skysight-inc/HackerNews huggingface dataset:
He actually does suggest a reason in the book, which is a primordial black hole passing through it.
I agree & disagree.

Browsers are very important part of our life. If someone compromises our browsers , they basically compromise every single aspect of privacy and can lead to insane scams.

And because arc browser is new , they wanted to build fast and so they used tools like firebase / firestore to be capable of moving faster (they are a startup)

Now I have read the article but I am still not sure how much of this can be contributed to firebase or arc

On the following page from same author (I think) https://env.fail/posts/firewreck-1 , tldr states

- Firebase allows for easy misconfiguration of security rules with zero warnings

- This has resulted in hundreds of sites exposing a total of ~125 Million user records, including plaintext passwords & sensitive billing information

So because firebase advocates itself to the developers as being safe yet not being safe , I think arc succumbed to it.

firestore has a tendency to not abide by the system proxy settings in the Swift SDK for firebase, so going off my hunch,

Also , you say that you have been convinced to never use arc again.

Did you know that chrome gives an unfair advantage to its user sites by giving system information (core usage etc.) and some other things which are not supposed to be seen by browsers only to the websites starting with *.google.com ?

this is just recently discovered , just imagine if something more serious is also just waiting in the shadows
Couldn't this also be considered a major security vulnerability just waiting to be happen if some other exploit like this can be discovered / google.com is leaked and now your cpu information and way more other stuff which browsers shouldn't know is with a malicious threat actor ?
Getting closer to the cave scanning drones from Prometheus.
IPv6 is not overengineered. It is, in fact, simpler in design than IPv4.
Do you know why they do this?
I was cooking but not very well. Or healthily.
“Build plan” would maybe be a more obvious name, but it’d still be confusing to deviate from what Nox uses, IMO.
Very small bounty, but I honestly believe this arc thing won’t last long…

Browsers are hard and my only choice has been chrome and will remain so for the long foreseeable future.

When I was younger I would enjoy switching to firefox, opera, etc..

But I always came back to chrome because it just worked and always performed when I needed.

Chrome/chromium is the safest browser.

People tend to fall for the shiny new thing and then realize it was just hype.

Please be very careful about what software you choose to perform most of your activities.

The same applies to these “new ai IDEs” that keep popping up every other say.
To start with, without a linearization table, white and black levels, how exactly do you expect sensor data to be usefully interpreted?
One reason I could see is to keep perceived price level for the frequent flyers. If they don't see best deals they won't expect those. And the hardcore deal hunters are not loyal to you or your brand.

Giving frequent flyers very good deals make them expect them, thus not be so willing to pay "regular" price.
Exploring Cross-Language JDBC Integration: Comparing Solutions
In this article, we dive deep into various options for JDBC integration across multiple programming languages like C#, JavaScript, Python, GoLang, C, Perl, and Ruby. We compare different solutions available on the market and explore their pros and cons. Additionally, we highlight how Javonet simplifies this process, offering a more streamlined and efficient approach for developers working in diverse tech stacks.
Well, in what concerns Android downstream, Rust-in-kernel is a reality, Google would like upstream to join the party, but it doesn't matter if they don't.
What companies do you think are held liable when students look at porn on a school computer?

I don't know what that has to do with cookies though.
> Can you hear the difference?

I can't. Is there an example that makes it clearer?
I think AWS SigV4 tries (and succeeds?) in solving this issue?
> also wouldn’t know how to contact a “state actor” even if they wanted to.

That's why brokerages like Zerodium exist - you can sell it to them, and they'll sell it onto state actors.
Theoretically possible, but show me a sound server that automatically drops resampling quality instead of just increasing the buffer size.
440 or 442Hz?
I guess we really have to add whether it is soft or hard realtime we are talking about. The former can be done in userspace (e.g. video games), the latter probably need a custom OS (I don’t think rt-linux is good for actual hard realtime stuff)
We didn’t roll out a component library, but something very similar. Yes, it most likely could have been achieved without deploying to Afghanistan, but the majority of my time on this effort was spent coaching people directly. My team did achieve success in all our business goals though.
yes. I feel sad that now we have created an incentive where selling to the govt.'s is often much lucrative than telling to the vulnerable party (arc in this case)

(just imagine , this author was great for telling the company , this is also a cross platform exploit with very serious issues (I think arc is available on ios as well))

how many of such huge vulnerabilities exist but we just don't know about it , because the author hasn't disclosed it to the public or vulnerable party but rather nsa or some govt. agency
Show HN: Beautiful Usernames – 18M+ random aesthetic usernames for your project
Because maintaining a modern browser engine is a huge amount of work that only major companies can afford.
Cool! How accessible filmmaking has become...
I can't help but wonder whether the major problem is actually API changing from version to version of software and keeping everything compatible.

If the build language is LUA, doesn't it support top level variables. It probably just takes a few folks manipulating top level variables before the build steps and build logic is no longer hermetic, but instead plagued by side effects.

I think you need to build inside very effective sandboxes to stop build side effects and then you need your sandboxes to be very fast.

Anyway, nice to see attempts at more innovation in the build space.

I imagine a kind of merging between build systems, deployment systems, and running systems. Somehow a manageable sea of distributed processes running on a distributed operating system. I suspect Alan Kay thought that smalltalk might evolve in that direction, but there are many things to solve including billing, security, and somehow making the sea of objects comprehensible. It has the hope of everything being data driven, aka structured, schemad, versions, json like data rather than the horrendous mess that is unix configuration files and system information.

There was an interested talk on Developer Voice perhaps related to a merger of Ocaml and Erlang that moved a little in that direction.
Was just about to see if someone mentioned this video. Really good explanation comparing JPEG XL vs AVIF.
…Firefox as an alternative to Chrome!? Am I really that old!?

I used Chrome for years and years, right from when it first came out. Since then, I switched back to Firefox, and have used it for years. It works perfectly fine.
> At least, not without intentionally opting into it.

just to clarify in Windows, users with administrative privileges will in theory still ask the user to opt-in every time before any process is elevated to administrative rights. Its just that Windows security is so awful that people have found many different creative ways around it over the years, but those are (sometimes) getting patched by Microsoft so they are considered "bugs".

For example a process stores its executable path in memory writable by itself, so you could start a process that replaces its executable string to "C:\Windows\explorer.exe" and it would (for whatever reason) bypass the "ask for administrative rights" dialog popup. This is the sort of "security" that Windows is built around to its very core.

https://github.com/hfiref0x/UACME

> "This tool shows ONLY popular UAC bypass method used by malware, and re-implement some of them in a different way improving original concepts. *There are different, not yet known to the general public, methods. Be aware of this;*"

(also i think you are responding to a troll btw)
Think of the children :'(
I mean yeah, but the more I know about computers the less I like the idea of it.

On a PC you have millions of lines of kernel code, BIOS/EFI code, firmware, etc. You have complex video card drivers, complex storage devices. You have the SMM that yanks control away from the OS whenever it pleases.

The idea of running a dangerous machine controlled by that mess is frankly scary.
Bluesky catches up to X with native support for video
> The Saudis aren't getting my tax money.

They are the largest military buyer of the US, with a 60 billion order signed in 2010 and a 110 billion signed in 2017. Both of which include the US army training and providing support for the Saudi Military.

Are the army dudes training them not paid with taxes? Do you think the Saudi Royal family being the richest in the world after becoming allies with the US is a coincidence?

If you wanna ignore the reality of the situation because there is an explicit bill in congress that says "2 billions to Israel" and there is no bill in congress that says "vote in tandem with Saudi in the UN, help them in Kuwait, help them in destroying Yemen and keep local gas prices low at the expense of horrible human abuses far away while they buy our military equipment and we train them up to have a local partner if we ever wanna invade iraq again" then yeah your tax dollars aren't going to Saudi.

> I'd rather spend that money on infrastructure or at least give it to the poorest Americans.

That money IS going to americans. You do not understand how the aid is sent to Israel. America pays an american company, like Lockheed Martin to produce X amount of stuff and the surplus is then gifted to Israel essentially.

This works in two ways. One is that it keeps war production pipelines running, countries that dismantle their weapon shops and then try to run them again have lots of trouble (see russia), however america does not need yearly the amount it produces and the jobs in certain industries are expensive. Engineers and union factory workers make good money in those companies so your tax dollars pay for those jobs, and Israel essentially takes the extra missiles (of the 3B yearly 2 are for the Iron Dome which has no offensive capability). No israeli is getting 200$, but some dude in an american factory makes 125k and has weekends off thanks to that 14B bill

> Answering most of your questions quickly

thats not an answer, thats a rationalisation and a poor one at that. You said america does not fund terrorism, and then you said "oh but it blew up in our faces" that is not lack of funding that is just what you get when you fund terrorism.

> This alone is a massive difference.

You have Trump meeting Bin Salman calling him a good friend in April of this year. So clearly you in the rhetoric department there is no massive difference. we have people in goverment like Bernie Sanders that criticise Israel and people who criticise Saudi, and both get your tax dollars.

The Saudi fund also has more money in lobbying, more money in US universities, has more overt corrupt deals like a 2 billion investment in the son in law of Trump or renting the entire top floor of Trump tower without anyone staying there. And at the same time they have killed 400k people in Yemen, funded the genocide of the Tigray in Sudan. And there has been 0 backlash.

I do not think it is outrageous to claim that the disproportionate attention on Israel might have reasons beyond the moral or the economic for its magnitude.
Look, either you force everyone to be open to competition and interoperable or you allow everyone to lock down.
How would you like all other manufacturers to do the same as Apple?
BMW, VW, Ford, Mercedes, GM ec all have their own petrol stations, their own approved roads, their own approved tyres, their own approved parking spots.
LG, Samsung, GE, Panasonic etc each require their own electricity distributor, their own wiring and plugs, for the washing machine their own approved clothes, for the fridge and cooking appliances their own food and cookware.
Each emplyoyer requires you to buy their approved apparel and use their own aplhabet and writing system.
And YOU get to pay for it all.
Show HN: AI Lyrics Generator
Hello everyone! We invite you to visit our website: https://www.lyricsgenerator.io/ to use our AI lyrics creation tool.
AI Lyrics Generator is a free AI lyrics generation tool. Our AI system is trained to recognize lyric patterns in various music styles, including pop, rock, and hip-hop. Whether you are creating a catchy pop song, a touching rock ballad, or a rhythmic hip-hop song, we can provide you with the perfect lyrics foundation.
If you are looking for a free and efficient AI lyrics creation tool, our Lyrics Generator is your best choice. Our web interface is user-friendly; just click the "Generate Lyrics" button and the AI will create unique lyric content based on your settings.
We welcome your valuable comments and suggestions!
We have lift-off Element X, Call and Server Suite are ready
This problem can be solved by the bootstrappable builds: https://news.ycombinator.com/item?id=41368835
It's part of the no more third party cookies thing and not iOS specific.

Scenario where this matters: If you do Login based on sessions + cookies (eg. Django's default authentication method) you won't be able to have the backend and frontend on different domains or the same domain, but different ports.

Specifically in a local dev scenario, you might have your backend on localhost:8000 and frontend on localhost:4200, you could auth your frontend and backend by allowing the browser to send the cookie between them via the cookie setting `SameSite = None` (Ignoring a couple of browser security details around CSRF, HTTPOnly Cookies and HTTPs requirements).

This is will soon not be possible anymore and in the local dev scenario you need to access both frontend and backend from the same port, by combining them with a HTTP reverse proxy or hosting the frontend files via the backend. This extends to real deployments and affects session + cookie based authentication in a couple of ways, depending on infrastructure.
> Is there any legal precedent about AI CSAM yet?

Is there specific case law concerning AI depictions? Maybe not, but it is already a federal crime to knowingly produce, distribute, receive, or possesses with intent to distribute "a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting" that (in simple terms) are both obscene and depict or appear to depict minors in sexually explicit scenarios, and there is very little reason to think that courts would carve out AI from this general prohibition.

18 USC Sec. 1446A: https://www.law.cornell.edu/uscode/text/18/1466A
Not hijacked. Faked.
Sequoia sure looks annoying.

Nagware and AI shit I never asked for? I'll stay on Sonoma, thanks.

Wish I could use Snow Leopard again at this point.
More like no will.

Does the domain/server implements required level? No? Block connection. Dtto email with automatic response.

Is your IP in a botnet? Cut it off.

Edit: I already get blocked connection (on target site) because EU regulation is too onerous. I get reminded on basically every Google search I am being censored (Some results may have been removed under data protection law in Europe).

Completely doable.
Wow, that looks super useful, thanks!
Everyone seems to have forgotten Beautiful Losers, one of the greatest novels ever written:

https://en.m.wikipedia.org/wiki/Beautiful_Losers

Way ahead of its time, both then and now.
I believe use of the equal sign character for assignment is a convention that comes from Fortran. It’s so unnecessary because JavaScript has two assignment operators. The colon character serves as an assignment operator in object literals and ternary expressions. If the colon character were the universal assignment character the language wouldn’t need == or === for comparison because = would be enough.
I beg to differ, I was interested and looked at flux pro.
The rendering is impressive and looks like the output of a larger organization or a dedicated professional. But it's just that. It feels a bit like most people don't really interact with art, except on ads, movie poster and the like. And I guess those images are good for being displayed on a screen.

Maybe this (cliche) analogy will help my point. Art is like sex. Apparently most people have only seen porn and think the machines are incredible at sex. But they are confusing one for the other
I went looking for the outright rage you're talking about and I don't see any signs of it, given your small collection of replies with a decent number of them flagged are you sure that this isn't projection on your behalf?
A viable strategy, but requires an experienced Linux/Unix admin and quite some planning & setup effort.

There are a lot of non-obvious gotchas with ZFS, and a lot of knobs to turn to make it do what you want. Anecdotally, a coworker of mine set it up on his development machine back when Ubuntu was heavily promoting it for default installs. It worked well until one day his machine started randomly freezing for minutes multiple times a day... He traced the issue back to some improper snapshotting setup, then spend a couple of days trying to fix it before going back to ext4.

For the Postgres data use case in particular, I would be wary of interactions and probably require a lot of testing if we were to introduce it... Though it seems at least some people are having success with it (not exactly plug and play or cheap setup though): https://lackofimagination.org/2022/04/our-experience-with-po...
Trip Report: Summer ISO C++ Meeting in St. Louis, USA
The US, obviously.
Do you have the link and the time in the video where he mentions it?
Haha, that's rich. I have never seen this popup (haven't had the use case), was it this one?

https://helpdeskgeek.com/wp-content/pictures/2020/10/02-HEVC...
There is an important difference between humans and LLMs in this context.

Humans do in most cases have some knowledge about why they know the things they know. They can recall the topics they learned at school, and can deduce that they probably heard a given story from a friend who likes to discuss similar topics, etc.

LLMs have no access to the information they were trained on. They could know that everything they know was learned during the training, but they have no way of determining what they learned about and what they didn't.
my brother uses arc browser , he is a developer .
I think he saw it from somebody using it (maybe theo t3 or some other creator he watches) , and he found it cool (plus there were lot of videos flooded with saying arc is really great IDK)

If someone finds something cool on the internet. They are going to try it , given that they are capable to do so.

He had a mac so he was able to do so , Even I tried to run arc on windows once when it was really beta and only available to mac (I think now it supports windows not sure)

I just kindly want to state that if the nsa could've bought this exploit , they could've simply waited and maybe even promote arc themselves (seems unlikely)

Maybe they could've tried to promote the numbers of arc users by trying to force google and microsoft search engine through some secret shady company advertising / writing blog posts for arc / giving arch funding or like how we know that there are secret courts in america

( and since these search engines basically constitutes for a high percentage of discovery of stuff by search engine by users)

People could've credited the success to arc in that case for getting more users but the real winner would've been NSA.
Where did that come from? It feels like you’re working backwards from some bad feelings felt about Apple.
you posted it 3 days ago, i don't understand your comment https://news.ycombinator.com/item?id=41561647
Yes, OP worded this a bit incorrectly. Open source, royalty-free standard would be better.
That's interesting topic
I'm not suggesting we don't want or benefit from high speed internet, I'm saying there's other ways of getting the same result, alternatives which don't mess with fundamental science for however long it takes to get around to building replacement radio telescopes in space.

And I'm saying this as someone who was seriously considering getting a Starlink connection (wired internet turned out to be good as well as cheap, but I was seriously considering Starlink).

> But if it meant 2x the price of the subscription, I'm pretty fine with them keeping it as it is.

If it was just about prices and nothing else, I'd be promoting the construction of an orbital ring launch system, which would inherently double as a global power grid and be a good place to mount PV.

Cheap space access (cheap enough to be used as a global 90-minute railway even if you have to go the long way around), cheap power supply (no clouds and less sun blocked by the air), cheap power transmission (because it's cross-subsidised with the other two).

> Global internet is just way too good for humanity to not do it.

So is "knowing where the asteroids are".
>(also i think you are responding to a troll btw)

You would be wrong.
How do you handle runtime - defined sizes then? Just preallocate maximum possible number of bytes?
I'm opening my Pivotal Tracker project from 2011... and I'm surprised at how good the UX is/was!!! Visually it looks old, but the UX I think is great:

Simplicity is reinforced with a great information density: lots, but not overwhelming. Current design trends make information density super low, forcing you to scroll a lot and spending much more energy/time just to be able to look at things.

When you need to "open" an item, you remain in the same screen (no modal, no context change): metadata, description, conversation. Nothing more!

In Linear I'm totally lost with projects, cycles, views, projects...

I'm stuck with Github Issues/Projects, but I miss Pivotal simplicity!!

I've just exported a 10MB Pivotal CSV...
Well, Windows wouldn't display the HDR part of the image, so you're still not exactly seeing it.
The new connectivity group is indeed awful. When expanded, some of the options are buttons that toggle state. Some open a whole new page of options. And Personal Hotspot is represented by a blank icon, and actually clicking it just dismisses the settings entirely.
Actual title (emphasis mine):

> iOS 18 does not allow a client application to specify SameSite=None

That’s quite a different thing from the present submitted title, “No same site = None cookies for iOS18”, which would suggest SameSite=None was being blocked altogether.

Glancing through, it reads more like “when SameSite default was changed from None to Lax [which everyone else did four years ago, if I recall correctly], there was a bug because the default was actually assumed in one other place that we missed, so that setting SameSite to None in a particular way didn’t work, and this pull request fixes that”. Simple bug, nothing to see here. But I’m not in Apple’s ecosystem, don’t trust my two-minute glance to be accurate and please correct me when I’m wrong.
Burst mode captures 10 images per second, for encode demands of 120 MP/s. That’s half the throughput of 4k30.
why do you seek permission from strangers on hackernews, is the real question. of course it is okay ...
Isn't "exactly once processing" also incorrect, since it's all always "at most once": the system could go down and never come back online, that would result in a missed processing
It does seem odd to restrict new features to the latest models, especially when older ones still have powerful capabilities.
No worries, The Great Wall of EU is coming.
Parallel PNG Proposal (2021)
Shouldn't it be `round(x/5)*5` ?