skysight-inc/HackerNews huggingface dataset:
I disagree with his argument that JSON web tokens are "less secure". He even quotes this:

> The only way to retrieve data out of local storage is by using JavaScript, which means any attacker supplied JavaScript that passes the Content Security Policy can access and exfiltrate it.

In my opinion, it is MUCH easier to get a CSRF vulnerability than it is to bypass the Content Security Policy. Unless you can get around the CSP and same origin requirement, this makes web tokens far more secure.

He also states that if you store your web token in a cookie you are still vulnerable to CSRF. This is only true if you are using cookie headers to send the token (which is less common), not if you only use it for storage/retrieval of the token.

Lastly, he argues JSON web tokens are not easier to use, but then points out you need a dedicated Redis session store server to scale session authentications. Managing sessions in mobile apps and command line apps is a huge pain compared to JWTs. How is that easier to use?
The one thing that I found scary when reading up on JWTs is that there is no way to revoke them. Of course you could check them against a list of revoked tokens on your server, but then your lose the stateless aspect. So the only remaining option to revoke a JWT is the nuclear option, invalidating all JWTs at once.

This seemed like a rather large limitation to me. Related to this, the ability to encode further information in the token, e.g. access rights suffer from the same flaw. If I use the tokens themselves to grant different privileges on a site, I can't revoke those privileges.

I've never used them in practice, this is all just from reading about JWTs. How do people deal with those aspects in practice?
Not sure why you're being downvoted.

Too many fanboys I guess. I would hope the community is more enlightened than that.
Seven? What?

There's Control, Option/Alt, Command, and Shift. Four modifier keys. This is the same set you have on other OSes, except there, Command is called Windows Key or Super.

Yes, Apple has symbols as abbreviations for Control, Command, Option, and Shift. Yes, Option is also called Alt. But it's not really all that complicated.
I clapped for at bigger-emoji line. But I'm over 40 and have to squint to read the pictograms my wife and kids send me.
Now you've got me wondering what would be required to convince the OSX kernel to boot from an NTFS-formatted volume. It certainly has the drivers (even if they're normally set to only mount NTFS volumes read-only.)
> How do people deal with those aspects in practice?

In one word: Poorly.

There is no elegant solution outside what you've outlined here. Or: they use stateful JWTs.
It's only got to beat FAT. That's a pretty low bar.
Forget this article. He just doesn't like everybody uses JWT instead of cookie in any case. I still think JWS is a good choice for REST API in stateless session. I don't like to setup a redis server. What you need to do if the redis server cannot support so many users? So use JWT to keep stateless is a good choice.
>No hardware at all was announced.

No hardware was announced yet. There have been occasions in the past that speed bumps and minor changes (i.e., not worthy of announcements) just appear in the web store without fanfare.
I'm disappointed that they didn't use Mongolian words for the 3 words.
So, I've been approaching JWT as a "proof of login" essentially, to handle authentication across web, mobile apps. The only payload I use is relevant to identifying the user logged in. Session data would be handled by server-side code, though it's still early days for me so I haven't had a use for it yet.

After reading this, I'm wondering if I'm misusing JWT, and should replace it for the use-case of authenticating API calls are coming from an identified user in a client agnostic way?
scrambling != encryption

scrambling is done in a lot of systems, especially in telecom to condition the signal to have some special signals processing property (reducing DC level, changing spectrum shape, etc)
Why? It's no different than pressing "Windows + D" to display the desktop on a PC.

As for the characters ⌘, ⌥, etc. they are printed on the key themselves...

Edit: Also, ⌘ historically denotes a place of interest. ⌥ is visually taking an alternative path... it's a straight line which goes parallel. It's the key for alternative functions... alt on pc.
KDE Connect is one of the most noteworthy developments in FOSS in the last few years, precisely because it's simple and elegant and "just works", like an Apple product, while at the same time carrying all the core values of FOSS.
I have my doubts that humans can hear above 20kHz.

It's more likely that the sound produced by those devices, even if ultrasonic, may produce intermodulations in the audible range.
At first I read it as "humanely" curated movie recommendations. I thought "well, I am glad no curators were harmed in the curation of these recommendations". Then I wondered how you might get inhumanely curated movie recommendations. That is a very dark place.
No, I think they are complaining about too many features that just aren't good. A little different.
Any chance of setting the region for the services one uses?
My current approach to buying and stuff: Never "buy", only "invest". That is, always consider return (happiness, time, money, etc.). Invest in experiences in the exploratory manner of an Angel investor. Invest in things in the more conservative manner of a Series A investor [1].

[1] See "7. Fundraising gets harder" in http://www.themacro.com/articles/2016/06/how-not-to-fail/
Thank you for the clarification, I'll do my best to stay free from any licensing issues.
Not trying to dispel your point, but my girlfriend uses her iPhone to FaceTime her relatives in rural Russia with where their main broadband is spotty 3/4g modems; and it performs better than anything else they've tried.
>Even if it only affects 0.1% of users, multiply that by the tens of millions, and that's a large number of people having a horrible experience.

Still nothing for the remaining 99.9% of them.
Tough crowd! That's what we used to do, but some extremely vocal people weren't satisfied, so we've done this to integrate our intentions into the license itself.
I haven't actually used Marshmallow yet; only read about the security model.

But historically, apps on iOS can only ask for permissions at run time, not at installation time, and you can refuse any permission if you choose (and restore it later if you want). So if an app wants to use a camera, it can either (terribly) ask you the first time you run it, or (nicely) ask you when you do something that uses the camera, and app store guidelines say the app has to not break horribly when it is told no.

In Android (historically) at installation time you get a list of requested permissions, and you either accept them all ("can access the microphone", "can access your contacts", "can access your browser history", "can control your phone", "can implant thoughts into your mind") or you can opt out by not installing the app. That's the scary thing; you go to install a todo app that wants to access your contacts -- what do you do? Is it malware? Will it be changed to be malware in the future?

From what I can tell, the interface in Marshmallow is still annoying in that the app tells you what it is going to ask for at install time, but doesn't get granted those permissions until it asks explicitly and you say yes.
Use sessions for client->server and OAuth2 for server->server.
CSRF isn't about content injection or acquisition of session tokens. I think you probably know that but the way you describe "doesn't make you invincible" I'd say a little more strongly; it doesn't do anything at all to prevent CSRF (or XSS!)
String phenomenology of the somewhat different kind
That Apple doesn't do quality anymore? For Mac OS, system bugs are increasing release after release, kernel panics were introduced in Mavericks and didn't go away with El Capitan even though it was supposed to be a bugfix-centric release. I also have deactivated upgrades.
What you've described is literally the same tradeoff you must decide on with caching TTL, but in the arena of credential validity for signed tokens.

In both cases, you're deciding how long something should be valid before it's flushed and must be renewed, or whether you should always check the source.
Well the fun stuff is just gives more way to express yourself. We might not use it but all these other chatting apps have had this for a while now. Apps, though, like any other thing that opens itself up to apps, have a lot more practicality. For example, the food ordering demo. I'm sure there are other things that would be useful to do without leaving the message thread (think Slack integrations).
I feel like your complaint is a little silly. ⌘ is Command and is printed right on the keyboard, Shift is an up arrow, and ^ is instantly recognizable as Control if you've used a Unix ever.

The only one that's really strange is ⌥, which by elimination is Option.
Google built their own voice recognition using neural nets. Apple licenses theirs from Nuance, the makers of Dragon Naturally Speaking. I don't know what technology Nuance uses now, but historically it was Markov Models, I believe. The founder of what-would-become Nuance, and early pioneer in voice recognition, Ray Kurzweil, was hired a few years ago by Google to "to bring natural language understanding to Google."
It's for teenagers. The sad thing is the number of developers, sitting through this, including me, wondering what happened.

But then again - 72% are first-time attendees. In other words, developers aren't coming back, but a ton of newbies want the experience?
Nothing. Apple is just being overly paranoid or hoping to some day do things that GPLv3 won't allow them to do. Microsoft, Facebook, Google, Intel, IBM; all of these companies have some interaction with GPLv3, but Apple staunchly refuses to even touch it.

It's a real pity, because Apple's popularity is sending some message that GPLv3 is poisonous, when it reality it's only a problem for them because they chose to make it a problem for themselves.
The GPL is an amazing license to prevent devs from profiting off others' work without also providing access to their own. Some might call that a "gag" because they're prevented from using the code without opening their own code as well, so it's closed to them for all practical purposes.

Is that the kind of gag that you're talking about, or did you mean something different?
Its rules for pronouncing "X" are also distinct in these cases:

say "Malcolm X"
say "Louis X"
Yeah I read about those, checked everything! Can't wait to learn more! :) Thanks anyway!
You're right about thread safety. And when you do want it, you probably want more guarantees than StringBuffer gives you (ability to synchronize multiple inserts, for instance).

With regard to the sufficiently smart compiler: it seems like you'd need every method the StringBuffer is passed to be final to do that kind of analysis.

In the case where you're writing:

public void foo(List<String> strings) {
StringBuffer x = new StringBuffer();
for (String s: strings) {
x.append(s);
}
}

You could conceivably do the analysis at compile time. But the whole idea behind the JIT is that you don't need to. If the code is hot, it'll get compiled, and you'll probably be fine thanks to removing all the synchronization, while if it's not hot no one cares.
They haven't managed to integrate Skype into anything else, it's a complete shemozzle. Why would they suddenly manage to integrate it into LinkedIn?
10ns latency means that a file entry/inode/block is available just 10-30 CPU cycles after it is requested. Suddenly the 1000 CPU cycles spent dispatching the system call look very inefficient by comparison.

Obsolete might not be the right term, but there is essentially no way that open/read/write can take proper advantage of this kind of low latency storage. We are going to need a new way to abstract and interface with this persistent storage.
That the process to get the word is patented doesn't seem like it would allay worries of the country becoming dependent on the company.
Still buzzes when it's on mute; in a quiet room at night that's still more than I want. If they just made it configurable like other device sounds I would be more than satisfied.
But an updated cp(1) that has all the same options as the GNU one has a much lower return-on-investment as 3x emojis (which I chose for this example since it could be around the same amount of work).
Dropbox + symlinks works great already.
I intentionally didn't address this in the article (and went for the "download server" example instead), because there's too much risk of people implementing my (simplified) description verbatim, and ending up with a whole host of security issues.

To address your usecase: This is perfectly possible without using JWTs as a session store. Your individual services will be either stateful or stateless.

If they are stateless, you can simply use single-use tokens that are issued by the application server, and the entire concept of "sessions" doesn't exist as far as that service is concerned. The only thing it cares about, is whether any particular one operation is authorized.

If they are stateful, you can simply maintain a separate session for each of the services. You then use a short-lived JWT token (issued by the application server) to authorize the creation of a session on a non-application-server. The client exchanges this for a session on the non-application-server.

This way you essentially get the best of both worlds. Of course that leaves you to still have to implement (relatively complex) revocation infrastructure yourself for the stateful services, but that's inherent to a distributed architecture.
Also an app for rolling dice in iMessages, I can't wait until someone does that.

No, seriously, someone please do this :-)
It seems that there is no ability to create iMessage bots.
It does actually acknowledge it, at the end of the post: "So... what is JWT good for, then?"
The vast majority of Windows desktop keyboards do not have a fn key.
It may well be that Google is worse, but I keep on having to opt-in my accustomed email address and shut off the icloud one. I've probably shut that thing off in Facetime over a dozen times. It keeps on coming back like some sort of boss zombie. It has even caused arguments with a girlfriend, when emails got sent to the icloud address because it keeps coming back. (Now forwarded.)
How about this one. If I tell Siri to call someone and the phone is t up to my ear put the call on speaker.
Validate your idea:Go out and talk to target customers.
If people like the idea, you could potential line up paying customers before the product is built.
iOS 10 allows inline and autoplay video in Safari
ZFS will be happy on a system with only 512MB of RAM, no matter how much storage it manages (assuming only 1 pool). It does need more RAM than UFS, but the amount is not notable unless we are talking about systems with 32MB of RAM.

Being energy hungry relative to UFS and others is likely true due to things like checksum calculations and compression, but there is no way to implement these things without needing more cycles to compute them.
there was an article on here which I found more in depth than this, about why tokens are a good way to do auth.

Im on mobile, but it was ~6 days ago if someone digs it up. However, I guess I don't understand what the actual argument is.

Vue js sets the header to auth bearer and pulls from local storage. I have a token and I verify the id in the payload, the subject which is usetname, expiration and the issuer.

If we assume this goes over SSL/https what is the attack vector. The other article (and this) basically say someone can run a script and get the token however it is pointed out that if soneone can run arbitrary code on your site or users machine, then you already lost anyway.

What am I missing?
Substantive critique is good, but please don't post generic dismissals.
Intel's Basis Peak Smartwatch Overheating, Causing Burns
I'm young, and I don't have to squint for the emoji I recognise, but some of them are more intricately detailed, and so it's difficult to figure them out without squinting. This is a welcome improvement.
I'd like to up-vote this response harder.
I'm not sure appealing to survivorship bias is useful here, since presumably you are also a survivor and just as subject to it.

But my argument was based on my observations of other people trying to learn. My experience learning was quite different from most that I've observed, and my observation has actually been that the way I learned is the one that works for fewer people. This is an area of interest for me, so I take opportunities to see how people learn as much as I can. If anything, the better argument against what I'm saying is that it's just anecdata, which is true. I'd welcome research to prove this one way or another, though.

Tools like this are quite unlike what I had available to me, and I think they are a much bigger step to creating learning environments for real computing than trying to shoehorn natural language into a box it just doesn't fit. We have been down that road so many times and it never works out the way proponents suggest it should.
It's a mindset thing more than it's an age thing.

My mom uses more emojis than my 14 year old niece.

And my mid-40s sister-in-law sends more Bitstrips than she does regular texts. (I doubt my niece would be caught dead sending a Bitstrip.)
While I generally support licencing of guns, the mass shootings are uniquely american thing. And I am not convinced it will reduce that kinds of deaths. Gun control will be great in reducing kids having access to firearms related deaths and other gun related incidents. It may even reduce the lethality of gang violence. There are benefits and lives that could be saved.

The Boston marathon bombers showed you don't need guns. As did the Oklahoma one. There are designs of all kinds of deadly stuff shared in the darker parts of the Internet, some of them perfected from decades of war.

If someones goes crazy enough to want to murder people he doesn't know - will the fact that he may have to buy his tools for the deed on the black market or jury rig them somehow deter him?

Gun control won't be the silver bullet that will stop the mass shootings. It may transform them from shootings to bombings or car rammings. Or worse stuff.
By "5 minutes of security" I meant all the queuing for bag drops, security checks etc, not just the actual check.

By delay you mean standing in line, waiting for the security check? From what I hear the time in security has become worse in later years in the US, what is the reason for that? Less staff at checkpoints? More thurough checks?
here you go — https://tinyapps.org/docs/e-ink-monitor.html
The stickers are equal parts feature-chasing the competition, and a 'serving suggestion' for developers about to code for their platform.
Very good points. Thanks.
Thats my point though. You dont have to be liked to be popular, but it becomes a lot easier for someone else to become popular if you are not liked.

And I do think the general sentiment towards Facebook is much more positive than LinkedIn.
> Often I'm sitting at work with my headphones plugged into my computer to listen to music. I'll then see a little video or something has been sent to me by a friend on my phone. I unplug the headphones from my macbook, plug them into my phone, watch the video, then plug my headphones back into my macbook. Simple.

For this I just connect my phone to my computer so that all audio comes out of my laptop.
Yes, but storage speeds and battery life are the two biggest pain points for computers. Non-Multi-threading applications are starting to become a pain point.
Google lets you use your own email address. Not sure what the complaint here is.
Does anyone know if this is a bad idea? Like do any of the system provided utilities do anything special in OS X that will be broken if they are replaced? I'd like to do install these replacements, but am concerned about possible side effects.
Lately I hear they spend their days playing Duke Nukem Forever on GNU/Hurd instead of working on memristors.
Ask HN: Why is this shady actor building a JavaScript botnet?
I run ChooseJarvis.com with my partner and our team. It's a social media automation tool. That's not relevant at all, it's just my job to tell you that.

Our referrer logs show tons of hits from:

http://cookie-law-enforcement-ii.xyz/

This is classic referrer spam.

The above site links to

http://cookie-consent.org/?lang=en

Which is a mini marketing project of

http://front.to/

Which according to ahrefs and google, nobody has ever heard of.

Looks to me like they're building a massive Javascript botnet.

Why?

There's a lot of things you can do, right? Keylog all website visitors (?), replace all adsense units with your own ads, use all the clients/visitors as a DDOS botnet, click fraud (?), serve downloads, serve exploits, etc...

The developers/websites have a sort of effortless polish that makes me more curious than I would otherwise be.

If this is indeed shady, and it looks like it, this is scary. I imagine a LOT of webmasters might fall for this.
Same here. I've had multiple problems with sync. Specially with Notes. I've lost notes, I've had notes duplicated, etc. The best decision I had was to switch to Simplenote.
Neo4J is open source.

> The Neo4j Community Edition is licensed under the free GNU General Public License (GPL) v3 while the Neo4j Enterprise Edition is dual licensed under Neo4j commercial license as well as under the free Affero General Public License (AGPL) v3.

http://neo4j.com/open-source-project/
I learned on Microsoft Basic and later QBasic. I fully intend to teach my children using the same.
My No. 1 guess as to why it wasn't in the keynote was that Apple isn't sure when this will ship. I think they are hoping for a year from now, but a new filesystem is hard to pin down.
CSRF vulnerabilities are less severe than a stolen session. I've addressed the reason for that here: https://www.reddit.com/r/PHP/comments/4nwpvg/stop_using_jwt_...

> This is only true if you are using cookie headers to send the token (which is less common), not if you only use it for storage/retrieval of the token.

That's the normal mode of operation for cookies, and what you should assume the client to do.

> Lastly, he argues JSON web tokens are not easier to use, but then points out you need a dedicated Redis session store server to scale session authentications.

At a scale where you can't just store the sessions in the database you're already using (or on disk - see PHP), the added complexity of a single Redis server is negligible. Below that scale, you can just use your regular database, at no additional complexity cost.

> Managing sessions in mobile apps and command line apps is a huge pain compared to JWTs.

I've heard a few people claim this now, but none have been able to explain exactly how it's a "huge pain" or "more complex". Care to elaborate?
/boot on FAT32 is mostly an artifact of UEFI these days. When I set up BIOS-based systems, I usually had /boot on ext2.
C# developer here. I use skype too. Had to downvote you
Your alternative is simply copy-pasting without using the system clipboard (old-fashioned style). I imagine there's a lot less attack vectors by doing it that way, at a small time cost.

Is there no option for a "local only" clipboard with this?
Absolutely. Someone knew and the advertised that fact in the stupidest way possible. That person is going to find themselves with some explaining to do, and they are probably going to end up paying a fine. My guess is that the information will be at most one hop away from the trader.
⌥ is not printed on any key on the Mac I am using, and I am sure ^ on top of 6 is not the ^ parent mentioned. I agree with parent, these are ridiculous.
Thanks for sharing your thoughts. What's the difference in use-case between OLAP and tabular?
This Startup Trains Africa's Elite Coding Apprentices
How to Unlock a Carrier-Locked Japanese iPhone to Use with a Cheap SIM