skysight-inc/HackerNews huggingface dataset:
It does not name specific sources, but it is not hard to find some. For example, in my programs I check passwords against the API provided by haveibeenpwned.com.

More context from the guidance below from https://pages.nist.gov/800-63-3/sp800-63b.html

> When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to:

- Passwords obtained from previous breach corpuses.
- Dictionary words.
- Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).
- Context-specific words, such as the name of the service, the username, and derivatives thereof.

If the chosen secret is found in the list, the CSP or verifier SHALL advise the subscriber that they need to select a different secret, SHALL provide the reason for rejection, and SHALL require the subscriber to choose a different value.
They want a MUD?

https://en.wikipedia.org/wiki/MUD
it's two different techniques to achieve the same goal:

to run badly maintened, outdated software lacking security updates, no matter how well the user maintains and updates the computer.
Yeah, this seems to be similar to what is happening to the banana.
Secretaries were extending emacs using lisp in the 70's. No one told them it was programming so they just read the manual and did it.
Yup great callout, something we think a lot about. We haven’t run into any rate-limiting yet, though are aware that it’s a possibility. iMessage returns the date_delivered which has been valid and we send an SMS in those cases.

As for Apple shutting us down, it is a valid concern, although right now the service looks no different than if one were to type out a message on their own device.

Happy to share more details and go through any concerns you might have - maybe there's ways we can help with appointment reminders!
I really enjoy teaching and have been thinking of doing something similar for a while. The biggest hurdle for me is carving out some of my “decompression” time on weekends...
These things are pretty easy to measure, you literally just measure the amount of conversions when ad spend is on vs when it is off.
You can sue almost anybody anywhere for anything. Whether you'll prevail on your claims is another question. What makes you think that such a lawsuit would prevail? E.g. have you read amex's terms and did they agree there to arbitrate disputes unconditionally? Or is there a law you're aware of that requires them to?
To solve the FF page wrapping problem, I wonder if it would work to double-map each 6502 page to x64 host pages side by side. I assume the word read at FF would straddle the two mapped pages effectively reading the second byte at 00. You'd have to map to host page boundaries of course and probably offset all reads/writes to the end of the host page at $3F00.
There's much more room in the cab of the Ranger than in the MX-5 the OP started with. Can also add a lockable box in the truck bed. Also beats having your soft-top cut open :)
I like being in the ecosystem. I'm "locked" in the sense that nothing else meets my needs and no one else has a whole suite of products that work so well together to solve my problems.

The benefits have far outweighed any inconveniences for me in nearly 2 decades as a customer.

Doesn't mean there aren't issues, but in general I am very happy with the ecosystem.

Anyway this gets away from my original point. $1k is not a lot of money for what a smartphone is and the role it plays in our lives (which is only ever increasing).

It's silly to skimp on something so integral that you'll likely have for 3-5 years (or more!). All for what? Saving $500? This is why the high end smart phone market won't be impacted as sharply as you're predicting. People understand this.
Each service provider needs to balance security and convenience based on the market they serve. Forced MFA for a product designed to be an easy to use video conferencing tool feels incorrect.
Seems like maybe the company who leased you the car might be willing to do a deal to get you to keep the car a bit longer. It's not like they'll be able to sell it quickly.
You're spot on - iMessage returns a date_delivered so we know if it's successful or not, and send an SMS backup via Twilio.
There is life everywhere (https://en.wikipedia.org/wiki/Extremophile#Classifications) including in boiling water, so why would there be no wildlife on Everest?

A short search gave me https://en.wikipedia.org/wiki/Euophrys_omnisuperstes:

”the Himalayan jumping spider, is a small jumping spider that lives at elevations of up to 6,700 m (22,000 ft) in the Himalayas, including Mount Everest, making it a candidate for the highest known permanent resident on Earth“

(That’s above the base camps on Everest)
This is such an awesome bash feature. Makes it so easy to generate variations of names. What is it called?
That's not how sales reps think.
> In the current system, all video can be monetized

To monetize your video you need to have 1000 subscribers and 4000 hours of watch time in the past 12 months.
Patterns of Software – Richard P. Gabriel
If you reach 10K in payments, it means there's a good level of trust between two parties, at which point even the 5% charge is not necessary.

Their messaging and time tracking tools are mediocre at best, and they certainly aren't worth the 5% charge. Payments are held for a week, and it still costs money for the worker to withdraw them. Their local currency withdraw is 2-3% lower than Transferwise.
Flat Earth has been around for a long time, and I don't think it's going away any time soon.
I don't know for sure, but I wonder if the Republican governor of a state like Massachusetts feels that way. He might get more votes if he spoke against Trump than if he didn't.
I hope all their clients gets lots of non-refunded cancelations.

always went out of my way to not pay their abusive service fee (sometimes more expensive than the ticket). until all the suckers would buy exclusively from them, killing all alternatives. hope it plays out realy, realy bad to everyone who is their clients.

nothing of value is lost.
PDF available here: https://www.dreamsongs.com/Files/PatternsOfSoftware.pdf
> The class action lawyers will get second houses with third boats.

With money from TicketMaster. People scoff at the size of class action payouts to individuals, but if you're looking to deter bad behavior, the total money extracted is what matters.
I was on board for points 1 and 2, but completely disagree with 3:

> The components might look wrong when rendered. Tests are very bad at this. We don't want to go down the esoteric and labor-intensive path of automated image capture and image diffing.

This is the main reason we have tests for our (Angular) typescript all; all the tests roughly look like:

1. set up component with fake data

2. take screenshot and compare with golden

3. (maybe) interact with component and verify change

These are super easy to write, and also easy to review: most review comments are on the screenshots anyways. And since the goldens are checked in, it’s easy to see what different parts of the app look like without starting it up.
If you talk HTTPS to a given host, assuming that TLS has not been compromised and the host itself has not been compromised, you can trust the app published by the developer to be correct. For stuff which is pulled in from other hosts which you don't control (e.g. CDNs), you can use subresource integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Subres....

Agreed that it feels like there should be another mechanism to publish subresource integrity hashes for your own resources somewhere so that people can spot if your server or TLS gets compromised though (similar to CT). Sounds like someone else had the same idea at https://lists.w3.org/Archives/Public/public-webappsec/2014Ju... - I wonder why it didn't go anywhere?

Meanwhile, if you don't want to trust TLS or the host which originates the code, then for now you're probably better off using a desktop app (e.g. electron, although that comes with a whole different attack surface) or a browser extension which can be distributed as signed code.
That's the approach taken by https://github.com/libcpu/libcpu. It supports 6502 and several other CPUs.
An alternative is:

mv file.name !#:1.bak
cp process.log !#:1.old

!#:1 expands to the word with index 1.
I don't know man maybe you're right.. But just today I had to edit a small screenshot and draw an arrow from text to a button and after trying all sorts of things like downloading scm scripts from defunct sites to reading two9 tutorials I couldn't do it. Maybe I lack knowledge to understand it. I kinda wasted more than 20 minutes and still don't know how to make arrow. Would take me 10s to do it in PS (plus boot time of Windows).

Regardless I do appreciate the hard work the guys have put in. I feel like such an ingrate to make comments like this about free software. I guess it's time to find an online course and learn it properly and if I still don't get it then that's that.
Unless you happen to be in the state of their HQ, Amex could have any such suit removed to federal court (in which there is no small claims) under diversity jursdiction, which would suddenly make it painfully expensive (compared to small claims) to pursue even if it had merit.
Ask HN: Good Intro to Virology Course?
Given all this craziness With Coronavirus and being stuck at home for the Quarantine, Id like to learn more about viruses, how they work, the math behind them, and the biology within them.

What courses have you all found that you found to be a great primer for someone who is a relative layman to the concept?
> ... but we know now that ventilators have a mortality rate of 66% to 90%, so use a cannula instead as long as possible.

I assume you mean to use a nasal oxygen cannula for as long as possible (as opposed to an intravenous cannula, a nasal feeding cannula, or any of the other various types of cannulae). I could certainly be wrong, but I was under the impression that this is already being done, which is part of the reason the ventilator mortality rate is so high... selection bias.

The last-resort treatment is almost always going to have a high mortality rate due to selection bias.

Maybe you have some information I don't, but I haven't seen any evidence that doctors are idiots and widely making poor treatment decisions.
I prefer having a nullable version of other types so it has to be explicitly wrapped. bool vs nullable(bool)
Part of the problem is that demand is spiky. A lot of people are going to want these rentals on weekends. So, for a reliable on-demand weekend rental, you're probably going to spend a decent chunk of a weekly rental fee if this became common.

What more tends to happen in practice is that urban folk who decide not to own a car just minimize activities that require one unless they can can draft off friends.
>If you are just the platform that venues use, and someone asks for a refund, it's pretty heavy for the platform to be on the hook for the full cost right now

So, Ticketmaster should make profit off of distributing tickets for venues and events, but not be responsible for issuing refunds for the tickets they sold?

Seems like that should be part of the risk of operating as a middleman whose sole purpose in existing is to sell something for somebody else, that basically would sell itself however it was being sold while sitting in the middle just sucking up money.
Exactly. I'm surprised there are accounts from large companies that must have some sort of SSO with MFA solution. Are they not using it with Zoom? That's a no brainer
Nbdev: Use Notebooks for Literate Programming
I'm shocked YouTube hasn't cloned Patreon for video creators. YouTube needs a tip jar if the content creators are resorting to Patreon, and that was back when the getting was good.
$5000 grants for US-based artists struggling due to Covid-19
Arguably, it's not just about support: It's often just not a good idea, complicating the existing product, still only gives you pre-defined hooks.

Jenkins is one of my favorite examples for why plugin systems are evil. As users accumulate plugins, it all becomes a giant, unmaintanable monolith that ends up unable to perform even the most basic tasks due to some unrelated/uninteresting/forgotten plugin somewhere doing something weird.

Instead of stuffing everything into a monolith with plugins, split it out into individual composeable units with minimal features.
Interactive Coronavirus Tracker
There are 2 other options:
1. Small claims court
2. Filing complain with California Department of Consumer Affairs
I disagree. Even the weakest form of MFA (click this link sent to your email to set an authorization cookie) prevents stuffing attacks, and is still available to anyone.
The problem is incentives. For example, maybe TicketMaster screwed the public out of $50 million, but the lawyers are willing to settle for $10 million, of which they take home $3 million and the public distributes the rest. It's not necessarily fair and the public doesn't necessarily have an alignment of interest with the lawyers.
Ask HN: Would you mind sharing high fidelity ideas that keep you up at night?
People should publish high fidelity ideas that keep them up at night, best ideas aren't everywhere.
NextDNS is excellent, I have my family and non-techie friends using it. Personally I just wireguard to my home network and use pihole.

Hopefully Windows, Linux, iOS, and MacOS natively support DoH soon. It's a pain setting up proxies.

Even worse, iOS forces you to use a fake VPN to change DNS servers at all on cellular!
CNN cuts away from 'propaganda' briefing as Trump plays video hitting press
Is Ticketmaster the definition of an anti-competetive monopoly that anti-trust laws exist to break up?
Kicking the Tires on Airflow
Part 1 - http://bicortex.com/kicking-the-tires-on-airflow-apaches-workflow-management-platform-architecture-overview-installation-and-sample-azure-cloud-deployment-pipeline-in-python-part-1/

Part 2 - http://bicortex.com/kicking-the-tires-on-airflow-apaches-workflow-management-platform-architecture-overview-installation-and-sample-azure-cloud-deployment-pipeline-in-python-part-2/
Been using NextDNS for a few months now, I cant even find a single flaw. DNS is fast, Both founder must be expert in networking, I have tried literally all the third party DNS services, Ad blocking or not and NextDNS is actually one of the best / fastest DNS services. And I often think of myself as having latency intolerance so it is very good. Despite what I thought 300,000 DNS queries/month was low it turns out I never exceeded that limit.

And its Dashboard / Control Panel, it is very fast, extremely responsive. Basically I love everything about NextDNS, from DNS Speed, Ease of use and Design. Anyone who want Ad blocking should give it a go.

Edit: Not affiliate with NextDNS, just personal opinion. Not sure why the downvote.
Vim Un-Alphabet Episode 13: Parentheses
Of course they're effective, how could you even imagine that they are not? All available evidence overwhelmingly demonstrates that they are highly effective, it is the fossil fuel that powers literally all popular media.
I use WG and pihole myself, but that is not an appropriate solution for my family and non-techie friends.
I think you're underestimating how much big companies spend on online ads compared to small companies. Most big companies have big non-terrible marketing teams that know how to track the effectiveness of their ads. Most of the times, they have ROAS requirements. If the ads aren't making money, they get turned off.
I bought new snow tires a couple weeks ago (long story, relocation has since been cancelled). The shop was empty. Regardless of the decrease in travel, when times are hard people put off general maintenance. Nobody is buying new tires atm. But what about the flip side of COVID? Air and bus travel is not going to come back anytime soon. Even taking a taxi/uber driven by a stranger will remain an issue. I think car use might increase in certain sectors. Prices may take a hit overall but I see a coming push towards private vehicle ownership.
Doesn't seem to be catching much that uBlock and pihole aren't. 0.07%. Not super surprising I guess

edit...and noscript
No need to repeat yourself
Brace expansion https://www.gnu.org/software/bash/manual/html_node/Brace-Exp...
Using C# in Godot instead of GDScript results in better performance. Roughly 4x better compared to GDScript in some naive cases.[1]

1: https://docs.godotengine.org/en/stable/getting_started/scrip...
I think there's a difference between seeing an ad on a billboard and ignoring it vs. an ad on a site that's just one big advertisement. Most people will not visit a site that exists purely for the purpose of advertising.
Ask HN: Digital Immunity Certificate: Thoughts?
Despite the clickbait title in this video [0], his claims and sources seem valid. Using digital certificates as proof of immunity would necessarily rely on a decentralized digital identity system [1]. What are your thoughts about this?

[0] https://www.youtube.com/watch?v=-aR7cz30chE
[1] https://identity.foundation
The channel membership thing is YouTube's Patreon clone. But I don't know how far they've rolled it out yet, and it doesn't seem as flexible or popular with creators as Patreon. And the fact that it is tied to Youtube, and thus the same channel shutdown etc mechanisms, will be a big minus for many.
You could make a counterargument that any official that is reusing passwords should be fired for gross incompetence and not following basic security protocols. I've seen people in the private sector get fired for less and they aren't working with sensitive data.
I think function colouring is a positive thing. A synchronous function cannot yield; so calling an asynchronous function from it doesn't make sense since those cannot yield either.
This feature is brace expansion.
What is left out of this entirely is that “composability”, sometimes, comes at the cost of efficiency or user experience. Companies like Google try to create each new product fit within Google infra and then end up with a less intuitive product. The reason many startups succeed in creating better solution is that they don’t have the baggage of making things malleable and composable.
Burnout often occurs because who you imagine/want yourself to be is not the same person as how you actually identify yourself to be.

It can be the feeling of "I know I can do better than this, but I'm not doing better than this right now, so I'm frustrated with myself."

There is no quick easy fix. My only suggestion to you would be to: firstly, accept that this is crap situation to be in, secondly: that it is escapable, and thirdly: realize that to escape you have to return to your roots, and rebuild from there.

When you first discovered programming, it was fun and what you created only mattered you. You started here, so go back here. Do an ancient Advent of Code (https://adventofcode.com/), or the first few Euler Problems (https://projecteuler.net/). Do not share your solutions with anyone. The most important thing is that what you do is not important to anyone except yourself. This is your baseline.
> You're saying that cutting (meaning reducing, not zeroing) budgets of social and health programs can kill up to 0.5% of the entire population of a state? Because that's the CFR of the virus.

I'm not saying that, but I could have been more clear.

The Great Recession is not a great comparison to a continued lockdown scenario, unemployment peaked at 10% while current reports are putting us already at ~14% and rising. The recession reduced demand but didn't wipe out sectors, nor did it cascade nearly as fast. Heart attacks and traffic fatalities will go down as the studies show.

I don't think I'm being contrarian, these pacts were setup to provide the political cover necessary for those qualified to make the call. My prediction is CA/OR/WA reopen on roughly the same schedule as everyone else, with just slight stricter restrictions. Such as quarantining the sick, isolating the high-risk, and other measures to bring the CFR down.
Adguard DNS works fine out of the box, but you can't configure it and more importantly have no way to whitelist sites. If you block ads you _will_ have page damage and no way to fix it with that service. Nextdns solves that problem.
CNN, MSNBC cut away from Donald Trump’s coronavirus briefing
Except with muds it wasn't 100 hours, it was more often 100 days character age..
The Ethiopian community in DC makes the best food. I need to get back down there one day.
Not that easily. A sophisticated attacker is going to be using a lot of different throwaway IP addresses. One of the common ways to (try to) prevent this are often how you end up with stuff like "all IPs we think are AWS or data centers or [...] are blocked from our service."
That's actually a good thing. Zoom is a great tool, but mainly because it exposes how important video conferencing is, and if it's done well, there's a market for it. Still, it's not $40B great.

MS, Facebook, Apple and Alphabet now has to think about improving their video conferencing protocol, and not just the next iteration of material design.
Double Commander[0] without a doubt. Works like charm on Windows and Linux. Saved me multiple hours when compared to Windows explorer.

[0] https://doublecmd.sourceforge.io/
It really is incredible, first time I couldn't think of any improvements a product could add
The issue is really about missing requirements... we spent 1,500 dev hours customizing something only to realize we were using the wrong tool for what we wanted... kinda hard to sunk costs that one.
A minimal compliant implementation could likely be ["passw0rd"]. Hopefully most compliant systems try a little harder, but with time and budget pressures...

Ideally a modern system should use haveibeenpwned or atleast one of the various lists you can find in password cracking forums.
This is why Eventbrite has stopped issuing advanced payouts to venues. Given the increased risk, they need to keep the money on hand for potential refunds. I wonder if Ticketmaster has done something similar.

https://www.eventbrite.com/blog/advanced-payouts-changes-rel...
Have you seen any movement?
Thanks for the heads up. I'll be avoiding Amex from now on.
Homebrew works for a lot of stuff, but not little details. For example:

All my Firefox plugins and their config (I guess this is technically data)

All the settings I've changed though the control panel (I can't figure out every file that changes when I make a change).

Any time I've changed a setting with nvram or defaults

Most of the settings of the default apple apps.

My wireless configs

For most of these, there is probably a shell script one could write that can backup and restore them, but I've never found a holistic solution.
So because an expert can do it easily means it's easy? In that case literally anything is easy.

OP was saying that mechanical switches could be deterministic, which is something that I haven't experienced.

I do agree that there is less to go wrong than a complicated touchscreen interface however.
The problem is that some jerk will copy your video out to YouTube and monetize it.

Given how snotty Google is for the big names, I am of the opinion that Google should get absolutely destroyed with damages when a small creator finds their stuff online without their permission.
I wouldn't be particularly upset if Ticketmaster continue to pay the band as if they'd actually played the show.

I'd bought 3 concert tickets for shows that got cancelled due to the lockdown, for a total of a few hundred $. I can listen to the music online, but I know that musicians make much more money from touring, so that's my way to support them.

As long as the performers get paid, I don't mind, because half the reason I go to concerts is just to pay the bands I like. The other half is bragging rights to tell friends which bands I saw live.