skysight-inc/HackerNews huggingface dataset:
> JSON Web Tokens (JWT) are Dangerous for User Sessions—Here’s a Solution

Actual title on the website.

Edit: To watch clickbait work in real time, check OP's submit history.
OK, but what's the real alternative here? I'm sick of these JWT hate articles on HN all the time with no universal solution.

Why not just use cookies and be done with it? This looks like an advertisement for Redis Enterprise.
Try to be careful in avoiding binding your opinion or comment to your employer.
Think more of apps that require a file system
> "so I'm on this specific Red Hat version, with this oddball graphics driver and three monitors and full-screen doesn't work with your game properly"

It simply isn't possible that there exists a technophile out there patient enough to set up such a non-Ubuntu rig, yet cave-dwelling enough not to thank their deity for the simple fact that any graphics-hungry software turns out to run at all without crashing.

Barring a copy of the original email and video testimony from the sender, it's more reasonable to believe this was someone trolling you (or perhaps even a team of someones if you received more than one such email).

Edit: clarification
I use an encrypted linux VM with a VPN on my company Mac for anything personal like listening to music or checking email. At least if they were to suddenly lock me out of my Mac, the personal data would be encrypted. If they had a problem with me doing this, I just delete a single disk image file and everything is gone.
IANAL, but I believe you are misinterpreting the clause - the clause disqualifies an officer or 10% shareholder of (subparagraph G:) a corporation that is >= 50% owned by (subparagraph A:) a fiduciary (owner of the IRA).

But Thiel did not own >= 50% of PayPal.
Try the Retrocomputing StackExchange, by the way.

Here is smoething useful. I just randomly picked the IBM 704 (famous for early Lisp work) and researched the architecture. I found this site:

https://sky-visions.com/ibm/

It has info the 704 and other higher model numbers after that. Whereas no exclusive OR instruction is listed for the 704, it looks like 709 got one: opcode ERA, exclusive OR to accumulator. The 709 was introduced in 1957.

OK, we have identified a machine. Next we head to the Software Preservation Group for any code for the 709.

E.g. here is some code that uses ERA, but not for swapping:

http://www.softwarepreservation.org/projects/FORTRAN/source/...

Looks like ERA was popular in 709 systems sources as a comparison operator: load a value into A, then XOR with some constant, and if it's zero, there is a match. I've spotted quite a few uses like that.
This isn’t an inaccurate description of the situation.

What’s happening now is political. The discovery of the Kamloops graves have just elevated this topic in Canadians minds (and the world). The actual knowledge of Residential Schools is quite old.

The First Nations are just being savvy about leveraging it for political power. And that’s not a criticism, that’s how things get done in a democracy - get the population on your side and politicians are powerless to say no.
I'm not sure whether you replied on the wrong discussion or were replying just to the title, but the post is an interesting discussion/profile about Albert O. Hirschman (forgotten economist and author of "Exit, Voice, and Loyalty" etc).
My two laptops cost $600; $300 each.
Almost all companies are effectively anti-innovative. To be truly innovative you need to constantly try new things, without knowing if it will succeed or not, and effectively move what works into production. Almost no companies do this. So worrying about chance meetings is way down the list of things to worry about when it comes to innovation.
> He was accused of making bath salts, and he was reported to be involved with prostitutes and much younger women. His reported statements seem to confirm that, not deny that.

Open and shut case then. So unattributed "reported" anecdotes on the internet are all it takes these days, huh. No wonder it's so easy to smear and bury people.

Everyone here on HN is so strict about online security and providence and yet assign truth to a story based on anonymous anecdotes.
> The weird thing is that none of it is terribly surprising or unexpected.

Have I been living under a rock? I think we may have suspected that the ultrawealthy was not paying their fair share, but paying nothing? Using elaborate loopholes to actually get out of any tax burden at all? I found that to be shocking.
I provide access to my work one from my personal so I can view it on my personal when scheduling events and hide it otherwise. Works pretty well imo.
> Security should be binary. Either technology is secure or it’s not.

From my experience, that's not the case for almost anything. In fact, I'd consider it a dangerous position.
oh yes the par value of stock...

https://www.nolo.com/legal-encyclopedia/what-is-par-value-st...

I think he went the route of his IRA's investment llc membership units being assigned a super large assignment of income distribution vs his initial investment.

just guessing...
HN is full of liberals that hate wealth and want anything you make an excess. That's the beauty of Bitcoin, you can't have what I got
Many politicians also feel that a flat tax rate isn't sufficiently progressive; that only by taxing higher incomes at higher percentages than lower incomes is it "truly" progressive.

OTOH, many politicians do want to see the tax code vastly simplified- they want the sort of system where you could fill out your taxes on a form small enough to fit on the back of a post card.

Everyone has their favorite thing that they want exempted (farms, capital investments, social security / welfare disbursements, medical expenses, school expenses, mortgage interest, rent, etc), and there are millions who would be put out of work by it- accountants, tax preparers, much of the IRS would be redundant, etc.

All of these competing interests keep us where we are. Blaming it on the "rich people" is lacking in any sort of honest intellectual rigor.
Holy hyperbole, Batman.

This is just a straight marketing post for Redis.
>Then an expression like (Foo bar (Baz qux)) could be rewritten as (Foo bar Baz qux)

Until you want to pass Baz as an argument of Foo. I understand the value of sugar in a language, but I also think that sometimes you don't need more than one way to skin a cat.
I mentioned elsewhere, but I run an encrypted linux VM for anything personal and run all its network traffic through a VPN. I think it's a pretty good compromise between mixing work/personal, and carrying two laptops.
What is closed about kaggle that this does differently? I've always viewed that community as extremely open, even allowing hosts the option to open source solutions or not, thus attracting more challenges and competitors.

The about page [1] for this project says,

> With EvalAI, we want to standardize the process of evaluating different methods on a dataset

Standardization often does come from openness, I'm just not sure juxtaposing against kaggle is the right move.

[1] https://eval.ai/about
Can this company beat Google at its own game?
Can one hold and trade crypto in such a vehicle?
Saying that liquidity reduces is a fallacy that was believed quite heavily pre-2007.

Liquidity does not reduce risk, it has no effect on risk because it has no effect on outcomes. If you invest in a stock that goes bankrupt, there is no way to get out of that decision with no cost.

Equally, someone is only willing to supply that liquidity if they get something in return. So in those worst cases, you will usually not have the liquidity that you think because someone needs a return for taking the elevated risk in those situations (and again, that risk doesn't go anywhere, liquidity just shifts that risk to someone else).

Look at the market, is there really a deficit of risk-taking? I think there is a deficit of understanding of the risks but there is a massive excess of risk-taking in pretty much every asset class.

I also wouldn't associate illiquidity with return either, that is quite wrong. The decentralized market-making model that we have minimises costs and maximises liquidity but this is just a net gain for investors (due to the clear demarcation of types of risk-taking within the system). There is no real illiquidity premium, and the societal gain from higher liquidity is just a pure gain for the system (again, I am not saying it reduces risk, it does not but it does reduce costs, increase transparency, and produces a system that is robust relative to bank-led financing systems common in Europe, for example).
Ya, I hate to be pedantic too, but security it almost entirely NOT binary. It should be, but it's not.
The competition was in 2015[0].. perhaps the title should include 2015 (when the competition closed and Argon2 won) or should be adjusted to "Argon2 Hash Generator & Verifier" (the name of the linked page - unrelated to the competition)

[0]: https://www.password-hashing.net/
No shame in my #3 above. I'm not an expert, but typically multiples range from 1-4x annual profit, but I've heard through the grapevine that some folks are paying 5-10x. So absolutely list on MicroAcquire.

If it's very profitable, then they might consider talking to FEInternational (or another firm like them). They take a cut, though. But they do pay referral fees, so make sure you get that cut!

Edit: Before someone says I'm crazy for saying things sell for 1x annual profit, I'm not saying that's typical for a brilliant business. It's more typical for something with heavy maintenance, or with really low profits. If you're really interested, check out the link in my bio.
I believe you but anyone got links? This is interesting information.
Yeah, I mean it sucks. Investors want returns. Employees want competitive salaries. There’s lots of greed in the world. I don’t have any answers for you, I’m just trying to help really smart people move the needle on this cancer thing and yeah, I like that I get paid competitively.
So all your data is stored offline and (presumably) on-prem? What if there's a fire?
The top 1% by what? Income?

Here's another one: the top 0.001% make 0% of the income and pay 0% of the taxes.
TDLR;
Use Redis to lookup your user data in realtime, instead of signing a token and trusting it.
I prefer the actual SBB clock in that its second hand sweeps smoothly, where as the second hand on the Mondain watch ticks. It's the combination of the smooth sweep and the stop that make the railway clock. Each revolution is a reminder of the elegant idea of making a clock from an imprecise electric motor and and accurate stall mechanism.
This article "50 Years of Data Science" by David Donoho (2017) had a sharp point about Kaggle-like competitions being under-valued by stats:

"To my mind, the crucial but unappreciated methodology driving predictive modeling’s success is what computational linguist Mark Liberman (Liberman 2010) has called the Common Task Framework (CTF). An instance of the CTF has these ingredients:
(a) A publicly available training dataset involving, for each observation, a list of (possibly many) feature measure- ments, and a class label for that observation.
(b) A set of enrolled competitors whose common task is to infer a class prediction rule from the training data.
(c) A scoring referee,to which competitors can submit their prediction rule. The referee runs the prediction rule against a testing dataset, which is sequestered behind a Chinese wall. The referee objectively and automatically reports the score (prediction accuracy) achieved by the submitted rule.
...
The general experience with CTF was summarized by Liberman as follows:
1. Error rates decline by a fixed percentage each year, to an asymptote depending on task and data quality.
2. Progress usually comes from many small improvements; a change of 1% can be a reason to break out the champagne.
3. Shared data plays a crucial role—and is reused in unex- pected ways.
...

The author believes that the Common Task Framework is the single idea from machine learning and data science that is most lacking attention in today’s statistical training.

https://www.tandfonline.com/doi/full/10.1080/10618600.2017.1...
TL;DR as always, is that there's nothing wrong with JWT. The problem is with thinking that there is a way to have an authentication token that isn't persisted in any way, so long as you want the ability to invalidate a token (i.e. logout, user banned, password change, etc).
I'm hoping experts will arrive to tell me why I'm wrong - but I think you just buy stock in your LLC at whatever price, or you can loan the LLC the money at whatever terms.
This doesn't only apply to the way JWT tokens are usually used for sessions (no persistence). The default session store for Devise (Rails) and .NET Identity is cookies, on the client. They are encrypted with a secret key and decrypted for authentication. Identity in particular allows you to store any number of "claims" in the cookie, such as a username or role. Because the cookies are signed and HTTP only, this is safe from attackers, but this method, along with pretty much any method that isn't storing some sort of state on the server, has the same 3 problems listed in the article.

1. Logout doesn’t really log you out!
2. Blocking users doesn’t immediately block them.
3. Could have stale data

I know there are ways around this with a really fast refresh time, or as I've heard, storing some sort of signature in the cookie, but I personally prefer a plain old server-side session store with something like Redis, or even just an in-memory HashMap. Authentication doesn't have to be that complicated.
The words "looking at your bio, I'd guess" are so reliably a marker for bad HN comments that I'm a little surprised the site doesn't auto-flag such comments. The guidelines ask you not to write things like this here.
I once watched a presentation about Macarons [https://en.wikipedia.org/wiki/Macaroons_(computer_science)] that is purportedly better than JWT. Are there any good success stories about using this?
I hear you. But I’ve also learned as an engineer that nobody really cares to hear from you how difficult and impressive it is.
It's actually pretty standard practice, and it makes sense. If your phone gets stolen, and it has sensitive company data on it, then they need to ensure their data is wiped.

In the case of the Microsoft Company Portal app, and enrollment in InTune, a separate work enclave is created, at least today. The enclave is fully controlled by your company's InTune policies, but your personal enclave remains untouched. It's how MDM should be.
There are many people still living who were teachers and administrators at these schools.

If we believe that this was genocide (and I think it's pretty obvious that it was), then they should be held accountable for their crimes.

The fact that they haven't been speaks volumes.
Snake for Figma
I just want our intelligence agencies to kick out a website so we can use them as a taxpayer-funded backup service for personal information.

Me: "Hey, CIA? My ex-girlfriend once sent me a message about her favorite Indian restaurant. I'd really like to try it, but deleted all of our messages like five years ago."

CIA: "Got you fam. It's actually Nepalese..."
Definitely use cookies. Opaque tokens. Works great.

All the good versions involve cookies somewhere - they’re the most resistant to all the various forms of attackers on the web.

Many use cookies in order to stamp short lived tokens, though.
it serves their entire ecosystem, what next, users loading PWA and bypassing their entire ecosystem? heave fordbid!

apple is like the malevocence of hardware software walled garden, they make it easy to do what makes them tied to the platform and e erything else a struggle.
Refresh tokens are the real alternative, IMO.

I kinda agree it looks like an ad for redis, since it doesn't even considers alternatives.
There isn't some unified hive -mind organization that controls "western jails". It could be some particular bloc with an agenda that took him out
I assume the IRS had them stolen but perhaps you are correct and it was an IRS employee who feels like this is a noble thing to do.
I know you're joking but to stay on topic, you still have to even get them to even admit they have your data, since it's supposedly illegal. Thanks to Snowden we know, but even in light of those leaks, they have and will probably continue to lie during Senate/Congressional hearings. Once we get past that hurdle, then we can talk about restoring your illegally captured data ;)
Ok, here is my problem...

I’ve dabbled in NixOS, I have it installed in a second desktop under my desk, and occasionally use it for Linux tasks...

Most of my Linux projects though have been doing stuff on raspberry pi or pine phone, or any of these sorts of little machines, where I’d really love to run Nix... the problem is every time I start digging, they seem to require already a lot of Nix experience, and expecting that I’m already on a nix machine to create and burn images, etc...

But where is like the image I can just download and burn from Windows to an sdcard, or at least really simple instructions to get that image from an nix machine?
Incredibly shallow and dangerously bad hot take. I think you have a very poor understanding of what "security" is, nor the concept of backups in general which necessarily (like security) have a very strong human factors requirement. A backup which is too much of a PITA and requires nearly any level of manual effort simply isn't going to get used much or maintained well at all by the vast majority of the population. Tools and systems exist to serve humanity, not the other way around, and when a system fails badly for many it's not humanity that must all change, it's a shitty system.

Fact: if these people had been running to a decent cloud service, they'd probably still have their data. Really "don't connect backup to the internet" is like, fractally stupid. The more one digs the more stupid angles turn up recursively similar to higher level stupid. "Don't connect backup to the internet" means what to you? What about the computer itself making the backup? If that is connected it could get infected as well, now what? Everyone is just supposed to give up on all networks entirely because "hurr durr nothing on a network is secure"? Which is wrong anyway since security an economic equation, not some ethereal absolute. I hope you never give this advice to anyone IRL.
“Expects” is a stretch. “Encourages”, “wants”, “likes to” more like.
Do you think he scours the internet for idiots who defend him so he can give them lots of money, or is this more of a kink situation where you get off on defending the rich in general?
maybe the HN headline should be edited to specify that this is WD My Book Live that was affected.
You can start a Directed IRA and literally buy and sell whatever you want tax free.
Setup Guacamole and remote into your personal device with just your web browser.
Reverse DNS was an interesting idea, but I tested connections from clients who have name entries in the hosts file, and still no luck.

Thanks though!
As a European, this is one of the most frustrating things when I visit the US. When I see a price here on a menu or in a shop, I know that's pretty much always the price I will pay.

Some restaurants (usually aimed at tourists) have a surcharge for large groups, or a cover charge of a few euro, but that's it. A tip of 10% is usually nice to give, but if you don't (especially now, where nobody has coins) you won't be chased out the restaurant.

When you buy something in a shop, the price you see on the shelf is the price you pay. I can understand in a way why it works the way it does in the US (you want the label on the item saying $25 sold in different cities/states with different taxes), but it doesn't make it easier for the consumer.
> You think that the legislature exists in a vacuum? That it writes out all these loopholes for fun? That other nations are just broken with their simpler tax code? This is yet another "American exceptionalism" thing where _somehow_ America is the only developped nation in the world with this level of issue yet seems to think it's sort of... intrinsic to the world.

I missed the part where they are suggesting any of these things.

> If you believe what you say, just argue to remove various deductions and exemptions.

That's exactly what they are arguing?
How would you handle stocks not paying a dividend? It is a clear moral hazard and with a flat tax you could expect even more companies to adopt this practice of only doing stock buybacks.
We don't have that luxury. It would be nice though!
Most Sites shows ads through Google AdSense. Most web searches are through Google. Makes sense for them to try and send you to properties where they might make some more money off of you.
Yep, that's the way to go. I do the same. Easy to do with Google Calendar.

In your work calendar: Settings -> Settings for My Calendars -> Access Permissions -> Get shareable link.

In your personal calendar: Other Calendars -> Subscribe to Calendar

With this, I've managed to remove all other traces of work from my personal phone.
Is the loophole investing well?
I respectfully disagree with both of you. Security should be binary, within a given set of requirements / implementation parameters and the intended threat model. Security must be binary within the space of “are you authenticated or not” (within the massive context specific web of trust and private keys) is binary and if it weren’t that would be a problem.
Democratic socialist clinches Buffalo mayor race
Is your assertion that authority figures are to be trusted and fleeing them proves guilt? Is this deference to authority provided to China and Russia as well?
Those who die from vaccine-related complications are not classified as Wuhan Flu victims, I presume?
Agreed. Long(er) lived refresh tokens, and then having signed access tokens such as JWTs so that the API server doesn't have to hit the database on every request.
Not the most environmentally friendly and may be against company security policies in certain places, but if you’re going traveling you could leave the work laptop plugged in and remote if disaster strikes (part of the point of this is that it shouldn’t be routine).

As for me, I’ve done the two-laptop thing when traveling since 5y or so. It’s actually worth it for other reasons too - having your only computer have a hardware failure or be stolen in the jungle is no fun. If both are of the same make you could even boot one’s drive off the other in a pinch.

For all the “what about X?” questions in this thread... you will figure it out easier and faster than you think once you force yourself to change habits.
Shh that inconvenient truth doesn’t fit the narrative.
Well the issue with CA was that users who installed the quiz not only shared their info, but also content shared privately by their friends.
> There doesn't seem to be any nuance or respect that they're trying to repair an orbiting telescope that was launched 30 years ago and designed 40 years ago - and that people are patiently trying to sort through a fully autonomous system 400 miles above the surface of the Earth with a very large set of failure options.

That's what the article says. The headline is clickbait.
JWT, while having shortcomings have the advantage of decoupling systems by enabling token validation and user data retrieval without having to communicate with the auth service or the database directly. Worst case, with the approach from the article, every component has to make a call to the database, becoming dependent on the data schema, etc.
Plug a good channel related to this called Not Just Bikes on YouTube. He does a great job tearing apart North American urban planning and housing and compares it to examples where the author currently lives in Europe. I want to be able to live in places like that but I’m stuck in the US. Here is an example where he also compares new planning to how we used to do it. These old compact suburbs that have become expensive because they’re incredibly desirable. Yet we don’t build like that now.

https://m.youtube.com/watch?v=MWsGBRdK2N0