skysight-inc/HackerNews huggingface dataset:
I went to the Carylon website to find a list of their companies and got

> Block Reason: Access from your area has been temporarily limited for security reasons.

My area is Australia.

https://caryloncorp.com/find-a-company/
Amazing software, a must have. They never merged my PR though.
Agree or disagree with the goings on, I find it interesting that these government memos and executive orders are still crafted with such beautiful prose. Who are these stalwart writers weathering the storm?
okay. so let me break it down further. you and i exchange messages via e2ee app. i text you, the app encrypts it, then sends it down the wire. the TLA lawful intercepts that data, but it is just random noise because it is encrypted. your app finally receives the e2ee data, decrypts it, shows you the message.

the data in transit is encrypted beyond anything the ISP has control over, so if the ISP provides lawful intercept they have fulfilled their obligation to the TLA because they let them see the data. it's not the ISP's fault that you and I encrypted the data. this isn't TLS encryption.

if that's not clear enough, then someone else will have to step in as I have taken as far as I can
thanks, placed an order through bookshop
Find a new provider. I have gone 2 decades without providing my SSN to doctors.
To the best of my knowledge (I only dabble in Rust) there aren't often too many breaks unless code accidentally relied on soundness bugs which Rust makes 0 promise of retaining to keep code working.
are you implying that society shouldn't aim to reduce human interaction with vomit, feces, and dead animals? Robotics in harsh environments isn't unheard of
A lot of people might also be surprised how frequently traffic engineers will OK unnecessary and less safe four way stops in order to get the annoying citizen pestering them to just leave them alone.
Topics mentioning DOGE and Musk are being quickly flagged here in HN, so I don’t think there is much hope for discourse here.
I guess the argument for is that this is isomorphic to an outside contractor being granted access, providing a list of cuts, and the prez signing off on it. I don't like it but it seems like a difference in semantics and paperwork so I'm not sure if going after it is meaningful.
I don't think flagging automatically kills posts, no?
So do I, I just don't sign up for the subscription through Apple's services but natively through the provider.
A few years after the first battle over Taiwan has taken place.

There has been news about Broadcom and NVidia testing their designs on Intel process nodes. Which is arguably worse in at least two respects, they are behind TSMC in density and also proprietary software tooling at Intel. After the 13000/14000 CPU chip death issues possibly also in regard to reliability. But they still want to do it.

Although this page in the history books is not yet written, companies hedging their bets this way is a really bad sign.
I'm losing my mind. This thread is already full of people sanewashing DOGE and Musk. I don't even know how to debate with them, because we seem to live on entirely different conceptual planets.
https://www.opp.purdue.edu/our-programs/undergrad-co-op
The market ensure (mostly) there is another individual.
Also possible a webdev opened it up so they could use the assets on a website, and didn't think about other private data in the bucket.
>this eye-opening memoir reveals what really goes on among the global elite

I wonder how many time it should be revealed to stop being an eye-opening and a revelation.

Brief look over the article and the photos, and it seems like a usual story - somebody is happy to be a part of the viper nest at the very top until they get kicked out, and then "eye-opening revelations" come out (of course i think that Meta shouldn't be able to block it, until it is some NDA stuff)
I believe, you and I are talking about the same colour when I say "white" and you say "light grey". Specifically, I mean colour 7, and I believe you do as well. In the CGA and EGA palettes, colour 7 is commonly called both "white" and "light grey."

Colour 15, on the other hand, is typically called "bright white" or "high-intensity white", which is indeed too saturated. When I said "white," I was referring to colour 7, not colour 15.

For reference, here's the palette I'm referring to: https://moddingwiki.shikadi.net/wiki/EGA_Palette

Additionally, here are examples from printed materials of that era confirming these colour names:

1) https://archive.org/download/logo-programming-with-turtle-gr... - Page 6-3 refers to colour 7 as white and colour 15 as high-intensity white.

2) https://bitsavers.computerhistory.org/pdf/microsoft/gw-basic... - Page 289 refers to colour 7 as white and colour 15 as high-intensity white.
That seems like a terrible way to estimate nurse wages.

People have spouses.

People’s parents pay credit cards.

People with bad credit sometimes don’t care.

People have family money.

People with low debt can be desperate for work.

Does it even work?
It’s as easily readable to me as well formed, college level French.

I can recognize some shared concepts and a general vibe maybe but I am materially incapable of reading it without hundreds of hours of study
Yep? I mean it's threatened every time by Republicans. But it's usually just grandstanding... Take Obamacare for instance. It was threatened to be repealed constantly, over and over, But even when they had full control and could do whatever they wanted it still survived.. at the end of the day, the elected officials know that it hurts their own people more to appeal it, so they just give the issue lip service and tweaks and fly a giant mission accomplished banner from the deck of their ship.

So on one side, I agree with you, who would think that they actually follow through with what they were saying over and over on the campaign trail.... And now they have.
> The closest I've seen to a class consiousness in America ...

You are mistaken. You can no longer consider the vast majority of trending content on social media to be crafted by actual people. LLM has made sock puppetry and the accompanying distorted reflected appraisal, both cost effective at scale and ruinous.

The cause of the policy change is an escalation of what naturally follows their exploitation of both the original unpaid moderators that left in the exodus as well as the unpaid volunteers who have left or were driven out leading to the Cooling Effect on Social Media.

The moderators they have that remained are for the most part subverted, and have turned to Anaconda in the Chandelier-like strategies to rule their kingdom like their own personal feifdom driving the core elements that made the community valuable in the first place away.

Reddit is starting to notice this too, because accounts are using the karma system in conjunction with large amounts of sock puppets are acting as sybil attack vectors where extreme content stays up, and they take a stock market hit every time the trusted news initiative brings it up on-air.

Collectivism trends towards destruction every time its embraced by a large number of people. It may be slower or faster depending on certain things, but inevitably it comes up against an out-of-context problem couched in existential crisis that the members of such cannot recognize or foresee. The consequences vanish along with all those people, to the sands of time and chaos. Bronze-age collapse, Greece, Rome, etc.

History is important, and when the ignorant in privileged positions take their flocks along for the ride, the destruction that follows is quite sinful and evil.

The simple fact of the matter is, when the pillars of society fail and unwind, it falls back to a rule of violence and the natural world. This is well studied under social contract theory and aspects on the history of political economy.

This isn't a political divide, its a ruinous cycle of spiraling madness where business thinks it wins, but they win so much that they destroy themselves and lose everything, and it was able to happen because necessity and urgency was decoupled from the funding, through money printing.

There are several pillars to society, one of the pivotal ones is a rule of law which requires several components that themselves are interdependent, and which have objectively failed today. The purpose of law is non-violent conflict resolution. When you have it, violence isn't acceptable, when you don't it naturally happens as abuses become egregious. In such disadvantaged environments, it is about what one can or can't do, not whether it should or ought to happen.

Natural law certainly doesn't follow Tolstoy's pacifism or nihilism except to extinction.
TIL. I learnt about the owl parser generator. Looks decent. Anyone's experience?
In 2025 an oath don't mean shit.
This is good up to a point. If you have only a medium amount of CRUD-like data jn a basic structure in a single user context, this is fine. But when you get into complex relationships, collaborative editing, and unique visual representations of data, this guess right out the window.

The easiest example is probably also the first app to really sell dynamic web apps to the populace: Google Maps. There were meeting applications before Google Maps, and they operated much as you describe--through HTTP round trips--and they sucked. As a user, it was such a pain in the ass to wait for those things to rerender after every click. As a developer, it was such a pain in the ass to field those complaints from those users and know--barring some new invention in browser tech that nobody saw coming (XMLHttpRequest in Internet Explorer)--there really wasn't anything you could do about it.

It's true that a lot of sites go over board with their interactions. But that's not the same thing as needing to ditch asynchronous requests completely.
I’m interested, given the massive nursing shortages, why any nurses were using this service at all? Especially for higher levels, there’s no reason to mess with a shitty app that underpays you, when you should be able to walk into any provider’s office or facility and get hired almost immediately (and for Runs, you even have wide-ranging telehealth options).
It depends there are some exceptions.[0]

>With persons or organizations (e.g., janitorial service or electrician) whose functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all.

Based on the context from the article of the PHI uploaded being incidental, it would probably fall under this exception. It sounds like ESHYFT isn't meant to be storing any PHI based on the privacy policy above.

0:https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
I'd be a great April 1st joke to replace ArgoCD by this spreadsheet
The README and faq are really funny. "What??" as the first question is gold
Snyk
WinAmp's yellow lightning icon is still sitting happily in my Windows icon tray right this very moment. Pageant is in there too with its cute little spy-hat :-)
Every time people have debates over the merits of languages I always put developer environment at the top of my list. Build tools, IDE, readable stack traces. Those things boost productivity for more than concise list comprehensions or any gimmicky syntax thing. It's why Python always felt stone age to me despite have such lovely semantics.
A few blogs mentioned that as an external US entity, you probably want to do VAT with Ireland (basically you deal only with Ireland for paying VAT, and what you pay gets forwarded through the system to all the other EU countries).

The reasons they cited were that it's in English, they have among the shortest initial application times (a few weeks vs. a few months for others), and that they're generally the most business friendly (which you can guess given how they attracted all the US tech companies as as tax haven).

In practice I've found this to be the case. I've had a few email chains with the Ireland tax authority, and they were responsive within a few days. And I got things done. Though I was surprised to find that the "best" EU tax authority was still worse than the IRS.

Things I was surprised by:
1) It takes an extremely long and complicated application form (and several weeks) to get an EU VAT number to pay VAT taxes. By comparison the IRS lets you get an EIN instantly, and you only need to fill out a few fields
2) Setting up a login to the Ireland Tax system is the worst thing in the world. I expected a simple username/password type system. Instead: you apply, then you have to remember a code, they don't give you any confirmation email, then 3 weeks later they send you an email giving you another code, and you have to hold onto that code, because you need to wait 72 hours for the database to update, before you can enter that code to create a certificate (but you don't know to use the first code or the second code), and you then need to save that certificate to your local machine, and re-upload it whenever you want to login. It's actually even worse than I describe, but I honestly cannot even remember all the steps
3) When filling in how much VAT you owe each country, you need to fill out every country and every amount manually, no way to upload a CSV or anything

If this is how bad Ireland is, I imagine other EU countries are even worse.
Codemcp – make Claude Desktop a pair programming assistant
Man. I thought you were joking, then I read the article. Yeah, I will never spend so much on an iPad. It's not even the same OS. I don't know why anyone would think an ebike compares to a Land Cruiser.
Sarah Wynn-Williams, Facebook's Highest-Ranking Whistleblower [video]
New provider is unrealistic for many in USA. In NYC, maybe easy; in rural WI/KS much less so.
That's the configuration that Edison Motors is going for, for their semi trucks. Electric drive motors with a diesel generator.

https://www.edisonmotors.ca/
HIPAA only applies to a very specific entity called a "covered entity". At a high level, "covered entities" are health care providers that accept insurance or insurers. That's right, there's a massive caveat on "accepts insurance". You can be a healthcare provider and do not have to comply with HIPAA if you don't accept insurance.

That being said, HIPAA isn't even relevant here because "ESHYFT" is just a provider a labor. No different than a big consultant providing staff augmentation services.
Its completely obvious that a bot army is gaming the system. Posts are flagged within minutes of posting
Which PC OEM ships computers with Chrome? And is it somehow anti competitive because a family member chose Chrome over Firefox?
This is so wonderful. I hope I can get your Transputer emulator running to try it. I wish I'd spent my teen years doing something so awesome.

One minor grammar thing: "didn't worked" should be "didn't work", because "do" in English as an auxiliary verb always takes the root form of the verb, just as "will", "may", and "can" do. Similarly "don't exists" should be "doesn't exist".
The API Connection in the example has permissions to read the secrets from the KeyVault -as per screenshot.

It seems to me the KeyVault secret leak originated when KeyVault K owners gave secret reader permissions to the API Connection. (And I will note that granting permissions in Azure requires Owner role-which way more privileged than the Reader role mentioned in this article.)

[edit - article used Reader role, not Contributor role]
It's still here, and anyone who finds HN posts by rss or other means will see the headline, url & have access to this discussion (although it might be closed to replies by then)
> Frankly, I don't find your correspondence courteous at all.

Point out the specific comments you took issue with.

This comment, for example:

> It seems incredibly unlikely on what basis? Your complete lack of legal expertise and any insight into legal practice?

is a clear violation of the guideline to assume good faith interpretations of an argument.

> which is that it would be malpractice to not claim the maximum amount of statutory damages available when you plead.

Which is why I asked: Meaning that they could not have asked for a lower amount without waiving their rights to all statutory damages?

And you still haven't really clarified the issue, since I have no idea whether you are saying that these statutory limits have to be claimed for a lawyer to remain in good standing irrespective of a client's instructions or if the client has the option to claim less than the statutory damages and simply didn't in this instance. If it's the former, okay, sure, you were right. If it's the latter, my original argument stands: Someone representing the plaintiff went over the details of the brief with the attorneys who drafted it prior to it being filed. They had the opportunity to claim a lower limit, and didn't. These are not unsophisticated clients, and they would know what the PR implications would be of a headline like "RIAA sues Limewire for more money than God." My contention is that they didn't pump the breaks on this because the whole point of these lawsuits was to scare people into not pirating music anymore.

> Yeah? You see a lot of attorneys in copyright cases not seeking the amount of statutory damages?

Where was that stated?

> I'm not sure what your point is.

They lost money on these suits.

You made the claim originally:

> Record companies, artists and other rights holders are not pursuing lawsuits because they are "somehow vindictive" or want to send a message. [...] Like anyone else who goes through the trouble of pursuing a case on IP grounds, they feel their rights have been violated and they want redress.

The message they were trying to send was that if you pirate music, you will be financially ruined. If it had ever been about the damages, they would have stopped when it became clear that they weren't recovering their costs.
> Which check or balance do you think is being ignored here?

Which check + balance is being adhered to?

Which actions aren't in violation of the constitution, are operating fully with stipulated oversight and clearly operate within established best practices?

This should be trivial to provide from the Most Transparent Administration Ever.
“…rush it to shelves after waiting for eight years.”

Jumbo shrimp.
Yes, but you're missing a massive caveat that is conditional on the definition of "covered entity".

Covered Entity has a narrow meaning. Notably, if you don't accept insurance, it's very unlikely you're a covered entity.
I've never had that happen (sample size ~5). They accept non-citizen patients, so they probably don't make SSN a required field.

(for SSN, never tried to prevent scanning of my ID)
Yes, SPAs are absolutely horrid. I tried to use HEY Calendar and the iOS app is just so absurdly slow I went back to the native iOS calendar app.

Maybe it speeds up their dev time but a native app should not feel like a (poorly engineered) web app. Every click loads for a second or two and sometimes it hangs for even longer. I grew to dread adding and managing events.

It’s a shame because even though the app made some questionable design choices, it was in general a breath of fresh air in terms of UI.

I’d like to hope that they’ll fix it, but I know they won’t.
No. That's what makes it much more difficult to attack at scale compared to centralized voting systems.

You can't stuff hundreds of ballot boxes without election monitors noting the discrepancy in number of voters. Even if you could, you can't add more ballots than people visited without the election monitors noticing or remove them for the same reason.

Since voter names are crossed off and publicly recorded as voting, stuffing a ballot also box risks discovery if that person tries to vote or sees themselves on the list.

Since votes are tallied and reported as counts happen at the precinct level, again, with election monitors, there's no easy place to alter votes. The sum of the precinct totals has to be the final result.

Then there are the automatic recounts which have to match the originals or one risks discovery.

The only real scalable attack is through electronic voting machines without a paper trail - which is why they should be banned. Well that and any ranked choice races for the areas that have them (since they have to be tallied centrally and aren't auditable in any reasonable way). Anything else has a high risk of discovery.
ESHYFT isn't a covered entity, so HIPAA doesn't apply to them. Even if they have health data of their employees in their system, they're still not a covered entity.

Really, "Uber for Nurses" is a title to drum up interest. "Large Staffing Service" would be factually accurate.
int ptr
The section on randomness and noise is an awesome resource
Now let’s map helm config files to csv and use pivot tables for networking
I did read the article and I'm not sure why this isn't about access control

> it is common to not mark input (and output) as sensitive.

There's 2 solutions to this:

1) Fail open: default setting is that things are not marked as sensitive and an active decision has to be taken to mark sensitive
2) Fail closed: by default things are marked sensitive and action needs to be taken to mark it as non-sensitive

Another way of seeing this is that 2 is the common paradigm of "least privileges." You give users, files, services, whatever the minimal privileges required.

> What I would not expect is that anyone with Reader permissions on the connection is allowed to arbitrarily call any endpoint on the connection:

To me this sounds like doing `chmod -R +r /`. Or as the author puts it

> all Readers on that subscription can call all GET requests defined on the connection.

This is certainly an access control issue. Even if the issue is that Azure doesn't allow for more fine grained access control, it is still access control. So that's what I'm not getting. It is about having the ability to do API calls, to do GET and POST commands, it is about tokens (accounts) having more privileges than they should.

What am I missing here?
How much information do you think your neighborhood PCP is “leaking” compared to, say, Elevance? This is such a goofy take. Are you expecting that every small provider group is just firing your data off on Facebook every Tuesday, and somehow, no one cares? They’re all using certified EMRs. They all take security seriously because their licenses are literally on the line. Do you work in healthcare?

If they provably expose your data, and you report them, they will get fined. Or they would have last year, who knows if those people still have jobs.
Completely agree about the wisdom of Narcan titration when you are able to do it. If you give them too much they can wake up swinging fists because you just ruined the heroin/fentanyl/whatever high they paid $20 for. And in that moment they won't be especially receptive to platitudes like "Dude, you died and I just brought you back to life."

And then 20 minutes later the Narcan will wear off and they can crash again, and you're back to square one.

That's hilarious about the teens. Teens don't have heart attacks. And you can never count on people having common sense.

I love our dispatchers. They work as hard as we do.
But also the API connection seems to have secret reader permissions as per screenshot in the article… Giving secret reader permission to another resource seems to be the weak link.
WALL-E would get lots of funding as a robot entrepreneur at the YC demo day today ;)
You’re not wrong in the literal sense. But the “inside baseball” of that question is just that it’s a prompt to talk about how you would horizontally scale a system should the need arise. It’s not a prompt to start questioning whether 10mm or 200mm is the specific limit.
>So probably only 1/3rd of their income is going to browser development, which is pretty bad.

Only because you assume that they should only be working on browser development.
Flagged. We don't talk about privacy issues on Hacker News. Especially not when they involve the government.