skysight-inc/HackerNews huggingface dataset:
That's what I don't quite get. I'm really wary of a "from scratch" web browser at this point. I looked at their project and their main selling point is that they're building both the rendering engine and the JS runtime from scratch "Driven by a web standards first approach" - what exactly does that mean? Firefox has always had that approach and web standards are more complex than they've ever been. I don't understand why not using code from other browsers is supposed to be a selling point when all the major browsers have open source rendering engines and runtimes and there's independent runtimes being built like Bun that they could use.

We're talking decades of features they have to support - unless they're planning on strategically dropping support for older unused/deprecated parts of the standard? Even in 2008 Google made the decision to use Webkit for their browser because they understood what an enormous undertaking it would be to write their own rendering engine. That was 16 years ago.
Sound randomization? Sound classes (short keys, long keys, spacebar)?
Yes, memory safety issues make up a large majority of high-severity security bugs in Chromium. See https://www.chromium.org/Home/chromium-security/memory-safet...
What's Google?
Hopefully, but you can only hope. My fear is that when people are crunching the numbers at Mozilla they'll see that Pocket (or whatever) is doing well and funnel resources to that, unable to distinguish between people who like Pocket and people who just want to help Firefox out.

Giving me a donation box to pay for Firefox means that I can be very confident that they are getting the right message from my dollars. But for some reason they are very reluctant to do that.
This diagram should be zero-aligned at the very least.
From the chromium website

> Around 70% of our high severity security bugs are memory unsafety problems (that is, mistakes with C/C++ pointers). Half of those are use-after-free bugs.

https://www.chromium.org/Home/chromium-security/memory-safet...
Not all the data is ephemeral - stuff like node_modules needs to he cached and if you’re suggesting to use tmpfs then it’s like 50x more cost than fully tricked out cloud ssd which is already ridiculously expensive
Donations are a way to buy influence. Just wait until they receive a generous donation from M. Soft.
32 bit only, no clang support :(
dude, my endocrine system is fucked. Im diabetic, have only one adrenal gland now, and have the T levels of a 90yro man unless i stick myself once a week.
All the major operating systems these browsers are running on, are written in c and c++.

How can you have a real memory safe application when the memory itself is managed by a shit ton of code written in an unsafe language?
When I'm interviewing, I'll usually start with something simple with an input that is a phone number and the first 'questionable' input I'll hand them is 1-800-FLOWERS and ask how they are handling it. There are a lot of interesting edge cases with phone numbers. None super tricky , but it makes for an interesting first set of how someone thinks
A memory safe language may force you to think about memory safety, but it can also work as a straightjacket that makes it more difficult to think about other security issues.
Anna: A Key-Value Store for Any Scale
Methane is also known as "natural gas," the thing which burns in your range stovetop or powers your water heater. When liquified it is known as Liquid Natural Gas or LNG. You may have heard of that.

In general, starting from methane you can then work your way up to all sorts of various hydrocarbons like gasoline or jet fuel.

Methane is also the propellant of SpaceX's Starship. If they launch as frequently as they want to launch, Elon will likely invest in local zero-carbon production of methane using techniques like the OP.
If you're an average Hacker News user, you use Tor over the Internet. If you're a more paranoid one, you use Tor to access your Protonmail account that you use with Mixmaster.
Local discovery didn't work for me. Loaded it on my (Linux) laptop and (Android) phone (both Firefox), but they didn't see each other.

I wonder if it's an IPv6 issue? My two devices might have shown up to the server as two different IPv6 addresses, not the same NATed IPv4 address.
all tv channels are transmitted with the same technology state actors use to redirect traffic from some site to their servers. (multicast)

That tech have no authentication or authorization. (IGMP, PIM-SM, whatever)

it mostly consist of a switch or router on the edge NOT forwarding UDP to some class D ip, or something, past it. But all the ancillary protocols have hundreds of redirection attacks still available.

All that is besides the BGP stuff everyone document by now so it's only used as a last resort.

Go read a book on network security published after 2013. If you want to play with it in your home, no need to build a homelab. Your home modem probably have smaller versions of this using uPNP or PCP or something. Not really recalling the consumer version names. But on those you mostly can point ports routed to any device to any other device, started by any device in or out of the network. fun stuff.

the reason i don't remember any of the details is because all the perl scripts written in 2000 or so still work just fine.
Rule 110 as a feedstock for Conway's Game of Life
Can it be used in liquid form somehow?
Do you know that memory safety is relevant for security, compared to other causes of exploits? Or are you just guessing?
I would imagine that there is caution about becoming beholden to user donations to continue operations. Such a situation would give users a measure of effective voting power in the development of the browser.
That's really great that you are quoting a generalized stat, but we are taking about browsers here, which are inherently runtimes allowing anyone to run anycode they want.

Just saying 'c++ bad' isn't really a serious analysis...
Functionally (not conceptually) like UEFI, kinda?
Confidential Computing: Complexity vs. Security
> The inability to fund Firefox development is completely baffling to me.

It's hard to imagine that it's for a reason other than "Google wants it that way".
And that situation would be worse than the current one, where 80% of their revenue comes from their only serious competitor?
Both are web apps sadly.
FTA: “Our top finding was that extremely small copper nanoclusters are very effective at producing methane," continues Salehi. "This was a significant discovery, indicating that the size and structure of the copper nanoclusters play a crucial role in the reaction's outcome."”

How can that be surprising for “a new catalyst for converting carbon dioxide (CO2) into methane”? Are there any catalysts where their effectiveness doesn’t increase with surface area?

Also, if they make them tiny (“we used copper catalysts with different sizes, from small ones with only 19 atoms to larger ones with 1000 atoms”), how do you make sure you don’t pump out the catalyst with the methane? A filter?
> isn't easily triangulated?

Depends.

Anything with high enough power is triangulateable, if you have either enough time, or enough listening equipment.

also what precision are we talking about?

on longwave you can bounce radio signals about quite a lot, but you lack bandwith, and the antenna are huge.

If you have a high band width transmitter, and you are doing async transmission, ie send a message when you are far away, then its not as critical.
It's always sad when a small startup like Amazon doesn't have the resources to keep a couple servers running and updated. If only some company invented some kind of service to make that kind of thing easier.
Why do you think aircraft carriers are obsolete?
I tried most of these apps some time ago, and the best ones for large files were Landrop and Localsend. If you have a VPN, you can use them to transfer files remotely too.

https://landrop.app

https://localsend.org
> How can you have a real memory safe application when the memory itself is managed by a shit ton of code written in an unsafe language?

It turns out actually pretty effectively? There are going to be more bugs and boundary issues of the OS, but memory unsafety isn't some goop that oozes into your runtime.
This has nothing to do with the article, which is about supporting talented students by providing them a venue to learn.
It won't prevent all, but may prevent many.

Quote: If you have a very large (millions of lines of code) codebase, written in a memory-unsafe programming language (such as C or C++), you can expect at least 65% of your security vulnerabilities to be caused by memory unsafety.

The quote is from https://alexgaynor.net/2020/may/27/science-on-memory-unsafet...
On the subject of hiding in high traffic channels, I wonder if I can even mention satellite piracy without getting on more watchlists. It's a thing that exists. Many satellites are relatively unsophisticated signal repeaters, and the antenna that receives their uplink signal isn't very directional, either. Or so I heard. Some companies have been known to go crazy trying to find out who's transmitting to their satellite that shouldn't, because they could be almost anywhere. Of course, if caught, they go to prison for a long time.
Plastics (a petroleum product) are not useless.
My employer exists because one day Amazon didn’t feel like supporting their warehouse robot b2b anymore. I have a sense that they do this kind of thing to use companies as Guinea pigs. They experiment and then abandon the product and take the lessons elsewhere.
Even if we accept the premise, carriers are still formidable force projection against non-peer adversaries. Imagine for instance a chinese carrier vs the Philippines, not vs the US.
This is really neat, I’ll have to try it out. It won’t catch all classes of errors though - won’t each call to pause() cause a synchronization between the threads and hide some data race issues? maybe this is a nonissue in Rust.
Also, ability to choose an audio output device (so it can clack on my dedicated USB speaker instead of my main HiFi speakers).
Second this. I'd much rather see more funding for a safer and secure browser than yet another browser that will have the same C and C++ memory corruption vulnerabilities again.
If you were starting a project from scratch I could see that as a valid concern, but the current world is one where 80% of the funds to pay for Firefox comes from Google. No one can seriously argue that becoming beholden to your users is a worse situation than becoming beholden to your primary competitor.
You can't buy certain data
Per convention shouldn't the title have: (2015)
Just today a delivery service wanted to send an SMS to validate my phone number, so I was forced to use a mobile phone number rather than landline. Landline often makes more sense, because usually they'd call to reach someone in the household the item is being delivered to, not a specific person. Other delivery services require a landline number, which sucks for people who don't have one.

Some services limit you to one account per phone number. Not only are there 5 numbers that route to my card (probably common given that this was a local provider's standard offering some time ago), once I even got a one-time token for some account a previous owner of a number was apparently trying to reset. It helpfully informed me which service it was for, so I could have likely used the fact that I now control that number to take over their account.

Using phone numbers for 2FA/account resets is worse than e-mail, even ignoring the fact how vulnerable telephone networks are to spoofing/intercepts.
Maintaining it wouldn't sell more of this specific product, but simply shutting it down damages their reputation far beyond those directly impacted.
I think it's too early to tell. Carriers can carry drones, too.
"Thanks but no thanks"
meshtastic is terrible for avoiding triangulation. you operate in receiver mode and you have a unique ID. so you can send nonsense packets to that ID repeatedly and it'll send them right out again.

Any kind of forwarding system with static IDs is very much not triangulation resistant.
Their primary “donation” is Google. They’re focused on virtue signaling values instead of real work.

It’s a fantasy land. I was there for awhile.
carriers can be used to project power in scenarios short of all-out war, which is the common case, at the moment
Exactly, time is money. Amazon wasted customer time, therefore money.

Very bad look.
> Who uses multicast for TV these days

you'd be surprised. Every resolution bump it gets back in fashion. And the infra is always left behind.

And there's only a shortage of ipv4 because ISPs drag their feet on ipv6. It's circular. They even talk about IPv6 nat, lol. For user safety now, i think.

remember when DSL didn't allow you to open listening ports? you had to buy "business DSL" for 10x more?
Global methane (aka LNG) demand is over $100 billion per year...
People keep saying this, but the trend in warfare these days is for limited wars, not superpower against superpower.

A modern carrier group has plenty of air defences and anti-drone capabilities to hold off a small- or medium-sized enemy, and it would still provide a very useful mobile platform to bomb them from.
Seems other way around. Since you can focus more on other security issues instead of memory safety and other security.
For the broader internet case, you'll probably still be dealing with NATs between both devices, so you'll need a centralized STUN (or even TURN) server to hole-punch (or relay).
From https://ladybird.org (not some subpage, but literally on the main page):

Why build a new browser in C++ when safer and more modern languages are available?

Ladybird started as a component of the SerenityOS hobby project, which only allows C++. The choice of language was not so much a technical decision, but more one of personal convenience. Andreas was most comfortable with C++ when creating SerenityOS, and now we have almost half a million lines of modern C++ to maintain.

However, now that Ladybird has forked and become its own independent project, all constraints previously imposed by SerenityOS are no longer in effect. We are actively evaluating a number of alternatives and will be adding a mature successor language to the project in the near future. This process is already quite far along, and prototypes exist in multiple languages.
*Comstock
I LOL'ed at your comment. It seems about right. It's also a reflection of itself.
Show HN: I made a script to generate GitHub org contribution overviews using AI
Hey everyone!

This is a contribution tracker for my Github org I hacked together today. I use contribution trackers to see what the org is doing at a high level.

It uses Claude Haiku, the Github API and Github Workflows to summarize and analyze each contribution for impact, then automatically generate a markdown document for the week describing the changes for each repo and what everyone did.

The main idea behind impact-analysis is to filter out low-quality contribution noise. The contribution overviews can also make an excellent input for an upstream AI that e.g. helps write a weekly newsletter!

I'd love to hear what you think! Critical feedback welcome!
He is great and the project is awesome. But please, do tell me the goal of serenityOS?
The blog post is weird. "Rogers didn't even try, so OOB is hard."

Also this sentence makes me question his IQ:

"Some people have gone so far as to suggest that out of band network management is an obvious thing that everyone should have"

Yes Chris, Rogers, the monopoly telco company of Canada, should have OOB network! They can afford it.

Talking about the challenges of OOB is great, but the point the blog post is wrong and dumb.

The report says "Rogers had a management network that relied on the Rogers IP core network". They had no OOB network. They didn't even try.

This is a a symptom of Rogers status as a monopoly, negligence on the behalf of Rogers, and negligence on the behalf of the government who should have regulated OOB into existence. This is some serious clown car shit.

One of the advantages that competitor networks provides is redundancy. Canada doesn't have that, so their networks will remain weak. This will probably happen again some day.

Yes OOB is hard, but not even trying and then throwing up your hands and defending the negligent is stupid.
Experimental KVM-Based Type-2 Hypervisor in Rust
I'm nearing 50 and I keep max 10 years of work on my resume and delete the rest. Nobody reads past the first page anyway. I don't list my graduation years, either. Ageism is real.
That would kinda suck as a user as these things are notorious for switching on and off as gas is available (which isn't constant). For bitcoin miners that doesn't matter, but if I was running a long compute job...
https://en.wikipedia.org/wiki/Liquefied_natural_gas
In my case, insurance wouldn’t cover O2 either (actually, I didn’t bother trying), but I had no problem paying cash for a tank with a doctor’s prescription. The up front cost was kinda high, but refills are fairly cheap.

Don’t look for a medical supply place. Look for a bulk gas distributor that sells medical oxygen. For one thing, at the rate you need oxygen for clusters, the small tanks that most medical supply places carry will only last about 15-20 minutes, so maybe enough for one or two attacks. Realistically you want something bigger like a J tank. You also need to get a non-rebreather mask with an inflator bag. A regular mask won’t cut it unfortunately. Search up the ClusterO2 kit for what you need.

If you can’t get medical oxygen, you should be fine with welding oxygen in a pinch. I understand a lot of clusterheads use that without issues. It is exactly the same as medical oxygen, the only difference is that for medical oxygen the tank is purged before each fill to ensure no contamination (although this is very unlikely with welding oxygen anyway, and you should be able to request they purge the tank before filling to be extra sure) and the chain of custody is certified for medical oxygen to ensure that it hasn’t been used for anything else before being delivered to the consumer.

Honestly don’t bother with canned O2. It is not 100% pure, which is an absolute necessity, and they don’t deliver nearly the quantity you need to knock out a cluster. If they help you, great I guess, but it’s probably in your head (so to speak). I took oral eletriptan for years for clusters, before finally realizing that the headache would go away after 45-60 minutes on their own regardless of whether I took the medication. Now I take injected sumatriptan when I’m caught without oxygen, which knocks them out in under five minutes. The relief is nothing short of magical.
I still don't really understand.

What is the conspiracy? Concretely, what is it that I believe is "going on," what is "actually" "going on", and how does the "actually" "going on" part harm me or screw me... somehow?
In many cases, you'd need to escape the browser before exploiting the OS itself. Security is not an all or nothing, layers and layers are effective at mitigating or increasing the time it takes for exploit to work. For instance ASLR is absolutely not a bulletproof solution, but many exploits are order of magnitude more complex to execute when enabled.

In addition to that, the browser is executing third-party code all the time while making it a good point of entry.
After this who on earth would trust the "home" version will stick around?
Talent Development happens in AoPS now, via classes, books, and forums.
Also there is a network of high-school student-run math contests, with older students coaching junior students. There are several active Discord Servers.

There are paid online courses as well as free purses run by students, some of whom are trying to polish their resumes for college apps.

We are in a golden age for student mathematics study.

What's missing is a strong environment for youth mathematical research. There is a collection of summer camps, but they are too few and expensive.
>Such a situation would give users a measure of effective voting power in the development of the browser.

Yes, better give it to Google and golden-parachuting C-level execs
AI tools right now are not mature enough to fulfill the ambitious promise of 100% full automation and replacing human expertise. Even though they have tremendous capabilities, and they can process and analyze massive sets of data and do predictive analytics etc. Right now, they are still just another set of tools that you as a DevOps or Cloud Engineer need to have under your tool set. These kinds of AI tools augment humans and can massively increase our productivity and save us a lot of time so we can focus on more creative and strategic tasks. By automating routine and repetitive work, we can dedicate our efforts to areas that require human insight, innovation, and decision-making. This shift allows us to pursue more fulfilling and impactful work, ultimately leading to personal and professional growth.In this article, I discuss the most important AI-Powered-Tools Categories and Use-Cases for DevOps and Cloud Engineers.
Microsoft is the king of enterprise because they support their products.

https://killedbymicrosoft.info/

Skype for Business is still supported!
> To a consumer it's fine.

Is it? Let’s say I buy a Foo rather than a Bar because it brings better value for money. A few months later, the device is bricked, and I get my money back, but Bar doesn’t sell my 2nd choice anymore or it got more expensive.

Even if it isn’t, I may have made additional investments in time (e.g. learning how to operate it) or money (e.g. buying an longer charging cable) that I won’t get back.
There is only one overall criteria in this case.
A cool way to structure the class, but hurt by the fact that the professor steadfastly refused to provide anything beyond the man pages. Even the lectures consisted of him putting a man page up on the projector and reading it aloud, verbatim.
Are you suggesting that decreasing surface area is not worth it?
Thank you. I didn't know this existed.

https://qtconsole.readthedocs.io/en/stable/
>No one can seriously argue that becoming beholden to your users is a worse situation than becoming beholden to your primary competitor.

The C-level execs getting their salaries off that Google money can!
Space vehicle launch failures and post-mission disposal statistics
That's the same situation basically any for-profit company with a paid product is in, is it not? If people don't like your product or don't see a future in it they will be less willing to pay for it (or donate for it). How is that bad?
I wonder if anyone has done any metrics about resume's that got filtered out by an ATS, but somehow got hired by a FAANG company anyway?
Chinese around the world are targeted by elaborate fake Chinese police scams
I recommend the book A City On Mars, which covers many aspects related to the feasibility of traveling to and colonizing Mars.
Yeah just a hyperbole.

My point is, people act like anything built with non memory safe languages is shit ever since Rust became the Jesus. We have the actual operating systems written in C, working ok. It is fine.

Yeah maybe Rust would be better but it is not a magic bullet and memory safety comes with many caveats in design of the code and possible performance issues when you are building something low level like a browser.