skysight-inc/HackerNews huggingface dataset:
Yes, CanvasBlocker for Firefox does this: https://addons.mozilla.org/en-US/firefox/addon/canvasblocker

e.g. For me it shows a new unique fingerprint each refresh.
Did op amps on a uni CS degree in 79-82 and they never explained why. "Learn this" was an unhelpful approach where "these are building blocks which matter in digital communications, IO, control systems and signal processing" might have helped.

Same with numerical methods. Zero sense of why we had to learn, and I failed spectacularly.
The fundamental flaw people make is assuming that LLMs (i.e. a single inference) are a lone solution when in-fact they're just part of a larger solution. If you pool together agents in a way where deterministic code meets and and verifies fuzzy LLM output, you get pretty robust autonomous action IMHO. The key is doing it in a defensible manner, assuming the worst possible exploit at every angle. Red-team thinking, constantly. Principle of least privilege etc.

So, if I may say, the question you allude to is wrong. The question IRT to SQL injection, for example, was never "how do we make strings safe?" but rather: "how do we limit the imposition of strings?".
Tell HN: Robots.txt pitfalls – what I learned the hard way
This applies to sites indexed on Google that hope to gain organic traffic. As an indie blogger and SEO enthusiast, I foolishly updated my robots.txt file to prevent indexing of certain unwanted parts of my site, leading to subtle repercussions that I couldn't have foreseen.

A few days ago, while reading about SEO, I came across the concept of a "crawl budget." Apparently, Google allocates a specific crawl budget to your indexed site, and the more useless content it has to index and store on its servers, the more it affects your site—resulting in delays for new content indexing, favicon updates, and robots.txt crawling.

Being a minimalist and utilitarian, I decided to prevent indexing of the `/uploads/` directory on my site since it mostly contained images used in my articles. I thought blocking this "useless content" would free up more crawling budget for my primary content, i.e., articles. So, I added this directory to my site's robots.txt:

# Group 1
User-agent: *
Disallow: /public/
Disallow: /drafts/
Disallow: /theme/
Disallow: /page*
Disallow: /uploads/

Sitemap: https://prahladyeri.github.io/sitemap.xml

The way search engines work means there's typically a 5-7 day gap between updating the robots.txt file and crawlers processing it. After about a week, I noticed that my site's favicon disappeared from SERPs on mobile browsers! Instead, there was a bland (empty) icon in its place. That’s when I realized that my favicons also resided in the `/uploads/` directory. After I recently optimized the favicon format by switching from WEBP to PNG, Google was unable to crawl and index the new favicon at all!

Once I realized this mistake, I removed the blocking of `/uploads/` from the robots.txt and requested a recrawl. But who knows how long it will take for Google's systems to sync this change and start showing the site's favicon back in SERPs! Two lessons learned:

1. The robots.txt file is highly sensitive; avoid modifying it if possible.
2. Applying SEO is like steering an extremely large ship or vessel. You pull a lever now, and the ship only moves after several days!
I learned that the hard way. If you eat a bunch of fresh pineapple with someone you're both going to be less inclined to want to make out afterward.
Among other things clashing and locks and possible conflicting rules on whether or not to block or allow something
It's the decision to use hex at all which is weird. I don't think most of this crowd would be particularity impressed by it.
The problem is that when people don't know how to use it and instead turn it off they're immediately deluged from every side with pathetic nerds screaming that YOU DONT HAVE TO TURN IT OFF ANYMORE RUN THIS ARCANE SEQUENCE OF COMMADS THAT YOU DONT UNDERSTAND AS ROOT AND THAT WILL FIX THE ONE ISSUE YOU HAVE without understanding that not every computer system needs to be locked as tight as a server that's being shared with a bunch of untrusted users who are running god knows what.
While true, I think your additions to the behaviors are rather... useless. Out of the original three, notice that one is the actual behaviour we want to happen and two are insidious side effects that we want to prevent.

Your proposed fourth and fifth outcome behaviours, on the other hand, are neither. Most importantly, they are transient (at least ideally). Either the workforce and the management come to an agreement and metrics continue (or discontinue) or they don't and the business stays in a limbo. It is an emergency (or some other word with lower impact; incident?). There isn't a covert resistance by some teams specifically working against the metric and lowering it while also hiding themselves from notice.
> where does this end?

It never does, because abstractly speaking, there is no such thing as a secure computing system. This goes double for any computer that is switched on.

Practically speaking, it depends on how critical your application might be. If you're storing values for neurosurgery or automated dispersal of life-saving (or potentially life-ending) medication, you'd better be sanitizing on the way in, validating on the way out, and have some additional layers like audits and comparisons to known good values at rest. Look into defense in depth, and never trust the computer to make a decision, because the computer cannot be held accountable.

If you're storing quiz results for someone's favourite colour, or it's not internet connected, you can probably be a bit less paranoid about it.

> Can everything be an injection attack?

But yeah, anything and everything could be an injection attack if the attacker is determined enough. It's just a matter of how difficult you want to make it for them.
Typeset: An HTML pre-proces­sor for web ty­pog­ra­phy
Codeberg Reconsidering OSI License Approval in Terms of Use
Scythe Works Without Borders
Why google don't implement basic boolean operator logic is beyond me. MH has -lbrace and -rbrace so you can wrap -and -or and -not up properly. Once learned, you can ask any question.

With google+ they had the same problem. How to say, @friends not @josh so you can do a secret birthday party for josh. The primitives here are simple. I asked them several times why they didn't do things like this and they said "to hard to explain to ordinary users" which frankly I thought was a cop out. I AM an ordinary user.
Followed by "surely the year of the Linux desktop is at hand!"

I'm not going to link it here given his disdain for this site but jwz at least got the CADT development right. If you stop fucking rewriting things every couple of years then maybe the average user could catch their breath and catch up but if you keep changing things that don't need changing (ALSA -> PulseAudio -> pipewire -> whatever is already in the works to replace pipewire) instead of ACTUALLY FIXING THEM then you lose the right to be surprised when someone just trying to use their computer just gives up.
How do you stop agents from prompt injecting each other?
https://linux.die.net/man/1/indent

I remember reading through it and deciding options based on what I’ve seen elsewhere. Later I just wrote in the chosen style without re-indent(1)ing whole files, cause this is generally a bad idea in my book.

The only change I made in around last ten years was using “}\nelse {“ because I realized that I’m post-newlining the preceding block anyway for visibility and “\n\n} else {“ looks kinda ugly.
I have about 30 numbers I use personally through voip.ms. They are all SMS/MMS enabled without TCR issues, signups, or requirements. Heck, I just checked and couldn't even find a way to register for TCR. Read into that how you'd like. I've had no issues with messages not being delivered to any mobile providers, but I honestly haven't tested this thoroughly. I just haven't had any messages I've sent not go through.

They have SIP support as well as an online SMS/MMS portal you can access from desktop or mobile. The only issue is they are still working on support to receive MMS by SIP protocol which might eliminate them from your consideration. You can send MMS by SIP currently though.

Phone number is only $0.85/month and then pay-per-usage of $0.0075/SMS and $0.02/MMS. Probably cheap enough to purchase a number to test it out to see if it will meet your needs. I've used them for years, have had no issues, and am happy with their service.

The only knock on using voip.ms is the initial setup is a little tedious and you need to understand the basics of how they are working with each part of the VOIP protocol. Their FAQs and guides are pretty well written to help you get set up.

I start with voip.ms and see if they meet my needs due to great customer service as well as low price and high stability. Then I look elsewhere if I need something voip.ms doesn't support.

edit: spacing for readability
Shipping sector is a huge co2 emitter and this claims to cut "fuel burn and carbon emissions by 75 percent without any sustainable fuel breakthroughs".

As we ramp down fossils we this kind of thing would enable eg international agreements to limit and progressively lower shipping sector co2 credits over time.

We need to do this for all co2 emitter sectors since all the slices of the pie are fairly small so focusing on eg top-3 doesn't solve the problem.
They'll need an awful lot of crackers for that.
> See link.

A blog article from a law firm isn't a great source here, especially when contrasted with the numerous accounts of people that have been forced to unlock their devices without legal basis.

> In any case, you're free to challenge, etc. See link.

Not if a 'legal basis' is claimed.

> Like most people then. Whether crossing US or Australian borders.

Yup.

> So Australia's not the worst "anglo country" then?

Is the term anglosphere such an unfamiliar term you had to put anglo country in quotes?

Australia is the worst country when it comes to searching devices without justification, objectively going by laws and user experiences.

The UK is the worst country for being treated with a lack of respect and being asked intrusive questions in my experience.

> Do you recall correctly? Did Australia stop?

You're being overly defensive, lad.

Maybe put your patriotism/tribalism aside while having this discussion?

I read a few articles recently that said Australia had stopped recorded, so yes, fairly certain I am recalling correctly but not about to go and look it up either.
That’s an interesting minor but significant difference. I’m from the UK, and both of my house keys (Yale, Abloy) have a distinct ‘right’ and ‘wrong’ orientation. Every house key I’ve ever had has been like this. The keys for my desk drawer and filing cabinets too.

Car keys don’t though, as far as I can remember.
Should elephants have the same rights as people? A Colorado court may decide
Because it was on my keyring... You should see the shit on my wife's keyring. :-) But, theoretically, if someone found the keys and wanted to, they could put a new battery in it and it would show up again. And mostly because the battery lasted long enough that it was worth replacing, but I never seemed to get notifications to remind me about replacing it, so I didn't until I thought about it.
raises left hand defiantly :)
I've implemented a custom powerdns backend that combines heathchecks, weighted probabilistic round robin, and geo DNS and it works excellent to build and auto healing CDN.

It was specifically built for multi DC or multi cloud or hybrid operations that are on separate continents, with geo DNS, heathchecks and faiolver on the DNS level at the same time. When all usa servers in the WRR pool are down, or DC is down, it starts to answers the closest next set of WRR (Canada) automatically.WRR pools are dynamic and auto healing, constantly doing http heathchecks.

It is also dirt cheap, like 100x cheaper as opposed to aquire provider independent IP address space and run and operate AnyCast and having 24/7 NOC teams on this AnyCast, constantly adjusting bgp communities etc. and it is not like anycast and bgp solve anything when one server is down but other works. You can't stop announcing whole prefix if you run 200 machines but only one or two are down.

TTL I'm using is 30 seconds.

I never shared this backed with the world, you can't test it or purchase it. But maybe some day I'll launch a route53 competitor ;)
I have a terrier and have had to clean up in the after math....Although some are too fast for him to catch.
Not my idea, but I supported it. Originally, client build scripts resolved the service names at build time, and that worked ok because our hosts tended to have a lot of longevity, and DNS tends to work, but things got a little better when we were more intentional about selecting the servers to be in the list, and keep track of which ones were in the list, so retirements could be managed a bit better. And I pushed until we got agreement on a set of FB load balancer IPs to include as well.
Excuse me but what would be the use of zeroing a register before overwriting it?
Generating Presigned URLs with Cloudflare R2 – Ultimate Cloudflare R2 Guide
The vanilla js APIs are so atrocious that we got jquery.
How do you make a function that returns 1 when an agent is behaving correctly and 0 otherwise, without being vulnerable to being prompt injected itself?
A lot of US nudity & sex tends to be bordering on soft-core porn. It's often gratuitous. I honestly don't think you are watching that with your little ones (if you have any) and your parents.
Capital investment means construction jobs and hopefully local economic uplift. Dead airport projects are a bit of a thing worldwide.
Android, Chrome. Could well be age of device.
Right, it’s kind of known as the incel mobile I think by most people. In the same way when you see a MAGA hat on the street, you already know a lot about the person before they a a single word and you do your best to avoid them but other people with MAGA hats will give each other the wink and nod.

In my experience that’s the closest thing I could describe to the cyber truck experience and how most people look at it.
JPEG XL has been here a while but Google has decided to avoid it, even Apple has adopted it. at the same file size webp has worst color banding and way more trouble at keeping small details accurate and compresses too much.
I found on her website [1] that she released a RDS decoder tool [2] relatively recently (compared to the 2013 of the video at least). Looks like it works with a USB RTL-SDR [3] receiver or a pre-recorded file in a number of formats.

[1]: https://www.windytan.com

[2]: https://github.com/windytan/redsea

[3]: https://www.rtl-sdr.com/about-rtl-sdr
Weirdly I ran into something similar many years ago. I took a similar alarm clock and hacked it to connect it the alarm signal to a stereo system with two 12 inch subwoofers. It was very very very loud. Neighbors could hear it a street over.

Anyhow, I had to update how it powered the internal speaker (which I was taping into) because it was a little bit too much and the thing would reset.

I’d go into more details but it was trashed and it’s been about 20 years since …
My favorite cheese fact is, and shall always be, that Wallace and Gromit saved Wensleydale cheese from ceasing production by having it be Wallace's favorite cheese in A Close Shave. Nick Park just liked the sound of the name.
"So I got to work"...

I love that hacker mindset :)
You nerd sniped me. The guts of how http2 deals with this in golang is in transport.go :
https://github.com/golang/go/blob/master/src/net/http/transp...

If I’m reading the code right round trips (HTTP requests) go through queueForIdleConn which picks up any pre-existing connections to a host. The only time these connections are cleaned up (in HTTP2) is if keepalives are turned off and the connection has been idle for too long OR the connection breaks in some way OR the max number of connections is hit LRU cache evictions take place.

Furthermore, the golang dnsclient doesn’t even expose record TTLs to callers so how could the HTTP2 transport know when an entry is stale?
https://github.com/golang/go/blob/master/src/net/dnsclient_u...
Always interesting to follow the etymology.

The gnu manifesto hit in 84/85 and I remember reading it and thinking "ambitious" but the thing is, we had the DECUS tapes. Sharing code had been routine amongst pdp11, dec10 and vax users since the 1970s.

I think the definition of open source is interesting but not definitive of what free software is. It's an enormously important term, but really only a flavour.
This!

Unless something is theoretical impossible, the only thing stopping a determined hacker is the amount of time and coffee in reserves.
A null finding in a study does not mean it “doesn’t matter”. Let’s take an extreme example: we want to know if exercise reduces mortality, so we randomise one arm of a cohort of 20 people to an exercise regime, while the other arm does nothing. After four weeks, we compare the death rate in each group. There’s no significant difference.

Does this mean exercise “doesn’t matter” for mortality, or it’s in the “doesn’t affect category”? No, of course not - the finding was null because the timescale was too short and even then, the statistical power from a cohort of 20 is going to be very low.

Likewise, if you look at the study characteristics, most of the studies were too short to find a significant outcome on an insensitive endpoint like CVD mortality or ACM. FWIW, Dayton 1967 had a followup of 8 years and did find significant increases in mortality endpoints in the SFA group, but those results are pulled towards null in the meta summation by the other, shorter studies.

CVD events are more sensitive because they don’t require the participants to die of a heart attack in order to register as a data point.

So no, there’s no lying or cherry picking going on here. In order for that to be the case, you’d have to argue that angina and non-fatal heart attacks are not negative health outcomes. If they are, then it’s demonstrably the case that SFA consumption is associated with negative health outcomes, and Nina is telling porkies.

As for your accusation that I’m lying - what false claim did I make? Be specific.
Ok so he was here on a student visa and did some work as well, and then dropped out? Not exactly the bombshell story that this author is making it out to be, since it’s not the typical illegal immigration situation or typical migrant. And it’s still not relevant to today’s debate as to whether there should be an open border or easy to abuse asylum processes. Also, if this is just planning for the next lawfare attack against Musk on political grounds, that’s far more disturbing than whatever is alleged here.
Interesting, it seems like this isn't part of the spec per wiki:

> Most browsers now recognize and support NAB, though it is not strictly part of the GIF89a specification.

So I guess the players for the new video codecs could do something similar and agree on some metadata to be used for the same purpose?
I’ve read that saturated fats from red meat get processed by our gut creating a metabolite called “trimethlylamine N-Oxide” (TMAOs) and that this is what increases one’s risk for CVD.
This seems like a battle the end user can never win. The only idea I have is that everyone would run an identical, specially crafted, 'browser-vm' / container? that presents identical metrics and values for any amount of system query.

Imagine the data start pouring in as every client is starting to present itself as a 68000 HTML5 only browser, with no react rubbish or javascript support. We might end up with a simpler, and faster internet again. Plus a lot of big tech and ad companies scratching their heads.
"That’s because to understand zero, our mind must create something out of nothing. It must recognize absence as a mathematical object." - I don't see how that follows from anything. So 0 in counting would account for "no item", while 0 in the decimal system would account for "multiply by 10"? Are there different neurons for that? :)

I've also read the linked article "https://www.quantamagazine.org/why-the-human-brain-perceives... which discusses the discovery of "number neurons" and goes on to discuss that there might be no "number neurons" after all.
In fact, due to the promotion of the Communist Party of China, almost all Chinese companies will adapt to Huawei's mobile phone system.
Years ago you could get crazy specific fingerprints from canvas. It got far less precise when Chrome introduced jitter into timers and treated performance timers as security sensitive functions. The main difference between canvas and this other stuff is that canvas couldn't be spoofed whereas everything else could and can be spoofed, or was so general as to be useless as an identifier.
Not someone like Bill Gates who moved his wealth into non-profits he controls. Jeff can't just sell Amazon and move out so easily.
Because we'll all be dead soon and I want to have achieved something great with the short time I was given on this planet.
Don’t know what OP might suggest but my first take is: never allow unstructured output from one LLM (or random human) of N privilege as input to another of >N privilege. Eg, use typed tool/function calling abstractions or similar to mediate all interactions to levers of higher privilege.
Begin (begin.com) team joining Sanity
This week's episode of the Radiolab podcast also covers these events.

https://radiolab.org/podcast/the-unpopular-vote
This is a thread about the Cybertruck.
>In California, college students are required by law to obtain repeated, vocal permission from their partners for a sexual encounter to be deemed not rape. But pimps can openly sex traffic minors on city streets in broad daylight, and the police can do little about it. All of these disparate approaches to perceived social problems are regarded as “progressive”.

What’s the historical analysis I’m supposed to take with this, dang? This is classic conservative framing, all the way to throwing progressive in scare quotes. Nothing other than generic culture war fodder can be gleaned from this unless you already agree with these absurd premises…
I thought the js DOM API was atrocious. But they copied it over with Java object hierarchy into Scala.js. Makes me want to give up on coding altogether.
These were not coworker or peer relationships, so I don't think your list/agenda here is particularly relevant.
The other reason: you have an open TCP socket that you're actively using. Unless you finish with that connection or it breaks, why would you re-resolve it when you're not running connect() a second time? The failure mode we noticed most when looking into why clients weren't following DNS changes isn't that they were long lived connections, like a server copying a large file or streaming logs. Which isn't unusual if you think about it, just not a short lived web browser or curl-esque connection.
If it was stolen from a wholesaler it's possible they're using the wholesale price for the charges. But the local big cheese seller is selling theirs for about 10£/kg. Cheddar is sort of a bulk cheese. We use a lot of it.
it's not a "defense". i'm saying your reply is weirdly bombastic and generally incoherent.
Ki API Documentation
Yes I've seen the dreck you produce with LLMs. Not a shining endorsement in my eyes.

https://news.ycombinator.com/item?id=41929174
> The existence of new language features has not forced me to adopt them.

You still need to be aware of them when you encounter unfamiliar syntax.
This. But for me it was moving into management instead of production. I don't really get to CAD/design in my day job, focusing on one of two projects with my mind for weeks on end. Instead I manage others and troubleshoot problems that arise that become impediments for my team. I also live in an apartment, so facotrio/building games are my outlet. Minimal impact on the environment, I get my design and building fix, and I can always stand up and walk away without much clean up.