skysight-inc/HackerNews huggingface dataset:
Definitely interested to kick the tires and compare to some of the other solutions out there. As others mentioned, you lose some benefits of an OIDC-integrated SSH CA, but that’s a reasonable trade off in order to reduce complexity for many use cases.

A missing piece of the puzzle for me is general OSS tooling to provision the Linux OS users. While it works in some environments to grant multiple parties access to the same underlying OS users, it’s necessary (or at least easier) in others to have users accessed named user accounts.

Step-ca makes good use of NSS/PAM to make this seamless when attached to a smallstep account (which can be backed by an IdP and provisioned through SCIM). While I could stand up LDAP to accommodate this use case, I’d love a lightweight way for a couple of servers to source users directly from the most popular IdP APIs. I get by with a script that syncs a group every N minutes. And while that’s more than sufficient for a couple of these use cases, I’ll own up to wanting the shiny thing and the same elegance of step-ca’s tooling.
that requires LLM as judge
"Tell me how process isolation prevents SQL injection."

You need process isolation to make the system secure enough to even require SQL injection. Otherwise, they can send packets to attack anything else on the system, get full privileges, and swap your SQL-enabled application with their own. While taking your database.

Further, techniques to block SQL injection work even better when they're in an isolated partition the attacker can't escape from. Even better if data can only flow in a specific way. Even better if it can be reliably cut off and recovered upon detection of a failure. That's why high-assurance guards used to sit between sensitive systems and untrusted networks. They did all of these things.

Now, for application-level issues. The Separation Kernel Protection Profile, which inspired designs like INTEGRITY-178B and seL4, called for secure middlewhere to protect communications between partitions or systems. That included message routers that enforced the security policy within the system. That would include protocol-level defenses, like for SQL requests, to protect communications outside the box.

seL4's isolation was, by itself, never intended to stop unrelated attacks. The vision, described in NICTA's Trustworthy Embedded Systems program, was to combine many components to do that. I'll add that seL4 team did a great job documenting the many points they may fail in their Assumptions page. They were much more open about it than most competing projects.
The journalist published proof that Hegseth texted detailed military attack plans via Signal two hours prior to the attack (the secrets) after multiple participants on the Signal chain lied to congress in a public hearing and claimed it didn’t happen. Would letting those lies stand have been the ethical thing for a journalist to do? Exposing a bunch of liars at the highest level of government is absolutely American and something all US citizens should be expected to do. Sadly, about half of Americans will still believe the lies even now that they have been exposed.
I had something like this once.

Vendor provided an outlook plugin (ew) that linked storage directly in outlook (double ew) and contained a built in pdf viewer (disgusting) for law firms to manage their cases.

One user, regardless of PC, user account or any other isolation factor, would reliably crash the program and outlook with it.

She could work for 40 minutes on another users logged in account on another PC and reproduce the issue.

Turns out it was a memory allocation issue. When you open a file saved in the addons storage, via the built in pdf viewer, it would allocate memory for it. However, when you close the pdf file, it would not deallocate that memory. After debugging her usage for some time, I noted that there was a memory deallocation, but it was performed at intervals.

If there were 20 or so pdf allocations and then she switched customer case file before a deallocation, regardless of available memory, the memory allocation system in the addon would shit the bed and crash.

This one user, an absolute powerhouse of a woman I must say, could type 300 wpm and would rapidly read -> close -> assign -> allocate -> write notes faster than anyone I have ever seen before. We legitimately got her to rate limit herself to 2 files per 10 minutes as an initial workaround while waiting for a patch from the vendor.

I had to write one hell of a bug report to the vendor before they would even look at it. Naturally they could not reproduce the error through their normal tests and tried closing the bug on me several times. The first update they rolled out upped it to something like 40 pdfs viewed every 15 minutes. But she still managed to touch the new ceiling on occasion (I imagine billing each of those customers 7 minutes a pop or whatever law firms do) and ultimately they had to rewrite the entire memory system.
I used atop sporadically at Facebook to debug performance issues. I actually learned about it there, was I think on all the machines. This was bunch of years ago, so not sure if it still is there fleetwide, but it was really helpful to get a past granular view of what happened on the machine on some exact second few days ago where error rate metrics indicate a particular host was struggling.
Here are more details about the "proof of concept":
https://eu-os.gitlab.io/goals#from-home

This seems to be more about Linux deployment in big organizations, they say goal isn't to develop yet another distro.

The FAQ mentions no name of any involved person, which leaves me slightly suspicious, and the adoption of RedHat-based Fedora remains unexplained goal rather than result of some analysis against a list of project requirements.
What if the abuse can't be 100% proven but you have multiple victims? In this type of case, the perp gets away with it alot of the time.

However...if judged by the community, its highly unlikely that they would get away with it.

The law fails victims of all kinds of sexual abuse all the time, to the point where most perpetrators get away with it.

Gaps the legal system let some paedophile priests get away with it and also lead to unjust prosecutions like we see in the article.
This also doesn't have the sort of language I'd expect from a project associated with the EU ('supported by', 'views do not necessarily reflect those of the EU', etc), which is what signaled to me that it wasn't official. Even calling it a 'community-led initiative' seems to me to risk misinterpretation, in potentially suggesting that it is some sort of EU initiative that is community-led, when it in fact appears to simply be a group of people and not associated with EU institutions at all.

It does have a logo, however, which seems to be extremely important for EU-associated projects.
Well said. I see few people who understand this.
It's in the FreeBSD src tree. But we usually commit code once it's working...
I've been wanting to try DJing so this could be quite good for me as someone at entry-level who generally doesn't buy music unless it's only on Bandcamp.
> HIPAA isn’t really a personal privacy regulation at all ...

HIPAA as a whole is not.

The HIPAA Privacy and Security Rules, which are enforced by a different entity than the rest of HIPAA, are (the bulk of HIPAA is insurance administration rules enforced by the Centers for Medicare and Medicaid Services; the Privacy and Security Rules are personal privacy and information security rules enforced by the DHHS Office of Civil Rights.)
> $1.5 million/year

That is excessive and it's already $4K a day.

Lots of teams really underestimate cloud costs since there is an assumption that the hundreds of millions they are raising will give them enough runway to survive a few years despite losing money for years.

Even scaling would be somewhat of an issue depending on the tech stack. Imagine the cost of running standard Java micro-services and the "solution" was to "spin up hundreds of more nodes". The worst that I have seen was a bank proudly having up to 8,000 - 10,000 separate micro-services.

Just imagine the daily cost of that. Unjustifiable.

But of course the AWS cloud consultants would be happy to shill you their offerings at "cheap" prices, but in reality the pricing is designed for you to accumulate millions in costs as you scale on the tiniest amount of usage, even for testing.

So before you build the software, one must think about the costs of scaling if it becomes widely used rather than taking the easy approach in just spinning up nodes and increasing more costs and act as if you don't have the capital to solve the problem. You can only do that for so long until you don't.
I wouldn’t say incentivized, but temptation would lead to that. We are not tempted though. We build new things on the same open, simple interfaces we want to support long term.

For example, https://mcp.run is one such business we are very excited about — and it is Extism at the core. No modifications to the runtime, just the same Extism we all know and love.

And we want way more than our own team to help maintain the open source project, no doubt about that! So simplicity and transparency are the name of the game.
Chinese Embassy Is Promoting American YouTuber IShowSpeed
If this was a regression, could a binary search be done on check-ins? Or is the code too distributed?
> Lets hope the BSDs can continue staying independent of Large Corporations.

I have some bad news for you on what MacOS and iOS are originally based on.
The massive sports funding is mostly only a thing for D1 schools and it doesn't take much funding away from academics. The sports mostly pay for themselves through ticket sales and media licensing, with the big chunks of revenue coming from men's football and basketball. Sports also drive a lot of alumni donations.
>and better than Google's mediocre Pixel line

Pixel 7, or any android in that era would definitely be slower than iPhone. ( Google Pixel itself uses mediocre SoC ) But the recent ones are catching up fast and latest Samsung is Snapdragon Elite is actually faster than iOS.

I think that is partly because Google had to optimise the hell out of its software due to slower CPU performance. And partly just Apple's iOS has fallen a lot in quality.
> is just that they’re doing less.

The loaded term for that is simply "cutting corners."
> I can't compare exactly but I feel like today the business pays more, the customer pays more, the drivers get paid less and it's all subsidized by investors to boot. Am I totally wrong on this?

It is exactly that! Food delivery is an excellent example of 'things just got worse'.

In 2019, 'delivery' was a specialty a restaurant would have to focus on to offer. Pizza places (Papa Johns, Pizza Hut, etc) and other specific delivery-focused restaurants (such as Panera Bread, Jimmy Johns, or your local Chinese restaurant) would have actual W2 employees who did delivery driving, as part of their job. The restaurant would want deliveries to go well (for both the customer, as well as the driver), so would make sure their own staff had reasonable access to food, some light training, and would ensure they could deliver it somewhat well. (They would reject orders too far away, they wouldn't serve food that wouldn't survive a delivery trip well, etc)

In post-COVID 2025, "every" restaurant offers delivery, but almost no restaurant still employs their own delivery drivers (locally, Jimmy Johns might be the only one left). Everyone else just outsourced to DoorDash. DoorDash drivers are employees who are 'legally-not-employees' (1099 employees), so they no longer have any direct access to the restaurants, and they can't train well for any specific service, because they might have to visit any-of-50 restaurants on any given day, all of which have entirely different procedures (even if they are the same brand or chain). Restaurants have zero incentive to ensure deliveries go well (the drivers aren't their employees, so they no longer care about turnover, and customers have to use DoorDash or Uber Eats or equivalent, because almost every restaurant uses it, so there's no downside to a DoorDash delivery going bad).

Prices to consumers are double-to-higher than what they were in 2019, depending on the restaurant. Wages are down, employment security is entirely eliminated. Quality and service have tanked.

Presumably, investors make slightly more money off of all of this?
Dont know about Andriod but iOS you can select not to save images into camera roll.
The post should at least mention in passing the major problem with CSV: it is a "no spec" family of de-facto formats, not a single thing (it is an example of "historically grown").
And omission of that meams I'm going to have to call this our for its bias (but then it is a love letter, and love makes blind...).

Unlike XML or JSON, there isn't a document defining the grammar of well-formed or valid CSV files, and there are many flavours that are incompatible with each other in the sense that a reader for one flavour would not be suitable for reading the other and vice versa. Quoting, escaping, UTF-8 support are particular problem areas, but also that you cannot tell programmatically whether line 1 contains column header names or already data (you will have to make an educated guess but there ambiguities in it that cannot be resolved by machine).

Having worked extensively with SGML for linguistic corpora, with XML for Web development and recently with JSON I would say programmatically, JSON is the most convenient to use regarding client code, but also its lack of types makes it useful less broadly than SGML, which is rightly used by e.g. airlines for technical documntation and digital humanities researchers to encode/annotate historic documents, for which it is very suitable, but programmatically puts more burden on developers. You can't have it all...

XML is simpler than SGML, has perhaps the broadest scope and good software support stack (mostly FOSS), but it has been abused a lot (nod to Java coders: Eclipse, Apache UIMA), but I guess a format is not responsible for how people use or abuse it. As usual, the best developers know the pros and cons and make good-taste judgments what to use each time, but some people go ideological.

(Waiting for someone to write a love letter to the infamous Windows INI file format...)
I think the theory would be that they never get practice and never manually drive ever. You know right after we solve the cost issue.
Doing sequential reading into a queue for workers to read is a lot more complicated than having a file format that supports parallel reading.

And the fix to allow parallel reading is pretty trivial: escape new lines so that you can just keep reading until the first unescaped new line and start at that record.

It is particularly helpful if you are distributing work across machines, but even in the single machine case, it's simpler to tell a bunch of workers their offset/limit in a file.
The Javascript ecosystem is the problem and is completely immature by design.
> If a segment has 6 function calls and you want the same error handling for each one, you can't get rid of the boilerplate with the current language.

My deepest sympathies for the person who has to respond to the resultant error once you've collected your paycheque and have moved on to the next project. Which of the six functions produced the error? Nobody knows. That may be all well and good for a contrived internet comment example, but if you write real code like that someone's life is soon going to become a living hell.

Every other language has recognized that you can't have the same error handling for each of the function calls. Even where they have special error handling semantics have special ways to ensure that the handling is different in each case. Why do you think it would work in Go?

> Assume the original error is not my own then.

Then you've forever hitched your horse to their code. A better or more performant replacement comes along in the future and you want to use it instead? Too bad. You can't without breaking your own API – and for what reason?

But, okay, we accept that you like to live life on the edge (or come from the Javascript world and thus don't know any better) and if the people using your functions start having breakage, too bad so sad. However, if you're just passing values through from another package, why are you really offering your callers in the first place? Why don't they just use the other package directly?
The pop composition was nice, if somewhat cliched. (And of course the MIDI instrumentation does it no favors). The guitar solo in the middle was fun - it kind of sounded like it reverted to some of the baroque pieces in its pretraining. Reminded me of the harpischord solo in the Beatles' "In my life".
Honestly any typescript library with great type safety probably has seriously gnarly generics inside. Here[1] is a random file from kysely, which is surprisingly readable even though kysely's type safety is incredibly good.

But things I encounter in the regular non-library world are usually recursive types that have specific constraints. A couple years ago I had my first foray into typescript generics, and was so stumped that I actually gave up. I was trying to map the type of one nested object to another. This[2] is the stackoverflow post from the legendary jcalz that saved me! Check jcalz's link to the TS playground

[1]https://github.com/kysely-org/kysely/blob/master/src/query-b...
[2]https://stackoverflow.com/questions/72461962/is-it-possible-...
> we decided the working class should take out crippling loans to pay for this degree

Historical point you've completely missed. You used to be able to declare bankruptcy and discharge this debt until very recently. This was not "decided" this was a trap sprung on the working class at a time when blue collar labor was almost entirely off shored.

> and just forgiving the debt only will make it all more expensive

That's why you discharge the debt instead. This is an institutional failure. They knowingly pumped a market at tax payer expense. The hair cut is theirs to take.
We've reached out to the maintainer over e-mail.
Let's not trivialize Trump by calling him "orange man", please. Hitler was a whiny little shit nugget as well, but that didn't limit the amount of abject evil he was able to orchestrate. The problem with whiny little shit nuggets is they attract other whiny shit nuggets, and they bond (clump up) over their shared persecution complex. And now we've got a real problem on our hands.

In the context of Canada, as an American all I can say is sorry and also thank you for doing everything in your power to resist "our" dictator since our own federal government is abjectly failing.
OpenAI Close to Finalizing Its $40B SoftBank-Led Funding
It’s not just Gruber. As both a medium-high HN karma person and a Gruber fan I can say there is a definite reduction in the overall quality of discourse around Apple news versus general topics on HN. Much more knee jerk reactions.

I theorize this is due to the overall startup versus incumbents focus as well as the hacker ethos of being opposed to more buttoned up closed systems meant for the general public. Like for example recent posts on EU regulation of Apple get generally favorable reactions and little analysis of actual consumer experience impact, of which Gruber is more keenly analytical.

E.g. most of us on HN would generally appreciate having opt-in side loading and whatnot onto our Apple devices, like macOS. So Gruber just sounds like some kind of apologist when he says this would hurt consumers in the large. We more advanced hacker types are quick to say PEBKAC.

But it’s a shame because his analysis actually offers really good insight in how to build successful consumer products the Apple way.
How do we know this isn't based on DOGE quality data?
We have the same thing in the USA. Some schools like Cal Poly or Texas A&M have an explicit focus on learning by doing rather than knowledge for it's own sake.
My mac of 13 years is running fine..except I am unable to update the OS because Apple has set limitations on the upgrading OS with old hardware. I will probably end up buying a new mac until I can see a good Linux ecosystem.

A friend who is also in the same situation is however going to Surface Pros. He swears its on par with Mac on hardware.
We launched mcp.run in December ‘24 with that prediction (err, gamble ;) )
> There are now more people making garments now than there was 100 years ago.

Exponential population increase only began 75 years ago. This is correct but the analysis is wrong.
Yes, they most certainly are.
P.S. @dang should unflag this
In rural Colorado there is a law that makes subdividing lots under 35 acres very difficult. There are lots of areas in the mountains that have expensive housing. You are allowed to build one 15,000 sqft house but not ten 1,500 sqft houses on the 35 acres. Would love to have something like this in Colorado.
Strongly agree. I don't see how this post in any way deserves flagging based on the guidelines. Is there no karmic penalty for false flags?
To be abundantly clear, this is one guy’s pet project. So far there’s a website and nothing else (I guess in that sense it could masquerade as an EU project). Even calling it a “community-driven project” is way overselling it at this point.

Flagged for clickbait.
so what you are looking for is reproducible build environment ? things like docker have been around doing just that for a while now.
It does mention this. Point 2.
I have no idea how much it helped them, but they didn’t start from zero.

Since it was a commercial product that was open sourced, it already had users.
I requested my data three days ago and got "Raw Data" and "Phased [...]" early today. Still waiting for the last set.
I'm not sure why you think they need new laws to detain you and deport a non-citizen, especially when your paperwork is no good. If you show up to a US border checkpoint and you are not a US citizen, that is standard procedure. It is also a situation where border control has very, very broad powers and entrants have very few of the protections that you might think they have. These are not wildly unpredictable procedures, and as far as I can tell, they have basically not changed - enforcement of illegal crossings is going up a lot, though. The huge difference between now and 6 months ago is that reporters are now seeking out these stories (see how Obama's CBP was putting kids in cages for years without a peep and it took until Trump's first term to get any reporting on the conditions under which families were detained).

The same goes at most other country borders. If I try to force my way into Germany (for example) with no permission to enter and then refuse to leave, you better believe I am headed to a German prison until they can make arrangements to deport me.

It's messy and gross business, certainly. People getting arrested usually is. It is not something to fearmonger over, though, to the millions of visitors who have clean and valid permission to enter the US.
Impressive move by OpenAI. MCP support in Agents SDK will greatly enhance AI agent capabilities. Can't wait to see how developers leverage it.
Given that this is a political figure at the center of a political story, it's no surprise that this story is surrounded by political takes. But I think there's also something to be said for, our modern, digital lives shed so much data incidentally, like a much worse dandruff.
On [1], If you only look at countries with decent GDP per Capita. iOS will have anywhere from 40 to 65% market share. Even in China iOS is well over 30%.

When you consider Africa + ASEAN + India has 3.5B population and has very low iPhone market share that sort of Skew the figures.