skysight-inc/HackerNews huggingface dataset:
Chamberlain who make smart garage doors under their own and the Lifemaster brand fail almost all of these. Here's a gem from their sign up page[0]:

<input autocomplete="off" oncopy="return false" onpaste="return false" data-val="true" data-val-length="The Password must be at least 8 characters long." data-val-length-max="100" data-val-length-min="8" data-val-regex="The field Password must match the regular expression '^(?=.{8,})((?=.*\d)(?=.*[a-z])(?=.*[A-Z])|(?=.*\d)(?=.*[a-zA-Z])(?=.*[\W_])|(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])).*'." data-val-regex-pattern="^(?=.{8,})((?=.*\d)(?=.*[a-z])(?=.*[A-Z])|(?=.*\d)(?=.*[a-zA-Z])(?=.*[\W_])|(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])).*" data-val-required="The Password field is required." maxlength="128" placeholder="Create Password*" type="password">

Passwords need to be at least 8 characters in length and must contain at least 3 of the following 4 types of characters: uppercase letter, lowercase letter, number or symbol.

The blocking of copy/paste in particular was irksome, but the whole thing is almost every bad security practice all rolled into one.

[0] https://www.mychamberlain.com/Account/CreateAccount
well it does say "ULTIMATE STROBE HAZARD"
Maybe they're preparing for a huge influx of migrants driven from coastal cities by sea level rise.
Why was that primary index not updated for those several months? What happened that led to that?
Not surprised at all. The only surprising thing is there is this much info to go on. I figured they would be tight lipped about their own private NSA style operation.
Alta Vista was great. The skill was in the user, yhough, not the algorithm. Construct searches like:

(word AND word) NEAR (word OR word)

and it worked great.
Why didn't you update your primary index for several months? Were there serious technical breakages?
this just happened for me shopping at a grocery store I do not usually frequent, I overheard them saying it was happening company-wide. people left full carts of food because the ATM was also not working. (non-urban area)
American Extremism Has Always Flowed from the Border
Thank you very much! I'll try and see if I can get my hands on a projector again.

Generative art != glitch art, but these might be of interest to some people as well, since there was thread about a week ago on PNG glitching, and I went down a rabbithole saving links.

https://news.ycombinator.com/item?id=19075003

http://www.glitchet.com/resources

https://www.vice.com/en_us/article/mgpv3a/heres-what-happens...

https://www.youtube.com/watch?v=tYytVzbPky8
I assume he does not want support. He wants to highlight a threat to DNS choice.
> At the very least you need a workstation grade machine to be able to do that kind of stuff on regular basis, you really can't expect everyone to have that. And there's a reason libLLVM.so is usually dynamically linked, it cuts a massive amount of time spent on builds, which is especially useful while developing

I of course do not argue doing LTO while developing, it seemed clear for me that the context of the whole thing is about what's released to users.
These are good points, agreed. Thank you
There is no reason anyone needs 100 different passwords and/or those passwords to rotate. This is terrible advice, you don't need it and you shouldn't do it.

As of current, haveibeenpwned hasn't found any breaches connected to my current email address, which I switched to around three years ago. Which is to highlight: Most breached password data is really, really old. A surprising number of breaches come via an email address I was only signing up for accounts on more than six or seven years ago.

Furthermore, most of your accounts don't matter. Things like your email, your bank, your web hosting, need to be secured well. An account you used once to sign up for a newsletter does not. Don't save your credit card info in every single web store you log into, and your security on those accounts don't matter either.

Focus your security and your password uniqueness and complexity on accounts that matter, and stop caring about ones that don't. People have reached security overload after being told all of their accounts must be secured, and then offloaded the problem to a bad solution.
You need a high-quality copy, viewed projected large, with good speakers, to get the full effect.

https://www.dropbox.com/s/6t9skr0ua4le5ma/whelmer46a_5m.mkv?...
You have it reversed. Europe is almost always ahead.
Interesting. I think this is useful if implemented correctly.

I had an idea similar to this a few years ago. Basically, you would be able to bookmark your place on the page and come back to it later or send the link to someone else. I didn't think that using a word or phrase was useful because it could show up multiple times on the page. Instead, I used the scroll distance. Here's a crude demo:

http://jboyer87.github.io/page-progress/

Of course, this isn't device-independent. I never went much further with it.
> This device is not architected for users who know what DNS, DHCP, or TLS are, much less who care.

The only technical data I suggested showing the user was an optional "technical details" popup, for the rare cases when someone (perhaps you) actually was interested in that information.

> How?

Iff there is a useful UI, the same way they show anything to the user. I suggested automatically failing over to the hardcoded DNS server (or similar workarounds) automatically. (If the device is literally a lightbulb and the only "UI" is if the lightbulb is on or off, user interaction doesn't make sense; just failover.

> And what should the user do with that information?

At a minimum, the are informed that something about their network required using a workaround. However, you seem to be missing the point: the minimal amount of user interaction I'm suggesting isn't (primarily) about informing the user. It's about asking permission to use their network contrary to how their network asked to be used. You are a guest on their network..

(if the DHCP server didn't provide a DNS serer, then there is no problem; just use a known server)

More importantly, I'm mostly talking about testing and failing over to a the builtin DNS server, instead of simply assuming it's needed in "some" cases and turning it on for everyone. This shouldn't be difficult. The DHCP already happened, do the DNS lookup and check a special URL over TLS. If it fails or times out change the DNS to Cloudflare or Google's service and retry.
How about CPUs without speculative execution and simultaneous multithreading (SMT / Hyper-Threading, which has similar issues)? We would, of course, need other optimizations to claw back the performance loss--an engineering problem I feel we can solve.

I've wondered if the solution is more, simpler cores. We concentrate on smaller, faster cores, and the programming to utilize them better. Perhaps advances in memory architectures as well. Hardware isn't my specialty, so I'm just brainstorming here.

Perhaps this is where ARM and even RISC-V based systems can step in.

But I'm a software guy, so what do I know? I just know I'd feel more comfortable with systems based on simpler CPUs that just cannot be exploited by the recent side-channel attacks discovered, rather than trying playing whack-a-mole with patches, along with trying to reason when it might be safe to use CPUs with these optimizations.
They do need a FB account to access all internal systems, but that can be a seperate account from their private one
This reminds me of the final battle in the anime Gunbuster where they are trying to save the human race while traveling at light speed. They know if they engage the alien race they will never be able to see their friends or family again.

I think they ended up returning 12000 years later to find the entire planet waiting for them with a light display across the Earth that says "Welcome Home".
And what is the name of the app?

Because I guarantee most of Europe has never heard of it.

That was my point. Solutions might gain adoption in a single country quickly, and there are some that are becoming very popular in various countries.

But it's hard for any one of them to get adoption across the EU.
It should be about 32 stories max if they are using Chinese concrete construction techniques (most likely).
You're discounting the idea that most religions are just really efficient, decentralized and federated power structures.
When costs and prices are hidden, competition cannot happen and the market stops working.
> what was the agile manifest a response to?

Frankly I don't know. The Manifesto itself is not very clear about it. I've worked in agile and non-agile companies, but none used a waterfall model. If anything, agile adoption always meant more process (stories, standups, planning, retrospectives, etc.) rather than less. Before or without agile, the structuring of work has been mostly the same, albeit without the formal process defined by this or that agile methodology (to be fair, scrum is the only one I've ever seen).
China should look to what Vancouver did for a tax on unoccupied housing - perhaps amplified as needed.

However, China is also a centrally controlled, single party state that is willing to experiment - if they haven't done it, it's likely because they don't want to.
Test Driving “Power of Two Random Choices” Load Balancing
I really don't think it's fair to compare China's housing policies to the United States' policies as they couldn't be more different.
What about a presentation? What if it's not a coffee shop, but a conference?
I was with you 100% until you said:

> So what is happening when someone tosses out their religious context? They are essentially saying "I understand this organism perfectly, I know its strengths and weaknesses, and I know better than the process of natural selection as to what is a better way of living."

That's the opposite of what atheism (well, weak atheism, the only valid kind) says, which is: I don't know, and I don't think you do either.

The idea of having a sense of community and values that can be communicated over generations is fantastic, but it does not require superstition any more. Sometimes you need to rip the band-aid, and sometimes you need to be more gentle. But let's agree that the band-aid is coming off so that we can move on to the next step in the healing process.

> God loves you

Again, let's stick to what we know.

Oh, and let's get rid of the notion that skeptics are bad people (Psalms 14:1).
Online - i am definitely not keen to do this trip:

https://archive.org/details/IrvingMcClureJohnsonAroundCapeHo...
Also, for the love of all the gods, don't prohibit pasting in the password field!!
It's also that after bootstrapping with text search and page rank, they can incorporate a lot more useful signals in there ranking algorithm: the clickstream on the search results, and page visit time after the click. If the majority of their user base would actually want precise search, this clickstream would not reorder the results, but it does. So most users are happier with imprecise ranking.

The wealth of user traffic is also what no other search engine can replicate, due to Google's market share in web searches.
It's a tradeoff between security and usability

https://security.stackexchange.com/questions/158075/is-it-un...
Campuses also have this kind of security. I can't use a Chromecast or a Google Home on my college campus because my school's IT team blocks all DNS servers except their own.
Add some bias to create dialogues when sampling based on movie subtitles and I could see it passing proper Turing test.
normally security would be implemented at an api level. you would have to be careful to implement that in the renderer here.
Thinking pragmatically, a password manager can fix this in one spot, while weird web pages will always be around.
It is exactly the same isn't it?
Pretty sure that is why... you enter your username and it checks to see what authentication flow to use, if it's a password flow then you get a password screen.

Pisses me off too
The 500M was for fixing up the eroding waterfront where they were building the campus. The alternative was allowing the damage to continue or fix it at a higher price themselves.
One big advantage this has over a simple opengl engine is that it doesn't obscure how the rendering occurs.
I think that reasoning is valid for state-sanctioned aggression, or war to be precise. Personally I think that as long as collateral damage is minimal, we should strive to develop the most deadly, most efficient weapons we can, specifically for the purposes of deterring unchecked aggression.

I don't think GP was making an argument that I should carry an AK-47 on me so that any muggers i come across are less likely to out-arm me.
The whole point of containers is that they are all-in-one and prepared each time from some build mechanism. Tracking down every binary on an OS is a whole different thing, thus the creation of containers in the first place.
Yeah, this is the biggest one. I remember Google used to do it too! (Not sure if they still do because I haven't tried it). Google would let you log in into your google account with a yahoo email address (or any email address I presume) as the google id. It threw me for a loop the first couple of times.
Because the DOM is not synchronously accessible, I guess.
If a service offers multiple ways to authenticate a single account, I don't see much problem with it. Google killed their standards-based logins? No problem, use one of the other providers you've linked the account with.
Panel Recommends FDA Approval of Esketmaine to Treat Resistant Depression
Of course there are differences, merely pointing out if building more housing, even building more housing to an almost comically absurd extent solved affordability issues by themselves, China wouldn't have them.
Yes please. So that our local alternative RuPay gets even broader adoption. :)
Most research on this topic has been done in the field of psychology. There are two problems. The first is a general one with psychology. The replication crisis in psychology started with the discovery that only 36% of studies in reputable journals could be replicated. And unlike psychology studies, that discovery can and has been replicated. What that means is that the wide majority of studies in psychology are, at best, misleading. This is made even worse by the fact that psychology also tends to have evolved into a very homogeneous group of people ideologically, politically, and so on - and that ideology is generally going to be on the opposite ends of topics such as violence as a means of behavior correction.

The second is that this is a really hard topic to study well, even if you genuinely wanted to. So for instance one thing you'll find is studies link corporal punishment to increased aggression, violence, and other such behaviors. But what sort of person receives corporal punishment in the first place? This is obviously not some amazing revelation, but there's 'perfect' way to control for these sort of problems. You have to make assumptions and rely on behavioral models and toy experiments. Now enter the quality of science that's ubiquitous in psychology and it's not a good situation.

This doesn't mean that corporal punishment is a good idea, but it does mean the 'science' should not be given more weight than it deserves.

----------

Another thing we can do here is look at how the same behavior varies by region. Let's assume that psychology is right and corporal punishment has a causal relationship with violence and other sorts of behavior. In Japan corporal punishment in child rearing is ubiquitous yet violent crime is practically nonexistent. And Japan is not cherry picked, the trend follows throughout most all of Asia. I only mention Japan since I think most people are aware of how incredibly nonviolent the Japanese as individuals are, yet may not be aware of how ubiquitous corporal punishment is. You now suddenly have a problem. You need to explain why corporal punishment on e.g. American children causes violent behavior, yet has no such effect whatsoever on Japanese children.
Definitely no monolithic opinion but my cohort (i.e. those I speak to regularly about this issue) believe there should be major reforms to vastly simplify legal immigration and enable a clear path to citizenship. You might call this open borders, but that implies a free-for-all. I personally think getting a work visa should be pretty easy, taxes paid by all, and employers should be severely punished for attempting to hire under the table.

I think you’re right to say illegal immigration causes a caste system. I think that’s artificially created by our strict immigration policies. We need more workers of all skill levels in the US. There are people who want to pursue a better life by moving here. Why get in the way?
...when discussing something different than what I was.
I feel that Google brought in a shift in thinking of internet companies. In pre-google era, companies operated like an government office, once they gain marked foot hold they virtually stop enhancing their products. Google and other successful startups have taught us that a tech company is prone to fall if it doesn't innovate.
Modality is ok. The reason being, a 'login' is often an interruption to the normal flow of experience. Trying to do 'A' then 'B' - need to login for 'B'. This is why modals exist.

The background to the modal gives the context to 'where the login is happening'.

If there is no context then it can have it's own screen.

The absolute worst is when you're doing a bunch of stuff, you login, and the app does not forward you on to 'that thing' you were trying to do, rather, you just get to the home page after login and have to re-search etc..
That would be worse, not better. E.g., IoT devices hardcoding NTP servers they don't pay for:

https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#No...
DNAT
Judge rules Blockvest ICO token is a security, reversing previous order
One way I've seen sites mess this up is when they allow me to sign up using a Google account on my Android phone, but don't offer Google login on their web page. Makes for very confusing UX!
Yes, splitting up auth flow allows you to query auth requirements, query apis for risk/security and more
Your comment reminds me of a recent article I read (on HN iirc but can't find the comment thread):

https://www.technologyreview.com/the-download/612947/pricing...

>Researchers at the University of Bologna in Italy created two simple reinforcement-learning-based pricing algorithms and set them loose in a controlled environment. They discovered that the two completely autonomous algorithms learned to respond to one another’s behavior and quickly pulled the price of goods above where it would have been had either operated alone.

>“What is most worrying is that the algorithms leave no trace of concerted action,” the researchers wrote. “They learn to collude purely by trial and error, with no prior knowledge of the environment in which they operate, without communicating with one another, and without being specifically designed or instructed to collude.” This risks driving up the price of goods and ultimately harming consumers.

I don't think it's out of the realm of possibility that two companies could arrive at such a move without conscious collusion. I also don't think it should be treated differently.

Long term, I think Visa an MC could shoot themselves in the foot. Merchants are now allowed to charge fees for using CCs IIRC in at least some areas.

You could easily end up with a situation like Europe where people mostly use debit cards for in person purchases since the processing fees are lower.

Consumers lose the protection of a buffer from their bank account, issuers lose out on revenue. Not a good outcome IMHO.
> That's a security failing - you shouldn't let the website user know that a given account exists.

It's not an issue if you let users pick their own username. There's simply no way to get around this (apart from assigning usernames). In other cases, usernames being publicly available is a desired feature.

[0] https://imgur.com/a/qCupYyQ
I too like the magic links. I've been an advocate for them in our tech stack ever since the first one I used on Slack. Yes, it's a paradigm shift, but I don't think that's a reason to avoid using it.

My team is split on whether or not they are a good thing, but the main reason people usually give against magic links are it's too cumbersome to go find it in your email. Am I the only one who always has email open?

From an implementation standpoint has anyone seen a negative consequence of using magic links? I know password resets are always a portion of our customer service handling – is there an equivalent with magic links?
Not that I disagree, but those could also be farmer or fisherman housing, or remote compounds (think remote military or university campuses). The ones around Beijing are usually inhabited in some form or another, even though they are in the middle of farmland or abutting mountains.

My wife has an aunt who lives in an apartment complex in the middle of nowhere near leiyang Hunan. This was because it was what the Energy SOE her aunt was working for required them to live.
Here's another one - DON'T disable the submit button if the fields are empty since some native password managers like Chrome iOS will render as if they've filled the fields, but only provide the values on the user's first interaction on the page. A simple form doesn't have an issue with that.
Simply the rate of change/growth, and the pressure it places on cities and long-time residents, are valid reasons for caution.

You imply that these issues are easily solved, if people like NIMBYs "simply" change their mindset. But history shows that mindset-change is a slow and stressful process.

Cautionary tales are a chance to study such issues, and find solutions, or at least strategies -- something that govt is usually bad at. Not blame the victims.
In React, forms are often built with this pattern:

* Type/change events fire on the field (e.g. username)

* Username updates the internal model (this.username = 'karthikksv')

* The submit button fires an event so the parent page can act on the entire data model ({ username: 'karthikksv', password: 'fluffykittens' })

I'm concerned that this model won't work well using server-side React components on a network with high latency – each type event would have to round-trip to the server to update in the DOM.
People always seem to claim this on HN but it's never happened for me - do you have an example?
Ofc, C# doesn't actually support non-trivial fall-through. You can have

x:
y:
DoX()

but you can't have

x:
DoX()
y:
DoY()

at all.
They make their position quite clear when they say things like "But who will do the jobs Americans don't want to do, like picking fruit and cleaning our houses?" It's not just Democrats, both sides are guilty of facilitating this. Nationwide e-verify is a common sense solution that nobody in power seems interested in implementing.
Centurylink hijacks 100% of real NXDOMAINs to their DNS servers and replaces them with a redirect to their internal portal. They "have" a configuration knob to disable the behavior, but it doesn't work or isn't reliably persisted; it never sticks. Big residential ISP.
> Since password managers are terrible

Wait, why are password managers terrible? That's not an opinion I see much, can you explain why you say that?
> Those transaction fees were originally prohibited by credit card merchant agreements, but eventually they relented.

They were prohibited by federal law until a few years ago. That was repealed, but now they're still prohibited by state law in a number of states. In addition, some merchant agreements still prohibit it, particularly if the merchant accepts American Express.