skysight-inc/HackerNews huggingface dataset:
>They're phishable the same way an OTP token is

Accurate point and why I caveat the malware/phishing point with (some types).

>U2F tokens were standardized and adopted as a phishing countermeasure.

U2F provides benefits over TOTP besides phishing

-TOTP seed generation may be compromised/bad at authentication point, may not be deleted, TOTP-seed may be shared with Eve

-Smaller exfiltration profile: When producing a U2F proof, user space isn't doing computation that could be exploited. TOTP clients generate excessive secret data for the necessary task:

User: Hey computer, I need a TOTP to log into my Vintage-Car forum.

Computer: Ok! I'll go ahead and compute the TOTP secrets to your bank, bitcoin wallet, SSH keys, and literally everything else in addition to your Vintage-Car forum account. Hopefully no one's shoulder surfing you or I don't have malware!

I think it's PAKEs are a huge win for high security-apathy users but there are trade offs:
-User space has to run more code

-All user-space platforms need to be able to run PAKE code, or else all the (non-phishable, non-server-side loggable, non-server-side sensitive..) benefits go away

-Low-entropy password choices can't be prevented server side (guess this functionality could be wrapped into the client-side code)
When Will the Planet Be Too Hot for Humans? Much, Much Sooner Than You Imagine
When an Eight-Figure IPO Windfall Can Mean a Zero-Digit Tax Bill
Unfortunately this is the problem that Chase created ... we give users a way to download a form letter instead, but were just trying to make it as easy as possible for customers to opt out if they would like to do so
Growing a tiny site with heatmaps and surveys
I'm sorry this happened to you sir and hope that you are in a better place now.
Note that there is a PDF for those who don't want to enter their information: https://www.chaseoptout.com/ChaseOptOut.pdf
Seems like an ideal use case for a glass jar.
Spotify: The Big Mood Machine
No, but I know a guy, and he can meet you in the alleyway
Our grocery stores sell disposable plastic bags for 5 cents and reusable fabric bags for a dollar. These fabric bags are so amazing and huge that I bought 15 just to help me move.

The concept of a 5 cent reusable plastic bag is a head scratcher.
What is gravity field data? Can you elaborate more?
Hackaday's case was interesting, they quickly hacked (sorry) a fix together and by mistake ended up piping all comments into the RSS feed.

https://hackaday.com/2019/06/11/the-day-hackadays-theme-was-...
Are you collecting email addresses of your future customers for marketing purposes ? Whats the guarantee that you don't mine the customer address information you collect for your new bank venture http://pdf.secdatabase.com/92/0001772417-19-000001.pdf
Are there any firm plans for what happens to the matrix.org matrix server in the future? I worry that all the friends and family that I've been convincing to register an account on matrix.org are going to one day be asked to migrate their account to somewhere else, and that feels like it could be a big bump in the road for the non-technical ones.
While it makes no difference in this case, it's worth noting that Badge<T> is not an aggregate type because it has a user-provided constructor. Therefore the object is value initialized, i.e. the braces are equivalent to 'Badge<Device>()'.

edit: what this means is that even if the struct had data members, you couldn't brace initialize it like an aggregate type, and to achieve something syntactically similar, you would need a suitable constructor.
Doesn't iPhone have some sort of device attestation?
Can you make the link for the download more obvious and less dark-pattern-y? I found it only after scouring the page (somehow the text under the form didn't catch my eye easily), and then it popped up a modal that unnecessarily asks for my email address. I closed it, annoyed, just barely noticing the small-font link to download without entering my email address.

If you actually care about privacy and claim to not be using or selling our information for anything, why don't you make it easier to avoid giving information entirely?

Having said that, thank you for creating this. I had left Chase's email about the terms change in my inbox, starred, so I'd remember to take care of this, but not having to formulate my own letter makes things so much easier.
This is really inspiring. If I wanted to try to create something like this, what would you recommend as a good starting point, is there an existing sample that you based all of these off? Do you release the source code for your art anywhere or just the final product?
Also, if we come up with sensible solutions then mass production of whatever packaging we decide on will also happen in Asia/Africa.

I like that we are doing something about plastic polution - yay! But I fear over fishing is actually more of a problem.
About 9% is recycled: https://www.economist.com/graphic-detail/2018/03/06/only-9-o...

Recycled is really a misnomer though, more of a marketing term. Plastic can only be down-cycled. E.g. used food containers can never be recycled into new containers to hold food ever again. Usually after a couple of hops it's roadbase or landfill.
sikuli ís nice
Apple Discusses Acquisition of Intel’s German Modem Unit
Should it be in the first thing to do is to explain who you are and what your project is doing? Not everyone is in the matrix or everyone are but not woke up. Need to say.

Anyway thanks. Now has a lead.
> actually exploiting this without a cooperative target, and a relatively quiet machine is quite unlikely.

... until someone does it somewhat reliably. I always assume my knowledge and imagination does not come close the collective creativity of exploiters.
We're covering that for now because we thought it was the right thing to do
> there's not much we can do

Open-source a script I can run locally to generate PDFs with the information your form uses.
That’s pretty cool. Great work. What needs to be done to make this so that an average person could use it?
How NeoCon Billionaire Paul Singer Is Driving the Oursourcing of US Tech Jobs
Hi, site creator here - link is here and is not 404'ing for me

https://www.chaseoptout.com/PrivacyPolicy.pdf - let me know if you mean something else?
I think, for me, the idea is that these companies aren't really gunning to make profits immediately and all are really in the play to get to automated taxis.

I'd assume automation of the vehicles plummets labor costs and then subsidizing the prices due to increased rider volume would be permissible.

That may be in the 10-15 year range, but I think they'll float along until something like that occurs. It's just a matter of time.

But I'm just a wild speculator.
Very sad. This has been a source of information and entertainment for a long time.
What did your legal counsel say about liability here? For example, what happens if a cardholder who used your opt-out service has a dispute with Chase, and Chase claims they did not receive the opt-out?

What has counsel advised about any risk of federal authorities investigating you as possible CC phishing operation (perhaps initiated by monitoring for bank-phishing-like domain name)? (Obviously you have some defense, but the best case might cost you money and misery.)

Also, do you expect to keep the domain name past an ICANN dispute?
This is the correct answer. There's no need for UTF-16 unless you're fixing up code that uses UCS-2. UTF-32 doesn't buy you anything other than bloat. In all cases you have to deal with graphemes that consist of multiple codepoints, so even UTF-32 is a sort of variable length encoding, which is why it buys you nothing but bloat.

UTF-8 is reasonably easy to deal with and very interoperable.
The C++ access restrictions exist solely to teach and enforce proper API usage by other developers.

They're supposed to trigger a reconsideration of the API when a new developer runs into a restriction, but more often in my experience the new developer will just add a new public interface.
It mentioned that the opt-out requires a specimen signature (from the FAQ as well What do I need to do to opt-out?). How would you be able to ensure that the opt-out process for the customer will be valid / accepted by Chase if there's no actual human signature?

From Chase's perspective, wouldn't they be asking for more details especially if their business hinges on retaining people into their business as much as they can?

Update: Additional wording
"Many developers vastly over-estimate the likelihood of customized spam."

I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can get after being on the web for just a few months. Doesn't matter how big they are or what they do.

I'm not saying ReCAPTCHA is the only thing out there or even the best, but having an open form is just asking for trouble.
Cooincidentaly I ordered this exact book the other day. I knew about Bernard because he became obsessed with Bancor, a "breakthrough" (his words) to solving the liquidity issues that plague complementary currencies. I became interested in the same project for other reasons and now I want to read his books.

He passed away earlier this year. RIP.
Very nice! I was actually in the process of building the exact same thing but charging users for the cost of mail and server/API expenses.
With a better understanding of how VGS works I really just fall back to my weakest link in the chain questions:

Does Lob hold any PCI level certifications? It appears they hold HIPAA but I see no mention of PCI?

Does Lob provide any interface that shows sent mail and the content (it appears they do)? If so and they don't hold any PCI certifications what benefit do we really have with ever getting a VGS token?

What stops you from scraping this data from Lob's API?

---

Original comment below.

I'm confused on how this data lands at Lob with an account number if you never get it.

Correct me if I'm wrong but the letter you send includes the account number and not the VGS token?

All of my following questions assumes an affirmative answer.

How is the account number landed in Lob? It appears something must be calling the Lob API with an unencrypted account number? What is making that call?

Does Lob hold any PCI level certifications? It appears they hold HIPAA but I see no mention of PCI?

Does Lob provide any interface that shows sent mail and the content? If so and they don't hold any PCI certifications what benefit do we really have with ever getting a VGS token?
A full investigation by whom? They've broken no laws. Voluntary? Ha.

I realize what the parent was attempting to say, but internet rumormongering is poor form.
I don't see how that's relevant to what I said. The problem I was citing was the encouragement to put this info into a Web form on an arbitrary site. You should always be discouraging that.
I've actually seen this go pathologically bad. Heads-up emails, sent out 14, 7, and 1 day in advance. Similar set of Slack messages.

Somehow literally nobody has noticed until the change lands, at which point everyone has an opinion.
The dominant C compiler (CC65) has a separate stack for parameters and local variables, and keeps SP as a pointer in zero-page. This is a nice general approach that allows for deep stacks, recursion, and lots of locals, but isn't very efficient.

Newer experimental 6502 languages either forbid recursion (cowgol) or limit parameters passed to functions (C02), but I can see a language using a hybrid of stack and zero page to keep locals and parameters.

The drawback of high-level programming on the 6502 is you are always looking for ways to make it better... :)
Fact: If millions of people were to take us up on this, we (Radvocate and our friends at HM Bradley) would get tangible value from the publicity around it.

I'd love for us to have that problem.
Does Reddit have a system to appeal mod decisionmaking for important (and not so important) subreddits?

I think Flickr had this back when they were a big property. You'd have site admins look at your complaint and follow up as necessary.

It's be nice to have and if they have it that it'd be more active to keep things from going off the rails --within reason.
Edit: dumb question from me. I didn't follow the flow because I don't have a chase account, so I wasn't aware it was a multi-part form.

Original comment below:

---

I'm likewise not an attorney, but how hard would it be to do a simple "Type your name here to represent your signature" type of deal? This is the most common lay practice I've seen, with the more common CYA practice for electronic records being e.g. what Docusign or Adobe offer, or the use of cryptographic signatures.
Act Now on Crispr Babies
I 'looked' at Linux many times between 1991 and 2000. Apart from playing with SLS downloaded from the BBSs and then Slackware after the 1994 CD, I didn't bother installing it permanently because I was already using 'real' Unix on my main personal desktop.(AT&T, Novell, SunOS, Solaris 2.x)

What really gobsmacked me every time was the huge jump in Linux's capabilities in the few months since my last 'look'.

After 2001, I changed to Linux exclusively.

These days I use Debian Testing or Mint MATE. (Mainly Mint MATE as my day-to-day desktop, with Debian as my 'emergency' installation.)
It's not very "Mac-looking", either: it reminds me of elementary OS.
As for whether you should opt out, I honestly don't know and that is your decision to make.
Man with Severed Corpus Callosum
I'd tried to make iCloud work in a shared setup and gave up after several libraries decided to corrupt themselves.

PhotoStructure is designed exactly with this sort of heterogenous family setup in mind.

My wife uses a Chromebook and MBP, I'm on Ubuntu, Windows and macOS, we have a NAS, and we can mount the library directly with CIFS/samba/AFS/NFS, or use the PhotoStructure web interface that's hosted by any of the computers that are running.

Photos and videos get to the NAS via SyncThing or Resilio Sync. Duplicate and downsampled files (like via Google photos) are handled gracefully by PhotoStructure's sync process.

Most importantly, I retain control of my own files.

Disclaimer: I'm the author of PhotoStructure, and I'm eager to get user feedback during the closed beta. More info on my HN profile.
A Limited Habitable Zone for Complex Life
The Anthology series is also a really good example of using archive material effectively. For example, you can see how songs like Strawberry Fields Forever and Day in the Life evolved over multiple sessions.
There's often a sinister motivation for such goodwill. Most often than not.

Are you just going to discard all the data afterwards or is it just a ploy to build a mailing list for your bank?
The Barney Design Redux [Episode]
Linear Mitochondrial Genome in Anthozoa (Cnidaria): A Case Study in Ceriantharia
I like these commute options that make it easier to get around but starting at $2/ride seems a bit high. If I were to use this twice daily for 200 days a year, I'd be looking at $800/year! I'd rather buy a bike in that case, and just use the bikeshare for one offs.

I've never used a GoBike, but are those prices real & what are the typical usage patterns?

Edit: I see, there are monthly and yearly plans that make it much more competitive with ownership. Great!
Release Scala 2.13.0
Yup, I just happened to notice this by chance when the email came. I was really surprised to see this. Fortunately, I do have stamps lying around, so I've already mailed out a letter rejecting the agreement to arbitrate.
Look at the time, it is hair-splitting o'clock! >_>

Having a single captain can still be a democratic system; what is being replaced isn't the democratic element (where power rests with the people) - that is still in place. What is being changed is swapping a deliberative assembly (or committee or something) for a single executive for making decisions.

So what is being identified is technically something like 'deliberative assemblies are better at dividing up resources and responsibilities but single executives are better at implementing policies and achieving outcomes'.

Interestingly, this is a lesson that is implicitly very well understood by major democracies without being explicitly bought up very often.
Detecting Dark Matter with Aharonov-Bohm
I remember Lyft partnered with Ford on self-driving, but does that have anything to do with Lyft choosing to take this over? Bike shares seems outside the core-competency of Lyft. Is it simply for marketing?

I'm confused why the company would take this on as part of some larger strategic plan.
You're teaching users it's OK to give out their account information "sometimes". Which is much less secure than "never".
Are pesticides linked to health problems in Argentina? (2014)
Can someone knowledgeable explain how a company can pick and chose was does and what doesn't constitute a binding agreement?

AFAIK in the Netherlands oral statements, when overheard by a witness, have the same legal standing as a signed contract.
Sure, I know. Just pointing out that, at least for AWS, you do not need recovery codes or a second device for MFA. For me personally, phone+email is good enough for my threat model.
Nineteenth-century nanotechnology: The plasmonic properties of daguerreotypes
Up to this point the comments seem to be missing the obligatory "Treasure of the Sierra Madre" reference, so here I am fixing that.
I am wondering if/when the first class action lawsuits will fly against the hardware manufacturers.
It's not about writing code, it's about using algorithms. If you're using MP3 algorithms to make money selling phones, you have to pay a fee. If you're using MP3 algorithms to make money selling your WinAMP player, you have to pay a fee. Whether you found implementation on github or read patents and implemented it yourself, does not matter. I don't think that you have to obtain a permission just to write implementation out of curiosity, but I may be wrong. And I have no idea about status of open source projects which include patented algorithms, but distributed free of charge. Probably they can't do that, because Linux distributions did not distribute mp3 codecs by default.

Also all of this is applicable to countries where those patents are working, of course.
I'm betting the latter. If you click on the HM Bradley logo it takes you to their homepage where it says that they're building a bank for the "next hundred years". I'll hand it to them, this is a pretty good way of collecting lots of email addresses.
Do you really want to give a site run by someone you don't know vital info and a account number. Probably legit but ...
If you fill in your info on the page and click the buttom, this happens as the final part of the flow before it submits.
The apps don't have to deal with it. It's a read error. Presumably something they already deal with. There's no operational difference for the end user between a block that can't be read and a block than can be read but with corrupted data. And yes, storage would ideally be paired with another physical device to provide redundancy and a mechanism to correct the error on the erroring device.
You can get monthly membership and it's free to take trips.
totally fine if you don't! we also allow you to just download the form so you can fill it out and mail it yourself
Transition metal dichalcogenide nanodisks:Hi-index dielectric Mie nanoresonators
... and it is a lot more fun when the toolchain runs on the target itself. With microcontrollers it's hardly possible (but see RetroBSD), but not needing a workstation to service an otherwise self-contained little machine somehow feels special.
A bike share being owned and operated by one of the biggest threats to cyclist safety is, well, it’s something.
I'm using Signal for text messaging as well, and thus can use its automatic backup functionality (only on Android currently, I think ). In case it's useful to you.
Carbon nanotube thin film patch antennas for wireless communications
The not-so-talked-about but killer feature of Matrix is that you can bridge other services into it. I'm currently able to send and receive messages from Hangouts, iMessage, SMS, and Slack all from within Matrix. If I'm working on my laptop I can put my phone in my bag and not even touch it for 8 hours, because there's no need. I have Riot running on my laptop with a full keyboard and access to all my communication platforms.

It's not exactly easy to do (iMessage requires a dedicated Mac, for example), but it's possible. And it works pretty well. Pulling out my phone to tap out an SMS when I have a full keyboard in front of me seems silly at this point. Hopefully the bridging will continue to evolve and become more accessible to the average user, because it's amazing.
Xfdbgdxf
https://twitter.com/CopaAmrica2k19/status/1138564148105793536

https://twitter.com/CopaAmrica2k19/

https://twitter.com/livestream888/

https://twitter.com/CopaAmrica2k19?lang=en

https://twitter.com/livestream888?lang=en
Other users have mentioned situations where this is true (and I have run into them myself too). But tiling window managers + workspaces are just so much more efficient for almost all use cases. And they don't have to have a steep learning curve.

I use KDE with the grid tiling plugin. When I open a window, it takes up the whole screen. Opening another window splits the screen in half vertically. They can be dragged as normal to swap positions. Opening a third window splits one window into two, horizontally. This goes up to a (configurable) 2x2 grid.

There are only four basic keyboard shortcuts to remember: meta+F floats a window to make it not affect tiling; meta+T makes it tiled again. Floating is useful for small utilities like calculators or temporary status indicators; they always float above the tiled windows. meta+Q/E shrink/grow the current window, and the rest adjust size to fit (of course window borders can still be dragged and it works the same).

Since every window is always visible, there is no need for a window list in the taskbar - mine only has the date/time, status icons for notifications, and the workspace pager (map).

Virtual desktops are the last part. You obviously will want more than three windows. I use a 4x4 grid of 16 desktops; 4 total desktops is more practical for normal people. They are mapped to a 4x4 square of keys on my keyboard. A few windows for applications like email or IM have a permanent space on the bottom row of 4 desktops. Normally I stay in the top left desktop and move to adjacent ones once space starts running out on the primary one.

The pager in the taskbar shows an overview of the grid. meta+WASD or arrow keys switches between them; holding ctrl moves the current window along to the other desktop. Oh, and meta+tab is like alt-tab but for workspaces.

This maximizes screen space that can be used. In a floating WM like Windows/macOS, only maximized windows take up the full screen; every other window is smaller. Windows has a 2-pane L/R split builtin, which is a weak replication of my system. If you have three floating windows open, using all the screen real estate is a frustrating task of dragging windows by their titlebars and then using the thin borders to resize them. With my system they just magically appear into place; the only user input is to swap their positions or resize them.

With floating WMs if you have more than 4 windows open you have to either:

A) leave bits of windows visible behind the other, which takes up time to arrange the windows, or

B) frequently focus on the taskbar and select windows, which is very inefficient

Workspaces solve this well, especially when put in a grid instead of a row. Related things are just a single press of meta+WASD away, clustered in their own area in the grid.