skysight-inc/HackerNews huggingface dataset:
That is a great idea! I am 100% in favor of helping the users understand the security tradeoffs between the 2FA methods.

We definitely have it on the roadmap to update 2FA Notifier to include more educational content. Thanks for the feedback!

I am currently writing a series on 2FA on my site All Things Auth [1] that gets into the details explaining how each method works and exploring the security and usability tradeoffs of each. I want to put together a summary and/or infographic highlighting the main takeaways and hopefully like to something like that from 2FA Notifier.

Currently, we use the data from twofactorauth.org [2] as our main data feed. I definitely encourage you to check out their community on GitHub and propose your idea there too!

[1] https://www.allthingsauth.com/tag/2fa/

[2] https://github.com/2factorauth/twofactorauth
afaik it’s how power distribution works in australia? i think there are energy “retailers” and energy “wholesalers”, and you legally aren’t allowed to be both. wholesalers cover plants and wires, and retailers handle billing and connection.

thats not a glowing recommendation of he system though because our electrical network is all kinds of expensive :p (but that could be for other reasons; i’m no expert on it)
> And use several providers if you have multiple domains in case one implodes.

I'd add only on refinement: if possible, use domains with different top-level (national) authorities.

Sadly, this kind of operational wisdom is rapidly being lost by the emphasis on hiring "DevOps" engineers, with most of the emphasis on the "Dev" part, since they're often just coders against cloud APIs, with much less value placed on traditional sysadmin (or what ended up being called operations engineering during and after the dot-com boom) experience.

Now, of course, that makes sense not to hire a full-time 100% sysadmin if what you (think you) need is a 5% (or less) sysadmin. Also, most startups, and probably even larger businesses, are going to be easily lulled into complacency by the uptime records of the larger vendors (or really just AWS), when following the best practices for technical reliability. "Infrastructure as code" is supposed to alleviate the human/administrative risk, and I'm actually convinced that it does to a very large degree (just at a huge cost in markup/profit for Amazon for that infrastructure).
> Partly as a result of regulation it seems all companies are offering ways of giving you your data.

Entirely as a result of legislation or lawsuits, like stuff done by Max Schrems. The companies aren't doing this voluntarily at all.
But why would you want to extract if you can mount the file directly? For simple archives, extracting is fine. But for larger archives (like a compiler -- 1000 files or more), loop-mounting is much better than extracting:

- Does not slow down your backup by adding thousands of files

- No need to wait for initial file extraction

- You can quickly and easily verify integrity of the whole archive

And if you are using fuse, it does not require any special privileges either!
How is parallelism limited by physics?

I thought the point of parallelism is you can throw more chips at a problem and see improved performance. Single chips are limited by physics, but true parallelism scales linearly ad infinitum.

Can anyone with more knowledge than me speak to known limits of parallelism? I’d guess it’s not truly infinitely scalable.
Anyone in the finance industry know why the keyboard would require speakers? Did the terminals use audio to deliver financial information or news reports?
Bummer. Maybe it was bad 20 years ago, but from the perspective of a kid who could get all around the city at age 15, it was fantastic. We did also hitchhike by jumping into the backs of trucks too... those were the days.

You're not still there are you?
I have a Twitter account that retweets a specific # from followers (who submit crowdsourced train updates). Would these count as 1 subscription, or how does the subscription counting work?

On the same account, I have some very basic chatbot thingy where you can ask "where is train 1234?" and get a response. It works by listening to the User Stream, and using regex to check if the "bot" is being asked a question.

> When we announced our plans to retire and replace Site Streams, User Streams, and our REST Direct Message endpoints, we did so as part of our efforts to improve the developer experience and provide a sustainable way to help businesses engage with those looking to connect with them.

Streams were pretty suitable for my use-case, so I don't believe Twitter on this sentence.

Their changes seem like they just want a way to get non-firehose users to pay for accessing data streams, and might alienate some developers. Someone else mentioned the short timeline over which to migrate (for devs that only get access from today).

Dear Twitter, you've had a bad run with alienating developers in the past; please decide what you want to do. If we build our communities around your platform, be more clear about what we have to now pay for.
Formal specification for a UTxO-based cryptocurrency wallet [pdf]
It’s not like there is some kind of internet police that’ll come after you if you don’t follow the RFCs, whether IETF approves them or not. You can decide to follow them all the way, partly or not at all.

Or you can debate them as much as you want, or even publish a new and improved version and perhaps people will decide to follow that instead. Or perhaps they’ll just do whatever they feel like.
This is one of the potential drawbacks of using ccTLDs like .io - individual nations are afforded much more control in the administration and dispute resolution process than gTLDs. Unfortunately some are run more poorly than others, which is why in this case the support agent states:

"Unlike common domain names [gTLDs] like .com or .nets. .IO's are managed by a specific organization, that manages only .IO domain names..."

.IO of course being the ccTLD for the British Indian Ocean Territory, run by these chaps: http://www.icb.co.uk/

At any rate, it's worth bearing in mind that ccTLDs are not administered the same way as a gTLD, and weird issues like this that are a pain to resolve can happen.
On average and handled correctly, a 747 at 40000 feet has about 100 miles of range, discounting winds.
Spokane millennials buying houses
Baseus Car Mount Carregador Sem Fio Qi Para O Iphone X 8
Isn't that how it is in real life in general? If your work colleagues are duds, you're kind of on your own. At least traveling you can fall back on hostel friends, Couchsurfing or Meetup, or going out for a beer and meeting people who might be interested in a foreigner.
I wasn't aware anyone from the marketing department of any company was putting a gun to my head. Power of the purse. Don't like it. Don't buy it.
Whoops! Good catch. Fixed.
Introduction to Loss Functions
> At launch, we will have two of the world’s largest airline alliances and a possible third signed on as HoweyCoins partners. The top three airline alliances accounted for over 60% revenue passenger miles in 2015.

Do note that the wording leaves open (and even implies) that the airline alliances they'd partner with _don't_ account for 60% of revenue passenger miles in 2015.

The PDF is a wonderful document, it also has an entirely incorrect description of how inflation works.
Next Hacker News Meetup in Kansai, Japan
What irks me is that the CRC32 instruction in the x86 architecture uses different polynomial than many of the CRC32 implementations in the wild, which makes the instruction unusable for them...
For those who run Hackintoshes - do you use a custom boot loader or kext to bypass dsmos.kext? Have you reviewed it to make sure it doesn't install backdoors, key loggers, or introduce other undefined or unexpected behavior?
The End of Third-Party Twitter Clients?
So is 5^5 * 4^4 * 3^3 * 2^2 * 1^1 * 0^0
There are security token ICOs which are not utility token ICOs.
From the screenshot, should be "DS Signons".
"Tollefson has some big plans for her Central Spokane property. The 23-year-old gets the keys to her first home Thursday.
...
If you think Megan is unusually young to buy a house - you're half right. Megan is young, but more and more people her age are committing to real estate.

According to the US Census Bureau, 36 percent of every American under the age of 35 owns their own home; a dramatic increase from just last year, when the percentage was 34.7 percent for the same age group."
I make my living as a CFEngine consultant. CFEngine runs every 5 minutes (it's lightweight enough to do that). The evolution was: CFEngine 1 ran once a day; CFEngine 2 ran once an hour; CFEngine 3 runs every 5 minutes. Self-healing infrastructure.
> The key difference with Amazon is that Amazon could choose to be profitable at any time

Wait what? No. They were a loss leader because they kept doubling down on a bad business models until they made headway on the reseller market to push themselves as an online retailer, which brought them out of the red. Only after the massive success of AWS, did they solidify as the most successful retailer because THAT got reinvested.

Notice, Google tries to follow this EXACT model, as it has for decades. It has little profit to show for chasing this fable-strategy because it doesn't work. Grabbing Doubleclick was a minor misstep (there were far superior companies to choose from), but at least they got youtube and were able to keep the boat floating (with a little Ad Tech dust). Riding their search engine product as far as it will go and then building an ad network on top of their search+youtube is where Google has settled.

Amazon has been looking into advertising for the last couple years and will probably be less successful than Google without a big new thing, which is unlikely to come from this mythic "reinvestment". Why does this fairytale story about Bezos keep getting pushed? Successfully keeping a company running is not the same as him being nigh prescient about how to manage the resources.
That would be ideal. Keep up the good work with Guix.
> Exploiting this requires the attacker to first manually place malware (a malicious JavaScript file) on your computer or on a Samba network share that your computer is already connected to.

I'm Alfredo Ortega, part of the team that wrote the original exploit. This is (unfortunately) not true. The exploit on the video was loaded from a Windows share that the victim's computer was not already connected. This is possible using "Anonymous shares" in Windows 10, and older windows versions.

To be clear, you need absolutely no additional software on the victims computers, besides having a vulnerable signal-desktop and be running on windows.
> There are security token ICOs which are not utility token ICOs.

Ah so securities fraud instead of just plan vanilla fraud?
Indeed that's a way to fix it, but I think the OPs complaints are warranted.
What about .gz.tar, in which all the files are gzipped, then tarballed? It seems like it would be a slightly fatter .zip file.
Vote for the one that matches your interests the best. I don't understand why you would do anything else (unless you're trying to make a symbolic statement). The two-party system is not going to go away tomorrow, and it certainly will not go away because you refused to vote.
Some people's ideas of what's important are stupid. Everyone has the right to an opinion but that doesn't mean we should treat every opinion as equal.

If someone was going to vote on the single issue of whether or not we should make it illegal to have more than 17,000,000 butterflies in a room smaller than 100'x100' I would have no problem telling them that their pet issue is stupid and there are other things they should care about more.

I don't see why that principle shouldn't hold for other issues. Obviously net neutrality is something we should be concerned about but a single issue voter says it's the only thing we should be concerned about. That's just not true.

If we elect a government who reinstates net neutrality and proceeds to immediately launch a nuclear missile at Moscow, will the 20 minutes that half of the US population got to enjoy net neutrality matter?
Socialism is inevitable. We just need to first develop technological systems which can assist the proletariat in identifying and eliminating corruption by the elite and/or powerful.

We can already afford to feed and house every person on the planet, probably several times over. Yet many are still hungry and homeless. It is not a lack of capital so much as a resource allocation problem - how do you 'throttle' greed so that you still motivate productive work without allowing those with disproportionate power to game the system in their favor. Technology can help us solve this.
Ask HN: What to do if I’m about to lose my job to mental health issues
I’ve had a history of mental health issues (diagnosed with depression and ADD).

I left my last job in part to symptoms of depression caused by stress.

I assumed that removing the stress would allow me to recover, but a new set of stressors caused me to quickly “regress” back into a deep depression.

While my work has been commended, my attendance and work relations have suffered, and I was put on a performance improvement plan.

I only recently started to seek treatment again, and the performance evaluation period is almost up. I believe it is likely I will lose my job.

What steps do I take from here? My small amount of savings were mostly wiped out between moving to the new job and a few mishaps since then.

I want to take a break and work on my mental health, but I honestly can’t afford it. Even a week or two of joblessness would financially ruin me currently.

I know I waited too long to do something. By the time I had mustered up the courage to do something, it was too late. The constant anxiety from the thought of possibly losing my job and possibly worse is only making things worse.

It feels foolish to almost “dump” my problem here but I feel crippled and don’t know what to do. Does anyone have suggestions?
Single issue vote

Seems resolve why many Christians vote for trump.

Communist pig strategy of give you a pig like NN and a war then desk with it ... you are grateful to them.

Public goods are hard to solve issues. Club, coupon, regulation, ... With actors know how to play the game like communist pigs and select and invent issues per district via big data ...

We have a powerful chi-na with no respect of humanity and a sick America with trump and gaming politicians ...

Who has said that is end of history and we are all liberal democratic ...
The problem here is that it uses twofactorauth.org

I submitted two PRs for sites that have 2FA that they didn’t have.

One they argued about whether it’s a big enough site to include (a commercial vps/server hosting company across ~5 countries) and never approved, the other they complained that the site doesn’t document it well enough so it must not exist (despite me using it).

I gave up when they then got a bad reply from the company in question (saying they only support sms) and changed my PR despite me telling them it’s wrong (because customer service reps never get anything wrong?)
> We need some guidelines for proper 2FA implementation.

I could not agree more. I write a lot about 2FA on my site, All Things Auth [1], and do teardowns of 2FA implementations for sites.

In March, we featured Zapier [2] in a screencast episode and a 5 post series digging deep into their 2FA implementation and related topics. I highlighted some things they are doing well and also made suggestions on how they could improve.

I plan to continue doing teardowns for 2FA implementations from many different types of sites. I plan to create a definitive guide to aggregate 2FA implementation best practices.

[1] https://www.allthingsauth.com/tag/2fa/

[2] https://www.allthingsauth.com/zapier
What's interesting is when there's a big discrepancy between what the numbers say, and what the place feels like. Stats, like impressions, are not all made the same way.

When I was in Switzerland I always thought there was something sluggish about the economy, the pace that things went at, the lunch breaks, but the stats say it's one of the most prosperous places in the world.

With the Scandies I wonder how on earth the happiest country in the world could possibly be Denmark. Maybe they hide their feelings, but I found a lot of other places have people who seem happier.

Getting those discrepancies is vital, btw. You need the impressions to make you curious about the stats, and vice versa.
> it would be great to use something like guix to define all the libsodium+zeromq+czmq+zyre dependancies and be able to spit out an 'ultimate container image'

You define a package for your own project that depends on libsodium/zeromq/etc from GuixSD. Then you export your own package with 'guix pack'. For an example of what a package definition looks like, take a look in /gnu/packages in the GuixSD repository, for instance libsodium [1] or Vim [2].

I did something similar recently to build an Nginx "application bundle" [3]. It uses Nix (previously Guix, but Nix worked better for me in the end) to build a squashfs image. You can then run the binary on that filesystem with systemd-nspawn, or as a regular service by setting RootImage=. Some advantages over the Docker approach are that you can easily customise the build (e.g. changing the ./configure flags for Nginx without having to manually perform all other build steps), and bit by bit reproducibility (if you build the same commit six months from now, on a different machine, you will still get the same image out).

[1]: https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages...
[2]: https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages...
[3]: https://github.com/ruuda/miniserver#readme
Basic concepts of promise theory (10 minute video by Mark Burgess who came up with it): https://www.youtube.com/watch?v=2TPsB5WuZgk

2014 introductory article: https://www.linuxjournal.com/content/promise-theory—what-it

Basic book on the subject: https://www.amazon.com/Thinking-Promises-Designing-Systems-C...

It's not "maths" like arithmentic but it's "maths" like graph theory:

Promise Theory, in the context of information science, is a model of voluntary cooperation between individual, autonomous actors or agents who publish their intentions to one another in the form of promises. It is a form of labelled graph theory, describing discrete networks of agents joined by the unilateral promises they make.

https://en.wikipedia.org/wiki/Promise_theory
Routing protocols are how computers communicate network admin instructions to each other really really fast.

They're still just tools wielded by humans, even at a distance. Even today.
Actually the sequence was CFEngine, Puppet, Chef.

See http://verticalsysadmin.com/blog/relative-origins-of-cfengin...
I like Markus’ examples. This one inspired me to write custom alignment code in my terminal, since fonts could not be depended upon to do sensible things for line-drawing, etc. (and even when sized correctly, you might see miniscule breaks between lines).
Informal Zcash Meetup in the East Bay
Luckily the current creation isn't already one.
Both could be true. Those particular numerical systems would have started in those cultures and would have existed amongst many but other groups would have adopted the ones that made most sense in their field and consequently solidified their usage.

Kinda like any open standard; ultimately it’s a popularity contest.
Michael Booth's "The Almost Nearly Perfect People" is a great book if the Danes' happiness is something you're interested in. A fun look at Scandinavia and their supposed perfect culture.
I misread the title as "announces company building", as if they were going to build a Stripe campus.
Nope.

There's the (albeit not 100% correct) meme that C is portable PDP-11 asm. What is correct in my mind is that PCC has much fewer, much less complicated transformations to go to PDP-11 (or M68k) asm than Babel does to go from ES-next to ES5.

But for some reason Babel is a transpiler because it's all high level and that's magically different. And no one in their right mind would attempt to call the c compiler of the 1980s a transpiler.
Whether this passes now or not is immaterial. Net neutrality is guaranteed to come back in the next administration, which will have as its primary agenda undoing all of Trump's damage. The question the big ISPs need to ask themselves is whether it makes any business sense to try to capitalize on this for a short time, knowing that they'll have to spend money to undo it all later.
So, how does one prepare for the worst? Let’s brainstorm:

0. Register alternative domains in advance with a different registrar.

1. Setup mailing list for all registered users and be prepared to blast them with a new domain.

2. Make mobile apps check both the main and the alternative domains.

3. Make the mobile app notify the user of a new domain name requirement via push notification and the like.

4. Setup the phone system so that it can read the new domain before connecting support.

5. Setup support on a different domain (e.g. zen desk). If zendesk goes down users will know to call us, if the main site goes down they may remember to check zendesk.

6...?
Reddit's redesign increases power usage of user's devices
looks like 8 people total [1].

[1]: https://ghost.org/about/
Washington state university (go cougs!) has an excellent short course for the beginner. I believe the University of Wisconsin has occasional classes as well.

Dave at Dairy Connection is a wonderful guy and a great source for supplies and connections: http://www.dairyconnection.com

Also, see cheesemaking.com
People can easily switch, maybe so, but generally they don't. That is one of the reasons subscription revenue is highly prized. Many businesses are sustained on long forgotten subscriptions landing on credit card bills every month.
This is a third-hand story. Most of it is lifted verbatim from the PCMag article ...

* https://www.pcmag.com/news/361098/ibm-employees-cant-use-rem...

... which is in turn sourced from an article in The Register.

* https://www.theregister.co.uk/2018/05/10/ibm_bans_all_remova...
Youtube, EDX , brilliant.org and Khan academy are all good resources. I'm taking hybrid online Math classes at my local community college; trying to get through all the Math requirements.
I work at IBM and I can get almost all of my development work down without logging into the company network when working remotely - quite similar to Google's approach. This is a relatively new development within the past few months.
Verizon was happy to use Title II provisions to access discounts for pole attachments. Regulations originally intended for classic telephony service now being used to lower costs on TV and Internet service deployments.
I live in an area with a cheap cost of living and even if I only went to one movie a month a MP is still about a buck cheaper.
The difference here is that you are guessing as to what might happen.

We know that some people without access to medical care will die. You're saying it's okay to gamble those people's lives on the chance that future lives might be saved. Obviously a balance between spending on research and health care must be struck so this isn't a black and white issue but you would need to put forth a pretty convincing argument that a lack of net neutrality would prevent us from saving billions for me to buy that.

For the record, I do not support single issue voting at all. There is no issue that outweighs the others.

I also think the idea that someone who was going to vote based on a single issue would choose something as trivial as net neutrality is particularly ridiculous when there are so many other issues where life hangs in the balance.
I'm thinking international presence.

Airbnb has .com, .de, .co.uk, etc.

If they have some disaster with one, they just lose 1 country instead of the planet.

If there's a problem with .de, some users will be intelligent enough to try .com

And if you lose a ccTLD in a major country, you can focus your legal efforts in one legal jurisdiction.
(she)