skysight-inc/HackerNews huggingface dataset:
Are there any good examples of embrace extend extinguish under nadella's tenure? I keep seeing this meme everywhere (including in this thread) but git is doing fine, Linux is doing fine. The only notable things I've seen extinguished are their own windows phone and phone hardware platforms.

Those examples don't count as extinguished.
The idea is that they would start by interoperating with an open standard, then they would make their version of the standard that has features they are not sharing, then they would convince companies/users to only use their version of the standard.

This is why we had so many websites designed specifically for IE6, and why many people are currently wary of that trend in Google/Chrome.

Github was already in the middle of their own version of EEE before Microsoft took over, so I don't know if you could blame them for that.

The thing is that quite a few of us were personally inconvenienced by Microsoft not supporting standards properly. When someone comes along and tells us that the stove hasn't burned anyones hand in over a decade, it doesn't mean that we're suddenly going feel comfortable touching it.
No. It is in the 28 tree.
If a website stores passwords in cleartext instead of hashes, would you have the same response?

This isn't fancy stuff. This doesn't require tens of thousands of dollars in code-audits or pentests to come to light. It's literally the absolute basics of password management. There should be no need to "convince a PM".

Rate limiting, not silently truncating passwords, not setting an extremely low and arbitrary maximum on password length... All of this stuff is as basic as hashing a password.
What a desperate click bait. Considering Israel’s groundless ever (self) perpetuating myth of technological sophistication is crumbling before our eyes, if you watch the news. I guess sticking an Xbox controller into anything should make it cool and headline worthy.

Most Israelis that care about Israel are now realizing Ben Gurion was a fascist bustard who’s best friend was a eugenist (Arthur Rupin); The kibbutzs myth of self sufficiency was based on the employment of underaged Israelis, both jews and non Jews; “startup nation”’s IT infrastructure is horribly dated compared to anywhere in Western Europe; IDF has been busy training generations of Israelis to disregard human live and ignore the crimes the government is carrying in the occupied territories and Palestine; and to make it really bad, 1.5 Russian economical migrants imported to change its demographics turned Israel into a developing country plagued with corruption at every level.
You can't really shield against galactic cosmic rays (too high energy, would require far too much mass), which make up approximately 95% of the dose.

https://science.sciencemag.org/content/340/6136/1080.abstrac...

*Edit - but the comment higher up isn't right either, that most Mars-bound astronauts will have decreased lives. The paper linked above estimates 3% of astronauts to die from cancer caused by the trip (assuming no exposure on the surface of Mars, meaning they're in the ground).
SMS 2-factor is wrong and bad and NIST has been yelling about this since 2016 or before. Simjacking is real and fairly commonly used in targeted attacks.

2-factor as an idea is great, and this author seems very confused.
They made the same poor choice as the designers of XML schema, which is to use the target language itself to describe the schemas. That is, a JSON Schema is written in JSON. As a result, they're extremely verbose and tedious to work with.

If you contrast JSON Schema with the type declaration subset of TypeScript, you'll find that the latter is much more concise and readable.

Having said that, there's an interesting discussion to be had about the distinction (if any) between schemas as understood in the database/XML/JSON world and types used in programming languages. JSON Schema does more than most programming language type systems do (e.g. requiring string lengths/numbers be within a certain range) and this is useful for validation. It still doesn't excuse the syntax though.
Like I said... my city is more expensive than the average, my number is for two kids, and I included funding for college.

I am not here to defend the USDA report. Take it up with them if you disagree.
You see stories like this constantly because salacious stories like this grab eyeballs.

The actual incidence of this kind of error is incredibly small.
Look if you think it is justified for China to keep out foreign companies, fine.

But if that is your opinion then don't come crying to the rest of the world, when they do the same exact thing to Chinese corporations that China has been doing to others, for decades.

Fair is fair.
First trick shows that update and delete should have a special syntax for when you really mean all rows:

UPDATE users SET email = lower(email)

This should return an error: "do you mean all rows?"

UPDATE users all rows SET email = lower(email)

Or something like that.
I did not get the explanation for why SMS 2FA does not work against credential stuffing. It clearly does.
Could You Have Covid-19? Soon Your Smartwatch or Smart Ring Might Tell You
Renaissance Italy also invented double-entry accounting, effectively creating a new discipline. And then, of course, gave us Galileo Galilei.
There is evidence for this as well: https://www.vice.com/en_us/article/mgbg7p/nsa-chilling-effec...

People have changed what they search for since the Snowden whistleblowing.
Someone just saw a parking page and it ends up on HN. I'm not sure why.

But I'm bringing it back online with a pre-Yahoo design in a few days, once I finish stomping the bigger bugs.

I run a for-profit bookmarking service based off of early del.icio.us so you can take a guess as to whether O.G. delicious will be read/write or read-only.
That's literally not how it works too. Agile has a robust and rigid structure that you then pull from and adapt to make your team and processes better. Few teams have the same implementation. It's important to understand the full scale of agile practices and tools but do not try to do it 100%, that's not the idea at all.
> Whether or not they are incompetent, companies that came from the mother bell, att, Verizon, CenturyLink, ... And all major ISPs are scary.

In fact, in some ways, the incompetence makes them less scary. Imagine the reach that Verizon would have with content delivery that was better than Netflix and webmail that was better than Gmail; and the resulting potential privacy concerns.
> But my sense from various moves/announcements they've made is that the revenue/cost may not be working out. I hope that's not the case but...

I'm curious what those moves/announcements are; I haven't been keeping up with Flickr, but I was actually rather happy SmugMug bought them as opposed to most other possible outcomes. SmugMug has always been a subscription-supported service with no free plans, so they were always "doomed" to be much smaller than competitors -- but they've also been around since 2002, are apparently profitable, and remain pretty laser-focused on their niche.
Until all their "purchased" books get into the DRM graveyard because in fact they did not purchase anything.

I lost access to all my "purchased" Amazon Kindle books when they blocked my account and no amount of calls and explaining allowed me to at least get my "purchased" content. Since then I created r/drmgraveyard to follow up the dead of DRM encumbered services.
There's a hole in the boot: “BootHole” vulnerability in the GRUB2 bootloader [pdf]
Creating Linux Packages for Rust Projects (1/2)
There may be concerns that TikTok's algorithms manipulate content to push certain trends and control public opinion so hypothetically there could be value in releasing the algorithms. They could also just as easily lie and leave out important sections. At this point there is no point except for empty posturing because no one will trust anything they release.
Not sure you need any maths for Kaggle competitions. Learn XGBoost and random forests for regression and classifications and learn how to evaluate the models and some of the tricks for coercing different types of data into them for good peformance. Then curve fit on various data to your heart's content.

It'll take ages before you need maths more complicated than arithmetic.

Taking a stats course won't help you at all. The way canned ML algorithms work has nothing whatsoever to do with data generating models which is what stats is about.

You'll start to need maths when it comes to dimensionality reduction and embedding and that'll come in the form of 95% linear algebra and 5% calculus. Still no stats though.

Wayyyy down the line if you get into the information theoretic view, or pick up the fetish of justifying everything via a Bayesian methodology then you'll need lots of stats.
Really? I own a Huawei and AFAICT, the OS / services (eg the kernel, android, Google play services) are basically the same as what would run on eg a Google pixel.
I'd prefer to be on a "zero pizza" team, as in a team that doesn't get pulled into crunch-time at all.
Guide to Scoring Baseball
Because it’s for-profit?
Is this why there are a bazillion of theories of the foundations of QM? I get that the mathematics is incredibly elegant, but concepts behind the mathematics are not really “understandable” to quote Feynman.
This was always an inevitability. China could ostensibly take territory from any of its neighbors except Russia. The idea that a small island would be able to stay independent was temporary.
Doesn't it stand to reason that delivery drivers would be in the grocery store as well?
I believe the arguments that SMS-2FA is not effective against phishing. (Or, at the least, I can't provide a compelling counter-argument.) But I had always thought of SMS-2FA against a more banal problem:

1. You have a unique, long password with Foo.

2. Oh no! They store your password in plaintext, and their security is terrible, so your username and password are part of a giant data breach from Foo.

3. Before you know about it and can change your password, someone that is not you, who does not have access to your phone, tries to log into the account.

4. While out living your life (or in, these days), you receive an SMS from Foo, and then ignore it.

5. There is no step 5, as no one else is getting in.

6. Okay, fine, you caught on, and now you log in and change your password with Foo, or maybe just drop the account, because really.

It seems to me that SMS-2FA helps in this scenario. Am I missing something obvious?
Basically every internet game/app store does this differently. Google's, Apple's, Xbox, PlayStation

I think even the Nintendo Switch is more fair about it, but I haven't checked it directly

This has burned me really badly. I had an account with hundreds of Steam games, and then my dad got hooked on some of the VR games I'd bought and set up on a Vive machine in the living room upstairs. I had to make a new account to be able to play new games. Then my nephew got hooked on one of the games on the new account, so I ended up giving it to him and making a third account for myself. That one only has a couple of games on it, since I've mostly just transitioned to playing stuff on GoG and the Nintendo Switch
It's quite possible TikTok will go down the path of promising the moon regarding self-regulation and accountability just until the immediate threat from regulators subsides. This appears to be a trend among companies to stave off regulation while in the public consciousness, then remaining largely unaccountable to these toothless accountability committees when the news cycle inevitably moves on.
Throwing my hat into the ring here as well:

https://james.js.org/tiles/

The basic mode is a matrix of identical tiles spinning at different rates, creating complex organic motion out of a simple concept. There are two other modes and lots of fun parameters to play with!
What I can tell you from experience is that people of color, and religious people, are the most likely to get activated on this idea at the early stages. They can be among the most impacted by the harms of mass surveillance technology, and are among those that stand to gain the most from controlling it.

They also are often already organized, and often already have the ear of elected representatives from their past activism.

All of these things combine to make it a very good idea to engage those communities at the outset of an effort. I am not a person of color, nor am I religious, but I have been able to play an important role in my city's effort.

Technologists need to help, not necessarily lead, these community efforts. Email me if you'd like more support on getting started!
Great for long drives, workouts, Migraines, or if you are losing vision.
The delays in the video feeds and bad quality is bit ironic...
The duplicate is almost always called EDU and stays in a cleanroom on the ground for troubleshooting.
I absolutely agree with you. Sports are good.

But it's an arbitrary good, because it's determined culturally. The rules of soccer could be changed at any time, and it would probably be just as exciting. Soccer is fun because we all agree it's fun, and no other intrinsic reason.

There's no reason we can't get excited about a monument to science the same way. If we have to spend billions just to get excited about science (without producing actual research), we should do it, just as we spend billions on sports just for fun and not because it produces any physical goods.
No. It will make the fuel from Martian resources like water ice and the CO2 atmosphere. Using solar power. First to split the water to oxygen and hydrogen using electrolysis, then use the hydrogen with CO2 to make methane (& some water which is cycled back to the electrolysis step) using the Sabatier reaction. This is done on the International space Station today, by the way. The methane on ISS is simply vented (as the point on ISS is to recover the oxygen from the CO2, which is most of CO2’s mass). It takes a lot of energy, so there will need to be very large solar arrays on Mars, but it’s possible.

This page describes the process: https://medium.com/spaceinmylifetime/how-spacex-will-refuel-...
I've often thought the WHERE clause should be required. You could just say WHERE 1=1 if you really meant all rows.
> Could you provide an example of such a barrier?

I did mention more than one example in the first sentence of my reply: CS degrees and certifications.

> Since software is utterly lacking anything resembling a formal qualification barrier it's hard to say a thing isn't valuable.

This is circular logic by either of our propositions. For if my statement were true (that "formal barriers to entry [in the context of software, as explicitly mentioned multiple times in the thread] are demonstrably useless") then it is not valuable as a barrier to entry [in the context of software, as explicitly mentioned multiple times in the thread]. However since you also assert that "software is utterly lacking anything resembling a formal qualification barrier" and this necessarily includes CS degree and/or certifications then that "thing" is equally not valuable as a barrier to entry.

What you've done is conflated your relative moral value judgment (approximately that there "should be" a formal qualification barrier to entry) with another separate relative moral value judgment (that existing barriers to entry are not useful or are so useless as to fail to exist). These are two different propositions. Also please do not attack the character of your interlocutor, for your suggestion that I have "never met such a burden for any professional industry" is wrong but also just pretty lazy.

If you believe you have a way of generating a useful hiring signal that beats doing a work sample, I'm sure any number of people around here would throw money at you to build a company around it.
Tavis discusses this explicitly in the article. His claim is that there will be some other service that doesn’t do this so the user is still vulnerable to credential stuffing - just not on your service.

I don’t fully buy the argument, but he didn’t just ignore this.

More valuable, I think, is the claim that we only get so much bandwidth to educate users and that spending time educating people on unique passwords is more effective than working on sms 2fa.
As is Elixir (Brazil).
Is this legal? I sort of assume it isn't, in which case why bother? It seems faster/easier just to pirate from the get go.
Deploying Solidity smart contracts to a Polkadot parachain
It's disingenuous to think that People of Color aren't Republicans. Many immigrants who fled communist regimes identify as such.
A Closer Look at the Super NES Doom Source Code Release [video]
There was an article by Time magazine showing that the US froze funding for Hong Kong protesters: https://time.com/5860163/trump-hong-kong-funding-freeze/
Ask HN: Asking companies to send annual user account status reports?
I've been on the Internet for almost 30 years and have likely signed up for well over a thousand accounts. It would be nice to get an email maybe once a year with my account name, last time I logged in, etc. from providers that have an account with my address. Ideally with an option to quickly disable/delete the account if desired.
Breaking monopolies is a form of regulation
Yeah, they're turning the brain off. So they are dumbing them down.
Boothole Vunerability Impacts Billions
Sort of. He discusses the benefits of phishing resistant approaches like u2f later in the article.
I loved doing background investigations and PI work. It could be exciting, ever changing, and often utterly fascinating. I loved the travel and, honestly, the drama.

But the hours sucked and the pay was weak. IT/Network Engineering pays me literally 4x what BI/PI did. There may be a happy medium there in cyber forensics or incident mgmt (or other security roles).

But if the pay was closer... I'd consider going back, for sure.
I ported this effect to Android in a live wallpaper called Rainpaper[1].

[1] https://rainpaper.com
> vacuuming up data in order to segment each customer into Infinitely smaller market segments to charge them maximum prices they can afford

Can you explain this mechanic? I see how segmentation can be related to filter bubbles, which cause externalities (political polarization, etc.). I also see how the Internet exposes "the long tail" that previously couldn't be marketed to. But I don't see how this inflates prices exactly.

The classic example of market segmentation, AFAIK, is tomato sauce: They used to think people wanted one kind of tomato sauce; then they discovered they could sell (e.g.) "chunky", "spicy", and "classic", and that people would pay a little more for these.

I guess, to use an analogy, you're saying that there used to be something like "American tomato sauce", which was mass-produced and sold for $5, whereas now there's "Blue state tomato sauce" and "Red state tomato sauce" (and more than these, but let's keep things simple), each selling for $7. And maybe even the old "American tomato sauce" is still on the market, but people are nevertheless willing to spend the extra $2 to get the "Red" and "Blue" varieties for some kind of emotional and/or signaling reasons ("I don't want communist tomato sauce in my pantry"). And that these companies are creating the red/blue fracture in order to capture the extra $2 on each jar.

But, in this analogy, what exactly is the tomato sauce?

I could see the answer being "news" in the feed.
I could see the "dollars" being paid by consumers actually being "attention".
So then the story becomes that FAAMG are selling eyeballs, which I think is uncontroversial.
But to complete the story, you also need to include all the brands that they're selling the eyeballs to.
So who are they? Starbucks vs. Chik-Fil-A?

To connect to your earlier lines about "competitive markets" and the "free market virtual game", are you saying that new entrants are shut out by this advertising arms race? Is that how you complete the story?

Your post is vague but gestures at important things. From it, I'm trying to draw the diagram of the complete "triangle trade" (and maybe it's more than three vertices) happening here. What are the pieces?

- Social media (content discovery, filtering, curation).
- Content (e.g. news)
- Brands (ad buyers)
- Consumers (eyeballs)

Something like that?

Can you spell out how this works with specific examples?
There are two questions about the CCP and spyware: is it technically possible and do they have the political will to do it?

I don't think the CCP is putting spyware into the iPhone because it's only barely technically possible and they don't have the will to risk it. Getting caught with your hand in the cookie jar there would be the end of their whole economic strategy.

Would the CCP put spyware into Tik Tok? It's trivially possible, and the will is absolutely there. I would be more surprised if it were somehow proved that they weren't interfering with Tik Tok on some level.

Would the CCP put spyware into 5G? AFAICT, it would be technically possible, and the payoff from it would be so huge that they might have the will for it, but it's a close thing. Hard to say definitively either way. I think the industrialized nations should make their own 5G, just so they're not shut out of a growth industry, but the spy thing is sort of a wild card that could be something or nothing.
> more about sovereignty than government surveillance

Those two things are not unrelated.
SpaceX. In any case there is nothing wrong with being "slightly derivative", especially since the concept is really vague, but there are still degrees. So I would argue that what SpaceX, Tesla or DeepMind(Google) are doing is more difficult and challenging comparing to what tik-tok, twitter or instagram do. Even if you claim all work is derivative.
A domain is a type of intellectual property. For all intents and purposes you own it.
“Why wear a seatbelt your car can crash and you can die anyway.”
Usually this job title is development DBA or PL/SQL developer.
Yes, it's true that SMS-based authentication has its flaws, but it's far from useless/harmful in many contexts. The same strawman arguments used here would also find TOTP "wholly ineffective" which is an absurd conclusion.

A main goal of security engineering is to increase the difficulty level for attackers. SMS authentication has demonstrated its ability to do this in a highly accessible, albeit imperfect, manner. I feel that the author severely underestimates the practical difficulties of widely deploying "Unique Passwords and U2F".

I strongly disagree with the conclusion that "SMS-2FA is not only worthless, but harmful" and highly recommend consulting a security professional before entertaining any of the arguments or following any of the suggestions in this article. I don't like leaving negative comments, but this is at best borderline misinformation that has the potential to create severe consequences.

Some more context, if you want to consider a more balanced perspective:
https://doublepulsar.com/infosecs-fantastic-fear-of-everythi...
To me this is exactly what the FIRE movement is about (Financial Independence, Retire Early). I know some people just want to live on the beach or run a hobby farm or foster 10 rescue dogs at a time, but many will have the time, desire, and bandwidth to participate in activities like this which require the type of bandwidth that very much feels like a job. Good on you!
"we all know amazon is evil, but did you know that when a book becomes an audible exclusive, libraries cannot buy copies of that audiobook? did you know that capitalism is the enemy of accessibility?"

Evil capitalist Amazon is also the greatest creator of book accessibility since Gutenberg.
He is thinking of it from the user’s perspective rather than the service. If I reuse my passwords I still get owned even if some of my services use 2fa, because others won’t.

It’s an unusual way of thinking about it and I think the weakest part of his argument but it is interesting.