skysight-inc/HackerNews huggingface dataset:
Is taking the website offline really necessary? If the vulnerability has been there for 1 year or so already, what harm does it being there for 1 year and an hour do? Also, maybe it's not clear to me exactly what is getting taken down, but I'm amazed that the chain from "person reading email" to "person that is permitted to take down the website" moves so quickly (or that the latter right is given so low in the hierarchy).
Or you can just link to a DB directly. A Flask app is just a WSGI app. You can mount and extend it with any kind of Python, no extension necessary.
Oh.

I was reading them out in hex. As in CA FE BA BE …

Now I feel stupid.
It's just irony of the tech industry that all modern architectures are little-endian.
Show HN: Charsible – Plausible Analytics in your pocket
Hey everyone,

I've been using Plausible Analytics almost 4 years. I think it is one of the best alternatives to Google Analytics, especially if you care your users' privacy.

I was thinking about how I can keep an eye on my Plausible Analytics numbers and then came up with an idea to create an iOS app that includes widgets. That's how I created Charsible and released it last week.

You simply enter your API into the app and then add the widgets you want into your Home Screen on your iPhone. Your API key is stored in your iCloud Keychain, there I can't access it. If you want, without installing anything, you can also use the widgets on your Mac and iPad.

Right now, there are 5 widgets that would help you to keep an eye on your visitors, page views, visits and goal conversions. If you have more than one website, you can also create a widget for each one of them. You can also customise the timeframe as well, like today, last 7 days, last 30 days etc.

I should also mention that the app doesn't collect any data about your usage. Also, if you are using self-hosted version of Plausible, you can still use the app.

Let me know what you think about the app!
Because of the fAItigue the mentioning of AI will go away, but the orweillian precrAIme is here to stay.
With 64 kilobytes of core memory to run in (and no swap), linkers were usually limited to 6 or 8 character symbol names. Compilers could let you name your variables anything but "my_value" and "my_valence_count" would still represent the same thing in memory. Being purposefully parsimonious with your names was good defensive programming practice.
It's not evidence, it's a point, that as a society we predicted this.
If it's too hard for everyone to do, then yeah, it's too hard.

At the end of the day, what matters is if you can, y'know, do the thing. And people just can't.

> which isn't even convincing to me as someone in the industry

Then you're confident that you can write bulletproof software? Prove it. Thankfully, as an industry we're pretty good at compromising software even if we can't write uncompromisable software.

Since we're talking about serious liability, how about put up a multi million dollar bounty for any single bug found in a non-trivial program that you write?
I actively support channels and causes by purchasing merch, donating, etc. That said, I refuse to waste a second of my life watching ads of any kind or supporting adtech. Adtech is what has enshittified the entire internet and we must burn it with fire at all costs.

I use FreeTube to block all ads and sponsor segments and I teach everyone I know to do the same.

The ad model results in creators being restricted in order to be advertised friendly, and encourages mass spying, of which the data is often irresponsibly managed and leaked putting people in danger.

This model is fundamentally unethical to participate in from either side.

Make some merch, and provide a mix of accessible and anonymous ways to donate to you.
This one is the straw that broke the camels back for me: https://github.com/kovidgoyal/kitty/issues/4965

"Are you sure you want to close this window",
meant to only trigger in interactive scenarios like ssh or htop, triggered on the regular shell sometimes. Not even consistently
The best quote I've ever read about that was "Why become a physicist, when you can be his boss?" Can't find the source anymore.
As a journalist, I would really wish to see a study saying that headlines like the one CNN used on this article drive readers away.
I hate the “this generic thing you have to discover by reading past the first paragraph” trend so much.
I also gained weight when I started running 2-3 times a week + gym 2 times per week. But I strongly suspect that's from increased muscle (though I have also been eating more)
Given the real money involved, keeping it online with this flaw in place isn’t an option.
This is the kind of theory-free science seems to permeate the entire field of ML lately.

I can only see this as a negative, what's the use of automatically generated papers if not to flood the already over-strained volunteers that review papers at conferences? (mostly already-overworked PhD students.) If I wanted a glorified chatbot to spam me with made-up improvements, I'd ask it myself.
PrecrAIme ©
> To be brash, maybe consumers need to learn how to protect themselves or move to dumb hardware that is impractical to hack.

Most people can't use systems well enough to take charge of their protection. Ideally they wouldn't need to use systems beyond their competence any more than I should have to synthesise my own ibuprofen from scratch (I wouldn't know where to begin), but software ate the world so they can't opt-out either.

Old survey now, but I doubt the results would be significantly different today: https://www.weforum.org/agenda/2017/02/a-quarter-of-adults-c...

> I don't understand this trend of blaming corporations for not being the de facto gatekeeper of security

Governments, the alternative place to seek security, can't do it. The attacks are global in origin, cross border government cooperation isn't at that level, while all Apple local corporations worldwide are all aligned with the one in California.

This trend was preceded with "install antivirus", which had some overlap with "don't connect to the internet" back when that was practically possible.

> They should help minimize spam/malware, but if you're going out of your way to disable those securities (likened to turning off Windows Defender after 2 warnings), your insecurities are self-inflicted.

Those warnings are themselves seen as Apple trying to prevent people switching to other stores.

> I won't believe a signifigant portion will get through idiot-proof safeguards just because "well they have a chance to now!"

What counts as "significant"?

For example, 1% of a nation having their bank accounts drained would be a huge issue — I think that's about 15 times what ransomware currently costs per year.

I've yet to encounter a system so well designed that it's at the 99% level of "idiot-proot", the closest they get is by being the exact opposite: too hard to use so the idiots hurt themselves some other way first.
Builtins well thought out? Have you seen the bignumber api?
As would anyone that has ever had the displeasure of interacting with him
That’s some good news that will hopefully smooth json handling out.
Maybe not "most", but those big brands you rely on in your everyday life, they do.
Respect to the OP as spiking networks are a different domain, but the field of Graceful Degradation and Perturbations itself is almost older than the field of Neural Networks itself. Generally, the bitter lesson occurs - these techniques show some kind of useful robustness at parameter M, but fail to show as much of a useful robustness relatively as parameter M*100. For example, before attention, using Drop out (in essence a form of forcing robustness) was one of the most common techniques. The quality of robustness or its resulting sub parts (e.g. the tradeoff between precision and recall) is incorporated as a measure in some of the fields basic scores, such as harmonic F1 score.

Still it, like alternate activation functions, data beyond matrices and vectors and non-linear networks, remain very unstudied.
So you used the same towels an entire week? How did you not run out of TP and soap?

I don't understand why you would not want them to clean your room as it's included in the price.
Out of interest, do you put relayd in front of httpd? (I’m not knowledgeable enough to know whether that would improve security or not)
Yeah this. I can't imagine running a marathon. But walk 40km straight? I'd be tired, but could definitely do it.
I just tried messing around with the chunk size until the results looked best to my eye. One important thing to note is that each chunk includes a portion of the previous chunk as context. But yes, it’s not going to have context that spans the entire document. For that you would need a final step that takes the entire output. One thing I learned from this is that you can’t ask too much at once from these value tier models. If you keep your requests modest and focused, they do really well. When you try to cram too much complexity and too many rules/requests at once, they start messing up and leaving stuff out and hallucinating.
I just returned from vacation in Wisconsin, where the Olympics were on everywhere. Every single time an ad prompting AI came on, people loudly booed, and it was not uncommon to hear "don't be a sucker!" and "fuck that bullshit" yelled out. When I asked, people would say "I'm not stupid, I'm not touching AI anything."
Man this has motivated me to help this guy out
Interesting connection can you elaborate more about ideal stoic which part of the philosophy that translate to which math concept.
I agree so much. Not a single mention of what a strip camera is and how the picture we see is not a picture but a composite of 1px wide timestamped slices.
Shame on Petapixel
Want to get to the real source of truth for your system? Do `ls /usr/share/man/man1/`[1] to list the commands, and then use `man 1 $command`

The manpage is opened with your $PAGER, so you can use your favourite search and navigation commands.

Ideally your system has a `man 1 intro` to guide you to things.

[1] Paths might be different for Nix or MacOS users
And you're relying on security through obscurity.
Henry Petroski's The Evolution of Useful Things
one big problem i have with this story is that they have magic anti antimeme drugs and they somehow still don't know what scp-055 is
It was a fad to abandon this for flat design, but it has been shown since then, that many designers are highly incompetent when it comes to useability - and this is great useability as in - the interface explains itself.

Which 2d- flatland designs usually do not (some do, with animations etc.) . Thus the fad is in full retreat and useability is king again.
That's what the extension does for you.
Personally I've always considered it bad hygiene to commit generated outputs, but this article notes that this takes on a new significance in the light of supply chain security concerns. Good changes from PostgreSQL here.

Generated output, vendored source trees, etc. aren't, or can't be, meaningfully audited as part of a code review process, so they're basically merged without real audit or verification.

My personal preference is never to include generated output in a repository or tarball, including e.g. autoconf/automake scripts. This is directly contrary to the advice of the autotools documentation, which wants people to ship these unauditably gargantuan and obtuse generated scripts as part of tarballs... an approach which created an ideal space for things like the XZ backdoor.
> Queue failures are just a destructive form of back pressure.

Depends on how it fails. Could just as well fail by throwing away entries.
I built a dependency downtime autoresponder to stay on top of outages
I am Guillermo, the inventor of Failping.

After working as a developer and deciding to quit my job to pursue building things.

Failping is designed to keep an eye on your most crucial services and respond immediately when they fail so that you are not left in the dark, offering your users some peace of mind. The process has not been easy though with numerous iterations and sleepless nights, but I’m quite contented with the outcome.

Please feel free to share any thoughts or suggestions, roasts...
Is this why / when airmiles when bankrupt and get bought out at the 11th hour by BMO?

https://newsroom.bmo.com/2023-03-10-BMO-Confirms-Agreement-t...
Ask HN: Where to look for part time jobs for something I like to fiddle with
I’ve worked on the industry for a long time as a system administrator/ SRE with addition, of my own volition, of some work with data analytics, like making some reports from databases using SQL and python scripts and making custom dashboards pulling data from multiple sources which provided good overview of status and health of the systems.

Recently, I’ve realized that working with data, SQL, Python, and Linux makes me happy. I’m looking to transition back into a part-time role focused on these areas, but I’m having trouble finding the right opportunities. I’ve explored job listings for data analytics on LinkedIn, but they don’t quite match what I’m looking for. I'm not sure I want to do full blown SRE stuff either. Specifically, I want to work on tasks involving writing SQL and Python scripts, as well as working with Elasticsearch and monitoring dashboard, getting data from unstructured logs using regex and so on, doing things in this area. If you know how to describe it better I’d be grateful. I I know it may be kinda strange but that's what I like to do.

Do you know where I can look for it or maybe how can I clarify it?
It's made by Omega. They are the official timekeepers and have to take care of this.

Also from the article:

> an image taken by an Omega camera
For vulnerabilities I can at least understand that — most of them can be used nefariously, and you also get a shitton of money if you report it. Publishing some company's trade secrets, though, would only hurt their bottom line, which isn't necessarily even a bad thing for a company that has orders of magnitude more money than it knows what to do with.
> They don’t even talk about what it does.

Fix photos?
Making YouTube non-viable is the entire point. Google should not be the gatekeeper for the world's content, or get to decide who wins and loses in a rat race trying to keep up with algorithms built to keep users addicted to low quality advertizer friendly content.

The end game of ad blocking tech is to make ads a non viable source of revenue so creators will move on to ethical platforms like LBRY or peertube where creators are in charge again and users can pay them directly with no corrupt middle-men .

I would suggest being an early adopter on alternative platforms building a direct relationship with a more independent donation-motivated audience before everyone else does.
This isn't much different to some of the early reactions to computers...
> I do worry that if this takes off it will just result in those sponsors pulling their budgets for this type of advertising

I think most advertisers track how their ads are doing by looking at how much the personal discount code gets used, or tracking links in the description. I won't ever use any of that, so no advertiser will ever know I didn't have to suffer through the ad read about their product.
I use the web app if possible 100% of the time, but there are other generations that only (or mainly) use cellphone apps.
I know it’s a good thing. I’m just curious to what degree packagers see this as extra work. Seems like probably not.
It's an additional install, like the jdk.
Typically on a brand new os install the equivalent of these steps would be done:

sudo apt-get install <jdk>
sudo apt-get install maven

And then you'll be good to go.
Gas taxes only fund about half of road construction because it hasn’t kept pace with inflation. The general fund covers the rest.
It is a very real option. If it's not being exploited by hundreds of people right now and you make more money keeping the site up vs. what you lose in "fraud" it makes sense to keep it running.

Just like you don't shut down your store if someone stole some merchandise or how credit cards just factor fraud into the fees.
The Pall Mall Process and Commercial Spyware Industry
The folks at Wix experimented with this (although I couldn't get their demo working) https://twitter.com/YDaniv/status/1820558358648435020

They say it works in Chromium, it's buggy in Firefox, and slow in Safari.
> The #1 valued thing in science is [...] reproducibility.

If only. Papers rarely describe their methods properly, and reproduction papers have a hard time being published, making it hard to justify the time it takes. If reproducibility was valued, things like retractionwatch wouldn't need to exist.
Ask HN: Why are employee-owned tech companies so rare?
It seems odd to me that employee ownership is not more commonplace in the global tech world. Especially for companies that serve a small niche with a useful product that won't necessarily scale massively, why try and chase VC funding instead?

Particularly for techies outside the major global funding hubs, employee ownership seems to be a model much more aligned with building a sustainable business with the potential for greater employee satisfaction and a healthier culture.
I often find that it's easy for me to explain things in enumeration. I'm wondering if a) there is a latent middle manager living inside me, always shuffling his little powerpoint decks, or b) there is a little LM living inside me, making me compulsively enumerate things.
Google still works without javascript.
Actually Patreon has played it perfectly by offering an android app, ios app and a website, and increasing the prices on the ios app to cater for the fees. The next thing should be to provide a clear notice on the ios app that lower prices can be found on the other apps. Then they will be able to objectively tell how many people value the app store's value additions enough to pay extra
No. It's relying on both cryptography, and the inaccessiblity of information. Which is a tried, practiced, and often federally mandated, method of security. Controlling who has access to information is sorta security 101. Don't dump your database to the Internet.

Security through obscurity is allowing REST commands to the /totallysecretaddress/neverleaked/ URI.
I have a feeling that you've never dealt with sequences of bytes (encoded strings) in Python 2.
Even sponsor segments mean you are being biased by third parties, which makes it harder for you to criticize them later if they are no longer something you would honestly endorse.

I did not click the video to waste time hearing about corpo sponsors you have been paid to shill. At most I will listen to information of non profit causes to donate to.

Use the sponsor segments to tell users how to donate to you. Sponsor block categorizes these differently and leaves them by default.
Exactly. What is he even comparing go modules with? npm and pip? The dependency disaster management which keeps breaking unless I create a new virtual environment for every project?
well i'm from chicago so to me pizza is a tureen of tomato sauce
Definitely comes down to mindset. And circumstances. And, as you note - having adequate tools for the job. (Not necessarily the ideal tools, but enough to get the job done without it turning into a grind.)

Working on my tractor in the summer, when it mostly sits idle anyway? A pleasure, I can tinker with it a few hours every now and then and bring it all back into working order before I need it. It almost feels like meditation, being focused on fixing a very real problem rather than optimizing some abstract piece of code.

If it is in the middle of winter, freezing inside the shed and I NEED it to be working by next morning in order to clear the snow, thus enabling the kids to get to school and my wife and I to work?

Not quite as enjoyable.

But, as you say - with the proper mindset and a can-do attitude, it is incredible what tasks you can figure out how to do by studying the problem, asking for a little help, looking stuff up on the 'net.

Experience? That is recognizing the tasks you had better leave to someone else. :)
Makes you wonder if there a colleague who wanted to use Django with the biggest "I told you so" grin right now
> It would be much better if you could just use the already installed, always updated browser as the runtime for your "local" app.

So that an update, automatic if at all possible, can break all the apps at the same time.
> I used to work for a Go shop. We dealt with financial data.

People dealing with finance are THE MOST risk-averse people I know. No new tool will be used without years of vetting and it'll still be blamed if something goes wrong - even if the new tool never touched that bit of the process =)

Source: Consulted for a finance company and it was Ye Olde Java and COBOL all the way down =)
I had read this comment, but didn't read it under this lens. Thanks for (re)pointing me to it.
Yesterday I went to a college entry prep seminar for my kid and they were selling a "personalized preparation plan created by algorithms and AI"
That of course works, but the problem is then using this. Take a simple JSON like `{"list": [{"field": 8}]}`. To retrieve that value of 8, your Go code will look sort of like this:

var v map[string]any
json.Unmarshal(myjson, &v)
lst := v["list"].([]any)
firstItem := lst[0].(map[string]any)
field := firstItem["field"].(float64)

And this is without any error checking (this code will panic if myjson isn't a json byte array, if the keys and types don't match, or if the list is empty). If you want to add error checking to avoid panics, it gets much longer [0].

Here is the equivalent Python with full error checking:

try :
v = json.loads(myjson)
field = v["list"][0]["list"]
except Exception as e:
print(f"Failed parsing json: {e}")

[0] https://go.dev/play/p/xkspENB80JZ
Biden admin wants to make canceling subscriptions easier
It still won't beat the deployment speed of

scp executable user@host:direc/tory/

that you get with Go.

I still use python for stuff that never leaves my computer, but in most cases if I know I need to run it on Someone Else's Machine (or even a server of mine) I'll reach for Go instead.
You can also time delay any content .

Supporters get access via paid LBRY views or access to unlisted or privately hosted videos right away, and they are published a month later for free on public platforms.
It's going to be a trivial amount of extra work. Packaging build systems (well, the mainstream ones: Debian, RPMs, ebuilds etc.) have the concept of runtime and build-time dependencies, so the maintainers will just need to add a few more packages to the build deps list.
I'm always open to meeting new people with different backgrounds, so if you do go we could get a beer together or something :)
You usually get 2-3 full sets at a hotel for towels. You swap towels more frequently than once a week?

Most hotels stock at least two rolls of toilet paper too. I’ve personally never run out of toilet paper this quickly.
You can, but then it's a lot of work to actually traverse that map, especially if you want error handling. Here is how it looks like for a pretty basic JSON string: https://go.dev/play/p/xkspENB80JZ. It's ~50 lines of code to access a single key in a three-layer-deep JSON.
Paula Script is a lightweight scripting language written in C++.

- Small but easy to expand. Currently minimum CLI build size is about 35 KB.
- No runtime memory allocation: everything runs in buffers that are initialized at the start.
- Stand-alone: minimal external dependencies. Built-in parser.
- Line-by-line, non-blocking execution: Paula executes the code on the fly while reading the input. It can take input from an endless stream and execute the code from a buffer without memory issues (no runtime memory allocation).
- Compiles for Windows (Visual Studio) and Linux (GCC).
- Command line interface (CLI) and a static library.

Project status: work-in-progress.