skysight-inc/HackerNews huggingface dataset:
Identity "theft" is corporate responsibility laundering. It is not "theft" it is "lack of safeguards on PII" plus "lack of meaningful, protected PII" combined with "A complete lack of proper vetting of loan / credit applicants"

Someone put the right 10 digits into a webform? What could we do! They stole your identity!

No, you just didn't want to force someone to walk into a bank to apply in person because that would cost more and reduce your new applicant rate.
Yeah I wouldn't rely on their editorializing. It's best to just refer to the FAQ [0], which covers these questions.

[0]: https://www.gnu.org/licenses/gpl-faq.html
I am also firmly a "tags versus folders" person, since an AWS credential is both "aws" and "qa"

Also, I get a lot of mileage out of the Fastmail "masked email" integration with 1P

I also still run KeePassXC just for its GPG agent support, which 1P hasn't (and I suspect won't) supported. I think 1P is all-in on using SSH keys to sign commits, which yes, is one GPG use case, but come on
Doesnt the US have like 17 clandestine agencies, I am sure many of which could engage in covert overseas activities that send a message to future actors about what could happen to them.
Yeah if an applicant/incoming hire is reaching out then definitely respond! But I'd wait for the applicant to initiate it - if the company does, the applicant is under pressure.
> The problem is that y'all unlike most/all of Europe don't have a requirement for people to possess a government issued ID card with a picture on it.

You aren't required to posses one in Europe either, but you get assigned a unique number at birth to identify you.

Of course life is hard without identification, but there is no law mandating that you get one, at least not in all EU countries maybe some of them do.
There's no way for someone to make an identifier that's also a secret secure. You could have huge penalties, give the corporate death penalty, and you'd simply see old insecure companies replaced with new insecure companies. Add a real death penalty for the CEO, and you'd just find all the new companies are run by people who have nothing left to lose (or death row inmates suddenly find they have a bunch of new opportunities).
Oh No! \s

As if SSN wasn't already the most insecure form of identification on the planet. Maybe now we can stop pretending it's a valid form of identification.
> Apache has probably more unofficial modules, but that's irrelevant to the core developpers.

In a way it's irrelevant, but in a way not. The myth was that they called it Apache because it's "A patchy" web server.[1] IOW it was designed to use modules to do most of its work.

[1] https://dan.hersam.com/2004/07/29/a-patchy-web-server/
> trust and a handshake

Bingo. If you really want to screw someone in a deal, you probably can regardless of contract. But, do that enough times and no one will work with you.
Well, there's a Venn diagram where there is overlap of legitimate concern over tracking people and these religious beliefs. OTOH SSNs are like the least of problems compared to how tracking is all over our digital lives.
Iran reports largest cyber attack in history on banking
Molecular biology. Building plasmid editor software, make some liquid cultures and glycerol stocks, did a miniprep, about to try transformation into competent cells, cloning, and expression.
I want kids, but would not raise them in America.
> make use of the ultimate in jam resistance: neutrino transmission. For all practical purposes, almost nothing (including several light-years of lead) will stop a neutrino

Signals aren't jammed by being blocked but overpowered. If you want to disrupt someone's neutrino comms, you don't start building lead walls. You flood their volume with neutrino noise. (I don't know how feasible that is to continuously do over a large volume.)
Oh, I am nothing but liberal when it comes to CSV: Clients get the liberty to either have their requests processed, or get a 400 BAD REQUEST

And yes, I am aware that the standard says this. My counter question to that is: How much client-liberty do I have to accept? Where do I draw the line? How much is too much liberty?

And the answer is: there is no answer. Wherever any system draws that line, it's an arbitrary decision; Except for one, which ensures the least surprise and maximum interoperability (aka. the point of a standard): to be "conservative", and simply demand the standard.
I think the best reason to use a Google phone is that turns out it's one of the easiest to Un-Google by installing GrapheneOS.
I've heard from a clinical psychologist and also from a bunch of people on the internet that the symptoms of BDP are often presented by (especially female) traumatized autists, and they run a high risk of being misdiagnosed with BDP. and based on the diagnosed (entirely AFAB) autistic people I know socially none of them show any signs of being unaware of or unmotivated by social validation.

Also there is a high overlap between autism and ADHD, many people have both characterizing them as opposite ends of a spectrum sounds like a stretch.
While that's true, there are two sides to crime. Prevention and Punishment. One happens before, and the other happens after. People are generally fine with punishment. The prevention part is where we disagree. This then poses the question: how many of your children are you willing to sacrifice on the alter of anti-prevention?

So while a punishment might exist for something, that doesn't preclude trying to prevent the crime form occurring in the first place. This isn't easy work, and of course, it won't work 100% of the time, but it doesn't mean we stop trying to reduce the number.
I learned typescript for a project I spent 9-10 months on. It wasn't that hard to learn but... ugh. On many levels. There are problems where it's typechecking is helpful (enough) for, but the degradation in readability was quite noticeable, and the fact that its abstractions only work at compile time was an endless thorn in the side.

Not a fan.
What service are you using that provides a single "switch" for all 3 agencies?
> Isn’t there loads of evidence for dark matter including direct evidence like gravitational lensing?

There is an equivalent boatload of evidence for modified gravity that can't be explained by particle dark matter [1], but one set of observations is hand waved away as a minor inconvenience while the other set is taken as definitive proof.

If gravity doesn't work the way we expect, then lensing in galaxy collisions isn't necessarily telling us what we think it is.

But setting that aside, if we take even the most naive modified gravity, MOND, then lensing does require a form of particle dark matter, like sterile neutrinos, but the total amount of dark matter required to explain the evidence is only double the amount of visible matter, rather than almost 10x the amount of visible matter as in LCDM. This has significant implications for calculating the Hubble constant from the CMB [2].

[1] https://tritonstation.com/2024/06/18/rotation-curves-still-f...

[2] TeVeS is wrong, but it shows that modified gravity significantly effects the H0 calculation, https://arxiv.org/abs/1204.6359
So git for ML? What a brilliant idea! This is exactly what my team needs.
I was perplexed as well. I even tried counting the randomly capitalized letters to see if it spelled out a secret message or something...but unless someone can tell me what 'TSGMUFLCSDVPVD' means, I think it might be a red herring.
Link to announcement on swift.org:

https://www.swift.org/blog/announcing-swift-homomorphic-encr...

Intro:

Homomorphic encryption (HE) is a cryptographic technique that enables computation on encrypted data without revealing the underlying unencrypted data to the operating process. It provides a means for clients to send encrypted data to a server, which operates on that encrypted data and returns a result that the client can decrypt. During the execution of the request, the server itself never decrypts the original data or even has access to the decryption key. Such an approach presents new opportunities for cloud services to operate while protecting the privacy and security of a user’s data, which is obviously highly attractive for many scenarios.
I'm also a fan of the public keys extension:

https://github.com/${username}.keys
I'm from the USA so I don't have great perspective here. Don't other countries have basic secure chips in their cards? Don't they attenuate or whatever similar to how NFC works?

I mention it because I have little hope in going after the scammers legally or playing cleanup later.
They questioned the hair color ("why blonde") but not the gender ("why a woman").
Geospatial tech transforms government strategy
That's ignoring all the negative effects of using typescript.
A single stock is high risk, an index fund is very diversified, and while it does fluctuate with the market, overall the risk is very low on a long timeline.
Only 10 credits, so, you can do one shot (one image) to test.
Wanted more credits to fine tune.
Apple's biggest competition in India? Used iPhone sellers
The Forests Inside China's Deepest Sinkholes Are Unlike Anything on Earth
And yet they can’t do folders or nested tags, which makes it unusable for me. All those other features are useless when it can’t handle basic organization.
100 times this. All the best teachers and lecturers I have had all followed this methodology.
At least in the EU there's some precedent where AGPLv3+ won out, though it was through settlement and not judgement (and it's not super clear how contentious the parties were anyway) [0]

[0]: https://archive.fosdem.org/2021/schedule/event/agplcomplianc...
It is annoying that passkeys are by definition discoverable passkeys, which make older Yubikeys useless because they can only hold like 25 passkeys or so. WebAuthn non-discoverable keys are so much better as just a second factor of authentication (after putting in your username/email for key lookup).
Context is important in English. Your example is, again, a different context.

A library is one or the other. Talking about safe systems languages where C and C++ share memory safety issues is very different from promoting a library. Thanks for the opportunity to clarify here. You’re confusing context with lack of technical precision.
This is the real and hard problem to solve. As far as I know, there are identity-verification services using other, semi-publicly-available data, which can still be spoofed for a lot of people, and some that use just-in-time photography (of your face, driver's license, passport, etc.), but that relies on more on-device security (and thus less end-user ownership of their devices).

It ultimately falls to the government to provide a more robust solution.
This seems like magic to me.
> Turns out we now have research which shows that people get very attached to the little box they are put in by the DSM and that influences how their symptoms evolve.

After being diagnosed with something in the DSM - I experienced this myself, and have been very aware of the Heisenbergian side effects of labelling and observing something like this in a specific concrete way.

Common wisdom with some psychological diagnoses is that the symptoms often seem to get worse after diagnosis because you start to notice the problems more. But I think there is an "identity" element to this too as you elude to.

I think this is somewhat inevitable, but the question is, even though you may be subconsciously influenced by the diagnosis itself - is it still better to have such a diagnosis and to be able to work with that information - versus not?

From my own experience, I'm not quite sure - but I'd probably lean towards having the diagnosis still being the better option.
It's fine to use them for disambiguation purposes. It's not fine to assume that just because I know someone's SSN (and maybe their DOB) I am that person.
Someone mentioned a skin color, must be racist!

Man, the internet sucks these days.
> A more likely future is less video

I would say less big budget video. If we're being honest, YouTube is essentially television at this point. Many YouTube views, maybe even most, don't go towards individual creators. They go to Studios and the Jimmy Kimmel's of the world.

If someone like boxxy is making videos with a potato cam on her bedroom floor, I don't think she necessarily cares much about the monetization.

That USED to be the entire draw and appeal of YouTube. Then monetization came and surprise! The platform changed to be more monetizable, i.e. watered down and corporate.
Why end with the id instead of doing it like SO, as per the example in the article?
Show HN: Resinq – Build chatbots that speak and text
Just launched Resinq, a platform we've developed to help anyone build chatbots that can both speak and text. Whether you need a customer support agent, a sales assistant, health assistant or something more specialized, Resinq makes it easy to create chatbots that are genuinely useful.

:
Voice & text responses: Chatbots that can talk or text, adapting to your needs.
Knowledge base: Feed your chatbot with knowledge from text, Q/A pairs, documents, or websites.
Easy setup: Deploy as a floating button on your site or app with minimal effort.

We built Resinq to be powerful yet user-frendly, bridging the gap between simple tools and AI. Whether you're a developer, marketer or a business owner, we hope Resinq can add real value to projects.

I’d love to hear your feedback!
I think there's kind of an issue with society when we start viewing people with shared neurodivergences as a "community"

I'm diagnosed ADHD. I'm not a part of any "ADHD community". I'm not shy about sharing that I am, but it's also not some kind of "out and proud" thing for me. It's just a part of who I am, and it's a diagnosis of why I struggle with some things that other people don't

That's all it should be. Not everything needs to be a community.

I would go even further and say that many things shouldn't be a community, especially an online community . People need to build connections with their physical neighbors more than they need a community of fellow autistic or adhd people online
I would have sworn I've read the opposite but found this history [1] outlining usage of SSNs:

> Private sector use of the SSN is neither specifically authorized nor restricted. People are asked for an SSN at banks, video rental outlets, hospitals, etc., and may refuse to give it. However, the provider may, in turn, decline to furnish the product or service, leaving some to conclude they have no real choice.

> Throughout the history of the Social Security program, the SSN, originally intended to be used only to record Social Security earnings, has been adopted for other purposes, both governmental and private. The broad-based coverage of the Social Security program makes the SSN widely available and a convenient common data element for all record-keeping systems and data exchanges.

[1] https://www.ssa.gov/history/reports/ssnreportc2.html
How about great email address design? Of course firstname@lastname.com is top tier. But there are some interesting hacks you can do, such as firstn@melastname.com if your last name domain isn't available.
Lot's of people don't have the means, financial stability and minimum stay duration required to buy real estate.

In my European country, you need to stay 5 years in the appartement you bought, otherwise you need to pay back a large amount of registration costs (tax) back.
Yes, that is called WebAuthn.
In this sense "adversarial" has the same meaning that it does with respect to the relationship between the defense and the prosecution in a courtroom setting -- the best outcome is going to be achieved from the equilibrium of distinct organizations with incentives balanced against each other.

It's precisely because of the importance of policing that we don't want the people responsible for oversight and discipline of the police to have a "solid working relationship with faith and trust running both ways" -- there needs to be an arm's length relationship, with the watchdogs incentivized to monitor for wrongdoing, and the police somewhat afraid of being called out by them, certainly not buddy-buddy with them.
I think Ramsey takes it too far, but then I think about his audience. I can gamble and drink alcohol without getting addicted. But for people who are addicted they usually need to completely stop. I see the same thing with those who are not able to manage their spending or debt. They need shock and extreme measures to get back to a good spot.
The effects of RF-EMF exposure on biomarkers of oxidative stress
Even so, it's still a pretty substantial amount. Larger than Ceres, for example.
I think you could make the same argument about the externalities of many of the components of the S&P 500 too. E.g. you also have to be cool with knowing that your ETF gains are largely contingent on the destruction of the natural environment, or the addicting of people to pharmaceuticals or social media, or…

It turns out our capitalist system associates very few returns to human flourishing!
It should be harder for you to impersonate someone else via their SSN than it is to take a stolen card and purchase a $5 coffee.
It's from a history of seeing their actions across various agencies. The actions are self-serving, typically taking away human rights rather than granting them.
If they don't even have a duty to uphold the law [1], why would they have a duty to know it?

[1] https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia
Are there any prominent examples of homomorphic encryption being used at scale in production? I hunted around for some a few years ago but couldn't find any.
Trump called it a disaster when the same thing happened DeSantis, so I don't see a particular bias in play with that particular phrase.
Could you explain your point in more details?

Sorry, I'm not super knowledgable about this topic.
"Cut and paste" was of course a term used with paper before computers, but arguably the computer version of it is not quite the same, because you have that hidden buffer ("clipboard") and can usually paste the same cut item multiple times. Adapting the physical-world cut-and-paste process to the computer realm can count as an invention.
They do also collect actual rent data, but that is fraught with its own problems. Notably that the large majority don't rent. If you are not collecting opinions from a meaningful segment of the population, you've missed the whole reason for preparing the CPI.

Actual sale data is the best way to find out someone's opinion, but asking them what they would hypothetically pay is nearly as good if sales data is absent. What is most important is to get an opinion from a statistically wide range of people. A billionaire paying $10,000 for a loaf of bread is not indicative. You need an indicator of what most people think.

There is no perfect mechanism.
The FAQ is not at all clear about this question. #GPLInProprietarySystem says that you unconditionally cannot "incorporate GPL-covered software in a proprietary system", although it might be OK to ship a proprietary system that integrates with and depends on GPL software so long as "the two programs remain well separated". How do I know whether a particular API usage qualifies as well separated or not? The only standard described is "like the compiler and the kernel, or like an editor and a shell".
1. It’s usually for institutions. If my email address is username@bigco.com, an attacker already knows that I use BigCo Inc’s internal SSO.

2. It’s avoids having users type (or autofill) their passwords, so if one of (for example) BigCo’s vendors is compromised, the attackers don’t learn the passwords of BigCo employees.
It’s just an interesting infographic that is factually correct. You can disagree that the chosen facts are relatively the best ones, but, not everything has to have an agenda. Calling facts dishonest because they make you uncomfortable is what I consider yucky.
The police do not have a duty to enforce the law, as determined multiple times by the supreme court and other federal courts.
One application I can think of is Google Street View. Gaussian splatting can potentially "smoothen" the transition between the images and make it look more realistic.
I have never encountered anyone claiming the antichrist has anything to do with IDs.
"In AGPLv3, what counts as 'interacting with [the software] remotely through a computer network?'"

"If the program is expressly designed to accept user requests and send responses over a network, then it meets these criteria. Common examples of programs that would fall into this category include web and mail servers, interactive web-based applications, and servers for games that are played online."

"If a program is not expressly designed to interact with a user through a network, but is being run in an environment where it happens to do so, then it does not fall into this category. For example, an application is not required to provide source merely because the user is running it over SSH, or a remote X session."

[0]: https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingR...
I cracked the code, it's an anagram for "Be sure to drink your Ovaltine".
When rich people fire tens of thousands of workers without any repercusion, nobody wants to have kids?
Stroll through a bookstore or library, and grab random books for different shelves
At first I thought it was sarcasm-case. But no, doesn't seem like that either.
Do you backup your Google Drive?
Mine has been leaked so many times at this point that I'll openly share it with anyone that wants it. Anyone here want my SSN? Just DM me. <3
Show HN: An open-source AI Gateway with integrated guardrails
Hi HN,

I've been developing Portkey Gateway, an open-source AI gateway that's now processing billions of tokens daily across 200+ LLMs. Today, we're launching a significant update: integrated Guardrails at the gateway level.

Key technical features:
1. Guardrails as middleware: We've implemented a hooks architecture that allows guardrails to act as middleware in the request/response flow. This enables real-time LLM output evaluation and transformation.
2. Flexible orchestration: The gateway can now route requests based on guardrail verdicts. This allows for complex logic like fallbacks to different models or prompts based on output quality.
3. Plugin system: We've designed a modular plugin system that allows integration of various guardrail implementations (e.g., anthropic/constrained-llm, microsoft/guidance).
4. Stateless design: The guardrails implementation maintains the gateway's stateless nature, ensuring scalability and allowing for easy horizontal scaling.
5. Unified API: Despite the added complexity, we've maintained our unified API across different LLM providers, now extended to include guardrail configurations.

Implementation details:
* The guardrails are implemented as async functions in the request pipeline.
* We use a combination of regex and LLM-based evaluation for output validation.
* The system supports both pre-processing (input modification) and post-processing (output filtering/transformation) guardrails.

Performance impact:
* Latency increase is minimal (<50ms) for most deterministic guardrails.
* We've implemented caching mechanisms to reduce repeated evaluations.
* Since the gateway lives on the edge, it avoids longer roundtrips

Challenges we're still tackling:
* Balancing strict guardrails with maintaining model creativity
* Standardizing evaluation metrics across different types of guardrails
* Handling guardrail false positives/negatives effectively

We believe this approach of integrating guardrails at the gateway level provides a powerful tool for managing LLM behavior in production environments.

The code is open-source, and we welcome contributions and feedback. We're particularly interested in hearing about specific use cases or challenges you've faced in implementing reliable LLM systems.

Detailed documentation: https://portkey.wiki/guardrails

What are your thoughts on this approach? Are there specific guardrail implementations or orchestration patterns you'd like to see added?