skysight-inc/HackerNews huggingface dataset:
> It's indistinguishable from a non-modulated SYN

If the attacker is sniffing the connection anyway (if they're not, then why be sneaky in the first place?), then they'll see the SYN packets.

What exactly is the difference between "the SSH port is filtered, yet right after a SYN goes to port A, then B, then C, the SYN to port 22 is suddenly answered" and "the SSH port is filtered, yet right after a UDP packet with this content, SYN from that address are accepted"?

They're both a secret being sent in plain text, after which the SSH port is open for a bit.

Anyone who's sniffing looking for secret UDP packets is also sniffing looking for modulated SYN packets, because it's still just sniffing. They already know that "something's up", because they see the returning SYNACK. Something made the port unlock.

So yes, it's indistinguishable from a non-modulated SYN, in the same way that a UDP packet with a password is indistinguishable from an unrelated UDP packet without a password.

> the eavesdropper can't even distinguish such port-knocking SYN packets from any other random SYN packet that happened to be routed to the host (there is e.g. a lot of port scanning going on around the Internet)

But isn't the goal to get past the firewall?

> It's encrypted, so even if the eavesdropper could distinguish such a packet, they can't learn the requested port; and they can't even replay this packet, so... what's exactly wrong with it?

Again, this is a completely different question. There are two distinct aspects to port knocking:

1. Generating the "token" (often a fixed password, but can as you say be encrypted, or a one-time pad).
2. Send that "token" to the server, to open the door.

Yes, you should generate a secure token. That adds security. It should not be replayable.

But why are you sending that token using modulated SYN packets? That's like if you had to enter your google account password in morse code. It's just more inconvenient, and the secret is in the password, not the modulation. Anybody who can sniff you entering your google account password can sniff morse code just as well as if you use ASCII.

And I don't buy that using modulated SYN packets makes you disappear in the background noise of port scans. It's not exactly hard to detect the pattern "after N unanswered SYNs from A to B on apparently random ports, A then connects to B on port 22, successfully". You might as well just send a UDP packet. It'd make your (apparently open) firewall WAY less of a footgun (for modulated SYN packets, the SYNs have to actually arrive).
> Scope functions are also great.

They are useful but I'm not sure they carry their weight. I have to look up the differences often, maybe they're just terribly named?
To those of you who frown when you see the word "metaverse"
> Once you do that, it becomes clear why SELECT first won out originally: legibility and troubleshooting.

Also, tools can trivially tell DQL from DML by the first word they encounter, barring data-modifying functions (o great heavens, no!).
HA! unfortunately its not the 90s anymore :)
The argument against Perl is probably the most compelling of the arguments against Rust.

In practice Perl programmers wanted various extra components. They didn't want to use out-of-the-box Perl, they wanted this popular CPAN library, and that one, and actually, also this other one. FreeBSD found that often "We have Perl" wasn't enough and yet "Lets add six more Perl libraries" is a tall order for them.

Unlike the Linux kernel programmers, FreeBSD's programmers are mostly writing userspace code, there is after all a lot more userspace. But in userspace, Rust programmers will reach for popular crates. Clap for example, to consistently parse arguments, or Regex to have excellent regular expressions. And so we're back to the same problem as Perl.

Like I said, this is the most compelling argument against Rust in base FreeBSD. However, it does make me wonder what the situation is for the C++ in Base today. Are FreeBSD base programmers part of the (large) C++ contigent who want to land everything in the stdlib because that way they can smuggle in larger dependencies ie it's just the same as allowing an extra dozen popular Rust crates or Perl libraries, but without any FreeBSD process ?

C++ appears likely to get the entire BLAS, a graph library, another whole suite of container types, several distinct lockfree reclamation mechanisms (including RCU and Hazard Pointers), a full blown Dimensioned Units type system and more, are these all vocabulary? Maybe such an argument can be made for the BLAS, and mp-units, but I'm sceptical. RCU is not vocabulary, neither in practice is this graph library. These will not enable practical interoperability.
Screwdrivers and duct taped on wires can be remarkably effective at bypassing switches and relays.

And having a random private stand around and poke something with a screwdriver when you want something to explode is, well, pretty much how much of the military works anyway.
At least here in Spain there is nothing “in the public domain” at least until the owner dies.

You can release something with the most permissive license, or without a license, but it cannot be made public by yourself.

Just say “no restrictions”.
Show HN: Homemade automated solar concentrator
Hi HN!

I quit my job two years ago to have more time to work on my side projects.

The main one is an automated solar concentrator.

I've just open-sourced it, it's not perfect nor finished, and I still have a lot of ideas for further development, but I'm interested in knowing what you think of it.

There are many applications where concentrated solar power could be a viable environmental and economic solution, I hope this technology will one day be more widely used.

Feel free to give any feedback and ask questions.
This story has it all, even from the first sentence - you should start a cult.
Thing is, HDMI forum is not a monopoly. It's a literal cartel of a few corporations and other cartels.
Other cartels pushing for it include MPAA.
The engineer has a lengthy thread on Twitter

https://x.com/GarethDennis/status/1829036280996315637
Red green does not mean that you ONLY have problem with those 2 colors. Means you will have problems with ANY color which is composed of some of the 2. Also there are Red/Blue Green/Blue... basically any combination. So relying in only colors is just bad design.
a blank? not sure what you mean.
Multiplayer Snake, Built with Gleam
I didn't dare to hook up Pi with garage opener as well. Our gate auto-closes after a configurable delay, but garage does not. If I trigger the garage opener by accident while I'm not at home, the garage stays open for anybody to come in and take stuff. So I'd need some sort of "is garage currently open" sensor, but I want to keep things simple.
How has Musk owning twitter changed it in a bad way? And cutting 80% of your ounces in backpacking makes a difference.
If cutting 80% of your ounces changes so little about your backpacking trip that you don't notice a decline in enjoyment you didn't need that 80%.
OpenAI is good at unminifying code
I wonder how much of this ultimately comes down to branding. Einstein has a memorable name, a memorable haircut/photograph, and also managed to have his name become a byword for “genius.”
I don't understand the order of your implication. You can use maths (say, some ZFC formalism) to specify the execution of any Python or Java or C program and even write a software tool that executes it. It's the converse that isn't true: You cannot write a Python or Java or C program that accurately expresses many mathematical theorems (e.g. you can only express computable numbers in a program). I.e. the expressivity of mathematics includes that of programming, but not vice versa.

In TLA+ you can express every theorem in ZFC, but that doesn't mean you can automatically prove or disprove every proposition or even every theorem, because that is indeed a limitation of mathematics. There are also lots and lots of theorems you can state and prove in TLA+ yet not prove automatically with the TLC model-checker (or, indeed, with any known automatic proof method). That is a limitation of TLC (or of any known automatic proof methods), but not one of TLA+.
Perhaps a button for people with enough votes to automatically generate an archive link?
> you cannot use aliases defined in SELECT in following clauses

Some DBs allow it or allow it partially. It's a major constant friction factor for me to do a guess work across different database systems.
oh yeah. let me see if we can change it to a dash or something.
Chain and Hash, an LLM Fingerprinting Technique
Deploying Next.js app on a self-hosted Vercel alternative [video]
No. I taught my kid that everything should not be followed by a reward, especially things like basic hygiene. Most tasks of that nature are things we all have to do to be members of a functioning society. He has a pretty good grasp on that as an adult.

He's a professional chef now, the first in our family to finish college, so I think it turned out pretty good.
Thank you! That clarifies it. The length of the signatures indeed seems to be a problem. I'm currently investigating ways to implement secure group chat (like adapting MLS to use PQC).
Not bad, but it's hard to think of a reason why they're doing this

It's protecting your standard from being used by others when wide adoption is the only thing that differentiates your standard from others

i.e. they're shooting themselves in the foot
Show HN: AI Hugging - Make People Hug With AI Free Online
AI Hugging is a free online AI video generator that creates heartwarming AI hug videos from static photos. Using advanced AI technology, it merges images to produce virtual hugging scenes, bringing your photos to life with emotion.
> SELECT first won out originally: legibility and troubleshooting.

It quite interesting to dive into history of SQL alternatives in 70x/80x.
> for one, I've never been required to get anesthesia as a condition of employment

You've been required to get anaesthesia as a condition of getting dental work done, or any number of routine day procedures, or more serious operations. Maybe you've never had to have anaesthetic at all, but you certainly will at some point in your life.

> lumping all vaccines together is not productive and we don't do that when discussing painkillers. there is a movement against OxyContin but not a movement against Ibuprofen

There is no "movement against oxycontin". There are a slew of well documented and successful legal cases against Purdue for its misleading advertising of Oxy in the US, but there's not like, a groundswell of conspiracy theories about it. In fact, the way that the Oxy case has played out is a good example of what real conspiracy looks like, and how it shows up in the legal system.

Sure there are accidental overdoses in other countries, and people everywhere every day are either hospitalised or die from accidental or intentional overdoses of opioids, but not to the same scale. The way that it's played out in the US worse than anywhere else and is as much to do with the dysfunctional nature of the healthcare system that allowed Purdue to behave the way it did, as it is to do with the drugs themselves.

Compared to that, the covid vaccine story (and story about vaccines generally) is a case in point about what a manufactured conspiracy theory looks like and how it shows up in the legal system (ie. a series of politically motivated lawsuits that fall along party lines).
Ok, I should have been more clear.

Modulating SYN packets is stupid.

Port knocking by sending a secret to the server, in a very simple protocol (to the point of being obviously correct), is good. Once it gets too complex, the implementation is more likely to have a bug than OpenSSH.

So just send that secret in a UDP packet. Modulating SYN packets is like sending your password (or other secret) in morse code rather than ASCII, for no reason.

I elaborated more in https://news.ycombinator.com/item?id=41389167
Fond memories, using it extensively during my early years with Linux. I do still like very much the neat look and feel of the NeXTSTEP UI. A couple of months ago I attempted to develop a small example using the SDK and it was an extremely dissapointing experience. Not related to Objective-C per se, but the way you are supposed to develop GUI apps (GORM: is surprisingly convoluted and confusing to use it). That combined with the fact that documentation is scarce (and pretty bad) to non existant, made me to put it away within days. I actually picked up WindowMaker as an excuse to have a peek at Objective-C and play around a bit and see if I could do some silly GUI apps. Is there any good up to date documentation out there for doing GUI development with the GNUStep SDK? All resources that I found seem to be really old. Another WM that I used during my first contact with Linux was BlackBox, though don't know if still alive.
Oh, the problem is rarely the ship's crew - they know all too well that if something breaks and they haven't got a spare, they're up shit creek.

The problem is rather - I'll just let my prejudices roam freely, my apologies - beancounters who realize that it is a waste to keep X sets of spare parts on X ships, when they are hardly ever used - heck, much more cost-efficient to keep one set of spares in a common location, then dispatch as needed.

Except, of course, that 'dispatch' is non-trivial if you're, say, doing core samples along the mid-Atlantic ridge...
I still got stuff out of it during my PhD (in mathematics, though I never finished). I think you might underestimate the value of tacit-knowledge-type stuff, especially from skilled mathematicians like Polya. It's interesting to see how they tackle hard problems, and to compare it to how you would do the same - at the very least I have a much less developed philosophy about it. Terrence Tao has blog posts about his problem-solving meta as well, that are interesting (to me) for similar reasons.
You know how many of the Civilization games have a replay option at the end of a game session? I'd love for something like that on a world scale to really visually see what kind of events happened in history in parallel.
I feel like my prayers have been answered, was looking for a good pixel font for the web and this seems like what I need! It's also monospaced so I can use it for programming
Ugh, DisplayPort already has the audio channel. As far as sync, neither protocol provides for effective reclocking or supplies the audio clocks, and you need VRR to provide sort of display clocks.
I'm in EU and I'm already restricted by Twitter because i have no account.
This is only the case if you blog for social media clicks and likes. Most people who write blogs don't do it for that reason.
The language/runtime certainly has an impact. But indeed, in reality there is no way to compare these scaling claims. For all we know people are talking about serving a http-level cache without even hitting the runtime.
I do not follow buzz. I am an engineer by education and attitude and always try to investigate my options based on my needs and requirements. I use buzz only to drive me trough my investigations. In my case I had a desktop application that had to run on Windows and MacOs and needed support for Rich text format and rendering of custom graphs.

Following buzz I started to do a prototype with Flutter and stopped after a few days as I found out that most of the open source controls I was using had bugs on Windows Desktop. Then I moved to MAUI and discovered that in order to have some decent Rich Text support my only option was Blazor Hybdrid. Nedless to say I found bugs that prevented my prototype to work correctly. Then I moved to UNO and found that it doesn't have full Rich text format support. I was able to find some .NET open source libraries for doing text layout on Skia and with that I was able to find a partial solution that was however pretty complicated. Out of curiosity I investigated Avalonia and found that everything that I needed had full support. Being fluent in WFP I built the prototype in 3 days and I never looked back.

Your experience might vary depending on your fluency of WFP but I found that, considering Windows Desktop as a target platform, Flutter and MAUI are absolutely the worst options.
In my opinion Uno is better than Avalonia when considering web application support but Avalonia has more coverage of the WPF api with respect to what Uno does for WinUi. And for sure marketing is the worst part of Avalonia while it is the BEST for MAUI and Flutter.
He'll find a job as a security consultant abroad. He'll be fine.
1. A tile view with pretty pictures might look nice but a list view with useful, sortable/filterable columns actually makes a tool like this useful. The first thing I do with nearly any lister UI is switch to a compact list view.

2. Thank you for not using infinite scrolling. I wish more people made this choice.
PostgreSQL Release Announcement Barman 3.11.1 and 3.11.0
As a workaround, you can add the following snippet as a bookmark:

javascript:(() => { document.location = "https://archive.is/" + document.location })();

When you click on it, it'll redirect you to archive.is and search for archived versions of the page you were on, which will usually remove the paywall.
I actually wrote a kotlin library (https://github.com/jillesvangurp/kotlin4example) a while ago to help me write documentation that is generated from code that actually compiles and runs.

Instead of embedding code in markdown, I actually generate the markdown from code. Which with Kotlin is easy because you can write your own DSLs. And I get to refactor my code and documentation at the same time. It has some other nifty features like capturing output that you can show in the Markdown and a few other things.

If you want to see it in action, check out the documentation for my kt-search project. There are probably a lot of other libraries out there that do similar things. But it's a thing that most projects don't seem to rely on for their documentation. And breaking code samples are a major hurdle for writing documentation to begin with.

I find that addressing that gets you in a mode where you are documenting things by default. And good documentation also reveals design flaws because you are kind of forced to eat your own dog food by writing working code that shows how you would use a particular feature. I'm basically constantly trying to make life easier for both myself and my users.
> If you engage the syntax with your System 2 thinking (prefrontal cortex, slow, the part of thinking we're naturally lazy to engage) rather than System 1 (automated, instinctual, optimized brain path to things we're used to)

You might not have intended it this way, but your choice of phrasing is very condescending.
Then it's not clear that the named user is also the author of the quoted post, and moreover it could incite harassments against the now exposed user.
If only everyone argued reasonable points.

But they don't. So how should others respond?

Companies said that the increase in minimum wage would result in cut jobs. Here are some quotes from "Fast food workers are losing their jobs in California as new minimum wage law takes effect" at https://eu.usatoday.com/story/money/food/2024/03/26/californ... : "Multiple businesses have plans to axe hundreds of jobs", "Pizza Hut announced cuts to more than 1,200 delivery jobs in December", and "Round Table Pizza, has plans to cut 73 driver jobs".

Can we now say that those predicted claims of doom and gloom did not result in meaningful job loss in that sector?

When that was published last March, should the reporter have known better and not written that article? Or should the reporter have commented that these were meaningless KPIs and asked the relevant corporate spokespeople to restate their claims using better ones?

Or reported that the companies may be lying through their teeth as an excuse to keep profits high?

Given that these publications exist, what should CA and Newsom do to highlight how the predicted job loss didn't occur?

What are the right KPIs and are they even available in a way which can be compared across the state?
smell test says there would be legal implications for the owner of the platform if they were to feature the automation of the circumvention of something about copyrights or what's the word I'm looking for?
The article mentions that this effect was seen in only the cohort taking one of two prevalent diabetes medications.

For your interpretation to be accurate, you’d need to also show that the other popular medicine doesn’t work for diabetes type 2 treatment.

FWIW, the last line of the article is a dismissal from a UK doctor saying that this would make the diabetes drug better than any existing Alzheimer treatments, and suggesting that there’s a confounding variable in the study instead.
Single-digit-nanometer-node custom ASICs aren't really required to achieve this. Although there is higher latency this can and has been done on FPGAs at a company I worked for which designed and built custom AVOD systems for private jets and helicopters.
That's a vast overgeneralization. Sometimes instead of being sociopath the opposite is needed: the so-called emotional intelligence and knowing where the wind blows from so that you can act accordingly. I good example is Mira Murati whom I definitely wouldn't call a sociopath and instead is very flexible in her position, something that would be quite painful for many engineers (at least the ones I know).
> It's great for what it is, a tiny embeddable client-side application database. Like an address book on your phone

Size is no real concern, if the user of a client side application has many gigabytes of data a sqlite database is still well suited for the role. There's no shoehorning, it just works.
Related: https://www.youtube.com/watch?v=WCpVGwSJoyQ
OpenAI in talks to raise funding that would value it at more than $100B
Show HN: web2sdk – Turn any third-party API into a Python SDK
Sure, it saves development time & money. But if they anyway need some kind of custom interface... problem is, the lifetime of the tablet is way lower than a corresponding "dumb" system. I'd see the advantage of using a tablet if you have lots of controls (let's say you control the temperature for 6 rooms, you can see more info, etc.). By the way not everybody wants to have yet another touch screen in their home, but that's another story.
Using which reverse service, though?
Headcanon Generator
Headcanon Generator is a character headcanon generator. It is generated with AI interface, which is unique and creative. Enter the name of the character to generate the characteristics and personality traits of the character.

Use scenario:
Applicable to the second dimension and content creation. It aims to produce richer and more detailed headcanon content through AI technology. Users can get the best possible character setting generation experience on this website.
Very interesting, thank you for the scientist reference.
Looking at Wikipedia I found that "...the identification of quantum structures in cognitive phenomena does not presuppose the existence of microscopic quantum processes in the human brain.". This highlights your comment.
That isn't what the charged them with and the AG's office own legal opinion was that the site was an asset in the fight against trafficking. Which was a problem because what the AG was attempting to charge them with was child trafficking. Instead, the only charge that stuck was money laundering due to the aforementioned use of Bitcoin after the government blocked their payment rails.
Not having LINQ is a terrible inconvenience everywhere. Most languages have libs that try to hack something similar, but it usually simply isn't.
Telegram regularly bans channels that promote hate-speech or do illegal activities.

The only issue is, their team is way too small for moderation, which is why so many weird communities keep popping up.

I’ve been on Telegram for 5 years and I’ve yet to see anything of what you mentioned in your comment.

It’s a fear mongering tactic against a perfectly good and arguably the best messenger application in existence right now.