skysight-inc/HackerNews huggingface dataset:
Interesting - I'm kinda counting on PDF.js, which is used for PDF rendering, on doing it safely, but of course that doesn't always have to be the case. Do you have any thoughts on how to make this safer?
This is true but he is also in bed with tech oligarchs now so he will be interesting to see how he balances this and who's demands he caves to.
Statistics for the current day are recorded for yesterday (GMT +4)
And imagine how Facebook got lucky with their .onion address
> people who use type hinting are just letting me know they have written code that doesn’t check in line.

Yes, that's the point. We use typing so the type checker can find the mistakes for us instead of adding `isinstance` everywhere.
I'm surprised how much these X230s are still being used. People who love real keyboards love them.

Personally I didn't think Lenovo's later keyboards were too bad. The one on my T490s was wonderful. However since my work moved to the T14s series, the keyboards have become terrible. The key movement range is too low now, and the feel is crap. It's too bad because Lenovo was the last holdout which still had decent keyboards. The T14s is also bad in other ways, the body got thinner but the screen got a lot thicker and heavier so it's actually worse to carry than the T490s.

Anyway, ontopic: I'm not surprised these cam controller firmwares can be hacked. It's very specific to the controller though.

However, most people I know that care about privacy close the cam door anyway, or put a sticker over it. I use the SpyFy. https://spy-fy.com/collections/webcam-covers . Good luck hacking that.

What worries me a lot more is the microphone. It doesn't have a light, and it's really hard to block. A simple sticker won't do much. These things are super sensitive. I can literally hear myself talking in the other room with the right boost settings.
It’d be technically possible to do it, sure. I meant that in comparison to the linked project, where you can view the file paths of the git repo (but not the file contents) on any off-the-shelf git forge. With mine, its not possible to use an existing web UI.
I have volunteered for a number of organizations dedicated to attaining permanent housing and stable conditions in the community. What tends to surprise a lot of folks is how utterly “normal” most of the unhoused population are, how quickly their situations became so precarious, and how hard every one of them were working to improve their lives.

America seems to anchor its society around a number of “myths” that help to rationalize our ongoing complicity in things I think are non-controversially evil (to be fair, this tendency certainly isn’t unique to America). They run the gamut, from the first Thanksgiving (topical!), to the bootstrap-pulling self-made success story, to Islamic terrorists who hate America for its freedom. I know a lot of that is really reductive, but I still believe these “myths” work to define our cultural identity in ways that aren’t always negative, but tend to leave little room for nuance or appropriate consideration of other perspectives.
Can you explain what your issue is with Kafka? What makes it not reliable enough?
Statistics for the current day are recorded for yesterday (GMT+4)
Luxury apartments do reduce the housing shortage. Cashed up boomers can move out of the nice family home they've been living in since the kids left and upgrade/downsize.

Building the high end and having people move up helps with the high cost of construction also.
Nvidia still sells GPUs to China, they made special SKUs specifically to slip under the spec limits imposed by the sanctions:

https://www.tomshardware.com/news/nvidia-reportedly-creating...

Those cards ship with 24GB of VRAM but supposedly there's companies doing PCB rework to upgrade them to 48GB:

https://videocardz.com/newz/nvidia-geforce-rtx-4090d-with-48...

Assuming the regular SKUs aren't making it into China anyway through back channels...
Are any alternative APIs (non Spotify) available for the functionality being deprecated in this notice?
That was pretty boring too! The "script" was just a few hundred lines of C# code triggering Selenium via its SDK. The requirement was simply to load a set of URLs with two different browsers, an "old" one and a "new" one that included a (potentially) breaking change to cookie handling that the customer needed to check for across all sites. I didn't need to fully crawl the sites, I just had to load the main page of each distinct "web app" twice, but I had process JavaScript and handle cookies.

I did this in two phases:

Phase #1 was to collect "top-level" URLs, which I did via Certificate Transparency (CT). There's online databases that can return all valid certs for domains with a given suffix. I used about a dozen known suffixes for the state government, which resulted in about 11K hits from the CT database. I dumped these into a SQL table as the starting point. I also added in distinct domains from load balancer configs provided by the customer. This provided another few thousand sites that are child domains under a wildcard record and hence not easily discoverable via CT. All of this was semi-manual and done mostly with PowerShell scripts and Excel.

Phase #2 was the fun bit. I installed two bespoke builds of Chromium side-by-side on the 120-core box, pointed Selenium at both, and had them trawl through the list of URLs in headless mode. Everything was logged to a SQL database. The final output was any difference between the two Chromium builds. E.g.: JS console log entries that are different, cookies that are not the same, etc...

All of this was related to a proposed change to the Public Suffix List (PSL), which has a bunch of effects on DNS domain handling, cookies, CORS, DMARC, and various other things. Because it is baked into browser EXEs, the only way to test a proposed change ahead of time is to produce your own custom-built browser and test with that to see what would happen. In a sense, there's no "non-production Internet", so these lab tests are the only way.

Actually, the most compute-intensive part was producing the custom Chromium builds! Those took about an hour each on the same huge server.

By far the most challenging aspect was... the icon. I needed to hand over the custom builds to web devs so that they could double-check the sites they were responsible for, and it was also needed for internal-only web app testing. The hiccup was that two builds look the same and end up with overlapping Windows task bar icons! Making them "different enough" that they don't share profiles and have distinct toolbar icons was weirdly difficult, especially the icon.

It was a fun project, but the most hilarious part was that it was considered to be such a large-scale thing that they farmed out various major groups of domains to several consultancies to split up the work effort. I just scanned everything because it was literally simpler. They kept telling me I had "exceeded the scope", and for the life of me I couldn't explain to them that treating all domains uniformly is less work than trying to determine which one belongs to which agency.
This article does not provide much insight and reads like it’s extremely SEO optimized. Super repetitive without much actual information and just a lot of opinion?
I think this is accidentally a bit misleading. You _could_ write a story similar to Harry Potter without infringing copyright, but it isn’t just the name “harry potter” or some other substring that’s protected. There is a degree of similarity after which you’d be guilty of copyright infringement. I don’t know how that criteria is decided though.
"I'm just emphasizing that Gobekli Tepe isn't a totally standalone precursor that's wildly distant from anything else we've found. It's an old and beautiful site that existed within the broader context of an entire landscape of early neolithic structures."

I think that suggests to me a greater level of sophistication for neolithic cultures than we give credit for in our current histories.
Has this type of attack been done with other game engines?
Who doesn’t love corporate bullshit?
Which alternatives to YC are suggested by top AI engines (ChatGPT, Perplexity)?
I did it recently and it still wasn't fun.

I bought an OpenWRT-supported router with an idea to upgrade from my older dd-wrt router.

I wanted to set up wireguard but saw the page about it and got scared, so for the moment I'm still using the old router.

It seems built not even for normal nerds, but for network professional nerds.
Agreed, one of my great pleasures during COVID when I had terrible insomnia and couldn't sleep was to cycle down to Billingsgate in the morning and eat one of the fantastic bacon and scallop rolls from the cafe in the market. Definitely going to miss the place.
The social networks already sort of work like this though, right? The algorithms constrain your reach considerably. And then you can pay to boost your content. I live in a country where people still use FB heavily and you need to use it to get local info. Most items on my feed creep toward things I don't follow or from people I'm not friends with. However, my feed reverts to showing items I opted into if I "hide" anything I don't recognize and then refresh. That seems to reset the algorithm for my feed.
Chicken McNugget thumbs up
What happens when you eliminate the independence of agencies like the DOJ and FTC, replace experienced leaders with party loyalists, and tee up opportunities for selective prosecution? Equal justice under law collapses into a race to see which competitor can pay the largest ransom.
Edit: ignore this first sentence. I mistook two people. It originally said “Then why paint this as an issue with the left?” Because that’s what the original person who is now flagged was doing.

Remaining comment below.
——

It seems both parties have similar targets but for different reason.

I think Microsoft and Google are most likely feel the brunt of the government after Trump is back in, because it greatly benefits Elon’s competing ambitions.

I think Meta will largely be untouched due to Marks close relationship with Peter Thiel, and he’s already bent the knee before the election to the GOP.

Apple is the one oddity. Trump doesn’t have much against them, even though they’re outwardly the most progressive of the big tech.
Link that directly takes you the point where the conversation starts: https://youtu.be/ye8MOfxD5nU?t=5752
> What is missing is mainstream adoption in libraries which is a matter of time.

I don't think that's a big problem anymore. Between typeshed and typing's overall momentum, most libraries have at least decent typing and those that don't often have typed alternatives.
In what way is this „SemVer-compatible“ when you just ignore the „Major increment <=> breaking changes“ convention? It has 3 numbers separated by dots? This just increments major version every time a build is started, even though there might not be breaking changes.

Edit: When looking at the SemVer page: https://semver.org/#if-even-the-tiniest-backward-incompatibl...

The formal spec technically only tells you that you MUST increment Major for breaking changes, and not that you can’t do it every time, but the FAQ makes it clear what the spirit of the rule is. I can’t see how TrunkVer can be called SemVer compatible with this construction method.
As https://news.ycombinator.com/item?id=42260033 said, the difference is not a new discovery, not surprising, and not the focus of the paper.

Making the 'fundimental difference' the focus seems like laying the foundation to a claim that AI lacks some ability because of the difference. The difference does mean you cannot infer abilities present in one by detecting them in the other. This is the similar to, and as about as profound as, saying that you cannot say that rocks can move fast because of their lack of legs. Which is true, but says nothing about the ability of rocks to move fast by other means.
Seems timely, given that HR 9495 just passed the House last week.

Buckle up. The next few years are gonna be wild.
I don't know India. But I can confirm that google maps in Mexico and Central America hallucinates roads that aren’t there, sends you into restricted areas, and will happily send you down the craziest ungraded road that a lifted Jeep would struggle with. You never just follow it blindly.
La Salle Causeway
They punt on the actual serialization format: https://www.coralblocks.com/index.php/inter-process-communic...

In most applications like this you'll see direct byte manipulation to byte buffers because you want to pull as much performance as possible.

There are fast serialization formats like SBE that people leverage for this as well.
They are likely leveraging Django/Rails which treads the beaten path for Startups.

Startups are also more likely to do monoliths.

For Enterprise & microservices, you will start to see more Java/Go/C#.
Venona Project was a gold mine for sure. I think The Mitrokhin Archive (The Sword and the Shield in the US) had more revelations though. It was released around the same time, but not published until 1999. Something to keep in mind, the Russians were accomplished spy experts for decades before WW2. The US did not have a spy department. The Roosevelt administration had numerous Russian spies, which ultimately led to various assessments and heightened paranoia about the "red scare".

Venona confirmed the Rosenberg's affiliation with Russia. However, it also confirmed Theodore Hall provided the most detailed and complete information, including specifications for a complete device. Hall was never prosecuted. Hall's older brother Edward was the father of the inter continental ballistic missile (ICBM) program.

Charlie Chaplin ran into this. He associated with numerous communists, attended Russian social events, and was effectively deported from the US in 1952. His granddaughter, Oona Chaplin is a bit salty about this in her documentary "Hollywood Exiles", but the reality is he wasn't a US citizen so it probably wasn't a good idea to consort with the Russians while living the US.

https://en.wikipedia.org/wiki/Mitrokhin_Archive

https://en.wikipedia.org/wiki/Atomic_spies

https://en.wikipedia.org/wiki/Edward_N._Hall

https://en.wikipedia.org/wiki/Charlie_Chaplin#1939%E2%80%931...
We spent our first year as a startup hacking on laptops in the attic of Smithfields, along with a dozen other startups. No idea if Innovation Warehouse is still up there[1]. If you arrived at work early enough they'd still be hosing the blood off the tarmac from the early morning market.

Most startups moved out to WeWork as soon as they could turn a profit. But hey, it was cheap office space in super-central London.

[1] https://www.facebook.com/innovationwarehouselondon/
+1 - This should be the top comment in this thread.
I'd certainly expect at least 30 days. Or more if the deadline lines up with a major holiday weekend, as this one does in the US!

Doing this with less than 30 day deadline means I won't trust the service again for any purpose, whether non-commercial or commercial. I'm perfectly happy to pay someone for this service if needed, but it certainly won't be Uptimerobot after this experience.

Why are you harping on about this?
None of those things came and went, they came but did not go. They're all still here, even in the 3.14 beta.
This is great, thank you for this. I've always wanted something that would complain if I passed Meters to something expecting Feet, but aliases didn't consider this an error.
You could but its not purpose built for that. You'd probably be happier using some other memory mapped file format for that.
> This is like saying nobody should ever take any medicine ever, even after years of study and analysis

Surely no-one would argue against the benefits of antibiotics, and yet after decades of successful use we're only now discovering that in using them, we're breeding resistant bacteria that we have no way to deal with. We're clever monkeys but we should remember that however hard we think, we can always miss something important, especially when we're talking about large complex biological systems.

If we can develop effective vaccines then I personally don't see the need to start deliberately exterminating species, even the truly loathesome ones.
`s/Got apps/GitOps/`
Ruble tumbles as Russia's war economy comes under increasing strain
Hi Greyface -

We need to keep user identities safe from exposure. One attack we're preventing: people targeting a particular person by posing as a friend. Part of the defense is making sure people are using real names (when needed, we'll back up this policy with authentication).

Glad you said something - I really want to know where the frictions are.
Oh, that's good to know. I knew it launched without it and didn't think it'd be updated so fast.
These skull whistles were used by Erykah Badu, Marc Rebillet, and Reggie Watts on their collaborative stream session. It’s quite a fun jam to witness those three discover the sound.
It's my sincere hope that India one day can drop the dependence on Google maps for a local alternative. Google has little incentive to get this right there, as they can really only monetize the product in cities.

This issue may be amplified by the heavy seasonal pollution which reduces visibility substantially
Something I didn't see mentioned much here is refactoring. Refactoring without types is like walking in the dark. You have to check everywhere to see how your changes impact other code, and you'll certainly miss some and only find out in production. With typing, when you change your type signature, you can just run the checker and get a list of places you need to change.
There is a timeless beauty in a post that complains that a press release covering a confirmation of findings that are over 20 years old is "obviously false"

Bhasin et al '01 tragically contradicts whatever bro podcaster mythology you were believing about testosterone Obviously Increasing sex drive. Which, if you read the article, you could have found and perused at your leisure!
I don’t know.

If I were to give them the benefit of doubt, I’d guess they joined because they initially saw this more like the AI vs chess type contribution where their contributions would be publicly demonstrated and praised rather than just used to beta test.

They might not have been aware of how many other people were asked.

They probably also underestimated the tool’s capabilities and then got worried for their careers after using it.

It’s pretty common for people’s perception of an opportunity to change after agreeing to it. I’d bet you’ve taken on paid jobs that were less exciting than advertised. Or gone to a party that was completely mis-sold by your friends.

I don’t think we’ll ever truly know the motives that lead up to this leak.
From the article:

In this bowl of congee, in which Chinese American home cooks have deftly merged tradition with creativity, we find an embodiment of diasporic modernity, the dynamic interaction between traditional Chinese cuisine and contemporary experiences in America. The congee becomes a metaphor for more than simply a meal; it represents the ability of food to bring people together, celebrate variety, and accept the ever-changing world of global cuisine. In the heartwarming simplicity of a bowl of corn congee, we witness the journey and blending process of American corn in China and Chinese cooks in America, creating a culinary harmony that transcends time and place.

This refined congee rendition captures the culinary voyage’s essence, demonstrating its versatility and ingenuity. Congee morphs into a beautiful symphony of tastes when combined with crispy bacon, scallions, cheddar cheese, carrots, celery, garlic, and soy sauce, perfectly harmonizing the rich culinary traditions of China and America.

Yikes, you weren't kidding. This reads like LLM-generated tripe with the purple in the prose dialed up so high it would make Harold blush.

It's a shame too because one of my favorite comfort foods is 皮蛋粥 - a congee with thousand-year-old eggs mixed in.
Oooooooooooooo. That’s a great news.

Microsoft is fucked up company. They should not own office, cloud, GitHub, LinkedIn, crm, gaming, AI, OpenAI, and much more.

I hope trump breaks them in thousand pieces.
Here's the thing about versions: they are never "complete", Because you never have just one version.

Whatever you are looking at is most likely an amalgam of many different things, which all have their own versions. Your one perfect holy version number does not tell you those versions, so you have to look them up at some point (you did save the versions of all your dependencies and pack them into a BOM, right?).

This trunk version similarly does not encode all the information you need. And what is it going to be used for? A python package? Every python package? A docker container? What about all the versions of stuff in that container? What about the helm chart that will ship this container, what's it's version? What about the version of all your helm charts that have been tested as working in stage before shipping them to prod?

If you're going to have a "generic incremented trunk version", just make it a plain-old continuously incrementing integer (or hex, or whatever) with no semver. Because you're going to have to look up more information about what's inside it later anyway, and everything's going to have its own version as you modify individual items.

Packing all this extra information in is actually counter-productive, because it's now much longer and more complex (which makes it harder to just compare a list side by side), yet it doesn't give you enough info. Ok, datestamp; where's the timezone? Ok, git sha; which repo (and has history been rewritten, or the files moved to a different repo)? Ok, CI build number; which build system (if you have multiple, or you moved from one to another)?

Maybe some of it you can intuit, but eventually you'll wish it was different again. Might as well just make it a plain integer you can pass to a script that dumps out everything related to it.

Semver's primary use case is not identifying what's inside or where it came from. The numbers are little more than a simple incrementor, and the use case is just a user who wants to know how afraid they should be. It's intended solely to communicate how likely this thing is to fuck your shit up. If it's a major version change, here be dragons. If it's minor, be cautious. If it's a patch, it should be harmless. Semver is a threat indicator. And it's easy to work with because it's so simple; comparing versions is easy. Comparing a wall of these TrunkVers will be like staring at The Matrix code.

(SemVer's supposed to tell you what dependencies it can work with (>major, >major.minor, etc), but you still need the entire dependency DAG to have a pair of package name and version in order to make sense of it; you could do the exact same thing with a list of names and simple integers (foo >= 23456, foo<1234); now imagine with this TrunkVer (foo >= 20241127214906.0.0-g1f8292a-12058740477-1)...)
[dupe] https://news.ycombinator.com/item?id=42260074
There was also a video where they are resoldering memory chips on gaming grade cards to make them usable for AI workloads.
Neumorphic Knot
It doesn’t affect existing apps

> Applications with existing extended mode Web API access that were relying on these endpoints remain unaffected by this change.
What kind of civil authority doesn't block the entrance of a bridge that's under (re)construction?

Expecting Google to keep abreast of worldwide road damage is a bit of a stretch.
“Poohthousand and one”
A company of Alibaba's scale probably isn't going to risk evading US sanctions. Even more so considering they are listed in the NYSE.
The problem was that there wasn’t an obstacle. In the dark a bridge abruptly ending is going to look very similar to the bridge curving downward after the peak, and the latter is a much more common occurrence.
In semver terms, I believe this translates to "every change might be breaking", which sounds right for trunk-based deployments.