skysight-inc/HackerNews huggingface dataset:
It's not just FastMail. Most other 2FA-enabled sites (including Google) offer and recommend providing a phone number as a delivery method for a onetime code.

The 2nd factor is only as secure as to the weakest delivery method, though, so defining a phone number does make that factor subject to porting and SS7 attacks. Most sites offered text message backup codes before those attacks had been seen in the wild, but they're probably also stuck with a lot of users who didn't write down their recovery codes.

There's no good recovery option with a large userbase. The closest is Delegated Recovery (https://m.facebook.com/notes/protect-the-graph/improving-acc...) but GitHub and Facebook are among the few, if not the only, implementors. Without that, eventually someone will lose or break their phone, realize Authenticator TOTP keys weren't in backups, realize they ignored the instructions to save the backups, and go to support.

As long as you actually do print and securely store the backup codes, I think there's a good argument for not giving your phone number as a backup method.
Definitely a case of the cliched bit about hard for someone to understand something, when their salary depends on not understanding it
Perhaps the insurance only covers the current car value, not all future interest payments and as such there is still quite a bit left even after insurance claims.
And belief is not necessarily orthogonal to knowledge.
You can belief in something and it can still be knowledge.
The interesting thing is that this change really happened in the past 10 or 15 years or so. That is, the phrase "under-represented minority" is relatively new, and basically came about because someone decided Indians and East Asians "don't count" anymore when it comes to diversity because we've got too many of them.

I consider myself liberal, but I feel this business of grading everyone by their race and sex is the exact antithesis of liberal ideals. What happened to MLK's ideas of not being judged by the color of your skin, but by the content of your character? Yes, I understand that things like subconscious bias and privilege can complicate this ideal, but at the end of the day, we shouldn't be surprised that anyone gets angry when they are told "Sorry, we don't want anymore of your race/sex, we've already got too many of your kind."
Against it's reality in tech, but not against it's utility!
Not as yoga teachers though, interestingly, from my anecdotal sampling.
Reminds me of people who complain about the cost of 1-mile of lightrail but don't know the cost of 1-mile of freeway.
The difference is the threat model. ASLR does kind of poorly when the attacker can read and write arbitrary memory, because the attacker can just learn what the addresses of all the objects are by dumping memory, then adjust their attack on-line. If you think that's far-fetched, it isn't, exploits for operating system kernels and web browsers do this.

Authenticated pointers can assume this threat model. The attacker can read and write arbitrary memory, but it doesn't do anything for their ability to hijack the control flow of the application because all values stored in memory that relate to control flow are signed and encrypted. The attacker can't create a new code-pointer value and write it in to memory without knowledge of the secret keys, which are not in memory. The attacker could cause the program to crash or exit early, but oh well.
But you wrote "Rust has no backward compatibility" who cares what libraries/projects do?
Sometimes a motion is dispositive of the whole case (or nearly so). Failing to dismiss on 12(b)(6) isn't like that at all.
I'm going to start submitting random science links from Wikipedia too.
Neither does it mean that it has no value anymore.

Taking your example "8-bit processors": it still has value. Even if it is only for learning purposes.
Something else interesting is the program byobu, which acts as a wrapper for either tmux OR screen, depending on your preference, and makes session management and configuration easier.
That's less memory than Firefox will leak between the time I end the last word of this sentence and type the punctuating period.
(again, only playing devil's advocate :-) )

> For the comparison to be apt, firearms should play the same role in war that the internet (or lack of it) plays in terrorism.

I used the example of firearms as it's a force multiplier (and yeah, it's not a great analogy I admit). This allows a single person to have a potentially much larger impact by reaching more people, some of which may be susceptible to the message.

The internet allows lots of people with similar opinions/interests to communicate (and find each other) which either would not have not been possible in the past, or very difficult. You see this played out in all sorts of places where there are communities built up online that wouldn't have been possible before, in all sorts of niche interests.

> Well, it has worked wonders for alcohol (the prohibition), drugs, pornography, and everywhere else this concept has been tried.

Did less (in number) people drink during prohibition than before/after? Would less people do drugs if they were legalised? Any reasonable argument would suggest that you obviously can't prevent all 'bad' communication, but you want to try and reduce the ease of availability of propaganda.

Although I admit there is an obvious parallel with the 'gateway drugs' argument that's frequently made :-)

> Which doesn't matter much, since you still need lots of in person checking out the person, plus meetings give them physical equipment they'll need (guns or whatever). Unless they fed-ex those...

For a good number of recent attacks, this isn't necessarily true. Attackers use everyday items (vehicles, knifes etc.) and you don't need to 'check anyone out' because it's not a conversation, it's just a 'go out and kill people' message.
> I always wonder why schools don't even teach the beginnings of finance to everybody. You'd almost think there is a reason why it explicitly is not being taught.

This! It's crazy the advantage you get from knowing some basic personal finance and economics. Whenever someone younger asks for advice about what to learn to get ahead my two answers are personal finance and programming.
https://www.nomorobo.com/ does the rating based on phone number, effectively an RBL
I honestly don't know where do you see an invalid temporal causality here. I can't unsee the organiser's response :)
Ask HN: What's the prerequisite to become an exploit developer?
I want to learn reverse engineering (RE) and exploit development.

There are great resources for both of them (like MBE http://security.cs.rpi.edu/courses/binexp-spring2015/ and RE https://github.com/fdivrp/awesome-reversing).

The only problem is that there is hardly any article which actual lays out a path for a complete beginner.
I want to understand what are the ACTUALLY NECESSARY topics required and in RIGHT ORDER to MINIMIZE the TIME WASTING and wandering in between topics so that the knowledge aqcuired is more practical in context of current vulnerabilities rather than being more theoretical.

Something like programming fundamentals>python>C>Assembly>Computer Organization>Windows Internals>Reversing>Fuzzing etc. (its only an example, please teach me the correct order)

Actually there's an article http://www.myne-us.com/2010/08/from-0x90-to-0x4c454554-journey-into.html but it is quite outdated.

Your opinions along with updated resource links and views on them will be greatly appreciated. Please, only focus only on topics that are actually necessary because RE and Exploit development are vast topics in themselve (for eg: Do I actually need to learn computer architecture or organization? AFAIK those circuits and architecture specific thing is more helpful for a electrical or electronics engineer rathen a RE. We need to learn the intricacies of a particular architecture like x86 or ARM but in my opinion those circuits won't help any RE in his daily reversing schedule, so please foucs on the only required part like one I know: OS fundamentals.
QtPass
Some of the emulators for older computers provide similar functionality.

The VICE Commodore computer emulator can use an external program called TCPSer to provide an emulated Commodore PC with a virtual modem. The command ATDT ip-address:port can be used to connect to telnet-ready or vanilla-TCP BBS's with vintage terminal software.
This is actually last years Essen. The new Essen is coming up in September and there will be even more great boardgames to play!
> the authentication code depends on the target address

The authentication code is a combination of key and context: there are 5 total keys in the system, and then an unlimited number of contexts. Contexts are I think most useable on the "return" edges, because you can add the current stack pointer value to the context when you push the boxed return address onto the stack, then re-derive that context when you're at the return site.

That exact scheme doesn't work that well on the forward edge, because the stack pointers will be different when calling function pointer F in function A vs function B. What you can probably do is encode something about the type of F into the context. However, as they outline in the white paper, this isn't enough on its own because the type signature of gets and system are really similar and if your type-to-context encoding scheme maps them to the same context, an attacker could take a call to gets-via-function-pointer and replace that value with the value of system as it appears elsewhere in your program.
This is a pretty cool scheme, but I'm not sure about the UX argument. The login flow itself is good UX, but it's arguably just the happy path, and now I'm responsible for irreplaceable data on my device. My device might fall into a river, or a customs lockbox. I can mitigate that but then I'm doing manual secrets management work that "eh, I'll just trust my email provider" would have prevented.
To clarify, it's not about you. Poor word choice? My bad.

The sailing through life bit was specific to the context of being untroubled by the need to examine ones relative privelege or lack of, and the structures affecting same.

Not to imply that not having to think a out these things means life is automatically easy. You can still get cancer, get hit by a bus, etc.

----

You say that if people were not so quick to call out perceived racism or sexism things would be better.

I say if people were not so quick to be personally insulted when perceived racism and sexism are called out, things would be better.

Did I misunderstand your point?
The problem is not communication. To quote Paul Graham in a keynote from some years back: People have been waiting for "sufficiently smart compilers" to cut programmers out of the loop for 30 years. It is a neat idea in theory. In practice it is just very hard. You need to design the algorithm for the hardware, so it is sort of an AI problem. Programmers do fill a role usually in coming up with the best algorithms...

The point is simply that C doesn't have the concepts you want to program with. Vectorization only gets you so far, there are many other things you can do with AVX/SSE. It doesn't need to be ASM, it could be supersets of C instead (like CUDA).

Intrinsic functions for AVX is what I use and I don't see the problem with using those. It sort of is such a superset of C.

In practice a few numerical computations (BLAS, FFTs, etc) are reused a lot by many. It is worth it to write those few libraries in assembly (or at least intrinsics).

For the rest we just have to live with a small performance penalty.

I am just saying "if you want to go the extra mile to get high performance, you can beat compilers". In most scenarios of course it makes most sense to not bother.
Do you think these terrorists were just going to stop at killing a few people? "Gee, I think I will kill 10 people then go home." Seriously?

My guess is they would keep on killing as many as they could, just as they tried to enter the stadiums and concerts to do maximum damage, just as they locked in the Bataclan to kill as many as they could, etc, etc. In which of these events did they kill a few people then went home?
metaphors we live by
This is not the way to do things, like literally not the way to do things:

1. They could've reached out to many more different groups if that's what they wanted (and it's not like that's a bad thing anyway).

2. That out of the way, they shouldn't postpone it based on the characteristics of the speakers they got. Now that is a bad thing.

3. They shouldn't have pointed out that it was precisely because of that they postponed it. "Logistics problems" would have worked just as well as an excuse.

Now all this is visible and bad for everyone. I don't care about electron either way, but many people do. Just a cavalcade of errors this thing.
I wish I had read Real World Divorce, much of which can be found on realworlddivorce.com. It's notable for the fact that Philip Greenspun is a major contributor to it, which I found most surprising and intriguing.

I don't want to duplicate a lot of text, so I'll link to my Amazon review of it:

https://www.amazon.com/gp/customer-reviews/R2UKHDY7L4NPSV/re...

TL;DR it's the only bit of literature I've found that's got the real talk, and in data-and-comparison driven ways hackers will appreciate.

Yeah, obviously I'm going through a divorce, but I really think this book should be required reading for anyone before they get married in the US. I don't say that lightly or confer that kind of veneration unto books at the drop of a hat.
> It is as if experienced programmers are forever stuck with their past experiences and won't ever look back.

This is totally the case. IME, anything that makes them step back from how they would normally solve the problem and rethink other approaches is of benefit. It is good if you can frame that as an appeal to their ego, 'cos people get defensive quickly. Sometimes they just feel out of their depth with the new and instinctively push back.
uBeam really must be the longest running joke in the history of SV. I don't wear a hat, but I'm going to buy one so I can eat it if it turns out they're not a scam after all.
Being Muslim is not a necessary pre-condition. A lot of Europeans and north-American joining ISIS are not of Muslim background.

Do we have proofs that any of the violent ones had not converted at the time when they attacked?
This appears to be about an entirely different technology. The original article appears to be about the use of rim-driven electrical ducted propellers.
You mean besides posting your referral link to HN and waiting for suckers?

Given that the house takes a cut, here's a more-profitable approach:

Step 1: print out some BTC as cold storage paper tokens

Step 2: light them on fire

Step 3: aww, looks like you lost this time

Step 4: repeat
I agree with you, and I also like playing these games, even though they are "a little stupid".

But I think some abstractions can be better than others.

The abstractions of Catan, for example, make sense, since they somehow capture the essence of the things: a terrain simply produces a good, goods can be traded, houses can be built from goods. Of course it is not perfect, but doesn't bug my mind.

Puerto Rico, on the other hand, has so many types of buildings and actions, all referring to real-world things, that it is impossible to make decent abstrations.

I guess I'm just advocating less detailed real-world themes, if you can't make simple abstractions that make sense.
Running Your Flask Application Over HTTPS
Although Jacobsen v. Katzer (2008) seems to give teeth even without dual licensing. Katzer argued that the open-source conditions are "non-economic", and therefore not enforcable as a copyright infringement case, but the Court of Appeals, Federal Circuit wrote

> Traditionally, copyright owners sold their copyrighted material in exchange for money. The lack of money changing hands in open source licensing should not be presumed to mean that there is no economic consideration, however. There are substantial benefits, including economic benefits, to the creation and distribution of copyrighted works under public licenses that range far beyond traditional license royalties. For example, program creators may generate market share for their programs by providing certain components free of charge. Similarly, a programmer or company may increase its national or international reputation by incubating open source projects. Improvement to a product can come rapidly and free of charge from an expert not even known to the copyright holder. The Eleventh Circuit has recognized the economic motives inherent in public licenses, even where profit is not immediate. [---] The clear language of the Artistic License creates conditions to protect the economic rights at issue in the granting of a public license. These conditions govern the rights to modify and distribute the computer programs and files included in the downloadable software package. The attribution and modification transparency requirements directly serve to drive traffic to the open source incubation page and to inform downstream users of the project, which is a significant economic goal of the copyright holder that the law will enforce. Through this controlled spread of information, the copyright holder gains creative collaborators to the open source project; by requiring that changes made by downstream users be visible to the copyright holder and others, the copyright holder learns about the uses for his software and gains others' knowledge that can be used to advance future software releases.

The parties later settled, so we don't know what damages could have been awarded, but this affirms the basic principle of the GPL.
>Since most politicians start out as lawyers

Do they? I guess you’re talking from a US point of view maybe.
Which GPU database is right for me?
> You're making an assumption here that the blind selection process will change or that added/substitute papers will not chosen by the same criteria

Clearly they won't be because now diversity is part of the additional criteria. I don't have to wait for the follow-up as they've already given the information.

Hindsight is 20/20, but we've had enough of these to actually analyze what the problem is. The organizers took the out the will require the least time and money but looks good on a brochure as opposed to furthers a goal. Having grown up and worked on a reservation, I am well aware of the nice photo op versus the effective program.
patio11 has posted a few times about that on HN. Here is one: http://www.kalzumeus.com/2014/11/07/doing-business-in-japan/
Bit late isn't it Essen 2017 insn't that far away
Or you can use raspberry pi and tcpser

http://www.insentricity.com/a.cl/215/putting-your-retro-comp...
To simplify a little, in a democracy, if 51% of voters are "backwards" in some way ... that group will be making the decisions for 100% of residents.

This is the big problem with a "pure" direct democracy: you automatically get tyranny of the majority.

Most of our real world democracies suffer worse problems than this, though. The leadership elected to make the decisions may not even enjoy a majority of popular support. Even having had popular support at an election, there may be no mechanism to compel a government to actually act as it promised to win those votes, other than voting for someone else several years later. The nature of the electoral system may lead to very short-term, populist thinking, particularly towards the end of each electoral cycle.

My own view is that in light of these kinds of weaknesses, many of our political systems in the West are simply not fit for purpose, and that once-pragmatic reasons for accepting those limitations mostly expired with the rise of modern transportation and communication infrastructure. Sadly, I have not yet been made supreme ruler of the universe, so I have limited ability to do anything about this unless a lot of other people start to agree...
But the interest is lower the more stable the leveraged assets. I get a lower interest if I mortgage my house compared to if I borrow with stocks as leverage, which in turn is lower than a car loan which in turn has lower interest than a loan with no leverage, even if I have a solid income and a stable employment.

Banks are actually very much in the speculation game, which is why different people get different interest rates for the same loan, they speculate that the person with the lower interest has a better chance of paying back the loan. See also the financial crisis of '08
Boardgaming has vastly increased my social circle and my life quality in a part of the world that is renown for the number of social shut-ins.

I run a gaming club out of my apartment; I have gone from knowing very few people to having a constant stream of new people coming into my family's life. I couldn't ask for more; especially when compared to the alternative (only knowing people at work, having a narrow circle of friends, etc..) I am also glad my kids get to see their parents with friends.

However, on the other hand... I don't find the new stream of games to be all that compelling. I don't get who will be picking up all of these new games.

Every bg is a whole new set of rules to explain, and often, to people who are relatively unfamiliar with many other games. In most cases, I tell them "Let's play a few rounds and restart the game when you get used to it" because explaining everything is a futile gesture. Then you only get to play again 2 weeks later (in a best case scenario) and someone brings one of his games and the process begins again... and again.

To get away from this, I have a very small subset of games I run in rotation at my place (7 Wonders, Power Grid, Pandemic the Cure, Race/Roll for the Galaxy, Catan). The group sometimes gets together separately for more complex games (Food Chain Magnate, Eclipse). There really is no place for another 12 games an year, even 12 good games, unless they are of the "dead simple" social / party game variety.

I respect the creators very much, but I think diminishing returns are going to be kicking in if they haven't done so already.
Here’s a Painful Problem for Aspiring Entrepreneurs
Ok. Just say that right away then.
Make sure to educate yourself on Byteball and IOTA. You'll see that they're very different from each other.
Because when I choose a GPL license, I do it because I want anyone that uses that code to share their changes back with me.

If all I get out of a long court case is finally seeing their code, then it's not worth it for me to sue, and it's not worth it for them to comply with the license.

Instead: if I dual license it: when they don't comply with the GPL license, I can sue them for damages: which makes things a hell of a lot more appealing for a lawyer to take my case, and not as much as a waste of my time.
My bad, I actually confused the U2F acronym with 2FA. You are correct, of course.
Or create an email account. It's impossible to sign up to any web email service to be able to send email not just receive if you don't have a phone.

I needed an untraceable email to send from for reasons I won't go into but couldn't create one.

If you're poor but need a webmail account you need a phone. You can't even put in a fake number since you need to reply to the approval link setup email. Gmail, Outlook, Yahoo, everyone one I tried all require a phone.
> Call your cell phone provider and put a “do not port under any circumstances” hold on your phone number.

Jokes on them, my number is ported to google voice, and they don't have customer service...
A grow box and weed seeds.
Additionally, if you're in the market to buy a $850,000 car as an investment then you probably have better assets to use as leverage (Property, stocks, etc) which are less prone to suddenly becoming worthless, as a car would be in the event of a major accident.