skysight-inc/HackerNews huggingface dataset:
> Security though obscurity is highly effective.

If you say so.

> Think of some common sense physical analogies: a hidden underground bunker is much less likely to be robbed than a safe full of valuables in your front yard. A bicycle buried deeply in bushes is less likely to be stolen than one locked to a bike rack.

That's not what security through obscurity is. If you want to make an honest comparison - what is more likely to be a secure - an open system built based on the latest/most secure public standards, or a closed system built based on (unknown)? The open system is going to be more secure 99.999% of the time.

> Without obscurity it is straightforward to know exactly what resources will be required to break something- you can look for a flaw that makes it easy and/or calculate exactly what is required for enough brute force.

The whole point of not relying on obscurity is that you design an actually secure system even assuming the attacker has a full understanding of your system. That is how virtually all modern crypto that's actually secure works. Knowing your system is insecure and trying to hide that via obscurity is not security.

> it becomes nearly impossible to even identify that there is something to attack

That's called wishful thinking. You're conflating 'system that nobody knows about or wants to attack' with 'system that someone actually wants to attack and is defending via obscurity of its design'. If you want to make an honest comparison you have to assume the attacker knows about the system and has some motive for attacking it.

> but in most cases I think simple obscurity is more powerful and requires less resources than non obscure strength based security.

Except obscurity doesn't actually give you any security.

> I’ve managed public servers that stayed uncompromised without security updates for a decade or longer using obscurity: an archaic old Unix OS of some type that does not respond to pings or other queries, runs services on non-standard ports, and blocks routes to hosts that even attempt scanning the standard ports will not be compromised.

That's a laughably weak level of security and does approximately ~zero against a capable and motivated attacker. Also, your claim of 'stayed uncompromised' is seemingly based on nothing.
>Figure 13 right panel also shows there isn't a y=x relationship on out-of-sample tests.

A y=x relationship is not necessary for meaningful correlation and the abstract is quite clear on out of sample performance either way.

>Second, in those corners it is not clear to me what the relationship is but it looks flattish (i.e. if the ground truth is ~0 then the model-guess-for-truth could be anywhere from 0 to 0.5).

The upper bound for guess-for-truth is not as important as the frequency. Yes it could guess 0.5 for 0 but how often compared to reasonable numbers? A test set on TriviaQA could well be thousands of questions.

>edit: By the way there are people working on a re-sampling algorithm based on the entropy and variance of the output logits called entropix

I know about entropix. It hinges strongly on the model's representations. If it works, then choosing to call it "knowing" or not is just semantics.
- context of millions of tokens is frontier

- context over training is like someone referencing docs vs vaguely recalling from decayed memory

- context caching
OpenAI adds search to ChatGPT, challenging Google
Corporates will soon have to realise the hard reality that when masses of humans have been replaced there won't be masses of humans with salaries to buy said corporate's goods anymore.
Check this Manning Early Access Program (MEAP) soon to be published book on AI-Powered Search:

https://www.manning.com/books/ai-powered-search
I see: load-aware routing. Why skip the weight update phase on low weight reports? Isn’t that precisely the period when those nodes are likely overloaded?
Ask HN: How to stop text spam during election season?
I kept blocking and reporting individual text messages on my phone and I grew tired so I got annoyed. As I have learned this particular cycle, there are apps out there basically allowing people to reach out to people like me via that app but using their phone. Yay.

Is there a systemic way to stop this nonsense? At this point, I even tried reporting suspected offending apps on both Google and Apple market, but there is no 'spam' option.

I am relatively certain it is a bipartisan issue. I just don't want to be bothered.

Incidentally, is there a way to remove yourself from the voter rolls? I am not trolling. At this point, I am just desperate for a solution. Today it is election, but tomorrow it is regular 'I want to sell you Z'.

Contact list whitelist app?
The bank tellers didn't go away: they just became higher paid and higher skilled when cash management was no longer the job.
The anecdata of this thread alone might be enough to re-categorize wood spoons as dishwasher safe.
the magic of nixos-anywhere is that you can start with a common OS base image and overwrite it with nixos.

you can also run nix as a service on other operating systems. https://lix.systems/install/#on-any-other-linuxmacos-system
People might not buy a game if they don't think they'll get a fair play experience.
There are tons of apartments for less than 250k in nyc right now, just gotta accept the bronx or maybe far out queens.
https://www.zillow.com/new-york-ny/?searchQueryState=%7B%22p...
Hanging Punctuation in Pandoc
The market would be even more shocked to learn that another 30% is pasted in from Stack Overflow!
I hate negotiation with a passion. However, IME, just being semi transparent about your max offer lets anyone else come back with new numbers without having to ask for a specific number.

Another is to ask for additional benefits in monetary value. IE if one company that provides parking/commuter/better health coverage benefits, ask for an additional $X per year to the companies that don't.

That also make it like you're trying to equalize total comp instead of asking for an arbitrary higher number.
KLA isn't about preventing cheaters. It's about protecting the artificial scarcity of products for sale via microtransaction.
Realistically if you make a game hack where it behaves exactly as well as a high skilled player, no one should care. The lobby experience is the same as if you got a really good player in there. When people moan about hackers its when they are blatant. Dominating the entire server and obviously hacking when you spectate them. If you take away all this low hanging fruit who cares about the people who are cheating within statistical variance of player skill?
> What's the point of this comment?

To encourage people to use Emacs (or vi).

> Should we have frozen tech in 1998 with our 28.8kbps modems

We had Ethernet and high-speed networks in 1998. The rest of the world has just caught up, that’s all.

> Why did you switch to this emacs fad when you could have stuck with ed(1)?

Emacs is an improvement over and above vi & ed. No other current editor is an improvement over and above Emacs. The only improvement Emacs is lacking is Common Lisp extensibility.

> I think it's great that people are advancing the state of the art.

But they’re not — they’re reimplementing the decades-old art. Why waste time using worse technologies to extend worse editors when one can invest one’s time using better technology to extend a better editor?
A game that is overrun by cheaters makes it less fun to regular players. If regular players don’t want to play your game, it ends up being a hacker circle jerk before the servers stop getting consistent players at which point the game is dead. And a dead game is not interesting to potential buyers which affects the publishers revenue stream.
This suggests a question: how does the Voyager handle authenticating commands? Whatever crypto they had in 1977 is surely completely broken now. Security by obscurity? Or can anyone with a large enough antenna send commands to it?
Sounds like the POS software isn't controlling the reader well, maybe because it wasn't adjusted for this model of reader. Or the reader's firmware could have been misconfigured, from what it's supposed to be for that POS setup.

The modern reader firmware tend to have multiple modes and many options. Some modes are as simple as "scan whatever you see out of the many formats you support, and spit out the decoded value of something as USB Serial". Or, worse, "...as USB Keyboard".

You can imagine how easy those modes are to integrate with POS software, without implementing the proprietary protocol for that device, and you can also imagine how poorly that can work out.

If you owned a store with a POS setup with flaky reader behavior like this, and were stuck with it, you could try reconfiguring the reader (to, say, disable QR support). This reprogramming can sometimes be done via documented protocol, via sketchy Windows software, or via... barcode... Careful you don't make it worse.

(Our startup used modern readers (multiple 1D formats, QR, NFC) for a factory station, and had to do a lot of experimenting with different brands and models, to get the behavior and speed we needed. We even managed to brick a reader, just with configuration changes, not flashing firmware.)
I recently learned how to cook non-stick with my stainless steel pan [1]. Needless to say it's a bit more involved, but I felt more accomplished when I figured out how to cook with it.

Pros: SS can go right in the dishwasher, it's safe & you can use metal spatula, no worry about loss of efficacy over the years.

Cons: It takes a minute more to prep, harder to clean (sides/edges aren't non-stick)

Personally, between this option and carbon-steel pre-seasoned, I see no reason to own Teflon pans.

[1] https://www.youtube.com/watch?v=EAtNfS7KeE0
ChatGPT Search
I understand my comment was made in anger, but where is the ideological battle?

I am trying to ask people to discuss non-tech-related politics elsewhere, as per guidelines. How else am I supposed to do that? Flagging doesn't work, politically inclined people just unflag it.

The parent post is the definition of off-topic; if you won't delete it, maybe you need a new guideline, where in garbage posts like this garbage comments like mine are allowed then? :D I think a good approach would be if posts like this were allowed to accumulate comments and then deleted completely, destroying all the dubious "contribution" and thus disincentivising it?

I do hate both ideologies fwiw; as applied to HN however, only one tends to create and promote off-topic political posts like this, or at least I never see the other kind of garbage in the RSS feed.
Sadly true. It's about jobs and donors, not about battlefield effectiveness.
> BenchmarksGame offers a much better close-up comparison by having much simpler submissions that mostly consist of code that you could totally see yourself write in a regular setting

Yeah, except if you are working on Web servers the quality of the framework and its supporting libraries is much more important than what code could theoretically achieve. What is the point of being able to 200 mph when you only ever drive up to 30mph.

> Neither gives you the required low-level access, performance oriented APIs, ability to use zero-cost abstractions.

Java is working on high performance abstractions, see Vector API (Simd) and project Valhalla (custom primitive types).

Sure C# has a theoretical leg up (for which it paid dearly by causing backwards incompatibility with reified generics) but most of the libraries don't use low-level access or SIMD optimizations or what not.
The entire time the remote viewing program was funded, the United States was actually remotely viewing their enemies and any location of interest they wanted, from space, with photos [1]. This was only recently declassified.

Funding the remote viewing program allowed the United States to bait other nation-states into funding their own paychic bullshit units, while being able to be completely misunderstood if anyone ever compromised their communications and heard them talking about "remote viewing." It also allowed for parallel construction, as another commentor in this thread mentioned.

[1] https://en.wikipedia.org/wiki/KH-9_Hexagon
Really? Most gaming communities seem to hate kla as it breaks their steam deck compatibility or linux compatibility.
This is Q for Democrats.

Except it is just hysteria.
I would have thought that llama3.2:latest would run OK with 8G. Same for phi3.5:latest
This is overselling the variety a lot. Hot and cold drinks including a couple of types of soup (sold only in winter) are everywhere. Cigarette vending machines are pretty common (usually located in front a tobacco shop). Ice cream and small snack vending machines often exist on a train platform but they are not common on the street.

Occasionally, a shop sells its sausage or something in a vending machine out in front. Sometimes, usually in a small town, you will see one that dispenses hot food like fries or takoyaki. School or work cafeterias often have a cup noodle vending machine for after-hours food but it's usually located inside. My guess for order of magnitude: if you train/walk around Tokyo for a week on vacation, you might see 5,000 drink vending machines, 100 cigarette vending machines, 10 ice cream vending machines, 5 snack vending machines and 3 total of any other type of food and maybe one selling something weird.
So, the JavaScript audio/video APIs already available in the browser are fully competent to build any kind of media player. The major limitation is that media players reliant on the browser APIs are limited to the codecs and containers supported by the browsers, which turns out to be a huge limitation.

A media library written for WASM with supplied codecs would not have that limitation, such that you could have an equivalent to VLC directly in a browser supporting immediate playback of any video/audio codec/container supplied in the WASM payload. The major advantage of a browser based application versus a desktop app is immediate playback of media via hyperlink without the soul crushing limitations Apple imposes on iOS.
After careful research, it turns out this conspiracy was actually started as a sales promotion by Spatula City! I have just as much evidence of this as most other theories
Show HN: Burgher – a static site generator focused on galleries
Hi this is another static site generator. Its different to other generators because the main focus is on generating gallery websites from existing folder structure. I found that most existing solutions did not handle nested galleries. I use it to generate my gallery website where I have 44GB of photos. Its still a bit rough around the edges.
I dont think we agree on enough fundamental facts about the world to have a productive conversation. It seems like you are in denial about the possibility that some workers can be detrimental to bottom line profit and efficiency.

By the way, the charity comment wasnt about volunteers. Companies are not run as a non-profit charity with workers as the beneficiaries.
Common Lisp is an amalgamation of every lisp they could find, they slammed it all in. Calling it well designed is funny because every single CL developer openly accepts that its a fucking weird language with hell lot of warts that cannot be polished away.

Ada is fine, just verbose, kinda fun, no comments about it except that its kinda sad how weak their formal verification is. I prefer Frama-C over it. You can compare Ada and rust but ada is horrible, sincerely horrible at working with ownership. Frama-C can run laps around it as you can verify EVEN arbitrary pointer arithmetic.

Calling rust a horrible abomination is weird. As someone who dabbled in CL for an year, I love the fact that it has proc macros and even tho its harder to use it, i can make my own DSLs and make buildtime compilers!!

That opens up a world of possibilities.We can actually have safer and stricter math libraries! Maybe put us back in era of non-electron applications?

The horrible part might be syntax but eh, its a stupid thing to care about.
I was pretty good at CS:S, semi-professional level. I nevertheless still enjoyed hanging out on public servers with friends. I cannot tell you how often I have just been banned.

Another example: I was an anti-cheat admin in a major league about 20 years ago. I am quite confident a lower double digit percentage of banned players were innocent - it was simply too hard to get enough competent people for doing manual checks (you'd have to be really good at the game yourself to confidently tell what might be intuition and what cant while evaluating pro players with money-prizes on the line).

So while I appreciate that sentiment, and maybe you found THE one community where all that really worked out for you, but it was by no means the "best alternative" from where I am standing.
> where secrecy and marketing hype is used to attempt to conceal the flaws.

That's literally the practical basis of security through obscurity.

> Others, like my comment above, are talking about systems carefully engineered to have no predictable or identifiable attack surfaces- things like OpenBSDs memory allocation randomization,

That's exactly the opposite of 'security through obscurity' - you're literally talking about a completely open security mitigation.

> I’ve found when it is impossible for an external bad actor to even tell what OS and services my server is running- or in some cases to even positively confirm that it really exists- they can’t really even begin to form a plan to compromise it.

If one of your mitigations is 'make the server inaccessible via public internet', for example - that is not security through obscurity - it's a mitigation which can be publicly disclosed and remain effective for the attack vectors it protects against. I don't think you quite understand what 'security through obscurity[0]' means. 'Security through obscurity' in this case would be you running a closed third-party firewall on this sever (or some other closed software, like macos for example) which has 100 different backdoors in it - the exact oppposite of actual security.

[0] https://en.wikipedia.org/wiki/Security_through_obscurity
Mad Gasser of Mattoon
I cook on cast iron multiple times a week. Have for years, using a very antique pan from a dead relative. My rules are fairly straightforward. I don't do any other maintenance or cleaning than this after-care routine:

* Let the pan cool (if I'm lazy or it's late, possibly this is overnight and then I do the rest in the morning).

* Scrape out any easy solid waste (burnt food bits, etc) with a wood spatula edge and throw the waste in the trash.

* Toss a healthy amount of salt into the pan and scrub the pan using the salt, with your hands/fingers. The salt is a great abrasive, like sand, but I don't want sand ground into my cookware, while salt is fine for food.

* Rinse out the dirty-salt-mess with plain water from the sink.

* Occasionally, if stuck-on things are particularly stubborn, repeat some of the above steps as necessary until the pan surface is smooth and clean.

* Wipe off most of the remaining wetness with a paper towel (the towel will probably look pretty dirty, that's ok).

* Throw the pan back on the cooktop, pour a few tbsp of cheap olive oil in the middle, and turn the burner on as high as it goes. Wait a few minutes for the oil to thin, spread, and smoke. Once it's smoking pretty well, shut off the fire and leave the pan to cool again.

* Later when it's cooled off again (possibly overnight or hours later, whatever), gently wipe off any excess liquid oil with a paper towel and store the pan back in the cabinet, ready for next use.
At the very least, there’s about a 100% chance of microplastics getting into your food when using these things under heat. You can argue about the risks all day, but I imagine most people would want to avoid this bioaccumulation if possible.
It's an educational concept. Not something you'd use in a sentence like that.

I think you're being a pendent.
Don't many editors have the feature of allowing remote editing through ssh?

There was discussion here a few days ago for example of an Acme clone named Anvil, which has the feature, as does Acme.

VSCode has it.

Also, TRAMP is a poor (unreliable, fragile) implementation of the feature. Or at least it was the last time I used it regularly about 10 years ago.

Finally, if you have to resort to quoting a slogan then it is probably better not to comment at all.
I think one of the worst repercussions of the DMCA (there are so many), is how it seems to have perversely motivated tech companies to implement their own even worse bespoke processes for handling complaints--processes that are not actually DMCA. Like, DMCA is awful, but the process YouTube and others put you through is even worse, less transparent, and tend to put more, rather than less burden on the target/victim.
Worth pointing out that this is also true of the Le Creuset "cast iron" skillets and frying pans with the black cooking surface. That surface is (annoyingly) enamelled too.
The ostrich method is avoiding existing evidencea available online and searchable for full stack llm programming
You hear this sometimes from cast iron owners that think using some soap will "ruin" the seasoning. It's a myth, you can absolutely use soap. My preferred method is chainmail + coarse salt + small drop of dawn.
A weak acid (tomato paste, dilute vinegar, ...) will help with burned-on stuff, but the real trick is just good, hard scrubbing with an abrasive (steel wool or similar).
How to Fix X11 Forwarding on WSL
I think the comment just meant using generic constraints with structs.

e.g.

interface Foo {
int Calculate();
}

static void CalculateThing<T>(T impl)
where T: Foo {
var num = impl.Calculate() * 2;
Console.WriteLine(num);
}

Here if you pass a struct that implements 'Foo', 'CalculateThing' will be monomorphized and the dispatch will be zero-cost, same as in Rust.

You can apply additional constraints like `where T: struct` or `allows ref struct`. The last one is a new addition which acts like a lifetime restriction that says that you are not allowed to box T because it may be a ref struct. Ref structs are for all intents and purposes regular structs that can hold so-called "managed references" aka byrefs, which have syntax 'ref T', which is discussed in detail by the article this submission links to (ref structs can also hold other ref structs, you are not limited in nesting, but you are limited in cyclicality).
It's not tools. It's intelligent agents capable of human output.
I feel like it's almost criminal of textbook writers not to mention this when introducing the characteristic function... At least as an aside or a footnote, for readers already familiar with Fourier transforms.
I put my wood cooking spoons in the dishwasher. They're the cheap kind and now they're quite bleached but they still work.
Yes, the bottom has enamel but inside the pan is cast iron. I prefer this TBH, make it easier to clean when spills happen.
Robinhood != Robin Hood != Robbin' The Hood
It costs as much as shipping just one container. Just because you can distribute the emissions over more people doesn’t make it less bad for the environment. Not ordering something from overseas is the only solution.
Perplexity founder Aravind Srinivas is still waiting for his green card
This is mostly poorly written gushing about a specific laptop, repeating a lot of Qualcomm's claims and specs without testing, criticism of x86 laptops that is mostly hyperbole (semi-true but not to the extent claimed here) and then noting that Windows still kind of sucks.

A more important question is whether MS will truly commit here, or just half-ass this again.