skysight-inc/HackerNews huggingface dataset:
> Only CAs which offer organization-verified (OV) or extended-verified (EV) certificate, typically at exhorbitant prices, does the TLS certificate attest the publisher of the website.

Even so, I’ll expect financial institutions to have that.

Note: I’m not saying the above is a Cloudflare issue, perhaps someone at Visa was being stingy - I’m just saying it’s an issue and would be bad if that becomes the mainstream.
The noun you're looking for is "hypothesis," and that's if we're being charitable.
If it’s a website which supports API key or any token of sorts (without expiry or long expiry), they could do some real damage even if they can’t use the 2FA again. Another thing would be to disable 2FA.

All they have to do to achieve this is to use the phished credentials to immediately login with the original site, trigger 2FA and then show a field to capture it and pass along. Then capture all the cookies.

The best defense against phishing is to use a password manager that does domain matching.
The idea is that the screen lock should directly call the kernel accessibility API, and not start other processes at all.
They are very different kinds of failure though... This was not an exploratory "try something new" test. This was an integration test to verify that all the "on paper" work was correct. The whole point of SLS is that its use of technology with extensive "flight heritage" is supposed to avoid having to break new ground.

This is like discovering a major issue during the shakedown cruise of a new ship. It's better to find the issue now, and that's why they test, but the point of this test wasn't to learn anything new, it was supposed to just prove that it works as expected.

SpaceX is generally very up front about tests that they think have a high likelihood of failure, and the tests that do fail tend to be doing genuinely "new things" (like belly-flopping a booster).

I'm not a SpaceX fanboy here (I think Elon in particular is pretty insufferable), but it's not really to fair to compare SpaceX's development testing failures with this integration test failure.
I thought this said "lichen" and it was some sort sort of crazy fungi network for a second, like the slime mold and the light experiment. Oh well...
I've always loved knots and have learned a few cool ones throughout my life, some useful, some just cool. But I've always wanted to learn the discipline more holistically. I wanna "get" knots and be able to think in knots.

What kind of cool uses have you found for your new knot skills?

Any recommendations for learning how to "get" knots other than just looking at knots in books?
> It is very rare for a PC laptop power cable to break.

The failure was usually the plug breaking loose from the board. (Both on PC laptops and old Powerbooks with the barrel plug.)
> Other than storage, no peripherals care about USB 4.

Video??? The comparison was with HDMI.

Also thanks for missing my main point about USB C...
Recovering sudden upsets in IMC is VERY different than doing it in VMC. Doubly so if you're not sure which of your instruments you can trust.
In my opinion / experience there are two areas of frugality that are important to focus on for the types of high-growth venture-backed companies that are common topics on HN.

1. Having a non-wasteful, nonindulgent culture. I've heard culture described as "a set of rules for what you will tolerate" and you don't want to tolerate waste. If you're trying to grow fast you typically need to spend money to make money, but it's important that a culture of low-consequence spending doesn't turn into a world where you're throwing money at anything under the sun just because you have a lot of $ in the bank.

2. Having a handle on your gross and operating margins. It's really hard to dig yourself out of a whole of low/negative/declining margins, as they are often indicative of structural assumptions that get built into your business model.
How many websites allow U2F as the only 2FA? Every website I tied it wanted a backup authentication app added.
When I was a kid, I wanted to be a game developer. I am happy I didn't go down that route, all I hear from the industry are nightmare stories.
Frugality is underrated in businesses.

That said, not wasting too much time to save a few bucks is also underrated.
We can also do better than using insults against a service which isn't perfect - and maybe won't be if it continues its course - but is doing a good thing for the right reasons.
It’s not ethical to post the persons name, and potentially even illegal.
There were people with using nazi symbols in the protest. People wearing nazi symbols are historically violent to certain groups of people. That's enough reason to alert people in the vicinity about it.

At my work's Slack I get snow alerts, heat wave alerts, lockdown alerts. All those can be politicised depending on the audience, but are still highly appropriate to be had on a company's Slack channel.
Show HN: Auto-updating personal README via GitHub Actions
> "Cyber Security is one of the most expensive fields, You are required to do a number of exams and certification. Unlike Software Development, These certifications are very crucial, They are more or less like a "Get out of jail free" Card."

This is terrible advice. You don't need lots of BS certs to get into security.

The only cert here worth doing is OSCP, and even that has lost respect/value in recent years to rampant cheating and answer sharing.
>>> The top result on Google is invariably an advert for a scam site.

Wait what now?
That employee is taking the position that "there are" is equal to "all those people are", the same flawed logic is being used as a premise by a lot of commenters here.

It's so blatently wrong that it's hard to assume good faith.
Our service has depended on GCP/AppEngine for the last 8+ years. Our business depends on it and Google has proven to be reliable partner. We pay ~400/month for a support package and have always been able to get someone on the phone.

The only time we've ever really needed it was when one of our customer's (satellite) IPs was once flagged incorrectly as originating from Cuba and blocked because of sanctions. We reached an engineer via phone support and they were able to get the Google team responsible for their Geo IP database to correct the entry.

We've also had support engineers based locally call us to check in periodically, and I doubt we are in the top 10% of their customers by spend.

Definitely would recommend GCP without reservation.
It's a good thing Nat took the time to tell us that GitHub condemns the attack on the US Capitol. We might not know otherwise.

I mean seriously, why do corporations feel the need to say this nonsense? Are we really at the point where a corporation needs to waste time to tell us "hey y'all, in case you weren't sure, we don't actually support an armed insurrection attempting to stop the democratic transfer of power, and lynch a sitting Vice President."
Here's a screen recording of me trying to log in to app.element.io [0].

0:10 - Stuck on "Verify this login" despite cancelling

1:00 - Same as above. The security phrase I have saved seems to be invalid.

1:38 - Can't drag or expand the left panel. Went away when I made the window wider after I stopped recording.

1:52 - After clicking "Verify" again, the session immediately verifies? I didn't enter any passphrase or do anything in my other logged in sessions.

2:18 - Every time I log in I get a notification about trusting a bunch of old sessions. There doesn't seem to be a way to get rid of them.

This is on a non-private Firefox (68, Debian) session, so maybe the security key is saved somewhere and didn't get loaded the first 2 times I tried to verify?

Also, not necessarily a bug, but to verify by phone I should just get a notification and not have to do 'Settings > Security & Privacy > Show All Sessions > [Guess one of several identical unverified Element Web sessions] > Verify.

[0]: http://files.widloski.com/matrixbug.webm

Mirror: https://youtu.be/QIRHAusQyYI
I find them incredibly ergonomic, another bonus is that it provides the same defaults found in most terminal emulators. Most people try to use pinky for Ctrl, or map to Capslock, but using the side of your palm for Ctrl is really comfortable. I generally run circles around colleagues in a terminal or working with text, especially when utilizing macros, but the learning curve is definitely steeper and took some time to get used to.
So I listened to a podcast about this... but SpaceX and Boeing/NASA are explicitly taking two different approaches to proving their rocket will work. Obviously we know SpaceX is proving their rocket through system level tests. But for SLS the plan has been to use a long accepted NASA approved method of proving their design where individual parts are so thoroughly tested and proven to work that they don’t need many flight tests of the full system. In fact I believe the original plan was one flight test without humans and then have the second flight be a manned mission! So they really aren’t supposed to fail like this.

So at the core are two different approaches to proving their system, where SpaceX totally expects some failures and SLS is supposed to be proven before it even flies. Personally I’m a fan of the SpaceX method but I can understand why the old guard space developers would choose this slower more cautious method.
Contextual ads don’t need cookies. The sooner publishers realize that, the better for them.
god I miss matte screens, I really need to find a matte screen cover for my current MBP
Yeah it's funny - sometimes it takes someone reacting/challenging me to pause me so I can figure out how to articulate it in a way that makes my intention and logic more clear.
There’s another way to look at it too: a waste of time. If what you enjoy is lowering costs for the sake of it, living an extremely minimalists lifestyle, and focusing all your energy on finding ways to avoiding spending money then good for you. But for the rest of people? Probably a waste of time. And most individuals will never accrue the level of wealth necessary to live a FIRE life. After all, you can’t actually reduce your costs to anywhere close to $0 in the US. Healthcare, food, shelter, and more can cost a lot. God forbid you want to live a somewhat normal life and have children who grow up with some normality.
Try Magit. You’ll know whether it works for you. It clearly does for many people.

Or fugitive in Vim.

The difference is like that between using Ed and Vi. Seeing things as you do them is valuable.
I think that the GitHub repos are a copy of their internal VCS that aren't necessarily updated frequently.
This was corporate myth-making. They did it to drive home the point that Amazon was a scrappy place. Obviously it wasn't a logical decision from a pure cost basis. But from a story-telling perspective it was a heckin' home run.
All over social media (https://twitter.com/jlazaroff) and on this very website, you rail against white people, you rail against white people having too much wealth, you rail against white people having too much power, and you rail against white people having too much speech.

Yet consistently, you become furious whenever anyone makes a similar assertion about Jewish people.

Why should non-Jewish people continue to tolerate your tribal behavior? You're basically a walking, talking Nazi caricature of a subversive Jew. You can do better.
Backdoor for law enforcement?
"Weight" is a poor control. BMI is a better one. Going back over the study, it looks like the controls are listed in table 2. 12/17 appear to adjust for BMI, with the following note from the authors regarding the resolution: "We were unable to perform a subgroup analysis according to the body-mass index because the mean values were not stated or estimable in the majority of the reports." (emphasis mine) This certainly doesn't throw out the results for me, but I still find myself asking the same question. But moreso the protein vs fat ratio question, as in my reply to the subthread above. With only three macronutrients in play, I can't fathom throwing two of them together.
Legal mechanisms for one way doors seem possible. The offensive agency can communicate info about 0 days to the defensive one, but not the other way around.
I'm wondering something similar, where maybe GMs could train against a neural network that is built off of their upcoming opponent's historical games and thus they would get more experience against that 'opponent'. Instead of having to actually have played against the opponent themselves to learn weaknesses.
Very excited. I got an Intel MBP in 2020, but these models have enough that I am willing to switch. The question is who will buy my maxed out Intel laptop when the M1 is faster and costs less? XD

Also wondering if this new version will have M1X or M2, just a M1 that supports more RAM or an M2 with updated architecture?
I learned a lot from reading the Perkeep [1] codebase (formerly Calimstore). One of its core developers is Brad Fitzpatrick (former Golang team member) so you can be fairly confident it’s idiomatic Go.

[1] https://github.com/perkeep/perkeep
Everyone in adtech, except perhaps Google, is worried. One non-Google player I know is seriously concerned about what the cookie-less web means or online ads. Essentially the entire online advertising industry, both publishers and advertisers, is built on 3rd-party cookies.

The goal: to show you only ads for things you care about and are likely to buy and be influenced by advertising for, is good. But the reality is a mess.

Some of the downsides of Google's proposal are obvious, given its position, but there's at least one downside that users might notice: lots more ads targeted only by the demographic of the publication, making the web look more like print media or TV and presenting you and me with a lot more space on our screens wasted showing ads for things you don't care about.

As for the "fingerprinting" proposals? Bad. Very Bad. Think digital "facial" recognition bad.
> and there does appear to be a much lower salary cap for developers than security engineers.

Shit this is what’s kept me from leaving software. If that’s true, maybe I should try security, I’ve done some security adjacent stuff, but mostly implementing software for compliance purposes.
I love that all the replies are just competing appeals to Authority

"My Experts™ are more Experts™ than your Experts™"

Not a single person in this thread as actually made any factual statements or presented any actual evidence of either sides correctness or validity.

It simply "She has these degree;s so we should listens" vs "The WHO Says...."

It would be amusing if it was not so sad...
It's against the rules to call it out on HN, but given how incredible Matrix is, I will happily risk being banned to share that I believe there is an astroturfing campaign currently being undertaken to promote Signal and that you should take the complaints with a grain of salt. Matrix and other competition are being cast with FUD in an attempt to sway fence sitters.

Thank you for Matrix and Element. My non-technical friends and family all use it without issue.
There is one in Element Android. When the phone is shaken, a dialogue pops up "It seems you're shaking your phone in frustration, file a bug report". It has in-app bug reporting.
The most significant value of Jetbrain IDEs is that all programming languages have good support. I switched between Java, Python, JS, Typescript, C, Golang, and so on regularly. For example, Java and Kotlin support are miles better than all other IDEs.
Curiously, the ability to alter biomes at a planetary scale is also one of the prerequisites for colonization. The trick then is having sufficient control of industrial processes to 'get it right,' which requires better global decision making than humans have thus far demonstrated.

(The alternative is extreme plasticity, allowing lifeforms to adapt to otherwise hostile atmospheres...)
Certifications are far less important than this article makes out - this roadmap seems to really just be a roadmap of certifications for some reason, rather than a true roadmap for a beginner. If you focus on certificates, you won't gain the rounded knowledge you'll need.

You don't need certifications at all to do well in the sector - people are still judged on their merits (and previous gigs), as there's a broad recognition, by those who are any good at least, that certifications are very prescriptive and don't signal quality. I have none, nobody has ever asked about them.

The recent scandal around some large security companies sharing cheat-sheets and answers to certification exams [0] shows one reason people don't trust certifications.

Some "customers" will want certifications, generally those that have no clue about cyber security, and who therefore have no clue what they want. You might find it hard to break into those kinds of roles in the first instance without some kind of certification, however once you've got some experience and track record, you tend to find they go away.

[0] https://www.theregister.com/2020/08/14/crest_investigates_nc...
Why is XMPP not mentioned as an alternative? it's decentralized, fully open source and supports end to end encryption.
Agreed. I wouldn’t touch any post-2015 MBP, but I wish I had bought one with dedicated graphics card. With each new version of macOS, things have gotten so much slower and laggy, even though I have disabled almost every unnecessary process and app in the OS.

The other day, I was working with a 2011 MBP with graphics crad and Chrome was much faster in that compared to my 2015 MBP. I think the graphics card does improve web surfing quite a bit.
The thing I keep seeing people miss is the narrow slice of time that we have existed in a technological state to be broadcasting and/or looking. Assuming exponential distribution, this is most likely to only last further as long as it has already. And with us as the only example, it would most likely be the same for others. So 50 years out of 5 billion on the planet and 3 billion since life began. Are there 100M stars within radio range? Do we even have time to point antennas at each one long enough to get a signal? That’s about 15 seconds each. How many bands do we need to scan in that time?

Any hope of contact or expansion requires an extremely long period of sustainable existence in a state of constant technological development. Most of modern humanism is antithetical to this. The entire world today seems focused on expanding consumption. This is especially true of both colonialism and immigration. Economist today judge an economy by its internal consumption rather than older notions like export productivity. Seems like we’re going to have to reconsider policies and priorities if we want to make it out of here.
> Not if it also steals the 2nd factor.

In Webauthn/u2f the 2nd factor is a proof that is unique against the particular site. So stealing the 2nd factor is significantly more difficult since it requires compromise of the computer/endpoint used to access the site to pass the wrong site to the hardware token, or cloning the physical device which should be tamper resistant (but not totally unheard of to clone some devices).

Your statement is true for HOTP/TOTP based 2nd factor like google authenticator on a phone, although the stolen credentials shouldn't provide persistent access.

And password re-use is still a problem if every service isn't covered by Fido2, but we need to start somewhere.
For display and editing purposes, yes. However, from what I understand, the LSP, linters, and auxiliary tools all run on remote.
That assumes the incentives and policies do not shift. Is that a good assumption? I hear very antinuclear sentiments all the time.
Yeah totally sounds like with Steve gone, there was nobody anchoring him to the ground.
How the MP3, Pirates and Apple Changed the Music Industry
It's perfectly reasonable to believe in freedom of speech in the public forum but a set of rules and decorum at the workplace.

The two should be separate. When people really complain is when someone faces consequences for their public speech at their workplace. But we're still humans and we still care about who we associate with.
I might be mistaken but I think someone wrote here a few days ago that they noticed the Server being updated but that the github repo doesn't reflect those changes.
Sure, I don't think there's necessarily a single filter, or that this is it. Just that it's a candidate. Your examples would presumably be much more common.
In today's radicalized political climate labels like racist, fascist, and terrorist get flung around so carelessly that they have lost their meaning and power. People simply refuse to take you seriously once they recognize how improperly these terms are applied and as such are effectively being redefined.

The fact that such an extreme proposition (someone being a fascist) is even entertained and on such flimsy grounds is troubling. Glenn Greenwald is a progressive and a critic of Trump, yet he's suspected of being a fascist? It seems like these terms are used as ad hominems to defame character, rather than arguing based on the merits, because the mainstream left can't stand honest criticism from their own side of the political spectrum.

It seems all it takes to raise suspicion of being a fascist is saying some favourable things about Trump or some things that benefit Trump politically. The problem with that is that everyone that's honest is gonna have to say favourable things about Trump some of the time, cuz he's simply not that bad. Trump is just a 90's democrat with a New York attitude that somehow managed to get elected as a republican president, yet here we are talking about him and half the country as if Hitler and his movement have been reincarnated.

About the january 6th thing. I've personally heard Trump's political strategy to challenge the election being expounded for months by the people involved and it did not involve any violence at any point. They expressly warned against the use of violence, feeling that it was unnecessary, unethical, and counterproductive. The violence was perpetrated by a separate group that acted against the express wishes of the president and did not even attend the rally, but went straight to the capitol. Trump and his confidants were well aware how counterproductive violence would be before the events of january 6th unfolded. He's not a stupid guy. If he had wanted a coup, I guarantee you he would have had it executed properly, but his eyes were already on 2024, and for him to peacefully protest the alleged stealing of this election was gonna be a win-win situation: either he proves his case and is vindicated, or he demonstrates the alleged corruption of the system which will fuel his next run for office.

I don't blame you for having such a caricatured picture of Trump, though. It's what the media has been spoon feeding everyone for years now. Unless you go out of your way to look for the person behind the caricature, you will have a hard time understanding anything that is going on. Both sides need to stop demonizing each other.
Note that you never get a reply or any reasoned argument. Only shadowbannings. They censor you, and that's all they do. Their pretending that they are "fearful" is only to exploit the empathy of others in order to sadistically hurt them. The "fragile left" are not afraid, they only use those tactics to humiliate you.
That 2012 laptop is amazing! I put an ssd in it and moved the original HDD into the CD slot for extra storage. Total powerhouse.
>That USAF person in the back of the room with their finger on the destruct button.

I think (at least at the Eastern Range), they started leaving this seat empty for Falcon launches in 2017 once the automated flight termination system was qualified. This system also reduces staffing requirements at the radars in Bermuda and all over the place