skysight-inc/HackerNews huggingface dataset:
You and someone else pointed this out. I only use GitHub-org actions, and I just thought that surely there would be a "one version to rule them all" type rule.. how else can you audit things?

I've never seen anything recommending specifying a specific commit hash or anything for GitHub actions. It's always just v1, v2, etc.
Such a breath of fresh air compared to poor DX libraries like langchain
Well timed for the weekend. Some teams may notice Monday morning.
Optifye.ai (YC W25) Is Hiring
No the "v4" tag gets updated from v4.1 to v4.2 etc as those minor versions are released. They are branches, functionally.
The issue with Chrome isn’t its ownership by Google. The problem lies in the fact that Google search is integrated into the very fabric of the browser at all levels. This creates an unfavorable and, frankly, unchallenged system that hinders competition. It’s the Achilles heel of unchecked capitalism.
I haven't heard this particular rumor, not like they have In-Q-Tel connections a la Wickr, but they do take funding from the Open Technology Fund [0] which some of the more righteously paranoid take issue with, being US State Department and all. Same parent as Radio Free Asia, Radio Free Europe, Voice of America [1].

[0] https://briarproject.org/news/2018-1.0-released-new-funding/

[1] https://en.m.wikipedia.org/wiki/U.S._Agency_for_Global_Media
If you want a Cathedral they still exist. Use .NET and only MS Nuget packages.
> nobody writes checks to Chrome to make a certain search engine the default

And some people wonder how Chrome could ever make money if it were divested from Google...
Yes, but that is nonetheless the context in which it is said.
As per their website, the account is local to the phone.

It just cannot be backed up, unfortunately.
Biden has severe spinal arthritis and neuropathy in his feet. The guy walks around in pretty severe pain and suffers from a stutter.

The story of the cognitive decline was pushed aggressively by the Trump people because it’s good TV. Just like they neutralized Desantis with the weirdo campaign.

It’s pretty obvious that Trump is a turnip. I’ve heard him speak in person… the sound bites sound cogent on TV, but the dude is like a drunk monkey he can’t string sentences together. The reactionary policy isn’t out of Trump’s head, its from a little army of fascist attorneys.

Both are odious Presidents… it’s ridiculous that a country as large and powerful as the United States is led by 80 year olds.
I'd say it's the norm rather than the exception outside of the US.

US operators do things quite a bit differently from the rest of the world; for example, prepaid cards without a monthly fee are not really a thing, i.e. essentially every plan has a monthly fee, but that then almost always includes texting.

Outside the US, it's usually possible to receive calls and SMS on a prepaid SIM without paying anything other than maybe the occasional top-up to not lose the number; in exchange, outbound texts and calls are usually paid.
So this dumps env to stdout using some obfustucated code? And then relies on the fact logs are viewable publicly so the attacker can go scrape your secrets.

If so, why did they use obfustucated code? Seems innocuous enough to load env into environment vars, and then later to dump all env vars as part of some debug routine. Eg. 'MYSQL env var not set, mysql integration will be unavailable. Current environment vars: ${dumpenv}'
What does the June 3rd issue look like?
His profile has contact information.
I am hopeful that governments will do things to benefit the people.

Maybe that’s naive, but I’d rather be hopeful than cynical
I'm just going to say this out loud: It's mostly a Javascript thing.

Not that every other platform in the world isn't theoretically vulnerable to the same sort of attack, but there's some deep-rooted culture in the javascript community that makes it especially vulnerable.

The charitable interpretation is "javascript evolves so fast!". The uncharitable interpretation is "they are still figuring it out!"

Either way, I deliberately keep my javascript on the client side.
It's up to the mobile networks to support that (usually by outsourcing it to Google, which I'm not sure they do for free).
> PostgreSQL compiled with a non-standard block size

Do you think this could become less important for your use case the new PG17 "I/O combining" stuff?

https://medium.com/@hnasr/combining-i-os-in-postgresql-17-39...
I have long since stopped using any extension that doesn’t belong to an actual company (password managers for example). Even if they aren’t malware when you installed them, they will be after they get sold.
That location in SF then isn't an example of brutalism or soviet aesthetics either if I go by the photos I found on the internet. It was a totally irrelevant example.
iMessage has nothing to do with RCS, though. I'm also curious how key exchanges will work across operating systems on the latter.
most restaurants are absolutely terrible value for money.
I’ve found the Ruby community really cares about DUX. Not sure why it’s not in other language communities
You're not necessarily making more destinations available. You're potentially just requiring more changes to go to the same destinations.

Imagine a metro area with somewhat grid-like streets (or at least common paths) that go on for an hour+ in each direction. People still generally cluster to 20-30min from the destinations they care to go to, so it doesn't break that standard. Breaking it up into four 15-minute stretches isn't making it better for anyone. All you're doing is forcing people to get off one bus at an edge and hop on another. Just run more busses on the full path so there's still ample service for the changes.

How does forcing the 15-minute max path make more destinations available?
Wow, thank you (and the other person that pointed this out to me). That's madness.
Sounds like someone made a bunch of bad hires recently and needs take some time to mature their workforce.

Are good programmers the ones that fix everything and put themselves out of work or the ones that can drag things out to keep themselves employed long enough to jump to another company?
I believe even then only US carriers (the rest of the world has moved on from P2P SMS, and only businesses are really still sending them for SMS-OTP and marketing), and of course Google, as the only party actually invested in it (via their acquisition of Jibe [1]).

[1] https://jibe.google.com/
That's not a 'free market' though, especially not by the majority standards in the US. That's the US government attempting to pick a winner by funneling money into startups.

Mind you, it's not something I particularly disagree with, but the only way this works is by imposing regulations on the dominating market forces to prevent them from buying out the competition or using their network advantage to crush them. And regulation is considered the antithesis to a free market.
Well, it's kind of the same thing with P2P money exchanges.

Legitimately you may need to exchange crypto into fiat, since there's no "regular" exchange that does that.

The trick is that for it to escape regulation just have to do it in a way looks like money-laundery.

Legit use cases that (unfortunately) also enable criminals.
They drill into your jaw and screw in a tooth. I don't think it has developed at all.
Fuck. Insecure defaults again. I argue that a version specifier should be only a hash. Nothing else is acceptable. Forget semantic versions. (Have some other method for determining upgrade compatibility you do out of band. You need to security audit every upgrade anyway). Process: old hash, new hash, diff code, security audit, compatibility audit (semver can be metadata), run tests, upgrade to new hash.
Shouldn't the title be 'Learning to scale Postgres'?
I believe GP's objection is to not being able to access RCS from a non-Google-provided app on Android, not access to the RCS network on the backend side.
People got out of their comfort zone during COVID and tried new things.

Campgrounds got packed, people got into skateboarding… if you look at statistics, you’ll see a 2020-ish bump for many interests and an associated sudden growth in revenue.

But the question is how long it will last…

Some outdoor brands that expanded with new stores post-pandemic discovered that many people who tried camping/surfing/etc. only had a fleeting interest and these brands had to close stores.

Tech companies that hired during the pandemic found out a lot of people who tried online meetings/online work only did it because they had to and stopped as soon as they could and these companies had to lay off staff.

But maybe the people who “discovered delivery orders” during COVID won’t ever stop.
I suspect Epstein was not motivated by sex, rather he was likely some sort of spook. We will probably never know unfortunately
To be clear, I am in no way a conspiracy theorist, at all. Seriously, not just a bs disclaimer. That said, all of the recent photos of the moon that have come out in the last month or so look, to my eye, super CGI. Just uh, overly smooth and lacking in detail?

Is there a reason for this or am I just tripping?
Briar is actually even older than that!

2011: https://sourceforge.net/p/briar/mailman/message/27393146/
>The situation you described sounds so stupid. To break emails and websites of many people simply because the two letter acronym isn't matching reality well

Perhaps, but it's also not particularly bright to rely on the continued existence of a domain whose corresponding political entity hasn't existed since 1991. ccTLD's have an ongoing administrative burden and financial cost to maintain, so it shouldn't come as a surprise that it would go away eventually.

Besides, the signal to start migrating was when they closed registrations of new .su domains in 2022. And the 5-year countdown for removing the domain hasn't formally begun yet (AFAIK), so there's still plenty of time for .su domain owners to migrate away.

Personally, I'm more interested in if/when the British Indian Oceans Territory will dissolve, prompting the retirement of the .io domain.

>But their system administrator actually conducting the change is not, breaking things is against the philosophy of system administration

Knowing when to retire systems and going through the migration and end-of-life period gracefully is an important part of systems administration. We can't hang on to the past forever.
For graphical stuff like this, try enabling WebGL, just understand that you break a lot of anti-fingerprinting efforts if you do this.
What's unclear is who the buyer is supposed to be? Chrome's entire monetization is centered around its synergy with Google's ad business. Cutting off Chrome is so much messier, than the obvious, (although I fear it would itself have bad repercussions) decision to force them to sell Youtube.
I hope it stays that way. I'm almost certain that the minute management remembers it's there, it will get shut down, at least for non-paid (i.e. GSuite) accounts.
In case the tool is used against them.
Nor WEI, which Ars Technica described as a "nightmare." The final solution to general purpose computing.

https://en.wikipedia.org/wiki/Web_Environment_Integrity
I agree. If Chrome is sold off, the new owners might think its uneconomic to maintain a (desktop) Linux port, keep it open source, or they might make it even less standards based than it is now.
Exactly. And that's what happened here -- the bad actor changed all of those version tags to point to their malicious commit.

See https://github.com/tj-actions/changed-files/tags

All the tags point to commit `^0e58ed8`
https://github.com/tj-actions/changed-files/commit/0e58ed867...
You can always use Chromium or dozens of others viable Chromium derivatives.

Google at least gave you the option to do that.
It should, but if you are using poetry and say you forgot to pin boto to a specific version, your entire day might be spent waiting for poetry to solve.
I don't get the negative comments here. It's pretty simple I think...

- Google is banned from paying Firefox to be the default search engine -> Firefox has way less money -> Firefox development massively slows

- Someone buys Chrome and needs to turn a profit from Chrome, rather than using it to indirectly profit from the web in general like Google does -> Chrome probably goes to shit and development massively slows

So what now? Safari is going to be the leading force moving the web forward? The Chromium forks that are doing basically no browser engine work are going to suddenly find billions of dollars to invest in hiring developers? Someone will buy a time machine and go 10 years into the future to get a version of Ladybird that is comparable to what we have today in Chrome/Firefox? Just because you guys hate Google doesn't make any of those scenarios remotely plausible. And if you hate Google, there are much better ways to punish it than this.
A trouble with breaking up Google is I think from one perspective the impact it would have is not to reduce monopoly tensions but to increase them. Because now it's Apple Microsoft, Meta, Amazon, we will have gone from G.A.M.M.A. to A.M.M.A. (I no longer know what the new acronym is supposed to be, now that FAANG is gone).

And I'm not sure that I would start with Google. I'm honestly not sure how I would rank the major players in terms of antitrust concerns, but I do think there probably should be an order of operations such that you don't go after the "wrong" one first, effectively consolidating the industry further rather than balancing it.
creating a branch that happens to be named the same as a revision, which then takes precedence for certain commands

TIL; yikes! (and thanks)
> This is just anti-ev propaganda.

It's not. I'm not in any was opposed to EVs. Assuming so is a bit ridiculous on your part.

There's a marketing push to cast EVs as green no matter the prevailing sources of utility power. EVs can be green (like hydrogen) if they're charged from renewables. They also get greener over time since they're as green as their charging source.

In the short term EVs are just moving their emissions from tail pipes to smoke stacks. Contrary to the marketing around them.
Only commit hashes are safe. In this case the bad actor changed all of the version tags to point to their malicious commit.
See https://github.com/tj-actions/changed-files/tags

All the tags point to commit `^0e58ed8`
https://github.com/tj-actions/changed-files/commit/0e58ed867...
Necktie knots, formal languages and network security
The constitution establishes that a core role of government is to provide for the general welfare of the people, and public health is part of that. I’m generally in favor with government efforts to combat misinformation.

I’m also fine with wartime propaganda within limits for similar reasons.
OpenBSDs pledge[0] system call is aimed at helping with this. Although, it's more of a defense-in-depth measure on the maintainers part and not the user.

> The pledge() system call forces the current process into a restricted-service operating mode. A few subsets are available, roughly described as computation, memory management, read-write operations on file descriptors, opening of files, networking (and notably separate, DNS resolution). In general, these modes were selected by studying the operation of many programs using libc and other such interfaces, and setting promises or execpromises.

[0]: https://man.openbsd.org/pledge.2
Also don't het GH actions to do anything other than build and upload artifacts somewhere. Ideally a write only role. Network level security too no open internet.

Use a seperate system for deployments. That system must be hygienic.

This isn't foolproof but would make secrets dumping not too useful. Obviously an attack could still inject crap into your artefact. But you have more time and they need to target you. A general purpose exploit probably won't hurt as much.
For the OAuth part, the access_token is all an MCP server needs. So users could do an OAuth Authorization like in the settings or by the chatbot, and let MCP servers handle the storage of the access_token.

For remote MCP servers, storing access_token is a very common practice. For MCP servers hosted locally, how to deal with a bunch of secret keys is a problem.
Wow. So thoughtful.

Ruby: late to the party, brought a keg.
And that whole "war on cookies" where they keep pitching replacements that basically let Google (and only Google) do all the same things, so that they can then gatekeep it and pay others for the privilege of accessing some limited subset of that data.

Regardless of why Google made Chrome originally, today, the main reason why it exists is to enable Google to track users more efficiently. And that is a bad thing.
> I didn't know I was donating so much, my dumb ass thought I was just buying stuff. Got to put that on my Tax sheet.

It’s not tax deductible, though (and even if you didn’t get anything in return, I don’t think Floorp is a registred charity anyway).
Show HN: Lightweight and free CMS/RSS feed/podcast hosting on Cloudflare
Do you want to cite a source?
Matz said he designed Ruby to optimize for developer happiness, it’s just a core principle of the language since it was created
> On one hand, I really want WebUSB, but at the same time, I REALLY don't want the average person to have WebUSB.

This is the endless struggle of all time. It's like some people have some sort of super-messing-things-up power. If you don't make something LITERALLY impossible to achieve, they will find a way to do it by accident. Always. They will go out of their way to find things to do by complete accident, and they will never have any idea what they're doing! They'll follow guides to change settings they don't understand, trigger functionality they don't understand, grant access they don't understand, no matter how complex you try to make the process, no matter how many warnings you add, and no matter how hard you try to guard against exactly this kind of idiocy.

And this sucks. Because there are people out there who do know what they're doing, who do things on purpose, and who would appreciate to have power that it just so happens that an Idiot should never be given. It is practically not possible to expose that power without being flooded by Idiots who did something Stupid with it.
With Baltimore tunnel project under way, CSX detours 16-plus trains per day
I've traveled enough in Europe, and not just major cities, to understand this about housing.

However, what is the average size of a graduating class from secondary education? My high school class was quite small, just under 100, but it was an oddity and classes before and since were more like 120-150. Even in elementary school we had around 75 in each year. It is not unusual in larger metro areas in the US to have over 1000 students in each graduating class.
NotGoogleLobbiests.com?

Great source.
> because what is good for the web is good for Google

Counterpoint: funding via advertisement
Given the recent layoffs in the tech industry, how do you see the role of immigration in addressing labor market needs?

Some people express concerns that the H-1B program might be used primarily to reduce labor costs rather than to fill genuine skill gaps. How do you view this issue from a legal and policy perspective?
I really, really, really hope RCS doesn't make it as a standard.

Now that it's end-to-end encrypted, it's slightly better than SMS, but it's still laughably incapable compared to decades-old protocols that support multiple devices, phone-number-independent identifiers, self-hosting, have open implementations and non-insane specifications etc.

As it is, RCS is just Google Talk (Google runs most of the infrastructure), but tied to a single device (no messaging from your laptop or tablet if your phone battery dies!) and impossible to use without a phone number.

It makes me really sad to see that even technical audiences don't see the long-term plan here: Cementing the use of phone numbers instead of email addresses as the primary identifiers in people's digital lives, and making the closed, carrier and Google operated RCS ecosystem the ultimate replacement for email and other open web standards for B2C and P2P messaging. (Yeah, most people already use Gmail, but the point is that self-hosting email is at least still possible, and there's still relatively free competition of sending service providers; with RCS, there's no chance to play without paying the cartel.)
Web browsers are probably complex enough at this point. Putting them on maintenance and letting new architectures fight it out might not be a bad outcome.
Stealing crypto is so lucrative. So there is a huge 'market' for this stuff now that wasn't there before. Security is more important now than ever. I started sandboxing Emacs and python because I can't trust all the packages.
This is a nice fantasy, it's just a shame we live in a world full of psychotic C-suites that would do anything and everything they could if it meant the magic line goes up half a percentage point. I guess you could just "take personal responsibility" to not drink polluted water tainted by unfiltered chemical dumps, but I'd much rather we tell companies to get bent when they try pollute rivers and lakes en-masse to save a buck.
No idea. But they didn't do a great job -- they broke the action, which caused build failures that people were going to notice.

The malicious commit only landed at 09:57 PDT today (March 14) in one specific action (out of a number that is quite popular). Maybe they were planning on coming back and doing proper exfil?
There is no atmosphere, ergo no light diffusion. Shadows will be crisper, lit spots will be brighter, dark spots darker. It makes sense that such differences could make an image feel "off".
…I really don’t think Nazis are taking over because of a lack of bad faith Internet discussion.
The premise of this post is flawed. The government is trying to bar Google from paying browser vendors to make them the default: https://www.theverge.com/2024/11/20/24300617/doj-google-sear...

> Other remedies the government is asking the court to impose include prohibiting Google from offering money or anything of value to third parties — including Apple and other phone-makers — to make Google’s search engine the default, or to discourage them from hosting search competitors. It also wants to ban Google from preferencing its search engine on any owned-and-operated platform (like YouTube or Gemini), mandate it let rivals access its search index at “marginal cost, and on an ongoing basis,” and require Google to syndicate its search results, ranking signals, and US-originated query data for 10 years.

I don’t think they’re going to get all of that, but it’s interesting, and it definitely doesn’t line up with the “sell your car” analogy in the post.
It's small enough to lose plenty of heat without conduction.
Try a spoofed user-agent, if disabling ETP and RFP doesn't help.

Also, fuck companies that do this. I just start permanently deleting accounts whenever services do this.