skysight-inc/HackerNews huggingface dataset:
> The military and the judicial system had to be purged because a religious cult had colonized them

Ok, just so we're clear on this: that's ridiculous nonsense, conspiracy theories basically, but you're using it to justify the indefensible actions of a hard-line authoritarian ruler.
And to what degree are the numbers skewed by the proliferation of "left-pad" tier libraries on npm?
If this were a tech interview and you had ever had a job in industry on your resume, I would likely end consideration of you a candidate and switch to mentor mode to help you understand what to study before your next interview (at a different company). I dislike when developers insist on “not invented here” mentality and anything concerning security should not be an excuse to reinvent the wheel and make the same mistakes a million other developers already made.

Auth is ridiculously complex, is the source of MANY critical security defects, has plenty of frameworks which solve significant parts of it, and always seems easy until someone explains to you what all you didn’t know you needed.

Components:

- login page

- two factor state

- password reset form

- username lookup form

- logic for 401 status

- logic for 403 status

- throttling, is ban, user lockouts, and/or captchas for the forms you don’t want attacked at scale

- if you are storing credentials on your server (like password hashes), you better know what the options are for hashes, what a salt is, have investigated bcrypt and scrypt, know what happened when any of the thousands of large websites had their user databases leaked

- maybe support warning users that their credentials in your DB matches a record in HaveIBeenPwned and lock down their account until they password reset using their email address

- have a plan for when the hash you chose is deprecated in a few years while you aren’t paying attention and need to spent days re-coding to support new hash and legacy hash users, auto-migrating the legacies on next login

- want to support multiple 3rd party IDPs as well as local password auth? That starts to explode complexity and the number of forms.

- want to support SSO for enterprise? Use a framework that already supports SAML integration
I've resorted to using YouTube with Safari when I want to watch a video in Picture-in-Picture mode.

I'm NOT paying a monthly fee for a feature that basic.
Never realized that until you mentioned it. And I've owned some of their products for a long time. I guess it's because I figured it was pronounced "satéchi" which is more likely sound for an Asian company ("saké" and not "sakeuh")
Dems' Iowa caucas voting app stirs security concerns
Typically to integrate OAuth2 based authentication flows, you need an OAuth Client ID and Client Secret that identifies and authenticates your application with the provider. Generally this requires an account of some kind, though it may not always be identical to a normal user account on all systems. For Google you would need a Google account, its managed in Cloud console (though any kind of account will work.)

I actually don’t know if you need this if you just want to identify the used, off hand; I know there is a separate flow for that when using OIDC, but I suspect it still would have at least a Client ID. (This would be used for the provider to display your application name and possibly some other info.)
Nit: I don't believe that comparing hashes in constant time is important, as long as you accept the user's password and then hash it, since being able to find the prefix of the hash is computationally just as hard as reversing the hash.

Though it doesn't hurt to do anyway :)

It is important when comparing (some forms of) auth tokens, such as csrf tokens.
can you recommend any good for windows?
powertoys doesn't work for me.
How do you handle a single atom? How do you know there's only one atom?
And bash is also perfectly OK. It doesnt have all the bells and whistles of, say, zsh- but the things that it does do, it does better (especially autocomplete).

If you want to write scripts, bash is often a pretty good choice for anything involving simple manipulation of text files. If you want something more advanced then bash will let you edit, compile and run programs in the language of your choice.

That said- there may well be a killer usecase for Oil. If so- what is it?
In .net world aspnet identity give you a basic login, can add social logins and identity server adds auth2 support. Both highly customizable
The idea was that simulator was for fast-as-possible turnaround for most stuff, but you’d just use a real device wherever specific hardware behaviours are being developed.

I get the appeal of a more “complete” emulator, but such things are never perfect anyway—best to not even pretend that they are.
Do you still have the titles of those books at hand? I'd love to take a look at them.
I am working on a hyper-open, hyper-compatible, and hyper-accessible forum system with accessibility by historic browser included in the spec.

I use a multi-layer authentication system with various levels of compatibility, security, and accessibility.

* The default mode is unauthenticated, which allows the user to post plaintext. Optionally, this can be backed by a device fingerprint, which would group all of this user's posts together. This is supported by all post-Mosaic browsers, except perhaps Mosaic 1.0, which does not support HTML forms. (For Mosaic, there is a fallback writing mode, of the form http://example.com/your+message+here)

* There is also a cookie-based authentication system, in which the user asks for a new ID, and the server sets cookies for user id and checksum. The checksum is checked against a server secret via hashing, so no storage of account data is needed on the server. This works with all cookie-supporting browsers.

* The other authentication system is based on PGP, and allows the user to either use in-browser PGP (insecure) or client-based PGP (less insecure) to sign their messages. These messages can be both client verified and grouped together into a profile on the server.
Later IRIX .28 and above has an active community.

I feel the same. Indy amd O2 were amazing computers. I got rid of all my SGI gear. Every so often I feel a pang of regret...
David Foster Wallace on David Lynch
Not true. Sometimes it's whistleblowers and people who rather not have their identity doxxed in case they end up fired at <insert FAANG>. Sometimes people want to share extra info about their startup but w/out divulging who it is... where as their REAL profile has all their personal data so you can easily figure that stuff out.

There's plenty of reasons for throwaways besides just being 'nefarious'.
Show HN: The Best way to Protect Data in Python
Group texts are some arcane crap that seems to be very heavily an US specific problem.

The rest of the world uses WhatsApp or Telegram or something similar for group messages (and pretty much ALL messages).
> I don't know why would I use framework or even service, it's just few dozens of simple lines of code

Oh...oh god...oh god nooooooo!
The important part is the cortex, so in this case he might have lost some white matter connectivity but kept most of the gray matter structures. IQ of 75, though.
Has she ditched The Voice? Perhaps that got him attracted. She is intelligent, too. Which is potentially attractive.

As for physically attractive: lots of make up isn't, to me. She seems tall. I don't fancy blondes. Ie. also matter of taste.
> command clicking everywhere to easily find call sites and follow application logic

Not as intuitive but it's there:
⌘+Ctrl+Shift+H

> xcode also feels less snappy

Not sure what you're doing in Xcode but as long as you evade using automatically updating live UI views it should be pretty snappy.

> When I used it last you could not refactor swift code but I think that's been added now?

Well there's a small handful of things now but Objective-C never had a ton either.
Lots of people using it in production. Snowflake, IBM Cloud, Goldman, VMWare.

CouchDB is re-architecting onto it, https://youtu.be/SjXyVZZFkBg
Digital Marketing Course
Digital Marketing Course for comprehensive knowledge
> Changes to licensing in leading open source projects like Mongo DB and Redis are reminders that...

That the author should do their homeworks and get the facts right. Redis is BSD licensed for 10 years now. Redis modules by Redis Labs, never a part of the Redis core, changed license.

Article flagged because I can excuse a casual commenter here but if you write an article about OSS licensing and are not able to show facts in the correct way, for me there is no place on the HN top positions.
Having had the concerns and experienced the issues described, I eventually built a clone of Pinboard and now run it privately. Added Telegram bot and iOS shortcuts for dumping links, adjusted tag system for my needs, and so on. Having control over your bookmark archive feels great, and then you can transform it into some kind of a knowledge management system like Zettelkasten. In any case I don’t see how the author is going to work on Pinboard being busy as he is with other issues.
Grant Sanderson is doing such amazing work in divulgation of science and mathematics, promoting, I think, real understanding rather than the mere illusion of fluency. He's like the opposite extreme from WIRED Magazine, Chris Anderson, Malcolm Gladwell, and Deepak Chopra.
There seem to be several devices that offer two USB-C ports and two USB-A ports. That's pretty inefficient but at least it gets you more ports.

https://www.amazon.com/AVLT-Power-4-Port-USB-3-1-USB/dp/B081...

You're pretty screwed if you want a 4 port hub, yes.
The older post [0] has some info:

> Our research team analyzed our database of over 3M open source components and 70M source files, covering 22 programming languages.

[0]: https://resources.whitesourcesoftware.com/blog-whitesource/t...
Is recutils available as a library? Are there language bindings? Specifically asking for Go support.

Never heard of recutils before but the on-disk format looks compelling. There has been limited (no?) takeup however which makes me fear recutils are intrinsically broken
Having used Siri, my optimism about Apple AI and technology, above all other competitors, powering a car are not great. It’s significantly behind Google and Amazon on that front. Wouldn’t it be odd if they were suddenly the world leader in self-driving vehicles?
In my current situation I don’t always agree with my tech lead on design decisions. Sometimes I can feel a bit stressed about the tasks I’m assigned too, since I have this sinking feeling where they might end up down the road. Still, the experiences I’m having at my current job are worthwhile to me, so I’m overall okay with committing to my current situation.

I’d ask you the same question: do you feel you’re overall benefiting from the job you’re in? If not, and you’re able to, it might be good to look for other work. You might find satisfaction, and someone else might be a better fit for working with this lead of yours.

One thing I’m aware of is that while I don’t always agree with my current lead, I know that he’s shielding me from incompetence from other areas of the team (and there are plenty of incompetent people on any org!) to help me be productive. Consider if that’s true for you too; if not than I think it’ll be easier to leave than you might be considering.
This is the kind of thing you tell investors to justify a higher valuation because the total addressable market is potentially massive. I wouldn't read it too literally. They're very likely to be focusing on just 1-2 of these to start.
Side note: Using the language the correct way to compare hashes is important. Researchers found that PHP can coerce strings into scientific notation if the hash begins with “0e...” and using the == != operators, thereby causing a massive error space[1]

[1] http://www.darkreading.com/vulnerabilities---threats/php-has...
GraphQL Support in MongoDB Atlas with Stitch
Firebase Authentication.

I can't say enough good things about this service as it has been a game changer for me productivity wise.

-Supports most of the popular OAuth providers natively or you can add any custom OAuth system via custom tokens.

-SMS Auth, passwordless login (aka magic links)

-Excellent and well maintained client/server SDKs for most of the languages. Makes user management very convenient, including neat things like revoking tokens, cookie session management, linking accounts of users with multiple providers, RBAC via web tokens.

-Tight integration with Firestore. Can have fine grained security controls on which users can read/write what documents etc.

What takes the cake is Custom Tokens [1]. This is really useful for seamlessly integrating with another authentication system. Would recommend anyone to take a look if they're exploring an auth service.

[1] https://firebase.google.com/docs/auth/admin/create-custom-to...
Not all fruits hang the same. Some hang low, some don't, and the tools we use to pick them change as we try.
Ask HN: How do you deal with being laid off?
I was recently laid off as a part of a mass layoff, and I'm having a hard time coping with it.

For context: I was at the company for a little over two years. It was my first job out of college, and it was my top choice. While I wasn't the smartest person in the room, I was promoted once and was on track for the next promotion. I was completely blindsided by the layoff.

I think there are two main things I'm having a hard time with:

1) Comparison: I keep comparing myself to every person on my team who wasn't laid off - especially those who joined the company much after I did. I know I'll never truly understand the reason I was picked over others, but I can't help fixating on it. It is a huge blow to my self esteem. I feel like I just went through a breakup without any chance for closure.

2) Disorientation: I realized how dependent I was on the ecosystem. In a matter of hours my whole world was upturned - I was suddenly kicked out from a place that basically provided 3 meals, all my social contact and most of my intellectual stimulation. While I do have hobbies outside of work, being removed from place that was more familiar than my apartment feels extremely disorienting.

How have you dealt with being laid off in the past? Also to managers who are willing to share: How are layoffs usually decided?

PS: I'm not worried about getting hired elsewhere. I'm more concerned with being 100% okay before starting my next adventure.
O2 has a specialized graphics sub-system. Copper?

Anyway, it is a shared memory system, and under IRIX, that was done dynamically. The same chips were used in their NT visual workstations. Those did not manage the graphics memory dynamically, but were capable in every other way.

At the time, one could push 500mb plus images around like nothing. Was a big deal.

SGI did Linux drivers, and the SGI / Microsoft Farenheit project got in the way. Those never left SGI for legal reasons. Had that happened, perhaps Linux for an O2 would make sense.

I am not sure that system has ever seen a low level document release.
I brought a Spanish SIM card in and had no problems accessing Wikipedia (or presumably any other site that would have been blocked).
Cool! If I want to get into hobbies, then I should first get a Nobel prize. This should make it 22 times as likely that I'll get a hobby.

Is there a statistic for someone hoping to go in 'the other direction', i.e. what proportion of hobbyists (vs. non-hobbyists) go on to win a Nobel prize?
> at Satellogic we had on-orbit error-handling problems due to Python 3's string encoding, where coercing binary data into a Unicode string caused an exception in our exception handler.

Woah. If you're using a dynamic programming language for mission-critical software and your tests don't properly cover "coercing binary data into a Unicode string", then your problems run way deeper than Python 2 vs 3.

This isn't restricted to on-orbit software. Your GSE ("ground support equipment", for those not in the industry) also shouldn't have that kind of quality problems.
Maybe that’s also why it’s called the rust belt.
SQLite is not "just a file format" anymore than say MS SQL Server is a file format. SQLite is a RDBMS in the form of a library and uses a particular file format for persistent storage. But it can also run purely in-memory: https://www.sqlite.org/inmemorydb.html without any file at all.

Being a RDBMS is not defined by whether the engine runs in-process or as a server in its own process.
Django user authentication:

https://docs.djangoproject.com/en/3.0/topics/auth/
UTF-8 turned 20 years old (2012)
Especially given great 15kRPM SCSI drives could peak over 200Mb/sec
Aside from the stats, which are not really surprising, I still find it very hard to get my head around licensing and I bet that this is the main reason why MIT is used. MIT is indeed the only license that is really understandable.

The mentioned choosealicense.com is not really helpful with choosing a license because it not really explains all the legal terms used, in my opinion. There are many blog articles out there but to this day I couldn't find a single overview that describes each of the major licenses in a regular-human way. And this overview is what I would need. Simple language, tailored to the most important questions: copyright, attribution, what can both non-commercial and commercial users do and what not, and what are my rights as the owner.
If you have any resources on this please share it!
I might have lost sight of the forest for the trees there :).
I think YouTube app is user-hostile on purpose and has similar behavior on Android. I mean, My biggest pain point with it is that after switching to another video, you can’t go back to the previous one without visiting account history. At least I couldn’t find a way to do that, and when I asked a friend who I knew was spending few hours a day in that app, he didn’t even know that there was such a problem (why would you ever want to navigate back?).

I’ve been using Ivory for iOS as NewPipe replacement, but it’s still much inferior, especially when it comes to updates (for example, it cannot play videos right now due to YouTube API change, and past experiences taught me it will take at least a week before developer fixes it).
Do you use a salt?

Also how do you determine what is the same connection and what mechanisms do you have in place to prevent someone stealing that session?
I did search and rescue training with dogs in the army and we always had to start things off with a toy to get the dogs "into it", even in "sharp" situations. But once they were started everything was like a game for them, they'd run ("play") until they couldn't anymore. You'd have to stop them.

If you're ever in a SAR situation and a dog finds you, you should be prepared for a little rough treatment from it. It'll likely jump all over you, be up in your face and all that. It's just looking for the toy, and when it find out you don't have it, it'll move on, calm down or go back to the owner. And it'll bark a lot. Like a lot. It's not out of anger or anything, it's just what it has been told to do when it thinks it has found what it was supposed to find. I've had a dog tear my entire goretex uniform to pieces looking for the toy when we were both trapped deep under snow. Good times!
and that's why the West is decaying. Who cares about your morals when there's an epidemic ?
Here is the link, for convenience:
https://github.com/pennersr/django-allauth
I think this gets really interesting when combined with the bash builtin that supports reading records into variables[0].

recsel contacts.rec | while readrec
do
if [ $Checked = "no" ]
then
mail -s "You are being checked." ${Email[0]} < email.txt
recset -e "Email = '$Email'" -f Checked -S yes contacts.rec
sleep 1
fi
done

0. https://www.gnu.org/software/recutils/manual/Bash-Builtins.h...
This story was told before many times but what I thought was interesting is that this actually tells us the name of the diner where UTF-8 was invented, which still exists today under a different name:

https://goo.gl/maps/d2Ps6WUNESFVtDuj6

Now anyone who wants to take a pilgrimage to the birthplace of UTF-8 can.
Wuhan coronavirus: Travel bans for diseases like this don’t work
Can you elaborate on why? I've used Django a lot and have yet to find auth a problem after running things for quite a while, so I'm curious what the issues might be that django-allauth helps with.
We've seen the same script play out over and over and over again every time someone wants to become a dictator. So, rational people don't buy the excuses.
Slippery slope fallacy!
The default emulator performance is bad compared to iOS simulator, but fortunately there are plenty 3rd party emulators that can be used for android development (e.g. Nox, GenyMotion, BlueStack, Visual Studio Emulator), though recent version of official android emulator is supposed to be as fast as those 3rd party emulator. Maybe try to lower the emulator's resolution to speed it up.
If I understand correctly, the whole point of Oil is to make a shell in which this kind of code is perfectly correct and robust.
I think most people don't realise how many attack surfaces there are.

Good TLS and salt + strong hash solve the simple cases of DB theft and network MITM... But that's the bare minimum amount of protection.

As it does nothing for tokens being stolen, sessions, password reset hacks and emails being compromised.

It does nothing for stopping users trying to brute force. Password strength, loads of things mentioned.

I think the point is not really needing to know what good libraries mitigate against, but that you probably (as an individual) don't know all the ways that things can be compromised, and can't easily remember to implement them all, so you want a system that has been created, tested and improved by many security conscious people and out in the wild.

You probably wouldn't build your own lock for your front door either. The risks simply outweigh the benefits.
I think the markets intersects a lot, at least if you are to trust what the polls made on people who just bought e-bikes, a lot of them used them to replace cars mainly for everyday work and shopping which is HUGE. Research show that more than half of the car users here live 50 min from their work by bike.

If we spent money on infrastructure for bikes my travel time by bike could be 10 minutes shorter, that would the 50 min area above even bigger.
Just curious. Is there a reason to not redirect the www. to the non-www. ?
David Boies [1] represented Microsoft in Microsoft vs. United States (USG won), SCO vs IBM (IBM won), he represented Harvey Weinstein, and he represented Virginia Roberts Giuffre vs Jeffrey Epstein (suspect committed suicide). He also took part in Bush vs Gore. He represented Oracle in Oracle vs Google (Google won), and he represented tobacco companies.

I'm not sure if he's still part of Theranos legal team (in whatever way) but he surely was in the past.

The point is, lawyers don't always end up standing on the right side of justice. They almost always end up getting on the paid side of the spectrum, though. Especially if they have a nice curriculum.

[1] https://en.wikipedia.org/wiki/David_Boies
TikTok has a very large proportion of users from India. Byte is not released in India. So I doubt it is a serious competitor.