skysight-inc/HackerNews huggingface dataset:
Good point. The EFF has made and published three lists of words to use that are easy to spell and generally easy to remember.

I wrote a command-line tool in Rust for generating passphrase using these wordlists. I use it myself any time I need a password.

My tool is fast, free of charge, open source and it can also tell you the entropy that will result for any given choice of number of words.

For example let’s say I want it to give me four words from the long wordlist, and I want to know how many bits of entropy this corresponds to.

pgen -l -n 4 -e

Current settings will create passphrases with 51.70 bits of entropy.

51.70 bits of entropy.

What does that mean, you might ask.

The Wikipedia article on password strength (https://en.wikipedia.org/wiki/Password_strength) explains it well:

> A password with an entropy of 42 bits calculated in this way would be as strong as a string of 42 bits chosen randomly, for example by a fair coin toss. Put another way, a password with an entropy of 42 bits would require 2^42 (4,398,046,511,104) attempts to exhaust all possibilities during a brute force search. Thus, by increasing the entropy of the password by one bit the number of guesses required doubles, making an attacker's task twice as difficult. On average, an attacker will have to try half the possible number of passwords before finding the correct one.

Ok, so how good is 51.70 bits of entropy, you ask?

Wikipedia, same article again:

> The minimum number of bits of entropy needed for a password depends on the threat model for the given application. [...] RFC 4086, "Randomness Requirements for Security", presents some example threat models and how to calculate the entropy desired for each one. Their answers vary between 29 bits of entropy needed if only online attacks are expected, and up to 96 bits of entropy needed for important cryptographic keys used in applications like encryption where the password or key needs to be secure for a long period of time and stretching isn't applicable.

So let's say that you are satisfied with 51.70 bits of entropy in this case. What does a password like that look like? Let's generate one.

pgen -l -n 4

plastic case refocus demise

Pretty memorable if you ask me :)

Oh yeah, and about the claim that it's fast. Just how fast is it? Have a look.

time pgen -l -n 4

browbeat hummus sandbox unfixable

real 0m0.005s
user 0m0.001s
sys 0m0.006s

That's 5 milliseconds.

But hey, let's say we wanted to generate a bunch of passphrases at once.

How much time does it take to generate 10.000 passphrases and dump them into a text file?

time pgen -l -n 4 -k 10000 > 10k.txt

real 0m0.132s
user 0m0.073s
sys 0m0.058s

About zero point one seconds. Not that generating 10.000 passphrases is something that you are likely to do, but it just speaks to how fast this tool is ^^

Source and instructions on how to install it are on GitHub.

https://github.com/ctsrc/Pgen
Settings -> In list of links on the right, Your Facebook Information -> Access Your Information -> At the bottom, Information About You -> Ads
I know everyone love to hate on the industry but I think with such firepower, I'd go for a "takeover" of the 3rd parties (read middle men) in Online Advertising.
You probably have decent capabilities to detect fraud while building a privacy minded tracking system where the user can manage its personas.

While the ITP (Safari's -and maybe Chrome soon-- attempt to regulate tracking) initiative is on paper a good idea, I'm not convinced it's going to deliver.

Barging in with an OpenRTB v4 (current version is V3) that delivers on that - and maybe cut the middle men, that could be neat for every one : publishers, consummers and advertisers.
> with your interpretation of the "truth".

And we've come full circle back to bias.
> But while the massive media blitz on the GDPR makes it appear terrifying; it doesn't magically grant jurisdiction over a local west virginia site. The enforcement agency isn't likely to bother, because they have no means to enforce any sanction.

Yeah, they do. The EU issues them a fine, and they don't pay. Okay, nothing happens to them. But now if any of the the executives or board members or anyone else who can be held liable for their failure to pay the fine can never visit an EU country without fear of being held accountable for their failure to pay that fine.

>Is a west virginia site "established" in the EU? That's dubious enough that I doubt they need to worry - for now.

This is false. GDPR applies to any company that collects data on customers in the US. If you run a site, and an EU user connects to it then GDPR mandates that you follow the GDPR rules for that EU user. [1] This is pretty screwed when you really think about it. Can Saudi Arabia outlaw Facebook from letting Saudi women post profiles without Burkas? Can they outlaw Facebook from allowing Saudi users from blaspheming Islam? Granted in practice, US companies are probably just going to tell the Saudis to eat shit. But that introduces the other gnarly question: which countries or pan-national organizations do have the right to govern beyond their borders (and, crucially, why do they get to do this and not others)?

1. https://www.forbes.com/sites/forbestechcouncil/2017/12/04/ye... I confirmed this for myself in the GDPR text. If you insist, I'll dig it up for you.

> All in all: this sounds like an overreaction. Maybe it's a cultural thing too; lawsuits with huge punitive fines are much more common in the US, so the habit of avoiding liability is perhaps more deeply ingrained. But again, the risk seems trivial. And you know, if you don't care about overseas readers, would it kill you to be so polite as to say so? It currently says only: "Our European visitors are important to us. This site is currently unavailable to visitors from the European Economic Area while we work to ensure your data is protected in accordance with applicable EU laws." That's just a lie, likely both parts of it.

It's pretty clear that the EU wants tech companies, especially American ones, to bleed. Headline after headline in European articles from the Economist to The Guardian and others are calling for fines against American tech companies. You're right that showing a message, "This site is currently unavailable to visitors from the European Economic Area while we work to ensure your data is protected in accordance with applicable EU laws" is misleading. It should really read, "Your government has instituted vague and overly broad regulation on data collection which, coupled with a hostile attitude towards American tech companies, makes us unwilling to serve EU visitors".
Would you accept this “bug” if it happened every 1 in 10,000 times? 1 in 10,000,000? Obviously not a desirable outcome but let’s be precise about what our acceptable tolerances are for errors. It’s unrealistic in any complex system to have an absolute 0 error rate.
Maybe this concept should just get rid of the CTO aspect and position it as the "SaaS security checklist".

Then gamify it so that all the technical people in the team can each give their independent rating of how the company performs on each checklist item.

Then give each checklist item and owner and assign action items, status and followup discussion.

The outcome of that is something the CTO would be interested in because it would be a dashboard with accountability.
Because it causes every website to non stop nag you with captchas and half of websites to change time zones to something not useful for you.
Agreed. It's not likely to be handled so directly, but the people who do this negotiation are well able to make the point without saying the words. If chess was a good analog to the wars of old, poker is a more fitting analog to diplomacy today.
They actually increased the password strength recommendations in the newest guidelines. Length counts more towards the security of the password than character classes which was increased.

Even without MFA the lack of password expiration is still considered best practice. It's not just parroting.

Separately though applying MFA anywhere possible is a best practice and should be separately encouraged from the strength and rotation policies.
Pica?

https://en.wikipedia.org/wiki/Pica_(disorder)
If Cloudflare wants to branch out, here're an idea.

Global Memcached or Redis. Support caches near the edges. SPA or apps running on a client's browser/machine can use the one nearby. Support pre-populating/warm-up the caches in batch.
Ruby 2.7.0-Preview1 Released
On HN you'll get a lopsided response to this because smart guys think Google is evil.

I'm not that smart, so I think Google is far more trustworthy than the other sharks out there.

Even though I trust Google more than most, and I don't think using Google auth is a security or privacy risk, and Google auth is almost certainly more secure than bespoke auth, most regular people probably aren't clear on how this works.

They might be reluctant to type in their Google password on what looks to them like a third-party site.
Just speaking for myself: I don't need the Mac App ecosystem to be revitalized, thank you very much. It's done fine without appstore/itunes since its inception, and as far as I am concerned, "app" quality has gone down since programs were called "apps".

Now get off my lawn!
the assumption is you do not come up with your own words, and pick words at random from the whole dictionary.
Actually, there is another vendor. A new one - www.logicalclocks.com - we are selling a next-generation version of Hadoop, with consistent distributed metadata for HDFS, it's built on TLS/SSL (not kerberos), and it's laser focussed on Data Science. We have customers with racks with 10s of GPUs training models with 10s of TBs of feature data. And we also built the industry's first enterprise feature store for ML on this platform.

References:

https://www.logicalclocks.com/feature-store/

https://www.logicalclocks.com/introducing-hops-hadoop/
Look into Browserpass..

Or Enpass, or if you still want free then Bitwarden.
I need a name for our internal Gitea instance, do you mind if I grab this idea? Haha.

* gitgit.at — as in, gitgit.at/username/
* gitgit.dev
* gitgit.ist — sounds funny
Why the downvote? This is just my opinion. I wasn't saying the parent was wrong, this is just my take on it. I'd like to hear some thoughts on people's experience in this area rather than just be downvoted.
I disagree. You accept his blog post as an essay and in those terms I'll agree, you can see a thesis in there.

But it's not an essay. It's a blog post. There are no references or sources. There is no way for you to take that post and research the underpinnings of its conclusion. It is wholly self-referential.

The original post is a hot-take, it's pure opinion. It's not even a noteworthy post, it's just part of the Svtble echo chamber and has inflated worth.

There is no essay in either the original post or the apology for it, and similarly so there is no thesis. Language changes and a thesis now is commonly accepted as a significant body of work with academic significance and a grounding in empiricism or at least extensive research.

Going back to the Ancient Greek (and beyond) roots of 'thesis' to claim an innocent usage of the term is a monumental stretch.
Holy shit I had no idea! I was tired of Chrome's bookmark manager hijacking CTRL + F. I'll use CTRL + G from now on!
The only non-core-business work that I really want from Cloudflare is to do something with LuaJIT stewardship, because I thought they were supposed to be taking the helm and the official GitHub repo is basically completely dead.
No, Firefox forgot to renew their certificates and it broke all extensions.
That extension has been dead for over a year.

For it to work on future macOS versions, the developers would need to convert it to a Safari App Extension and cough up $99/year. They’re not interested.
Microcontroller-based system makes NYC fashion runway debut
G20 countries eye tax policy for internet giants: Nikkei
It is well documented that Tesla regulary releases features which make wrong decisions and put drivers into dangerous situations. Last case happened literally 5 days ago and already well-documented by Tesla owners (and not some imaginary evil short-sellers):

1. https://np.reddit.com/r/teslamotors/comments/burimz/psa_emer...

2. https://np.reddit.com/r/teslamotors/comments/bulra4/emergenc...

3. https://teslamotorsclub.com/tmc/threads/emergency-lane-depar...

It worth mentioning that this feature, called ELD, can't be disabled permanently and enables itself back again after each trip. Driver is expected to disable it manually each time. Also, this feature could kick in anytime, even when driver is actively steering!

So, maybe author was wrong when he mentioned his kid, but his point is essentially correct.

How is this behaviour OK on a public road -- "I made it half way into the shoulder and the emergency lane departure kicked in a yanked me back into the lane, almost hitting the car I was passing as I fought with the automatic steering"?
> So I would be surprised if there is any federal form that requires you to put the "city" you live in, outside the context of a USPS address.

Forms that ask for separate physical and mailing addresses often use the shape of a USPS address for the physical address (including ZIP code), even though many of the fields may not apply. “Physical locations all have addresses shaped like postal addresses” is a common belief that is often reflected in form (and software/DB) design.
If the app is open source (or at least the source code is accessible), the user would proceed to the source repo, clone it, open the Xcode project and relink to the framework version of their choice.

Others have pointed out how it could work with closed source apps. It's a bit more complicated, but it certainly is possible.
The HN objection is more likely to be the privacy/tracking implications of logging in with Google than that Google is evil, in my experience
You have to read that comment from a long-time Microsoft developer : https://forums.theregister.co.uk/forum/all/2019/05/24/github...
This 100%.

I have a complicated google password - I use it no where else. I have a security key. In 12 years I've NEVER had to change my google account password AND I have not been hacked. This works well. Because google is resistant to brute force I don't even bother adding tons of weird special characters.

I worked at a govt related agency. They had to change passwords every 30 days and there was a dual password requirement (one to login to the VPN, the next for the app). Result?

- Many folks used a shared account with a public password emailed out every 30 days so everyone else did not have to deal with all the hassles of the password expiration dance. It was also super hard to onboard anyone new (ie, 3-4 months for staff with 12 month projects) This account ended up posted next to every computer.

The idea that making security so user unfriendly will makes folks like and use security is a ridiculous approach.

- Rate limit attempts
- Block after 4 tries for an hour, after 8 tries till a reset
- Screen against password lists
- Screen out other obviously bad (ie, too short etc).
- Allow hardware 2fa BUT allow staff to validate computer.

This alone gets you a ton of mileage
When was the last time you bought a MapR license to use it in a cloud?

When MapR was selling them the M5 and M7 were deployed in a data center on servers.
Do you say your opinion has a good thesis? Or are you checking up on the dictionary to see the traditional definition?

In any case, it's high flung language for a blog.
Yes, I was attracted to it. If nothing else, it made my Python skills that much fuller.

Its never something I wanted to turn into a reusable solution though. I have 3 of these right now, each time, I took the old one as a starting point, and then changed to match the newer needs (and only those specific needs) and maybe whatever was my latest approach to solving.

For me, the utmost guiding principle has been to keep them simple so that someone can casually tweak/change it with not too much work.

I've worked in automation (food processing, nuclear manufacturing, and agriculture) for a lot of years. One thing I've discovered is that while you can automate everything in the real world, there really are some parts of the process where an adaptable human being is the best tool for that particular part of the process. I've viewed these efforts in a similar vein.
How to Size and Assess Teams from an Eng Lead at Stripe, Uber and Digg
No, netflix isn't side loading apps. They are asking you sign up for the service on their site, not through the app to avoid having to pay Apple the 30%. A user still must get the app through the app store. There is no way to get an app on the phone that is not signed by apple..
Well for wiki, usually a branch containing markdown will transfer well across forges. Issues and PRs are the real issue. I’ve been hoping git appraise would get supported by the forges for distributed PRs, but it doesn’t look like that’ll happen.

Gitlab is implementing MRs via git send-email though, which is part of an epic to federate Merge Requests: https://gitlab.com/groups/gitlab-org/-/epics/260 .
To add another point, not only does this Steven-Pinkerism or whatever name this ideology deserves ignore tail risk, it also fails to analyse things from any point of view that isn't ten mile birds-eye utilitarianism.

The primary motivation behind terrorism, is as the name suggests, not material violence but psychological damage and attack on the nerve centers and political systems and ideologies of targets. The physical violence is only secondary and a tool. So to evaluate terrorism in terms of body count, and not generated fear, is quite myopic.

It also of course ignores that systems aren't uniform and can take blows at any point with equal consequence. Terrorism at a political focal point of 10k people can collapse a nation state a thousand times as large, ask Franz Ferdinand and Europe. The effects aren't linear.

It's quite frightening to see how shallow and superficial the analysis of people has become who are apparently in charge of our institutions, because this thinking is extremely prevalent.
less do it pm me - i'm SWE at a company in town.
Thanks for taking the time! Its fascinating learning about this in an area (storage) I know nothing about.
Decentralized SCM features for issues, CI, etc. GitLab is great but it is still mostly centralized. Creating a modern connector for IPFS would be awesome.
I was referring more to relative passivity rather than income potential, but I haven't written one myself and I'm not too sure whether it's worth pursuing at all if your goal is money so I'll take your word for it.
AKA the old bait and switch! Well I've been needing a reason to finally make the full switch to firefox ( the containers were already compelling )
LG is the only supplier of apps for their TVs and forbids any competition there.
No. It reflects what we are worried about dying from.

Instead of

<likelihood of thing being in the news> = f(<probability of dying from thing>)

It's more like:

<likelihood of thing being in the news> = f(<probability of dying from thing>) * g(<scariness of dying from thing>)
I feel problem definition is underappreciated in current ml world and the effort is put into the ml methods. People has been able to tackle almost any problem well defined but these are usually simple in comparison to true ai so we still get "stupid" agents. What problem is the test to true ai?
"However, a recent analysis of the current situation published by Barrons suggests that alternative sourcing and better management of supply chains in the rare-earth industry could help U.S. companies ward off a potential crisis"

Is buried at the end of the article as it undermines the whole clickbait premise.
> At the top left of your Firefox browser, you will see an icon that looks like an i inside a circle. Click on it and then click on Content Blocking

...did anyone figure out what the hell that is supposed to be, or look like? Why wouldn't they just put a screenshot.

Apparently they just mean the security settings and selecting Custom in those. Except it's on the right. And it's stripes, not a circle. shrug
But doesn’t that mess up the order of reverse-i-search?
There are non-complex python libraries on pypi that can be brought to bear on the problem.
With some light glue code:
https://gist.github.com/iiie/33314479f2d84db9285c4e3e0921de0...
Worse yet, if more than 80% of new cars provide an imitation, and the market is chasing trends that move more vehicles and make closing a sale easier, the touch screens that do land in the field are low quality.

They are slow to render, low resolution, suffer from target calibration problems, and lack novel utility (mostly they're just music interfaces or lame geolocating/navigation systems, plus useless feature padding that feels like afterthoughts).

Sometime the lag on button presses will lock up for not just tens of seconds but even minutes, with no way to escape the frozen system, and kill any stuck process. Sometime lag persists even when the car is turned off, powered down and after the keys were removed from the ignition. Sometimes lag occurs when volume is too loud, or during an inappropriate song or annoying commercial, which really kind of sucks.

The systems are neither robust nor durable. They seem to get clogged by over indexing map details and music libraries, for starters. Media files with artist photos embedded as cover are seem to get cached and never evict to release memory.

All of this means a touch screen is going to rot and become unusable over any amount of time, in most vehicles. Even to the point that firmware patches probably won't help because the hardware resources are usually underpowered, and fail to fit intended application requirements.
It's more subtle than that. For any given technique used to illustrate a scene, you could come up with a means of automating it, and those means are employed by professional artists on the regular, from rulers to draw straight lines up through 3D modelling software. A lot of finished work will go between the sketchbook and the computer and then back again to iterate on technical elements like proportioning and perspective.

But what you cannot automate is the design work that puts together each of those techniques. You have to decide: how much detail to add? What are the spatial relationships? What will my light values and colors communicate? What shapes and forms should be given emphasis?

And then at the level of storytelling, all the considerations around plotting and characterization; the themes of the story and how scenes develop to express those themes, and how that translates into imagery and the physical description of a character.

Working on commercial art today is much more about these kinds of conceptual distinctions than about the quality of traditional pen-to-paper drafting skills. If you know how to pull out those techniques through automation, you can still get a satisfying result. But getting the "eye" for knowing what is possible still needs training.
Because those opinions are not being banned by existing social media platforms. Whereas so-called "fascists" (who are not really fascists) are.

No one is banning those opinions on gab, there is simply no point in them being there because they are free to post those opinions on twitter (and others) with impunity.
You’re assuming United States production facilities can just push a button and they all turn on. Or that you can take what’s being produced in China and just automatically produce it here?