skysight-inc/HackerNews huggingface dataset:
Nope. I totally agree.
I don't trust a single thing from facebook. I mean, good on them that they open source their tools, but most everything that comes out is just a huge pain in the ass with very little benefit to adopt, other than we can say we're using open-source facebook technology.

The funny thing, though, is that keeping up with other web tech, you always have to deal with facebooks API's and sharing and whatnot, and its also, usually a huge pain in the ass.

So, like, what's the benefit of this, switching build systems, other than a tick on the resume for someone who wants to get a job at facebook?
I'm nearly 40 and been programming for nearly 20 years for living and see no way to get out of this. I'd love to be pushed to a management position... Tbh the idea of doing this crap for another 20 years for this low pay check is not very appealing...
I find the voice of the operator at HK airport incredibly soothing.
> like Fukushima happen you see the astronomical costs of the negative externalities in the long term and things look suddenly very different

Erm, the cost/damage on the whole region (and not just Fukushima) is much higher than the nuclear power part itself. Let's not forget it's a once-a-millenium kind of tsunami that occurred there.

> Now I see that nuclear power is not only an ecological hazard but also a fool's business from the economical point of view

That's the best thing we have, right now. Good luck powering up cities and means of productions with solar & wind, from tomorrow onward.
So JWT is bad because there are bad implementations and there are dumb people who shoot their feet^W^W^Wdon't force alg. Seems like doing software development for 13 years leads to serious problems with logic. There is also confusion between sessions and session storage. Meh..
A standard that best case doesn't explain the risks properly (so many implementers get it wrong) and worst case prescribes dangerous behavior isn't a very good standard. Especially in a field where many developers are told over and over again to rely on standards, it really should spell out even tiny issues.
It's a shame that America (and possibly other first world countries) punish developing countries for not bending to their will. With the massive amount influence that the US has on the world, it's hard not to imagine that we've become the global mafia by demanding payment--however unjust or in bad taste--in exchange for economic and military protection.
I'm not a watch geek, but I do love them.

The thing I love the most is they are quite unique in the sense they can be passed through the generations and become more than an object.

The watch my grandfather gave to me before he passed away is, and will always be one of my most prized material possessions, which I also hope to pass down to my children one day too.

It's why a fitbit, apple watch or the like will never do for me.
The idea of apolitical money is a fantasy. Read sociology studies on the origins of money, ie Debt the first 10 000 years has a good counter narrative to the the idea that markets self generate (with plenty of historical evidence).

Markets, and money, have always been consequences of state power.
Yup, would save a ton of printing from imslp.
Presumably, some of the same benefit is gained by having the generic sticker, even without the alarm system.
What's wrong with mediocrity? Once you "won" (have FU money), the rat race terms are no longer relevant.
Greenpeace is fighting nuclear waste recycling. For me, it is a proof that they are manipulated.

Disclaimer: I have worked at "La Hague France" between 1994 and 1999.
One advantage I think not mentioned by some of the linked articles is that the JWT's claims are readable on the client.

It's a pretty good plus, for me: no additional round-trips to the server to grab key user details, which can be put into claims, or check access levels (via roles, permissions, or other types of claim).

This doesn't discount the disadvantages, of course.. I think as with everything it's a case of the right tool for the job. "Depends on the use case".
> many immigrant lives are cut short because they aren't allowed to migrate.

I'm not sure what you mean. If you cannot leave your country (because of your country policies) that's a problem, I agree. If you cannot enter, say, the US, you still have a lot of other countries where you can try to immigrate to.

Btw, when I use the word "immigrant" I mean "come to live in a foreign country". I'm pretty sure you are using a different meaning (maybe "refugee"?), could you clarify?
> not everyone believes the GERS number of £9bn.

The GERS figures are produced by Scottish Government statisticians. Why would they massage the out of Scotland's favour?
Sad but not unexpected in the tech industry.
JWT can help make a system look more secure, for example you store userid, email some token in session store and a customer goes poking around and tells everyone that he can see that inside the inspector (his data), if you obfuscate it with JWT you eliminate false positives but it doesn't make it anymore secure.
He didn't say use SESSIONS, he said use COOKIES for the data you would expect to go within a session. They scale just fine. You shouldn't be storing that much data in a JWT either.
Ah, hang on. The link to Amazon Route 53 is bogus...
Potentially, because they live in a poor country and the income far exceeds what's possible with a legitimate job.
Poland is similar, the matter of safety when choosing where to live is not a concern for people here - it's just very safe everywhere. The worst that can realistically happen is some non-physical harrasement by drunks at night.
There are two schools of thought on this: it is and it isn't.

For people who believe code isn't literature descriptive names are wasted characters. The biggest difference between code and literature is that code is structured where literature isn't (literature makes up for this with a flow like a plot). Explicit structures are things like subtypes and nested scopes, qualities that exist directly and not through inference or reference resolution. There are things that can be inferred directly from structures like context and scope. For these developers code can be less explicit and less wordy because they aren't reading code line by line and guessing at how the pieces come together.

The code is literature camp represents an educated formalism. In the absence of explicit structures you need to understand what the code is doing by simply reading the code.

The problem with the code is literature approach is that it is for humans only. The computer absolutely doesn't care, and so therefore it can be wrong or deceptive.
Out of interest, do you check the authenticity and integrity of the JWT on the client side?
I'm all for using existing tools, but not for the sake of itself. If there is a good reason (and everyone in the team agrees), all now obsolete tools should simply be replaced by the new one.

If this did not work in your office, this is most likely a problem of people in your office not communication properly about their choice of tools. Did you have people make a short presentation when they introduced a new tool? Did nobody ever point out that you already have various tools that can (easily/elegantly) accomplish what the next new thing(tm) is introduced for?
EDIT: the secondary spec describing the algorithms is at least clear on the use of none, I missed that at first:
Implementations that support Unsecured JWSs MUST NOT accept such objects as valid unless the application specifies that it is acceptable for a specific object to not be integrity protected. Implementations MUST NOT accept Unsecured JWSs by default.

https://www.rfc-editor.org/rfc/rfc7518.txt

Still, my point about it missing from RFC7115 stands.

---- Original comment ---------

The standard says you should support NONE as the algorithm and that you should use the algorithm the client sends you, all the while completely failing to mention the issues with that, both in its Security Considerations section (which mentions even more "obvious" things like "use keys with high entropy") and in the description of the algorithm to decode a token (which initial implementers probably relied upon to get to a "correct" implementation). Sorry, that is a failure of the spec as well in my book.

If you spec something with risks, at least mark the critical parts clearly with "point away from foot".

A better standard IMHO would have suggested the API for the decode functions, making it clear that the algorithm used should be whiteli
I have briefly used https://github.com/Factual/drake for this.

It is a bit unpolished and still a work in progress, but has some features that are useful for data science workflows that most software build tools do not cover:

* Steps can produce multiple named outputs (for example full.csv and summary.csv), dependency graph can branch in both ways,

* Outputs that are directories with many files,

* Built-in input/output file sharding (for example by date or month) and HDFS support,

* Lots of control over which steps to execute: not just "rebuild target X and any required upstream dependencies". Can select a target and all that depend on it downstream (if you know that a remote file changed), skip rebuilding some steps, etc,

* Can put very short (text processing) scripts directly in the Drakefile in Python, Ruby.
We provide an endpoint to check validity with the server, but haven't used it too often. Anything "reasonably sensitive" (or more) doesn't depend on anything like this client-side security.

But, if you're just hiding an additional Delete button on a page based on claims, this comes in handy.

(Edit: in one case, we've used asymmetric keys, i.e. public key so everyone can check integrity. This was a very different use-case to most web apps, though. Overall I'd say if you're carefully checking integrity of something in client-side JS to do something, I think that's probably the wrong approach)
Similar for me really. All my school friends had spectrums, i had an Acorn Electron. Nothing wrong with it at all, but i had no one to swap games with...and being poor led me to messing about with the code side of it. Well done to my parents for not listening to my cries for a different machine...future me appreciates it.
I will admit that this is a gross simplification. However it's a totally plausible prediction. I stand by it as a summary.
Asymmetric encryption is generally synonymous with public key cryptography[1], as there are few processes which are asymmetric and useful.

In terms of definitions, with an asymmetric system, knowing the key with which something was encoded doesn't allow you to decrypt it.

With symmetric cryptography, if you know the key, you can decode whatever was encrypted.

[1] https://en.wikipedia.org/wiki/Public-key_cryptography
The none issue was highlighted by Tim McLean 2 years ago [0] and comes up in any trivial search about JWT. Surprised that anyone who chooses to use JWT is still getting caught by it as, as you say, any half decent library mitigates this.

For me, the log out / cross device session management issue seems to force a pattern of short expiry with self refreshing tokens. Commonly used devices feel always logged in, whereas uncommonly used devices end up needing a fresh log in each time.

0: https://www.chosenplaintext.ca/2015/03/31/jwt-algorithm-conf...
Alpha smart https://en.wikipedia.org/wiki/AlphaSmart
Agreed.

My proposal isn't intended to make open-source sustainable. I don't have any magic solutions.

Rather, my proposal is pragmatic. Can we derive some of the benefits of open-source in a sustainably-funded way?
Any idea why not?
Oh, you are right, this can be bad. But I doubt that CIRCLean does any of the badUSB mitigations. They could fix all of these including the instructions. But that they copy unrecognised binaries ("Octet-stream" in their readme) without marking them dangerous is the most worrisome for me [1]. It seems to be useful only for office documents.

[1] https://github.com/CIRCL/Circlean
Probably stands for Diffie–Hellman, a well-known key exchange algorithm.

https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...
I'm really confused by this post, a signed JWT is issued by the identity provider (or API end point) and is then validated again by the API end point when part of an API call, usually as a bearer token in the header. The validation of the signed JWT is done via the API.

The approach I use is to have a 'use once' refresh token (long timeout) and a security token (short time out) and JTIs to hold a list of logged out/invalid (refresh token used twice) security token IDs.
Not necessarily, it should be possible to do this correctly, although I doubt this specific device does so. The device itself needs to be hardened against USB attacks, otherwise it would be pointless, of course. Then it copies the contents of the malicious USB stick into a buffer storage, analyses the buffer and cleans up the documents on it, and then it unmounts the first device, mounts the second device and copies the contents of the buffer to it.

If it also allows for write-protection, then it might be interesting for forensic work. (AFAIK, USB write protectors cost a few hundred bucks, and maybe this device is the cost range.)

The crucial question is, of course, how well the device is hardened against targeted attacks. Just using some seemingly secure Linux won't suffice.
> But similarity is a symmetric thing ...

Yes, I agree with the idea, but the sense of "use ... similar to ..." implies intent and temporal order in many contexts. If I use language similar to Ernest Hemingway, am I justified in expressing it in the reverse order?

More realistically, in copyright and patent disputes, saying a person has "used ... (a method) similar to" that of a presumed originator matters a great deal, and a defendant in such an action may well reverse the order of the words in his own defense -- "I didn't use a method similar to Mr. Smith's, he used a method similar to mine." Clearly there's a temporal order implied in this particular context.

> And if the biological knowledge is a more recent discovery that the engineering knowledge...

Good point. One might assume biology is farther along in its grasp of the intellectual terrain than engineering, but that's not necessarily true.
I'm always a little surprised nobody has re-implemented it (as a full WP, not just a plain text editor) after so often having heard praise of it.
Definitely as an ereader user I would be interested any low lag technology even if I don't really want a bigger device currently. But I am also curious about the glass free display because I do really worry about the fragility of the e-ink displays. The idea of a textured surface is also very appealing if the display quality remains good.
Buck is a great tool but doesn't work on windows, where bazel is now starting to support.
So for crossplatform builds, either GN or bazel.
While I see where you're coming from, this strategy has a severe downside: once you lose the urgency, I expect conversion to renewables will grind to a halt.

Inertia is a powerful thing.

In that sense it may be more reasonable to skip the nuclear step and invest the necessary billions in renewable infrastructure, not nuclear reactors.
I think I had the space games one. I remember keying in the moonlander game. What I found interesting was the feelings it stirred in me. I 'remembered' in an emotional way what it was like to be 10 years old and keying in BASIC programs from books and magazines.

One of the other things I remember doing was drawing a pattern of lines radiating out from the centre of the screen. The spacing between the lines would interfere with the video rendering and you'd get lovely moire patterns. Varying the space between the lines would change the pattern.
>To your last paragraph: if the girl think programming is male occupation girls are not naturaly interested in, she won't consider it nor try it.

I'd like to see a source on a paper that finds evidence that supports this theory.

As far as I know all the gender study department grant money thrown at this has not been able to produce data to convincingly affirm that hypothesis.
Yeah, and that's kinda sad because now you have to check a signature AND query a database!
So, what should one should use then?
However, It's insecure with a bad client, right?
Beacuse I was going to use http+JWT for microservices communication an internal network, would that be a problem? any tips on what to switch?
Btw, GraphQL and React Native / Expo is a great combo https://www.learnapollo.com/tutorial-react-native-vanilla/rn...
That doesn't make it any less absurd for you to have some kind of hatred of anyone who is a felon. You obviously think some laws are wrong given that you explicitly moved overseas to get around them. And you are a hairs width from not having complied, indeed, I think that a reasonable court could have convicted you (did you use knowledge that you gained in the US to help you write crypto?).
that sounds a lot like sharing code by inheritance as opposed to composition. which is unrelated to dispatching by the type of the first (or implicit) argument.

i personally would prefer to code to interfaces and keep hierarchy separate from behaviour
> Sorry if I come across as rude/uncaring but I have seen people working 2 jobs and still be able to self-learn web development with no programming background/education. I don't understand why his father couldn't have helped himself a bit more during his career.

Plenty of reasons could have lead to this, and citing anecdotal experience of people that manage extra ordinaire feat shouldn't set a standard for everyone.
The problem identified has nothing to do with OO. Look at this code:

logFile.write(message);

We might as well replace `logFile.write` with `fprintf(logFile...)`, and get the same result in C. So we don't need OO to experience this pain.

Conversely, this is only a "problem" if `logFile.write()` results in SIGSEGV or NullPointerException or whatever. But some OO languages (Smalltalk, Objective-C, others?) dodge this by making null a message black hole. Confusing, but terribly convenient.

One last point: notions of "pattern matching with totality checking" or "verify something's not null through the type system" presupposes exhaustive knowledge of the environment in which your code will run. Maybe that's correct: google.exe on Google owned hardware in Google-owned data centers will behave very precisely.

But sometimes it's not correct. Your JavaScript code is running in a yet-to-be-written browser on an ancient version of some OS on random hardware. Your code's typechecking environment is unrelated to its runtime environment. Totality checking requires predicting the future. In this highly dynamic universe, languages like Haskell have no good solutions.
"Sometimes it's better to have no map versus having a wrong map." (Paraphrased)
Circlean seems to run on RPi - that won't boot off USB by default. In fact, you have to jump through extra hoops to get a similar effect, such as "bootloader runs from SD card, then explicitly switches to USB". So unless the makers of this have deliberately implemented this vulnerability, it's not there.
Because it is easy. With those skills you also know how to hide your origin, and collaborating with a burglar to identify and disable systems. I can see talented people choosing the easy job over hard but legitimate work.
The Great Hedge of India
That's exactly what is useful for. Of course access to a resource is determined server-side; JWT simply allows you to adjust the UI to the permissions the user has without any additional calls. If the user changes the JWT he has client-side, he will just get a broken delete button (the server will reject a JWT that has been tampered with).
Crooks hijack Magento Realex Payments extension to steal payment card data
ΔΙΑΓΩΝΙΣΜΟΣ FREE FUCK 15 ΜΑΡΤΙΟΥ 2017 – escorts| athens escorts |call girls
> Let's not forget it's a once-a-millenium kind of tsunami that occurred there.

Maybe we should stop calling it that. It's now obvious that there was a miscalculation at site surveying stage, no need to hype it up.

> That's the best thing we have, right now.

The environmental record with just two INES scale 1 accidents is poor. As nuclear proliferates to places with even less safety culture and the number of reactors installed reactors grows, so will the catastrophic outcomes.

If nuclear production grows say fivefold worldwide, it's not unreasonable to expect at least fivefold increase of INES 1 incidents. Which means instead of two catastrophes in a 30 years span we'd have 10 or more.
I turn off autorun and only have it test what's changed.

And it also doesn't run coverage checks, it's only for running the test i'm currently working on.

But yes, the ruby infrastructure is pretty bloated i recon.
"38%" is still a minority, isn't it? Besides, this is counting miners, but what about businesses - almost none are interested.
JWT is fine. Just lock down the library you chose as much as possible (only accept one algorithm for instance).
These are definitely the "uncontroversial" features. None of them really change anything.

I'm not convinced by the new switch statement either, but I'll suspend judgement until I see some examples in the wild. The examples Microsoft are giving don't strike me as a good idea.
"Just use cookies over HTTPS [instead of JWT]" is weird advice. I mean, JWT goes… inside… things like cookies. (or the Authorization header in APIs, of course)
perhaps I haven't felt your pain of rigid static designs because i mostly work in clojure, ymmv
At least within the developed world, secularism is very much on the rise. And that's true even in the US.

http://www.pewforum.org/2015/05/12/americas-changing-religio...

Between 2007 and 2014, the portion of the population that is unaffiliated with any religion soared from 16.1% to 22.8%. The portion of the population identifying as Christian dropped from 78.4% to 70.6%.
Wordpress plugin – simple category post widget
If you want to incorporate physical security, you need the devices to be physically linked to be paired. I suppose you could use a custom made USB device to simply transfer the keys from the devices to the hub.
MATERIAL RÉSUMÉ
For node: https://github.com/kimmobrunfeldt/chokidar-cli
I still remember getting my first paycheck after graduating and buying a Breitling 15 years ago because I liked the logo. And got a cheaper Rolex when I started my first company.

We were watching a TV show where someone gets a Patek as a gift and told my significant other that's a really expensive watch. She had no idea. Then I went onto explain how cool different mechanical watches are because you can hear the different movements tick. She didn't think so.

I wore a fitbit for the last week.
$429 is pretty high, you can get a few separates for less than that. but if it had a lot of b&w productivity apps it could be a better buy than an ipad pro.
>Have you considered that maybe it's "no fun" for them because the societal expectations of what girls and boys should enjoy begin from an early age?

Do you have a link to data supporting this theory? The theory has been around for many years, I'm interested to see the new findings.
You could sell bottled air in the current economic environment. I am not surprised that something like ETH is also going up. What matters is if it has any fundamental value that will sustain it when all the slush capital disappears.
Amazon AWS Route53 issues in Europe
I don't think the spec meant to read that you must allow the client to be able to forge tokens by accepting tokens issued by it without an algo or signature.

If you issue tokens with none, then you will have to accept them when clients send them back. This is obviously a very bad idea, but that's all th spec says. If the issuer chooses to be insecure, that is a valid choice.

If you issue tokens with a specific algo, and clients send them back with a different or none header, you know they have been forged.

The spec allows issuers to decide whether to use none, it doesn't say you must trust none tokens if you know you didn't issue them.