skysight-inc/HackerNews huggingface dataset:
> […] rendered unusable for attackers by using port knocking.

Port knocking renders SSH unusable: I'm not going to tell my users "do this magic network incantation before running ssh". They want to open a terminal and simply run ssh.

See the A in the CIA triad, as well as U in the Parkerian hexad.
Was this abused in the wild?
What's in My Location History?
Just in the task of structured data extraction

So very misleading title
Sorry, I forgot the link to the support page:
https://octoeverywhere.com/support
The old Sleep Number beds were not smart, they worked fine. I think people want to drown in useless data these days trying to "fix" their sleep when the reality is its their job or high stress causing sleep issues.
This might be optimal for off-the-cuff content, since reading is faster than listening but speaking is faster than typing

Unless stenography ever catches on
Product Hunt’s primary audience is product managers. If your tool targets product managers and helps them do product management things, it can do well on product hunt.

There is a slim chance that journalists might pick up on a product that does well there, but relying on that is a wishful thinking PR strategy.

For product managers who spend a lot of time there, it can feel like the center of the universe. The Product Hunt PR campaigns have also tried to spread the impression that it’s the premier place to launch products and attract customers. It’s nothing more than a Product Manager hangout and self-promotion site, though.
Just listen to it then.
looks impressive!

What are your plans for further development? I guess for this complex project to evolve in order to meet the needs of the professional users it will require lots of work/team/resources/etc.

Do you plan to monetize it somehow in the future? or how are you going to sustain it?

Another free alternative to AE (targeted at more casual users) that comes to mind is CapCut... which is obviously a ByteDance product. And they already offer tons of features for free, so the competition could be tough...
Unpopular opinion, but I always say that unit tests are contracts for the API. If you don't want / don't need to make contract, don't do unit tests.

Unit tests main purpose is not to improve code or reduce bug, it's main purpose is to verify the code to work against the contract that's defined in unit tests. Code improvement or bug reduction are added benefit, if any.
> This guy just shared a video of people engaging in a hate crime. [...] China [...]

Marine Le Pen was charged in France for promoting jihadism when she shared a picture of a beheading or some other gorry crime to denounce daesh.
Is zero the optimal amount of deliberate law breaking by corporations?
It happens constantly to any startup with a security@ email address.
I’ve been preaching this for a while.

When a codebase gets too big, and devs gets too clever with their tests, the whole test suite becomes complicated.

If your test suite is approaching the complexity of the actual codebase (what with layers of mocks and fixtures that are subtly interdependent,) how could you be expected to trust a test you wrote more than the code you wrote.
I see a lot of saying that, but no evidence.

A single senior developer full time @ Google is probably a half million dollar a year investment, give or take. How many do they have maintaining it? How long before that yearly cost exceeds both license fees for an alternate solution and the cost of development and migration?

The answer to that is not obvious.

(edit: response specifically regarding "astronomical" costs)
>And Erlang. And Haskell. And OCaml. And F#. And...

JavaScript (maps), Rust, Ruby, Python...
Thanks, I've made changes to the copyright

Thanks for the feedback
I liked it when I read it, but it's not really a good book. Influential, certainly. But not good.

There's on trick that kept is seeming up-to-date: the author invented many words without giving it any explanation, and later authors have filled in the blanks in a way that is compatible with the novel.
After what they did to Foundation, I’m not getting my hopes up.
A Prehistory of Zoom
The premise of this article is flawed. It assumes that higher performance automatically leads to higher income.

What’s more, the summary points out particular data points which result from step wise tax system and tries to turn it into an “anti performance” argument.

I can’t help but believe that either the summary or the paper is more ideologically motivated than anything else.
Pakistan is a borderline failed state. A few decades ago, GDP per capita was roughly the same in Pakistan, India, and Bangladesh. Now, India and Bangladesh have 60% higher per capita GDP.

But Biden (or should I saw Blinken, who I guess is the one actually running U.S. foreign policy) continues to prop up the military regime in Pakistan, which tolerates radical Islam and creates a security risk for the entire region. That includes reportedly pressuring the military to get rid of Imran Khan, the first decent leader Pakistan has had in a generation: https://www.msnbc.com/opinion/msnbc-opinion/us-pakistan-ukra...
I use LLM information extraction for financial news articles with OpenAI Azure and it is a huge problem for me.

404 Content moderation response in 4% of articles. This is just financial news text.

It is a prime reason we are considering open models.
Example instructions:
1. Replace the sky with a deep blue sky then replace the mountain with a Himalayan mountain covered in snow.
2. Stylize the car with a cyberpunk aesthetic, then change the background to a neon-lit cityscape at night.
2. Replace the person with sculpture complementing the architecture.

Check out the Research section for more complex instructions.
You were supposed to be directed to the jobs section

I have fixed it now

Appreciate the feedback
You can start again?

Neuromancer is a bit of a guilty pleasure; like an airport novel.

It's fun enough to read, but it's not a good book.
It only shows past behaviour so not completely a proof that nothing could be sent.
People are generally not trying to get root via an SSH RCE over localhost. That's going to be a pretty small sample of people that applies to.

But, sure, in that case fail2ban won't mitigate, but that's pretty damn obviously implied. For 99% of people and situations, it will.
Imagine I fill a bathtub full of marbles - and I pull a solid semi circle through the marbles. The marbles that flat side moves past will barely have to move, the marbles that are displaced by the round side will have to 'move further'. They won't come out exactly at the same time, but they will have had to move further and move faster as the semi circle moves through the bath.
humans are creatures of habit. fixing these flaws is not enough to motivate us onto something new, it has to be groundbreaking.
> Unpopular opinion, but I always say that unit tests are contracts for the API

You’re talking about integration tests or e2e tests.

Those don’t sound like unit tests.
We're neither disembodied brains nor bodies in isolation of basic needs like shelter or desires for energy-intensive conveniences, so I challenge that we should try to assess energy consumption in the way you're proposing. The outcome and the inputs required to get to it are the two relevant variables IMO.

Being consistent, though, I should've included the amortized cost of training and the energy cost of the rest of the data center to the 4o analysis. I don't think that those costs would be more than a factor constant greater.

When we can create disembodied brains that don't have needs for shelter and desires for energy-intensive conveniences, I buy that we can do 10% of the energy accounting.
Thanks for the link!

But, after reading the article, it seems that Trump's assumptions about bird killings were true?
Apparently US windmills kill hundreds of thousands of birds every year. Among them hundreds of bald eagles. So over time that adds up to thousands.
A Software Multiplexer (Bitwise Table Lookup)

/* Bits: selected, hovered */
const colors = [
grey, // 00
green, // 01
blueA, // 10
blueB // 11
]
const color = colors[selected << 1 | hovered]

https://blog.uirig.com/bitwise-table-lookup
I've seen venues with long lines to buy tickets where they put a sign with a shortlink to buy online and skip a line.

Long links are not convenient when people have to type them into devices with no physical keyboard.
Depends who your 'real customers' are. If you're launching a product where the type of customer is the type of person who would use product hunt, you might get customers. If not, you probably won't.

Promote your product where your target customers are. (Also consider the audience for promotion style. If your doing tech services cold emails or being contacted cold on linkedin is a great way to get on a product blacklist. Never annoy the people who control the spam filters.)
the core issue with GIT is this: it requires cognitive overhead. JJ doesn't seem to solve that.
The fact that he's a solo dev giving his project away for free (even for a limited time) is a good enough reason.
Can you link to any comment in this thread of someone actually claiming that?
> I would assume that the claim that "most users on Product Hunt are developers, designers, or founders" has always been true.

Their user base is narrower than that, IMO. Actual founders (not just wannabe founders) are too busy to be scrolling Product Hunt all day. If they do, they’re more likely to be there to rip off your idea than pay you for it. Developers prefer sites like HN or engineering blogs.

Product Hunt caters to product managers and designers.
Doesn‘t seem to work in Safari?
But does `printf();` return to the caller unconditionally?

This is far from obvious -- especially once SIGPIPE comes into play, it's quite possible that printf will terminate the program and prevent the undefined behavior from occurring. Which means the compiler is not allowed to optimize it out.
Red Hat 8 (maintenance support until 2029) has openssh-8.0 which is too old to be affected. I suspect other LTS distro may have openssh older 8.5 too. So the number should be below 99%.
This kind of attack on people for disagreeing is what most of us come to HN to avoid. Conspiracy theories are fun entertainment but anathema to discussion.
> Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept.

It's pretty bad, but not trivial to exploit, especially since most machines are 64-bit with a larger space for ASLR.
String diagrams are also pretty confusing if you're not already very comfortable with category theory. They exist to make complex equality proofs a little easier, but the underlying proofs themselves are not easy to follow.
Meh, even with change, in the future, we may still have segregation, or slavery, or no women voting. (Most probably, all three.)

Change, simply "is". It's not "good" or "bad" in and of itself. We shouldn't be using it as the basis of an argument for or against some particular thing. We should, instead, argue the specific merits of that particular thing.

Killing people for thought crime is "bad", in my opinion, because the person may not have intended to commit any crime. He might have said, "John should not have torn pages from the quran." And at the same time had no intention of an angry mob descending on John's home to burn John and his family to death. But for a lot of crimes, in the legal codes of many places, it's not necessary to prove "intent".
The compiler is moving a potentially UB operation above a side effect. This contradicts uecker non-time-traveling-ub and it is potentially a GCC bug.

If you want an example of GCC removing a side effect that happens-before provable subsequent UB: https://godbolt.org/z/PfoT8E8PP but I don't find it terribly interesting as the compiler warns here.
Cool!

Does this also mean that one could put most of the closed source part into a DLL, make a shell executable that is open source and statically link LGPL code into the latter? This then would allow modifications to the LGPL code to be put in just by having the closed source DLL.
My app is around 500 KB (not megabytes) and it supports dark mode (see https://www.abareplace.com/). So this is definitely possible without using Electron or bloated GUI libraries.
Nah. If something is 'safe', it's safe, period. If something is safest is, it's only the best of the available options and not necessarily 'safe'.
It's a great book. What are you smoking
I disagree, it's a conspiracy. There is evidence from the past where the Pakistani government tried to fight Islamic radicalism, but the mob was stronger and even threatened to kill government officials.

(I have another conspiracy theory: People who try to blame it on the government try to do so because they want to make the people, or Islam, seem less bad.)
There are a lot of things that date it, but for me one of the things that seems most grounded in the early 80s is the description of connectors and converters. If you ever had to deal with non-standard serial ports, or the plethora of different SCSI connectors then you’ll feel the pain of needing to connect two things and desperately searching for the right cable to do it with.
It's not extraneous.

https://en.wikipedia.org/wiki/Fully_qualified_domain_name
A surprising number of systems are apparently on an old enough version to be unaffected; ex. RHEL 6-8 aren't vulnerable.
Robot cats, dogs and birds are being deployed amid an 'epidemic of loneliness'
In Firefox I use this extension for the same purpose

https://addons.mozilla.org/en-US/firefox/addon/work-offline-...
Is this supposed to be an argument why he "should" have kept his keyboard shut? Because it does not seem coherent.
I click "find jobs" and it takes me to the jobs section. Works perfectly!
Which is both true and also missing the point.
The contemporary "Left" has become more ideological than the "Right". It rests assured in dogmatic belief that is reinforced through popular culture. The Right, no longer easily defined by a neat ideology of its own owing to the absolute discrediting of traditional Rightist thinking and the hegemony of liberalism, has become a heterogenous bag of all who oppose the prevailing Leftist dogmatism/dogmatists.

This has the effect of producing a very unruly, disorganized and chaotic set of ideals, but if we step back and recognize that dogma and ideology is inherently dangerous and must be checked, for it cannot check itself and is liable to rampancy, we recognize that the diversity of thought currently on display among the Right will be necessary for future progress.
> I have a conspiracy, that our economy is so utterly shit that our govt uses such lynchings as a release valve. Hey, inflation biting you? Go kill someone and set them on fire, let that pent up stress out.

You are not completely wrong here, I'd speculate that it also plays on two desires that people have: unite around some common enemy (let's say blasphemers/infidels), and feel having power. Mob lynchings give it to them, although I'm not sure if abundance of such events won't drive them for more. The life won't become less shit, but as long as people feel they "fight a good fight", it doesn't matter much to them.

I'm wondering what is the survival strategy in such places.

Pray, and keep your eyes open wide for an opportunity, too.
Given it's free, it might be worth open source the project, or at least opening it up to community plugins so that community can build & fund additional functionality.
'Qt for Application Development Enterprise - Small Business (ADE-SB)' is $499.
3 megabytes of hot ram.
> Data extraction/structuring data is the only serious application of LLMs

I fully agree. I realized this early on when experimenting with GPT-3 for web data extraction. After posting the first prototype on Reddit and HN, we started seeing a lot of demand for automating rule-based web scraping stacks (lots of maintenance, hard to scale). This eventually led to the creation of our startup (https://kadoa.com) focused on automating this "boring and hard" problem.

It comes down to such relatively unexciting use cases where AI adds the most value.

AI won't eliminate our jobs, but it will automate tedious, repetitive work such as web scraping, form filling, and data entry.
Talking through the inevitability of death is a fixture in philosophy and really does make it easier to bear.

One of the most popular works through the middle ages was Boethius's On the Consolation of Philosophy, a treatise on not lamenting death through philosophy. Of course, the author's point about speaking about consolation is often for the speaker, and Boethius was no different.

Formerly one of the most powerful men in Rome, he wrote the work while imprisoned by the Ostrogothic king Theodoric the Great and facing imminent execution on sham charges of treason.

Sure, it's not a terminal illness, but he was rugpulled to death in a very similar manner. It's basically basically Martis cum Moriar and I highly recommend it for anyone concerned about death, dying, the inevitability of decay.
You don't think Ukraine is allied with western Europe? The assassination attempt on Yuschenko was clearly trying to remove the western-friendly democratically elected president of Ukraine. The people of Ukraine, by majority, are overwhelmingly interested in being closer to the west, though their interest in NATO has only been recent. That interest has been reciprocated broadly by Europe and by the EU, much to the displeasure of Russia.

https://en.wikipedia.org/wiki/Viktor_Yushchenko#TCDD_poisoni...
https://en.wikipedia.org/wiki/Ukraine%E2%80%93NATO_relations
https://en.wikipedia.org/wiki/Ukraine%E2%80%93European_Union...
Hmm. How could that be when it's based on Qt?
Show HN: An API to fine-tune Whisper AI Model for high fidelity transcriptions
A consolidated API to fine-tune whisper models for scalable and cost efficient transcription and translation of audio files.
As a hypertext purist, I used to think this. But working for a large organization, shortlinks can be an invaluable way to actually maintain the integrity of links that have been deployed to unrevisable media (emails, print, pdfs, etc).

If a resource has been relocated off of a host/url, often part of that situation is that we don't have immediate access to implement a redirect from that host to the resource's new location.

Now I see a shortlink manager as a centralized redirect manager, which is so much more rational and stable than creating a tangle of redirect config across dozens of hosts or hundreds of content applications.

The caveat is that you don't need to use a 3rd party domain or service, you should definitely at least use your own domain. You also don't need to make them unreadable hashes, they can actually be more human-friendly.
Every job pays money, mostly around the same range (at least in your search range)

Sure, if a company offers 2x pay, I'm there for the money. But otherwise, asking why they want to work specifically for you is a proper question. And I never came across of the 2x company.

"Why do you want to work?" is a very different question than "Why do you want to work for us?"
Interesting. I tried to read it in the late 90s and bounced off it, I wondered if it was “you had to be there” thing for the 80s.
Yep. In your description, maintain the present tense. IR isn't a calling, it's a sentence.

> ... was multi-ethnic with...

So was Han, so was Tang. Basically all the good periods.

Fast forward to Xi's COVID: great excuse to kick the foreigners out. What. What do you mean our forex is tanking? Come back, investors! We're "open for business"!
https://archive.is/BAjal
I am more terrified of getting old. I don't have much on my to-do list and every year feels like I get weaker and more things become impossible forever

I guess dying is just the final form of that
> Wouldn't a good systematic evaluation need (or at least benefit from) a few actual working exploits/PoCs?

Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install.

> I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense.

The point is they have very little in the way of containing attackers and restricting what they can. Until pledge and unveil, almost all their focus in on eliminating bugs which hey, great, but let's have a little more in case you miss a bug and someone breaks in, eh?

An insecure dockerized webserver protected with SELinux is safer than Apache on a default OpenBSD install.
Justice at the service of whoever has the bigger wallet. :/
Ask HN: Is investing in non-tech stocks sensible at this point?
I was talking to a friend about investing and he was adamant that it only makes sense to invest in tech stocks at this point. I kept saying that this was only because tech was having a bull market for quite some time, but I was getting less reassured myself...

According to him the 7% to 10% that you get from investing in the whole market is too conservative and you would get 15%+ conservatively if you invest in a tech index or fund. And if you invest long term the risk difference is minimal.

I then tried to come up with scenarios in which tech would implode, but I honestly don't find those plausible. The US gov would certainly step way before that point, as a last measure of resort.

I'd be interested in hearing your opinions.
For my own setup, I'm looking into Path Aware Networking (PAN) architectures like SCION to avoid exposing paths to my sshd, without having to set up a VPN or port knocking.

https://scion-architecture.net
SEL4 and derivatives.

For starters.

And if you want to simply go by vulnerability counts, as though that meant something, let's throw in MenuetOS and TempleOS.
I wonder if a one-way trip with an impactor would be useful. It would at least be easier than a roundtrip journey to and from solar escape velocity.

Also, it seems like the space base weapons treaty is being ignored now (https://spacenews.com/russia-vetoes-u-n-resolution-on-nuclea..., https://www.npr.org/2024/05/30/nx-s1-4975741/what-to-know-ru...). I wonder if there is an opportunity to do some science with space-based lasers and spectroscopy. The energy would be small, but then again we can learn a lot just from the off-gassing created by the sun’s photons as well.
> ... instances where tests are written too early ...

omg yes. However, reading this makes me wonder how the TDD people handle this.
I really hope you charge money for it and make it awesome, it's about time Adobe gets disrupted and this is a wonderful idea!

It will take significant resources, cash and teams to make this into a serious contender, and folks that have problems to solve will always be happy to pay decent dollars for great software.
We have to use this exploit to update a critical raspberry pi that nobody seems to have keys to...
America has helped prop up Pakistan and actively interferes with its politics.
Even better a failed nuclear state