skysight-inc/HackerNews huggingface dataset:
Oh, that's funny... apparently to reduce the risk of there just being one person.
Very sorry, updated the link address but forgot to redirect. Here’s the new link: https://soham-saha.github.io/ProceduralArt/Tangled/Tangled.h...
Correct. I don't believe in killing people before they do anything wrong. I really can't believe people think that it is fine to kill innocent people because they may turn bad. There is also the possibility that you cause Hitler (see the Twilight Zone episode "Cradle of Darkness").
You wouldn't be interested in him as neoclassicist, academist, even professor at Beaux Arts today, because that period is totally uninteresting at all. If not how they suppressed the independent artists, romantics those days. In England or Germany much more interesting painters were celebrated those days, who won over those salon academics.
(2015) Previous discussions:

2015 (114 points, 56 comments) https://news.ycombinator.com/item?id=8827985

2023 (265 points, 202 comments) https://news.ycombinator.com/item?id=34513806
Voice recognition and saving audio streams is not new. It has basically nothing to do with this tech. It's not getting repurposed for surveillance.
He was an exemption, not an exception.
> help the author avoid writing up the same ideas again.

Oh, how I wish!

Except that many sites and services are hostile to this because it
encroaches on their "attention territory".

If as an author you link to an idea you already carefully expressed
elsewhere as a blog post or book, the comment gets put down or
censored for "promoting".

More often on HN now, to avoid punishment, I just copy/paste my
original writing rather than give the reader a link to explore more
deeply.

There's clearly a gap between what we preach as good "academic" ways
of spreading information and ideas, and the reality/practice in
systems that control expression.
I use GrapheneOS with my Pixel 7 with no issues. I won't ever buy an apple device. If the OS isn't opensource, I'm not buying it.
Java Virtual Threads: A Case Study
I remember it very well. https://forensic-architecture.org/investigation/police-bruta...
I have the same thoughts. Eventually there will be a lot of money to be made breaking the s&p 500.
The catch 22 for this assumption is that they want to be richer than their own money would allow
This is such an important lesson, but it's a difficult one to convince people of - telling people NOT to sanitize their input goes against so much existing thinking and teaching about web application security.

It's worth emphasizing that there's still plenty of scope for sensible input validation. If a field is a number, or one of a known list of items (US States for example) then obviously you should reject invalid data.

But... most web apps end up with some level of free-form text. A comment on Hacker News. A user's bio field. A feedback form.

Filtering those is where things go wrong. You don't want to accidentally create a web development discussion forum where people can't talk about HTML
because it gets stripped out of their comments!
my father was born and raised in river oaks, houston before ac. summers were hellish, with little sleep at night.
> literary value

Not everyone has to be Joyce - there is literary value in more humble works and intentions, and Breathed's Bloom County was sublime in its preposterous ideas. Not perfect, not an Everest - a "local maximum", relatively a peak, if dwarfed by other works in more specialized, high-brow efforts.
Why not not both? Escaping output should be a requirement but doesn't hurt to remove obvious garbage in the input (including harmless stuff like pointless spaces)
I think the challenge is, you share data with other systems. If you don't treat "sharing" as "output" you're in trouble.
Chess also has a huge search space and allows cycles, still, wouldn't a better approach be refining a scoring function and then doing a deep search and suggest an action and min maxes your odds of victory?
The documentation seems to be lacking. I am specifically interested in gvisor and kata support, but cannot find information on installing additional runtimes
Triton is getting a lot of attention for its adoption in PyTorch2 compiler
This is false. The "Location History" setting that the article is talking about is a different feature entirely from the "Web and App Activity" setting that you are referencing. "Location History" has never been required for any Google Maps features other than (obviously) Timeline, AFAIK.
Why can't I just monetize and steal all the ad revenue if they use my face or voice, just like copyright holders can?
You're not going to make a measurable difference at all this way. What needs to be done is a complete change of the zoning system.
That is too strong of a condition. The economy doesn't need to grow for passive investing to work.

Even when the economy is flat, passive management works. As long as companies are economically productive, capitalism will hand over a chunk of the profits to the owners of the capital.

Of course, growth increases the size of that chunk year over year, but capitalism doesn't stop when growth stops.

Active investing is when you are looking to exceed this passive margin by timing your trades well. Active investing requires changes in productivity (such as growth).
So why does my android phone not allow sudo or chroot, and when I root it my bank application stops working, citing the EU payment service regulations? Virtualization is not enabled too, even though the cpu supports it.
Well there is the Hunane AI Pin:

https://humane.com/

It looks like the product launch didn’t go well though:

https://arstechnica.com/gadgets/2024/05/humane-ai-pin-founde...
If you follow the https://www.documentcloud.org/documents/24796009-foia-reques... link, you see that's already classified as uncl, and ready to be released. But first someone needs to digitize it for free. They sure do have the equipment, but probably not the resources for such requests of questionable value. She gave hundreds of such talks.
Still looking for a way to safely parse HTML string into DOM while avoiding XSS attacks. Most solutions end up with sanitizing input.
1-2. ETFs are not uses for crypto. They’re a vehicle to hold crypto, not a usecase. Blackrock doesn’t even use the blockchain and doesn’t have custody of it’s own keys. It’s a bit of an own goal as far as crypto adoption goes.

3. Tether totally has $110+B in holdings, though they’ve never produced a financial audit and they try to pass off attestations and non-financial audits as such to believers. Both times they’ve been forced to open their books, they turned out to be unbacked. Also, Circle and Tether are centralized entities who have full control of their currency and can and will censor transactions and block accounts, just like a regular bank.

4. Sure, cool, but is it actually used for anything anywhere or is that more of a “vague distraction”
Use of Formal Methods by a Silicon Manufacturer (1988) [pdf]
I discovered him 6 months ago and watched most of his lectures. Truly a gem of a channel!
GitHub Issues have a very comprehensive API. I've written code in the past to export all of my issues and their comments: https://datasette.io/tools/github-to-sqlite
> your fellow traveler

I didn't vote for Trump in 2016, but having had to deal with taking care of my aging, disabled parents in 2020 in a city heavily affected by the riots (and COVID), I was and remain bitter about the media inciting the riots, and then the media and progressive politicians enabling and excusing the rioters ("mostly peaceful protests"), all before memory-holing everything for the sake of political expediency.
It's not fine unless you consider your machine disposable. RAM wears out and new software always needs more. Want to collect these machines for posterity? You're out of luck, because they all have even more limited lifespan and can't be fixed.
Google Location History is privacy friendly now. It was just recently changed a month or two ago and it no longer works in the way the article describes. The history data is now stored on your phone. Cloud backups are optional and default off and always end-to-end encrypted if enabled, so your location history database is not ever accessible to any Google server. Google made this change in response to issues like the ones described in this article.
I do worry about that. I've been meaning to setup an automated export of my issues to protect against that situation.

My protection for now is nepotism: I know enough people at GitHub that I'm confident I could use back channels to recover my account if I ever need to.
It looks like they did the right thing since privacy advocates don't even consider that sufficiently difficult https://news.ycombinator.com/item?id=40959052
Guys, the talk is unclassified if you care to read the article. It's about the resources. They won't digitize everything for obscure FOIA requests on old tapes unless some billionaire spends it for them.
YouTube History Analysis 2.0
I have been using https://scoria.info/. It is privacy first and offers great flexibility with how you can filter, view, and export your location data.
Our approach at work: parse it as HTML, define a short list of known-acceptable tags & attributes, and strip everything else.

Limiting attributes to ["href", "src"] and tags to ["p", "br", "h1", "ul", "ol", "li", "span", "div", "img"] gets you remarkably close to rendering the safe bits of HTML - add to that list upon request.

If you want to take it further, use an `iframe srcdoc=""` with sandbox attributes set.
Glove80 is a new curved keyboard design (in many ways a departure from Kinesis' 1990 designs).
During development you will need to login to the pod, to review settings, directory contents and so on. If the OS running in the pod does not allow you to do that - during development - then that's severely limiting.
> ... (a) covid and (2) one ...

> ... because we (a) ... and (2) actually

Why are you (consistently) follow "(a)" with "(2)"? Is this an AI thing?
They don’t suck.
What are possible applications of this?
> If you don't need the extra features Lua provides, why include them?

The whole point of a feature like this is that you don't know what will be required. It's going to be pretty annoying when a user does find they need something that's impossible with CEL and they can't do it because the devs think they'll write slow code.

Lua is not very nice IMO, but I've used Rhai successfully in the past. It even has an operation limit feature already:

https://rhai.rs/book/safety/max-operations.html
> The stream is a stream of Result<ParsedMessage, ErrorMessage>

Fair point! Yeah that would allow error handling the state machine.

> > Lastly, and this is where using async falls apart: If you try to model these state machines with async, you can't use `&mut` to update shared state between them AND run multiple of these concurrently.

> I'm not sure that I see your point here. I think it's just you never have to think about concurrent access if there's no concurrency, but I'm sure I'm misunderstanding this somehow. Maybe you could expand on this a little?

Yeah sure! If you are up for it, you can dig into the actual code here: https://github.com/firezone/firezone/tree/main/rust/connlib/...

The requirements are:

1. Run N clients of the TURN protocol.
2. Run M connections (ICE agent + WireGuard tunnel).
3. Allow each connection to use each TURN client.
4. Everything must run over a single UDP socket (otherwise hole-punching doesn't work).

In theory, (3) could be relaxed a bit to not be a NxM matrix. It doesn't really change much though because one TURN allocation (i.e. remote address) needs to be usable by multiple connections.

All of the above is managed as a single `Node` that is composed into a larger state machine that manages ACLs and uses this library to route IP packets to and from a TUN device. That is where the concurrent access comes in: We receive ACL updates via a WebSocket and change the routing logic as a result. Concurrently, we need to read from the TUN device and work out which WireGuard tunnel the packets needs to go through. A WireGuard tunnel may use one of the TURN clients to relay the packet in case a direct connection isn't possible. Lastly, we also need to read from the UDP socket, index into the correct connection based on the IP and decrypt incoming IP packets.

In summary, there are lots of state updates happening from multiple events and the state cannot be isolated into a single task where `&mut` would be an option. Instead, we need `&mut` access to pretty much everything upon each UDP packet from the network or IP packet from the TUN device.

> The Stun example is simple enough that it is achievable just with an async state machine.

I am fully aware of that. It needed to be simple to fit into the scope of a blog post that can be understood by people without a deep networking background. To explain sans-IO, I deliberately wanted a simple example so I could focus on sans-IO itself and not explaining the problem domain. With the basics in place, people can work out by themselves whether or not it is a good fit for their problem. Chances are, if they are struggling with lots of shared state between tasks, it could be!
HN has often allowed important news stories about Trump. Some of the most popular ones include his inauguration (2,215 comments), Facebook's suspension of Trump (1,293 comments), his first electoral victory (1,708 comments) ands his firing of FBI director Comey (297 comments). Does his assassination attempt not rise to this level?
We are definitely not good.
They don't allow that more than a web browser does.
I loved the 12 Mini, but battery life was one of the reasons to upgrade. 44% after 24 hours is very impressive. I often wouldn't make it through the day.
Is Talos for running inside pods, or running on the node. It is not immediately clear from the website.
> The dormancy period for IRAs cannot begin until the account owner reaches the age at which one must begin taking required minimum distributions. As of 2023, the required minimum distribution age is 73.

So not until you retire.
For me personally, I learned to avoid every smartphone vendor that:

1) doesn't share the sources of their Android OEM images online

2) isn't compatible with LineageOS.

3) doesn't have replaceable batteries.

If either of those apply, it's just a waste of money that can be avoided, regardless of build quality. In the case of the Jelly devices, they have a replaceable battery, but it's still just software waste.

Usually I ended up buying devices that fit my description from ebay in used condition so it's also kinda better for the environment because I am breathing life into a device that would've been electronic waste otherwise.
I find that hard to believe. Time will tell on that front!
The reason you sanitise input is because the data can attack the host and the client.

This post has a narrow view on attackers.
> just a general computing device

No, it's an Apple device. It _should_ be a general computing device, but Apple ensures that it will never be, and you should be aware of that when you buy it.
After the bell on Friday is an infamous time for releasing news you don’t want to be covered.
It’s really not. The point is that sanitizing output is a better way to protect the host and the client.
Lithium salts would be a wonder drug if they didn't cause permanent kidney damage.
While looking into a replacement for auto increment primary keys, I also encountered TSIDs / Snowflakes. At least with TSIDs you can store them easily as 64 bit integers; ULIDs were not as compact. Haven't made a decision yet though.
love this.
reminds me of picoCAD though this is obviously more robust. lo-poly is so awesome
These restrictions are enforced by the OS, not Apple's store rules. Even in the EU sideloaded apps can't do these things. It remains to be seen if their hands will eventually be forced, my understanding is that the EC is still working on striking down the Core Technology Fee, and these battles are going to take a while to catch each and every way Apple is trying to retain control of people's phones.
The SensorVault warrants going back decades were already explained in a 2019 nyt times article, which is stolen here. https://www.nytimes.com/interactive/2019/04/13/us/google-loc...
They can even solve cold cases.

What is new is that users can opt-out of location tracking. They won't purge SensorVault though (location reporting).
This looks like a Community note.
It's sickening just because it's really greasy and unhealthy, not because it's particularly meat like (maybe it is, I can't remember anymore). And the Impossible in particular always leaves a weird aftertaste for me that I can only describe as "bloody ultra-umami" that lingers in the mouth for far too long.

By contrast I love most Indian food, though I've only had it with tofu and chickpeas or lentils, not TVP or jackfruit that I know of.
The jelly pro/star is very thick, but I suspect the jelly max will be much thinner as there's more screen space to put a bigger battery behind
> Limiting attributes to ["href", "src"]

You need to clean that up as well to avoid e.g. javascript: links, and then there are more issues with SVG if you allow media uploads.

Then you need to be very sure you’re using a proper html5 parser and your rendering is completely canonicalized or you open yourself up to filter evasions (https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Ev...)

And of course I assume that’s what you meant but you should not add upon request, you should evaluate the addition.
There are brokers for website vulns? This presentation says there are brokers for clientside RCE vulns, but doesn't mention any brokers for website vulns.

https://github.com/mdowd79/presentations/blob/main/bluehat20...
Dr Markus Studer did a very similar career change in the early 2000th. Heart surgeon went truck driver.
Some customers of an internal Kubernetes platform complain that their pods keep getting evicted because their nodes keep running out of disk space. The platform's maintainers' first instinct was that customers' pods should not write to ephemeral storage, e.g., should not write to log files on the filesystem unless mounted from external storage. But that turns out not to be the case: customers' pods did not write anything to disk at all. So why were nodes running out of disk space? Prometheus metrics show which partitions use how much disk space but cannot go into more detail. The team wanted to inspect the node's filesystem to figure out what exactly is using so much disk space. The first thing they tried is to run a management pod that contains standard tools such as 'df' and that mounts the host's filesystem. Unfortunately the act of scheduling a pod on that node causes it to experience disk pressure, and so the management pod gets evicted.

So, being dogmatic about "the host should not have any tools installed" is good and all, but how do you debug this scenario without tools on the host?

We eventually figured it out. By logging into the host OS and using the shell tools there.
The article clearly states why not: first you probably screw up your data (example is names, but there are many more examples) and second what is garbage depends on your output usage. Html/sql/JSON/etc all require a different sanitization.
I took an Android detour late last year, early this year, just to see what the other side looks like. From the major vendors, only Google releases security updates like clockwork across all devices (similar to Apple).

Many Samsung flagships have monthly updates (good), but rolling out the updates is a shit show. Like the S23 could get the update on the 11th of a month (~10 days after Google opened the monthly security bulletin), while the S22 would only get updated on something like the 28th. Also they usually missed Google's 5th of the month platform updates, causing some flagships to be vulnerable for a Bluetooth RCE for almost two months.

Then some security updates are rolled out through the Google Play System updates (not Google Play or Google Play Services), however, the rollout regularly gets stuck on non-Google devices until someone at Google (?) fixes it. For instance when the Samsung S24 got out early this year, phones were stuck on the (I believe) July 2023 Play System.

If you want regular updates on Android, your best bet is getting a Google Pixel. Unfortunately, Pixel has a long history of issues (like not being able to call emergency services).
Daffodils or dandelions?

https://cfpub.epa.gov/ncer_abstracts/index.cfm/fuseaction/di...
I enabled it (quite intuitively) by clicking on the little cloud icon in Timeline. I didn’t need to go to settings.
Here's someone who found 120 bugs in 120 days (in addition to working full time). The bounties totaled $80k.

https://shubs.io/high-frequency-security-bug-hunting-120-day...
I think there are some key differences to cycles in Chess. In Chess, the cycles come from your (or your opponents) actions. With minimax you would max (or min) over these actions, so if you pruned away the cycles at some depth your result is not incorrect because the min or max does not change. But here the cycles come from randomness in the game of which chess has none, and you need to take an expectation over the cycles. So you can't just prune them away without changing the result.

A scoring function could definitely help guide the exploration and/or prune the tree, but only at the action nodes, not the environment randomness nodes. Rolling out the full tree more than 1-2 levels would be infeasible because of the randomness in the environment. When you take an action, the randomness can transport you into an exponential number of states, so you have a huge branching factor that is much larger than chess. I think in chess you have a factor of 40ish? Here it's more like ~1000 or ~10,000 depending on the item.

I also wouldn't know how to design a scoring function for this. If you do something simple to take the number of missing modifiers you will end up stuck in bad states. Maybe there is something really clever here that you can do, but I don't know what it is.

If you have an idea how to make tree search work for this I'd love to try it.
Facebook is well known for using bait-and-switch tactics once they grow past a certain size. They've burned bridge after bridge over multiple years on their existing platforms, increasingly making it difficult for people to reach their audience unless they pay up for ads.

During the initial release, Threads seemed like a sanitized corporate playground for various big-name organizations to share their slop and promotions. Right now I get a lot of anti-Elon / anti-Twitter slop or political slop despite never engaging with such content. Most of the famous people I follow on Threads are just cross-posting the same content on every major social media platform anyway. I barely know anyone from real life that actually participates on Threads. In general, the tools for discovering interesting or new people don't seem to be there for Threads.

Finally, this current version of Threads is probably the best it's ever going to be. Once enough people are using the platform Zuck is going to start shoving ads down your throat, just like they've done with Instagram.

Edit: Instagram also keeps giving me notifications when certain people make posts on Threads, to try and get me to use the platform more often. And even Threads will randomly send me a notification that Yann LeCun made some post on Threads which it thinks I will really love, despite it being incredibly generic and uninteresting.