skysight-inc/HackerNews huggingface dataset:
The ideal survey should feature among these criteria:

* For evaluations use a rating system of 1 to 7 where 1 is low and 7 is high. It must be an odd number so that there is always a forced middle optional available. More than 7 is too many points of evaluation and less than 7 is too few.

* The questions should be worded in a way that asks a question with precision. Do not provide open ended questions. Force the user to make a decision with confidence.

* Always remember the goal of a survey is to gather data that distills to qualified measures in the aggregate. Know what data you want to see before writing your questions in such a way that you can draw directly logical correlations between data points without making biased assumptions upon the data.

* Yes/no boolean type questions are acceptable, but impose a forced dichotomy, which is less precise, and that lower precision could cloud your data.

* Don't ask questions that impose a hypothetical or ask the user for their wishes or desired futures. These always result in poorly informed bias. Instead ask such questions in such a way that asks for reflections from facts or past events. Its your job as the expert to determine solutions moving forward.
So people shouldn't write what they care about, just so they don't offend uneducated rednecks who might stumble on an article that's not meant for them anyway?

If you have a family member who distrust msm and 'the globalists' then you're not going to convince them with a nature article anyway.

You have to understand that these maga-cultists don't use logic. Just like religion their beliefs are based on faith. Faith is exactly believing something despite facts and arguments. Someone who has drank the kool-aid and has progressed to the level of; "they said something bad about X, so they must be on the other side and I shouldn't trust anything they say", cannot be brought back with scientific proofs and logical arguments.

If you want your trump-family to stop taking bleach you cannot just argument against bleach. You have to repair their trust in science, education, the government, etc.

Not talking politics, but just sending snarky links to science they don't understand anyway is not doing your family a service.
“Either a strike from a meteor, OR this highly specific wiring problem. Could be either! ” is actually pretty funny
You don't follow. Nothing against you in particular, but this is why we've had 10+ years of "color problem" articles and no real solutions. The problem isn't the colors, it's the ergonomics.

The naive solution doesn't work because it turns out the difference between functions that return a value and functions that return a promise matters..

The other approaches destroy ergonomics.
What is your definition of "string"?

If it's "human-readable text", then fine, a string is not the same thing as an arbitrary byte array.

But lots of languages don't enforce that definition.
You could put a firewall at the other end of the wireguard connection.
The graph of snapshots is for forensics when someone breaks the tests and keeps obliviously trucking along
and it's still open source?
> However it was still a lot of work to cut the wood (log cabins required you to square all the logs - round logs will roll off each other and make for large gaps

Square logs are not needed if you notch your round logs:

* https://www.logcabinhub.com/log-cabin-notches/
They’re stored on the DType instance. This requires that there’s only one DType instance per “owned” array buffer, which I figured out how to do along with Sebastian Berg and others using the new DType system.
A Compiler for 3D Machine Knitting [pdf]
> you still must trust something implicitly. except now it's a company that has agency and a will of its own instead of just some files on a filesystem.

Some keys on a file system on a large number of user endhosts is a security nightmare. At big companies user endhosts are compromised hourly.

When you say forced key rotation how do you accomplish that and how often do you rotate? What if you want to disallow access to a user on a faster tempo then your rotation period? How do you ensure that you are giving out the new keys to only authorized people?

My experience has been, when you really invest in building a highly secure key rotation system, you end up building something similar to our system.

1. You want SSO integration with policy to ensure only the right people get the right keys to ensure the right keys end up on the right hosts. This is a hard problem.

2. You end up using a SSH CA with short lived certificates because "key expires after 3 minutes" is far more secure than "key rotated every 90 days".

3. Compliance requirements typically require session recording and logging, do you end up creating a MITM SSH Proxy to do this?

Building all this stuff is expensive and it needs to be kept up to date. Instead of building it in-house and hoping you build it right, buy a zero trust SSH product.

For many companies the alternative isn't key rotation it just an endless growing set of keys that never expire. To quote Tatu Ylonen the inventor of SSH:

> "In analyzing SSH keys for dozens of large enterprises, it has turned out that in many environments 90% of all authorized keys are no longer used. They represent access that was provisioned, but never terminated when the person left or the need for access ceased to exist. Some of the authorized keys are 10-20 years old, and typically about 10% of them grant root access or other privileged access. The vast majority of private user keys found in most enviroments do not have passphrases."

Challenges in Managing SSH Keys – and a Call for Solutions https://ylonen.org/papers/ssh-key-challenges.pdf
Given the nature of it (pretty.c) and the stated intention of being "backwards-compatible with C and all of its libraries", what would make more sense than sticking with C's multibyte strings?

https://en.cppreference.com/w/c/string/multibyte
Creating DSLs within C has a long tradition.

Stephen Bourne wanted to write his shell in ALGOL so badly that he relentlessly beat C with its own preprocessor until it began to resemble his preferred language.

https://www.tuhs.org/cgi-bin/utree.pl?file=V7/usr/src/cmd/sh...
Probably not much because everybody uses WhatsApp anyway ;) (in Europe that is)
That rocket docket is somewhat diminished after TC Heartland

https://www.bakerdonelson.com/return-of-the-rocket-docket-ne...
Congrats on the 10 year anniversary, though honestly I think having tried your new 2048 I'll go back to the classic build. It might just be the hours I've poured into the original but it feels faster without the additional animation. But still a lot of good work there and I'm wishing you the best of luck.

As for the argument about Threes!, I have to say that I've generally found 2048 to be a much more fun game; the full-screen sliding and the lack of the 1+2 mechanic makes things move much faster, which for me is a priority. That's definitely personal taste, but I hate the vitriol that comes up on the topic.
NextDNS Windows Client Mass Deployment Guide
Count me in, because reasons 1 and 2, and because Go.
There is a paper about : https://arxiv.org/pdf/2405.18719
Companies liked to bring patent suits there because it has historically been a very “business friendly” docket
As someone who just got diagnosed with type-1 diabetes (the auto-immune variety, not the “you eat too much sugar” variety), this was far more depressing than funny. I’m probably being overly-sensitive, but man my life has gone to shit in the last couple of years…
great post, on a somewhat related note: https://slow-thoughts.com/aspects-of-fashion/
>most artwork about the American revolution it's obvious which side is and isn't a professional army

True. But wasn't the reality complicated (as usual)? There were French regulars on the American side and various militias fighting on the British side. And Indians fighting on both sides.
There is an app called Slowly [0] that kind of does that, you send open letters and people can respond to you. They take time to arrive, the longer you physically are from each other, the longer they take.

I've found it very cool, got a few responses to my open letter and responded to some letters. People were cool and writing long form stuff is great. Unfortunately I struggle to have a long term relationship through this, I feel too shallow. But the experience has been great.

[0] https://slowly.app/
TinySA looks cool! I want one.

I made a thermal camera https://github.com/RamboRogers/M5StickCPlus2-AMG8833-Thermal...
New plant-based glitter shows no harm to soil organisms
Why is small claims court better than a law flipping the default liability?

It's basically insane that we require individuals to sign a blanket billing authorization prior to receiving care. Perhaps the hospital should have to provide a maximum amount that is at risk (hopefully creating pressure to operate in a sensible way).
> In Go or Rust, returning an error is also a “color” that spreads out to the top of the call stack.

Not unless you're doing it wrong. Errors need to be handled. That may, in some cases, mean handling it with another error, but that isn't adding any "color". The new error is independent of any previous error state.
My JetBrains all products pack is one of the few subscriptions that I enthusiastically pay every year. People talk about Copilot or Claude as a force multiplier, but I use both and would rather give them both up than switch full-time to VS Code or similar. Between their git integration, navigation tools, refactors, search, and so on, programming in a large codebase with a JetBrains IDE is just a completely different experience than trying to do it in a lower-power editor.

And, of course, the other reason why I'm so enthusiastic about their products is that they're one of the only companies that has been able to maintain a thoroughly symbiotic relationship with the developer community. They somehow have consistently maintained a healthy balance of giving things away without losing their business—their subscription model is humane (you get to use the last version you paid for indefinitely), they have an open source core, and they lean in more than most to giving their paid products away to students and others who can't pay.
Ah I could see how that’s confusing. I was trying to indicate that the size stored for the string in the example is 28, but it’s stored in a 64 bit uint.
To tell time in Ethiopia, dawn is 12 am
Ethiopia, like Japan, with its unique culture, is proof that the world is not completely homogenized yet.
That was covered in the article, but as the author was already older than 30 years, it wouldn’t have been applicable for them. It also seems the Working Holiday visa is intended for “employment as an incidental activity of their holidays for the purpose of supplementing their travel funds” [1], whereas the author rather appeared to be looking for a “working full-time with some incidental holidays alongside” situation.

[1]: https://www.mofa.go.jp/j_info/visit/w_holiday/index.html
> fair lengths of natural language interspersed with [greek with a smattering of hebrew, hiragana, etc.]

Also some made up stuff also. For example in financial maths, the the derivative of an option's price with respect to volatility is called "vega". Why? Well because all the other option derivatives are named using Greek letters (delta, gamma, rho etc) and "vega" sounds sort of Greek even though it's just made up.[1]

[1] I haven't heard a convincing etymology for vega in financial maths but it's generally written using the letter "nu" which just looks like a "v" https://en.wikipedia.org/wiki/Greeks_(finance)#Vega
The parents bear a tremendous responsibility for failing to adequately secure it.
What the state of the US economy can tell us about Trump's populist appeal
https://ovogames.org/
Like it or not, the leader derives his power from the populace. An autocrat is powerless without people going along.
> What was so bad about that?

They invented the ponzi scheme of pensions. There needs to be an army of younglins slaves to prop up the system. No generation will willingly accept no pension.

Plus, last time I checked the vast majority of those billions is china, india and africa. The native west is already in decline and keeps importing third worlders to keep said scheme barely going.
Not really. It makes it clear from the first attempted sweep they altered construction -- the opposite of a long game.
I found someone with a pen recording me. They left it on the desk, and I took it by mistake. I found it in my kit and realized it was a spy device.... yikes.
> Some software call home at 4am every day

Which app?
With a firewall you can keep using them, instead (and maybe only let through some of the traffic)
Enough with the gatekeeping.

I understand the fundamentals of how git works under the hood. But the cli commands are in no way shape or form, intuitive (just one example). But LLMs nail them every time when I forget.
Datahaven.net – Registry of the .ai domains
> Premature optimiiation is about manually unrolling loops or doing inline assembly - things any modern compiler can do for you automatically.

If compilers consistently did this, projects like ffmpeg wouldn’t need to sprinkle assembly into their code base. And yet.
It baselines on power on. So you'll need to get closer to raise the baseline. It also doesn't seem to alert on beaconing (or very little), my wifes phone and other devices need an active transfer to trigger it. (more than a 1/2 second)
Build durable apps on Cloudflare Workers: write Workflows, we do the rest
That's no longer a requirement since iOS 17.4 (also thanks to the EU, but also only for users in the EU):

https://developer.apple.com/support/alternative-browser-engi...
And people in Russia's neighboring countries also remember maany things.
I totally understand being frustrated about people demanding workflow changes or huge accessibility features, but this is literally just a color swap that can be done with a touch of CSS it's really not a big deal.
Thanks, I spent the whole day reading this awesome blog, thank you so much for posting it!

I loved the articles about their daily life at the Pole, it feels surreal to see an almost regular building with kitchens, showers and other amenities on the South Pole.
Ask HN: How does DKIM forgery via Salesforce work
Recently Sam Mitrovic posted about a sophisticated phishing attack:

https://sammitrovic.com/infosec/gmail-account-takeover-super-realistic-ai-scam-call/

As part of that attack, it appears that the attacker was able to forge an email from `workspacesupport@google.com` which passed SPF/DKIM/DMARC checks. To explain how this is possible, Sam states:

> The header showed how they spoofed the sender email address. They are using Salesforce CRM which allows you to set the sender to whatever you like and send over Gmail/Google servers.

This explanation seems incomplete to me. Since Google outbound SMTP servers use a shared IP pool I see how sending email via this pool could circumvent SPF protections for any domains which adds `include:_spf.google.com` to their SPF policy (vs say using an outbound gateway). However, I thought that the DKIM protections should still be in place. It seems to me that the private DKIM key shouldn't be shared between Google Workspace clients in any case and therefore the forged email should not be correctly signed.

What are the best practices for Google Workspace clients to protect their domains from this type of forgery (which passes SPF/DKIM/DMARC checks)?
Interesting. It's clearly complicated. The tl;dr appears to be that Congress loves meddling in USPS affairs but requires it to pay its own way, and uses it as a political punching bag when it falls short. From the article you posted:

"While state government workers and teachers have their pension and retiree health funds invested in a mix of stocks, bonds, and other quality assets, USPS, by law, can invest only in government bonds. USPS had $298 billion in such assets at the end of fiscal year 2022. Its inspector general estimated it could have had up to $1.2 trillion if it had diversified its investments as states do for government workers."

So USPS is $900b short because of laws Congress passed, and now needs $100b in taxpayer assistance.
Amsyar hensem
We got a nice little CTF group on Briar where we are doing interesting exploitation stuff every other week. In case that's interesting?

Most of the stuff is implemented in Go because I believe that you've only understood the problem if you can automate it in code, as you can see in my writeups repo [1] :D

[1] https://github.com/cookiengineer/writeups
> The noise values used for the encryption key were originally produced by large mercury-vapor rectifying vacuum tubes and stored on a phonograph record.

That's sure a hardcore way to run an analogue randomness generator.
Are variadic macros turning complete?
The main difference is the strings are stored in a single contiguous arena buffer (with some minor caveats if you mutate the array in-place). With object strings each string has its own heap allocation.

More details in NEP 55: https://numpy.org/neps/nep-0055-string_dtype.html

This post is based on the content of a 25 minute talk and it’s hard to explain everything fully…
> There is no sense of obligation to users who use your product for free.

I bet he paid for his phone and had no chance of using another OS on his phone.
(and i am not talking about dark patterns which send you to Google services)
Dev is HSTS preloaded and thus can't be used for internal http services as .internal can.
does this transpile to C or how does it actually work?
You could without boost converter and the battery.
https://x.com/rogerscissp/status/1847430193113141549/photo/1
Sorry for what is probably a stupid question. Does pretty.c act as a preprocessor or sorts, converting your pretty.c script into actual c, that is then compiled? Or is it a virtual machine that interprets your pretty.c script?
Why is everybody saying this when the game mechanic of 2048 is fundamentally different. The difference in play between swiping over one tile at a time VS swiping and moving all tiles to one side is a big difference.

Furthermore, the author didn't know Threes existed when they made it, so calling it a "blatant rip" is rudely false. Let's lift each other up instead of pushing each other down.
Reminds me of "Bronze orientation day" https://www.youtube.com/watch?v=nyu4u3VZYaQ
It depends if they are using a “vanilla” instruction-tuned model or are applying additional task-specific fine-tuning. Fine-tuning with data that doesn’t have misspellings can make the model “forget” how to handle them.

In general, fine-tuned models often fail to generalize well on inputs that aren’t very close to examples in the fine-tuning data set.
The title doesn't make it at all obvious what or who this is about. It appears to be a followup to https://randomcriticalanalysis.com/why-conventional-wisdom-o... , recently posted at https://news.ycombinator.com/item?id=41870858 (and also several other times since the original publication, but this is the first time it got traction on HN).

The thing that isn't clear to me in the author's model is why it should make sense to see this kind of power-law result (it obviously cannot extend indefinitely, since at some level of income, health care spending would be predicted to exceed 100% of income). This should be at least as much of a problem as the "poor countries are predicted to have negative health care expenditure" problem that the author points out with linear models.

(If we're concerned with out-of-sample data in judging the soundness of a model, then presumably we should also be concerned with these sorts of hypotheticals. The author does seem to note the concern, but IMO dismisses it too readily.)

A more intuitive model, IMO, would be a fixed percentage of income in excess of some threshold - but this is also problematic in that our "threshold" for covering basic needs is apparently highly variable (given how poor some countries are compared to the US).
Not everyone who receives a computing device is the same one who set it up. I’ve told this story before but I’ll repeat it because it’s illustrative. Back when MacBooks ran intel processors and bootcamp was both new (and explicitly unsupported) I spent a few hours assisting a new and very irate customer in figuring out why their new MacBook was having all sort of problems that as they described it were not possible in macOS or had already been solved by software/firmware updates. Turns out they’d bought their new MacBook and given it to their nephew who was “smart with computers” to set up. Said nephew decided on their own that what their aunt needed was not a MacBook running macOS but an expensive windows laptop. So they installed bootcamp, installed windows, shrank the mac boot partition to the smallest it could be and configured it to boot directly into windows. As a result, all their usual issues with windows were still present and firmware updates weren’t being installed because it never booted to macOS to run the macOS software updates. I spent a few hours with the woman explaining what her nephew had done, the general concept of an OS/dual booting and fixing things so she could use the MacBook as a mac, without losing data in a drive re-partition. The reality is that not every end user is making informed decisions about their devices, and not only does that harm the user, but it also harms Apple. From their perspective I spent hours supporting unsupported software and trying to repair their brand and reputation in the eyes of an irate customer for something that wasn’t even their fault, and caused by giving other people the choice to leave the curated path. That customer later became one of our better customers, but if they hadn’t happened to get the store employee who understood bootcamp, and who had a manager that would allow them to spend that time supporting unsupported software, they might have both never been a customer and been an active detractor.
Or just use Ruby.
Current discussion: https://news.ycombinator.com/item?id=41932225
Related:

The global surveillance free-for-all in mobile ad data

https://news.ycombinator.com/item?id=41923931
Show HN: Fluxa – Simple task management for small teams and freelancers
Hello HN,

I built Fluxa, a fast, simple, and flexible task management tool for small teams and freelancers, because over the years I couldn’t find anything that truly fit my needs. Tools like JIRA were always too cumbersome or rigid, so I decided to create something that focuses on simplicity, speed, and flexibility.

Fluxa currently has a limited set of features, by design. I'm starting simple and plan to expand based on user feedback.

I myself am already using Fluxa to manage both software development projects and personal projects, like renovating my home. I invite you to try Fluxa and share your thoughts. Looking forward to your feedback!

Cheers,

Nick
Huge! Forced data collection, I hope at least the code is not sent for training