skysight-inc/HackerNews huggingface dataset:
Apropos of the other reply to you about security. Maybe some security people could let me know their thoughts on this.

It seems like generally, the best way to expose your database to the internet is considered to be not doing so in the first place, i.e., have your webserver query and cache a hosted database that isn't directly exposed.

Is my understanding correct? It seems that almost all data breaches we hear about are directly exposed databases or their cloud equivalents.

Is doing this in the era of "cloud" being made impossible?
The Vision/Vision Pro product was also years behind schedule, based on original expectations, and some people feel that they had to launch something so that's why we got what we got.
The Rise of Algorithmic Businesses
Oxygen detected in the most distant galaxy ever found
> Air seal and upgrading insulation: correct me if I'm wrong, but that implies either tearing open all of the exterior walls or ripping off all of the siding, no?

If you do the exterior walls yes, but most heat loss is through the attic and roof. Air sealing and super- insulating the attic floor is pretty cost effective. Likewise sealing cracks around windows and doors.
> We’d like to avoid the grave.

Don't we all... but somehow I get the feeling that something was "lost in translation" here?
On the one hand, yes, certificates are issued by certificate authorities. And this is a critical part of the current web landscape.

But, I'll counterpoint that LetsEncrypt isn't the only ACME provider. Should they behave badly others can step into the gap.

The 90 day thing isn't a barrier. Certificates in general are automated- it's no harder to be HTTPS than HTTP.

Promoting HTTPS and dropping HTTP is ultimately valuable to all sites, because it prevents HTML injection. Given that your reader will be accessing the web via an ISP it prevents that ISP from injecting things into your site.

As an author of my own websites, I'm https only, and I think LE improves the indie web experience. There is a long chain of big companies between my site and my reader (Isp, LE, DNS, browser etc) but HTTPS offers me the best way of making sure the contect I create is the content delivered.
I don't think most largescale breaches are directly exposed databases, they are just the ones that summon the largest face palms.
Discussion (187 points, 15 hours ago, 148 comments) https://news.ycombinator.com/item?id=43422909
You've moved the goalposts from "logging" to "inspecting". But pretty obviously checking for password reuse does not require logging, or otherwise storing, the passwords.

Again: your claim was that Cloudflare had admitted to logging the passwords. You've been unable to provide any evidence of such an admission. Why not admit that it was an incorrect claim?
I bought a ~$500 item from amazon the other day. They sent me a code to give to the driver to recieve the package. They told me not to give it over the phone/intercom, and to only give it in person. He tapped it into his phone before giving me the package. I suppose he needed to do so to mark the package as delivered. That seemed a reliable enough system.
The same technique is also done with uniqueness types, which Clean[1] implements.

They look very similar on the surface and are sometimes confused. The paper Linearity and Uniqueness: An Entente Cordiale[2] goes into depth on the differences - but it basically boils down to - Uniqueness is about the history of some value - a contract that asserts it has not been aliased in the past. Linearity is about the future of the value - a contract that it must be consumed exactly once, from this point onward.

The benefit of uniqueness types is that it enables us to perform in-place mutation, because we know that nowhere else is this value aliased. The benefit of linear types is to guarantee proper cleanup. The two systems complement each other, and we can have types which are both unique and linear - steadfast types.

Austral doesn't have uniqueness types as such, but Capabilities are used to fulfil the same purpose. Because capabilities must be created from other capabilities, they're unforgeable - so we can design types that encapsulate a capability which in effect, ensures their uniqueness, but it's a bit more cumbersome than having uniqueness as a property of the language. Granule has both systems built in - uniqueness and linearity - but it doesn't support types which are both - they have to begin unique and be made into linear values.

[1]:https://wiki.clean.cs.ru.nl/download/html_report/CleanRep.2....

[2]:https://granule-project.github.io/papers/esop22-paper.pdf
Z generation is not the youngest generation now, so there are two generation.
How exactly is that fair?
> Except if you badmouth Trump at an airport, obviously.

The context is speech in the country you are a citizen of. I'm sure citizens of all countries can badmouth Trump at any European airport, but that's not a good test of whether citizens of a European country A have free speech rights within their own country especially when speaking against their own governments.
Yes, though many of the constitutional rights do apply to all people, not just The People, it's just that there is one right that foreigners definitely don't have in any country in the world: the right to enter and stay in any country other than their own.
Ex U Mich coach indicted for hacking accounts >150k athletes, downloading pics
Why is it hard? You need to be able to position things with sub-angstrom precision from a platform that has ~nm uncertainty in the critical z positioning, and in the case of nc-AFM is oscillating to boot.

And you can’t use existing tools. You need an atomically precise scanning probe tip with very specific reactive chemical structure, but NOT react with the surface while scanning with a voltage bias.

And where do you source feedstock from? Needs to be delivered to the surface in passive form but be activated when needed to switch to being chemically reactive in a specific way to get it on the transfer tool and then onto the part being built.

Oh, and this is without even getting into how many electronic structures are entirely invisible at certain voltages, everything looks like an identical blobish shape, surfaces are reconfiguring themselves constantly, and probes randomly crash due to piezo creep, destroying days or weeks of work.

My startup has solutions to all of these problems. And the payoff at the end is reliable, scalable quantum computers, followed by full-on Drexlarian nanotech. But yeah, it’s a fiendishly hard problem.
The web browser is just another app. It's not sad to check out multiple apps vs being locked into one platform.
Although has some successful interventions, USA wasn't able to win a war since almost a century and in the last one people were falling from the planes when USA was trying to ran away. Russia wasn't able to defeat its neighbor, had to get help from DPRK, China to sustain parts of invasion and get help from the USA to expel invasion on its own territory. Although Israel was able to level a city in its proximity with tens of billions of US weapons, they still weren't able to capture it. Yemen, a country with less than 500$ per capita GDP is able to withstand US attacks and still block marine traffic by launching attacks.

The moral of the story is, if people don't feel like getting invaded you actually can't. There are a very few places that were successfully invaded, like Northern Cyprus or Crimea but those already had significant ethnic population with ties to the invaders.

Obviously it's very damaging and obviously some powers attempt to invade but I don't think that there's a credible case to just give up. Also, that argument is a good example of why EU should control its own communications.
My strong suspicion is that mods generally either operate programmatically (that is, adjust site and other weights to favour or deprecate specific sources or stories, tweak flamewar detectors, voting-ring detectors, etc.), follow up on complaints emailed to them, and/or adjust member-based actions (voting, flags, vouches), etc.

That leverages their power far more than individually policing stories, though keeping an eye on the 30-odd stories which are on the front page at any time probably fits in somewhere as well.
I think you responded to the wrong post in the thread if you are concerned about someone making something political.

EDIT: You may be able to read my other post on this thread. It was flagged almost immediately, probably by someone whose feelings were hurt. Maybe their self-confidence suffered, I don't know. The truth can be like that sometimes, really challenging everything you thought you knew.

I come into the conversation from the standpoint of someone whose spouse is an auditor for an OIG in a federal government agency. Having spent several decades with an inside view, I have an understanding of how things work when they are done legally.
I thought PG's table inheritance was widely thought to be broken, do not use.
People should get informed that LLMs are still untrustworthy.
Also, if you call everyone a nazi, all you have is nazi bars. I was called a nazi last week for driving a Tesla, and I have Jewish ancestry. The word hardly makes any sense.
The 96GB is the maximum on Windows. On Linux, you can allocate 110GB.
Well it's certainly small. Absolutely bombs my KTANE test though - poor character recognition, poor handling of even mildly complex tables, and prone to getting stuck in repetition loops. (Task was convert to docling, in the official HF space.)

That said, I'm definitely glad to see work in this area, particularly with open weights.
Twenty years ago, the norm was to email your personal "social network" using a completely standardized and decentralized protocol.

Twenty years ago, the norm was to maintain a bookmark list of personally maintained websites you might visit in your online time, using a completely standardized protocol distributed across hosts ranging from home PC's to closet racks to countless disparate ISP's, universities, and hosting providers.

Twenty years ago, the norm was to have topical conversations with strangers using completely standardized protocols using decentralized or federated networks (NNTP and IRC).

Twenty years ago, the norm was to trade with and organize within your community on minimalist bulletin boards that took no fees and had almost no rules.

Twenty years ago, the norm was still that you kept most of your purchases in your local economy, but when you chose to remove money from your local economy (a certain kind of travesty, now become the norm), you did so with nearly unmediated relationship with far away merchants, with only a few points in fees being absorbed by agencies situated in between.

Twenty years ago, the norm was that when you bought digital media, you received a commodity copy of it that you could duplicate and access and re-encode as you saw fit.

Twenty years ago, the (illicit) norm was to digitize your own physical media and share it freely with others using numerous clever protocols to overcome bandwidth and accountability concerns, all decentralized.

True, twenty years ago, you did not get to have trivial access to trivial interactions with celebrities. You did not get endless streams of trivial headlines about trivial things. You did not get to drone out to endless autoplay of trivial videos. You did not get to monetize your own trivialities so easily.

Frankly, having been around for twenty years and then quite a few more, I have no idea what you're talking about in your comment.
The early web was largely academic, not corporate. I was there when it switched over. You’re describing a time period after the dot com crash as the early internet, but it was around before that and was quite nice actually. I was a kid back then, we learned in junior high school how to upload our hand-edited websites via ftp over dial up internet, and the companies that intermediated the internet to us were ISPs not advertising companies. I suppose AOL was an exception but nobody I know used it and would have been made fun of for doing so.
I had a similar need, and after going through the docs for a few existing solutions (grafana, elastic, prometheus, etc) I decided to roll my own.

No db on the receiver and log-based storage on the senders (using standard log rotation to manage size). A systemd service to write to logs, another to read the last value and push to remote if it has changed. Bash all around.

Other than absolutely 0 maintenance required, and just a $5 droplet, the thing I like the most is the dashboard. It just looks like a spreadsheet. A row for each server, a column for each metric. Click on a cell to view charts for that metric. If metrics are failing health checks cell goes orange, or red if critical. Otherwise it's all gray.

So I can have the dashboard open on a screen and just glance at it and know if something is off. I haven't seen anyone else providing such a dashboard, maybe you can give it a go:)
A fair assessment might be that instead of a large number of regular users leaving bad comments there is a small number, potentially even one, that spin up sock accounts to make a disproportionally larger number of bigoted comments.
>make the barrier to entry, and especially mantainence over time, of personal websites much more difficult.

All of this can be automated away.
That doesn't change the content in any way. Of course people will use one off accounts to be assholes.
It doesnt matter. What matters is what side you are perceived to be on.
UniSQL/X had a reasonable table inheritance model in the 90s, as did UName*It (though I'm probably one of half a dozen people here max who know what UName*It is, let alone used it or worked on it in any way).
Why is dropping HTTP valuable? CA HTTPS is extremely fragile and will eventually break over even just a few years without mantainence. HTTP sites have no expiration date(s). HTTP+HTTPS is the best of both worlds. Unless your threat model includes targeted MITM attacks and your website requires the execution of javascript code.
It is never mentioned that electricity from fossil fuel generation consumes a lot of water.

According to the U.S. Geological Survey, electric power generators are the largest source of U.S. water withdrawals and account for about 40% of total water withdrawals in the United States:https://www.eia.gov/todayinenergy/detail.php?id=37453

Thermoelectric power plants—including coal, nuclear, and natural gas plants—boil water to create steam, which then spins a turbine to generate electricity. Cooling water is passed through the steam leaving the turbine to cool and condense the steam. This step reduces the steam's exit pressure and recaptures its heat, which is then used to preheat fluid entering the boiler.

U.S. thermoelectric plants are the largest source of U.S. water withdrawals, accounting for more than 40% of total U.S. water withdrawals in 2015:https://www.eia.gov/todayinenergy/detail.php?id=50698
Tweag [0] has great content supported by a high contrast, brutalist(?) website that I find quite attractive.

[0] https://tweag.io/
It is a good scam, but you have to assume you have a limited window before getting caught. Too many accomplices - eventually someone will be caught and rat out the rest of the crew.

What other high value items are shipped regularly? I thought Costco started selling gold recently, which seems way more lucrative and harder to trace than phones.
> My rather hasty prototype is actually implemented in Python - not a language you want to do tons of arithmetic in [...]

It might actually not be too bad? The actual big integer arithmetic is written in some fast language, and Python is just the glue holding everything together.
I came back to this post because of this issue.

I want to delete my account—not unsubscribe. It's a cool idea, but only accessible to me between 00:39:00–03:39:00 (UTC-01:00). I'm too old for that! :P

I assume there is a way to delete my account behind the login wall… but I can't log in outside of the "open" hours.

Therefore, I'm stuck: I can't be online during the "open" hours and the login button is disabled and reads "Log in (unavailable)" during the "closed" hours.

I also tried to reply to your email with a data deletion request, but the delivery failed. There is no support email on the homepage, nor a way to message you directly via HN.
Is the old background-image way still valid?
That disclaimer when visited from HN has been there forever, it’s not related to recent news.
Wake me up when we go back to discussing progress, instead of being wooed by fake toddlers doing tricks badly.
In narrative games, constraints are the point
That's a good point. I think most people go into Costco to get the gold though. I'd need some good shipping insurance on a $3000+ purchase
If leaders use LLMs even a fraction as often as I do each day, we can say with 99.99% certainty that major decisions are already heavily influenced by them. IMHO, that's a significant improvement over human intervention, which often comes with biases or even ill intentions.
Whatever the solution is here, it must not, under any circumstance, involve an analysis of why people are so willing to steal from one another. All that matters is me getting my iPhone.
Things have been moving so fast that it’s honestly hard for a small team to do that in parallel.

I got to present at GCP Next about a part of this last year: https://www.youtube.com/watch?v=5QsM1K9ahtw

I’m presenting in one (and maybe two) sessions with more info on the training side this year.
Terms of Service, Didn't Read
Are deliveries of new iPhones not insured? If they are, I'd think it's the insurance company's problem. I suppose they will claim they have a photo of the package on your doorstep but if a porch pirate gets to it first do they not cover that?
Henry Heffernan Portfolio
Guess the title was changed from earlier.... "shakes up"

https://news.ycombinator.com/item?id=43425082
I have a partially assembled QMX+ sitting on my bench. I need to get it finished.

I'll let somebody else talk about why this firmware update is somewhat earth shattering for the ham radio community and why the QMX itself is a huge deal. We're talking a $1K SDR for $150, multiband up to 6M, fully digital.
When I'm coding, I have at least 2 workspaces out of 10 dedicated to manual pages and documentation, so I don't need to always remember (sometimes incorrectly). I do make mistakes, but usage of strtok is not one of them.
Isn't this just the elliptic curve problem and RH?

As in, could you somehow solve it without knocking the other two down in a major way?
This seems like introducing unnecessary complexity in the final artifact in order to use LLMs. Square peg, round hole.
Benchmark of QtQuickCompiler on low-end embedded Linux
LLMs are not free of biases (and, because there are comparatively few major LLMs in use, and with very similar training, far less diversity in biases than humans that might be consulter.)
Or maybe HTMX
Existing career auditors have been ineffective for whatever reasons. New people taking a look at things seems reasonable. Whether DOGE is part of the answer remains to be seen.
When I say “they”, I’m referring to the people ICE reports to. Precedent and rules don’t constrain them, so what happened in past years seems irrelevant.
You would need first-class functions (closures). This might work for the example you've given where we pass in a string - a non-linear value.

However, consider the case where we might partially apply a linear value - the value will be consumed and stored as part of the closure object - but linear values can only be contained in linear types - which would mean that the function itself must also become linear - and then you would only be able to use it once. These would be "one-shot" functions - because calling them would consume them. You would only be able to use them once - and if you wanted to reuse them, you would have to return a new function to replace the old one each time you call it.
Yes, now you say that, I think what I read was actually about the engines.
You might like 'git commit --allow-empty' to make your somewhat-useless commits.

But honestly, doesn't github now have a button you can press to retrigger actions without a commit?

GitHub Actions are least hassle, when you don't care about how much compute time you are burning through. Either because you are using the free-for-open-source repositories version, or because your company doesn't care about the cost.

If you care about the compute time you are burning, then you can configure them enough to help with that, but it quickly becomes a major hassle.
A couple pieces of feedback from someone who loves your content

1. I can't find an RSS feed anywhere?

2. Your homepage (https://longlead.com/#stories) is — and there's no gentle way to put this — borderline unusable. All I want is a simple list of your stories.

With a little bit of "undesigning," you'd have an amazing site :)
This has already been solved since last year with Private Cloud Compute.
As a counterpoint... 50 or 60 years ago your average person wouldn't be familiar with QWERTY unless they were in one of a fairly small number of professions (secretary, author, journalist...). QWERTY was something you had to learn.

These days everyone types on a keyboard. It's way more universal, to the point where a non QWERTY layout has to impose additional cognitive load.
It’s used in order to prevent redundant rerender to child components.
When passing to a child component a function you’ve created inside functional component it’s get recreated because JS doesn’t keep references to a function created inside a function, thus making your child component rerender because a prop has changed.

This example actually really corresponds with this post comments, the need for useCallback have only emerged after the move from class components, because private methods you create in a class do not get recreated at each render
In fact, he's a dictator (or dictator-wannabe) out of central casting. Same excuses, same rhetoric (conspiracies, etc.), same crap going back to the Cold War - secret communicst conspiracies among the left that had to be stopped, and somehow it had to be done illegally would coincidentally end up with him holding all the power.

It's even more absurd - another universal characteristic of dictators - because in the Cold War, at least the CCP was leftist, supported by some radical left fellow travellers. You won't see many on the far left supporting the Chinese Communist Party! It's now a favorite, along with Russia, among far right-wing oligarchs.

Kudos to the South Korean people for stopping this nonsense and standing up for their self-determination, freedom, and democracy. The West should follow their example and get their help and advice.
> soda bottle

The article never states that the bottle should be made of plastic. Or glass.
What ElevenLabs and OpenAI call “speech to speech” are completely different.

ElevenLabs’ takes as input audio of speech and maps it to a new speech audio that sounds like a different speaker said it, but with the exact same intonation.

OpenAI’s is an end-to-end multimodal conversational model that listens to a user speaking and responds in audio.
My computer treats me like a computer
Xeriscaping is a thing. Also are other greenery options than grass. We had a dust/mud patch, but then planted 100% clover (by simply throwing seeds on the ground). Now we have completely unmanaged greenery. It's not neat, we don't even water it - it's green in the spring, golden/brown in other seasons. Easy peasy.