skysight-inc/HackerNews huggingface dataset:
Firstly, great writing. Secondly, magic proxies are awesome. And pyca/cryptography instead of something terrible like pycryptodome! All great stuff.

Some critique of the crypto bits, since I'm a crypto person.

1. Do you actually need asymmetric cryptography for this? It seems like at some point the proxy has full authority, and it could just encrypt the token for you symmetrically? (This is valuable because symmetric crypto is a lot less precarious than asymmetric crypto, see next point)

2. Please don't use PKCS1v15 padding for encryption in new systems. It's been known to be busted for about 20 years now. We have workarounds, and they may well be deployed in the exact context you're using it. But they keep breaking, because we just have them to keep the infinite amount of already-deployed software running, not because we think it's fundamentally fixable. This is also the textbook example of a vulnerable service: one that takes ciphertexts and decrypts them on demand. With PKCSv15, I can modify the ciphertext so that _the way you treat the modified ciphertext_ tells me something about how to make private key operations. And in this setup, that means I get the real token, so that sounds bad. The good news is that you've successfully designed around it by adding a signature, so I don't think it's mountable... but. Please, no more PKCS1v15 :-(

3. It feels a little awkward to use JWT for the outside signature but not the inside encryption. But less JWT is a good thing :)

Concrete suggestion: use Fernet (you're already using pyca/cryptography) or libsodium's secretbox and then all of the crypto problems go away. You keep the security engineering dilemma of stateful v stateless proxy (do I want the real token in the proxy at all?) -- but that's another argument.
Congrats on the book Yehonathan! I remember meeting you at ClojuTre some years ago, nice to see you're keeping up the good work!
In my experience, your statement is true when writing library code or tests that don't need to mock lots of objects.

Unfortunately, Unit testing becomes highly coupled when testing classes in the standard web architecture. A service class you're testing can depend on other service classes, a DAO, and potentially other web services, so now you're left mocking all those other classes if you want to create a Unit test instead of an integration test. Since the external dependencies have been mocked out, now the Unit test is higly coupled to the implementation and is a PITA to change the implmentation of the test or the code implementation. I suspect that's why OP prefers integration testing, as it helps keep the test less coupled from the implementation.
I mean, Bill wasn't really wrong. Just maybe naive?

People have been lying/wrong in print forever. This is not new [0]. What's new is the vast amount of information. He was definitely correct with "for all practical purposes there'll be an infinite amount of text".

What he got wrong is that he seemed to have expected these "referees" to grow vertically when they grew horizontally. Instead of multiple levels of referees filtering the output of one another, we ended up with a few players that vastly outpaced the rest [1].

The rest is the same thing that happens anytime you have a monopoly or relatively few big players. The big players get bigger and bigger. The barrier to entry grows with them. Before long, they control the space.

That space includes the information and the flow of information within it. Sure, they don't have perfect control, but they control enough of it to shape it to however they need (Facebook is a great example of this).

Today, we can all rattle off maybe a dozen companies that clearly control the internet. It is not the wild west anymore. There is the odd exception that might wrestle control of a niche space for a while (e.g. GitHub, Reddit), but once they get big enough to show up on Google's [2] radar, they're bought, threatened, replaced, or somehow otherwise removed.

And then there are things like analytics.

[0]: No, I don't have a source or example, but surely I don't need it to say "somebody has lied in a book or newspaper before".

[1]: Namely, Google.

[2]: Or some other Big Internet Company™.
you know that content (specially well made content on youtube) is not free right? content creators spend money to create stuff for you to see.

so now, they need to recoup the money, or even better, earn a living through content they create. that's done either by ads, youtube premium or stuff like patreon.

would prefer that your favorite content creators stopped doing stuff you like because they can't earn a single cent on stuff they do?
I completly agree with yoghtos.
One of the main reasons, Clojure is not as famous as it could be in the developer community, because it has a reputation of a language that is hard to learn.
I hope that my book will attract many non-Clojure devs inside our wonderful Clojure community.
I personally use NetGuard which is free and open source. It works by setting up a vpn locally combined with a hosts file to send ad requests to a blackhole. This works on the Web and in apps. Follow this guide here: https://github.com/M66B/NetGuard/blob/master/ADBLOCKING.md
Most of my career has been spent building web apps in Rails, Node, a smattering of python frameworks.

Python is pretty great, but the fragmentation of the ecosystem puts it behind Rails imho.

Node is a constant headache and I have seen it be the death of more than one startup. Unless you are using a typed version of JS it is going to be a problem, I can guarantee it.

Rails kinda just works. It isn't as performant as I would like, but for the overwhelming majority of web apps that isn't an issue.

I know it can be hard to find rails devs, so just make them. Hire competent CS grads and train them. If they actually earned their degree it will be easy.

If you are in an executive role at a startup building a web app and optimizing for team velocity it is always in your interests to choose an opinionated framework that has already solved the hard problems for you and imposed structure on your team.
No. This is a misconception that is being spread around. I don't know what FF containers are useful for, but they certainly do not function to replace Chrome's profiles:

Here are my notes from when I investigated:

https://news.ycombinator.com/item?id=15688651

I went deeply into trying to use containers as a profile replacement, replacing Chrome with the new Firefox beta for one month, and I can report that it is not the right direction to go in:

- New tabs do not inherit current container

- No way to make Ctrl-T do this by customization (I investigated extensions (can't remap Ctrl-T) and even system-wide Ctrl-T remapping with Karibiner; neither gives you what you want)

- History is shared across containers. So e.g. work URLs mixed up with personal. That's contra to one of the main purposes of Profiles.

- External applications do not open a tab in the current container. So e.g. clicking in a link in work slack will fail because it will not open in a tab which has work cookies / google account etc.

Evidently Containers are not designed as a Profile replacement. I'm not sure what they are for but I don't think it's a need that I have.

As I understand it using the long-standing Firefox profiles feature is the way to go, but personally I switched back to Chrome after a month of the new Firefox Beta because of the convenience of Chrome profiles. I should try Firefox profiles, but I exhausted my experimentation energy on Containers.
So how does this actually work? It sounds like Xamarin Forms.
> it does spell checking of form fields.

So does FireFox, other than Form Fields where else would one need/use spellcheck? I wonder what's been done to yours so that it doesn't.
Signing is pretty important. Without signing anybody could surreptitiously replace your addon with something else.
I do. But those are all things still end up with parents and the students.

If you have a single mother that works odd hours and can't do basic algebra, it's very unlikely you'll excel as a student. That isn't a judgement of anyone, that is just a fact based on the data we have.

How to prevent that situation is a different discussion, but does illustrate that resources may be better used fixing the root of the problem as opposed to putting all the effort and responsibility on education.
Safari has an upper limit on market-share though because it can only be on iOS or Macs. Looking thru my website's stats, it looks like Safari has the overwhelming majority of iOS users and about half on Macs, and from experience Safari is faster than Chrome on old iOS devices.
Shouldn't that sort of grading be on a bell curve? That would seem to be the fairest.
Why do you think that? It's typically more lucrative to work private.
Pi-Hole is a great tool, just make sure to be exhaustive in your testing to see if it will break any services you depend on.

When I unboxed my old Kindle one day I couldn’t get syncing to work and had no idea why for several days until I tried adding a pass-through filter for Amazon in Pi-Hole, which was the culprit.
DHL's e-commerce offering for Africa
I interviewed with Canada's CSE, an NSA equivalent but broke off the process once I had an offer with Amazon. The salary ranges at the CSE were so low that it would be over a decade before I made what Amazon was offering on day 1. I suspect my career income will be more than double.
Men Mature After Women – 11 Years After, to Be Exact (2013)
How does this compare with previous administration's vocabulary limits? Words fall in and out of favor all the time.
I find that putting a deeply faked face of an enemy on a video where someone is brutally killed or executed to be strangely pleasing.
It clarifies that the writer likes Jordan Peterson.
I like this idea. You could perhaps add a small logo that says "optimized for Firefox and AdBlocked browsers".
>Fake news has always been with us and the internet just propagates it along with everything else. Contrary to the claim that the internet legitimized it, it made us more aware of how common it is, delegitimizing all news sources in the way that multiple clocks delegitimize clocks.

It's also that those in power would love it for their opinions to be the "authoritative" ones and only ones permitted to be heard. Same for mainstream media (though for them it's their business model).

The internet allows the "unwashed masses" to voice their opinions and viewpoints too. And of course those higher up will always have a distaste for those opinions.

Imagine everybody being able to criticize the Vietnam War in the sixties, or e.g. segregation in the 40s, or prohibition in the 20s, or the war on drugs in the 80s, or McCarthyism, on a platform that could get equal eyeballs as the Time or TIME LIFE or NYT. All those critiques would be discarded as "fake news", "propaganda" and so on too (in fact whatever little was, e.g. in underground papers and so on, got exactly those labels).

Of course people would also be able to voice their support those things, but that we be business as usual. People touting the elite's opinions were never without a soapbox in the mainstream media. The revolution is in the ability of the "unwashed masses" to speak for themselves.
I like the clock analogy - especially when tying in the solution of having digitally transmitted clocks from a source we trust, and so points to solutions that we must each decide which source(s) of trust we subscribe to. The issue then becomes funds being allocated to support this - and I like Andrew Yang's solution relating to supporting democracy (and countering impact of larger contributions by individuals or organizations), of using tax money giving everyone $100 to contribute to any party they want - we could do the same with journalism, and perhaps one in the same with journalism - do it also with allowing organizations to be funded who curate and moderate content for us.

There is some foreseeable scary potential to this though: if say 30 million of your population have been manipulated and contribute their $3 billion to fund the campaign of a pathological liar, someone on the path towards tyranny - perhaps a puppet of bad actors from other nations, then how could that unfold? Perhaps it would balance out however if the remaining population aren't in propaganda media silos and the amount of funds contributed to their campaigns are enough to fund enough action to respond.
My one issue with Firefox is the disk usage. Running on an internal SSD, the entire browser still slows to a crawl for 30+ seconds upon opening, regardless of the previous tabs open (although if a video is there, it takes even longer).

I've done all the tweaks and configurations found online, and nothing has made a marked improvement whatsoever. Not going to switch, but it's incredibly frustrating.
Seriously? They're upset that people are using the term "zero waste" when that's physically impossible thanks to the 2nd law of thermodynamics? How semantic can you get?

Instead of being upset about your "bratty" roommate reducing plastic waste but driving half a mile to work everyday why not use that as an opportunity to say hey, I know you care about a lot about the environment and you've been doing a great job reducing your plastic waste but there's even more you can easily do by walking to work - you'd get some exercise too!

See? There's constructive ways to have these conversations, and they're good to have because we all need to be concerned about reducing our impact on our home planet. Working together you might even be able to come up with new ways for you and your roommate to reduce your impact. That'll improve the quality of life for both you and your roommate.
If they aren't opted in to the program then you're not giving them anything. As far as I know Brave is still accepting tips on behalf of people even if they're not opted in. Also, these tips are in an altcoin that Brave created and not the currency of the content creators.

See also: https://twitter.com/tomscott/status/1076160753793683456?s=19
The Guide to Object Storage and IAM in AWS, GCP and Azure – Zenko
This great feedback. I'm definitely not a crypto expert. I'm happy to update the post with a different padding algorithm if you want to suggest one. I'm a little hesitant on swapping out RSA because I intentionally picked something relatively simple and familiar to folks, but yeah, will still do some research. Others had suggested ECC which I think is totally worth noting in the post one way or another.

Thank you!
I've known several people, like yourself, that had that sort of abusive experience while homeschooling. We've built our system with the specific purpose of avoiding those pitfalls. I think you're projecting your suffering on us and not seeing the reality of what homeschooling is like outside a paranoid, anarcho-religious context. I empathize, but I'm not convinced there are any actual similarities.
I had to switch to Chrome after Firefox caused my computer (macOS Mojave, 2012 MBP Retina) to freeze to the degree of requiring restart every few days. Even when it didn’t freeze the entire machine, the browser itself would lock up a few times a day. During the course of normal use, my CPU temps would jump to 100°+ from a baseline of ~55°. (And battery life was disappointing, as other comments have noted.)

These issues occurred when my computer was plugged into a charger or on battery power. Replacing the thermal compound, thoroughly cleaning the fans, and reducing the number of open tabs and windows didn’t resolve this. Chrome doesn’t appear to cause these issues on my machine, holding all other workload and plugins constant.

I really want to use Firefox but cannot rely on it currently.
I can't really speak to the Windows (FF/Chrome) -> Linux (FF) switch, but I have seen so many Windows setups that 100%-CPU-loop for unknown (likely browser unrelated) reasons that I would not be surprised if people considered switching to what I experience now a major improvement :)

> You make it sound like Firefox is heavily broken for everyone. That's not the case.

I didn't say it's unusable. But these things matter. If you get constantly annoyed by such things and you know that with Chromium this annoyance would stop, it is no surprise people use Chromium a lot and claim it's "faster". If we want them to be happy Firefox users, this has to be fixed.
The agencies don't care about degrees as much as they care for raw talent. Many years ago I was in vacation and was just talking about video games with some random dude, then pirating, how to reverse engineer and crack em and from there into buffer overflows and exploit. After our conversation, he told me works for the NSA and asked if I'll like to work for them. I asked about pay, and it was more than double what I made then. Told him I would think about it, but passed. Spooks gives me the creeps. Many that I know that have gone to work for them don't have college degree and were recruited solely on raw talent
> I'm a big fan of integration tests though because they lock down the code based on high level features and not based on implementation details.

I've found this to be a dangerous mindset. Integration tests are great, but they need a solid foundation of unit tests. Integration tests are slow, difficult to root-cause, complex to write and maintain, and also generally don't test all the various corners of the system.

Testing is a pyramid, with unit tests at the bottom and integration tests somewhere in the middle. If your unit tests are based in implementation details, as you say, then that's probably a sign that a refactoring is in order (would love to be less blunt but it's tough with the absence of more details).
Oh, and we use asym because it's useful for us to be able to inspect the token (and see stuff like it's permissions and expiration client side). I only kinda mention this a bit later, but I might make that a bit clearer.
Dashlane raises $110M, nets new CMO in password management push
The idea of a conversion funnel for investment captures the real business model in play here. This is a marketplace in which the products being sold are business stories, and the audience is a very small group of wealthy consumers. Since the stories don't have to be tested against the real world, they can be perfectly tailored to the preferences of the buyers.
Actually it can be much better. As has been argued time and again (including by people who have suffered both), with a totalitarian regimes that controls the press means the population knows to distrust the press.

A "free press" instead, while still controlled by the elites (press empires, their politician buddies, corporatism, etc), on the other hand, gives the false impression of pluralism and trust...
Oh interesting! TIL. I think that probably means that this is UB then: https://github.com/JuliaLang/julia/blob/d8ff21c69c118e8801e8... --- You can't enable NO_UTF_CHECK in PCRE if you're going to pass data that isn't valid UTF-8.

N.B. As of PCRE 10.33, you can able the PCRE2_JIT_INVALID_UTF check for JIT matching instead.

It looks like this is also coming to the standard interpreter as well: https://lists.exim.org/lurker/message/20190524.173112.0d226a...
His conclusion that "high quality software is cheaper to produce" neglects to mention any kind of time frame over which it actually becomes "cheaper".

Over the short term (e.g. the next several product features) it may in fact be cheaper for a team to focus on speed and not quality. The accumulated technical debt would only cause problems for future development, and that's why it's taken on. In most cases, I think everyone (including management) knows perfectly well that high quality software is cheaper in the long run, but they're willing to take on that debt in order to have some short term benefit.
The $1.5T Question: How to Fix Student-Loan Debt?
It drains battery too fast, and seems to load pages slower than Firefox.
I think what he means is that just because you have tests (and even if you have high code coverage) doesn't meant that your code is high quality. They're correlated, but I've actually seen code with high test coverage... whose tests never made any assertions.
From https://en.wikipedia.org/wiki/Gab_(social_network) -

"Gab is an English-language social media website, launched publicly in 2017, known for its mainly far-right user base.[9] The site has been described as "extremist friendly"[10] or a "safe haven"[11] for neo-Nazis, white supremacists, and the alt-right.[10] ... Antisemitism is a prominent part of the site's content[24] and the platform itself has engaged in antisemitic commentary.[13][25]" - and so on.

I'm curious how the existing Mastodon users feel about this.
You're pushing arcball really quite hard across this discussion, but it's just one of many ways of handling interactive rotation of an object, and the one used in the article (give or take accumulating inaccuracy) is fairly normal, too. Certainly, though, the article will not really help anyone aspiring to write a 3d engine of most any kind.
This is how the GO Train system in metropolitan Toronto & southern Ontario works as well.
I don't think most experience what you do with video in Firefox, I wonder if you have hardware acceleration disabled.

I was interested in Firefox containers but quickly lost interest when I discovered Firefox Sync doesn't sync container configurations, I wasn't going to replicate them in multiple places.
In my experience, if your tests require lots of mocks then that's a sign that IO is coupled too tightly to application logic. Refactoring your code so this isn't the case isn't always obvious, but it's a breath of fresh air and really cleans up the interfaces.
NFL Pass Blocking Is Even More Important Than You Think
What does AdGuard do that a host blocklist doesn't provide?
I don't think that's true. People's job titles generally aren't classified, even when they have them at present, as far as I know.
Assuming the tunnel is not in use then yes.

Here the are filling the tunnel and using a TBM. https://www.newcivilengineer.com/farnworth-tunnel-widening/1...

Widening an existing tunnel without interrupting traffic is still possible like: https://www.rocksoil.com/pdf/233_r.pdf. Though with increased costs.

However, this changes for under sea tunnels which are segments placed down and thus can’t really be widened.
Twitter has WAY more extreme people and expressed viewpoints on its platform than Gab.
JWT is multiple layers of bad. My favorite summary is that it has poor implementations of a harebrained scheme designed to solve a problem you don't have.

The idea that I need to read the header, which is unauthenticated, to parse the token violates the Cryptographic Doom Principle. Has that led to vulnerabilities? Of course it has: I just said it violates the Cryptographic Doom Principle.

The idea that it has everything plus the kitchen sink -- even for drastically different behavior and opinions on how the world works, from symmetric encryption to asymmetric signing and multiple implementations of each at that, is anathema to modern cryptographic design. Wireguard has one scheme and it does a lot more complicated stuff than "encrypt a session token".

JWT's saving grace here is that few people implement all of it. And ... that's ... cool? Until they do, of course.

You can argue that something is an implementation problem and not a spec problem. Some issues definitely are, but if every major implementation has the same damn bug, then I think it's a spec problem. Unauthenticated headers are a spec problem. PKCS1V15 enc is a spec problem. The fact that an implementation can patch around it doesn't make it not a spec problem. I'm sitting on several more vulns in ~every JWT library that are, to cryptographers, literally too boring to publish even though one of them is _key recovery_.

Other posters have said that it's silly to say that merely the ability to use it unsafely is a problem. But good crypto looks exactly like bad crypto while you're doing it, and there's good crypto that doesn't have that set of problems, so why would you ever choose the poor design?

(Don't use JWT.)