skysight-inc/HackerNews huggingface dataset:
Can you remedy this problem by making it so that anyone can delete the file? That way anyone can take it down if they have a problem with it? It's supposed to be ephemeral storage anyway... people might not mind having files disappear.
But what is an appropriate level of liability here? Phone companies never signed up to be the guardians of our digital lives, and the tech industry at large has just built a castle on shakey foundations.

And there are obvious trade-offs here, if we make number portability harder, it means you're somewhat hostage to your phone provider.
yeah, Zoom has PTT of a sort, you can mute and unmute yourself as you wish (and I will mute myself when I know I'm not going to be taking part in a call for a long period).

That said, you still need a decent mic if you're using PTT, dealing with someone's crap audio when they do P to T is still a bad experience.
My partner resets her Google password every time she logs in. It's just part of the normal flow for her. She probably does it with everything, but I'm not listed as a recovery on the other things.

Something better would be great. She's probably an extreme example, but I think we techy people tend to have a warped view of how comfortable "normal people" are with effective password management.
The security advantage it offers is specifically to remove aapl/goog from the equation. The security features big tech is offering these days is primarily designed to lock you into their ecosystem and out of your device rather than actually securing it for you. The primary security they're offering is from casual hacking, which of course has value if you're not tech savvy and unable to do that for yourself.
Yeah, I edited my comment as I think I miss-spoke actually. Technically, GitHub as a platform will allow us to fork or clone this code. But with no license file, from a legal point of view, we cannot use it, or whatever else an open source license would allow.
It is atrocious. Reinforces every possible stereotype about web apps. One tab of the reddit redesign after scrolling will eat more memory and cpu then most AAA games on my rig.
yeah that's pretty close, although it doesn't seem to have the amount of activity I'm looking for. It would be nice to have a few hundred people from HN in a room over there - I'm always trying to get youtube recommendations from people I meet here.
I have two rules for interruptions:

1. Please do, but
2. If I signal that I need time, respect that.

#2 is the flip-side of interrupting: Don't persist if there are any signs you should not.

I am more than willing to help people with their problems, and I love answering questions, teaching, providing advice, discussing thorny problems...

...but I won't countenance an "interrupt": Come to my office, knock on my door, say my name, whatever, but if my hand shoots up with the "Just a moment" index in the air, respect that.

If I do that, it's because what I have in my head will take me far too long to regain once lost - and the interruption will blow it up.

I need to checkpoint. Maybe even solve. I need anywhere from a few seconds to an hour (and, yeah, I may forget you were there, foibly human and all that).

Pretty much everyone I've ever worked with has learned that I have all the time in the world for them, except when I don't, I will let them know when I don't, without being rude (well, perhaps debatable, it is the barest acknowledgement), and when I can I will give them all I can.

Unless you persisted. On a good day, when I am feeling open and relaxed, hopefully we can talk about how to manage things differently, figure out a way that works for us.

On a cross day, an impatient day, I will kill you with fire. Metaphorically. Being a foibly human. Who sometimes overvalues his time. We are both likely to regret this. Hopefully we will find occasion to laugh about it later.

(Over the decades, the "just a moment" finger comes up less often, at least in part because I've learned those thoughts I was holding were neither so valuable nor so fragile as I once thought. Often, it barely starts to rise and I've already shifted gears, caching things away for later. I had to teach myself that because I really do prefer taking the interrupt and helping to breathing flame.)
> And your 3-point list scares the crap out of me because while it might look fairly reasonable to you, it looks to me like you’re looking at the government for a source of paternalistic love, something it can never provide.

I was more talking about things like deciding what the right tax rate is. The people might want low taxes, but if those taxes can't support all the things those people need (roads, etc), then low taxes are not what those people need.

> Congress isn’t in the business of doing what’s “best”, they’re in the business of politics

And I see that as a problem. The point of government is to make life better for everyone being governed. Making life better just for the large companies that can pay for it is not the way government should work.
“Immunity doesn't last forever:” Covid-19 boosters set to become routine
You have to pay a monthly fee to own a phone?
It was 66%. Most adults, but less than “almost every”.

https://www.pewresearch.org/internet/fact-sheet/mobile/
not the constant barrage of modders?
Another HN story where the solution is to yell into the virtual sky loud and hope that someone "important" enough escalates the problem through completely non-standard channels that "normal" people don't have access to.

It's getting old.

(To be clear not hating on this guy, his extension, post, etc. Just the status-quo of how these problems are "solved")
If people don't want the zero-cost solution of PTT, they definitely won't buy a $100 mic.
I think the author was motivated by intellectual curiosity rather than money. Thankfully he was enthusiastic enough about it to share it with the rest of us.
When Young Turks Take over a Government
The WFHpocalpyse Part 3: Remote Work One Year Later
I've spent many hours staring at a radar scope, and fixing and maintaining those radars.
In my mind that just means switching over the big boy browser to that approach just means giving an incentive for more of those types of ads that slip through.
Seconded, I would be extremely interested to hear this due to some code I have been working on that has been effectively abandoned.
> While adding a number, Sakari provides the Letter of Authorization for the user to sign. Sakari's LOA says that the user should not conduct any unlawful, harassing, or inappropriate behaviour with the text messaging service and phone number.
But as Lucky225 showed, a user can just sign up with someone else's number and receive their text messages instead.

Um, what?!
Ah. I only use uBlock Origin on mobile so that explains it.
Their method of making money has directly contributed to a nosedive in the quality of their products. I frankly consider this a kind of rarely documented market failure.
You mean in case the type-inference doesn't halt?

Aren't such programs not very interesting by definition?

And why would you call them "valid" programs?
"Please hold while we look up your account..."
I run a couple of programming groups currently over zoom. Usually between 5 and 15 people. I will tell people to get headphones or fix their audio issues (breathing/mouth noises) and I will mute them if they don't make progress on these issues. Perhaps it helps that most of these people I consider to be friends, but earlier today I did switch the CTO of a company from Slack to Zoom citing the quality of his audio.

I've found that most people seem to fix things themselves after being told a relatively small number of times.
Is the initial set of expectations the immutable legal standard?
Along the lines of the trucker's hutch, I particularly like the Versatackle knot system:

https://notableknotindex.webs.com/Versatackle.html
I do like it, but not being able to edit a comment is kinda annoying, and I find myself needing to on the website to do so.
Cap on Trident nuclear warhead stockpile to rise by more than 40%
This is actually a great idea, and it shouldn't be too hard to implement.
You're welcome! Depending on how new it is, you may need to use testing versus stable.
Often the rates I'll end up limiting in rest aren't even bottlenecks at all in graphql. like if I wanted to grab a relationship that hasn't been implemented with its own resource endpoint.

e.g. get all the comments in every article written by one author, I might say `/author/john smith` that returns all their articles, then run an `/articles/{}?include=comments` for each one. That'll run a separate query server-side for each one, which can get very heavy if I'm doing thousands of queries. On the gql this is trivial as `{ author(name: "john smith") { articles { comments `, but because it's one request the server-side fetch can be run _way_ more efficiently. We have dataloaders for the SQL written that'll collapse every big query like this into (often) a `IN (?, ?`... query, or sometimes subselects. Same concept works on any sql or nosql approach. So yeah it might be "a lot" data were it RESTful, but we're not going to bottleneck on a single indexed query and a ~10MB payload.

The real advantage I see for REST in that scenario is that it can _feel_ faster to the end-user, since you'll get some data back earlier. Running a small query on thousands of requests is slower, but you can display the first little one's result to the user faster than a big gql payload,.
As long as you don't blithly accept new ssh connection end points or bypass certificate warnings, you should be fine.

They could track where you go online via the DNS requests ( the sites at least ), and they could mess with anything unencrypted.

Used to be if an HTTPS site loaded an HTTP script resource it provided a dangerous place middlemen could invade your secure session.

chrome, IE ( presumably now Edge as well ) and firefox rightfully block mixed content by default, and have for some time

https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_...

( the mentioned Firefox 23 came out in 2013, so like I said, a while )
what can you possibly not like about the dinosaur game?? I love it and i like how chrome has debugged it over the years.
TOTP is only better than SMS against SIM swapping, a rare threat. They are identical against phishing, an enormously more common problem. For a typical user the delta in security when transitioning from SMS to TOTP is minimal.
There seem to be horror stories on reddit about Google Voice numbers being terminated for people out of the country too long.

Is there a stable inexpensive phone number service for folks that are outside the US a lot?
Do you recommend OpenAPI based docs? I used SlateDocs for mine: https://butterflylabs.gitlab.io/api-documentation because I found that generating OpenAPI with NestJS to be kind of a pain as part of a build process.
Demand went up to more than existing factories can make. It takes deep pockets to build a factory.

I don't know if it is a good business though. It's is hard to be sure if demand is high enough to support a factory or if you get a dozen orders and then demand is met.
> In other words it either must allow type invalid programs through, or it must prevent some type valid programs (or both!).

I don't see how this is the case. The type system being Turing complete just makes it undecidable, ie. it's not guaranteed to finish type checking. In a way you could call that "preventing some type valid program", though I wouldn't consider an infinite loop of types valid.
That's for the schooling me with Cunningham's Law with the fact the frequency wasn't ~2.4GHz, and the signal power was way less than 100 watts.
In many places, a victim has quite a lot of say whether a crime is prosecuted.
It's more a $60 mic.

Most of the time people just don't know their audio is a problem, and all of the times I've pointed it out it's got fixed.

PTT isn't 0 cost if you take into account the reduction in fluidity of a conversation. If I didn't have my mic already I would consider it a reasonable price to pay to get good audio quality, especially since you still need good audio quality when you're actually talking.
Why would employees want something drastically different for the company? Employees in general like to get paid.
haha I laughed
No, that's government level. I'm only fine with private entities choosing to do or not do business with whom they please. If google wants to block apps that use encryption then they can do it. Of course that would destroy their business so they won't.
The problem with not having PTT is that in large calls, a small noise from potentially tens of individual people becomes a larger overall interruption in the call.

Its a blunt stick when you cannot trust people to keep quiet or appropriately position their mic when they aren't talking.

Atleast you only need to deal with their mic quality when they're talking, which at that point you can directly ask the person to fix it if need be.
Gamers playing this game have all kinds of tricks to try to bypass the load screen itself because it takes a long time to go through it but the game by design forces you to look at the load screen multiple times just to do one task. One way that I remember was to play in a Solo session that way you don't have to load every time you come out of multiplayer. They even make a GTA online software tool that blocks GTA on the firewall at very specific intervals to force an online session in order to speed up load times.
Trucker's hitch isn't really a specific knot. It's a technique that can use any number of knots (you just need to be able to put a loop in the middle of the rope and tie some sort of securing knot in the running end).
> which someone cannot hack easily

Everybody gets phished. Much easier than sim swaps.
Yubikey is complicated?
It’s absolutely worth that much and more. GTA5 Online pulled in well over $500 million in 2019, and even more in 2020. It’s now the 3rd best selling game of all time, behind only Tetris and Minecraft. https://www.tweaktown.com/news/69666/gta-made-half-billion-d...
This was always going to happen. Make it political/religious that the vaccine is 1000% safe and anyone who says otherwise is antiscience and probably a white nationalist. Then discover there may be some issues with the vaccine after all. Now the train has no fucking brakes, so you've got to derail it instead.

Meanwhile we "anti-science" folks who have been blowing the whistle all along that the vaccines were not and could not even theoretically have been adequately tested (9 women can't make a baby in one month!) will just get shat on some more for some reason.
I don't think that bad actors are the problem you think they are. They still exist in our society and we manage.

The issue in my view hinges upon making it easier for people to choose who they interact with online, including tools for delegating those decisions to zero or more third parties.

We'll need a good decentralized identity system first.
It seems like a dumb move to me. Like you said hundreds (thousands!) are dying daily and they get a few blood clots out of 17 millions doses and they stop completely and panic, even though this stuff has been out for months now.
I honestly don't know how I avoided doing this during my years of employment thus far.
Author here. Thank you HN for helping me get my extension back up! <3

Wish it didn't require getting on the front page to find a timely resolution on these sorts of issues, but it's heartening to see that the community is so supportive whenever something like this pops up.
No, this is exactly what they signed up for. When I sign a contract with my phone company to give me access to their network I expect that they will not just give it to someone else instead under my name.
Absolutely. I gladly pay for YouTube Premium, Subscribe to Twitch streamers I like to remove ads there, and other services that do an ad-supported free tier than a premium ad-free tier.

Other replies to me are reading me wrong, I didn't say "I hate ads therefore I believe no one should ever use ads", I said "I hate ads and would happily pay for me to personally not see them". Telegram can fill their apps with ads if they want, for those that can't/won't pay, as long as there's an option for us to pay and not see them.
... or trivial number porting attacks like the one described in this exact article.

Depends on your threat model, but unlike SIM swapping this may not be out of the reach of even a mildly technical angry ex.
It's not me who draws the line and that's the point. Government/the public isn't involved. The companies themselves draw the line.
Phone companies are guardians of our our accounts with them. The absolutely bear responsibility if poor security or loopholes allow someone to gain any sort of access to our accounts. Security and convenience are often a trade off. Clearly service providers are not properly judging where that balance should be.
is that really the case? apple as example, they develop secretive and innovative security measures that, while compatible with their corporate mandates, do actually aim to protect end users. yes, this is in contradiction to certain privacy needs, user lock-in, etc as you mentioned

primarily, i am interested to learn what pine or other offering does outside of the obvious benefits of it being open. specifically, what security measures on their own merit, hardware and/or software, does pine offer, either uniquely or in an effort to "catch up" (e.g. secure enclave)
Extensions such as uBlock Origin just happen to be important enough that they should not be subjected to these limitations. They're essential browser features that for some reason haven't been integrated into the browser itself yet.
So this means that the only protection from attacks like this is the law, and not a technical or operational hurdle like going through an AT&T hotline to get sim swapping going.

This is bad news because following the law isn't a top priority when trying to hack someone.
I'm aware, I'm a hacker (in the evening news definition of the term as well as the TMRC one). I was referring to the fact that most USians would not sign up for a whatever b2c service that demanded their SSN, but wouldn't hesitate to provide their phone number.

We should all stop doing either.
The idea that screwups are "shameful" is poison in any organization. I fight it in the companies I work for, I fight it here.

Bugs happen. Serious bugs happen. They will always happen. Shaming people for bugs undermines institutional robustness against bugs because it incentivizes people to hide mistakes. Furthermore, companies with blame-n-shame culture typically fault users when those users make inevitable "mistakes" statistically guaranteed by bad UX design.

In contrast, transparency is good, acknowledgment is good. Rockstar acknowledged fault and rewarded the reporter, which is difficult. That's a positive institutional arc I'd like to encourage, at Rockstar and in the wider industry.

If you stop at "embarrassing", I'm with you. But when you proceed to "shameful", that's quite different and we part ways.
Immutable Linux desktop with OpenSUSE and Snaps
Oh hi! Thank you for the kind words. I cant tell who you are by your name here, but if you've been with us since 2011, we have certainly spoken. Are you using our second San Diego data center for your failover location? If you and I aren't already talking directly, ask to speak with Mike in your ticket.
Ironically, the suspension of vaccines has now sowed far more doubt than some isolated reports of blood clots would have.
Okay I'm genuinely curious why "mail lady" wouldn't fly today.

...why not?
Are you aware of the fact that most molded containers, just like the ones you use (the 'cardboard' where you put the food) can be dangerous? As greases, especially hot, destroys common cardboard those containers usually contain PFAS, a chemical which is the reason why those containers are so difficult to soak up. This is a widely used product, for example on clothes, to waterproof things. However using it on material coming in contact with food, especially hot or greasy, may be dangerous because the product leaches into the food. Previously used molecules in this family are named pfos and pfoa, are now already classified as dangerous (for human health) and global pollutants, and not produced anymore in most countries. There is now a major concern about PFAS found in drinking water in a growing number of nations, including the US, some class actions may follow, and it may become one of the most prominent food scandal.

To be on the safe side may imply to really check that the containers do not contain such molecules.
I had a lot of help today from one of the brilliant programmers on YC's incredible software team. And there are other people who work on HN, just not full-time since Scott left.
This doesn't require rewriting extensions, it is backwards compatible.
Clubhouse Breaks Through
WebAuthn, so, a Yubikey would work for that, but also cheaper products (the keywords for a product search are FIDO Security Key) which are similarly capable.

If they have a nice phone (modern iPhone or Android phone that is able to recognise who you are by fingerprint or facial recognition ought to be enough) that can do WebAuthn too, the actual recognition remains local to your device (so you're not giving some mysterious entity your face or fingerprint).

I'm assuming since they're "nontechnical" that you mean as a user, the user experience for WebAuthn is trivial, one touch. You do this to enroll the Yubikey, and then you do it whenever you need to prove who you are to the same site. It's entirely phishing proof, the credentials can't be stolen, you can keep one on your keyring or just leave it plugged into a personal PC all the time, it has excellent privacy properties, the biggest problem is too few sites do WebAuthn but Google and Facebook do, so that's a good start for non-technical people.

Which brings me to the other side, if your non-technical friends are wondering what their organisation should mandate, then again, WebAuthn, but this time I admit it's somewhat complicated. Somebody is going to need to at least research what product suits the userbase, and check boxes in the software they use, and at worst they need to do a bunch of software development. It's not crazy hard, but it's a bit trickier than yet another stupid password rule requirement. However unlike requiring passwords to contain at least two state birds and the name of an African country requiring WebAuthn will actually make you safer.
Only if they work hard for it.
Microsoft Exchange Server Vulnerabilities
Yeah I don't get it. It's the same as half the text fields on the web that get a border when focused.

e.g. https://getbootstrap.com/docs/5.0/forms/form-control/
Python has a `multiprocessing` module that sidesteps the GIL.

You can question me all day. Go build the benchmark. Publish it. Have people scrutinize it. I have my prior based on building this sort of tooling for years and actually publishing benchmarks.

And you still continue to miss my point. Instead, we're in a hypothetical pissing match about code that doesn't exist. Either the parallelism problem is uninteresting, or your benchmark becomes about complex synchronization. The former complicates the benchmark for no good reason. The latter results in a different benchmark entirely.
Yes, we've got a good backup system thanks to the greatly-missed sctb.

Sorry to hear that, that sucks.
This should be an autorespond link, but [cite]?
It wasn't brought up for comparison it was brought up as an example of why POC have their doubt about a 90% white government telling them it's not a problem. You and I know there is a 99.99999999% chance that this is not Tuskegee 2.0, but when you've had to live with bias and doubt about government/police/etc.
I use telega on Linux, I guess this is the Qt-based desktop client?