skysight-inc/HackerNews huggingface dataset:
> consider the alternative, not doing it....Let the temperature rise so fast...

Sounds like the obvious choice...but can you put some numbers to it?

1. How much C02 do we need to take out of the air to prevent your doomsday scenario,

2. How fast do we need to take it out of the air?

3. How much energy would it take to do that?

4. What are the side effects of generating that much energy, and expending it according to the timeframe of #2?

HellifIknow the answers, but I can do a bit of Fermi-style estimation, and no matter what numbers I plug in, it just doesn't make any sense.

Depending upon the answer to #2, we might not even be able to:
1. convert 100% of our energy generation to carbon-neutral sources,
2. Install 2.5-3x (depending upon how efficient carbon capture can become) the amount of power generating capacity we already have--again, all from carbon neutral sites
3. And then start extracting C02 out of the atmosphere at the same rate we put it in.

#1 alone seems like it will take decades, to say the least. #2 says that doing #1 is going to be 2.5-3x harder. We will have to not only supply our current power budget, but also the energy needed to power these global scrubbers.

And is the rate in #3 even enough?

> Animals and plants have fairly narrow bands of acceptable temperature and don’t have air conditioning.

Yeah, unless I'm very mistaken, they are screwed. It might not even be physically possible to do steps #1 through #3 in time to save them.
Most people look at images via browser these days.
That’s the “Preview pane” in explorer. It only supports the file types you could preview in explorer, it only “opens” the file currently selected in Explorer, and didn’t let you zoom in or inspect the image in any way that I recall. It was a plain preview that was supported (in ME) by the integrations Explorer had with Internet Explorer, I believe. Often installing IrfanView let you preview more file types in Explorer, and you could open more than one, display them full screen, edit them, resize them, and more…
If cache usage is that major of a concern, arena allocation works just as well as it does with manual memory allocation. Thankfully there aren't too many areas where garbage collection has to compete with such conveniently contrived examples.
> basic features like toggling block comments

Whether this is a basic feature depends on the languages you're using, I'm pretty sure I haven't toggled a block comment in 10+ years. Some languages don't even have them (Zig), others do but you are encouraged not to use them (Rust) and some only have those e.g. OCaml.
But in this example, many of the programmers know the alternative (i.e they learned c++, java etc) and still prefer something else...
I’m sincerely in awe at the cleverness of this bit of snark.
Those typically require custom client side code, for a website you have the requirement that a web browser must be able to connect to it using TLS. Or maybe I'm not getting what your suggestion is - Access is supposed to intercept the connection and display a custom authentication page, with requests not reaching your server at all until they are actually authenticated.
A reminder for anyone who hasn’t already done it, freeze your credit at all 3 credit agencies. Only unfreeze the 1 you need for the time period it needs to be unfrozen for, if applying for new credit. This should stop most identity theft related to the SSN leak.

This should be standard practice for everyone after the Equifax breach several years ago.

Of course if someone can take control of a person’s phone number, that’s essentially a new form of identity theft now that 2FA has turned our phones into our identity, whether we asked for it or not.
I had no idea it could do this.

I want to vote with my dollars so that more research and productization happens. This should continue to get lots of dollars.

Imagine if this market keeps growing and research keeps happening.

I would have loved to have had this as a kid.
A self hosted virtual browser that runs in Docker
I think this article makes some really valid points. Many languages try to address the spooky action at a distance type errors by requiring explicit annotation of types at certain boundary type conditions like function argument and return arguments -- which can help but can still also being annoying when the type system knows the types you want to write but you still have to figure them out and type them in yourself. A lot of times it's less cognitive load to verify that a type declaration is what you expect than it is to write it yourself (something we often do with tools like rust-analyzer or highlighting over variables in ide to see the type).

Personally I'd like to see languages embrace "format on save" as an explicit part of language ui to improve ergonomics here. Firstly, a first class auto formatting tool is just great and spamming cmd-s as you write code until it auto formats nicely is a really quick way to observe and address syntax issues -- to me that part of the experience is already important enough to explicitly incorporate making that developer experience work well a goal of language design.

But secondly -- if you do embrace auto format on save at language design level, there's a lot more you can do than just auto format the code! You also gain a really nice channel for communicating information about "program change" to the developer. Say you allow in the language to differentiate between inferred and not inferred types -- and then at auto format time, the inferred types are explicitly added to the code (in some heuristically useful set of places-- or even just everywhere that a non type inferenced language would require explicit types).

In that world, as you make changes to the code, your git diff state is going to start giving you a lot of potentially useful feedback about what actually happens in your program when you make certain changes. Additionally because the inferred types are automatically added -- you can easily have a mode to hide them when you want a less noisy view. Mayb the convention would become that committeed code is always serialized to a form that conveys more of the statically knowable program information by default -- which your ide can hide to give you a more streamlined view -- rather than the other way around). And then the parts of your code you know are boundaries or apis or not expected to change types, you just update the annotation to indicate that the type is not supposed to be reinferred and a type error will be issued if it doesn't match instead of being updated. Now you've got a nice way of constraining program evolution in desired directions to help tame complexity or at least force explicit acknowledgement as certain assumptions about the program structure become invalid over time ...
A WASM setup should completely sandbox the plugin so even with malicious code, it would not have access to anything sensitive.
Yes and no, we still run the tests against PG but it's done in CI instead of locally.
mb needs a 2015 tag?
Show HN: FaceLandmarks – ARKit Face Mesh Vertex Tool
Hey everyone. FaceLandmarks.com is a little project I put together last weekend, while working with Apple's ARKit for iOS face tracking.

For those not familiar, since iOS 11 and A9 processor was released, all iPhones (i.e. iPhone 6s and newer) support augmented reality capabilities.

When tracking a face using the front camera and the ARKit framework, a face mesh is generated using exactly 1,220 vertices that are mapped to specific points on the face. These vertices are accessible through ARFaceGeometry, ARFaceAnchor, and ARSCNFaceGeometry within ARKit, and provide a foundation for developers to do facial tracking for common use cases like: social media filters, accessibility, avatars, virtual try on, etc.

While the ARKit's tech is impressive and has a smooth DX, the most frustrating part for me was identifying the vertex indexes for specific points on the face mesh model. Apple does not provide a comprehensive mapping of these vertices, besides a handful of major face landmarks. Vertex 0 is on the center upper lip, for example, but there is seemingly little rhyme or reason for the vertex mapping.

While devs could download the vertex mapping, open up with a 3d rendering software, and identify vertex indexes (which is what I originally did), I decided to make a simple web app which simplifies this process.

FaceLandmarks.com uses Three.js to render a model of the face mesh, with clickable vertices so you can zoom, pan, and easily identify its vertex. In the future, I hope to continue adding semantic labels for each vertex (there are about 2 dozen so far) for searchability.

It was a fun afternoon project and hope it may be helpful to others in this niche case. Enjoy!
“The core thesis has always been to take the mundane and make it magical.”

I'll cross my fingers, but trusting a contacts managing app and allowing that risk should at least be a trade off for cool new tech. It seems like she wants a tiny Google-esque suite of products.
Isn't the second example representative of all tech debt / neglect ever? If so, it's very common.
Is there an easy way to check if you're in the data set?
For me it’s because I haven’t run Windows for ages
The eta reduction code hint is a weird one for sure, although let's be real with Haskell naming conventions that usually means dropping an 'x'.

If the linter cares so much about making code point-free maybe they should start suggesting refactors like

foo x = bar x (baz x)

to

foo = bar <*> baz

(... /s)
“You don't have to write any JS.”

But you can, if you want.
Or alternatively, do you want faster training runs (and thus lower training costs)? Then JAX is a good choice for you.
Over 20,000 backdoored NPM, PyPI, and Go packages detected by Socket
Yeah, it's less about detecting backdoors specifically and more about having a way to compare releases to build jobs.
I do not work on verification directly, so I do not know the details. I believe at a high level you generally have a automated first pass which generates a source<->machine trace. You then have multiple independent reviews validating the correctness and exhaustiveness of the trace.

Generally in these environments you build with optimizations off unless needed to ease this validation process as, obviously, you must validate the released/deployed version.
My point is less around usage and prevalence, and more around reimplementing basic paradigms ad infinitum.
It seems that this day the art of configuring a database has been long lost. I also completely don't understand the issue. Just buy two huge behemoth servers, put your postgres there in a replicated mode and move on. It'll sustain huge load. Surely those companies can afford to hire one sysadmin.
IIRC, Sourceforge's reputation was being tarnished even before the malware. Sourceforge had some kind of data loss incident, whereupon open source developers I knew started referring to it as "Sourceforget".

Later, one day someone said in a group of Linux developers, "So, Linus made a version control system...", kinda amused. I didn't know whether Torvalds was actually going to use it for Linux, and didn't even consider that it might be adopted by pretty much all software developers of any kind.

It was even named "git", like it was aggressively trying to be unmarketable.

But at some point, GitHub emerged, and grew a very favorable reputation. Then they sold out.
This is a great site for checking current and monitoring future breaches: https://haveibeenpwned.com/
Point is that simply removing the profit incentive doesn't fix the issues.

This page[1] also clarifies the status of Welsh Water - it's government regulated and "[has] the same organisational status as water supply utilities in Scotland and the pre-privatisation water supply undertakings in England."

[1] https://en.wikipedia.org/wiki/D%C5%B5r_Cymru_Welsh_Water
Fair enough! But you might want to add this feed to your Google Reader, Brad :-) https://scrutineer.tech/monitor/cert/tailscale.com.rss
>That's exactly the fundamental concept behind Iridium and several more constellations since, Starlink perhaps most familiar to the most HN readers.

This isn’t at all a fundamental concept special to space. This happens all over the ground (smart networks tolerant to faults). Routing protocols, packet switching, multiplexing, link layer authentication, etc were all before SDI.

Any special sauce for iridium or Starlink has nothing to do with the nodes being active routers.
The flip side, and I recognize this is not a privilege everyone shares, is that being an older parent may mean better financial stability and opportunities. On today's world of housing costs putting ownership out of reach of many, inflation, layoffs, that can mean a lot in terms of stability for a family.
the CPU usage of manual memory is also pretty high. it's just more evenly distributed throughout the program making it harder to observe.
Is Java not (still) cool?
You misunderstand.

I'm commenting on the fact that it's totally legal and feasible to do the war on drugs but when it comes time to muster that same kind of force against actual poisons being spewed into our environment all sorts of people trickle out of the woodwork to say that it's unconstitutional, infeasible, an overreach of power etc...
if salt is a per-user randomly-generated 32 digit value, then even if you're using a weak, outdated algo like md5,

md5($ssn.$salt) is still safer than md5($ssn): pre-computed hash lookup tables don't exist for md5($ssn.$salt) but they do exist for md5($ssn).

A competent adversary could still crack these if they got the whole DB, but salting is meant to be a defense in depth thing, not a one stop solution to every database security problem.

Hell, if the adversary only gets the DB but not your application source code for some reason, them not knowing the order or formatting specifics of your salt and other static values might stop them from being able to crack even with the full contents of the DB - i.e. imagine your hashes are md5(md5(md5($ssn.$signUpTimestamp).$salt)."iejfmgklaihfje").

If the adversary doesn't get your source, there's almost no way they're guessing the hashes column is computed like shown above, they're just going to be banging their head against the keyboard trying to figure out why hashcat isn't spitting out passwords when they feed in the hashes and salts.

The idea of an adversary getting db access but not source access may sound strange, but I've been doing security work for close to two decades now and I've seen this happen multiple times to real companies.

Never undervalue defense in depth! You don't know what your adversary's capabilities will be so whenever you have an opportunity to deny them if they're missing a capability, you should try to if it's not an unacceptable businesses decision.

Disclaimer: you should NOT be using MD5 for security-sensitive one-way hashing in 2024. bcrypt is a much stronger algorithm and has stood the test of time well, Argon2id is newer so less battle-tested, but is ostensibly a major improvement even over algos like bcrypt.
Not OP, but that's exactly what I do - type my public functions fully.

I built a basic static program analyzer for Solidity smart contracts over the past 7 months. I'm re-writing it to work off CozoDB now, as I want to be able to express more complex mutually-recursive concepts and I believe Datalog is much better suited for that.
Type inference is a good thing. If you abuse it, the same way you abuse lambdas or any other feature, it can get bad.
I'd love to use this for windows in a downtown office. You can get ambient light and a general sense of the outside atmosphere, but with the added benefit of privacy and seeing fewer people walking by.
> One of the author's arguments is that type inference in an IDE is bad because sometimes I read code in a book where I don't have type inference...

That feels like a bit of a straw man because you just took the weakest example from the author's list and took that single one out of context. The full quote was:

> But there are many other contexts where I read code: a book, a blog post, a Git diff. When editing code in a limited environment, e.g. stock vim in a VM.

In other words, there are other contexts that most programmers encounter in their day-to-day that don't have the benefit of autocomplete or popups. I think the general principle of "the code should stand alone" is a fair one to point out without just scoffing "Who reads code in a book??".
Sam Altman is trying to convince Hollywood Sora won't destroy the movie business
> For me it makes sense to distinguish between type inference at the call site or the definition site.

Bidirectional type checking kinda sorts this out by requiring annotations on top level functions and inferring or checking the rest in a mechanical manner. That's kind of a sweet spot or me. (And reportedly it's faster and gives better error messages.) Most dependent typed languages do this. I believe out of necessity. And Typescript also requires top level function definitions, but I haven't cheked if it is using the bidirectional algorithm.

If that's what the author is trying to say, then I agree. And with a Hindey-Milner system it's still best to annotate (most of) your top level functions (IMHO).

And I've gotten into trouble not doing this in the past. I started a project at work with flowjs, got inscrutable type errors in a different file than wherever the root cause was and bailed for typescript. In hindsight, it wasn't the fault of flowjs, but rather my lack of annotations on top level functions. (I knew far less about type-checking at the time.)
> If a reasonable person can't read the law and determine how not to be a BongoBoomBah then...

You haven’t spent much time reviewing actual laws in the US if you think the common person should be able to easily decipher the meaning. They are generally incredibly difficult to decipher if you’re trying to read them based strictly on your understanding of the layman definition of a word.

You almost always have to read the full thing to get context and even then will have to cross reference multiple times to figure out the legal definition of the language in use. It frequently deviates from how those words are used in common speech.
Hopefully we’re one step closer to realizing that the core concept that determines who wins all the marbles is just an amalgamation of sociopathy and sensitive dependence on initial conditions, rather than some version of merit.
Seconding this. It's free to create accounts at the 3 agencies (Equifax, TransUnion, and Experian) and place an indefinite freeze until you need to apply for credit in the future.

Sometimes people sit on the data in these breaches for years before using it, after the dust has settled, assuming people have since let their guard down.

Unfortunately, it's also worth noting that you typically opt into allowing these agencies to sell your data during signup, so after be sure to comb through the privacy policies for opt-out links and submit requests to prevent the agencies from sharing your data with third parties for marketing offers, etc.
The person in the picture asked that people stop using it, a few years ago, but female CS students have been complaining about it forever. The “ideological statement” they are making is fuck your feelings, especially if you’re female. So yes, it is inherently offensive.

“Being confronted with the Lenna image made me very aware that I was one of the only women in the room.”

I wrote the first two PNG image decoders for Java. The first was done as part of an IP swap between Sun Microsystems and NCSA. That was a straight wrapper of the C library. The second was a pure Java implementation I wrote on my own time the following Christmas when I was stuck overseas.

When I wrote the first, Lenna was part of the corpus I was handed to prove I had it working. I felt weird about it at the time, and my sexual politics were decent but not great. What’s their excuse? It didn’t really help me with getting the implementation right either. It was a picture of a curved road and thatched roofs in a village somewhere in the British Isles that helped me fix a memory corruption error that held up calling it done. And the color test patterns hosted on the libpng homepage helped me get the rest.

I wrote those right around when the first official complaints were being lodged, 28 years ago. https://ieeexplore.ieee.org/document/8100841
>How did this get accepted into main repos while flying under the radar? When I do a code review, I try to understand the actual code I'm reviewing. Call me crazy I guess!

And? You never do any mistakes? Google "underhanded C contest"
> That means some sort of profiling tool

I’ve really enjoyed using Application Performance Monitoring tools which sample in real time across production workloads to get insights into application bottlenecks. Sometimes the APM tool alone is good enough to track down performance issues and sometimes you’ll need to drop down to language specific profiling tools. But it’s a great way to get pointed in the right direction based on actual app usage.
I've run it via wine for probably close to twenty years now.
Show HN: Microlaunch your products over a month of maker-friendly rankings
Hey everyone, I'm the founder of Microlaunch.net

After feeling most product launch platforms were lacking marketing impact in the mid-term, I started my own with this simple difference: help product makers get feedback over a month, and not just fight for upvotes during a launch day.

I shipped the platform and submitted it to Product Hunt. Both Microlaunch and Product Hunt are actually complementary.

The launch results were 5k+ visits on launch day, 10k in total. The platform got featured a couple of times and got 10k unique users after a month.

Microlaunch also helps with product discovery.

I hope you'll like it and would love to get your feedback on how to improve it and make it more enjoyable for regular users.
no, even if you are a greedy kapitalist pig, we'd be better off not burning the carbon...because:

1. You can't scrub the air using energy from burning fossils fuels--it puts more C02 into the atmosphere than it yields energy to take it back out again, and

2. In the scenario described, we were only able to provide 90-95% of our energy using carbon-neutral sources. That and #1 above means that we would not have the energy needed to scrub any C02 from the atmosphere. Burning fossils fuels at that point would be a net loss in power.
> Obviously the rise of git played a big role in this.

I would argue it's the other way around. Mercurial is a better source control system, and was a close contender with git back then. However, GitHub winning the hosting war and also being all in on git is what cemented git as the leader. Bitbucket was hosting both and with a more generous free plan, but they didn't win the social and UX fight so git became the de facto standard since that's what you used on the cool good new platform.
That's a pretty cynical take.
Locality drives me insane, but I'm old-school and keep my HTML, CSS and JS separate. That said, I really like HTMX because you aren't required to do that React bullshit where CSS and HTML are all mixed up with JS. HTMX looks like HTML, so it's less of a cognitive leap (my opinion, anyway, and I haven't dug deep into it, yet).
This breach is quite old (2019), the news here is AT&T finally put out a press release today a week after the big story about the data finally showing up in public. Note AT&T still has no idea how their customers' data got out. At least they're admitting now the data is really theirs. Still not taking any responsibility for how it escaped or why it's been five years and they still don't know what went wrong.
Confirmed; just as you noted this functionality from Notepad++ exists in Kate!!! I guess i now am fully going to dive in to Kate even for Windows (nothing against Notepad++, but no need for it now)! Thanks!
> Well their observing wildlife is nice

I'd love to use an invisibility wall to do that. There is a caveat in some cases though. Birds can die by colliding with windows.