skysight-inc/HackerNews huggingface dataset:
As I'm currently working on possible options to expose on-device keys and cryptography for our open source FIDO2 key (SoloKeys) beyond the FIDO use case, I'd be curious about opinions on just exposing and using the PKCS#11 API (Cryptoki) [0] directly.

Envisioned setup would entail: download (custom) `libsolo-pk11.so`, generate RSA or ECDSA key on the USB key, get public key via `ssh-keygen -D libsolo-pk11.so`, use via `ssh -I libsolo-pk11.so user@example.com`.

The equivalent thing can be done for TPMs with simple-tpm-pk11 [1] today.

Technically, I'd extend the FIDO2 CTAPHID transport with "vendor commands" [2] mapping the basic Cryptoki API, and call that from the custom PKCS#11 shared library, which is then just a simple shim/wrapper. No additional drivers needed (everyone has HID).

Issues I can foresee: Users too attached to GPG workflow. Installation of custom shared library. No SSH support (via PKCS#11) for Ed25519 yet. SSH support for ECDSA only in about-to-be-released OpenSSH 8.0. Vanilla PuTTY on Windows has no PKCS#11 support. Bad rap of PKCS#11 due to existing vendors adding proprietary and closed source extensions. And the fact that SSH (currently) presents all keys to the host - I'd really like to be able to specify which key to use.

Personally, I'm a bit allergic to the GPG/PCSC/PIV/CCID way of doing things... My itch-to-scratch is just having a few keys off my computers (in particular, portable), and perform (infrequent) signatures on the separate device. And do this via a (comparatively) sane, open standard.

[0] http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs1...

[1] https://github.com/ThomasHabets/simple-tpm-pk11

[2] https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-cl...
If maximum (or just more) flexibility wrt memory safety is the goal, I might suggest the author take a look at SaferCPlusPlus. In particular, it supports memory safe pointer/references[1][2] that can target objects associated with different allocators (including stack allocated objects) without, as the author desires, imposing the "sometimes confining" restrictions that Rust does. And in terms of data race safety, it allows you to hold "read-lock" and "write-lock" pointer/references simultaneously in the same thread [3], which adds a little extra functionality (and maybe convenience).

[1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus#registered-...

[2] https://github.com/duneroadrunner/SaferCPlusPlus#norad-point...

[3] https://github.com/duneroadrunner/SaferCPlusPlus#tasyncshare...
The book still needs to be physically stored in an environment that prevents rapid decay (from humidity, vermin etc). And you do need to pay for that storage.
>So the fact that they don't like it and tend to oppose it doesn't mean they're inherently desiring to be corrupt or violent or bad cops.

But that fact is the seed that causes such corruption.
But this relies on associativity - without associativity, you just don't have a consistent definition of e.g. (a + b + c + d) but only, e.g.

+ + +
/ \ / \ / \
+ + a + a +
/ \ / \ / \ / \
a b c d + d b +
/ \ / \
b c c d

and others as well. There would be practically no point in trying to find a definition of "commutative" for these structures that don't involve associativity.
Interesting concept! This could also be cool for missed connections.

In lieu of the missed connection's email address, you could provide a few specific details about the encounter (choosing from prewritten options):

Time (options provided in 3-hour blocks ie 9am-12pm), name of neighborhood, city, your ethnicity (or some other easy personally identifying feature).

If the other person also goes on the site to submit a missed connection within a few days of yours and fills out the same details, they'll be prompted to answer the detail about your personally identifying feature to receive your message and relay email to respond to.

(Yes this would only work well if the website became widely known as the place to go to for private missed connections.)

Probably a few loopholes with this, just thinking out loud.
Yup, I will write up the algorithm some time soon.

I've seen Swift's intentions to add lifetime analysis to ARC, but from what I could see it is much more complicated in Swift, requires annotations, and with significant runtime overhead remaining.
> If you send hints like "someone wants to #reunite" I'm sure the recipient will accept just to find out who the person is regardless of what their offline intentions are. Since your identity is revealed anyway I don't see how this saves you from the perceived embarrassment of just asking the person directly.

The way hashtag-based hints work is that the recipient would only see that someone had a thought with that hashtag, not who. I don't know if that addresses your point exactly, but the recipient in this case doesn't necessarily know who wants to #reunite, it's not revealed just by clicking or anything. If they suspect someone specifically then it's up to them to guess essentially.
>Or don't post things that you'd be embarrassed to be associated with?

I can't predict what will be embarrassing or harmful for me to be associated with in ten years. The only way to be (sort of) sure would be to censor everything I say on the internet to be as inoffensive as possible to everyone, which would suck.
I know. But acknowledging that some glorified voodoo like Traditional Chinese Medicine is singlehandedly driving many species to extinction is merely acknowledging a well known fact.

Anyway, I lived in China for a while. The sale of endangered species is rampant and in open display all over the country. TCM is still a huge part of culture for much of the population, arguably more so than ever with the growing middle class. Even something as nonsensical as bear bile cough drops are as routine to many as something like taking Dayquil is to a westerner.
Not always a good idea.

Back in the 70s as the LGBT rights movement was beginning and being gay was still illegal, the Sydney Morning Herald published the names and addresses of those who marched in the first LGBT Mardi Gras, which became a riot after police became violent.

Some lost their jobs and were evicted. Many had problems for years after.
what's the process of restoring to a backup key in case this key is lost or destroyed in laundry for example
> > whereas in civil cases the plaintiff might have a more lenient burden of proof, such as the standard of “preponderance of the evidence”, which is the requirement that more than half of the evidence that is presented will support your case.

> What the fuck? This isn't right.

It's very close to correct; preponderance of the evidence is the dominant civil standard of proof in the US, though it is more accurately summarized as requiring that the trier of fact (jury or judge, depending on whether it is a jury trial or not) must find your claim to be more likely true than not based on the evidence. (“More than half of the evidence” sort of implies that it's just volume of evidence at issue, which is potentially misleading.)
You're using Venezuela as an example of the success of "real currencies" hahaha

Look at Bitcoin's yearly lows, and tell me more people aren't finding it useful every year. Again, YOU mentioned the Venezuela example, and IT IS BEING USED THERE. I never claimed it would save that country, nor have I heard anyone else make that claim. Clearly some people there find it more useful than other alternatives to their hyperinflationary fiat currency.

Bitcoin doesn't care about Venezuela nor any other specific use case. It keeps existing because people keep running the software. You can deny this, but there's no point being exasperated over it. Just let it go and concentrate on whatever you do care about.

But don't go around claiming fiat currencies are the final solution when situations like Venezuela are happening right before our eyes.
Arc isn’t that stuff, Arc is what it already does today. “Automatic reference counting.”
Carmine offers Clark the opportunity to make a lot of money just for running small errands. The first is to pick up a Komodo dragon from JFK Airport and transport it to a specific address.

https://en.wikipedia.org/wiki/The_Freshman_(1990_film)
I would love to see Keybase tackle this also. I expect it would be marginally less secure than the current nightmare but orders of magnitude more convenient.
My favorite Docker BuildKit feature is SSH agent forwarding. Add "--mount=type=ssh" after RUN commands in Dockerfiles and the command will use your host machine's SSH agent. I've been able to greatly simplify a lot of Dockerfiles and CI build processes using it.

There's a good introduction here: https://medium.com/@tonistiigi/build-secrets-and-ssh-forward...
Yeah but then you just write "#reunite" and the match is made and identity is revealed right?
Wow I had thought briefly of the "missed connection" case but never could work out the details. Your post makes me think there could be a way, if there were some standardized version of a "thought" that goes beyond the hashtag. Interesting. Thank you for jogging my brain a bit.
Config: Cloud native config management for go. Zero dependencies. Two line setup
Free suggested edits that you can use as you see fit (or not at all -- whatevs):

Sometimes you want to ask someone a question or tell them a secret and you suspect or hope they're thinking the same thing, but it's uncomfortable to bring up. This is what Thoughter is for!

And they don't even have to know Thoughter exists. You can send them a Hint. But more about that later.

Let's say it's the holidays and you and a loved one had a fight a while back. You aren't sure they would welcome hearing from you. You can send a Thought like "I miss you #reunite" that lasts one week. If your loved one sends the same sort of thing with a matching hashtag, you each get the other's email. If not, nothing happens.

This used to be done much more naturally back when people routinely lived in close-knit communities. People would ask a friend a question and that friend would ask their friend. Word traveled by the grapevine, which helped sort things out.

But in our increasingly mobile world, a lot of grapevines have basically died. This is your modern grapevine, now with Encryption!

Move: "The first project out of Aytwit's software research labs." to much later. Like close with it or something. It's important to you. It mostly isn't important to the process of getting adoption. Making it the first sentence amounts to "noise."
Woot Woot! Way to go Tom!!
I don't believe that list is accurate, the US abandoned construction of the two it was building [1]

Also, very few of the reactors on that list are in OECD countries.

[1] https://www.nytimes.com/2017/07/31/climate/nuclear-power-pro...
Very personal opinion and matter of taste: Many lambda syntaxes are a bit weird.

map(my_array)element:element*2 //lobster
my_array.map{|element|element*2} //ruby
Arrays.stream(my_array).map(element -> element*2).collect(something list something) //java?

Lobster feels a bit unbalanced. Ruby has "pipes" which are a bit confusing substitute parentheses. Java has the cool arrow syntax but otherwise it feels very glued on.
(edited and fixed, thanks for the comment)
I've actually since changed that to be more conventional. Now the "inline" by-value objects are called "structs" and the regular by reference objects are called "classes" much like C#
> If this is indeed what is announced, I sincerely hope the responsible parties for making the decision to go through with MCAS in this way are paid well in jail time.

I'm sorry, but your wording sounds like you're advocating taking revenge on engineers / managers for poor decisions made in good faith. That's barbaric, and I hope we as a society move beyond this sort of communal revenge. We'll all be psychologically better off if we encourage more healthy ways of seeking relief from tragedy.
The article starts by saying that inviting the government to arbitrate is a legal and ethical nightmare, and establishing a third party is offloading corporate responsibility. It finishes saying that it's rarely a good idea to outsource regulation to the enterprise that needs it. So which is it? Gov regulation is no good, and self regulation is no good!
I apologize if I've read too much into your comments, but I think you're the one making estimates replacing everyone's housing? It's certainly not something I'm suggesting.
That is awesome and fascinating at the same time. I genuinely hope you make a dent in the universe and succeed. I hope you post an update with your success dealing something out the door and dealing with the NRC.
Yes! DRM is not about piracy, it is about CONTROLLING HOW YOU WATCH. Exclusive deals, upsells, ads and devices.
Yes, and it could be viable for short flights with mountains between, where it's hard to build high speed rail, like flights LA<->Las Vegas.
The recipient of the hint #reunite has to guess the identity of the person who sent the hint. It is never simply revealed in this case. To add to the confusion ;) there is another type of hint that only reveals the identity and not the hashtag.
> they all fall or become obsolete.

I was in this industry through all of that. It takes a long time for a company to fall that far. Yes, given enough time anything can happen, but I'm not interested in tautologies. In any time span relevant to this conversation, it's not going to happen. If you want to claim otherwise, that's your burden not mine.

> "we've ended our policy of treating users as the product."

OK, so I guess there is that one unrealistic possibility. Even if Facebook moved to a subscription model, "treating users as the product" is not a phrase they'd use for what came before. So you still haven't indicated that you'd be satisfied by anything that could actually happen.

> You're repeating this rhetorical question

It's not a rhetorical question if there are multiple valid answers, and repeating a question is still better than repeating statements based on counterfactual assumptions. If you want to play "high school debate champion" you'll have to try harder.
> "Let me restate that important point. No matter what the technology, a sustained 2.3% energy growth rate would require us to produce as much energy as the entire sun within 1400 years."

1400 years seems like a perfectly reasonable timeframe to develop into a Kardashev II civilization.
Whoever does this -> I would love for the ability to backup my ssh and gpg keys using backup words, similar to what cryptocurrency wallets use (24 words that are used to define the entropy).
$35k/each offers you some capital expenditure for capturing. I'm sure it's not much different than capturing alligators and other dangerous animals.
I would recommend checking out the guidance and tips pages from the Building Science Corporation [0]

[0]https://www.buildingscience.com/
Turn a Vacation into a Treasure Hunt with Just Your Phone
> The only issue here being that you don't consider a non-absolute basis to be valid.

Well, it's not just me. A lot of people have, going back at least to Plato. Plato thought that you needed to have something absolute for there to be morals, but his problem was that his gods weren't big enough to proved that.

> However, the deity of choice isn't absolute either - you have to deem it so in the same way that the atheist does.

Yes and no. Yes, you have to deem the Christian God, say, to be absolute in order for Him to provide an absolute basis for your morals. (This is true whether or not that God exists.)

But the Christian is not in the same position as either Plato or the atheist. Within the Christian's position, God is absolute, and therefore can provide a rock-solid basis for a moral standard. In contrast, Plato's gods were inadequate as a moral basis, both in theory and in practice (that is, in practice they often behaved in ways that were not very moral).

The atheist has an absolute (at least, I think most atheists do) - the physical universe. Within (most flavors of) atheism, that's the only thing that can be really absolute, but it provides no moral standard whatsoever. (C. S. Lewis remarked that "what the universe is doing" is working toward the final and irreversible extinction of all life forms, and taking that as a moral standard would leave suicide and genocide as our only moral values. It seems better to just say "there's no moral standard there".) The atheist can pick a different basis for a moral standard and ascribe validity to it - say, the human race, or the atheist's society, or whatever. But the atheist has made a somewhat arbitrary choice - there's nothing within the atheist's position that compels that particular choice of moral basis. What's more, the atheist knows it. This is very different from the Christian's position, where there is one clear moral basis that can only be accepted or rejected.
Please pretty please open source plottool
No, you’re making an incorrect extrapolation. Obviously there’s a minimum number of features for readability. Example: dictionaries use a core of a few thousand words. Yes, they could use less or more, but it’s an optimization. Obviously a language that doesn’t allow sufficient expression isn’t easy to use either. But still, the more rules, the more you have to learn and that means harder to read in that respect.
I'm amazed this is so complicated. I recently used https://github.com/sekey/sekey to set up SSH with TouchID on a mac, and was really surprised how simple it was.
I agree. Especially in a cave where frantic movements could kick up sediment and block visibility. Definitely a pragmatic move but probably the right choice.
GPS Rollover Event May Cause Devices, Systems to Go Haywire
Vogtle is still underway, as another poster pointed out.
Mentour Pilot (as others have mentioned in various other comments) does a great job explaining this.

On the 737 the trim adjusts the entire rear stabilizer (the entire horizontal structure of the tail), while the elevator is a sub-component of that stabilizer.

So, when you adjust the trim, it's a much larger surface area that is moving. Ultimately, the stabilizer just has more aerodynamic control that the elevator, due to the larger surface area.

I have no idea why the design is that way, though.
Thank you for taking the time to do that. I hope you don't mind, I may have to steal some of that when I eventually do some tweaks to make it more modern. :)
The "something" is almost certainly entering the text/data into their database.
> What do you believe are some examples of things that are over regulated?

Ok, this is a very good question.

Thinking about it, I cannot think of any area I know about that is regulated, as a baseline, too much for my taste.

BUT:

E.g. 2 years ago I thought that the logs of my app (whiĉh is SOX-relevant - https://en.wikipedia.org/wiki/Sarbanes%E2%80%93Oxley_Act ) weren't nice, so after talking to the other team members I slightly changed them to e.g. align strings (using tabs instead of fixed chars) and posting more informative/detailed messages.

When the auditors performed their review they saw that the new logs did not match the old ones (aaargh - string mismatch!!!) therefore we had to go over each change, checking why-it-was-done-by-whom-based_on_which_request_and_did_it_get_the_approval_to_go_live_and_was_it_reviewed_and_signed_off_by_business_after_go_live etc..., so an infinite pain. This is what over-regulation means technically for me :)
> Smartphones are equally as portable, too—but it’s hard to argue that they’re even half as lovely.

Actually, why not? You could find an endearing custom printed case, and to an extent personalize the software in a lovely and unique way.

Is the problem that they're not rare/irreproducible enough to be a collector's item? If so, will we eventually see collectors obsess over out of production phones?
I'm aware of that, I said "add lifetime analysis to ARC", as in, ARC is what I call regular runtime reference counting, and with lifetime analysis some of it can move to compile time.
Almost all americans shop at supermarkets. There they can buy anything they want. Seems to be equal temptation yet the results can vary alot.
That was neither "us trying data ownership" or "society rejecting it".

That was tech titans smearing each other with feces, trying to dodge responsibility for tracking teenagers as if they (companies) were pedophiles in power.

Besides, Apple? Is almost always on the side of themselves as brokers of your data.
Grid isn't supported on some web view's in Elo Android devices we deploy to...
Oops! Second attempt: looks like they single out "stack underflow" as implementation-defined behaviour:

> A system shall document the system action taken upon each of the general or specific
ambiguous conditions identified in this Standard.

So, essentially the opposite of what I said.
>Turn on the printing press

This is nothing more than a form of taxation.
I was going to respond to parent but you brought up the point I was going to bring attention to: requiring anyone to forget/destroy/not disseminate information is an infringement on their liberty. While I understand that we do have laws that attempt to stop the intentional, public dissemination of false information, I think the focus (in relation to privacy) should be more on creating an environment where people can choose to prevent the release of that information in the first place and less on restricting what it can he used for.
I was replying to Tharkun's comment that upgrading housing to PassivHaus standards could "solve" the problem of generating energy for heating. It does no such thing unless you actually upgrade the housing, and there's a lot of housing in the world.
Original source, much better info + technical details: https://www.microsoft.com/security/blog/2019/03/25/from-aler...
It's funny how in those days XML was also short hand for "make way guys, this is the future".

I thought it was a really overhyped and ugly way to represent data, but this did not seem like a popular thing to express. In retrospect, standardizing on something was probably a good thing for the time though.
It's not that simple. There's no denying that there was tremendous commercial pressure, but ... from a single data point (prior to the second crash), it wasn't obvious that the risk of continuing to fly the aircraft was greater than grounding the planes, which results in cancelled flights and greater risk of road deaths due to some passengers taking road alternatives instead of re-booking flights. Also, the 737 MAX is a longer-range aircraft, and some of the slack would be taken up by capacity in shorter-range aircraft, converting direct flights to multi-leg flights, where most of the risk is in takeoff and landing. All else being equal, more flight legs means more risk. Some of the slack would be taken up by smaller regional airlines flying older planes, and I'm not sure how those safety records generally compare to larger airlines flying newer planes. In any case, I expect the majority of the offsetting risk would be from people deciding to drive when their flights got cancelled.

Now that we see that training and procedural changes appear to be a less effective mitigant than expected, we can say that with a high degree of certainty that the risk of increased road deaths does not offset the risks of continuing to fly the aircraft.
Better article: https://www.microsoft.com/security/blog/2019/03/25/from-aler...