skysight-inc/HackerNews huggingface dataset:
> 2FA = something you know + something you own.

That's not exactly correct. Another factor is something you are, such as a fingerprint or eye. There are three classes of factors from which drawing any two is called 2FA.

There is also a 1.5 factor auth, used for example by many banks, in which there is a server challenge for the very vulnerability stated in the article.
You’re right, I was thinking of even neighborhood bars. Along those lines, is it not the case that Twitter, FB and all other social-media sites could institute user vetting and behave more like a club? Some services are invite-only already. Obviously changes the business model, just pointing out the perfect legality.
Source? As I recall, Edmund stated he just didn't think of it in the heat (actually: cold) of the moment. They were only on the summit for a few minutes.

I'd be very surprised if a man of Tenzing's calibre and achievements could not figure out something so trivial.

Edit: I've found some citations that support your point, I apologize.

Although, I'd add (a) Tenzing's account states that he offered to take a photo but was declined. And (b) a more fair description would be "because he had never used a camera before" rather than "didn't know how to work a camera".

The later suggesting a lack of intelligence or civility (though I'm sure that wasn't your intent), I'm probably just nitpicking :-).
Tell that to folks building on the paid maps API's.

I don't think AWS has every really screwed anyone. My simpleDB kept running long after I even remembered it used simpledb! I can't even remember a price increase, much less a 10X gotcha one with no grandfathering! Ouch!

Google will kill your account, change pricing etc much more commonly than AWS. The nightmare of google+ and being forced to jam a profile onto everything - they give two sh** about user stability / happiness on some things if the command comes down to blow the house up which it seems to periodically.
Why don't airliners have AFTS, then?
I have the newest XPS. It's a 15" laptop, it's huge. And yet, they've gone and put Home and End under F11 and F12. Meanwhile, Printscreen is under F10, which no one needs, and NOTHING is under F9. Also, F5 is covered with the brightness key! I can either refresh or have brightness, while F9, which is used nowhere, is blank.

There used to be such a nice last column along the rightmost edge of the keyboard with Home, Page Up, Page Down and End. Bring them back! It's stupid design to have.

The other thing, which I take is the same for the macbook, is that the trackpad is so huge that the edge of the keyboard digs into the forearms, causing pain for any reasonable length of use.
Right? Effectively these graphs do not communicate anything other than the numbers of comments on big tech companies over time.
So unprofessional.
Sure, there are definitely cases where you can be frugal on unit costs. I think your examples are not very good ones, though.

The cost of a kubernetes cluster while working on an MVP is not a unit cost. It's a development cost. If they don't even have the MVP yet, then I don't think it's fair to say they're going to pay a multiple of that kubernetes cost for every sale - I could be wrong of course, the details matter.

Your second example to me seems more clearly totally fine. Those costs scale with the number of employees, not with the number of sales. If their sales scale linearly with their number of employees, they are totally screwed under the VC funding model. As somebody upthread said, frugality is important for traditional businesses, but not so much for software-y startups.

$150/month is peanuts for their runway almost certainly, too. Think about it this way: even at a meager $50k/employee/year, their costs are 99.3% in the employees, and 0.7% in those software products. Or think of it this way - $10k will cover the $150/month for over 5 years, which is a really long time.
> How many IPOs in the past 10 years have come from turning old doors into desks instead of going to Costco?

I know Bezos' perspective was that the door desks were a way of creating the culture he wanted in the company both for employees and for investors. A desk from Costco would probably cost $400 to $2000 whereas the cost of what you need for the materials for a door desk from Homedepot is $50 to $75. Having put together some furniture from Costco, I'd guess that the time spent creating a door desk is probably less than the setup time for a Costco desk. Folding tables might be another option in the same price point / setup time as the door desk.
wow thank you, i don't know how i never knew the term for this. it's gotten frustrating explaining so often, as it happens too often. as my old econometrics professor would say, "knowing a little bit about statistics is a very bad thing"
> Moxie, why haven’t you put Signal on F-Droid yet?

There's no security benefit in having Signal on F-Droid instead of using https://signal.org/android/apk/.

I don't think Signal would say much if F-Droid distributed this APK directly (instead of a recompiled version with a different signature). It's just complicated to set up, which is why (I think) nobody has done it.

> But we have to trust that Moxie is running the server software he says he is.

I don't understand what you're suggesting instead. There's no practical solution to this problem.

> Signal doesn’t have a warrant canary

Warrant canaries are legally untested.

> Truly secure systems don’t require trust.

Can you give an example of a truly secure system? What's your threat model?
Don't do any of these certifications. Yikes.
Ye quite worthless graphs without explaination. Also the sentiment and the amount of comments should just be two lines not colorcoded bars. xyy-plot.

How do you even measure sentiment? The amount of curse words?
So you're asserting that the only reason developers would keep developing for the Apple App Store is if they have no other choice? Security guarantees are a sales-pitch, hard to get numbers on that but I bet I'm not the only one that avoids installing random proprietary apps out of fear for privacy violations. The recent move to showing "privacy promises" on the App store pages is an indication of that. If alternative stores can't give sufficient security guarantees, then users will prefer the official one.

Android is doing well with its multiple app-stores, security-conscious users can limit themselves to F-droid, and the rest can keep using the PlayStore for proprietary apps. Granted Android still lacks an independent option for paid apps, but I think it will come.
GCP's potential for product abandonment and their terrible customer support are their primary weaknesses. And then there's the issues well-described in [1].

[1] https://medium.com/@steve.yegge/dear-google-cloud-your-depre...
Tell to the folks paying for the Maps API who built businesses around it.

What a scam. Has amazon EVER raised the price of an AWS service?
You don’t think that in the midst of a terrorist attack in which multiple perpetrators bear Nazi symbols, people in the area should be at least slightly more worried about Nazis than usual?
Photographer creates video narrative to low key advertise that he sells lithopanes of his work.

Lithopanes are a technique someone developed years ago for printing a photograph on an FDM 3D Printer. They work by varying the thickness of the print to control the amount of light that passes through. The result is a monochrome image you can see when held up to light and feel with your fingers.

In the video the gentleman, who seems to be a photographer specializing in very early photographic techniques, shares a story of how he got a 3d printer during the pandemic and created some lithopanes of his work. He low key mentions you can buy them.

If you're interested in lithopanes this video is at best a definition of the technique and demonstration of results.
Lol at CEH. Nice joke there.
Trouble in Paradise: Fibonacci
Don't discuss politics at work. It's unprofessional.
This is not my diet, it is the diet I commonly observe from those going simply lo-carb or attempting "keto": hi-protein, rather than hi-fat. This directly questions the unvalidated assertion that, "People don't eat a low carb diet by accident, when they do they often follow the horrible advice given by the many misguided keto diet proponents: eat low carb, high fat, medium protein."

Hi-protein is glucogenic and thus not ketogenic, so the ratio would seem to matter. So would the resolution between an avocado and a fistful of bacon, given the safe assumption that the materials and cooking of them rate to have different impacts on human health.

This is backed by other meta-analyses such as https://www.thelancet.com/journals/lanpub/article/PIIS2468-2... :

> Both high and low percentages of carbohydrate diets were associated with increased mortality, with minimal risk observed at 50–55% carbohydrate intake. Low carbohydrate dietary patterns favouring animal-derived protein and fat sources, from sources such as lamb, beef, pork, and chicken, were associated with higher mortality, whereas those that favoured plant-derived protein and fat intake, from sources such as vegetables, nuts, peanut butter, and whole-grain breads, were associated with lower mortality, suggesting that the source of food notably modifies the association between carbohydrate intake and mortality.

Stressing that both hi carb (contra your claim) and lo carb when specifically overindexed on animal protein had higher mortality, not just lo carb.
> Also, Flutter will most likely be discontinued in 2 years.

any source on this?
Remove the Google Blacklist Warning from Your Website – Easy Guide
Except that the comments weren't in the context of any product initiative or related to company business at all.

I'm sure Christians or other religious sects feel that it's essential that they proselytize their gospel to you, but I don't think you'd be very happy if you were getting bombarded with messages about it at work.

There's really no reason the kinds of conversations linked above should be happening with frequency in a company chat room. If you want to be an activist, great. Do it after hours.
> Maybe we have the great filter in front of us in plain view and we can't recognize it.

One candidate, if we take ourselves as the primary example, is biogeochemical crisis following rapid discovery and exploitation of environmental resources or energy reserves without sufficient consideration of the consequences
Let's say I've got 2FA enabled. I get a confirmation link to my e-mail. I click the link. Because the e-mail is sent by the real site, the link leads to the non-phishing site. The scammer has my password, but is still unable to access the site. How does that not help?

Of course if it's a 6-digit code or something, then they are able to stole my it like they did with the password.
Thank you for sharing. Also Murugan comes from the Pleiades, thus his name Kartikeya
A LOT of shops require OSCP to even get an interview. I know for a large number of them that OSCP is indeed a hard no go if you do not have it.

Unless your plan is to go it your own, and either start your own business or go black hat, OSCP is indeed good advice.
run your own instance of Bitwarden.. there's a nice dockerized server available written in Rust
Similar pet theory, but that other hominids are remembered as dwarves, elves, and trolls.
> I switched from Linux to Windows

This is where many people leave Emacs. It's not that there's better tools on Windows, it's that Emacs on windows is terrible.

Magit is orders of magnitude slower, for instance, and external tool integration is grossly impeded by the poor availability and quality of package management on Windows.

Maintaining Emacs on windows takes considerable effort.

Personally, I make do with WSL1 and Emacs. WSL2 is intolerably broken when working on NTFS folders, so it's a nonstarter. This means Docker is broken (mounts don't work) but Emacs works well.

Yah, it sucks.
> Users value their convenience, and security and privacy are inconvenient.

True. A messenger will be widely adopted if it offers features that WhatsApp et al. don't have. And by that I don't mean security or privacy, but something that people actually care about, like the stickers in telegram for example. And then that messenger just needs to be secure without interfering with functionality, convenience or UX ... problem solved.
Just curious, why do you say that? I'm no expert in this field, but I thought the OSCP cert was viewed as being a valuable entry level cert in the field?
> how it even does reenforce that idea.

It reinforces “Christ as the son of God” because, if the phrase is translated as “sons of God”, that sets a precedent in the Old Testament that God has sons. The Jews do not believe God has sons. Christians do. So it is in the best interest of Christian translators to translate that phrase as “sons of God”.

> but the claim that the translation "sons of god" is specifically wrong only seems to be based on the declaration of a single earlier source.

No, I only provided one source (Chabad), but there are many others, including all Jewish translations of the Old Testament (Torah) from the original Hebrew to English. You’ll never see it translated as “sons of God” in a book translated by Jews.
Interesting comment, definitely want to hear more. I have concerns about Beam/Dataflow, but they seem different to yours.

The dataflow product seems to run older versions of Apache Beam just fine, so minor deprecations don’t seem like an issue in practice, but maybe I’m mistaken.

“No visible contributions to Apache BEAM itself”. I don’t think this is true, I’m a contributor and somewhat active on the developer mailing list, it seems the majority of the contributions these days come from google employees.

If the questionnaire you’re referring to was the paid Apache Beam survey, I participated and definitely didn’t get the impression that they were considering deprecating the service. It was much more focused on how they can improve docs, examples, and help developers use it.

Now, I think the project is too ambitious even for google. They don’t need to support Spark/Dataflow/Flink on three different languages (java/python/go) imo. I’m also frustrated with some of the bugs that slip through.

The fact that there is no back pressure support for a streaming framework is such a google thing to do: why worry about back pressure if you can just tell another team to increase their throughput for downstream sinks? /s

Dataflow does seem to be one of GCP’s most popular services (spotify and twitter are both users now) so I would guess it is here to stay in some form.
Tons, this technique has been around for quite sometime and the process is pretty mature.
A symptom of not having national ID infrastructure and falling back to credit reporting agencies for suboptimal identity proofing.

The IRS also does this sort of identity proofing to prevent fraudulent return filings, as do some financial services providers and healthcare systems.

Login.gov would be a great fit for this, with identification verification performed by local trust anchors (usps branches, banks, social security offices, dmvs) acting as notaries.
Trying to reconcile "extremely high price" with "we want to paint buildings with this stuff". Clue?
We don't have to resort to technicalities. This attack was a reactionary populist movement, led by white supremacist groups (eg the poor boys). It is a stretch to label the whole thing "Nazi", but only slightly.

Republicans are currently faced with a choice - conservatism xor this new reactionary populism. If you're an actual conservative and don't appreciate your own voice being pigeonholed with the neo-Naziism, then work to cut the cancer out of your party.
I'm not so sure. It really hasn't been that long in a generational sense that the internet has been around. Society may still be in the honeymoon phase of it's relationship with the internet. If building network services was like building houses, we may not be anywhere near drywall.

Who is the "we" who can't do better, just technologists? Or humanity as a whole? Is it all just a demand side problem, and the people chose centralization, or was centralization a matter of policy for some group of sufficient influence? Is it just a byproduct of unfettered capitalism? A conspiracy to make the internet less 'libre' by a powerful special interest looking to profit (or a three letter agency looking to snoop) isn't outside the realm of possibility, is it?

Anyway, I guess my point is that there are a lot of different factors that got us to this moment, and as people say, change is the only constant. I don't think anyone should give up on their ideas for the future, even if they've been tried without success before in some form.
I'm a long time Emacs user and just recently I have been learning and using neovim a lot. This is the most jarring difference between Emacs and other editors. The second biggest issue is Lua instead of Emacs Lisp. s-expressions work so well in the editor extension context. Steve Yegge wrote a really nice million word essay on this topic.
Replace 'frugality' with 'capital efficiency', 'cost-benefit analysis' in your search and you'll find positive articles from big names often claiming they're underrated or even only thing that matters.

Startup ecosystem just likes to create their own terminologies for things which we know is good for business and done all long.
And we won't even give the name of the person who's taking personal responsibility, we'll just quietly scrub her name from the "leadership" page. Some anonymous person is taking personal responsibility and keeping her name out of the news so she can get a CHRO job somewhere else.

https://github.com/about/leadership

http://web.archive.org/web/20210101021219/https://github.com...
In VSCode, you can selectively stage lines in files too, just select them in the diff, right-click, "stage selected" - I love being able to do that so easily within such a nice UI.
Study: No evidence of transmission of Covid from children to adults in school [pdf]
Very expensive buildings? Relatively dilute paint? Agreed, it does seem like a disconnect.
From the intro:

Haskell is a lazy language, which has its consequences. In this post I'll demonstrate just how easy it is to shoot yourself in the foot with laziness using the classic example of computing Fibonacci numbers, which very ironically virtually all relevant Haskell documentation gets wrong, given that it's the primary use case for Haskell.
Intel has to be better than lifestyle company Apple at making chips says new CEO
I think you mean something like Do-not-track header [0] , which is not respected at 99% of the web and enabling it makes you even more traceable.

My solution is using Cookie auto delete [1] which deletes cookies after a set time and I don't care about cookies [2] which removes the annoying banners and popups.

[0] https://www.eff.org/issues/do-not-track

[1] https://github.com/Cookie-AutoDelete/Cookie-AutoDelete

[2] https://www.i-dont-care-about-cookies.eu/
"as an oil-like enabler of dapps, rather than as a gold-like scarce collateral" is an economic statement (!)
LispNYC: “A Lisp Flavored Erlang”
My thoughts exactly. I don’t want to sacrifice my own convenience for the sake of a company, which by the way, doesn’t even bother including a freaking adapter in their other product, the iphone.
I've read a few of her articles recently and been very impressed. I understand a default stance of skepticism but the writing speaks for itself. I would be curious for your criticisms on this "petrodollar" article, for instance: https://www.lynalden.com/fraying-petrodollar-system/
I’m starting to see Bitcoin and ETH/ other alt coins a kind of mutually dependent relationship. Bitcoin succeeding as a store of value allows that narrative to continue, drawing in institutional investment while other faster projects allow the narrative about changing all monetary transactions to continue. I don’t think maximalists on either side would like the price if the other side failed.
I don't know why people think Apple even has a good UI. Because it all looks the same? None of it makes any sense if you have any experience other than Mac/iOS.

Let us never forget that we are holding it wrong.
GitHub’s head of HR resigns in light of termination of Jewish employee
I think password managers are the first step you should take and FIDO/U2F hardware keys are the second similar important step.

With that even if your password manager get hacked you still have a secure account as they didn't got the U2F at the same time a password manager is a must have as it's prevents a lot of phishing attacks from even getting any chance and is quite convenient, too.

The problem with hardware keys is that for many people they are not so easy:

- You MUST generate and safely store recovery keys, storing them in your password manager is suboptimal, but better then not having them. (Not having them means potentially losing account access permanently.)

- You often need to enable it.

- You should store it with your keys, which dependent on habit might not be around your PC (in my case they always are in my pocket so :=) ).

- If your site doesn't support U2F/FIDO you might need an additional phone + app, or laptop app to get the numbers out of your key.

So while I think it's a must have for every developer to have a hardware security token lie a Yubikey it's not something I could convince e.g. my Dad or Sisters to use.
https://news.ycombinator.com/item?id=25812655
> Hashicorps' projects are more or less gorgeous

Is there a particular piece of code (as in, a single package/file/function) that jumps out to you as "gorgeous?" When I look at a random Hashicorp repo, it strikes me an impenetrable labyrinth.
MBP SE
Ask HN: What do you answer to “Why do you want to work here?” questions
Sometimes, you can really like a company for a variety of things: culture, product, not to mention pay.

But most of the time, when you are actively job hunting, chances are that you haven't heard of the company you are applying to. I don't think that most engineers are attached to a particular profile (maybe that changes at senior levels?). In those cases, what do you answer? And how do you come up with that answer? I am not talking about generic silicon valley answers like "making the world a better place", but actual targeted answers.
A while back before AWS was so popular their support at lowest tier developer accounts was totally ridiculous. I'd messed something up, out of their scope to fix (they could have just said nothing wrong with X). Instead some AWS engineer with my permission jumped in and got application side to fix things up and walk me through the configs etc.

What!! So I paid $50 for one month for support, and got a full on support expert who'd bill (at least in my world) $250+/hr. Honestly, the support cost was maybe even LOWER, and I'd just signed up for support to submit my ticket.

Google does not care. You GSuite calendar is not accessible on google home devices etc etc despite TONS of requests from paying customers. That same calendar integrates easily with ALEXA from amazon. Huh? Someone is paying attention, and it's not google.

I do like project based permission / approach in GCP. I like a lot of other things there too. But I've had stuff running for years on AWS without issue - so the trust with AWS keeping things going mostly is there.
How was "Editing efficiency" measured. I use emacs and seem to be able to make changes in fewer keystrokes and time than any other editor.
So we’ve been there 20 years. How many more decades before we realize it’s a problem we can’t solve?
> web is amazingly better now that Flash has been relegated to its best use: historical animations and games

Is it though? All I see is millions of bloated websites that all look the same thanks to lack of Flash, and not much success with html5 to really replace Flash.