skysight-inc/HackerNews huggingface dataset:
For local communication Microsoft Visual Studio Code often uses TCP sockets (bound to localhost) even though UNIX sockets are available. What's more, old versions used to pass the authentication token as a command-line argument, exposing it to all users on the system.

I wonder how many other security disasters it contains that nobody has discovered yet.
You read the article right?

VS Code has inherent security concerns due to the dynamic and unbounded nature of JavaScript combined with the attack surface introduced by its extensibility and web-based architecture. Electron (the JS interpreter used) has a dynamic web-based attack surface. Even if you mapped it out, it can change at any time thanks to the changing nature of JS standards.

Furthermore, the security issue with extensions in VS Code is well documented. And the obvious bit is it's executing code sometimes, arbitrary user code and extension code. Telementry, etc. are built in. It's really up to the user to use it in a secured manner. A lot of people just don't consider this.
I propose Solaris.
Further discussion: https://news.ycombinator.com/item?id=41993801
> no client of their cares because their identity systems are so messed up, that it's better to have the mess of Okta, than the mess they are sitting on

Yes, this is very true.

Also some companies realize that they can screw up royally because they do no have the proper knowledge, and authentication is not a core business of theirs.

I can understand them. I also use mail systems I am not that happy with, but I have this comforting idea that if they have a problem, 3B people are waiting together with me for it to be solved, and that's the kind of pressure that helps.
So a shopify and woocommerce aggregator?
Most of the ethno-nationalists are born here.
In a similar vein: it turns out councils are only liable for pothole-related damage if they know about the pothole - i.e. if it was reported or they found it themselves. Maybe fair enough.

But the county of Gloucestershire fixed the issue by ceasing all pothole inspections. If they don't know about them, they aren't liable.

On this basis, they reject 97% of all claims.
> NeXTSTEP was based on UNIX, because Steve Job wanted to win the workstation market against Sun, using UNIX compatibility as EEE, bringing folks into NeXTSTEP and keeping them there with Objective-C development experience, Lotus Improv, Renderman and such.

So Embrace, Extend and Extinguish?
I'd like Java to add support for the null coalescing operator `?.` and associated `!.` and `?:`. -- I find this easier to use and read than using Optional or null check code.

I find heavy use of Optionals for nullable values can quickly overwhelm the codebase and make it hard to read the control flow. Especially when interacting with other parts of the codebase.

E.g.

var baz = foo?.bar?.baz ?: return false;

vs something like:

var baz = foo.map(f => f.bar).map(b => b.baz).getOrElse(null);

or using `then`.
The first time I've actually checked what kind of bloat VSCode brings to a server, I stopped used it this way. No deep inspection, just in sake of Occam.

Long forgotten mutagen works much cleaner, although requires a bit of a setup.
To me at least it looks like it's throttled on a single core https://kalleboo.com/linked/opnsense/vmstat.png

Vs Linux/OpenWrt which still has somewhat lop-sided CPU usage https://kalleboo.com/linked/opnsense/openwrt-htop.png

The CPU is a Core i3-8100T, which should handle it fine based on that CPU benchmark site
Sure, but the parent comment was aimed at the western side and not at the Russians. The West did everything it could to ignore and deny Russians growing hostility because it would have been inconvenient and maybe it would go away somehow.
Taxes don't pay for things at all in a monetarily sovereign country. The spending happens from new money creation. The tax (among other things) is about resource liberation to prevent inflationary pressure.
No idea. All I know is whenever I try to execute the module in e.g. VS Code's debugger, it somehow triggers the attack and enters a de-facto-endless 100%-CPU-load loop.
erm, you mean harry potter tom riddle's horcrux diary, sure

you know, the diary that wrote back to you and possessed your soul? that cursed diary?
> I distinctly remember seeing some program that was named something duck-related but for the life of me I can't remember any other specifics

cyberduck - https://cyberduck.io/
> so it isn't a restriction of your freedom of speech when you choose to seek out and repeat somebody's very particular text.

I hadn't made that claim, but I will in now that you've brought it up. Art operates as part of a discussion, the reference to and re-use of prior art is a key part of the how that happens. There are sooo many cases of copyright being used to limit the freedom of expression, that this really isn't disputable. Copyright clearly restricts speech.

> By choosing the one that's already written you accept that the author has done work for you.

No I don't, at least not in a sense that's different from the shoulders of all the people that author learned from and so on. Cultural works exist and take on roles in our cultural semiology, our memes our language without our choice. You can coose to not engage with a work, but you can't choose which works will be culturally relevant or not.

When you publish something, it becomes part of our shared culture and no-one has an inalienable right to own that. The limited rights we granted to encourage commercial creativity have already snowballed out of control and now people are blythly buying into another dramatic expansion of them.
The '-g' flag is obsolete. Somehow it got into my new docs. The right way is to use '-ma' flags where '-m' is for matching the whole string and '-a' stands for all the outputs.

You got the idea correctly. E.g. to generate all strings of length 5 over alphabet 10 (and truncate to 10000) you can do:

echo '' | ./trre -am ':[a-c]{5}' | head -n 1000

The docs are fixed now. Thanks for pointing this out.

The infinite generators is something nice to have, I agree. Just didn't wrap my hand around how to do this in 'ergonomically' correct way.
> Thus, learning Mandarin by reading requires first memorizing hundreds or thousands of words, before you can even know where one word ends and the next word begins.

That's not been my experience at all: As long as the content I'm reading is at the right level, I've been able to learn to segment as my vocabulary has grown, and there's always only a few new words that I haven't learned how to recognize in-context yet. Having a good built-in dictionary wherever you're reading (e.g., a Chrome plugin, or Pleco, or whatever) has been helpful here.

My fear would be that the longer you put off learning to segment in your head, the harder it will be.

My advice for this would be that you present the text as you'd normally see it (e.g., no segmentation), but add aids to help learners see or understand the segmentation. At very least you could have the dictionary pop-up be on the level of the full segmentation, rather than individual characters; and you could consider having it so that as you mouse over a character, it draws a little line under / border around the characters in the same segment. That could allow you to give your brain the little hint it needs to "see" the words segmented "in situ".
> I just don’t understand where they went wrong on curtailing free speech rights of their citizens, privacy rights, etc.

Security establishment's innate desire to read and listen to absolutely everything. Blair/Bush's war on terror. Id card proposals. Smart phone use sky rockets. Supposed E2E comms. Hate speech. Something must be done! Right wing policies on pretty much everything cause more protest. Tories criminalise (*some types of) protest. Labour government raises TCN to Apple.
Where we lived the road was very country, grass up the middle etc. A gas company went to put mains gas in, and they made such a bad job of the road it was almost undrivable. The council actually made them go back and resurface it fully, after that the road's one of the best around, certainly for the size of it.

The damage that gas company did to it and the state they left it in after putting the gas in though was atrocious.
> and it works well for my case

Yes, if you're using a Microsoft (c) approved and tested system configuration.
The cause: while trying to block a phishing site they accidentally turned off R2.

I am not joking. Check the blog.
I think that's a stretch. The nations with the best road/transit systems and the most law-abiding drivers are invariably the most prosperous.
Baltics disconnect from Russian power grid, start isolated operation
In UX, there is nothing intuitive, only familiar

Although have you seen that video of a chimpanzee browsing Instagram?

Or a parrot using zoom?
Threatens his fragile sense of masculinity, one assumes.
Trash fires are definitely a rare occurrence in Tokyo, the bigger chaos generation is some bird poking at a trash bag and causing stuff to fly all over.

Though apparently there are about 50 trash truck fires a year? Mostly from batteries in the trash of course…
To me, the question is why we keep using PDFs that never get printed?
> the White House recently took down its paper about the future of programming being memory safe

They took down all of https://www.whitehouse.gov/oncd/, what makes you think they gave any thought to this paper in particular?
You're comparing the actual intent of one side of the argument to a watered down version of the other side. "I will do anything in my power to stop this" is the stated intent of sabotage, not "I'm vocally stating my opposition to this" If someone said "I will do anything in my power to stop Linux development to proceed without Rust integrated into it", then yes, that would sound like intent to sabotage, but that's not anywhere close to what anyone is saying.
They wrote "compromised" not "buggy". There does not have to be any bug. It can all work as intended... by an attacker!
Here's my quick and dirty recipe for many things including peppers, carrots and kale/collard/mustard greens:

- 3 tablespoons salt to 4 cups non chlorinated water. (for greens I boil a handful of rice in water, discard the rice, add a teaspoon or so of sugar and use that water w/ same salt ratio).

- Cut up the veggies and pack them in a jar. No thick pieces (like a whole carrot is too thick, a carrot stick like your mom may have given you as a child is fine).

- Put a weight on top of the veggies to keep them submerged. A ziplock bag partially filled with water works or they sell special weights and spring loaded jar tops for this.

- Don't seal the jar, gas will be produced. Cover it with a cloth if you like although usually the baggie weight is covered enough.

- Leave it room temperature for about a week. 4-5 days is usually enough but longer produces a more sour taste. I've gone 2 weeks plus no problem.

Put it in the fridge (drain some water if you like), keep it sealed (no air) and that is it. It's pretty simple at the end of the day. Some people weigh things and add 2% salt by weight of veggies/water and there are other methods, but what I listed is how I do it and it works. Key is to keep veggies submerged.
How USAID and Its $50B Budget Became a Target for Reform
Get rust out of the kernel, now! Rust as a language is meant to be the output of an llm which can be verfied by humans.
Just curious, you didn’t use the e-invoice solution (載具）？
Agreed. Boot camps tried to fill the void. Some were great, some were not, like anything. Most of the boot camp grads I worked with were good juniors with real world experience to bring to the table (designers, writers, etc). But, in general, the disdain boot camps were met with by many engineering orgs spoke volumes for how little value people place on junior engineers. If you won’t train people, and you won’t accept graduates of job training programs, it’s hard to see how you can ever have a sustainable pipeline. Many people would seemingly rather spend billions training AI than training junior engineers. (For the record, I don’t view these two options as exclusive)
PhD system needs to go. For the 10% of superstars who need to do cutting edge research at a university that isn’t feasible in industry, it’s indispensable. But for the other 90% of graduate students it’s an intellectual serfdom scheme. You work long hours for net minimum wage and the credit goes to your boss. It is my sincere hope that deep research AI will make this corrupt system untenable for future generations.
Also that hard work and touring often took a heavy toll on them. Some musicians didn’t survive that life unfortunately
I tried mtr (I usually use ping and traceroute). 87% packet loss at my router and the next hop, then 0% loss. WTF I say to myself and uninstall.
Why wouldn't it be? OpenAI and Anthropic keep everyone's prompts and use them for training too
Indeed, and that's exactly what the Rust for Linux guys are doing. They have Binder, multiple changes with various degrees of dependency on newer compilers, support for different kinds of drivers, and they are extracting them and sending them to Linux in small bits.
The workers on whose work the thing was trained, too
Why do UK supermarkets have clock towers? [video]
This isn't even just your read of it; as other people in this thread have pointed out, he's pretty explicitly stated it at this point.
It’s a little bit more nuanced than this. Your parent commenter is wrong, by the way.

Suppose you want Rust, just not a single Rust driver using PCI. But CONFIG_PCI and CONFIG_RUST both selected will cause the PCI abstractions to get built anyway, even if not a single driver using them is selected. Then if the PCI subsystem introduces a change but the Rust counterpart fails to follow it fast enough, the build will break for the kernel as a whole.

This was illustrated with an example in that email thread.

I have some sad experience with polyglot projects. Unless you enjoy pain and drudgery, it’s an extremely unrewarding thing requiring very careful treading.
> JSON parsers discard whitespace information outside of JSON strings, but that only works because JSON has an explicit string type. In HTML everything is a user-visible string unless it's a tag, so the same logic fundamentally can't be applied.

Well, sure. The point is that's an unfortunate design.
In fact I recall a study (I saw on HN I believe) that showed that IQ is only correlated up to a certain value (not very high, I.e. Lower upper middle class IIRC) but then becomes quite uncorrelated. This certainly matches my anecdotal evidence that most of the rich kids during school were not very smart. The smart ones were typically the kids from academic middle class households.
I'm making a simple service that outputs layout-following ASCII from images, PDFs of images or text PDFs. I too think the risk of hallucination is in many cases too great.

I fed my system the first image in the post [0] and got the text below in return.

I will be looking for beta testers next week... Email if interested!

VEH YR MAKE MODEL IDENTIFICATION TYPE SYM ST TER USE CLASS ALARM
2 02 HOND CIVIC EX 1HGEM22952L086006 PP 18 IL 37 L 887120
LOSS PAYEE THAT APPLIES: 2
3.02 HYUN SONATA / GL KMHWF25S72A671544 PP 16 IL 37 P 887120

H NO. COVERAGE DESCRIPTION LIABILITY LIMIT (S) DEDUCTIBLE PREMIUM
2 Preferred Extra Auto
Bodily Injury $ 250,000 / $ 500,000 $ 92.00
Property Damage $ 100,000 $ 43.00
Medical Payments $ 5,000 $ 13.00
Uninsured Motorist $ 250,000 / $ 500,000 $ 62.00
Undinsured Motor.-BI $ 250,000 / $ 500,000 INCL
Collision $ 500 $ 141.00
Other than Collision $ 250 $ 92.00
TOTAL FOR UNIT 2 $ 443.00
3- Preferred Extra Auto
Bodily Injury $ 250,000 / $ 500,000 $ 92.00
Property Damage $ 100,000 $ 43.00
Medical Payments $ 5,000 $ 13.00
Uninsured Motorist $ 250,000 / $ 500,000 $ 62.00
Undinsured Motor. BI $ 250,000 / $ 500,000 INCL
Collision $ 500 $ 136.00
Other than Collision $ 250 $ 90.00
TOTAL FOR UNIT 3 $ 436.00

DRIVER INFORMATION
DR VEH SEX MAR BIRTH G / S PRIN DVR LIC NO. NAME PTS

[0] https://i.imgur.com/sLWQoFG.jpeg
The grammar is underspecified. The full grammar is more complex. I guess I need just remove the current version from docs. Now it is confusing indeed.

> Why is "c" not being replaced with "da"?

It is all about precedence. According to the discussion I think I've chosen a wrong one and it raises confusion. Current version of precedence table is this:

| 1 | Escaped characters | \<special character> |
| 2 | Bracket expression | [] |
| 3 | Grouping | () |
| 4 | Single-character-ERE duplication | * + ? {m,n} |
| 5 | Transduction | : |
| 6 | Concatenation | . (implicit) |
| 8 | Alternation | | |

So the ':' is stronger then '.' (implicit concatenation).
As if Trump cares about precedent. It makes no difference.
> there is no way to have a "half-secure" kernel.

There is, and this is how Rust naturally works. If you look at its standard library, you will see a lot of unsafe code or libc calls hidden away under safe interfaces.

In fact, this is how all memory safe languages work, including Java, Python, etc: A small trusted base written in an unsafe language that exposes a safe interface (i.e. the interpreter, the JVM, etc), with the large majority of the code written over that safe interface (i.e. the Java/Python code).

Rust is used to make kernel drivers secure by providing a safe interface for them to use.
Once, and in context it was "Tim [at] Apple", because he loves to name drop like that." Any future mentions of Tim Apple by the president are tongue in cheek.
Bash is not running though. You might get a Bash session once you connect via SSH, but it just sits there waiting for you to input commands, while the VS Code installed agent thing does network stuff on its own iiuc. Bash is not acting as a server, afaik.
While there is right wing angle into this, I feel it might be just because Twitter does not want spend extra resources on handling government requests. Twitter is making losses, so let's not increase cost.
Thank you! Still a lot of work to do. I really like the jq style.
How does tramp make my autocomplete work seem I need to build on the remote machine so all the paths are in that file system?

How does it execute the exact version of clangd that is running on the remote not my local laptop, desktop, or windows machine I’m using to remote in?

How well does it search through files on a slower connection when it has to download every byte of every file?
Anthropic says

> To date we have not used any customer or user-submitted data to train our generative models.

https://www.anthropic.com/news/claude-3-5-sonnet

There's an obvious problem with the concept of training on user prompts; how would training on a bunch of questions cause it to know the answers?
Low quality discussions and partisan reportage. We could use a few sources which elaborate on why cutting spending is legitimate, how funds have been abused and the statutory authority of the executive over government bureaus. We don't have to agree, but we've been browbeaten with the other side's arguments all week.
You think that workers having certainty of their work hours is a bad law? What are your work hours?
The President's Statutory Authority over Independent Agencies [pdf]
so cool to hear how Hotline impacted you -- really cool.
Imagine your eye's effective integration time (the period over which it "samples" light) shrinks during a rapid saccade—say down to about 5–10 ms. Under steady conditions, our flicker fusion threshold is around 60 Hz, but that’s because our retina integrates over a longer window.

If we want to “smooth out” the PWM cycles so we don’t see discrete pulses, we need a few cycles (say, 3–5) within that 5–10 ms window. In other words:

For a 10 ms integration window:
3 cycles → f≥30.01 s=300 Hzf≥0.01s3 =300Hz
5 cycles → f≥50.01 s=500 Hzf≥0.01s5 =500Hz
For a 5 ms window:
3 cycles → f≥30.005 s=600 Hzf≥0.005s3 =600Hz
5 cycles → f≥50.005 s=1000 Hzf≥0.005s5 =1000Hz

So, to cover worst-case scenarios (rapid eye movement, bright conditions where the eye’s temporal resolution is higher), the PWM systems for LED lights should be rather in the ballpark of 300–1000 Hz than 200 Hz. Given that one would be viewing headlights some 2 meters away (impacts the what is the view angle change and speed).

And yes, what we are now seeing in cars is super annoying. Similar disregardful to user comfort can be seen with HUD displays (at least with Volvo).
Using that image and the following prompt on Gemini 2.0 Flash "please do ocr of the attached file and output ascii following the layout of the original as faithfully as possible" outputs something that isn't bad but not perfect:

PI tno Name Time 3.5 km 18 C (cont.)
MEN B (39) 3(34) 4(52) 5(53) 6(54) 7(55)
8(40) 9(57)
12(60) 13(61) 14(62) 15(63) 16(47)
17(48) 18(100)
1(51) 2(33)
10(58) 11(59)

The first column is offset vertically which mixes up information and is wrong.

I'm building a traditional OCR pipeline (for which I'm looking for beta testers! ;-) and this is what it outputs:

PI tno Name Time

MEN B (39) 3.5 km 18 C (cont.)
1 (51) 2 (33) 3 (34) 4 (52) 5 (53) 6 (54) 7 (55) 8 (40) 9 (57)
10 (58) 11 (59) 12 (60) 13 (61) 14 (62) 15 (63) 16 (47) 17 (48) 18 (100)
Finish

13 425 Peter Hodkinson 11:40 0:48 +0: 06 (21) 1:29 +0: 13 (28) 1:58 +0: 13 (24) 2:44 +0: 18 (23) 3:38 +0: 20 (19) 4:28 +0: 22 (18) 5:05 +0: 23 (17) 5:36 +0: 26 (17) 6:19 +0: 29 (19)
Great Britain 0:48 +0: 06 (21) 0:41 +0: 09 (30) 0:29 +0: 01 (4) 0:46 +0: 07 (22) 0:54 +0: 02 (5) 0:50 +0: 03 (7) 0:37 +0: 02 (10) 0:31 +0: 03 (11) 0:43 +0: 05 (20)
6:47 +0: 28 (17) 7:02 +0: 29 (17) 8:21 +0: 38 (16) 8:41 +0: 39 (16) 9:00 +0: 41 (16) 9:13 +0: 42 (16) 9:43 +0: 42 (16) 10:36 +0: 43 (14) 11:32 +0: 41 (13)
0:28 +0: 02 (8) 0:15 +0: 01 (4) 1:19 +0: 11 (16) 0:20 +0: 03 (15) 0:19 +0: 02 (4) 0:13 +0: 02 (11) 0:30 +0: 01 (2) 0:53 +0: 01 (3) 0:56 0:00 (1)
11:40 +0: 40 (13)
0:08 +0: 00 (8)

(edit: line wrap messes it all up... still I think my version is better ;-)
I don't think that's true. I think the C guys told themselves that writing safe C code is just a matter of skill, but data shows that the amount of skill necessary to avoid writing unsafe C just isn't there. The average C developer isn't as competent as they claim.

You can lie to yourself and say that the same security problems exist in other languages, but that isn't true.

When I check the vulnerabilities marked as HIGH on a JVM based project, it's often banal stuff like a denial of service in Spring. The consequences of an attack are a few days of downtime until we patch the library, but the truth is that while downtime on our application might be profitable for a competitor, it's not profitable for a black hat hacker working alone. They can't blackmail us, because we can update the library without paying them to stop.

Meanwhile the average C vulnerability is usually some form of RCE that would let the hacker install ransomware.
Another alternative is regex and use replace all. Then you cam replace the regex cat with dog (or use a group for wrapping with space)

This is a common modus operandi for me in VS Code.
Hey I think you’re missing important context and in the meantime getting a bit aggressive. Neither is helpful.

Regarding the context:

> A redundant wrapper is such a trivial mechanical problem to solve or work around,

The DMA maintainer explicitly NAKd a wrapper. He insisted that each Rust driver copy and paste the needed Rust code.

He even explicitly stated the reason was to ensure he did everything possible to keep C the only language in the kernel.
> Euro standards are 8-10A 240V circuits.

Hrm, which country is that? Something between 13 and 16 amps is normal everywhere in Western Europe that I can think of, at 230V.

In Ireland, any random kettle that you buy is likely to be 3kW (pedantically, 2.99kW); you do sometimes see 2.2kW ones, generally _very_ cheap ones.
Wanted to build my own dashboards for spend, instead of using an app, that’s basically it.

I might apply for the 載具 API at some point, but for now it works great