skysight-inc/HackerNews huggingface dataset:
Just not Macaroons again :(

Macaroons have many small edge cases that'll bite you when you try to use them in practice:

- there is no spec and all people re-implement the de-facto standard. If you read the whitepaper it's not what's in use.

- the de-facto implementation is full of holes, e.g. time is expressed without timezone so it's not clear if it's UTC or not.

- the implementation requires custom parser for custom binary format but the caveats in wild use (remember: there are no standard ones) still use text so it just avoids the potential benefits of encoding dates and numbers in binary.

- the highly hyped third-party macaroons are barely supported in implementations in the wild - only one level is allowed and it's not specified anywhere.

- if we're talking about third-party macaroons there is another layer of problems: no standard for caveats means your third-party service needs to be closely coupled with your own.

- immature implementations, I'll just leave this here: https://github.com/nitram509/macaroons.js/blob/master/src/ma...

JWTs have many problems but compared to Macaroons it's just JSON and base64. This is available in all programming languages with no additional cost. JWTs also have actual spec that implementations can agree on. Macaroons promise you extreme power but doesn't deliver. Several of Macaroons issues could be resolved with some effort (e.g. standarization) others - like resolving cycles in third-party caveats are IMO design flaws deeply embedded in the format.

For more info from people deploying Macaroons in the wild see https://www.youtube.com/watch?v=MZFv62qz8RU

As for tptacek's recommendation this only serves as a reminder that even if a highly respected internet figure recommends you something you still need to do your own homework instead of blindly following.
Deliverability is a big marketing/selling point for all these providers & important selection criteria for their customers. So it'd be very interesting to see what % of emails for each provider landed in Inbox vs Promotions/Spam/Junk folder.
Lending Tops Сrypto-Industry by ROI: What Can Go Wrong?
If you expose your information you’ll be spammed, and when the spammer is challenged he/she will reason that it was done under “legitimate interest”. The only way is closing the leak and avoid any of your personal information exposed on the internet.

History time: a shady company that organises conferences contacted me guessing my corporate email from information in Linked-in. When challenged they said “legitimate interest” and removed my information at the moment. I sent a formal complain to as much people as I could (they also exposed a lot of emails online) and left in some message boards information about this company so other people affected could understand easier where the information was leaked.

They contacted three months later with a different company name (same speakers, same program, same names everywhere, same web, different domain), I repeated the same procedure. Also my name in Linked-in has only my initials.
You don't need a blockchain or proof of work for that, timestamped digital signatures are a thing that's being used already, you just need a proper trust infrastructure.

A blockchain with proof of work solves the problem of decentralization and absence of trust; however, for legal matters, having a centralized root of trust is the simpler way to go and requires much less resources.

However, tampering with the actual recording device is a very relevant risk - I struggle to imagine an attacker who has the desire and capability to make some serious crime, and convincingly fake a video as part of it, but would be foiled because they can't figure out a way to upload it properly in the exact manner as a real camera would.
There are well-maintained wrappers for BLAS & LAPACK in Rust

https://github.com/blas-lapack-rs/blas-lapack-rs.github.io/w...
> I just assume the Universe is so big (and expanding) that nobody besides bacteria could make it alive to Earth.

Why would you assume that ?

Even if the speed of light is an absolute barrier why do you rule out the following:

- ET's that are immortal or with enormous lifespans, either naturally or because they re-engineered themselves that way

- ET's that have produced artificial intelligent entities that are immortal

- Generation ships

- Ships that travel at a significant fraction of c, causing time-dilation effects to greatly reduce travel times in the traveler's frame of reference

I certainly wouldn't be surprised if humans were able to achieve at least one of these in the next thousand years and an ET civilization could easily be millions of years ahead of us.

Don't get me wrong. I don't think ET's are the most likely explanation for what's happening either, but I also don't think they can be ruled out entirely.
@codr7 - By chance I was just browsing your projects yesterday!

g-fu ¹, a Lisp dialect in Go, is a marvel. Other languages you've been creating (gfoo, cfoo, lila) are tastefully done too.

So I'm in total agreement with you about the monstrosity that is modern C++. Nobody would have designed such a language from scratch.

It seems to be a common fate of popular and long-lived languages (or projects, companies even), that it grows into a complicated monster that would horrify its original creator.

¹ https://github.com/codr7/g-fu
On land or on a drone ship?

I thought I've seen pretty much all of the landings, but can't recall a drone ship landing shown from an air plane camera.

Especially with all the exploding rockets in the early days of landings.

Do you have a link to one such landing, would be really interesting to see.
Nouriel Roubini: The White Swans of 2020
That's precisely the use case for JWT I recently had to work with, where cookies are irrelevant.

The web server gets a token from the API server, then prepares a few JSON messages that the web client will send asynchronously with JS. Since each message content is signed, the web client can't tamper with what is sent to the API. JWT was perfect for this 3-tiers messaging.
I love tech, too. This is why I have divested myself from Facebook, beyond messaging tools (FB Messenger and WhatsApp).

If tech is building new edifices to the capabilities of tech, then Facebook is certainly tech, and the nightmare Facebook has become is inevitable. (Though I agree with other commenters that FB probably matters much less than we with in-built pro-tech biases are willing to believe.)

Otherwise, if tech is "doing more with less," then Facebook is extremely hard to justify as tech.
See https://meta.stackexchange.com/a/164449/192171

If an answer is factually wrong (as opposed to just poorly formatted or missing a few details), generally its better to leave a comment rather than try to edit it.

I agree its not ideal, but suggested edits go into a site-wide review queue, so not everyone reviewing them will necessarily be familiar with C. This makes edit reviews a poor tool for evaluating factual correctness; the comments section and voting system on answers is a better tool for that job.
Would this also make it easier to slurp data from Diaspora, in the name of providing friend recommendations?
I think an overlooked aspect of a legacy system that makes "strangling" difficult is that nobody fully understands the behaviours of the system anymore.

It is really hard to replace the functionality of a piece of code when you don't know 100% what that functionality is.
Because your static .html and .css files won't get immediately hacked like an out-of-date turdpress site will.

There are many wordpress-like tools that spit out static files to upload to your hosting provider https://www.staticgen.com/
My experience looking at, say, the front-page (or more likely these days, inside-page briefings section) of a newspaper, today vs. say 1970, or at an issue of a leading magazine, is that writing and editorial standards have changed, largely for the worse.

Newspapers are an easier direct comparison, and though I don't have a specific example to show (a selection, say, of front pages from the same day of the month across a span of decades would be useful -- 12 issues a year, enough to show trends, but not so many as to drown them out -- would be a good demonstration), but I've done periodic research and am struck.

There are always gradual changes, but a tipping point toward commercialisation and sheer crassness emerged strongly in the 1990s.

For magazines, the larger problem is that so many simply aren't what they once were, notably leading US news weeklies. It might be better to consider a set of political magazines -- New Republic, National Review, The Economist. Possibly Atlantic, Harpers Weekly, and The New Yorker.

And perhaps Rolling Stone as well.

There's some survivor's bias, yes. But there's also been a palpable shift.
works fine for me

https://api.twitterstat.us/
Learn Docker internals by building a toy clone
My Favorite Areas of Opportunity for the 2020s
The North Koreans didn't become obsessed with getting nukes in 1953.
New form generator is in the hood! Welcome Jafar
> Yes! If a JWT is stolen, then the thief can can keep using the JWT.

Unless you have some form of fingerprinting the client who authenticated and received the JWT.
Introduction Excellent new feature in JavaScript ES2020
As someone currently dealing with this on multiple fronts: it's complicated. ESP's block out different ranges for different customers, dedicated vs shared IPs, etc. really hard to generalize.
211m gallons of sewage spilled into Fort Lauderdale waterways, officials say
Not every nation can be "lucky" and have a city of several million people located in a nation that few other nations hate yet still conveniently within artillery range.
>Also, you should look at least at the docs of the packages you install

Brb reading the docs for every micro-package installed as a dependency for what I just installed that provides functionality that could've been hand written in five minutes.

Gonna spend the next few months reading about a thousand package README's for this single package I installed and all its dependencies down the tree, be right back.
Worst thing that can happen in a startup is trust issues affecting focus and ability to get stuff done. I see many conflicts that need to be addressed for this model to succeed.

By having their people directly within the organization (potentially at very senior operational levels), there is inherent information asymmetry that favors SEV over founders and other VCs.

Founders will have to figure out how they will protect themselves from SEV insiders screwing them over other startups in SEV portfolio.

I'm very curious to see what would be SEV's pitch to the talented people they hire to deploy in these startups would be and how would the three party contract between this talent, SEV and startup would be setup.
QMK worked well for me, using supported controllers but entirely custom odd-ball hardware designs. It handles the somewhat annoying bits (USB protocols etc.) while allowing you to completely rip out most of the built-in logic (matrix code, scanning, layers, ...) without touching the tree. It also has a lot of kitchen sink functionality, although some really weird omissions as well (the only way built into QMK to receive free-form communication from the host is through virtual serial port). Overall it's kinda neat for that specific niche.

But as a "framework for [basic] customizable keyboards" it is imho a poor choice because of those omissions and what you mention.
I expected this to be about Java Web Toolkit until I saw it was implemented in many languages.
..., but I don't care how it is implemented as long as it is secure.

I totally agree with this part. The problem is that the security of the implementation is the security of the implementation. So your sentence reads:

This is implemented extremely insecurely, but I don't care how it is implemented as long as it is secure. I also don't care about water, as long as it is dry.
No, Bitcoin uses a simple chain, one after the other.

GIT, as you may know, has branches. IOTA in a sense, does too, a lot of them.

And again, this incident was caused by a Nodejs/NPM package, not by the IOTA tangle or protocol.
I mean they're not supported OOB but you're just describing a session cookie with some signed metadata. If "the ecosystem" and interoperability with existing services is the goal then has the advantage.

If you're talking about something bespoke then it probably doesn't.
I just thought about Jim Keller interview as an example of one of his failed interviews, at least partially failed. Keller had interesting stuff to say but Lex was constantly pushing him into too general or too philosophical direction he was not interested in and had noting to say about.

If you get one of the best microprocessor architects into your show, why not focus on that and dig deep.
And from writing things the right way the first time around rather than on iteration #3 or so.
I don't run a car-sharing company but I don't think this is the way to handle the situation:

> after @GIGCarShare told us to sleep in our car on the side of the road and try again in the morning we called a tow truck on our own and made it back to our Airbnb. TBD on whether I’ll be refunded for this.

> also we were able to turn the car back on somehow but now we are afraid to turn it off because it may not start again and Gig told us we used our “allotted restarts” of the car so we are on a literal endless road trip through California now
The English titles really aren't all that great, but those videos themselves are really cool.
From the linked Nature abstract:

> The devices produce a sustained voltage of around 0.5 volts across a 7-micrometre-thick film, with a current density of around 17 microamperes per square centimetre.

How good is that? They talk about powering smart watches with this, and other personal electronics. So it sounds like it’s within range of a useful amount of power?
> Video evidence simply won't be admissible unless it's signed

Courts today readily admit the testimony of eye-witnesses, which ware notoriously fallible. It is a common misconception among tech people that all systems operate in rational ways, but this is only really the case for machines.
> Become a farmer.. I probably missed some ...

You will probably need first aid skills.
Order does not matter with compose, that also makes it more user friendly than dead keys.

The modifiers' proper names are "ring above" and "breve".
FYI, that was how the menus worked in previous versions (Alt-f for the file menu, etc.), so ribbons didn’t expose any new functionality in that regard. In fact, Microsoft bent over backwards to ensure that every old pattern people had used would continue to work exactly the same way.
Smartphones work to some extent because they are relatively light and you hold them in your hand. This means it is very much not a rigid surface. Typing on a projective keyboard on e.g. a desk is very unpleasant, because you are pecking a hard, rigid surface with your fingers.
Glad to hear that you don't buy into the myth that longer hours are better for their own sake - I agree.

Realistically, I've never met any programmer who has more than 4 to 6 (on a really good day) hours of solidly useful work in them per day.

Time spent above that, and those 20+ hours above 40, are invariably spent spinning wheels and making mistakes from fatigue, etc. and I think ought to be discouraged in sensibly run orgs.
The pitfalls of illustrating prehistoric creatures
Because it’s bologna presented from an investor who has a huge bias in favor of their own product. Likely it was teams of data scientists who didn’t see the value add in their software. Having worked in the field, and seen plenty of ML platform pitches, they often promise much more than they can deliver and force data scientists to work in a box they have no desire to be in.
> it would be great to get some of the de-risking that comes with a portfolio approach.

Right, but at some point "de-risking" seems like it can easily become "we're installing our own leadership team/ops staffers to make sure this company moves in the right direction."

I think it'll wind up divorcing the company from the vision/passion of the founder — and that might be a fatal and overlooked risk in itself.
Then at least link the first instance to the Wikipedia page or something. After reading the first couple of paragraphs I had no idea what this article was about.
Uber cuts $120M of its $150M display ad budget- had no impact on performance
> That's true to a point, but neither of those pieces of legislation actually define "insider trading"

That's true in the narrow sense that they don't have a definitions section with the term “insider trading” and a definition. They both use “insider trading” in their titles and internal headings of the code sections they add, and specify the covered behavior (which differs slightly between the two) in the body, “purchasing or selling a security while in possession of material, nonpublic information” (15 USC 78t-1) and “purchasing or selling a security or security-based swap agreement while in possession of material, nonpublic information, or...communicating such information in connection with, a transaction on or through the facilities of a national securities exchange or from or through a broker or dealer, and which is not part of a public offering by an issuer of securities other than standardized options or security futures products” (15 USC 78u-1.)

While Congress did give the SEC the ability to set the rules around insider trading, it didn't give the SEC a blank check which the SEC used to pull the idea of insider trading and regulating it out of thin air.
He was physically described pretty well in the article.

As for "weird" and "freak," you should probably load the 1971 context for full understanding.
Works perfectly fine for me. Also there is absolutely no reason to post about outages here unless they are somehow remarkable.
I mean is all this complexity really worth "I can send data to an untrusted client so that it can later send it back to me?" compared to just storing that data somewhere like Redis?
I would be interested in opinions on the approach taken by Laravel Airlock. It seems to be a hybrid approach between stateless auth and session.

https://laravel.com/docs/master/airlock
The entire Apple dictionary system is a PoS AFAICT. It only works with perfect spelling and it only works with single words. How about finding closest match and how about letting me select lots of text and go through all the words.

I can only guess no one on the team actual uses the feature.

As a language learner I use Rikaikun for Japanese on my desktop browser. While I'd really like it if I could also run a similar extension in my mobile browser I'd be okay of Apple's dictionary actually worked with a fuzzy search and multiple terms... but no....
So instead of replacing the entire menu paradigm with ribbons, how about just grouping things better, wouldn't that solve the problem?

On Mac OS for example the "Preferences" item is always in the same location and has the same shortcut, throughout first party and third party apps.
Thank you for sharing this...it so awesome to see threejs.org for understanding educational concepts so easily. Kudos!!!
How Amazon convinced people to welcome ‘listening devices’ into their homes
Curious - do these packages work? Have they reduced smoking addiction?
How many variations will you store? It's very easy to calculate the Levenshtein distance on plaintext data, but basically impossible to enumerate all the variants and hash them.
The new version of DeathAdder[1] reintroduced DPI adjustment buttons, and the LED settings persist even when set with the open-source Linux drivers.

[1]: https://www.razer.com/gaming-mice/razer-deathadder-elite
I assume that everything depends on:
- how much storage you need,
- how long you need it to store this,
- if this data easy reproducible.

Generally storage isn't cheap, and cloud storage is quite expensive in the long run. If you need storage for more that a year, I would invest in own local HDDs - put to your PC or buy used NAS server or PC. You will benefit with much better performance and this would be the most cost effective solution.

Keep in mind that often transfer to cheap cloud storage is slow, I tried to keep my backup in few different providers, it could take literally months to upload 6TB of data. Also keep in mind that you may be charged for data transfer separately, for every data access, so cloud cost may be much higher than expected.

If you plan use this in shorter periods, I would go with OVH offer - they probably have best quality/cost ratio. Depending on your needs I would suggest buying dedicated storage server, or use their Data Storage (3x replicated $0.0112/month/GB, plus outgoing transfer - $0.011/GB). They also have cold storage for about $0.0023/month/GB.
There actually is a modern (almost) equivalent of the DataHand called the Azeron gamepad [1], and there are some DIY 3D printed DataHand replicas too [2][3].

If you want to type really fast (>200 WPM) and don't mind a VERY steep learning curve, then getting a $95 Georgi keyboard [4] and learning steno [5] is probably the way to go.

[1]: https://www.azeron.eu/

[2]: https://github.com/JesusFreke/lalboard

[3]: https://geekhack.org/index.php?topic=41422.0

[4]: https://www.gboards.ca/product/georgi

[5]: https://www.youtube.com/watch?v=Wpv-Qb-dB6g
Also increased responsibility. You can seriously injure or kill someone with a forklift (I’ve seen someone drive the forks through the side of a fully loaded Cisco router once...)
Popularity definitely is value when designing APIs for public consumption. JWT has a concrete edge here. This is why I asked HN about their opinions on Paseto, if there's a chance it'll overtake JWT/JWE in popularity, then that makes it more suitable for APIs.

In the context of security, popularity has the added benefit that there's enough eyeballs, so all bugs are shallow.
Does this happen in practice or the old product is just replaced by a newer _competitor_?
This is ultimately about time, energy, priorities, and all of that.

One of the things many open source maintainers (and especially leads) run into is time constraints.

More mentoring and empowering of others while not trying to do everything ourselves is important for our health.
Do you own any startup that uses this setup? Could you please tell me?
I also use to manage exim4/spamd long ago. Part of the problem I remember is that your email (sent from your server) can be marked as spam on someone else's inbox (e.g. you are blacklisted without knowing it). So while you haven't had issues on your side, it's hard to prove that you didn't have issues outside your box. This was especially common with VPS datacentres, as their IPs routinely showed up on blacklists.
I think the hatred wasn't directed at ribbons specifically, but at the tendency of (not only) Microsoft to overhaul the UI of their applications with every major release. Maybe that didn't happen as often with the Office applications (which increased the backlash when it did happen), but with the apps bundled with Windows (e.g. Explorer - not IE, the file manager), you had to find your way again with every new Windows version. That's one of the reasons why under Windows I still use good ol' Total Commander and don't bother with Explorer at all. What Microsoft (and Google, and Apple) don't understand is that for most people, applications are just a tool to get a job done. They don't want the latest and greatest UI, but they get annoyed if they have to re-learn how to do the things they want to do. It's as if the controls on your car would be rearranged every time you got it back from inspection...