skysight-inc/HackerNews huggingface dataset:
You don't need to rewrite history unless you weren't using LFS or accidently committed large files to the repository. Nothing about LFS "requires" rewriting history.

Not to mention, many users are paying for a service that provides LFS, and hosting an LFS service isn't crazy hard. It's a file server with a custom API, it's mostly doable using S3 as a backend. It's not like this is crazy complicated stuff.
If Jeff / Elon would instead say "it's a lot more nerd cool points to take maybe 30 people to Mars, possibly fruitful in 80 years, than it is to spend money doing the boring work of keeping the planet from overheating" and market their Mars ambitions that way vs. saving the human race then I'd have a much different opinion on the matter.
If the session material is routinely compromised, why use that method of storing session material? Make sure cookies are httpOnly, Secure, and where appropriate, use Strict instead of Lax.

I can understand the need to invalidate sessions server-side that might be malicious or fraudulent, to create a button in your app that says "Revoke all existing sessions", etc. And I can understand that other rules say a logged out session must not exist, and therefore you have to revoke the session. I especially agree if the JWT has sensitive roles in it, such as for an admin user.

But ... for most OAuth that uses JWT, I think keeping a short-ish expiry of say, 1 hour, combined with using cookies to store it is relatively okay. Perfect? No. But not terrible either, assuming you validate your JWT by specifying RS256 or whatever algorithm you expect, validate against cached JWKS and check both issuer and audience, issued date and/or expiry date, for example.

JWTs definitely aren't simple to validate unless you're lucky enough to use a really bullet-proof library out of the box. On the plus side, there really are only what, a half dozen steps to memorize about JWT validation. :D If new to JWTs, I highly recommend pasting one into https://jwt.ms and have a look. Yes, there's a lot to goof up, but they're relatively simple even so.

That said, I routinely use session cookies with a Redis KV session table to keep the JWT if I need it for other APIs etc. The one gotcha is making sure the random value for the session cookie doesn't already exist in Redis; using a timestamp-derived random string can help there, other than that, you're fine...
I feel like the author doesn't mention one thing that I always thought was one the best advantages of using tokens stored in browser localstorage instead of cookies which is that the risks of CSRF attacks are lower/gone?

Cookies _always_ get sent with every request, so an attacker site can make a request to your API and if the user is logged in there, they can do as they please with that user's session... so CSRF tokens then need to be sent with any request which adds a bunch of other complexity.

If authentication is handled with a token stored in localstorage rather than a cookie, no other site has access to the token and thus through more authentication hoops one need not jump.

Am I just horribly confused and wrong about all this?
Apple does have massive resources. They're one of the highest revenue companies in the world, and have way better margins than most of the higher companies in the list.

At least in the Steve Job days, they'd spin up three teams to make a 1.0 product, unbeknownst to the teams, and only ship from and keep the team that did the best.

These examples like the iTunes thing you list are them not caring, rather them not having the resources to get to it.
I've always thought municipal hot water systems are a good idea. Maybe warming water in buffer tanks to supply to homes for hot water and heating writ large a few hours or days later is a feasible buffer?
IMO most of the “exceptional” people in a country “by of and for the people” are hypocrites for waiting on billionaires to fix things

How is political capitulation by the masses exceptional?

Covid offered a perfect opportunity for info workers to show solidarity with on-site workers by not opening those laptops at home.

But really it’s the leopards fault they keep eating our faces because we refuse to build a cage (higher taxation, breaking up monopoly).

The solution is not new either as we just went through it in recent memory with ATT.

I’m rather tired of the general public pointing fingers at everyone but themselves.

Stop going to the jobs they offer. It’s our agency not theirs. Demand they respect it.
It would be interesting to know how many Unit 8200 or other Israeli security service alumni work at these companies.

https://techcrunch.com/2015/03/20/from-the-8200-to-silicon-v...
Thank you for your comment.

I'm no longer in California and that complicates things. I do have a website and a Reddit and I haven't simply thrown in the towel, but it's pretty back burner at the moment.
Would you be able to expand on scoped sessions, invalidated subsets, delegated sessions?

Our roadmap has a big emphasis on improved session management and these are ideas we haven't considered and I'm keen to understand more.
Stream-Guided Smoke Simulations
U.S. Tariffs Drive Drop in Chinese Imports
Generally clang and GCC share the same set of builtins/annotations and most compilers offer similar sets of intrinsics (ICC generally also targets GCC/clang as a comparability target). I’m genuinely curious what compiler you encounter where this is an issue (MSVC?). Also For what it’s worth the optimizer generally can detect these kinds of patterns and replace them so even regular c/c++ code without intrinsics can generate the same thing.
I'm sorry you are having a bad experience. If you spend any time reading on the internet, you can easily see that your experience is a rare exception. Apple gives you 14 days to return it, no questions asked. I assume you returned a computer with so many issues. Good luck with your next computer choice.
Archived version: https://archive.is/1kGNU#selection-4139.0-4139.221

“If the goal was to reduce imports from China then it succeeded,” said Craig Allen, president of the U.S.-China Business Council, which represents U.S. companies that do business in China. “But if the goal was to increase manufacturing employment in the United States I don’t see any evidence that that’s happened..."
> Changing the logic from "must be in this list" versus "must not be in this list" does not give you much -- maybe some performance gain, depending on the situation.

As someone who implements this exact solution, it actually gives you a lot. If your JWTs have a relatively small timeout window (say N minutes), then that means the number of expired tokens you have to keep track of is usually very small (e.g. for everyone who clicks the logout button with a valid token you have to keep that token around for at most N minutes), and on many websites the average user never makes an explicit logout request.

So that means that in many (most?) usage scenarios you can just replicate the list of recently expired tokens to your servers (easy with something like Redis) and then just check incoming requests against that in-memory list. Again, this isn't anything special or new, it is discussed in the article.

This is very different from storying the list of every valid JWT, which will often times be much bigger than you can store in memory.
I just make my home directory be a git repo directly. That's even simpler -- no symlinks. You have to get used to having a repo with many unchecked-in files, but it works well enough. I have a git alias or two to help. This has been a good solution for me for more than a decade across ~a dozen OS installations.
> Meat is not solely the used to describe the output of slaughter.

Reminds me of this bit from an underrated sitcom I binged a while back:
https://www.youtube.com/watch?v=lN4V_tgXuNY

I'm surprised the lawmakers didn't try to regulate "tuna steaks" out of existence.
It's an orthogonal issue - you can store JWTs in cookies and you can store session ids in local storage.
The point is that you probably don't want a truly stateless backend.

What you probably want is to store a small amount of critical state in a very fast, very scalable KVS, allowing most of the backend to be stateless.

So much of the discussion around JWTs boils down to "I want a stateful backend, how do I use JWTs for this?" (Answer: Not well. Why use JWTs?) Or "I have implemented a stateless backend, I'm using JWTs, how do I work around the limitations inherent in being stateless without adding state?" (Answer: You can't. Why are you using a stateless backend?)

That being said, if you really DO want a JWT replacement: PASETO, Fernet, and Branca are all possibilties. See, eg, https://www.scottbrady91.com/JOSE/Alternatives-to-JWTs There's also Macaroons, but I don't know much about them (http://macaroons.io/).
> I don't think anyone expects Twitter or other social media companies to get this perfect

That's exactly what nearly everyone expects, for exactly their own individual definition of perfect.
Junk mail is "useful" because it distributes information.

It's much less effective than, say, books, because there's a lot of overhead and waste in sending junk mail to people who don't care for them.

Beyond that, it also subsidizes other mail deliveries. If mail wasn't being delivered to every address, having someone drop off a parcel just for you would be much more expensive.
That's true. Personally, I wouldn't mind if these kind of constructions are being stopped by the government but I don't see that happen anytime soon.

Not surprised about the news at all. Just don't like if these kind of constructions are used in such manner. I understand you want to lower the tax burden but this is going a bit too far imho. Of course, Uber is not the only one.
Ask HN: Where Are You Recruiting From?
I am currently a hiring manager in the tech part of a very large non-tech focused company and like a lot of companies we’re hiring fairly aggressively right now.

Going back to my startup days I like to source good candidates myself, and for a long time LinkedIn was a good enough place for that. There’s always plenty of recruiter spam, but I generally found that a short message from the hiring manager (me in this case) to a 2nd degree connection was well received and more often than not would get a response, even if it was “no, but thanks for asking.”

Recently though, that doesn’t seem to be working. I get that a lot of folks are over the amount of spam there from recruiters doing the spray and pray approach. Have people moved on to anything else in the place of LinkedIn to make themselves searchable without looking like they’re looking for work? Or is the well too poisoned and most people only want the pull model of jobs vs push.

Besides the mostly who’s hiring and who wants to be hired threads here, where are you having success recruiting from for quality senior engineers/engineering managers?
Apple parts ways with recent hire Antonio Garcia-Martinez amid backlash
It's not self defense because you aren't defending yourself in this scenario, you're defending your property. It's only your property because you can defend it, but most of the time you won't have to because we all agree that you own it.

The same goes for money, you're money is your property because we all agree it is, especially in the modern world where their is no physical item and inherent value. All the money you have is worthless if we decide it no longer has value. One of the trade offs for us deciding that your money has value is that we tax it.

> Personally I steal from people as much as I desire to. Which is none at all

That would be great in a universe that never has bad actors, that is not this universe.
I don't understand what you mean. It reproduces the racism of the authors, no? It's just an extension of the producers. Like I guess you could say the hammer in the hand of a racist hitting you isn't itself racist but I think the point of people saying some tool is racist is to say that it is in some way designed to reproduce their own racism (even if completely accidentally and unintentionally.) But is something designed so like a hammer or is it something more specific?
Well this is the first I've heard of it.
I've seen plenty of people make the equal and opposite wasteful mistake: they insist on using a shared state store so that logins can be properly revoked, then they notice that every server looking up the session in this shared store on every request is having a significant performance impact, so instead they have the server cache sessions locally for 5 minutes (or even longer).
Fastmail [1] is a great alternative to Gmail. I pointed a few domains at it for family members to use.

[1] - https://www.fastmail.com/
Pretty awesome, pretty clear DNNs are the future for decoding/mapping biological signals/inputs. Tied in with reinforcement learning, amazing.
Old Bill Gates his deal went down

buying all the comp'nys

the internet knocked down his door

he said "no that's for phonies"
The persisted state of user access can be two of consistent, available and partition tolerant. JWT uses cryptography to expand partition tolerance at the expense of consistency. The lower the requirement for consistency latency in user state, the lower partitions are tolerated, such as geographic availability, multi-rack, multi process and so on down to not allowing client-server partition. JWTs are fine when partitions are more important than consistency and a pragmatic choice to avoid centralized state on a backing service.
It's important to compare apples to apples which, in my opinion, both the headline and the article itself fail at this.

I did appreciate an article on Generational Wealth which it linked. From that article, people in the US in the age range 20-35 had a median net worth of $13,600 in 2019 vs $14,800 in 1998[1].

[1] https://www.magnifymoney.com/blog/banking/net-worth-of-mille...
Shell also invested heavily in hydrogen production for trucks at their oil refineries in Scandinavia a year back or so.
It is obvious that women and people of color are far superior, and deserve better, than white people. Get over it.
If you don't put a stamp on it, it's probably going in the trash. If you put a stamp on it, they might return it.
This is huge.

OpenPGP can becope usable in a scope of a realistically large organization, and most of the hassle can be put on the shoulders of dedicated IT people, instead of every user.
A surprisingly small number of dollars per month will give you a Redis instance that will solve your sessions needs for a truly absurd scale. And Redis scales horizontally pretty well too. (I say Redis, but there's many equivalent tools that'll work just as well.)

Scale is relative, but...let's put it this way. If you're at the sort of scale where you might struggle to trivially use sessions at scale:

1. You'll know. If you're not sure you're at that scale, you definitely aren't.
2. You shouldn't be taking advice from Hacker News; go ask the large team of experts you've already accumulated about what works best for you. If you don't HAVE a large team of experts on staff already about operating at your massive, massive scale, then see point 1: You're not at that scale.
Yes.

> increase capital gains tax to equal income tax

Is far easier said than done. For example, would you include the $250K capital gains deduction for selling a home in that? Additionally, you're probably referring to raising long-term capital gains tax, but that has the side effect of disincentivizing long-term investment in favor of more short-term speculation.
Wear resistance and, somewhat, accuracy as well.

Sapphire/ruby in really hard so tends not to wear.

You can also lap sapphire more accurately because it is so hard.

And interesting aside is that the sapphire cups are supposed to hold oil so that the metal pin end kind of "floats"--but not too much and not too little.

It's remarkable to see something like a mechanical watch that was the end result of a century of gradual engineering improvements.
Curd doesn't traditionally exist in (Han) China, as with most other dairy. There's a word for it now (凝乳) but it's not in any relation to tofu.

The "fu" in doufu taken by itself does indeed mean rotten. But characters on their own can have very different meanings compared to when used in combination in words. There isn't necessarily a connection, just like in English the word "rotten" doesn't have anything to do with the number 10 that's contained in it.

Tofu isn't fermented but made by boiling soy milk and adding a coagulating agent. I was curious and looked it up and that process was described the same way already in Ming Dynasty, so the "rotten" character might just be random and not have any such meaning. It's very common in Chinese that new concepts are expressed with existing characters, because you can't go around making up a new character for everything, no one could ever remember that many characters (bad enough as it is). Often it's just about the sound. For example the characters in the word for cheese (起司) mean "rise" and "manage" when taken on their own. It would be gibberish to read it that way, but every Chinese person knows combined they mean cheese.
Self-publishing and use of a professional editor are not mutually exclusive!
Thanks so much! I'm glad you enjoyed!
It makes no sense to try to mine a crypto token if the cost to produce one is greater than its value. Advances in mining technology or the increasing value of crypto can help keep it profitable, but there are diminishing returns to investment in technology, and (one would hope) the value of Bitcoin will eventually stabilize.
The DarkSide ransomware gang must be shitting itself
Chrome has been pushing Houdini [1] for years. It doesn't have special WASM integration right now AFAICT but it is basically a lower level layout & rendering API for the browser.

[1] https://ishoudinireadyyet.com/
That’s just the media trying to explain stock movements. Doesn’t mean they are right.
> Secondly, Canvas is often "hardware-accelerated", which can make some things faster, but also slower because this kind of immediate-mode drawing doesn't match the GPU interface well. It's particularly slow at vector graphics. Some effects would require pixel readback, which is slow for the same reason.

https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasE...

One would assume/hope that specifying "bitmaprenderer" for the context type would give you a regular immediate-mode CPU rasterizer. Is that not the case?

> Getting arbitrary data into such a Bitmap is slow, so if you want to do it every frame you may run into issues.

To expand on this, doing that ("putting raw pixel data on screen") anywhere is slow if it's modified regularly. There just doesn't exist a fast CPU-buffer-to-display pipeline anymore, that died out years & years ago. So that one at least isn't a JS/web limitation, it's more a modern graphics architecture one. You just can't bit-bang pixels yourself anymore, not reasonably efficiently anyway. In theory that'd be possibly on unified memory architectures (read: mobile devices & integrated graphics), but GPUs don't like to publish their swizzled texture formats so you still don't get to even there.
Anyone with any money should setup a trust. Especially if they want to marry. Done right it’s an amazing way to protect your wealth. Better protection than a prenup can provide.
In general, the more people cooperate, the better the results are overall. The downside is that the more people cooperate, the more they can be taken advantage of by defectors, by bad actors who decide to harm the public good in exchange for personal benefit. I absolutely agree that being able to trust particular actors is a huge benefit.

Part of the problem is language. "Trust" isn't just trust in a particular actor's intent, but also in their capabilities to carry through on a promise. In order to trust somebody to carry out a promise, you need to indirectly trust on others not to interfere with that promise. In this case, if you don't trust the US government to handle currency, then you certainly can't trust a publicly traded company that is beholding to work within and has assets that can be seized by the US government. If you assume ill-intent on the part of the government, then there's no reason to assume that a smaller actor wouldn't be influenced by the government.

In this case, I trust the US government to manage currency well, because it is in its best interest to do so.
This is only true for cookies that do not have the SameSite=strict attribute. Cookies that have that value won't be sent by a cross-origin request.
Welll… If you made 1M today from crypto (and ofcourse you did "relatively" no evil in obtaining so) - wouldnt using that 1M later to actually solve a hard problem (or say a social cause) be just as worth it?
Then at that point, the corporate network has to be considered critical infrastructure too, no?
I feel like it would be great open source product idea
What's the difference between this and an in-house centrally managed CA?
Your application should certainly have some resolution to an account being hacked or a session token being stolen.

No expiry and no denylist means an attacker can cause problems until you patch your code.
Since when does Lightning Network not make it less decentralized? That's news to me
No, you're not wrong. But I would go further and say JWTs should be obsoleted by using an object-capability model (see: http://habitatchronicles.com/2017/05/what-are-capabilities/ ) which is a more fleshed out way of using unique unforgeable "tokens" to access things. The ocap model is tailor made to solve the problem that CSRF is an instance of (confused deputy attacks).
I thought "division is slow" was one of the more widely-known performance heuristics. I genuinely wonder how much of the division load in typical programs is an essential part of the problem vs. programmers not knowing/caring about slow division.
JWT are useful where logouts are rare (games/apps), high API volume or some latency between logout and actual logout is acceptable.

Think of apps like Uber. Millions of DAU, but rarely people explicitly log out. If your logged-out user list is 5-6 order smaller than active users, it is easy to replicate/cache that. Very high API volume to many different services. Apart from few, majority of APIs won't have major security implication, if called by a rogue actor calls them.

So yeah, banks shouldn't use them, Farmville/Uber using them is perfectly fine.
Apple's CPUs are compatible at the userspace level with normal ARM. At the kernel level, I only know of one architectural violation so far (other than adding custom optional stuff): the M1 has the HCR_EL2.E2H bit forced to 1, which forces hypervisors to use VHE mode (non-VHE operation is not supported, which is a violation of the arch spec). This only matters for hypervisors, as regular OS operation doesn't care about this.

It is true that Apple implemented a bunch of custom optional features (some of which are, arguably, in violation of architectural expectations), and they definitely have some kind of deal with ARM to be able to do this, but from a developer perspective they are all optional and can be ignored. I don't think Apple exposes any of them directly to iOS/macOS developers. They only use them internally in their own software and libraries (some are for Rosetta, some are used in Accelerate.framework, some are used to implement MAP_JIT and pthread_jit_write_protect_np, some are only used by the kernel).
I agree, and I can't believe more people haven't mentioned it here. I am not going to rehash what anyone can read at the linked site, but it seems like an absolutely great project, and seems to be flying under everyone's radar.