skysight-inc/HackerNews huggingface dataset:
I wasn't trying to say my lumber mill would be affected by a land tax, though presumably they would if a land tax was imposed here and a different business could theoretically extract more value from that land.

I raised a local mill as an example of how a less dense area can also lead to higher efficiency and lower resource use.

I was responding to the idea that we need a land value tax to push us towards higher density living because that's the most efficient. Its only efficient if we have centralized infrastructure that will always have to be shipped across the country or around the globe to get basic goods to people. I used my local mill as an example of how lower density can lead to resource efficiency that will simply never be beat no matter how efficient a centralized industry and shipping is.

Does it scale? Well I have no idea. Do people want the life in a less dense area? Again, no idea and I think most people living in a dense area don't really know what that life would look like to answer that question. I have plenty of uncertainties for either approach, what I don't want is for a central planner to push one path on us when its not clear the right way to go
From the article:

> The 'node-ip' project exists on the npmjs.com registry as the 'ip' package
From someone who I think works for GitHub: "We think that GHSA-78xj-cgh5-2h22 still has potential, albeit low, security impact. We believe it makes sense to keep the advisory but to lower the severity to low."

https://github.com/github/advisory-database/pull/3504#issuec...
“The shape of the ancient thought” by Thomas McEvilley goes deeper into this:

https://www.goodreads.com/book/show/925680
Great, thanks, I'll spend some time with that.
I'm using WAL mode - I'd almost given up on sqlite until I remembered to enable it.

I've been playing with benchmarks, yes! I haven't written them up yet because I worry about doing them the "right" way. but since you asked, I did a quick test with a single server and single client on a t2.nano. With 3 sending threads and 5 receiving threads, and mesg size of 2kb, I can send 700 msgs/s and receiver 500 msgs/s.

It is way faster on my laptop, and I have a lot of tricks that I've been playing with to improve this.
Cheyenne is less than 20 miles from the Colorado border, 56 miles to Fort Collins, CO, 46 miles to Greeley, CO. Fort Collins has 25,000 student Colorado State University, Greeley has 9,000 student University of Northern Colorado. University of Wyoming, the only 4-year public school in the state is 51 miles away. Educated workers will be recruited and drive from Colorado.

I hope Wyoming and Cheyenne governments haven't given too much in tax breaks and incentives for this, the take home pay and sales tax is going to Colorado.
node-ip is the name of the repository. The node package is apparently just named ‘ip’.

https://github.com/indutny/node-ip
Not quite right - that’s a back road. This is I95:

https://www.onlyinyourstate.com/maine/welcome-to-maine-me/
Energiewende is a failure in both technical and economic senses: half a trillion euros spent to get a more expensive and less reliable power grid, and a fleet of perfectly functional nuclear power plants were spitefully binned.
I'm surprised they can even reach $800/mo.

But there are multiple other avenues for revenue. One can sell merchandise, such as the ever-popular band t-shirt. And there are still many who will want to buy an official cassette rather than just download a song. There are also paid gigs - a live performance is not replaceable with a download. One can livestream a performance, and get paid for the ad placements.
It's about https://www.npmjs.com/package/ip
Race realists would do well to remember that, if you were a Mediterranean or Asian a couple of thousand years ago, the empirical evidence would have persuaded you that Northern Europeans were a lesser race: https://elfinspell.com/PrimarySource54BCCicero.html. History could have turned out very differently if the Romans hadn’t invaded bringing technology and civilization to Europe.
So if Perplexity ran locally, you would be alright with it?
My experience is that it’s not higher end commercial users who would actually harass the dev, but lower scale commercial users who don’t care and the license wouldn’t scare them off.

Any large company that would care about the license, would also have terms on their employees to not directly interact with projects and would likely internally patch it if needed instead.
IP the node module used regular expressions to validate 32 bit numbers and failed at it.
It may be, but perhaps there is some performance concern? I’m not familiar with this domain and application so it’s not clear to me whether the decisions made are sensible just from reading the code.
This looks great! How were you planning on tackling distributed?
Coca cola was still a sports thing in the 90s to the point where I remember being told (maybe apocryphal) that one of the reasons Sampras threw up during the coretja match was he was drinking coke instead of Gatorade or water.
Also from the article:

> The popular open source project, 'ip' recently had its GitHub repository archived
Keeping questions from scale & benchmarks aside, this is a cool thing for functional/unit testing module that uses SQS, instead of dumb mocks.
Lightning Source, now part of Ingram. Wouldn't recommend them for working with you to get your book on shelves, and this was before POD really took off so I'm sure there's better alternatives these days. The print quality was top notch though.
Archived version of the medicalxpress.com article: https://archive.ph/2024.06.30-162004/https://medicalxpress.c...
The package author has a point

> the verification process of vulnerability reports doesn't involve maintainer at all, and it sounds like the commercial interest of advisory repositories is aligned with creating more vulnerabilities and proving themselves “useful" to companies that utilize them.
I agree. I really hope that they improve it.
Frankly, the end of the article where it says that CNAs don't have the time to verify the vulns being reported for new CVE issuance, is the real problem.

If you're an authoritative entity over a system (CVEs) that can break production systems (and to be clear, NIST recommends blocking builds/deploys that contain high CVEs), then it's also on you to make sure you're not issuing bogus CVEs.
Given the sheer thermodynamic effect of the earth's rotation I have to ask what would it even take to get 2 weeks without wind? It would probably take at least globe spanning superconductors or very careful heating of the world to ensure constant temperatures in order to not have wind from the temperature cycling. That is 'Dyson sphere builders fooling around with their power for laughs' territory.
Yes, and I think that is a very reasonable policy overall. I was screwed by Centos when they suddenly dropped the support from Centos 8 and moved to Ubuntu. So far I've been very satisfied. Canonical has figured out that you can make money without screwing over your users.
Most of the CVEs I have to deal on my $DAY_JOB are regular bugs, not security issues. Nowadays CVEs are like bitcoin mining but for the security folks.
This is ridiculous. The "AI" frenzy has jumped the shark.
I concur. Any time I see tangles of regexes and if statements, it's going to be full of holes. I spent several months replacing messes like this with proper parsers and you'd be surprised at how many fuck ups fell out of the mess.
You're both just repeating the "you wouldn't download an apple" argument. In the context of the Internet, you're voluntarily sending the user an apple and expecting them to not do various things to it, which is unreasonable. Nothing is taken. If it were, your website would be completely empty.

Remember, Copying Is Not Theft. Copyright law is just a temporary monopoly meant to economically incentivize you. Nothing more.

BTW, pro-AI countries do differentiate between private and public posts. If it's public, it's legally fair game to train on it. If it's private, you need a license to access it. So it does matter. Also see: https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn
It seems absolutely insane that this would get anywhere near a 9.8 severity considering that the windows RCE over wifi scored 9.8 as well. Who makes these scores?
A testcontainer could be useful. I use always this adobe-mock from s3 for my test. Hmm.
To keep the elderly from feeling lonely?
If I understand the origin of the case, a Federal agency decided that fishing boats had to bear the costs, some $700/day, of a mandatory monitor (usually a person with marine biology and stats knowledge, I think) that travels on the boat.

So every week the boat is operating, is another $3500 in costs added on. This was not something that was in the law, it was decision made by the agency to shift costs off their budget and onto the companies they regulate.
Yep, I think you should store the source file (the .drawio file for drawio) as an attachment of the edited document and call the dedicated editor whenever someone wants to edit it with it, but also save the rendered file to be used to display the result when displaying the document or during regular document edition.
It doesn't seem like that odd of a choice. What else would you use?
There's an interesting point hiding in the article about security being an emergent property of the whole software system.

Many libraries are flagged with CVEs because they can be used as part of the trust boundary of the whole software system, and they have corner cases that allow certain malicious inputs to give outputs that may be surprising and unexpected to the clients of the library. The library developers push back and say "Can you point to one real-world vulnerability where the library is actually used in the way that the CVE says constitutes a vulnerability?", effectively pushing the responsibility back onto the clients of the library.

But that's exactly how real malware usually works. Individual components that are correct in isolation get combined in ways where the developer thinks that one component offers a guarantee that it doesn't really, and so some combination of inputs does something unexpected. An enterprising hacker exploits that to access the unexpected behavior.

There isn't really a good solution here, but it seems like understanding this tradeoff would point research toward topics like proof-carrying code, fuzzing, trust boundaries, capabilities, simplifying your system, and other whole-system approaches to security rather than nitpicking individual libraries for potential security vulnerabilities.
Britain is going down the toilet, but it is not going down the toilet that badly.
This was my first thought? The amount of effort I have to go through verifying what I get from gpt makes me wonder. On the other hand, there I’ve been thinking about how it might help me read datasheets. There are details that are easy to miss when skimming, that may be easy to verify through simple text searches.

That said, I know someone who almost took a job writing the actual text of laws, and they were excited about it because, while they didn’t control the laws in general, comma placement allowed them to subtly change the law’s meaning.

I currently would‘t trust an LLM to understand subtle comma placement.
Truthfully, I don't know yet - I haven't even built a paid/hosted version at all. It is related to my existing business in the sense that it deals with realtime data.

But I started working this as something I wish existed as opposed to having some big VC strategy and pitch deck behind it.

(Also, I appreciate all of your feedback on this a month ago! It was really helpful to encourage me to keep looking into this and also figuring out the "first" things to launch with!)
Yep, they got renamed a few months ago in-game and now many many more people know what sherds are.
Then it's the time for a public funded and steered project.

There is more indeed https://www.stellantis.com/en/news/press-releases/2024/janua... or https://arstechnica.com/?p=2019282 to show some I've read about relatively recently but being private initiative they are constrained by money and competition a public Xerox PARC alike project would have no such constrains.

About Chinese EVs yes, they show different software, but that's at the infotainment level, car core systems are essentially interchangeable and so are many parts, you can find the same on a SAIC, BYD, CATL, BAIC, Xpeng, Geely, Voyah, Chery, Changan and so on.

> I think you don't know what software in cars even is

Not in details, but I see the same pattern, a "core" part, with some buses and standards, mostly canbus and ODB, to communicate between core elements and in infotainment part in a tablet, hooked to the core for simple communications. Since all functions are pretty the same for every car because you can let's say design gazillion of breaking techniques, differentiating the break force/pulse per wheel, with various sensors to choose how and so on, the devices you actuate and the sensors you use are essentially the same the same. Of course at a very low level you are tied to the specific iron, like inside a CPU, but just above there is so little difference that you can have a common software stack. Failing to have one is a way to keep costs high while China get ground even if they are terrible at software.
Correct. The scientific experiment was the lack of water.

> James Sullivan, the chief organizer of the games, wanted to minimize fluid intake to test the limits and effects of purposeful dehydration, a common area of research at the time.
I should provide a photo submission - there are some much nicer ones for Wisconsin at the Illinois border.
I don't know if it's a lot, but I drink 3 cups a day, with the last one usually around 6pm, and I don't have any trouble going to sleep around 10-11pm, usually fall asleep the second I put my head down(but then I never had any issues going to sleep).
I’m generally in favor of not trying very hard to get more users for open source software. More users means more problems. What’s in it for you?

The trouble is that many software developers have jobs. It sucks to work on open source software that would be useful, except that you can’t use it at work due to the license. (Possibly at a future job.)

If you fully control the software then you can dual-license, but it’s a more difficult negotiation than “it’s yet another npm with a standard license.”
Coca Cola is still a thing among amateur endurance athletes (think cycling for days with minimal rest) and there's nothing inherently wrong with it. It's just water, plenty of sugar and some coffeine.
Nah, people should pay, at least a minimum amount for others's work. Look at open source, it's a mess, exactly because of the nonexisting payment layer. And what they used open source code? To bootstrap llms, for free.
The birth, life, and death of grunge.
Minor thing - the gif browser demo should have been maximized. The video zooming into the action on what would have fit onto a single screen was distracting.

Are there maintenance actions that the admin needs to perform on the database? How are those done?
It's using GPT-4
Bullsh!t plays a big role in a capitalistic economy. Or as corporations prefer to call it --- marketing.

Prices tend to be set based on whatever the market will bear --- and so is the level of bullsh!t. Both tend to get moderated over time as reality settles in and consumer awareness starts to develop.

Where AI/LLMs are concerned, we are currently near peak bullsh!t.
I was not aware of testcontainer until you just mentioned it! I have a very basic Dockerfile for deploying to fly.io. What/how would I get started?

It looks like localstack is a supported testcontainer and they do support SQS (but I haven't tried it myself.)
This is an excellent antidote to the terrible hot takes floating around, to which I’ll add just one point: the implications of this case are mixed for both liberals and conservatives. Remember, Chevron itself ruled in favor of an oil company and against an environmental non-profit. Chevron greatly curtailed efforts by the left to force agencies to give effect to the full scope of regulatory laws.
I don't think superintelligent AGI will occur in our life span.

That said, most investment in ML/AI is around applications of ML in automating specific domains.

My argument is against this:

> FOMO investment completely pointless

I have an example of a 10-11 figure TAM industry that is actively in the process of migrating to being majority automated, and there are plenty of other industries in the midst of this as well.
No, I really mean things that shouldn't exist at all. I see it used a lot by marketing people generating press releases nobody really cares about, online media generating images for short useless pieces meant to be filled a space between few really useful articles etc.
It's testing using regex, which is much less performant than converting an IP address to some numeric representation and running comparisons on that.
> For example, IBM, the owner of Red Hat, forbids the use of GPL3 software on their equipment by their employees.

This I can understand. But the fact that they joined the witch-hunt for Stallman after the slandering piece by Selam Gano, who knowingly presented untrue statements as facts, and these were later picked up by mainstream media (some of these lies are still out there uncorrected[0]), that is still beyond me.

[0] Google for "Stallman defends Epstein", e.g. https://techcrunch.com/2019/09/16/computer-scientist-richard...
Likewise, plenty of people who care about the customers and their coworkers as well. Collaboration with such a teams is where it’s at.

In my experience such situations are transitory though and a time comes to move on (gracefully and maintaining accountability for one’s own actions).
> I drink it because I enjoy the taste and that's where it ends.

Coffee is a very bitter drink. I don't know you of course, but my guess is that what you like more is the dopamine caffeine releases in your brain, which you've now associated with the taste. You can try and experiment with good decaf coffee to see if it is actually the taste that you like.
I've burnt out on work multiple times and it's not fun, but to be honest the first paragraph is not how it felt at all. The word burnout didn't even come to mind until I read the other comments. At the risk of armchair diagnosis, it sounds like it could be depression. It is worth bringing up with a professional. Wish you the best, hope you get through it, whatever it is.
This doesn't seem like a fake CVE? I'm sympathetic to the maintainer, and I don't know that I would have acted any differently in his shoes, but the report correctly describes a possible scenario where the issue could defeat a SSRF check.
Your first sentence is a little confusing, but I can confirm that Google, at least, uses lots of open source software, and the build system automatically checks that all the third-party libraries used in an executable have a suitable license. [1] They also vendor everything and will patch security issues locally.

It’s been a long time since I worked there, but I don’t know any reason that they wouldn’t send a patch upstream as well.

[1] https://docs.bazel.build/versions/0.24.0/be/functions.html#l...
Water with lots of sugar is wrong, when your body needs water.

So drinking water and a sip of cola is fine, but drinking cola against thirst has side effects as you need water to process lots of sugar.
> 90% of candidates (regardless of IC vs. manager, regardless of seniority) loves to ask what the company’s AI strategy is, or “how will AI impact your business in the next 5 years?”

It may be possible that they just want to sound as if they are "aware" of the latest trends, especially considering how often companies talk about it.
You cannot try to rationalize the prices that China charges for goods. Everything is, more or less, state-owned and state-controlled.

If the Chinese government wants to undercut an American product, they will tell the manufacturer to drop the price to X, and the manufacturer will comply.

This also does not take into account Chinese currency manipulation.

Profit or loss be damned.
Ask HN: How to prevent Apple sherlocking your app?
How can you prevent, or at least make it difficult, for Apple to replicate your app's functionality within their platform?

* Is developing companion web and Android apps to link with your iOS app the answer?

* Or should you focus on making your app so advanced and sophisticated that Apple can't compete, like Procreate for iPad?

* Do you believe Apple will eventually absorb all features developers could create, forcing programmers to work for them or a handful of other corporations?

* Even if Apple creates a free, built-in replica of your app, will users still download yours?

This practice raises concerns about Apple's monopoly. It's similar to:

* A brewery constantly buying nearby bars and forcing unfair contracts on those it doesn't own.

* A car manufacturer copying suppliers' products and integrating them into their cars, pushing the suppliers out.

Isn't this a bad business decision? By squeezing out developers with each iOS version, wouldn't Apple's platform become less innovative by removing potential app ideas?
AGPL for extra garlic.
Is Arizona’s sign for California some sort of dig at how folks are leaving the state? lol!
Yes, you can drop older clients in which case the advertising rate is higher (not sure how clients can handle becomes at arbitrary speeds but it does seem to work). However BT does not provide for this kind of control.
> It may be, but perhaps there is some performance concern?

I'm skeptical of that concern: executing multiple regular expression matches on a string is never going to be faster than parsing the entire string once, into a 4-octet structure, and then performing integer comparisons on the octets.
It seems like there should be some authority weight baked into CVEs based on history or upvotes from credible companies (with higher authority). Need some tree structure to manage the growing scale.
i would say that even if you don't want to label it as burnout or depression, absolutely pay attention to the symptoms you're experiencing, because they are worth addressing with or without a label on it.

i had a burnout experience a few years ago, and didn't realise until i got a very strange symptom. i was constantly thirsty for water, even after drinking two litres of it. apparently this is a stress-symptom some people experience.

to give you advice:

if you want change but not sure where to start, simply pick one small thing and see how it makes you feel. you have mentioned starting your own business... perhaps start sketching on it and observe. listen closely to your mind and body as you go through the process, did it light a fire or feel like a chore? imo, sitting around thinking about doing things is a mind-numbing experience, it's by going through them we get information about what it means.

if you're actually ready to leave the life you're in and looking for validation, watch Office Space. it will calm your nerves and make you feel great about switching directions in life towards something more meaningful. i sent it to my brother when he had a similar crisis and it helped him.

best of luck!
I remember a Node.js library I worked on completely broke after a Node.js security update disabled a encyption feature. I don't think anyone could come up with a tangible exploit chain but the Node.js maintainers made the breaking change anyway because of the CVE. There was maybe one guy bringing attention to the CVE and 20 or so more people complaining about broken production applications. I wonder at what point people give up on CVE notices and just don't update for security patches when the majority of CVE reports are bogus anyway. I know the Node.js library we work with had about 10 security notices on npm audit. But none of them compromise the libraries security in any way. People still try to remedy them with npm audit fix but that just causes there dependencies to break completely.