skysight-inc/HackerNews huggingface dataset:
I agree that browser-based password managers and password managers on Android are insecure. These platforms have huge attack surfaces.

I'm using ForgotIt? [1] because I'm its author. It doesn't have a browser interface and doesn't have a mobile version. I would make a version for iOS if I used an iPhone, but I have never planned to make an Android version, because Android devices are just too insecure. (They are theoretically secure but in practice most of them don't get enough security updates.)

That being said, ForgotIt? also has some weaknesses that are laid out in its documentation. It doesn't lock memory, so you should use encrypted swap or disable it, and its keystretching algorithm compromises a higher security margin for speed.

Depending on your threat scenario you can also keep some of your passwords written on paper in your wallet. You could also keep them in a physically secured place like a wall safe. If you're worried about targeted attacks, that's in fact the best choice for most people, since no current operating system, no PC, no tablet, and certainly no phone is currently safe from a targeted attack by a dedicated adversary.

[1] http://peppermind.com
I've had success using C vector extensions in GCC and Clang [0]. With a simple typedef, you get a portable SIMD vector type and basic arithmetic operators working. It's compatible with platform-specific intrinsics (SSE, NEON, etc), check out this small example with some basic arithmetic and a few uses of intrinsics with it and what kind of compiler output it produces [1] (warning: I'm pretty sure the rcp/rsqrt/sqrt functions are wrong, this was just an experiment).

Here's the gist of it:

typedef float vec4f __attribute__((vector_size(4 * sizeof(float))));
vec4f a = { 1.0, 2.0, 3.0, 4.0 }, b = { 5.0, 6.0, 7.0, 8.0 };
vec4f c = (2.0 * a) + (a + b * b); // with -ffast-math, this will emit a fused multiply-and-add (FMA)

Note: if you look inside the intrinsics headers (xmmintrin.h, arm_neon.h, etc) supplied by GCC, you'll find that it uses these internally. E.g. _mm_add_ps(a, b) is defined as a+b.

I work with basic 3d math and physics, so I don't need that much and just having 4-wide vectors is good enough for me.

I've also found out that you can use vector widths that are not available in the target machine. E.g. 4 x double vectors work fine even without 256 bit registers, the compiler will split the vector and use two 128 bit registers and emit two instructions. This might also work for using 16 x float vectors for 4x4 matrices.

Some C++ overloading magic would be useful for naming things (e.g. no need for dot4f vs dot4d).

I've been trying to get some time to write an article about the ins and outs of using vector extensions, but haven't got there yet. Some effort would also be required to put together a decent library of basic arithmetic (dot, cross, quaternion product, matrix product & inverse, etc) as well as basic libm functions (sin, cos, log, exp). I haven't had the time to put together a comprehensive (and well tested) collection of these nor have I found any open source library that would do.

[0] https://gcc.gnu.org/onlinedocs/gcc/Vector-Extensions.html
[1] https://godbolt.org/g/N9VvXZ
Which encryption do you use?
Dissecting Crackme0x01
Why not KeePassXC? https://keepassxc.org/docs#faq-keepassx
There must be something else wrong with this user's setup, otherwise there would be more comments about that. From what I've read the Adrenalin driver update was received positive by most users.
When using a gl API, doesn’t code declare a version number that they could use to selectively patch known bugs, if that’s the case?
But back then you had to go out to a specific shop and talk with the person in the shop, about your desires (or at least face him when paying).

Now you can have your _exact_ fantasy, at no social embarrassment, in the privacy of your home.
Leafy greens have a high percentage of their calories in carbohydrates, but they are not high in carbohydrates (they are recommended because they have a high ratio of valuable vitamins, etc., to calories, and recommended for weight loss because they have very low calorie density. They are typically recommended even on specifically low-carb diets.)
Well, yes.

They/we want backwards compatibly and that does indeed include workarounds for shitty game engines.
Ask HN: What's the best way to set up a SaaS as a non-US solo founder?
Hi. I want to use Stripe for payments, but they don't offer services in my country. Paying $500 for Stripe sounds like a good option, but I want to make sure I know what I'm getting into before I do that.

I'm a solo founder (non-US national). The product will be a consumer-based SaaS purely on the internet. There is a treaty between the US and my country to prevent double-taxation. I don't intend to ask for VC investment any time in the near future as I want to own 100% of the company (with YC being the only exception; I'll be applying this summer).

I know that I should probably talk to a real lawyer, but I'm hoping I could get some idea on what other people in my situation do before I go into that meeting.
The comparison "x != y" is illegal for slices.
No, most DirectX 9 games still work (otherwise the driver would have NEVER passed QA). They probably removed a workaround for a buggy way some game developers were using the API.
Great People and Culture at 34th Chaos Communications Congress
Have you actually looked at other laptops?

True, most doesn't come with nvme ssd, but you can always upgrade (which you cannot on a macbook), processors and graphics are way better for half the price, and you usually get a matte screen in which you can actually see anything besides reflections.
An idea for a side project I had for some time: Use Raspberry Pi Zero connected to the PC as a password manager . Explanation: RPi Zero supports OTG and can emulate USB keyboard (in other words, it can "type" your passwords for you).

Never got too deep into this idea, but it shouldn't be extremely hard to implement. Need to create some mechanism to allow the web browser to ask the RPi for a password for a certain site, and use GPIO to connect a LED Matrix display (16x2) plus some input method to allow the user to physically confirm the password request (possibly PIN entry or a simple yes/no button for simplified usage)
Yes, but ... surely questions should have been asked at the point where they raised $45 million? It's a lock. Has there been any ordinary door lock in history that cost even a fraction of that to develop? I don't think this can just be blown off by saying "hardware is hard". People have been making locks for millenia. It is objectively not hard. Hotels and offices routinely have cryptographic unlock keycard systems that are managed remotely and they do not cost $700. There just seems to be a disconnect from the rest of the world in this business plan.
I was shocked by the casual mention of genetic engineering:

"using crispr, the genome-editing technology, they began flying along the rails of the Asian elephant’s double helix, switching in mammoth traits. They are trying to add cold-resistant hemoglobin and a full-body layer of insulating fat. They want to shrink the elephant’s flapping, expressive ears so they don’t freeze in the Arctic wind, and they want to coat the whole animal in luxurious fur. By October 2014, Church and his team had succeeded in editing 15 of the Asian elephant’s genes."

Sure, this project is toying with making an elephant more cold resistant. But if the technology spreads, how long until we get sharpened pathogens and pests ?
Ease of use. Uwsgi is faster, but it's not the place in my stack where i need speed. The cost of transforming nginx packets in wsgi object is very small compared to all the rest.
Nobody pays $600 for a phone. They pay $600 for a portable computer with a touch screen and multiple types of radio attached.
Unfortunately techniques like browser fingerprinting[0] still work in private browsing and can be used to link your private browsing to your normal browsing.

[0]: https://en.wikipedia.org/wiki/Device_fingerprint
Add metrics and advertising obsessed companies into the mix and the only result could be a complete clusterfuck.

The major issue with web apps is that the customer (or depending on the company bag of meat that watches the ads) has no control over the app or the data. They will be abused by the company in all sorts of creative ways.

And yes, those VMs could be local-only, but why would Google, MS or Mozilla want that? The former two are heavy in the cloud+ads business, the latter was pushing FirefoxOS.
Why would web developers want that? All the stuff they write is online-first.
That’s funny. Someone should ask why they are even working on “old” tech like DX9 then - it was released back in 2002!
Bitcoin is an asset (or a currency). Not a user experience. I think you should distinguish between the UX of a Bitcoin wallet app (which is analogous to Alipay and WeChat Pay) and the "asset" Bitcoin (which is more analogous to CNY or a stock you hold).

Bitcoin can be made user friendly with a user friendly Bitcoin wallet app. Coinbase could streamline KYC by partnering with banks / regulators, request Uber rides in-app, or enable QR based merchant payments (basically make it's app exactly similar to Alipay/WeChat Pay).

None of that has anything to do with the success / failure of Bitcoin. Bitcoin is failing because it is not a good store of value for consumers at the moment. It's too volatile and too hard to acquire. It's more of an investment class asset than a stable store of value I can purchase and not worry about.

The Alipay vs. Bitcoin comparison doesn't make sense — you're comparing apples and oranges.
Hindus for Trump. Hahahhaa
the append way is much efficient than the make+copy way: https://github.com/go101/go-benchmarks/tree/master/append-vs...
Have a fallback. Authors death +10 years or at most 30 years (numbers pulled out of my posterior. I am not suggesting anything)
> Anecdotal I know, but I find the GOG lineup more curated and less filler than Steam.

There's a reason for that: It's harder to get your game on GOG, they are still deciding on a case-by-case basis. While on Steam every game which pays a fee (~$100) gets accepted IIRC.
> TCS, Asia’s largest software maker,

I'm wondering if that's a fact or just part of the news article.
Of course it doesn't stop all drug use and abuse. I simply enjoy some like folks would enjoy alcohol. But surely you can understand that having a shitty life makes drugs look more appealing.

For example, if you can't get proper time off work to heal an injury - which really is an indicator of a shitty life - you go to pain meds to get through. Or maybe your doctor said you couldn't keep working your current job, but you don't qualify for disability or any assistance to find or train for a different one. So you take pain meds in between. Keep doing this and you might find an addiction. Sure, it is better to go to a therapist to get over trauma, but that's more expensive than weed or vodka in the short term - plus either drug is more immediate.
even if taking your hypotheticals seriously:

1) which drug supply? what exactly constitutes a “drug”? (IMO this has been actually the worst part of the “drug war” - the linguistic confusion the very term itself causes within the general public)

2) comes back to #1. Some drug tests check for metabolic byproducts, etc. As the number of substances falling in the “drug” category go up, so will false positives. It simply doesn’t scale

3) ok sure. But see 2 and 1, and you’ve already almost accomplished this goal with 4.

4) again if technically possible, only for a small subset of possible “drugs”

So you’re right, no one has tried this because it’s nonsense, just like the “war on drugs” has always been.

tldr; it has always been about money and power and excuses for control. The Opiod crisis has started slapping us across the face with this fact daily.
Addendum: I know in most modern CPUs the memory controller is on-die, so my comment is partially wrong (RowHammer is definitely a SoC issue).

Also, if you're interested in this type of things: Armv8.4-A adds a flag … indicating that you want the execution time of instructions to be independent of the data.

https://twitter.com/agl__/status/927929410321244160

Now the primary source seems to have been edited(why?)… But webarchive still has it:

Data Independent Timing

CPU implementations of the Arm Architecture do not have to make guarantees about the length of time instructions take to execute. In particular, the same instructions can take different lengths of time, dependent upon the values that need to be operated on. For example, performing the arithmetic operation ‘1 x 1’ may be quicker than ‘2546483 x 245303’, even though they are both the same instruction (multiply).

This sensitivity to the data being processed can cause issues when developing cryptographic algorithms. Here, you want the routine to execute in the same amount of time no matter what you are processing – so that you don’t inadvertently leak information to an attacker. To help with this, Armv8.4-A adds a flag to the processor state, indicating that you want the execution time of instructions to be independent of the data operated on. This flag does not apply to every instruction (for example loads and stores may still take different amounts of time to execute, depending on the memory being accessed), but it will make development of secure cryptographic routines simpler.

https://web.archive.org/web/20171107164628/https://community...

The scope seems limited to ALU, so not really related to the TLB thing we have here. Also, it's still very far away, I'm not sure its predecessor Armv8.3-A is even shipping to customers yet.
How can someone write an ode to the 747 while simultaneously decrying "vile, predatory capitalism"?

I suggest anyone wanting to read something non-hypocrytical about the 747 instead try https://mobile.nytimes.com/2017/10/10/travel/747-airplane-je..., for some informed commentary that isn't half diatribe.

/end ironic rant
> not even something like JVM has done

Not counting applets and Web Start?
Let's be fair here: It's an easy pivot where they keep paying the DOTA artists already on the payroll with a minimum staff of software and game design devs in order to milk the plump microtransaction teat.

Yes, it's a game. But barring the DOTA IP and existing graphics assets it will not be particularly different from any given other offering in this specific market space.

And that's the unspoken thing in the post you're replying to: "new". Valve hasn't made any truly new game since Left 4 Dead, and i'm sure it could easily be argued that even that wasn't particularly ground-breaking.
For extra fun there was talk today on twitter about several people that have to file Japanese tax returns but have originally english names. There are many ways to convert the name to english, and different systems actaully enforce you to convert it in a different way with various limitations.

This results in them having the system believe they are two people, one of who hasn't filed returns and no easy way to fix it (apparently the easiest fix is to possibly create a company?).

This despite there being some kind of unique ID submitted in both systems, but that ID is not currently reconciled.

Not sure 100% on the details myself but I guess the moral of that story is, duplicate checks on the name itself may not even be a guarantee of uniqueness - even assuming there was only 1 person with that name!

More information in the Twitter threads:
https://twitter.com/patio11/status/947821990810869762
https://twitter.com/marcan42/status/947862901725024257
On the one hand this is true, but as someone who does prefer keeping unit tests relatively small in order to be able to pinpoint issues easier and not have tests break as often without it being clear why, I think the article does strike a nice balance of only recommending it where it really makes sense, rather than simply stimulating you to write as high-level tests as possible.
Million Arab Coders Initiative
Finally, wasm short-circuited the will of os manufacturers to make their platform exclusive and incompatible with others.

Now let's see if wasm performs well enough on Android phones, and I guess we are finally arriving into the software deployment heaven.
Most culture is created by prior works. It's the fan art and spin offs that keeps culture alive.
Chinas first space lab is falling to earth, will probably miss you
I know you're not advocating them.

I'm saying your hypothetical policies couldn't possibly be enacted because it would be suicide.

I've been to the Philippine's and talked to Duterte supporters. It is perhaps more fair to describe the situation as extremely anti-meth rather than generally extremely anti-drug. The reason this position is popular to begin with is because of a broken court system. People are choosing quick-and dirty summary justice over the perceived no justice of the court system. The "death squads" are tolerated because there are a lot of legitimate targets for this brand of illegitimate justice. Its a case of hate the principle, love the result.

In general the Filipino people are not irrationally rabid about private, responsible, recreational drug use.
ex-employee here. throwaway for obvious reasons.

This isn't a three month old startup. People literally were sleeping under their desks. Wretched company. Multiple people burned out and one suicide attempt. Hired some of the best and brightest from all around the the globe. Used them. Burned them. Banned people from working in the UAE ever again. Zero transparency between investors and management. Zero transparency between management and product. Zero transparency between product and engineering. Missed three launch deadlines successively with Alabbar committing to hard dates for launch in the press. Alabbar looked like an idiot one too many times in the press and fired everyone including the CEO. Threw away all intellectual property. Purchased competitor JadoPado with zero due diligence. Intent was to repaint JadoPado with noon paint. Founder of JadoPado joined as CTO, left seven days later. Threw away JadoPado code base and created everything from scratch. Minimal lovable product was ready to launch nine months ago but didn't sign up enough suppliers or SKUs to actually launch.

https://www.reddit.com/user/halfpastnoon

https://www.reddit.com/r/dubai/comments/6813vw/nooncom_is_no...

https://www.reddit.com/r/dubai/comments/6c23nb/noon_closing_...

https://www.reddit.com/r/dubai/comments/6elfio/nooncom_reshi...

https://www.reddit.com/r/dubai/comments/69vjgt/can_confirm_j...

https://www.reddit.com/r/dubai/comments/6fsmkb/exnoon_ama/

https://omarkassim.com/whats-hiding-behind-noons-beta/

https://blog.esanjo.com/the-jadopado-experiment-is-at-an-end...

https://www.arabianbusiness.com/alabbar-s-noon-com-set-launc...
While I like the message generally speaking, I can sympathize with developers who just don’t have the time or the will to contribute code.

If you don’t mind I’d like to propose an alternative but imo equally valid option for those people, which is contributing financially.
> a sandbox strong enough to run completely untrusted code

No browser has provided that either.
In fact, browsers are by definition a security anti-feature because they are always connected to the network and the customer/user data lives on the network.

Even if they manage to solve the problem of computers getting hacked when visiting websites they are very unlikely to solve the problems of tracking and private data vacuuming.
That is one better lecture.

Also, people injecting opioids often have had horrible experiences during childhood. Handling that, offering free psychological/medical support to the people would be a great thing.
Ah yes. The fall and rise of JavaScript.

https://www.destroyallsoftware.com/talks/the-birth-and-death...
https://archive.is/PO1WZ/image
And it only uses 400MB of RAM.

Neat though.
I wonder if we had similar success with curing Alzheimer (or cancer for that matter) in humans if experimenting on humans were possible.
It comes up frequently in such discussions, in my experience. Usually when someone cannot any longer argue that the current war on drugs is anything but a failure, but still feels that drugs need to be driven from society by force. Usually the poster has some pretty abhorrent views about the value of human life and 'druggies'. (Note I am not saying that's the case here, it appears at least on the surface to be a devil's advocate type of argument.)

Usually it's a simple call to either poison or execute "them". To which the answer is usually "what the hell gives you the right? These are people we're talking about".

The other trope in this direction is someone will suggest drug use centres where people can access all the drugs they want, but they get locked in forever, and can thus take all the drugs they want until they die, hopefully soon. People proposing such things appear to be entirely devoid of either empathy or understanding of drugs and addiction.
Fietsenwinkel
I think this is a fairly standard practice. This is exactly how shared links on Dropbox, Box, Mega, Imgur, etc. work. You can think of the URL as one long, and extremely hard to guess password.

Completely agree that Google Photos (and the other data hosting services) could provide warnings to those new to this method of sharing — I wouldn't expect my grandma to simply know this.
After the Flames, Allegations of Rent Gouging
> One thing to avoid in publicly exposed numbers is sequential order. It allows people to probe for resources (/videos/1.mpeg, /videos/2.mpeg etc) and also leaks cardinality information. Add a Feistel cipher on top of a sequence. This hides the ordering while maintaining uniqueness.

> The PostgreSQL pseudo encrypt wiki gives an example cipher function:
> [...]

I get that they want to leave the key value in the schema, but practically this kind of thing feels worth pulling out into the storage engine. Just generate a random string as the ID upon row insertion and force uniqueness on that column. If insertion fails, generate another random string. (And it should pretty much never fail because otherwise you're still suspect to the enumeration attack you're trying to prevent.)

Although given that Postgres can read from a file, could the above be done in the schema by reading from /dev/urandom? If so that seems like the better approach.
U hoeft geen andere winkels af te reizen voor een fiets. Wij zijn in Nederland het enige adres waar u terecht kunt voor alle merken en modellen fietsen. Waarbij wij ook gratis leveren en laagste prijsgarantie aanbieden.
No the "opposite extreme" would be advocating for what I believe, which is the abolishment of copyright in its entirety

A compromise would be to meet someone in the middle, say like on the original term of Copyright, 14 years plus a single 14 Year extension to the Original Creator if they are alive
I've been using UC Browser on my Nexus One for about a year.
It has two killer features:

- It can be installed (unlike Chrome, which never ran on Gingerbread, and Firefox, which I tried before but can now no longer reinstall).

- It renders most pages correctly, unlike the AOSP browser.

It unfortunately does not solve the other major problem with the Gingerbread ASOP browser: that I cannot connect to many modern SSL sites, so I keep Opera Mini around for those. (Opera Mini is otherwise terrible.)
It's because antidepressant are a miracle drug. Sedentary work weeks and normative society will always drain your energy and kill your soul.

I have the opinion that most people should use antidepressants.
JVM had to be installed, and it was far from seamless the way OP describes it.

The advantage of wasm is that all the people running Chrome today already have it.
I’ve not seen it mentioned before but the anti-climate change platform feels just like the tobacco, margarine, and sugar misinformation campaigns of yesteryear. Would not be surprised is students of those were involved somehow.
Yeah, they'd have to be some new rookie company to make a mistake like that. In fact, it was EDS :0)