skysight-inc/HackerNews huggingface dataset:
That's not the program's goal.

>> The Minerva Research Initiative supports social science research aimed at improving our basic understanding of security, broadly defined. [...] The goal is to improve DoD’s basic understanding of the social, cultural, behavioral, and political forces that shape regions of the world of strategic importance to the U.S. [0]

The emphasis here is on background, that should then better inform regional DoD strategy, that will then... well, 'not screw up things like Iraq' seems a fair summary.

For the amounts, this seems like an excellent use of DoD money. Throwing military hardware and soldier time/lives away in pursuit of doomed to fail goals is expensive and often counterproductive.

Fight smarter, not harder.

[0] https://minerva.defense.gov/
Let's say a University has $1m in the bank. In this case, they decide to use it to "endow" a "chaired professorship" to retain some top faculty member. The reason it works - the professor stays at said University - is because they give the professor the proceeds from the endowment (usually, this is like 5% expected rate of return, or in this case, $50k), which he/she uses for their research.

So now, should the University instead reallocate funds like that, thus (perhaps) losing top faculty, to (marginally) lower tuition?

Similarly, imagine a university raises millions of dollars for scholarships. Once again, they use the proceeds to fund the scholarships. Should they instead use the principal (as you're kind of suggesting), thus eventually running out of funds, or should they keep the endowment, and thus keep giving out scholarships?

Before condemning endowments, it would be better to first understand how they're being used. For example, if you found out that some large fraction was for student scholarships, would that change your position?

(to be clear, I'm not particularly on one side or the other here; I just think more nuanced positions are needed...)
Deep geothermal promises to provide what is usually considered high-grade heat (800+°), but what I'm trying to understand is how cheaply you can convert that high-grade heat into electricity, because the answer seems to be "far too expensively to be competitive with wind and solar".
The csrf token is ideally tied to your session. If it's anonymous, Eve didn't need Alice to visit a page in the first place. If it's tied to a session, Eve can't create a working token for Alice.
By that argument dentistry is fake.
I'm considering moving to LibreWolf, and also promoting it in various ways, so some due diligence questions on my mind:

1. How responsive is LibreWolf to security updates? (Once Firefox pushes them out to users, how soon are LibreWolf users then also protected from the now-public vulnerabilities.)

2. Who maintains LibreWolf? Who is in position to vet Mozilla code, vet LibreWolf-specific code, modify, or release code? How are new people given these powers? What is the protection against bad actors on the team, or compromising people on the team?

3. Given some of the odd behavior in the last few years, is there a plan if, hypothetically, a Mozilla executive were to somehow cut off or sabotage LibreWolf? (For example, plan to pivot to doing a hard fork, while somehow assembling and vetting sufficient volunteers to make that viable? Or plan to rebase off some European or LatAm gov't-funded hard fork, while performing much the same third-party vetting&tweaking distro function as done now? Or plan to give up?)

4. Are there any thoughts on when it might make sense to get under the funding&governance umbrella of some tech public interest organization?

5. Any thoughts on moving to official Debian packages (e.g., a combination of the official Stable-track channels for something Firefox ESR-like, plus the Debian Backports channel for the latest browser features)?

(Please note that these infosec questions aren't intended to reflect negative impressions of LibreWolf. The reason for asking is that there are positive impressions of LibreWolf, and these are some questions to consider when moving forward.)
So I did the same thing of installing Waterfox and copying the profile over. In Waterfox, the telemetry remains disabled and cannot be activated even if you want to - the use of an existing FF profile does not enable them. I verified this by going through a howtogeek page[1] and verifying the active settings.

[1] https://www.howtogeek.com/557929/how-to-see-and-disable-the-...
Such OS should be more secure than Linux, yet it should be able to run practically all Linux apps (and ideally Windows apps, too). It should be FLOSS with a good UI and a serious developer team. Such OS exists: https://qubes-os.org. My daily driver, can't recommend it enough.
I always find it amazing, ypy get core functionality that remains broken for months.
> it will often recommend things that are already in my library.

This is going to be a really dumb suggestion, not because I think you are dumb, but because LLMs are. This happened to me the other day:

Me: "I'm going to upload a list of [things]; please suggest similar [things]. Please do not repeat any [things] on the original list."

ChatGPT°: [Blah blah blah] <List with about 1/5 repeats>

Me: "Please do not repeat any [things] on my original list."

ChatGPT: "I'm sorry, here's a list of [things] without any [things] on the list you gave me: <list without any repeats>"

No idea why that worked, and maybe it doesn't always.

°Bog-standard web interface, not an API request with a system prompt. No idea which ChatGPT flavor; I can't be bothered to keep track. Maybe doing something fancy stops that from happening in the first place, but I was dumb enough to try something dumb and whaddaya know?
Completely misrepresenting what the web was trully about in it's birth: a tool to make distributed information more accessible from a central place. Nothing to do redistribution, or power or anything like that.

It's just that people piggy backed on it
>If anything in any country should be free, it should be education.

I can't tell you're being serious or you're being hyperbolic for the sake of defending education. Most people, given the choice would rather get free food, water, or healthcare.
Side note: Why does Mozilla pay their CEO $6.9 million as of 2022 [0] while seemingly mismanaging their business? As a Firefox user, Mozilla feels like a hollow company with little impact, existing primarily to give Google the appearance of competition. This seems like just another example of Mozilla sabotaging themselves.

[0] https://assets.mozilla.net/annualreport/2022/mozilla-fdn-990...
> as if no amount of solar and wind power generation capacity could be an adequate substitute for any amount of geothermal power, because you don't have solar power at night, for example. But actually that's just a question of how much it costs to store the energy until it's needed or transmit it from where it's still being produced.

I guess this depends on the region, at least to some extent. In Northern Europe we've had these periods during fall/winter in recent years where it's cold, essentially dark, and (worst) no wind. It's not really feasible to store ≈multiple days of consumption for tens of millions of people.

In three of the four Swedish price regions I think we are essentially in a situation now where wind power is "worthless" and can't be built out any more, at least not without major changes to consumption patterns. When the wind is blowing there is such high production that prices go almost to 0, and the operators earn ish nothing, and when prices go up there is no wind so no-one can produce.
The logic or reason is emergent in the combinations of the activations of different artificial neurons, no?
the data really isn't that large and the algo isn't difficult, most people who do this work don't need to compare proteins across every organism in the world. most people just compare to a few organisms that they work within the context of for clinical trials or data.

if you're comparing DNA and looking at every organism ever you might need such power, but if you do i'd hope you work at some institute that makes your own algo in house because blast isn't the end all be all
I thought the new admin was finished with appointments? /s
Oops, now I am going to apply a dupe label to myself: https://news.ycombinator.com/item?id=43233455
It’s more accurate too. Linear rebased histories aren’t representative of what occurred.

I think much of the confusion comes from git log which is a lie. People want git log to be an accurate representation of what occurred.
Absolutely. "Conspiracy to commit abortion" is being proposed if not partly a thing in many states, and runs the gamut of anything from looking up info online, to traveling, to financially supporting or even giving a place to stay for someone doing this.
There is a Flatpak, if you wish; as far as I understand it does not run code as root.
This makes no sense. Firefox has been around for ages. The need for a change in ToS makes no sense now.
Ban pornography depicting strangulation, review urges UK ministers
Many moons ago I used to speedrun Goldeneye and Perfect Dark on the n64. This was in the very early 2000s. I was pretty good but by no means the best.

It's strange to see many of the people I used to hang out with on AIM and MSN messenger now have legendary speed runs and entire lore threads and wikipedia pages written about them.

I think the itch you scratch doing speedruns is a lot like the itch you scratch doing any kind of creative coding and/or exploit research.
The CSRF token is usually stored in a cookie. I guess one could try stealing the cookie assuming the CSRF token hasn't been consumed.

But if one's cookie happens to be stolen it can be assumed they already have access to your session in general anyways making CSRF moot.
> You could have 2 employees doing the same job, but one (Joe) has a 5 minute walk as their commute and the other (John) has a 50 minute drive in a personal vehicle.

This doesn't mean they have different expenses. John is paying $2500/mo in time and commuting expenses, Joe is paying $2500/mo in additional rent to live in the downtown. Efficient market hypothesis says they're the same and anyway you care about the mean or median rather than rare outliers when operating at scale.

> Facilities costs are actually pretty minor in the grand scheme of things…especially if your company has other roles that cannot be done remote. Incremental office space costs are minimal.

Most offices are just offices. The jobs that can't be done remotely are the likes of data centers or factories, but these are different facilities in different places. If you're e.g. a tech company, your offices in San Francisco or New York contain entirely people who could work from home whereas your data centers might be in Oregon or Virginia.

So the costs are not incremental, they allow you to close entire facilities; and those facilities are the ones with higher costs per unit area; and the incremental costs are not trivial either. Things like rent and utilities scale approximately linearly with square footage or number of employees. Some are even super-linear because larger facilities succumb to bureaucracy, HR drama and combinatorial explosion in risk interactions.

> Your only hope to win the debate is to demonstrate with real productivity data.

I can win the debate this way too.

That two hours a day your employees were wasting in traffic? They're salaried employees, that's 10 hours a week they're not working.
> and I've applied it successfully in other places

There is a positive effect to quitting without too many crutches or aids. Not so much that you learn how to do it, but that you realise that it can be done, it's not that bad and it will make your life better.
Was going to say. I graduated high school 33 years ago. Was one of the last cohorts that had wood shop and metal shop. It was fun, but even back then the tools and presses we used hadn't been relevant to industry for awhile. If you want shop to be relevant to modern industry you would need to teach robotics, CAD/CAM, CNC, 3D printing, etc.
You could do a simple weighting, probably adjusting for sample distributions.
> cost of delivering the electricity that was produced to a market was just greater than the revenue stream that we could create."

So, the same as nuclear, wind, solar, gas, and coal, all of which which largely don’t work without significant government support.
Vulnerability research, in my experience, has been pretty collaborative and open - especially in the bug bounty space.
Hard problems like that can take a long time to solve, multiple phds and/or breakthroughs. Maybe a good longbet[1].

[1] https://longbets.org/
I suppose if you really wanted to you could view condensing useful abstractions out of a highly detailed system as a kind of language game, but I'm not convinced that that's useful in the context of investigating particular abstractions rather than investigating the nature of the process of making abstractions.
Edge cases like 85% of the mass in the universe, and 95% of the mass-energy.
All of them sucked, though. Turns out, running regression on some features picked as much to help the user as to satisfy business objectives, doesn't lead to a system that can capture one's preferences well.

LLMs have the benefit of understanding (or some values of understanding) how people feel about things in general, in a global sense. They may not have a database of people's choices, but they have a "database" of connotations for every word, how ideas and emotions relate, how interests connect, etc. Instead of relying on a relatively tiny historical record of choices in few, specific (and ill-defined) categories, they can just place user's history in their 10 000 dimensional latent space and use that as a direction to explore, effectively guessing whatever the user's actual preferences are likely to be, without being able to name them or fit into explicit categories.
I'm overemployed as a 40+ but this would get a CV from me pretty quickly.

Offer some part-time options and you'll get a custom-crafted cover letter professing my love and why I am a perfect fit as well. :)
> In other words, CSRF protection is about write protection, preventing unauthorized cross-origin actions, while CORS is about read protection, controlling who can read cross-origin responses.

I apologize for the length of the reply, I didn't have time to write a short one. But to sum up, CSRF is about writes, while CORS protects both reads and writes, and they're two very different things.

CSRF is a sort of "vulnerability", but really just a fact of the open web: that any site can create a form that POSTs any data to any other site. If you're on forum.evil.com and click the "reply" button (or anything at all), that could instead POST a transfer request to your.bank.com, and if you happen to be logged in, it'll happen with your currently authenticated session. When the bank implements CSRF protection, it ensures that a known token on the page (sometimes communicated through headers instead) is sent with the transfer. If that token isn't present, or doesn't match what's expected, reject the request. It ensures that only forms generated by bank.com will have any effect, and it works because evil.com can't use JS to read the content of the page from bank.com due to cross-origin restrictions.

CORS on the other hand is an escape hatch from a different cross-origin security mechanism that browsers enable by default: that a script on foo.com cannot make requests to bar.com except for "simple" requests (the definition of which is anything but simple; just assume any request that can do anything interesting is blocked). CORS is a way for bar.com to declare with a header that foo.com is in fact allowed to make such requests, and to drop the normal cross-origin blocking that would occur otherwise. You only have to use CORS to remove restrictions: if you do nothing, maximum security is the default. It's also strictly a browser technology: non-browser user agents do not need or use CORS and can call any API anytime.

Fun fact: you don't need CSRF protection at all if your API is strictly JSON-based, or uses any content type that isn't one of the built-in form enclosure types. The Powers That Be are talking about adding a json enclosure type to forms, but submitting it would be subject to cross-origin restrictions, same as it is with JS.
The validity is up to the service, as described in https://datatracker.ietf.org/doc/html/rfc6238#section-5.2

Because of clock skew and latency, a service might choose to allow the previous and/or next code as being acceptable.
oh wow. This is one of those things that I remember, but I never would have thought of it specifically. Formmail.pl !
Every time that I see someone talking about Tailwind like a panacea, I put weird faces. For looks a weird way to write a style attribute to a HTML tag. Something that MUST be avoided.
Yeah I don’t know why GP would think computability theory doesn’t apply to AI. Is there a single example of a problem that isn’t computable by a Turing machine that can be computed by AI?
I don't think Chromium renders non-WebGL content with ANGLE.
RF is cube root I believe - nope, inverse square law, sorry - from an isotropic radiator. So 1000mW from your wlan AP is very quickly 10mW, at 10 meters.

Lightning exists and that's on the scale of 64gigawatts of energy, I have a differential lightning detector that can "hear" lightning roughly the entire hemisphere. I had to make the antennas. Blitz system blue.

Clear channel broadcast stations (the FCC term, not the company 'ClearChannel') must output 10KW - 50KW no more and no less.

If you're within a dozen or two miles of one that is beam-formed, you can pick it up with basically any semiconductor, a wire, and a speaker. Like, a resistor will work.

edit: I can probably do a demonstration video with a VNA/antenna analyzer and an HT radio, if such a thing doesn't exist. But the "voltages" that radios can detect can go as low as, well, i'll quote one of my radios specs:

> Sensitivity: -140.0 dBm (0.02 µV / 50 ohms at 15MHz) MDS Typ. at 500Hz bandwidth in HF

> Sensitivity: -141.5 dBm MDS Typ. at 500 Hz bandwidth in FM Broadcast Band (64 – 118 MHz)

> Sensitivity: -141.0 dBm MDS Typ. at 500 Hz bandwidth in VHF Aviation Band (118 – 260 MHz)

i was only able to test that radio to -136dBm or so. I forget why, i think the service monitor i was using was really old and probably needed some new caps and a decent interior cleaning. But the radio specs claim it can detect 2 hundredths of a microvolt in specific circumstances (like detecting a very faint beacon signal)
"Musk orders FAA to give him $2.4 billion" would be more accurate.
While I can see the broader point about how the language used in diplomacy favors the native speakers... Trump is terrible at English.

The only way it is more of a weapon than a crutch is the way it is shamelessly abused, 1984-style.
functions in stylesheets?

That's nuts.

The web is developing in the wrong way.
I like Qubes, but it is just multiple Linux installs running in VMs. Also it depends on Xen and an X server, both of which are not long for this world.
Heuristics implemented within a formal system are still bound by the limitations of the system.

Physicists like to use mathematics for modeling the reality. If our current understanding of physics is fundamentally correct, everything that can possibly exist is functionally equivalent to a formal system. To escape that, you would need some really weird new physics. Which would also have to be really inconvenient new physics, because it could not be modeled with our current mathematics or simulated with our current computers.
I'm a bit surprised there was no mention of semiconductors (mostly capacitors?) going bad on 1990's hard drives. I want to rescue the Fast SCSI2 drive on my old Amiga at some point and never thought the problem might be inside. If the electronics on server-quality drives (it sounds like a jet engine) are this reliable, then I'll be thankful for having just one problem and not two.
When you logged in to bank.com, it set a cookie that your browser presents when it makes any request to bank.com, regardless of how it was initiated (i.e. it would still send the cookie on a cross-site XHR initiated by evil.com's JavaScript).

> What stops a script on evil.com from going to bank.com...

CORS
My fear is that LLM generated code will look great to me, I won't understand it fully but it will work. But since I didn't author it, I wouldn't be great at finding bugs in it or logical flaws. Especially if you consider coding as piecing together things instead of implementing a well designed plan. Lots of pieces making up the whole picture but a lot of those pieces are now put there by an algorithm making educated guesses.

Perhaps I'm just not that great of a coder, but I do have lots of code where if someone took a look it, it might look crazy but it really is the best solution I could find. I'm concerned LLMs won't do that, they won't take risks a human would or understand the implications of a block of code beyond its application in that specific context.

Other times, I feel like I'm pretty good at figuring out things and struggling in a time-efficient manner before arriving at a solution. LLM generated code is neat but I still have to spend similar amounts of time, except now I'm doing more QA and clean up work instead of debugging and figuring out new solutions, which isn't fun at all.
It's a mindset thing for some people I think, they have a "flow" and just continue using it. I sort of see it, but it's a time sink.

Personally if I'm working by myself absolutely not, commit straight to main or a feature branch, life is way too short.
“Firefly is literally and figuratively over the Moon,”
That would require me to focus on one subject :-)
Firefly's Blue Ghost – Mission Imagery
The article describes very strong similarities, definitely more that between a taxi and F1 drivers; read the sections "Glitch hunting is reverse engineering" and "…And it’s vulnerability research".
Nothing stressed me out more than working with a band saw hoping I didn't cut my fingers off
Building an AI in shop class, what a prospect. I'd choose "giant mecha robot with laser attachment on each shoulder" as my assignment!
The people who committed genocide (or simply murder without cause) are clearly to blame for those they killed, directly and in many cases, indirectly.

As for your example, that's a bit convoluted. Perhaps clearer would be if you intend to genocide say, a town and meteor hits killing everyone before you get there as well as the neighboring town, it would be difficult to argue you're to blame for their deaths. That doesn't mean you're a nice person and we'd generally still lock you up for attempted genocide of the town you attempted to murder, but not of the town you didn't.

The meteor in real life was disease. By some estimates, 90% of the population in the Americas died from diseases the Spanish accidentally introduced by 1600, most the Spanish did not know existed.
Having never used the authoring tool, can you point me towards something to model it after?

I think a Bret Victor, "Inventing on Principal" style editor would be perfect, combined with some sort of scratch like Python IDE where each element is defined in terms of its reactive behaviors with other elements on a timeline.

I didn't say easy, I said not too difficult. Order of magnitude difference. :)

https://youtu.be/PUv66718DII?t=634

With some http://lighttable.com/