skysight-inc/HackerNews huggingface dataset:
Here in Germany - and I believe most of Europe - these calls are illegal and that works perfectly. I have never gotten a robocall on my life and am still free to phone around as much as I want.

(Not sure how exactly they are regulated. If they're illegal by themselves or if it's a side-effect from the ban on signing contracts via phone)
> Clients that want to or need to (for example those doing PGP in the client) can still fetch the RFC5322 if needed. The message is represented by a blobId, and the raw bytes can be fetched using the same binary download mechanism as mentioned above.

This bit of JMAP has irked me - encryption is a second-class citizen, in a world rapidly evolving to need it every step of the way.
A new solar technology could be the next big boost for renewable energy
If you use a realtime transport like WebSockets, you could keep automatically re-issuing a fresh JWT with a very short (e.g. one minute) expiry every 50 seconds; just push them at an interval to authenticated clients. That way your banning mechanism would only have a one minute a delay. No need to revoke tokens; just let them expire.

In such a system, a user would be logged out after one minute of closing the connection... Probably good enough for online banking. In a way, this is safer than standard sessionId-based auth because once you've issued the token, you don't need to worry about scenarios where the user has gone offline suddenly.

There are very few systems that need banning with down-to-the-millisecond accuracy.
Music theory for nerds (2016)
> People time is always the biggest cost.

False.

> Docker and Kubernetes have been a game changer in time-to-production.

False.

> ...it's cheaper to buy the next tier of EC2 instance than to waste developer and operations staff time trying to squeeze more out of existing servers.

Only if your management is completely clueless. You can't solve people problems by buying machines or installing containers.

> It's about productivity per dollar.

No. Or, rather, only if by "productivity" you mean "clueless management KPI, meaning wasted company dollars per hour".

The root problem is higher-up management being unable to any set useful goals except "let's get investment capital and waste it ASAP to get more investment capital next year, growth, #yolo lol".
Most firms who sell lawfull interception appliances also sell the appliances required to protect, detect or mitigate against it.
Usually they only sell their appliances to law enforcement, the militairy and intelligence agencies after signing a NDA. The legality is often dubious, and atleast some are nothing but a expensive user friendly box around GNU radio, osmocom and very little code of their own. ( But my knowledge could be dated. )
If you so desire mail me for a list of names, but i'd rather not post them here connected to my identity.
A Guide to Merkle Trees in a Blockchain Context
Generally it is the linker that seems to be the issue AFAIK. 32 bit platforms can no longer link at all for large programs like Firefox. Link time optimization will probably make this worse. The gold linker (that Android uses) uses less memory than GNU ld; possibly the llvm linker is better too.
"The IETF likes separation of concerns" but they're letting Google et al. ram through MTA-STS, which fails to define a standard port number for SMTP-over-TLS and instead requires MTA implementations to also be able to fetch port numbers over https, a completely unrelated protocol.

All because the authors believe mortal men are not capable of understanding DNSSEC. Leaving aside the unholy alliance of Google + Microsoft + Verizon + Comcast, the fact that the IETF made Fastmail ditch authentication from a mail protocol while letting Google subsume DNS and web-based port knocking into another mail protocol definitely tells me there's nobody behind the wheel any more.

I'm happy that the Fastmail team is doing work that excites them, but does anyone know if the IETF has any plans to use ports other than 443 ever again?
Google ”died playing on a computer”. I got many hits showing “Nobody dies playing on a computer“ isn’t true. Examples:

https://www.mirror.co.uk/news/world-news/tragic-teen-gamer-d...

https://edition.cnn.com/2015/01/19/world/taiwan-gamer-death/...

https://en.m.wikipedia.org/wiki/Video_game_addiction#Deaths
Ask HN: Which SaaS products should have a better/cheaper alternative in 2019?
There are abundant SaaS products available in the market that are being used every day. According to you, which of these products requires a major upgrade or which of these products should have a cheaper alternative available for customers in 2019.
All new apps I’m building are based on password-less auth [1] & bearer token.
NoPassword is just so much more comfortable than having to remember passwords. And boy, people are really bad at coming up with passwords - you might have seen it this Christmas at your parents’.
[1] http://notes.xoxco.com/post/27999787765/is-it-time-for-passw...
Show HN: Kernel Parameters Interface with HTTP(S) Using Rust
Browsers automatically attach cookies to HTTP requests, opening the door to attacks like CSRF.

The security impact of automatic client-side expiry is tiny, since token expiration must be done server-side anyway.

The HttpOnly flag as an XSS mitigation is almost useless; competent attackers will simply run their code from the victim's browser and session. To protect against XSS, HttpOnly doesn't really help you at all. You should be setting a CSP that prevents inline and 3rd party scripts by default, and whitelist what you must.

Overall, cookies may seem like they have a lot of security features, but in reality they are just patches over poor original design. IMHO, using local storage is probably better, because there's less room to get it wrong.
90+% are having cellular modem inside SoC, all the cheap ones do for sure.
The open source ory ecosystem ( http://github.com/ory/ ) might have what you're looking for, but it's definitely for advanced usecases. I know a lot of people that worked with Auth0/Okta/AWS Cognito but got so frustrated by downtimes, bugs, and complexity that they moved away. But it is an option for rapid prototyping although I'd keep a "replace it" somewhere in my milestone planning. Another possibility is Keycloak which is very enterprise / java fullstack and quite complex to understand.

Most advice in the comments is pretty bad though. Stuff like "API Clients need bearer tokens" is completely backwards and pushed by marketing people from companies (Auth0, Okta, ...) that misuse open protocols (OAuth2, OIDC) as a way to legitimize the closed source saas approach they took. Along the lines "if it looks complex it looks secure because most people have no idea". It's actually very easy to use cookies (httpOnly, secure) with API clients and you're saving yourself so much complexity with refreshing tokens and all that stuff.

Yet another possibility for super rapid prototyping is: https://github.com/bitly/oauth2_proxy

edit:// I forgot KeyCloak, but it's also for advanced enterprise use cases (SAML, OIDC, Realms, ...) and (from what I've heard) with a steep learning curve and heavy.
> Why are you expecting to revoke a token in a scenario where the token is supposed to be used once?

An attacker was able to somehow issue a bunch of tokens for himself. Now you want to invalidate them even though they're not used yet.

> Either the token is deemed valid and accepted or it's invalidated and rejected, which triggers clients to refresh the token and retry the request.

The other point here is that you are probably (not always, not in every possible case, but in most common cases) better off using just a bearer token (refresh it on every use if need be). There's no performance benefit in using stateless tokens when they can be used only once, and handling bearer tokens is much easier from a gun-to-shoot-your-feet-with perspective.
This is a great little read, full of the author discovering useful tips along the way. The case is retro gorgeous on the outside, even if it's a kapton-wrapped horror on the inside.

The fact that having built this thing one of the author's first projects is a BF interpreter adds icing to the cake.
FP is good idea for safety critical systems. It just has to be designed differently.

You want uniqueness typing that allows you to have functions that modify the variables without breaking the functional abstraction in straight forward manner. You could also reason about the memory use and have fixed amount of memory. Ordered typing would be nice feature to have. You also want hooks in the compiler for a additional tools for static analysis and proof assistants.

Recursion itself is not bad idea. It's strictly forbidden in safety critical code today for reasons that can go away. If you allow recursion, compiler must be able to reason and define the limits. Recursion is not good idea in safety critical code when it obfuscates the execution, but that is not always the case.
I see your point of view too. And I realize that Electron performance story seems to be improving, bit by bit.

I can understand you preferring to make life easier for yourself as a developer, leveraging your existing code and getting cross-platform support for free. Personally, I'm of a belief that the extra work necessary to do it with less resources is worthwhile and needs to be encouraged, which is why I a) actively avoid Electron apps, and b) speak up about it.

> Regarding the RAM as long as there's enough available I think it makes no difference performance-wise if I have 5gb or 2gb free.

It makes a difference when you want to use more programs at the same time. Which is what most users want and expect from their computers, and which is a fundamental feature of contemporary computers. Given the increase of bloat in software all across the board, most users are operating near the top of their RAM capacity, not the bottom. There's only so much of it left before they just can't have everything they want working at the same time.

For instance, right now when I launch (and use for a while) Firefox and Chrome, Emacs, and a local instance of a product I'm working on, I'm nearly maxing out my machine's RAM. If someone was to force me to use an Electron app for chat and music, I'd proably have to either a) keep closing and opening browsers, b) launch the product I'm developing on a different machine (less convenient), c) upgrade my computer. But instead, I can choose not to use bloated applications and keep my workflow convenient, and my perfectly good computer still in use.
Freedom of movement has caused quite a few issues for Seattle, with many people moving here from a variety of backgrounds.

One of my exes actually came here from Spokane, as its much easier going out here as a homeless gay 17 year old then living with his abusive brothers. Many suburbs and towns are all too happy to encourage the least well to do to head towards the nearest major town, generally involving the police corralling those less fortunate than us and giving them a ride towards said major town.

I hear Tacoma is still relatively inexpensive and nice, one of my old professors moved down there and finds it rather decent. Not sure how many not-white-collar-professionals will continue to be able to afford to live in and around Seattle (outside of a handful of "Affordable" aka heavily subsidized housing complexes).
This looks really great — I’m going to try it over the weekend. Thanks for sharing
I find the snippet on CRLF funny. Even Microsoft didn't like them!

>In Opus paragraph marks are represented by two characters (carriage return-line feed) except for section marks which are only one character (chSect) and possibly other format files (Unix files with only line feeds and Mac files with only carriage returns). In Mac code all paragraphs end with a single character. Our model caused many
problems and complicated code on top of the complications arising from being different from Mac Word.
No. Medicare pays the least because the don’t negotiate. They just set prices. As a hospital/doctor you can choose to accept Medicare patients or not. Most providers lose money on Medicare patients, or so the like to say.
Elon Musk promises 100 percent Tesla Supercharger coverage in Europe next year
That would make sense. Do you think they lacked experience or received improper training?

From what I remember when preparing for the helicopter license, it was emphasized that being able to use manual sensors and controls was critical in case of such failures.
The Business of Removing Negatives from a Product
A short and funny collection of issues related to Internet video streaming
Arcsecond: A JavaScript Parser-Combinator Library Based on Haskell's Parsec
> What exactly is the scenario you envision in which JWT is all someone has? Do you mean they're forced to use stateless session management, or that JWT is literally all they can do for authentication because nothing else is available?

Good luck using session cookies with Cordova on iOS, for example [1]. In cases like these JWT is perhaps your only option.

[1] https://issues.apache.org/jira/browse/CB-12074
I have run Fedora for the last 3 years on my XPS. I do hang out at /r/dell and /r/fedora and havent generally seen anyone having any issues. Fully out-of-the-box performance.

I havent used Ubuntu for a long time, so im not sure what the issues are. But I like Fedora for their professional distros.
"Service update" SMS messages can write certain things to the SIM card and other aspects of the phone without user interaction.

(this machinery is rather hard to google for and I'm not sure if it has a better name in the official GSM documents)
All our users have client certs, so using then makes sense to me.
> It's probably better than cookies.

Why do you think so? I would guess it's a tradeoff about what you think is more likely to happen. XSS or CSRF.

Local storage (and session storage) is vulnerable to XSS. Use a strict content security policy and escape (htmlspecialchars in php and similar functions in other languages) output to combat that.

Cookies are vulnerable to CSRF but can't be read from JS if they are http only (no XSS). To combat CSRF most frameworks already have built-in csrf token support. In case of a API use a double submit cookie. Frameworks like AngularJs/Angular support that out of the box. Also use the secure flag SameSite and __Host prefix [0][1]

[0] https://www.youtube.com/watch?v=2uvrGQEy8i4

[1] the slides from the video: https://www.owasp.org/images/3/32/David_Johansson-Double_Def...
I am on maybe 20 a week at the moment - main problem is the cost (which is probably $160 AUD a week) and how it makes the next morning/next few days useless while your body recovers.

Hope you continue succeeding!
that, or the source data is not very good. maybe you got a phone number used by a person of spanish origin before.
He has labeled himself as such. My comment is clearly about self proclaimed shock jocks looking for controvercy and then complaining as if that wasn't the point to begin with.
I find it interesting that even though they knew that they were building a multi-platform product, they insisted on inheriting CRLF from DOS anyways, knowing full well that it created issues. That little decision he described as a failure painted a good picture for me.
Looks great. Nice work. I had similar checkboxes, and notion.so seemed to check most of them, and has been great.
A Florida man found the largest known prime number on his fourth try
Establishing identity is a vital, risky and changing business
How to surf in CS:GO
Had new insurance and a sore shoulder. Was billed ~$1,400 for a physical therapist to examine it ("evaluation"). No treatment. Very little covered by insurance.

The next day had a chiropractor treat it and shoulder was fine. $25 with coupon. Funny part is, as it was new insurance, I spent over 30 minutes with insurance rep in advance on phone going over options and trying to get an idea of likely costs.

When I had a heart problem and no insurance, we called providers all over town (Minneapolis) to try to get prices in advance. Most would only give estimates over a wide range. Some flat out said it was there policy to not give estimates. Eventually found a cardiologist who worked basically free ($30 plus donation). I bought a Kardio to record my own ECG so I can have more data to improve my communication with cardiologists, who are (understandably) a bit alarmist about what can go wrong and tend to err on the side of (expensive) caution without sufficient data.

Feels like a broken system.
Thankfully on this front most of the desktop environments have come a long way, one can give a user a laptop running Debian or Fedora and that user will be able to install software right in Gnome Software, change wifi networks, display resolution/configuration and so forth without ever using their keyboard.

Its feasible in 2018 to give your aunt a laptop running Linux (just so long as its not Hannah Montana Linux or Gentoo) and expect her to be able to go about her normal Facebook browsing, document editing routine without much issue.
You can probably justify the expenses as "travel expenses" that you would have done anyway. If I was rich and had no job AND I had an important place that needed mapping, I wouldn't mind doing this just to get to play with the gadgets.
I especially liked how they said the process improved the protocol.
HTML
WORDPRESS
PHP Development
PHP
WORDPRESS
I think that image cost FreeBSD a prominent place in datacenters.
BLU Foldable Phone Release Date, Rumored Specs
No one want safe widespread solutions: we want to being able to spy both for bad and good reasons. The good part is simply justice: telecommunications are vital to anyone, criminals included, to a point that we do not want to limit them. But to catch criminals we still need a bit of surveillance power.

Unfortunately the very same power is interest for criminal itself to spy on their targets, any kind of criminal from the home thief that may like follow you to know when you go on holidays, what kind of safety you have at home (because yes, you post new shiny photos of your new home surveillance system, together with it's plan, photos of you and few technicians during the mounting phase etc), what you have in your house (because you post tons of photos/selfie with relevant "background") to your insurance company that buy with discretion your data from Amazon/Google/Microsoft/Apple, data recorded by voice assistant, smart devices with cameras everywhere, speaker mic of your phone etc (curiously in the past such kind of spying devices were buy, and they are very expensive, by people who want to spy on you. Today you buy them from the people willing to spying on you and also you pay connectivity and electricity form them) to your government that likes to know your political opinion and influence network like ancient est-German STASI or modern NSA/FBI/CIA/* do.

The real "safety" point is not safety itself but balance of power. A knife good to cut a succulent steak is also good to kill someone and perhaps to open a package. A car the same. A phone the same. etc. They are instruments with more or less effectiveness, comfort and power. If they are balanced so anyone have more or less the same power we have no real safety problem. If too few have too much power we have a problem, bigger as fewer and powerful counterparts are.

Unfortunately to proper balance power as a society we need also a certain level of awareness and civic sense distributed among us, because yes knowledge is power. At any level. Today's and not from today's we evolve in a more and more ignorant society with a more and more reduced élite that rules against tons of sheep.
My conspiracy theory is it was designed this way over time so that people “needed” insurance (before it was required).
Step 1 is a good backup. With JMAP that could be done for any provider, can you with gmail? The solutions that I've seen all seem like hacks. But I have yet to try it so I could be very wrong. But please let me know if there is a decent alternative, I'm about to migrate a google account.

I'd hope most decent providers let you use your own domain...

It's easy to think gmail spam filtering is good if you never check the spam folder. It has filtered out some very important mails for me and others so I do my very best to disable it. Create a filter for "is:spam" and "Never send it to Spam" is the best solution I know. But despite this google might remove mails anyway.
I can tick those boxes with just a filesystem, a text editor, and grep.

Except, maybe, Evernote import — no idea how that works.
That's a huge help, thank you!
Even in those stills (cherry-picked for sure) it's easy to spot NN artifacts, it's just that most people on HN trained themselves to spot "classic" CGI problems that are local. Check the general geometry and long-distance order, that's what problematic for NN because of their nature. Even using photos as references NNs can't avoid shifting ears or gaze or warping faces because there's no concept of the underlying 3D object there, just a bunch of flat transformations.
Build and deploy huge static websites with Caddy
For authentication I use Auth0 on the free tier, with a passwordless setup that uses Google OAuth and Microsoft OAuth and allows fallback to emailing a code to a user. We store nothing more than the email address. The great thing about Auth0 is the separation it provides between the authentication layer and the web app, and how if you go down the SaaS route you can allow people to bring their own Auth0 accounts and configure their own bespoke authentication.

For authorization you are going to have to implement your own solution once you have an authenticated session. What someone can do always depends on your app and the functions you provide and so there is no nice third party solution to this. In my case I store the map of users to roles and what a role can do in a PostgreSQL app and cache there the answers to "which users are in a role" and "what can a role do"... user permission and roles changes are infrequent but flush the cache and so take immediate effect.
Bullshit. It's not even remotely true that you have to be wealthy to study in the UK. I received absolutely no financial support beyond the standard student loan and managed to save money. If I decided to sell my body online it would have been for extra cash, not because I needed to.
Internal Linking: What It Means for SEO and How to Do It Right
Maybe it's a new body for Peter Thiel made out of some poor person.

Maybe it's immortality for all of us, ability for a dying person to hop into a young, healthy, good looking clone body.
I blame bad USB micro cables. Replacing bad cables with new high quality solid cables fixed the unreliability for my pi3.
The little sticker on the first page of the memo indicates that we're able to read this because it's part of the Comes V Microsoft antitrust litigation. See http://iowa.gotthefacts.org/

Perhaps a good time to remember not to put things in writing at work (this includes Slack) that you wouldn't want seen in exhibits for the prosecution.

I browsed around randomly (the exhibits are untitled) and found http://iowa.gotthefacts.org/011607/0000/PX00697.pdf : "we have sorted criticisms of Microsoft into three categories: lying, cheating, and arrogance" (to Ballmer)

http://iowa.gotthefacts.org/011607/0000/PX00764.pdf : angry letter from Borland

http://iowa.gotthefacts.org/011607/0000/PX00859.pdf : competitive analysis memo versus PenOS, perhaps the first company to produce what would be recognisable as an iPad ancestor. In 1991.
It would be a sad and cheerless world if the only motivations were discovery and profit.
NHS spending is £2892 per person/year, that's quite a bit lower.
Microsoft beat WordPerfect in the transition to Windows.

This was the product that eventually killed WordPerfect and gave them a decades long monopoly in word processing that still exists.

Lotus 123 suffered a similar fate against Excel.
KYC will become even more webcam based until the tech catches up
Sometimes, reading this website makes me happy that I don't live in the US.
The best laptop 2018