skysight-inc/HackerNews huggingface dataset:
You're going from something simple straight to Terraform and secret storage systems like Vault (KMS and similar).

While I'm not the biggest fan of where we are right now, it's better than the complexity of integrating with a secret engines.

What I really think is ideal is to dump individual secrets into files and only load the decryption key into memory. That way at runtime secrets can be read and decrypted without polluting ENV and avoiding them from lingering around.

Another integration, that would be great if it existed, would be if more web frameworks (the perspective I'm seeing this problem from) would integrate with the Linux memfd_secret api. Which would work great with implementations such as php-fcgi, but no so much with greeanthreaded systems.
We stopped making microscopic microservices but we still ship services. Services are deployable independently from each other, can be scaled independently from each other. A monolith that results in a single build artifact / executable or whose contents must all run in a single pod or application server is inherently harder for larger teams to work on. Deploying a small change means re-deploying your entire application. Scaling your authz system means scaling up your analytics data producers. Separating your code into services that run and deploy independently from each other means organizations can scale without creating headaches for developers.
For the best ideas to win, they must subject themselves to open conflict.

I didn't make a claim on how long conflict would last, but money is not infinite.

Noise is part of the system, and the system is not perfect, but that's a reflection of our imperfections, vs anything wrong with the final outcome.
>If corrupt incumbent politicians have complete control of the finances of an election, how could they be held accountable?

The exact same way any relief is sought against the government: the court system.
OK, this is how you know I'm not just pretending to have grown up in the Old Country. Between a steady diet of Itchy & Scratchy during my formative years and a national sport which consists of violence punctuated by committee meetings, I had fixated so much on the floral song conceits that I'd completely spaced on all the ultra violence.

Let's see if there are any US Top 100's (1955-1992) in which lyrics are ambiguous between human and botanic...

1961 https://www.youtube.com/watch?v=fT-tYh3OSUQ "san antonio rose"

1962 https://www.youtube.com/watch?v=OdGphk-XTh8 "rambling rose"

1973 https://www.youtube.com/watch?v=c9bJJNUdXEs "wildflower"

1980 https://www.youtube.com/watch?v=Het6ww147Es "the rose"

OK, that's more than I'd thought, but considering those 4 are out of ~3'300 titles, I'm pretty confident there'd be (relatively speaking? or even absolutely?) far more eastern entries, and maybe far more even if we limited them to the format of "${COLOR} ${FLOWER}".
Starting out a relationship by lying seems like a horrible idea.
The world where ChatGPT configures your server?
> "All Watched over by Machines of Loving Grace"

This reminds me of the tycoon's thunderously semi-religious speech from The Network [0], which has aged pretty well for a movie 50 years old.

> The world is a business, Mr. Beale. It has been since man crawled out of the slime. And our children will live, Mr. Beale, to see that... perfect world... in which there's no war or famine, oppression or brutality. One vast and ecumenical holding company, for whom all men will work to serve a common profit, in which all men will hold a share of stock. All necessities provided, all anxieties tranquilized, all boredom amused.

[0] https://www.youtube.com/watch?v=35DSdw7dHjs&t=0m43s
> It won't speed up to compensate for delays, and it's never going to wait at a station because it's running ahead.

The first part absolutely makes sense, but the second one I'm not so sure. They don't have any "Hold at station" or whatever it's called to get some even spacing if they're running ahead of schedule? Seems unnecessarily chaotic.

Doesn't that mean sometimes you end up with 2 or 3 trains coming right after each other?
+1, especially the 'Grand Inquisitor' portion. And a close 2nd would be Dostoevsky's "Crime and Punishment.'
> until AI and the bots ruined it all

Well... advertising as a business model ruined it all. They get paid for getting page views, so the business model optimizes for maximum page views at minimum cost of creation. This is the end result of what Google and Facebook have spent the last 20 years building.

But I'm sure the engineers who built all this have very nice yachts, so it's all fine.
"Original Pong did not have any code or even a microprocessor" : https://news.ycombinator.com/item?id=31511719

VM's just provide the software version of asic boolean logic

------------------

a) Boolian logic / explicit constructions to generate results. aka pong on specific purpose computation device.

b) Programmable computing / general purpose computer uses constructive logic (process of construction of mathematical objects aka programming languages)

c) "compiling"/"interpreting" b sets up the path through a to generate 'results'
vs. a's fixed path/hard wired path transition/state table aka compiler generated type punning![0]

-----

[0] : https://en.wikipedia.org/wiki/Type_punning

: punning with character : gawk chapter "11.3.11 And Now for Something Completely Different" program

: nil-punning : https://ericnormand.me/article/nil-punning
It's just that the "AI" word is no longer taboo
I have some blog posts about the making of Band, if you want to know more about how it was developed feel free to have a read!

https://meanderingthoughts.hashnode.dev/cooperative-multitas...
you have no data that suggests I can't fly either.
OTH they limit the blast radius.
Both statements are simultaneously true.

The goal is to protect the physical and institutional USA (and equivalent for other countries' intel agencies); this requires making sure there's no successful conspiracies, from within or without, to destroy it; this requires all the things we here all agree are bad for digital security, including the security necessary to running e.g. electronic banking ledgers or votes.

I don't have any actual solutions here, that's just a description of the problem space as I understand it to be.

There's a bunch of US agencies sponsoring Tor, presumably to undermine hostile governments, even though there's also US agencies trying to subvert it.
Show HN: Knowledge Table – Explainable multi-document extraction
hi HN,

We've just open-sourced knowledge table, a tool designed to simplify extracting and exploring structured data from unstructured documents.

We built it internally to help solve some of the structured data problems we work on, and kept getting questions about it when we used it in demos. A lot of it was motivated by the frustration of zero-shot multi-document retrieval, as well as the need for non-technical domain experts to have an interface they're familiar with. We found that inserting a tabular intermediary step for structured data construction in your backend RAG system improved accuracy and consistency, and was immediately explainable (and critiquable) by domain experts.

It's built with react and fastapi, all dockerized. We're going to consistently contribute to this, mostly integrations with some feature extensions we learn from customer work. Future work is outlined in the readme and roadmap.

key features:

- natural language interface for data extraction

- customizable extraction rules

- chunk linking for data traceability

- spreadsheet-like interface for familiarity

- extensible backend for developers

This is intended to be a community project, and we're looking for feedback and contributions, but we'll be working on it regardless as customers use it. We're particularly interested in hearing about potential use cases, feature ideas, and code contributions. Suggestions and critiques welcome.

github: https://github.com/whyhow-ai/knowledge-table

demo: https://knowledge-table-demo.whyhow.ai/
I write off not knowing things I'll never know. Not worth the time worrying about it.
The Evolution of Cooperation by Robert Axelrod
https://www.goodreads.com/book/show/366821.The_Evolution_of_...

See also https://ncase.me/trust/ for a really nice 30-min interactive summary of the ideas presented in the book.

My rough definition of "best" here is "most potentially impactful to humanity" (see also Andrew Breslin's Goodreads review).
Also annoyed that the title has

> and here's how to do it better

And then basically just says go use a vendor solution. Cool.
And the shuttle was designed to launch and recover DoD payloads. There's a lot of "military synergy" in the early space program. No one else was interested in paying.
The idea of reserving some capacity for specific workloads make sense, but that's mostly a load balancer / job scheduler configuration thing. The latent capability to serve other workloads physically hanging out in the same binary is really unlikely to have a material impact, if you're not sending it any work.
Indeed. It is often a feature that core infrastructure doesn't gain new features.
That matches my experience. Kagi doesn't surface much content beyond what Google/Bing do. What it does better out of the box is guessing which content is low-quality and displaying so that it takes up less space, allowing you to see a few more pages worth of search results on the first page. And then it lets you permanently filter out sites you consider to be low quality so you don't see them at all. That would have been awesome 10 years ago when search spam was dominated by a few dozen sites per subject that mastered SEO (say expertsexchange), but it is less useful now that there are millions of AI content mills drowning out the real content.

For content that isn't time sensitive the best trick that I have found is to exclude the last 10-15 years from search results. I've setup a Firefox keyword searches[1] for this, and find myself using them for the majority of my searches, and only use normal search for subjects where the information must be from the last few years. It does penalize "evergreen" pages where sites continuously make minor changes to pages to bump their SEO, which sucks for some old articles at contemporary sites, but for the most part gives much better results.

[1] For example: https://www.google.com/search?q=%s&source=lnt&tbs=cdr%3A1%2C...
Alot of programming languages don't integrate with memfd_secret because while most stuff runs on Linux, very few people actually develop in Linux and thus the friction.
I hate getting unsolicited junk mail. It's got all the attention theft of online advertising with the litter of shoving flyers in the mailbox.

Also some national postal services sell this "feature".
>I can't find any evidence that anyone has ever died from bisphenol-A poisoning.

That's like talking about cigarettes and claiming people don't die from nicotine, therefore smoking isn't a problem. Missing the point terribly.
They are also inherited by child processes. Though, so is the mount namespace.
Or an adult movie
I tried an L-theanine supplement for anxiety. It had a notable short-term effect, but when I was off it my anxiety significantly worsened. Got better once I stopped taking it, so I guess it was a dependency kind of thing.

So, I would say that it definitely has an impact. Perhaps it would have worked better with a smaller dose.
Fun with Go Iterators
Remind Me Later
But all of them would kill for Philip Morris levels of product-market fit.
Costco brand is surprisingly good. A bit chalkier than Gold Standard, but hard to beat the price.
Scale makes a difference.
The dev secrets tend not to be as useful from the internet as they are from the intranet. They also often don’t work in prod, only in dev. Worst case scenario if you have to frog-march an employee out of the building, you revoke the dev credentials and distribute new ones. Dev team is locked out of dev for an hour tops.

We were just moving into AWS secrets when I left. The API was simple enough, other than the fact that now everyone had to use aws login instead of just the few of us working in terraform, and the terribly chosen session timeout, which I don’t know if our people chose or AWS chooses.

But the management of the namespaces/roles for secret visibility looked Stone Age to me. I did not envy the OPs team the problems they were volunteering to deal with.

It feels like the same brand of tedious bookkeeping that led to the Arc security hole.
Aside from the .env points, which, fair enough, don't use "environment variables in a file", this always boils down to one actual security concern: Are you okay with every piece of code in your codebase having quick and easy access to all secrets?

The answer _feels_ like it should be no: zero-trust-by-default, etc. but you're fooling yourself - a compromised dependency isn't _just_ going to look at process.env. It's going to be installing a backdoor and having an agent login and poke around. It's going to be netcatting for 3306 and finding out where the credentials are eventually. Security thru obscurity is no security at all.

Last thought, Kubernetes' `envFrom` is such a salve of simplicity in this day and age.
NTN seems to be only offered by geostationary satellite operators at this point, which unfortunately puts the use case from TFA out of coverage. See for example Inmarsat's coverage: https://www.inmarsat.com/content/dam/inmarsat/corporate/core...

I'm not even sure if Skylo is live with Inmarsat at this point, or if there are any other NTN providers covering oceans.
Why does the invisible hand of the market work out in every case except this one?

There are a bajillion egregious things going on in the App Store. Why draw the line for Federal intervention here? Is there a sincere answer?
good question. i'll let you know if i can figure it out with https://bookhead.net
This really gets at one of my issues with the term "AI". There is a very scientific, textbook definition of what Artificial Intelligence is however, this term carries baggage from sci-fi.

Using a term like "AI" to describe this is like using a term "Food" to describe pickles. Poor analogy but "AI" is just so vast that most lay readers or those not familiar with this phrase in regular computer science discussions aren't grounded in the consequence.

I feel that we as an industry need to do better and use terms more responsibly and know our audience. There is a big difference between a clustering algorithm that detects pixels and flags them and a conscious, self-aware system. However both of those things are "AI" and both have very different consequences.
Is a cat-o'nine a culture?
It’s not tautological, it’s the difference between giving someone twice as many heart beats, vs making their heart beat half as fast.

Even if we figure out how to do the latter, it doesn’t help folks who have already had most of their heart beats. It’s not actually life extension.

And what is life like lived at half speed? Let’s say we can get people to 200 by keeping them immobile and cold and nearly starving them of calories and oxygen—dramatically suppressing their metabolism. Who would want that?
Right, but dumping envs is a common debugging and attack vector.
Thanks, wouldn’t think of environment being shared via DBus:

> Note that environment variables are not suitable for passing secrets (such as passwords, key material, …) to service processes. Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC, and generally not understood as being data that requires protection.

> Moreover, environment variables are propagated down the process tree, including across security boundaries (such as setuid/setgid executables), and hence might leak to processes that should not have access to the secret data.
> shut up all the "Starlink satellites are blocking my view of the sky" complaints

These complaints make a lot more sense when you project forward by just a few decades. We're talking about _one_ provider already causing minor hassles. What do you think an entire commercialized segment is going to do?

Maybe we can shut up all the "LEO satellites are the best way to build a communications network" people by building out a reasonable and fair network on the surface of the earth first.
Adults are not children. We often afford special protections to children that we wouldn't afford to adults, because they aren't fully developed humans. Nowhere did I talk about adults or say adults shouldn't be required to testify to provide evidence. But I think children need to be allowed to be children. You can look at the law in some US states around crimes against children, and a lot of them do permit either CCTV or recorded testimony with the assistance of a child psychologist or similar. The law already treats children as different. It sound like you're arguing that they should be treated like adults in this specific instance?

Slippery Slope is a fallacy if the person you're arguing with has no intention of going further than exactly what they've said.
Bots use YT comments to find private info [video]
As a non-American, social security numbers are a bit of a mystery.

Unique identify in a healthcare setting is critical, but SSNs aren’t used this way are they? From the wiki, it seems they were setup for social security tracking alone.

Having one number for everything makes sense, as I have a healthcare unique identifier, a driver’s licence number, an IRD number and probably others. However SSNs aren’t used for all these uses are they?

https://en.m.wikipedia.org/wiki/Social_Security_number
> Amazon S3 Select is no longer available to new customers. Existing customers of Amazon S3 Select can continue to use the feature as usual.

:(

But you and patrickthebold are spot on in pointing out Athena. I've always thought of it as a database you load via S3, but of course it's equally a tool for querying data in S3.
Hard to say really. One of the few (if not only) books i wish i could unread was the fountainhead
I guess you're being downvoted for sarcasm, but I agree with you that ultimately the "solution" of "just use some secrets manager from the cloud vendor" is 100% a shell game.

The arguments here are mostly the same logical fallacy that makes most DRM a joke: In order for the application to function (the end user to view the movie) they must be able to use the secret (the decryption key(s) of the movie). You can play as many games of indirection as you want, but it's all basically security by obscurity.

If your application is required to fetch its secrets from AWS or Google, then someone with the type of access needed to dump the environment vars (i.e. root access on the box) can likely also modify your application code, for instance, to dump out those fetched secrets to a file.)
We don't need to replace primary energy with electric energy in a 1:1 ratio.

An ICE car is 20-30% efficient, an EV is 90% efficient. Generally we are looking at a grid expansion, but it is not massive.

See this amazing chart on rejected vs. useful energy:

https://flowcharts.llnl.gov/
I sat down once and read all 8[0] Harry Potter books, and while the author is a terrible person, the books are absolutely fantastic IMO.

[0] I'm including the script for Harry Potter and the Cursed Child
I recently found exactly this vulnerability in a non trivial php app that is pretty widely deployed.. I think it just slipped through.
Don't use secrets in environment variables, but use this secret in environment variables, but this one gives you access to all secrets.

Things like vault which was suggested still requires you to pass the vault token in to your app somehow. And even then if your application does not have direct vault support you will still be using vault to supply secrets via environment variables, its even the recommended way with Nomad and their template system.

I really dislike these sort of articles. Because it has a catchy phrase "Do not use secrets in environment variables", and that is all that will be remembered. And next thing you know you will be at a company submitting a PR and some guy will say "Do not use secrets in environment variables", and then advise you to pass them as arguments on the command line (this happened to me).

Environment variables are today, the most safe way to pass secrets to a program.

.env files ARE NOT Environment variables, they are files. A better title and write up would be "Do not store secrets in file". Once you do that all the weird problems described, with exception of printing them as logs, go away. Then you need a new article "Do not print secrets in your program".

But that is all moot, because you should already be filtering out secrets by configuring your local log system to do so. I my self write wrappers and log systems that handle filtering out secrets from logs within the same context of the application I run. Its super simple, it s fast (if you know what a trie is) and you can worry free print secrets.

Edit: This article in fact has more damaging impact to security as a whole, mostly because of the conflation and 99/1 on problem/solution. This entire domain will now be blocked on all networks I have control over.
The flip side of this is that AI tools can enable much faster learning, so the time to go from junior to senior can potentially become much shorter for people who are motivated.
I really enjoyed that series. My mother was a geologist, and it was a fun time.
The Art of Code: The Crucial Balance Between Computer, Developer, and User
A modular monolith has a single executable which runs in different modes, typically depending on environment variables. So you can run three processes in the mode that handles web requests, five processes in the mode that processes events on a queue (e.g. Kafka), etc. Eight processes, running in two different modes, but it's all the same executable. That's the basic idea of a modular monolith.

By "plain monolith" I meant just any kind of monolith.
You do need to set some rule when onboarding people into an Elixir application. Not everything needs to be a GenServer, and please don't endlessly nest Enum.map calls.
Actually, using more energy is never good for the climate. While a lot of new facilities are "clean" (still needs quite a lot of infrastructure coming from across the globe), we tend to not decommission older, dirtier, plants, which results in a net increase of emissions. Emissions from "dirty" energies are on the rise, globally.

Don't forget also, that Trump's solution to the increasing energy demand of the USA (he mentioned AI specifically) would be to, and I quote, "drill, baby, drill". That is to say, not very good for the climate.
Seconding this. Variables I care about are packaging, sweetener additives, and country of manufacture/origin.
I read Google News' Technology section and avoid the AI subsection.
When I started my first job, I was like "Hey, these files don't have a closing ?>!!" and then my boss sighed.
“I lie to people’s faces to conduct a test around a mundane question in order to safeguard myself from the ‘meatspace’ ruffians that don’t like Ayn Rand” is a hilarious strategy.

As an aside, it kind of seems like Atlas Shrugged actually is your favorite book. You don’t appear to care what others think about Neuromancer or The Dying Earth but you literally require a specific and narrow set of feelings about Objectivism to pass The Test. (And obviously, it is the feelings that you mandate, not the lack of social graces, as you have noted that you don’t mind if others politely stop talking to you even after passing The Test. They do not feel positively enough toward Ayn Rand and as such are not worthy of your time)
Do you genuinely believe that if there were any way to get this thing type approved in an EU country, no one would have done so by now?
I suspect that what is happening here is that Hetzner received a lot of orders for storage node snapshots and/or evidence preservation from law enforcement (you probably won’t even be notified).
Encrypting dotenv files is a thing, I would even say it has become popular!

https://dotenvx.com

https://github.com/getsops/sops
Dead coral skeletons hinder reef regeneration by sheltering seaweed