skysight-inc/HackerNews huggingface dataset:
They'll just see how bad the complaints are about weird UI choices and privacy, and then release Windows 12 which will be a return to Windows 10 except with less control over your computer.

No strong evidence that this will be the case other than Windows 95/2000, Windows Vista/7, and Windows 8/10.

As best I can tell from the last 25 years, alternating releases are basically alpha versions that everyone is forced to pay to test for them.
It shouldn’t be, either. Things evolve around it, definitions change, but also things need to be less secure because of convenience or necessity. An emergency stop button that halts machinery, causes damage to the machines, stops production, but saves lives, can be the target of any number of imaginative scenarios of malicious actors hitting the button to cause damage or be a part of some grand hacker scheme. But we definitely don’t want to secure that until it takes badging in and a 2FA prompt just to use it.
But security through obscurity is a valid part of a security methodology, and it’s a part that inherently a continuum rather than binary.

For sure some aspects of security are binary. But even with JWT (I agree with the main points of the article), a token with an expiry of 5 minutes but no revocation capabilities is still objectively preferable to no expiry at all.

The binary aspect of security is primarily about whether you fall within your risk appetite or you don’t.
No reads like a list where each clause there is separate so being a director or officer would be a disqualified person.
An exchange usually makes more when people trade more ("we're in the moving business, not the storage business") and stocks are more volatile, so from one angle it would seem like the very worst place possible to try to encourage long-termism.
It's an ad for Redis.

If you're spending too much time looking up the credentials associated with a session cookie, you're doing something wrong. Maybe you need a cache. Sure, sometimes it won't be in cache, but it probably will be.
I don't know, this one fits the franchise more:

def should_terminate(Person):
"""Check whether a Person should be terminated"""
try:
return True
except Exception as e:
return False
Ironically, a week before I left one of these companies, they remotely wiped my work laptop. Someone got the memo wrong, and I spent the better part of my remaining time with them trying to get access to all the various systems so I could complete one bug ticket. I hate to imagine what would have happened if I had given them access to my personal phone.
I think that was the poster's point.
> That was the message from Microsoft employee Jerry Nixon, a developer evangelist

That was just one employees comment at initial release and the guy probably just intended to communicate the idea Windows 10 will get continuous incremental features updates for a very long time without version change not make a lifelong promise they'll never make another version again (even though that's the literal meaning of what he ended up saying).

Upgrade wise it'll be free and automatic just like any normal Windows 10 update assuming your hardware qualifies.
I got this.

The "Mechanics License" is an informal certification that all reputable technicians in the US employ and is widely recognized. It's a form of de-facto licensure that's easily recognized at a glancing distance, and serves to ensure that a mechanic is not going to leave on a moments notice, without at least bolting a wheel on. Instead, he or she will tell the foreman or whomever's name is on the sign, likely to call a tow truck for Friday.

It goes like this: Once a young apprentice lube tech graduates from Harbor F. University, an unusual ritual occurs in most mechanic's shops where a large, diesel, truck with a lift gate and a Square terminal approaches.

A nondescript individual emerges from the truck, (slowly, as to not alarm anybody who has a pending tab) where our young acolyte is soon taken gingerly by the hand and ushered onto this mysterious conveyance.

Seven or Eight hundred dollars later, the young, oily apprentice emerges holding a shiny, new, silver gun and possibly a ratchet and a t-shirt or pocket protector.

Most seasoned veterans will recognize this as their Mechanic's License. It's good for brake jobs, mostly.

If you foul up to many times in the shop, they call the MAC or Snap-On guy who will gun it in his diesel and demand full payment for the impact tool and ratchet. They usually get to keep the shirt though, because, yuck, you know?
Clojure uses the underlying host's GC (e.g., JVM, CLR or JS engine). It also typically generates rather more garbage than other languages may due to immutability by default. As with all things, you can avoid the garbage if you are willing to abandon the usual idioms.
Taiwan Semiconductor Is Hiking Chip Prices Up to 20%
This lists several countries with a media tax. I wonder if its still the case.

https://en.wikipedia.org/wiki/Private_copying_levy#Regulatio...
Here's a list I put together last year of similar sites, I just added Tiny Acquisitions to it. Disclaimer, haven't looked at this in a while, some may be inactive.

Marketplace
https://microacquire.com/ - SaaS
https://flippa.com/
https://empireflippers.com/ - Focus on Amazon but also SaaS and other online businesses
https://exchangemarketplace.com/ - run by Shopify
https://latonas.com/
https://websiteproperties.com/
https://www.sideprojectors.com/
Investors.club
https://app.centurica.com/marketwatch
https://tinyacquisitions.com/home

Brokers:
https://www.quietlightbrokerage.com/
https://feinternational.com/
https://digitalexits.com/
https://thefbabroker.com/
https://www.websiteclosers.com/
https://www.globalwiredadvisors.com/
https://helloexit.com/
https://www.wearebarney.com/
https://acquisitionsdirect.com/

Listings only:
https://www.bizbuysell.com/
https://www.businessbroker.net/
https://dealstream.com/
https://www.businessesforsale.com/
https://www.loopnet.com/
Why Is It OK to Be Mean to the Ugly?
Its kind of surprising to me how obvious it has become to compare % as more or less instead of absolute numbers. I dont know anything else but taxes that people use this notion.

30% of a small number is a lot less than 10% of a massive number. Most definitely PT has paid a multiple of taxes than middle class: millions upon millions of it.

The most common justification is the subscription to the punitive usage of taxes: if someone has money, he should be punished more and more for it.

Maybe you could use another framework and say, how much of taxes and public services do you consume and how much do you contribute. And I assure you people like PT are very much net providers, whereas middle class will very often be a net consumer.
In general, I agree that sessions should be opaque tokens stored in an http-only, strict same-site policy cookie. I just had a few problems with a couple of the arguments:

> 3. Could have stale data

The only use case I've seen for storing authorization information in a JWT is for something like OAuth2 scopes, which is different than strict authorization rules. They're more like delegate rules, but you should only treat those as a first line of defense before you do the checks that the authorizing user actually has access to.

Also, it's just as easy to let a redis cache go stale. Seen it more than once with this same security issue.

> 4. JWT’s are often not encrypted so anyone able to perform a man-in-the-middle attack and sniff the JWT now has your authentication credentials. This is made easier because the MITM attack only needs to be completed on the connection between the server and the client.

If someone can MITM your connection in plaintext, they have your credentials, whether or not you use a JWT. Yes, any information you encode in a JWT is plaintext, so if you put personal information in there, consider it leaked. Am I missing the argument here?
A tad late but I missed this before. You're spot on, we (ironically) didn't do a good job at explaining our own game haha.

I think it's roughly:
"It's hard to find docs -> A filter on your browser history helps a lot"
That's why I become a software engineer. I would like to host the services and use cloud as backup.

Right now, the only thing bothers me is the email service. For a selfhosted email service, there might be some problems.

For example, I would like to sign up FB by my custom domain email address, but after roughly two days they treat me as bot and ask for cellphone which I don't want to give them. Because there is no way to delete the cellphone later. The function on their setting is not working. Even if you deleted the cellphone on setting page, you could still get targeted AD by hashed cellphone information. It seems like they use hashed information as the way to against user deleting.
Hiring Hackers These Days
I am not here to tell you the exact way to hire hackers but I will suggest you always hire a hacker ONLY via the deep web but you must be careful when accessing the deep web because if it is done wrongly, you might be vulnerably too. DarkBasin.be is still one of the platforms as they always screen their hackers. SniffingnoseATrepairmandotcom wold be my Fav as they had more reviews on Phone hack.
FYI never contact any hacker or make payment with your personal details.
I'm wondering if we can use Pub/Sub to push revocation data to all servers. Presumably revocations are rare, plus we only need to store them only for the JWT validity period, so additional memory usage should be minimal.

The downside is it looks more brittle than the simpler approaches. Upside is performance plus ability to revoke tokens.
Aren’t JWT tokens only supposed to be good for 10-15 minutes? I know using flask-jwt you have to go out of your way to make them last longer than that and it isn’t recommended.
None of your security postures will fly at any organization with an infosec team.

AuthN/AuthZ is one of the most important areas to lock down.
> If you think about it, these constant debates themselves should be a red flag because you should never see such debates, especially in the security realm. Security should be binary. Either technology is secure or it’s not.

Hm. I'm not sure this actually matches what I've learned reading from security experts....

What do other readers think?

I am sympathetic to the idea that it's suspicious that there are so many "debates" about a security topic. But I don't think security is actually all-or-nothing/binary. It depends on threat models, risk tolerance, budget, etc.
That's fine, there's plenty of reasonable debate to be had about specific policy reform, but OPs main point, to me, is how exactly do you intend to get Congress too enact it?

Their campaigns are bankrolled by the people benefiting from the loopholes.
Someone got radicalized this past year.
I like working like this too - I want to be able to work when inspiration strikes, or when my customers need me, and not be forced to busywork when it's not necessary. Of course, it helps that my work is really my hobby and, to some degree, what I do for fun.

I also want to be fairly compensated, though, and if I'm lying awake at 4am solving the hard problems because I'm so engrossed in my project that I'm dreaming about it, the only really fair compensation is a percentage of the profits. So for me, since nowhere I've worked is willing to contemplate a profit-share arrangement, this kind of work only really works if I own the company.
controlling eye balls is the business model of the 21st century. ads, games, videos, vr, the entire web itself. globalization has brought down the costs of production orders of magnitude lower to produce than what they cost before it. the entire global system is designed on the premise that it is possible to sell to Americans cheap products that requires them to work more and more for new shiny things.
That's the problem. Unless you're doing something which does a very large amount of work on the client, you should not need WASM. Game engine, yes. Blog, no. Shopping cart, no. Scrollbar, no. Snooping on the user's mouse cursor, NO.
> I 100% agree Thiel has broken no crime and I think you should be embarrassed to say that the people who created the Roth intended this. There is no evidence of that. We should recognize that this Roth IRA is sheltering more money than people expected and make (or refrain from making) regulatory changes in response.

I remember when I was young and maxed out my Roth, also converted a lot into it, and a tax accountant warned me that the government could change the rules so the gains are taxed. I thought, "no way, they couldn't do that!"

Now I see they very well could as a response to arguments such as yours.

I can't say I'm a fan of Thiel's business or writings however many of us rely on Roth remaining as-is. It already has limits. Thiel simply made good investments. We shouldn't punish that unless there was something like insider trading occurring. And that should not impact the existence of the Roth.
Yeah, I 100% relate to this, and I bet a lot of people do. I would wager that ADHD like most things exists along a spectrum, and that its symptoms in mild cases can be coped with. I'm sure there's a point at which they becomes impossible.
That's a weird take on this change. Centering the Start button is less touch friendly. When you're holding a tablet, your fingers are near the sides. The center takes the most effort to get to.
Haha thanks!

If you're curious, we're keen to monetise with a 'Team' plan eventually. We intend to keep everything that's there today free.
Right.

The problem then is that people - Us - all of us here on HN - frequently fail to understand their project requirements or at least fail to anticipate the future requirements of a project - and we’re arguing about what those requirements should be :)

And it’s not just people under-estimating things: it’s too easy to us ambitious-types to think “what if this simple PHP project goes viral and we need to scale to millions of users overnight?” (Answer for the curious: it won’t) - which in turn makes people think using stateless tokens is fine (well, it is fine, actually - provided you have a revocation system; TFA’s title is just clickbait, and the problems are hardly unique to JWT: almost every web platform’s built-in authX system will support stateless user-info and authorisation and use it by default… if not always and by-design (ASP.NET’s ClaimsPrincipal, Kerberos, etc). (Note I’m not referring to server-side session-state (like PHP’s $_SESSION) which is not intended for authX nor does it scale, for reasons mentioned in the article)

The article is a contrarian-sounding ad for Redis, written by a Redis employee, on Redis’ own website. Why are we treating it like news? And why am I even writing this retort? Argh! HN’s content team know how to drive my engagement! I’m doomed…
So if there were more people who had it by July, 16m more than originally figured, maybe we were closer to gaining herd immunity than figured back then. I had it end of December 2020, confirmed by testing, but I am pretty sure I had it January 22, 2020, when there were no tests, because I went to the hospital with a high fever, no congestion, tested negative for flu and strep, and felt weak for two weeks. My wife and I had been to two or three Asian markets in NY/NJ and spoke and ate lunch with many Chinese tourists who had come to celebrate Chinese New Year with their families over here. Funny thing is that I had lived in China for 7 plus years, and I had been to Wuhan. My friend told me about the lab near the wet market, and we both said it probably escaped from there and had a great talk about the Andromeda Strain. I mentioned the lab at work without implying it was malicious, but possibly an accident, and got the looks. The irony is people always viewed people who believed in UFOs or aliens as fringe, and now look. Life is just getting stranger by the year. I am going to go watch Lifeforce for the tenth time now... ;)
Both in corporate and open source settings, I find the most difficult part of documentation to be how to organize it. There is a huge amount of good information out there, but it's incredibly difficult to find. I have this problem as a user all the time, but even when I'm creating the docs I'm not sure how to make them more accessible.
WSL2 runs in a VM with host OS integration, and I assume this is how the subsystem functionality of the NT kernel is used in WSL2.

WSL1 is the "Linux as a subsystem of Windows" thing I described.

Note that WSL2 is not a complete upgrade from WSL1, and WSL2 does not render WSL1 obsolete. They each have strengths that the other does not.
About 20 years ago, when I was living in Yorktown Heights NY (in Westchester county - a pretty high end county just north of NYC), we had to call 911 once because my then wife slipped on the ice and fell when she returned from work late night.

I called and said what had happened and within a short time we had police, ambulance and a fire person show up (I guess they were all bored).

IMO that's part of the problem in US policing: The assumption is that the people are bad (in my case that I had hit my wife I guess - I was interviewed by the cops before she was taken to hospital for a checkup). I called 911 for a medical emergency, not a criminal issue so why do cops have to come and treat me like a criminal. If you think that something is wrong then you find a way to find something wrong.

I wrote a blog about US policing a few years ago because I feared for my son's safety: https://medium.com/@sanjiva.weerawarana/police-in-us-need-to....
It always amazes me how quick people are to needlessly take away freedoms and fuck others over as a knee-jerk reaction.

Putting restrictions on others should have careful thought and clear rationale.
> but being in a position to decide what what your taxable income will be is a loophole in itself

mmmm not a loophole, the government encourages entrepreneurship and created tax deferred plans because social security is flawed and inadequate and pensions also shouldnt be expected by the general population

Having a self directed IRA with some good trades in it is the expected outcome
Nightmare – intro to binary exploitation / reverse engineering course
no question but congrats! remember when i first herad about LTSE, it sounded a bit unrealistic but cool to see its being adopted.
I used to work with a security guy who tried to make it a policy that staff would have to hand over their social media logins to make sure that they weren't talking to anyone or having any conversations that were "suspicious".

Fortunately that idea was beaten to a bloody pulp by the HR team before it got off the ground. But you would not believe the mall cop mentality in many companies.
Why does PHP use \ instead of / for namespaces?
e.g.

namespace Foo\Bar\subnamespace;

instead of:

namespace Foo/Bar/subnamespace;

it seems like, in 2008/9, when the decision was being made/implemented, the arguments were around whether or not to stick with the '::' operator or find some new symbol.

as a much more casual coder, i find the backslash operator annoying.

and it's the type of aesthetic thing that bothers me more than other things that seem to bother other folks much more -- alleged less than ideal type coercion, etc.

i'm assuming using the forward slash, '/', was just a non-starter, but....was it?
Better yet, they can only invest in blue-chip companies
I felt that by page 180 or so it really starts to hone in on Slothrop’s journey and it stabilizes. You can page back to revisit a character you faintly recall. It was around then I felt I had a grip on it.
And, right to cancel AUTO-UPDATING!!!
Parents are and should be deciding the set of values and skills their children acquire. As the Amish demonstrate, there are ways to mix tradition and modernity in a functional package.

However, it is highly likely that indigenous American parents would rather choose a modern education for their children. The myth that the indigenous American parents, given an informed choice, would somehow condemn their children to a life of deep poverty, malnutrition and disease outside of the industrial society is just a myth. Like indigenous Europeans, the vast majority of indigenous Americans would rather join the modern culture and enjoy the fruits of its incredible wealth generation structures. Small isolated pockets, like the Amish, notwithstanding.

To those glamorizing preindustrial lifestyles, take a summer off your cushy six figure office job and go live in an unelectrified hut on some remote mountain, living off the land. With your spouse and kids. Wake up as soon as the sun rises, do hard labor all day long (e.g. manually mow a meadow with a scythe), eat polenta and maybe a bit of cheese, crash for the night, lather, rinse, repeat. Chances are you'll last less than a week. How do I know? I lasted about 10 minutes.
Windows is "POSIX compliant" still, whatever that is worth. Are you sure that was a subsystem?
I do want to follow up - there are two parts of JWT issuing that are problems and why I prefer using JWTs only issued by OAuth providers (third-parties that know what they’re doing) - 1. JWT tokens you issue yourself might not have expiry dates in them - I am assuming that your JWT tokens are valid for a reasonable duration such as 2 hours or less, otherwise you should probably use a different technology - and 2. Like SSL, you will have to rotate the credentials used to sign the JWT, otherwise anyone could pretend to be anyone else, at any time.

So it’s not that JWTs don’t have risks but the risks are overstated. It would be like saying never use Redis because by default it doesn’t have secure SSL or a proper password system and thus anyone could access it. Security isn’t easy, but it can be done, and often looks like a series of mitigations, monitoring tools and trade offs… such as how long sessions last, or planning for features like key rotation or session revocation in advance…
While it would be fairly complex to coordinate multiple systems to simulate a UAP, it certainly wouldn’t be impossible. It also would not be out of character for the US government to run an exercise to measure how a military unit would manage themselves in an unusual situation. I am not saying that is what is happening here, but it seems certainly more likely than some unknown foreign super tech, aliens, extradimensional beings,time travelers, or unknown terrestrial intelligence doing it.

Occam’s razor and all that…
These articles are uniformly terrible. They all and this one complain about stateless authentication systems and describe stateful systems as better. Probably, at small scale. Choose stateless systems for greater scale and reliability when you have to and when you have the capacity to make the careful choices and compromises that come with it.

But JWTs are neither here nor there. JWTs are stateless if you put the user information in them, and stateful if you put the state lookup token in them. JWTs are a format, not an authentication system.

Never ceases to amaze me when marketing content makes me think less of a company.
That does not make sense. Then the clause would disqualify "an officer" of anything.
I’m still not really following, what are you saying about assigning income distribution?

But so the way the article made it sound then is his IRA paid for the shares at par value ($1700 = 1700000 shares IIRC). Even though they were of course worth more than par value, so then he owes money to the company for the difference but if that wasn’t paid out of the IRA that would seem an incredible and surely illegal tax dodge so I don’t think that could be the case.
Not if IT can remote desktop into your work device while you are doing personal stuff... a separate device is much better.
Would you mind sharing more details about that "encrypted linux VM with a VPN", I would like to get something similar going on my company macbook.
And to be fair, Pynchon reiterates that quite a bit throughout the novel. And it is a fascinating thought every time. Terrifying really.