skysight-inc/HackerNews huggingface dataset:
Brings up an interesting question: Why do we need a Let's Encrypt to issue a TLS certificate? At what point can we stop using them?

PKI in a nutshell: the CA signs your CSR which was created with your private key; the CA gives you a cert based on your CSR; you show random people a website using your private key + CA-signed cert; random person's browser trusts your private key+CA-signed cert content because their browser trusts the CA-signed stuff implicitly.

Why we need more than 1 of them: in case one of them goes down and so we can't get new certs; in case one gets compromised and the browser revokes their trusted CA cert; diversity of "features".

What could we do instead of this process?

Idea 1: the registry becomes the CA.

Why?

To get a cert, you have to prove you are allowed to have it. Currently that almost always involves proving that you currently control the IP space that is pointed to by a DNS record. There are other verification methods which are somewhat more problematic than this, but this is the simplest method. And if you can find one single CA which will create you a cert if you can do this, that means that if anyone can do it, they can get a cert. Meaning that this verification method is the minimum security barrier for getting a valid cert.

How can an attacker to subvert this process to generate a valid cert for any domain?

Options: 1) Take over the domain, by hacking the domain's account at the registrar. 2) MITM the registrar, such that updates to the registry's NS end up controlled by the attacker. 3) Take over the domain, by hacking one of the domain's nameservers. 4) Perform a DNS hijack, such as cache poisoning, so when the CA looks up your domain to find the IP space, you return attacker IP space. 5) Perform a BGP hijack so when the CA tries to connect to the IP space, it connects to attacker-controlled IP space. 6) Plenty of others based on other validation methods such as DNS record alone, HTTP [no S] content, a pre-configured list of e-mails for a domain, etc.

How to prevent all but one of these attacks?

Option A: Make the registrar the CA. The registrar would simply request the user use an HTTPS API to request a new cert, using an API token generated by the login for the domain's account. The only way for an attacker to generate a cert at that point is to either hack the registrar account, or hack the customer's server to get the API token (basically the same impact as if they compromised the customer's web server).

The browsers would trust the registrars who would follow the exact same stringent guidelines that CAs use today. The difference to the end-user is the CA is run by the registrar.

Option B: The registrar and the CAs stay independent, but they use a standard secure protocol to authorize signing of certs using a customer API token. Same benefits, but an extra hop. Browsers continue working as before, users use an HTTPS API to the CA to generate the certs.

With either options A or B, there's no more stupid hoops to jump through just to prove you own the domain and thus deserve a certificate.
>Failing all else, StarLink.

This doesn't make any sense. A Starlink satellite's bandwidth is shared with everyone under its radius, so any throttling/bandwidth caps is going to be even worse. A quick search says that each starlink satellite provides 20 Gbps each, which works out to 6.57PB per month, or around 5000 1.2TB/month users. This is the best case scenario, assuming that their usage is uniformly distributed per month. Most bandwidth use is bursty (think netflix in the evening), so in reality it's actually going to be much worse. Assuming a 4K stream at 25 Mb/s, one satellite would only service 800 users. Given comcasts' statistics (5% of users use more than 1.2TB/month), that would mean you need dozens of satellites to service all the heavy users in even a small town.
And it depends on your use case - whether you want to guarantee exactly the same behaviour and ship all the dependency updates yourself; or do you want to have less maintenance burden and trust the base layer to not change behaviour.

In a tightly controlled environment inside a company where the update mechanisms are preconfigured / enforced, I'd go with nix model. When distributing an app to people on the internet, I'd choose flatpak model.
Perhaps the trick is to be capable of using analogies.

"Facebook is an authoritarian regime." means "Within the context of users' actions on the platform (and actions of non-users that are nevertheless tracked by the company), Facebook acts in ways that are analogous to how an authoritarian regime acts towards its citizens."
Cheap access to debt is inflation. You are violently agreeing with me.
Is there anything to help one stop wasting time by reading about how to stop wasting time?

People must waste more time reading about how to not to waste time than anything. Just like all these people being unproductive while reading about how to be more productive.

Of course the solution to all this is self-discipline but that doesn't sell.
I bought a beaten up Sony NEX camera with PMCA(discontinued Android app market feature, not to be confused with other PlayMemories features) while ago, and turned out there’s already an app on GitHub to start telnet over Wi-Fi with root.

The camera seems to use standard gadget modules to handle USB connections, but Kernel seems to predate gadget UVC driver, and the main image sensor is not operating as a V4L2 device.

If anyone could get a UVC module to compile and load, and use Sony API to pipe video from, that’ll let users skip the HDMI part when using it as webcam.
Can your boss know you're procrastinating?
What sort of distance are we talking? What sort of devices? Running a PCIe lane to a client seems a little odd to me, but I figure I’m missing context
Thank you for this. Great motivational reading!

I started building simple, 2D clones last month but have been losing steam in the face of how much work goes into even a simple game. Who knew so much goes into 80s arcade hits!?
I happen to agree, but it's ridiculous to think that a list "loses credibility" for one of its items not fully fitting one of the million reasons people choose to avoid Google products.
My bad, I am mixing metaphors here. I meant 'theory' as in 'the opposite of practice or experiment', not music theory. I totally agree that there are many famous and accomplished musicians who don't know any formal theory or reading notation.
Maybe the news article was being informal, or maybe they specifically wanted to carry concealed and not open. It still seems like whatever was being requested was on behalf of the security team he was overseeing as his primary job duty at Apple.
Motorola did it and Microsoft did it.

I think Samsung may have also given it a go.
We're describing essential oils.
This sounds like from 10+ years ago. It did that discovery thing for me, but only for a while. Today my youtube is an isolated cell that I have to forcefully break out of to discover something new. As if they were not interested in me consuming new content at all.
Did the CEO of that defense contractor ever come around?

He probably had a protection team, as do most individuals in similar circumstances.

Cook, Zuckerberg, et al. have private armed security.
Concealed or exposed, you need a BSIS license as an armed guard (executive protection) in CA.
And head security guard is very different from head of security. The laws attributing liability to the company don't only apply to actions of chief executive - Apple head of security would definitely qualify.
Its fine to say dont buy such hardware. The concern is what happens if thats all AMD, Intel and qualcomm sell to people. Apple already does this with the iPhones and tablets, and unless you find a bootrom exploit good luck running an other OS on the device.

You also start running into problems where more software and content may require such hardware.
Worth1000
Really? A concealed carry permit issued subject to a background check is useful for intimidation?

Why not just intimidate without a permit (which wouldn't somehow make things less illegal)?
You may also be interested in Duplicacy (not to be confused with Duplicity etc). Can also backup to SFTP, great dedupe features, RSA encryption, etc.

https://duplicacy.com/home.html
In my limited experience there is much more control over AMD CPUs, but it could have more to do with ASROCK bios options. It took me a while to learn about all the controls that were there and it was a bit of a double edged sword that I need to learn them at all (while building a very small computer). You can control the throttling at multiple temperatures if you want, but I opted for just throttling at a much higher temperature (80C or 85C).
As a PagerDuty alum, one of my favorite anecdotes was of a time when the system experienced an outage early on and the founders along with early employees had to resort to calling people up manually and reading off alert messages.
TCP Performance problems related to Nagle’s Algorithm and Delayed ACK (2005)
The only game I'm aware of with an extensive automated testing infrastructure is Minecraft:

https://youtu.be/vXaWOJTCYNg?t=993
Re: universal healthcare. Latinos in the US have the highest rates of lacking health insurance (20% versus 5% for non-Hispanic whites). But they have the second highest life expectancy (81.8 years—longer than people in Denmark). And they have the lowest maternal mortality rates: https://www.cdc.gov/media/releases/2019/p0905-racial-ethnic-...

> If you look at health care for the poor in the US, it is generally geared towards emergency care. They will stitch you up if you are about to die. However it generally does not cover regular doctor visits and checkups. Hence in the US a lot of expensive effort goes into saving babies when born, when the problem could far more easily have been resolved early in the pregnancy with better checkups.

That’s absolutely false. Medicaid covers preventative services: https://www.kff.org/medicaid/issue-brief/coverage-of-prevent...

CHIP also covers pregnant women and children under 19 and covers pre-natal checkups and delivery.
There’s a few nuances like this with OpenGL and Vulkan that you’ll find in the specs. Normally you don’t encounter them because the compiler by default aligns to certain boundaries. Then someone tries to get clever and uses a custom allocator or a packing directive on a struct, and suddenly your vertex buffer isn’t aligned any more.

What I’m getting at is that it likely wasn’t a driver bug. The other drivers were just more tolerant of the incorrect behavior.
Honestly, I think it is because of the high level of the payments it could no longer be ignored, and the sheriff pissed off someone more powerful than them. Usually this stuff would entail a couple of thousand per individual, the whole process was based on insider networking/understanding, no explicit quid pro quo, and the money was slated to an organization that was set up to receive funds for other legitimate purposes so there is some level of transparency. Based on the article, Santa Clara had taken this to a whole new level with what was being demanded and the demands were explicit.
Good. If only I could convince all of the morons I care about to do the same.
It's Fahrenheit 451 without actually having to burn the books. Commerce will turn them into toilet paper and soon there are no original works. Just digital content that can be changed to meet the narrative at the moment. Interesting times.
Downthread there's a lot of talk about rust.

I grew up on an extremely small scale farm on the west coast of Norway, lots of rain and 100m from the sea, 12 or so km from the open ocean (you see the Atlantic if you drive a boat 500m out to the middle of the fjord.)

Rust didn't stop any of our tractors, not a single stroke of paint even for the 40-50 years old machines.

But here's another thing, picked up from a friend of me after I asked him why he bought a brand new Valtra at some point instead of buying a slightly used one that was available on the market.

His answer has stuck with me since: if you enjoy getting up and going to work in the morning that count for something too.

I still happily use old equipment - if it works - but I factor in the value of not wasting my (or my customers, when I work as sysadmin) patience on slow computers.

Edits: spelling, redundancies
Here's how you write a quote:

> Steve: I'm a simpleton I've always had this view that we pay taxes and the city should do those things. That's why we pay taxes. Now if we can get out of paying taxes I'll be glad to put up Wi-Fi.
reply
Can you please share the GitHub repo? I have a NEX
I kind of like it. I haven't got far, but I think how it will work is to let it serve pages for the admin site, and provide JSON API to a stateful frontend.
Pluton can securely track what software was booted on the main core as long as the previous component in the boot chain participates. If your OS doesn't participate, you don't get any measurements beyond that point. And that means there's no way for Pluton to block execution.
Google: Bert now used on almost every English query
The podcast 99% Invisible had a recent episode about evacuation times of airplanes
Look at Duplicacy. It's memory usage is reasonable for me and dev is lowering it. Also faster than Restic and fully incremental.
Courts are very familiar with adjudicating such ambiguity and have been throughout history. They simply have to avoid discriminating in ways that violate the law, but other forms of subjectivity.

As a stupid but illustrative hypothetical example, if the official decides each morning whether he will approve all CCW applications he sees that day or none of them based on a die roll before leaving home, and then unilaterally changes it a month later to go based on whether the last digit of the local CBS affiliate's high temperature forecast from the 7am newscast is odd or even, these stupid rules and rule changes would be completely compliant with the equal protection clause.
Why are you making stuff up?
If a cellular network IoT is the future, why is it blocked by 5G deployment? Seems like it could just happen now with 4G. Does 5G relax the need for a phone number (which I believe all 4G devices have, even if they can't make calls) or something?
I'd assume individuals who want a permit vs campus with concentrated amounts of high-net-worth individuals is a different problem. I can't fathom why anyone would want to live in a place where they themselves need a CCW permit to feel safe.
Any easter eggs or cool background stories/inspiration/deeper meaning to any of illustrations?

This creative work gives me life, thanks for sharing.
No one is debating that, and the BSIS standards are absurdly low and they are available to everyone. There is no taint in the process for BSIS issuance that has been raised.
TP Link originated from mainland Chinese in Shenzhen. https://www.eweek.com/networking/china-s-tp-link-refreshes-b...
No thank you. I like my constitutional rights that are actually taken semi-seriously by my fellow citizens and the leaders we elect.
Interestingly, the ranking approaches used here are quite comparable to how those big giants do their recsys algorithms. The algorithms are never perfect and there will always be edge cases that even machines learning models cannot handle decently.
The fact that a bribe is necessary is the problem. The second amendment guarantees the right to keep and bear arms and the “may issue” vs “shall issue” permitting process is a direct affront to that right. Anyone that meets the legal requirements for a permit should be entitled to one. It shouldn’t be up to the discretion of a public official to anoint chosen ones based on their own personal feelings. Either requirements are met or not. But a public official shouldn’t be evaluating “need.” That’s not the Jon of the public official. That would be like a public official deciding one media outlet should be allowed to publish and another one denied. Equal protection is violated. Two people with identically clean backgrounds should not have one person awarded a permit and another denied. To get a drivers license, you don’t have to prove a need to drive: you pass the test and pay the fee and you are good. And unlike driving, keeping and bearing a firearm is constitutionally protected.
Your role in the company may not directly harm anyone, but if the company is doing "bad" things, then you're arguably an enabler for those anyway.
If you live in a place where you need a concealed carry permit to feel safe, you probably should move to a safer place.
I'm guessing the ncurses-based IM client based on libpurple (in other words, the text-based version of pidgin).

Which I used quite a bit when that kind of thing was more useful
It's possible the journalist was wrong, but I believe the BSIS issues the professional license, not the sherriff. Open or concealed doesn't matter when it's for armed employment - the license from BSIS is what's needed. So it seems this was for personal CCW.

Edit: Never mind. CA is super stupid and requires a state license to carry a firearm for employment but would then also require a license from the sheriff to conceal it.
I feel this when I watch tv shows and movies from the 70's and 80's

And SNL, but that's another story.
This study seems biased to always select reconstruction. Why isn't there an option showing no reconstruction, or an option to say neither reconstruction is aesthetically pleasing?
> No one NEEDS a news 1500$ Gibson

I do. Donations accepted. ;-)

(Sadly a Gibson [not Epiphone] Les Paul Standard is more like $2500, though a Special or sub-$1K Tribute looks like it might be a pretty good deal for a US-made Gibson...)
I stand corrected. I confused Apple and Twitter when recalling this article.

https://www.theguardian.com/technology/2020/nov/17/twitter-h...
I've found memory palaces useful for public speaking (remembering main bullet points), cramming for exams, remembering trivia, and strings of numbers like credit cards and phone numbers. My nine year old daughter also memorized the US presidents with a memory palace app on the iOS store.
You are putting everyone else in danger when you start carrying weapons, as an ex-resident of the bay I'm really happy that the rules are against weapons in general
> Why does someone always have to be in poverty in your world view?

The short answer is, "because there has always been". The longer answer is about distribution, effort, and capability for populations. There's also the issue of individuals who choose not to participate or concern themselves with their own well-being.

It's almost assured that there is uneven distribution of goods in every economic model leading to a complete breakdown of availability for some.

In an egalitarian utopian socialist/communist system, there are inadvertent gatekeepers who create an uneven distribution from corruption and opportunity cost. ie Distribution work that is hard is avoided when there's plentiful and ongoing distribution work^.

Any economic system that is not explicitly egalitarian has gatekeepers by design and you end up with uneven distribution. I don't see any way around these issues, even with automation...which has to be maintained by humans and you end up with the same issues.

^I think the USPO is an exceptional marvel as an egalitarian service which actually works, albeit by making cost/benefit choices about what areas to cover. To whit, this is a compromise that still leaves some without mail service, akin to mail-poverty.
I'm well aware of how many places the Arduino core is ported to, it doesn't change the fact an actual Uno has the defining form factor and MCU.

There's a million and one peripherals designed for that specific combination that don't work seamlessly with other boards (even within the "official" Arduino family)

I mean your complaint about the quality of the library code, it's perfectly fine that the code sucks if it lets people do 1 million and one things they couldn't otherwise.

Do you really think someone programming an Arduino for controlling their cosplay LEDs cares if the library they used is poorly written? As long as it works it works.

They were never going to read the datasheet for an MCU and start figuring out bit masks for pin initialization, so it's literally a case of something is better than nothing, and there's no reason to gatekeep the environment that lets them use embedded systems
You are free to defend yourself (or not!) however you please!

Ultimately - that's okay, so long as my rights and the safety of my family aren't subject to another's particular distaste for self-preservation.
One of the reasons that so many people are ok with javascript is that they're ignorant of the risks they're exposing themselves to by using it.

This includes even places like HN, where I've had people claim that JS was completely secure and refused to believe there were any JS vulnerabilities until they were shown proof.

So, yeah, my option is to stay silent and conform, and let everyone have a pleasant time at their steak dinner without mentioning that I'm vegetarian for ethical reasons and either eating their steak or going hungry.

Incidentally, both vegetarianism and environmentalism have become much more popular over the last few decades, while they used to be very fringe positions, far out of the mainstream. They didn't become popular by people staying silent about them.

You might say there's a time and a place for everything, and the reveal of artwork that's powered by a javascript website is not that time or place, but I say what better time or place is there?

This is the best opportunity for awareness to be raised.

That said, I didn't intend to derail this thread in to an anti-javascript screed, but if people are going to start calling me entitled simply for asking for a direct link to a video so I don't have to run their javascript, then I'm not just going to swallow their insults. I'm going to respond.
They have to provide legal reasoning. Simply using an arbitrary die roll would not be lawful, unless the legislature specified it.
RClone is more about copying folders/files between storage systems, it doesn't pack files together like other tools. I use Rclone for larger files like pictures or media files that don't change or move around, pure sync to targets. You can use cron to run it if you want.
>Unfortunately all the jailbreaks in use today are closed source and obfuscated to some extent

In that case why we call it a Jail-Break?
I would rather call it a Jail-Switch/Choice ...

It's another Jail if I still don't have a full control.
I wonder how they arrived at that number?

It seems like you'd want to do something like:
(max axles) = 256 - (% of missing an axle) * (number of axles)

More or less. (Obvs you'd have to know the chance of missing an axle - but without a reasonable guess at this it seems you couldn't really set the max value accurately)
I imagine there is a pretty big pool of skilled senior engineers that cannot pass stereotypical leetcode interviews, especially at the more competitive companies. That's something you can tap into.

Not all senior engineers make huge salaries. Senior engs with decades of experience at many non-tech companies might make slightly more than a junior or mid level engineer at a mid to top tier tech company. For every elite senior engineer at a competitive elite SV tech company getting 300k+ before hitting the 10 year mark, you have many senior engineers at boring non-tech companies that might be lucky to hit 200k when they retire after decades of work.

(Although it could be argued that such senior engineers are not quite as skilled or "senior" as a senior engineer at a tech company - disclaimer - I speak as a "senior engineer" at a non-tech company myself)
This isn't inflated, really -- Quebec doctors are allowed to charge about the same to the province (depending on several factors, but it's within 2x even for the cheapest option), so it's a reasonable approximation of the costs involved, it's just who pays for it and when.