nightpool

Unfortunately, seems like this is Forgejo's best suggestion on how to compare the two: https://i.imgur.com/j1665QR.png. Not sure that page helps much if you're not already bought in to a free-software-absolutist mindset

why is that more likely?

https://support.claude.com/en/articles/14604842-real-time-cy... says that Cyber Verification Program doesn't apply to Opus 5.5 yet, they hope to roll it out for 5.5 "soon"

Both Anthropic and Internet Archive have gotten sued into oblivion by publishing companies once, there's no way they're going to do something even more flagrantly illegal

Unfortunately copyright law does not have a squatters-rights exception

That seems pretty sub optimal

That's what damage deposits are for, no?

If you worked in housing in Seattle you would know it's not really legal or practicable for landlords to exclude pets, considering the expansiveness of ESA designations. Almost every landlord already excludes pets outside of ESAs

I think this is a good example of "AI tools are not as good as users think they are". If you're having problems with AI tools not checking to see if a component already exists, then they're not ready for prime-time on your codebase. The solution isn't to stop caring whether or not you're using reusable components, the solution is just to acknowledge (regretfully!) that AI coding is not good enough to meet an appropriate quality standard without more supervision than you've been able to use it with in the past.

I think part of the issue is that a lot of programming languages don't make a strong distinction between the two, and only provide the (more powerful) fold, but in a way that makes reduce operations harder to reason about (like OP said, with 0 types).

Associativity also makes fold hard. It's not super trivial to know when you might need e.g. left fold vs right fold

Ah, you're right, my mistake—wasn't reading the username carefully enough

Are you sure? The change says "A malicious template repository could be used to read arbitrary data from the Forgejo host" (emphasis added). Couldn't an attacker create a template repo and then immediately create a new repo from their own template, causing the Forgejo process to execute their template code on the server?

What does the error message mean by "Your search request"? Why is viewing a single file in a repository considered a search request? That smells like poor caching somewhere

Thanks Mustafa! This was a great article—I'm curious, did you consider the non-technical / organizational costs in keeping the two codebases in sync as a separate factor? Do you foresee more organizational overhead as part of this decision? How are you planning to manage that? E.g. small implementation difference between the iOS and Android app increasing the support burden or bug burden and causing duplicated team effort.

This is a great point that I wish the Shopify article went into in more depth! Would love to hear if they considered this

> The traffic still has to flow from an india provider to the international leg and back via the domestic provider.

Right, but Cloudflare doesn't have to pay for it in that case. If Cloudflare sends you to their Indian POP, then they have to pay their Indian service provider for traffic. If they send you to their France POP, then they have to pay their French ISP for traffic. The Indian provider cannot claim any of Cloudflare's traffic in that case, because the Indian service provider wouldn't have any relationship with Cloudflare

This is very standard for places with high ISP costs, like South Korea and India. You can see a lot of discussion about it online. I agree with you that Cloudflare should be more transparent if / when they make different routing decision for Free/Pro plans based on bandwidth costs, but I don't think their decision itself is unreasonable at all. Indian bandwidth is very expensive.

Do you have any sources for this? My understanding is that all of the discussion about prediction market wildfires are completely speculative, nobody has actually started a wildfire for a prediction market payout yet.

The chat example here doesn't really seem to work for me—I get 32 FPS consistently no matter what the chat settings are. Maybe a Chrome thing? Or an M3 thing?

That might be true if you're applying for a megacorp like AWS or something but hard to feel like that's a valid argument when you're applying to a company with 2 open roles.

Have you interviewed any of these candidates yet? I doubt that you have 500+ real candidates. My experience in the past 12 months of hiring is that you'll have maybe 10 "qualified on paper" candidates, and 490 AI-generated profiles.

Cool, but, uh, this seems really astroturfed? Why are there two anti-Perplexity articles from independent research firms with identical websites on the front-page of HN right now, submitted by the same person? Feels like they should get deleted

(see https://news.ycombinator.com/item?id=49536201)

I don't even know if I disagree with this post, but this seems really astroturfed. Why are there two anti-Perplexity articles from independent research firms with identical websites on the front-page of HN right now, submitted by the same person? Am I going crazy?

(see https://news.ycombinator.com/item?id=49536375, left a comment there also)

Did you read TFA? They're adding zero data retention back for 5.1

One could argue that, certainly, but I think it's a little disingenuous. Pip makes it impossible to use extra-index-url safely, in the ~only use-case that option has. There is no world where you use extra-index-url and you're not vulnerable in some way or another to dependency confusion.

The CVE looks relevant to me. If you're trying to get a package from a private repo, and someone publishes version 999 of that package on a public repo, then you're executing their code instead of your own. Just because the pip maintainers refuse to fix it doesn't mean it isn't a security vulnerability that could lead to remote code execution and needs to be controlled for in some other way.

How do you define a job "practically possible to do remotely"? It is not practically possible to attend in-person daily meetings remotely. While replacing in-person meetings with Zoom meetings is a choice many companies can and have made, I don't think anyone is saying that they're the exact same thing. If your job requires attending meetings to work on a team (and given that almost every job contains an aspect of teamwork), I don't see a clear way for the government to define when having in-person meetings are "required" for better team coordination. I certainly wouldn't want it to regulate by fiat whether zoom meetings were a required replacement for in-person meetings--that would be the same as the government defining Pi as 3.2 (https://en.wikipedia.org/wiki/Indiana_pi_bill)

The stats are from the Wikipedia page for ECT--I'm not sure about the base rate/risk ratio.

ECT can be very, very unsafe. 70% of patients experience some form of memory loss and at least 30% of patients experience self-reported permanent memory loss. The rate of major adverse cardiac events found in a 2019 meta-analysis was 1 in 39 patients. For the people that it helps, I'm happy they've found relief, but it's a tool with significant costs and I know a fair amount of people who underwent it as children or otherwise were pressured to undergo it and I don't know any of them who have a positive impression of it.

Yes, I was actually a part-time Jenkins admin back in high school and college. I use CircleCI more than Actions most of the time (and used Travis before that), especially for higher cost workflows, but there's no beating Actions in terms of its ease of setup and ecosystem advantage. It's way easier to just set up a simple JS file that runs on every commit in Actions compared to anywhere else.

Would be happy to be proven wrong!

Only if you live on Southampton Island. Otherwise, different countries have different DST rules, so it's always important to clarify which offset you're referring to.