skysight-inc/HackerNews huggingface dataset:
The issue is that password managers are a huge weak point and a significant compromise in your security. Generally password managers have some sort of master password, which unlocks access to all of your other accounts. Why bother setting different passwords for every account if one password unlocks them all anyhow?

Password manager security flaws are also a dime a dozen, and none of them have been without significant flaws at some point or another. None of them are operated by companies with an ironclad reputation for security. And if you don't want to have a lot of issues going from computer to computer to phone, you more than likely will do what many password managers suggest, which is storing your password data in the cloud, which is even more laughable, because now we've secured all of your accounts with a single password, and then put the data that password unlocks out on the Internet where anyone can try to crack it.

Which is to say, if you really want to manage your passwords, don't use a password manager. Use a scrap of paper in your wallet, or a notebook, or a sticky note. Because all of those are vastly less attackable than a password manager, because they require physical access or physical proximity and probably the will and risk of accosting your person to get. Password managers, on the other hand, are somehow both the stupidest security idea we've ever come up with, and the thing that every "security expert" currently recommends ad nauseum. I don't understand it at all.

Now, sure, all those accounts you don't care about, if you want to randomize their passwords and store them in a password manager and say it's "better" than using a handful of common low security passwords, more power to you. I'm going to say you're wasting your time and effort (and probably money), but you're not hurting anything.

The problem is when you entrust that same password manager to your high security accounts like your email, your banking, etc. Accounts that deserve far more security than a single point of failure with some cloud app written by some company that doesn't do much else.
I think you need to keep in mind a few things here:

1. Many of the things you mention are kinda complex, and many sites use CMS type setups/SaaS setups where the team creating the site doesn't have that much programming experience.

2. Browser support for novel authentication methods was lacking for a while. I read that Microsoft finally added functionality to Edge to integrate with the computer's login authentication setup, and some of the others are now doable with JavaScript, but they weren't practical there for a while.

3. Most people are still kinda confused about novel login methods, as mentioned in the article in the magic links section.
It's a JS framework that targets server-side (node.js), and is written in a language that is not natively supported - TypeScript, thus requiring transpilation right out the box to use. Does that seem odd to anyone else?

On the update: This does seem kinda neat, and certainly useful in some situations.
Internal issues I'm not comfortable talking about in depth. It was a combination of technical problems and political problems; I expect any specific person's opinion of the percentage breakdown of those factors depends a lot on which group they were in at the time.
"Google knows better than you" gives way too much credit IMHO. Google Search is nearly useless for my most searched topics today, and even dangerous in that it gives you a very wrong perception of what is out there.
Well, for one it's far more secure than password-based logins are. (No need to worry about weak passwords, brute-force attempts, credential stuffing, etc.)
It's been a while (~10 years) since I've had to deal with credit processing, but at least back then, discovers terms were pretty abusive for small businesses. In any month where we processed 1 or more discover transactions we had to pay a minimum fee of (iirc) $50. Given how relatively unpopular discover is the risk was just too high.
Well I face this everyday with apps in my TV and playstation. Want to log in to your EA sports account? Here is a keyboard and type away. I usually have to open 1Password, make the password's font giant, then proceed to type. Dreadful.
Just an opinion but this is fantastic tech, just lacks any humanoid resemblance, more like an industrial car factory assembly line. In the future of course, we will have humanoid robots that appeal to our emotions as well because why not?
My username/email address for my Google account is not a GMail address. I don't use GMail, and it would be ridiculous if I was forced to create a GMail address to be able to sign in to YouTube, etc.
Verbatim mode doesn't do the trick, though. It appears to be essentially the same as quoting your search string.
Because they most likely hussled someone in order to get their wad.

The average wealthy guy doesn't' become wealthy because they lived a Christian life?

I live in Marin County. I am surrounded by the wealthy. I can't think of one of the wealthy boys whom didn't screw over the little people on their way up. Their dad usually taught them well. That goes for taking advantage of the uninformed too.
Hello HN! This is both my first Show HN and my first post!

On Fridays, we tend to relax a bit more and share some music. SpotDJ was a fun little experiment to see if we could have an "Office DJ" with a live feeling, knowing everyone was listening to the same thing, even if they're remote.

I also want to have something small enough that I could focus really deep (for the small amount of time) on polishing the animations and UI, and play with some new (for me) tech.

The idea is this:

1. When you first go to SpotDJ, you're in DJ mode. Sign into Spotify, copy the DJ link at the bottom and share it with your friends (or coworkers in my case)

2. Anyone who visits that link and signs into Spotify with it will have their player synchronized with yours, including scrubbing!

It's built using ReasonML [0], ReactMotion [1] (though it's using StaggeredMotion instead of TransitionMotion, so that causes a lot of movement whenever a new track comes in. Need to fix this.), authenticates and controls Spotify via GraphQL [2], and sends synchronization messages via WebRTC (peerjs) [3]. It's the first time I got to go deep on various animation techniques, and I'll post a gory-details blog about my experiments later.

It's still rough, so I'd love to hear your feedback!

One thing I'd like to add is a "push-to-broadcast" button for the dj to be able to speak to all the listeners for the radio-like feeling. WebRTC should make that pretty easy, but I haven't gotten to it yet.

Also happy to answer questions!

Finally, today is my last internship, and I'm looking to join a company with a strong frontend and design team that also cares about tech. Consider this part of my CV :D

EDIT: Whoops, forgot to add a link to the source. https://github.com/OneGraph/onegraph-examples/tree/master/sp...

[0] https://reasonml.github.io

[1] https://github.com/chenglou/react-motion

[2] https://www.onegraph.com

[3] https://peerjs.com
> the banks jointly sold the company behind it, and now looks like some banks wants to let it die

There could be a dark brilliance to such a move. Want to raise your margins? Get paid to sell your low margin product, let it die, and get paid again when you raise your margins in the new market.
He gets to have the added insecurity if putting it on his clipboard for other programs to see on the way by.

/s

I actually can't imagine how it could be safer than having the password manager do it directly.
I have seen this on YT, but it's normally "CodysLab" and CodysBLab" or "VSauce" and "VSauce2" where it's very clear that the original channel and spinoff are related. Is this what you're talking about?
Speaking personally: I trust a random password per site more than I trust every site I use to handle my Google credentials correctly. Login with Google seems like it is begging for a phishing attack.
This is incorrect, employees have a workplace account for work.
Yes but those additions would’ve secured support for the deal to go through. That’s how it works: not a marshaling of principles but an exchange of met needs.

Edit: also as New Yorkers seems to be aware DeBlasio is fairly powerless in relation to the governor.
The few times I've seen this (Google and Amazon I think), my password manager (Lastpass) has had no problem, but I've run into several sites where simple two input and a button login forms don't autofill correctly. Usually the username field will get cleared when the password gets autofilled, so I have to manually paste the username.

I wish password managers would become popular with non-tech people already. I can't wait for a day where there's just a "Sign in manually" link for the few people that manage to remember their 1200 usernames/passwords. Password managers shouldn't need to rely on autofilling inputs at all.
Two indexes: the supplemental index (refreshed frequently) and the main index (refreshed less often). The latter is the one that wasn't refreshed for an unusually long period of time.
Assume things will be structured to favour the VC.
The software security crisis: evidence from the trenches
That's why you should turn off auto-fill.
You're combining numbers that should be used in isolation.

In a hypothetical world where the richest are only 10x richer than the other across the world, your $712 vs $62k data comparison simply doesn't exist.

Ultimately, my beef is with you making a straw man argument.
Normally when markets have so much unsold inventory, prices fall to clear it out. But prices can be "sticky" and won't go down. All this unsold inventory makes you wonder why the prices are so sticky.

Here you can see one reason:
"Shanghai homebuyers came out in droves to protest a developer's decision to cut prices in an apartment complex."

I'm sure there are others. Like if you're holding a loan for a giant apartment complex, and the owner cuts the price, it becomes immediately obvious that the loan is not going to be paid back in full. But say it's a 30-year loan: if you get the owner to keep the prices high and the units unsold a little long, maybe you can unload the loan onto some other bank or investor before the reckoning comes. Or maybe you're a bureaucrat who will be fired if the prices go down.

I have also heard that in China it can be difficult for person to rent out a vacant property. So people are holding onto empty units just as a store of value, like bars of gold.
Agreed. Modality isn't bad. The author's concerns about them can be boiled down to "make sure your login form has a URL".
why didn't you rant about it first, then,
AdmiralAsshat? (if you are so good)
> No, that's not how it worked

Yes, it is; Chromecast activation has always used the Chromecast itself as the WiFi host; you have to do that to even set it up to use another network.

> you got a code on the screen you could use to activate the device with google from any browser - much like many many many TV apps use (visit foo.com/activate and enter code NNNN).

TV apps can do that because the TV device is already configured to connect to a network. And both the app and your browser can connect to the same remote server. Chromecast activation can't work that way, since it occurs as a necessary prerequisite to connecting the Chromecast to a network.
> keep in mind that google removed the + operator, but you can achieve the same results using double quotation.

I can't. The plus operator meant the the word you applied it to must be in the search result. Quoting the word does not do this for me.
For the lazy: https://github.com/NaomiProject/Naomi
Not to me, if it's distributed on npm in its transpiled form it doesn't matter.
Thanks so much for this! Bookmarked for some cool tricks!
Unfortunately people who misunderstood Amazon wasn't being gifted $3B includes the recently elected congressperson for the area: https://mobile.twitter.com/qtrresearch/status/10961811573167...

EDIT: Congressperson for an adjacent area, not for that area.
Makes you use the password manager credentials to access your login credentials for other services. Works to stop nosy coworkers, siblings, spouses, etc.
These robots take the space of a human, but it isn't safe for a human to be in there at the same time as the robot. Plus, people can self-optimize. If you put another robot in there, it would barely increase throughput. Two humans would easily fit in that space, and they could roughly double throughput during peak hours.

Look to CafeX for a slightly different approach at the exact same concept. Except the whole coffee shop fits in a 2 meter cube.

Personally I think the most effective coffee machine won't even use these gigantic industrial robot arms. But they make for an entertaining gimmick.
They don't retain IP addresses beyond 48 hours but they may retain other information (permanently). For example, the domain requested, your ISP and your approximate location (city or region).

https://developers.google.com/speed/public-dns/privacy

So, while it can't be traced back to you, it is absolutely useful information for their business. Why do you think they offer the service? To be nice?
I don't get it. There have been fully-automatic, vending machine style espresso machines around for a long time. This seems to use technology suited for a different purpose; it's certainly a big robot, but it doesn't exactly seem good at making coffee.
Most HPC stuff likely (in my experience) fits this scenario.
Something that's always highly amusing is when people who have no idea who Paul Vixie is try to school him about anything DNS related...

Never fails to make me chuckle.
That is a very ugly solution in my opinion. TFA they set out to make a bit of performance art out of it with “machines operating machines” but the result is dystopian not beautiful. Seeing a robotic arm with n degrees of freedom which looks like it could weld cars just to move a coffee cup around in space...

And it probably makes terrible coffee. Notice the lack of late art, and the poor quality of the foam.
Email Pals: “It's faster than pen pals”
The consumer of the DNS is the Chromecast. Its preference is 8.8.8.8 .
So like with most ML/AI technologies, it's usually not the specific use case that is the most troubling. The most troubling is that everyone scanned are put into the database for later use or as training data.

So even if I'm not a stalker of Taylor Swift, I'm now part of ISM Connect's database, so when they release a "EnergyGuard" product, it will certainly recognize my face at an environmental protest at a coal power plant. And now they know that I'm a climate change advocate and I like Taylor Swift.

This kind of mapping is what scares me about ML/AI the most, where you pretty much have to collect, store, share, and map data that violates your Fourth Amendment rights (e.g. the "mosaic" principle of privacy from US v. Jones[1]).

[1]: https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
They are competitors, but it's not a zero sum game. There are plenty of consumers who have both.
Search something on google, on the results page click 'tools'>'all results'>'verbatim'

afaik putting a term in double quotes does the same thing but I am unsure if the implementation is really the same, the effect seems to be
Ask HN: How would you sort HN users by quality of comments?
Suppose you wanted to generate a list of HN users who consistently provide high-quality comments.

What metrics would you use to construct your formula?
I was getting insurance claim information from a large company in another state for a while. I finally made a big enough stink that they took my email off the account.

And yeah, I'm sure it was the real company and not some phishing emails.
A few historical notes: Paul Flaherty (1964-2006) was a principal engineer at the the Digital Equipment Network Research Laboratory. Paul is credited with having the idea for Alta Vista, but I think that it was Andy Freeman's sudden flash of insight that led to Paul's development.

Paul had been in Italy at a trade show; when he returned he talked with Brian Reid, who headed the Lab, about the need to find a demonstration project that showed off the top-of-the-line Alpha computers.

Paul and Andy and I used to have lunch together frequently. At one point, just after Paul returned from Italy, we were talking about Internet search at lunch. I'd been using the Magellan search engine and had some comments about how useful a better search engine would be.

Andy began talk about the problem and sketched out how a better search engine might work and how a web crawler could gather the information needed to do an index.

Paul listened and then went back to his office and enlisted Brian Reid's help in resourcing a search engine project. Brian got Louis Monier and Mike Burrows involved. The three of them did the hard work of reducing the concept to a real program running on an Alpha computer.

Alta Vista was an instant success with Alta Vista computers overflowing Paul's office and cluttering the hall nearby as the team worked to satisfy market demands for search.
From the security point of view, it means that it can be used execute code from user space. Just about anything that's Turing complete should be on someone's list of potential attack vectors.
I spent ~2 years in mainland China (Zhengzhou, where iPhones are assembled). The number of 15+ story apartment buildings along major freeways was astounding -- all of them seemingly empty.

When in China I was told this is driven by a combination of two things:

1. The average person in China does not believe in investing in intangible assets. This means the stock market is not appealing, so they all pile into the best physical investment around -- housing.

2. Owning your home and a car before marriage is considered 'mandatory' in traditional Chinese culture (for men). If you forego this you have what's known as a 'naked wedding' -- not good. Renting doesn't count.

Excess housing means the average rental yield (rent / property cost) is so low that it's not worth finding tenants. Examples include $300k condos renting for ~200 USD / month.
> More often than not, the first result for a given query on most common search engines is the correct, authoritative source for something.

I can't remember that happening in years with Google. Now, it's unusual if the thing I'm searching for even appears in the first page.
They'd do it the same way every web service since the beginning of the internet has done it.

"By using service X you are agreeing to be bound by the terms located at .... "
I'm a little confused by this. If the chromecast didn't know my wifi password, how could it connect to google to receive any information / configuration? Mostly commenting because I want to know if there's some cool mechanism for getting around that! Thanks!
That seems to add a lot of logic and interaction complexity to work around a problem that is only a problem for people who already have the technical skill to remap 8.8.8.8 to their preferred DNS server anyway.
I can't speak directly for the person you replied to, but it's almost certainly worth their while. We're not talking about $100-200 in potential benefits. We're talking about thousands of dollars (in the case of international business class seats).

The reason is because on the legacy airlines, international business class seats usually cost 4+ times more than the economy class seat on the same flight but you can redeem just 2-3 times more miles for a business class seat rather than a economy class seat.

One of the issues with this hobby is that the reward redemption flights are typically not as good as the non-redemption flights (i.e. you might have a layover as opposed to a direct flight).

---

For instance, the United/Lufthansa/Swiss alliance has flights from NYC to Paris departing May 27 and returning June 5.

Economy seats are ~$650 or (60k United miles + $105). For economy, those miles would have a valuation of ~$0.0091/mile (($650 - $105) / 60k miles). Chase somewhat regularly offers signup bonuses on their United credit cards of 70k United miles if you spend $3k within 3 months (you are charged a $95 annual fee in this case). So the ROI is ~$450 ($650 - $105 - $95) in exchange for spending $3k on that new credit card.

Business seats are ~$2900 or (140k United miles + $161). For business, those miles would have a valuation of ~$0.0196/mile (($2900 - $161) / 140k miles). The same Chase offer as before applies. But you have to open the card, meet the spending requirement, get the bonus, close the account, and reopen the account and repeat once more. The ROI in this case would be ~$2549 ($2900 - $161 - $95 - $95) if you spend $6k on those two new credit cards.

In either case, it shouldn't take you more than a ~10 hours of active work to get those kinds of returns. You do need to occasionally check the banks' websites to see if they're offering any special deals, occasionally check the airlines to see if there's any favorable redemptions available, etc. In the case of economy, the ROI is ~$45/hr. For business it's ~$255/hr.
was it ever considered to make altavista non-free ? even for advanced use-cases ? or follow google ads strategy ?

giving away a free demo of <company> prowess is cool, but it's a big reason for its death I guess
It obviously could have gone either way but given how adamant politicians were on guaranteed union jobs and Amazon's refusal to entertain the idea, I don't know what they would have been able to meet in the middle on.
Well, that's better though. So even if there's a key logger and mouse click recorder on your machine, one cannot recover your password. Though, if your machine is that compromised, might as well have a screen recorder, too. Though that would create more outgoing traffic.
I'm a fairly n00b-level hobbyist music producer, but I can take a stab.

I like thinking of the "stereo image" of a track as having 3 dimensions in physical space. If you imagine looking forward at a stereo system, left to right is the "pan" (how much of a signal is originating from the left vs. right speakers, with 50% each being dead center), volume of each track (or instrument) is how distant (or close) the sound is (you can imagine an individual instrument moving forwards toward you if louder, and vice versa), and the frequency (or pitch) is how high the track is (with lower pitch or frequency being at the floor).

When a mixing engineer "mixes" a track, each track (or instrument) tends to be: 1) adjusted to an appropriate volume relative to other tracks (forward/backward), panned or spread left/right (usually more stereo "width" on the higher frequency sounds), and "equalized" to narrow and manipulate the band of frequencies coming through to the master mix from that track (it's common to cut out some of the harmonics either side of the fundamental of one instrument to leave "space" for another instrument competing for the same frequency range).

So now, even with a final, mastered track, we could apply various filters to de-mix fairly easily if the mixing engineer has left a good amount of "space" in between the elements in this stereo image. If our bass is always under 150 Hz and every other element is above 200 Hz, a simple low pass will grab the bass (and likely also the kick drum, if there is one). But we could also use a "gate" to only allow a signal of a certain magnitude (volume) through to isolate that kick hit, or the inverse to exclude the kick and just get the bass sound. A band-pass could do a decent job on a guitar or vocal track, but will also grab background noise from other tracks sharing the same frequency range. More complicated techniques could be used to isolate things that have been panned left or right of center based on comparison between the left and right stereo channels of the mix.

These techniques won't be as universally useful as the approach in this article, but for certain tracks or sections of tracks, can give very good results very quickly. More tracks and effects like reverb and distortion make all of this more difficult to do with simpler techniques.