skysight-inc/HackerNews huggingface dataset:
Just to be a little bit pedantic about the article.

Do not contain any sensitive data in a JWT.

If there's nothing sensitive in the JWT then why might we encrypt it? Sometimes the whole purpose of a JWT is to pass some sensitive auth information whether as a session cookie or an authentication token that a service uses.

If you worried about replay attacks, include a nonce (jti claim), expiration time (exp claim), and creation time (iat claim) in the claims

This isn't always the case... One of the reasons JWT is so powerful is the asymmetric key operations built in to the spec. If some JWT generation and signing body signs a JWT and someone else steals the JWT, all consumer services of the signing service are vulnerable to a replay attack. The JWT is valid for use at ALL consumer services.

If you have symmetric keys and are encrypting/signing a JWT to communicate, and you want to prevent replay attacks with a JTI and EXP, you've lost the stateless property of JWT in order to do it correctly, and you haven't solved the problem of using the JWTs at OTHER services. It only works for 1 to 1 communication.

If you're preventing replay attacks inside of a JWT you've chose the wrong battle and you've decided to design a cryptographic protocol on top of JWTs. Don't pick this fight. Just go home.

The secret signing key should only be accessible by the issuer and the consumer

This won't be the case for asymmetric keys. Services that create JWTs and sign them for other services to verify should not share the private key with other services. This is basic crypto but if someone reads this ONLY this article they may not know.
What’s Wrong with Microsoft’s WebRTC Announcement
Its worth noting that that $100 million fine was -- by the FCC's own description -- significantly moderated because it was the first fine under the Transparency Rule [0]

[0] https://apps.fcc.gov/edocs_public/attachmatch/FCC-15-63A1.pd... (para. 38)
Great! Thanks for the article, it makes a good reference when setting up VPS's.
I just had a phone interview that was incredibly telling about the company. The interviewer ... didn't speak english. And, I've been doing this long enough that I embrace that broken english is the international language of science. This guy didn't speak english. We had to communicate by typing into the pair coding app (remember this was a phone interview).

Anyway, a company who puts that person on the phone as one of the first points of contact has serious communication issues. It was an easy pass for me (I already work in a company with broken communication).
> These tokens are usually signed to protect against manipulation (not encrypted) so the data in the claims can be easily decoded and read

Is this really true? I mean, if you can decode the token you must have access to the secret anyway?

From https://github.com/auth0/node-jsonwebtoken

var token = jwt.sign({ foo: 'bar' }, 'shhhhh');
var decoded = jwt.verify(token, 'shhhhh');
console.log(decoded.foo) // bar
In that case, it's almost as irresponsible to adopt Frege... It's not like it's got any real traction, either.
That's one thing I hated about Australia/NZ. Real Pseudoephedrine requires a prescription. I was surprised in Singapore when I could buy it with just showing my ID like in the US.
The Men Women Love
Do you have any specific examples of how scala would hold y'all back in relation to haskell? I actually have trouble imagining how one could justify, in a business, scrapping an 80% complete rewrite to rewrite it again in a different language. I wonder what would be so compelling.
>and you're gonna need rollerskates. :-)

What does that even mean?
You may be surprised to learn that none of the factual matters in the story of the hare and tortoise are remotely representative of real hares and tortoises. Not only have there been no recorded instances of hares or tortoises using human speech, scientists are fairly sure that they are physiologically incapable of human phonology.

I don't understand what you're saying. There is a consensus that poor Americans are at a disadvantage when it comes to school, business, and health. Are you challenging that that's the consensus, or do you acknowledge that that's the consensus but you're challenging whether it's true?
The Strange Saga of Lonelygirl15: An Oral History
Nobody does, because there is no open source "visionect", but there really should be. They have put in the work to make a simple stack (dev kit) for working with the tech, but you can't just borrow that stack and source cheap panels. I would say the market is wide open for someone to do what they are doing, but crowd fund it, open source the controllers, hardware, software etc
When those publications are as generally biased and nutzo as they are, I feel the need to disclaim referencing them even for direct quotes and facts. They had the information I needed, but I still don't want to act like they're gospel for anything else!

As for the data mongering, your link notes that (ignoring gang violence), there have been only 3, not 136, shootings this year. It's a bit curious that such a large order of magnitude change can be had by changing the definition slightly--and yet, it's nearly always the more dramatic number reported and reported as an imminent threat!
I shall use this for so many pranks :))
Awesome discovery dude.
Similar in spirit to John Rauser's 2014 Strata Conference + Hadoop World keynote "Statistics Without the Agonizing Pain" (https://youtu.be/5Dnw46eC-0o).
Ok there. You sound so smart there bud. You guys are such pretentious losers.
It may be useful, at step 0, to check out the server and see basic server orientation. Which Linux is it (cat /etc/*-release)? How much ram and disk (htop, df)? How is the filesystem setup (mount)? What packages are already installed (dpkg -l)? What processes are running (ps aux, htop)? What did the last root, including me, do (history)? I also like to know where is the box physically, roughly (tracert, run locally).
Online Resources to Learn JavaScript
OR you could encrypt user password with your public key. Then when you login, you can decrypt user password with your private key. Then go on decrypting user information with that password. This way you won't have to make copy of information posted by users and still will be able to view it with admin login.
SketchUp in your Browser
I was going to say that's unlikely since the API is part of what makes Slack Slack, but I would have said the same thing about Twitter 6 years ago...

That said, Twitter and Slack are very different beasts. There is not nearly the same network effect to keep teams from switching to a competitor... except to the extent that 3rd party products integrate with Slack's API...
I too am curious to know what the consensus is. People seem to fall into one of two camps: 1. it's unnecessary if you disable password login or 2. it's an easy thing to add as yet another safety net on top of sane service configuration and firewall rules.

I've taken some flak here for being in the #2 camp so I'm loathe to expose myself once again, but my thinking is that even with password authentication disabled, sshd is still vulnerable to DoS attacks. From the public internet or from other machines in my VPS provider's datacenter. The ssh and recidive fail2ban filters add some minimal defense against that.
The contests I joined, I found out about via the Jonathan Coulton forums a few years ago. One was "Masters of Song Fu," which I think is defunct now. The other was SpinTunes, http://spintunes.blogspot.com/

I have not participated in Song Fight but know people who do -- see http://www.songfight.org/
Previous discussion based on an earlier 2015 version of the slide deck: https://news.ycombinator.com/item?id=10244950

Back then, I wrote a small tutorial on how to implement and animate the bootstrap technique in R/ggplot2 based on the talk: http://minimaxir.com/2015/09/bootstrap-resample/
> That said, a script that pokes and prods the right places and reports a machine's 'security factor' and prompts improvements would be cool (and probably already exists).

https://cisofy.com/lynis/
Or just use FAUST: http://faudiostream.sf.net/

Seriously, check it out, it's awesome. Write your audio DSP in a language suited to it, compile to efficient C++ (among other languages) and optionally embed it in a (huge) variety of environments. (even Javascript for webaudio)

It's a functional description language that describes a DSP graph, and can generate block diagrams too. Not to mention, it has libraries containing any filter you can imagine. Highly recommended.
Automatic weapons are expensive, because they require tax stamps and other various legal work to own and operate.

To the best of my knowledge, legally-owned and purchased automatic weapons simply aren't used in crime. It'd be somewhat like hitting somebody with a Learjet: sure, you could do it, but there are a lot cheaper ways.
I don't think this works in Silicon Valley. I'm a recent transplant but I've found that people here are very passive aggressive and it's always a mistake to be direct with people. Now, in NYC I never had a problem after talking to someone about a disagreement (obviously in private). But, it's just not affective in SF.
It is a problem that the American people are too cynical. Cynicism is the reason negative campaign ads are so effective - no one trusts political ads unless they're negative - and the more negative they are, the more people believe them. Cynics don't bother actually studying the positions of a candidate - because they know all candidates are corrupt anyway, and all parties are the same - but of course they'll vote for anyone who's politically incorrect and promises to "throw the bastards out," because the only politician anyone trusts is a politician who pretends they're not running for office. Cynicism has made the concept of being engaged with the political process a joke to anyone who doesn't want to destroy that process.

I mean, the cynics are correct, but they're also more than a little responsible for perpetuating that system by setting the bar so low.
I always change the ssh port to something other than 22. It has always seemed to work well for me for most automated attacks. Perhaps this is not advisable for some reason?
> A fine point in an ideal world. The problem is that as traffic increases, the number of people that drive in a way that doesn't respect the safety of the neighborhood increases. There's a distribution of types of drivers at play here--more samples necessarily results in more observations of people driving poorly even if they are outnumbered. People who have a tendency to look at their phones rather than the road due to their use of an app probably skews the distribution a bit as well.

> I'm all for utilization of public infrastructure, but I'm also sympathetic to the homeowners who observe the safety of their neighborhoods decrease as a result of increased traffic volume.

I for one have zero sympathy for people who put up street signs on their own saying no through fare. Personally, I'd say that is a criminal offense.

I have zero sympathy for home owners who think their rights extend to the streets.

There are other ways to increase safety. Stop signs, speed bumps (sparingly!), very low speed limits (I'd say less than 20 mph) are all low hanging fruits.

No, you should not play on the streets every day. Block parties and such that happen infrequently (think once a month and probably only for a few hours) won't be a problem. However, people who say no through fare on their street are guilty of NIMBY.
Probably still because of the license? Btrfs is GPL.

It will be interesting to see which license, if any, APFS is released under.
Plum Alley: Connecting Women with Money (2014)
Jon Harrop has some ... "interesting" views on Haskell.
Algolia/places: Turn any  into an address autocomplete
>all employment contracts are presented as permanent

On the contrary, the vast majority of employees in the US are under "at will" conditions, where their employment can be terminated at any time. There is nothing permanent about any employment contract in the US.
Any ideas on how to promote self-actualization and self-improvement in the masses when UBI takes hold? Sounds like a project that must go hand in hand with UBI experiments.
The Civil War didn't occur just because of how deep the divisions were, but because they were strongly correlated with geography and not strongly correlated with class (particularly, that the divisions were quite present among the upper class with disproportionate influence on governments, and, while not perfectly aligned with geography, strongly correlated with it especially among the upper classes.)

The same degree of division with different geographic and class distribution could very well not have similar results.
Like a lot of things I suppose I would say that it depends.

I think that it is OK to question if someone is being really charitable or helpful to you when they suggest that they are being so, in the context of what is otherwise a put-down.

On the other hand if someone asks a question about a scientific theory and has his or her motives for asking it scrutinised simply because the question implies doubt, then I don't think that's OK.
Well...nowhere online. I've got a MicroCenter nearby. They claim to have a bunch in stock in their store, and I've heard other people claim that they bought theirs there. I've got to imagine that there are other electronics shops in a similar situation.
Encoding != encryption. This article isn't discussing JWE (JSON Web Encryption), but rather JWS (JSON Web Signature).

These tokens are base64-encoded and signed. They can be decoded easily, but not forged or altered without knowledge of the secret key.
Katie Conf, a conference with talks only by speakers called Katie
Time for some headspace and anxiety therapy (ie rejection therapy) to reach the next level.
NoSQL Injection and GraphQL
Thanks, this is very useful! Follow up questions, if you see them:

1. Does what you said include ScriptProcessorNodes?

2. Is this true of all browsers per specification, or true of a particular browser's implementation? My experience with web audio has been that in Chrome things work as you say, but in FF I could never find a webaudio library that played back without heavy clicking, so I supposed audio workers might help.

3. Given what you said, what will be different about Worklets? I scanned the links but I guess I don't follow the bigger picture.
The Creative Way This Firm Is Getting Female Investors into the Big Leagues
LIGO Reports Second Black-Hole Merger
Why is it a call for research? A simple n-gram model would be enough. It only needs to be almost grammatical, the spammers can't read all the messages anyways, if they want to fight that they need another machine classifier.
what's your definition of inference, and what do you call the purpose of a machine learning algorithm, and how does that purpose differ from a statistics approach?

perhaps I used the term incorrectly but a dictionary defines inference as "a conclusion reached on the basis of evidence and reasoning."

bottom line... similar objectives, slightly different if often overlapping emphases and bags of tricks.
There are many many things people could be doing better with their time than sitting working for someone else for 7.5 hours per day.
But that's the easiest way to identify the bad people.
Rapidly or rapid? Is in the unscheduled part that is rapid or the disassembly?
Introducing Project Bletchley (Microsoft's Blockchain Architecture Overview)
* Know what's going on with the whole team (what state the project is in, etc) and be able to communicate it with anyone asking.

* Also be able to reach out to other teams to unblock issues.
I think you're on to something.
> but I doubt more than a few percent of them ever consider that, absent any specification otherwise, all employment contracts are presented as permanent.

While much social expectation and institutions are based around that kind of essentially feudal lord/tenant relationship, that's not actually the case with at-will employment in law: employment contracts without specificity of term are indefinite but not permanent (were they permanent, it would be illegal for an employer to terminate them without a breach of a nature that made the contract voidable.)
Jesus. You are halfway between poetry and ostentatious drivel.
With csound you have a mature, stable audio engine that works everywhere, even works for android, you can call it from various languages, while you can use it as a c/c++ library it has well supported libraries for java on android and objective c and swift on ios. http://csounds.com. I used it for my psychoflute and moonsynth apps on android.
Let's say 30 minutes [https://goo.gl/maps/SjMUzazkmUy]. Is that "much further" than 15 minutes?
The world’s oldest computer is still revealing its secrets
> This is nothing but a short term problem that could be easily solved with batteries.

Easily? The engineering challenges in doing this at utility scale are formidable.
yes, ssh-agent will let you enter the password once, and then it won't prompt you anymore.

(see https://help.github.com/articles/working-with-ssh-key-passph... )
You managed to check all of their docs already? Because as far as I know greenplum doesn't have incremental aggregation.
For example strtol, you may pass whatever (implicitly nul terminated, which is bad) and it either returns a value or an error. I wasnt advocating _you_ don't know what to pass but that the caller doesn't include specifics of the callee.
Verisign Top Trending Keywords for May – Trump Returns
If you have a secret in the JWT you definitely want to encrypt it (JWE instead of JWS).

But yes, it's true. A signature will protect against manipulation though, like the article points out, which is enough for a lot of applications.
In Norway it is typical to start a new company to develope a business idea and transfer employees there through various insensitives like stocks or options. That do allow to "fire" people by closing down an unsuccessful business. The big upside is that one looses the job not alone which feels much better. Also one does not need to explain why one was fired on previous position when looking for new one.
Thanks, Evan. these are all good points, I'm surprised to see this on HN since it is an old article I wrote.

In regards to the replay attacks, if you are using JWTs in a 3 party setup, and they are validating JWTs locally (not sending them back to a validation endpoint), the jti claim won't be enough.

Thanks again for clearing that up! Considering this blog post may still have a use, I'll update it soon.
I would be annoyed with a cryptic Audi password. I would prefer 'BatteryHorseStaple' passwords. Anything I can't remember gets written on a post it note and put next to my screen with what it is for. This is my behaviour and the problem with cryptic passwords is that there are others like me, willing to keep a good password secret and not willing to be so secret about a clumsy, easy to crack by machine but impossible to remember password.
No, I'm in the US. Shipping costs are definitely understandable.

I just mean that there have been times I've looked for one only to find marked up prices before shipping/other costs.
This isnt' a nitpick but a genuine question because I am unsure: Should that be --save-dev rather than --save, given that typings are very much a dev/compile/transpile time concern rather than runtime concern, or is there a reason for using --save?
There's two ways you can do this cleanly. One is to start from scratch and create a GraphQL server that directly hits your data source(s) by replacing the REST component of it. The other is to create a GraphQL schema that serves as a gateway to your REST app. In both solutions, you'll be creating GraphQL types for your input and return types, and re-writing your calls on your client apps to conform to GraphQL. However, the long-term benefit of this is that you can write your queries once, and run them anywhere on any client app platform.
If you're comparing the accessibility and cost of chain stores in and out of cities I'm going to assert that you're missing a lot of what cities have to offer (museums, interesting restaurants, live music, parks with lots of people in them, etc...). Also some people truly enjoy not needing to get into a car to accomplish even the most basic task

Cost of living and accessibility to nature and open space are the big compromises though
Dual gigabit Ethernet ports and USB 3 round out the impressive X-15's impressive features. It's not available yet but should be by the end of the month or early July based on the wiki. If it runs OpenBSD I might choose it over Soekris.
OP is most likely using "JWT" to refer to a JWS - the most common form of JWT by a very wide margin.

JWSes are not encrypted, only signed, so it is true that you must not put sensitive information inside a JWS.

You might want to use a JWE, but that is not in scope for the article.
The horsepower ratings of engines in the hobby world are optimistic at best. I have personal experience with some RC airplane engines and a dyno, and frankly I don't understand how the manufacturers can keep advertising the numbers that they do.
Thanks for the insight - it's always good to hear from average people who were on the ground.

I'm glad you clarified the Colombian perspective on Pablo - his philanthropic efforts were inarguably happily accepted by locals, but that doesn't equate to admiration, more of an acceptance that taking his largesse beat the alternative.

Finally, I think you make a good point about being a model for failed states, at least re: coming to terms with reintegrating some number of the architects of the failure back into society, although the influence of American military assistance and Plan Colombia cannot be ignored either.
> While I'm sure Netflix would claim the same, I doubt McCord was expecting the axe to fall...

Exactly. How likely is Hastings to adopt that standard if he knew that it would apply to him too?
Inside the Sharing Economy
IT worker at Panama Papers firm detained in Geneva
So, be surprised. They are.

Implementing RSA has many, many pitfalls. People are finding vulnerabilities on those libraries all the time. Now, take a look at libsodim source code - it's simple and direct, no special cases anywhere, no tests for validity. The only concern is with stuff like if the compiler will optimize out things like zeroing the memory and the platform has constant time opcodes.
Yes, it's still very impressive. At any point in time these images could have gone up on gamedev.net as screenshots of the day/week.

To those saying he should sell this game, I disagree. This is obviously a very interesting and personal project and commercializing it would take a lot of the joy out of the work. It's also something that is obviously in perpetual evolution. Once there's a release, that adds constraints compared to freeform development.
How would Illumos be better? I don't have any experience with it (although I've got some with Solaris/SunOS itself), and I'm curious.

I'd assume that Linux would have a lot more software available to it, as well as more maturity to its ARM ports.
Locking means it changes the password to a value that nothing could ever hash to (by putting a ! in front of it, for example). Unlocking just removes the !.

The security disadvantage is that if someone gets your /etc/shadow file they can still see the password hash, in case they wanted to try to crack it, but honestly at that point your server is likely compromised anyway.
In the presence of -Werror, this seems isomorphic to the notion of adding a '-fdynamic-type-errors' flag.

It can't be done in full generality because, as I mentioned, there are places where term-level values depend on types. If we don't know what type, we can't know what term.

We could certainly treat only those situations where behavior is ambiguous like '-fdefer-type-errors' currently treats any type mismatch, and add dynamic checks for the rest. It would be an interesting point in the space, though not one I would expect to use very often.