skysight-inc/HackerNews huggingface dataset:
I had a massive "discussion" (argument) with a friend the other day, they were convinced that the internet is just a place full of trolling and nasty commentary and social media was the thing likely to ruin things for our children. My position was that if you spend your life looking at X, Facebook or whatever then, sure, it can seem a bit of a hellish landscape, but the Internet is and can be so much more than that.

This article is perhaps one of the finest examples of this and I applaud you massively for writing the site, looking at how people used it and then taking the time to share the experience.

It's made me really happy reading it and I'll be sharing it lots. A wonderful experiment, well played and much respect. :)
I wish JUST ONE PERSON in the comments would read the gosh darn article.
I didn't know the tool and it looks, interesting, I'll give it a try
> Gallup’s most recent annual crime survey found that 40 percent of Americans are afraid to walk alone at night near their homes, the figure marking a thirty-year high that runs counter to plunging violent-crime rates.

ugh. spurious reasoning

When areas or situations are unsafe people must make compensating behaviors to protect themselves because nothing else will protect them. They don't go out at night, they don't go out alone, they avoid looking like they have valuables, they especially don't go out at night alone with valuables while being a woman. They take longer routes to avoid worse places, they don't make eye contact. They carry weapons. They change to the other side of the street.

The effect of these compensating behaviors is that the recorded rates of crime go down and can continue to drop even as the level of safety and imposition on people's lives goes up. In that case they're not more safe, they're less, but they're not relying on the people whos crime stats we look to for as much protection as they did... which brings me to:

Another reason drawing this connection can be fallacious is because in areas of persistently high crime people don't report it because law enforcement will not do anything about it (or won't even take a report). Exceptional events are worth reporting but when a kind of crime is common it's not an exception, reporting is just a waste of time for everyone involved. Again, reported crime can go down while crime is going up.

Yet another reason why these figures can be misleading is because the nature of the crimes can change. In one location most shootings may at one point have been drug dealers shooting each other in turf wars, but later they begin shooting uninvolved residents as part of robberies. While its terrible that anyone is getting shot, criminals shooting each other is rightfully less of a concern because it has the obvious personal mitigation of not being involved in the illicit drug trade (for this example...). So yet another reason why you can hear from people that they are less safe even when the stats say crime is decreasing-- essentially simpsons paradox: the way you aggregate or disaggreate data can swap the direction of a trend. No person experiences the population's crime rate, each person experiences their own crime rate.

And sure there are also plenty of effects in the other direction too-- the 24 hour news cycle, open records laws, social media feeds, ubiqitous cameras-- all making some people feel like they're in the middle of a warzone even when they're perfectly safe. But the existence of biases in one direction doesn't make the other not exist. And for some people and places the net bias may be one way while for other people and places its another.
Just look at the r/solar for similar quotes.

Here’s a $51k quote for 12kW with 5kW battery: https://www.reddit.com/r/solar/s/Fema45FkDx
> The doctor wrote in the my medical journal: “During his hospitalization, he took medication on time, and even without IV fluid therapy, his blood calcium levels were normal. However, once he returned home, his blood calcium levels became elevated. It is evident that he did not adhere to the medication schedule at home as instructed.”

This is so typical of Swedish doctors. If something doesn't work, it's ALWAYS the patient's fault. If they don't know what a problem, it's ALWAYS psychosomatic. This guy is just lucky the latter is literally impossible in this case.

Also, for all the people assuming the case was dropped just because she was released, that may not be the case. People are often (most of the time?) released before trial here. It seems like OP hasn't updated enough for us to know whether it's prosecuted or not. It definitely seems like something that would be.
They made the day of a lot of people, making the KCM program available to crewmembers of thousands of smaller airlines.

I take issue with the way that disclosure was implemented here. The responsible thing to do would be to contact the site first, no matter if 1 or 1000 employees.

Then you move forward with FAA, DHS, Etc. Assume that the site will act in good faith and recommend that they take down access until the problem is remedied, then back that up with disclosures and calls for auditing and verification to partner agencies.

Contacting the site first is the only honorable thing to do. It doesn’t mean you wait to contact other agencies, but contacting the site means the quickest halt to the vulnerability and least interruption to service. Disclosing to partner agencies is still required, of course, but hopefully they will be looking at a patched site and talking about how they can implement improvements in auditing the systems connected to the KCM service.

By disclosing in the right order you improve the possibility that organisations will focus on their appropriate role. The site fixes their egregious error and realises that their business depends on being secure, the TSA KCM manager realises that they need to vet access, and the FAA realises that the TSA needs to be supervised in the way that they interact with aircrew access.

Otherwise, everyone might just focus on the technical problem, which will be solved in a few hours or days and then go back to business as usual.

The vulnerability here actually is much, much larger thanSQL injection. It is an inherent vulnerability in the organisational structure and oversight, and this will only be addressed in a bureaucracy if the actual problem is made clear at each organisational level and no red herring excuses that allow finger pointing are provided.

Not to mention it’s a dick move to leave the technical people out of the loop completely in the process of disclosure, even if the disclosure is primarily of a systemic organisational failure.

I’m sure the individual responsible was much more alarmed to get a call from DHS than they would have been to get a call from security researchers, so the given rationale is clearly fictional.

Assume people will act in good faith, but don’t give them room not to. Trust but verify. When dealing with companies and orgs this is the way. When dealing with randos on the internet, not so much.
A simple approach to static site generation
Here’s the best list of search indexes I’ve come across

https://seirdy.one/posts/2021/03/10/search-engines-with-own-...
If I remember correctly my students in Glenallen AK used to be bussed from up to 2.5 hours each way! I always have thought that was so silly to still have daily classes. Why not just once a week and the whole day is filled with socializing. Humans get an idea in their heads like "how school should be" and just can't let it go...
Paolo Bonzini email is available here:

https://github.com/qemu/qemu/blob/master/MAINTAINERS#L134
> It's advertised as being private because it uses your own iCloud Drive as the database.

That doesn’t mean it uses iCloud syncing. It could use its own or a third party method to sync data with a file on icloud.

> How would you implement it?

If I were to implement something like that, I would read Apple’s documentation (https://developer.apple.com/icloud/cloudkit/), Google for blog posts and try to find Apple or third party sample code (e.g. https://developer.apple.com/documentation/uikit/documents_da...), and think hard about testing.

(I wouldn’t know how much of these were done for this project)
Pie cannot be duplicated. Even if you're offering me a worse pie than I ate yesterday, either I enjoy yours or I have no pie.

Software, on the other side, is duplicated on a whim. If you are not offering me new solutions that I need, I'm not even going to bother looking at it.
Judge grants restraining order against expert who exposed Columbus OH hack
I suspect this could probably be broadened to "how to market industry specific software to people in that industry", since I don't think it's just engineers that figure out the worth of a product this way.

A doctor, lawyer, graphics designer or scientist probably also has industry specific jargon they expect to see, a certain type of visual presentation that matches how they expect data to be presented, a need for actual specifics about the product and its features, etc.

It's likely less engineer specific, and more the difference between marketing general purpose consumer goods and art (where emotions are the key differentiating factor) and industry specific tools (where a checklist of features is likely seen as more useful).
Yeah, legal strikes again. Unfortunately SPIR-V was never going to be an option for WebGPU, because Apple refuses to use any Khronos projects due to a confidential legal dispute between them.[0] If WebGPU used SPIR-V, it just wouldn't be available in Safari.

See also: Not supporting Vulkan or OpenXR at all, using USD instead of glTF for AR content even though it's less well suited for the task, etc. (Well, they probably don't mind that it helps maintain the walled garden either... There's more than one reason for everything)

0: https://docs.google.com/document/d/1F6ns6I3zs-2JL_dT9hOkX_25...
I read your comment just after posting mine. You have expressed the concept better than I did.
Regarding SSH bastion hosts, apart from open-source and enterprise solutions that may add some valuable features, you can always get away with a properly configured SSH jump host using TcpForwarding to relay connections to the target host.
Most ISPs don't allow BGP announcements smaller than /48 so you don't get any usefull information from that.
Thank you for taking your time to write this, it gives me a valuable insight. Wishing all the best for you, me, and others out there who're struggling.
Political activists disguised as software developers
It is, but not a trade off many would make.

' itself (!) may not convey information, but it's existence does convey information.

While making it a keyword may help beginners to understand code and wish they could see the meaning directly, because they don't know the meaning of certain symbols yet, people who know the language and productively produce code are more concerned about content rather than syntax.

Content meaning the name of the life time, the name of the types, the name parameters, the structure of the types, the constraints on the types, etc.

Especially for Rust, there is a lot of the things mentioned above, and since the concepts in Rust aren't easy, it's important that these things get as much space as possible from the limited space on the screen, instead of wasting it by self explaining syntax elements, which are trivial to memorize.

Thus { instead of begin_function_body, *; instead of statement_end, ? instead of 'if err != nil then return err' and ' instead of lifetime.
This week in Rails: Last call for Luminary nominations, SQLite3 full-text search
No, I'm not going to start resizing my window just to read your article.
> Hyperbole aside, they certainly haven't given as much as they've gotten, though.

Agreed, but the point of sharing software is that it's not a zero sum game. The thing you create once is not diminished by me using it many times.
It prevents opening new tabs, blocks key combinations that would normally allow you to disable focus tools, and restricts mouse movements that could reveal browser tabs or elements. Browser extensions like Freedom do not prevent such.

Example situation: I started to solve physics questions but drifted away after sometime by opening VSCode or switch to reading something on Wikipedia which is unrelated to my primary objective.
Having superficial knowledge about data storage/DBMS, perhaps I am just spewing nonsense. But I always imagine that a compaction layer for the long-tail/old data should be a standard, where less accessed(sometimes once a month) is pushed to a s3(but still queryable) like storage.
>I am not about to resize my browser window every single time when I switch tabs.

That's sincerely and squarely your problem to deal with.

>Line width is not something a designer came up with and just decided to force on to people. It is well-supported by research and actually proven to make text more pleasant to read.

Doesn't change my point that user preferences should be left to the user to decide.

>don't you think it is a bit silly that you are effectively just arguing that we all should go back to plain text with no formatting?

No. That is actually the ideal internet. Browsers are user agents, users should be rendering web pages as they see fit.

Practicality dictates the correct answer is somewhere in the middle, but authority resting with the users is a good thing.
Sadly, i need to work on my willpower, 30 mins in, i drift away to some other task instead of what I was meant to do
Hence I need repeated lashing by some software to keep me on check

my weaknesses sigh
Show HN: Create your own custom directories easily (e.g. AI tools, courses list)
Hi Hacker News community,

Keeping track of all the software links, example like AI tools, can be overwhelming. That’s why I developed a tool to help you manage them effortlessly. With this tool, you can easily create directories to organize and save your favorite software links. It’s simple, efficient, and you can even share your curated collections with others.

Interested? Try it out and see how it can simplify your workflow: https://chromewebstore.google.com/detail/cokeep-extension/gp...

Thank you!
Solar + LFP batteries, Energy Combo for the future
Laravel Cloud
s/Franklin/Codd/

s/represent the above/relax the above/

(Sorry!)
Anyone who has ever worked with Indian development teams knows that this is largely untrue. Unless your definition of “better” is different than most.
Julia is a splendid, high performance language. And the most overlooked. Such a huge pity and shame that the entire current AI ecosystem is build on Python/Pytorch. Python - not a real programming language, let alone is interpreted... such a huge loss of performance besides Julia.
For me, Kagi is super fast and provides high quality, customizable results. Web search Just Works. When I use a new computer/browser and accidentally search with Google, it is a viscerally unpleasant surprise.

As for perplexity - I got a free year of Perplexity because I bought a Rabbit R1. I tried it, wasn’t impressed. I use Kagi’s AI assistant all the time. It’s my primary way of getting information from the web. I just type a a free form question into my address bar, append !expert for general questions or !code for technical ones, and seconds later my question is answered and I’m back to work.
If control flow statements don't require parentheses to be parseable, doesn't that mean that it is the parentheses that are completely unnecessary?
https://ourworldindata.org/grapher/energy-use-per-person-vs-... is probably where the inspiration comes from...
Large models of..? Mistaking engineering achievement for human linguistic agency
Little Bobby Tables' story is still a valuable lesson.
Missing a link here?
It seems to me that C and Rust approach library APIs with different mindsets.

Warning: lots of stereotypes follow.

Rust believes APIs should be [close to] impossible to use incorrectly. So we get rich type system, contracts, and other kinds documentation. All corner cases are either impossible because of the type or explicitly written down in the contract. If UB happens because user wrote incorrect code, that's a library's bug because it did not defend against it.

C believes the programmer. Documentation typically mentions happy path and some popular errors only. Lots of assumptions are implicit, like thread-safety, reentrance, (lack of) NULLs, lifetimes of inputs/outputs. It's up to the user of the library to figure out restrictions if their usecase is not in the documentation. Common sense and knowledge of C traditions helps. If UB happens because the user did something a bit out of the usual, it's on the user.

That brings us to different mindsets of library developers.

In Rust you typically write code while proving that it's correct in all theoretically possible cases, otherwise the code does not even compile. If it becomes too hard, you refactor API, possibly making the implementation harder. But your API is kind of nice in the kind.

In C you take whatever piece of code you found to be useful, extract it in a function or two and use in the project. If you happen to need that exact code somewhere else, you use it. There is no need to prove that the code always works or that it's a sound abstraction. If it works, it works. If it stops working in some case because of a bad API design, then you decide whether it's worth refactoring or not. That makes the initial implementation simpler, but it lacks contracts by design.

So I attribute it to cultural differences between "C programmers" and "Rust programmers". For Rust programmers, "full function contract" is a must, so documenting it seems easy. For C programmers, "full function contract" is not required for writing working code in 95% of cases, so documenting it is extra chore with no benefit.
Sigh. The company is a different problem than the product. Sally in accounting who has pii on her desk is a totally different problem than that the team that wrote insecure code 15 years ago.
I did almost exactly the same thing at my school (brought down the system with a VB6 script that wrote infinite text files to networked storage). They sent my mum a letter accusing me of terrorism.

At the time I thought I was pretty ridiculous and unfair (lucky my mum agreed), but now looking back with adult eyes I also see it as an almost criminal level of disregard for the job of raising children. Just absolutely irredeemably small-minded, truly pathetic, it makes me so angry to think that there are still young people growing up in that environment and being taught by those people.
My understanding (after talking to several market analysts) is that OpenSearch is focused on APM/monitoring/log-aggregation, while Elasticsearch has an edge on pure search engine functionality and now AI.

Not in my experience. AWS is fully behind using opensearch as a search engine. For AI, hard to see how Elastic can compete with AWS...given it's vast resources and deployed products.
I think there are 2 mechanisms for jargon, and he misses them both;

1) Easy filtering caused by precise communication. A non-jargon term is missing nuance. The audience can't tell if they should be interested (probably not). This is your API vs Software.

2) courting the customer by speaking their language. If a marketeer indicates some level of knowledge, the engineer is more willing to spend time: The chance to gain something usefull is higher. If a marketeer sells an API, I might ask if he also has a library, because I know he understands the question.
Sort of. Idemia is the entity trying to push proprietary BS and lock the states in!
So raising capital then.
like parenthesis for functions, tuples and for denoting prioritized evaluation?
Does “Paste and Match Style” (cmd-shift-V) work? I use this key combo (or the alternative binding, cmd-option-shift-V) all the time in various apps to paste more “directly”.
Just installed WindHawk thanks to this list, great work.
Twilio still is rock solid IMO. The issue is when sprint and T-Mobile merged as well as the backlash from the carriers dealing stir shaken. They rushed to create the campaign registry. It’s effectively made many normal sms use cases nearly impossible. What’s happened is the industry is being bogged down in regulations self imposed and directed by the feds
One larger cost you might think of with solar is land - but even in the U.K. where land isn’t exactly cheap leasing prices are about £1k an acre per year, and an acre will generate about 350MWh a year, so that’s well under 1 cent per kWh, so it’s lost in the noise.

https://www.fwi.co.uk/business/alternative-land-uses-leasing...
Yes it's only IPv4 where it's practical to scan the whole address space in minutes but there are methods to find IPv6 addresses [0] certificate transpareny logs are also scanned for hostnames to get AAAA records. But from my experience it's multiple orders of magnitude less than v4.

[0]: http://netpatterns.blogspot.com/2016/01/the-rising-sophistic...
The other day I was shopping for a redundant fiber internet link for our company.

Vendor A had a sales person that started a 20 minute presentation without asking us any questions. Most of what they told us wasn’t relevant to our needs or not informational.

Vendor B had a sales person that just asked what we needed and we had a detailed technical discussion about how they implemented redundancy.

You’ll never guess which vendor we chose.
Deviating from conventions to avoid footguns is so misguided. I've been writing C family languages for like 15 years and never once accidentally done a if (foo); whatever;

The convention itself IS the thing that stops you from fucking that up. It's the kind of thing you do once 2 days into a 30 year career and never again.

I still think it's dumb in Javascript, where you could be using the language on day 2 of learning programming. But in a GPU shader language that it would be almost impossible to understand with no programming experience? It's actually insane.

Having said that everything else about this project looks pretty good, so I guess they can get a pass lol.
When you don't know what assets to secure, power won't do you any good

Or

The keyboard is mightier than the sword.
The current SDL GPU API does not intend to use this shader language. Instead, users are expected to provide shaders in the relevant format for each underlying graphics API [1], using whatever custom content pipeline they desire.

One of the developers made an interesting blog post motivating this decision [2] (although some of the finer details have changed since that was written).

There is also a "third party" solution [3] by another one of the developers that enables cross-platform use of SPIR-V or HLSL shaders using SPIRV-Cross and FXC/DXC, respectively (NB: It seems this currently wouldn't compile against SDL3 master).

[1] https://github.com/libsdl-org/SDL/blob/d1a2c57fb99f29c38f509...

[2] https://moonside.games/posts/layers-all-the-way-down

[3] https://github.com/flibitijibibo/SDL_gpu_shadercross
> just as they are in the US.

This is incorrect. Far from unheard of, the civil justice system in the US is, in fact, frequently used as a secondary route of recourse by private persons, regardless of the existence or outcome of a criminal prosecution. The legal test used to determine liability (in civil justice) is different from the legal test used to determine culpability (in criminal justice), and therefore, you can also have mixed outcomes. Furthermore, civil law in the US focuses on "making the plaintiff whole", vs criminal law which focuses on sanctioning the defendent. As a result, civil cases might be the only way in which a victim of a crime could get any form of compensation from the perpetrator.

One extremely high-profile case in the US was, of course, that of OJ Simpson [1], who was found not guilty of murder in a criminal case, but liable in a civil one, for the exact same action.

[1] https://en.wikipedia.org/wiki/Murder_trial_of_O._J._Simpson