skysight-inc/HackerNews huggingface dataset:
Not all 2nd Factor solutions allow stealing the 2nd factor.

Mainly U2F incorporates the domain and (should) only work if an TLS connection with a valid certificate for given domain is used. Furthermore it uses a key exchange. This means:

- The attacker needs a valid certificate for the applications login domain, which wrt. web security is normally assumed to not be possible but tbh. might be possible in case of an state actor or similar.

- The attack needs to be live in the sense that password and 2FA auth needs to be directly forwarded to the attacked web-application and there it needs to trick any bot detection to make it believe it's not a bot. This also means even if they phish your authentication they only can use it once at the moment they phished you. But to e.g. then to disable U2F they often need to enter another password, so they need to phish you twice in a row, which is harder, but only slightly harder, tbh.

- Alternatively they might hack the service and get their hands on the private webcertificate and clients private key if the service doesn't use a HSM for that. But that is normally much harder and for many attacks unfeasible (and there is normally little reason to phish if you can hack a server that deeply).
There are no mentions of Trump in the first two paragraphs.

In the first, the author likens Suetonius, author of "The Twelve Caesars", to Michael Wolff, author of a book about a Trump WH scandal and intrigue.

In the second, he references Mar-a-Lago.

If these comparisons to the present "detract" from the "interest" of the article for you, rest assured that's a personal thing.
You are reading way too far into my words when I'm speaking causally, I do not write my comments in the dense and precise language in which studies are written as it's a bit overwrought for casual discourse. I had hoped you would give me the benefit of the doubt that when I said weight you would take that to mean some sort of levelized metric.

The people that do these studies aren't as dumb as you seem to think they are nor are the type of confounding variables you are expressing foreign to them. Not even study can get exactly the quality or quantity of date it wants, that's why its a good idea to look at multiple studies and examine large-scale trends and repeatably, which is the type of studies I linked.
There’s no ambiguity if the firing was only about the original comment - that screenshot however is missing possible further comments from the fired employee. If the discussion turned disrespectful (e.g. personal attacks), that could explain why HR did the firing yet had no issue with other instances of the word “nazi”. Still probably not a justified firing, but would make more sense.
There is[0] something called "pencil" for mock guis.

[0] https://pencil.evolus.vn/
I hadn’t really sat down and thought how much more complicated ETH 2.0 is than Bitcoin so that was interesting. I don’t think that the Concord metaphor is very meaningful though. Isn’t supersonic flight hard and inconvenient for real world physics and engineering reasons while cryptocurrency relies on CS/ math developments but if those problems are solved there is no reason to think the solution will remain impractical. Crypto won’t burn excess fuel or make sonic booms.
Don't go into security for the money. For the same effort you can make more money in some other part of the software industry. Only go into this industry if you're nuts about it because you will be competing with people who are nuts about it.
Spain spends too much energy dealing with internal problems.
Disclaimer: my account is a biased one. With that said, I hope the following comment helps.

Not working there but have a friend that does and looked around a bit myself.

My experience:

- 3 university courses from VUSec (e.g. how to do Rowhammer via JavaScript? How to analyze a binary? How to do a XSRF, XSS or SQLi? <-- is stuff I learned there)

- Hack The Box full-time for 2 months, most difficult machine I pwned was PlayerTwo (making a working heap exploit by poisoning the t-cache).

My friend also did OSCP after that and he rated it between easy to medium level compared to Hack The Box. However, you did need to be faster at finding the easy to medium exploits compared to Hack The Box (since OSCP is time-based and Hack The Box isn't). The levels of Hack The Box are: easy, medium, hard and insane. IMO, this is a false characterization, since the levels are more like:

Easy: metasploit vulnerability

Medium: some payload vulnerability

Hard: harder to find the vulnerabilities, but most vulnerabilties are of level "medium", mixed in with some binary stuff that's quite easy to do (if you know binary, because if you don't, you're gonna cry with how hard it is. I suspect most people don't know how to do it, but VUSec prepped me well for that)

Insane: medium web level vulnerabilities (same as hard), but the binary stuff becomes a lot harder, also mixed in with C vulnerabilities (e.g. heap exploit).

That's it for the education side, now for the work side.

-----

My insight is, there are two types of companies:

- Tech companies (they don't care about things like OSCP)

- Traditional companies (they care a lot about things like OSCP)

The job ads that I saw for tech companies, or tech-related companies (e.g. Airbus [1]) were quite deep. Most of them require deep C/C++ skills with binary stuff and less on the web side.

The job ads that I saw for traditional companies were more web-based, had no clue about binary/low level stuff and terms like OSCP were mentioned quite often but not always.

My friend now works at a traditional company. He noticed a few things that the article doesn't touch (I skimmed it, I might be wrong).

- The level that he needs is at most medium hack the box level (technically)

- The level of social skills that he needs is quite high, because you're always telling some IT team that they didn't secure their shit properly

- The level of political skills that he needs is quite high as well, because not only do you deal with the IT team, you also deal with all the managers relevant to it

So yea, that's what I know. So the resources that this article gave were quite good for getting a job at a traditional company as a pentester, because it's more or less what my friend did. However, if you want to work at Google or something, I think another path is required that probably starts at VUSec.

FYI, VUSec is the systems security department at the Vrije Universiteit Amsterdam.

Btw, I'm for hire as a junior pentester or junior reverse engineer.
There actually is hard evidence of direct Russian manipulation and the Mueller report’s overall conclusion was that there was extensive manipulation:

“ The Mueller report found that the Russian government "interfered in the 2016 presidential election in sweeping and systematic fashion" and "violated U.S. criminal law". The report relayed two methods by which Russia attempted to influence the election. “

Mueller could not find hard evidence of Trump colluding although he had clear evidence of obstruction. This obstruction when also considering Trump’s very unusually obsequious deference to Putin, including them meeting multiple times with no other US official present, something completely unprecedented, is a lot of smoke.

On the other hand can you show a single shred of evidence backing a Qanon conspiracy?

On one side you have a series of conspiracy theories that have continually been disproven from a completely anonymous source, and on the other you have hard evidence from investigations and actual events that you can view online. You have to be pretty dense in my opinion to not see the difference.
Do they or linode have a managed database product?
Google provides a list of App Engine features they've removed. [1] Beyond that there is also a somewhat undocumented phase of working-but-forgotten. Classic App Engine features like the datastore, memcache, Users API, Python 2, Go 1.11 etc go under this category. These are things that still work, but get no updates. Instead you get constant e-mails and other notifications about how you should redesign your app to work with the 2nd generation App Engine system. Which means Firestore (in datastore mode) instead of datastore. Memorystore instead of memcache. Your own solution instead of the Users API etc.

--

[1] https://cloud.google.com/appengine/docs/deprecations
MBP SE/30
They are a investor in Bitcoin.

So they clearly do not get it
In every cloud provider I've used, filing a support ticket was done from within their web UI. And that meant logging in.

If Google bans your org for unknown/nebulous reasons, and you're not able to log in, can you get to those support channels?
Install Wine. ;-)
For those curious about the fire-resistant plants mentioned in the article, here is a list: http://firesafesdcounty.org/wp-content/uploads/2017/05/Compr...
Not to mention Antarctica is a whole continent that people do not live on
best kind of post. short, to the point, and true, backed with even shorter links.
China Wants to Be the World’s AI Superpower. Does It Have What It Takes?
Google Maps API is still not a comparable kind of business. And Google+ is completely irrelevant.

> I don't think AWS has every really screwed anyone.

The apples-to-apples comparison is not to AWS, but to Amazon. There are plenty of complaints against Amazon for ways they've screwed shoppers, book authors, publishers, etc.

If you want to compare Google Cloud to AWS, you won't have nearly as much to complain about.

It's perfectly reasonable to say you don't want to deal with or depend on Google because they've screwed you in the past. But the claim that there's a serious risk that GCP will suddenly be discontinued is just silly.
All these leaked screenshots, quotes, etc are almost certainly missing full context.
There innumerable (I do not say this lightly) cases where election procedures were compromised. This election is a standing act of illegal and fraudulent action by county-level and state-level election authorities.

This is not a debated aspect of the argument. Ask me, and I will show you just a slice of proof that would warrant a forensic audit (esp if the shoe were on the other foot).

Now, for Mr Friedman to call these great patriots numbering the tens of thousands that spent their own money to support the president in D.C. as, categorically, Nazis is ludicrous.

It's an injustice to these American patriots, and to those that actually suffered under the Third Reich.

This is a joke at this point if you refer to you grandpa who wears Trump shirts as a "Nazi". It's a pure joke.
Different threat models, but a raid is a raid.

Just like an arrest is an arrest, even though in the US it will necessarily involve firearms and in Ireland, it almost never will.
I suppose it depends on the details quite a lot.

But fundamentally, it isn't particularly harmful to just burn a user that starts spamming. If a compromised account is recovered, it's fine if they have to restore communication out of band, if it isn't recovered it's fine that it is burned.
I agree with this.

FWIW, IMO, the best form of proof is showing how hard you can pwn boxes :)
This is my observations for midwest area (not chicago)
I have no idea what out west is like. There is a HUGE lack of talent for application security, most security starts as network security, and then matures into application security. So if you are a competent developer and have security adj. experience in the appsec space, you likely will be able to do a better job and have an easier time than existing security professionals who specialized in network security.
I'd prefer it if folks on the right were more offended by the presence of nazis in their ranks, than by folks pointing out the existence of those nazis.
I think the "great filter" is evolution itself. Life formed almost immediately that the conditions allowed for it.

But it took over three billion years of relative stable conditions for it go go past the stage of single celled organisms and even the cell itself took a long time to form. Higher forms of life are only 500 million years old and the human line only started taking shape the last few million years.

Personally I think the universe is teaming with life but intelligent/sentient life is exceedingly rare.
What happened to good old accessibility?
If a blind person can't access content on a website using text browser then this site goes into the trash.
I imagine hunter-gatherers, whose life depended on their eyesight acuity, would be find it easier to spot than most modern humans do.
I've been doing software development for the past ~21 years and have been doing game dev for the past 6 of those, and I've experienced a lot of what the traditional software industry and game dev have to offer, from massive corporate FAANG or AAA behemoths to small startup like indies.

Like most industries there is bad and good, but the nightmare stories are the ones you tend hear about, there's not a lot of juicy material in "game dev studio provides satisfactory work environment". There are definitely exploitative horrible studios out there, but there are also plenty with satisfied workers.

Just my anecdata as a software dev who happily moved into game dev and has no regrets about the decision.
>There's another useful way to look at this mathematically and practically: survival time. If you cut costs to nearly zero, you can survive nearly infinitely.

Only if you don't enjoy doing things like eating food and living indoors.
I second Russ Cox's contributions to the stdlib. I recently went to check which version of Go the embedded API was added, and noticed a PR by Russ, I glanced through it and saw some really impressive and thoughtful code. I've made a point since to go back and look through more!
Congress and the Nixon administration trapped NASA in LEO. There was extensive planning inside NASA for applications of Saturn-Apollo technologies [0]. Two of the ambitious ones were a manned Venus flyby [1] and a permanent Lunar base [2]. After the Apollo I fire Congress lost its appetite for space and slashed NASA's budget [3]. The Nixon administration went all-in on the Space Shuttle which ate up all of NASA's manned spaceflight budget. Skylab and the Apollo-Soyuz Test Project were the only AAP projects to survive and only at the cost of Apollo missions 18-20.

The Saturn-Apollo program had a super-heavy lift rocket (Saturn V), a man-rated heavy lift rocket (Saturn IB), a Lunar trajectory capable command and service module, a lunar lander, and a workable wet workshop space station (Skylab).

Congress tossed all of that away. The Space Shuttle program wasn't a bad idea, a heavy lift vehicle that provided a shirt sleeve environment but could support EVA is actually an awesome thing for LEO. But Congress scrapping Saturn-Apollo trapped NASA in LEO because the Shuttle was only capable of LEO. It's not a platform that can support manned Moon missions let alone any more distant bodies.

[0] https://en.m.wikipedia.org/wiki/Apollo_Applications_Program

[1] https://en.m.wikipedia.org/wiki/Manned_Venus_flyby

[2] https://www.wired.com/2013/11/moonbase-apollo-1968/

[3] https://www.wired.com/2012/08/before-the-fire/
Why wouldn’t services just proxy their vendors cookies for them via another side channel? Then voila your third party cookie problem goes away.
He also wrote a book: https://www.packtpub.com/product/building-microservices-with...

The book might be good, but my copy had a problem with spurious characters in every code block, but that seems to be fixed in later printings.
Only for keyboards whose VID/PID combo it doesn't know and so can't associate a scancode mapping.
I often find that the HN comments are more helpful than the article itself. If I read a bit of an article and it doesn't get to the point quickly, I just close it and start reading the HN comments.
I have even installed Big Sur on mine and it runs fine. (Needs a patch though)
The internet was a much kinder trusting place back then. We assumed when the browser makers agreed to not use it for bad things, we believed them.
Governance?

What are the necessary features cloudsql doesn’t support?
Let us hope that there will also be normal, maybe smaller?, e-ink displays for PCs and that they will not only be used for eBook readers or similar. I for one would love to have a display that blends perfectly in with its surroundings and doesn’t stand out under any lighting conditions.
I've heard people argue that e-ink displays would be in much wider use if the patent-holding company weren't so protective of the technology. So the news I'm waiting to hear is when E-Ink the company decides to loosen up its business practices.
Would you mind sharing a link to the podcast? It sounds interesting!
I should be clear, I wouldn't say Matrix/Element "sucked", and I apologize if that's the tone that my comment implied. It's pretty cool, and I greatly preferred it over trying to finagle XMPP + OMEMO, and I will probably try it again soon enough.

In my case, my issues came down to mostly your last point:

> Verifying yourself when you log in on a new device has confusing UX, and there's a known bug that can stop keys being synced to the new login even once verified.

If I installed a desktop client on two different mac computers, I would have issues with messages not decrypting properly until I do a re-verification, and figuring that out took some Googling and trial-and-error.
WSL2 + X server was my go-to for a few weeks, but then a rather large repo I access, with git-lfs, became corrupted due to WSL2 + NTFS bugs. They've been mentioned on HN before.

Thereafter, every day or two the same bug would arise and I'd have to lose an hour or two recovering the repo. Just a week or so ago I switched back to WSL1, and I ssh into an RPi4 to access docker containers, using qemu and binfmt to execute x86 code slowly.

Yah, it sucks. ;)
I really enjoyed reading the upspin codebase. I thought it was really a clean design and clean code. Some of the early go team members were working on it including andrew gerrand and rob pike. I think its a bit of an experiment on how one might design a content sharing system if you were to start from the ground up and not on the current web standards. I particularly like how they work authentication and authorization into the model. I had a few experimental upspin services I wanted to write but never got around to.

Another great read for learning go that covers the more traditional challenges of standing up a basic web service with user accounts, testing, metrics, etc. is https://github.com/benbjohnson/wtf and the accompanying blog posts that cover how to structure such an application and why.
Humans are doomed to die at the Heat Death of the universe. Science tells us our universe had a definite beginning, the Big Bang, and that this event will not repeat: there will be no Big Crunch, no reboot. SciFi authors prefer to ignore science so they can imagine immortal humans who survive the cycle of infinitely rebooting universes. If we colonize the stars and galaxies we can postpone our death a few trillion trillion years, but eventually the last star will snuff out, the last black hole will evaporate, and there will be no energy left to power the phenomena of intelligence and consciousness, and life shall be no more. The last humans will have to bravely face certain and inevitable death just as our prehistoric ancestors did, and just as you and I must.
They have wrote such a list of values down but seemingly forgot such values as aesthetics (e.g. Sublime and VSCode look great, at least after you install a theme which suits your taste) and smart context-aware code completion and refactoring facilities (e.g. try IntelliJ once and you are hardly ever going back).
After 10+ years with Vim, and 5 on emacs before that I switched to vscode this year and have been pleasantly surprised.

I tried vscode in 2018 and it wasn’t there yet.

What I like better than vim:

Better integration with python.

Per-workspace interpreter and linter path settings.

Outline view.

Integrated terminal.

direnv and venv both work well.

JSON Schema integration. This is actually what sold it for me.

Edit: format
I have never clicked on an ad and bought something.
No, it's a pathological NASA problem. It does involve Congress and the public indirectly, since they're both terrible at statistics and mission failures have a huge impact on NASA's budget. Mission success has diminishing returns at about 80% chance of success so (as an example), NASA can spend $250 million on a mission with an 80% chance or $500 million for a 95% chance. The probability of two $250 million missions failing is 4% but the public only looks at the absolute number of failures instead of absolute number of successful missions or their cost so NASA decades ago learned to err on the side of extreme caution for self survival.

This style of risk management has trickled down across the entire agency, compounded by pork barreling, so now pretty much everything NASA does is done as a one off trying to optimize for least number of total failures at the expense of productivity.
That looks promising since the feature list basically covers what I try to do currently with powerpoint.
Eulora Bitcoin MMORPG hits $379M
Minigame is Eulora's producer, listed on MPEX as S.MG.
Interesting collection of stats, though I don't think the author's conclusions are the only possible interpretation. It's clear that the family size intentions really have been falling since the 60s, and that actual fertility is a fraction of that, which is unsurprising. The bigger sorry here, I think, is that the intended family size drops from 3.4 kids to 2.0. Possibly what's happening is that 'high producers' now make four kids instead of ten, bringing down the overall averages. Basically, it would be nice to see how the distributions of kids per woman change over the decades... I expect something at least bimodal, with a shrinking tail.

(Ed: fixed a couple stats, removed a bad statement about quotients. :P )
You have to understand the data at a structural level and how it flows through the application. Then you can identify entry points to access that data using non-traditional methods that the developers may not have considered when implementing security features.

That, or get lucky by clicking around a lot.
If you have multiple files then you can choose to omit the file name and git will let you decide on each hunk for each file.

You can also hit "s" to split a hunk to only commit a part of a hunk of if you want fine grained control you can hit "e" to edit just that hunk in your $EDITOR to only select a specific line or whatever you want.

Personally I tried fugitive and other git clients in the past and always come back to git add -p on the command line. It just feels the most natural and it also forces you to look at the hunks, so there's really no chance you'll accidentally forget to add something.

When using GUIs with sidebars showing what files changed, etc. it's easy to forget to add something because you skim it without really paying attention to what was changed.
Shouldn't a reporter know better than to just drop that number without saying anything about the cost of living in Poland?

So now I have to go look it up if I want to gain any actual information from this tweet. Then as I'm looking up what city their office is in, I realize the only reason I'm checking at all isn't because he told me CD Projekt is based in Poland, I just had a recollection they were based in a formerly-communist state.

So now I've been able to fully determine this Schreier guy is a scumbag faster that I can determine just how scummy $400/mo or $700/mo is.

Spoilers: Warsaw and https://www.numbeo.com/cost-of-living/in/Warsaw?displayCurre...
has only gotten more relevant
Humans have deposited a lot of iron and other useful elements on the surface for the next civilization to start with though.