skysight-inc/HackerNews huggingface dataset:
> Why does the attacker need my private key?

To authenticate as the user on the target server.

> If he has his own private key and I accept it then he can successfully perform a MITM attack and proxy the connection to the real server.

That's not the case.

If you accept the public key offered by the attacker's machine-in-the-middle, then half the attacker's work is done, as they've tricked you into connecting to their machine. The other half of their work still remains though: they need to connect to the target server, impersonating the user.

They can't do this, as they don't have your private key. It doesn't do them any good to try to generate their own keypair, as it won't be recognised by the server. (Roughly equivalent to guessing at a password.)

I'm not sure if I've been very clear. There are plenty of explanations of public key crypto out there better than I can provide here.

It's a major advantage of using public keys to authenticate users, rather than passwords. (Servers are always authenticated using a public key.) If we were using passwords, then in the situation we've described above, it would be possible for the attacker to connect to the target server, impersonating us, and enabling them to set up a man-in-the-middle. The attacker just needs to capture our password when we send it to them. Of course, as they now have our password, they might do plenty else besides.

> what is the purpose of key fingerprints and the web CA system?

It's to ensure the target machine really is the expected target machine.

As you say, the web uses certificate authorities. SSH supports a similar approach, but the 'conventional' SSH solution is to manually check the server's fingerprint (which has the effect of checking the server's public key).

> For HTTPS there is a handy tool[1] available to do this. If there isn't already one for SSH, the same principle still applies.

That's just a web proxy, there are many of these available. If such a proxy is used maliciously to attempt to intercept an HTTPS connection, the connection will fail the browser's certificate-authority check, and will be terminated. (At the very least, the user will be shown a scary warning popup, but sensible modern browsers may just refuse the connection entirely, as users tend to unthinkingly click through such popups.)

These proxies can only work with HTTPS if the (self-signed) certificate used by the proxy, is added to the browser's list of trusted certificates. [0]

[0] https://docs.mitmproxy.org/stable/overview-getting-started/
I am extraordinarily bad at dancing. You can get traumatized for life watching me dance. Can someone please suggest online videos you have found useful.
When I got my bose headphones they would not connect as bluetooth headphones until I installed the app. After that they would but I still had to sign up and accept location access the first time.
I own the Bose QC 35's and I never had to use an app at all until I decided to update them to the latest software
We just should to stop tolerating conventional things using Internet connection. There is no way headphones really need an Internet-connected app to work and even to let you use advanced functions (i.e. all the configuration can be implemented in a purely offline app). And if they don't need they should not even nudge, let alone require, you to install such. Most of the people just don't give a uck, somebody competent on the state level should give it.
I just heard this one a little while ago. It's definitely up there.
Surely you mean the number of publications, or some other superficial metric (e.g. being the third "supervising" author on a paper with a dozen authors).

If I read a paper and have a great appreciation for the ideas, and have a sense that an author contributed significantly to the aspects I appreciate (either from explicit descriptions of the authors' contributions in the publication, or by speaking to them), why would that not be impressive to me?
It's been discussed pretty extensively: https://news.ycombinator.com/item?id=23932082
You're not thinking of the right victim. You're considering the organizations who compiled the databases in question. If the databases are composed entirely of their own information that they created themselves, then sure they've suffered a loss. In most cases, however, these databases include privacy-sensitive personal information about the customers of the organization. Those customers have been victims of bad security practices ever since MongoDb was first installed, and this "meow" hack has ended their victimization.
>The headline is potentially misleading. There are already "nuclear power plants"

It is not potentially misleading. This is just you being pedantic about a connection that very few people make. When you say "nuclear power plant", people tend to think of nuclear fission reactors, not RTGs or fusion reactors. Both of these are applicable to the term "nuclear power plant", but only one is commonly referred to by the term. A lot more people would feel misled if it actually referred to RTGs when it said "nuclear power plant."

The only group that it could potentially mislead is people who know RTGs exist. Most of those people would instead think "I wonder what kind of nuclear power plant it is" instead of "wow, what a misleading headline!" unless they were intending to be pedantic (like you).
A friend of mine was doing a chemistry phd when he discovered his supervisor was falsifying data. If he had blown the whistle it would have ended his career, but if he had played along his dissertation would have been based on false data. Both options were bad so he just quit.

https://www.statnews.com/2016/11/25/postdocs-grad-students-f...
In my experience that's a less than frequent occurrence. I.e. I agree that there is a predominant voice here on HN (echo chamber) that lives to shut down (vote) other views
English has another advantage: it's the language of "cool", i.e. a kind of soft power. It's the language of hip-hop, of Hollywood, of tech and of finance. English is a prestige language is many parts of the world not only due to its incumbency, but because new pop culture is being created in it every day.

People learn languages for all kinds of practical reasons, but ultimately for a language to really take off, it has to endow personal prestige in some way and provide a window into a culture that is interesting or aspirational. People learn French and Italian due to the aspirational qualities of those languages. In contrast, relatively few people are learning Indonesian (outside of Indonesia) even though Indonesia is the 4th largest country in the world (yes!) by population, potentially a huge emerging market, plus Indonesian is a super simple language.

It seems to me the Chinese language does not currently have much currency in the soft power domain, partly because soft power requires the export of desirable cultural goods, which in turn requires a society that endows the creators of cultural products with freedom of expression. This freedom currently exists in Taiwan but Taiwan struggles with scale. This used to exist in HK, but the HK cultural industry has been on a decline since 1997 (and HK exports its cultural products in Cantonese).

Japanese is arguably a harder language than Chinese, yet the Internet is full of foreigners trying to learn it because they're into anime etc.
What's special about Pixar, that you have your own office? This is very rare in the industry, and it's unsurprising people don't miss the open office.
I feel like you missed the theme of the last few months: The police are targeting minorities, i.e. not most people, disproportionately and people are trying to get the majority, i.e. most people, to stop being happy with that and to join them in being loud about it.
In Soviet Russia, headphones listen to you!
Well that's odd. I've been scanning the front page quite frequently since I heard about this on Friday and yet somehow missed this.
And even before that, there was this great purging of fanfic and other communities from LiveJournal by Six Apart (the then owners) that had people looking for alternatives, and you had a slew of LJ-alternatives built from the same code base pop up.

My memory for internet dramas is fading a bit, but I think it was both the sale to SUP (the Russian company) and the content policy changes (and the fears were only stronger under a Russian owner) that led to the massive LiveJournal diasporas to Tumblr (which was new, launching in early 2007), and the various LJ clones/forks like Dreamwidth, JournalFen, DeadJournal, InsaneJournal, etc. As far as I know, Dreamwidth is the only one of the clones/forks that not only still exists, but is maintained, which is really incredible.
> My suspicion is that grit (in the sense that matters, not whatever the grit researchers have been pushing) is mostly indistinguishable from intelligence as it's typically measured.

I don’t know about that. I’m pretty intelligent, but don’t have much grit at all.
Forster in Cambridge
There will never be unlimited resources. The earth has a finite amount of space, minerals, water, and energy (mostly from the sun).

Even if we gained access to exoplanets the problem would still remain. People can and will continue to demand more. Individuals will stake claim to entire planets for their own.

The problem is that satisfaction comes from relative success, not absolute. Look at folks like Bezos and Musk. The only thing that will slow them down is aging and eventual death.
My website once started failing because someone had connected to redis and set a password on it. That was the day I found out the redis docker container accepts everything that can connect to it unauthenticated by default.
> But there's already been a process slip.

They mean to say "another" process slip, but they've said that so many times it's starting to look bad. (And if their leadership was less clueless, they'd realize their mistakes there, but I've digressed....)

Another place the marketers have taken over is in the naming. It's widely accepted that TSMC 7FF "7nm" is the peer to Intel P1274 "10nm", and general consensus is that TSMC 5FF "5nm" is the peer to Intel P1276 "7nm".
While I generally think more telework is a great thing for numerous reasons, the state of discourse makes me worried about people spending so much time online. The social media "hate laser" effect is I think the main force behind things like the kind of histrionic leftism you describe as well as the alt-right and fellow traveler movements. Social media rewards that kind of extreme polarizing content as it drives "engagement," and everyone is losing their damn mind.
The government doesn't have to be consistent with itself. And even if the IRS treated Bitcoin as a "foreign" currency you'd still have to pay just as much tax on it.
I have no interest in the gen-ed bits myself, but you might take a look at the Coursera/University of London CS degree program. It's a 3 year program if you do it full time and it's entirely CS content.
I think that a lot of people find that LYAH makes you feel like you're learning, but have difficulty actually applying/using the concepts. This is compounded by the lack of exercises.

I definitely agree with this review: https://bitemyapp.com/blog/functional-education/

> The material often bores learners and leaves them feeling like they're not "getting" it. This is because they're being "talked at" and demo'd to. They're not engaging with and solving problems.
We will be the Borg!

This is the one I couldn't remember for my own comment, actually robotics generally, was thinking farms, self driving, android companions... tiny bots is another good call. I think there will be a lot more uses outside of humans, probably first for safety reasons.
Three spacecraft heading to Mars this summer
These people can't configure a firewall. How are they going to implement payments in the secure fashion you suggest?
This runs counter to all of my recent working experiences. What sort of things have you experienced that have led you to this point of view?
That's some guts to do the right thing. Respect.
That's a cool product, didn't realise Shodan did that
Requiring all work to be in person is no better. It causes brain drain from most places and real estate hyperinflation where the jobs are. "No jobs, unaffordable housing, pick one."
it certainly feels as if people have become markedly stupider due to this phenomenon and the internet. has anyone attempted to quantify this? some measure of falsely held beliefs over time? level of conspiratorial thinking over time?
This happened to me. Was just getting started with docker and got everything working and a few months later someone had set a password on my redis database. Who knows what else happened before that.

Ended up deleting the server.
silicon valley, where everything is about "race, gender, or sexuality" except the jokes.
If regular citizens of your nation can get a COVID test back in less than two weeks, you should consider yourselves more developed than USA.
There have been several recent HN threads on the subject. This one is currently on the front page https://news.ycombinator.com/item?id=23957278
I didn't know some of the computers being integrated so I did some searching:

PC532: https://en.wikipedia.org/wiki/PC532

Ceres: https://en.wikipedia.org/wiki/Ceres_(workstation)

Oberon (OS used on Ceres): https://en.wikipedia.org/wiki/Oberon_(operating_system)

I guess most people here know the BBC Micro, what I did not know is that you can add a second processor to it (the author mentions they will be adding a 32016 Second Processor): https://en.wikipedia.org/wiki/BBC_Micro_expansion_unit
It's quite likely that compartmentalization exists, but their response to the attack was to turn everything off until they could figure out how to proceed.
> putting search results back at the top of search results

Watching Google slowly fill more and more of the search results with ads, this is an obvious and very welcome idea.
Expect “equal pay for equal work” at your new remote job
It is on heck of a problem. We need two things to solve it. We desperately need networks of trusted institutions or experts to which we can offload some of the fact checking and individually we need to become much more skeptical about the information we consume. In fact we should be teaching our kids that most of the information they are likely to come across, outside a few trusted sources, is false, and often malicious.
Crap library, even sourcing without process manager? (saga is an after thought) doco does not even bother to teach users about command/event distinction. The library works I guess, just like code i wrote in my junior years.
Woz had something to do with the creation of Apple too.
https://en.wikipedia.org/wiki/Steve_Wozniak
It is a three bedroom house. My wife and I have the master bedroom, my 4 year old has her room, and my 1 year old has the other room. We have a decent size front room, a normal kitchen, and then a smaller family room connected to the kitchen. There are no doors on anything besides the bedroom.
Haha you win. That is absolutely bonkers to think about.
OMG Ponies!:)

I'd like to see those alternative OSes target the ARM architecture; the smaller number and type of peripherals should make it simpler to develop on (probably not emulating though) compared to a pc. It would make an interesting choice for smaller boards where either a full fledged distribution might choke or where one wants to squeeze out the most from the few resources available.
These metrics can just as easily be gamed, see how all the glory at Google goes towards launching exciting projects, that then immediately get put into stasis, then canceled.
Note (I am not the author): The words “You should” seem to have been auto-edited out of the title, as I copied and pasted directly into the title field from the blog post-which I think may give the post a different flavor to those browsing titles here.

Otherwise, no intentional editorializing done here. Just a brief caveat lector.
online databases that can be written and deleted by anyone on the internet are no good at all. The data can't be trusted. Of course no welfare for you! All I do is to replace all the names with my name and I can take all the welfare in the whole country! Or for example, doing a search for names and replacing all female names with male names ... how can you trust a database like that?

Making decisions based on a writable database (to the world, and not just from data sources like census, etc) is utterly useless.
1. Found few very interesting thougts from this very long article:
https://docs.google.com/document/u/1/d/1zao_AyBhNb8TPWrQqgXn...

2. Learned tested and implemented for fun few visuals from this link:
https://datavizcatalogue.com/index.html

3. Learned and tested two diferent frameworks for the web scraping.. nice, interesting what will be our role at the time when one machine prepare information and another machine will consume it..

4. Found interesting analysis at:
https://www.vox.com/a/maps-explain-the-middle-east

5. Checked what are the main advantages of timescaledb and how can i benefit from it:
https://www.timescale.com

6. Learned and tested how it works css data attributes
https://css-tricks.com/a-complete-guide-to-data-attributes/?...

7. Read 20+ long and detailed wikipedia articles to find out definitions and origins of various terms and subjects

Read anothe hundred or more of posts and newspaper artivles, but i think it was wasting of time, because so many authors writing to get click but not tell something important/interesting.. subjective. I do agree.. problem is that i always hope that maybe at the end i will find some briliant mind or conclusion. so, im reading whole article.. need to change this bad habit..

Not bad week.. but always can be better..;) thing what im missing is - continuity.. but thats probably something what need to fix by myself..;)

...

This werk i also climbed 3 peaks with prominance grater than 1000 meters and elevation 2300-2700m... on commercial side i implemented two small automation improvements. Changes will benefit client company and at the end - myself..
Also, for phone calls and conferencing, wired headsets have neglible latency, compared to bluetooth, which is likely at least 100ms. In itself, this isn't terrible, but add the other latencies in (e.g. wifi, inter-city network). Our brains do a great job of compensating, but I'm starting to think that this compensating comes at a cost (headaches, tiredness), especially if you're on conferences all day as many are in remote work.
Luigi Model found in Mario 64 source code
In search of self hosting email I tried out both MailInABox and Mailcow.
MailInABox wanted to control DNS records which was a no-go. The primary driver behind the project seems to have arrogant attitude towards having users do DNS records themselves. Mailcow seemed nice but was guzzling up ram for seemingly no good reason.
Finally tried out Mailu a few days ago which seems to work nice, albeit with limited testing.
paywall (didn't read). I had a co-worker who used to use irregardless. I didn't say anything. My own personal pet-peeve is the phrase "that begs the question...", and then the speaker raises a question. No. That's not begging the question. sigh.

At this point in "post post-modernism"? I guess my line in the sand is pronunciation of proper nouns. Cue the "gif" vs "jif" debate.
How to teach Transformers to care about word order
If only it didn't come with so many things (Roundcube, NextCloud) I don't need.
Power isn't the main driver, it's the desired outcome however. The main drivers would be control to be able to maintain a certain status or behaviour - arguably that you can't maintain due to what society deems is acceptable or that you couldn't lawfully gain ethically/legally.
Which makes sense! Many features from Tumblr and even Facebook, were first implemented by LiveJournal. The idea of having a “friends list,” as well as the separation between just following someone or having them also follow you (hence, being “mutuals” or “friends” in LJ parlance), the idea of broad tagging across the network or within specific communities, the existence of multi-author blogs (LJ communities, essentially), the ability to see and intermixed chronological feed of posts from your friends/people/communities. Oh, and the birth of Memached and OpenID (which was essentially the precursor for OAuth).

Tumblr introduced and pioneered the concept of the reblog, which was similar to a trackback/pingback in blog parlance, except turned on its head.
> rather, the argument is that the ascendancy of China, abetted by its economic strategy in the developing world, will force Mandarin into a more central position on the Internet, like it or not.

I can't see how China can ascend much further. They are hedged in by powerful nations who see China's military ambitions as their own loss. They have no allies of note and are bordered by several unstable regions (some of whom possess nuclear weapons).

Economically, they have already converted the bulk of their regional citizens to urban workers. Their growth is largely bound to the debt expansion they promote and, while they are hardly alone in this, they are centralising and making their economy more rigid rather than making it flexible enough to cope with the inevitable restructure.

Politicians and public servants appear (from my perspective) to make decisions based on who these will make happy and who they will upset.

The Chinese culture does not appear to be making any headway into selling itself to the world. Few people want to immigrate to China and become Chinese (outside of academic interest of course), but the West remains a destination for people who want to take a chance on making a fortune.

Lastly China has walled off its internet. While they are happy for brigading to occur on certain topics, they must balance this need with the possibility that someone might compare Xi to a certain pooh bear or be reminded of Tienanmen Square for all the wrong reasons.

There are paths China might take to global ascendancy. There are no signs that they are willing, much less capable, of walking them.
No. There are nearly 8 billion people on this planet. Figure it out.

This is a complex problem. Almost all solutions are worth trying. Most of them are going to be required. There does not need to be a winnowing of solutions. We just need to fucking start rolling them out.

I'm so over the argument that something won't be good enough.

No fucking shit.

Nothing is going to be good enough, nothing is going to be potent enough to solve how monumentally we screwed the environment up.
You would just get people massaging or generating the data to fit a conclusion prior to sending it out for statistical analysis. If people want to cheat they can find a way. The only way to really do what you are getting at is to construct core labs or CROs to run all experiments on behalf of the investigators. This is not infeasible in many cases (and is already done in narrow ways) but it requires hiring staff scientists to run every experiment rather than grad students or post docs and costs / complexity will explode.

The real way to defend against a lot of fraud is to force people to submit actually detailed methods sections so experiments are legitimately reproducible (they largely aren't now). This would catch a lot more fraud quickly, although even this won't fully work as some experiments are simply too costly to reproduce for validation purposes (eg animal studies).
A good PhD is launching a successful project.
I'm not even a tech person and I know that AWS has an option to set billing alerts for whatever amount you want. Damn sure I'd be setting those up if I wasn't 100% sure I knew what I was doing (is anyone ever 100% sure?).
Worth noting that there are a wide variety of B12-fortified plant-based foods available (non-dairy milks, cereals, etc.). One can also find algae-based EPA + DHA supplements.
Nice - I've done the same with Data Analysis with Rust Notebooks here: https://shahinrostami.com/posts/programming/rust-notebooks/p...