skysight-inc/HackerNews huggingface dataset:
Docker would punch through the host firewall by default, but the database wouldn’t be accessible to the internet unless the user opened the ports on their router firewall as well, which based on the article, it sounds like they did. Making the assumption they’re using a router firewall…

In this case, seems like Docker provided a bit of security in keeping the malware sandboxed in the container, as opposed to infecting the host (which would have been the case had the user just run the DB on bare metal and opened the same ports)
You're right. The hacker discussion is about all kinds of crime, including murder, but the article is about minor incidents.

"There was some initial internal resistance, but eventually Quinn and his staff came up with general parameters: they would not erase names in cases of violence, sex offenses, crimes against children or corruption."

It's a bit odd, because newspapers rarely report on minor crimes, and when they do they don't put the names of the guilty in print.
What about the reverse: a post only shows up after 24h after submission? :-)
As former IGDA member and GDCE attendee, still catching up on GDC Vault and Digital Dragons, regular EDGE, MCV Develop and RetroGammer, I kind of well aware of how things are, and not confused at all.
If you codebase isn't somewhat modern C++(C++11) I would start there before concidering a port to rust. It will be a significantly easier upgrade in safety even if not going all the way to rusts level of safety.

Generally code that has been running for years is unlikely to have too many bugs since they have been shaken out, "rewrite it in Rust" as a fad just ignores the decades of work already put into the codebase and for large codebases likely eont succeed.

As you mentioned, write new modules with rust. That means likely needing to export a C API for your libraries but there's a good chance you were already doing that. There was also a rust crate that tried to automate most of the c++ rust interop for you but not sure about how good it is in reality.
Ok, so can we and should we try to come up with a more suitable term?
> spinning up a Postgres instance in Docker seems secure because it’s contained

This doesn't make any sense. Running something in a container doesn't magically make it "secure." Where does this misconception come from?
Yes big dam do redistribute mass and alter the Earth's rotation. But by my rough calculations the Three Gorges Dam should lengthen the day by roughly 0.05 to 0.06 microseconds. So around 1 second every 50,000 years. You are more likely to get late to work because your alarm run out of battery :-)
Since Burst compiler was introduced for HPC# subset, that
C# is used for engine internals as well.

Unity is like doing AI with PyTorch, or CuPy, yep there is a low level C++ layer for the GPGPU code, that hardly anyone touches directly.

By the way, CAPCOM goes even further, they have their own .NET Core fork, and games like Devil May Cry for PlayStation 5 were made with it.
It’s not a random website, it’s backed by Shopify!
Yes, the original headline was actually pretty good
One of them 2001 was that Netscape didn't render correctly if the connection is still open. Hah. I am sure this issue has been fixed a long, long time ago, but perhaps there are other issues.

Nowadays I prefer SSE to long polling and websockets.

The idea is: the client doesn't know that the server has new data before it makes a request. With a very simple SSE the client is told that new data is there then it can request new data separately if it wants. This said, SSE has a few quirks, one of them that on HTTP/1 the connection counts to the maximum limit of 6 concurrent connections per browser and domain, so if you have several tabs, you need a SharedWorker to share the connection between the tabs. But probably this quirk also appllies to long polling and websockets. Another quirk, SSE can't transmit binary data and has some limitations in the textual data it represents. But for this use case this doesn't matter.

I would use websockets only if you have a real bidirectional data flow or need to transmit complex data.
"I don’t think it’s trolling to point that out, but maybe I’m missing some subtext."

It is a troll because it was only pointed at progressives.

You made the point that technically correct, this applies to conservative and progressives can both have similar issues with echo chambers.

But the parent was clearly only focusing on progressives that are in error, as if the conservative ideology is correct.

When really, there are a several studies that show that conservatives are more likely to fall for conspiracy theories, and not able to use critical thinking.
Any ideas on what that would be like?
Sometimes it’s better to treat the symptoms if the root cause is out of reach.
Subscription prices are also determined by overal company costs.

And until users understand that, they will continue being tracked and shown advertisement.
Sandboxing is a great idea. But the fact that this is a near-universal feature of language packaging reveals a preference that's going to be hard to counter: users do want effectively-arbitrary system access at build time, because that's the paradigm that's supported by the million-and-one different ways in which a build environment can be valid.
you've got to have the eye of a hawk to achieve something like this
> You realize that operation Warp Speed was championed by Trump right?

I'm not sure if you read my full comment before replying, I specifically called this out in my last paragraph.

Edit: to include that I'm also not supporting Trump or saying he did things well. I'm only making a comparison of the Democratic party leaderships' opinions and statements before and after Biden took office. What was Trump's vaccine and had to go through standard safety tests before they would consider it became Biden's victory with a vaccine rushed through EUA, required for all federal employees, and recommended for everyone including children who were never even studied (unless you consider a test population of 30 statistically significant).
When an ASML Lithography Machine Goes Down:
https://youtu.be/6v9gx3Z4oVk?
What do you need Tailscale for? Why isn't Wireguard enough?
USA-UK comparisons are always tempting because the UK is English speaking, but my feeling is that the UK is in such disarray that its not a good European reference point
Both sides have Narratives.

If I speak out against the right, then I'm a tranz communist child molester that needs some Jesus.

And, there is data, the right 'cancels' more people than the left. The right has it's own virtue signaling and cancel culture.
To the contrary of you last statement, my understanding is that alcohol and drug use is down and cigarettes are up among young people.
What motivates this attitude? Software, like anything else, needs to be actively maintained. This is a positive sign of technology evolution and improvement over time. To expect to run some software for 20 years without needing to apply a single security patch is ridiculous, and probably exactly the attitude that caused the author to get himself in this situation.
Those are largely disjoint sets, and the post in question is about PyPI.
I've seen what appear to me to be far less deserving papers get the same kind of perhaps excessively exuberant hype, but in this case, it's not looking quite that far off the mark, IMO
Tbh I prefer not exposing any ports directly, and then throwing Tailscale on the network used by docker. This automatically protects everything behind a private network too.
> You have already realised the biggest value of that company; lessons about what to look for in a future co-founder, how to run a company and build a product.

Agree with that, I now know what to look for if I started a new venture. Thanks a lot for sharing your story!
There's no good reason a VM or container on Hetzner cannot use a firewall like IPTables. If that makes the service too expensive you increase cost or otherwise lower resources. A firewall is a very simple, essential part of network security. Every simple IoT device running Linux can run IPTables, too.
It's an excerpt of a much bigger email.

I told him about corporations using AGPLv3 as leverage in order to build SaaS products around the software. As copyright holders, they can do whatever they want while everyone else must comply with license terms. The CLA is a necessary component of that strategy.

I asked him what he thought of the practice. That's what he replied. He didn't go into much detail about SaaS. He said it was too broad a term to judge.

Here's the full email exchange:

Hello, Dr. Stallman. I would like to know your views
on the ethics of certain uses of the AGPLv3.

There are apparently some corporations that
are releasing free software under the AGPLv3
while building software-as-a-service platforms
using the same software. It is my understanding
that as the copyright holders they have the right
to do it without any problems. They leverage the
AGPLv3 to make it harder for their competitors
to use the code to compete against them.

In online discussions on this matter, I pointed
to an article that you wrote regarding the ethics
of selling exceptions to the GPL. You argued
that that if selling this exception was unethical
then so was releasing software under permissive
licenses, and rejected the idea that it was unethical.
The conclusion was that this enabled proprietary
software to be freed, an ideal outcome.

I'd like to ask if you think the same logic applies
to the SaaS situation I mentioned. I think it does,
but others did not agree.

People are using the AGPLv3 to maximize leverage.
Corporations seem to be incapable of tolerating the
license's terms, a situation that leads to copyright
holders providing a business solution: paying for it.
They can buy special permission to use the software.
These days, it appears the choice being offered is to
buy into the company's SaaS platform instead of
purchasing a special permission or license.

The exact mechanism employed by the business
seems like a minor detail to me but perhaps there
are some ethical considerations that I'm not seeing.
So I decided to send you this email and ask what
your opinion on the matter is.

Thank you for your time,
Matheus

---

> There are apparently some corporations [...]

"Software as a service" covers such a broad range of computing
practices that I generally don't use it. It is too broad, and gives
too little information, to judge whether a practice is good or bad.

> It is my understanding [...]

I see what you mean. The original developer can engage
in a practice that blocks coopertation.

By contrast, using some other license, such as the ordinary GPL,
would permitt ANY user of the program to engage in that practice.
In a perverse sense that could seem more fair, but I think it
is also more harmful.

On balance, using the AGPL is better.
A messy experiment that changed how I think about AI code analysis
Usernames still visible on report export pdf despite
Sports mega project? Heh, do tell more.
Fine, then throw out the requirement to display my plate which is an unlawful self-imposed search of my registration papers without probable cause nor reasonable suspicion. You can't just force people to affix their ID to their method of transportation to get around the fact you can't stop and ask them for it without RAS, it's a cheap sleight of hand around the 4th amendment.
>Reading this as a layman, it looks like releasing ΛCDM's cosmological principle

You mean relaxing. Also... "as a layman"? Lol what kind of layman are you. Respect.
Quite literally a section in the Wikipedia article.
Very awesome work indeed... I haven't looked at ELKS in a long time and seeing everything it can do now is heartwarming.

The 8018x/ROM mode sounds like it could make for a fun breadboarding project, not that I'll likely wind up doing it myself. Is there any way to run it in emulation?

Running native compilers on XT/286 hardware does indeed sound sloooow. At least it can be tested, probably automatically, in emulators where it'd run faster than the native compilers did back when this all started :)

---

It's funny... 7-10 year old hardware back in 95-96 when this started could barely keep up with current software at all, and I'm writing this on a 7 year old Dell Precision (albeit upgraded well beyond stock :) ) that still runs Linux pretty darn well.

- Chad
Also from TFA:

> it was exposed to the internet, with open ports in the router firewall

Upvoted because you're right that the comments in this thread have nothing to do with what happened here.

The story would have been no different if OP had created an Alpine Linux container and exposed SSH to the internet with SSH password authentication enabled and a weak password.

It's nothing to do with Docker's firewalling.
[dupe]
https://news.ycombinator.com/item?id=42591221
I guess we have different risk tolerances.

The best way to learn is to do. Sure, you might make some mistakes along the way, but fuck it. That’s how you learn.
Drive-on/off rail?
Cloud architecture diagramming and design tools
You absolutely can. Have you a credit card and a web browser? You can buy all sorts of heavy machinery and have it shipped to your door!
This is pretty common, developers are focused on making things that work.

Sysadmins were always the ones who focused on making things secure, and for a bunch of reasons they basically don’t exist anymore.

EDIT: what guidelines did I break?
Very cool! What sort of prompt did you use to parse the text into a timeline?
What is the point you're trying to make here? Are you waiting for some malware that exploits a buffer overrun to infect you before conceding that C/C++ is a terrible choice for memory-safe code?
Show HN: Free TI-84 Calculator Online
Free Online TI-84 Calculator
Experience the power of Texas Instruments TI-84 calculator right in your browser. Perfect for students, teachers, and professionals.
That reminds me of the toilet paper calculator during peak covid.

He put up a site in about half an hour and it ended up getting coverage on TV which led to ~10 million visitors and it making $5,000 a day in ads for a while. The core logic of the app is 6 lines of JavaScript to take a few inputs and do basic math on them.

I ended up chatting with the creator on how he built and hosted it back in 2020: https://runninginproduction.com/podcast/35-determine-what-yo...
Nice, I hope if some corp. makes a move of this, his family will get a nice payout.
Correct, newspapers, television, they all had similar problems.

I think the point is social media is larger, more encapsulating, more pervasive, more targeted than a newspaper or television ever could be.
I think that attitude is a result of the tech startup culture.

Companies get founded and funded with the exclusive goal of being bought up by a bigger fish.

Why spend time investing in the company’s long term future when the goal is to not exist in X years.
*aisle unless I’m missing something and you’re talking about an actual island?
The following are assumptions based on vague memories from books, articles, documentaries, anecdotes and thinking based on observations of past and current events and economic methods. You'd have to consult historians and engineers to confirm.

The choice was a purely pseudo-economic one.

a) Alternatives needed less than 12 months longer R&D.

b) Alternatives were less than 5% more expensive.

c) Alternatives were reusable/repairable and would not have been single-use, which would have reduced production mid- and long-term.

d) Alternatives would have sparked more industries and would have created more jobs, more captains and more (metaphorical) ships,
especially in engineering and crafts.

e) Alternatives would have meant better production methods and waste that would be easier and more constructive to handle, which would have meant better health and a more thriving environment and natural produce, which would have meant less opportunity to study negative impacts on humans as well as flora and fauna and less opportunity to make all kinds of swarms dependent on corporate "solutions".

Again, alternatives would have sparked more industries and would have boosted our civilization's/colony's R&D by 50 or more years. And the resulting cumulative competition would have boosted R&D even further. More money overall, less of gap between the wealthiest and the rest.

Pretending that the growing populations required unhealthy factory jobs is thus irrational. People were keen to learn and work and thrive and even dimwits like me had enough brains to catch up within a few months or years.

The conventional argument "do we create jobs now or later" is nonsense, as more emerging industries would have meant at least just as many jobs.

I could probably use an LLM and some books to craft a much better and technical answer but I probably won't use any for at least some longer while.
> in Europe it costs money to start a business, some paperwork and taxes is involved, even if you don’t make a single sale

not everywhere - in Poland it is fine to run a tiny-scale business without registration

https://www.biznes.gov.pl/pl/portal/00115 - among requirements, scale must be less than 75% of a minimum wage. Enough to test it.

> otherwise how do people know you are a legit business? For example, I’m not giving my credit card details to any random website to buy silly stuff unless they are properly identified

I do not care so much, as long of amounts are tiny - in case of fraud it is bank's problem
Show HN: One-Click Explanations for Research Papers
Decoding research papers shouldn’t feel like solving a puzzle. Formulas, figures, and citations often slow you down.

Moonlight changes that. Unlike chat-based tools that require typing questions, Moonlight provides instant, one-click explanations for any part of your paper—text, formulas, tables, figures, even citations. No typing, no back-and-forth.

Powered by YOLO object detection, Moonlight automatically detects and explains every element in your PDF, letting you focus on insights.

We’d love feedback from the HN community: Is this how you’d want to interact with your research papers?
I wonder if there is a set of interesting CSS challenges, with well written solutions and explanations, to help practice CSS layouts. And maybe debugging challenges -- why doesn't this code snippet give me the layout that I want?

ChatGPT has been very helpful when it comes to debugging CSS issues (not always correct but mostly in the right direction), still, I always want to get a deeper understanding of how CSS works. I have read books and tutorials, and for sure it just comes down to a set of rules, but correctly applying them is hard.
I love eating a bag of Dicks on a sunny summer day.

https://keyw.com/dicks-burgers-changes-french-fries/
I just switched to Tailscale for my home server just before the holidays and it has been absolutely amazing. As someone who knows very little about networking, it was pretty painless to set up. Can’t really speak to the security of the whole system, but I tried my best to follow best practices according to their docs.
Some people haven't yet understood that the transition into AI is similar to how optimising compilers mostly replaced Assembly programming.

While not yet there, eventually AI based code generation will be good enough to generate native code directly, without going through existing languages code generation.

So while we might get the equivalent of a -S compiler switch, to dump the AI compiler decisions and fine tune the prompts, that isn't something everyday dev will be bothering with.
Not if I am looking for something specific like Reddit threads.

Anyway. I want more and you.com and perplexity does that so I will use them over chatgtp.
Can someone explain why TTL = 60s is a good choice? Why not more, or less?
Pretty impressive. But for the part about nitpicking on style and uniformity (at the end) the results seem useful.

Btw I thought, from the title, this would be about an AI taught to dismiss anyone's work but their own, blithely hold forth on code they had no experience with, and misinterpret goals and results to fit their preconceived notions. You know, to read code like a Senior Developer.
I think it’s easier to manage, plus you get ACL functionality. You can use Headscale for the control server and tailscale clients.
There's nothing wrong with wireguard at all if you already have the hosting service available. The core value add for Tailscale is that they provide/host the service coordinating your wireguard network.

If I'm not mistaken, there's a self-hosted alternative that let's you run the core of Tailscale's service yourself if you're interested in managing wireguard.
Please explain how you reasoned this out. If one 9.5m tunnel requires 70 m³ of removal for every meter of forward progress, and two 5m tunnels requires 40 m³ of removal for every meter of forward progress, won't it take nearly twice as long to dig the single larger tunnel? Won't that require twice the machine hours and twice the crew hours?

How does the volume of material removed not directly impact machine and crew costs?
AI and Marketplaces: The Future Is Agent-Led Marketplaces
It wasn't until I think around ww2 when sf got fucked really hard population wise, that had like some maybe good 10 years until the burden on the infrastructure and culture just blew it to bits, I know people with family histories in the bay going back until the gold rush and they really know what's been going on and why it's so bad
Checklist security at it's finest.

My team where I work is responsible for sending frivolous newsletters via email and sms to over a million employees. We use an OTP for employees to verify they gave us the right email/phone number to send them to. Security sees "email/sms" and "OTP" and therefor, tickets us at the highest "must respond in 15 minutes" priority ticket every time an employee complains about having lost access to an email or phone number.

Doesn't matter that we're not sending anything sensitive. Doesn't matter that we're a team of 4 managing more than a million data points. Every time we push back security either completely ignores us and escalates to higher management, or they send us a policy document about security practices for communication channels that can be used to send OTP codes.

Security wields their checklist like a cudgel.

Meanwhile, our bug bounty program, someone found a dev had opened a globally accessible instance of the dev employee portal with sensitive information and reported it. Security wasn't auditing for those, since it's not on their checklist.
Yes, I agree with all of that. My points still stand:

1. You can’t claim a donation of personal money is a responsibility to shareholders. Shareholders don’t control your personal life.

2. More importantly, fiduciary responsibility to shareholders is a bullshit reason whose only purpose is to justify unethical behaviour. If you go against your values because of money, they’re not your values.

3. Tim Cook likes to claim he fights the good fight. He’s an influential and powerful person whose actions can influence the lives of millions of people, so what he says should be compared to what he does.
How to Debounce a Contact (2014)
What’s the lie? Groups like Oath Keepers planned it. It was not spontaneous.

The only reason anyone thinks otherwise is because they were completely incompetent. But being bad at overthrowing the government doesn’t mean you didn’t try.
Pre-configured AI environment for fintech privacy
How is The Boring Company doing lately? There will be huge induced demand for tunnels if they manage to deliver even close to their goals.
Some content mills seem to display a date but automatically update it periodically. Sometimes you can outright see it can't be correct since the information is woefully out of date or you can check from Internet Archive that the content is the same as before but with a bumped date.