skysight-inc/HackerNews huggingface dataset:
And we would absolutely do it more often if compiling would cost as much as training of an LLM costs now.
>either all software developers are engineers or none of them are.

Why? I have worked jobs where I definitely didn't do any real design and was just there to implement certain things. I absolutely wouldn't call what I did engineering.
> I realize as I'm writing this that I don't really understand what "publishing" means.

1. Fully gather and analyse the data, no stopping early when you realise it isn't working

2. Write the paper, read those background papers you hadn't got to yet so you can cite them, chase down references for things you know from memory.

3. Realise there's a gap in your table because you tested A, B and D at three levels each but C you only tested at the low and high level, not at the medium level. Go set up your test equipment again to fill in the blank space.

4. Run the paper by your collaborators and your boss, all of whom will feel obliged to suggest at least some improvements, which you'll make.

5. Choose a journal, apply the journal's template and style, send it in.

6. Wait for as much as several months for peer review.

7. The first peer reviewer suggests you retest with a slightly different protocol for cleaning your equipment before the test. You do so.

8. The second peer reviewer replies suggesting you test combinations of A, B, C and D, not just one at a time....
I'm not sure if we're worried that the outliers are at the top exerting illegitimate control or at the bottom undermining it without justification but either way I agree that there are no easy answers here. It's just something you've got to navigate if you want to have a society.
How to Turn the Browser Bookmarks into a Beautiful Website with Pintree
Would recommend people interested in this start following "metascience".

https://en.wikipedia.org/wiki/Metascience

And read "Why Most Published Research Findings Are False".

https://en.wikipedia.org/wiki/Why_Most_Published_Research_Fi...
> 1. Exploiting endpoint agents is mildly popular on blogs and in conference talks. It could happen in the wild, but that's costly R&D for something that would be found and patched immediately. The economics are against it, so in practice it doesn't happen.

You can't know that with anywhere near this level of confidence. For most organizations the only thing that would detect such an attack to begin with is the ERR itseld. An exploited endpoint agent in a world where endpoint agents are the cornerstone of security means that there is no guarantee it would be found immediately, especially if it's used for a targeted attack and cleaned up afterwards. Even if it was, it would be impossible to patch automatically and would require reinstalling the OS.

> 3. In the 2020s, almost every attack you'll have heard of was because of weak passwords or missing MFA. SolarWinds, Colonial Pipeline, Uber, Okta, Microsoft, UnitedHealth, on and on. Plenty of malware, zero exploits.

There were plenty of attacks that relied on exploits in the 2020s. The KEV database itself lists hundreds every year. Multiple ransomware groups relied on RCE vulnerabilities. Sometimes weak credentials are also implicated, that doesn't mean they are the only reason, and certainly doesn't mean "zero exploits".

> So to sum up, you have real risk from bad things that actually happen, and then you have tools that effectively manage that risk, and then you have hypothetical risk that never happens associated with those tools. And your position is that the hypothetical risk that never happens is so great that people shouldn't use these tools to stop the real risk that actually does happen.

The real risk that gets exploited every day is that we trust endpoints we shouldn't and don't need to. These tools do not manage this risk effectively, and in fact they make it worse because they are extremely difficult to administer when you don't integrate the endpoints in your network, and in addition to that they require you to trust one more party. The "hypothetical" risk of trusting your endpoint and integrating it in your network literally proves itself dozens of times every day.

Besides, SolarWinds and Okta showed that trusting additional security vendors is a real risk. What if instead of SolarWinds being the supply chain attack, it was CrowdStrike, and that patching the malware would require manual intervention? Supply chain attacks are hardly a hypothetical risk.

And before you say that endpoint trust and EDR is unrelated, try managing an EDR deployment without Active Directory. It's basically impossible. EDR tools assume your endpoint is trusted by default because they're too invasive to be managed otherwise.
> This makes them look like absolute amateurs.

This applies also to all Architects and CTO's at all these Fortune 500 companies, who allowed these self updating systems into their critical systems.

I would offer a copy of Antifragile to each of these teams:
https://en.wikipedia.org/wiki/Antifragile_(book)

"Every captain goes down with every ship"
Sadly, USB-HID does not define a hyper key, so no USB keyboard has a true hyper key. What one can do is configure the keyboard to emit a different, little-used key, and then configure X to recognize that key as hyper. I think what I do is emit left super for both super keys, and right super for both hyper keys, and then X turns right super into Hyper_L. Or something like that. This doesn’t bother me, because I don’t want to assign different meanings to the physical left and right super or left and right hyper keys — folks who do (e.g. for games) might not like it.

I also had to do a little bit of magic to get hyper recognised as a modifier.

It would be awesome if someone could get Hyper added to the official list of USB keyboard keys.
I believe the goal is to defeat the compiler trust thought exercise where a malicious compiler could replicate itself when being asked to compile the compiler. Since this produces human readable code instead of assembly, the idea is it allows bootstrapping a trusted compiler, since pnut.sh and any output shell executables are directly auditable.

I suppose the trust moves to the shell executable then, but at least you could run the bootstrapping with multiple shells and expect identical output.
Texas is big in economic freedom and not that great in personal freedom unless it's about guns.
Ah, I missed that sentence on my first read. Kind of a shame because the NPC meme is dumb as shit and the rest of the post was interesting.
Having worked for the past 25 years in high- and low-stress jobs the consistently most important thing to make sure you are effective at work and still have your mental health is to prioritize your time and work at least every morning. This prioritization should be shared with your boss (at a high level, not every task) and you should give them an opportunity to help you reprioritize. Most people can work a 40 hour week and have an impact in their job if they consistently do the things that are most important to their employer, and aligned to their skillset.
From my experience, there's no definition as such but having your study "published" implies that it went through a peer-review process featuring at least two qualified referees and an editor. The implication being that the claims from the study are valid as reference for future studies, to varying extent depending on the quality of the journal etc.
Show HN: Habit-tracking app with GitHub-style grids
Hi HN! After ~9 months of development, I published my very first app to the App Store. It's called Checker, a habit/goal-tracking app that uses GitHub-style calendar grids to visualize your progress. It's relatively simple for now but I'll be adding quite a few features in the coming months, like board color themes, Apple Health integration, more widget styles, etc.

Hope you give it a try, and if you do, please let me know if you have any feedback.
> C-suite employees are all officers at least.

I'm not sure that's always or even often true, despite the 'O' in the name. You're generally mostly talking about the CEO plus directors.
It does not work as standard anyway. The publishing practices are different from field to field. Also journals have different policies and practices. So it is hard to get a real representative definition other than making paper available. In which case arxiv will be a publishing mechanism that does not provide editor, peer-reviewed and does not cost money.
are you familiar with LoopKit (an opensource automated pancreas)? I'm looking at moving from injections like yourself to this, it looks more complete than the closed systems, and also the closed systems aren't approved in my country.
But sometimes it turns out to be “we found a friendly judge much later who was willing to break the law for us”. We don’t know.
Yeah, I cringed when I saw that too. It violates an important rule of selling: Never tell the customer "Trust me".
The definition of assault and the reporting rate are completely different. You can’t compare those numbers just looking them up on the Internet.
> I mean, nothing stops you from making it into job requirements in your company

What, nothing stops you making director-style fiduciary responsibility a job requirement for normal employees in your company? I'd, er, check with a lawyer before you try that one.
what's the problem with "kamikaze drone"?
I really have no clue what p is, but I also really believe Randall Munroe does. Not that he's above making mistakes, but come on.
Kind of true, yes, in theory, because FATF is largely controlled by the US and it enforced US-style rules to the rest of the world.
However, on the practical level AML/KYC works differently outside of the US. Regulator would create well-defined criteria for banks to execute: To onboard a customer bank must do this and this, check that field against that record.
In the US regulators just washed their hands and placed the burden on banks: banks must make all the "reasonable" efforts to "know" their customer and what is is deemed "reasonable" varies across banks, branches and even individual clerks.
CEO of the PC company can't miss the new primary form of personal computing and blame a VP.
Show HN: I Made a Chrome Extension to Query Hugging Face Datasets with SQL
You could publish it in the Journal of Trial and Error (https://journal.trialanderror.org), which I created with a number of colleagues a couple years ago!

Our editor-in-chief was interviewed for this related Nature article a couple months ago (https://www.nature.com/articles/d41586-024-01389-7).

While it’s easy pickings, it’s still always worth pointing out the hypocrisy of Nature publishing pieces like this, given that they are key drivers of this phenomenon by rarely publishing null results in their mainline journals. They are have extremely little incentive to change anything about the way scientific publishing works, as they are currently profiting the most from the existing structures, so them publishing something like this always leaves a bit of a sour taste.
> I feel the world is too hostile to big tech

Lmao what? If the world were sane and hostile to big tech, we would've nuked them all years ago for all the bullshit they pulled and continue to pull. Big tech has politicians in their pockets, but thankfully the "populist techno-pessimist" (read: normal people who are sick of billionaires exploiting the entire planet) are finally starting to turn their opinions, albeit slowly.

If we lived in a sane world Cambridge Analytica would've been the death knell of Facebook and all of the people involved with it. But we instead live in a world where psychopathic pieces of shit like Zucc get away with it, because they can just buy off any politician who knocks on their doors.
Not sure how it is outside the US, but subscribing nurse-practitioners (requires just 2 additional years after a nursing degree) have been quickly replacing GP docs in the US for this reason. They'll send you to a specialist just like a GP would. It's all the same problems in terms of the underlying model, but the financial and time costs to the system are lower.

I'm not totally sold on what I'm selling though. My spouse has been a nurse practitioner for over 10 years; she had the option of becoming an MD but picked that route because she saw the grueling 80+ hr work weeks of older doctor friends and decided it wasn't for her. Unfortunately, she's still stuck with only 20 minutes for sometimes extremely complex patients that require a great deal of research and follow-through outside of work hours, and the extra slack in the system that is provided by her lower wages has just gone to hiring additional administrative middlemen that are seldom capable of actually filling in the gap, whether for reasons of liability, knowledge, skill, or motivation. These positions exist to try and ease the pressure on docs just like NPs exist to ease the pressure on docs, but it doesn't work because at the end of the day you need someone who can hold the liability (both legal and moral) and the knowledge (the correct diagnosis and the correct plan of action) within the same person.

Just like in software, where throwing more developers at a problem doesn't guarantee your problem gets solved more efficiently, for much the same reason. You need somebody who understands the domain, understands the tools, understands the business framework, and is ready to take responsibility for solving the problem. Each additional person introduces information overhead that makes each one of those tasks more complicated.
In practice, nothing breaks if it can't reach OCSP in a lot of cases. But as with most PKI systems, it causes problems sometimes, so we have to do stupid things like add firewall rules to allow secure systems to reach OCSP endpoints to avoid random PKI-dependent stuff coming crashing down.
RAG is akin to “search engine”.

It’s such a broad term that it’s essentially useless. Nearly anyone doing anything interesting with LLMs is doing RAG.
import github.com/carlmjohnson/flowmatic

func whatever(ctx context.Context) {
err := flowmatic.Race(ctx, taskA, taskB)
}

Provide your definition of taskA and taskB, of course.

As I said in another message, this is not a particularly fruitful line of attack in either direction. All the languages in question are perfectly capable of abstractions.
I’m a little disappointed the article didn’t talk about why they are skipping 119.
Ironic, in that American Express (AMEX) traveler's cheques used to be (before credit cards were common) a nearly universal way for American tourists to carry cash when traveling anywhere in Europe, you could always exchange them for the local currency, and they would be replaced if lost/stolen.
Can you do anything so the images are looking good on mobile as well?
Having interacted with a bunch of other concurrency models in a bunch of other languages, I call. Concurrency is hard, every concurrency model has flaws, and which flaws you want to live with is largely a matter of personal preference and what type of problem you are working on.

For myself, I happen to agree with OP that single threaded plus async/await has honestly been my favorite concurrency model I've ever worked with for the types of programs I tend to write (IO-bound web apps with lots of network requests and no hot loops). The property that they described of having no race conditions of any kind except where you opt into them by calling out to an explicitly tagged async function is an enormous unnecessary mental burden removed.

In other contexts with higher compute demands, a full threading model or something like Go can make a ton of sense. But it's not worth the overhead for your average web app where what you really want is to just resume when that web request finishes.

Use the right tool for the job, don't get dogmatic about programming language features in the abstract.
Because Japan don't have the same export juhgarnaut base as they used to.
heh I'm sure a PM with a relevant metric punted on that ticket plenty times.
It's obvious that there are good and bad engineers everywhere, and we consider most applicants crap regardless of where they come from.

The average developer in the world struggles at being proficient at its craft and can, at best, poorly glue some APIs in an unreadable mess of code. That's true globally. And that's true regardless of the candidate having graduated in CS/SE or not. In fact we have been so far been happier with self-taught devs rather than people who went into programming just to find a job and never really learned much besides trying to pass the exams.

But Indian/Middle Eastern developers tend to be, on average, even worse. Indian news sites have different articles about that and tie it to the level of education, not just university one.

But on top of that, we couldn't match culturally too. As a German/Dutch company my client is all about straightforwardness and no bullshit, whereas devs from those regions focused on impress and not create issues and would hardly raise their hands in case something got wrong. They would consistently do A' when asked for A.

Even very simple task like add a translation key or a tracking event took eternities.

Obviously there was much we could do to onboard them better, and we tried, but it was always difficult and though, in the end these devs tended to add more work in supervision than what they would accomplish but we simply have no time/budget/patience.

Again, I want to reiterate, that's the experience we have and what we feel about devs from any part of the world, but statistically it was worse in India/Middle East (again, probably for cultural/education reasons).

It's like if you get burned twice/thrice by a car brand, even if stats tell you it's an okay brand, you're not gonna buy it again.

Even other stuff like payments and contracts was complicated. And them being up late at night (for them) when we were still in the morning/early afternoon, was an issue. They were obviously tired and in their circadian low.

And no, we don't hire from any other time zone than Central Europe +-2.
When you say taking this with a grain of salt, do you mean the success rate would be better outside of Indie Hackers?
Again, "build" is also captured in the prevailing engineering definition (although software may not be).

What is the significance of you not wanting to call it engineering?
Remember all the cries of "the science is settled"!

Yeah, that's not science - it's the exact opposite of science. This is the perfect example of why reasoned skepticism is more necessary than ever. Blind trust in any institution is a recipe for disaster.
Curious: What does "writer's mind" mean with respect to deepening meditation practice?
(2024)? We're still in 2024, aren't we? (@dang)
Who would track this registration and would it require approvals now?. Then what if you changed your current research because you have personal reasons, change of plans, didn't see it fitting....etc. How would you handle these situations? And why are you introducing MITMs.
Maybe the author writes those REST APIs which respond with status code 200 but with body `{"error": "Not found", code: 404}`.

Half kidding, I also thought the article was great and full of good advice, but share the sentiment that HTTP status codes are great when used correctly!
No, I don't think random pathing is the best algorithm for maze exploration. Doing best possible with limited information in real environment should be the meat of this competition, not having all the time time to leisurely map the entire regular gridded space and then hyperoptimize a solution based on specific behaviour of tiny wheels on flat cardboard surfaces. Boston Dynamics robots can do backflips nowadays. As I said, I consider _some_ luck better than no luck or all luck. Entering with 100 identical robots... you'd have to actually build all of them, people would shun you and I'm sure nobody would be against a rule against that.

edit: But the accessibility argument is probably valid, yeah. There should be a higher less artificial league then, or something.
> There's way more money in Enterprise B2B than there is in B2C.

Definitively not true by a huge margin.
I learnt a few things from that and I have been writing HTML and tables since before they were famous! B^>
AI firms will soon exhaust most of the internet's data
I've had an unnamed content-addressable language in my private repos for awhile now. The language was an exploration of what it would look like if an entire language was transactional, and any failures (power loss, etc) could be mitigated by simply restarting execution at the last line of code executed. Content addressability helped solve the issue of ensuring state was consistent even in the presence of restarted I/O transactions.
https://archive.ph/AbsLm
But the phone can easily be rotated to landscape, so landscape has wider compatability.
The 'excess mortality' phenomenon: What does the future hold?
For 2, is there something done already?
I use the terms "bespoke work" and "commodifiable work" to differentiate the two kinds of work in the article.

I think the article misrepresents what actual technicians do and their value.
I've described it this way to my colleagues:

RAG is a bit like having a pretty smart person take an open book test on a subject they are not an expert in. If your book has a good chapter layout and index, you probably do an ok job trying to find relevant information, quickly read it, and try to come up with an answer. But your not going to be able to test for a deep understanding of the material. This person is going to struggle if each chapter/concept builds on the previous concept, as you can't just look up something in Chapter 10 and be able to understand it without understanding Chapter 1-9.

Fine-tuning is a bit more like having someone go off and do a phd and specialize in a specific area. They get a much deeper understanding for the problem space and can conceptualize at a different level.
Currently, the system can be gamed exactly as you say by publishing sloppy studies that falsely find a "real" effect. But editors and readers of the article will look at and judge the methodology section. Sloppy experiments risk not being printed or cited.

>Would people run shoddy experiments to get null results to undermine their rivals?

In this case, the rival would be very much inclined to recreate the "null" experiment.

>Could somebody pump out dozens of null publications to pad their CV and screw up h-indexes?

Possibly, but would null publications be cited as often? Also, who's going to keep funding a researcher that mostly publishes null results?[0]

[0] Besides agenda-driven "think tanks". Which is worrying itself.
Got it, yeah I think we're in the same boat here. It's clearly physical, and yet that ought to be the beginning, not the end of inquiry.

Dualism is probably one of the most intellectually destructive ideas we've managed to come up with.
Hypothetically, is it possible that periodic table is infinite, its just too hard to create other elements?
Overcast podcast app revamped with new design, faster performance, more
There are several more studies and dietary recommendations regarding oat, just search Google Scholar and similar.
Buildel 0.2 release – no-code AI orchestrator
Hey, me and my team have been working further on our Open Source tool called Buildel.
It's an AI orchestrator with built in functionalities to quickly create your own bots, automations and advanced AI workflows.
All of that without much vendor lockin because of standardized APIs and fully documented and accessible codebase. Would love for everyone to check it out at https://buildel.ai/blog/buildel-0_2

In this release we've added a new design, new workflow editor, new interfaces, tools and much more!
Some general advice:

To be treated better, support biz that aren't in your field. My law/med/auto clients always treated me well. My tech-ish clients (geothermal/web retail) treat me well. An IT firm is more likely to see me as a cog.

I found local work thru local biz orgs like the Chamber of Commerce. I once joined BNI for a year (search it) and still have recurring business from that.