skysight-inc/HackerNews huggingface dataset:
> For the same reason why insider trading and price fixing is illegal: [...]

Insider trading isn't illegal everywhere, and it's not even illegal for the same reasons in different jurisdictions. (Specifically, I know that the reasons are different in eg France and the US.)

> If you don't protect against this sort of behavior, public confidence erodes and eventually the system collapses because nobody's actually producing anything; they're just scamming each other.

That would be easy to test: compare different market with different degrees and kinds of 'protection' against the ills you mention, and see how confidence differs. I doubt you'll find the kind of correlation you are asserting here. (But, of course, we need to watch out for correlation vs causation.)

You don't even need to look at different countries: even in the same country different assets are often traded under different rules. Eg equities vs bonds vs commodities vs commodity futures etc in the US.
xz is also used in Windows and who knows what versions or how it is used there (impossible to verify because of the closed source nature of the windows ecosystem)

if Microsoft security detected some kind of relations between xz and exploits injected into the Windows source code/build process, they are pretty much 100% going to order github to nuke the entire repo regardless of what other people in the open source community thinks or wants.

https://en.wikipedia.org/wiki/XZ_Utils
Just put the chemical plant right next to a field of solar panels and windmills. If it's not sunny or windy, scale down.
I think that's what makes skincare interesting. We want our system to be able to understand your goal, lifestyle, budget, ... and pick out which product is the best for you, given what others who have used the product before said.

With less of this information, the ground truth would probably related to how popular the product is or the average sentiment of people reviewing the product. With this information though, you can compare each one to see which best fits the user's needs. Having compared enough products, you'll eventually figure out which one is the best.
Haven't you ever seen "they're giving our kids speed!" posts on social media?
Everything in your post is true, but stigma isn't based on reality.
Stigma against speed and Adderall are both fruit of the same poisoned tree.
Trying to offset Adderall stigma by drawing (a correct!) distinction from speed is just furthering the problem.
AWS spends tons of engineering time on features you don't need. There is a lot more than 30% on the table.
Pulling directly from github is the good thing. The release tar was compromised, the sources not.
Too much fallout.
For lots of small files, that might not be the case.

(I worked on a FUSE filesystem that had these issues.)
You already gave an explanation before that had nothing to do with any difference in gendered behavior (it was next to the men's locker room), which makes it even more baffling that you're now suggesting that no, it really was because men were less capable of not opening the door.
There's a bug in the detection script. The line:

if [ "$path" == "" ]

should be

if [ "$path" = "" ]
These are difficult problems and perhaps the modern web has developed at a pace that older tech like RDP has not kept pace with. But Guacamole bucks that trend.

Guacamole is good, and I love that it's clientles and works in the browsers, but VNC lacks sound so you need to do that separately. Also the input lag when remote frames increase in frequency is challenging.

If you're looking for something lighter weight and possibly smoother and faster (albeit non-free software with a non-commercial option), check out BrowserBox: https://github.com/BrowserBox/BrowserBox

Solving input lag, and maintaining responsiveness across a range of bandwidth situations has been one of our priorities and I think we've mostly achieved.

We've accomplished this through a combination of sensible heuristics for congestion control, and using WebRTC with a fallback to WebSockets when faster. We also have audio out of the box, no set up required!

However there's always room to improve, which is why it makes it so exciting to work on. Depending on how close you are to a server you may encounter lag issues, too.

Right now you can play with a free live demo of BrowserBox here (sorry, signup is not supported yet!):

https://browse.cloudtabs.net/signupless_session

Some other problems we solve that are not always so easy to configure with Guacamole (and are harder to do with an RDP layer in general), but much easier for us as we virtualize the browser itself are first class mobile support.

Obviously that's an issue with remoting desktops from small form devices in general, but if a browser is all you need remotely then we got your back! :)

Same time, BrowserBox will not be for everyone. It all depends on what you need. Get on touch if you are interested!
> Already from the meat of the article, it seems that this solution is setting you up for using a complex language to specify the interface, which immediately begs the question of how you can be sure the interface is correctly specified.

This is insightful. That is exactly what is happening, but our sense is that this language will be no more complicated than C itself, and will to a large extent parallel it.

The question is really what is more effective, working under one set of constraints imposed universally (like the ownership semantics in Rust), or taking upon yourself the responsibility of defining such constraints within each program. In this way what we're doing is an application of the "trust the programmer" design philosophy; trust him, not only to know what he's doing, but to be able to express it (in the interface specification).

> Sure, in a three-line function, it's kind of obvious (if you know to be aware of this possibility!), but in a function where the pointer and the use are separated by hundreds of lines of code, it's easy to miss that there is a requirement that the hash table not be resized between the two calls. With Rust, the fact that &mut for V means that I can't touch the hash table until I'm finished with V makes it a compiler error.

It can seem as though the example we provide is contrived (because of course it is), but it is not mere contrivance. The point we stress the most is not that the bug is obvious if there are only three lines, but that the presence or absence of a bug is impossible to see even with a single function call whose interface is informal. So what is remarkable is not that we can write three lines of code that have or do not have an obvious error, but that by the mere fact of the interfaces being informal, a three-lined function can be impossible to analyse by itself.

> The ability to mutate an object necessarily implies the ability to mutate the state of an object to break guarantees. While there are definitely patterns where multiple mutable references to the same object can be safe, it is not inherently safe, and proving safety is far more challenging because you can't as easily rely on pre/postconditions for lemmas.

This doesn't answer the question. "it is not inherently safe" does not mean "it is inherently unsafe", it only means "it may be unsafe". So our point is that Rust precludes many kinds of programming that can be safe in relevant contexts, and this is what is so limiting.
Why had you preferred AdGuard over PiHole? Just curious, didn’t follow AdGuard at all, never used it.
> It's also the classic plot for many stories;

And a more general trope: one idea that stuck with me from childhood TV was that badguys were always trying to drive people off their land. (Scooby Doo, A-Team, Airwolf, etc.)

But what TV also taught us kids was that, no matter what weapons the badguys bolted onto a trafficopter, the big black attack helicopter of justice would rain Hellfires down upon them.

Where are the Airwolves, BA Baracuses, and Mystery Teams that we were promised?
Are they storing source archives for each version? I'd think mirroring the actual repo might take less space than a bunch of copies of source archives.

Though it looks like git only uses deflate on pack files. Someone should write a patch to add lzma support. :-)
Oh for sure. I'm not suggesting that this wasn't a government actor, although I'd only give you 50/50 odds on it myself. It coulda just been someone with a bunch of time, like phreakers of old.
This [1] is a fun project to follow.

[1] https://github.com/fruit-bat/pico-zxspectrum
Same for here in FL, there’s not a single city with any usable public transportation (other than Disney’s).
No. Be specific, and think about it:

The Brooklyn Bridge, Queensboro, Manhattan, GW (heading to NJ only), and Williamsburg bridges are the only bridges that do not currently have tolls. All cross the East River. With this plan, you will have to enter the congestion area to use all of those but the GW -- but that's already tolled heading into Manhattan. They even defined the "zone" to be sure to catch the Queensboro onramps. It's intentional.

As for NJ (which is every New Yorker's favorite scapegoat when imagining car commuters): every crossing of the Hudson south of Albany has a toll.

I guess you can count the tiny bridges over the Harlem river if you really want to be pedantic about it, but this is essentially a new tax on NYC residents, whether you own a car or not. Literally every truck entering Manhattan by a major artery will be tolled in one form or another -- in many cases, twice.
The De-Nerdification of Programming
Confusing that the article has different numbers on the wealth gap than the source material:

“Working-class union households hold nearly four times as much median wealth ($201,240) as the typical working-class nonunion household ($52,221), suggesting that membership vastly increases wealth for working-class families.”

https://www.americanprogress.org/article/unions-build-wealth...
Nice. I worked on a Linux disto when I was a wee lad and all we did was compute a new md5 and ship it.
Rule for naming destination ports according to the service name and the host IP
Guys, have you ever tried to access a specific service through port forwarding and keep forgetting which port you need to use to connect? I number my rules like this. I want to access PBS, I know PBS is on the final server .11 so it would be .
iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 8017 -j DNAT --to 10.10.10.10:8007
I remember that ProxMox Backup Server web interface runs on port 8007 and I remember that the machine's IP is 10; this way I know which external port I need to connect to. Not sure if it makes a lot of sense, but it helps me. (Yes, I know you can configure a nginx)

Hahaha, but for now, I'm using this.
He’s a freelance photographer, not an employee. That was probably ahead of its time.
The entire situation seems strangely surreal. With a name like Altman Sam, it's definitely evoking strong Hideo Kojima vibes.
If this is a conspiracy or a state-sponsored attack, they might have gone specifically for embedded devices and the linux kernel. Here archived from tukaani.org:

https://web.archive.org/web/20110831134700/http://tukaani.or...

> XZ Embedded is a relatively small decompressor for the XZ format. It was developed with the Linux kernel in mind, but is easily usable in other projects too.

> *Features*

> * Compiled code 8-20 KiB

> [...]

> * All the required memory is allocated at initialization time.

This is targeted at embedded and real-time stuff. Could even be part of boot loaders in things like buildroot or RTEMS. And this means potentially millions of devices, from smart toasters or toothbrushes to satellites and missiles which most can't be updated with security fixes.
Forward Progress Guarantees in C++ (2023) [video]
> What matters is to build the cheapest possible machine, to make use of the energy in excess.

I see 4 ways you can use excess. Either sell it to other states or countries, make green hydrogen (natgas competitor), charge short term storage (batteries, pumped hydro), or carbon conversion.
It's somewhat regional, and it means to hunt down the target at the expense of everything else, as a dedicated hunting dog might.
Ivanti-linked breach of CISA potentially affected more than 100k individuals
The number of changes that this guy can pack into a half hour is pretty impressive https://github.com/Jrbiltmore/shock-turbulence-simulation/gr...
Google has strict licensing for what you can do with such data (almost nothing) and you have to go through an extreme vetting process

However, this won't generate the same headline because any company can go through it, and it isn't some API sold for some special privileged company. Also the user knows it is sharing their mails (not sure if that's the case with facebook)
I’m of limited mental capacity. Who’s doing the supervising in this thing?
macOS TCC
If a government wants to cast a wide nest and catch what they can, they'll just throw a tap in some IXP.

If a government went to this much effort to plant this vulnerability, they absolutely have targets in mind - just like they did when they went to the effort of researching (or acquiring) four separate Windows zero-days, combining them, and delivering them...
I mention Chinese social media specifically because I know it's not indexed so well by western search engines. You can't conclude someone has no social footprint until you've actually checked.

Regardless of how likely you think it is, finding a social media footprint would be useful information. Seek information first, reach conclusions second.
Show HN: Factory-JS – TypeScript dummy object generator for testing
I made Factory-js inspired by factory-bot (https://github.com/thoughtbot/factory_bot), supports Prisma and Drizzle ORM and more. TypeScript is now widely used in both backend and frontend, but there is no de facto standard factory library. I'm developing a web application using Prisma, trpc, and nextjs, but I was struggling with how to write more beautiful and readable back-end tests. That's why I made factory-js.
It means that `xz` was depended upon by something that depends on eg "xz OR lzma"
> Like everything in mathematics, "obvious" is a term of art. Broadly speaking, it refers to a fact, proof, consequence, which is necessary for the proof to advance, but which is already established elsewhere, so it does not in itself aid in understanding the proof being presented.

"Trivial" is a term of art (and doesn't mean exactly this) but I'm not sure that "obvious" is.

I think that something already proved is called an immediate corollary if it's a very small step, theorem if it's not that small but well known, a previous result (with a citation!) if not well known, or if you can't cite anything, at least say it's part of "mathematical folklore".
Looks good! It will be a great addition to the Faceless video series!
Robert E. Lee himself was against microaggression.

> A true man of honor feels humbled himself when he cannot help humbling others. — REL
Individuals and corporations quit caring about the environment; Which, is why there is sewage and microplastics in the sea and ocean.
>The CEO thinks it can be a robotaxi at some point in the future pending regulatory approval.

The problem isn't approval but Tesla's capabilities.
They don't get an approval because FSD doesn't work but they already sell it to customers.

That's not a vision that's fraud.
This strategy of trying to snuff out web apps by locking all iOS users into a decade out of date fork of Chrome that only gets a trickle of new features, and those features consistently have added UX friction that exists in no other modern borders is working in North America.
America's Drivers Agree: LED Headlights Are Just Too Bright
Unrelated to Google, but one of Android's best high quality wallpaper apps, Walli4k, has been absolutely devastated by AI generated crap. The weirdest part is that it's the Walli4k team that is adding all of them. The app has become almost unusable.
mas namtla
MakerKit – Firebase/Supabase SaaS Template
Quick way to build MVPs with MakerKit. Ideally using Supabase, since it uses Postgre
> the greatest technology the world has ever seen?

Give me a fucking break. Seriously, people.
Product Almanac
Great list of product management topics from Shreyas about lessons he learned from Twitter, Stripe and other big companies!
Guacamole has supported windows RDP for at least eight years now. (Probably longer, I started using it in 2016 and it had support already)
Boeing's shakeup and GE's fall: 2 more black eyes for Jack Welch's legacy
Here's a handy bash script I threw together to audit any docker containers you might be running on your machine. It's hacky, but will quickly let you know what version, if any, of xz, is running in your docker containers.

``` #!/bin/bash

# Get list of all running Docker containers containers=$(docker ps --format "{{.Names}}")

# Loop through each container for container in $containers; do # Get container image image=$(docker inspect --format='{{.Config.Image}}' "$container")

# Execute xz --version inside the container
version=$(docker exec "$container" xz --version)

# Write container name, image, and command output to a text file
echo "Container: $container" >> docker_container_versions.txt
echo "Image: $image" >> docker_container_versions.txt
echo "xz Version:" >> docker_container_versions.txt
echo "$version" >> docker_container_versions.txt
echo "" >> docker_container_versions.txt

done

echo "Output written to docker_container_versions.txt"
```
The problem with the parent's suggestion is you end up banning lots of useful techniques while not actually stopping hackers from installing back doors or adding security exploits. The basic problem is once an attacker can submit changes to a project, the attacker can do a lot of damage. The only real solution is to do very careful code reviews. Basically, having a malicious person get code into a project is always going to be a disaster. If they can get control of a project, it is going to be even worse.
Probably less of an individual and more of an exploit to sell.
I don’t think healthcare for employees comes anywhere close to the list of top expenses for a company as large as Boeing.

Based on the article, it sounds like the expertise of more experienced workers was preventing the reckless management from shipping poorly tested products earlier, and this was the actual reason for terminating them.
Maybe we shouldn't rely on a corporation owned by Microsoft (of all companies, jeez) for essential parts of our open-source infrastructure.
I think your missing parents point, both are just preshared keys, one has some additional fuzz around it so that the user in theory isn't themselves typing the same second key in all the time, but much of that security is in keeping the second secret in a little keychain device that cannot itself leak the secret. Once people put the seeds in their password managers/phones/etc its just more data to steal.

Plus, the server/provider side remains a huge weak point too. And the effort of enrolling/giving the user the initial seed is suspect.

This is why the FIDO/hardware passkeys/etc are so much better because is basically hardware enforced two way public key auth, done correctly there isn't any way to leak the private keys and its hard has hell to MITM. Which is why loss of the hw is so catastrophic. Most every other MFA scheme is just a bit of extra theater.
Nope. This is an implementation of one of several things that people often imagine Microsoft's DirectStorage to be, but the real DirectStorage is a lot more mundane.
It still has to go through the entire memory system. It's hard for me to imagine that transferring a number from the CPU to the GPU is faster than transferring a byte, and if you have 2 CPU-resident numbers per GPU-resident byte that's a lot of transferring.
> The author may well be on to something but personally I hate "story mode" in popular science books, and would really hate it in actual science papers, both the ones I read for work and the ones I read for fun. I want to go straight to the equations -- often I prefer them to the graphs.

I think John Baez agrees with you. At the conclusion he says,

> The ideas here take practice to implement well, and they should not be overdone. I’m certainly not saying that a good math paper should remind readers of a story. Ideally the tricks I’m suggesting here will be almost invisible, affecting readers in a subliminal way: they will merely feel that that paper is interesting, carrying them in a natural flow from the title to the conclusion.
Double the suicide rate compared to what? Look, I'm not saying social media isn't bad for you, just look at what HN has done to all of us, but in what universe is it possible to create an even vaguely controlled study on this? You can't measure across time, you can't measure across cultures, the confounding variables would ruin your results. And suicide is rare enough that you can't manufacture a control group on teens you get to not use social media.

I've searched around and can't find the numbers that you're referencing. I can't even find a study that confidently asserts even correlation. It's just "the suicide rate went up in 2010's and we think it might be social media?" So to not only say that this is the problem but also this is the magnitude of it implies a level of confidence that is simply not supported by the data.
From the above post the Titan API seems to be an oauth API that's extremely vetted, hence the special name and why only spotify and netflix has access.
They could mirror them on gitlab.com if they wanted to. It wouldn't even be that difficult to set up and automate.
The existence of real, honest-to-goodness commercial robotaxi service, being offered by other companies makes the deception even more clear: The actual thing exists and it looks nothing like Tesla's offering.
So much for those “many stories”
AArch64-Explore/vol1 M1 Explainer [pdf]
https://archive.is/snbeV
In this repo: https://github.com/Jrbiltmore/UniversalBankAndTrust looks like he's talking to chatgpt to generate the code. It appears someone let an AI run on the internet.
Basically they're all ext2 with different implied feature flags enabled.
> But why won’t banks at least support customer provided yubikeys?

> support

You answered your own question.
I believe the bigger problem is that the tesla models are increasingly being designed in a way that makes it harder for the driver to directly control the car.

Newer tesla cars are removing or degrading critical controls.

The ability to turn on defrost, use the turn signals, shift into forward or reverse, neutral or reverse is all being hobbled by cost-cutting controls.

There is no shift lever (car guesses) and there are no turn signal/light/wiper stalks.

Some functions have buttons on the steering wheel, which rotates and moves the buttons.

Defrost and other critical controls are on the touchscreen and it has gotten harder to reach out and access controls with each new model.

(and I am someone who likes tesla)
> wouldn't we just be better of not burning the carbon?

Of course, just like we'd all be better off not overfishing, but tragedy of the commons dilemma makes it hard to coordinate to stop that from happening. Not to mention, renewables have only become cheap recently, but we've been emitting for a long time.
Great, now you have many points of failure spread over different hosters. The basic fact they're SPFs haven't changed.
There's much better and older sites than this that do exactly the same thing better and cover other constellations

There's also many other providers available globally

This one person nonsense only applies to maybe Tesla superchargers in the US

And only because of the incompetence of competitors