skysight-inc/HackerNews huggingface dataset:
PyPi has 2FA for user logins to the website, which:

"safeguards against malicious changes to project ownership, deletion of old releases, and account takeovers. Package uploads will continue to work without users providing 2FA codes."

They are also working to enforce 2FA on uploads:

"But that's just for now. We are working on implementing per-user API keys as an alternative form of multifactor authentication in the setuptools/twine/PyPI auth flows. These will be application-specific tokens scoped to individual users/projects, so that users will be able to use token-based logins to better secure uploads. And we'll move on to working on an advanced audit trail of sensitive user actions, plus improvements to accessibility and localization for PyPI. More details are in our progress reports."

From: http://pyfound.blogspot.com/2019/06/pypi-now-supports-two-fa...
No, I understand you. My point is that whether a package uses 2FA or not should have zero impact on your security practices, yet your proposal suggests otherwise.

It doesn't seem like it does you much good to know if a package uses 2FA except to potentially weaken your defenses. For example, any scrutiny you level at a non-2FA package should also be leveled at 2FA-enabled packages. Though I suppose there is a non-zero benefit, so I won't belabor this argument any further.

Perhaps package repositories should be nagging publishers to enable 2FA. Though poorly implemented 2FA also introduces new attack vectors like the "lol lost my phone" social engineering attack.
>Everything taken together hints at a completely unaccountable executive looting a company that is running as quickly as it can from massive losses that may very well be fatal whenever the next recession hits.

Absolutely spot on
1) hg absorb

2) hg-git exists, and there's other things afoot that should be better
Counter-anecdote: I interned (many years ago) at Altria / Phillip Morris and found everyone I worked with to be very aware and conscious of the impact of their products. There was always a sense of finding that line between creating a good product that people enjoyed, and actively creating transparency and support around the risks created by that product.
regular "app based" is just OATH-TOTP in most cases. This uses a shared secret and the time to generate one time codes.

The Yubikey explicitly supports TOTP, and will happily store your secret on the key. You can then use Yubioath to pull codes from the Yubikey as needed.

I'm a huge fan of the ability to use either U2F or TOTP with the same hardware token.
UK sources are not reporting anything in line with what the politician in the referenced social media post is claiming.

Instead we have comments like this from the Independent:

> [Cathay Pacific] said it would comply with a directive from the Civil Aviation Administration of China (CAAC), which ban any employees who took part in the protests from working on mainland China-bound flights.

https://www.independent.co.uk/travel/news-and-advice/cathay-...

and from the BBC:

> Last week, Cathay Pacific had told its staff it would not stop them joining the pro-democracy demonstrations currently sweeping Hong Kong.

> But on Monday, Mr Hogg warned staff they could be fired if they "support or participate in illegal protests".

https://www.bbc.co.uk/news/business-49367949

It is certainly possible this is true, but I find it troubling this story is at the top of HN without other reliable sources backing it up.
AI in education: Can AI improve the way we teach and learn?
United States will give Huawei another 90-day export license
After reading the documents this seems to apply to industrial scale rockets, space-X scale launchers; not hobby rocketry or amateur rocketry.

It would be interesting to see a rewrite of hobby/amateur rocketry laws but this isn't it.
If we knew that it would be fixed by now. Julia's REPL only supports VT100 terminals and its descendants. My guess is that CMD.exe on older Windowses fails to emulate VT100 correctly somehow.
Desperate Spammers Are Targeting Calendars with ‘Meeting’ Invites
WordPress powers 1/3 of all sites on the internet . . .
One of the best features of iOS currently is the reminder when an app has been tracking your location, asking if to continue allowing. Hope Cook trashed that “letter” and Apple will continue putting users first.

Using a phone is not an excuse to steal your data and etiquette for developers should really be a priority, and violations should be punishable by law, especially when users are misled and data has been used without explicit permission.

Even so it should be illegal if the data accessed was not needed for the declared purpose of the app.

UPDATED: spelling mistakes.
IMHO: Great stock to own if/when its trading about 50% down from its IPO. I feel similarly concerning Slack.
It seems this was posted a few times to HN already (I just posted it again: https://news.ycombinator.com/item?id=20746962).
Quite interesting.

Some of the messages:

* Their GTK code became very fragile, such that they did not wanted to touch it anymore, and could not implement new features.

* The GTK community was/is not helpful.

* The Qt community was/is very helpful.

* Qt documentation is much better than GTK.

* The Qt frameworks has more to offer (basic data structures, etc).

* CMake is much nicer and easier to understand than just raw makefiles (but somewhat unrelated to Qt vs GTK).

* The model and view system/framework in both Qt and GTK is somewhat/completely broken.

* Qt Creator makes live easier, compared to Emacs (at least for C++/Qt development).

* Qt is nicely encapsulated, in contrast to GTK.
If this is true (and from his resignation, it would seem that way), this is very refreshing news.

There are horrible examples throughout history (Argentina in the '70s, where German automakers volunteered their left-leaning employees) of what amounted to business leaders giving up employees' lives to opaque regimes to ensure further profit for themselves and their companies.

This may or may not have resulted in anything as extreme as that, but credit where credit is due.
It isn't. SW can be updated and is usually open-source and mostly secure.
HW not so.

At least two HW backdoors have been found in chips such as this one in earlier versions, the first using an improper RSALib RSA variant (developed by NSA or Mossad). The source for the second, SCADA, is unknown.

So any nation state wanting the most people to use it, will advertise it as such. "unbeatable security and can protect against a variety of threats, including nation-state attackers."

This happened with the Infineon backdoor, the SCADA backdoor, the earlier Crypto AG backdoors.
https://acmccs.github.io/papers/p1631-nemecA.pdf
Some of the messages:

* Their GTK code became very fragile, such that they did not wanted to touch it anymore, and could not implement new features.

* The GTK community was/is not helpful.

* The Qt community was/is very helpful.

* Qt documentation is much better than GTK.

* The Qt frameworks has more to offer (basic data structures, etc).

* CMake is much nicer and easier to understand than just raw makefiles (but somewhat unrelated to Qt vs GTK).

* The model and view system/framework in both Qt and GTK is somewhat/completely broken.

* Qt Creator makes live easier, compared to Emacs (at least for C++/Qt development).

* Qt is nicely encapsulated, in contrast to GTK.

(Copied from here: https://news.ycombinator.com/item?id=20747126)

This video was posted here: https://news.ycombinator.com/item?id=20743293

This is from Dirk Hohndel, one of the developers of Subsurface, which was created by Linus Torvalds.
"Yes, Minister, that is a very courageous position to take!"

(British comedy series, "Yes, Minister", usual staff response to an appointed gov't minister's barking-mad pronouncement.)
i would say most use ableton nowadays. the reason why things sound the same is because people put 80% effort into recreating something that they love about another song
It’s not entirely obvious from the description, but the main difference is (I believe) that the cheap keys can only do FIDO 2-factor authentication whereas the expensive ones have secure storage so you do things like putting your pgp private keys on them.

If all you want is true 2-factor authentication for Gmail / Facebook / Github etc then the cheap keys are exactly what you need.
I agree with all of your points. Really Github should just let you remove any dependency on SMS entirely. I lucked out in that I never configured SMS as a fallback. I have backup codes printed out in a safe.
Show HN: Learn Japanese with Emojis and Short Stories
Manual Feature Engineering
I watched Apple’s live presentation with Oprah and other stars, and I was very enthusiastic about having another platform.

Since then, we got Amazon Prime for the bundled media (I had been on my brother’s business Prime membership that did not include video).

Amazon did a good job of integrating other paid services like Netflix, HBO Now, and CBS streaming. The user experience is actually pretty good, and the only hardware needed is a very inexpensive Firestick that our daughter and son in law gave us.

With no cable or satellite service, good internet, and monthly costs of $10 Prime, $15 Netflix, $6 CBS (for Star Trek), and $15 HBO Now, we have way more entertainment than we could every watch, and a reasonable cost. Friends who can’t give up cable are stuck because they are addicted to channel surfing the “news” shows, which I argue is a really unhealthy activity. No new and no commercials works for me.
You should have gone to the hospital to get it checked. That was risky.
I use USB-C devices almost exclusively and opted the other way around, carrying a USB-A variant with a C-A adapter. A few reasons:

* The A variant yubikey is crush resistant and mechanically simple for a longer life.

* The adapter acts as a form of connector saver for my yubikey, since I usually keep it physically attached to the yubikey itself. With this approach both wear-prone sides (C male and A female) are on the adapter, which costs as little as 1/50th the price of the yubikey.
What excellent article. It summarizes things that sometimes need decades to learn by ourselves. Reading books and good articles like this give us a shortcut for such wisdom.
I'm not sure what triggered the association for me, but it reminded me of Peter Watts' The Things.

http://clarkesworldmagazine.com/watts_01_10/
Only three black dots black and one white would not be possible.
Before the next recession hits, WeWork will be the first to die.

I hope someone from WeWork reads this, and knows it to be true.
Yeah, but I meant the more general problem of "modalization" and monetization of the Web, biggest service providers like Facebook or Google shutting down their open APIs and pushing us not towards common, open web standards, but towards some sort of closed bubbles or silos. Rss may have its own niche, especially among the hacker community, but most non-tech people will rely on Facebook or Twitter for staying up to date with sites/topics/people they wish to follow. And both FB and Twitter are neither open nor free (as in freedom)
That’s just one snapshot. In terms of motor vehicle exhaust:

NO2 in Paris is 5 right now, but it was 151 a few days ago. https://aqicn.org/city/paris/

NO2 in LA is 4 right now and peaked at 25 over the same time period. http://aqicn.org/city/losangeles/los-angeles-north-main-stre...

PS: Condescending all air quality into a single number is still useful, but does represent the subjective experience of different areas as well.
A 3D open location code
Sounds terrible. I hope you are better now.

I read here in a comment here about a person that went through years of antibiotics, to no avail. What finally helped? A 2 week fast. He said he found the idea on some forum and decided to give it a go, since he had nothing to lose at that point.
You'd think once you scaled up to 50 launches per year your process would as well.
exactly! creative flow is killed by all the fiddling you have to do to keep things working
The lack of a unified trade policy is easier to understand if you bear in mind that it's actually a huge team of people negotiating on the US side, almost all of which none of us have heard of before. It's definitely not Trump hashing a deal out on the top floor of his office: he's probably providing some executive direction, but even then he has other things demanding his time.
Governments around the world consider taxing red meat to curb climate change
I have noticed lots of things break when the resource horizon shrinks. Weirdness happens as on crosses into 1/2 (for things that like to double, like amortized data structures) and then again at <5% of free space/cpu/network/etc. Often the best mitigation is to have excess reserve and remove the false blocker (file on disk, optional process eating ram, etc).
I took my daughter to a Women in Bio event and someone pointed out that the biology pipeline is pretty much 80% female from the PhD level on down. Someone asked how long they were going to keep running the program and, of course, the women didn't have an answer. Who would? It's a nice job.
Scam Alert Domain Expiration Notices
Hey it's like Sublime Text!

I don't see how this is useful. It reminds me of the redundant scroll indicators on the top of some websites.
Agreed, there's a lot of uncertainty at this point. It could be a true story, and it would explain why he suddenly "resigned", but so far I've only see it circulate in dodgy WhatsApp groups. The article cites "local Hong Kong media reports", but I haven't seen it in the English language HK news (HKFP, SCMP, The Standard), and I don't read Cantonese...
I do not. It was one of the generic broad-spectrum antibiotics. One of those "take two then take one daily" if I remember correctly.

The doctor I went to was equally perplexed. He basically said "you never go to the doctor but you're here. I don't think you have lyme but I don't know what you have. I'll give you an antibiotic and see if it helps."
I own one, but never did manage to get much fluency with it. The build quality is good, though keeping it positioned in your hand right is tricky. I hold it with the bottom on my thigh so it doesn't slip down. The mouse joystick isn't analog and therefore basically useless.

That said, the ergonomics of it are stupid amounts better than any keyboard. You can just wheel your chair back a bit and sit however is comfortable. Changing position while using it is much easier too since you're just holding it in your hand.

I should get back to practicing on it I think. The advantages would be enormous.
Not the OP, but my experience with Lyme 25+ years ago in New Jersey was similar. I took oral and IV antibiotics over multiple years. The antibiotics I recall taking are Claforan, Ceftin, Augmentin, Penicillin, Ampicillin, Rocephin, Doxycycline, Azithromycin.

While my symptoms would often improve during/after a course of IV antibiotics, they would always return. I don't ever recall thinking that one of them was what cured me. It was more like the symptoms gradually tapered off over years. I do, however, credit my MD's willingness to aggressively treat the symptoms with my eventual recovery.

Interestingly, both my MD and his wife (also an MD) had Lyme, as did at least one of their children. My advice to people who think they have Lyme is to seek out a physician that has experience in treating Lyme and a willingness to do so. At the time, there was a lot of pressure in the medical community to simply give two weeks of oral doxycycline and then tell the patient that they have to live with whatever remains.
My understanding is the issues that lead to U2F being considered to be better than TOTP were mainly about it being phished easily compared something which will only dispense the right code with the right challenge.

But if you never actually login with TOTP, and always use your U2F key, then does it actually decrease security to have it as a backup/removal option and you know that's the only reason you'd enter it.

It feels like its competition there is "convince phone support with a sob story" and TOTP feels like a clear step up from that.
Matt Levin recently wrote about this too: https://www.bloomberg.com/opinion/articles/2019-08-19/we-loo...
Lets see, the fine particles of soot you get from wood or coal fires aren't going to get into the plant, or are the fine copper particles from people's brake pads. Nor will carbon monoxide, nitrous oxide, or sulfer dioxide. Most sorts of pollution that can make you sick from eating vegtables exposed to it will kill you super dead if you breath it in. One obvious exception is lead which can accumulate in soil over the long term so make sure you don't get your urban garden soil from an abandoned lot which hasn't been tested for lead levels. Also some radioactive isotopes of things like iodine can be concentrated in plants but the ones that come to mind as doing that, like iodine-131, have half lives on the order of days to weeks so that's mostly just a concern if there's been a recent reactor meltdown or nuclear attack in your area.
How about a split, so releases can be uploaded by API key, but only published by someone using MFA?
Kallithea was an option 2 years ago, now the development of it is basically dead. Rhodecode is still releasing regularly. Just check the feature differences: https://rhodecode.com/blog/133/rhodecode-vs-kallithea-compar...
> Actions taken by individuals who are employed by the government--especially when such actions are explicitly illegal--hardly count as an abusive government.

When the justice department does not enact the punishments for the laws they set, it is absolutely government abuse. Authority is authority, and people rarely use it uniformly. All are government action unless actual steps are taken to punish it.

> Got a link?

https://en.wikipedia.org/wiki/CIA_involvement_in_Contra_coca...
https://www.intelligence.senate.gov/sites/default/files/hear...

And then combine that with the sentencing differences between crack cocaine and cocaine (same drug, vastly different punishments). You can also look at the legal treatment of opioids and the origins of marijuana laws (originally targeting mexicans)

http://www.drugpolicy.org/issues/race-and-drug-war

> Research shows that prosecutors are twice as likely to pursue a mandatory minimum sentence for black people as for white people charged with the same offense. Among people who received a mandatory minimum sentence in 2011, 38% were Latino and 31% were black.

Again, the justice department's actions are government actions. Absolutely abuse of citizens.

> Allocation of scarce resources in a way that you personally disagree with is not the same as an abusive government.

Not that scare really, first of all. Secondly, resource allocation is a powerful tool that's literally used to strongarm other countries and across world politics. The action does not define abuse, the effect of the action does (in my book at least). Letting thousands die because it is affecting a minority population is an abusive policy. To take this to an extreme, food is a scarce resource, so if the US made a law saying X people don't get food, that would 100% be abuse. Now that's nowhere near the same thing, but it shows that again, the effect defines abuse, not the action.

--------------------------------------

I think the latter two come down to a fundamental difference in the definition of abuse. If you use a literal model of an army physically hurting people then sure. And it's not the exact same thing - nowhere did I say HK = USA. But your first comment got the reaction it did because it appeared to sweep a lot of the US's less than ideal history under the rug for the revisionist "Well post slavery/civil rights everything was great!".
Nonsense from a user with a throwaway.

>Courtney Dauwalter dominates men in Ultra races

She will sometimes beat them, if that's what you mean.

>you can call them niche races if it helps your ego, but lets call those races what they really are...the longest and most grueling races, stacked with elite and professional runners.

Even the most competitive ultra is a niche race. If the award money for ultras increased 10x overnight then east africans would be dominating in 5 years (the most competitive ultra in the world, UTMB, has a reward of €35,000).

And competition wise, races in america are a far cry from european ultras which will often have thousands of runners. Not to mention thousands of meters of elevation.

The fact that this woman's many extraordinary achievements are buried under titles like "Women are better then men in ultras" is disgusting to me.

EDIT: Oops east, not west africans.
loosely speaking, I think there's a limit on finger actions per unit time, so if you're spending more per letter, you're getting a lower WPM

as an example, Matias' one-hand keyboard, in which half of the characters cost an extra keypress, had people getting up to 75% of their normal qwerty WPM [1]

I've never seen any study of a chording keyboard doing more than 70 WPM without a steno style multiple character output system

[1]: http://edgarmatias.com/papers/ic93/
And it's getting worse by setting the wrong priorities.

OPs point stands though, as there is no platform like YouTube where you can easily discover similar content. wordpress.com is not really the place for that, either.
French school mobile phone ban comes into force (2018)
Surely you're not arguing that these ultra-marathons aren't niche compared to, say, the New York City marathon or marathons in the Olympics? It seems like a bad-faith argument to assume the person you first responded to is belittling the races just because women can and do win them, rather than because they get MUCH less publicity/interest. No reasonable person is going to suggest a 50K marathon isn't physically way harder than a standard marathon.
Handy table comparing their 5-series options:

* https://www.yubico.com/products/yubikey-hardware/compare-yub...

Seems the main questions to ask yourself are:

* is NFC desired?

* do you need/want USB-A or USB-C?

This product adds a Lightning option.
If the companies didn't profit from it, I'd fully agree with your statement.
Ignoring the Crystal issue that others already answered, why didn't Julia developers instead create a kick-ass JIT for Python or R?

And the answer to that is that the semantics of the language were designed from the start for efficient JIT'ing. Thanks to the language design, Julia can get close to C performance with a comparatively simple JIT approach (resolve types, compile a function statically with LLVM just like C, then use multiple dispatch to select the right function at runtime (simplified, yes, but roughly like this)). Compare this with all the tracing JIT heroics that Javascript implementations or PyPy pull, while still getting performance far from what Julia achieves.
GitHub Quietly Opens Learning Lab to Everyone (and Any Subject)
Yea, knowing what I know now about fasting, that would have been the first thing I tried, not surprised at all that it worked! Glad he is better.
Better yet to pressure companies to not hire / fire anyone who is on a list... that way folks can see "what happens" to people who don't do "the right thing".

The general population will find that quite upsetting.
I'm sorry to be pedantic but you've used "loose" incorrectly 3 times in a row. It's "loses" and "loser"
Facebook wants to make cryptocurrency mainstream. Here's how
Emacs supports chorded key combinations.

http://melpa.org/#/key-chord
> She even holds the record for longest run in a 24 hour period

No she doesn't, she held the womens record for that category but never the mens.

Men record 24h: 303.5 km

Women record 24h: 262.2 km

Dauwalter record 24h: 250.0 km (155.391 miles)

> She is beating professionals in these ultra's

I highly doubt that, there are extremely few professional ultra-marathon runners. She might beat professional marathon runners, but that is another sport so isn't really comparable. It is like beating a 100m runner in a marathon, women can do that easily.