mcint

Nice to be reminded of the collection, and another way to present it.

I want to view the boxes, especially after filtering, grouped near eye level and seeing the faces not just the spines.

Nice to see VR (potential for XR), cool use!

The overriding of click behavior is quite annoying. 30 years of browser user-agent behavior.

Next, Vercel, already handle this correctly. It takes special effort to violate "least surprise" here. Cmd-click on a link, should open it in a new tab.

It does appear to be an issue with SimpleAnalytics, now Adobe's,

    onclick="saAutomatedLink(this, 'outbound'); return false;"

Good sites, good blogs, *don't override onclick for links.* Or handle it correctly. I'll leave an issue on the github.

Between your footer, and dotfiles repo, OP does seem to appreciate standards & norms, in principle.

Should you use RSA in production always make sure to use numbers which are at least 512 Bit / 64 Byte long.

512-bit RSA has been breakable, by academics, since before this millennium.

RSA number | Decimal digits | Binary digits | Cash prize offered | Factored on | Factored by

RSA155 | 155 | 512 | US$9,383[8] | August 22, 1999 | Herman te Riele et al.

https://en.wikipedia.org/wiki/RSA_Factoring_Challenge

Further, according to authors of the paper factoring RSA-768 (bit), in 2009/10

it would be prudent to phase out usage of 1024-bit RSA within the next three to four years. (p1, 2010)

https://eprint.iacr.org/2010/006.pdf

Enterprises moving slow, or preferring to remain on old technology that they already know how to work...is received wisdom in hn-adjacent computing, a truism known and reported for more than 3 decades (5 decades since the Mythical Man-Month).

Sounds like someone who's responsible, on the hook, for a bunch of processes, repeatable processes (as much as LLM driven processes will be), operating at scale.

Just in the open, tools like open-webui bolts on evals so you can compare: how different models, including new ones, perform on the tasks that you in particular care about.

Indeed LLM model providers mainly don't release models that do worse on benchmarks—running evals is the same kind of testing, but outside the corporate boundary, pre-release feedback loop, and public evaluation.

https://chatgpt.com/share/69aa1972-ae84-800a-9cb1-de5d5fd7a4...

Congratulations! I’ll be interested to see the next steps in alignment. Do you plan to start selling access, or collect more data to train bigger & better? What tasks or benchmarks are your biggest guide stars, or what was unexpectedly tricky—a few are hinted in the post.

It would be pretty interesting to see activation maps for the encoder on video, confidence building to see the compression derived from so much training.

I would appreciate it. It’s such a joy to use, to share, and (admitting I haven’t) nice to see & share the code & configuration to feed algolia, on a more serious scale of us than I’m likely to use in a hobby project or find/grok/share another public example with code + data.

It's good FUD. You re-iterate their talking points. (Also, no CTA, no takeaway, just "worry!")

As others have said, the data has to be publishable to be useful. We do have data export laws. The format is known to be ready to use interoperably, not some private schema--atop the PBC commitment, which will at least have moderate legal costs if not a guarantee. It has unequivocally set a new high bar.

They seem pretty locked in to doing what they committed to. The day may come when they turn. It may come first by friction, but the turn has to be pretty complete, because the data is pretty open. What's needed to view it, use it at all, is pretty close to what's needed to host it.

"The site whose value prop is sharing your posts and data with other apps may stop sharing your posts and data with other apps." Yeah, it's possible. It's also possible they just close.

The math don't math.

$/TB, TB, and $ don't interconvert. Most obvious when you sort by $/TB. Sloppy slop.

Well, Twitter/X gets this wrong too. Pretty often jumps away from what you're viewing, especially on the nav-in to a thread or nav-out from a thread actions.

aiui "distrobox" is built to support these setups and experimentation, even more readily, including defaults to support:

The created container will be tightly integrated with the host, allowing sharing of the HOME directory of the user, external storage, external USB devices and graphical apps (X11/Wayland), and audio.

https://distrobox.it/

Why * Provide a mutable environment on an immutable OS, like ChromeOS, Fedora Silverblue, OpenSUSE Aeon/Kalpa, or SteamOS3 ... * Provide a locally privileged environment for sudoless setups (eg. company-provided laptops, security reasons, etc…) * To mix and match a stable base system (eg. Debian Stable, Ubuntu LTS, RedHat) with a bleeding-edge environment for development or gaming (eg. Arch, OpenSUSE Tumbleweed, or Fedora with the latest Mesa) * Leverage a high abundance of curated distro images for docker/podman to manage multiple environments.

Aims This project aims to bring any distro userland to any other distro supporting podman, docker, or lilipod. It has been written in POSIX shell to be as portable as possible and it does not have problems with dependencies and glibc version’s compatibility.

It also aims to enter the container as fast as possible, every millisecond adds up if you use the container as your default environment for your terminal:

Security implications Isolation and sandboxing are not the main aims of the project, on the contrary it aims to tightly integrate the container with the host. The container will have complete access to your home, pen drive, and so on, so do not expect it to be highly sandboxed like a plain docker/podman container or a Flatpak.

  distrobox create -n test

  distrobox create --name test --init --image debian:latest --additional-packages "systemd libpam-systemd pipewire-audio-client-libraries"

  distrobox enter test

It needs to resolve faster if more people vote, based on a running average of voters, or sqrt of viewers present.

Yeah, I'm bouncing for now on the localhost requirement. Or, on a related issue of not parsing my .ssh/config, a Match directive, and not wanting it to parse it yet. I grep'ed for an env var to override, but only USER and SSH_AUTH_SOCK are pulled in.

I did go get install ...nerdlog/cmd/nerdlog-tui@latest just fine.

Thanks for hacking in the open, and releasing early.

Hi again. I have the same issue in my browser, and locally in nvim.

NerdFonts (and the right terminal emulator) were needed, and enough, there. Playing with AstroNvim, and blocked by use of yakuake.

Hoping that I can hot load something from https://www.nerdfonts.com/font-downloads, I'm not sure what from https://fonts.google.com/ has the needed ligatures or symbols.

Excellent descriptive analysis. Wrong, misleading title, perhaps "technically correct," but at best with a "backdoored" meaning.

It points out the need and use for build-manager tools that go a step beyond union file system layers, but track then enforce that e.g. tests cannot pollute build artifacts. Take a causal trace graph of files affecting files, in the build process, make that trace graph explicit, and then build a way to enforce that graph, or report on deviations from previous trace graphs.

Can we update the title with the project name, adminer?

I've gently relied on this tool, it's basically delightful to use. Simple to deploy, doesn't fight the protocol and software stack it can be deployed alongside for securing, using. A shining, straightforward FOSS success.

Well, simple guesses at migration don't help either.

https://www.krayorn.com/posts/why-blog-if-nobody-reads-it/

https://www.krayorn.com/why-blog-if-nobody-reads-it/

Good luck with the personal blogging infrastructure, hobby horse of many a working developer. Good excuse to play with new systems.

Looks like the blog migration is incomplete -- links still point to the former

https://andysblog.uk/why-blog-if-nobody-reads-it/

https://andysblog.uk/why-your-blog-post-didnt-go-viral/

Which now 404s, with message from Vercel, "Deployment not found", sfo trace ids.

Congratulations on migrating to a new domain -- hope Vercel serves you well. A little disappointing about the lack of easy redirecting so far.

https://web.archive.org/web/20250219111210/https://andysblog...

https://web.archive.org/web/20250214201735/https://andysblog...

Bearblog.dev no less.

You should include your name, and link to channel in the form's self description. I accidentally followed the link blindly, and had no context.

Anyone following the link directly without viewing comments or knowing your hn username will be confused. I suspect your intended audience is larger than: people who already know you and your content well.

Good call, already linked.

p 11 (/30), makes a terrible case in handwaving.

It ignores the requirement that secret data needs to stay secret for 30 years, or 100 years, or long into the future, and attacks only get better.

https://www.schneier.com/blog/archives/2009/07/another_new_a...

They also describe an attack against 11-round AES-256 that requires 2^70 time—almost practical.

> AES is the best known and most widely used block cipher. Its three versions (AES-128, AES-192, and AES-256) differ in their key sizes (128 bits, 192 bits and 256 bits) and in their number of rounds (10, 12, and 14, respectively).

> In the case of AES-128, there is no known attack which is faster than the 2^128 complexity of exhaustive search. However, AES-192 and AES-256 were recently shown to be breakable by attacks which require 2^176 and 2^119 time, respectively.

Shared previously:

* yesterday, Feb 9, 2025: https://news.ycombinator.com/item?id=42990401

* Jan 28, 2025: https://news.ycombinator.com/item?id=42862468

* Dec 28, 2024: https://news.ycombinator.com/item?id=42529701

Someone should say it, even if it amounts to a wordy "get" or "first". Proof of concept, attacks only get worse, risks here only grow.

Each year, between Christmas and New Years. https://en.wikipedia.org/wiki/Chaos_Communication_Congress

Piece first appeared at Houston Strategies.

[author] is also an editor of the Houston Strategies blog.

It all makes sense.

--

Most large cities, even in the US, succeed because of good planning, specifically that doesn't require treating cars as the dominant lifeform.

--

I sympathize with comments on the [original] blog post, where, given that Huston already exists, and you've built a career there, and the city and community: speak, serve, reward; marginal car use (except for everyone else's car use), I understand how an incremental billion dollar freeway seems like an incremental improvement over something that doesn't let you do what a car could let you do.

It's a kind of Stockholm syndrome, "Huston syndrome" might be more appropriate,

[original]: https://houstonstrategies.blogspot.com/2023/06/induced-deman...

I would also recommend, call to attention, the Further Reading from CLIG, https://clig.dev/#further-reading. POSIX, GNU, Unix resources, Heroku CLI guide, and 12-factor CLI app guide.

Checking in incognito set me right. That message didn't go up for quite some days.

I've only see the ERR_INVALID_RESPONSE in all my attempts.

pushcx undermines his case by mixing more and less legitimate reasons.

It's hard building a browser to be accepted widely.

Though Brave also does incredible research in security and privacy --- and actually deploys it to millions of clients.

The 5-8 settings toggles to turn off sponsored features are a small price.

Inserting their own referral codes into links was a bit far -- though with 1) explicit notification, and 2) a setting to disable it, I would find it perfectly unobjectionable.

Some of the complaints are legitimate, that brave team discusses quite clearly in GitHub issues how to bypass blocks, though in many cases this amounts to the same as bypassing paywall or registration blocks with extensions, something I presume is so standard among hn and lobsters readership alike, that its absence would be remarkable.

Thanks for posting this! I was bitten by this since last weekend and I didn't think to share here.

Mentioned by others, but I like project pages or home git repositories.

https://github.com/openstenoproject/plover

https://www.openstenoproject.org/plover/

An in-browser demo, https://www.openstenoproject.org/demo/

Suggested, loved extensions, https://github.com/openstenoproject/awesome-plover

Chorded keyboard input methods, more generally, are worth looking into.

The meaning, clear by original context, of the author, head at instagram, would be "web data [as opposed to [total user web &] app usage data]". Which matches closer to what he's responsible for in parallel.

But, continuing technical distinctions outside of original context, in web jargon, web would be HTML served over HTTP (preferably even on www subdomains), and, by my single-utterance litmus test: "browser-viewable". These apps do make content available over/on the web, but having the distinction available seems worthwhile, web traffic versus app traffic. Many apps don't. Some of the content is meaningfully "not on the web" by the same common sense appeal.