skysight-inc/HackerNews huggingface dataset:
OK so they buy you the phone.

Shouldn't the thing _actually be_ "if they want you to have Slack on your phone, they should pay you for availability during off hours"? The phone buying is a basically one-time cost from their perspective.
+1 to sibling comment about not choosing the SOTA just cuz SOTA (if you're in the market for an ANN algo). Almost all the ones there are pretty darn fast these days and many (e.g. hnsw) are implemented out of the box by libraries like nmslib.

Also, most search use cases have requirements besides just the "get_k_nearest" functionality too (scoring-level filtering, business logic built into scoring unrelated to similarity, disparate query patterns that don't fit nicely into a single similarity space), so unless you only need to retrieve the K most-similar documents it might not be a good solution.
hey man, sideloading is just the start, next thing you know theyll be saving progressive webapps and never leaving their browsers!
And it's not just teenagers either. You see tons of 30-something and middle-aged people in low skilled, service sector jobs. There is an overly optimistic assumption by policy makers and economists that low skilled workers are supposed to 'graduate" to better jobs, but for all to many ppl it's the destination.
I actually find this post/ad for Redis pretty ironic, because Redis is actually a really great solution for storing revoked tokens (since you can just store the token with an expireat equal to the token's expiry timestamp). I do think it's a serious issue that most jwt howtos don't mention expiring tokens and/or refresh tokens, but "JWTs are not safe" is hilariously hyperbolic.
- Holder of macaroon can issue a sub-macaroon with smaller power, while JWT is fixed
- Macaroon is notably longer than JWT
- Macaroon is equivalent to signed JWT, but does not offer equivalent to encrypted JWT

Doesn't sound like it solves the problems mentioned in this article.
It’s true they’ve rewarded shareholders and shareholders have rewarded them, but the profit metrics by division are almost trivial in this context. Amazon didn’t turn a profit for nearly 15 years- and not because they couldn’t have. The e-commerce has historically been run at near-zero margin, even willfully running categories at a loss to drive out competitors. As the consumer buying diapers from Amazon you might think you’re just saving a dollar vs diapers.com, it’s low margin so who cares, maybe you’re even sticking it to them if they’re really losing money on the transaction? But then diapers.com doesn’t exist anymore, and shareholders are rewarding Amazon. A single snapshot can only begin to tell the story.
San Juan is the capital of Puerto Rico.

San José is the capital of Costa Rica, but there are also many other cities around the world with that name.
https://www.cnn.com/2021/05/25/us/defund-police-crime-spike/...

“ Homicides and aggravated assaults in the city has increased over the last two years. Year to date, homicide up 26.5 percent over 2020, up 44.9 percent over 2019. Aggravated assault is up 12.8 percent year over year, and 11.3 percent over 2019. Overall violent crime is up year-over-year 5.8 percent, driven by homicide and aggravated assault numbers.”
These devices typically callback to the server and stay connected. Since the client is initiating the connection, there is no incoming NAT necessary.
Once you reach this level of enlightenment ("any session should be revokable and fail closed"), there are still higher levels of abuse you'll need to prevent.

Let's say you keep your user sessions in Redis and replicate active-active between multiple regions. Your service allows for more than one active session per user, and has a second index of such "live sessions" so that users can terminate all of their sessions at once (eg. "Log out all of my devices").

You use optimistic concurrency to update multiple indices and pieces of information. Session mutation events and validations can occur anywhere.

What if an attacker slowly logs in thousands of different accounts, hundreds of sessions apiece, then logs everything out in unison?

Redis is single threaded, and all of your validation reads are going to get jammed with impossible to clear logout events. Replication is going to play these events out in all of your Redis clusters, meaning each of your regions will fall over. Nothing in logged-in flow can be processed, and you're stuck.

That was fun to fix.

I've got so many horror stories... Redis is great, but engineering at scale is tough even with great tools.
And she is the sister of Youtube's CEO. :)
Everyone here seems to have some inside track on McAffe's mental state. It's so ridiculous presumptuous, when we barely have an understanding of the mental state of those close to us.
In Theil’s and Max’s case, the proceeds account for 99.9% of the account’s value, no? The investments appreciated over 100x. Thus the entire position is locked up / faces withdrawl penalty. Maybe the position could be liquidated but the ROI would be lower. As a VC, the action signals such a friendly relationship with the founder that the VC doesn’t care about the returns. That materially affects incentives—- especially voting incentives.
Is there any reason not to use Argon2i or Argon2id over Argon2? Non-public side-channel exploits seem inevitable.
How does this relate to or differentiate eval.ai from kaggle?
I do find it rude that people would go to the devs for issues like that. It's one thing if it's not working on a system that's supposed to have support, but otherwise you should really be figuring it out yourself, or going to the community.

Maybe actually clarifying where the community lives, like WineHQ and ProtonDB do for running Windows games on Linux, would be a good start to help reduce devs having to deal with this sort of thing.
I'm an open source supporter, but why do a open version of Kaggle?
Is not needed.
Stop cloning ideas and claim an open source version, a good product is much more than just the source code.
Yeah, I wouldn't trust company MDM on a personal device at all. Best case is that someone with an itchy trigger finger wipes your phone. Worst case you've got someone deciding to poke around your personal device for shits and giggles.
There's "JWT hate" articles on HN because people keep implementing JWT auth without understanding it - they want an easy, cheap way to do auth when talking to different services, but it can be a huge security flaw since you can't do revocation. There's a lot of ways to configure JWT, so it's very easy to shoot yourself in the foot.

JWT for short-lived tokens is fine - it can work well for signing requests between microservices. If you want to give them to end users, use refresh tokens.

As with anything, the alternative depends on your needs and use case. There is no universal solution.
You could have short-lived JWT tokens so it wouldn’t matter because they only last 5-10 minutes or less. They could be refreshed or if using OAuth, simply redirect an unauthenticated user and they’ll be reissued based on the cookies stored by the OAuth provider… assuming the redirect doesn’t break your app of course.

Alternatives? First, you could live with the possibility that tokens are valid for some period of time after logout because it usually doesn’t matter - generally you delete the cookie and the user is logged out, even if technically they could restore the cookie later. They won’t, unless you’re under attack.

Other alternatives: You could use Redis for session data as pointed out with the random key in a cookie and delete the session when done to invalidate the cookie.

You could also use Redis to keep token IDs that you want to invalidate or block. You could use something like Open Policy Agent to distribute a list of invalidated tokens to each server.

Finally, you could send your JWTs to a centralized authentication service — single point of failure, yes, but you could record invalidated tokens to memory and responses are very quick and easy to audit. With careful planning you could reduce the risks in having a single central service to validate issued tokens.

I’m sure there are other ways to mitigate this risk. The general reason why folks don’t recommend JWTs is because it’s too easy to make mistakes in the validation logic. But the same is true (with different possible mistakes) when you roll your own session cookies. At a certain point I think you have to either assume competence or you have to suggest that developers use identity proxies in the cloud, or frameworks others have written, and never implement this themselves.

But yes, this is a rather transparent advertisement for Redis as a KV session store.
Using JWT in the browser id an anti-pattern for a different reason: they can easily balloon over 4kB if you have groups as claims and now you got to split them and a bunch of other things that are annoying.

On the backend you get similar issues. Many servers default to 4kB header sizes, or 8kB, or unlimited, or anything between there. So now you get to have some fun configuring reverse proxies and node and uwsgi and tomcat and…
The truth of this is he'd probably be blocklisted from FAANG and most of the rest of the industry. This is sort of a lose-lose situation.
> Who wants to carry around two phones just for staying on top of slack during _off hours_?

Why would I be doing that?
The comment thread mentions flying into a city by air. There are taxis at airports without fail anywhere I've been
Do you know today what they will do with these thousands of files on other people’s personal details?

Do you think they will just… delete them? Because if so I’ve got a great time traveling hot tub to sell you
Same here. Mac has had some poor choices (Touch Bar, less ports) but at least the decisions aren’t quite that huge in terms of the OS? Not to mention Apple makes money off devices so you don’t have shitty decisions like ads in search and weird preinstalled apps.
Technically, taking the land of the natives would the "original sin" and everything else involves justifying and maintaining the situation, including the death of those who held the land, the elimination of their children, etc.

"It may sound crazy but North America was previously inhabited and yeah, what happened to the previous inhabitants?"
To me this looks more like a competitor to CodaLab than Kaggle, and seems to target the ML research competition market. It seems unlike Kaggle, it doesn't seem to support things like notebooks, discussions, etc.

I might add that the comparison to Kaggle is added by the OP, I don't see it mentioned on the website anywhere.
It's not a zero sum game. This is such a misleading article. Contributions to a Roth IRA are made after the taxes were already paid. Sure, the money grows tax free, which is what such an IRA does. So what? When the money is distributed, taxes are paid. The only issue is that the writer is engaging in class warfare.
Hasura [0] has a great article on how to make front end authentication as secure as possible.

[0] - https://hasura.io/blog/best-practices-of-using-jwt-with-grap...
That is what I'm looking for. There are clocks that synchronizes to radio signals (for example DCF77 in Germany), but my problem is that the signal is too weak inside my house, and there is no information given when the clock has lost the synchronization. Maybe I look into this and build my own :)
They weren't worth nothing, since they got investors to invest at 500k.
No implementation is perfect.
> By your logic: You are free to invest like him in early stage startups. You will be out zilch, so why not do what he did?

1. Accredited investor rules
2. Please find me a startup which will allow me to buy shares at $0.001/share while simultaneous selling to other investors at a price of 500k[0].
3. If you say to start my own and invest in my own company that I am working for in my Roth, I'll remind you that it's explicit not allowed, and the fact that it's not allowed is the thing that most people are taking issue with.

[0] Yes, that's not the full valuation issue, but it's enough to see that the value at the time wasn't really legitimate.
Yep if you look at the bottom paragraph it's a marketing advertisement.

I suspect the engineers that helped write this article are either very strongly for redis or cringed knowing their content would be used this way.

No system is 100% secure.
Narratives are generated out of thin air. The person could have been perfect and they still could make them look like a suicidal lunatic. Any additional help from past circumstances is lubricant, but not necessary.
We see some of this already on the inverse. FAANGs and their ilk frequently hire and keep talented developers with various forms of golden handcuffs. They could be doing much more to innovate, but the risk/reward vs being a code janitor making six figures is far safer.
I discovered this in my PhD. I spent 3 months trying to automate a process (running a finite element model atop very fragile software platform). I couldn't figure out how to automate my way around the errors the system would give me, every run was unpredictable in duration due to the errors, and I ended up spending a lot of time holding the system's hand.

Eventually gave up on the automation and resolved to spend a few weeks clicking every 15 minutes to complete the simulations. It was very hard to stay motivated, but I got two papers out of it.

The disadvantage is now my CV says I'm an expert at an FEM framework which I never want anything to do with ever again.
Their screenshots only show the cool new bling, I wanna see all the instances where its still the same Win2K UI
No one here is proposing we give this data to insurers.

The poster I responded to is proposing we deny medical science this data, and that we remain remain sicker and more ignorant about health, because otherwise the discoveries medical science makes might get used by insurers who somehow gain access to our purchasing data later (another thing no one here is proposing they be given).
Edit: turns out it's a duplicate article

https://news.ycombinator.com/item?id=27625822
Best Books for Startups
We can't even export Google Docs in its native format. If one day Google shutdown Google Docs, you probably loses your documents forever.
That particular example is absurd, but for a time the CIA World Factbook was one of the best online resource for information about countries
At least radio controlled clocks know then all hands are at the 12'oclock position.
> where they are suggesting any of these things

>> Of course this is fantasy; lobbyists for CPAs and for attorneys would never support anyone who voted for this kind of simplification.

>> And, Congress would f* it up immediately by restarting the "let's use the tax code to reward our donors and punish our enemies" process.

I think it's a bit defeatest to just say that it's just intrinsincly impossible for better things... but I'm maybe reading into those comments too harshly.

They're arguing to rip out everything and replace it with a flat tax + a deduction.

What I'm arguing instead is to do a line-by-line removal of exceptions and deductions, and don't try a "novel" flat tax (instead sticking to a tax with income brackets and different rates, that we _already have_), as it is a better system. And you get the advantage of the optics of "making the tax code simpler" rather than "replacing the tax code".

A universe in which we just removed the number of IRS forms that exist is _roughly_ as good as the universe in which replaced all the forms with one form, except that removing the number of forms and still having a W2 would be much easier to migrate to, and doesn't involve nearly as much philosophical debate (even if the result is roughly equivalent). We don't need a novel solution here, we can just move more towards what other nations do (and where we are actually not that far from!)
Interesting. My experience is that companies that "move fast and break things" have been better at making money and paying me (whereas I personally lean too far in the perfectionist direction). Interesting businesses face a wide range of risks - competition, regulatory, market - and infosec is rarely the biggest one IME.
That's not quite true. Win32 apps that use CreateDialog use absolute positioning for widgets, but the "dialog units" used for that purpose are specifically defined to scale with DPI and font size (one DU is defined as "average width and height of characters in the system font").
What did you find lacking with the VM approach? Have you considered or tried Qubes?

I’m a two-decvicer. It increases the lifespan of my personal computer. And, more often than not, when I have left a job, employers have let me keep the old laptop, saving me from buying a new personal one. Honestly, are you really telling me you’d not own a personal computer? This sounds extremely trusting towards your employer, and puts you at a lot of risk depending on their policies and philosophy.
No solution is universal. That said: use sessions. They’ve worked fine for decades and there’s a 99% chance they work fine for your app.
The Future of Feedback
https://redislabs.com/blog/json-web-tokens-jwt-are-dangerous...

> 1. Logout doesn’t really log you out!

That is true, but if someone intercepts a token then they can already see all the data (or perform all the actions), even before the user logs out, so this doesn't count as a flaw.

> 2. Blocking users doesn’t immediately block them.

Lame. A simple blacklist would suffice.
The blacklist entries would expire after the lifetime of a generic token.
Since the blacklist is small, it could fit in server's RAM and be fast.
Or it could be stored somewhere in Redis.

> 3. Could have stale data.
> Imagine the user is an admin and got demoted to a regular user with fewer permissions.

Lame. Just block the old token on any privilige changes.
All roles are stored in a token anyway, so if a user's priviliges change, then all the user's tokens should be included in the blacklist.

> 4. JWT’s are often not encrypted so anyone able to perform a man-in-the-middle attack and sniff the JWT now has your authentication credentials.

Not even true.
There're no credentials in the token.
There's just a user ID and that's it.

> It’s been found that many libraries that implement JWT have had many security issues over the years.

And Linux kernel has had many bugs.
So what now? Not use Linux?

> In many complex real-world apps, you may need to store a ton of different information.

And storing it in the JWT tokens could exceed the allowed URL length or cookie lengths causing problems.
Lame.
No one uses cookies or URL for that.
No one stores enormous amounts of data in a JWT.

> In many real-world apps, servers have to maintain the user’s IP and track APIs for rate-limiting and IP-whitelisting.

Not a valid argument.
Those apps aren't even many, they're a very small portion.
Very small, almost zero.

> One popular solution is to store a list of “revoked tokens” in a database and check it for every call. And if the token is part of that revoked list, then block the user from taking the next action. But then now you are making that extra call to the DB to check if the token is revoked and so deceives the purpose of JWT altogether.

They aren't very smart, are they?
Because they don't even see a difference between a short in-memory list and a database full of users records.

> Bottom line

Bottom their ass
Geez, even RSA is not secure if you push this thing hard enough. Cryptography is all about making it difficult to decrypt, not impossible to decrypt. One can easily setup a conspiracy theory that the government can record all the traffic, and decrypt the dump in the future when computers are fast enough.
> Note that the lightning emoji indicates a blazing fast speed. And the snail emoji indicates slow speed.

This article was embarrassing, and makes Redis Labs look childish and inept. Whatever process resulted in this blog post should be axed immediately, and this author should not be writing anything public facing.
Transformers from Scratch: Training a Tokenizer
Replacing DX is a tall order
It is most definitely an abuse of IRA's to shield from capital gains taxes this way. It was never meant to be used for this.

On Wall street bets they talk about buying options with IRA accounts (famously wsbgod for example) so it happens frequently and with large amounts.
I don't think you're disagreeing with GP. Maybe it should be binary, but in reality it almost certainly is not treated that way. Trade offs are often made for UX or other business reasons.
Keep in mind that only GRUB needs to be signed, so you could use the Ubuntu GRUB build with almost anything else.
Wisdom of the crowds: means vs. medians vs. modes on 2M+ trivia responses
Default rails cookie-based session storage is similarly stateless on the server, it's just a cryptographically signed packet sent by the client. Does it suffer from the same problems? Are these problems inherent to server-stateless session solutions, is the argument that you need server state?

I think.. not actually. If you store the user_id in Rails session, as is typical.

The OP seems to be complaining about storing a serialization of the user, or the complete list of user auth entitlements, in the session, to avoid doing a user lookup at all... as is apparently common with JWT? I don't use JWT. Can you just store the user-id in JWT instead, planning on doing a db lookup for the user? Is this not something people do?

Or maybe it would apply anyway, becuase you still can't "revoke" a session? It's still true that if someone snooped on your session, they could immpersonate you I think, which is also what they're complaining about? I'm a bit confused by the threat model honestly, it's a pretty verbose post.

> JWT’s are often not encrypted so anyone able to perform a man-in-the-middle attack and sniff the JWT now has your authentication credentials.

Wait.. is he saying literally the password (that can be used to get a new JWT?) is put in the JWT payload, unencrypted? This is a thing people do, really??? It is obviously a bad idea, yeah. Back to Rails, Rails started encrypting as well as signing session cookies a while ago, because of Security, yeah.

The OP seems to be conflating a bunch of differnet things... which is fine if they all apply to standard commonplace uses of JWT I guess, or if JWT is too flexible and allows people to use it wrong... but doesn't make it very clear what the problems actually are.

Still back to wondering if the claim is that ALL no-server-state sessions are bad, or just that JWT is a bad implementation of it, or just that JWT as commonly used isn't being used right (like you COULD encyrpt JWT payload, but most people don't?)

And... it ends up just being a redis ad, really?
Paro.io Is Hiring Senior and Lead Full-Stack Engineers (Remote OK)
Fantastic! I've been thinking about tinkering with clocks lately, Here's why: I recently saw this video [0] about controlling clocks and it made me want to do it too.

[0]. https://www.youtube.com/watch?v=bdnXLv5za-k

At one time I had a backwards clock [1]. It turns out it was the only analog clock in the house so after a while I got used to it. Then I would be jolted back to reality when going outside and seeing a "normal clock.

[1]. https://www.walmart.com/ip/9-quot-BACKWARDS-CLOCK/35002444

And how about these one-handed watches [2]. Ostensibly, they "fundamentally change the way you look at your watch and ... give you a much better consciousness about the progression of your day". True? After my experience with the backwards clock, I'd like to find out. But I don't want to buy an expensive watch, I'd rather make my own one-handed clock.

[2]. https://www.slow-watches.com/24-hour-one-hand-watch/

edits: fixed link and typos
My customized PS1 only contains the current path.

Additionally, I have used git-prompt as PROMPT_COMMAND for a long time, and it's certainly the most useful piece of information.