skysight-inc/HackerNews huggingface dataset:
> JWTs can be read by every script you add to your site, making XSS attacks easier. A cookie with the HttpOnly flag prevents this.

You're confusing JWTs (a standardized token / means of representing claims) and JavaScript localStorage (a storage which can be read by scripts, partitioned by origin). The two are completely orthogonal; you could store a JWT in a cookie, if you wanted to.

> JWTs [… make] XSS attacks easier. I also found cookies easier to use, since the browser handles them and you don't need to attach headers to each request.

The browser handling them automatically means you need to think about CSRF, which I think largely negates the benefits.

If your site is vulnerable to XSS, a cookie won't save you; the XSS attacker just makes the necessary authenticated request using an AJAX.

My current favorite writeup on this is https://portswigger.net/blog/web-storage-the-lesser-evil-for...
Hi all,

I created Distinguish because I was frustrated with how messy naming CSS classes and IDs can be. There was (for me at least) no simple system that could reduce class names and work across any file extensions. So I reasoned that employing the author to add a little extra information to the class name (the "_cls-" prefix) was a reasonable compromise that only adds clarity and intent.

I've used Google's Closure Stylesheets before to great results, but it depends on a very specific build system. My intent with Distinguish is for it to be very lightweight, modular, and fast (and it can work for any type, not just CSS classes and IDs, though that's what I've found the most useful).
Apparently the study could be replicated (with a neutral expression as shown in the example). Given that, I think it's unlikely that anyone is unaffected.

I have two hypotheses:

a) It may be a kind of hindsight bias. You watched the video in the context of an article on the Kuleshov effect and knew it was the same neutral expression each time.

b) You cannot gage the mood of the embedded scene and thus cannot transfer it onto the encasing scene. The end result is that you are not affected in this instance. But it would not be because of some immunity to the Kuleshov effect itself.
> would websites really give up ~30% of their audience (including the lucrative iPhone crowd!) just to use some Chrome-only dingus?

Websites? Maybe not that much (at first, at least). But from IE experience: There are many intranet-style tools that would most certainly go "well, our tool X is only supported on Chrome, deal with it"[1]. Which, of course, only further cements Chrome's monopoly because everyone would just go "well, I have to run Chrome anyway, so why bother installing another browser?"

[1]: Yes, SAP, I'm looking at you.
Except the viewer is loosing context. I'd go the opposite direction and show the entire screen. (Of course shrink your screen size to be just right.) If you want, maybe zoom in later once you have given context. I don't know otherwise if this runs in the browser or if it is a standalone app.
> Go to about:config and set extensions.pocket.enabled to false.

That doesn't remove Pocket, it merely disables it. It's a stupid feature and a stupid default. It should be an extension that users can choose to install (or not).

> remove the (paid?) list of URLs that's apparently preloaded

This might be an android thing only, but when I type, for instance "sea", the URL bar autocomplete will suggest "sears.com", even though I have search disabled and have never visited sears.com. There are a bunch of these which seem to have come out of nowhere.
Interesting report!
> GAN:
Generative Adversarial
Networks, a specific kind of deep
learning algorithm that can train a
neural network to generate realistic
imagery. Whilst GANs are not integral
to creating synthetic media, they
represent the most significant
development in the how new kinds of
synthetic media are created.

In the future, our enemies will be Anonymous GANs, or GANNONs
I think const ref is ok, but avoid non-const
Wait, what!?
Tech's Winning (and Losing) Jobs in 2019
If you prefer not to have solutions, pretend you don't have solutions. Having solutions is strictly better (for the reader. I'm ignoring the cost of producing them to begin with)
Color code Columns,Rows and cells of a pandas dataframe
Blog post: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...

DEFCON CPV talk: https://paragonie.com/files/talks/NoWayJoseCPV2018.pdf + https://youtu.be/RijGNytjbOI

Alternative design that isn't radioactive: https://paseto.io

Apologies if this wasn't more readily available or commonly known. I'm worse at marketing than I am at engineering.
The left uses any inequality of outcome, like the unequal representation of minorities and women in the software development industry, as evidence of discrimination without allowing for the possibility these differences are due to different abilities, choices, or desires.

And if anyone challenges the belief that all outcomes should be equal, they retreat behind the very different argument you've just made, which nearly everyone agrees with.

The motte and bailey tactic.
I understand why they want to—even to the point of thinking it would be the right move if only it would actually work—but it won't work.

True, software is dual use[0] but it's too slippery. Even things like nuclear weapons designs[1] are getting pretty easy for people to get their hands on. This stuff is just text! How are you going to stop this from spreading? It won't work.

Besides, top-shelf AI tech isn't much better than mid-shelf stuff. For example, self-driving car technology. We're talking about the difference of 1000kms with no intervention by a human driver vs 5000kms. A terrorist weaponizing self-driving tech for, say, a mobile weapons platform (AKs connected to remote triggers, say) doesn't need the top shelf stuff. They need an auto that can go maybe 10kms.

Thing is, unlike most people I talk to in tech, I actually support the majority of the objectives intelligence agencies in the west have. I just don't know how you solve this one. We need free speech to be a liberal democracy but information itself is becoming dangerous. How do you square that?

Further, if the power of individuals keeps going up due to technological advancement how do you maintain security and freedom at the same time? The only way I can see it working is for individuals to continue to get more peaceful.

[0] https://en.wikipedia.org/wiki/Dual-use_technology

[1] Thank goodness weapons grade fissile material is hard to make.
> types that may make complete sense in your program's world, but they drift out of sync as the larger system evolves.

At the risk of being inflammatory, I would say that you've been looking at poorly designed systems.

A running joke about Google engineers is that all they do is shuffle data from one ProtoBuf to another. It's largely true. The upshot of that is that every single service/system has common, typed definitions of the data structures they use and require. Data never drifts out of sync.

To be sure, a lot of the problems I dealt with there were around data structure migration on large systems — but there was never any uncertainty about the structure of the data itself.

I like JSON APIs, but I think JSON especially contributes to people getting hand-wavy and casual about the structure of data across systems in stupid ways (see NoSQL vs SQL).
There was a small study that came out recently on biorxiv, with 29 PhD students with GREs all over the place -

>GRE scores, while collected at admission, were not used or consulted for admissions decisions and comprise the full range of percentiles from 1% to 91%. We report on the 29 students recruited to the Vanderbilt IMSD from 2007-2011 who have completed the program as of summer 2017. While the data set is not large, the predictive trends between GRE and long-term graduate outcomes (publications, first author publications, time to degree, predoctoral fellowship awards, and faculty evaluations) are remarkably null and there is sufficient precision to rule out even mild relationships between GRE and these outcomes. Career outcomes are encouraging; many students are in postdocs, and the rest are in stage-appropriate career environments for such a cohort, including tenure track faculty, biotech and entrepreneurship careers.

Now a GRE isn't a GPA (one's a specific test, one is your grades' average), but both are being used for university admissions, and I reckon both are not good predictors.

Edit: Link: https://www.biorxiv.org/content/early/2018/07/20/373225
> I don't get how it's supposed to be funny and why it's even there. It is possible to explain it?

I think you just covered about 70% of monty python for me.

I think much of it falls under "if I have to explain to you, you won't get it".

FWIW, I get (and like) a lot of british humour, but really not much of MP.
I'm not sure "buy another vehicle" is necessarily the environmentally conscious approach, nor is a scooter likely to be the best approach in many areas of the US you might vacation to - for both distance and weather reasons.
Survival is the ultimate measure of rationality (as per Taleb).

This is a higher order intelligence than stale test taking, or complete trust in the medical establishment, for instance.

Low IQ is predictive of being mentally deficient. Average and above IQ is a predictor of... not much.
Popular wisdom is that google culture rewards too much the creation of new projects, but not as much their maintenance
- which looks comparatively worse in a CV or when being considered for raises. Since they also hire mostly high-achievers, the result is that everyone wants to move into new things and "old" products are soon left to wither.

I'd be curious to know the opinion of actual Googlers about this common theory.
When I was in Atlanta, I regularly took MARTA, which travels through some rather slummy areas. Beyond the faregates, you're going to be rather safe. I personally felt safer riding the train in Atlanta than I did driving around in a car in Southeast DC.

I don't think crime is any worse on mass transit than it is in the surrounding areas. I suspect that most of your fears are driven by media bias: crimes that happen in the crime-ridden section of town are inherently less newsworthy than crimes that happen outside of it.
> the expert consensus that the technology is mostly there if the political will can be found to disruptively deploy it.

Citation needed. This may be the case for a few rich Western countries but if we expect China, India, and Africa to gain a modern quality of life (which seems likely), global energy consumption will continue to increase. My understanding was we didn't even have enough raw materials to scale solar that far with current technology.
This is the NYT. They approach everything from an investment mindset. For investors, growth matters more than turnover, more than profits. So it is no shock that the NYT evaluates public transport in terms of percentage increases and the number of new market players. Thier target readers are people looking for places to park thier money, not plebs looking for comparative city commute options.
At 115-125, there is an edge over other students. On the other hand, it's not strong enough for others to notice. Also, the typical curriculum is challenging enough to prevent boredom. Then a bias appears to have been institutionalized, as according to corporations, 115-125 equals capable enough to do the job + not smart enough to synthesize (ie, parrot).
>"meanwhile his website is almost unreadable on a desktop PC, with whole paragraphs stretching the length of the window"

That is not a fair point at all. Resize your window and the content flows with it. What better layout can you demand from a 15yo fast loading webpage that is still online?
The point I was trying to make was that the parent comment completely missed the point. Is the hand-written text really intended for people to read? Why is there a voice-over then? Or a link to a plain-ASCII version of the content in the bottom? It should be obvious that the form was a deliberate choice on part of the author, not some kind of web design incompetence. If nothing else, the color shifting backgrounds, blinking dots and animated swirls should give it away. You don't need to like it, but commenting on the font choice is just as silly as judging paintings by human-interface guidelines.

Speaking more generally, I was just being annoyed with this type of comments. See any post that links to a website that doesn't adhere to whatever the latest web design fad is and there is a good chance that a large part of the discussion will be about how the font or colors make people's eyes bleed. As much as HN is able to foster intelligent discussion, this aspect of it is pretty annoying.
Yeah, Emacs doesn't have plugins as such. It's a Lisp system, and programs, packages, and modes can modify or extend that system. From what I could tell about vlf, it runs pretty seamlessly, aside from a prompt when you open a large enough file.
Rent a house with someone before buying with them. I've given away two fully furnished houses - put me back 15-20 years I reckon.
The west coast epitomizes postwar American culture - car infatuation, suburban sprawl, and so on. Transit is growing in the west coast, sure, but transit needs a critical mass of convenience for people to actually live without depending on their car (or choosing to own one at all)

We're not going to see cities go all-in on transit while self driving cars are on the horizon.

Maybe after cars drive themselves, when people learn traffic is still not getting better, more cities will get serious about transit infrastructure.
Is Coinbase using Stripe as a credit card processor?
Just curious: Anyone knows how is Coinbase processing credit cards/debit cards payments? Are they using stripe or they developed their own deals with VISA/MASTER

Thanks!
How 20th century synthetics altered the very fabric of us all
The text is about exploring the boundaries of various different media (playing videogames, pencil drawing, programming). The form that the page takes is exploring the boundaries of how blogging and web design can be done. It seems to me the form was specifically designed to illustrate the idea of the text. One particular part I found interesting was the Zelda map with one part highlighted and one corresponding caption word highlighted, and the colors hue shifting together.
> Employees agree that Google will own their creative output, even off the clock.

Is this true, and does it apply to all google employees? Gosh, it better be a huge wage to justify that.
> Just because something is a good predictor doesn't make it scientific

Perhaps, but Taleb’s charge of it being nonscientific is based on it not being a good predictor of success except at the low end, from which he concludes it is not a valid measure of intelligence. This is wrong both on the facts (it is a good predictor across the board), and the underlying logic (intelligence and propensity to succeed are two different things, while it turns out that IQ is a good predictor of the latter, that actually is not logically necessary for it to be a good measure of the former.)

> There could be a third variable like wealth which needs to be controlled for, but is rarely done in those studies with few exceptions.

I've read lots of studies of the relationship of intelligence to various success measures, and controlling for other variables (especially various socioeconomic ones) is the norm, not an exception.

> In those exceptions, it was generally found that wealth of parents played a much bigger role in future success than IQ.

While that's true for some success measures (for a number, parental educational attainment is actually a better predcitor than parental wealth, which mostly seems to be a predictor as an imperfect proxy for parental educational attainment), that doesn't invalidate IQ as a scientific measure of intelligence or intelligence as a factor in success, since the intelligence as measured by IQ predicts variation not explained by parental wealth. Your argument is like trying to invalidate a measure of speed because it is a worse predictor of winning a race than which starting line a contestant is allowed to use.
Spring Tips: Reactive SQL Data Access with Spring Data R2DBC
none of these systems brings in
enough in fares to cover a majority
of their expenses

Public transit systems often generate a bunch of economic value they can't (or find it isn't politically acceptable to) capture in fares.

For example, if trains to the financial district save each rider 1 hour per day, and the riders are 70% stockbrokers on $150/hour and 30% janitors on $15/hour, a fare of $40/day might maximise revenue but be unpopular with voters as it excludes all the janitors.

Or if a new public transport system means for the same commute time I can travel further, and that means I can buy a family home for $300,000 instead of $450,000 it's going to be difficult for the public transport to capture much of the value created in fares.
I can also really relate. For me as a kid, the biggest such effect came from Might and Magic VI. It was such an expansive game - starting from fighting cave goblins with daggers and culminating, about two months later, with fighting dragons with laser blasters while flying (in 3D). It was so incredibly liberating and empowering compared to what I was doing at school at the time, and in hindsight did a lot to pull me into a career in coding.
you might complain if you turned up an art gallery and couldn't see the art because the lights were off or the building was locked

there's a reason paintings are framed and that same reason is why helvetica exists. UX.
I understand the challenges involved, but if an algorithm were fault tolerant enough to handle a flip book of qr codes, one could manually animate a file transfer. :)
What Is the Chinese Room Argument in AI?
from the top of my head, marketing gimmicks at some event, air gap jump and/or data exfiltration
Not uneven in that regard.

One of the issues being debated is the uneven quality between geographic regions. Not a new issue though, a more contemporary issue the lack of care givers and long waits that seems to be a problem in general.

If I were to guess a combination of the large age group just retiring and an attempt to allow more private health care options from a few years back started a vicious circle of relatively low wages and increasingly stressful working conditions driving competent people to seek out private employers instead.

Apparently it’s not uncommon for nurses to leave an employment, only to come back as contractors for the same job with twice the salary.

If that is the case I’m sure it’s mostly a temporary mess that needs to stabilize into some new configuration.

But the private options seems to be doing a good job, in general the people around me seems to be happy with their service at least. But to access those services you need the typical insurance through your employer, defeating the entire point of a public health care system to begin with.

So any resentment among the 10% probably stems from fear of not having a private option for things like cancer treatments if the current mess in the public system continues.

That said, the public system does an excellent job of all standard physical care I’ve needed so far. Have had some unlucky encounters with incompetent people, but can’t blame the system for that.

The psychiatric care looks like a complete failure though. If you have any anxiety or depression to deal with you’re on your own. The treatment plan is basically for a GP to administer prescription medicine and sick leave. If you do manage to be remitted to a specialist their main function is to evaluate to which degree you’re faking it. (In Sweden your either working or a lazy freeloader, “arbetslinjen” is very strong)
https://en.m.wikipedia.org/wiki/Arbetslinjen
Like commercials, I don't think it works when you watch with suspicion. So you cannot watch this movie and draw conclusions from it because you're focussed on the context of the Kuleshov effect (which also makes it more difficult to replicate). Even movies are different when you watch them critically.

(FWIW, I have ASD as well, and for me the expressions on his face are meaningless.)
Hacker Newsletter – A look back at 2018
To add to this a lot of the AI stuff is being posted open source to Github. At first it's to detect faces in a photo for social media tagging. Then it gets used to detect people in a camera feed on an automated turret.
Markov chains can be used to do type ahead prediction. It's likely what the iOS uses for their predictive keyboard.

https://en.wikipedia.org/wiki/Markov_chain
This is not realistic for childhood curiosity. A 4 year old is curious about things like what happens when I bang a pot on the ground. It's unreasonable to expect the 4 year old to read a manual to inform them it makes a loud sound, and also unreasonable to expect them to know the difference ahead of time the difference in scale of danger between banging pots and flipping a switch. In fact, for most areas of curiosity no such manual exists. Experimentation is the primary mechanism of learning.
Al Gore.

Al-Gore-Ithm
A single bus can move about 100-200 people. A single subway train can move about 1000-1500 people, an order of magnitude more.
The case study at the end seems overly modest. Even relatively unimpressive internal promotions can bump you up 7-8% or more; jumping ship to new jobs can often add 50% or more.
I wasn't being nearly as specific, and I'm from the UK, but the US seems to have reached a point where there is no real bipartisan support for even such basic propositions as "the US federal government should run things other than a military" or "the government should pay its staff on time". Meanwhile the UK is in the middle of a convulsion of ripping up all its treaty law with no real plan for replacement, and hiring ferry companies with no ferries for "emergency" transport: https://www.independent.co.uk/news/uk/politics/chris-graylin...
The graphs chapter is my favorite. It's not very rudimentary like other text books
Ended? the great game continues to this day.
The way I understand it the only sane use for JWTs is for short-lived delegation of authorisation.

E.g. a user wants to talk to service A but access to that service requires certain privileges. Instead of authenticating with service A, the user authenticates with service B (e.g. using a long-lived conventional session mechanism that requires DB lookup), which issues a token the user can then pass to service B (which trusts service A the info is valid and needs no lookup to process the token). JWT standardises a format for that token.

Most uses of JWT in the wild however seem to be for authenticating the user of a (web) app with the backend of that same app, so the token is passed from the backend to itself (via the user). This use case is better suited for conventional session tokens.
FOSS mobile on market – shipping in March 2019
Necunos mobile NC_1 is shipping in March, says Necunos.
Is there any particular reason why dotnet core and perhaps SQLite (or PostgreSQL) couldn't be used in place of SqlExpress and run the app on Linux?
All of the software listed is made by Apple and bundled with the OS. So not that mysterious.

Beyond that, and to your actual point, different developers have different motivations. Maybe their tool fits a specific need on macOS or within their community, or maybe they are starting with what they know, with a view to expand to other OSs later if they get traction. Or they aren't trying to sell the most software, and so don't feel the need to fish in the biggest pond. Or their software is iOS specific, which is potentially more portable to macOS in a way that it might not be to other OSs.

Seems like lots of reasons, and probably not that different to why some software is only available on Linux.