skysight-inc/HackerNews huggingface dataset:
If someone is asking you the PIN so they can confirm it is you, you can ask them to give you the PIN so that you can tell if it matches or not.
For one, it needs to install the SDK's for the new deployment target you just installed (be it macOS or iOS), and update the toolchain so it can build for it.

It's mildly annoying, but the alternative would be to let you continue using the old version pegged to an older deployment target, and let you figure out all the incompatibilities at once when you decide you want release your app to the app store. IMO this would be much more annoying than just getting a coffee once while you wait for the upgrade.
that they had a DB with bank ids<->phone numbers already.
China doesn't really vote with wallet. It's CCP telling/herding/forcing people of China what to do and the populace is going along, because the alternative isn't pretty for them.
You! :)

AGPL requires all users to open-source their projects using your work, even if they don't modify your work. It is an extension of GPL not LGPL. If my web application uses an AGPL library, it's a derivative work.

I, like many in my field, work in a small team with almost no budget. My current project involves collecting sensitive (medical) data over the internet. The cost and risk involved in open-sourcing our application is prohibitive.

However, it's slightly less relevant for your project, as I can't see much value in directly integrating it into another application :) This is more a problem we run into with AGPL libraries, not AGPL applications.
Interesting! So salt, Magnesium, and potassium only. I want to try fasting for a week or so. Is there a specific type of these supplements you recommend?
There's an individualized (unique per device) embedded cryptographic key in each Apple processor, emulator solves nothing on that front.
Who does "Phishing protection as a Service"? Like, a line you can call and ask "Is this legit?" .
Hi guys,

I have built a custom hook for form validation, please check it out and feedback welcome <3
Thank you.

I am speechless on the behaviour from DropBox.

I wonder why I have never heard of this and I do not remember any major security scandal regarding DropBox stealing your admin passwords, but maybe that information just went around me for some reason.. :)

EDIT: I wonder how this was implemented, I imagine that any app, can recreate a pixel perfect dialog imitating system dialog asking for password and steal your sensitive information, though how can app add itself to accessibility list programatically? I am not knowledgable of MacOS API and somehow I think apps should be prevented to be able to do this on their own. Was it a MacOS security bug? What else DropBox did "under the hood" with admin password that we do not know of yet?
I mean, if they called you why do they need to send you a pin though? Safest way is to just always call the bank back that’s what I do.
Real problem is motivation.
Try to find a better job? Then we need to push our self for constantly learning.
We live in a society where people upgrade their phones every 6 months but do not think about the routers for years.

I wonder if there's any company that's trying to encourage people to upgrade their routers often.
One I almost fell for, was a tab that changed to a Gmail login screen in the background. When I switched to it, I thought I had gotten logged out and entered my password. Luckily 2fa saved me. Did not use a pwd-manager at the time, that also would probably have prompted some red flags when it didn't auto-fill.
US DOE and US Army collaborate to develop hydrogen fuel cell vehicle technology
I'm surprised this doesn't happen way more often with many other pages. But we were all warned not to take Wikipedia as a single source of credible information. If bold statements or dubious information is not properly linked to credible sources (and even then...), don't take it as 100% true.
okay, personally I thought that piece was a little fluffy and made me think of this quote from the Billy Madison movie:
<<At no point in your rambling, incoherent response were you even close to anything that could be considered a rational thought. Everyone in this room is now dumber for having listened to it. I award you no points, and may God have mercy on your soul. Billy Madison : Okay, a simple "wrong" would've done just fine.>>
This is so true. My wife (US) just needs user+pwd to access her bank. Me (Italy), had physical tokens or at least SMS 2fa for years.
Also EU is now going through a major security upgrade for banks with SCA (Strong Customer Authentication)
It seems like a standard library sort-function is the ideal candidate for investing in proving correctness.
Depends what you need to do I guess. For ‘normal’ usage I like Solus.
>> I'm still waiting for the option to see the ads that I want to see.

It's not about what you like, it's about what you need or think you need.

Probably is because your interests change over time. And because they want to profit on what you need today. You might like cars, but you don't buy cars every day, just as me that I don't purchase guitars every week.

I think they want to profit from your immediate need, and that requires spying on you, your messages, your browsing history, etc.
Oh it gets worse.

My UK bank had a hardware token for years. They recently "upgraded" my security for online banking, and now use SMS 2FA codes for login and authorising new transfers. The hardware token is now unusable.

I'd change banks, but I doubt the others are better.
This:
Under GDPR, IP addresses can be considered PII,so it makes sense to set up an anonymizer

is wrong. First of all, PII is a legal definition from mostly the US. The GDPR talks about Personal Data, which is different. If any consultant is talking about GDPR and PII, he is confused, stop listening. Have fun reading the details here: https://gdpr-info.eu/art-4-gdpr/

Which doesn't matter all that much, because the next part of the line is way to broad:

Is an IP adres Personal Data? Maybe, if you can use it to track an individual. But if you arent an ISP and don't actively try to identify anybody with an IP, stop worrying.

Next question: Do you need it? In general, using them for keeping the website running is normal usage.So no need for consent. Using them for attack prevention might actually be an industry best practice, and then the GDPR requires you to keep them.

Next question: If you need them, how to keep them safe? Throw logs away after a while, encrypt backups, etc...

The GDPR has been hijacked by consulting companies to extract money from everybody, so they do their utmost best to sow paranoia with all kinds of weird urban myths. DOn't believe it. Basically, do the normal IT best practices and stop worrying.
"Data doesn't want to be organized in a single static hierarchy."

Data has no feelings.

In the case of file system, it makes perfect sense to be stored in a single static hierarchy because that perfectly reflects the concept of a paper file in a filing cabinet, in a little binder.

Even a relational database system that lets you query tables for data based on set ordering has a single method of storing the data on disk - that's a clustered index. You can't get away from having that, despite being able to support additional nonclustered indexes. In that case, the table and its rows really is organised in a static hierarchy too.

As it stands, NTFS has plenty of features that lets you attach a secondary data stream to a file anyway, and all manner of metadata. The Windows Internals book on NTFS is very informative on this.

These features don't exist on APFS though, as it's not as good despite being brand new, it seems!
I just got a t480s and I feel the trackpad is my main complaint ... it feels kinda plasticky and the responsiveness isn't quite there (e.g. phantom dragging).

Overall, the quality doesn't compare to my 2013 macbook air, but it does have some newer features which're nice.
Sure, but I hope we can agree that the power of cops is quite different from the power an IRS reviewer has over you.

And while a lot of tickets are issued on a his says, she says basis, this is not how a tax audit works, is it? I'd say its vastly easier to defend oneself against a paper trial based acqusation of tax fraud than again a witness based police acquisation.
Musical Tonality and Synchronization
This is partly an issue with phone calls as a medium. If the bank only contacted you through the app, this couldn't happen unless the app itself was compromised somehow.

E.g., the Monzo app has a chat functionality built in. If, upon a fraud attempt, a notification appeared in the Monzo app, it would certainly be legitimate.

If the ease of conversation offered by chatting with voice is necessary, add a link in the chat that has the user call the bank, not the other way around.

You can't easily verify that someone is who they say they are over the phone.
(XLM) Stellar is an existing alternative.
I don't understand why people use Twitter to begin with. It's what, 160 characters of text per tweet, right? But to load the webpage, it wants kilobytes or even MBs of data in scripts and media objects, and it doesn't even work with JavaScript or media disabled. To simply show a text message! There's no graceful failsafe mode to display a few bytes of text! This makes one conclude that Twitter is a data gathering and marketing business disguised as a messaging platform. Anything they do as a company should be very, very suspect.
Your bank. If someone rings you claiming to be from them, you hang up and call the phone number printed on the back of your card.
N8n.io looks amazing. I would absolutely switch over to this if there were more integrations! (Namely: Shopify & Zoho Mail)

Half-tempted to dive in and see if I can code something up, but I need to focus on other parts of my business and not dive down the scratch-my-itch dev rabbit hole (again).
Hashnode Series: The What and How by Bolaji Ayodeji
Although I'm not personally a fan of it, I don't see what Gnome is lacking that you can get on those OSs you listed
Well remembered!

I used to work with a guy who was a spitting image of the PC character
When sending SMS or other notifications, always include the purpose. "You requested a password reset, the PIN to completel the reset is 112938181".

Ideally the pins are also in different formats, so your normal PIN to login is a 6 digit number, the password reset is a 12 digit alphanumeric.
If my bank calls me then I call them back on a number that's on their web site.

I'm always amazed at how stupid the security situation is in these cases. Banks, telecoms services, etc. do actually call up and try to 'take me through security', and when I say "tell me something you know about me first so I know you're who you say you are", the best they can usually manage is "well, uh, you bank with [Bank]". It just perfectly trains us to fall for scams.
OP here. Just a couple of the things I learned since I posted the Twitter thread:

- The caller spoofed the phone number of the bank. The bank was not in my contacts, so I did not notice. Someone else in the thread noted that they did have the bank's phone number stored, which upped the credibility of the call to them.

- The caller called me twice in rapid succession (First ignore the call from a number you do not know. Then they call back again immediately: "maybe this is urgent / important"). Another person in the thread, who fell for the scam, noted this same pattern.

- It is better if banks include a security warning / specific reason the code is sent with the password reset pins and similar credentials. My bank did not. Another twitter user noted being subject to the scam, and just glancing over the warning copy. So it helps, but it is not perfect. Especially pre-coffee.

- My bank no longer allows me to reset my password without calling them (thanks bank).

When I read the thread now, it's obviously full of red flags. I was successfully manipulated, and whilst I'm certainly not as clever as all the people pointing out they would have caught this from sentence one, I believe I'm also not the lowest hanging fruit in terms of a target :-) Makes you wonder what this will look like when these scams evolve another couple of generations in terms of complexity ...
From reading the description it seems like AAA used tests where there was a bend in the road and / or the pedestrian was moving across so they weren't actually in the path of the vehicle until a couple seconds before impact. These systems are going to be conservative in classifying potential obstacles as in need of emergency braking, as they should be - you don't for example want your car slamming the brakes because it sees a pedestrian on the sidewalk next to the lane you're driving on.

That said, it should be noted that the Honda Accord actually did quite well in these tests.
Thanks for a great post. I also want to recommend you excellent gaming platforms for https://greataussiepokies.com/online-pokies-free-spins-bonus.... There is something to choose from.
It's even worse in Russia - fake caller ID makes you think you are talking with the bank, mobile phone operators don't seem to be doing much, or at least didn't a couple of months ago.

That said, all the banks I used send you along with the confirmation code a description of what you are actually confirming.
A quick internet search finds news articles from March 2018, for example:

> the Windows and Azure platforms are being combined, operating under Jason Zander

https://arstechnica.com/gadgets/2018/03/windows-leader-terry...
The easiest way to avoid this entire class of attack, is to never be willing to answer any kind of question from someone who calls you. Always hang up, Google the customer support line for the business, then call them.
It depends on the contract.

It's good to have a contract that defines behaviour even in the case of invalid input.

That could be throwing an error, or it could be given unsorted input. Either way is ok.

(The C and C++ answer is to leave the behaviour in the face of invalid input undefined. Undefined means that anything goes, including formatting your hard disk.)
Personally I like Manjaro and Mint a lot.

If you want something that feels familiar after using macOS, you maybe should try Elementary OS: https://elementary.io/
Factually correct. not sure why this is being downvoted.

https://github.com/libra/libra/blob/master/Cargo.toml
A guide to completely rewrite with React Hooks
Do you have a history of this - was it just that the ownership was moved offshore? Did they "not work" or was it just lobbied against?
Many actual banks and brokerages do exactly this
You're probably looking at this from outside the mainstream Western perspective which is, for demographic reasons, inevitably the majority view here. I've posted a ton about this today. Perhaps it would help to review some of those posts:

https://news.ycombinator.com/item?id=21200971

https://news.ycombinator.com/item?id=21199884

https://news.ycombinator.com/item?id=21195089

https://news.ycombinator.com/item?id=21195898

More comments on this at https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que....
Which bank you have is not very secret information. Any payment exposes that information.

It's a very clever scam, but it's also a very insecure bank if this is enough to authorise payment. Get a different bank that uses 2FA, makes it clear what an authorisation code is for, and doesn't call you for this kind of sensitive information.

If they really do need to reach you quickly to stop a fraudulent transaction, a simple "that's not mine" should suffice. They know they're talking to you because they're the ones calling you. If the person making that payment has also stolen your phone (entirely possible) they will not deny they made that transaction, because they want that transaction to stand. That means only confirming it's your transaction in this situation is suspicious, not denying it.
I've never heard of Wireline before, but looking at the above tweet and a quick glance at their website (https://www.wireline.io) makes this whole thing smell like a team of amateurs running a scam. Why anyone would think it would be a good idea to dump a million USD into any ICO is beyond me.
Microsoft ships the entire Ubuntu, which does contain GPL3 code. Maybe they get away with it because it's not so integrated with the rest of Windows.
Ask HN: What's the best way to detect whether a road is jammed?
I have a webcam looking at a particular narrow bottleneck of road near my house. It's usually either free flowing, or completely jammed for ages, most often due to two wide cars not being able to get past each other leading them to have to reverse and do some weird manoeuvres.

I want to build a system which will output whether it's jammed or not. What would be the best path to go down for this?
My bank does that. They call you and say "we need to talk about some fraudulent transactions, can you please ring the helpline and ask to talk to Dave".
This is a one hundred year old study which literally states on the first page:

> These studies were supported in part by a research grant from the Institute of American Meat Packers.

Inuit populations suffering lower incidence of heart disease is a myth.

https://www.ncbi.nlm.nih.gov/pubmed/12535749

> The mortality from all cardiovascular diseases combined is not lower among the Inuit than in white comparison populations. If the mortality from IHD is low, it seems not to be associated with a low prevalence of general atherosclerosis. A decreasing trend in mortality from IHD in Inuit populations undergoing rapid westernization supports the need for a critical rethinking of cardiovascular epidemiology among the Inuit and the role of a marine diet in this population.

https://www.ncbi.nlm.nih.gov/pubmed/25064579

> Most studies found that the Greenland Eskimos and the Canadian and Alaskan Inuit have CAD as often as the non-Eskimo populations. Notably, Bang and Dyerberg's studies from the 1970s did not investigate the prevalence of CAD in this population; however, their reports are still routinely cited as evidence for the cardioprotective effect of the "Eskimo diet."

They don't have lower incidence of ischemic heart disease than white westerners, they don't have lower levels of atherosclerosis, and these have actually improved as their diets have become more western and less traditional.
My simple policy is I never give out any information if I'm cold-called. If they claim they're my bank, I say I'll call them back on the number printed on the card, and ask the caller which department I should be put through to. Legitimate callers have never objected to this approach, and it saves me any stress - same policy, no matter the caller, no exceptions, no need for me to try and figure out if I'm being phished.
This is really a SS7 issue not a Russia issue, spoofing outbound caller ID in the USA/Canada is also trivially easy using any major SIP trunking provider.
I have endogenous hyperinsulinemia (mostly proinsulin). That means I really can't go without consuming sugar or I will get neuroglycopenic. What's interesting is (they don't know yet) this could be caused by a type of pancreatic cancer. Seems really bad then if the cancer itself wants more sugar. Maybe this is why Steve Jobs tended toward fruits for 9 months and ended up with metastasis...
> Intel cards are the only option if you're buying a Thinkpad.

Not true. My Thinkpad E485 from late 2018 has either a Broadcom or a Qualcomm chip, but definitely not Intel. It works like a charm though. The bigger issue is the Realtek Ethernet NIC which has an annoying driver bug where it does not detect the carrier except when the cable is already inserted at boot time. Never buy Realtek if you can avoid it.
The problem is taking a low salary at the start limits the increases you can get for the rest of your career and your also ignoring the time value of money.
For a fair comparision he should have bought one of Dell's laptop which come preinstalled with Ubuntu.
> Last time I needed a new token issuer dongle, I had to actually visit the bank and sign stuff.

I'm glad UK banks try to avoid physical dongles because having to go to the bank and sign stuff to get one is not always convenient, not to mention you need to carry around the dongle everywhere, and if you lose it while you're in vacation it's yet more troubles.

Phone 2FA would be good but a bit pointless because the 2FA app is on the phone, and so is the banking app. Personally I'm satisfied with the way UK banks handle security - it's secure, they block suspicious transactions, etc. yet it doesn't get too much in your way.

I don't think UK banks are less competent, it's just a fine balance between usability and security.
tried going to networking events for years. didn't do anything. the only thing that actually made a difference was to give talks myself and help people (without letting myself be taken advantage of)
The bank I'm currently at has this "obnoxious" text around verification numbers:

Don't EVER communicate the following verification number to anyone, including <bank> collaborators: 123456

SMS OTP should always have that or similar text.
Personal Finance, Budgeting and Financial Literacy Application
That PIN should not even be readable information. It's a password. It should be salted and hashed. It should be useless for any kind of over-the-phone confirmation of your identity.
This has been my experience too. I was looking forward to the feature and upgraded straight away to try it out (something I'd never normally do!). But I've found that response to commands is flaky, there's a noticeable performance impact, and, worst of all, dictation doesn't seem to be supported in non-Apple applications, e.g. Slack. Pretty disappointing.

I'm still using the "basic" dictation feature, which works well enough, but doesn't support editing.
Does Warp actually hit the CF Bangkok endpoint when in Thailand? Is local regulation affecting Warp rollout location wide? This would circumvent the licensed international gateways as I imagine Cloudflare is backhauling this traffic to Singapore fine as a CDN edge but as ingest for VPN traffic sounds risky... Can you check? I bet your hitting the Cloudflare SGP cluster instead so still leaving Thailand via True/CAT/AIS/TOT/3BBJastel.
Power is out here. Not a trace of wind.

This is just corporate spite. "Look what you made us do!"
I don't understand why there are still banks that do SMS verification. It has been proven so many times now that that it is vulnerable to both phishing (proven here), sim swapping attacks, etc.

The banks here in the Netherland all have (well, except for one maybe) hardware authentication devices. They are portable smartcard readers, you insert your card, enter your PIN on the device itself (not your computer or phone) and transfer a digest from your PC to the reader by typing or scanning a QR code (some readers have a little camera). You then type the signature into your computer or phone.

The readers for my bank even have a screen, that tells you what you are signing, like a login, or transfer of which amount to which bank account. Photo here [0].

The banks are very clear that they will never ask you to use the device over the phone. And that double confirmation by showing the sign action on the screen of the reader makes any form of phishing really hard.

IMO these smart card readers are the best compromise between convenience and security for banking.

[0] https://4.bp.blogspot.com/-6c1NGHew1P8/VBqvTeqDQdI/AAAAAAAAf...
Yet the author chooses to use a bloated piece of software (Wordpress) to highlight the issue. The software uses lots of CPU, Lots of RAM, Lots of resources which in turn uses energy, ironically the author evewn talks about optimising code in the article.

Epic fail
There's so many outside circumstances that might even make a technically adept person like the original poster fall for this: bad day at work, fight with the girlfiend, getting called in traffic, having loud kids playing at home, not feeling well, etc.

Like you said, spam and phising used to be obviously bad but I'm afraid I'm going to fall for it some day now.