skysight-inc/HackerNews huggingface dataset:
Show HN: Give and Get more GitHub stars
Yes I can't find the articles now but there are reports of phishers using this technique to get around 2FA over SMS.
Taken literally, the article only highlights a correlation - introduction of the physical keys + absence of phishing. But Google may have introduced other security changes as well. The article doesn't go so far as to say that the switch to physical keys from SMS 2FA actually solved the problem on its own.
Sounds great!
Have you got any related blog posts and/or open-source code? I'd love to have a look :)
Ask HN: What is the normal distribution of scale?
It's common for this to be measured in Requests per Second (RPS) or Queries per Second (QPS).

When most people think of services at scale, they think of Google, or more specifically Search. Which does greater than 40k RPS [1], though that number is difficult to identify since it's made up of many subsystems and internal services.[2]

But then there are also IoT platforms that ingest maybe an order of magnitude more requests.

Those services likely fall outside the 99.7% or three standard deviations of all services that receive traffic.

What would you expect the volume of traffic to be for other standard deviations?
For example how many would fall within 10k RPS? 95%?
And what would you expect the mean to be?

If we extend this to socket-based communication, such as some games, would these numbers change?

[1] http://www.internetlivestats.com/google-search-statistics/

[2] https://www.quora.com/Google-processes-40k-searches-per-second-On-average-a-web-server-can-handle-1000-requests-per-second-Does-that-mean-Google-can-run-using-only-40-web-servers/answer/Andrew-McGregor-12
I think the Caddy mess had a bunch of factors complicating it, and isn't a good comparison. E.g. they promoted themselves as an easy and powerful solution for people that aren't really sysadmin/server types, and then hurt that exact demographic by from one day to the other requiring them to either pay a not-insignificant amount of money or learn how to compile a product they choose because it's really easy themselves. People really don't like bait-and-switch.
For sure, any system level changes should be tested extensively to determine pros and cons. Performance testing should ideally be a part of the QA process. We found THP to be nothing but trouble on our systems across a myriad of applications. Most of our systems have 512GB+ ram so the problems induced by it are exacerbated quite a bit. The real issue in our case is the associated defrag. It exhibits nearly identical intermittent system lag spikes to Java FGC's.
'Twaddle': librarians respond to suggestion Amazon should replace libraries
This is the thing I struggle with: name a scenario where you would have your unique site password compromised but not have at least 1 valid 2FA code compromised at the same time.

The best answer I have for where TOTP can provide value: you can limit a potential attack to a single login.

I wanted to say you could stop someone doing MitM decryption due to timing (you use the 2FA code before they can), but if they're decrypting your session they can most likely just steal your session cookie which gets them what they need anyway.
NeXTSTEP had digital distribution via Electronic AppWrapper in the early 90s.
It's not multi-factor auth.

Most of the smartphone based solutions are two-step auth -- it's just a different kind of secret that you know. If you use 1Password or Authy, your token is your 1Password/Authy credential.

The hardware based token approach is always going to be better, because the secret is part of the device and isn't portable. The Yubikey and challenge/response tokens are great as you need to have it present, you cannot easily get away with hijinks like putting a webcam on your RSA token.
My home in the same area has a whole house fan, and while it doesn't get a lot of use in the summer, it's nice in the spring and the fall. Helps clear the smoke if you burn something in the kitchen as well.
Discount offers using Dynamic Programming?
Make a developer's day. Give a star and you will get one too.

This is all just for fun we don't plan on manipulating rankings and don't accept large popular projects. We are hoping to expose github users to other projects they normally wouldn't see.

https://www.gitstarred.com/anonymous
It is not about being allowed at all. The compiler does not understand the required high level result almost always.

There are some attempts to patch typical general algorithms (e.g. tree searches and implementations) with faster equivalents. They typically fail as devising such structure safely from low level code is a really hard problem.
Because they recognized that there was some value in the centralization, namely that it makes it far easier for users to find content. Putting your own blog out there into the ether is far, far, far more difficult to drive users to it. And then, if you want to have comments, now you have to invest time and effort into moderation and anti-spam, whereas here Medium takes care of most of that.
One Day

I correct that because my English 201 prof made it a point to indicate that the title was deliberate. This day was simply one of the many days that Ivan Denisovich had to find a way to survive, over and over again.
Seems like that’s what any rational actor their size would do. But leaving that aside, I’m not sure why that stance should affect whether they are generally considered trustworthy?
Ask HN: Negative impacts after making the front page of HN?
Hi - was wondering if any of you had negative experiences after making the front page of HN?

Temporary traffic boost is nice, but has anything negative happened after?
Your expenses seem highly optimistic.

As a number of other posters have mentioned, your estimate for tax liability seems pretty low.

You also mention that you included all of your tax mortgage payments as going toward your net worth. Your mortgage payment will include more than just the principle and would want to include that in your estimate for monthly expenses.

If you are not in an expensive city (i.e San Francisco, NYC, etc) 5K could be a very comfortable to live on. In a more expensive city it is still doable but likely won't have as much room for international vacations, luxury cars, etc.

Also, family planning will play a big role in this. Children are expensive, you will need to factor in child care, education etc.
If it's B2C and you're going after affluent tech early adopters the folks that frequent these galleries likely are your target market.
Where can I read more about this? Specifically, which parts of memory are mapped in?
If you are looking to explore programming, there is a great python library for interacting with the LEGO Mindstorm.

Possibly a stepping stone into more programming intensive projects.
> Imagine having to go through US-style customs every time you want to fly to California.

Customs is far less onerous than security. Passport control is a pain, but that's easily solved. Germany and France have no such borders, yet are independent countries.

An independent Catalan that's signed up to schengen, the single market, the customs union, etc. would be fine, it just devolves some power from Madrid to Barcelona.

Likewise there is no technical reason that an independent California couldn't join a schengen style passport agreement, customs union, and free trade area, with the rest of the US. Canada could join such an agreement too. It's all doable.
The address extraction piece would make an awesome API that you could charge for if it's effective. I imagine a lot of aggregators would pay for something like that.
180 seconds is a fairly terrible specific impulse...

Hydrazine monopropellant has something like 220 seconds, and the new safer monopropellants are comparable (less specific impulse but denser for less tank mass).
We're playing with a Raspberry Pi 3 b+ together with the CamJam EduKit 3 – Robotics: https://camjam.me/?page_id=1035

Bought a small bluetooth speaker so our robot can make some noise, possibly with Sonic Pi as the sound engine: http://sonic-pi.net
>> ...thieves can intercept that one-time code by tricking your mobile provider into either swapping your mobile device’s SIM card or “porting” your mobile number to a different device.

> Has this ever actually happened?

Yes. For example: https://krebsonsecurity.com/2018/05/t-mobile-employee-made-u...
Most users don't see this as something that needs to be "fixed". They're fine with it. This is only for those that don't like the stylistic choices made.
Thanks for your response!
This is absolutely wonderful!
Could you provide some further links to example projects (eg, interesting open-source designs and/or source code)?
Ex Pharma Sales Rep speaks the truth Pharma doesn't want to cure you
Age and Gender Prediction with OpenCV
I don't disagree with that. That would have been the right approach.
Total BS. Apple only needs country-level address for tax compliance as local jurisdictions (states, cities, etc.) aren't allowed to impose their own taxes on digital sales anywhere.
> Countries within nation states are not uncommon.

If it has more than one distinct nation within it, it is a multinational state, not a nation-state. Nation-states have been the dominant (but not universal!) norm for so long that people use “nation-state” when they just mean “state”.
There's something to be said for having a product that's stable and bug-free. If the first person to use your product does so in the middle of your first enterprise sale, it's probably not going to go very well.
I would love to know how to improve that experience. I don't think I'm understanding the exact issue though. The buttons should be right next to each other already. Are you suggesting the buttons should replace each other when toggling the answer so the mouse has to move less distance?

Happy to work out this issue individually if you would like and address other questions/feedback you might have. My email is niko@pensieve.space. Thanks!

You are right. The reporting feature is just an Airtable form.
Obviously we need much more than retpoline for the whole class. I nominate something like masking all addresses to force speculation to calculate them before speculating on them.
There are certainly more opportunities in cities to be part of a wider expanse of recreational activities / groups. There are "more things to do." We never repeated weekend family activities in NYC (outside of things in our neighborhood).

I'm still unconvinced that cities tolerate "weirdness" better than small communities. I'm a religious conservative who works in the tech scene. People were "superficial[ly] polite" (for the most part), but it was obvious my "mere existence [made] people uncomfortable and [my] hobbies or views or whatever '[weren't] right.'"

I didn't move away from Brooklyn because of that, but it was a very real thing. I was fortunate enough that when I moved to the city I was already pretty successful in my career. I didn't have to kowtow or apologize for who I was because I didn't really have to care what people thought of me personally. But my kids definitely caught flak for it (even from the parents of their friends -- it was strange seeing a 40 y/o father debate the existence of God with my then 10 y/o daughter who finally, in exasperation said, "Listen, I'm just religious, okay?").

But I completely agree with tech meetings, veganism (though it's growing in popularity even in smaller towns), frisbee, etc. That is a definite trade-off. I used to grab lunch with players from pretty much any and every company. This week I'll grab lunch with a guy from Shipt, and... that pretty much sums up Birmingham.

The trade offs are very real. I happen to be at a point in life where my community consists largely of my wife and kids. Once the kids are gone (or once they bore of me), I'll probably reinsert myself into other social groups. But right now, I don't want to spend Saturdays playing frisbee with other adults. I want to spend it hiking with my kids.

Those things are possible in the city. But as a family we prefer the trade offs of living in the county. I think the secret is that you don't have to have the same preferences that I do. And if you find the city more embracing of your goals, appetites, life style, or whatever then that's great. But every time I sit in my car all by myself in near silence, I breath a long sigh of relief.
taking all of the associations into account and making a polygenic predictor score "does a lousy job predicting the outcome for any specific individual, but it can explain 11 percent of the population-wide variation in years of schooling."

only 11 percent. this tells us that the remainder is more likely to be attributable to environmental factors.

in other words, even with a view of the genes, we would need to encourage education more strenuously if we wanted to improve educational outcomes for society.
OMG have I got stories for you - short answer YES.

Back in the day I recall searching for a job and having little success. I found one job with a company I thought was perfect. I submitted a resume. A month late their HR called me up and told me 'I found your resume searching online and I think you will be perfect for a job at my company'. He described the job I had applied for. I agreed and explained it was the same job I had applied for ... never heard from them again. Why? They get paid to find YOU. The HR department does not look o brilliant if you find them. I know this is a very negative opinion of HR, bit it seems common.

For some reason HR departments are mystified by IT requirements / resumes. So they pay services to filter your resume. But they trust the headhunter who bought them lunch / dinner to know what they are talking about. Also if you do not work out they can blame the headhunter.

You have nothing to lose by using a headhunter, unless they try to charge you.

Once again, especially since I just reread your story, it is an obvious YES.
It's not at all obvious to me, because 1Password passwords are stored in the exact same places that 1Password-managed TOTP codes are. You might as well just concatenate the TOTP secret to your password.
Scientists take step toward creating artificial embryos
This is surprising to me as well. In Germany, where I live, the government is using smartcards as authentication mechanisms at many places for at least 5 years now, if not 10 or more. The workers don't need passwords or user names, they're simply plugging in their card into their keyboard and when they're leaving for a break or are going home, they're taking their card with them and everything locks automatically.

This is only working internally, externally they have to log into a VPN via username/password and then have to use the smartcard as well.

I don't see why this is suddenly innovative.
"200 employees is not small, that is considered a medium sized business"

I'm just curious what your basis for that is? To go with some kind of standardization on the term "small business" I would say the safest definition (within the US) would be to follow the SBA guidelines that define a small business. Depending on the industry a small business is defined by the SBA as a maximum of anywhere from 100 to 1500 employees. So it is not cut and dry that this is or is not a small business; industry and also potentially revenues in millions of dollars would need to be known to determine absolutely if it by definition a small business.
I don't know much about UK politics, but I thought UK did use the military to prevent Northern Ireland from splitting off.

But I agree that in $CURRENT_YEAR military intervention against Scotland would be highly unpopular even in England.
I haven't picked one up (yet), but the Edison[1] looks like a pretty decent Lego-compatible platform.

1: https://meetedison.com/
Normally I believe they just require the password. The threat model there is someone leaving their account logged in.
Czechoslovakia seems like a good model.
FWIW, I had the first generation Mindstorms and I definitely consider it the most important factor in getting me interested in engineering and software.

Resale on LEGO is good, so if it works out and gets the kids interested, it's a small price to pay to introduce them to logic and mechanical concepts (make sure you don't lose any pieces). If it doesn't work out, sell them and take a small hit - it's really a win-win in my book.
Yes. 9-5 is really more of a saying than legal truth. People who have to clock their hours usually work 8-5 with a one hour lunch, with some opting to take a half hour lunch and leave early / arrive late with manager approval.

Of course someone who has only worked salary without concern for billable time may never have experienced this. But even for salaried employees if your employment agreement says 40 hours, that does not include lunch breaks. Few employers in tech care because bean counting hours doesn't increase performance for creative types or knowledge workers.
I don't think I agree with you. jackhack's comment is in reply to jlebrech's comment, which explicitly mentioned racism.
Not entirely sure what you mean: genes cause environments, and interact with environments.

If you mean something like whether it's just picking up ancestry markers for families which happen to be rich etc, there are a lot of methodological components which try to minimize the more obvious ways of population stratification affecting results.

The most iron-clad part of showing direct gene->trait causation is the 4 sibling-comparison studies, where you see whether you can predict the difference between 2 siblings; as they have identical ancestries, families, locations etc, their environments are near-identical in the first place, and since meiosis at conception randomizes genes between siblings, success in sibling comparison shows the genes must be causal. IQ GWASes have always passed the within-family test since Rietveld et al 2013, and this is no exception.
What's the point, though? I just don't see the appeal.
Thanks for sharing real experiences in real Russia.
I've never been given an ASD diagnosis, but have wondered if I was on the spectrum. Regardless, I've struggled with reading faces, and generally just being weird/awkward in social situations. One thing that really helped me though was my first job where I worked retail selling computers. Initially the hardest part was approaching people. Once I approached someone and they seemed interested in a PC or Laptop it was easy, I just had to talk to them about one of my favorite topics (computers). I ended up being one of the top sales associates, and this gave me confidence to be more outgoing and social outside of work.
I actually added protections in some of our internal software against that recently.

People (professionals with a lot of experience) would open orders or product sheets twice (two new tabs) and it created issues. So now, you can't double click.

Once you click something, it is disabled for a few seconds.

I still hear double clicks, but now it doesn't create any bugs.
Any tips for understanding the lowest level code like the bootloader? It seems to be pretty opaque to me.
Normally I would reply back and explain, but you know more about this than I do, so instead I will ask a question.

Does it not protect against your password being compromised in some other channel? Sure you're probably not reusing passwords, but what if they compromised it some other way? What if the website had a flaw that allowed someone to exfiltrate plaintext passwords but not get at other application data?

Or to put it another way, if you're using a password manager, why use TPOP codes at all if you believe there are no other attack vectors to get the password that TPOP protects against?
This would make sense if virtually every website in the world didn't react to the short-term TOTP secret by handing back a long-term HTTP secret.
In the future, I suggest submitting the article with a non-editorialized title, as the rules stipulate, and then starting a comment thread to spur discussion.
My rule of thumb is: Only take advice from people you're willing to switch places with.
> It’s safer than Congo.

Uh ... OK
Being able to look at the source and troubleshoot it is not mutually exclusive to a product being proprietary (ie, source available would give you this).

There is also plenty of business I know that do everything in their power to ensure that if they go away the customer isn't left helpless (this is very popular in some parts of industrial engineering where it's common sense to hand over the blue print along with a service contract).

It's just very popular for software vendors to behave without care for the user but it's not the only business model and I think that's a common mistake of some people (ie, believing that FLOSS and proprietary is a binary property that will automatically mean certain things like you mentioned).
That's clearly not what I said.
From ES6 section, first thing I notice:

> let is the new var. Constants work just like let, but can’t be reassigned. See: Let and const

I say it once, I say it one thousand times: "Let is not the new Var".

They certainly have some similar behaviors but surely they do communicate very different things to a developer who is reading the code.

let: "you shouldn't/can't edit outside this block scope"

var: "feel free to change me whenever you want inside this scope (whether it's global or function)

JS stuff aside, this is actually very helpful.
In a place like NeXT this may have been applicable:

(From 48 Laws of Power):

"In 1502, in Florence Italy there lay an enormous block of marble standing in the church of Santa Maria del Fiore. Everyone had agreed this piece of marble had been ruined and was impossible to sculpt. Friends of the great Michelangelo decided to write to the artist, then living in Rome. They were sure he could do something with the marble. Michelangelo traveled to Florence, examined the stone, and came to the conclusion that he could in fact carve a fine figure from it.

Piero Soderini, Florence’s Mayer, thought this was another waste of time to attempt to sculpt the impossible. Weeks later, as Michelangelo was putting the final touches on the statue Soderini entered the studio to examine it. Likening himself a connoisseur of fine art, he studied the huge work and told Michelangelo that while he thought the piece was magnificent, the nose was too big. Michelangelo realized that Soderini was standing in a place right under the sculpture and did not have the proper perspective. Of course he did not tell him this.

Without a word. He gestured Soderini up the scaffolding. Reaching for the nose he picked up a chisel, as well as a little bit of a marble dust that lay on the planks. Michelangelo started to tap lightly with the chisel letting the little bits of dust he had gathered in his hand fall little by little creating the illusion that he was changing the sculpture. He actually did nothing to change the nose, but gave every appearance of working on it. After a few minutes of this charade he stood aside: “Look at it now.” “I like it better,” replied Soderini, “you’ve made it come alive.

Michelangelo knew that by changing the sculpture and the shape of the nose, he might ruin it. Yet Soderini prided himself on his knowledge of his aesthetic judgement of art. So to offend such a man by arguing over such a thing as ‘perspective’ would be foolish and futile. In fact it would probably put future commissions in jeopardy. His solution was to change Soderini’s perspective (literally bringing him closer to the nose) without making him realize that this was the cause of his misconception. He found a way to keep perfection of the statue intact while at the same time making Soderini believe he had improved it. A genius move.”
People work hard on their projects and some find it difficult to get anyone to review their work. This is a way to meet other devs and see other github profiles. This is all just for fun.
Edge does, Chrome doesn't.