skysight-inc/HackerNews huggingface dataset:
Yes, many aren't aware of that. If nodes webserver performance is not enough, you could always use uwebsocktsjs or hyperexpress with node.
> Personally, I don't expect this to make much of a difference, if any.

While you're probably right, I'm hoping ClownStrike's court results so absolutely dwarf their insurance coverage that it's nearly company ending.

ie something to actually get them to improve things, not just generate empty PR platitudes: https://www.youtube.com/watch?v=SiL2AjOtjZI
I haven’t used them much, but when I did, I found them quite usable.

I think a main reason Keynote, Numbers and Pages web apps exist is for sharing with non-Mac users.
I have a completely different outcome from my time with language models. They are amazing at absurdist humor. Gpt-2 and gpt-j rock at coming up with absolute nonsense stories that make me crack up. The more quote unquote sophisticated the language model gets the worse it gets.
I'm pretty sure the stock options of the corner shop near my house won't be very attractive to employees.
How a Founder Survives on Loans?
I kinda suspect it might be that chagpt is excellent at getting you to an "average" performance in any field.

My background is computational material science, but more on materials than the computational part. I have an ok broad knowledge of most CS topics but I'm always finding I'm playing catch up. My work also involves a lot of making research prototypes in areas I don't have time to get a proper background in.

For me GPT has had a transformative impact on my work.

For example I had a lot of projects that needed Docker. I have an ok idea of what Docker is and what i want to do with it. But, I don't have the time of a real software developer to learn the syntax and deal with subtle bugs or how to do basic things, e.g., "how do I ssh into my Docker container X"

I think I'm on the end of users that is best poised to make use of llms. A decent knowledge of what strategy i want to go for but don't know the tactics. And I'm mediocre enough at programming that the Llm can usually beat me. Another example, I would just never write any unit tests, not enough time. With llms I can get simple dirty tests done + I know enough about testing to filter out the bad ones and tune the best ones.

I see poor responders on two extremes on either side of me. People who really don't know what they are doing and can't prompt correct the llm into doing anything better. And people who really know what they are doing and are generally working on one tech stack/ project and don't need help getting dumb basics in place + have more time to write things themselves.
It operates under guilty until proven innocent, i suppose i didn't consider that due process. Having to prove yourself innocent is not viable.
>> "71.93% of Americans Living Paycheck to Paycheck Have $2,000 or Less in Savings"[0].

It's a meaningless statistic. They can still have high net worth and/or large incomes even if they don't keep cash on hand.
Production of chips, for example. One could argue that design is a form of administration rather than work.

I'd say so called AI is largely a scam. It's wobbly databases with non-deterministic query languages dressed up as a substitute for intelligence. Email is similarly a scam. Through mail you send someone an item, which might or might not have some script on it. Email is very different, and it's largely used for spam, even though the name seems to say it is very similar. Is this what you call progress?

No, I'm pointing out that Nvidia are supplying criminals and tyrants with the tools they need for their abusive and oppressive activities. I do not expect your mood to change from having this pointed out, rather the opposite, I expect you to already be somewhat aware of it. Personally, I try to avoid doing business with such people, and I would prefer to not be dependent on their enablers, though that is almost impossible for systemic reasons.
If you have good examples, I'd love to see it, A writeup even more so on the techniques they used. My findings so far in the wild (and on my honeypot) is really amateur level garbage.

I spent a weekend and abused a c&c infrastructure server to fix the clients and remove the flaw and malware. I see very little sophistication there.
But randsomware is mostly targeted to servers, many of the devices affected were clients
Only your third point makes any sense. For the other two, obviously the answer is yes, that's entirely reasonable. Businesses and government organizations use plenty of commercial tools that they have no way of designing or understanding on their own. Software is no different from hardware from this point of view.

A hospital doesn't have, and couldn't use even if it did, the blueprints for an MRI machine or an old-fashioned iron lung. And those machines are built by commercial companies and contain plenty of trade secrets.

If anything, using open-source software that you maintain yourself in critical infrastructure is the more bizarre practice from a historical or industry-level perspective. Even in software, things like Solaris, IBM OSs etc. are much more common than OSS. And even when using FOSS, a commercial distribution like RHEL is far more common than using your own Linux.
It obviously wasn't the top comment when I posted it. When I came into the discussion most were about not attributing it to the state in question despite no evidence either way, and downplaying it. And, the fact that my comment has come to the top means that it has seemingly resonated with a lot of users with similar experiences (~+70pts).

If you do actually follow the topic very closely, or read one or two comments further down in this thread you would have come across this link to pro-israeli astro turfing zoom call tutorials by the idf https://www.leefang.com/p/inside-the-pro-israel-information and many other examples
Why does Google do this. There isn't any need for so much data just to link a resource
He is giving a ton of business to Taiwan. That's probably enough personal safety risk.
Episode 5: The Crowd Strikes Back
I hope that happens to every company that simply updates terms of service by sending email...
Linux can't be secured out of the box to do anything that Falcon does. If you use AuditD, eBPF and things like GRSecurity patches you might get into a good state, but it's still not the same thing at all. it might be secure depending on your linuxfoo, but it's not the same thing as running EDR which will help correlate system behavior across different systems etc. and look with much more depth into process behaviors and system interactions.

Also, you don't want operating systems to provide this actual EDR program. They need to provide the facilities for EDR vendors / creators to tap into and do their work properly. You don't want a butcher to rate their own meat... you want a third-party to do this. As Example: MS Defender is totally rubbish (general sentiment for a lot of people in security, hence they run falcon or cortex XDR etc.) at defending Windows.... and it's by Microsoft. They should focus on building an auditable OS and let auditors do the auditing...

The best thing imho is a tool like CSF but integrated with network appliances (which CS doesn't do i think), which is where the strength of such tooling really comes together, correlating network data / behaviors to endpoint behaviours and having a full 'causality chain' of processes / systems and network traffic invovled in an attack.

And you are right on the balance of security being dramatic. using crypto is still hard as ever, and allowing external parties to interact with your users is just impossible to do right (let alone have users in the right awareness mode). This last is a problem of security industry imho, making tools so difficult.

Someday maybe rather than EDR tools and firewalls, cybersecurity companies will deliver 'secure business services' which are easy to use, userfriendly services that are secure by default. - maybe in like the year 3042.
They need a lab full of canaries.
Very much every 3rd party anti-virus software I tried (and paid for) caused data loss or other problems (a few catastrophic) in the long run. One product didn't even stop a virus getting in.

Since then I just use Defender and never had any trouble or a virus or ransomware. Only issue is that sometimes the antimalware service takes a lot of CPU.
> Economic illiteracy

I respect your opinion but the stats presented before does not “shows“ illiteracy but low investments. Lack of liquidity to invest seems a very plausible raison because a revenu threshold has to be passed to be able to buy food before founds. This stat is probably almost a proxy for how many Americans are below that threshold.
This reminds of https://binvis.io a binary file visualisation tool that uses space filling curves for visualisation. Discussed here previously https://news.ycombinator.com/item?id=39210436
Is it? I think ransomware affects clients more than servers, doesn't it?
Uber Is a Poor Replacement for Utopia
We bought everything needed to make $3M worth of fentanyl
That's easy, it's the US and any Canadian city with an NHL team.
> People's entire livelihoods are at stake

No they aren't.
Depends how broadly you define it.

America literally produces movies about "Captain America", a heroic do-gooder who has superhuman strength, speed and endurance and who wears a flag as an outfit. In these movies he saves the entire planet. America spends like a hundred million dollars every year on that alone.
Right, but even for the NASDAQ which took a real bath yesterday, it only went back to where it was a month ago. So it's not really a historical entry point opportunity. Maybe it's the start of a bear market. But if it's not, this sort of market corrections is not something a buy and hold investor should wait in cash to try to time. You typically lose more in market opportunity by waiting for a big selloff than going in early, taking the hit and coming back.
> And yet people overwhelmingly prefer to work for these non-employees owned companies instead of working in cooperatives - how do you explain that?

Easily: there are far more non-employee owned companies than employee owned. Thus this isn’t a preference at all, it’s merely the availability of the market.

Now you could say that entrepreneurs who start companies have a preference for non-employee owned, thus explaining the aforementioned market allotment. Again that’s pretty easy to explain, because of course such an entrepreneur would give up ownership in an employee-owned arrangement. It’s also just the de facto paradigm most are aware of in news cycles and business schools, and is easier to setup and support.
Yep, although I myself never played tabletop DND gamed, Planescape and Return to the Tomb of Horrors are my two favorite readings.
yeah, I don't get the "we couldn't have tested it" crap, because "something happens to the payload after we tested it". Create a fake downstream company and put a bunch of machines in it. That's your final test before releasing to the rest of the world.
> surrounded by a vast market/culture (US +Canada)

US companies don't think about Canada as anything but an afterthought, and struggle with the same issues here that you just mentioned.

Canada is metric, uses different spellings (closer to UK English.. colour, not color [Chrome just marked my spelling as wrong despite me having Canadian English as my setting]) and is officially bilingual with localization laws requiring companies to provide French versions for certain kinds of services. US companies either don't bother, or usually get this entirely wrong.

e.g. It's been how many years? And navigation on Android / Google Maps can't pronounce French names for streets/places while driving around in bilingual places in Canada. Just completely butchers them, their system can't "understand" the concept that you could have your language set to English but still need to hear French place names, or vice versa.
Well it might please you then that about 50% of the respondents report low income as the cause for living paycheck by paycheck. Even more report high monthly bills as a cause.

Just read it, it's all in there.
On the one hand, you’re absolutely right. But on the other hand it’s not like it matters in practice. Isn’t most technology technically neutral? But it’s also made to be used by people, who can do so beneficially or detrimentally. Criticising a technology is a shorthand for criticising how it’s used.
None of them is reasonable. Open source and regulation on software safety is required. The society at large has been too lenient with poor quality software.
You can do dangerous actions in user space without any need for escalated permissions.

E.g. downloading a file and running the contents as code, or uploading/encrypting all files you have access to.

Crowdstrike and Defender handle those possible but suspicious actions.
While the slow strangulation of Levitt's mass production formula for building large volumes of homes that were affordable for people who otherwise couldn't afford housing was the saddest part, in 1994 Levitt died in poverty close to the well over 20,000 affordable homes he had built in Long Island.
Great! This kind of stuff will finally make companies start taking quality seriously.
Indeed. Its the same reasoning behind the utterly repugnant 5-eyes apparatus, which allows Western governments to violate the human rights of their own citizens with impunity.
And if judgements are found, local to the jurisdiction assets (including and money being forwarded by banks, eg via credit cards, or wire transfers) can be seized.

If that doesn't work, judgements can be registered in other courts for collection purposes.
not to defend its "you must accept updates" insane /inane fail, but, the suite of crowdstrike inc falcon stuff we have enables the response side of EDR pretty well, and for a mixed windows, linux, mac shop, where we would like the same agent on all systems, it does a better job than most. Not as good as Jamf on Mac mind you, but better than than most "windows ecosystem". And if you run jamf for policy and detection, but not response, you sort of get it all. So, that's why not "just defender" - at 10k+ systems the anti-malware is just the beginning. What do you do when that fails and ...yeh.. anyway.. there is more to it.

As to why windows is not more locked down- that's on the shoulders of the admins. But out of the box, you are right, it is to permissive. But apparently users and management like it that way.
I remember “Sovereign Sect” as having something to do with skateboard(apparel)[1]. Not totally sure what or how.

[1]https://www.thrashermagazine.com/articles/magazine/the-regro...
If your system was processing any valuable information owned by the company (code, PII, etc) than the company is likely much safer today than it was when you had exclusive control over that system, even if they introduced several vulnerabilities. Previously, if you decided/were coerced to do something against the company's interests, you could do whatever you wanted from that system and they never would have even known. Now, they have some chance to prevent you from doing that, or at least find out in a reasonable amount of time.

Security is a complicated topic, and employees are also potential attack vectors. A system that is in the complete control of a malicious employee is a security problem for the company just as much as a system that was corrupted by an external cracker.
I’m mostly using Windows, so even today, it remains my main audio player. I use Winamp for FLACs and DI.fm streams
> How do you actively detect a malware agent running in user space using stealth or a kernel.

You start with correct design.

The system has a root of trust (ideally you skip the insane level of complexity that is Secure Boot + TPM and use something simple, testable, and verifiable — this isn’t actually that hard). Only authorized images will boot, and, more importantly, nothing else on the network trusts the machine until it proves it’s running the right image.

Then you make the image immutable. Want to edit a system file? You can’t. Maybe in developer mode you can edit an overlay.

All configuration is stored in a designated place, and that configuration is minimized. A stock image from the distro vendor has zero configuration, so there is no incomprehensible soup in /etc to audit. Configuration is also attested.

Persistent data is separate from configuration. All persistent data is considered suspect. Any bug that allows malicious persistent data to compromise anything is a blocker, including corrupt filesystem metadata.

A root-of-trust attestation has limited lifetime. The system forcibly re-verifies periodically. This either means rebooting or doing a runtime “dynamic root of trust” attenuation. The latter is complex.

Complicated messes like kernel “lockdown” and the stock Secure Boot signatures have no place. Usermode root and the kernel are approximately equally trusted. SELinux is barely necessary, if at all, unless the actual user code wants it to control access to persistent data. But there are simpler, better schemes that are easier to reason about.

Sadly the industry doesn’t think this way. I’m regularly surprised that Apple hasn’t gone in this direction more aggressively than they are with their MacOS products.
In my mobile Safari it doesn’t work either.

Edit: looks like iphone is not supported yet, https://support.apple.com/en-gb/120585
As we speak the US is in breach of international law per the ICJ's legal conclusion that enabling and / or supporting "the transfer by Israel of settlers to the West Bank and Jerusalem as well as Israel’s maintenance of their presence, is contrary to article 49 of the 4th Geneva convention”.

Prior to which the US very publicly issued threats and sanctions on the ICJ and Judges in hopes of avoiding the judgement being published.
I've taken to using it because i feel uncomfortable even naming them a lot of the time
Claims, without making a substantive argument.

Mearsheimer initially comes across as concerned, serious and intelligent. But when we stop to unpack what he's actually saying -- he emerges as a prime example of someone way too ideologically biased and beholden to broken narratives to be taken seriously.
When working for a large US company they insisted we do not accept returns, they always were astonished that in Germany there is a law for 14 day returns, no questions asked. They could not understand that this is a law in Germany.
Optimizing Your Creative Impact
Sure but GP is praising "deploy so slowly that people complain."
> now a reporter

Ouch. That has potential to go that bit extra badly in the press/media too.

Though with the scale of ClownStrike's fuck up, they might not even notice.
Could the word "gun" be added to the title, so it would come up in HN search for the query "gun emoji", please?
Something like

X redesigns Water Pistol "gun" Emoji back to a firearm

would be ideal.

---

BTW, what is the reason this post is currently [flagged]? I almost (re-)posted it myself (since I've sloppily searched for that "gun emoji" instead of the URL what returned zero results for this week), because I find it interesting especially from the technical and "semiotical" point of view. I see it is somewhat political topic as well, it even might be covered on the TV eventually (?), but I think other HN relevant aspects overweight that.
I received a variant of this problem as an interview question a few months ago. Except the linear time approach would not have worked here, since the list contains trillions of numbers, you only have sequential read access, and the list cannot be loaded into memory. 30 minutes — go.

First I asked if anything could be assumed about the statistics on the distribution of the numbers. Nope, could be anything, except the numbers are 32-bit ints. After fiddling around for a bit I finally decided on a scheme that creates a bounding interval for the unknown median value (one variable contains the upper bound and one contains the lower bound based on 2^32 possible values) and then adjusts this interval on each successive pass through the data. The last step is to average the upper and lower bound in case there are an odd number of integers. Worst case, this approach requires O(log n) passes through the data, so even for trillions of numbers it’s fairly quick.

I wrapped up the solution right at the time limit, and my code ran fine on the test cases. Was decently proud of myself for getting a solution in the allotted time.

Well, the interview feedback arrived, and it turns out my solution was rejected for being suboptimal. Apparently there is a more efficient approach that utilizes priority heaps. After looking up and reading about the priority heap approach, all I can say is that I didn’t realize the interview task was to re-implement someone’s PhD thesis in 30 minutes...

I had never used leetcode before because I never had difficulty with prior coding interviews (my last job search was many years before the 2022 layoffs), but after this interview, I immediately signed up for a subscription. And of course the “median file integer” question I received is one of the most asked questions on the list of “hard” problems.
It used to be that most gyms set with tape on each hold to mark the route--this allowed them to reuse the same hold on different routes and to use their entire inventory of holds in setting a route, since holds didn't have to be the same color. It also let them solve the colorblindness problem by using patterned tape (i.e. stripes or checkers).

Nowadays most gyms have massive hold inventory and just set routes using holds of the same color with tape only on start and finish holds. It's easier for routesetters, who don't have to tape as often, but I think a lot is lost this way.
Visualizing Entropy in Binary Files (2012)
Show HN: I built an easy straightfoward email monetization tool
I built MailShare to solve a problem I encountered while trying to monetize my own email list: existing solutions were either too complex or i had to setup my email sending provider completely from scratch again.

What MailShare does:

Provides a simple way to set up paid subscriptions for your email content
Integrates with Stripe for secure payments
Offers a free tier with a fee and a $89/month premium tier with only Stripe fees
Automates welcome emails and subscriber management

Key features:

One-click audience setup
Customizable payment links
Automated subscriber management
Basic analytics dashboard

I'm particularly interested in feedback on:

The pricing model (free with 20% fee vs $89/month flat fee)
Essential features for email monetization that I might be missing
Potential integrations that would make MailShare more useful

As a solo founder, I'm excited to share this with the HN community and eager to hear your thoughts, criticisms, and suggestions. I'm here to answer any questions and discuss the challenges of building a product in the email monetization space.
- https://binvis.io/#/view/examples/metricprops.pdf.bin?colors...
I’m my opinion a finger pistol would be appropriate.
Microsoft Knowledge Base
It’s just a way to distinguish a language from its implementation, similar to Python / CPython, or Rust / rustc, or C / gcc. Yes, officially they’re both named Nix, but that’s not helpful when you’re trying to discuss alternative implementations: “Nix implements Nix” just sounds like a tautology.