skysight-inc/HackerNews huggingface dataset:
What’s your threat model?

Is there anyone out there with $$$$ who will stop at nothing to part you, a rando, from your old data? Probably not. Are there sophisticated attackers who will burn a couple 0-days to build a botnet for the sole purpose of randsoming NASes AND attached cloud accounts AND the origin systems, accounting for tons of possible configurations? Still pretty unlikely — this is NotPetya level stuff with small payoff.

If you find yourself in the crosshairs of a sophisticated, dedicated attacker (perhaps one in possession of a 0-day), you’re pretty much done. Offline write-only backups stored offsite are the only defense.

However, is there a bug lurking in Hyper-backup that might accidentally wipe stuff from Azure storage, and the bug hits a month before your house gets struck by lightning? Maybe…
https://paseto.io
Office and Explorer were actually shown in some other videos today, they've been updated to the new UI theme as well. As have paint/notepad. Edge as well, that combined with the Taskbar/Start menu and Store they demoed in the main video. Settings has also been completely restyled to match the new theme, don't remember which video(s) that was in though. The new Terminal (which can now replace command prompt as the default terminal for applications too) seems to fit in visually too.

Overall I don't think every Microsoft app ever made is going to get a facelift but it really seems like all of the main user facing apps have actually been updated together for once.
It is funny that this is the way most web auth systems worked back before the JWT brand was invented. I made one that had a prefix extension bug, but you didn’t see the marketing drumbeat against it until it got a name and you could paint a target on its back.

(E.g. branding something is often a transition from people using language as a club against hunger, wild animals and the unknown to using it as a club against the other man.)

It is not unusual for systems like this to have some details such as verifying the cookie against the db if somebody is doing a critical operation and not being too worried about a five minute window for people reading articles and such.

High volume attacks need their own countermeasures.
Ghost's source code might be a good start.

They already have most things you need but the Git integration.
TIL. Thanks!!
Yes, this is what is being criticized. Other investors have no ability to do this, and there is little to know what to verify that the stock that was purchased was actually fairly evaluated. If it wasn’t then he was able to invest far more money tax free than should be allowed.
I like how strong your memories can be of art in context. I can remember times I rounded a corner decades ago to first see a major piece, how many people were around, what the room was like, etc. I remember the second time I saw Guernica I had my brother with me, who hadn't seen it before. I picked an intentional path to it so his focus would be in one direction initially and then he'd turn and see it for the first time from a great position. My first viewing I'd approached from a pretty dull angle.
Walmart only makes less than $7k per employee. They have 2.2million employees. Regardless of the common narrative - they simply can't afford to raise all of their employees wages by any meaningful amount with their current profits.
This would send a very loud message, but is it wise
Ask HN: Did Google disable line height on search?
Since this afternoon I’ve been noticing that Google search results have zero line height, making them hard to read.

Is this a bug or some sort of AB test? It’s happening on multiple devices.
> I know several people who use these devices because of their simplicity, and they’d be devastated.

I can’t imagine a scenario where I’d rely on an 8-10 year old device that hadn’t received a security update in 6+ years…
People cut it in half. It’s a thing!
The plug-in TPM module for my motherboard is already sold out..

This is going to be a real problem for upgraders.
I know some folks who thought they could use JWTs from a traditional LDAP identity vendor (open source Active Directory so you can manage computer login credentials centrally, issue Kerberos tokens, etc.) but they managed to misconfigure their JWTs by following the defaults from the vendor so the JWTs issued were valid forever. When I tried to explain that they couldn’t be revoked without key rotation, I got some very blank looks. I’m not even sure the tokens had an iat (issued at timestamp) though if they did you could use that to at least ignore tokens older than a certain date. They assumed because they deleted the cookie at logout, it wouldn’t matter that the session could be re-used forever. Then they implemented session limits by setting a cookie expiry time. /face-palm

Issuing your own JWTs also means you have to keep the secret or certificate used to sign them secure or if it leaks anyone could impersonate anyone else. This is especially problematic if admin or role assignment is embedded in the JWT.
The difference between shell and environment variables
I have respect for my colleagues at other companies.

They lose it when they talk down to me. "oof, sorry about that, but this is not important enough for us to fix right now" is not how you keep my respect, when the functionality has been broken for months.
That applies whether you're posting from a work or personal device, really.

Alas, the stories I can no longer share on the Internet like it was the 90s.
Haha fair enough, I was just trying to point out that the question itself (IMO) is not really how Apple thinks of things.
They always pick the year 1968 and not the year minimum wage was introduced. Always.

I'll leave it to you to figure out 'Why'.
Yes but a lot of times people don't do that properly, some frameworks have incorrect defaults or people don't want to deal with writing the logic to handle refreshing tokens after that 10-15 minute window etc etc.

They are insecure but it's not a problem if you follow best practices like those, the difficulty is a lot of people don't because they don't really understand what it is they're doing or potentially causing by making the changes that let them be lazy or do things the easy way.

You could probably change the title to articles like this from "JWT Tokens are NOT safe" to "JWT Tokens are NOT safe when you ignore all security practices and take the easy way out" but that doesn't make for a flashy title.
I'm not familiar with Logo. How are you supposed to know where parentheses are implicitly opened and closed?
I use Xubuntu, which is great. Really, I would say the difference between Red Hat/Ubuntu/Debian/Fedora is largely cosmetic. I haven't actually used Red Hat as a workstation in years, but the nice thing is that on Ubuntu you can just install the gnome-desktop package or the kubuntu-desktop package, and you get that desktop environment.

So the idea that it's "more workstation oriented..." doesn't really reflect what your experience is.

At the end of the day you have a desktop environment and some packages. And Linux, especially Ubuntu with its package manager, makes it really trivial to swap out the DE if there's something that doesn't seem "power user" enough for you. (And for me, I find the default Ubuntu DE bloated and trend-chasing, but Xubuntu-desktop gives me the same well-supported packages you get on Ubuntu with a stable, no-frills desktop.)

Ultimately it really is about support. There's a lot of services and products that simply don't offer a Linux client, and that's where the trouble comes. Like I was contemplating trying out Tidal since I was annoyed with Spotify's removing a bunch of features from their desktop app, but Tidal doesn't offer a native Linux client. Zoom's Linux client is simply inferior. Lots of stuff like that which have nothing to do with any shortcomings in the OS is where I find the actual problems lie.
Version 1.0 is out. Uninstall is no longer experimental. You really should do some more research again. You are doing yourself no service by being so smug.
JWT is fine when used within an auth protocol like OIDC. It’s like claiming certificates are unsafe because I send the public and private keys.
Act – Run your GitHub Actions locally
By design it can never be seen in action ;)
The relevant states were already audited. There is no "magical knowledge" required.
> The general reason why folks don’t recommend JWTs is because it’s too easy to make mistakes in the validation logic.

That isn't why I don't recommend JWTs, and it's not why this article is not recommending JWTs.

> Logout doesn’t really log you out!

> Blocking users doesn’t immediately block them.

> Could have stale data

^ JWTs fundamentally are not compatible with server-side authentication revocation.

Your typical developer is like, "Well, I don't care much, I'll use JWTs anyway", but then some poor soul has to deal with the ticket titled "Blocked user still able to access service", or "User still able to access service after logout", or "session never expires!" (oo... look, you configured it incorrectly).

I've been on the other side of having to deal with screwed up JWT implementations other folk have built.

It's not fun.

...and yes yes, there are work arounds, you can have rotating short lived tokens and long lived refresh tokens and a database of revoked tokens...but you've just reimplemented server side session authentication yourself, and it's probably wrong.

> I think you have to either assume competence...

I think that's terrible advice. You should never assume developers are competent to implement authentication. It's a Hard Problem, like, writing a database, and frankly, only specialists are competent to do this correctly. Anyone can writing some kind of data store, but it's a bit harder having it ACID and concurrently multiuser.

> or you have to suggest that developers use identity proxies...

...but yes, this is probably the only useful piece of advice to give to people: If you use a 3rd party authentication provider, you can delegate responsibility for doing the hard work of making sure they have a solution for the hard things; at which point, you don't really care if its JWT or cookies, or whatever.

I still wouldn't recommend people use JWTs.
The article references 39 minutes as the upper end of JWT token expiration.

Is this typically the case? Or can JWT token remain valid for hours/days?

(Issue being that even if you “logout” of a JWT session, the session token server-side is not invalidated as it would in a traditional (I.e. redis-based cookie/session store))
There’s no reason to put all the user info in redis and this article makes no valid argument for it. Give the token a unique ID and store that ID in redis (or some other fast store). Validate the token by checking its sig and verifying that its ID is in redis. Store all the signed metadata you want on the client, revoke it by removing its ID from redis. Addresses all cases where the token is stale. So basically redis becomes your token whitelist, not your store of user metadata. Problem solved.

Signed blobs of data such as certificates and web tokens are a very powerful massively distributed cache where the entity that benefits from the data being cached is also the entity responsible for persisting it. This is a wonderful optimization whose sole drawback is that you need an external way to decide when that entry is invalid. Solve that problem, don’t abandon the entire concept of the distributed cache.
Realistically, this is impossible for me.

It can be done, but it would be a massive hassle, a massive security problem (or set of them), etc. etc.

I was hoping the article would say something interesting or compelling - some new way to look at this old issue. Nope.
This is just over stated. Expiring tokens remotely isn’t that hard.
Are you suggesting any investment that is made after you've paid taxes on it should be tax free regardless of growth? Roth is an exception, not the rule. Tax is cyclical, not a one time thing, by design. It was never the case that you only ever paid tax once, and it's confusing to me that it's even being suggested otherwise. Roth is a very special exception to this.
Thanks for that comment, it’s very kind. :)
And did it truly appear visually? I’m not willing to to accept anything as gospel. Especially when the source is the government.
The vast majority of users assuredly have an Internet connection they already use with at least one other machine on it, so unless ISPs are handing out another public IP for their NAS, it's almost certainly behind a NAT.

If so, someone simply cracked bad security 6 years out of date and scanned for devices.

Maybe the majority of them aren't so much an "exploit" as they are "easily guessed credentials". The fact that anyone else, anywhere else on the Internet can also use those same credentials to access their data is something that probably few people realise when they set one of these things up.
A bit of background on compilers exploiting signed overflow (2016)
Expiry is just one of the fields you can set. Also if you’re curious about what’s inside a JWT, the next time you see one from an OAuth cookie perhaps, copy and paste it into a tool like https://JWT.ms run by Microsoft and it can show you the details. Commonly you want to load a JWKS (with multiple keys possible for easy revocation) to validate the signature, and check the iss (issuer of the JWT), aud (your app registration or audience of the token) and expiry date of the token. Oh and don’t forget to hard-code or reference the JWKS validation method so you don’t accidentally allow “none”. JWTs are not without their complexity, but the same could be said about maintaining secure session cookies and implementing 2FA yourself perhaps.
@dang might want to check into that, OP seems to have a history of forcing submissions through.
> Look at the market, is there really a deficit of risk-taking? I think there is a deficit of understanding of the risks but there is a massive excess of risk-taking in pretty much every asset class.

There's a deficit of risk-taking in a crisis (and maybe an excess of risk-taking in "normal" times). In the old days crises would be softened by market makers who were willing to act as de facto prop traders and buy at the bottom for their own account - an extremely risky trade ("falling knife") but an extremely lucrative one if you get it right. Nowadays the algorithmic herd just exits the market when times go bad, and if you did do the trade and make a killing then you'd get your trades broken ("clearly erroneous") and have to fight a lawsuit and it just wouldn't be worth it.
and even if they have to be enabled in uefi, I don't think MS expects the average user to dive through it to enable it. Also why not legacy bios support, I have an old dual core 2ghz Intel 8gb ram perfectly capable but doesn't have uefi support
> The Linux fragmentation could decrease if Linux distros adopted a MacOSX-like standardized app-bundle format.

Everyone decided this so we got 3 different "standard" formats... (Snap, Flatpak, and AppImage). See: that XKCD about standards.
Large-scale CO2 removal facility set for Scotland
Why Are Ketchup Bottles So Hard to Use?
They are likely referring to people that interact with cats and then contaminate their own food (fail to wash hands etc.)
> I can see where you are coming from, but charging the company for office space in your home is a bit over the top

Why? What about electricity bills?

> so it's not like they're using your space with only disadvantages to you

Then put it in contract as a home office agreement and not assume that everyone is okay with it.
It was at least not a public intention, but I know more than one multi millionaire that has used this "loophole". Peter thiel isn't some super rare exception
One users quote:

"The WD MBL log files indicate a script issued “FactoryReset” command to users all over the world.
I don’t use Cloud Storage so I don’t understand how this can happen?"

Oh boy... plus side is other users said data seems to be potentially recoverable
I think you actually mean FBI. :P CIA only has jurisdiction outside the US. Although, in context of the joke, NSA would make more sense.
>>> how to go from 100 to 10 mil users

You want to implement the equivalent of "load balancing" in the cloud, for your massive open world ;)

https://documentation.improbable.io/spatialos-overview/docs/...

Load Balancing for Massively Multiplayer Online Games

https://research.ncl.ac.uk/game/research/publications/7B329d...
And yet - meltdown and spectre were both independently discovered by multiple separate teams.
A part of me feels that with any acquisition ever. If it's really that good, why're you selling?

I think there's some element of passion (like you said), though also just around the skill set needed to really take the business somewhere.
Looks like a massive attack. I wonder if the goal of the attacker is to short the stock.
Doesn’t matter. Better to pay explicitly than by being manipulated to pay via the things you’re manipulated into
Related, XOR Swap Algorithm, https://en.m.wikipedia.org/wiki/XOR_swap_algorithm
https://sdirahandbook.com/self-directed-ira-investing/fund-s...

looks ok
Same with education. It's horrible that these children were subjected to a sterilized, culture killing national/standardized education, and killed their individual culture.

Also, opposing nationalized education curriculums for everyone else means you're an evolution denier, hate minority children, and probably still think we should teach math with numbers.
So you don't have to say anything on point.
Just abstract imaginary accusations.
Move along.
some countries have nude beaches but not sure if you want your private photos leaked to the public.
Please try and explain this to a single mom running a hair salon or a married couple that owns a BBQ restaurant. I expect that they may laugh at you and ask you to leave.
> You could have short-lived JWT tokens so it wouldn’t matter because they only last 5-10 minutes or less.

The author argues that you can't revoke a JWT - suggesting that 30min is the usual default. To their point, if 30min is too long, then 10min is probably still too long.

However, implying that 30min is too long for a token to remain stale suggests that you aren't really working at the scale that JWT was destined to address (Facebook, Twitter, etc.). If you really are the unfortunate soul trying to solve per-request authz, specifically at the scale that JWT was designed for, then I feel deeply sorry for you. For the 99%, i.e. the rest of us, 30min is just fine.

> You could use Redis for session data as pointed out with the random key in a cookie and delete the session when done to invalidate the cookie.

I'm not picking at your argument, honestly, I'm just pointing out the absurdity of authz without JWT (or similar) at scale. Redis is eventually consistent: what happens during a network partition?

Saying that the JWT expiry is a vulnerability is tilting at windmills.

> The general reason why folks don’t recommend JWTs is because it’s too easy to make mistakes in the validation logic.

Bravo, that's the real problem with JWT right there: it's too easy to misuse - especially when convenience or demanding customers enter the picture. It also has brain-dead specification opportunities like signature-free tokens.
Trusted Computing and Digital Rights Management: Theory and Effects (2004)
http://www.diva-portal.org/smash/record.jsf?pid=diva2%3A206552&dswid=-5253

The paper discusses the Trusted Platform Module, or TPM, and its role in Trusted Computing and Digital Rights Management.

> Trusted Computing Platform Alliance (TCPA), now known as Trusted Computing Group(TCG), is a trusted computing initiative created by IBM, Microsoft, HP, Compaq, Intel and several other smaller companies. Their goal is to create a secure trusted platform with help of new hardware and software. TCG have developed a new chip, the Trusted Platform Module (TPM) that is the core of this initiative, which is attached to the motherboard...

The paper discusses using the TPM as a way to establish Trusted Computing, which can be used to strengthen DRM measures:

> There is a possibility that more and more applications will be developed with TC in mind,hence users without TC will get less functionality from the applications than users who has a TC computer. There is also a risk that companies will only develop software for TC platforms that does not work on a regular computer and thereby forces users into using TC. The companies behind TC have interest in getting users to adopt the new technology and specifying TC hardware and OS as a requirement for an application is a good way to achieve this.

> Secondly the user could loose his freedom in choosing which applications to run, since attestation gives the server information about what application made the request. This application may be unauthorized to interact with the server; hence the server would deny it service. ... This is a very serious drawback since it allows companies and governments to decide which software a user must run. This leads to less freedom for the user.

With TPM 2.0 being required for Windows 11 devices, it's interesting to look back at the original goal of that technology.

The full paper can be downloaded directly here: https://www.diva-portal.org/smash/get/diva2:206552/FULLTEXT01.pdf
There are countless systems out there which are far older and also more secure. Age is of zero relevance except to those who propagate forced obolescence, mindless consumption, and generation of massive amounts of e-waste. This "update mentality" is a cancer itself. Especially when this is supposed to be a simple device.

That said, relying on the same credentials for a long time is more problematic. My bet is on credentials being bruteforced, especially if many people have left them at their default or used easily guessable ones.
> Seemingly random pixel positions shift, brightness shift, density shift, etc.

These are all hypothetical though. We don't know if these techniques exist in the wild.
Turns out, when you follow the GDPR and make it as easy to give as it is to remove/reject consent, people will generally reject consent to be tracker and personally identified unnecessarily.
my bad you are correct,

https://sdirahandbook.com/self-directed-ira-investing/fund-s...

it is in section: Need to Know #1: Prohibited Transactions
> The gross sum of time spent tracing the origins of scrap will be greater than money lost due to theft.

I am quite skeptical that this is true.
I'd rather see a well developed OS that is built for a few good devices rather than a majority of devices. At least for the first stage of acceptance & adoption. After the user experience has been nailed, then expand devices it supports.

Similarly, I'd like to see a linux distro targeted strictly to apple silicon macs and nails the user experience, fully working drivers etc.
On one side of the house you have folks saying Windows 3.1 dialogs are still able to be referenced, on the other you have folks saying there is no backwards compatibility from Windows 7 onwards. Clearly both can't be true yet Windows gets the short end of the stick after each reference anyways :).

"Really old games" probably don't have the same backward compatibility weight as "really really really old business software". As a good example a friend of mine with a local business just had me migrate his 16 bit ordering system from the 90s... to Windows 10... and I'll be damned it worked.
Time to Ban Surveillance-Based Advertising [pdf]
Yes, we can always dream up some extreme case where somebody would find it onerous. How should we weigh that against a lot of people who are just trying to use their car to get to work having their catalytic converters stolen?
Short interest on WDC isn't absurdly high, so, if that's the motivation, it's a pretty risky move to make not a lot of money.

https://www.nasdaq.com/market-activity/stocks/wdc/short-inte...