skysight-inc/HackerNews huggingface dataset:
To extend on that, I can give list the lessons I learned from actually running a similar scheme internally in production for a while now:

1. Give developers the minimum amount of knobs. If they need to choose between 'auth', 'enc', 'seal' and 'sign' it's still going to be confusing. In my case they can personally come to me and ask "Which version should I use? Which type should I use?", but it's not clear.

I'm still undecided whether supporting an unencrypted authenticated token is useful, but 'enc' should ideally be the default, with users going a little bit more out of their way to do anything else.

2. Asymmetrically signed payloads with an expiry are this strange bird that looks like a duck, quacks like a duck but unfortunately _are not a duck_. They're certainly useful, but when I was calling them 'tokens', my users were confused whether they should use them as access tokens.

It's great to have a simple and robust encoding format for packaging payloads with an Ed25519 signature, but it's better to clearly call it something other than 'token', or you'll end up with users deciding they should use asymmetric access tokens just because it makes the key more secure.

3. You want to have some mechanism to specify key ID or key version in the wrapper, because this allows you to do automatic key rotation gracefully. You can use the optional (AEAD) payload for that, but that wouldn't be entirely clear to the users how.

Let's say you want to rotate the key every week, but your longest token has a TTL of 24 hours: you will need to have a window where you would support two different encryption keys. In other rotation scenarios (e.g. rotating every 24 hours with longest token TTL being 30 days) you can have many more encryption keys supported concurrently.
You can iterate and try all possible keys of course, but having key ID/version is much cleaner.
Demonstrating that the system is broken is not an effective strategy. It is impossible to get someone to understand a fact when their salary depends on not understanding it.
Exactly this. People sit comfortably in their morals while enjoy the huge benefits brought about by Uber. Things are comfortable because people like Travis were willing to take the blame on the wrong side of history and forge ahead anyways.

We all sit comfortably in the Bay Area because our ancestors murdered and stole lands from Native Americans. They also build an entire ecosystem that gained wealth from exploiting laborers and immigrants. History is messy, but they did these things so their children can sit around in comfortable homes enjoying these highly philosophical debates without any physical danger
To add to this "punching nazis" insanity:

If you start ignoring the rule of law and advocating violence then the "other side" is going to feel morally justified to escalate.

And guess what? The "other side" thinks abortion is murdering babies.

I don't think that is a path we want society to go down.
Looks like a Japanese fidget-spinner-like thing: https://www.youtube.com/watch?v=3hIHLEuUg8k
I was just looking for apps similar to RescueTime this morning for this very reason. Yours looks excellent.
Well said. Regardless of what side you're on, the journey is a reward in itself. The process of learning while creating is immensely satisfying, even if nobody sees the end result.
With Meltdown and Spectre, and CERT's statement that only replacement of CPU will solve those, it's hard to think about buying any computer for the next little while.
Just because Lyft entered some cities before Uber did does not mean they eventually paved the path for legalization. Most of the battles that occurred once local governments realized the magnitude of ridesharing were led by Uber.
I too was in a fraternity and literally nothing you describe resembles anything like anyone I've ever known in one has done, or would be bored or frankly, creepy enough to do.
What about Svelte / Sapper? Too small to register?
I have an older one of these, and you can get full root on them. They are basically stock IIRC, if they aren't they can at least run stock openwrt. By default they have a simplified second web interface, with an "advanced" button that loads the openwrt luci web interface.
It doesn’t have to last forever, it just has to last longer than the competitor.
Meltdown could have been avoided by following what is in CPU design text books about speculative execution.

Spectre is clever. Meltdown, as known today, is (mainly) an Intel major fuck-up.
With these fixes and the performance losses, does that stack?

IE if you have a Server on amazon running a newer kernel with the patches but then that underlying hardware is also running the newer kernel?
That's really interesting! How does calling WASM code on the JVM work?

And also in addition to a stdlib, maybe a great package management system. Is there a popular crate / maven / npm etc equivalent out there for wasm yet?
I love the display on my 9360. I use vim, and it allows me to comfortably have three windows open side by side, so I can view code from multiple files side by side easily. The high DPI allows me to use pretty small fonts without annoyance too.

That said, this is of course a very small computer, and I purchased it knowing I had an external monitor to use with it as well (same aspect ratio, for what it's worth). 13" is adequate but not ideal for me; I feel like this size machine is best paired with an external monitor back at your main desk, with the internal display used less frequently. If I did not have another monitor, I likely would have stepped up to the XPS 15 instead.
I wrote https://betterself.io (open-sourced) to figure this out for myself. After analyzing a year's worth of supplements and habits -- meditation at the start of my day had the highest correlation of productivity beating out any supplement I bought (I tried about 70+ supplements last year).
A good list, however quite voluminous. If I went through that much material in one year I would never have got any work done.
> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.

Clearly I didn't mean that the copyrighted work is only associated with a single number. The "two" in the "two are indistinguishable" was in response the the comment above:

> It's not the number that's copyrighted. It's the content that number represents that's copyrighted.
Install Netflix Plugin Plex – How to Disable SB Titles in Plex Player
You can access Netflix on Plex which is a media library application which is for your desktop or for your mobile device. This allows its users to listen and to watch videos and this is specially design for Mac computer.
I’m guessing that money was pulled out of mutual funds and put into ETFs.
>You can't prove the effect of "temporary arrays, choice of language, and parallelism" and "pointer indirection, cache efficiency, and SIMD vectorization" don't matter unless you compare one thing that does those things to another thing that doesn't.

I think he said the exact opposite. He's basically saying algorithmic time complexity matters (and therefore identifying your problem class matters, since you might get a more efficient algorithm out of it) since you can only get so far with the generic algorithm, however good your implementation is.
You probably 'agree' to an arbitration agreement when you make a youtube account.
“We lose money on every sale but we make it up in volume.”
That's no longer the case. I post a bunch of game playthrough vids and there are a lot of options to contest claims like that now.

I had a recent one where the sound effect from a game released in the 1990s was claimed as being part of a song released in 2015.
That's all perfectly fair criticism about a specific type of OSS advocate. But the discussion here is not actually about "it's more secure because it's open" and really about "it has a higher likely-hood of being secure because all of the code is fully audit-able"

Again, heartbleed is a terrible example because many many people have complained for a long time about the cruft building around OpenSSL. Do you think i don't read the code of an open source python module before I roll it into a project? Would I ever consider including a python module in my code that came to me as a binary blob (not that this possible ... yet)? Not on your life.

The reality is it's shitty that I have to trust corporations with closed source firmware and I wish it were otherwise.
The effect of passive heating on heat shock protein 70 and interleukin-6
> waving a smartphone in the face of regulators

At least for government, that wasn't a smartphone he was waving. It was a stack of something with drawings of U.S. Presidents on it, sort of greenish.

> waving a smartphone in the face ... the public was the next best thing to a Jedi mind trick.

In that case, the smartphones were the ones in the public's hands: Uber ran an effective media campaign, including paid-for editorials in major newspapers (and I'm guessing elsewhere) about how great it is to be an Uber driver, and, AFAICT, astroturfing in online forums and social media. Uber was a darling of the business world, a paragon of SV and American innovation. Not so long ago, you couldn't say anything negative about Uber on HN without being voted down to oblivion, and the talking points were repeated in every discussion.
Yes. Perhaps even moreso. With Uber, at least in the beginning and still a little now, there was a contingent of both professional drivers and customers willing to use a sustainable service.

Uber made total sense in big cities when minimums were $15, the average ride was $40+, and all cars were staffed by professional drivers looking for extra income and hours between clients. It was win-win, complied with the law and really didn’t even have that big of an impact on the taxi industry because it wasn’t a race to the bottom.

None of these services make any sense with $7 rides and random people with a drivers license trying to make a living off of driving all day long.
Benefits of GraphQL on the Backend
Looking at how they behave the only thing I would expect from them is to not give free shovels when people are trying to dig. They will keep turtling until there's a new product they can push and rush everybody to ditch the "insecure predecessors".
This isn't intrinsically true.

If they raise the prices, does the market go away?

If they are able to outlast and go to self-driving cars, how profitable is that business when factoring in competition, possible regulation, or it even becoming a public utility?
>What does my algorithm know about my problem?

I’ve phrased the same idea as “what regularity of the problem space is my algorithm exploiting?” A good first question to demistify any purported fast algorithm.
Steve Jobs was, on balance, likely a horrible person and needlessly cruel. I’m still very happy he did what he did. These people are human, and are not without sin. Entrepreneur worship is weird, I agree, however I wouldn’t dismiss the additive things otherwise miserable people did for society.
There are still a lot of simple attacks yet to be discovered. In SW and in HW designs.
Can you elaborate? Uber especially engaged in massive expenses on self driving cars, market share grabs, etc. But take those out and what remains seems to be a solid ride hailing business that should be able to generate stable profit.

It needs to be less expensive than a taxi to generate a lot of demand, but this seems to be a pretty low bar.
The XPS 13 would've been my top choice if Dell were interested in taking my money, but they're only willing to sell me one with 16GB of RAM if it also has a pro-glare display. I bought an XPS 15, which came with major backlight bleed. After field circus scheduled an appointment to replace the display the next day and didn't show, I returned it.

I paid $500 less for my X1C5, bought during the Black Friday sale. It doesn't have a dGPU (that I didn't want anyhow); but does have a WQHD display, WWAN, and a 1 TB Samsung SSD instead of a 512 GB Toshiba. No issues with Linux or OpenBSD, and the keyboard is better than both the current XPS 15/Precision 5520 and my 2013 rMBP 13". (Let's not even think about how hard the current MBPs suck.)
Vangaurd has a good guide on this http://www.american-vanguard.com/Governance

The standard rule is 3 trading days after news is disclosed.
There is also a WASM to Java source transpiler: https://github.com/wrmsr/wava
How does cycling AWS instances quickly provide additional security beyond obscurity?
A friend of mine "bought the dip" and profited about $100 in the first 20 seconds and it only got better as the day progressed.
I'm curious about the timing of publishing this on the day that AG Sessions announces a return to previous DoJ practices in prosecuting violations of Federal marijuana law, specifically mentioning money laundering and money transmitting statutes. It can't be coincidence, can it? Am I missing something or does this paint a nice big bulls-eye for the feds on Safe Harbor Private Banking?
Out of curiosity, is there a Linux distribution that can be used full time on a MacBook?
I've heard people justify war crimes this craven way, saying the survival of their nation was at stake, and those people usually and rightfully go to jail. I've never heard fraudulent business practices that someone cashed in on justified this way.
Would you care a adding some context or tl;dr to that? You linked to a really long text which - to my eyes - does not reach a conclusion.
My hope is that every lawsuit jeff files is dogpiled by every state AG that has legalized it.
> It’s trivial to run some cat 6 through the walls

Not if you're renting
There's no evidence that the unethical behavior was necessary or even helped.

> powerfully entrenched politicians (DeBlasio of NYC as an example)

DeBlasio is entrenched because he was elected by a majority of his constituents. The people get to write the rules, called laws. Who voted for Kalanick? What gave him the right?
Yep. I expect this will happen quickly. Some people are going to wake up at the end of a gun and find out they are the lowest hanging fruit.
The argument is symmetric; once you've tuned the algorithm the only way to get >10x speedups is by working with those low-level things.

Both the broad-strokes algorithm and the fine details are responsible for huge performance differences.
Oh right. I believe this is commonly referred to as organised crime.
Yes. Spectre2 can be and is being patched with a microcode update that partially disables branch prediction.
Yes.

Americans are the most divided right now. Polling these questions began in the 1990s.

IIRC General Mad Dog Mattis (not sure) when asked what's the biggest threat said it's the internal divisions and not terrorists, Russia, etc.
Something like adding "Implicit caching occurs when a memory element is made potentially cacheable, although the element may never have been accessed in the normal von Neumann sequence. Implicit caching occurs on the P6 and more recent processor families due to aggressive prefetching, branch prediction, and TLB miss handling." to the developer's manual.
I use vim because of battery life. If I kill Outlook and Slack and have only vim open in iTerm, I get almost twice as long away from my office.
How to Hack Your New Years Resolution
I'm surprised that only the touchscreen editions are UHD.
I'd have guessed developers would prefer UHD, but no touch. Am I really missing something? Do people really prefer touch (or, FHD)?.
I don't think anyone considers touch screens to be a "useless luxury"; the problem is that touch screens are also pro-glare, and that's actively harmful. I like 4k, and touch with a matte display would be unobjectionable, but any display that's not anti-glare is a big cup of nope.
> He deserves every cent of his billions of dollars.

He deserves the money he made by making a company that was competitive by knowingly skirting laws? That seems like a bad precedent to set.
I get that we've lost this battle, and some people seem to think there's a useful distinction being made, but man, does the word 'transpile' grate on me.
Affected and probably doing what everybody is doing for mitigation.
There's a firefighting documentary on Netflix and it's shocking how manual and inefficient the firefighting process seems.

A dozen guys load up in a helicopter and drop in next to a brush fire with rakes and shovels and start digging a trench. That's the grand plan, digging a barrier by hand with hand tools.

Or, pay thousands to fly and operate firefighting planes that sometimes miss the target and other times the fire is so huge their payload doesn't make a dent.

And the price tag for the California fire season runs in the billions. Seems like an area ripe for disruption.
Not the poster, but I don't think it "justifies" and of the bad stuff that happened.

But I think it is important to recognize both the bad and the good stuff that happened.
Many businesses have 'disrupted' industries, and almost all without behaving like Uber and Kalanick. Airbnb is a simple example.

Your description left out buying off politicians and breaking the law.

> taxi cartels

The picture of taxi owners as powerful doesn't at all match what I know. It's a shibboleth promoted by Uber.
Implications of Building a Lifestyle Business
(blog author here) It's unclear but I doubt it is practical given the preconditions required in the Spectre paper. see https://spectreattack.com/spectre.pdf, section 5 for the details of Spectre2 (aka branch target injection). Successful exploitation depends on the ability to predict the location of a useful gadget in target process memory and impact is limited to processes running on the same physical core. It also requires a branch mis-prediction training period which seems to be significantly easier to execute if you're running as an application and share a library with your target. Not saying it is impossible, but the bar to success seems way, way higher than with Spectre1.
I was wondering the same thing earlier. This doesn't feel like a disclosure that's had anywhere near ~6 months put into it.

Did the vendors ignore the disclosure initially and begin to change tactics later in the game? Based on how certain vendors have been characterizing this in their PR, I wouldn't be surprised if they didn't take the problem seriously originally.
Capitalism blood-lust.
I think that hackintosh for Apple is like pirated Windows XP for Microsoft: it brings more profit than losses by tying people to ecosystem.
Just like everyone else, I would also recommend an Archer C7 of whatever revision is the latest stable tested unit. As someone mentioned, the FCC recently clamped down of this, pushing mfgs to include protections against allowing the consumer to easily replace the original firmware. TP-LINK has been locking things down a bit more as off the past few years. Love my C7 w OpenWRT, great choice for a sub $100 device with tons of flexibility.
The SE400 isn't bad but the hoop size is a bit limiting. Beware that Brother intentionally slows down its cheaper machines but they are still quite usable. They also intentionally limit the clearance under the arm of their cheaper machines which can be frustrating with conventional sewing.

I would recommend picking up an "obsolete" home embroidery machine. Models that were top of the line 10+ years ago can be had for a steal and most have seen little use. That will require sacrificing USB connectivity but you can get a more capable machine in the end.
He said he didn't like it, not that he refused it in ever case. I don't like it but I accept there are certain limitations I must deal with. Its about trade-offs and where you draw the line.
Speculating memory reference reads across security boundaries is not a trade-off (except if you can prove that you will not further act on them in any data dependant way that is observable). That's mostly common sense.

Spectre does not need that -- but OTOH is more difficult to exploit; it is in a whole different category. There is a reason they have different names.
Jobs is a great point, for the other argument. Jobs didn't break the law, but he disrupted multiple industries from computers to phones to music to retail.
> I do not look fondly at what a pain local transport was in cities without public transport (and even those with), and it is Travis (yes, Travis first, Uber second) that led this paradigm shift.

How about we improve public transport? I know it’s unpopular to propose “socialist” ideas, but public transport works elsewhere in the world, why does it have to be so horrible here? Why does someone have to profit for something that you agree is a “pain?”
Yet another reason not to host on YouTube. Here are some more reasons not to host with YouTube:

- some YouTube videos use nonfree Javascript to implement DRM. https://notabug.org/GPast/avideo/ is a youtube-dl variant that avoids running that JS code. notabug.org seems to be down as I type this, perhaps it will return later.
- should you wish to allow your video to be downloaded, YouTube sets up needless barriers to allow downloads.
- hosting with YouTube means you and your users are being tracked by Google (which owns YouTube).
- YouTube doesn't make it clear how to download the precise video file the submitter uploaded; users get rewritten videos instead.
- YouTube only hosts videos, not arbitrary kinds of other media.

All of these problems are easily solved: use the Internet Archive (at https://archive.org/) and your own hosting instead of YouTube. IA offers a download URL which is static and will redirect to your uploaded data. You can use this URL in an HTML5 video or audio element to embed the data in a webpage (again, no JS needed). IA will (by default) rewrite certain kinds of files, but your original uploaded file is also available and machine-determinable (via an XML file that clearly indicates which is the source file and which are derivative files). IA can be used fully without JS turned on (no need to worry about executing code to get files). IA hosting is gratis (zero cost), as is YouTube.

I have no evidence which indicates IA tracks users akin to how Google does.

I encourage you to consider hosting your media with the Internet Archive and your own website instead of YouTube.
Oh of course, Auralnauts replace so many of Williams' works with Holst in their various videos that you hardly even know it. Similarly look at the opening of the 4th movement of Dvorak's 9th (https://www.youtube.com/watch?v=p9OBf8f55tU) for Jaws' inspiration.

Or listen to any of Ralph Vaughan Williams' 9 symphonies and you'll hear John Williams' orchestration and voicing directly.
Out of curiosity (and not looking for an argument about it): Doens't two-finger scrolling feel just as natural/comfortable?
Does the Galago Pro have a TPM? Their website doesn't mention one, but not having a TPM is just silly.
GhostWriter is a gorgeous distraction-free Markdown editor for Windows and Linux
Not really true. Lots of terrible companies manage to continue to exist just fine.

Maybe in the very long term it will eventually catch up with them. But then who cares?
From a myriad of anecdotal evidence from my immediate and extended family, I'm personally convinced that there are significant downsides to America's addiction to sugar.

Discussion, debate, close examination of results/methods, and the like are helpful. But calling out an entire research topic as "non-sense" holds back scientific progress, even if the research topic appears fruitless. Many of today's accepted truths were yesterday's non-sense.
They don't have to use it, but they'll save 30% on the cost of a transaction by using XRP. Why wouldn't they?

> it seems banks are only interested in the Ripple tech

No bank has ever said that. Some have said that they're not using XRP yet, but that's because they're simply beginning trial runs of the technology.
> Could this “check later” speculative approach similar to Intel’s explain Apple’s great performance advantage over other ARM CPUs?

No. Speculative execution is not unique to Apple's SoC designs; it's present in other ARM cores as well.

https://developer.arm.com/support/security-update