skysight-inc/HackerNews huggingface dataset:
Selfhosted Secure and Private P2P Chat
im working on a decentralized p2p chat app where it handles all the important cryptographic functions in browser-based javascript.

the crypto functionality can be seen [here](https://github.com/positive-intentions/.github/blob/main/cryptography/Cryptography.js) (it is used as a micro frontend and loaded into the main app at runtime). the main chat app is open source for transparency [here](https://github.com/positive-intentions/chat).

i think the approach on security in this app is unique and i would like to know which vulnerabilities i haven't considered. i try to answer all concerns in [this previous post](https://www.reddit.com/r/CyberSecurityAdvice/comments/1ev5kqn/is_this_a_secure_messaging_app/).

i think if i stick to the principle of avoiding using any kind of "required" service provider (myself included) and allowing the frontend and the peerjs-server to be hosted independently, im on track for creating a chat system with the "fewest moving parts". im hope you will agree this is true p2p and i hope i can use this as a step towards unparalleled privacy and security.

Looking forward to hearing your thoughts!

* The live app: [chat.positive-intentions.com](https://chat.positive-intentions.com/)
* More information about the app: [positive-intentions.com](https://positive-intentions.com/)
* Follow the subreddit to keep updated about the app: [](https://www.reddit.com/r/positive_intentions/)

(note: this app is an unstable, experiment, proof of concept and not ready to replace any other app or service. It's far from finished and provided for testing and demo purposes only. This post is to get feedback on the app to determine if i'm going in the right direction for a secure chat app)
Same here, I have no interest in funding someone's dream. I prefer to support a mutually beneficial relationship with a developer.
Building a self-contained game in C# under 8 kilobytes (2020)
I purchased my phone from Apple, and immediately used it on Mint Mobile, which is T-Mobile.
You are focusing too much on 'that' religion and not realising that parallel analogies exist for other countries, religions and culture too.

Sure, not lynch mobs, but AI-generate fake media can certain ruin people's lives, and unlike photshop etc, the barriers of skill and time required are very low, and the quality is very high.

I share my country's experience because I wanted to share my personal perspective and fears, but please don't under estimate how AI can affect you. Just because you won't be death doesn't mean they can't turn you into a social pariah with a few clicks.
Nextcloud is well known for it shitty legacy PHP codebase.
The parent poster's link describes the complete disinterest in engaging with it on economic aid. Reformists actually succeeding in their transition from communism might have nipped the problem in the bud.

With aid come strings, those strings could have been used to softly steer the internal political clusterfuck in a better direction.
yes, I know it is not 2015. .net runs everywhere.

Just that, by default, it is assumed you run windows
e.g. https://learn.microsoft.com/en-us/dotnet/core/docker/build-c... windows first, linux alt. no macos

at the bottom, 'container tools for Visual Studio'

Take all the video from https://devblogs.microsoft.com/dotnet/learn-dotnet8-beginner...
how many are not using Windows?

You can use .net elsewhere. Just that it is on you to 'fix' the difference when they happen.

it is ok. Others languages might have a windows-second bias.
Why not just switch back to GPT-4? it's still there.
> Modern C++" is the same rewrite costs as if you Rewrote It In Rust

Certainly not! The update can be done incrementally as pre-modern C++ is (almost) fully compatible with modern C++.
That's awesome. Looking forward to the code!
iPhone 16 Battery
Well it is the hedonic treadmill, but that doesn’t make it wrong. It’s a real thing. Maybe you’re more modest than me but the standard of the time absolutely changes my value of things. Ten years ago the iPhone 5 was the greatest thing ever, today I wouldn’t want one for $100.
> Fair point. Was that foreseeable in 2009? A lot of the actions we take now are based on what's reasonably foreseeable in the future. I honestly don't recall.

The company now known as Redis didn't acquire the redis trademark until 2018, and didn't change their name to include redis until after that. That is probably the better timeframe to think about.
Preventive Healthcare Integrating Data, IoT, and Incentives for Healthy Habits
Yes, there is a concept of "shared responsibility" in the cloud. Obviously the provider is going to handle some things and you have to take care of others.
This. Inconsistency is a big problem for large tasks, you are better off making your own models to do this.

I have seen this odd kind of inconsistency in generating the same results, sometimes in the same chat itself after starting off fine.

I was once trying to extract hand written dates and times from a large pdf document in batches of 10 pages at a time from a very specific part of the page. IN some documents it started by refusing, but not in other different chat windows that I tried with the same document. Sometimes it would say there is an error, and then it would work in a new chat window. But I am not sure why, but just starting a new chat works for these kind of situations.

Sometimes it will start off fine with OCR, then as the task progresses, it will start hallucinating. Even though the text to be extracted follows a pattern like dates, it for the life of me could not get it right.
I was in a bad state of mind when I posted. I would delete this if I could.
I use syncthing for files and radicale for calendar and contacts. Very lightweight and stable for years.
Radicale sits behind a proxy with basic auth, so dont have to worry about patching vulns to much.
Partly true. Stalinist planned economy (aka Socialism in One Country: as opposed to waiting for world revolution) excelled in macro matters, and was particularly vital to the Soviet war effort and post war rebuilding. However Soviets could never really solve micro matters, like empty supermarket shelves. Gorbachov reforms nominally tried to solve these problems.
China is a Soviet Union with NEP minus exporting world revolution.
But that doesn't account for the situation, of course you aren't going to post the illegal stuff you say. And then that gives you a blank to cheque to say what you like in private and say "Well, it isn't on my site, so it must be fake, right?"
My company IT sec person sent a presentation and asked everybody to follow a link inside the slide to go to the training website. So never underestimate a attack vector, also security is just a joke.
did the point of the analogie fly over your head so completely
The kiosk doesn't smirk when you order 6 large fries and a diet coke
I've actually been thinking lately about property based testing for UIs. In this particularly case, there should be an invariant for each entry in a radio button list that the selectable area covers the entire bounding box from button to the end of the label. There are many such invariants you could imagine - every paragraph of text should be selectable by a click and drag, menu drop downs shouldn't hide as long as the mouse is within its area etc. Build up a big enough suite of these tests and you could quite easily integrate them in Storybook or beyond. Probably not something you want to run on every save, but an asynchronous process running somewhere recreating this "sanding" activity would be a worth way of saving time and improving quality.
It's definitely his voice. Either way, why can't they hire a fucking voice actor instead of using this text to speech crap?
And the title
I don't think you understood the severity or the noobiness of the error. This is a browser not a crud app or electron app. A browser is a complex system level piece of software not a hacky mvp and this kind of error shows that maybe they don't have the competence to be building something like this. It makes you wonder what other basic flaws are there just waiting to be exploited, even if its built on top of chromium. Would you fly in an mvp airplane built by bicycle engineers? (maybe not the best analogy since the first airplane was built by bicycle engineers)
Does SoC 2 worth it?
Do you think official soc 2 report worth for SMBs?

My experience is that most companies use security questionnaires / vendor risk assessments so if your company is prepared you don't need to have the official soc 2 attestation.

What is your experience?
Thanks for posting it! Good point about adding the right lighting rig, haven't thought about.

I use a planer a lot but I'm still struggling with making multiple passes down a wide piece of wood. I often end up with grooves. I've gotten better over time but I'm still not happy with the results.
Obviously this won't catch everything human QA can, but where an invariant can be expressed (navigating then going back should result in being in the right place, as mentioned in the article) it seems good to try and capture it.
When I tried Nextcloud, I found there was an option to sync all photos from Google Photos. It synced around 10% photos and reported success. Overall, Nextcloud had lots of breaking bugs/instability issues like that in almost all cases I tried, so I ended up just buying a second account at a different cloud provider, so everything is now synced to 2 providers, in case I lose access to my Google account.

I experienced the bug you mentioned about 5 years ago, I wonder if they ever fixed it.
If you’re analyzing it that broadly then the interest on the CC debt will also be a profit for the bank which will distribute it across its workers and shareholders, and those people will also use it for consumption. It’s just a wealth transfer from the poor, and impulsive to the rich and clever.
I find that one concerning in an enterprise setup (which they target). Or the fact that the desktop client has 999 open issues. Or that the last version silently takes you off the stable channel. I could go on … Nextcloud desktop has severe quality control issues.
I'm part of a smaller shop. GCP didn't even bother responding to us when we tried to contact sales, which is why we're at AWS.
Never heard of the dict command?

The author went through the trouble of figuring out the protocol but never bothered to just run dict. Okay.
Meanwhile, I went for coffee at three different places in a row that used new TLDs. .bar .coffee and... .cafe perhaps?

There's a shift happening.
My faith in humanity has notched up a little today after seeing how easy Aiko and Oolama make it to use this incredible tech.

As a daily user of all the latest OpenAI/Claude models for the last few years, I'm amazed at how good llama3.1 is - all running locally, privately, with zero connection to the web. How did I not know about this?!
File syncing also frustrates me, although I think it's working as intended. I would expect that if I update a synced file on my laptop, that should also automatically update it on the cloud. But it seems like there's an extra step where I have to go to the web ui and say that I want it to use the updated version.

Also sharing has been very confusing, people keep thinking they've shared files they haven't.

Maybe the problem is me / us, idk. Or maybe it's better as a "personal" cloud than a shared one. I have, overall, not enjoyed using it. I wish management would just let us store docs in a git repo, which would be much more intuitive for most of us.
I miss the days when popping out the battery was designed into the devices.

I understand why that is now. But it's interesting that few - none? - of the major manufactures offer a model with a removable battery (as a way to position a given product as unique / different).
Game of Life Pattern of the Year
Hackernews amplifies alot of stuff
And if you like this sort of tasteful take on retro RPGs, you might enjoy SKALD:

https://store.steampowered.com/app/1069160/SKALD_Against_the...
This isn't a solution, because then you'd run into problems the moment those keywords are used in a different context, for example in this blog post describing the bug. Any language you may fancy has a parser readily available these days, there's no reason not to use it.
Agile is relevant here because it has been adopted almost universally as a shovel to push more things on the programmer's back without much care to the quality of the changes being done.

Sure, it is not to be blamed as per Agile manifesto but how many companies are adhering to the manifesto? It is how it is used, not what it was used for.
I think real creativity is creatio ex nihilo (creation from nothing). Not a remix of what exited before, but something fundamentally new. Trained machines will only ever be able to remix their training data.
I boot from the SD card but I have a USB SSD connected which I use for file storage. I have also configured stuff and set up bind mounts such that everything that gets written to regularly (such as logs, the Nextcloud install itself, Postgres, ...) is on the SSD.
The new paradigm is smartphones firts, not only for childrens.
Agreed. The breakdown is indeed pretty poor IIRC.

Generally you use these disclosures to make directional decisions about infrastructure. The list of fixed and disclosed CVEs combined with the legacy PHP code base doesn’t really pass the security sniff test. You really wouldn’t know for sure without doing a full code audit.
An enterprise setup where people share machines, sure. There are plenty of reasons to be afraid [and mitigations], no need to find them.

Either take control or sell/outsource it, no skin off my teeth. I was replying to someone making the case for 'just trust Google/whoever, lol'

My point is this nears hysterical fearmongering. I'd prefer if you don't go on, but it's more for your benefit.

Stopping before I start my own rant about risk tolerance
That's one thing that made me lost interest in computing. I felt we programmers are in fact centuries late to the party.
If a car manufacturer gave me an offer to only use one particular petrol vendor...I would very much consider it.
> If done properly cve-s don't matter that much.

I think it depends on the CVEs and where they are. If it's a software vuln that requires root or some other complex prerequisites then w/e. But, if we're talking about low level problems in either the OS or network layer (e.g. firewalls, routers) then big clouds are most likely going to have that patched and rolled out more quickly IMO.
Curing addiction with ultrasound, non-invasive brain surgery.

https://www.washingtonpost.com/wellness/2023/11/02/addiction...
Yeah, really weird. I'm raising this internally to figure out WTF. OP can email me (jgc@cloudflare) with account details but I'm doing my own test right now on jgc.org.

EDIT: OP please drop me an email. Three of us internally at Cloudflare have tried to reproduce this and failed and we need to chat with you about what's in your build process so we can try to narrow this down. Cheers!

I made a simple test: https://jgc.org/svg and we made a couple more using Astro: https://misty-mouse-d370.pages.dev/hello and https://cec6e042.laz-svg-test-assets.pages.dev/.
MS is able to research and deliver top results in compilers and languages, while letting other groups making the most stupid decisions and partially derail those efforts.

That is why things can go very toxic. Windows is not suitable for use, there is no concept of privacy and MS has shown many times it doesn't respect users ownership.

MS has a leadership problem. It should have made clear internally that the free cross-platform developer tooling should cover everything for 98% of the developer community. They could keep diagramming and other enterprise features as a paid offering.

On the other hand: There is no competition for modern .net + Avalonia UI for fast and sleek native cross-platform desktop applications. Maybe Java + JavaFX, but I don't know enough about its current state.
Incredibly Ambitious SMB 3 Hack Released After 12 Years
Syncthing (via Möbius Sync) works quite (surispsibgly!) well on iOS, but there are still many paper cuts. I‘d have hoped the DMA would have forced platforms to be decoupled from services.
Collaboration Distance: https://mathscinet.ams.org/mathscinet/freetools/collab-dist
Can be summed up as: Quod licet Iovi, non licet bovi...
Can you give some examples of prompts that you use that will tackle hallucinations?
I got a GOTY 2023 for my game YOYOZO which is just 39KB and includes custom physics, online high scores, two music tracks, and more. https://news.ycombinator.com/item?id=38372936
Some people live in the UK, or Germany. Or heck, just want to criticize the UK from anywhere in the world but don't want to find out whether their threat to extradite actually has any teeth.
This is so true. I'm the lead developer for a product and we have loads of small issues all over the place. It is not a great feeling to be responsible for something while also not having any power to fix it.

From the business point of view, why would they spend time and money on fixing these things unless it's hurting sales or brand? Long term it likely does affect the brand but most people will have moved role/company in 5 years so don't care.
Yes, raylib does support android. I have a slightly incomplete build script I use for my raylib projects (obviously you need to take better care of signing, you probably want to build for other targets besides aarch64, your SDK is probably not installed in /home/denis, and I'm not sure whether I'm adding .so files to apk in a way modern android prefers, but it still works).

https://gist.github.com/deniska/f1ee73e18e1444eb724c01f933b6...
Please note that during the last big war, your much vaunted capitalist economy. was turned into a planed economy. This was done in order to focus it into a war winning machine.

However, I do agree that in general the most good is done for the most people by application of the the free market.
The way I read it, the message you replied to was a complaint about parts of VSCode being proprietary. Do you mean to say Jetbrains is pretty ok on the "not being proprietary" front?
Well, this evolutionary assumption is a heuristic, to be constantly verified and doubted by the mind. You can have an abusive family, and you need to escape it the same way you would escape any other abuser. You can have a brilliant human being belonging to another race or nation, and you need to evaluate them according to their brilliance, not prejudices.

As of free will — our own free will emerges from a very physical combination of electric impulses and chemical gradients. This means it might also emerge from other material representations, and perhaps better than ours.
A student of mine had an assignment to write a game using SFML, they wrote a FlappyBird clone and it was like a few hundred lines of code. It's not a very complex program to write. To be honest, I think 4k is too much :)
Never heard about qlot, but looking at it now, doesn't that solve it?
In 2019 when working for a cloud consultancy they paid us to certify for Google cloud with the promise of many new customers. In reality since then the consultancy fired all pure Google cloud consultants. I myself have had about three Google cloud only focused projects. A lot of promises but nothing came out of it.

It doesn't help that the platform has stagnated and customers are afraid of committing due to loss of features. In comparison AWS doesn't remove features for customers or always provide alternative ways to migrate to. SimpleDb is the prime example here.
IMHO, the mail app is very slow and need a large screen. Also it doesn't help to manage emails when you need to delete, to search for something, to put in folders and to deal with spams. But I am a power users who like to keep thing clean. Some employees works with it without complaining. Nextcloud recently "bought" Roundcube and it might become the prefered mail app sooner.
> I don't think the author is sympathetic to autistic people

I think it's actually the exact opposite.

This reads to me like a very kind sentence. It can be very helpful to spell things out like this for such an audience. It is clear, simple, and direct.

I'll also note the sentence doesn't contain any sort of added emotions or judgment. (For example, the author could have made it worse by saying "If you decide to engage in" rather than "If you engage in," as it's currently written.)

So it really is just a straightforward statement about things that are usually never discussed at all. And, even better for this audience, the information is provided plainly, in a safe setting, with time and space to process things.
Perhaps, but this is where the body language part comes in. Don't walk up to those evenly distributed circle around a circle.
Was this the place?

bug.co.jp

Apparently they changed their name last year.
Honestly, we're in a post truth era at the moment. There's so much misinformation out there that a 5 second google query can disprove, but it doesn't solve any arguments. That kind of cryprographic verification will only help you in court. There will probably be irrevocable pr damage even if you win that court case though.
HEY! mail was great when I used it
> If you can’t tell I’m human then you’re doing it wrong.

I'm gonna go out on a limb and say that if multiple multi-billion dollar companies struggle with it, then it's less of a solved problem than you're implying.

> Especially if you run a VPN on your router.

Very few people do this, and almost all of them are also using ad blockers. If using Cloudflare protects a site from thousands of bot attacks while inconviencing a few real users with esoteric setups, that tradeoff is well worth it for most site owners.

I've set up Cloudflare on hundreds of websites and when you look at the amount of nasty stuff it blocks, it quickly becomes clear why it's needed. If you want to blame someone, blame the Russian and Chinese governments (among others) for doing little to nothing about their unfathomably massive botnets.
Show HN: I built a tool to stop chasing users for feedback and screenshots
Hey HN,

I got fed up with chasing users for screenshots and building custom feedback forms for every app, so I built FeedbackThing.Pro to make it easier.

Now, all I do is drop in a simple <script> tag, and users can send feedback, screenshots, bug reports, and ratings effortlessly. Everything is organized in one place, no hassle.

Tech Stack: T3 (Next.js 14, Drizzle ORM, UploadThing)

No more endless feedback forms—just clean, efficient feedback collection for developers who want to stay focused on building, not managing bugs.
Can you give any more details on your setup? This sounds great
I think Baldur's Gate is as much to blame for this - that was really the origin of these high-touch, narrative-driven, asset-heavy games, especially with voice acting. It completely demolished the keyword based interactions of the Ultima and Wizardry games, almost completely removed wilderness exploration as an option in RPGs, and turned them into very curated experiences. As much fun as Morrowind was, it was still a disappointment to me coming after the vast sandboxes of Arena and Daggerfall.
That's new. Previously there was a setting, but they removed it, and it would even throw a warning in settings.json that the property no longer existed.

They must have reintroduced the telemetry setting. I can't remember if I deleted the old one, but my setting on that new value was set to "all" by default.
You shouldn't use NC for syncing, much better options exist. NC is great for sharing files and photos though web or mobile apps.