skysight-inc/HackerNews huggingface dataset:
The OpenBSD approach to security always seems to be adding things rather than removing them. For example, this feature is intended to make it harder for attackers to break in by guessing the password. So why not remove password authentication, or enforce a minimum password complexity? Password auth for SSH is almost always a bad idea anyway - good, secure software should nudge people towards using it securely, not give them the option to configure it with a gaping security hole.

It's the same with the OpenBSD operating system. There's so much extremely obscure, complex code that attempts to address the same problems we have been dealing with for 30+ years. What if we started removing code and reducing the attack surface instead of trying to patch over them, or we came up with an entirely new approach?

A good example of how code should be stripped down like this is WireGuard vs the old VPNs. WireGuard came along with fresh cryptography, took all of the bells, whistles, and knobs away and now provides an in-kernel VPN in a fraction of the LOC of IPsec or OpenVPN. As a result, it can be proven to be significantly more secure, and it's more performant too.
No reason to use SteamOS, it's just immutable Arch with an A/B partition scheme. Modern SteamOS is designed specifically for the Steam Deck and they only ship it as a recovery image for the Deck.

You can install Steam on whatever distribution you want, I use the Flatpak, and just enable Proton in the compatibility settings.
"Total Recall", aka "We Can Remember It For You Wholesale"
3min Guide to LLMs (Large Language Models) Fundamentals [video]
Sure.
We all know that’d right. Everybody at Adobe knows too.

We also all know that they have the best dark patterns and just-not-too-sketchy business practices. Everybody at Adobe knows too.

Good luck with the fight.
Languages do in fact have similar distributional structure, so that it is possible to learn how to translate words without supervision: https://arxiv.org/abs/2203.04863

In principle languages are arbitrary, but in practice they’re describing the same world and the same concepts end up being useful.
The wonder what kind of revenue they are hoping to get from the short amount of attention users will fork over when they are already stressed from traveling. And how does this revenue compared to the overall cost of the ticket. Are airline margins really that thin?
$1 of revenue is $1 of revenue regardless of whether it was delivered with a smile
This is great, and helps solve several problems at once.

I would like to remind everyone that an internet facing SSH with a password is very unwise. I would argue you need to be able to articulate the justification for it, using keys is actually more convenient and significantly more secure.

Aside from initial boot, I cannot think of the last time I used a password for SSH instead of a key even on a LAN. Support for keys is universal and has been for most of my lifespan.
Yeah, it's a sample, not a census. A survey of 2000 people is enough to get a good sense of Americans thoughts on fast food so long as it's reasonably representative and pulled from a wide variety of locales and age groups.
I am reminded of a short scene in the film Goya's Ghosts, where the artists claims to charge more if the portrait he is painting includes one or two hands.
*tree :-)
Ask HN: Recommended programming language expect PHP
Good evening. I study programming PHP and want to study other one.

What programming language do you suggest?
It’s just fail2ban, should have been in core years ago
I wonder what would have happened if they created a ZFS snapshot, transferred as "tar over ssh" to the remote host, then created hourly snapshots thereafter and synced those across? It seems they were not aware of this method.
The Poor Man's 3D Camera (2017)
(Read the paper, didn’t watch the video)

I am a 54-year old undergraduate in computer science. I don’t know from Curry-Howard (or Hurry-Coward), but this paper made me giggle with delight and glee. (Knuth invokes this delight in me as well, although I don’t understand most of his writings, yet.)

If nothing else, it’s inspired me to implement half-ass easter-egg achievement systems in any future ‘serious’ software I write.
_,
,<g g__
_ _ @ %g[ @
, @ ]P@ @_) "
g"" ,*'g @ %r"
@p "@ @ "
@Lm
> babel-style compilation

"It's not a different language, because you could have another language compile to it."
I'm not sure the use of 'accidentally' was sincere. But I like this choice of words in your post in your first version:

> unmercenary assumptions
Blog says 100Gbit NICs and 200MB/s achieved. Big gap!

Since both endpoints are controlled by you, you should be able to tune the tcp buffers. In either case RTT and iperf3 with dozens concurrent tcp conns would be the first step to determine a baseline for what could be expected.

Author if you are here that data would be very interesting to know.
I don't like to appear to be dismissive of longer posts by picking out just one aspect of them and ignoring everything else that was said; but in this case there's one assertion you're making which stands categorically above all others:

You're still put on trial ... because you're Jewish.

If what you mean here is the fact that the State of Israel is often subject to criticism for both for its founding ideology and the violent mechanisms of its creation (or its various attempts to expand its borders and resource claims through the present day) -- no, it's not simply because the people behind this project are of Jewish ancestry. You seem to believe axiomatically that this is in fact the case -- i.e. that all strong critiques in regard to the founding of the State of Israel or its modern policies are basically the Dreyfuss Affair all over again.

I do not share this axiom, so it is unlikely that we will have a productive discussion in regard the finer-grained historical topics.
It does seem that many physicists confuse mathematical models with reality or at least do so when communicating to laymen.

At the very least, it sells more books.
All I can say is LOL. Off by default for Windows 11 24H2, on by default in Windows 11 25H2, impossible to disable in Windows 11 26H2 (except in enterprise versions of course). Microsoft's history with respecting the user's wishes speaks for itself.
That's exactly what I came here to find out. Most leaks, my imagination goes off the rails. This one just seems so god damn boring. Who tf wants to download 270GB of website source code? What are ya gonna do with it? Fix bugs for them?
Hmm.. System Page seems relatively recent[1][2]. Again, small thing, but small things do add up.

- https://answers.microsoft.com/en-us/windows/forum/all/system...
- https://www.howtogeek.com/697152/where-did-the-system-contro...
> I do not cut it. I dig out any shoots and as much root as I can as soon as they appear above ground.

That's a lot of digging!

Cutting vs digging shouldn't make much of a different in terms of the plant's response to damage (aggressive spreading). It'll spread when it gets hurt either way. Also, knotweed's root system goes down down 4-12 feet so usually removing the roots isn't feasible. Frequently digging it out or cutting it will hurt the plant but it's going to be a very slow and labor intensive way to eradicate it.
Japan Runs on Vending Machines. It's About to Break Them
Google's and Microsoft's AI Chatbots Refuse to Say Who Won the 2020 US Election
If your goal was wanting to use AI image generation to create such an image, this makes sense.

I think people are just questioning the assumption that such a feature is a desirable or necessary feature of a weather display.

I definitely was a bit surprised to open the repo to a weather display and see the need for an OpenAI key without an explanation of which features were AI-powered.

But of course this is a personal project, so "Generate a representative AI image using the location and weather information" is a perfectly valid, and cool, challenge to set yourself and achieve.
We are already recorded pretty much everywhere you go and there is no expectation of privacy in a public place.

In fact, I can’t think of a single place in any major city where I would be able to escape surveillance. Even parks these days have cameras on light posts.

Even when I walk my dog in the suburbs, I am passing doorbell cameras on nearly every home, and I have no right to that footage and cannot compel the homeowner to delete it.

And to your point about crime, violent crime has been trending down since the 90s. I don’t actually think surveillance helps reduce crime, as is evident in the rise of shoplifting in retail lately.
>the general argument that <ai technology> can't do <some task> and so that means it's useless and won't lead to AGI

The paper isn't making that argument. The point it makes is that parallelisable SSMs are theoretically no more powerful than transformers, contrary to some people's assumption that they'd be theoretically equivalent to RNNs and hence more efficient at certain kinds of problems.
Gift link: https://www.nytimes.com/2024/06/07/world/asia/japan-bank-not...
Study: 268% Higher Failure Rates for Agile Software Projects
The genius of your proposition is that you wouldn't have to be surprised, you'd just know
Normal gamers aren’t representative of normal users on a whole. Gamers are just a tiny fraction of the overall user base. Normal users buy cheap-ass laptops with their manufacturers’ opinionated Windows installation, including boatloads of bloatware. And they don’t ever change any of the defaults.
The luxury is the price, not the taste. For the same price, I can get much better local food.
If you want password auth, you already have to change a default setting in SSHD and restart it. How exactly is removing that as a option ‘less complex’ for the downstream distros?
Around February 2024?
How long before the M-word starts being thrown around? In all seriousness, is it possible, likely or inevitable that Nvidia be 'broken up' due to effective monopoly?

I'm just curious, I'm ignorant about how these things go or went in the past, just young enough to not have paid attention when this was about to happen to Microsoft, and don't really have a predisposed position.

Edit: a quick wikipedia search tells me that MS was just barely spared breaking up, and had to settle with a few concessions regarding non-MS software. I can't draw a parallel from this to Nvidia, though

> https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor....
> Journalism is anathema to biz models dependent on advertising and worried about shareholder values(sic).

That presumes that journalism isn't valued. I think a fair case could be made that it isn't valued as much as it used to be, but that's the reason for the "anathema", not intrinsic properties of journalism.
Browsing history doesn't contain what's displayed on the page, and what you input into the input boxes, or POST requests. It's sorta like telephone metadata.

On the other hand, I am always freaked out by Chrome extensions that "can read and change your data on all websites". Can't they have more granular permissions? You gotta have a lot of trust for those extensions LMAO. They can read your bank passwords, probably!! And if they are ever sold...
What to Expect at WWDC 2024
Politicians don't control the Federal Reserve.
The point was that it’s unnecessary for a user to explicitly change the permissions of the home directory as you had described for the data to be at risk.

I agree with your last paragraph, and that is exactly what makes Recall such a big problem, and why the security community is reacting strongly against this feature.

Assuming the attacker wins, which they currently do on a regular basis, they get to know everything about everyone who has used the computer to a degree of detail that is unprecedented both in scope and in detail. The harm of losing this information to an attacker is potentially extreme, with obvious consequences.

Since this is an opt-out feature, Microsoft has essentially guaranteed that a sizable portion of their user base will overnight start feeding attackers more details than they could have ever hoped for.

It’s incompetent, irresponsible, and should be categorically rejected by the tech community.

I say this while also seeing the value of such a feature if it could be implemented safely. I hope someone figures out a safe architecture because I could see a local model trained on everything I’ve ever done on my PC being a transformational capability.

But I wouldn’t go near Recall at this point.
Yeah, I think this entire debate is uninformed hysteria and manufactured outrage. "If an attacker has administrator access, they can see everything you have done on your computer!". OK? That has literally always been the case? "Attacker is root" is game over and always has been. The original writeup from DoublePulsar tried to justify that Recall is somehow different from other such scenarios, but I found it totally unconvincing.

I think it's the right move to have it off by default, but I'm just not convinced by the outrage here.
The pedestrian is most often walking in a crosswalk and getting hit by drivers breaking the law (illegal turn, distracted driving, not yielding)
I like how simple it is. Thanks for sharing.

By the way, I found one or two bugs.

The empty parentheses alone are treated as undefined:

> ()
undefined

And I think any equation using empty parentheses as an expression gets treated as NaN:

> 5 + ()
NaN

Empty parentheses should probably just be a parse error.
To put it as politely as possible, Andrew Tate is not a role model outside of a certain demographic, and using him as an example implies you are catering your app to that particular demographic.
> The amount of people that have “minor” autism and get upset at people looking for a cure is huge, for instance.

Yeah, it reminds me of that X-Men meme with Rogue talking about a cure and Storm saying there's nothing to cure because it's not a disease. "I'd take a cure" thinks the nonverbal kid with severe everything who needs 24/7 care. "Shut up, we're perf" says the girl who's the world expert on diffractometry but doesn't always pick up social cues.

I tend to liken the term ASD to saying 'lower limb impairment disorder'. Did I stub my toe? Is one leg off at the knee? Was I born with no legs at all? Who knows, it's just LLID! What are you meant to do with that information? No idea.

I really think in a lot of ways it'd help to have a couple of smaller buckets inside the giant bucket that is ASD.
Did you forget to submit a patch for it?
Any time you access an SSH connection from a different computer, you basically need the password.
United will beat the passengers into misery one way or another
This reminds me if scenes from the movie Idiocracy. They were mostly right about our future society (the movie is from 2005).

One thing they got wrong though. It did not take humanity 500 years to reach this depicted state.
You can't tell me what to do you're not my real dad
Yeah, give me the choice. If I could trade some intelligence for a bit of executive function/picking up social queues I wouldn't even hesitate.
Author here- and yes as a disclaimer I work at Convex.
As a caveat to that disclaimer, I pivoted my career to work here b/c I genuinely believe it moves the industry forward b/c of the default correctness guarantees, along with other things.

To this question here, some of the things that accelerate full stack development:

1. Automatically updates your UI when DB data changes, not just on a per-document one-off subscription, but based on a whole server function's execution which is deterministic and cached. And regardless if the changes were made in the current browser tab or by a different user elsewhere. Not having to remember all the places to force refresh when a user updates their profile name, e.g., makes it way faster. And not only do the Convex client react hooks fire on data changes, the data they return for a page render is all from the same logical timestamp. You don't have to worry about one part of the UI saying that payment is pending when another says it's been paid.

2. End-to-end types without codegen. When you define a server function, you define the argument validators, which immediately show up on the types for calling it from the frontend. You can iterate on your backend function and frontend types side-by-side without redefining types or codegen in the loop.

3. Automatic retries for database conflicts, as well as retries for mutations fired from the client. B/c mutations are deterministic and side-effect-free (other than transactional changes to the DB and scheduler), the client can keep retrying them and guarantee exactly-once execution. And if your mutation had DB conflicts, it's automatically retried (up to a limit with backoff). So the client can submit operations without worrying about how to recover on conflict.

There's obv. a bunch more in the article about features like text search and other things out of the box, but those maybe are more conveniences on the backend, since maybe a frontend person wouldn't have been setting up Algolia, etc.
True but the value of the hunt and fix may really come from this blog post long term. Content marketing and all that
Also here, didn't gain much notice for some reason.

https://news.ycombinator.com/item?id=40605449
Pre-Nups for Co-Founders
They don't need to be evenly distributed to be strong evidence against the Neanderthal connection. If autism was basically "latent Neanderthal ancestry", then you'd expect essentially no autism outside of people with European or Middle Eastern ancestry.

And it seems that the prevalence of autism is actually fairly even, but might actually be lower among white people.

https://www.cdc.gov/ncbddd/autism/addm-community-report/spot...
I have some hope for a technological solution to the climate change problem. However, I constantly struggle with the question, what if we are wrong? What if we will not be able to fix it fast enough? We are sitting on our hands and praying for a deus ex machina to save us from ecological collapse, when we should be actively striving for a sustainable society.

So, in addition to being hopeful for technological innovation, we must advocate for widespread systemic change, so that we would not even need technology to fix the problem for us. This includes destroying the inherently unsustainable supply chain and in its place constructing a supply cycle. We need to abolish landfills, and require all (at least industrially) produced goods to have a clear recycling strategy. Sustainability is a problem that needs to be solved socially as well as technologically.
Not sure why this is flagged when it's a literal piece of source code.
And then you have a good percentage of that .3 kWh available as extra energy to recapture as regen.
To date, nobody has found the quote among Asimov's publishing writings [1]. Similar (but not as succinct) wordings have been identified in earlier sources, but nobody has been able to identify the exact origin of the quote.

[1] https://quoteinvestigator.com/2015/03/02/eureka-funny/?amp=1
Careful you don't overgeneralize too much. You're probably basing this on home/small office product lines, which is not all HP does.

HP has some pretty interesting and successful products such as the Life Sciences dispensers for cells and fluids (see https://www.hp.com/us-en/specialty-printing-solutions/life-s...).

Then there are the industrial printing products (https://www.hp.com/us-en/industrial-digital-presses.html) which are rather mind bogglingly fast and capable. Imagine a printer printing to a paper roll 40" wide at hundreds of feet per second, and the printing is paper statements to be cut and sorted for mailing.
We are going to do absolutely nothing

Makes for lots of articles and airtime, that's all

Soon only multi-millionaires will be able to afford property insurance in large parts of Florida and California and eventually Nevada is going to have some amazing oceanview property.

That's how it works, we do nothing.
Recall FEELS like being watched. Your browser history does not.
This only applies to hwmon, i.e. `sensors`. You can still read this through powercap/intel-rapl (even on AMD systems).
On stock rPi5 running this takes > 3 seconds. Three seconds to render 370 x 370, 8-bit/color RGBA image to ASCII on a 2.4GHz CPU. And this is my lead-in to rant about neofetch, which takes about 0.2 seconds to run on the same Pi (see below), which would also be the time it would slow down opening a shell should I put neofetch into my .profile. Lastly, it takes cat to cat output of neofetch to /dev/null about ~0.01 seconds, which also is the time that neofetch should probably take to run (and really, this tool too).

$ time ascii-silhouettify -i neofetch-1.png > /dev/null
real 0m1.817s
user 0m3.541s
sys 0m0.273s
$ time neofetch > out.txt
real 0m0.192s
user 0m0.118s
sys 0m0.079s
$ time cat out.txt > time
real 0m0.001s
user 0m0.001s
sys 0m0.000s
Expect a market for airline seat back screen covers.
"They must have hid the incriminating stuff because they knew we were on to them."

It's 4chan. Where conspiracy theories fall flat, they'll just spin more conspiracies about a cover-up. The flow-chart process of conspiracies is designed to never disappoint the believers.
I’ll add to their anecdote, with my own. I don’t think I’ve ever learned anything from SO. It is books and occasional videos for me too.
One would expect that.

https://www.cnn.com/2024/04/02/health/adderall-shortage-pres...

> About 1 in every 10 people in the US who uses Adderall or similar combination drugs to treat attention-deficit/hyperactivity disorder (ADHD) has been affected by an ongoing shortage, a new analysis suggests.

> The US Food and Drug Administration announced that Adderall was in shortage in mid-October 2022, and the share of people with ADHD who filled their prescriptions for Adderall and related medications plunged in the following months.

> In an exclusive analysis for CNN, data from the health data platform Truveta shows that the prescription fill rate for amphetamine/dextroamphetamine medications fell from nearly 49% in October 2022 to a low of less than 41% in February 2023. Overall, the average monthly prescription fill rate was 11% lower in the first half of 2023 than it was in the first half of 2022, and it did not show steady signs of improvement through the end of 2023.
If there's AI involved, everyone's panic level skyrockets.

No one retweets "Attacker gaining root access reveals all user information", but instead "Attacker gaining root access reveals all user information collected by AI program" will go viral for sure.
ufw/iptables and other firewalls can also throttle repeated connection attempts, which is almost always fine but could be something you don't want if you have a legitmate need to support many rapid ssh connections from the same source (CM tools, maybe?)
Without Recall, an attacker needs to get a program to stay resident in memory to log keystrokes, screen contents, etc. for an extended period of time without getting detected. With Recall, they can get the same end effect by exfiltrating the Recall database file whenever it's convenient (i.e. an infected version of a text editor could send it while pretending to check for updates). This significantly lowers the barrier to entry for getting a victim's data, while also making it much easier to avoid detection.