skysight-inc/HackerNews huggingface dataset:
I don’t believe that you can make a comment as sweeping as “most Bay Area women... are so useless you could trade them for a jerry can of diesel” that doesn’t reflect a stance on all women.

There are 7.75 million people in the “Bay Area”, presumably about half women. The idea that you could believe nearly 4 million women with totally disparate histories - only united by currently living in the Bay Area and being women - are mostly useless without making sexist generalizations about women defies credibility in my view.

And I used the word “most” because his quote begins “most Bay Area women are soft, cosseted, and naive...” so you’ll have to ask him what he means by “most”.
Yeah, I got this comment elsewhere too. I decided to not edit, because I think current standards at least strongly discourage session id's in urls, and this functionality is basically obsolete.

Sessions requiring cookies felt like a reasonable approximation, and I've already had to hedge so many other statements =)
That's tacit agreement that 90% "literacy" is achievable, which number would be world-changing if it were 25%.
Localstorage is prone to XSS.

You can split the JWT to have parts stored in cookie and another in localstorage. Stich the two together on the server.
Exact same reason why I got out of academia, and my field was a lot more "realistic" than yours. (Post-Silicon Semiconductor physics)
> And what if of that 20 some were killed by their own misfire or that part of that body count are also militants or that the only reason that only 2 killed was because defensive measures that if weren't in place would drastically increase casualties.

Well unless you have specific evidence, that seems to be a reality we don't live in, so not really something we need to worry about. The point of the GP was to point out the power differential. That seems to remain the consant even in your hypothetical world.
What's to stop me from hiding my capital gains in a series of shell companies?
I use GNU Stow to manage my dotfiles and it's awesome because with Stow and Brew, I could create a script that setup everything in my machine from scratch, with one command. If anyone wants to take a look, it's here: https://GitHub.com/diegoholiveira/dotfiles
This is nonsensical. PoS is a mechanism for assuring transactions can get added to the block chain securely. It has nothing to do with whether the controlling interests are centralized or not.
Yes tbh I don't understand why there isn't more attention devoted to making renewable fuels that are more practical than hydrogen. Until we find a better way to store hydrogen I don't think it'll ever take off.
> where its no longer common to get payment failures

Sorry but they're still incredibly common
> I don't know, on the other hand, "random" is kind of a tired aesthetic.

In graphic design (as I learnt it 20 years ago) there's broadly two categories, stable and dynamic. A stable design follows the rules, has quite a logical structure, and even a dilettante can easily use templates to make one without even understanding the rules all that well.

OTOH, to execute a dynamic design well you need to have a strong intuition for aesthetics, as well as a deep understanding of the rules. My teacher put it more plainly, you need to understand the rules to break them properly - otherwise it just looks like you screwed up.

The tool provides full freedom to break the rules, it doesn't mean everyone will break them well, but it does open more possibilities for a capable designer. And if there's anything tired, it's the same-y stable designs that cover almost the entirety of the web.

Edit: changed quote
That's exactly the same as checking a list of tokens. If you need to make a DB trip on every request, what advantage are you getting from JWTs?
These are all standard practice even for the unclassified parts of intelligence agencies, which is probably where they borrowed it from. Now applied to the Department of Agriculture.
> You could also avoid the need to deal with large batteries by having the truck draw power from an overhead wire.

https://www.engineerine.com/2021/04/germany-opens-its-first-...
Just be thankful you are not on Gitlab. We pay $60/year for 10GB.

I need the data for my team, so we pay, but I use it as an excuse to force the team to clean up data every so often. As a game company we need large repos. It was either Gitlab or Azure DevOps.
Never trust the client, ever.
Oh and this is just my two cents but - never issue your own JWTs unless you're prepared to watch for bad actors forever, ideally have an HSM to store your private key material and are prepared to publish and add keys to your JWKS so you can rotate keys "easily" if they're compromised. I would not reach for JWT when you could just as easily design an API that uses distributed KV stores to validate if a session exists. However, at scale, JWT works great. And for OAuth, that means JWT is more practical than asking a cloud provider if someone's session is valid with every request. Basically, you'll know you need to issue JWTs when the benefits outweigh the complexity of maintaining it securely.

I would say though that this advice on JWT issuing might change in future: After all, Istio made running a PKI distrubution infrastructure a lot easier than before it came along allowing for mTLS between all the things, assuming your Kubernetes is secure, of course.

And the same advice on not issuing your own JWTs applies to session cookies like Flask's that are protected only by a server-side secret. Someday you'll need to rotate that secret and when you do, everyone's sessions will vanish forever. That's probably a good thing, and not a risk you'd see frequently, but when combined with the data exposure of keeping session data in potentially clear text (or base64 encoded text) which applies equally to JWT as to cookie stored sessions, well, it can feel a lot nicer to keep session data in KV storage. If you have really long JWTs, it's more practical too, compared to sending multiple cookies each under 4KB long to store a 7KB JWT with lots of extra fields and roles, etc.
I was under the impression that the right way to use JWTs is as object capabilities, much like Kerberos tickets.

Can you expand a little more on how you believe they should be used versus how they shouldn't?
By your very own logic, one should take 100% the side of Israel. After all daily crude rocket attacks are being done by just one side.

https://en.wikipedia.org/wiki/Palestinian_rocket_attacks_on_...
Primarily because the bitcoin codebase got taken over by some bad actors. However, if ETH takes over in market share, BTC can either improve or become irrelevant. The people controlling bitcoin may be dumb, but they aren't dumb enough to let something else take over without a fight.
even if it's 10% (which imo is pretty high) that's still far off from what we have now.
FlipMaster 9000 (Flipdot Display)
DOM performance has already improved leaps and bounds after millions of dollars of engineering and countless hours of effort. Same with Javascript. At some point you have to accept that the DOM has fundamental design flaws, its specification and requirements are the problem yet cannot be radically changed because of backward compatibility concerns. Browsers have spent decades optimizing everything possible, one should start by acknowledging that before tiredly trotting out magical performance improvements as the answer.
You mean if Israel takes down their Iron Dome and suicide themselves for 10x extra casualties, this will be a material fact to decide whom to support ?
> If anybody is a digital native, it is me. I did not just grow up with computers, I grew up alongside them.

How is that not misunderstanding the meaning of native? Google's first definition for native is "a person born in a specified place or associated with a place by birth, whether subsequently resident there or not." Growing up alongside computers is another way of saying they weren't with you since birth.
probably should explain what it is.
Yeah, real difficult. Like AGI.
Nice username btw
Except that it's fairly centralized
Medieval writers’ plagiarism resurrected by technology
You can use a bloom filter to check if a token has been revoked, and then do the query for false positives.
The name Writely reminds me of a side project I worked on around 2010. I was not satisfied with the performance of Google Docs and its competitors at the time like EditGrid and thought (naively, as it turned out) I'd be able to develop a faster alternative.

I had no idea what I was doing and thinking that using JavaScript to manipulate the DOM was going to be slow, I chose ActionScript and Flash as the language and runtime to develop the project in. I wrote a client-side expression parser and formula engine, and managed to develop a functioning spreadsheet UI with resizable rows and columns, copy and paste with Excel-like animations, cell references etc.

The problem that I ran into was text-rendering when there was a lot of text on the screen. The application would consume a lot of memory and the page would slow down to a crawl when scrolling. I couldn't really find a way to speed up the performance and stopped working on the application after some time. That's when I realized the incredible amount of work that went into Google Docs and other web-based spreadsheets. :)
good thing science works on consensus and not anecdotex
A store is a store. If he sells toothbrushes he has to take them back if the customer doesn’t want them. If he eats a loss on it, then maybe he should reconsider selling them.
> Something I've been wondering is, do we really have any evidence that the average Auth0 developer is more of a security expert than any other dev?

Security companies have average developers just like everyone else. They probably do have better domain knowledge from working on their product but they will miss other important things.

The real difference in security comes from product management. Almost everyone I've talked to has some sort of risk assessment process where these sorts of things are laid down in great detail. The leading companies will invest in not only trying to discover weaknesses but will plan to mitigate or resolve the issues within a reasonable timeline.
>No idea why you’d need an app

So that they can take and sell your information on a regular basis
BTC is not under SEC ( or even any) regulation for pump and dump schemes.
Behaviorally they aren't the same thing, so that's not a straightforward mechanical translation. For example if the variable is an object instance then if escape analysis can prove the variable doesn't outlive the loop, then it can be put on the stack & then yes there wouldn't be any benefit to the suggested change. Although deoptimization makes stack allocation more complicated, so JS engines are more conservative here than say JVM runtimes.

But it's really easy for escape analysis to fail, it has to be conservative. So you can end up heap allocating a temporary object every loop iteration quite easily.
Yeah, TinyEMU doesn't have a way of reporting clock speeds back to the guest as they're probably not meaningful anyway.
Clearly it's not ready for commercialisation (needs weekly recalibration; only a single individual tested etc), but it's still amazing - we're decoding signals from the brain! Isn't that worthy of discussion?
Could be, but if so their employees are insanely underpaid
If you're securing an API, you can mitigate CSRF by simply requiring a custom HTTP header: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Re...
Yes, unfortunately you've picked the wrong issue to be scared about.

The CSRF attacks you're describing have been solved by browsers with the SameSite attribute on cookies. If you set SameSite=Lax or SameSite=Strict, cookies will not be sent with requests originating from a different site.

In choosing localstorage over HttpOnly cookies, you've put yourself at greater risk in the event of an XSS attack (meaning, an attacker running their javascript code on your own domain).

When your users' session tokens are in localstorage, an XSS attacker can exfiltrate the tokens from localstorage, and potentially transfer them off your site to their server, where they can then cause more havoc.

HttpOnly cookies prevent this problem because the XSS code can't access the cookie value, so they can't be exfiltrated and transferred elsewhere.

I recently wrote a little bit about this here:
https://www.clerk.dev/blog/how-httponly-cookies-help-mitigat...
How do you authenticate the request if you don't send the token with it?
> Sixty years on, the most interesting thing about the case is enthusiasts' refusal to consider the most plausible explanation because it doesn't deliver the same satisfaction as less likely theories like government conspiracy.

One could make a similar statement about many folks' refusal to entertain ideas outside of the mundane for fear of looking stupid. Interestingly, this behavior seems more common amongst intelligent people (who perhaps are compromised by their pride of their intelligence, but not so confident in their intelligence as to lack that insecurity).
The White House also released a fact sheet which summarizes the order. It makes for a shorter read if you just want a summary.

https://www.whitehouse.gov/briefing-room/statements-releases...
> So you must be on the side of Israeli civilians at whome Hamas is salvo firing rockets.

I feel like this is similar to a false dichotomy. The GP is pointing out a difference in resources and thus power. It doesn't mean one does not empathize with anyone suffering. That's just not something that follows. Any case of someone who is having their home, workplace and life destroyed is an absolute tragedy. I don't think that distracts from GPs point at all which has to do with power dynamics and the media's presentation of events.

> Or if you are on the side of Hamas should Twitter remove all the Iron Dome videos showing interception of rockets deliberately fired at civilians by Hamas?

Why would they do this? I don't understand the relevance.
> So yeah, banks shouldn't use them, Farmville/Uber using them is perfectly fine.

That is true (and I think the author agrees with you in the article, see the par. about scalability).

However, many of us are not working at banks, or at companies that have the scale of Uber.

My main takeaway from the article, is that if you are neither of those, you might still want to opt for traditional sessions.
Exactly my motivation behind this experiment in search engine design http://ogi.vladimir.prelovac.com
Weird how American companies make an awful lot of mistakes that happen to support American interests.
They seem to be reasonably popular around here. I see them used on trucks on the Interstate probably more than 50% of the time.

They may not be worth it for short haul trucks, but long haul trucks I bet the savings adds up quick.
My Beloved College Town Has a Problem: It’s Too Popular
Ghosts of Unix past, part 4: High-maintenance designs
litterally just looks like a 12 year olds imagination.
To an outsider of both? It seems to be better.
Still taxed. You're effectively selling them your Bitcoin for the car. Or think if it with any other currency: if you bought Yen as part of your investment portfolio and it increased relative to USD, you still have capitol gains when you cashed it out.

Basically whenever you leave any financial position that increased in value for something not a financial asset then capitol gains are likely (there are exceptions)
The bill is https://capitol.texas.gov/tlodocs/87R/billtext/html/HB00316I...

It's going to be a fun game of whackamole as Beyond Meat starts producing "steak", "fillets", "bacon", etc and other things not explicitly listed in that bill.
Plans for physical objects that are commonly sold at high prices are often valuable trade secrets.
That's more or less what we ended up with.
We could choose one the following two extremes:

a) Store sessionId as a cookie on the browser, pull all details on backend from cache server - requires network call every time when any tiny user detail is needed, not a showstopped and it worked for us for quite a while but we wanted something more convenient.

b) Fully stateless backend, keep entire session in JWT - our user's session is on the huge, plus user's session has private data (we declined this option rather quickly)

Instead we ended up with JWT which contains sessionId + bunch of most commonly accessed user properties (various identifiers, roles, login time, etc).

Now it seems like that somehow I missed this "JWT means stateless" thingy, well, let's see what people say.
Ok, but rather than posting a meta putdown, why not share some of what you know about the topic? That way we can all learn something. A comment about neurosignal decoding would be much more interesting than yet another complaint about people being wrong on the internet, which we're all in a position to supply.

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...

https://news.ycombinator.com/newsguidelines.html

To be fair, this problem is a co-creation between comment and upvotes, and upvotes deserve more of the blame. But if you post an on-topic, substantive comment in the first place, then you're contributing to improving this place rather than worsening it. Recent comments on similar cases:

https://news.ycombinator.com/item?id=27110515

https://news.ycombinator.com/item?id=26894739
I think reporting posts promoting terrorism on social media is a reasonable thing to do,

one doesn't have to be part of some government-sponsored conspiracy group for this, as some allege here
He's poking fun at himself with the whole "programming has never been my forté" -- the fact that he kept count of all the bugs in TEX and METAFONT is the amazing thing.

At the risk of stating the obvious, iTeX is not a real successor of TeX, it's a deliberately-vaporware joke.
For users, I like to have a secret key per user and put something signed with this key in a cookie to represent the session. Then "log out everywhere" is as simple as regenerating their secret key.

No need to have to persist state for each session, which is nice.
With all these problems in current Social media platforms, isn't the time for de-centralized social platforms to flourish?
It’s not an agreement that it’s practically achievable any time soon. It’s just that more than 90% of people have brains that are capable of literacy (or did at some point).
Good luck exfiltrating it back to your bank account.
Your personal income is for yourself. A corporation's revenue that goes towards expenses is for the customer. Say you buy a gold at $700, and turn it into gold jewelry that you sell it for a $1000. If the tax rate is 30%, and the jeweler is taxed on the revenue, the jeweler would have made no money at all! If you do tax the expenses, it would have to be passed straight to the consumer.
I think the panic over this is a little unfounded. For docs this makes perfect sense. My concern I guess is if this becomes the normal way of doing development, and people build HTML replacements that work using canvas. What will the impacts be.

* How many browser functions will break.

* Will middle click still work.

* Will screen readers still work?

* Will search engines/ctrl+f still work?

One of the awesome things about web browsers is you get so many features for free on every website. Making the text bigger on a website mostly just works everywhere while on traditional apps it only does if the app has a specific setting for it.
Congress is corrupt (via lobbyists). Congress would make this illegal if congress men/women didn't sell out American Citizens.

88% of the cost of the US Fed gov is paid for by taxes by workers (income taxes). Less than 12% comes from all corp/business taxes combined with capital gains (taxing the rich 1%). Business shifting tax burden to workers is a massive scale problem. $3.5 Trillion = US Tax Revenues (2019) and 88% came from workers.
Wind resistance goes up by the cube of the velocity, it would be a much larger savings on an airplane.

Still even at interstate speeds a 5% savings pays for itself pretty quickly.
Yep, same thing as investing in a foreign currency that increases relative to the USD. When you convert it into a purchase you are realizing a gain, which is taxed.

Heck, even savings account interest is taxable.
A JWT still needs to be verified by the backend, it just doesn't need to do a database lookup to do so.

But if you're statefully storing sessions anyway...
Very few things apply always. Obviously money doesn't, but money is not your garden-variety competitive market like carrots or coal. The only legal suppliers of money are the nation-states that issue it. If you tried to print "money" yourself, it'd most likely be worthless because either nobody would use it (ok, maybe some cryptocurrencies excepted, but for reasons that have more to do with anonymity and a desire to stash illicit savings with a potentially lower probability of forfeiture than anything else), or you'd get in trouble for counterfeiting.
Do you have a source for these stats?
It gets really exciting when they go through a tunnel or under high voltage lines.
Yes, but we would also need an event loop I guess. As I understand it nodejs is essentially a (c++) js runtime inside a c++ event loop. But I think we already have a rust event loop (or two?)
The whole "orbital slot" thing is absurd. Space is really big. Like, really big. And orbital mechanics being what it is, you could launch a satellite in the exact same orbit as a Starlink satellite but trailing a few miles behind and they'll never impact one another. If they are using totally different uplink and downlink frequencies they'll be effectively invisible to ground stations of competing services.

That being said, your napkin math is a bit off. A single Starlink satellite isn't all that valuable. It can only talk to ground stations in some region on Earth for a short period of time. It's the dozens of satellites per plane that make the service useful (24/7 coverage). While you can divide total revenue by the number of satellites, the service only works with a complete orbital plane.
No albuterol? Terrible list.
Please not here Sam.

https://news.ycombinator.com/newsguidelines.html
chezmoi seems really promising. Been planning on migrating my dotfiles to it soon:

https://www.chezmoi.io/
Purchasing big ticket items with Bitcoin will get stomped on in many regions in any case, as it is a way of dodging capital gains taxes. Or income tax if you are paid in bitcoin. Or GST/VAT. Same reason you can't swap a bar of gold for a car. I don't think governments are going to want to track official exchange rates for all the coins, and given coin volatility it probably wouldn't work well in any case.
How would someone at that level of wealth give in a more empathetic way? What should Bill and Buffett be doing instead?
It would be more dangerous when spread over a large surface and allowed to vaporize.
Like on the PinePhone, using sxmo? Works great.

Ditching the _enormous_ Android stack is an easy win.
The Blue Check Mark’s Evil Cousin
I'm not trying to say otherwise. I'm more pointing out that solving this problem will be hard because a lot of people depend on creating the problem.
You logout on a public computer, the next user undeletes the cookie (which is just a row in a profile SQLite database).