skysight-inc/HackerNews huggingface dataset:
You can do a lot more than just keep Windows up to date. Here are some other things you should do:

1) Use separate accounts and machines for administration tasks. Basically, IT people should never use their e-mail, web browsing, and development machine for system management tasks. They should use a separate machine with a different account for these tasks. The main reason is the system management machine has a much smaller attack surface. Ideally, it should only run a communications program (IRC, Slack, MS Teams, etc.), and the tools the person needs to do their job. Examples of tools people need include SSH, Remote Desktop, kubectl (Kubernetes tool to manage a cluster), etc. The machine should have a web browser BUT the web browser should be restricted to the bare minimum number of sites needed to administer the systems. Examples of acceptable sites include the Azure Portal, the AWS web site, web sites to configure equipment, etc. Examples of things which are not allowed include web mail, documentation, etc. The goal is to have the smallest possible attack surface.

2) People need to be mindful of what they install on their machines. I have seen a lot of people who will install anything which looks useful on their machine. This is a great way to get hacked. Here are the questions people need to ask before installing software.

- Why do I trust the people who wrote the software?
- Why was the software created? What was the motivation of the author?
- How does the author support himself or herself? What would happen if one of the authors was in financial distress?
- How will I know when the software needs to be updated?
- What are the capabilities of the software's authors? Do the authors understand how to write secure software? How do the authors handle security bug reports?

Basically, you ask these questions because you want to avoid malware, and you want to use software which fixes its security problems.

3) Consider putting system management machines on a different network or VPN. Basically, it's harder to hack a machine if you can't easily communicate with it.

4) System management machines should not be listening on any ports (or should have a firewall which blocks all connection attempts). It's harder to break into a machine when an attacker cannot connect to it.

5) Put the system management machines behind a firewall.

6) Consider what happens when an account is eventually hacked. Many people assume that only dumb or incompetent people get hacked. Unfortunately, this is not true. Systems should be designed to assume accounts will get hacked. The best designs limit the blast radius (damage) of account attacks.

7) All users should have limited privileges. Basically, they should get the privileges they need to do their jobs. Very few people should be allowed to have the equivalent of root/Administrator for the entire system (obviously, people may have these permissions for some machines but almost no account should be able to do anything on any system the organization runs).
They either run out funding (so be forced to do layoffs, liquidations etc) or they have to find someone who can bail them out at unfavorable terms (read dilutions) or be really really good at story telling.
I'm trying to bring the encryption benefits of MTLS, the security of X509 Name Constraints, and the improvements that have been made in the various clients libraries and operating systems to TLS behavior into a nice group, so that any small company, or even individual, can run their own CA infrastructure that puts the bug enterprises to shame (specifically, https://enroll.visaca.com/ already deserves a lot of shame).

I'm doing so by making it easier to mint certificates for your pods in k8s (https://gitlab.com/gauntletwizard_net/kubetls/-/tree/master), by writing documentation on how to create good root certs with cheap HSM backed keys, updating cfssl to work with name constraints (https://github.com/GauntletWizard/cfssl/tree/ted/constraints), and building tools to issue short-lived certificates to developers.
> One of my minor bug bears is why we humans have to enter time into input fields in such rigid formats when there's a straightforward algorithm to make such inputs far more natural.

GNU date supports very human-oriented date input, some examples:

$ date --date "today"
$ date --date "next sunday"
$ date --date "now + 3 hours"
$ date --date "3 months" # same as "now + 3 months"
$ date --date "5 december 2020"
$ date --date "oct 19 2007"
$ date --date "08:00"
$ date --date "8:00"
$ date --date "0800"
$ date --date "0800 UTC"
Tesla and BYD having different philosophies doesn't mean we need to adjust to Tesla to look at their numbers. If they're targeting the same job to be done (getting from A to B on an electric charge) they're in the same overall market.

We can subdivide on long range travel, trucks, lightweight mobility, cars with a US plug, or having a plugin architecture or not, but that's not what the article was about, nor what we're looking at here IMHO.
Do they have that in there?
There's a huge need for a product like this in the small and mid-sized PR/marketing agency space. Announce to those folks -- PR and marketing subreddits might be a good place to start, subject to their product-announcement posting policies.
idk why you’re getting downvoted. you’re absolutely right and not disparaging in any way. sometimes hn can’t see the forest for the trees…
Well in Telegram's case the idea is that they knowingly provide taxi services to those criminals and do supposedly nothing when it's reported to them because they are "too small" to moderate everything
You'll be limited by memory bandwidth more than compute.
About the Psycopg2 Name
Are you using any API to scrape LinkedIn?
This is phenomenal. Thanks for sharing.
I'm putting the finishing touches on the major engine pieces for my NES game Tactus. (https://zeta0134.itch.io/tactus) The level generation is all working, there's a new raster effect system that can do nifty screen-slides and distortions, the dynamic lighting is more performant, and I'm at the point where it's time to shift gears and start making a bunch of content.

The one zone that's in the game is looking more polished than ever, but it's not going to be much of a game if there are only 4 levels. Next month is all about stage art, enemy design, and items to flesh out the new economy systems. Hopefully it all comes together, we'll see. It's a ton of pixel art, and I'm still learning my way around that craft.
For years I would fly with Sponge Bob Squarepants themed underwear so in the infinitesimal chance of a catastrophe someone cleaning up the wreck might get a chuckle.
For me, it's all about not leaving anything for the swim back.
Young Frankenstein
It’s over, you can’t just rebuild the old Boeing. It’s gone.

Good job bean counters.
> Benjamin Franklin

Supposedly that's not his quote though?

https://news.ycombinator.com/item?id=41342251
It should do just fine and if it has any misunderstandings, you can correct it via something like a cheat sheet in the base prompt. Not CoPilot specifically, I don't think it allows access to the system prompt.
I don't know why but I just love being able to read all of this fascinating information in such a compact form, just amazing! Heading back over to read the rest now!
620 comments now .. it's a chatfest.

The HN ranking eschews chatfest links*, clearly enough people know about it and are diving right in talking backwards and forwards, it's "hot" on the newcomments view:

https://news.ycombinator.com/newcomments

and doesn't require "frontpage" pimping (according to the ranking weights chosen) <shrug>

( * there's some downpressure from the Votes Vs Comments ratio, threads with many votes can frontpage despite the baggage of comments )
Nice work!

Cool that you made this available for other people to benefit from.
See also the classic "Are You Sure You Want to Use MMAP in Your
Database Management System?" which mentions this common pitfall of mmap, and others, in the context of DBMS.

[0] https://db.cs.cmu.edu/papers/2022/cidr2022-p13-crotty.pdf
He said he was up for two days prior.... Meth, and he's blaming mushrooms?
Super fascinating article, thanks for sharing!
What do you mean? I saw the videos online. The mighty Houthi missiles ravaged the Eisenhower, leaving it barely more than a series of smoking craters born aloft for PR purposes by support crafted AI-edited out of any of the video footage US-ians are allowed to see.
> But when an account is flagged for spam, Telegram rapidly responds [...]

In my experience it's the channel's admins who respond, not Telegram's.

If that's the case then CSAM not getting actioned is probably just channel admins allowing content that they approve of.
Founder and CEO of Telegram arrested at French airport – report
I've been working on BatchWizard, a CLI tool for managing OpenAI batch processing jobs. It lets you easily upload files, create batch jobs, check status, and download results - all from the command line. Handles multiple jobs concurrently with async processing. I built it to simplify working with OpenAI's batch APIs.
Check it out on GitHub if you're interested: https://github.com/cmakafui/batchwizard
PBKDF2 is at least better than YoloPBKDF (which looks rather like PBKDF1). Besides brute-forcing, YoloPBKDF/PBKDF1 has a maximum key length (the length of the hash function output) whereas PBKDF2 can construct longer keys. PBKDF2 also uses a pseudorandom function like HMAC-SHA-1 instead of just a hash function, and I'm assuming that change was done because it strengthens the security in some fashion.

In any case, if you have the choice of making "aggressively mediocre" passwords harder to crack, is there a reason not to do so?
> You won't believe for what are responsible paper money printed by central banks.

100 times yes. So where are laws and regulations for the money?! Oh wait. They exist :)
> fascinating information

...you don't find it uncomfortable or distressing to be confronted with the dry facts and hard-limits of the 1.5Kg squishy-pink prison we're all trapped-inside and all condemned to die inside?
One of my things is a C-based alternative to react native. https://github.com/petabyt/libui-touch
Completely unfinished and incapable.
There are plenty of reasons to reinvent tools that have existed for literally decades and are included in pretty much every Linux distro.

1. Someone wants to do it. Most open source is developed because someone just wants to.
2. You aren't happy with the language it's written in C vs Rust.
3. The tool is lacking some set of features that you want.
4. The tool isn't as easy to use as you would like.
5. The tool doesn't support some platform you care about.
6. Using the tool requires more knowledge or cognitive load than you would like.
7. The tool you are replacing has multiple variants that have different feature sets slightly different supported syntax (gnu make vs bsd make).
Reminds me of Pig. Or a pathological stack of CTEs.

Doesn't look compelling for the lockin.
I have some side projects that I work on alongside my regular job.

- TheFile.Ninja, which is a file manager with the Everything indexer built-in for extremely fast information retrieval. This allows you to quickly run file queries, and these queries can then be saved or even added as folders in the file system. When you open the folder, it automatically fills with the contents from the query. I have also created a service with LLM/AI that translates plain text into Everything's query language. This enables you to build very complex queries directly from plain text. For example, you can ask if any directories contain a certain file, and if this file is found and contains specific text, it will be displayed. You can learn more about the project at: https://thefile.ninja or watch https://youtu.be/JREufgkf5pk.
This summer, I also built three smaller games (not fully finished but almost):

- ThrustMe!, a space/underwater cave exploration game (https://youtu.be/M0d7CSpEJ1E). It works on Android, Web, Windows, and possibly soon on iOS.

- MergeQuanta, a Tetris-like game where you merge matching blocks (color + shape) to make them disappear, taking surrounding blocks with the same shape along with them. There are also cement blocks and bombs. The game works well with touch and stylus but also on regular computers (https://youtu.be/VXvpzhi8ySE).

- Flip the Maze, a simple multi-dimensional maze game (https://www.youtube.com/watch?v=qOVRB0uAPIE).

What do you think about them?
I don't understand. The article is about maze generation and it only talks about traversing predefined mazes. I had a similar thought after reading an article about generating sudokus. Like they were alreadt generated and the article was about creating a solver. I am surely missing something, what's the part I don't understand?

Ok, after rereading I think I'm starting to understand. The walls of the cells are generated after, based on the path the generator went through? I feel stupid for not understanding this later but will leave this in case I still don't understand something
> Telegram is end-to-end encrypted in private chats

Not by default (unlike the other services you've mentioned
)?
Thanks, I think the linked article is worthy of its own submission:

https://news.ycombinator.com/item?id=41344613
Lemmy is pretty good but still needs to grow in terms of active communities for any topic the way Reddit is. Still a worthwhile project and probably the most likely dominant alternative to Reddit
I use other chat clients. Encryption is by default and no clumsy UI or lost chats yet. Proves it's possible if TG really cared;)
And visual and thematic motifs that should seem heavy-handed but somehow just glide past behind all the action (Distorted mirrors! Distorted mirrors everywhere!) Arguably bullet-time was another form of visual distortion. Remember how in the 5 years after the Matrix, bullet-time seemed like it was used fucking everywhere? Movies, video games, TV commercials? This was back when convincing special effects were still thin on the ground, so bullet-time had quite the impact the first time everyone saw it.

Also, in my opinion the social metaphor of The Matrix has become more relevant over time. For 90's sci-fi, it has aged like wine.
That's funny, because some time ago (well, some years ago) I swore people were crapping on telegram's encryption and telling it was almost fake

But if it was so weak then various intelligence agencies wouldn't be bothering with it
I could feasibly do 2x partitioning. E.g. have caches for 16KB, 32KB, etc provided there's some mechanism to automatically combine/split pieces
Do you have any confirmation for what you are claiming? E.g. the claim that all ISPs simultaneously voluntarily decided to throttle Youtube to reduce foreign traffic? It seems to me that you either don't know the details or are simply trolling.

> It's not banned, it's throttled because google kept abusing backbone networks once their CDNs had started to burn down and claiming that this is totally fine and fixable with direct BGP peerings with ISPs (yeah, right)

> It works just fine on mobile internet connection where traffic shaping is an inherent feature and it only works like shit on broadband where ISPs are only capable of sending TCP RST once the queue is over the limit.

This is not true. The connections to googlevideo are throttled by government-operated DPI, not by ISPs. You can verify this by sending following request from a Russian residential or mobile IP address to a Russian hosting provider Selectel:

curl --connect-to ::speedtest.selectel.ru https://manifest.googlevideo.com/100MB -k -o/dev/null

The request above is not send to Youtube, it doesn't even leave Russia, but it will be throttled because curl uses "googlevideo.com" in SNI field in ClientHello TLS record. DPI detects the SNI and drops the packets. The download speed will be very low, in the range of kilobytes/sec. However, if you remove googlevideo.com domain from SNI and write

curl https://speedtest.selectel.ru/100MB -k -o/dev/null

Then the file will be downloaded at full speed, megabytes/sec. It is a request to the same host, to the same IP address, but it is not throttled anymore.

Also the information about mobile connection not being throttled is outdated and incorrect. Nowadays mobile connections are throttled as well.

The information that all ISPs voluntarily decided to throttle Youtube is implausible. Why would they throttle the speed to allow their competitors to lure away their clients?
Yo! Let's chat. Our visions align and are complementary.
Check email
Quill says it’s not.

The grammar and writing seems completely off though. Like poor.
I don’t know in France, but at least in Italy companies are not a shield for penal responsibility; crimes are always committed by persons. If a company does something criminal, someone is responsible for that decision within the company, and that could be the CEO.
https://www.youtube.com/watch?v=QifpqSiNSKA is the author showing it off (since the visual aspect is kind of the whole point.) (The little window-layout section of the status bar is neat, but I get the "monocle" version of this with stock i3 with a lot less effort - `workspace_layout tabbed` and some key bindings :-)
The most bonkers thing to me is how Starliner was allowed to fly with crew on board when it was on the pad leaking helium. This leaking was known and ongoing for hours and they let it fly anyway.
It's not ideal, but it's not a cryptographic risk.

Using an encoding that (like Protobuf) has multiple representations for a message may cause you problems if you switch implementations - sha256(encode(msg)) might yield different hashes on different implementations of encode().

But the main risk is an encoding that has multiple interpretations of a single encoding (e.g. sha256(encode("admin", "true")) == sha256(encode("admint", "rue"))), and Protobuf (can be unserialized, and thus) doesn't have that problem.
> “Not at all,” said the medtech. “Think of all the work he represents on somebody’s part. Nine months of pregnancy, childbirth, two years of diapering, and that’s just the beginning. Tens of thousands of meals, thousands of bedtime stories, years of school. Dozens of teachers. And all that military training, too. A lot of people went into making him.” She smoothed a strand of the corpse’s hair into place. “That head held the universe, once.”

-- Aftermaths by Lois McMaster Bujold
> I could imagine him staying in custody while being investigated for a couple days, then quickly facing some level of judge to decide whether he has to stay in jail or can be released.

I think the original link mentioned exactly that, and it would be done over the weekend
A game engine for coders.

It comes with a set of tool for your IDE (currently only VSCode) where you can draw sprites, compose music, make SFX right next to your code.

It's still not in v1, it's also my first "serious" C++ project, and life got in the way lately -- I haven't made significant progress in the last month or so

https://github.com/latebit/latebit-engine
> The Windows ecosystem is at its core about backward compatibility and minimizing training costs (path dependence). There are billions of employees who have to be trained button click by button click.

If this was their core they must've butchered it by releasing Windows 8, Windows 10 and most recently , Windows 11. And I'm not even counting thousands of minute stuff they've changed versions before these.
>By the way, the default fetch `credentials` value ("same-origin") doesn't send cookies to third-party websites either. Why CORS still applies here is a mystery to me.

There are other types of authentication besides cookies. E.g. TLS client certs. Does the browser not send a TLS client cert for fetch requests that don't send credentials? In some cases that could double the number of TLS sockets: one socket with a client cert and one socket without a client cert.

Another type of authentication is sites that only allow requests from certain source IP ranges. Or similarly, services run on a local LAN that aren't exposed to the public internet (e.g. a router's admin panel that's only accessible to devices on the LAN) or a service running locally on your machine serving on localhost. Someone might want to run a service locally and allow foo.com to make requests to it and read their responses, but block evil.com from making requests to it and reading the responses. And there might be no cookies involved with that local service, because it's running locally on the user's machine and thus doesn't need cookies to know who the user is. Of course we also need to consider DNS rebinding attacks. Those can be protected by Host header checks or Origin header checks, but Origin header checks only work for requests that send an Origin header, which aren't all requests.

>I think CORS is a security theater.

The same origin policy and CORS have 2 aspects:

1. Preventing evil.com from reading the content of email.com . I don't think this is security theater. This is very useful for security and doesn't have a bunch of confusing caveats. CORS headers can be used to allow good.com to read the content of email.com if email.com wants to allow that. That's useful for certain functionality.

2. Preventing evil.com from sending certain types of requests to email.com . This has a bunch of confusing caveats about which type of requests are allowed and which types are blocked. So this isn't super useful. However I don't think I'd call it security theater. Here's how I think this restriction was created: As browsers added more and more ways to send requests, they wanted to avoid introducing vulnerabilities to websites that were created in the past before those types of requests could be sent and that relied for security on the assumption that those types of requests couldn't be sent. So the browsers implemented preflights to make sure that these new types of requests they were creating wouldn't introduce vulnerabilities to old websites.
> Why should I think that LLMs would be good a

They make language that sounds like what thinking people make, therefore they must be thinking like people do, duh! /s
Thank you! If you replace a prologue (as standalone game) with a demo, can you transfer the wishlists?

Marketing isn’t my strong point, if I ever had the money to make another the first person I’d hire would be marketing. My boss owns a PR agency and she said she can help in getting it out to journalists but that’s about it. I tried CPC and it came in at about $1/wishlist.

Are there any methods of marketing you recommend?
what kind of a spare time is that, i want one also, congrats bro.
Kiki’s Delivery Service is a parable about creative work and burnout. I often put it on in the background during difficult periods at work.
Running an end-of-service OS such as Windows 7 means it's very likely that there are plenty of unpatchable zero-days for it. Being forced to upgrade probably made you safer and reduced your attack surface.

I completely agree with you about Windows 11's unusability. However, Windows 10 will be end-of-service in a year and that really sucks. I have been clinging to Windows 10 and I do not look forward to being forced to upgrade. But it's better than having a system that no longer has security updates and has tons of nation states looking for/already hoarding zero-days.
No, like all schemes created by the US, companies will only accept the money if they know they won't have to repay it back. They just need to show "intention" of investing that money; for example, trying to start a new factory, even if knowing that it will never be operational.
Why would you be afraid of EU LE? Unlike countries such as Iran, Russia, SA, UAE it has reasonable laws.
I've been taking a (mental) break from programming and doing a lot more climbing, getting back into my body. After twenty years of boulder/sport/trad/big wall I've drifted into the dark art of rope solo. It's an wild way to climb that really appeals to my engineering brain - lots of deep knowledge about gear and the mountain intertwined with various logistical puzzles. Very rewarding when it works. The latest mission has been optimising my system a lot to start tackling bigger stuff.