grammarxcore

Sure, but spigot is a library, not the interpreter. The author’s program is short because it hides that.

We have the same insight into the sources as we do OpenAI’s finances.

Surprisingly I don’t see Wales commenting on the Armenian Genocide talk page. I don’t see the difference between the two. What am I missing?

https://en.wikipedia.org/wiki/Armenian_genocide

Your README links docs that don’t exist.

This is fairly common in academia. Instead of having to explain something every single time something common happens, you just throw it on a web page and link that. Reference letters, office hours, and LaTeX formatting are all super common here. I understand why you might respond this way; I view it just as a different kind of https://nohello.net

I don’t understand what sets this apart from any other random AI scraper I don’t want wasting my resources. It’s possibly worse because of the brute force tools involved. Is the assumption here that you’re allowed to run this tool against any website that runs a bug bounty program? Or do you have more refined criteria?

AWS finally added the ability to swap between a few accounts [1]. There’s an arbitrary limit of 5 so it’s really bad if, say, you work for an enterprise and have lots of accounts or, say, you work for a smaller business following the AWS Well-Architected Framework and isolate things. Containers still win.

1: https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/mu...

> Many samples have an issue description that is underspecified, leading to ambiguity on what the problem is and how it should be solved.

OpenAI apparently tuned _basic discovery and refinement_ out of the tests so I don’t think this is a benchmark of anything useful. It can’t replace a human but can possibly make a human more productive.

https://openai.com/index/introducing-swe-bench-verified/

The big thing missing from the article is how a device that contains many passkeys is any different from a password manager that enforces security settings. I don’t worry about passwords my password manager generates getting compromised because I use at least 24 random characters (assuming my password manager is using a cryptographically secure PRNG that guarantees some level of randomness, giving us more than 128 bits). Assuming I use that to manage the password to my email, I really only have to worry about my password manager key being compromised. I only used my password manager on trusted devices so I really only have to worry about my trusted devices being compromised.

If I use passkeys, I have to worry about my trusted devices being compromised. According to the article, “as long as you can remember your phone password, you can log in to your accounts.” That sounds like my password manager. The other benefits also sound like a combination of my password manager and privacy focus. I’m not saying this is bad; I just don’t see how it’s different from a security-conscious status quo.

I refuse to believe that not answering every single email within an hour is a good predictor of anything other than being glued to your phone. I think extending it to a reasonable amount of time, maybe a business day max, works out pretty well. Sometimes people respond really fast because they’re taking regular breaks and other times they don’t respond all evening because they’re putting on their kid’s birthday party. Even at work, sometimes very good colleagues are doing things back-to-back for hours and using short windows to do things like go to the bathroom.

On the other hand maybe this is some art thing I’m too far away from to understand? Maybe really good artists to work with never need more than twenty minutes of deep focus at a time for anything?

Poe’s Law strikes again…

The comment said “crack on with it” not “take crack for it.” “Crack on” is an idiom more associated with British English than American English.

https://dictionary.cambridge.org/us/dictionary/english/crack...

The author directly addresses your concern at the bottom of the post. There’s also a link to the context for why they had to do this and a reluctance for the authority.

Assuming you’re interested enough in the content to actually care about subscribing, using single-purpose email aliases is the best way to handle these two problems. For the rare thing I want to subscribe to, I have a unique email and tuned subscription preferences. I can turn off the email if I’m done with the content and not worry about trying to figure out how to cancel the sub.

If you are contending only the rich should be able to own homes, sure. Canada’s had a huge problem of rent vs own and has seen a huge cost of living increase. Building homes exclusively to rent is a net negative when looked at through the lens of home ownership. If, however, you just want companies busy building homes their employees will have to pay someone else to use for the rest of their lives, it’s okay to build just for renting.

For this specific problem, I trust the large number of companies that have product lines with devoted test suites more than I do a random LLM. Sometimes it’s better to pick the correct specific tool for a job than a random general purpose tool.

This is a classic XY problem [1]. My _immediate_ reaction to seeing the dev attempt to compare US addresses was “where’s the USPS library?” Using an LLM prompt instead of a vetted library is just the wrong answer to solving the right problem.

[1]: https://xyproblem.info/

Where can I find any information about the handoff? There’s been a slew of stories about the mil->ml typo and a few claims on the fediverse about the government taking back domains. I can’t search it without just getting articles about the typo (and nothing else). So far I haven’t actually found anything that announces a change in ownership (aside from some different names on IANA).

I think that’s fair! I am currently in a phase where I’m struggling to find something to pull my interest. I often reevaluate things I’ve put down before if the right commentary pulls me back in. I might give it another shot to see if I can hit that mark. Thanks for the insight!

I had to open the article to understand what it was about. The initialism is ambiguous; I thought someone might be trying to shorten GitHub Copilot and was curious to see how the team behind it was optimizing its speed. I would have been much more enlightened.

If you’re attempting to share something with an audience not steeped in your jargon, it’s usually better practice to lead with the full then shorten later.

I really struggled to get into this; I’ve had several people recommend it. How far do you think it’s important to read before deciding it’s not for me?

I feel like the two are already equal in certain circles (eg the crypto space) so, as many comments are pointing out, understanding how relationships are built is important. That being said, if the black box is revealed, it’s not really a guessing game any more.

That’s been my experience with DevOps/SRE tooling as well. I think things are beginning to get a bit better (or the projects I’ve been using for a few years are finally getting stable). After getting burned multiple times by HashiCorp I am super non-1.X+-averse when it comes to picking anything.

WSL has been out for at least five years now and it’s still just a fancy kernel adapter without feature parity. I might begin to worry once things like containers actually work properly. Until then, I don’t think Microsoft has fully embraced Linux much less extended it.

I did just now learn that systemd was finally added to WSL. Originally that was never going to be added and back in the days of WSL 1 I remember the WSL writing blog posts about that being ridiculous. Who knows, proper container support might be added soon.

One of my favorites is “nonplussed,” because its evolution into two opposite things is both generational and split across British vs North American English.

Have you considered that you might not be the target audience? Atuin’s ability to sync across computers while being able to separate the context the command was used in has been incredibly useful to my team.

You are correct that the specs support ECC. Go's implementation is not complete (see https://godoc.org/golang.org/x/crypto/openpgp/packet). More importantly you can't guarantee clients will be able to use ECC. See this issue (from my initial link): https://github.com/golang/go/issues/20058

I've mentioned this before on HN [1]. I strongly hope 1.15 will finally address the math/big.addMulVVW issues that really slow down RSA computations, directly affecting PGP and TLS.

[1] https://news.ycombinator.com/item?id=21968913

Edit: I screwed up some initialisms.

Why is coding something that could easily add functionality to, say, PC Part Picker, a lazy trend?

I misinterpreted the title. Fortinet has removed backdoors from SSH and databases in its product. Granted, I'm genuinely surprised any security program has this feature:

> "FortiSIEM has a hardcoded SSH public key for user 'tunneluser' which is the same between all installs," said Andrew Klaus, the security researcher who identified this issue.

What other horrible assumptions have been hardcoded into this product that we have yet to discover?