skysight-inc/HackerNews huggingface dataset:
Anecdotally I see the source of security issues with auth[n|z] and/or JWT in general as lack of developer education or miseducation due to pervasive misinformation that so many (inexperienced)? coders post and share on YouTube, Reddit, and blogging sites.

The top examples of misconceptions I see being spread:

- JWTs are encrypted or secure in-and-of-themselves. You CAN encrypt JWTs, though I don’t think I’ve ever seen this, and generally speaking they won’t be encrypted, just signed. The best practice is to not store private information in a JWT. I’ve seen suggestions to include PII in JWTs since “cryptography” is used - incorrectly thinking this means encryption or not knowing the distinction between encrypting and signing

- Base64 encoding as encryption - Posts/videos explaining the HTTP Authorization header is “encrypted” using Base64. I have no idea where this comes from other than complete ignorance

- OAuth2 - I see lots of click-baity titles targeting beginner coders using variations of “How To Authenticate Your Users with [O]?Auth and JWT”, and the post/tutorial/video goes on to regularly conflate authentication (OIDC) and authorization (OAuth), and conflating use cases or distinction between sessions, cookies, JWTs

I am sorry for nit-picking, but the author says:

>In many complex real-world apps, you may need to store a ton of different information. And storing it in the JWT tokens could exceed the allowed URL length or cookie lengths causing problems.

I am not sure I understand, is the author suggesting that JWTs are embedded in the URL? I’ve seen codes that are exchanged for a token embedded in URLs, but this one is new to me. I’ve only ever seen or used a JWT within the HTTP Auth header (eg Bearer <token>).

Additionally, the author says:

>It’s been found that many libraries that implement JWT have had many security issues over the years and even the spec itself had security issues. Even Auth0 itself, who promotes JWT got hit with an issue.

Uh, ok, I guess since software or specifications can sometimes have a bug, they can’t ever be patched or revised with a new version, so we shouldn’t ever bother using computers… seriously, what kind of argument is this?
The placebo being what, exactly?
Hahahahahhahahaha. You might have a point with the likes of Debian, Arch, and Gentoo, but Ubuntu, RHEL, CentOS, Fedora, SUSE, Oracle Linux, Amazon Linux, Rocky Linux are all maintained by corporations.
Hello Fastly, sorry to hear that you're struggling. I'm no expert on advising you or anyone through what you're going through, but there's an above average amount of mental illness and alcoholism and intergenerational violence in my family - all four grandparents were alcoholic and have seen a lot of scorched earth approach to life, but in every case there was a redemption and a happier life of some form in the long run. I carry a lot of them in me, through nature or nurture I don't know, but seem to have made through a vastly more complex path than was necessary to a contented life, but it's taken a very long time, and it doesn't hold together every day. If you're at the point where you hate the life you have, there are lots of ways to walk away from your current life and start a new one. Plenty of places where a person who can read and write and drive a car can do a lot of good and help a lot of other people. My unexpert opinion is that being open about exactly how terrible you are feeling and functioning is extremely freeing, a lot more people than you would think are secretly ashamed of their hidden chaos. A lot of the people who outwardly seem prosperous and functional are running on maxed out credit and self loathing, and will be very empathetic towards you and willing to help if you show them the truth of where you are at.
There's an amazing interview with Hank Azaria from the simpsons about how his athletic physique is actually a symptom of his intense self loathing and his constant unrelenting need to punish his body and shame of his appearance. The people around you are messier than you think.
What state or country you in Fastly?
ah I thought you meant without ads
Gender Differences in Scientific Careers: A Large-Scale Bibliometric Analysis
How is the permafrost doing?

Is there any global measurement? If you dug in 3 meters would it still be cold? What metric is useful at all here, I’ve never had to consider it since the concept suggests permanently frozen, and that was a reliable assumption
You forget HGST. They have a longer track record of reliable models than any other manufacturer, even taking the death star into account.
What I’m curious about is where does the Windows App Store Fit? The only special stuff it has is the ability of update Games Pass Apps I think. But If it’s not on Game Pass , gamers aren’t going to the windows store, they’re going to Steam , Epic, origin, ea, where they already have an established library , some that allows them to edit game files.

There’s no way they’re trying to compete in mobile since Alt stores on Android is futile due to friction and Google’s Pushing Power. iOS at the current moment is out the question. Does Microsoft have a phone out at the current moment ?
Say your going to open your firmware, and who ever stands up to oppose it, fire them! There standing in the way of progress.

On a serious note though, it's kind of a double edge sword, you still have to provide firmware "I bought this device and I can't even use it without downloading something from the internet...!!!" or "The firmware I downloaded off the internet stole my wife and burned down my house!"
> "Again - this isn't a tax dodge. This is someone who used the law exactly as intended without any illegal or shady dealings and happened to be incredibly fortunate."

Absolutely. But key is the interpretation of "used the law exactly as intended". In the context of ongoing reports of no taxes paid, off shore tax shelters, etc. "intended" takes on new meaning (read: nefarious, or at least should be questioned).

The disgust isn't that he didn't do any wrong, the disgust is that what he did isn't wrong.
Revenue is largely irrelevant in either case.

And why would anyone treat an established retailer like a high-growth company? That makes no sense.
Sign me up! The Pinecil and PinePower are totally awesome, they changed my whole worldview on soldering.
Y Combinator was a deeply in-person experience until the pandemic hit
If you don't like that title why not suggest a better one?

HN has been "becoming reddit" since before it was called "HN". As Voltaire said, "it must be very slow".
HGST was bought by Western Digital.
Stress does turn hair gray, and it’s reversible - https://news.ycombinator.com/item?id=27615683 - June 2021 (122 comments)
FBI Possibly Dug up $400M of fabled Civil War era gold
I’m confused by the edit- WD is Western Digital, no?
Don't Buy New – Upgrade Something Old (a Honeywell standing fan to be exact)
I think you are reading into my post too much.

I am trying to wrap my head around these rules regarding IRA transactions. I’m certainly not trying to defend Thiel here. Would you mind pointing me to what in my comment lead you to that conclusion?

Also I would be shocked if there aren’t directors at publicly traded companies making under 208,000 and are filing jointly in a single income household.
US bars imports of solar panels linked to forced labor in Xinjiang China region
I like the idea and motivations behind a lot of the changes a lot of the time but it’s basically never done well. It’s like… always mediocre.

Like they added weather to the Win 10 taskbar recently and it’s something I’ve wanted before… but it’s blurry! Wtf??

That’s the problem I have with MS… they can do a lot of good engineering but they rarely can do product design, so half the things they build are doomed to fail by default.
https://archive.ph/BPRe4
You make generalizing statements like “everyone knows”.

I genuinely don’t understand what kind of reaction you think “everyone knows”. That some people will be inexplicably scared when the the name of Karl Marx is invoked?
Sorry, you caught me before my newer edit. My brain was doing something stupid. (And I need to go to bed.)

Edit: To be clear, it was my mistake, my post made no sense before I fixed it. The parent doesn't deserve the downvotes.
I’ve thought about what JS would look like if instead of await, the language would await by default and expressions would be explicitly deferable via some other keyword (like “defer”).
A Eulogy for the Free Press
> I'm the opposite. I can't believe that Finder is the best Apple can do for a file explorer. It is an absolute abomination and after 4 years of using my MBP I still hate it passionately every time I have to use it.

Brother, I feel you. I hate finder so much I operate almost exclusively from the command line in os x.
I don't know if that's a distinction with a difference. The rules are that they don't want you investing in a business you have material control over, as part of your IRA. Maybe it's because they think it's too risky, or can lead to self-dealing abuses...or $5 Billion tax loopholes.

The guidance they give you may be helpful

Department of Labor (DOL) Advisory Opinions suggest that under the following circumstances, a prohibited transaction would likely occur:

The transaction is part of an agreement by which an IRA owner causes IRA assets to be used in a manner designed to benefit the IRA owner (or any person in which the IRA owner has an interest) such that it would affect the exercise of the IRA owner's best judgment as an IRA fiduciary.
The IRA owner receives or will receive compensation from the subject company.

By the terms or nature of the transaction, a conflict of interest exists between the IRA and the IRA owner (or persons in which the IRA owner has an interest).

The IRA owner will be relying upon or otherwise be dependent upon the IRA investment in order for the IRA owner (or persons in which the IRA owner has an interest) to undertake or to continue the investment (e.g., minimum investment to be satisfied jointly by the IRA and IRA owner).

https://www.dwt.com/blogs/startup-law-blog/2020/10/startup-i...

https://www.irs.gov/retirement-plans/plan-participant-employ...
>I am guessing this is normal? My data backups are offline. The idea of making my backups read/write on the internet seems insane.

It's a NAS. Backup isn't the only thing you can do with it. A personal cloud (aka dropbox) is also a valid use case, and requires internet access to work.
Nor should they. I don't know how to operate a printing press or an astrolabe.
those on the first page of search engine results are more likely to command a higher price. I wonder how much time it would take to reconcile the investment with ads, and likely a reduced userbase. probably years
NSA Releases D3FEND to Improve Cyber Defenses, Info Sharing
> To list on LTSE in August, Twilio and Asana are agreeing to a slate of commitments such as aligning executive and board compensation with long-term performance; taking customers and employees into account; and explaining how the company’s board oversees its long-term strategy. These commitments must be concrete policies that can be monitored by LTSE.

Sounds like a good thing.
Sure, start ups are insanely risky, but that doesn't mean stock in them can't be incredibly undervalued, and often is. Any tax incentivized investment plan, that allows investment in private companies, whose worth is going to very difficult for the government to judge, given there is a lack of public bids on them, is ripe with opportunities for fraud.
who else do you go with where you won't run in to the same problem?
Just half a dozen. I only backup a set list of playlists (just an array of playlist IDs in bash I periodically change).
He only reliable backup mechanism is starting a successful cult whose main tenet is that your data is valuable communication from God, so that they continually duplicate it. Anything else will go bust long, long before the heat death of the universe.
Searching “China” in Apples default Messages app shows no results
Have you any experience using it with F#?
Not commenting on the morality of the leak but given the IRS has been gutted [0] over the years by those in power, perhaps this insider was sick of seeing the public narrative on taxes be completely different from what was happening privately.

[0] https://www.propublica.org/article/how-the-irs-was-gutted
A maximum is not necessarily - or even normally - an outlier.
Had severe jaw pain from grinding in my sleep and clenching last year. Largely because of the last administration, but also starting a stressful new job situation and general 2020 pandemic stress.

Apparently my dentist was seeing a ton of this.

Got a night guard and felt immediately better with some of it. On stressful days I still find myself clenching or biting my tongue but it's a lot less.
I’m referring to the behavior in humans. Alpha high status or beta bucks provider in males. Do you have words you’d prefer to substitute?
Nvidia Canvas
The speeds are different - the right one smoothly goes from stationary to the target speed, while the left one appears to speed up and then slow down again. It's explained further down the article.
The article says you can manage them from a WD site.
Node Application Stopped Sending Updates to Slack – Can’t Identify Protocol
In defense of the parent comment, there is a meaningful difference between a device acting as the terminating IP meaning any open services are directly probe-able and a device sitting behind a firewall.

For this particular attack (assuming c2 server compromise?) that might not matter, but ultimately there is a massive difference in attack surface when comparing “direct” with “NATed”
Who is pretending? You managed to come up with an irrelevant and misleading take on the data. Do you expect the media to consider all hypothetical incorrect ways of interpreting the data, and say why they are incorrect? That doesn't seem like a reasonable ask.

I'm not sure in what sense those four things are not being communicated.
Math problems aren't technical problems? Do you mean it's a mathematically-impossible technical problem?

Noise and obfuscation can be added to the data such that the unique person it identifies doesn't exist. For example changing the dates by some limited random amount. Replacing values with roughly-similar choices (replace engineer with scientist, replace Mexico with el Salvador, etc.) The technical problem is doing that in a way that doesn't harm its research value, never allows the final set of possible similar identities to be below some lower limit, and can't be reversed of course.
Your teeth can remineralize given the right conditions and some time. Obviously the aesthetic won't change much, but if you clean your teeth thoroughly 30 mins after a meal, reduce sugar intake, chew sugar free gum for saliva and helping with ph levels etc. it should help.
> because x% of a lot of income is a lot bigger than x% of a little income.

If you make $10k a year, vs someone who makes $10M a year, and both are taxed the same, the lower income person loses more purchasing power. At 15%, The hit of $1.5k is a harder loss than than the $1.5M.
Off-topic: for at least a year arstech has been filled with stories about the 'rona and "oceans gonna rise soon".
I'm going to blackhole their domain on my network.
NNs don't extrapolate
Alright. So if Netflix wants their app to be hosted and indexed by the App Store, Apple should just provide the costs related to that because of charity? The bandwidth alone I imagine carries a pretty hefty price for an app like Netflix. By your logic, this should all be given free - which actually is negative profit for Apple .. why? Would you create an App Store, dedicate resources on moderation and app curation, as well as infrastructure, and then just give it away free? Would your stakeholders still back you if you did that?

I never understand this line of logic, and the idea that for-profit entities somehow _should_ do lots of charity.
Do you have a citation for this?

> * A Microsoft account and internet connectivity is required for Windows 11 Home setup

I saw a video of Linus tech tips taking the leaked demo for a spin, and it looked like there was an option to use it with a local only account: https://www.youtube.com/watch?v=odZSCdNTFPw&t=305s
Chromebooks provide separate logins for personal and Workspace/GSuite accounts.

As for what happens if your Chromebook is stolen and you've not selected the option to lock it when the lid is closed, Workspace/GSuite accounts can be remote wiped, personal ones cannot. Perhaps with the upcoming Workspace Individual plan, remote wiping of personal accounts will be possible too.
Many reserves do indeed have their own police forces internally. In fact, when I was in high school, a Fort Frances City police officer pulled over a First Nations police officer who had their emergency signals activated, for crossing a double line, on a provincial highway (just outside city limits) It was a shit show. My father was involved in mediating that, there was a real world consequence to that officer not being able to respond to that call, and the city officer admitted he was concerned with making a jurisdictional point (even though, even if he was technically right, he also ended up being technically wrong, the road had become provincial). In another instance, a first nations officer got into an accident responding to a call on the reserve with their emergency signals activated (ran a light iirc), at the time, they were within city limits, so the city decided to issue them a traffic violation and charge them.
New Type of Prehistoric Human Discovered in Israel: Homo Nesher Ramla
Now imagine how car manufactures are going to be able to deal with this in a few years.

This shit is coming.
This article seems to put a whole lot of conjecture out there. People are more likely to get vaccinated if it uses older technology? Says who?

I was the opposite: the technology of mRNA vaccines made me more excited about getting vaccinated.
Ivermectin: Enigmatic multifaceted 'wonder' drug continues to surprise (2017)
yeah, well, we might have our heads up our asses when it comes to housing people, but at least we can order shit online that shows up the next day!!!
If an application needs a total order over authentication,authorization, and transactional events then redis doesn't cut it either. Take this scenario:

1. User A creates resource X

2. User A sets X=1

3. User B fails to set X=5

4. User A transfers ownership of X to B

5. User A fails to set X=4

4. User B sets X=2

This scenario happens in all sorts of applications; games, document editors, financial ledgers, forums, etc. Ownership transfer is the hardest use case to support with time-limited tokens like JWT, but even cached sessions or external security services may not be sufficient because proper ordering requires ACID compliance between security and data storage. Failing to provide a total order over auth* and modification events leads to race conditions and bugs.

Ownership transfer is mostly a superset of resource deletion (how long the actual resources persist in storage varies) so if an application accepts an authorization/authentication token as evidence that a resource (including a user account) still exists it can lead to reference-after-free or stale reference bugs, especially in systems where resource identifiers can be reused, or inconsistencies and race conditions in logic that makes decisions based on assumption of event ordering, e.g. orphaning related objects that would normally be deleted when the parent/child is deleted but which fails if the owning user no longer exists, despite the authentication layer allowing the initial deletion to occur due to stale credentials.

If correctness is the goal then authorization decisions need to be made in the same transaction as the action being authorized, and authentication changes need to at least occur no later than corresponding authorization changes, e.g. revoking access before deleting a user or transferring ownership or invalidating sessions/cookies/JWTs that can't be updated in the same transaction.
If you read the article, it is not a gratuity. You are still expected to tip.
XCiT: Cross-Covariance Image Transformers [video]
When Vista came out I was one of the few ones that loved it and was excited about the slew of features that Windows Explorer brought. Every field of photos and MP3s was visible, sortable, groupable, editable.

Then I tried macOS 10.4 and found the Finder an absolute joke in comparison and other than QuickLook in 10.5 there haven't been any improvements since. The only things that the Finder has going for it are QuickLook and the columns view, everything else is pretty subpar.

Nowadays I don't do much file management (or so I lie to myself) so my Mac is good enough for that.
You should trust anything connected to the internet. Demand a physical write-enable switch from your backup drive vendor.
When you get prompted with a mandatory dialog that you must answer where one of the two choices offers no clear benefits, of course no one is going to pick that one.
This is a meaningless statistic.

That’s why phrasing questions and choices in any kind of poll or survey is a complex subject if the goal is to ensure minimal bias.
Hah! That was the system my small university IT department bought to act as a storage server. Actually they bought 2, with one to act as a backup.

Unfortunately for them, no one knew how to administrate Solaris, so they... installed Windows. No idea if they actually succeeded in doing anything useful with the systems.
Fascinating buried lead:

> A NASA history of the Hubble,[24] in discussing the reasons for switching from a 3-meter main mirror to a 2.4-meter design, states: "In addition, changing to a 2.4-meter mirror would lessen fabrication costs by using manufacturing technologies developed for military spy satellites."

Hubble was derived from these spy satellites.
For 2 and 3 I was mainly referring to Identity, although I'm not sure how it works internally. For 1, I think the main issue is that when someone logs out, or you log someone out, you aren't guaranteed that they are actually logged out. There are cases where this does matter.

How does Devise handle 'revoke all sessions for this user'?
Right? It's literally Fitt's Law, one of the first things we figured out for sure in UX.

https://en.wikipedia.org/wiki/Fitts%27s_law
HGST was acquired by WD in 2012 and stopped being a brand altogether in 2018.
Wow - so here I am an hour later... Thanks for that link!
Second definition of plant:

> n. a place where an industrial or manufacturing process takes place

In this sense a slaughterhouse or meat processing plant are indeed meat plants. For the primary definition, it also seems plausible to genetically engineer a plant to create animal proteins.
Red and Rebol have prefix notation and no parentheses to delimit the arguments. That means you have to know the arity of each function to understand how to build the parse tree. This is apparently not as hard as it sounds, because natural languages work the same way, although they can be ambiguous, at least if you're familiar with all the functions.
The affected model here, known as My Book Live, uses an ethernet cable to connect to a local network. From there, users can remotely access their files and make configuration changes through Western Digital cloud infrastructure. Western Digital discontinued the My Book Live in 2015. The support forum thread was first reported by Bleeping Computer.

The affected product is not a drive but a NAS solution. In terms of being a reasonable consumer my thought process is to evaluate distinctive products differently.

NAS is a cheap computer with attached drives. It’s going to have computer-like failure modes.
Let's see....

- Dangerous work

- Cast as the villian by national media and politicians

- Under constant scrutiny

- Low Wages

- Target of organized agitators

- Occasionally doxed, with threats to family

TBH, it was the last political cycle that spelled the tipping point.