MurphyA/hacker-news huggingface dataset:
by xienze | 2025-05-13 19:21:05+00:00
I don’t think banks are deliberately trying to avoid using TOTP, it’s just that they have to cater to the lowest common denominator, you know, the kind for which anything computer-related is basically black magic.

SMS is an easy target because ~everyone has a cell phone and with things like Apple’s verification code auto-complete, the amount of friction is greatly reduced.

With standard TOTP, now they have to worry about if the user correctly added the secret information to whatever authenticator app. And write corresponding documentation explaining how to do so, for every major authenticator app.

There also has to be a backup flow for when the user loses their authenticator app which is probably just going to be SMS. So why not stick with just SMS in the first place?

I hate using SMS for 2FA, but I understand the business decisions around it. I think as engineers we forget, to be frank, just how bad most people are with technology.
by impendia | 2025-05-13 19:21:08+00:00
Take this with a grain of salt, because I'm an academic, not an entrepreneur.

That said: when I was younger, being a nerd was uncool. To out yourself as one was to take a social risk, and it makes sense that tight-knit communities formed.

These days, entrepreneurship and the tech industry have acquired something of a social cachet -- perhaps because there's boatloads of money in it now. I've read that "geek nights" have attracted a bunch of hangers-on, who like to talk big but haven't necessarily invested their time into learning anything difficult.

Whether fairly or not, you're probably being taken for such a person.

I've been in an analogous situation, and it sucked. I feel for you. That said, to echo what others have said -- if you're going to try to make cold contacts like this, you probably need to either lead with a specific request, or else approach in such a way that makes it clear that you're bringing something interesting to the table.
by alternatex | 2025-05-13 19:21:19+00:00
I worked with PHP back in 2014 and nobody was building anything in PHP that could be called advanced by today's standards. That language barely had decent backend framework options and we're talking just 10 years ago.

If this person has been working for 20 years, they were definitely working at the time when MD5 hashing was considered security in the PHP community and the best technology that community could muster at the time was the horrifying architecture of WordPress.

I'm sorry, I'm sure this fella is a good engineer but you could not convince me that back in the day PHP had anything going on for it except for low barrier of entry.
by reverius42 | 2025-05-13 19:21:55+00:00
Someone who's 42 needs to be a "TL" (tech lead?). Not everyone can be a leader (like you say, not that many openings available) -- and leading is often a totally different job and skill set from developing software. So what do you call it when everyone above a certain age is automatically shunted into a smaller pool of openings for a different role? I would call that ageism.
by pants2 | 2025-05-13 19:22:25+00:00
Definitely - o3 proposed a few things initially: Costochondral separation, Intercostal strain, rib fracture, pericardial effusion and a few other things...

After answering questions about symptoms, it gave me a few movements/actions to do and to rate the pain of each. Based on that it diagnosed me and gave me a timeline of what to expect and things to watch out for.

Really it was as helpful as a doctor could have been in that scenario, IMO.
by chvid | 2025-05-13 19:22:36+00:00
Identity providing is a natural monopoly and should be provided by the state in same manner as a passport is provided.

We can discuss the implementation but in Denmark and quite a few other countries, the login problem in online government services and banking is solved by a single state run identity provider (MitID) and hopefully the EU will be succesful with their EIDAS initiative and provide a solution that works across country boundaries.

https://en.wikipedia.org/wiki/EIDAS
by godelski | 2025-05-13 19:22:53+00:00
> And one of them is the cheapest software you could make.

I actually disagree a bit. Sloppy software is cheap when you're a startup but it's quite expensive when you're big. You have all the costs of transmission and instances you need to account for. If airlines are going to cut an olive from the salad why wouldn't we pay programmers to optimize? This stuff compounds too.

We're currently operate in a world where new features are pushed that don't interest consumers. While they can't tell the difference between slop and not at purchase they sure can between updates. People constantly complain about stuff getting slower. But they also do get excited when things get faster.

Imo it's in part because we turned engineers into MBAs. Wherever I ask why can't we solve a problem some engineer always responds "well it's not that valuable". The bug fix is valuable to the user but they always clarify they mean money. Let's be honest, all those values are made up. It's not the job of the engineer to figure out how much profit a big fix will result in, it's their job to fix bugs.

Famously Coke doesn't advertise to make you aware of Coke. They advertise to associate good feelings. Similarly, car companies advertise to get their cars associated with class. Which is why sometimes they will advertise to people who have no chance of buying the car. What I'm saying is that brand matters. The problem right now is that all major brands have decided brand doesn't matter or brand decisions are always set in stone. Maybe they're right, how often do people switch? But maybe they're wrong, switching seems to just have the same features but a new UI that you got to learn from scratch (yes, even Apple devices aren't intuitive)
by windowshopping | 2025-05-13 19:22:55+00:00
I saw the same things you did and thought the same things you did. I made it to more than his salary in 1/3rd the time - from 2013 til 2019 is what it took me to get to $225k on almost purely frontend work despite being fired twice - and I've been vacation for three years now. I anticipate when I look for a job again I'll have no trouble. But I don't insist on remote, I didn't change my name to something edgy and impractical (if he was born to that name I apologize but that seems very unlikely, I've never seen or heard of an inherited single-letter last name in any culture), I have updated my skills as time has passed, and I'm not just building projects to look like I'm keeping up - I'm building real things I'm passionate about and which people use.

Moreover, after 3 years of work from 2019 I had saved enough to quit and go on vacation indefinitely. I haven't looked for work since and am on my second multi-month trip to Europe. It's not that hard. People are just absolutely trash with money. I didn't inherit anything and nobody is helping me pay for anything, not a penny. People are just bad with money, and in my opinion the situation this guy has described in the post gives off every conceivable red flag of someone who's terrible at both financial planning and career planning.
by xp84 | 2025-05-13 19:23:19+00:00
They should all be shamed continually until they adopt the common sense ideas in the article.

Sadly I have to conclude from evidence that these incompetent buffoons think you can compute “how secure our site is” by asking “is it a f*cking pain in the ass for everyone to log in, almost all the time?” If yes, then secure.

Bonus points for “is it impossible to log in when you don’t have your cell phone that you registered with us?”
by johnea | 2025-05-13 19:23:35+00:00
Once again, goggle catches up with linux features from 10 years ago.

Just one example article, using a chroot environment:

https://www.nextpit.com/turn-your-android-device-into-a-linu...

But Ubuntu touch, and other native linux phone installs have touted desktop mode over the years.

The h/w 10 years ago was marginal at performing this task, and the non-corporate OSes were, and are, actively suppressed by goggle and the rest of the corporate "phone" development industry. This is an almost identical scenario as M$ dominating the PC manufacturing business, even though they didn't make the h/w.

But this serves as another typical example of how long ago this type of feature could have been available if every new innovation didn't have to be vetted from the perspective of vendor benefit, instead of advancing on the basis of user benefit.
by thesuperbigfrog | 2025-05-13 19:23:40+00:00
This is largely due to the popularity of full touchscreen smartphones compared to those in the past that had hardware keyboards (for example Blackberry and Palm Treo devices).

Devices with hardware keyboards were easier to use for creation (especially writing) and more of the software was focused on creation because of the more limited media processing capabilities of those devices (e.g. less processing power, less memory, more restricted media codecs at that time).
by eightys3v3n | 2025-05-13 19:23:44+00:00
I use a combination of Obsidian notes and Confluence.

Obsidian is a not-very-organized mess unfortunately; I still haven't figured this out but it's good enough for me to usually find things I remember. Confluence is organized as such https://docs.divio.com/documentation-system/. This works great.I always know where to put something and where to find it again later.

I also don't keep tabs open, I write things on a Todo list in Obsidian. Then at the beginning and end of the day I organize it; finishing small things like "record this", prioritizing, and moving project specific tasks to a page just for that project.
by reverius42 | 2025-05-13 19:24:19+00:00
I wonder if he should consider taking his mother with him and moving somewhere with a better local job market. Similarly, parents move and take their kids with them when the job market demands it.

There is a separate conversation to be had about whether this is a good thing -- should we allow the job market to force people to move away from their homes/families/friends/connections? -- but it's already a fact of life for a lot of people.
by bruce511 | 2025-05-13 19:24:20+00:00
You're on the right track, but missing an important aspect.

In most cases the company making the inferior product didn't spend less. But they did spend differently. As in, they spent a lot on marketing.

You were focused on quality, and hoped for viral word of mouth marketing. Your competitors spent the same as you, but half their budget went to marketing. Since people buy what they know, they won.

Back in the day MS made Windows 95. IBM made OS/2. MS spend a billion $ on marketing Windows 95. That's a billion back when a billion was a lot. Just for the launch.

Techies think that Quality leads to sales. If does not. Marketing leads to sales. There literally is no secret to business success other than internalizing that fact.
by fkyoureadthedoc | 2025-05-13 19:24:48+00:00
Recently had to call Discover because of unauthorized use of card, apparently to buy Facebook ads of all things. They didn't call me, just locked my account and said I had to call them. I couldn't even pay the balance until I did.

Anyway they needed to verify my identity, so they ask me for some info from the back of the card and a phone number that they can send the OTP to. I give them a phone number, it's not even the one on the account, they send the text to it. The text message says that the bank will NEVER ask for the code over the phone. They ask for the code, I give it to them, identity verified.
by ponow | 2025-05-13 19:25:10+00:00
Could it be that your particular position required more ongoing learning, and that has kept you better prepared for a changing world?

What fraction of positions require that ongoing learning, or at least to that degree?

Also, consider many other jobs, are they doing their job, and the doing of their job itself provides the experience that makes you a more valuable worker? Or is the doing of the job basically a necessary distraction from the actual task of preparing yourself for a future job? What fraction of humanity actually takes on two jobs, the paying job and the preparing-for-the-next-job? Might doing the latter get you fired from the former? Most importantly, is doing that latter job getting more important over time, that is, are our jobs less secure? If so, is this what is an improving economy, rising, as it were, with GDP?
by bee_rider | 2025-05-13 19:25:38+00:00
My rule is simple: if you contact me, you are the one that had to authenticate. Otherwise you are probably a scammer.

Although, I haven’t had many instances of communications from my bank where I cared about them authenticating. Like, if they tell me there is a problem, I can go check it out through the app, website, or whatever the user-initiated channel is. When I feel like it.
by layer8 | 2025-05-13 19:25:50+00:00
Operating systems usually initialize new memory pages to zero by default, for security reasons, so that a process can’t read another process’s old data. So this gives you zero-initialization “for free” in many cases. Even when the in-process allocator has to zero out a memory block upon allocation, this is generally more efficient than the corresponding custom data-type-specific default initialization.

If you have a sparse array of values (it might be structs), then you can use a zero value to mark an entry that isn’t currently in use, without the overhead of having to (re-)initialize the whole array up-front. In particular if it’s only one byte per array element that would need to be initialized as a marker, but the compiler would force you to initialize the complete array elements.

Similarly, there are often cases where a significant part of a struct typically remains set to its default values. If those are zero, which is commonly the case (or commonly can be made the case), then you can save a significant amount of extra write operations.

Furthermore, it also allows flexibility with algorithms that lazy-initialize the memory. An algorithm may be guaranteed to always end up initializing all of its memory, but the compiler would have no chance to determine this statically. So you’d have to perform a dummy initialization up-front just to silence the compiler.
by corytheboyd | 2025-05-13 19:26:11+00:00
I use browser bookmarks organized into folders like /dev/blog /dev/tools etc. so that I can browse by category later when I think “what was that tool again?” A flat list of bookmarks drives me insane, all I want to do is delete it.

I tried Obsidian for a while but I’m too prone to bike shedding with it, so I gave up. I DM myself in Slack with bits of info to keep around for the near term, because it’s already a simple feed ordered by time.
by Aurornis | 2025-05-13 19:26:13+00:00
> For someone who cares about latency, instant is less than 10 milliseconds

Click latency of the fastest input devices is about 1ms and with a 120Hz screen you're waiting 8.3ms between frames. If someone is annoyed by 10ms of latency they're going to have a hard time in the real world where everything takes longer than that.

I think the real difference is that 1-3 seconds is completely negligible launch time for an app when you're going to be using it all day or week, so most people do not care. That's effectively instant.

The people who get irrationally angry that their app launch took 3 seconds out of their day instead of being ready to go on the very next frame are just never going to be happy.
by canucker2016 | 2025-05-13 19:26:33+00:00
So fixing approx. 5-10% of CVEs (by zero-initializing all stack vars) is a worse cure than letting these uninitialized stack vars be possible sources of exploits?

see https://msrc.microsoft.com/blog/2020/05/solving-uninitialize...

Initializing the stack var to zero would have helped mitigate the recently discovered problem in GTA San Andreas (the real problem is an unvalidated data file) - see https://cookieplmonster.github.io/2025/04/23/gta-san-andreas...
by gtkspert | 2025-05-13 19:26:35+00:00
You have to think of a Bank's threat model though.

Account compromise is one threat, but the use of valid accounts for money laundering is another. In my view the reason they "get it wrong" is because they don't want you to be able to automate transactions, as that makes money laundering easier...

Therefore, they don't want to use standard TOTP because that's easy to automate. Requiring SMS based 2FA is harder (but not impossible, use a modem or maybe a SMS service.) And requiring a special app is quite difficult to automate.
by LexiMax | 2025-05-13 19:26:55+00:00
This is something that most people engaged in internet discourse could learn as well. It's often not productive to write a long response to a pithy sound-byte argument.

Not only is that losing the engagement economy, but onlookers to the thread are far more likely to read and latch onto the smaller soundbites. Longer replies also give critics more gristle to latch onto - you may think a long post covers all its bases, but you're really just giving people more avenues of rebuttable.

Better to be succinct, and if important context is left out, respond to it as concerns are raised.
by ssivark | 2025-05-13 19:27:19+00:00
Currently I use Obsidian to make note of a few key things, but what I'm more excited about is that the way tech is evolving is going to allow us much more expansive solutions for personal knowledge-bases. Eg: See what Perkeep tried to do.

Here's an idea: We should be able to record the full experience stream (or just the laptop screen, let's say) for a person -- digitize it suitably (eg. pull out all the text, or tokenize it with a VLM, etc), attach some metadata, and have the whole database ready for a person to query / play with, using powerful LLMs.

To the extent that you can store everything and perform effective recall/search, it obviates the need to carefully "pre-process" bits by noting them down in the right file, tagging them appropriately, adding metadata, etc. All of which should make for a much nicer UX.

Given the Jevons' paradox though -- I wouldn't be surprised if our experience stream becomes so dense/rich that storing everything and querying from it eventually becomes prohibitively expensive. We would then have to construct pre-processing rules to prune the stream, and amortize the cost of certain deductions by performing them at data ingestion time instead of repeating it for each query. It's all just the basic principles of system design at the end of the day, and how systems need to be rearranged as various component capabilities (and user needs) scale.
by YaBa | 2025-05-13 19:28:05+00:00
I was one of the affected customers, guy offered me 2 years subscription at cost zero, it's something, but I will never trust this company again, neither lifetime subscriptions.

Same with web hosting, nice 30 bucks deal some years ago, ended this year, saying they cannoy support the costs anymore, wow, who would guess that a business is not profitable when you give stuff away.
by andrewflnr | 2025-05-13 19:28:23+00:00
Because the drop/puddle is trying to keep its shape. I think that's what the current top comment is saying about the contact line being fixed. On rough surfaces the edge can't just retreat as it evaporates, and if I understand correctly it also wants to keep the rounded shape at the edge due to surface tension, so water gets pulled in from the rest of the puddle to fill it out.
by xp84 | 2025-05-13 19:28:28+00:00
This is no excuse for not offering it. And no, SMS must NOT be a backup that’s always available, as the article points out, its availability for use is a security hole.

If you can’t access your actual 2FA there should be an option for the bank to have it call that registered number and ask you “Hey this is (Bank). Are you trying to log in right now from Moscow on a Windows 10 PC using Firefox? If so, please call the number on the back of your card, hit 9, put in your SSN, then we’ll turn off 2FA for one login and let you add a new one. Btw if it is not you, your password is definitely compromised.”
by lcnPylGDnU4H9OF | 2025-05-13 19:28:51+00:00
> I don't think it's most people's priority to use part of their paycheck for this

Why don't people prioritize increasing their income? Like, they could look at wealth inequality and consider that if they owned some of the wealth around them then they could instead generate income from it, which might obviate their desire for lower taxes because they're able to pay their bills with a surplus of savings. What's the purpose of destroying science funding when the problem is a lack of personal wealth?
by geijoenr | 2025-05-13 19:29:04+00:00
I think this is almost spot on.

There is also people with just toxic personalities that everybody tries to avoid. In Europe unfortunately, is not easy to get rid of such characters and they often victimize teams and jeopardize entire projects.

Septic avoidance and minimizing interactions, sticking to process and keeping the distance are absolutely necessary for mental health.
by MinimalAction | 2025-05-13 19:29:13+00:00
Amazing article! His writing style is unique and made me go down a rabbit hole of discovering his other works.

I was unaware of this demagogue of a bacterium Deinococcus radiodurans. It survives levels of radiation that is designed to kill all lifeforms. Wikipedia [0] lists this as a bacteria that supports panspermia -- that life originated elsewhere but spread through cosmic dust and was seeded on Earth eventually.

Fun fact: Thermococcus gammatolerans is known to be the one that tolerates the most toxic radiation.

[0]: https://en.wikipedia.org/wiki/Deinococcus_radiodurans
by ActorNightly | 2025-05-13 19:29:26+00:00
Or people could just understand the scope of the issue better, and realize that just because something has a vulnerability doesn't mean there is a direct line to an attack.

In the case of speculative execution, you need an insane amount of prep to use that exploit to actually do something. The only real way this could ever be used is if you have direct access to the computer where you can run low level code. Its not like you can write JS code with this that runs on browsers that lets you leak arbitrary secrets.

And in the case of systems that are valuable enough to exploit with a risk of a dedicated private or state funded group doing the necessary research and targeting, there should be a system that doesn't allow unauthorized arbitrary code to run in the first place.

I personally disable all the mitigations because performance boost is actually noticeable.
by signal11 | 2025-05-13 19:29:40+00:00
Banks are aware that NIST and various other bodies have updated their guidance about password expiration. Even vendors like Microsoft who supply extensively to financial services, have updated their guidance about password policies.

At this point — barring edge cases of operating in geographies where regulations haven’t caught up — it’s just inertia, aka “inaction doesn’t get you fired (usually)”.