skysight-inc/HackerNews huggingface dataset:
This is the most insightful post in the entire thread. Thank you for that.

Most of the discussion here is about TOTP, which at this point is like arguing about the beautiful plumage of the dead parrot. TOTP for professional 2FA is a walking corpse, pushing up the daisies, wouldn't squawk if you put 10K volts through it [1]. If you're a company seeking to secure your infrastructure all your employees and contractors should be using U2F hardware keys to access your network. Period, end of discussion. Same for admin access to any external SaaS dependencies - and you should be loudly complaining if your SaaS does not yet support hardware keys.

And if you're a startup and even a solo developer, start looking at supporting WebAuth so you're not caught with your pants down later, especially if you want to sell to other businesses.

Business to consumer TOTP is a more complicated issue. The future is clearly hardware keys, tied to devices like phones, but the support is not yet all there. So you're going to have to support TOTP for a while yet, since it's better then bare passwords. But you should be making plans to move to hardware U2F ASAP, and the earlier you do it the easier the transition will be later when you will have to mandate it for all your users for liability and CYA reasons.

The looming shadow over all this is account recovery, which is not a solved problem in Business to Consumer space (IT/HR can sort you out to get back on your corp network if you lose your keys). There are too many implementations and all of them have flaws. There's little consensus on how to do it and all of the recovery methods can be misused or abused. If you lose your house keys you go to a locksmith who's usually bonded (in the US) and generally not a crook. Who do you go to if you lose all you hardware keys?

And of course there's a cost to users to having multiple hardware keys, which at $25 a pop will not fly with consumers. These things need to be basically free (your phone) or comparable to the cost of your house keys (for backups) for mass consumer uptake.

Bottom line, U2F hardware keys are the future of authentication. Learn to love and support them.

[1] https://www.youtube.com/watch?v=vZw35VUBdzo
The article is generalizing a bit, and focusing on just one aspect of boomer housing matters.

For example, it's also quite common for baby boomers to hold onto their existing 3-bedroom homes, and in the process restrict housing supply of what should be affordable, reasonably-sized homes for millennials seeking to put down roots and start a family. I don't think there's anything wrong with this BTW, as it can be quite prudent to do so.

I think people were gambling on baby-boomers moving back to the cities and "downsizing" to a decent 2 or 3 bedroom condominiums. Instead, those units ended up selling to cosmopolitan millennials and Gen-Xers.
Were you a month to month tenant? If not, why would you sign a lease that lets the landlord break it with 60 days notice? Doesn't that kind of defeat the purpose of having a lease in the first place?
Yeah, the change to 100 or 200mb came as a desperate attempt later to stop the gmail hemorrhage.
Oh nice, just did that, thanks! I wasn't even using the OTP to begin with, but I didn't realize I could just disable it.
Another way of rephrasing Conway's law?
Well, particulates are still molecules. There should be a measurable difference.
> There especially isn't an issue with a redistributive land tax rather than a property tax. That would take money from corporate landlords and move it back into the rest of the economy.

I commend you for being honest about such a tax: it is indeed someone (perhaps those who call themselves "the authorities") taking what is not theirs. Taking it, without permission.

I disagree that noble ends can justify such means.
Hi. Thanks for letting me know about this. Indeed, I told my developer friends to check out our open source project and give us an upvote if they liked it. Ok. Now I know that it is not allowed! Then please make a banner on the submit form.

A feedback for HN: if you are looking for stories, then delete show HN category. There is no story in what I want to show. It's simply the project that I wanted more developers to know. That's why I put in the "Show HN" category -> to show to HN. If you don't want people to show the projects, why did you have this category?? Very contradictory.

Also please remember that - No algorithms are perfect, neither are human's judgements!
I'm not getting a 404 error
"One thing to mention, is that setting up a new hive is relatively easy. You take a new (or about to be) queen, some workers and separate them. They’ll form a new hive. This can be done once a year (or more) on a healthy hive in the spring. Meaning... we can double the bee population yearly. They recover very well, if we know what to do to minimize hives death."

This seems like an easy way out of the problem. Is this being actively pursued?
Also, with UPI, you don't have to add beneficiary. Money transfer is instant (although there may be limit for the amount to be transferred).

Seriously, this UPI mechanism is absolutely killer.
More specifically, hiring occurs if a business is growing, i.e. due to increased consumer demand.
Change the name. Any other solution is foolish and short-sighted.

A terrible name is something that is haunt you for the rest of your time at the company. Just have the page links properly managed so that they mention the new name and the old name. In 6 months, no one will care or remember the old name.

Internally, you can refer to it as the old name, and you can keep the filenames as is. It's a pain but that probably isn't worth the effort to migrate.
If HN is the standard by which to judge the west, then such sites seem to get a fair shake at things. That's a taboo website but not taboo enough to silence discussion about it.

https://hn.algolia.com/?query=unz.com&sort=byPopularity
In my experience, communication skills are always the bottleneck.

> But with the coming-of-age of IoT and ubiquitous connected services, we call them "stream-aligned" because "product" loses its meaning when you're talking about many-to-many interactions among physical devices, online services, and others. ("Product" is often a physical thing in these cases.)

Foreboding over IoT is not a strong argument against product teams. Whether it is product teams, streams, microservices, or monoliths: people have limitations on how they can maintain equilibrium and the current set of processes and tools overwhelm it at the cost of productivity.

I agree with the spirit of the argument, but I think it's counter intuitive to suggest "yet another" thought construct based on a premise of under-loading cognitive faculties.
What a terrible waste. All this just so they can brag about how thin they are for a couple of minutes during a keynote while customers suffer the consequences for many years after.

I remember the time time when a key became defective on my 2013 MacBook Air. I brought it to an Apple store and they replaced the problematic key and sent me on my way in 5 minutes.
That argument doesn’t really make sense.
If you stop paying rent your ass is on the street in days.

Stop paying your mortgage and it can be months or years.
In college I let my roommate borrow a copy of a fairly long fantasy novel with a lot of scene building and heavy on foreshadowing. He returned it the next day and asked for the sequel, which is how I learned he was a speed reader.

I was appalled. Part of the book was wondering what every obscure comment five hundred pages ago meant and whether it would come back to bite people. It was like a murder mystery without the murders. If not for the anticipation, other bits if the story arc were actually a bit weak (like many authors, they don’t want an editor but desperately need one).

I never did figure out what he was getting from the story when he was getting through them in three or four hours.
The voters are not one person. Sadly democracy ends up being the fascism of the many.
These guides tend to assume the reader makes a consistent paycheck more than their expenses every month. There are two big assumptions in there: one, that the paycheck is consistent; two, that the amount is sufficient to cover the expenses of the previous month.

All too often, for many people, these two assumptions are false. What good is advice like "pay your credit card in full every month" when you have no money left after paying rent? Or if you have just enough money to pay it off, but you're not sure how much you will have next month? How do you choose whether to save cash or pay debt?

The article strikes a tone that seems naive and slightly patronizing, by failing to consider a situation that many people face on a monthly basis.
In the UK they do have to:
https://www.fca.org.uk/firms/fca-mandated-and-voluntary-info...
> That's what people want, right?

Yes. That's exactly what they want.
Google Project Zorro: Real Names and Not-So-Real (2018)
Tesla's black paint just got $1k more expensive
> building more houses won't help solve the high cost of housing

It won't:

> Building enough housing to roll back prices to the "good old days" is probably not realistic, because the necessary construction rates were never achieved even when planning and zoning were considerably less restrictive than they are now. Building enough to compensate for the growing economy is a somewhat more realistic goal and would keep things from getting worse.

https://experimental-geography.blogspot.com/2016/05/employme...

Unless we do something dramatic and Bucky Fuller-istic like...

https://www.berkeleyside.com/2018/08/02/prefab-housing-compl...
Grow locally native pollinator plants if you can, or any flowering plant.
Deere could make the emission control system separate from everything else instead of tightly integrated to help make that harder but that method would not increase service revenue.
I guess that's why the JavaScript type confusion fixed in 67.0.3 was "exploited in the wild"? Because on its own, the rendering/JS process is compromised (which of course is bad) but it should still be sandboxed from the rest of the system assuming no sandbox escapes (like this one) are known?
> If anyone wants something or know about one problem, you should be the first one to know this. Never go to team members.

What I am trying to say is, it is better first to talk the manager if you think there's a problem or you want a feature than going to the team and bothering them with things. The manager has to be able to analyze your requests, check if there's a real problem, not a false positive, then mediate with the entire stakeholder things to allocate time to do your requests. The opposite would be you changing the scope of every person's agenda because you have the free will to move on to anyone.
Can I ask what led the vulnerabilities to be missed in the development process?
Steve Jobs told engineers to hardcode a full signal strength indicator on the iPhone for his launch presentation, because the actual phone couldn't maintain full bars.

In the real world, speed, timing and practicality matter. I can't get too worked up because a janitor didn't use APA citations for an internal business proposal.
I bought a refurb i7, 16GB in summer 2016 that site says the has already been serviced. Too bad because I really need a battery replacement and I'm otherwise completely happy with the computer.
I loved this CPU, programming it using spim, then actually getting to write some PSX code.
I think they're pointing out that many of the bottlenecks that make computers feel slow can't be fixed by throwing more cores at them—multithreading can be tricky
It's a mirror of the intracity highway issue. Access is improved for people who don't live in a specific location, and the externalities of this decision are dumped onto local citizens. The desirable location ends up hollowed-out, as no more geography is generated but instead the existing geography sliced away and allocated to visitors. They become destinations, more theme park than city.

It's well accepted that the highway boom of twentieth century had a negative impact on city life. That's why the Big Dig put that city-cutting highway underground in Boston, and (one reason) why the viaduct in Seattle is going underground, and why the I-93 corridor in Massachusetts became a public transit route instead. Here's a longer list:

https://en.wikipedia.org/wiki/Freeway_removal

Transforming private residences into hotel rooms makes it easier to visit and harder to live. Acknowledging this doesn't mean people don't like Airbnb, it just means that both the positive and the negative impacts of their business model are being discussed.
As I said, it's guesswork, but my guess is that you're far too experienced an internet commenter not to know what concern trolling is. When I see someone seemingly-innocently try to relitigate workplace diversity in a thread about an article by Ellen Pao, of all authors, I ask myself what the odds are that they don't know what effect that is likely to have.
It's largely the comfort and familiarity. Yeah you could walk away, but there's so much risk. So back to your stationary bike to make little pellet things for some reason, eating food out of a vending machine, while watching reality TV and decorating your virtual avatars using Merits you've earned at your job of dubious actual value, anxious always that you'll fall down a rung on the social ladder (while, of course, mocking those who have).

[EDIT] at least as the episode depicts it, which is very much a slice from a range of middle-ish class perspectives. Fussellian middle-class anxiety certainly appears (though not the full scope of it) and perhaps is most prominent, but there's more going on than just that. The episode's not trying to be about everyone, I don't think.

[EDIT EDIT] I think the key components of that episode are that 1) the system they live in is starkly meaningless, divorced from anything recognizable as value in practically any ordinary sense and in almost every single action they take, 2) nothing like a jack-booted thug, even broadly, ever features—the closest thing we get is "cuppliance" which is bad, sure, but given how passive it is and in the context of the rest of the episode, reads almost like an escape hatch for the writer rather than an intentional part of the thrust of the story, 3) an attempt at actual rebellion at the system is smoothly and efficiently coopted by the system—some clear ironic self-criticism from Brooker, that—and 4) our final shot reveals that they may well be able to just walk away any time they like.

(some people like to wonder whether the windows at the end are real or screens, but between what precisely they depict, which is not some remarkable vista or wilderness but a fairly ordinary one, and the context of the rest of the episode, I don't think there's a ton of ambiguity there)
CVE-2019-11708: sandbox escape using Prompt:Open

Reporter
Coinbase Security

Impact
high

Description
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer.

References
Bug 1559858
Right. The first CVE gets you for example, cross window access. The second gets you system access outside of the sandbox.
USB-If: USB4 Products Coming in Late 2020
What is the japanese word for "shop cards"? Mise Meishi?
Zapffe's The Last Messiah is a good read on this topic if you're not already familiar.
Business banking, loans/mortgages, investment, savings and, when things go wrong, accessible human assistance.
Canvas Debugging – WebKit
The problem with JavaScript is that it's a terrible example of a dynamically typed language.

> The benefits are a vastly improved safety net at a very minimal cost, smarter tools

That's entirely subjective. As far as tooling, I get the impression from my coworkers and what I've seen online that people that love TypeScript love big bloated IDEs. They love having their IDE tell them what to do. And, personally, I find their usage of IDEs to be a crutch that prevents them from transitioning from a plateau of mediocrity to being a great developer. They don't understand the code. They merely throw things together that match the types that their IDE tells them, like LEGOs. Then they spend hours trying to figure out why their code doesn't work.

As far as the cost goes, my experience has been vastly different than yours. TypeScript is killing my organization. For no real benefit. The warnings it produces are for theoretic bugs rather than actual bugs. The warnings TypeScript produces are incomprehensible to most developers. And when they finally quiet TypeScript down, they don't realize they have the wrong types! No one seems to fully realize how easy it is to get TypeScript wrong. Your code gets littered with ts-ignore and "any" types and suddenly you have a mountain of tech debt. Code becomes ugly and difficult to read with type annotations. It's hard to imagine anyone actually winning in this war of attrition between clean, simple, readable code and TypeScript.

If you're doing TypeScript and having an easy time of it, you're most likely doing it wrong. TypeScript is incredibly nuanced.

Management loves TypeScript though. It's a shield for responsibility. When bugs happen (and they still will with TypeScript), they can point to TypeScript as something they tried. They didn't fail the organization, their technology failed them.
They know which devices are signed into iCloud anyway, so they might as well notify users directly.
2019 State of Salaries Report
Apple launches recall program for select MacBook Pros
Think of it instead as a player closer to the money printing machine that is the fractional reserve banking system. This is the inflation the Fed created directly, and these institutions probably are thinking: 'housing prices only go up, so the duration of my borrowing doesn't matter, borrow short term buy long term, it's all gravy!' If you're over 30 and feel like you've heard this story before, you have....
Sorbet Is Now Open Source – Ruby Static Typing from Stripe
https://web.archive.org/web/20190620180133/https://www.mozil...
> I've been around a company that was 180+ years old (so rebranding was non-trivial ;))

It's not fair to mention this and NOT tell which company and link to the story about this! :)
"Stories" in this context is just a synonym for submissions, i.e. top level posts as opposed to comments. I've edited my comment above to use the other word.
> Forcing a company to have a diagnostic tool or team to identify a problem you might not have them fix is silly IMO.

As a counter point, OBD-2 works and everyone can use it.
Active malice is worse.
Now this is seriously contributing to climate change.
The basic budgeting formula given does not allow for debt repayments, my suggestion is to split the leftovers after your bills are paid, including credit card monthly minimums on the bills column, three ways. Save a third, pay off debt with a third, and spend the last third.

Some people will suggest that paying off debt with two thirds is more advantageous due to the interest rate difference. However psychological effects of watching a savings balance grow are more powerful than the tiny monetary amount you recoup by paying off 20% interest debt twice as fast.

You want your finances to be as much 'set and forget' as you can possibly get. I've switched to fixed payment amounts over paying off the balance every month on my regular card. So the spendy months are offset by the lean months. And my head can wrap itself better around the fixed $1400 I have going out rather than having to constantly check balances, not that that really stops me, lol.

Occasionally you need cash, such as if you're saving for a down payment or want to quit your job. In this case you can drop all your monthly payments down to the minimum, let your credit and cash balances pile up. If your credit is good, then once the dust settles and you're back to normal you can get a fixed interest loan to cut down on the interest-rate pain. $6k in credit card debt costs about $200/month. Cutting that interest rate in half saves you a hundred bucks.

You can't plan everything, and you can't always tame the little inner demon wanting you to spend more money. Some years are just spendy. Distinguish between capital spending, recurring spending, and incidental spending. It's the incidental stuff that will kill you if you don't rein it in.

Don't worry too hard about capital purchases like buying furniture, buy good stuff so you don't have to replace it every few years and just pay it off.

Don't worry about running up a few hundred bucks coming out of your account every month for Patreon donations or cloud services. Just run through your bank statements every six months or so and cancel stuff you don't use anymore.

It's those incidentals that will kill you. I probably have $3k in debt for frivolous purchases over the last few years that I really should have been better about. Key here is to recognize the psychological need they're filling. I used to go to the bar a lot because I'd get bored. Nowadays I spend a lot less money comparatively on cheap tech toys and hobbies. Retail therapy can be cheap or it can wreck your long term goals. Start paying attention before it goes so far you're paying $500+/mo just to finance your previous life.
Search is still hugely important. If you have a podcast ad or a tradeshow booth people don't remember you by your company name. They remember you as "that one company that does x". You need to make sure you show up as that company that does x, otherwise your competitors will eat up your marketing budget.
I mentioned the possibility of an untrustworthy person gaining access to bugzilla yesterday but it seems that most people disagreed with it: https://news.ycombinator.com/item?id=20221397
Same story reported a month ago: https://news.ycombinator.com/item?id=19910973
Because it's interesting! I think it is, at least.

From the guidelines:

> What to Submit

> On-Topic: Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one's intellectual curiosity.
Renting an apartment is actually the opposite of being homeless. Homeless people have no secure housing and need to sleep on the streets, in cars, or in shelters. If you are renting a place, you have 24/7 access to it and can stay there for shelter.
My iCloud account shows all my devices
Fool me once, shame on you.
Fool me twice, shame on me.

Everybody can see that these are blatant lies. Just like the MILLIONS and MILLIONS of federal dollars 'spent' on AT&T to get high-speed broadband to rural regions of the country.

I can't accept that every damn politician is that fucking corrupt to just bend us over like this and keep a straight face.
Not a good few days for Mozilla and Firefox. They just pushed 67.0.3[0] two days ago to fix a zero day.

[0] https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...
I read the entire article and got the impression that instead of objective journalism, it sounded more of a partisan attack and anger in the author’s tone. A journalist is supposed to take out their emotions and state the facts and let the people decide the emotions based on the facts.

Anyway, I am curious (and the author fails to cover) is how many new employees at&t hired/hiring in 2019? I used to work for a Fortune 500 company which did a similar thing but they would also hire the same amount. They would lay-off 70,000 and hire 80,000 new employees. Is that the case here too?

EDIT: This has been posted before and the article is misleading as I suspected. Check out these top comments:

https://news.ycombinator.com/item?id=19911521

https://news.ycombinator.com/item?id=19911694