skysight-inc/HackerNews huggingface dataset:
Yes, and you've just demonstrated the problem here. People believe RSA is secure if you just use 2048 bit keys, but the problem with RSA is the key themselves... And the padding scheme.

For starters, let's look at the keys. You need to select a safe public exponent and safe private parameters. If you generate the key with openssl without mucking around with the parameters, you're likely to get a pretty strong key, but nobody guarantees the key is safely generated.

To constant, in Ed25519 (or Curve25519) your key is just a random 256-bit string (32 bytes) with a a couple of bits being ignored. All keys are secure and you cannot generate or use an insecure key.

Cryptosystem Rule #1: A good cryptosystem does not let yet generate insecure keys.

Then you've got side-channel attacks. RSA is far more vulnerable to timing and cache side-channel attacks, due to its complex BigInteger math that usually relies on code that was designed for solving math problems, not for cryptographic operations. The Big Integer math also makes implementing RSA harder, and therefore RSA implementations are more likely to have bugs.

Ed25519 is a good counterexample yet again. djb has famously implemented it in just a few 280-character tweets in TweetNacl[1]. The entire library contains Ed25519, Curve25519, Salsa20, Poly1305, SHA-512 and HMAC in 100 tweets or 800 lines of C code.

Yes, there are many toy RSA implementations out there that are even shorter than that, but they either only use regular integers (limiting your RSA keys to puny 64 bits at best) or using third-party non-cryptographic Big Integer Math libraries, which brings us back to square one.

Cryptosystem Rule #2: A good cryptosystem is designed to avoid cache and timing attacks.

Cryptosystem Rule #3: A good cryptosystem is designed to be simple to implement

The last issue is the padding. Almost all RSA implementations out there use PKCS#1 v1.5 padding, which has been known to be insecure for decades now. It is vulnerable to a padding oracle attack known as Bleichenbacher's Attack [2]. It's easier to exploit PKCS#1 v1.5 with RSA encryption than with RSA signatures, but it can also be exploited with signatures[3].

Ed25519 does not need any kind of padding. The signed data is always pre-hashed with the same hash which is defined by the algorithm (SHA-512).

Cryptosystem Rule #4: If possible at all, do not require padding (e.g. use pre-hashed signaturesand stream cipher construction).

If you don't trust me on this, you should still follow Latacora's Cryptographic Right Answers:

Ed25519, the NaCl/libsodium default, is by far the most popular public key signature scheme outside of Bitcoin.
It’s misuse-resistant and carefully designed in other ways as well.
You shouldn’t freelance this either; get it from NaCl.

Avoid: RSA-PKCS1v15, RSA, ECDSA, DSA; really, especially avoid conventional DSA and ECDSA.

You can look at this blog for more information:

https://blog.trailofbits.com/2019/07/08/fuck-rsa/

---

[1] https://tweetnacl.cr.yp.to/

[2] https://en.wikipedia.org/wiki/Padding_oracle_attack#Asymmetr...

[3] https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBV...
Benefits of anonymity: “ I have derived a lot of benefit from people not being able to mail heroin to my home and call the police to SWAT me”

Downsides of anonymity: no free heroin
You should see Windows 10 or 11. The best hammer out there.
As I can't try anything without creating an account, I will just have to wait and see what others have to say about this.
I made an eink rpi display for staying in touch with my parents, inspired by the poetry clock (https://www.theverge.com/23669343/ai-clock-chatgpt-poems-rhy...).

My dad didn't like poetry clock, but he does like image gen. So we got a (color) Inky Impression 7.3 and hooked it up to an RPi.

I made a basic telegram bot that you could send a verbal prompt to ("snowy day"). It would then ask which of your favorite artist styles it should create an image in. I found that presenting a list of two styles combined had cooler results. The prompt would be used to fetch a random quote on the topic, and quote and style would then be feed to stable diffusion, and maybe 30 seconds later you have fresh art and a quote on the display.

My dad then asked if we just could forward images directly there. He prefers, each day, to post an image of whatever the day is (November 13 is "World Kindness Day") and occasionally share a family photo. My mom looks forward to seeing what day he picks every day.
Was there anything controversial in that dossier? The Guardian claims it was blocked for leaking JD Vance social security number
Shouldn't it use much less compute than an LLM? Or is that not a significant percentage of the total cost?
Agreed that C++ FFI is not niche, although it's also not really a core feature (C FFI suffixes for that).

Safe FFI with lifetime support is definitely lower priority though, given that FFI is usually in a thin layer of application code that can sort out safety itself.
What a beautiful use of technology to uphold someone's personhood, and let them know they are loved, despite (and with regard to) a profound injury.

This reminds me of a desire I've had for a long time: a simple, wall-mountable eInk device that could be configured with a URL (+wifi creds) and render a markdown file, refreshing once every hour or so. It would be so useful for so many applications – I'm a parish priest and so I could use it to let people know what events are on, if a service is cancelled, the current prayer list, ... the applications would be endless. I'd definitely pay a couple of hundred dollars per device for a solid version of such a thing, if it could be mounted and then recharged every month or two.
I find any conversation these days involving Wolfram or Yudkowsky hard to listen to. Them trying to talk to each other... I'd imagine them talking completely past each other, and am happy not to have to verify that.
The SR can't route for your gateway or else Tailscale itself would break it's own connection. A gateway IP isn't treated the same as a subnet route.
If you like videos, there are some excellent ones by Richard Borcherds, in very different style to 3b1b but by a Field's medalist

This is his algebraic geometry playlist. The whole course is directed at graduate level but the first few videos are very accessible
https://www.youtube.com/playlist?list=PL8yHsr3EFj53j51FG6wCb...
Open Source and Mental Health (2021)
That's... actually pretty brilliant.

I wonder if it'll Just Work [eventually, given enough repetitions], or if the crowd-sourced network location algorithms will filter it because it is dynamic.
Yes, it's not difficult to get out of. You could also get out by saying that you don't trust the police, or any number of things that might affect your ability to be impartial in the case before you.
Yeah can’t say I’m a fan of the node eco system in general but obvious unavoidable sometimes
> You’re just playing pedantic games.

I see you've been cultured by typescript and js.

> I said roughly equivalent which means isomorphic.

"roughly equivalent" isn't the definition of isomorphic, and I hinted which properties a type system and the runtime have to support for that isomorphism to be manifested in a language implementation, which isn't there for all of the mainstream languages, unless you're willing to provide that conversion by hand.

> when I am the one dictating the point here. I made the first statement and you responded to it and you started out your previous response by trying to turn the conversation to your point.

You're simply wrong, that happens.

> In the very beginning I said functional core imperative shell. That’s the point.

That terminology only exists as a coping mechanism for those on the mainstream languages. In Haskell everything is functional composition, and `IO a` is neither exempt from it, nor is made into a special case. When you realise this I'll congratulate you on becoming less ignorant.
This is such a wonderful story, and I'm so happy that the author found something which worked well for their mom.

> Despite her amnesia, my mom came to remember that this display exits and what it’s for. She looks forward to seeing updates from her children on it.

This is the most interesting part for me here. Brains are such wondrous things. Would be cool to know if this is a special quirk of her mom or this is something which can help others like her too.
Completely agree. Having worked previously for ... (humans?) ... I can authoritatively theorize it would be fixed in a jiffy if it weren't making them bucketloads of money.

To make my case: just ponder the opposite: "What would an honest version of AWS do?". They would address the concerns publicly, document their progress towards fixing the issue, and even try to determine who was overcharged due to their faulty code, and offer them some compensation.

"We're too big to fix our own code" is, sadly, taken from the MS playbook (IIRC, something like that was made public after the breach of MS manager mailboxes after the whole Azure breach fiasco that was discovered by, IIRC, the DOJ that paid to have access to logs).
It's always better to stick to the LTS versions. Well, unless someone
really needs bleeding edge features, but most people don't.

Current LTS is Java 21, it's supported until 2028 -- a much longer
timeline than Java 24.
I guess Go is quite fine for his use cases, but I suppose if suddenly he had to delve into more frontend-focused apps or AI development, he would be forced to use Javascript and Python.
I actually worked with one guy who coded java in vim (on windows).
So you are saying this is specifically limited to SwiftUI? This fact does not make it any less absurd, especially with the last part that has been said.

My question stands: why does this happen and how come it is still so primitive that you do not even get to know the location of the issue?
The tradeoff would be speed and implementation simplicity against the high cost of SRAM, like you highlighted :)

(Re your 386 RAM board: Nice necroproject!)
This is THE track from UT99

https://m.youtube.com/watch?v=i_0G6WPuss4
DeepL is such a poster child for German sw startups.

They truly had something unique when they started - but instead of polishing the product with enough VC runway to either find an exit or grow into a real consumer driven utility like Grammarly - they tried their hand at a B2B play.

From then on, their software integration sucked (browser plugins, etc.), their file translation sucked, and their “sass” shenanigans reached adobe levels.

Why can’t Germans do software?
That's why I like to use Ruby on Rails.
I wonder if space vacuum would work similarly to welding techniques that require inert gas
Not saying that there's a lot of games where the publisher/dev made this choice, just responding to OP saying its not possible with steam. Unfortunately the store doesn't show drm free games either.
Temu is like the most downloaded app on Google play, fair to say most users aren't buying electronic components. They're buying clothes, cutlery and cookware.
Fair enough, TFA does claim some fans want to take down the edited version.

Helping the author's case is the ambiguous wording of the title of the change.org petition, to wit:

> "Remove ghosting and dimming from Jujutsu Kaisen Season 2 on Crunchyroll"

While "remove" could be read either way (i.e. either "make another edit also available" vs "replace the version that exists now"), I think the author's interpretation, coming from an experience of being actually disabled, is a reasonable take. I don't see bad faith like you do.

PS: going by the comments on change.org, only one seems to be openly asking for both versions to be made available, while most of the others seem to match the accusation of the author: "but I'm not epileptic!" (in so many words). Spot on.
Chips and Cheese's Microbenchmark Framework
I've run it against my nightscout data a few times to get insights to my profile. So yes, you should install it somewhere and run a CGM app such as xdrip which can transfer your libre2 data to your nightscout database.

So yes, if you are interested on autotune, a nightscout is required for now.
For regular Swift developers who make iOS apps, yes it's niche.

C++ interop is probably more important for Apple itself.

Swift compiler speed and error reporting are abysmal and improving them would have a much bigger impact. So far it's not getting any better at all.

If I could give up some level of type inferrence and get the build time from 3 minutes to 20 seconds, I would.
Then you go beyond that. Now what?
> I am just amazed that people are able to navigate the services and configure them properly.

Most people are forced to use AWS because CTO at their company was pushing a "wE mUsT shIp tO cLoUd" initiative. It's not out of choice, but out of survival.
Yeah. See https://news.ycombinator.com/item?id=42131043
I brought a pot.. metal, made for this.. I thought that was a given. It would easily last forty-fifty years (re the original article). Not that I would need the pot all the time, fish I would grill in various ways, e.g. on a stick on a fire, or just leaving them on a flat rock close to the fire. The pot was for soup of some kind which I didn't eat very often.
As I don't drink coffee when I'm on a mountain hike I wouldn't bring a coffee pot. A knife is a must, if I didn't already mention that. The main point is that I wouldn't need a rifle, a lighter, or a GPS. I wouldn't even have thought of it. Not that there was much GPS around when I was a teenager. A paper map though, that's useful sometimes.
We considered this, but thus far I’ve only had someone ask me if I’m a Burning Man participant after seeing the logo.
I don't think this is true: the older the tech, the less hype it has and thus the less blog posts/example repos/etc will be available. In particular, a boring language without a strong open source culture (COBOL, say, or Oracle SQL) will probably not have a lot of training data available despite being very much in use.
Does this result in a regular model that say llama-cpp can run? Is there any way to test these ourselves?
Are you sure? Your link also lands me at an auth required splash page.
The Chagos Archipelago and the .io domain
Now multiply the logic required by multiple cost factors across hundreds of services.
It's open-source and can be run locally
Astrocytic determinant of the fate of long-term memory
A big part is that you are not working for man but yourself.
> Unemployment weakens governments. Inflation kills them. That’s what a government official from Brazil once told me. But in rich countries, including the United States, the politically destructive power of inflation had been forgotten. Standard policy tools left us unprepared, and the Biden administration was slow to fight back.

D'oh, yes. (Though hardly the only lesson.)

Ya' know - Biden was around back in the late 1970's - he shoulda been able to remember how much high inflation helped Presidents Ford and Carter to get re-elected. Right? <cough/>

Cripes, Biden was already in his late 20's by 1971 - when President Nixon's heavy-handed war against inflation (nation-wide price freezes by Executive Order, among other things) made his position on inflation quite clear. A year or so later, Pres. Nixon was re-elected - winning over sixty percent of the popular vote. Gosh, what a terrible thing to happen...

Or - maybe Ol' Joe has long since lost those memory marbles?

Or maybe Pres. Biden was just being a proper member of the modern Democratic Party - where doing anything more than pretending to care about the little people, a little bit, for just for a month or few before each election, would have marked him as some sorta weirdo creepy loser, who was "obviously not one of us Democrats"?

Still, you'd think that any bright young Democratic advisor who'd taken a good history course or few coulda warned them. Oops!, wait. History is one of those "non-STEM" subjects - that colleges are busy phasing out - isn't it?

/rant
If OpenAI wrappers can flourish I'm sure DeepL can too. My guess is that they will have sales team that will reach out to customers and provide them with solutions to their specific needs and use cases.

You know how ChatGPT was supposed to be able to act like a translator in voice mode, they even had an amazing demo at the keynote? I tried to demonstrate it to my father who was supposed to speak in Bulgarian and I in Turkish and see how cool the feature looks like. It didn't work remotely as advertised, it instantly screwed up and we both knew it because we both speak these languages and proving that its not to be trusted. The tech behind it is amazing but the UX still needs to be crafted to be valuable for more than tech demos, so if DeepL has the tech and know the market they will be in much more advantageous position than OpenAI(has the tech, doesn't know the market) and others who might know the market but use OpenAI(their margins will be thinner if OpenAI can't reduce costs dramatically more than DeepL).
RIP Open Core – Long Live Open Source
Chat about Salaries? NY vs SF
Looking to speak to software/data devs to understand the differential between NY and SF.

If you are open to talking would love to jump on a call!
Buy HOMM3 then you can use the content with VCMI and have an overall better experience in my opinion.
It's very funny that the very first thing anybody knows about the department of efficiency is that it has two bosses.
https://danielchasehooper.com/posts/why-swift-is-slow/
this is literally amazon temu

also

> Amazon screens the products sellers offer in Haul so customers can be confident they’ll receive products that are safe, authentic, and compliant with applicable regulations.

How is it possible for amazon to actually screen these products ?
As with all things, you are trading away old problems for new ones. The question becomes: are the new problems easier for you to solve than the old ones?

There are parts of AWS that feel like magic and parts that cause me to bang my head against the wall, overall I like it more than it annoys me so I use AWS but it’s not a silver bullet and not all workloads make sense on AWS.
I'm not sure I follow what you're saying. People who work at Google should pay more/less tax? Or that people who start companies should get more tax breaks (or pay more?)

I'm European so I don't really click with the obsession some places have with avoiding tax, so you may have to explain it like I'm 5 :-)
> Look at SQLite. SQLite is notable example where they don’t even have CoC(!) and focus only on getting engineering done. No marketing, events, sponsorships.

They kind of do have a CoC, called Code of Ethics.

https://sqlite.org/codeofethics.html

But it's probably not what "tolerant" people are looking for. And it's
fine.

Also, SQLite is open-source, but not open to contribution, so they can
"get away with it". Although I completely support their model of doing
development.
at certain levels in the corporate ladder, it's all about who or whom you glaze to get to that next level.

actual hard skills are irrelevant
Google Releases Standalone Gemini AI App for iPhone
Mail is better at moving messages from folder to another, by typing names, but I absolutely can't stand the way it handles attachments, and for this alone I won't touch it with a ten foot pole
Codeproject.com Is Closing
Of all things, python went with async instead of gevent!
In the last Stack Overflow survey[1] I was surprised to see quite a large percentage of respondents considered vim to be an "IDE". Don't get me wrong, I love vim and nvim, but I use them as editors and not as a fully fledged IDEs.

[1] https://survey.stackoverflow.co/2024/technology#1-integrated...
Show HN: The Billy Bass I put on the Internet
This one is just for fun.

A couple years back I put together this tool to help me make synced up open/close mouth animations. End goal was always to "put it on the internet" like so many other things I remember when I was a bit younger. You can't drop this into a livestream these days without getting banned because people can't play nice, so I made it to record and distribute videos privately.

I only code like this as a hobby, so it is a bit rough (I am a hardware guy), but these days you can get pretty far without knowing a lot.
Enjoy
Thank you!

let result: Double = -(1 + 1) + -(1 + 1) - 1

> Swift 6 takes 6.2 seconds to compile this one line. Even toy languages compile equivalent expressions faster.

Wild. :P
Use OpenAI API to reply to emails?
Is there a gmail add-on or chrome extension that I can use to draft email replies directly in gmail, using my OpenAI api key? Something that allows to easy change of API would be welcome, but for now I am happy with the OpenAI one.
24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config.

See here: https://news.ycombinator.com/item?id=42133181
Looking at the project issues, it seems it supports only 1989-era C, and some Apple stuff, before you even get to attributes.
That doesn't really contradict my point. Create separate accounts as soon as you open a business, not as as soon as you create a new directory under ~/projects/.
It works quite well in practice. The unapproved notes are a bit all over the place in terms of bias and or being wrong but the ones that get enough votes to be shown are mostly fairly factually correct.
The difference is I trust this website, and wouldn't trust an LLM.
Your other comments just confirms to me that you seem to have more problems with Israel than with the plight of Palestinians. This is a line of thinking that only increases the conflict.

Your outlook isn't realistic. That the UN has many resolutions against Israel is a danger to the credibility of the UN, not to Israel in the context how international law is enforced. The UN resolutions against Israel are political opportunism that undermines institutions like the UN and in some cases is the usual international political calculus. It is often against the US hegemony instead of against Israel.

We disagree about what the future will likely look like. I think your position is part to the problem Palestinians do face and they may have to stay in a limbo for a longer time.

Something could be done against the radicalization of young people in Gaza. Something more than confirming their beliefs with conspiracies about Israel.

In most cases where people have problems with Jews there is an underlying problem with some form of inferiority complex. Be that as it may, it is of no relevance to me.

Here is what I believe to happen if nobody has some productive new perspectives. Gaza will be occupied again until maybe Israel decides to withdraw at some point. Israeli will live their "normal" lives, while Palestinians have to content themselves with Islamic Fundamentalism. But there is little political capital for another withdrawal in the foreseeable future. Other surrounding countries will normalize relation or already have done so because as the Saudi Prince just demonstrated, some words are enough for some groups placate their aggression against Israel.

Some rhetoric of international help organizations directed against Israel in a sharp manner, because they too see little hope in any improvements in the middle east because the current situation is even more dire for them than before. But ultimately Israel can only do so much to help here, because the real genocidal intend lies with the radical political representation of Palestinians.

I don't see where you believe the improvements for their situation would manifest and I believe even Iran will be more careful to undermine Israel. Their political battles will be elsewhere and Palestinians were also just a tool for them. Just don't be disappointed later.
Istio is a notorious pain to maintain, because it has a bunch of dependencies around Kube clusters, so you can't just helm install istio every time there's a new release.