skysight-inc/HackerNews huggingface dataset:
> You cannot use an untrusted computer to reliably log out.

You could conceivably have a login sessions page and access it from a trusted computer to force logout of a session from an untrusted computer.

But it seems the bigger problem with login from a malicious computer is that the computer could do whatever it wants with your session while you're logged in, regardless of how securely you can logout later.
The SaaS founder’s guide to customer intros
tax assessment would raise money but it would cost money. by costing money some businesses may leave. for example, amgen just put a new plant in RI instead of california.
That's a misconception - I don't see where this helps with phishing.
A heuristic where you transform a truthful answer might be better.

i.e. your first car was a Bronco, security answer = hash('bronco'+secret).slice(6)
Fruit company pulls the plug on anyone who writes anything bad about them. No more marketing money, no more freebies, so publishers think twice about it.
Agreed. As pointless as railing against language change is, it bothers me a bit that 'crypto' has come to be synonymous with a very small (yet very loud) area of the application of Cryptography. But this too shall pass.
when enough people start to say crypto to mean cryptocurrency, the meaning will change.
You're aware the ISPs don't generally do any of the research and development of telecommunication equipment? They just put their stamp on modem they rent you. The "ISP innovation" line has always been pure propaganda.
The current situation with docking station is that they are ~10 blocks apart from each other.

There should be a parking spot for bicycles on every single block. Just like we have 40 spots to park cars on every block.
I think he meant this:
https://trezor.io/

And more specifically:
https://trezor.io/passwords/
> not upgrading the software

For goodness sake no! Blocking software updates is a terrible thing to do, because most people don't want to install them anyways. You're basically putting people in an already bad situation in a worse situation.

> Nagging him at least lets him use the phone and keeps him informed.

It only takes the user using the sketchy Touch ID sensor once for their fingerprint to be sent out to malicious actors.

> If the user is stupid, let him be so.

That's what you think, but that's not how Apple works. It's their job to make the default work well for those who may not be completely knowledgable about security.
Working for FB itself during this controversy won't tarnish your resume anyway.
Particularly since the perceptions of the telecom industry are not exactly positive as a whole.

It's worth raising a question -- do the executives at AT&T/Comcast/Mediacom/Verizon really think that the public is on their side?
Paper? You write on paper? My DR plan is in a file and backed up locally, and ... um ... oh oh.
Which type of cryptography investments do you think readers will confuse this with?
Leaking corporate data or trade secrets to the general public is not the solution for a couple of reasons.

- Depending on the actual contents of the leak, people might panic; this is basically never useful.

- Depending on the outlet, the contents may get distorted before being published in order to fit some narrative -- potentially causing a panic. See above.

- You or the original leaker may be traced back using even editorialized data, or without the corporation seeing the data. This would land you and/or the original leaker in a lot of legal hot water.

- A side-effect of that is that you'd become unemployable in many cases, and you might find yourself running from the law in other cases.

So, yeah -- quitting facebook probably isn't a bad idea as a user. Refusing work as a contractor or an employee may be difficult, but because absolute morality doesn't exist, it's really up to the person in that position to make the call about quitting.
It doesn’t have to be about coastal vs inland. It’s more about growth vs stagnation.

Be careful about romanticizing the idea of rural life if you haven’t already done it. It’s nothing special in my experience.
It doesn't actually. If the authenticator expects passwords, then this simply moves the problems you cite to another part of the system. These are the sources of compromises on the modern web. It's a neat system - but it doesn't solve the key issue.
Probably because people think that their current level is 'unnaturally low' and if only they 'did this one secret thing' it would get some kind of immediate boost. I've observed that tech people especially, are naturally interested in learning new things, but find it harder to go into a heads-down productive mode where they completely dedicate their time to one thing. A lot of programmers seem to use deadlines or other external pressures to get themselves into a productive mode. It would be good (for them) if they could be in charge of their own productivity.
Here Are the Questions Mark Zuckerberg Still Needs to Answer
Why doesn't any other phone manufacturer have this problem?
If we keep going down this slippery slope, next thing you know there'll be stores called Phonezone or Advanced Phone Parts on every street corner selling repair parts for every popular brand of phone at reasonable prices enabling consumers to do their own repairs at home.
PCSX2 Q1 2018 progress report
Facebook hacker
Hi I am Abdul zabe
Coin trackers are all commodities.

In fact, the best tracker is the one where the price of the coins I am holding increases.

Please optimize for that one single metric, coin tracker creators :)
Fully agree with this. I got rid of any major debt almost a decade ago and it's the only way I keep myself afloat. No car loans, not furniture or electronics that I can't pay cash for, and I keep a credit card only for functional aspects (online purchases, credit rating etc)
I do realize the difference here; it's just that the parent brought up security, so I assumed that they were bringing up the case from two years ago.
Well... " It turned out that from those 8-9 developers we hired, at the end of the project only 3 of them were actually committing code."

I guess that's what went wrong :( . I wonder why they do this, because they can?
That’s not true. I was able to form a LLC, and incorporate a INC without even being an US resident at the time.
Expect stellar earnings from banks in Q1; Capital return could be disappointing
Perfect Timing, I was just purging my followings list. my 2 pennies: 1) The "Next Account Please" button is not necessary, just show the next account. 2) You could sort followers by last_tweet_date
http://www.youtube.com/watch?v=W6NpoUk62CM
Prototypal inheritance plays a huge role in understanding the language because JavaScript uses it for everything.

It might be a good idea to learn about this before using ES6 classes; remember that ES6 classes are syntactic sugar on top of prototypal inheritance anyway. They wouldn't learn legacy patterns, but the actual pattern that JavaScript uses.
How to improve productivity in doing things that you don't care about? For various reasons lot of people don't have the liberty to work on things they love or care about or delegate the work they don't care about.
Does the open source NGINX distro support gRPC out of the box, or with plugins? I stopped using NGINX in favour of nghttpx (and Caddy for http1.x) when I started using gRPC.

I think before gRPC became popular, the story from NGINX was that it didn't make sense to support supporting h2 in the backend [0], I'm glad they eventually changed the decision.

[0] ttps://trac.nginx.org/nginx/ticket/923
If cryptography was exciting to the non-IT crowd it would still hold the belt, but...
The physics seem slightly off... :)

It seems to be pretty easy to go off the top of the screen.
Prevent Lazy GitHub Practices in 10 Minutes Using AWS Lambdas
You see what you want to see. FWIW I think there have been more positive comments than negative.
Isn’t incorporation fee and franchise higher with an Inc than with a LLC?
No other phone manufacturer is that tightly HW/SW integrated.
"I think I am at least somewhat more productive than average.." oh come on, no need for false modesty here, I think we can all acknowledge that average is a pretty low bar, especially for someone in his position lol.
I think that there was still a lot of things that could have been done in real-time graphics even at the time of Myst 5's release that weren't done simply due to the business economics that the Uru engine (Plasma) didn't support them, in large part due to the compromises Plasma made to support real-time multiplayer physics.

> (also, as a bit of a Cyan nerd, I do sort of want to be pedantic and point out that GameTap was actually the third place Uru Live was hosted

I mentioned that obliquely in that it had a long history. I played every version. If we want to play pedantry, that "test-ish" server you are thinking on was Ubi's official server which was meant to be the original MMO publisher before Ubi got cold feet and shut down all of their MMOs.

You are correct that Myst 5 came out before GameTap's server, and I misremembered that, but the exact order of operations isn't entirely critical to my point that Myst 5 was a "keep the lights on" release of content originally meant to be slowly released to Uru. Ubi's cold feet scuttled five years or so of planning. GameTap's scuttled two or three years. Between the two "publishers", Cyan Worlds got several hugely raw deals.
A few years ago I was trying to build such a system.
When Microsoft broke third-party stuff, the end result didn't cause fires. It was also done very deliberately to damage competitors, according to information revealed at trial.

Software companies can do things a bit differently from hardware companies.
To expand on the other user, most of the negative gdpr commentary I've seen here has been that it either doesn't do enough, is confusing or vague, or will further entrench the big guys. None of those are particularly "we shouldn't regulate the big guys", but more of a "I have specific issues with this regulation".

I expect that there would be some similar sentiment if we were discussing a specific piece of isp regulating legislation.
Not intended as criticism, but isn't it easier to just express your query in Python using filter?
Typically using a secret question also requires you to have access to the email account you signed up with, so it's almost 2FA at that point.
Would it be so hard to unbox homogenous arrays for BEAM? I know at least V8 does it for arrays of doubles.
I agree that productivity is key, then you don't have to "overwork"!

I can accomplish something in about 3-4 hours in an 8 hour work day, of what used to take me the whole day when working 12+ hours. That, to me, is productivity.
Is this a trick question? I would build another one AND charge $600 each. Developers build for clients with money, like landlords.
How AR Is Reinventing the Brand-Consumer Relationship
Contrary to popular opinion I actually enjoy living in Seattle so I’m not interested in moving anywhere. The only Canadian cities that appeal to me are cities like Seattle so a move wouldn’t make much sense.

If I left Seattle (and the US) it would be for something completely different like Taipei.

I’m also a bit too patriotic to move out of the US while I can still build a life here.
Doh, good point. Not quite giving up on the dietary utility though. Fluorescence only needs enough energy to re-emit, and the emission could be activated by other actions. Is it immediate or delayed?

The activation of fluorescence by UV may not be the only means of activation. Lingulodinium polyedrum, for example, bioluminesces normally under pressure changes, but also under acidity changes (brilliant but lethal: https://en.wikipedia.org/wiki/Lingulodinium_polyedrum).

Turns out puffins eat fish. Is it possible the puffin's beak glows underwater as it swims, attracting fish? Either due to salinity or pressure change?

Here's a nice paper on the penetration of UV in saltwater: https://aslopubs.onlinelibrary.wiley.com/doi/pdf/10.4319/lo....
Right, if a service provider is willing to register new public keys/certs (or any kind of credential) on your account as a result of identity fraud, that is indeed a different problem. But not nearly as big as phishing and password reuse.

So, I don't see how the presence of that problem suggests it's not worthwhile to work on better types of credentials.
>Indian engineers in India are like animals in a zoo. Indian engineers outside India are like animals in a forest. They thrive and shine because they are free. It's all in the environment.

These kind of generalizations are useless. There are "zoo animals" and "forest animals" all over the world regardless of location.
You know, this would be far less of an issue if Apple offered some way of downgrading iOS...
Electricity production is the biggest chunk of greenhouse emissions, accounting for 29% while transportation accounts for 21% [0]. Within transportation, emissions from airplanes only account for 9%. Extrapolating, airplanes are then calculated to be responsible for about 1.89%. On the other hand, emissions from vehicles and trucks emit 17.4%.

Applying Pareto's rule, we're better off focusing our efforts on decreasing emissions on electricity production and vehicles.

[0] https://www.epa.gov/ghgemissions/sources-greenhouse-gas-emis...
I get what you are trying to convey. I disagree but there is no problem in that.

However: where does Apple state that their products may stop working if repaired with different components? (Honest question, I have tried to find it).
So now, FB employees all of a sudden have 'ethical concerns' over their job and what they were building. Let's be real - Facebook (the product) has always had the goal of collecting as much data from users as possible, and displaying as many relevant ads to users as possible from data that users provide. The product, throughout all these years have been tailored and designed to do just that.

Facebook isn't a billion dollar business like it is today because they take steps in protecting your data and ensuring transparency and not selling out to advertisers. Transferring to Instagram or Whatsapp isn't going to absolve you of ethical issues if the leadership is the same. It'll be a matter of time before FB finds a way to monetize all the messages you send via Whatsapp
There are companies like cigarette makers who's entire business is generally considered unethical, and others like big banks that could be ethical but often aren't. I would expect this to make a big difference in the type of workers they attract.

Could Facebook exist without selling as much personal data to advertisers as possible? It doesn't look like it currently, but it is at least hypothetical possible.
> WhatsApp and Instagram seem to be much more respected than Facebook proper right now

Yes, that's my point. These people, in my head, are trying to minimize the damage done to their reputation, but without actually realizing that moving around inside Facebook doesn't really help. I seriously doubt that how Facebook, the product, is run is significantly different than how Instagram or WhatsApp is run. Anyone who just jumps around isn't trying to really address the root issue.
Additional question. Is it possible to develop JavaScript without setting up Node?
I'd honestly just rather get hacked on 99.9999% of sites.

I absolutely hate getting told to go get my phone or go to my email.

This also makes me a lot more paranoid about losing my phone.
Well, security was just a small part of my comment, anyway: you replied as if it were the main issue.
Best Practices and Considerations in Egress Filtering
I was looking for one as well, but it seems we did not write a blog post. I will do some digging when I find the time, as I know we at least messaged some people that voiced their frustration directly.
FWIW, this is really just clickbait as Snap released its first annual report (10-K) that day, which most certainly had the effect on share price.
The lightning port is a double edged sword. On the one hand, the wires are "smart" and can adapt to any protocol, so the same port can theoretically function as a USB or ethernet at the wire level (again, theoretically). But to make that happen, every plug has a chip that negotiates the protocol when plugged in.

It's likely that negotiation failed in some cases.

That's absolutely crazy for most of us who think "this is a wire, why the hell would it fail?" but this kind of crazy complexity in a 5mm plug is possible nowadays.
Scottish colonization of the Americas
Phishing is more problematic on mobile
Agreed; but could we start with new media? This is a real nightmare for the industry.
Or you know they could build according to standards for interfaces and cables and provide excellent documentation making it easy to repair.
Support for gRPC was introduced in NGINX Open Source 1.13.10

(I assume this means it's supported out of the box, but have never tried it myself)
Performance traps of ref locals and ref returns in C#
What's the culmination of all this?

Oh, that we've know for fifty years. It's the acceleration of the Spectacle:

"In societies where modern conditions of production prevail, all of life presents itself as an immense accumulation of spectacles. Everything that was directly lived has moved away into a representation."
Ah ok! I'm a bit sceptical of how well that would work in practice, though:

1. the uploader would have to quickly send data to the server, which requires fast encoding in a different format (so lower-quality than AV1, and introducing artefacts from a different lossy encoding)

2. this low quality then gets recompressed with a different codec with different artefacts, and possibly worse compression due to the artefacts introduced by the first codec

When uploading to video sites that are not live, the idea is usually to use as high-quality an input as possible first, in which case this won't be much of a problem.

But I might be mistaken on how bad this affects live-streaming! Perhaps the first codec throws out information in a way that smooths out the video, which then makes re-encoding with AV1 faster and have better compression with minimal extra loss of details.
What do people think of the admission by Sam that he uses cannabis to help sleep, and thus uses cannabis in general? I have no problem with it, but it's interesting to see high profile people in business become more open and on the record about their usage.
Hey Matt,

No worries, I always try to assume that people are well intentioned with their questions until there's undeniable evidence otherwise!

I didn't have any specific ROI in mind, I just wanted to get the thoughts out of my head and onto "paper", and hopefully help out anyone who finds they have the same challenges. Also, if I'm re-inventing the wheel or missing other obvious ways of doing things, that would be interesting too.

Sorry it's not any deeper than that! :)

Alice.
DHT isn't magic.. every peer builds a cache of other DHT peers over time, but for a new client it'll have no such cache, so falling back to trackers is still important. (IIRC older DHT clients also fell back to a hardcoded "bootstrap.bittorrent.org" or somesuch DNS name)

You might observe when trimming the tracker list off the URL that sometimes you can't find a peer, that's because you've never used the same client to contact what effectively amounts to a subnetwork that has no overlap with any previous subnetwork you leeched from in the past.

Especially if you're always fetching the same content (e.g. Game of Thrones episodes) it'll probably just work, but you may find it breaks when you suddenly decide to grab e.g. an old copy of OS/2 or similar, representing a set of BitTorrent users with entirely different interests.
Why do people get so pedantic over a title? Even if it is confusing at first - so what? I never understood the need to correct such minor details...
A neuroscientist explains why reality may be a hallucination
Much better to use gnu/Linux on chromeOS. That way you get updates for drivers, security, etc.

Basically a commercial gnu/linux.
Facebook is a huge organization and although to the outside world it's perceived as one, internally it's basically hundreds of separated teams and companies. So to your point, yes probably some are aware of all what's going on around the company, but there's probably an equal amount that are not. I work for a Fortune 50 company and I get much of the information about the company from the news, despite having a relatively senior level role.
I used them for an extranet system I built around 10 years ago. Certificates are a total PITA, and users hate them - they need to be provided with step by step instructions on how to install them, and they still manage to struggle with it. Plus the procedure differs between browsers. And they generally have private key export disabled, so you can only use them on the machine you first installed it to.

Oh, and some companies have things so locked down that users can't install client certs at all!

Things have barely changed here, so I avoid certs for users - having said all that, they work great for authentication between software components where there are no pesky users involved.
Doesn't really matter if the authenticator expects a password, because that password _isn't_ what's used to authenticate to the site itself; it's always a public/private key pair.

If the user decides to use 12345 as his password for a Web Authentication authenticator that's obviously less than ideal, but still impossible to phish (the browser validates the domain the user is on), infeasible to brute force without access to the user's device (where the actual key pair is stored), and impossible to compromise in a data breach (the site only has a public key).
The beam needs an apl-y language
Hashing a salted string of "an answer" usually works. Phone operators try to ask you the question, though, and you sit there for five minutes reading off hundreds of characters, and everyone is suddenly having a bad day, which I find hilarious. The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as miserable as they make me.

The obvious corollary though, is that there really are organizations with systems that using publicly available information about, mixed with misinformation to see if you can discern an "accurate-ish" (which is sometimes not correct at all, even if you know what they think the correct answer is), and they don't even give you options about what public information they're going to select, to verify your identity.

It's usually a brief questionnaire about previous addresses, associated last names, states you paid your taxes in, and it deeps the impression that there are simply gaping, flawed security gaps at the core of everyone's financial factoids, because it's also sourced from poorly conceived paper-based bureaucratic files that never had any hope of being accurate from the outset.
You're missing the point. The portuguese state levies energy taxes as part of the public-private partnership deals which subsidize corporations that took a part of the national renewable energy program.

Those taxes are so eggregious that even the IMF demanded that the portuguese government should lower them as they harmed the economic recovery.
Show HN: 2kB React state management library using the new Context API
I very deeply agree with you and have not been able to find this kind of thinking/feeling synthesized into a life-philosophy I can say I subscribe to. I'd love to discuss more with you if you're interested.
Scratch all that. Go for as long as possible without reaching for a framework like React or Vue. You don't learn JS learning those tools, you are just learning the tool.

React et al gives language newbies good shoulders to stand on, but a lot of React's so-called concepts map fairly simply to lesser-known language primitives. (And for the record, writing a simple, one-way databinding library in JS takes all of about 20 lines of code)

Don't be a tool, learn more than the tools :)