skysight-inc/HackerNews huggingface dataset:
Biometric data should be considered identity and not authentication data. They can never be revoked or rotated for one. And who knows how many people have it on file. Not every auth server gets their own « key »
Ha! I only read the windows fs stuff and came here to see if the rest was worth reading.
No user should trust the security of an app that was abandoned 2.5 years ago. It's irresponsible (and typical) of Google to keep the app available and unmaintained.

Even if the code were bug-free at the time, dependencies, APIs, and attacks change.
Representative governments are well known for supporting powerful groups over the collective benefit of society. Just look at any of those countries tax codes and you will find a multitude of special exceptions.

Patents are of limited duration because the tradeoffs of unlimited patents are so horrific. If we accept a billion dollar drug must enter the public domain, clearly copyright should also be limited just as it was proposed in the US constitution. However, because a tiny minority has a huge benefit and society does not really notice the difference you get the modern mess of unending copyright.
That sounds like a great system. I am very pro-markets and capitalism but I have no problem saying there are very unhealthy examples in capitalism where huge corporations grow too much at the expense of humanity. A 'middle class' of companies seems much more sustainable, healthy, and fair. It could make buying local the norm again.
In Firefox / Chrome, tick "view desktop site" from three dot menu, and view in landscape mode.
A Wild and Dangerous Effervescence
> You can't block accessibility on the OTP app because then blind people will not be able to use it.

True - but you can make accessibility access an opt-in feature. I hate phrasing it like that. But a piece of security software should allow people to disable accessibility features when they aren't needed.
You can autofill the field into a text editor, and read it from there. The security comes from the fact that you had to interact with a privileged UI element to do so, which an accessibility assistant cannot trigger; you need to use the system accessibility features (e.g. the voice assistant) to trigger privileged UI elements.

(See also: accessibility of elevation prompts in Windows.)
The Canada Pension Plan is not a proper pension plan, which is why in the 1970-2000 period, good employers offered good pension plans. Now everything is matched RRSP contributions if you're lucky. It's possible that housing costs will never come back down; now that the housing bubble has pushed way beyond the metros, "just sell your downtown house and move to the suburbs" is not a retirement strategy anymore, if it ever was. (Bloody London, ON is getting a fat influx of Torontonians seeking cheap housing! That's nuts!)

So people should either be buying a house that they can afford not to lose in a downtown, and/or put some good money in their RRSP. The earlier, the smarter.
Yeah, it's more a thought experiment you get in copyright class. You are right, legally the matter is fairly settled.
I agree. I would rather keep things minimal and have 90% correctness, than a weird and complicated interface that's 99% right.
Ocaml and SML are not the Haskell dream world. They allow imperative code, side effects, and mutation.

The difference is that they have sane defaults (eg, immutable until you specifically ask for mutations) and an actually sounds type system (no null exceptions, exhaustive pattern matching, good generics, etc)

SML in particular was designed to be easy to learn and implement and succeeds rather well on both counts. It also has a standard instead of the implementation being the spec.
It's just using the accessibility privileges to look at the contents of the screen like a screen reader would, and copy the shown code. This isn't quite as advanced as "stealing your seeds".
Specifically, the filesystem. Other parts (memory management, cross compilation, goroutines, channels, etc) work just fine.
I'm interested to read more about this, do you have a source for it?

That seems like it would be just asking for a world of warranty returns and support nightmares for whatever company built it into their phones.
> The curb is a hazard to cyclists, more so than a crash with inattentive pedestrians.

Numbers, man, numbers. Link to some hard data "or it didn't happen."
Thanks, I'm much less familiar with AMD product lines and didn't know about EPYC.
You're welcome. I thought I'd aggregate all the useful tricks I'd found while working on my last project. It's a collection of snippets I had found in the docs and in Github issues.

The post contains the most important snippets, but you might find the advanced section of the requests docs [1] useful and the requests_toolbelt [2].

[1] https://requests.readthedocs.io/en/master/user/advanced/

[2] https://toolbelt.readthedocs.io/en/latest/
It does seem like GP has not heard of the ant and the grasshopper fable, though.
TL;DR: Unlikely.

"The only product that is better than VS Code is WebStorm, but sadly you have to pay for it" - TANSTAAFL. Perhaps it is better because the team doesn't waste time grovelling for donations, or maintaining two separate versions?
> Same if you were homeless. I wouldn't hire a homeless barista that will turn off customers.

To be clear, I currently have a shower, mattress, access to a washing machine, etc etc. Living in squats is pretty ok, police repression aside. I don't look like... whatever you're guessing, and nobody I'm applying to knows I don't have a permanent legal residence.

Hairdressing is a ridiculously qualified job in the UK, I have no idea what you're talking about. People go to vocational school to learn it.
Is the app truly abandoned? If there's one 2FA app I wouldn't expect to be abandoned, it is Authenticator.
Motorized vehicles, except electric bicycles (250W max, motor shuts off above 25km/h), are forbidden to use bike paths in France and I guess most of Europe.
But you knew C# was Windows only. Go was always touted as a cross platform solution due to statically compiled binaries. If said binaries have issues on Windows due to design decisions it seems like a language fault.
If the PM doesn't have enough expertise to understand how severe a bug is, how are they supposed to accurately assess the business impact?
Copyright law considers the importance of a sample to the work as a whole, in addition to just the size. Any arbitrary three-word phrase from the middle of a script is probably not copyright infringement. The most memorable line from the entire movie probably is.

Related: The Supreme Court ruled that excerpting a single paragraph from a 454-page book can be copyright infringement. The book was Gerald Ford's memoirs, the one paragraph was his reasoning for pardoning Nixon. The Court's reasoning was more-or-less that nobody cared about anything else Ford did, so excerpting the one paragraph was as good as giving the whole book away for free.
And I'm saying that if you have only, or mainly, worked at projects where all information (including about failed historical approaches and why they failed) is encoded in the source code, you have been very lucky to the point where I have a hard time imagining that to be true.

There is so much implicit knowledge that goes into the finals source artifact that is not spelled out.
I lived for over a decade in downtown SF without a car. I can't imagine having owned a car, or needing one, or wanting to deal with the hassle of actually using one. Things certainly got better with rideshares, but transit was abundant and taxis worked fine too (sort of).
Why can't yubikey use a single root secret and derive all sub-secrets from that root secret?
I don't understand why you would create a statically typed language but not actually take advantage of types, instead typing everything with generic types like string. Why make the user pay for complexity in types but not actually deliver their promise? This is the problem with C and Go doesn't really solve it either
Learning that there are people who have favorite intersections really made my day.
I had to make a choice on UI framework several months back and Semantic UI looked nice, but wasn't as comprehensive as Ant. Do you use some sort of add-on to fill in the rest or do you just roll your own components in that case? E.g., I was looking for a tree component and couldn't find with Semantic UI.
No matter what, after 100k loc, you'll encounter language quirks that irritates you. It's a matter of how complicated it was to find and what the work around is.
I think one year is enough, as that's the time the majority of the money comes in.
Hello sir. Good luck. In addition to all the other good advice, if there is someone you know and respect, and who has a stable living situation overall, I would strongly encourage reaching out to them and ask for help and meeting with them regularly, both for the advice that they can give, with their more intimate knowledge of you than those of us online, and for the encouragement and motivation that comes from feeling like you have someone in your corner. It's one day at a time.
I think you are missing the overall point that you are overestimating how important knowing that is.
There is Clarity: https://clarity.design/
> Maybe if they acted less like some sort of bizarrely over-trained AI and cranked up the exploration constant, they'd stomp on each other less.

It's not just the music industry. The whole economy starts to feel like overfitting the profit function.
Love the spirit of this work, but nobody is an authority on what a melody is. How many different tuning systems were used? Why 8 notes? Why not 0..n notes? [0] Is a given melody, realized at 10ms per beat a melody? How about a 17-month pause before the first note? [1] Absurd? Sure. But who decides where the boundaries are? Lest one think that there is only an appeal to extremes here, check out Polansky's beautiful Lonesome Road, and put boundaries around melodies [2].

[0] https://www.amazon.com/Larry-Polansky-Worlds-Longest-Melody/...

[1] https://universes.art/en/specials/john-cage-organ-project-ha...

[2] https://www.youtube.com/watch?v=0aIifUv1Tmk
Yes and no.

Yes, it puts 1Password as the only point of failure iff 1Password security is compromised. This would require knowing my Master Password, my Secret Key, and 2FA with either my OTP from Google Authenticator or a Yubikey to open the vault on a new device, or knowing my master password on a device that I already have 1Password set up on.

On the flip side however, for anyone who _doesn't_ know I use 1Password (oops), any credential stuffing attack or password leak is not likely to get anywhere, as they're not going to be attacking my 1Password vault.
I'm not sure I would consider Embraer a hidden champion. It's a fairly large aerospace conglomerate in Brazil with very high level of public awareness (especially among the global flying crowd).

It has a revenue of R$20m, which falls within the arbirary hidden-champion revenue cut-off of US$5b only due to the poor BRL-USD exchange rate right now.
Show HN: Pomodoro Calendar: custom printable planners for Pomodoro technique
My windows defender indicates this has malware in the download.
I enjoy creating software users find useful.

But it goes beyond "this is what they do". Users tend to do a wide range of things when entering dates and you kinda have to guess what they mean. Throw in guessing what localization should be used (it's not always clear) on top of that fuzzy system and it can become a frustrating experience for everyone involved.
GDPR side effect: Lack of access to WHOIS internet domain registration data
Things to Consider When Building a Remote Team
Ask HN: Help me like modern web development
I am trying to figure out if I'm just getting old or if modern web development, and by extension javascript-based mobile development, really is that horrible. I mean am looking at a project now with dozens if not hundreds of config files (mostly .json and .xml) and at bash build scripts with hundreds of lines of code, all super fragile btw., and of course I have to "npm install" things but that literally downloads more than 2GB of dependencies. And all for a very trivial mobile app..

I mean I get it, it's web, it's sandboxed, it's safe, it's run-everywhere, but it also makes me want to quit my current job.

HN: What am I missing? Can you cheer me up?

(Btw. I usually love programming. C, C+=, ObjC, Ruby, ..)
That is a beautiful, if sort of minor, hack. "I need a license because I want to use this at work and they need me to have a license for all code we use." "Here's the license: 'No.'"

It's like the opposite of the WTFPL [1], the FYL.

[1]: https://en.wikipedia.org/wiki/WTFPL
Any feedback would be appreciated!

*and I just launched it on PH: https://www.producthunt.com/posts/pomodoro-calendar
Ask HN: Pros/Cons of Horizontal vs. vertical SaaS
Throwaway for obvious reasons.

We have a pretty good technical offering analyzing videos at scale, with low costs. We also have traction across multiple verticals.

Our dilemma now is whether to go horizontal saas offering supporting multiple industries (eg. media, ad tech) or focus on a single vertical (e.g. surveillance). Conventional wisdom states to pick an application and dominate it before spreading one's wings. But our market traction is pulling us horizontally.

Surely we are not the first to deal with it, and would love HN to chime in with thoughts on how to approach this issue.
I went to Authy and then to Yubikey. I can get to my OTP from just about any smart phone now or even my desktop.
Stretching the Beat
AFAIU it's the trojan app that uses the accessibility privileges? Which are probably only activated when the user activates them in the OS settings.

Not sure if possible, but perhaps the authenticator app could detect that accessibility mode is on, and refuse to show the codes? (or at least do it behind a warning?)

Also, I think the trojan app would need to ask for accessibility permission from the user to be able to read other apps' text?
Thanks for posting this. The threat modeling in this thread feels very much out of wack with my personal experience. The thing that has lead to the most compromised accounts for myself is old, short, unchanged passwords on accounts I had forgotten that probably have been leaked.
Windows Defender being Windows Defender[0].

[0]: https://support.mozilla.org/en-US/questions/1159513
Totally agree! Being listed as a top town is a death sentence for the town's charm and community but a boon to real estate developers.

I think there are plenty of "really nice, affordable small towns with a real sense of community" but it's constantly in flux and fragile.
I wish that requests had a default timeout instead of defaulting to waiting forever.

It's very easy for devs to forget to think about timeouts, but inevitably that ends in a cascading production outage.
As some one who started in the Three little book days.

Original 70's DnD started as players vs a killer dungeon built by the DM Aka Gary Gygax

Ironically it was those of us who crossed over from traditional wargames who where more into the role playing your character.

You can see more recent players in pathfinder and dnd 5th wanting to win "the game", the full on RP style of the Mighty Nine of The Glass Cannon is quite different are actors or semi pro ones AND THEY ARE SO WELL BEHAVED""
So you would prevent blind people from using 2FA because someone else installed a tool that also reads screen? Please no.
The idea of a like feature on a platform that's supposed to be for you, your friends and family is kind of fucked in general. Likes, contrarily enough, encourage you to not give a fuck. Why bother responding to your friends or family when you can just click like, give them acknowledgment and move on to the next thing. It's bad enough on random internet forums, but if it's your friends and family you should put the effort in to actually respond to something if you actually care, otherwise don't. I think the discourse and posts on Facebook would be radically different without the like feature.
Can we just stop with the "Rust vs Go" shit?

If you want me to take a critique of Go seriously these days, pick another language to compare it to. Any other language.

And yeah, I'm aware that 5 years ago there were a ton of "Go vs Java" articles. I didn't think much of them then, either.
I work remote from home ~80% of the time and love the quiet solitude. But I live with my my wife, three kids and a dog, so those hours of alone time feel precious. If I lived by myself I think I'd go crazy.
I've also heard that there is a hardware mod to give the Acorn true raster interrupts.
Since some say, "No DnD is better than bad DnD," an AI might seriously consider a 'Wargames' scenario if players are hellacious enough...
Just last night I was setting up “2FA” for my girls gmail account. It has so clearly become surveillance it’s disgusting. The only options are google consumer apps (or the physical key). The opportunity to link a mobile device to a desktop for advertising purposes was too great.

I have little trust that google authenticator app is any different. But as far I can see you can’t use any of these alternatives from the article.
Yeah I think there's a balance somewhere and for me it's not 40 hours a week in an office. Maybe 20 hours in an office and 20 at home would be more reasonable. I would imagine different people will have a different preferred balance from 0 to 100%.
What do you do in the event you lose your Yubikey?
Ask HN: Where do conservative, pro-military software engineers hang out online?
Looking to find more like-minded peers.
> Forget X, the real challenge for AI is Y.

As soon as Ys become Xs over time, and we come up with new Ys: we’re making progress.
Generate Ideas for Investing
> (or at least do it behind a warning?)

Couldn't the accessibility app just approve the warning? Otherwise how would blind users do it?
Interesting. What is your opinion is preventing SML from filling the vacuum in terms of adoption? Is it just marketing?
Only the keys that specify they may be backed up. The ones that don’t are not included, not even in the encrypted backup.
I actually am in the process of removing antd (previous version) from my website and am not planning to upgrade to 4.0. The reason being is because you still run into the same issues as using any framework -- customizing it ends up overriding a lot of the base styles and implementations (line heights, grid, etc). Thankfully I saw this coming so a lot of the components in my app (React) are labeled as `Wrapped<ant component name>`, which I quite literally just wrap the component and add any additional props/styling that I'd like.
Phytomining: Down on the Farm That Harvests Metal from Plants
Thee is no reason not to have a special privilege level for screen readers.
There are tons of farm to market roads in Texas that have 70 speed limits out of towns and lower limits within towns. Many towns on these roads setup speed traps and have stoplights or stop signs.

US-380 runs directly through cities with stoplights too.
This is sort of like asking: If you had Star Trek replicators, what would be the optimal configuration to use those replicators as paperweights?

D&D is not a game with rigorously defined rules and winning conditions, instead it's a means to an end, the end being: have fun with friends through a mutual fantasy. If you had a genuine post-singularity superhuman AGI, it would be silly to use it for D&D, because you could just directly instruct it, "Make my friends and I have fun through a mutual fantasy". This might be inherently dangerous because a truly superhuman AGI would probably be so effective that you and your friends would end up unable to distinguish said mutual fantasy from reality and you'd all end up blissfully running around in the resulting fantasy for the rest of your lives.
The periods should be read as hand claps.
Follow institutional investors & company insiders to generate investment ideas and perform due diligence before purchasing a stock. in addition the fastest way to search for filings & financials. Sign up Free! I'd love your feedback on the tool.
Is there known instances of this attack? For me it sounds like Sci-Fi.
There is a huge amount of push in media to cripple our devices because some users don't want to reason and use them responsibly. Because Apple limits something, the assumption is that every other platform now must be limited in the same way and prevent their users from running more powerful software themselves. Because some of them might cut themselves approving too many things.

I don't like that viewpoint.
> you can make accessibility access an opt-in feature

It already is. You have to explicitly go and enable it per requesting program in the system settings.
Oh I see, I didnt click to go to the homepage so I missed it all. Maybe in blog posts like this one it might make sense to include one, even if its just a basic screenshot. You'll be glad you did this for every version release cause you can see back in time over the years as the editor evolves.
> They are on average much worse drivers

How do you know?
I'm not sure if you noticed, but the post contains a section on how to set default timeouts.

https://findwork.dev/blog/advanced-usage-python-requests-tim...
They should be doing that. Maybe the OP means the limitations on passwordless credentials and not u2f credentials.
"dangerous"?

Edit: I personally know a good amount of people for that is a life goal.
I live in the ozarks, much like Appalachia. So I can answer those questions at least anecdotally.

Door dash: none. Nobody is using it, or am incredibly small number.

Solar off grid: a decent amount. It’s certainly doable. It’s easier to be on-grid, though.
It would be awesome if you had something like a bicycle, only more comfortable that could hold you, a friend, and some of your things. You could enclose it to protect you from the weather, too. For longer distances, or people with disabilities, you could add some mechanical contraption in case you can't pedal that far.

That'll be the day.
Accessibility services are disabled by default and need to be explicitly enabled by the user. At that time the user is clearly warned that the enabled service (by name) will be able to read the screen.
Didn't Tokyo actively encourage building?
Or Raspberry Rye.
Video: How to export your LinkedIn contacts to Excel
Keys that specify they can’t be backed up are not migrated, they are not included in the backup.
I use Authy, but God, I hate their UI and UX. Finding the accounts there is a pain in the ass, and for some reason, I always end up with duplicated accounts (when I just added them once). Also, it has been two months since their last iOS update, so it's not like Twilio is taking care of it either.
I agree with this comment. First seek stability. Then you have a base, launch position, to move upwards from at your personal mental pace, after you get your feet back under you. Most people do not function well at all under the intense stress of homelessness, it breaks you down.

If they can quickly find a tech job, that's great of course; otherwise find anything that provides the necessary stability to make further sound moves from. It's dangerously easily to get trapped in homelessness for extended periods of time as it breaks people down and they can't get back out.
I have heard stories about people in Ireland struggling to get certain services because their name contains a Fada, but some of the identity paperwork they have is missing the Fada due to lack of support by computer systems.
Probably a "water maker" for a boat, my understanding is that they use reverse-osmosis to desalinate water, so it's easier to have them take up small amounts of extra load. It's a nice self-contained unit that you can start and stop pretty much instantly.
Subvert go's type system for fun and profit
That helps a lot. Do you have a good LinkedIn page with a list of technologies you've done something with?