skysight-inc/HackerNews huggingface dataset:
> effectively pushing the responsibility back onto the clients of the library.

That does not compute. The responsibility is pushed back onto the security researcher to prove that there is an actual vulnerability in practice.

Libraries (ideally) have documentation and contracts on what they expect on their input. If clients don't abide to the contract then it's on them. If the library has a wide contract then it's on the library. However even if the library has a bug, the bug needs to be exercised by clients for it to be an actually impactful vulnerability.
The term makes a lot of sense when you read it as having the package manager at it's core, which also happens to be the update mechanism. But in the container world, that would be an idle update mechanism and package management (as in selecting the subset of installed stuff) is also handled through image selection. But an image created from scratch by whoever would be considered end user in the container world would still contain the package manager of the distribution used to set up whatever is eventually imaged. With this as the baseline, distributionless is either an image that has this umbilical removed, or, as purists would probably prefer, an image where the package manager has never existed because everything was set up without involving one, or set up from the outside, without ever running anything "inside".
As someone currently forced to live in Ohio for work, where the hell does it get off with the slogan "the heart of it all"?
Thank you for the feedback - agree on the gif. Also it should probably show real messages an an example instead of rand().

re: maintenance - I have tried to build this to be hands-off. The only storage this uses is SQLite, and I have the code set to automatically vacuum as space increases.

It also has a /metrics endpoint which has disk size. This is going to be used for two things in the future: first, as a metric for autoscaling (scale when disk is full) and second so that a server can stop serving requests when its disk is full (to prevent catastrophic failure.)
I counted 417 comments on that page and scrolled through a few dozen. Every one of them was spam. That's pretty much the internet these days isn't it.

Other than that, the blog post was very interesting, I learned a bit of history of QNX, and concluded that I should avoid it.
I think you must be living in a parallel version of reality.
Very cool. I needed something like this.
Looking at short video in readme - I suspect adding live stats similar to sidekiq would make UI look more dynamic and allow quick diagnostics.
Docs for current features are more important though.
Ha ha. The part that isn't being discussed how it is more profitable for certain commercial interests to have more vulnerabilities even if they are bogus.

There is something wrong with security industry and we are all paying the price. At my day job some tool automatically opens security bugs against 15 or so repos we maintain and now we are on the hook for arguing how the report was bogus or fix the vulnerability. Just PR and Jira dance one has to do is exhausting.
IMHO labeling people “incompetent” is a bright orange flag. Sometimes it is true, but far more often it’s a genuine lack of respect.
If the devs indicate that they aren't going to fix it, raising a cve is

- Rude
- Counterproductive
- not going to result in a fix
- not going to help users

If someone does that in the full knowledge that it will cause a DoS on inocent party's build processes and their ability to shift fixes. It could be validly considered a deliberate denial of service via a supply chain attack.

Maybe that should be policy, so these security bods are forced to accept responsibility for the work they cause.

That would look good on their CVs.
Isn't the US basically the same? The US government gives massive subsidies, tax breaks or just has the military buy components for 10x the price (to offset commercial loses and R&D).
The world is approaching 1 TW/year of solar deployed (will likely be achieved in the next 18 months at current global solar manufacturing ramp rate) [1] [2]. Germany will phase those coal plants out before the end of the decade, regardless of what the current narrative is.

[1] https://news.ycombinator.com/item?id=40788172

[2] https://archive.is/2024.06.24-223854/https://www.economist.c...
Correct. BLE is sane, 5ghz WiFi is insane with > 100 data channels and all of them can beacon. I really don’t understand why the WiFi alliance doesn’t learn from BT here. Maybe there are technical reasons like WiFi is always becoming so they need more channels to spread over in an urban environment? Still seems a bit silly.
> They are not used for normal day-to-day training.

That makes sense, but you probably should do some training with them, so first use is not in a dangerous situation.
How to hide used ports? [cybersecurity]
Let's say, I live in a country, where I want to play Minecraft. I also know, that my government has officially banned Minecraft, and I will get in troubles by trying to play it.

I could try to install Minecraft over Tails OS, so all my traffic would be routed through Tor, but my friend has told me that I still could be caught because of the the port: Minecraft uses port 25565, and by analyzing my internet-traffic government can find the port, and thus the app used.

Is that true? If so, how can I hide/change/fake a port, used by an app?
Since the commons is never wrong, I guess I live in Arizona now. Yesterday, I thought I lived in California.
Going to sleep is the easy part. The quality of your sleep is the thing :) The biggest problem is that you don't know how good/bad your sleep is, unless you make some changes to your lifestyle (e.g. starting or stopping with coffee).
CISO and people in his office (the so-called cyber security experts) are nothing but report pushers. They run vulnerability scans on code, and whatever comes back from packages like Tenable, they send to everyone to justify their own existence. They don't consider the severity, they don't consider snd differentiate between attack surfaces and attack vectors. They just hound you and your superiors in the name of insurance liabilities... they suck. They turn developers into hounds that harass other developers for fixes. Out goes the desire to work on a software because all you're doing is patching nonsense every day because some ciso somewhere is unsatisfied. To hell with each and every ciso. Security is important and having cyber folks that have programming background is even more important. Mindless lemmings otherwise.
Thank you for posting this! The hot takes on HN on the day of were exhausting—all of a sudden it turned out that this tech forum was chock full of lawyers, most of whom knew for a fact that this ruling was the bringer of the end times for rule of law in the US.

In particular, this is the clarification that I was pretty sure was the case but couldn't find a lawyer who'd said so yet:

> None of this means that Congress cannot delegate certain matters to agencies. Indeed, Loper says that Congress can still provide agencies with discretionary authority. But Congress must do so through statutory provisions or language where the best reading of the statute, applying traditional tools of statutory interpretation, is that Congress delegated discretionary authority to the agency, subject to ordinary constitutional constraints. Silence or ambiguity alone no longer requires a court to conclude that Congress delegated authority to an agency.

So many comments on the day of insisted that this meant that Congress would from now on have to spell out every detail of every rule, and if they didn't do that then the district courts would create a hodgepodge of contradictory interpretations that would make interstate commerce impossible.

Yes, there will likely be statutes that need to be rewritten (though, as noted in TFA, not as many as people feared). But they'll need to be rewritten to expressly delegate the authority, not to spell out every rule.
I'm from Ohio and didn't understand it the first time they used it in the 1990s or when they brought it back again last year.
There is no "the Internet". There are computers, and wires, and silicon and electrons and photons, and there are cells and nerves and brains, but there is no "the Internet" in the real world.

> your direct connection is to the internet

You've still got a brain? A brain in a jar wired to a computer network is still in the physical world.

You have to figure out your metaphysics before you can talk about this sort of thing. What are you?

(I would say that you are subjective awareness itself, but that's useless from the POV (no joke intended) of someone trying to build a machine that can be a conscious being, or trying to transcend physical reality.)
From this article [1] written in 2019, I have gleaned that of the 27% of the Americans that do not pay for broadband, 50% say that cost is a factor and 21% say cost is THE factor. I can agree that the costs are ridiculous (Comcast keeps raising my prices), but that isn't exactly the same thing as "being unable to afford it". 22% say it's because service is not available (or unacceptable) and 7% say that's the only reason.

I didn't have broadband until I moved out (this was long after broadband was widely available), dial-up was the only option because AT&T never bothered to install the equipment that would enable DSL for our address. Today, 15 years later, their only options aside from dial-up are cellular data plans and satellite Internet, which are sub-par, prohibitively expensive, or both.

1. https://www.pewresearch.org/internet/2019/06/13/mobile-techn...
How to get root access to your Sleep Number bed
I hope so. We were considering migration from on premise to AWS or GCP. Did a couple of simulations, went with renewing hardware for our on premise. It was the right choice. Storage alone is almost 3 times more expensive on cloud, compared to a netapp appliance with financing...
Stil using GCP for couple of use cases (e.g. BigQuery, Vertex), some backup infra, but 95% works on our hardware in rented racks.
HERB from 10 years ago was said to be able to unload dishwashers, but I only find videos of it manipulating a bottle of drink:

- http://web.archive.org/web/20130801064313/personalrobotics.r...

- https://youtu.be/PEg9ay-Wy-M
If the CVE pipeline has decided to blindly trust anyone who puts information into their system, then the only sustainable system is for the downstream processes to do the same thing.

The solution therefore is to blindly accept any PRs from white knights that show up around the same time an obscure edge case CVE is reported. As the CVE reporting process teaches us, always accept unauthenticated input as valid without regard to how this impacts other people's lives.
This is a great question and something I've been thinking about a lot. Big picture:

Each queue node can operate (mostly) independently, and this is good. As a consumer, I don't really care where my next message comes from, so I can minimize the amount of data that needs to have a "leader".

The only data that needs to be synced is the list of queues, which doesn't change often. If one server is full, it should be able to route a request to another server.

When we downscale, we can use S3/Dynamo (GCS/firestore) to store items and redistribute.

There's more nitty gritty here (what about FIFO queues? What about replication?) but the fact that the main actions, "enqueue" and "dequeue", don't require lots of coordination makes this easier to reason about comapred to a full RDBMS.
I do not know how you would end up with that impression, because for each person who downloads a copy, the IA has made a copy.

Regarding the removal of books, if they were licensed to the IA in a way that allows for 'digital lending', and the IA then violates that license agreement, then the IA no longer has the license and cannot anymore do 'digital lending'. And if they weren't licensed to the IA in such a way, then they're making and distributing copies without a license to do so, which is copyright infringement.
The article suggests that this DDoS is incentivized by the resume-padding cachet of having a CVE to your name, a kind of Hacktoberfest-style cobra effect:

> a recently growing pattern involves newbie security enthusiasts and bug bounty hunters ostensibly "collecting" CVEs to enrich their resume

Naturally, such a reporter would value higher severity reports.

I haven't really thought that much about the CVE process. It's kind of strange to me that Github, Snyk, and the NVD may all have different evaluations of a report. I guess decentralization is a feature, but one not without bugs.
Even if the rate of inflation is down I think many (including myself) will remain frustrated and angry.

My month rent has gone up significantly as I’ve stayed in the same apartment for the past several years. In the past few years my rent has had a 1000 dollar increase now in 2024 compared to when I moved in to this apartment a few years ago. The rent in all the surrounding apartments have also increased horribly over the past few years.

Even if the rate of rent increase from now on is less I am still going to be having a tough time.

Also the fact that the food and other necessities have skyrocketed. Even if the future rate of price increase on these goods is 0, I’m still having a tough time.

So these articles always have this assumption that somehow because inflation rate has lowered people should be happy. But that’s not how reality works. The cost of everything is still too high!
Here is a calculator:

https://cvss.js.org/
And since some states have an extra photo, the title is 100% wrong. There are over 50 photos for less than 50 states :)
Related. Others?

Athletics at the 1904 Summer Olympics – men's marathon - https://news.ycombinator.com/item?id=39036502 - Jan 2024 (1 comment)

Athletics at the 1904 Summer Olympics: Men's Marathon - https://news.ycombinator.com/item?id=32651197 - Aug 2022 (47 comments)

Running a marathon was never crazier than during the 1904 St Louis Olympics - https://news.ycombinator.com/item?id=24112827 - Aug 2020 (23 comments)

1904 Summer Olympics – Men's Marathon - https://news.ycombinator.com/item?id=23016964 - April 2020 (1 comment)
As long as GD is getting paid their fees I think they DGAF.
QNX really needs to modernize if they want to survive. Their tooling ecosystem is stuck in 2008, and their kernel's performance is pretty low. IIRC, the kernel itself is also single-threaded, and can't take advantage of multiple CPUs (even if tasks can be SMP scheduled).

Their moat is supposedly their ASIL certification, but I see that value shrinking more and more over time for the following reasons:

1. If your product has a software-related failure, customers won't care about all of your certifications. Only the end product.

2. I'm not convinced that the QNX kernel is less buggy than the Linux kernel. Also, most failures don't tend to be kernel related.
I don't think 37signals is a very strong example that this could become a trend. They are in the goldilocks zone where they're big and stable enough to save a lot of money with self-hosting, but not big enough that they can negotiate meaningful discounts with Amazon.

In reality cloud is too convenient, and the tradeoffs for self-hosting just don't make sense for the majority of companies. The talent to run your own servers with modern HA and reliability expectations has largely been consolidated into the giant cloud providers and other large companies at this point. As much as I think a lot of cloud is wasteful and more diversity would be beneficial, I don't see any meaningful change to cloud dominance on the horizon.
This kind of things might be the first step of a hostile takeover: push the developer to make some changes quickly and then offer help.
Except the law did contain the provision for this fee. The Magnuson–Stevens Fishery Conservation and Management Act included a “Necessary and Proper” clause that mirrors the Constitution’s, yet the Supreme Court decided that Congress’ ability under that clause doesn’t extend beyond itself. Despite the “History and Tradition” of this delegation, and despite the fact that such powers are literally written in the constitution itself.

It seems we are inching closer to a world where it would require a constitutional amendment to make traffic laws.
There's a thread on reddit with a bunch of translated comments from Chinese social media and evidently nobody knew there was a rocket base there. Not even people from Gongyi, where it is.

https://old.reddit.com/r/interestingasfuck/comments/1drzauu/...

This happened 3 hours ago btw

Update: https://www.msn.com/he-il/news/other/update-1-space-pioneer-...

More vids are starting to show up
https://www.youtube.com/watch?v=_KD07C5wDpU
FOMO is legit though. Every organization has an obligation to assess if LLMs and OpenAI(-like) can improve their workflow. No need to expect much of it, but every org should know what they’re missing on or why they’re not missing on anything.
Both version of the macro makes this fall through from 0:

switch (a) {
brkcase 0: foo();
case 1: bar();
}

so in a sense the `if (0) case` trick also affects the previous case, not the current one. But that one also falls apart when there are multiple statements under the brkcase.
New Hampshire: Live Free or Die? :)
It can be done in a single line of code, like this JS example: "wakeWordHeard && !sayingAlexa ? doWakeWordCommand() : null"
By Betteridge’s Law the answer is likely “no” ?
I had no issue submitting PRs to random dependencies on github while at Microsoft
Completely agree. I get a lot of "CVEs" that are "test code has a hardcoded key" or similar. Once or twice a year I get a real CVE.
Both Ulysses S Grant and Grover Cleveland were heavy consumers of cigars. Both ended up with oral cancer.
Guide to the Gary S. Becker Papers 1923-2014
'It is a religion here': India united by shared love of cricket – photo essay
Ugh - say I wrote a daemon that runs every 2 hours, it exposes no end points and has no metrics. But just because I depend on some library that brings in promethus which in turn brings some http2 library, I am on the hook for fixing this Cve in my code.

Shouldn't it be on security researcher to prove that how this can be exploited if no http end points are created?

So much of security scanning is such bullshit.
> From someone whom I think works for GitHub

It’s “who”, not “whom”, in this case. The “who” is in the nominative case here, i.e. it is the subject of the clause, not the object.
cloud computing is way too expensive for what it is. you'll have most of the benefits with a managed database and a good cdn
It sounds like your partner is not pushing for it because it will improve the product for users, but because it will improve the product for investors. It’s a branding exercise. So, if you’re doing anything at all that involves statistics, or multiplying matrices, using some kind of backtracking algorithm, maybe just call that AI and everyone wins. Or just slap a “genAI” button tied to a ChatGPT API next to your user input.
Can you tell me more about why you needed this (and what you ended up using?)

Totally agree on adding more metrics and information to the UI - but how much of that should be on the dashboard vs exposed as a prometheus metric for someone to use their dashboard tool of choice?

I am not very good at visual design and have chosen the simplest possible tech to build it (static rendering + fomanticUI). I sometimes wonder if the lack of react or tailwind or truly beautiful elements will hold the project back.
There is a Moscow, Indiana after all.
> Your first sentence is a little confusing, but I can confirm that Google, at least, uses lots of open source software, and the build system automatically checks that all the third-party libraries used in an executable have a suitable license. [1] They also vendor everything and will patch security issues locally.

I think that you and your parent agree, and that inserting an extra comma, marked by [,] below, would show this:

> My experience is that it’s not higher end commercial users[,] who would actually check the license, but lower scale commercial users who don’t care and the license wouldn’t scare them off.

That is, "higher-end commecial users would actually check the license, and are not engaging in this kind of behavior; lower-scale commercial users don't care about the license, and are engaging in this kind of behavior."
There is no causal connection at all between the two, insofar as the former even refers to anything specific.
I think people should take a step back here, and meditate a bit on what "disclaimer of warranty" means.

All of the popular open source licenses, GPL, MIT and BSD, quite plainly state that, to the extent permissible by law, there is no warranty about anything, whatsoever.

There was a time when Linux users (in general) understood this. You want free? You pick any distribution you like. You want a warranty? You pick RedHat.

But over time, it seems we've gotten to a point where "I imported your package, so that means you're obliged not to break my precious CI" has somehow become the norm.

This is bad for open source, and, frankly, bad for everyone, and I think it's high time that people start taking responsibility for their dependencies, either by paying for support, or by maintaining their own bugfix branches...
https://news.ycombinator.com/item?id=40445159

"The largest solar power project in Wyoming, which plans to supply electricity to a burgeoning infrastructure of power-hungry data centers in south Cheyenne, was given the green light for construction Tuesday by a key state permitting agency.
The $1.2 billion solar farm project with more than 1.2 million panels will be built by Canadian energy giant Enbridge Inc.
The 771-megawatt solar farm will be built on private land leases in two phases south of Cheyenne, about 4 miles southeast of the capital city. The solar power facility will generate enough electricity to light up more than 771,000 homes, more than in all of Wyoming."
It Sure Is Great to Get Out of That Bag
Good, we need open implementations of all the AWS stuff.

I swear they reimplement stuff we have just so there are more places to bill us.
I think so, but it's also funny to see some companies (my current included) struggling to get there to replace their on prem private Cloud, driven in large part by the VMware Broadcom situation.
> recently growing pattern involves newbie security enthusiasts and bug bounty hunters ostensibly "collecting" CVEs to enrich their resume

That's exactly the problem: they use automated vulnerability scanners and AI to "find" these vulnerabilities, flooding the system with useless reports.
>If your product has a software-related failure, customers won't care about all of your certifications. Only the end product.

If you're in a market where a ASIL certification is needed, the customers ONLY care about this certifications. I keeps them out of jail.
Do you have links to back up this argument? Anyone that actually cited the parts of th law and and explained how scotus got it wrong?
Without any information on the startup, your situation, and your goals, there's not really a way to answer this.
ChatGPT's Moral Compass
https://web.archive.org/web/20240525212957/https://quillette...
> the two Abrahamic religions

It's three main ones (Judaism, Christianity, Islam) and a bunch of off-shoots such as Samaritanism, Mormonism, Baháʼí.

I'm opposed to religious philosophies in as much as non-real/provable beliefs, and feelings based on these non-provable beliefs, are used as justification for the philosophy or moral stance.