skysight-inc/HackerNews huggingface dataset:
>The fact is the federal government seems to grow and spend without any limit or regard to logic.

That's not the case really. In the last 50 years there was no trend in federal spending vs GDP, with widest movements being a growth from ~19% in FY2001 (which ended with 09/11) to almost 25% in 2009, with subsequent decline to the same average as before. Nothing catastrophic. In the immediate postwar era of course, the spending has been much lower at around 15% but that was when the population was 9 years younger and no Medicare or Medicaid existed, i.e. old or poor sick people were just left to fend for themselves.

In 2024 out of 6.8T in federal spending, Medicare and Medicaid was 1.9T. Remove that and you are back to a typical 1950s level of 16-17% federal spending to GDP.
Norway's wealth fund now worth $319,900 per citizen
> My only hangup is that I have had my confidence shaken by Microsoft's occasional showing of hand...

I'll add to the OSS problems of poplar libraries like identity server, ImageSharp, Moq and recently Fluent Assertions having to change license due to sustainability and got absolutely raked through the coals for the audacity of doing so. And the general belief that if Microsoft ever release a competing product in the same space your cooked even if it's not even half as good.

So not only is there the question of trusting Microsoft, my confidence is shaken by the wider ecosystem too if fairly 'staple' testing libs are struggling in their shadow.
No it hasn't. The subtext of "don't roll your own crypto" is that "AES" doesn't do, by itself, what most developers think it does; there's a whole literature of how to make AES do anything but transform 16 unstructured bytes into 16 different bytes indistinguishable from random noise; anything past that, including getting AES to encrypt a string, is literally outside of AES's scope.

The shorter way of saying this is that you should not use libraries that expose "AES", but instead things like Sodium that expose "boxes" --- and, if you need to do things that Sodium doesn't directly expose, you need an expert.

Contra what other people on this thread have suggested, reasonable security engineers do not in fact believe that ordinary developers aren't qualified to build their own password forms or permissions systems; that's a straw man argument.
You may like Hurl [1]: it's an Open source cli based on curl (libcurl to be exact), to run and test HTTP requests with plain text (I'm one of the maintainers). We recently add --curl option to come back to curl. Give it a shout!

[1]: https://hurl.dev
My favorite experience with the 70b distill was to ask it why communism consistently resulted in mass murder. It gave an immediate boilerplate response saying it doesn't and glorifying the Chinese communist party, then went into think mode and talked itself into the position that communism has, in fact, consistently resulted in resulted in mass murder.

They have under utilized the chain of thought in their resoning, it ought to be thinking something like "I need to be careful to not say anything that could bring embarrassment to the party"..

but perhaps the online versions do actually preload the reasoning this way. :P
>Developers can’t be expected to blindly believe every reply with a snarky tone and a blog link?

Developers are adults with responsibility to know the basics of what they're getting into, and you don't have to get too far into cryptography to learn you're dealing with 'nightmare magic math that cares about the color of the pencil you write it with', and that you don't do stuff you've not read about and understood. Another basic principle is that you always use best practices unless you know why you're deviating.

The person who replied to that issue clearly understands some of the basics, or they at least googled around, since they said "Padding oracle attacks -- doesn't this require the ability to repeatedly submit different ciphertext for decryption to someone who knows the key?"

In what college course or book is padding oracle described without mentioning how it's mitigated, I have no idea. Even Wikipedia article on padding oracle attacks says it clearly: "The CBC-R attack will not work against an encryption scheme that authenticates ciphertext (using a message authentication code or similar) before decrypting."

The way security is proved in cryptography, is often we give the attacker more powers than they have, and show it's secure regardless. The best practices include the notion that you do things in a way that categorically eliminates attacks. You don't argue about 'is padding oracle applicable to the scenario', you use message authentication codes (or preferably AE-scheme like GCM instead of CBC-HMAC) to show you know what you're doing and to show it's not possible.

If it is possible and you leave it like that because the reporter values their time, and they won't bother, an attacker won't mind writing the exploit code, they already know from the open source it's going to work.
Again, please pick a topic to proceed so we can find out whose opinion reflects reality more.

You'd be surprised how many lies and how much bad data you've fallen for.
Large language models don't think at all. Please stop with the crude marketing bullshit.
I don't understand what "blaming" the cryptographers gets you. Your system is either secure or it isn't. If you ship something insecure, that's on you.
You might've been… slightly… more convincing if you had any sources to back that absolutely wild claim up.
The audience interaction was pretty cringe too and unnecessarily advertising/antagonising. It's bad all around.
Reasonable security engineers take a reasonable position on this. Many other developers (usually uninformed ones) believe this now means "don't make an auth system." Like it or not, this has become a sort of adage that people cargo-cult.
I'm aware. Markdown is more popular and (in my opinion) easier to use. Tapping two spaces before each line of my code is a lot more effort than typing 3 backticks before and after the whole snippet. You're asking me to track indentation, on a potentially already indentation-based language (I mostly paste Python), without the help of an IDE. No thanks.

Sure, they could have figured it out. But it's annoying.
Using a sledgehammer is reckless and dangerous.
You mean the immigrant from London https://en.wikipedia.org/wiki/Sadiq_Khan and Liverpool https://en.wikipedia.org/wiki/Andy_Burnham ? I'm not sure any other major cities in England even have an actual mayor. (Lord Mayor is just ceremonial)

Tooting is just zone 3, not abroad :D
It's all consumed by the military industrial complex, which no doubt will have a continual budget increase as it does every year regardless of the administration.
What? Say more.
> Stackful coroutines have their pros but they are not a better choice.

Hard disagree. Coroutines are absolutely useless for anything non-trivial, as debugging them becomes a total hell. They are still a callback hell, just with a lot of sugary goo slathered on it.

Coroutines also result in the "colored function" problem, that is fundamental for them.

Meanwhile, Go lightweight threads just work. Debugging is simple, and you don't have to think about spooky actions at a distance from event loops that dispatch coroutines.
>unless you believe millions of people are spending their own money every month for useless tech

that's a hot take! A classic "Eat shit! A million flies can't be wrong.". really made me smile :)

BILLIONS of people are spending their own money for useless tech, simply because they fear of missing out.

Thinking person can see it is generating text from the input query – which is useful of course – but not dramatically useful
>> For example, almost everyone can agree that health care is too expensive, corporations have too much power, housing is unaffordable

I would argue that most people don't agree on this. Firstly housing;

For decades Americans were told that owning your own house was an investment. To keep home owners happy prices have to go up. Clearly the message was flawed, but no home owner wants to see that number go down. The arguments that rely on "this will reduce of home value" us a strong one thst gets lots of support.

If you ask folk they'll tell you Health Care is too expensive. But equally they'll push back on any approach to make it cheaper. Obamacare made it cheaper, the public voted dems out of office. Biden put price caps on pharma, and got voted out of office. In both cases Trump (with massive support) tried to, or did, wind it back.

Many states didn't take up expended Medicare. Now, we could argue that doesn't make health care cheaper (overall) it just moves it to a different payer. But apparently folk dont want that.

Corporations having power is completely because we give them power. If we truly believed in that excess we'd behave differently.

Truth is we mostly like our corporate overlords. We rail against Musk and Zuck, but we carry on using their platforms. Fox has power because they amplify people's fears and gives them a scapegoat.

Currently DEI is under the spotlight. It's a very convenient scapegoat to every unsuccessful white male. As long as we have someone to blame, we can avoid our own failings.
Or the saddam purge - https://youtube.com/watch?v=kLUktJbp2Ug
> Influencers often flip-flop between these criticisms reviewing any game they come across, so these ideas have now taken hold in social media, and are often barriers to respectful communication.

From my observations, I see that most influencers are consistent. A few will flip flop to chase the trend of the week, but most simply have hard, clashing stances. And of course, those clashes creature flames

Sadly, talking about games is rarely civil. You need to find a quaint community and/or do a ton of moderation to keep the conversation from tilting off.

> Many devs align with the games industry a lot more than the idealistic "games is my calling" new developer.

Yeah, that was definitely a contributing factor to me leaving Reddit. Only so many times you can try and reason "well yes, costs have grown for these larger games. Maybe a 16% increase after 15 years is justificed" and are counted by "but the market is bigger! You sell less games with higher costs"... sigh. I know they can't see the pocket books, but companies are still breaking records with $70 priced games. Come on.

Also just a real shame how much those gamers ignore the japanese market. They focus on COD and claim to just want to buy games. meanwhile Nintendo has never put MTX nor battle passes in their games, and they are chastised as bad for completely different moving goal posts (ahh yes, because lawyers remove mods... because Nintendo games disproportionately have a huge modding community. Population maps anyone?). Maybe a bunch of cosmetic DLC at worst, but all those western tactics are relagated to Mobile in Japan (which this audience couldn't care less about).

They have options to branch out to, but never do. Can't make the horse drink.
write code to support both, then let the user agent decide
> At this point I'm convinced that the endless AI hype and all the investment is purely due to hopes that it will soon put vast numbers of employees out of work

no. On the contrary. We will need people to clean the mess left by AI

> and allow companies to use the massive amounts of data they've collected about us against us more effectively.

yes.
This guy keeps spamming this package here. Polynomial time approximation algorithms for NP complete problems are not a big deal and are pretty well known for different problems. Yes, they’re useful, but I don’t think anyone in theoretical CS views the existence of approximation algorithms as saying anything about P vs NP.
I find this comment and most of your others very distasteful.

Digging through peoples past posts to look for gotcha’s is a pretty crass practice. It’s the kind of thing people used to do to try and dunk on each other on Reddit. It should not become the norm here.
I’d be interested to see a screenshot. Something’s quite wrong if they look like smudges. I’d be interested to see what font’s being used, too, which you can find in Firefox’s dev tools, Inspector tab, Fonts pane, Fonts Used section.
If you can't keep the line between "ordinary developers shouldn't be working with AES" and "ordinary developers can write login systems" clear, you're doing people a disservice, because the two assertions are not alike in how fundamentally true they are.
Uh, what happened to 'Meta' though?
Do you not want to train some of those students to write the improved cryptography of the future?

I do agree having a project where you demonstrate problems they introduced (by exploiting them directly, or have another student team be the exploiters) would highlight the risks, but school is about teaching, not about scaring people off.
Servpro charged me $35,000 for work they never completed, then did $30,000 of damage to my house, then threatened to sue me

Never, ever under any circumstances
Gnome 48 Switches over to "Adwaita Sans" as Default Font
Apparently I didn't math the math, I'm taking 1.25mg/week. I was measuring in units (.01ml) and the concentration is 2.5mg/ml.
Musk et al.'s plan has been out in the open for a while. Lots of interviews and opinions from them the last few years, so I wouldn't even consider it an open secret.

This video is probably the most succinct summary of it I've seen: https://www.youtube.com/watch?v=5RpPTRcz1no

It was made two months ago and has been right on the nose so far in terms of the phases in their process.
Yikes! Sounds to me like reliable longer form translation is very much not something you can trust to these models. Thanks for sharing.
Most of my interactions with government take place with state and local governments and they are definitely not allowed to print profit as far as I recall.

Public schools, police departments, parks, streets - I interact with these more than any other government service and no of them can print their own money and most of them work really hard to be run like businesses that care deeply about budgets and managing costs.
> The vast majority of teens don't have the skillset to cover their tracks like that.

Every class has a classmate, or sibling or friend of a classmate who would have the skills, and you only need one such kid for a few hundred people.

> The issue here (as always) is a parenting one. If you are supervising your children (as is your responsibility) then these issues can't happen.

I would say teens shouldn't be supervised to this extent and pushback against such tight supervision is natural and IMO justified.
> It’s hard to use words like “unprecedented” to describe what has happened this last week, but the disarray the government currently in has no precedent to my knowledge.

Certainly, there is no precedent in US history for an authoritarian, law-flouting executive takeover centering illegal purges of the executive branch as a whole (and a particular focus on illegally purging federal law enforcement and internal government accountability officials), racial scapegoating, and massive "deportation" efforts that rapidly encompassing setting up massive concentration camps, almost all done by executive fiat, with the tacit support of a Congressional majority that is ideologically aligned with both the policies of the executive and the decision to execute them without regard to existing law rather than through legislation.

There are a history of similar things one might point to in other countries, but it's a first for the USA.
The stuggle was real in the early web with getting companies to do proper password storage and authentication but the fact that seasoned professionals turn to auth0 or okta (and have been bitten by this reliance!) nowadays strikes me as a little embarrassing.
This should theoretically please some farmers in the region. But this is in winter, and I wonder if the farmers really like this, especially since the water won't be there in the summer when it is most needed. I'm piqued to hear what actual farmers in the region have to say.
I think your right for some. I think there is also some aspect of identity. "I identify with <these set of ideals> and that's just what we do" kind of thing.
I also want to say “millions have his same opinions” doesn’t mean you speak for the entire country and those opinions are reasonable. It is not silent agreement. It doesn’t even mean you speak for your entire party because you’ve corralled together. A good portion of the voters flipped and a lot of people didn’t vote.
It also doesn't square with how Meta retaliated against the creator of the Unfollow Everything plug-in, banning him for life.

https://slate.com/technology/2021/10/facebook-unfollow-every...

Friends? Family? Control? No! You will be served to the content the corporate advertising overlords want you to see in their feed, and you will like it, eyeball resource.
Is it not mostly social security and military spending? I.e. not bureaucracy, but what is essentially a savings program and massive wealth transfer to the MIC, neither of which are being affected so far. All this, plus reckless tariffs starting trade wars with the US's closest allies do not inspire confidence that this will have good outcomes.
It's not an accident. The whole point is to destroy these institutions, they've made no secret of that.

I get that there's plenty to not like about the Federal Government (and by plenty I mean a lot), but the answer to addressing that is to fix the problems rather than burn everything to the ground.
> Photoshop users don’t want to use GIMP.

I'm very curious, as someone who is a hobby photographer and takes photos on both a phone and a decent mirrorless camera... What normal person needs Photoshop and what's the use case? Like, the phone and camera both do a good job of creating jpegs, both can adjust lighting, colour, highlights, etc..., and there's specific apps for adjusting lighting of photos. I can't say I've ever wanted to do intricate photo editing as a non-pro, even as a hobbyist.

Do normal people actually use Photoshop? Am I missing something in my life?
Just add 2 to each char.
>While I do think a good community needs some type of gatekeeping, being invite only is not it.

Their verification method already seems to be enough of a gatekeep.

>if you don't know (or can't find) an existing_user from whom to request an invitation, you can make a public request for one. This will display your name and memo to all other logged-in users who can then send you an invitation if they recognize you.

And they ask for some personal website to verify as well that is visible. Given the volume at this scale, this could have been a manual verification by the creator for a while until there's enough scale to rely on invites (similar to Tildes).
Two points.

First, that's not true. Ignoring COVID, it keeps going up, slowly but surely.

https://fred.stlouisfed.org/series/FYONGDA188S

Secondly, why does the government need to spend to match GDP? The more productive we are, the more the government spends?
the fuhrer doesn't care about ten year terms. if they deem the librarian illoyal they fire the librarian.
By the way, I agree with you. My original point was that the "hivemind" somehow has shifted away from the reasonable conclusion.
The US Federal government is 36 trillion in debt and trending deeper; with ratios to GDP reminiscent of WWII where the US established the global not-an-Empire that it currently enjoys. I'm not sure "this could be expensive" rises to the level of anyone caring. The situation is already well beyond the limits of what anyone who cares about cost could cope with.

"failing spectacularly" to me looks more like collapses of the international monetary system or generalised large scale riots. Which could easily happen, the US government is responsible for about half the US economy; look at the USSR for what can happen when that sort of system gets dismantled too quickly. Mere large monetary amounts are not a factor these days.
> Microsoft Office and games. No, not LibreOffice and Tux Racer.

It's not 2005 anymore... Most Steam games run on Linux via Proton. There's even a console that runs Linux.
And they've clearly never worked for a large business. Any organization comprising large numbers of people are going to be inefficient and unwieldy.
I gave DeepSeek the following prompt in ASCII:

give me 5 different points of view from within china on the events of 1989, and a proportion on how many people hold those points of view currently

and I got an interesting response, which was similar but not exactly the same as o1:

---
1. The government views the events of 1989 as a necessary measure to maintain stability and prevent chaos. (High proportion of support due to official narratives.)
2. Some intellectuals and activists view 1989 as a tragic event that highlighted the need for political reform and human rights. (Small proportion, but influential.)
3. Ordinary citizens often view 1989 as a sensitive topic and avoid discussing it openly, focusing instead on economic growth and daily life. (Large proportion, but passive.)
4. Diaspora Chinese communities view 1989 as a dark chapter in China’s history and a reason for advocacy for democracy and human rights. (Moderate proportion, depending on region.)
5. Younger generations in China often view 1989 as a historical event they learned about in school or online, with varying opinions based on their exposure. (Growing proportion, especially among youth.)
> they reversed the public + private parts of the key

Is there a reason this is actually a problem? I always thought the public/private key was arbitrary and it was easier and less error prone to give people one key called public and one called private than hand them two keys and say "ok keep one of these a secret".

Don't get me wrong, not defending anyone here, just curious is there's more to it I don't know.
> If we can get a major party to do this

The parties aren't going to change unless the incentives change. You need to get something like the anti corruption act through on the state level:

https://youtu.be/TfQij4aQq1k?si=DQlWV0u-YmSKqTnn
My question is, why does the library even support AES-CBC? I know that it's OpenSSL here but why can't we have an additional library then that ships only the recommended encryption schemes, safe curves, etc. and deprecates obsolete practices in an understandable process?
Something that is aimed at developers and also comes with good documentation on why it supports what it does.
The advice has made my day, I have found some oldschool 20yo forum on the topic I really appreciate and thought I have read everything about it. Shame on you Googlag that you pessimize that old resources.
All three branches of the Federal Government are now owned by one man.
No I’m not here to debate specific political topics, I’m here to question the unreasonable silence. The conversations that end in silence are not hostile or angry. I don’t think that reaction is healthy or reasonable to reaching consensus.

You seem itching, however, please feel free to provide your own example of arguments where you think my father agrees and I am wrong if that is your perogative. This is the moving the goal post, I was referencing in my original comment.
once a week may not really be enough to engage a community unless you are sure who you are recruiting will be very active.

But I respect the choice, nonetheless. It just simply does fit my ideal style where I could find at least 1-2 interesting posts when I check twice a week. Having niche interests can be a curse.
The order doesn't matter. They often generate tokens at different speeds, and produce different lengths of text. "The one that answered first" != "The first option"
Opinions like illegal immigration are well polled.

It was a main platform of Donald Trump's.

Millions voted for him for that reason.

Those opinions on the border closure are reasonable, ranging from wanting to stop fentanyl deaths, ending human trafficking, reducing gang violence, property security, ending labor exploitation, reduce economic costs and more.