form, for SDI.

Specifically, communications satellites before that were as dumb as possible, the 'bent pipe' model -- whatever goes up on one frequency, comes down on another. The satellite neither knew nor cared about the payload. The majority of electronics were actually analog.

But with SDI, satellites had to communicate with each other. They had significant processing on-board. They made their own in-space mesh network, though that term wouldn't be used until later. They had to cope with possible loss of a satellite and keep the data flowing between the others.

That's exactly the fundamental concept behind Iridium and several more constellations since, Starlink perhaps most familiar to the most HN readers.

Motorola did a lot of the dev work for SDI, and after the project was scrapped, Motorola went on to build Iridium. Brooks argues in the book that the fundamental R&D for Iridium wouldn't have been practical without the groundwork laid, and paid for, by SDI.
Thoughts from writing an MVP tool to audit other OSS projects for backdoors
SourceForge offers hosting of git, mercurial, and svn repos. I found a compressed bundle of the latest KeePass source in a few seconds of clicking. Can you clarify?

Edit: or downvote, sure!
That makes it easier in some sense, you just have to convince Larry and Sergey.
Yes, the author doesn't seem to understand this is the problem:

> They need to move through that data quickly, without a lot of digging around in the interface.

Maybe, maybe not. Only the users can tell you what's important, and what metrics they want to improve.
Video by Alexei Navalny - "Putin's palace. The story of the world's biggest bribe"

https://www.youtube.com/watch?v=T_tFSWZXKN0

Also bear in mind that Putin has a record of killing or imprisoning people he regards as being insufficiently loyal.
A few infrastructure things:

- Serve traffic behind a load balancer that has a WAF

- Network segregation for database (separate subnets)

- Make sure you serve https and have a cert that’s valid. Redirect to https if http

- Restrict ports on LB

At some point later:

- Endpoint monitoring and threat detection

- VPC flow logging

- Execute backend as non root

- Dependency / artifact scanning

- Cloud SIEM to monitor common actions taken

- Make sure no hard coded creds. Ie, use role-base auth with cloud providers

- Reproducible infrastructure builds with infra as code

- Email domain protection

- Grab misspellings of domain names to prevent squatting
Burial of St. Lucy in Syracuse is interesting as the painting is displayed at the original place where it was commissioned, on the way of his hectic getaway. Ghastly, the context of the painting feels to be similar to the one you described.
Duplicate of this: https://news.ycombinator.com/item?id=39874404
XAMPP is on still on SourceForge, but I am not sure if it's still widely used.
I winced at this. I once got my finger caught in a zipper.
I also had a homebrew installed affected version.

I understand it's unlikely, but is there anything I can do to check if the backdoor was used? Also any other steps I should take after "brew upgrade"?
Also:

> Power users need the app to be efficient. Naive outsiders fret too much over æsthetics and the potential usability for newbies. In turn change does not work out for the better.

This is exactly the sort of naive guess the designer made in the first place. It was not known what power users wanted, clearly, and users of different products will have different needs. It assumes power users are the users the company wants to appeal to: Maybe they’re trying to make life easier for new users. There’s no “lesson about power users” here. There’s a “lesson to understand your users and your business needs.” I am a power user of all sorts of software that I sorely wish had a less cluttered and “more white space” or “more aesthetic” experience. This designer may not have been wrong in their choices in that situation despite designing for software with “power users.”

Design is a set of tools. You have to know what you’re trying to do before you start saying stuff like “screwdrivers are for newbs — when making things for power users only user chainsaws!”
Noob question: is it possible to run a small website in such a server? Something like a static blog?
I think this is a very good point. We've focused a lot on correctly matching reviews with products / brands, but haven't taken hard enough of a look at astroturfing.
Seems he got to build one eigenvector at least - the last photo in the article, the Tilted Arc. Across a public square, everyone needs to walk around the eigenvector. I had a reaction similar to that of the students

But beautiful small figures :-)
And get compromised again immediately after said roll-back?

Fast roll-back/restore is a useful feature for improving availability but does nothing to improve security.
In our Cyberpunk future, finger safety is optional. All limbs and body parts are optional replaceable addons and accessories for our Neuralink(TM) implants. /s
Ugh! I'm not too surprised to hear this. I deal with Shopify daily at work and once installed the Shop app to troubleshoot some problem we were seeing. I didn't get to the point of noticing what OP points out, but it immediately struck me as some kind of virus (not saying it's an actual "computer virus"!) -- it wants to take control of everything in regards to your interactions with Shopify stores, which is a huge amount of shops. I immediately uninstalled it... I think I made a clean break, maybe I'll never know.

The only way I'd ever install it again is if work buys me a separate phone and pays all costs associated with it.

(Now if I have to troubleshoot a Shop-related problem -- of which there are many, I'll say! -- I get someone else to do the "dirty work"...)
I am not in the position to judge myself, at least not yet, and I got bit last time when I tried Elm :D

By the book (hypermedia systems I mean) it seems very promising even for mid-sized or large organisations, I can see potentials to develop micro-frontends using the patterns, but I am not a frontend focused engineer at work, and I don't really trust my intuition (see the Elm reference above).

I am not waiting for anything, I am using htmx for my projects and I am indeed enjoying it, but the question in my OP still stands IMO.
>I managed to somehow disable the button that appears on the video without totally disabling the feature

Not too hard really. This seems to do it:

media.videocontrols.picture-in-picture.enabled -> true

media.videocontrols.picture-in-picture.video-toggle.enabled -> false

media.videocontrols.picture-in-picture.keyboard-controls.enabled -> true
To be fair, Media Matters has also gone after Facebook/Meta in their quest to suppress speech online, for example:

https://www.mediamatters.org/facebook/meta-still-allowing-mi...

The fact that we've heard about X and not about Meta appears to be a choice made by the rest of the media.
> increased tire wear, worse comfort, and worse mileage… Not to mention money

It literally means none of this to change a miata as I described - we are talking a single degree of camber here not a race car. An alignment is normal maintenance - no change in price - and tires stay the same price if you go up a single size, so if you do this when getting new tires anyway it costs essentially nothing.

It’s a minor camber change (done at a standard alignment as normal, no extra special bits - just ask tech nicely). The tires will last just as long for your driving style and gas mileage unaffected. Comfort unchanged - no spring, damper or tire pressure changes.

The point this all makes is simple factors beyond weight have a huge bearing on constant lateral load car will sustain, to the point it’s almost pointless to compare weight and max corner load. You will never see car enthusiasts comparing weights of their cars and arguing in favour of more weight, almost ever. This entire comparison is pretty odd. No one who knows what they are talking about is going to question the classic Colin Chapman quote because physics didn’t change since his death - the concept of same car but lighter was faster in the 60s and 70s, and is still faster round a circuit today. It’s why race cars set faster lap times as the fuel tank depletes, which proves the point beyond doubt.

If you haven’t had a good alignment done to your NA recently get it done and don’t be scared of small adjustments, they won’t ruin anything - it does quite the opposite! - and the numbers that work great for all miatas are insanely well documented online. Steering feel will thank you for it. It’s the first thing I will have done to any generation of miata - they all benefit a lot, and usually arrive from factory not very accurately setup at all - you will see this when you have first alignment done and brand new car has initial numbers all over the place.

I’ve owned and maintained multiple examples of all four generations of the car over the last 20 years - a precision alignment with a touch more camber/toe is one of the easiest, best and cheapest (100-150 dollars typically in major US city) things you can do to the car - the miata is all about that steering feel which is easily corrupted.
This feels like the exact opposite of the takeaway you should have. Old software isn't inherently more secure; you're missing thousands of security and bug fixes. Yes, this was bad, but look how quickly the community came together to catch it and fix it.

It only took 6 days for it to be found and fixed.
There isn't any evidence of corruption by Joe or Hunter Biden.

https://apnews.com/article/hunter-biden-fbi-informant-smirno...
I do a lot of different types of systems programming.

Only times I actually use GC is to manage resources other than memory.
You must be a software engineer to not understand that other engineering professions are actually professional. Which means that they have actual ethical standards which they must adhere to or have their credentials revoked.
Absolutely. Just don't expect it to handle massive traffic

edit: I'll concede my definition of "old" might be different. My current phone is a pixel 3 from 2018 and before that was an n900 from 2009.
I was talking about designers, specifically. But I have found that senior people on any I’ll are generally more capable of making considered choices. Not all, of course. And engineers definitely will bias towards tools they understand and have had good past experiences with. Again, to be “senior” at something means being aware of these biases and making reasoned choices despite them.
This is how I understand your position:

At core, it is about prioritization of strategies to facilitate mental health. In office work makes it easy to not explicitly or skip prioritizing socialization because its already there, for the most part. Without that prioritization, it can be easy to become undisciplined in maintaining those strategies for mental health

Been there a few times. For me, I love biking and trail riding. Its two wheel therapy for me, particularly on trails because you do need to pay attention. If your mind starts wandering, you'll be ejected over the bars real quick.

And there's hobbies that you can do outside of work, if its a priority for you. But like physical fitness, that's self-driven, and really easy to slack off and lose gains if you don't keep up with it.

But if you take into account the implied requirements for in-office work, that means time lost in commute, and needing to sync travel plans, vehicles, etc. that's the problem I have with blind mandates, they often are benefiting the person making those decisions, regardless of the people who need to implement and execute projects and goals.
This scenario has almost nothing to do with a scenario that includes armed law enforcement.
> the same things would also happen if I were at my desk and you were off talking somewhere.

Nobody claimed otherwise. The point here is they wouldn't happen when not "off talking somewhere". Like, you know, when there are more than 2 people grabbing coffee/lunch.

> How would you get me into the conversation?

This is indeed no different than when everyone is at the office and you decline to grab lunch with the rest of your team. You miss out in a similar fashion. And just like how nobody is going to replay the entire conversation to you over Slack and restart it at every juncture, nobody is going to do that for you in person... that's just how humans are. The fact that you are capable of missing out in-person in a similar fashion is not an argument for anything.
Just because he's a hypocrite, doesn't mean we should censor more.
Functional Terminal User Interface
I’m neither an engineer nor an architect, so this may come off as incredibly naive, but why wouldn’t layers of reinforcement — eg a retaining wall or guardrail — some distance out and around the main pillars help mitigate this kind of risk?
Another benefit: modern smartphones have large GPUs, large media blocks, and fast RAM.

With the right software, they can be a surprisingly powerful AI host or transcoding server.
I believe I got my original GitHub invite from another HN user, back in the days when it was still invite-only. I confess at the time I didn't really "get it", despite having played with Darcs and the like prior to this.

But (in retrospect), I don't think it's really that complicated. SourceForge, back in the day, had a really atrocious UI. As a highschooler navigating CVS and SVN repos for the first time, it was really difficult to figure out how to even download source code (this was especially horrific with CVS on Windows), let alone contribute in any meaningful way. Discussion on these sites required you to sign up for a mailing list. I think Gmail was just barely a thing, but prior to that as a student I would have been stuck with some awful Hotmail account or similar. Anyway, the hurdles were high and therefore this selected for "serious" contributions (or people willing to put up with a lot of obstacles). SourceForge may have supported some sort of bug tracker, but I don't remember ever interacting with a project that used it, so in practice people were splitting their various components (code, mailing lists, bug tracker) between several different sites.

Ignore Git for a minute. GitHub, if nothing else, had a really slick UI. That UI put code front and center, so it was (finally!) obvious what sort of project you were actually looking at. I think it can't be underestimated how much this uniformity makes code easier to browse, as compared to the vast gulf in difference in quality between the best and worse homepages of open source projects prior to this.

For fun, here's one that I authored back in the day. The home page here is actually kind of informative, but you can see how if this is all you get, the results are going to be all over the place:

https://ip-interfaces.common-lisp.dev/

Beyond this, GitHub offered a permissionless collaboration. In the bad old days of open source, I could clone a repository, and I could write patches, but the cost of setting up forks was prohibitive. This is one of the things I didn't "get" at the time, but GitHub made it practically (and socially) acceptable to just fork whatever you needed, change something, and submit it. Or not, it didn't matter. Whether you intended for your experiments to be useful to anyone else or not, it dramatically lowered the cost of starting and maintaining those experiments. And that I think dramatically changed the face of open source software (for the better).
> $90 for 8GB RAM, 128GB storage, 2.8GHz 8-core CPU

Just struck me this is double the spec compared to the “servers” I was planning to rent on AWS…
A 192-year heatmap of presidential elections with a Hilbert-like y axis (2016)
That's how I remember it too, with the additions that they also did a bunch of additional shit like show early-stage surveillance ads, and sign you up for unwanted mail lists by default, and more, but all less-awful than the installation of unwanted spamware).

My dad runs his company accounting on GnuCash, and I sometimes help him set up a computer, and it is always startling that SourceForge even exists. (It's still the official download[1].)

[1]: https://sourceforge.net/projects/gnucash/

P.S. I think you meant "death knell" but it's all good, we all understood. :)
The bundling thing happened after Sourceforge was already well in decline, 2013, which was five years after GitHub launched. Google Code shutdown was announced 2015. IIRC Sourceforge was becoming less relevant because it hadn’t introduced git support, and GitHub answered that demand. By the time it added it, it was too late.

Bundling adware with software was not the death knell for Sourceforge, it was a death rattle - though the corpse is livelier than I’d have thought ten-plus years later.
the US Realtors settlement is already changing the way some buy and sell homes
> And isn't the whole point of being a judge that you're impartial, are they subtly alleging the court is partial to whatever laws are made by one of the two major parties or something?

Federal appellate judges are typically appointed due to their association with one of the two parties and often because they have a history of rulings favoring a certain party’s ideology in lower federal or state courts. They are officially impartial but everyone working within the system recognizes there’s tilts, and the media does too. A clear example of this is that they typically time their retirement so the party that originally appointed them can replace them.

I believe in some other countries the judiciary appoints their own replacements and in that case the ideology / politics of the judicial branch may diverge more from the legislative political parties.
It should also include the households where the people worked in union shops that went out of business. Tesla, a non-union shop, makes the best selling car now. The union places in Detroit can't sell electric vehicles period.

Or consider the "wealth" of the people in Hollywood who are pretty much out of work because most of the production has stopped during the various strikes. Their savings are evaporating because one union after another wants to strike.
I would describe that article as more of a call-to-action than drumming up fear. The article is quite clear that the problem in this particular case was due to design. On top of that, there was no suggestion that it was a faulty design. Rather, it's design does not reflect the realities of today.

I am not suggesting the article is perfect. There are lingering questions about which types of bridges fit in that 7.5%. Not all bridges have to deal with shipping traffic, heavier vehicles, or even more traffic. There are also questions as to why such large ships were permitted to pass under the bridge if it did not fit the design parameters of the bridge. But that is more indicative of an incomplete analysis rather than of fear mongering.
Or Tesla engineers do have engineering degrees, but Tesla management pared down the list of requirements.

I'm not a close follower of Elon Musk, but apparently he believes in aggressively trimming requirements. According to this, at least: https://mondaynote.com/what-makes-elon-musk-move-so-fast-8e7...
The article says, "However, Peer noted Section 6 states health risks should be weighed “without consideration of costs or other non-risk factors”."

Peer is not the court, it's a non-profit involved in the litigation. You can read the opinion, and the court doesn't tell the EPA to use section 6, just that they can't use section 5: https://www.ca5.uscourts.gov/opinions/pub/23/23-60620-CV0.pd...
There's no risk of pinching—the panel gaps will spare your fingers.
Script compatibility is another factor.

e2fsprogs is already comprehensive of 2, 3, and 4 versions: <https://sourceforge.net/projects/e2fsprogs/>
Incidentally I’ve written about this before [^1].

Basically, the sitting president appoints circuit judges to a lifetime position. The judicial candidates are selected by senators from whichever state the judge is to be appointed.

Generally, a conservative president will only nominate conservative judges. The candidates will generally be even more conservative if the senators who nominated the candidates are also conservative.

Over time, court watchers can conclude how ideologically predisposed a judge is based on their opinions. Usually, judges appointed by conservative presidents tend to rule as conservatives (that is, side with Republican positions), and vice versa with judges appointed by democrats. This trend is so consistent that you can often predict the outcome of a case from the composition of judges hearing the case.

The Fifth Circuit is dominated by republican senators and has recently seen a lot of appointments filled by Donald Trump. As a result, the Fifth Circuit overwhelmingly rules more conservatively than its sister circuits.

In this case, the fifth circuit panel ruled against the EPA in favor of commercial plastic producers. This is in line with Republican goals to erode the power of administrative agencies. Nobody is surprised by this because the Fifth Circuit operates in service of the Republican Party. As we say, you don’t bite the hand that feeds you.

[1]: https://news.ycombinator.com/item?id=25473858
Nice links. Thanks for posting these.
Does anyone know if it supports ethernet when plugged in to a generic USB-C dock?

This seems like it would be a huge step up from the raspberry pi 3 I'm using for home assistant!