skysight-inc/HackerNews huggingface dataset:
I always thought Hamilton [1] does a good job of giving enough visual hooks that draw you in.

I also noticed this pattern where library authors sometimes do a bit extra in terms of discussing and even promoting their competitors, and it makes me trust them more. A “heres why ours is better and everyone else sucks …” section always comes across as the infomercial character who is having quite a hard time peeling an apple to the point you wonder if this the first time they’ve used hands.

One thing wish for is a tool that’s essentially just Celery that doesn’t require a message broker (and can just use a database), and which is supported on Windows. There’s always a handful of edge cases where we’re pulling data from an old 32-bit system on Windows. And basically every system has some not-quite-ergonomic workaround that’s as much work as if you’d just built it yourself.

It seems like it’s just sending a JSON message over a queue or HTTP API and the worker receives it and runs the task. Maybe it’s way harder than I’m envisioning (but I don’t think so because I’ve already written most of it).

I guess that’s one thing I’m not clear on with Bruin, can I run workers if different physical locations and have them carry out the tasks in the right order? Or is this more of a centralized thing (meaning even if its K8s or Dask or Ray, those are all run in a cluster which happens to be distributed, but they’re all machines sitting in the same subnet, which isn’t the definition of a “distributed task” I’m going for.

[1] https://github.com/DAGWorks-Inc/hamilton
The parent of your post outlines a phishing attack vector. The only known way to close the vector is nuking the user account.

If you can explain how, in a phishing resistant way, passkeys can grant access to a user’s account in the absence of any devices they own, I’d like to hear it.
40%[0] of the US population is considered obese. Pretty relevant to population wide averages.

[0] https://www.cdc.gov/nchs/products/databriefs/db508.htm
Mental Texas Hold'em: a mental poker implementation of Texas Hold'em
Exactly. Used to. RIP.
If they suspend an account after, say, 20 password attempts, they're success rate at stopping password guessing will be vanishingly close to 100%. Especially if they've instigated strong passwords.

If passwords cannot contain dictionary words and must be mixed case with at least one special character in digit, there's no freaking way anybody's going to guess their way in, with a small number of tries before the account is frozen. The number of penetrations from that is going to be so tiny, it's not worth worrying about.

The bigger worry are stolen password hashes being cracked surreptitiously, where the attacker has an unlimited number of tries whose rate is only limited by their hardware.
Think of how when the moon is in the sky at night the ground on Earth is lit up and not fully black. Same with the moon, it’s not totally dark on the night side of the moon if the Earth is in the sky from the moon’s perspective.
> Or better yet, give municipalities an incentive to stop layering a kinds of taxes. Just have a VAT and be done with it.

Switching our tax regime to VATs, effectively flattening 13,000+ sales tax jurisdictions down to 50, would be a monumental undertaking involving rethinking and reorganizing financing of literally everything below the federal level. And in the end it would solve a problem that is at best a minor annoyance to most Americans.

The juice ain't worth the squeeze.
I'm not super familiar with the details but I've heard that Shen has a really good type system. Aditya Siram addresses types at 12:00 in this video: https://youtu.be/lMcRBdSdO_U

Shen homepage: https://shenlanguage.org/
SpaceX wants Starbase to become an official city in Texas
This mindset creates bad OSes.
I have no idea who you are, am comfortable with who does and does not believe me here, and think you should do you. But no: the two approaches do not offer comparable practical security.

From the questions and comments across the rest of this thread, the misunderstanding here seems clear: the person I'm responding to did not realize that FIDO2 cryptographically binds credentials to sites.
Yeah, this is spot on. I just tried it again with 4 large letters I had conveniently in front of me, they were instantly gone, and I could only remember what they said, but have no visual.
Anything new of note here?

The more interesting and sadly often updated page is https://wiki.archiveteam.org/index.php/Deathwatch#2024
English isn't my native language, so I often misunderstand things.

I really thought you were thinking of the graphs. Sorry :-)
I hope someone is working on TikTok archiving
> Open source video models are going to beat closed source. Ecosystem and tools matter.
Midjourney has name recognition, but nobody talks about Dall-E anymore. The same will happen to Sora. Flux and Stable Diffusion won images, and Hunyuan and similar will win video.

Neither Flux (except the distilled Flux Schnell model) nor Stable Diffusion has open licensed weights, Stable Diffusion and Flux Dev are weights-available with limited, non-open licenses, Flux Pro is hosted-only.
How about something about sitting all day in tightly environmentally controlled facilities filtering all the pollution away?
Try using the Google Chrome extension Shazaam to find the answer. It is pretty good.
The fuzz is about writing 2,000 words on a simple concept in impenetrable jargon in order to better demonstrate the thought leadership of your practice and the need for deep consultation to translate the aforementioned impenetrable jargon into simple language so mere plebes can implement the advice.
I'm the author and I can tell you what happened.

You are right: I did start the YT channel exclusively for this video and here's why.

I was on Linkedin, I posted my parody/trolling video with my small audience.

Virtual friends told me they wanted to share the video on other platforms but they were unable to do see because LI didn't allow external video thumbnail —or something like this.

The video almost instantly reached 200 views on YouTube (and you are right, I had no followers)... and then it was suddenly shadow-banned.

I know how to detect when growth (or lack of growth) isn't organic.
It’s your fault for not carrying your desktop and a camping battery with you.

Just install a webcam on it and scan the qr code iOS displays.

/s
> It’s the first result for “ki editor” on Google as well. I suspect they just typed in “ki”.

I tried "ki vimlike." In retrospect, "ki editor" would have made more sense.
I'm really impressed you've made the system faster as part of this work. Kudos
Will the content of USA accounts still be accessible outside the USA? Or will it just vanish?
What were your characteristics to define an SSH connection? Port only, or protocol(s), or traffic pattern matching?

(I want know more!)

I have flags on my firewall(s) for outbound connections to a list of ports that are commonly attacked, so I get notified if it looks as if attacks may be originating from my networks. It's purely based on port numbers though, nothing smarter than that.
So what happens when you buy that ticket and don't pay any of the fees? If you get taken to Hawaii then they're in the clear. If they won't take you without you paying the fee then I guess the fee wasn't optional after all.
My home ISP has an exit point in a different city from where I live, so even without a VPN the IP lookup is only accurate to country level.
I guess the EC doesn't have to worry about the MEPs being able to do much of anything since they don't have much of a say.

Meanwhile, the actual people affected (drivers/pedestrians) don't exactly have much of a say in the US either.
16 CFR Part 255 Guides Concerning the Use of Endorsements and Testimonials in Advertising https://www.ftc.gov/sites/default/files/attachments/press-re...
CSRF is not as big of an issue as it used to be, and when it is an issue it can be solved more easily and comprehensively than XSS:

1. The default value for SameSite attribute is now "Lax" in most browsers. This means that unless you explicitly set your authentication cookies to SameSite=None (and why would you?), you are generally not vulnerable to cookie-based CSRF (other forms of CSRF are still possible, but not relevant to the issue of storing tokens in local storage or cookies).

2. Most modern SSR and hybrid frameworks have built-in CSRF protection for forms and you have to explicitly disable that protection in order to be vulnerable to CSRF.

3. APIs which support cookie authentication for SPAs can be deployed on another domain and use CORS headers to prevent CSRF, even with SameSite=None cookies.

On the other hand, there are no mechanisms which offer comprehensive protection from XSS. It's enough for a single JavaScript dependency that you use to have a bug and it's game over.

For this reason, OAuth 2.0 for Browser-Based Applications (draft)[1] strongly recommends using a HttpOnly cookie to store the access token:

"This architecture (using a BFF with HttpOnly cookies) is strongly recommended for business applications, sensitive applications, and applications that handle personal data."

With regards to storing access tokens and refresh tokens on local storage without any protection it says:

"To summarize, the architecture of a browser-based OAuth client application is straightforward, but results in a significant increase in the attack surface of the application. The attacker is not only able to hijack the client, but also to extract a full-featured set of tokens from the browser-based application.This architecture is not recommended for business applications, sensitive applications, and applications that handle personal data."

And this is what it has to say about storing the refresh token in a cookie, while keeping the access token accessible to JavaScript:

"When considering a token-mediating backend architecture (= storing only access token in local storage), it is strongly recommended to evaluate if adopting a full BFF (storing all tokens in a cookie) as discussed in Section 6.1 is a viable alternative. Only when the use cases or system requirements would prevent the use of a proxying BFF should the token-mediating backend be considered over a full BFF."

In short, the official OAuth WG stance is very clear:

1. HttpOnly cookies ARE better in terms of security.
2. Storing Refresh Tokens in local storage is only recommended for low-security use cases (no personal data, no enterprise compliance requirements).
3. Storing short-lived Access Tokens in local storage should only be considered if there are technical complexities that prevent you from using only cookies.

[1] https://datatracker.ietf.org/doc/html/draft-ietf-oauth-brows...
No need to worry - it's your data.

Large organizations do a takeout/checkout process that sends you a notification when the data is ready for manual exports.
Hilarious because true! But also sad because true!

Can you believe Microsoft paid $ 26.2 billion to acquire Linkedin? look at the network now. Imagine what could be done.

If I were the CEO, even for 1 year, I'd transform LI into one of the best platforms...
Search. I think it's a modifying space: what one sees last week may not be the same as what one sees this week, nor need the same query return the same response.
Show HN: I Built a Canada Quiz
Archive Team was started by Jason Scott, who is also software curator at Internet Archive. Unclear on timeline of his employment with IA, but he started AT in 2009. No official connection between the two orgs that I’m aware of.

https://en.wikipedia.org/wiki/Jason_Scott

https://en.wikipedia.org/wiki/Archive_Team
Simplified but care-full application of notation: "no empty bunches"? And (,much less care-fully maybe a little machinationally,) what do you call the op that maps bunches to open sets and sets to closed sets?

空即是合， 束不可空 (expectedly trad)

Somehow.. Hehner could be better rendered in Classical..
Sod off. Your take on overweight being ”willfully and knowingly overeating” is ignorant and naive beyond recourse.
Evaluating a Sitting Senator's Healthcare Claims
This is nice. I like this editor, will try it out. The beginnings of a "mode" exist in vim, with plugins like tinykeymap that let you get into "tab manipulation mode" or "window manipulation mode", you can really do that with anything though, but maybe not as extensively as in Ki. It's quite a neat trick, example that lets you c-w +++++ instead of c-w + c-w +:

nmap <C-W>+ <C-W>+<SID>ws
nnoremap <script> <SID>ws+ 10<C-W>+<SID>ws
nmap <SID>ws <nop>
>Apartment so no way to do outgoing mail with the flag on a mailbox like a home.

Australian here. I literally never realized that's what the flag was for until your comment.

I thought it was so the mailman would lift the flag to notify people that the mail has been delivered.
Wouldn’t you need more cash for a full set of LEO sats?
Love the simplicity and magic of this!
> You're not supposed to, that's the point. It's frankly shocking (and also not, but you know) how much businesses in America are allowed to bullshit you.

There's actually an administrative code in Washington that furniture (and maybe other) stores are only allowed to have a "Going out of business" sale _once a year_.
Hi,

I’m the founder of Eqvista — an equity management and 409A valuation provider. Eqvista is a strong competitor to Carta, and we’ve seen a significant number of migrations from Carta for several reasons, including costs, lengthy 409A valuation timelines, difficulty accessing support, and, more recently, adverse media coverage.

One common issue customers face with Carta is how challenging it is to cancel their subscription, as they try to prevent you from transferring your cap table elsewhere.

At Eqvista, we do things differently:
- Flexible Plans: Cancel your subscription anytime, with no lock-ins.
- Cost-Effective: Up to 70% more affordable than Carta.
- Fast and Reliable Support: 100% responsive and dedicated to solving your needs.
- Comprehensive Services: We handle $3 billion in client asset valuations monthly, onboard 400 companies every month, and currently serve over 20,000 entities on our platform.
- Cap Table Audits: We’ll ensure your cap table is audit-ready and fully compliant.

If you’re interested in joining Eqvista, feel free to contact me directly at tom@eqvista.com.

We can onboard you now and you pay us once your Carta contract ends so you don’t have to pay for two platforms. We will migrate you for free - in 3 days!

Looking forward to helping more startups succeed!

Many thanks, and best of luck!

Tom - https://eqvista.com
Go’s error handling is still cumbersome and lacking. I love writing Go but I don’t want to ever adopt anything like. It’s bending over backwards to achieve something sum types provide and this pattern is a mess.
It’s a product we get an aha moment immediately, love what you guys are doing
There was also a Radiolab episode that discussed this idea at a different hospital...

https://radiolab.org/podcast/apologetical-2303
The Crumbling Foundation of America's Military
The impact on their server is barely anything. Itty bitty fractions of a penny. So the amount we need to respect their wishes specifically for burden reasons is negligible.

Control over your own likeness is not "burden", but it's important too, and in this situation I would say it's orders of magnitude more impactful and important than the server costs of a few seconds of viewing.

> Perhaps because I consider "burden" more broadly than just the marginal effort of supporting an additional viewer of a camera feed?

The reason they set it up is not for selfies, so I think the marginal cost of selfies is the right metric. But even if we look at total burden to set up the system, that's divided over a ton of users, so the person taking a selfie is still looking at a minuscule fraction of it.
Raptor also has twice the thrust/weight ratio of the F-1.
Unexpected because, in my mind, Yandex = Russia (leading search engine in the region) + a few Russian-speaking populations such as Belarus and Kazakhstan.

I knew they also had a Turkish audience... but now I'm learning real English-speaking people are actively using it!

If you read this, please let me know why you find Yandex rankings more satisfying!
The FTC has guidance on when it considers a compensated endorsement to be "deceptive advertising", which is something they can legally enforce. [0]

[0] https://www.ftc.gov/business-guidance/resources/ftcs-endorse...
Free Software predates Open Source, so that's not an ideal conflating.

I get where you are coming from though. The choice of the word "Free" in "Free Software" isn't ideal because the word "Free" has multiple meanings. Most people (especially non-tech users) assume it means "no cost" rather than "unencumbered".

So yes, it would have been simpler either a different name. Hindsight is perfect.

That said Free Software is different to Open Source (although lots of tech folk conflate the two.) That aside, it doesn't stop people adding their own (incorrect) requirements or expectations, as seen elsewhere in this thread.
So, nothing. Got it.
That's a really neat demonstration! Would you mind if I use this code to jump off with my own tangent? (I want to hook the microphone audio into it, to control the patterns based off voice/music)

The way the patterns looked, felt natural enough that my brain was trying to make sense of the chaos.
Agree. Somewhat. But given that Elon Musk (who wants to shut down the Consumer Finance Protection Bureau completely) is likely to have a lot of say in these type of things, I think they'll forget that fear.
If "ki editor" is hard to google, I suppose "ad editor" must be basically impossible to google. A clever way to keep the project low-profile before it's ready for world domination :)
> When scanners attempt to identify open TCP ports by sending SYN packets, our solution introduces a second layer of disruption. It delays SYN-ACK responses, sending them after a set time. While the delay for a single port may seem minor, the impact compounds when attackers scan thousands of ports across a network teeming with virtual devices.
It absolutely is a Valid question. At the end of the day, the problem with passkeys Is that they are explicitly negatives for common people.

Have a broken phone camera? Cannot scan qr codes.

Lost the phone? Cannot log into vital modern day accounts like email.

Your house burned down, and the passkey device with it? Say goodbye to literally everything.

Homeless (temporary or otherwise) persons, random local government sweep just trashes everything you own. Bye bye to the passkey again.
> Wouldn’t you need more cash for a full set of LEO sats?

Not if you only aim to cover the EU’s population centres in round one.
Discussion (126 points, 11 days ago, 43 comments) https://news.ycombinator.com/item?id=42345500
Their download page may have more info:
https://wiki.archiveteam.org/index.php/Main_Page

Seems like a appliance that can archive web page. Could be good for ppl to run and not totally rely on archive.org incase it goes down again.
>If you're trying to predict what he's going to do you can look at past actions, or what personnel he has put in place. Just reading what he says is useless.

I'd just like to reflect on how absolutely batshit crazy America is to have voted this guy into the most powerful political position in the world, again!

The whole thing is actually very impressive. Nobody actually knows what he stands for, other than he claims he's the best at it. Even after he did none of it when he was in the same position before!
> starlink was a change-in-the-seat-cushions byproduct of a rocket development company

What does this mean? SpaceX built a better truck. Communications satellites are what everyone puts on trucks. They’re more than happy to be everyone else’s truck; the EU and Kuiper will pay SpaceX to lift their birds.
Our interactions online don't happen in a vacuum. They are to a decent degree an outcome of the real world we live in.

Sure, there's effects that are exclusive to the medium, like pseudo/anonymity, or related to the place, occasion and purpose of the interaction. But they are also influenced by our emotional state, personalities and life circumstances and everything that influences that in turn.

When you encounter people like that (they could be bots...) ask yourself what could be going on inside their heads. Are they on a mission? Are they in a bad spot and trying to cope? Are they trying to troll for amusement, fishing for attention?

A lot has been said about the internet becoming shittier and unfriendlier over time. Where it used to be (in my mind) an exuberant place to learn and meet new people or create entirely new culture, a third/fourth place outside the real world, we have seen that there's many more agendas at play. More eyeballs, surveillance, commercial interests, political influence, cheap entertainment and addiction. Too many cooks ruining the stew.

How do I deal with it? Use self-moderation if possible (e.g. I filter submissions by site, user and title on HN), find side alleys like special-purpose communities, save good stuff, so you don't forget what's possible (can't rely on search/recommendation engines or the permanence of anything anyway), and don't take it too seriously. I'm lucky to have been around for some time and know some older communities that are still going.

Online communication can be meaningful, intellectually and/or personally, but it doesn't come as easily as it used to. Everything is in flux. It's a shame, but it is what it is...

P.S.: If you get annoyed by HN comments from time to time, try http://n-gate.com. Doesn't seem to be active any longer, but it's still quite amusing.
99% of the time is a rather high rate of failure
.. 1% of a year is still over 3 days. 1% of a million is still a lot of incidents
The distinction started with rings of protection which was orthogonal to processes. Roger Schell said the guy who designed the one for Intel’s 286 had security kernels like GEMSOS in mind. Here’s GEMSOS and STOP so you can see how they did that back in the 1980’s:

https://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf
As somebody who is now on the “need to scrape a website to get my customers data for them” side of the fence… I get the reason bot detection exists. If you want people to not scrape, offer API’s that allow customers or their software to log in using oauth and let their software / LLM agent grab their data for them.
The term you’re looking for is “constant current driver”, not “linear regulator”.
Enterprise Python code. Somehow ends up being worse than Java enterprise code. I’m too used to it at this point.
I think that many small businesses that have been replaced by 'big-box' shops need to be restarted. Things like shoe-shops and hardware stores. The problem is paying overpriced rent, so having physical stores is difficult for any small business.
I agree, this was a really touching admission:

> Looking back to March 2022 when I left my job to pursue this startup full-time, I have absolutely no regrets. I knew the risks—that failure was a very real possibility—but I also knew I had to take this chance. Today, even as we close this chapter, I'm grateful for the failure because it has taught me more than success ever could.
Not really, I didn't have any delivery-related issues, and didn't get any complaints from other people as well. I have mixed feelings towards Matrix due to;

1. The only stable and maintained implementation is "matrix-synapse" and it is written in Python.

2. The most commonly used client is "element", and it is governed by the same people. So it feels we are the mercy of a single company.

I wanted hard to go with a more established protocol like XMPP but failed to get a server running properly :)
ah, yes, completely separate.

HTTP code: 200 ok

Body: {"error":"internal server error"}
RatingE – Revolutionary Review Management Platform