paws

For me this answer was helpful and succinct, thank you.

Neat trick, any other params folks might want to know about?

I'm looking forward to trying out incremental backups as well as JSON_TABLE.

Thank you contributors!

It's possible to opt out of the TheWorkNumber [0] by postal mail. You might consider it. [1]

[0] https://employees.theworknumber.com/employee-data-freeze

[1] https://krebsonsecurity.com/2017/11/how-to-opt-out-of-equifa...

> Unions for police and prison guards are 100% a mafia and they should not be tolerated. It needs to be much easier to fire cops.

I used to be neutral on police unions until I learned that unions

- are why officer discipline records are exempt from FOIA requests in some states [0]

- are why officer misconduct liability is still shifted to _taxpayers_, even repeatedly [1]

- bully politicians into getting their way [2]

- are why police pensions are pants on head stupid. Illinois has suburbs where there are more people collecting police pensions than officers on the job [3]

- apparently why when charged with a crime, officers are granted 72 hours to conspire^H^H^H^H^H^H^H^H get their story straight.

My view wholly shifted. Now I consider police unions a serious nationwide menace and to the extent accountability matters in a just society, the US is a significantly worse place to live because of them.

Do you know of any politicians against police unions? Federal or otherwise? I can't find a single one and I can guess why. It's a pretty disheartening situation.

[0] https://project.wnyc.org/disciplinary-records/

[1] https://www.washingtonpost.com/investigations/interactive/20...

[2] https://newrepublic.com/article/159706/police-unions-bully-p...

[3] https://www.dailyherald.com/news/20230617/which-suburbs-have...

I had the impression the Seventh Amendment to the U.S. Constitution guarantees the right to have federal cases adjudicated by a jury. So I'm not sure how the Supreme Court was able to abrogate that [0],[1] by allowing mandatory binding arbitration.

Is it because parties consent to the jurisdiction of one state and avoid federal court by default? Would appreciate learning how it works, if anyone knows.

According to Matt Stoller [2] we have Alan Kaplinsky [3] to thank.

> Kaplinksy’s claim to fame is that he’s the lawyer who figured out you could get rid of the ability of a consumer to go to court by using what’s called a pre-dispute arbitration provision in a contract.

I'm no expert but Kaplinsky sure sounds like a modern day super-villain.

[0] https://www.nytimes.com/2018/05/21/business/supreme-court-up...

[1] https://www.reuters.com/legal/government/column-arbitration-...

[2] https://www.thebignewsletter.com/p/ending-junk-fees-the-most...

[3] https://www.ballardspahr.com/People/Attorneys/K/Kaplinsky-Al...

As a generally healthy person it's very disappointing that catastrophic plans are only available for under 30s. [0] For me it makes the most financial sense to pay out of pocket for incidentals/annuals, but be covered for catastrophes e.g. get hit by a bus and wake up in a hospital.

What magical event happens to people at age 30 that led the legislators to ban catastrophic? Would love to see the actuarial data on that. I have no knowledge/evidence of the reasoning but to me it definitely smells like lobbying.

[0] https://www.healthcare.gov/choose-a-plan/catastrophic-health...

> the heart is designed for max availability over consistency, so when in doubt, it triggers a beat.

This is a great line, thanks! Going to share this with my distributed database reading group

I believe this is only available to paying members with a blue check.

EDIT: "this" meaning posting

Yeah, the current situation is pretty terrible. Deprecating the old credential-based auth flow, before adopting login.gov was a massive misstep. Five months ago I noticed the alert about deprecating the classic username/password auth, and posted about it [0].

As far as I know login.gov is a viable solution, already in use at the SSA, that is government-run aka doesn't require users to kowtow to an EULA, capricious arbitration, etc. The problem is there was apparently interagency squabbling that messed up the original deployment schedule. So it's not available. I do hope that changes because the current situation, of mandatory id.me seems pretty terrible.

[0] https://news.ycombinator.com/item?id=35519938

A few weeks ago I had excellent results using this to install Ventura on a 2017 MacBookPro13,3. While obviously not as fast as a newer machine, everything I tried so far works great, iCloud, Universal Control, latest apps etc.

Compared to other vendors, it seems like Apple has an aggressive obsolescence position. This app offers a significant countervailing force to eWaste, and IMO deserves broader recognition. aAuthors: great job, thank you.

I'm not taking a position on OCLP being trustworthy or not, but at least the project appears to be 100% open source [0], which is more than we can say about Apple.

[0] https://github.com/dortania/OpenCore-Legacy-Patcher

Thank you for pointing this out.

The macOS appocalypse was a really shocking moment -- it was so disappointing to learn that despite the privacy marketing shtick, macOS engineers chose to have Macs phone home sensitive data in an seemingly aggressive way, with no opt out. Now in 2023 the fact that "a preference for users to opt out of these security protections" never materialized, and the copy just disappeared from the website, is quite disappointing. Great write up here [0] - thanks @lapcat!

Anecdata: Ever since that day I've blackholed ocsp.apple.com/ocsp2.apple.com at the DNS level, and all my Mac apps have launched just fine since.

If anyone at Apple reads this, I want to be given the choice. Warn me, stuff the setting into whatever plist -- whatever, but give me the choice.

Frankly for a company with Apple's resources, it's hard to believe the OCSP test suite somehow didn't consider half-open TCP connections. If a global catastrophe like that can happen once, it can happen again - which is why, in addition to the clearly negative privacy implications, Apple should give users who care a clear opt-out.

[0] https://lapcatsoftware.com/articles/ocsp.html

Yikes. The only other time I heard about the Splunk sales team in the news, it sounded pretty bad also.

https://www.theregister.com/2020/08/12/splunk_sales_discrimi...

Could you please explain more about who these counterparties are exactly? Do they include brokerages?

I'm trying to understand why a counterparty would enter into an arrangement where a stock price change obligates them to financial liability like this. Presumably there's some upside if the stock price goes the other way, but it's unclear who the $ would come from in that case.

Also: Who originates options? When someone buys an option, is it the brokerage who collects the fees? Is the counterparty already involved at that point?

Not sure I'm understanding you correctly - by captive portals do you mean the "challenge" that renders in a browser/webview context, commonly when joining a new network? I'm of the impression these challenges appear only at certain times usually in response to user action, no?

What makes LittleSnitch/Lulu/similar nice is they listen for "all" outgoing traffic types TCP/UDP/ICMP/etc, and they show UI immediately, including for non-browser apps, e.g. games, VoIP, P2P apps, whatever -- it tends to be covered. Unless I'm mistaken I don't believe a captive portal can be triggered when "just any" process originates traffic.

That's the strength of LittleSnitch/similar, but the major weakness with host-level filtering they rely on, is you're 100% at the mercy of Apple's networking stack, and this Sonoma issue isn't the first time Apple moved the goalposts. Not too long ago Apple exempted their own services from whatever LittleSnitch hooks [1] and it could of course happen again with any macOS update.

In my view this is precisely why a separate box is appealing. Ideally it'd have as tight of a UI as the incumbent apps, including the same metadata (process name + app icon, protocol, port #, most recent previous attempt, etc).

[1] https://news.ycombinator.com/item?id=24838816

The more macOS seems to break user control of networking, the more I wonder what kind of "separate box" solutions are out there that can intermediate _outgoing_ traffic. e.g. Something like LittleSnitch on a router, where it notifies the Mac when it detects a new outgoing connection.

Do things e.g. pfSense support that already? "Hold" an outgoing connection from the moment the SYN is observed, notify whatever client, and only allow if the user clicks?

A few months ago I paired gcsfuse with Seafowl [0][1], an early stage open source database written in Rust. Was a lot of fun balancing tradeoffs that are usually not possible with classical databases e.g. Postgres. Thank you gcsfuse contributors for making it possible!

More context if you're interested [2][3]

[0] https://github.com/splitgraph/seafowl-gcsfuse

[1] https://www.splitgraph.com/blog/deploying-serverless-seafowl

[2] Previous post https://news.ycombinator.com/item?id=36215088

[3] https://seafowl.io/

Why?

Lovely, thank you!

> MultipathTCP

Can you please share more about this? I've been curious to build a router with redundant internet providers ever since I noticed certain PCEngines boards supported LTE modem modules. [0]]

I assume you're using Linux; do you wire all your modems via Ethernet and manage MultipathTCP all in your router? Any hardware offloading you're aware of/recommend?

[0] https://www.pcengines.ch/apu3c4.htm

Slightly OT: I noticed Colorado, Connecticut, New Mexico, and New York City either ended or limited qualified immunity in recent years. (In other states similar efforts faltered, apparently thanks to police unions and politicians in their pocket [0])

The linked article includes:

> Fifteen months after the Colorado bill was signed into law, there is so far little evidence to support any widespread negative effects on police retention or recruitment.

Now that it's been more time I've been curious to measure how curtailing QI has affected 1) police misconduct 2) police hiring and 3) insurance rates (e.g. indemnity) municipalities/townships/states pay.

If anyone has insight on ways to measure, places to find data, etc would be appreciated.

[0] https://archive.ph/evcEG

Glad to hear you've had good results! Yes, @mildbyte did a great job making Seafowl comply with HTTP cache semantics (i.e. Etags/Cache-Control), and it should give good results for both CDNs and browsers. When building Open Data Monitor [0] I certainly observed some nice speed ups.

For those interested in how caching works (i.e. if your dataset is public it could be an easy win) more info is in the docs [1]

[0] https://open-data-monitor.splitgraph.io/week/2023-05-22

It's a Socrata scraper that renders diffs of public/government datasets

[1] https://seafowl.io/docs/getting-started/tutorial-fly-io/part...

Hello HN! I'm an engineer at Splitgraph and recently started learning Rust so I could make my first contribution to Seafowl [0], an early stage analytical database. Along the way I figured out a database hosting hack on GCP and wanted to share it with HN. It's a way to achieve "true" scale to zero database hosting that could be useful for certain side projects or spiky traffic situations.

A recurring problem I've faced with side projects is the need for Postgres, but no desire to deploy or maintain new instances. So when I learned GCP's "always free" tier includes serverless [1] I got curious to see if I could run a database.

While a lot of classic databases aren't usually a great fit for serverless, Seafowl separates compute, storage and catalog (catalog == a SQLite file of metadata). [2] Last month I was able to introduce GCS bucket compat to Seafowl, which enabled me to mount the catalog via gcsfuse (i.e. an adapter that allows attaching GCS buckets to local filesystems). Upshot: while FUSE does add HTTP requests to container startup, init time remains comparatively quick, even cold starts, because fetching is limited to the single catalog SQLite file only.

With this approach you get a URL you can query directly from your FE if you want, e.g. fetch() can send SELECT * ... queries straight from your users' browser. You could plot a graph from a static React frontend, or observablehq.com editor, with no persistent backend needed. So at times when nobody's using your app, 100% of your stack can scale to zero with obvious cloud spend advantages. And even if you exceed free tier limits, being PAYG offers a good chance you'll come out ahead on hosting costs anyway.

NB: Seafowl is an early stage project, so it's not really suitable if you need transactions or fast single-row writes. Otherwise, this could be a nice way to get free database hosting at a big 3 cloud provider, especially for e.g. read-only analytical reporting queries.

Feedback and suggestions are appreciated. Hope it helps you! More available if you want [3].

[0] https://seafowl.io/docs/getting-started/introduction

[1] https://cloud.google.com/run/pricing#cpu-requests

[2] Neon is another interesting project that separates compute and storage. https://neon.tech/blog/architecture-decisions-in-neon

One issue I observed was a noticeably longer startup time vs this FUSE approach, which I believe may be related to Postgres connection setup time/roundtrips. Looking forward to trying Neon again in future.

[3] https://www.splitgraph.com/blog/deploying-serverless-seafowl

Recently I got curious about SQLite in serverless settings and eventually figured out a way to combine GCP Cloud Run with Seafowl, an early stage database. SQLite has been quite helpful! Did a write up [0] in case anyone is interested. (also about to submit it for my first Show HN.)

[0] https://www.splitgraph.com/blog/deploying-serverless-seafowl

Does anyone have resources/links that touch on kTLS for this release? [0][1]

I'm not an expert by any stretch, just have the impression a historical downside of HTTP/3 is that "most" of the crypto stack (also parts of UDP IIUC?) now run in userspace, meaning extra copying across the kernel/user boundary. Would like to refine my understanding of how it works.

Previous discussion

[0] https://www.nginx.com/blog/improving-nginx-performance-with-...

[1] https://news.ycombinator.com/item?id=30902744

Thank you @thethirdteacup - that looks helpful.

Because you were downvoted I can't reply directly so doing it here instead.

Anyone else run into an Angular 15 styling nightmare when upgrading to the latest Material Design (MDC) release?

I attempted to use the migration tool [0] for upgrading an in-house LOB app, but unlike previous upgrades client hated the resulting UI - understandable b/c of major styling regressions everywhere - so downgraded back to 14.

Angular 14 LTS support ends in November [1] and as best as I can tell, if we want to stay on a supported Angular release we're forced into a lot of custom styling work users simply don't care about.

If there's some way to stay on the "legacy" [2][3] components on Angular 15 or 16, would appreciate any links/hints. Cheers

[0] https://material.angular.io/guide/mdc-migration#2-run-the-mi...

[1] https://angular.io/guide/releases#actively-supported-version...

[2] https://material.angular.io/guide/mdc-migration#form-field

[3] https://material.angular.io/guide/mdc-migration#library-wide...

"These changes generally improve spec-compliance and accessibility." Maybe that's great for some folks, but the client liked the UI exactly as it was.