101011

Agreed, but server frameworks shouldn't easily enable a foot gun that allows bots to have disk access to your host. Instead, only explicitly defined routes or resource files should be available.

If I had to guess, this person committed their .env file in some repo and pushed that up, and that become available because the server was misconfigured.

For other servers (such as, say, Jetty), config files like that won't get exposed like that unless you're very obviously placing your config files in a public resource folder.

CoW?

The constant stream of features getting added to pgvector is impressive. Also, really love some of the benchmarks and explanations that were thrown in here.

No, for a myriad of reasons. Not the least of which being that investigative reporters have been systematically silenced within those countries, which is well-documented across a number of sources.

And to top it off, the US government isn't deciding who gets Pulitzers - that's an award granted by a private ivy league school.

I know this is completely anecdotal, but I've been a Goodreads user since before Amazon purchased them, and I have found that Goodreads reviews are way more accurate...or, more accurately, they don't have as high of a degree of skew towards very low or very high ratings.

It's definitely changed my buying behavior on more than 1 occasion. I have to imagine it's a big driver of sales, otherwise, as the article mentioned, Amazon would have made much larger UX changes post acquisition.

I'm a little bit incredulous reading this statement. In no world are those outlets in the same ballpark as Russian or Chinese state media.

Just because a new source has a tendency towards bias, doesn't mean that it isn't reliable. There are a small handful of news organizations that make a best effort towards the truth - and WaPo, NYTimes, and WSJ haven't won as many Pulitzers as they have by being unreliable.

Subtracting economics from the equation, aren't there a very limited number of physically difficult problems?

Rockets fans need not inquire?

To be fair, this person didn't say anything on the topic of race.

I don't think that's true. r/nba, a top 10 active subreddit at the time of going private, put it to a public vote where the overwhelming majority of the community voted to suspend indefinitely.

This was during the NBA finals, mind you. Hard to put that sort of result on a small group of mods.

Very interesting perspective, thanks for sharing. What are your thoughts on a mechanism to oust existing mods? Is there any path you'd be willing to see? Or a lesser of two evils? E.g. mods being able to kick each other out with some plurality vs community members holding that power at some high voting threshold

Loved the article, appreciate the share. A meta topic but I wish people would spend more time discussing what they like about something than the opposite.

This author took great pains to give many caveats around their writing and distilled down a very complex topic into something that could be consumed in less than 10 minutes.

I'm smarter for having read this.

Best of luck to any poor soul who attempts to summarize the work of many architects and then share it with this group of people.

They are not the same, but your initial problem of throw a whole book at it and have OpenAI give you an answer is a demo that is solvable in 20 lines of langchain code when leveraging a vector DB.

Demo here: https://www.youtube.com/watch?v=h0DHDp1FbmQ (github code is linked within as well)

Try looking into vector databases to solve that problem.

You can chunk up a book and embed those partitions into a vector database. Then you can take a query and fuzzy match the most relevant documents in your vector database, then feed it back to open AI to resolve an answer.

It's brilliant. Postgres has an extension to support indexing the vectors, and there are some other open source and turnkey solutions in the market as well.

Interesting, I recall it being the nerds of Reddit getting the users of Digg.

Also, they explicitly do have that right, as laid out by their TOS - https://www.redditinc.com/policies/user-agreement-september-...

> You retain any ownership rights you have in Your Content, but you grant Reddit the following license to use that Content:

> When Your Content is created with or submitted to the Services, you grant us a worldwide, royalty-free, perpetual, irrevocable, non-exclusive, transferable, and sublicensable license to use, copy, modify, adapt, prepare derivative works of, distribute, store, perform, and display Your Content and any name, username, voice, or likeness provided in connection with Your Content in all media formats and channels now known or later developed anywhere in the world. This license includes the right for us to make Your Content available for syndication, broadcast, distribution, or publication by other companies, organizations, or individuals who partner with Reddit. You also agree that we may remove metadata associated with Your Content, and you irrevocably waive any claims and assertions of moral rights or attribution with respect to Your Content.

I know this question is situated around the tech, but the real answer is to leave every couple of years. There is always more money to be made, and the more experience you have the easier it is to get it.

I'm not saying this is what somebody should do, but if you're only indexing for income, then it's the only answer IMO.

This raises interesting moral questions that I'm not sure I have an answer to.

For one, I don't believe this place fosters a hostile environment, although it's definitely a place where people love to tell you how you're technically wrong about something.

For another, I would guess that there are a very limited number of websites that would opt into this sort of anti-traffic behavior. Hacker news could certainly choose to honor it, but it also feels within their right to bypass the block.

I wonder if there's a sort of middle ground, where HN alerts the user of the redirect that would have occurred, but still shoots the user to the desired location.

But now you're getting into user flows and begging the question as to why the redirect is there in the first place.

I'd love to know more about the perceived hostility, even reading up on Mastodon left me with more questions than answers.

Couldn't you say the same of Mastodon?

If it was the query planner than I suppose the protocol wouldn't have been the way to make it fail

What if I charge you $6 because you order so many hot dogs that I have to find another distributor of raw hot dogs and hot dog buns? And charging $3 would mean that I'm taking a loss?

Respectfully disagree on this point. Here's the definition for AI:

"the theory and development of computer systems able to perform tasks that normally require human intelligence, such as visual perception, speech recognition, decision-making, and translation between languages."

I would say that chatgpt is not sentient, nor is it capable of independently improving its intelligence - but I think this tech hits the (lower) bar for "AI"

That's fascinating - do you happen to have a source for this? I tried Googling but came up empty.

And it's different in more ways than one. Hosting the images is just one fraction of the features that you get with Apple or some other provider. Searching, albums, sharing, are all baked in services that are still cheaper than, say, going through S3 and having a bucket with similar storage.

Even so...storage is not free.

Looking at the rates of enterprise storage costs compared to what Google or Apple charges consumers - I was surprised by how subsidized people's photo libraries are.

Minor correction, people employed by companies that banked with SVB are also heavily affected here.

If I'm understanding this correctly... You can take an interest free loan out against your Ethereum and leave your Ethereum untouched. What happens if many people do that and never repay the loan?

As soon as you tether these 0% rate markets to something else, you are suddenly dealing with real like risk that cannot be ignored.

On step 3, explaining exactly what you tried and ideas for next attempts is crucial! I've never heard of an engineer that took the time to communicate those points and still get rebuffed for help.

So trivial that nobody has ever solved it at scale.

If there's a flow that a human can go through to oauth with an application, then there's a way to bypass that same flow through a bot.

There's a very common data/ETL pattern wherein raw (unencrypted) data is stored into S3 at the very beginning of any pipeline. Adding encryption adds a layer for failure, which can grind your pipeline to a halt.

I've seen a pattern of: drop raw data into an S3 bucket that has a very restrictive policy with a long retention policy. Then, process that data asynchronously (encrypt, transform, filter, etc) and drop it into a different bucket/area that is accessed by other consumers.

Then, if any part of your ETL fails (encryption included), you can fix your bug and reprocess from your raw data without writers seeing any impact.