skysight-inc/HackerNews huggingface dataset:
> Disregarding that property, Apple needs to know that the "CSR", ie attestation request, is coming from the secure enclave. That means that the "CSR" needs to be signed by some key. If the CSR signing key is unique per device, Apple receives device-specific information. This can't be an ephemeral key, as there wouldn't be a chain back to the secure element. If OTOH the CSR signing key is shared, it is probably exposed, or at least accessible for malicious signing, via the now known T2 compromise. There is much to be gained by such an exploit, so this isn't merely a thought exercise.

> This complexity is all avoided by on-device attestation. EPID or EPID-like scheme could have been used, vs batch attestation.

EPID is a DAA scheme. _If_ Apple is using a DAA scheme to their attestation service, then you would use that to protect the equivalent of a CSR (which really should only need the public point and hash of the creation request).

The intermediate service exists to hide the choice of DAA scheme (and needs to potentially require things like BN curve cryptography to handle it), and to do other value add logic. For example, the attestation format is extremely similar to DeviceCheck attestations, which assert hardware/os/application authenticity for a third-party remote service call.
unnamed sources have said that Epic was outright lying https://daringfireball.net/linked/2020/09/29/epic-games-unre...

> multiple sources at Apple told me Epic’s claims were simply false. There was never a September 11 deadline for their SIWA support to stop working, and in fact, Apple’s SIWA team performed work to make sure SIWA continued working for Fortnite users despite the fact that Epic Games’s developer account had been revoked.
> My own experience (particularly in online communities) is that once groups achieve a certain momentum, the average participant in the group cares very little about policies that impact a tiny minority of users no matter how draconian they are.

Agreed this can be a problem - but I wonder if it can be solved with UX? If the filtering rules are really obvious, and the clients give you the ability to actually visualise and curate the filters being applied, I'd hope that it would be much easier to spot toxic moderation.

> I'm just deeply disappointed to see it -- social credit styled systems like this penalize people for having bad mental health days, or who have unusual interests or points of view, or who are LGBTQ+, or belong to some other vulnerable minority group, and I think generally have a chilling effect on communities -- or rather on these specific subcultures within those communities, clearly not all of whom are "bad faith" actors.

Hm, "social credit" implies an absolute reputation system (like Reddit, HN, China etc ;) which this categorically isn't.

The idea is that if you as a user want to subscribe to a reputation feed which prejudices against minority groups - then that's your bad choice to make. You'll find yourself having to explicitly remove the filter to follow the conversations around you. Alternatively, if you find yourself in a community which has engaged a blanket ban or filter on minorities, you may want to find a different community.

We get that there is a massive responsibility on the Matrix team to implement UX for this which is designed against factionalism, censorship, filter bubbles, absolutist social credit, persecution, polarisation, antagonism etc. But we also feel a massive responsibility to stop users getting spammed with invites to child abuse/gore/hate rooms, or from accidentally hosting content which could get them incarcerated.

Critically, this stuff doesn't really exist yet - the first developer hired to work fulltime on it hasn't started yet. So this is the perfect time to give feedback to help ensure this rep system actually works (at least as well as real life society does) and not go toxic like so many others have done before it.
Tell me more about what you mean exactly by "internet of energy". What is Enphase doing with this that's unique?
Nobody said it was hard. But what's your percentage of people that will "save the code" in a document and remember where it is X months/years from now?
But everyone will still have their email for the most part.
It isn’t productive to establish defense against an arbitrary future that turns on you. Spend those brain cycles focusing on your user and building a great product. Choosing Sign in with Apple is great for Apple users.
This is the great irony, isn't it? You want to escape Discord, because it's centralized, so you jump to a decentralized service, whose user experience sucks, so you sign up for another centralized service, just so you can use the decentralized service that was supposed to get you away from centralization in the first place.
What's stopping you from linking more than just one physical FIDO-enabled device to a particular site/service? Most MFA implementations I've seen already allow this, and it seems especially important if you want to minimize the pain of losing/damaging that one sacred card.
I have a small group of emoji that I turn to for this kind of color. :sweat_smile: for a note of self-aware awkwardness. :thinking: when I'm posing an idea without standing behind it too hard, or when my thoughts are continuing beyond the message I've just sent. A few others are not uncommon, but more situational.

(I'm using their Slack codes here, since I'm not sure I can just embed them directly in an HN comment...)

I tend to come across in text as very detail-oriented and precise, so some careful emoji usage helps recover some of the consideration that would normally be carried by tone or body language.
I don't own any Macs, but I have setup far more printers on other people's Macs than on my own PCs. No Windows user ever asks me for 'tech support' to get a printer working. But the few Mac users need it all the time.

It is so odd to me that setting up a printer on Mac is so much harder for the average user, apparently. My current printer worked by just plugging it into the computer. Windows downloaded the drivers and it all just worked.

If your printer is well supported out of the box in CUPS you might do ok, but that does not seem to be that common if your printer is new-ish.
it works great, just change

struct fd_set fds ;

to

fd_set fds ;

in line 608.
You can get that the interior line is shorter and the outer line is longer than the arc by relating these to the inner and outer polygons used in Archimedes' demonstration that the area of a circle may be related to the circumference:

http://www.ams.org/publicoutreach/feature-column/fc-2012-02

It is possible to prove that the circumference of the outer polygons gives a decreasing sequence and the circumference of the interior polygons gives an increasing sequence simply by applying the triangle inequality when you double the number of sides. This is sufficient to justify the use of the squeeze theorem here, although you are correct that the axiomatization of geometry is quite subtle.

I did not give much thought to the definition of the trigonometric functions while writing this because I assumed this theory is usually fully developed before we begin complex analysis (but is it?).
The grind is interesting.

I think one of the things the pandemic exposed is how much time is wasted in class for discipline and "class management". Really, without it the quiet kids can pretty much get the regular curriculum in half the normal time.
I really hate the "we're going to send a code to your email" approach because it so often breaks.

Case in point, I tried to log into Patreon earlier today, they insisted on sending a code, and it never arrived. I tried several times, no email. I have a record of every email sent to my address for the past several years regardless of spam status so I can be 100% positive they simply never sent it.

In the end I had to give up. I can't log into Patreon today, because of their insistence on sending me an email even though I'm logging in from a computer I've used many times before.
I'm one of the DMs on this site and I have to say, nothing pulls a group together like a life or death experience.

Bonds form quick and true friendships have been made.

What's nice about using a Virtual Table Top is that each player has their own FOV to the game.
> Do you really not see how saying, "businesses should be allowed to sever ties with people who say mean things" is different from saying, "the courts will decide whether or not you committed libel"?

Of course I see that. Contract law and defamation law (tort) are separate domains. A court does not have to conclude that a party to a contract committed libel in order to determine that they are in breach for making disparaging remarks about the counterparty. The layperson might (understandably) believe that the analysis would be identical, but it is not. A finding of libel under tort law requires a multi-part test which I won't elaborate on here, and there are lots of defenses, too.

> Companies with contract language like this have broad leverage to wield their power in whatever way they see fit -- because for the most part courts have not ruled that escape clauses boiling down to "we can decide to ban you at any time for any reason" are illegal or unenforceable.

I think we're in violent agreement for the most part -- I'm just saying that your characterization is overbroad since obviously "any reason" is not quite "any reason." As engineers, we should strive to be as accurate as possible in our analyses and avoid hasty overgeneralizations.

At bottom, courts aren't generally inclined to force parties to do business with each other if one of them is no longer interested, there are no promises left to be fulfilled, and there's nothing binding them to an infinite term (which courts also don't like to enforce). Apple is not a common carrier or the government, and so they're treated just like anyone else for the purpose of contract law.
Or Wazuh (ELK stack fork)
Galatea, Pt. 3
https://i0.wp.com/syncedreview.com/wp-content/uploads/2020/1...

I hope Google will adopt this into google maps streetview. Models this is producing are generations ahead of the current glitchy mess

https://news.ycombinator.com/item?id=24324813#24326803

"Look at 'NY 41 central park west' train wreck. You have >20 good photos to work with, but the end result doesnt even maintain straight windows. Balconies look like Lara Croft breast from first Tomb Raider, not to mention they are all different geometry despite high quality source material showing them being all the same shape. The best data saving option would probably be no additional geometry at all, just a texture."
> cryptocirrencies don't make any sense

that summarizes it better.

Cryptocurrencies aren't a smart workaround around the financial system. They are simply violations of laws.

They're not loopholes. Thousands of years of economic theory wasn't suddenly made obsolete by something new. It's just crime. Economic systems already knew we don't want money laundering and we do want reversibility. Some techie thinking mixers aren't money laundering and thinking reversibility is a bug doesn't make it so. They were on purpose. Because that's superior.
Same except that, if Apple blacklisted a provider, I'd want to know why they got blacklisted. At this point, I trust Apple as a neutral third party more than I trust most other companies since Apple isn't incentivized to sell my info.
Or you just can't exchange crypto currencies against dollars because the finance industry is already regulated and has to follow the rules.
China Is Now the World’s Largest Economy. We Shouldn’t Be Shocked
Biometrics fail every test for a password, but, assuming sufficient accuracy, work pretty well for Authentication, which is the actual purpose of a password.

Biometrics are closer to a public key than a password.
Probably because lower-c calories are meaninglessly small for like 99% of the population. It'd be like doing all your cooking in milligrams.
The author of this article, Samo Burja, also gave a great lecture in 2018 called “Civilization: Institutions, Knowledge and the Future” (https://youtu.be/OiNmTVThNEY) which was mentioned in Jon Blow’s popular 2019 talk on software complexity, “Preventing the Collapse of Civilization” (https://youtu.be/pW-SOdj4Kkk). Burja’s talk is worth watching if you’re interested in his analysis of technology and history over an even longer period, and it provides some context for his remarks at the end of the article about intellectual institutions and the benefits of centralisation.
How you intepret those is absolutely a choice. If you do not have enough information to know 100% what the intention of the other person is, then wherever you land is a decision. If it's that the person is angry, that's your choice the same if you believe the person is not angry.
Well because many services aren't just a mobile apps, and people use multiple devices, and devices have to be replaced from time to time, there are a lot of legit reasons for accounts. There are a lot of ways to mitigate having to make accounts, but many are less secure, more work, and most users at this point are use to creating an account.
Purely anecdotal but I think it’s from irc/aim users (a lot of millennials/genx including myself) since long form communication wasn’t really a thing on there. I see some people write paragraphs as messages on discord servers and iirc that wasn’t technically even possible on irc and I feel like it’s even strange to see in the middle of lighter chatter.

Also slack threads are awful, imo. I can appreciate them in certain contexts like asking what tool everyone likes or where to grab dinner, but if your slack has become a place where complicated tech answers wind up in threads it makes searching so frustrating just due to the UX. Also they’re limited, or were, on features (code blocks never looked right, etc). I HATED when outages wound up in a slack thread and not a room which was too frequent at my last employer.

That #tagging/#threading feature available on the other slack/discord/teams competitor I can’t think of right now is something I really want.

I have to pay attention to not treating slack like irc quite a bit.
As a user, I recently deleted x account. I used login with x on a few services and now I can't access them anymore.

This situation is solvable by implementing forget password and storing user's email but many services don't and with a system similar to apple's where you mask the email or phone number, you can't do anything.
It's not super difficult to spell but given that it's not very commonly used, a little on the difficult side in terms of spelling.
Can the downvoters please respond to the post with the reasons why they are downvoting?
A Civboot software stack OR what software does civilization need?
Slack also makes no sense. I need a different login for different channels?
If you're arrested for something, your possession of a pry bar might count as evidence you were involved in criminal activity
> I like the idea but it does seem like you're setting up a poll tax to participate fully in the internet, simultaneously having it high enough to deter or at least raise the bar on scams and low enough to be affordable to the whole world is a hard ask.

It's not actually that hard, because ordinary users can generate one ID and use it for many years, but spammers have to generate a new ID every five minutes because they immediately get blocked and have all content associated with the blocked IDs get retroactively dumped in the spam folder. So the cost to spammers is literally a million times higher than it is for ordinary users, which is exactly the sort of thing that actually works.
Correct me if I am wrong but doesn't Go yield better performance than Python?
Worth noting that this carries a lot better in a medium like IRC or Slack, where the message framing implies an "end" in its own right. It looks a little strange in an HN comment, because they all come in the same single message.
Y'know, I don't think I've ever heard someone use that exact sentence, but I think it's an ok distillation for parts of stoicism (depending on your definition of better, that word has a lot of baggage when applied to human beings), especially the parts Seneca focuses on if I'm recalling them correctly.

Ultimately I think the problem is trying to distill it down to a single sentence. Perhaps I was in error in attempting to provide a better example of something that cannot be done adequately, it may have just caused more confusion.
As a DM, I can put up different listings. Each listing has it's own price.

My general pricing is $120 per session. $20 for groups of 6 or $30 for groups of 4.
You can offer your code under as many licences as you want. So you can publish the same code under both GPL and a proprietary license. This is called dual-licensing. The people that receive the code from you under one of those licences will not have that liberty. They will have to abide to the licence you gave them. For proprietary licences, that usually means they are not allowed to do more than use it. For GPL, that means they can pass it on under the GPL.

So in your example, while people could share the code you publish under the GPL, it does not impact what you can do with your closed source version. Only when you'd start to integrate patches to the GPL branch from third parties, you'd get into trouble.
Ask HN: What product, etc. do you think is snake oil?
I would agree except I always had issues where I would never receive their TOTP emails. I was using Fastmail and had my spam settings set very leniently.

Fastmail Support claimed they never received any mail (ie it hadn't bounced) but DigitalOcean Support would insist I check my spam folder for the 500th time.

Ultimately, I just swore to never use their services, primarily because I... could never log in and actually use their services.

I think it's fixed nowadays but I wasted so much time on that issue.
No, you and I shouldn't roll our own cryptography.
Good, cryptos are for cranks and criminals and should be illegal
> A native app has every opportunity a webapp has to track you and much more.

Nope, an iOS app can’t leave a cookie that other apps can use to identify me.

Clearing storage is not the issue, making sure that the storage is not accidentally cleaned is.

The data consumption of an app is predictable because the download size would be listed in the appstore. On a website, it could be anything and the only way to find out is to load it. You can check out the data usage after install in iOS but there’s no easy way to do it for websites.
I assume DIN-mounts, more so than standard 19-inch mounts, given the size of the Turing Pi.
To quote:

With the case set to go to trial next month, prosecutors recommended that the Justice Department drop the charges to preserve national security interests and prevent Russia from weaponizing delicate American law enforcement information, according to the official. The prosecutors also weighed the benefits of securing a guilty verdict against the companies, which cannot be meaningfully punished in the United States, against the risk of exposing national security secrets in order to win in court.
you're right that using biometric data for authentication is bad, but that's not what's happening here. faceid/touchid stores a private key on your device, and uses your biometrics to unlock that private key. it's the same idea as using a yubikey or something where you have to press the button on the 2fa dongle to prove it's physically in your posession and unlock the private key stored within it, but it goes beyond just pressing a button by doing some biometric identification.

the concern isn't what if the biometric data is leaked, because the biometrics are only used to allow local access to your phone. the concern is what if the private keys stored in your phone are leaked. and the secure enclave makes that as close to impossible as any other existing solution.
What I find irritating is the absence of what Chinese/Korean/Japanese apps have: a curated sticker market where the platform takes a cut of money that goes to the IP holder (brand or artist).
I took a very quick look at the source code, and seems you’re using the curl default options for things like the user agent. Please correct me if wrong!

Did you try pretending to be a search engine crawler, for an idea..?
As a DM, I control this. I keep open communication with the players about start dates and player counts.

It's easy enough for me to cancel a session before anyone gets charged.
MixtapeManager – A side project I made to automate Spotify playlist management
> a "join server" link only requires you to put in an username

While that's good, it would be better if they added an option to "log into an existing account".

I created 3 different discord accounts that way. There was no way to realize that I was creating a new account rather than just creating local name for an existing account.
STAT-Harris Poll: Share of Americans who want Covid-19 vaccine ASAP is dropping
It absolutely can be productive. So many people have done as you said and had the rug ripped out from under them by $ARBITRARY_PLATFORM_DECISION (cough cough YouTube) that if they had thought the risk they were taking on by going with one platform they might still be in business.
I had a chronic headache that lasted 17 years, so I feel your pain. I know you probably tried everything, but it might be worth trying the random thing that ended up getting rid of my headaches completely. 30mg of melatonin every night. Yes, this is 10x the recommended dosage of 2-3mg. But it turns out there's some random chemical imbalance in my brain causing these headaches. It's not that documented but there are studies.

This worked for me almost immediately after the 2nd night. The euphoria of not being in pain lasted months. From one person who lived in constant pain to another, don't give up!!
So what exactly is the concrete downside here, apart from the icky word "platform", that, in this context, means "a security chip that's not removable", ie as opposed to a Yubikey or such.
Firstly, I also highly doubt it.
Secondly, I also think the Great Silence is down to something entirely mundane like our perhaps being the first out there.

That said - My point being - even if there is a tenth of a tenth of a tenth of a chance that my speculation is possibly not entirely incorrect, it then becomes of the utmost importance that going forward that we oblige ourselves in having some almost Monasterial-like utterly analogue back up where external input of first principles are wholly questioned; proved as much as possible from outwith the digital realm and then transcribed and stored in flesh, or by hand, or memory and voice. Elsewise, how do we know our ideas have not been interfered with?
Really? As someone who's been using Discord since 2015 the interface is by far the worst aspect of it in my opinion. The desktop client has a minimum width, the channel list is not resizable, Ctrl+K for some reason doesn't prioritize channels in the current server, no tabs, you now need 2 clicks to reach your mentions instead of 1, if you don't have access / don't want to use a scrollwheel the server list is literally unusable (and even then, it feel awful reaching for the last servers), the client lags insanely hard if you're in a voice chat (Linux 5.8.14 with RX 5700 XT), virtually no accessibility features (besides TTS, which admittedly was there from the start)...

These are the UI complaints I have that I can list from memory. There's a bunch more regarding to how the service is operated (especially support), but it's overall not really a good experience for me. Definitely better than Skype, though that's a very low bar.

Edit: Oh, and no threads. That's Slack's best feature by far.