skysight-inc/HackerNews huggingface dataset:
Cybersecurity != security in the technical/mathematical sense. It's related, but not the same.

For businesses, cybersecurity is (like everything else, ultimately) about minimizing costs related to digital threats. That is - any threat scenario can be modelled as T*D, where T is "how likely it's going to happen (per year)", and D is "how much it'll cost us when it does (per incident)"; the result is the expected yearly loss, denominated in dollars. The less of it you have (integrated over all scenarios you can think of), the better, but prevention and mitigation also cost money, so what you're actually minimizing is the (expected loss + mitigation costs); i.e. makes no sense to spend more on improving something than it'll save you.

The reason for this exposition dump is: actual security at the technical level is one of many ways of improving TxD, and usually is neither cheap nor the most interesting one. It's also mostly focused on the "T side" (minimizing risk of an incident), which is harder to move than the "D side" - reducing impact.

The service an authentication company is selling is not "cryptographically unbreakable authentication". What they're selling is roughly: "low-T auth sytem cheaper than you could build&operate yourself + if it breaks it's our fault". That is, more than lowering "T side", they're offering to let you shift part of the liability to them, which significantly lowers "D side".

Internally, how they do it is up to them. But there's only so much need for technical security experts - you obviously can't sell a broken system (everyone has to at least pay a lip service to real security, otherwise people get angry, politicians get interested, and costs start to multiply rapidly), but eventually, it's cheaper to focus on your ability to take on liability from your customers and discharge it somewhere else, which involves improving operations, customer service, etc. - all the stuff you need regular, non-security-expert programmers for.

Note the bit about discharging liability. After working in cybersec and GRC for a bit, I realized security is best understood in terms of managing liability (which corresponds to minimizing the D part of TxD from earlier). That's the primary product of most security service companies, as well as security frameworks and associated compliance audits. They do improve the technical side somewhat too, but that's not why those things are bought. They're bought so, when something happens (something eventually always happen), you could point at the SOC.2 audit results and a string of security contracts and say, "we've followed all the best practices, there was nothing more we could do; crime happens, not our fault" - and have the liability flow down the contractual agreements to other companies, which do the same, until, like spring rain flowing down the mountains, into rivers, into sea, it all gets turned into insurance payouts in the end :).

Might sound cynical, but it's probably the right and reasonable thing to be happening 90% of the time. Shit happens, criminals be criminals, opportunity costs are real, etc.
> And if you still doubt me, remember: The two most popular operating systems in the world, iOS and Android, do not have windows.

You have to keep mobile and desktop OSes separate. Mobile OSes are for use on-the-go and mainly focus on content consumption and getting most out of a pocketable touchscreen. Desktop OSes, in contrast, are for productivity. People understand browser tabs, how would a tabbed chat window be so fundamentally different?

> Modern email clients also follow this design paradigm.

Email clients are different. You don't usually jump between messages/threads back and forth like you do all the time in IM clients when you're actively chatting in several conversations at once. You open them one by one, read them, and go do something else after no unread emails are left.
Also interesting that they don't mention Cloudflare R2 at all—guess they want to double-check the cause.
> invent other ways

Just turning off some features gets them just about there. It wouldn't take rearchitecting things. Those features being bundled by default means very little for the difficulty.
I think you should re-read what they wrote. Asserting that you're part of a group of people who agree with you (aka conformism) is what they're saying is common in places that hate intellectualism and are scared of individualism. You're kind of just doing what they said you'd do.

Not just that, but your post is almost a perfect example of the attitude which most of the Germans in the book "The Germans 1933-1945" ended up regretting, if not on moral grounds, then after it led to the destruction of their country.
The distinction that i think is important to make when talking about "the bitter lesson" is that improving the compute and training infrastructure and tricks in the abstract wins over intelligent model and system design.

Its more about the information about the specific problem you are solving having less impact than techniques that target the compute. So in this case, breaking down how to parse a PDF in stages for your domain is involving specific expert knowledge of the domain, but training with attention is about efficient use of compute in general; with no domain expertise.
>Beside i don't know what you do with chicken corpse in city, you aren't going to put it in recycling can.

You do with it the same thing you do with a turkey carcass after thanksgiving: throw it in the trash.

"City folk" throw away meat trimmings, spoiled meat, or other meat products in volumes greater than a single chicken carcass every day.

Put it in a bag, put that bag in an another bag, and throw it away. It isn't magic or esoteric wisdom.
Lightning Talk: Podcast Feeds
AI-generated Answers experiment on Stack Exchange sites
Also motorcycles/scooters. Unless you have children or live in a place with serious snow a motorcycle and a car sharing app/rentals for when you need to haul a sofa or something is a great combo.

Cheap, easy maintenance, good fuel economy and speed, traffic jam immunity..
RE ".... America desperately needs more air traffic controllers ....." or THE TRAFFIC at some airports NEEDS TO BE LIMITED to SAFER levels ....

I'm looking at the recent airport crash of the Helicopter and plane as an example of where traffic should be limited. Must be other over busy airports too...
pulling dockerhub images also returns 500, so i am assuming this is the cause?
Looks like we have logged the first errors at 08:12 UTC and the status page has the issue at 08:34 UTC.
Meh, pretty basic. Most SaaS businesses have something like this in place already.

Closing inbound leads is relatively easy, since they've already shown active interest... The challenge I'm struggling with is (cold) lead generation: finding leads (and how to contact them) that match well with the service you're offering.

There are a lot of dubious scraping tools and B2B lead databases, but I feel like it should now be relatively easy to build a reliable web crawler & lead generator ... Does anyone know state of the art open source tools or services for this?
Sciter is great but is also just a minefield of bugs and quirks. And its main developer Andrew is too stubborn to realize why it's not popular because he refuses to hire an evangelist that would take care of its missing ecosystem.
RE "...The first time a plane goes down carrying a dozen congress critters and ...."

Is it realized it almost happened in the recent helicopter / aeroplane crash. As it was said the helicopter was used for moving VIPS ....
Never heard "Oggs" so ymmv.

Fully agreed on the hw support though. I had an mp3 player discman knock off, later cheap mp3 players and none of them played Ogg Vorbis, I want to say one of my Nokia dumbphones in the mid 00s could do mp3 but not Ogg Vorbis as well.
You realise this works both ways? The average left leaning person doesn't have 700 pronouns and isn't calling for a communist revolution. They're not paid by Soros. They don't have blue hair and have a meltdown at the slightest upset.

The online charicatures are just that. In both directions.

Real talk though: the US, via the current administration, is trashing its international reputation. With tariffs and lashing out at (former?) allies. Or with Musk demanding regime change in the UK, for instance. On a personal level people will still be chill no doubt, but you should be prepared for some negative attitudes towards the US if things continue unabated.
Really looking forward to that one.
Thank you, I'm a bit surprised people took issue with my comment but I suppose I could have worded it better.

As for your case, I wonder if Okta is relying on an external service like IPQS to get a score, that could explain why they don't really have any control over it.
GitHub Copilot Down?
https://en.wikipedia.org/wiki/Santa_Susana_Field_Laboratory#...

https://en.wikipedia.org/wiki/Jackass_Flats

https://coloradosun.com/2020/12/29/grand-junction-cold-war-n...

https://en.wikipedia.org/wiki/Radioactive_contamination_from...

https://en.wikipedia.org/wiki/Windscale_fire

https://en.wikipedia.org/wiki/Kyshtym_disaster

https://www.gw2ru.com/history/3317-kyshtym-accident-radiatio...

https://en.wikipedia.org/wiki/Andreev_Bay_nuclear_accident#A...

A Time-Lapse Map of Every Nuclear Explosion Since 1945 - by Isao Hashimoto

https://www.youtube.com/watch?v=LLCF7vPanrY

or https://www.arcgis.com/apps/Time/index.html?appid=b8540a8a25...
Thank Google. There is no way they'd implement blanket config. Therefore neither will Firefox.

Lack of competition for you. Very American, not very EU.
But that should be the goal. Using skin color as a proxy for being disadvantaged works only inasmuch the proxy is precise enough. If it's not, it's just another bias.

If you had a better metric that can be used to help people from marginalized cummunities, wherever they happen to be, you should be using those if the goal is to be more inclusive, more diverse and more equitable.

But the problem is that the very same psychological mechanisms that drive racism are the ones which drive these modern attempts at fixing racism.

I think there are two different but related angles at play:

1. Historical injustice. Racism against black communities in the USA has such a long and disgusting history that when new generations learn about that it's understandable that people want to wash that away and find ways to make amends and counterbalance things.

2. Since we live in a world where skin color is a visible marker that you literally wear on your skin, there is a sense that you're just being disadvantaged for being you and thus you need a more-than-normal counterbalance to set things straight.

We thus ended up in a situation where we destroyed the aspirations of a truly color-blind society. We need to keep reminding ourselves about the fact that color matters.

This is not helping defusing racism. This is feeding racism because despite the best intentions it operates in the worldview of racism.

Of all the words you Americans have purged from the language you kept the word race, a word that post WWII many European nations successfully defused.
I don't think it's the default. Lots of people think about what they do, in my experience. If you think ICBMs are purely bad, fair enough, but I imagine lots of people believe they - particularly when not fired - perform a vital defensive service, and are worth working on for that reason.
GC is bad because of memory fragmentation due to pointer aliasing. (Not GC pauses per se.)

Theoretically you could have a GC'd language that cared about scope, lifetimes, stack vs heap and value vs reference distinctions, but no such thing was ever seen in the wild. (Perhaps because people use GC'd languages precisely because they don't want to care about these distinctions.)
>In theory if DEI was about being race, sex, gender, sexuality, age blind, it wouldn't be controversial.

I think it would, there is a substantial contingent that wouldn't even like that.
Yeah but remember kids "regulations = evil". If apple was forced to allow porn what's next? We'd probably end up in a communist dictatorship or something equally terrible
Perhaps strategy because they want people to use their ecosystem. Which I would wholeheartedly not recommend because you become instantly dependent. Tech companies aren't banks and should not be trusted with access information aside from that to their own services.

They probably will lobby a lot around allegedly superior security of their solutions but this is only real security under a warped perspective neglecting important factos.

User owned password safes are still the better solution and services that do not allow for password authentication are to be treated with caution.
That's what brought me here. Seems to be resolved now
Isn't a hash map supposed to already be internally hashing the string for you and correctly handling collisions?
First we have to make sure we're talking about the same thing. There are "active record" ORMs (like Django, Ruby on Rails, etc.), there are "data mapper" ORMs (Hibernate, SQLAlchemy etc.), then there are things like LINQ which are not ORMs at all but merely SQL generators (but you could build an ORM with it if you want).

The arguments against them, I think, are most strong for active record and much less strong for data mapper.

The problem really is complexity, aka coupling. An active record ORM naturally pervades an entire codebase that uses it. People pass around these "objects" that are really just thinly-veiled database rows. But that's all they are. They are at exactly the same abstraction level as the relational database itself, they just look like objects. But in fact they are filled with footguns because accessing those attributes could trigger database requests.

So you'll see business-level code written that has to "know" about the ORM and "know" about N+1 queries and therefore essentially "know" about SQL and the underlying relationships (or, conversely, data access layers that have to "know" about the business logic, e.g. "I know this logic needs to access this bit so I'll prefetch it"). So you're not really gaining anything. These ORMs are the complete opposite of a good software architecture that gives you flexibility and ability to reason about components in isolation.

A good data mapper ORM at least lets you map data from relational tables to real objects. That way you are able to build a new abstraction layer upon which to write business logic etc. A programmer writing those business rules should be able to fully write and test logic with no knowledge of the ORM at all. But in active record projects you'll find each and every developer has to have the full stack in their heads at all times.

I would be interested to know if there are strong reasons to avoid data mapper ORMs too.
It should be noted that it's not even sure that people could survive with such low gravity for a truly long time, or at least thrive. It could be that various parts of the body get weakened to a point that is even dangerous in the low gravity conditions (for example, you might find that you get a bone fissure in your leg every time you bump into the bed corner).

Also, it's not at all clear that people could procreate and (especially) have a normal pregnancy in very low g conditions. We have nowhere near the kind of understanding of the gestational process that could allow us to know for sure before trying it out.
Account created two weeks ago, posting pretty much only right-wing propaganda comments.

A bit suspicious...
I'm slightly surprised that no one has suggested PDP-11 assembler as a good starting point if you're not going to learn a current instruction set. Perhaps it's because it was the first one I learnt properly but all the early miccroprocessors felt like a step backwards. I did spend a few years writing Z80 assembler but I wouldn't recommend it nowadays as it's not a very orthogonal instruction set and 6502 doesn't have enough registers to give you a proper feel for writing assembler.
> stereotype [...] innuendo [...] slippery slope

No need for histrionics, it's simple: Someone doesn't need to actively desire a terrible outcome to be morally culpable of making bad choices, ones they should-have-known would enable or encourage it to happen. Multiple such people can and do form groups.

It's not limited to politics either, which is how we get idioms like "playing with fire."
Just want to add that, while Reddit is a huge time sink, it is pretty easy to just see the good parts of it:

- Mute any subreddit you do not enjoy

- Generously block any asshole in the comments

- Subscribe to the subreddits you do enjoy

- Create one or more themed multireddits of the subreddits you enjoy

My Reddit experience is cheesy feel good clips, cool videos of skilled people or weird occurences, funny niche humor and nerdy niche hobbies. No drama.
Going by the most reliable thing, which is history, jobs will only become more abstract and more "fake busywork". As more and more of the real things gets automated, we moved to abstract things on top of the real ones. Managing the people / machines that do the real things for example. When you automate the second layer, the follow-up for me isn't "we'll go back to doing real things", but more like we'll create yet another layer on top and it'll suddenly be a very important new layer of work that "we must do".
You should consider https://news.ycombinator.com/active the real front page.
We haven't tried that, we might do that in the future.

My intuition - not based on any research - is that recall should be a lot better from in context data vs. weights in the model. For our use case, precise recall is paramount.
> I just want to appreciate how well written and thought out this was

Cath church is well famous on writing good things and then failing at putting them in practice.
It took up to 1992 to see an official pardon to Galileo Galilei (1564 - 1642) we are still missing few words on people like Giordano Bruno, killed with fire because he dared to speculate of life outside of earth.

I personally find this piece of text over closer to a philosophic rant rather than an accurate analysis of the current situation.

> The commitment to ensuring that AI always supports and promotes the supreme value of the dignity of every human being and the fullness of the human vocation serves as a criterion of discernment for developers, owners, operators, and regulators of AI, as well as to its users. It remains valid for every application of the technology at every level of its use.

this is being said by the organisation who decided american natives were lacking souls and therefore could be killed, the very same organisation who helped promoting slavery across the world, in the 2nd world war worked together with nazis and it is well known it supported far right governments in south america in the 1970's .
the very same organisation against promoting condom use in Africa to prevent and contain AIDS .

> 54. Furthermore, there is the risk of AI being used to promote what Pope Francis has called the “technocratic paradigm,” which perceives all the world’s problems as solvable through technological means alone.[106] In this paradigm, human dignity and fraternity are often set aside in the name of efficiency, “as if reality, goodness, and truth automatically flow from technological and economic power as such.”[107] Yet, human dignity and the common good must never be violated for the sake of efficiency,[108] for “technological developments that do not lead to an improvement in the quality of life of all humanity, but on the contrary, aggravate inequalities and conflicts, can never count as true progress.”[109] Instead, AI should be put “at the service of another type of progress, one which is healthier, more human, more social, more integral.”[110]

TL;DR yes you can use AI but for few things, for other matters please refer to your local community priest
Password hash functions are designed to be slow, are designed to be use with salts, and may have low entropy inputs. Being slow is a waste for (true) KDFs, salts aren't relevant (although nonces may be), and are designed for high entropy inputs.

The naming overlap between the two is bad, so the industry has tried to move towards naming the two differently. Password hashing functions are not ideal KDFs, even though a particular primitive may be secure for use as a KDF. That's a root of some of the confusion.
Tried any of these?

https://www.perplexity.ai/search/mac-alternative-to-shush-Tx...
We do, but people are maximizing utility and not minimizing costs.
SEEKING WORK | Amsterdam, London or Stockholm | Senior Full Stack Product Engineer

Remote/Hybrid: Yes

React Router Framework / Remix, Supabase, Deno, Node, TypeScript, Python, Fly.io, CI/CD, Testing

linkedin.com/in/larswo

Hi! I can help you launch a great product fast! I have 10+ years of full stack experience, working in elite product teams for reputable companies. I take a product-engineering approach, able to iterate to great UX and find engineering solutions that works for users and business.

I can work on-site in cities above and hybrid anywhere else.

lars@productworks.nl
on one hand: applauds ingenuity

on other hand: gapes at major security hole in PDF, wonders why this is defacto document type in industry for reading
This is one of the problems with voluntary redundancy, which is quite common in some countries. You do tend to lose the people who can easily find jobs elsewhere and get left with the people who can’t, so it selects for a less skilled workforce when all’s said and done.
The topic of the 6502 ISA simplicity is a pet peeve of mine, because to me it's clear that anybody thinking that such simplicity is a good thing, never progressed past a hello world.

Programming anything of moderate complexity on the 6502 is hard. 8 bits are way too restrictive (e.g. screen addressing on the Commodore 64). Multiplications/divisions need to be hand-rolled. And even 16 bit sums/subtractions are simple but still not trivial to perform efficiently.

The 8086+DOS platform is way easier to work on, in comparison (if one wants to learn basic assembly).
That's assuming people like Altman can keep artificial superintelligence under human control. It very well may escape control and humanity would be disempowered forever. Or worse, wiped out.
Property Prices in Peril
I mean, they won’t last forever. Sooner or later someone is going to have to clean up the mess.
Update - seems like it's back up? (status page not updated though)
Seems to be resolved now, requests and listing works again overhere.
I'm not in sales, but I imagine the customer attention is a limited resource in this scenario. If you create a fast, cheap and reliable way to generate leads, you'll saturate the market very fast. It's not really an edge if everyone uses it.
I have dealt with traditional ML models in the past and things like tensorflow non-reproducibility. Managed to make them behave reproducibly. This is a very basic requirement. If we cannot even have that or people who deal with Gemini or similar models do not even know why they don't deliver reproducible results ... This seems very bad. It becomes outright unusable for anyone wanting to do research with reliable result. We already have a reproducibility crisis, because researchers often do not have the required knowledge to properly handle their tooling and would need a knowledgeable engineer to set it up. Only that most engineers don't know either and don't show enough attention to the detail to make reproducible software.
Congratulations, you've reinvented HTML 1.0! With if/else you're almost at DHTML.
> almost never I good idea to assert in a library, unless the error is truly unrecoverable

Like getting an input that is too long? :)

I think a library asserting that the preconditions of its arguments are true is fine.