skysight-inc/HackerNews huggingface dataset:
> "it's just the way older languages did"

It's a C family (predecessors and descendants) idiosyncrasy that very unfortunately got out of hand. Most other old languages had either 1-based indexing or were agnostic. Most notably FORTRAN, which is the language for numerical calculations is 1-based.

The seminal book Numerical Recipies was first published as 1- based for FORTRAN and Pascal and they only latter added a 0-based version for C.

Personally, coming from Pascal, I think the agnostic way is best. It is not only about 0-based or 1-based but that the type system encodes and verifies the valid range of index values, e.g. in Pascal you define an array like this:

temperature = array [ -35 .. 60 ] of real;

You will get an immediate compule-time error if you use

temperature[61];

At least with Turbo Pascal you could chose if you wanted run-time checks as well.

I have a hard time wrapping my head around the fact that this feature is pretty much absent from any practically used language except ADA.
I don't think there is enough nuclear fuel for everyone to significantly (more than several times than today) run on nuclear. Yes, there are these breeder ideas, but it's not mature. So (aside from capital costs) it will generate only a relatively small portion of total electricity consumption.
A Wearable Device That Makes You Blink When You Should Blink
The problem of browser extensions having "too many" capabilities allegedly boils down to some small subset of users stupidly or unluckily installing dodgy extensions and Chrome wanting to prevent this. But people are always going to do dumb things; outside of browsers, they're going to smoke cigarettes, they're going to drink and drive, they're going to eat too much junk food. How far are we willing to restrict freedoms to prevent dumb behavior? How many corners are we going to round off to prevent misfortune?

From the perspective of a typical HN reader, Google and Mozilla have turned into Internet nanny states with Fisher-Price browsers. How far can they go in the name of "safety" before it's too far?

Not to mention the problem the article highlights: their motives aren't pure. The more control they give themselves, and the more inconvenient third parties they marginalize, the more money they stand to make.

Also, it's not a perfect A or B between flexibility and security. They could require extensions to be more open and inspectable so users could catch bad behavior. They could better police the extension store to catch malware faster. They could add more layers of warnings and permissions dialogs to prevent accidental compromise.

At any rate, whether due to incompetence or malice, the situation is not as one-sided as Google pretends it is.
Is this growth-hacking?
> As uuid v7 hold time information, they can help bad actors for timing attacks or pattern recognition because they contain a time information linked to the record.

Are you then not doing security by randomness if that is the thing that worries you?
If the article wasn't paywalled it looks like it goes into exactly that.
The same place the “missing money” goes when stock market crashes.
As an aside, I with Americans would stop using _legos_ as the plural. (Most of) the rest of the world uses _lego_ as a mass noun.

The company itself insists though that it should only be used as an adjective :D:
https://x.com/LEGO_Group/status/1359856214591627269?lang=en
Well, yes, Lego sets are super fun for everyone. Even shoplifters.
Achieving Energetic Superiority Through System-Level Quantum Circuit Simulation
I remember being like 15 and being excited about vrml. I think I knew one page with a working demo, and I used to tell people it was going to be the future.
Don't know why I got sniped into this on a friday night, but here's clang-tidy with only cppcoreguideline checks enabled, against every example:

First example: https://godbolt.org/z/898rorEqG

Second example: https://godbolt.org/z/K6aceesG9

Third example: https://godbolt.org/z/KcbqzMzdK

and I can't get the fourth example to compile without fixing the problems.
I was at University, doing a lot of typing, and complained about wrist pain. The IT dudes pulled this dusty old Maltron out of storage and gave it to me. Once I got used to it, I loved it, and Uni let me keep it when I left. I unfortunately had to stop using it because it had a PS/2 connector, everything was moving to USB, and I couldn't afford a new one at the time. I'm hoping my current keyboard (MS Natural) will finally die so I can justify getting a new one.

I haven't used a Kinesis, so can't compare to it (though Kinesis is supposed to have copied their design, so I guess it's very similar.)
That's what people do with tools like Kryoflux; the head of a floppy drive doesn't touch the disk, it floats above it and picks up the magnetic flux. https://www.youtube.com/watch?v=UxsRpMdmlGo covers a lot of it.
Not Legos or Lego: LEGO. All caps.

For example: https://www.serious.global/LEGO-SERIOUS-PLAY-Trademark-Guide...

(It also says when you speak the word you're supposed to shout it as if you're scaring off birds. If you look down there on page 11.)

Danes are weird.
Ask HN: Do you use AI for writing?
I'm working on a docs site for the AI coding tool I built [1], and I had to turn off GH Copilot for markdown files.

As massive as I find the productivity boost from AI tools for coding (> 2x for me conservatively), with current capabilities I find it's a net negative for writing prose, even technical prose.

The problem is: I like to think I'm a better writer than an LLM, but writing is hard. Every paragraph, every sentence requires a small shot of mental energy to get right. And what the LLM suggests is never bad. It's always like, "yeah, that could work." And that's the problem. It's good enough to be seductive. To make me want to skip that little bit of effort and auto-complete the sentence, auto-complete the paragraph.

But the end result when I do that is missing something. It's grammatically correct and substantively correct. It's fine. But it doesn't grab the reader and pull them through. It's text that remains text and keeps the reader at a distance.

The core problem, I guess, is the lack of a human voice. There's some kind of essential weirdness that is missing. This generally isn't a problem for code. In most cases, code that is boring and generic and anodyne and does the job it's supposed to do is good code.

It will be interesting to see how this changes as LLMs continue to progress. Is this a fundamental limitation of the technology or a minor hurdle that will be quickly overcome?

If I could write docs with AI that would genuinely pull the reader in and hold attention better than my own writing, I'd be happy to do so. It's not sentimental for me. But for now, Copilot will stay disabled for markdown files.

1 - https://github.com/plandex-ai/plandex
That cherry-picks several studies
Shameless plug, you can use wstunnel which disguise your traffic as websocket to tunnel any traffic you want. I had most success with it, as it uses TCP, than with QUIC/HTTP3 as usually UDP is more heavily restricted.
It works behind GFW and let you use your wireguard for example...
I had also good feedback from people in Turkey and Iran

wstunnel: https://github.com/erebe/wstunnel
This and Visas always make my heart skip a beat.
I appreciate the shout! To accommodate the influx of people coming to the blog, I updated the post to include IAM role assumption credentials as well. I hope you all enjoy!
Deep packet inspection. it's supposedly how the great firewall of China (GFW) detects VPN connections.
How much cash would it take for you to quit your job?
Sounds like you're in LA? Installing both solar panels and and AC on every home in America would be huge (there are quite many that have neither). It would be hard to have an AC you power yourself be rationed.
What's a good cheap invertor vendor from china these days?

We are looking at ordering a lot of these systems in Ukraine to deal with russian attacks on power grid
Weird agenda, bringing politics and California into this.
I have the Brother P-Touch CUBE PT-P300BT and “pwned” it (not really) some time ago. Using this code as a starting point [1], I set it up with a FastAPI backend serving an HTML+JS frontend on a Raspberry Pi Zero 2 W. I connect to it using a browser, design the label, and it prints via Bluetooth. One of the first options I added to the interface is the “no feed” checkbox, which I use when I know I’ll print more than one label in sequence before cutting.

My idea is to add another endpoint to the API so that using Whisper or Siri, I can say, “Print Eggs and today’s date” or “Print Coffee in medium size.” I use something similar with an Alfred workflow, but voice commands would be nice in the kitchen.

I hate when someone talks about a project I’m interested in but doesn’t share any code. However, the entire thing is so ugly that I’ll never permit any other human being to see it. I’ll incorporate a Dead Man’s switch to delete everything or burn the Raspberry Pi, if needed.

Anyway, it’s all very simple once you realize that Fabric.js [2] handles 80% of the interface and functionalities on the frontend. Probably with Aider [3] and Claude Sonnet 3.5, you can make it during breakfast (or 7 years: I’m a dev, so I’m VERY bad at time estimations).

[1] https://gist.github.com/vsigler/98eafaf8cdf2374669e590328164...

[2] https://github.com/fabricjs/fabric.js/

[3] https://github.com/paul-gauthier/aider
This one is good too

https://xkcd.com/1171/
The British Library online scan is fantastic and well worth a close look. They also have pre-restoration images of the scroll. Seeing it in person is a little disappointing since they only unroll a bit of it at any time.
Past the edit deadline, but s/confidence/convinced/
From UX and security perspective (especially for non-technical users), passkeys will be the default login method in the near future.
There's more to this:
https://www.le-vpn.com/le-vpn-responds-to-removal-from-russi...
Exercise in futility. We like our S's. I don't know a single person in the Midwest who doesn't say Meijers and Krogers, despite neither having an S in their name.
Also check out Andrej's new llm.c library which includes a script to do this from scratch with fineweb.
I am not in the least amused.
Say I store a password for service X on 1P.

The password becomes known to attackers somehow.

That doesn't mean they have access to my TOTP for the service, even if it's managed by the 1P app.

Loss of 1P's password/key would indeed also mean loss of my TOTP. But then one would have much bigger problems anyway, except if all their 1P passwords also had an external TOTP.
yes, birthday and birth day are different things. Just like everyday and every day have different meanings, and it isn't confusing (to most people).
It's a much needed tool!

I saw one more project do this with a credit based system, I read in this article: https://saasgodfathers.com/article/seo-tools-without-subscri...
Tactics and Keyframes: Visualizing Lean 4 Proofs in Blender [video]
Stumbled across this excellent video while searching for ways to communicate proofs in a presentation using lean4. Hope you also like it!
This immediately makes me think of TCL/Tk, back in the days where that was the lowest barrier to entry to get a basic X11 GUI app up.
The concept of zero was not popularized in 500s Europe, when the system was devised.
Only if the vault is cracked. If it's intercepted somehow, or pulled from a database dump, the 2FA token will still be secure.
If we're going to be really American and overuse caps, shouldn't we also be sticking in all kinds of unnecessary periods? Like: L.E.G.O.

Then someone can set about to backform the phrase being acronymed.
same in the UK actually. The supermarkets Tesco, Aldi and Lidl are frequently pronounced as Tescos, Aldis and Lidls.
Where do you get volume and CPC data? keyword planner API?
if your network is compromised I can read your password but not totp

if I hacked a website you’re registered to and you had reused your password I got your password but not totp

if I broke through your computer and password manager then yes it’s all over, but this is not the only threat model and frankly the least i am worried about
Ages are zero indexed, but people avoid saying zero by counting age in months in year 0, then switch to years in year one.
Why would I use this over existing js libraries such as D3
Agit-Flow and git-repo (2020)
I recently started reading it and I love it. Her style of storytelling is very unique. It feels very meandering in a way, but rather than that making reading feel like a drag, I feel like I end up getting more color on the world she built.
Seems to be “normal resources”, where normal probably meant file descriptor based.
Here: https://www.youtube.com/watch?v=A0PJ1KlxDtM
U.S. SEC Wins 'Shadow Insider Trading' Trial
The one about Lisp, Perl and God is good too.
I can't stand these articles. Why does it have to start with:

> As railways expanded across America in the 19th century, there was little law enforcement.

That immediately tells me this is going to be a filler of 20 pages, followed by 1 page of actual content.

I just can't read this, it's actively destroying all willingness on my end to make the effort of skipping all that filler part until the substance pops up.

Are journalists paid by the word on these websites?
Get around it.
Having a password stored + totp in a password manager does give the advantage of protecting you against the loss of the stored password itself.

Which becomes far less relevant when using a password manager, because people don't reuse passwords anymore. Password managers also autofill, so eavesdropping on a password is also not possible anymore. One of the primary vectors for compromising passwords is compromising the password manager, which would also compromise the TOTP codes if they were in the password manager. You have much stronger protection against that if your TOTP codes are stored on a separate device.

That said, TOTP is also pretty terrible because does not really protect against phishing (just make a phishing site proxy both credentials).

Hardware keys are the only really secure solution if you consider password manager compromise as part of your threat model.

Remember that password managers are comprisable, just look at LassPass' history.
Singling out "some" moms.
I'm a dad and I'll never RTO again. My work-life balance is near perfect now that I WFH.
DevOps like Agile was a beautiful idea with a coherent underlying well reasoned philosophy.

DevOps like Agile was then hacked to pieces and had its corpse paraded around by sleazy consultants and idiotic management that was told "you can save all this money on all your infrastructure people by making your developers do all the ops stuff to." And who doesn't like saving money on those useless crusty old system administrators that don't seem to do anything except whine for "more disk space" if they were so smart they would've prevented that outage la da t week where the logging volume filled up.

Finally the toolmakers sold the idea that DevOps was something you could buy. Just like the vendors convinced management that buy purchasing Jira you were now agile, now if you have a CI/CD pipeline you are now doing DevOps. But you still can't release without getting approval from the release committee and you can't actually provision a new host in the cloud until you have filled out the requsite approval forms, but key for some reason we uprooted our monolith and threw it on kubenetes so we are doing DevOps.

It really feels like relieving the Agile cycle all over again in every detail. Just wish I could figure out the next big fad so I could get in on this money printer.

PS. If you use the term DevSecOps or DevSecFinOps unironiclly your living proof the Dunning-Kruger effect.
https://www.kramerlevin.com/en/perspectives-search/in-echo-o...

The allegations against App Annie are reminiscent of the expert network cases of a decade ago when the SEC and the Justice Department cracked down on consultants who allegedly provided inside information to hedge funds, hedge fund traders who relied on that inside information to make trades, and expert networks that facilitated these information exchanges. As the alternative data industry comes to prominence, like the expert consultant industry before it, it will likely draw increased focus from the SEC and, potentially, federal prosecutors.

None of App Annie’s investment firm customers have so far been charged in connection with their use of Intelligence data, but funds and others who subscribe to alternative data sources should take heed and take proactive steps to ensure that the data providers’ representations are accurate and that appropriate measures are taken to ensure that subscribers are not receiving material nonpublic information.
If your 1password is compromised, then loss of the password would mean loss of the TOTP, in which case TOTP doesn't help.

But there are other scenarios where your password could be stolen without someone getting access to your 1password, for instance if your connection isn't protected and a man in the middle can intercept your password.

In the end, I would argue that having TOTP in the same place as your password is weaker than having it somewhere else, but it's still better than no 2FA
Can I ask (as a humble application developer, not a backend/database person), if the two requirements are:

1. The UUIDs should be ordered internally, for B-tree performance

2. The UUIDs should not be ordered externally, for security reasons

Why not use encryption? The unencrypted ID is a sequential id, but as soon as it leaves the database, it's always encrypted. Like, when getting it out:

SELECT encrypt(id) FROM table WHERE something = whatever;

and when putting stuff in:

UPDATE table SET something = whatever WHERE id = decrypt(<encrypted-key>)

Seems like the best of both worlds, and you don't need to store separate things.
Space, because tab is too good for daily use.
There are other fun ideas to explore e.g. if your external id is a hash you can rebuild, it might be an option to scavenge the full hash but keep the first few bytes of it, indexed. That increases lookup costs if the hash does not exist or has been scavenged but lowers storage.

In fact if your external ids are evenly distributed you can do that anyway, only index the few leading / trailing bytes of the id. That will increase lookup costs a bit but significantly decrease storage.
Latest Ghostscript vulnerability haunts experts as the next big breach enabler
They insist likely due to the “Kleenex” effect. Couldn’t find a good reference, but once an item becomes generic, it can loose copyright.

Article: https://www.nytimes.com/2019/06/24/smarter-living/how-a-bran...
LEGOs Engender Genius Offspring! (supposedly)
If restarting didn't take you back to the "Welcome" screen, the account was created, I suppose. Did he prompted for activation lock?
This is super nice

Keyword research should absolutely be a pay per use thing instead of a SaaS. So many marketers I know use Ahrefs literally for 2 days for keyword research for a new project and cancel right after. But they still have to pay for the full month.
Really? What about the retailer who didn't pay "cents" to purchase the inventory?
>"food" is used as a drop-in replacement for the expletive "shit".

No food.

Holy food!

Day by day the world is getting foodier and foodier.
They can be used to replace ups.the voltages are close enough with lfp cells. I've done it. So long as you have a bms, there is nothing to worry about
Ask HN: How can I built an AI assistant using RAG?
I want to create an AI assistant using RAG, and I need some good resources. Do you have any tips on building it, any good tutorial blogs for it?

Kindly share.
Not always. Maths will never sound right to me. Even my spellchecker hates it.
1-byte integers or any other integers smaller than 8 bytes (64 bits) save space only when they are parts of arrays or structures.

As individual variables, they take exactly the same space as 64-bit integers, both in registers and in memory (i.e. in the stack used for automatic variables or in the heap used for dynamically-allocated variables), because of the alignment requirements.

Therefore it never makes sense to use other integers than 64-bit, except as members of aggregate data types.

A database table is an aggregate data type, so the use of small integers in some columns may be justified, but such types shall not be used for variables in the programs that process data from the tables, where misuse of the small integers may cause overflows and there is no advantage from using smaller integer sizes.
Raku is looking good though.
This is a bit of a pet peeve with anonymous Internet writing, but: are we supposed to know when you were at university? Do you know when I was? Why not state something like the number of decades or whatever?

And yeah, a void * is how you express pointer to data of unknown type in C.
> If we're going to be really American

It's Danish though :-)
Latest prices for highthium cells are $40/280ah
I'd be really interested in your implementation. Can you share a link or some code?
I'd say you just answered your own question, there.
I can't comment on what the earlier comment exactly meant but hopefully the shop has insurance. I'm not condoning the theft.
The password becomes known to attackers somehow.

Let's work through the scenarios:

- Eavesdropping on you, doesn't happen because you use the password manager's autofill.

- Hacking service X, TOTP doesn't matter. They'll have the TOTP shared secret, but who cares anyway, they have access to your whole account.

- Using the same password across sites -> shouldn't happen either, this is why you are using a password manager.

- Phishing: while they cannot access your TOTP secret, they can just ask you a TOTP code while phishing as well and log onto your account.

So what is this scenario where an attacker knows your password, needs your TOTP, but doesn't have it? The primary scenario I can think of is where they somehow compromised your password manager, but you stored your TOTP secrets on a separate, uncompromised device (like your phone).
Cruise altitude for a ramjet would be between 5 and 20 miles up. The earth has a 4,000 mile radius. There would be no meaningful difference because of the change in circumference because of altitude.
Show HN: I made a free Project Manager app that uses AI to generate task
Hey fellow hackers,
I love to use Jira. But honestly small scale startups are too high paced to create ticket for every task.
- Jira is very new to interns and they find it hard to adopt
- Startups find it easier to just send you a Slack messsage on your next weeks task
- Early stage startups dont have project managers who would spend tens of hours every week to create task tickets and track them

So I created AutoPM. A free and minimal project management software that generates task in seconds.
You can generate tasks by either copy pasting the list of tasks sent to you by your manager or give it a prompt like ChatGPT.
I studied the mechanism, and while it’s true that some tape must be wasted, I think there is room for improvement (with a different idea or even small changes, given that I have a Dymo that uses the same mechanism but wastes much less tape). I simply believe there aren’t enough incentives to research something that saves tape.
at most relying parties you can create multiple passkeys, so this is IMO a good solution until portability might be better
I’m surprised they didn’t mention the kerfuffle with Baker Creek Seeds and their Purple Galaxy tomatoes.

They’re a seed company that’s explicitly anti-GMO, and came out with a nearly identical tomato to Norfolks. At first they doubled down and said they’d tested for gene markers and were certain their variety was non-GMO, but eventually they pulled it from the catalogue after being contacted by Norfolk.
If anything, the insistence of the Lego company ensures that I won't ever say it that way. I'm not here to protect their trademark, and I resent them trying to cajole me into it.