skysight-inc/HackerNews huggingface dataset:
I was pretty paranoid about moving to 2FA for my personal account due to fears about getting locked out, but finally decided to take the plunge when I got a yubi for my work & realized I could also add my personal account to it. The nice thing about the Yubi is that decreases the chances you'll be locked out, because (if you're using it for a Google account, then) you still have a phone app, like Google Authenticator, that you can use to authenticate. And you've still got backup codes. And I also have two keys.
They sell a Yubikey 4 with USB-C adaptor which looks like what you want: https://www.yubico.com/product/yubikey-4-nano-usbc-bundle/ Looks around the same size as Yubikey 4C.
This is true but misleading. You could make a similar statement about any field where technology improves over time. For example, "nothing has changed in the manufacturing process that would prevent someone from building an automobile the same way as 60 years ago" -- sure someone could build it that way, but it doesn't mean it would be a successful product compared to other things currently on the market.

And I am not talking about using different frameworks / compiled languages / etc... I'm talking about the improved techniques we've developed over the years combined with new features in browsers, such as:

* HTML5 vs. HTML4 (streamlined and more consistent syntax in a lot of places)

* Float-based grid systems for layout

* Flexbox(!) for alignment

* media queries and picture/srcset for responsive design (heck, the whole concept of responsive design)

* web fonts (not being limited to the dozen or so that are available through the OS only)

* BEM methodology (having a modular mindset about styling components, combined with avoiding specificity issues by just using a class for everything)

...and that's just plain old HTML and CSS... don't even get me started about javascript (even just JS/ES5!)
Please do all you can to support this. Send to your local makers, hackers, and geeks. Also kurig, john deere, and tesla owners may also be very excited.
I'm not convinced that bandwidth is the main issue. The fact that we interact with supercomputers over SSH today rather than a live video stream like we could in terms of bandwidth hints at the larger problem.

We really struggle to get computers to understand what we mean. We still largely have to program computers rather than just interact with them to do the sorts of things the GP is talking about. If AGI advances to the point that computers will easily be able to do our bidding using voice, video, or a neural lace, I'm not sure that there will be much need for computers to be directed by humans at all.
So I guess you can do shelling and ethnic cleansing of those who don't support your desire to break away?

http://www.rferl.org/a/Eyewitness_Accounts_Confirm_Shelling_...

https://en.wikipedia.org/wiki/Ethnic_cleansing_of_Georgians_...
Depends what part of LA your in, but in most cases your absolutely right. Most areas are designed with cars being the prime transport, with sidewalks halfheartedly tacked onto high speed roads. I'd never walk along that by choice!
From a technical level, no. Absolutely not. I can name at least 5 other free ways to blog, and maybe 15 if we throw in ones that require me to have my own server.

But finding a way to make money on blogs/internet journalism is starting to look pretty difficult. How much money is tumblr making for Yahoo? What about all the traditional media companies that should have this in the bag?

People are too used to "free" that making money on the kind of content Medium wants to be known for is starting to look a lot like a moonshot to me. But instead of the laws of physics or technology, you're going against human nature and culture. Not exactly a fight I'd want to pick.

I'm not going to argue with you about hero worship, though; it's pretty ridiculous.
The good news is, they'll be free! Coincidentally, we solved the problem of figuring out when you're actually watching an ad, so the ad market is going to be much more efficient.
Trust: a hardware token has a very limited interface where it can be attacked compared with a general purpose computer or phone.

Take the devices you use: how many exploits have there been in the last year where an attacker who could get you to click on a link, view an image, etc. could run code on the device? Maybe you have something like the iOS sandboxing between application which would stop a compromised browser from compromising your authenticator app but there are many cases where attackers have been able to bypass that.

Using a hardware token prevents almost all of those attacks and means that if you are compromised you'll have an easier time regaining control. They also have some nice benefits such as not running out of battery when you need them in an emergency.
A messaging standard that only advanced users can use is basically useless. That's the point of the article.
See https://what-if.xkcd.com/147/. Niagra Falls is usually flowing at 100,000 ft^3/sec, the same as the spilway. Granted your 3ft pipe is a bit bigger than a drinking straw, but closer to the straw's scale than the spillway's!
C (complex numbers) is a field, just like R (real numbers). It's an algebraically closed field, unlike R, so in some sense it's actually the most natural set to call "numbers".

https://en.wikipedia.org/wiki/Algebraically_closed_field
Of Thousands of Apps Tested, These Endured
I dislike that "substantive domain knowledge" has here been replaced with "communications skills." Science stands on the shoulders of giants, and ignorance of what has come before doesn't do that.

Being able to spin a good yarn isn't really enough here. If data science just becomes a code word for brogramming your way through a set of black-box ML algorithms, then I will welcome the inevitable crash of data science.

If insight is the goal, then classic applied statistics plus reproducibility feels like a much better story. At least if insight rather than "making it go" is the goal.
Do the right thing. What an important notion to convey. This is the point. Do the right thing. But alas, money, large groups of ppl always screw it up.
Free? I don't get it. Can you make 2 HEX color combo not free?
Yep - the warning clause in the documentation is there because of those issues.

thanks!
TS gives you nothing but new warnings and errors that would not be JS errors. I find JS ok, and use clojurescript when I need to develop bigger apps. Angular2 is much more difficult to work with clojurescript than React.
How to get hired by Elon Musk
Yes, but it's not ethnically Georgian, which was sort of the problem. That wikipedia article toes the Georgian line, which is sort of disappointing, but they do cite the EU report (via the 'world socialist news', which I don't really want to cite) that the pretext was manufactured.

The Russian point of view is that they were stopping an ethnic cleansing right on their border, before it could get too far. It's not a crazy point of view, the Georgians were shelling a mostly non-Georgian city. The US is also not a super neutral observer, we were selling them tons of weapons, and the Georgians were pandering pretty hard to us.

It looks like the full EU report is mirrored by the BBC: http://news.bbc.co.uk/2/shared/bsp/hi/pdfs/30_09_09_iiffmgc_...
You mis-spelled "iphone."
Touché. Although the opponents in the campaign are mostly terrible. Even by French standards.
Neat! I've been looking at a few things similar to this for various purposes recently, one thing I'd like is some sort of mix of this plus some content analysis system for managing an email inbox and then performing actions based on and using the data contained within, for example an email comes in with some sort of semi-structured data / information - it's contents is analysed, it's put in some sort of group like a 'this is an SNMP alert' then the data is formatted / munged into another form of structured / passable days and then routed off to another email address, I.e. Create a markdown / whatever table, Look for IP addresses and FQDNs, pair them if they're on the same line and create an extra column with a human-usable hyperlink, send it on to an email that logs a ticket in whatever ticket management system is in use at the receiving end. That's just one simple example I could make up off the top of my head, but I'd like to easily create some neat logic rules based on the content and then use some of that content to decide where it should be routed onto, again to use a ticketing / helpdesk situation as an example just because it's what I thought of just then - an email comes in and if it contains certain keywords or phrases a response will be sent back with a table / list of information to fill out in the form of questions like 'please include the following information in your reply...' and it might have some basic information gathering steps for the end user like getting their IP address, OS etc... then when they reply the system could pickup that data, munge / transform it into some sort of standard / structured format, do some more troubleshooting like pinging the IP provided, doing a whois, perhaps relating the data to a list of clients or something and then passing it on to the right team or ticketing system via email again. I think the key to this would be to use something like the OSS product mentioned here that's more modern and lightweight coupled with a nice query / rule builder interface that's fast and responsive and easy to test. Business rules / logic apps I've used in big corps in the past have been a combination, mix of, or all of the following: slow and resource hungry, proprietary with all forms of vendor lock-in, hard to build rules and apply them, require up to a whole team to support and maintain them, and often not technically focused / directed.
I'm in the same boat and actually submitted an "Ask HN" awhile back to see what others were doing (https://news.ycombinator.com/item?id=13567209). I have the plain ol' yubikey and also the NFC yubikey but I haven't found a good, real world use case for them. It might be that I'm just not the target market or that I haven't put enough time/effort into it. For me the big selling point was the FIDO stuff but so few providers seem to use that...
Let me contrast the author's experience with my own. Note that I had a brain injury during this process that made me forget scripting and GPG plus hard to learn. I'm a nice test case for how hard things are. :)

So, I looked into GPG. Holy shit there's a ton of options and complexity. High-assurance security says subset to minimal thing that works for increased trustworthiness. I noticed it could encrypt files with others' public keys. The person that contacted me was able to receive attached files. Text editors only have so many 0-days left in them & are easy to sandbox. So, I decided on this protocol:

1. Type the message into a text file.

2. Type a cryptic command to encrypt it with that public key.

3. Attach the file to a message to that person. Optionally doing this on a different box passed through a data diode if I was worried about GPG box compromised. Just using Linux for now.

4. Receiving works other way where I download an encrypted file that I run a decryption command on.

So, that's simple. How to get started and what commands to use? I installed GPG first. One look at the man page made me hit Google instead. I found a cheat sheet, identified the minimal commands necessary, and compared them against the man page. Saw what seemed to be right stuff but that man page was horrible. Looked at a bunch of other sources online with varying trustworthiness to see if they had same commands. Seemed like I had the right ones. I was also warned the key gen phase could take a long time so I just ignored that usability problem that stomped the OP so much. I was warned after all.

The key generated. Messages sent and received well. Only thing left was tediously typing my new buddy's email into the box with every encryption. As others came up, I was having to remember more email addresses. Time to automate that shit with a front end that worked on any system I needed. Also, without remembering how to program.

I recalled Python was easy. So, I'd need a data structure for a list of (alias, email) pairs, basic operations on text for maybe substitution, input, conditionals, ability to print them, and spawn function of some kind. Python reference gave me all I need which I tested each to be sure then composed them with tests. End result was a Python script with the list of alias/emails in it like a config file where I could just add people to the script itself. Then, I run the script on the text message with it asking which of a listed group of people to send it to. I type in number or name for it to run command automatically. Then, I verify by eye the new file looks like gibberish and attach it to the email.

End result was that I had GPG for friends using it, I figured out how to use it with fair degree of trustworthiness, and I automated the annoying part with less than beginner's knowledge of scripting. This shows GPG is way less hard than it appears to be. Although I sure could use a great front-end to smooth over all this. I'm sure any half-ass programmer could create one given what I did in that state. :)
The First Program I Ever Wrote
The U2F zero was on amazon for a while. But not anymore.

Unfortunately the guy who is doing it no longer has time for it.
Designing the Foundations of a Secure Organisation – Cyber Management Alliance
This is a beautiful analogy. It captures the essence of it. The clock has transcended from wood and steel gears into flowing electrons on a generic computational matrix. It will be the same for humans.

I'm stealing it, it's mine now. Thanks.
Agree about Matrix. You get addresses such as @username:example.com , which work somewhat like email addresses. The example.com part is the homeserver, analogous to gmail.com or yahoo.com in emails. Users can communicate across homeservers.

It's also fast to setup. Took me about 30 minutes to set up a homeserver and host a customized riot client to use it.

It's not completely decentralized yet, and you can only use from a fixed list of identity servers. Although you can set up your own synapse node, you can't yet use it along with the centralized identity servers.

The reason they give for not decentralizing the identity servers yet is to avoid spam. But they plan to make them decentralized in the future, so at that point it would completely be like email.
Can't they just overtake your motor functions for, you know, a commercial break?
Encryption works automatically, yes. You can also send encrypted emails to non-proton users that require a pin code to read.
Consumers Are Going to Love the End of Net Neutrality – At First
Of course! I think there's a good reason (1) is the first definition of e^x we get in school, though. I don't think it's the most "natural" definition, but I think it's the most grok-able. It's easy for high-schoolers to learn precisely _because_ each part of it is so intimately familiar that it's clear without hand-waving precisely what everyone's talking about.

When we then step into viewing real exponentials as "The thing that gets bigger at a rate proportional to where we're at", it's un-abstract, which is honestly important for intuition. Of course you're going to want to then view it with the calculus definition, or as a matrix, or as an operator... But I wouldn't start there.

So I feel the same about the complex version. There's another nice proof in this thread that starts with the calculus definition and follows a similar track. It's a much more beautiful proof! But I worry some will lose intuition when we start the conversation with "a complex exponential's rate of change is perpendicular to its position"...

That said, if I were to ever teach a math class on complex numbers, I think fleshed-out versions of these two 4-step proofs are the ones that together best build intuition for what "rotation in complex exponentials" really means. That rotational aspect is the foundation of much of the handwaving done in control theory, DSP, ASP, signals and systems, and really anything involving fourier and laplace transforms. So, it's important to grok it well.
Note that this isn't just a U2F key; if you're looking for a token principally to log into web services with, this isn't what you want, and the token that does that costs less than half as much (it's the U2F-only token).

You want a Y4 if:

* You SSH into sensitive machines.

* You log into a VPN that you control and can configure to use the Y4.

* You're actually relying on PGP.
Great to have a USB-C option available, though bummer they didn't include NFC in this one
Gee, should I be asking "why" instead?
Findr – Discover what the internet knows about you
I disagree... they are hard. The fact that you think they are easy speaks to your own intelligence or "way your brain works" that you are able to grasp it (and/or your persistence/practice over the years of learning it).

But try teaching this stuff to people with no experience, and/or people who don't have as analytical a mind as us tech folks and you will quickly discover just how hard it can be.

(I recently taught a college class that was an intro to web design / development - suffice to say it really gave me a clearer picture of how far I'd come in my own professional skills over the years... it's easy to forget what it was like before you knew what you know now :)
The USA hasn't tried to annex parts of those countries.

Do military bases count?
> Funny how it wasn't until after they were acquired by that company that they began the project to adopt the protocol that would make reading their messages cryptographically hard.

Perhaps you don't remember this:

https://www.theguardian.com/technology/2016/oct/28/whatsapp-...

https://www.theguardian.com/technology/2016/nov/17/facebook-...

Can't parse your second sentence, sorry.
Remember that closed source security-related products are a complete joke and you should spend your money somewhere else.
>If computer science becomes code word for brogramming your way through a set of black-box algorithms, then I will welcome the inevitable crash of computer science.

huh. Hasn't crashed yet.
This is a common and very natural treatment of constipation. The other treatments are very unnatural, because they amount to poisons that the body what's to reject (in the intestines). That's what my gastroenterologist told me 15 years ago.
Ask HN: Need help designing a database for an app that tracks creditors
Why would spy agencies wanted to read people's messages from server, when they can get plain text in each device ? Nonsense. Current encryption type secures only storage and transmission states. What secures kernel, decryption, caching and read states ?
You have no idea what you're talking about mate. As a state-level actor, I could obtain/develop a nice Safari root exploit and get the target to visit a malicious site. Heck, if I were the NSA, I could probably get Facebook to insert the exploit payload once the target logs in. Game over.
> Which also applies to the distributed systems - email, in context of this particular discussion. Same logic here: email works for both.

Email yes, encrypted email, no. That's the whole point. A decentralized system, as nice as it is in theory requires participation to enable widespread change. You cannot just say "now we all encrypt email" and know that everyone does. But you can change the transport mechanism of a centralized system to something encrypted and know that it works for all participants, even for those that don't care or don't know how to do it themselves.

It's a trade-off. Again.
Most applications let you download backup codes for the event where you lose a key. But it's an anxiety I have as well.
Yeah, I didn't mean to say China would democratize.

Rereading, I see how it can be read that way.
Belarus, really!?! They look like a fragment of the USSR that simply hasn't gotten the message yet. Where's the burgeoning democratic movement, where's the economic modernization?
Google Maps makes your favorite places social with launch of shareable lists
"Scarce resources cause competition" and "Scarce but close to impossible to catch on own resources cause cooperation".
Is that really a discovery worth publishing?
Ah I remember discovering JK many years ago. Definitely one of the more enlightened and aware among us.

I think Ive had the most potent personal and spiritual growth when I spent time alone with myself.
Any government on this path is a tyrannic old dinosaur in need of reform.
Can't help but bring up the notion of envy these people (technocrats specifically) have for the biological miracle that is the human body. They can simulate the human brain all they want, but they'll never match it, as it's orders of magnitude more complex than any supercomputer they can dream of. And it has free will, which AI does not. AI is impotent at making free decisions because it's deliberately constrained by the programmers to think rigidly and inside their own custom black box. There's no room to roam unless we get to Mars where we can unleash AI and watch it make free decisions, which I suspect Musk is trying to do...Turning planets into giant labs where AI can be less constrained.
Some people will tell you to buy two Yubikeys and leave one as a backup. I don't think that's necessary. No matter what, you should generate a backup software key and keep it on offline encrypted storage; if you lose the token, just use the backup key until your replacement arrives.

It's even easier for Github and Google Mail. For web services, the right stack is:

* Hardware U2F token

* Backup software TOTP (Duo or Google Authenticator or whatever)

* Backup printed (or saved on offline USB key) passcodes

* Disabled SMS.

Unlike SMS, which is devastating to security even as a fallback, having a software TOTP option is basically fine; most of what U2F buys you is unphishability. This leaves you with two levels of backup, one of which is reasonably secure indefinitely.
It seems that Elon Musk used to read the ghost in the shell (攻殻機動隊) as well... which very soon will have a Hollywood version in every cinema. The problem I find on Elon words is that everything he says tends to be oversimplified and put in a dichotomy without much fundamental basis (just because something is plausible is not more closed to happen) this is in one hand great to create a vision, but I would say that at the same doesn't play well with the scientific method...
Specifically, diversity makes for a terrible battlefield logistics problem. It doesn't matter how many rounds of 5.56mm you have if your rifle fires 7.62mm.

Further, has the EU ever projected it'd forces outside of Europe without US backing? Can the EU put troops in the middle east or Africa collectively? (Yes, I know the individual countries can.)
The fact that WiFi advertises your MAC address whilst searching is quite annoying.

Have there been any developments in randomising MAC addresses or other solutions to this problem?

Edit:

I found this app called Pry-Fi:
https://play.google.com/store/apps/details?id=eu.chainfire.p...
I've had one on my keychain for a while. It's rugged enough for day to day use.

The only issue is that the hole for the key ring has a thin wall, so I have a plastic coated keyring to prevent the metal from rubbing the hole.
Especially brilliant in those situations where you come up behind heavy trucks. Normally you can't see shit for the clouds of water those leviathans kick up. With Rain-X... no problem. (Shit, I sound like a advert, now. How annoying!)
The OTP functions basically as a USB HID keyboard. So you can plug it into something that is not locked down (like a phone or tablet), and then just copy the code.

The drawback is that the code could be long. A few years ago, the codes were just 6 digits. My latest nano spits out a very long (20 char?) alpha-numeric string.
1. Just like Crimea?