skysight-inc/HackerNews huggingface dataset:
>An Associated Press analysis of available government data from May shows

It really irritates me how news organizations think this is appropriate. I can't even share this because I can't validate that it isn't a complete lie. I refuse to accept a secret analysis of data as credible.

Sources buried, no breakdown of how the analysis was done, worthless article, yet this is routine for journalism.
Maybe it's sending personal texts or emails from your work phone, editing personal documents or photos on your work laptop, or joining a virtual happy hour with friends from your work tablet.

So... I agree with much of this article. However, the above is silly and undermines the point. Basically living with these devices should not be a concern any more than faxing personal health expense forms using the company fax machine. Or using the cheap pen from the office supply room anywhere.

Should you do projects with company resources? No. But that is not exactly a slippery slope. Don't pretend it is one.
It runs Linux, and they could have at least opened up the firmware for opensource updating. WDs response to Windows 10 blocking network access because the My Clouds use an old version of SMB is to buy a new one (and trash working equipment) or enable a not particularly secure SMB version in Windows.
You can purchase real estate with a self directed IRA, not sure if it can be a Roth IRA, and probably not your primary residence, but I don't know the exact rules.
Could you expand on why 30min session validity after explicit logout is okay? I don’t mean to sound accusatory; I would like to understand your reasoning.
Google says "When they say 720 sexes, what they mean is that we have found 720 different DNA sequences at the mating type gene which have somewhat different mating behaviors."

I take that to mean they know because of genetic analysis, but don't necessarily know the pheno-level combinations yet.
This is a very strange and misleading way of looking at the data. For one, what you call infections are actually hospitalizations. Your analysis also neglects to consider the differences between the vaccinated and un-vaccinated populations; specifically, older Americans are more likely to be vaccinated than younger ones, which already puts these percentages on uneven footing.
IoT once again proven to be a horrible idea. Hardware OEMs can't be trusted with security. They can hardly make a product that holds up to normal use, let alone malicious attacks.
I don't think it makes sense at all. If they want to own my phone, they should give me one and not take the one that belongs to me and have all my personal stuff.
Shift+F10 is your friend at installation time.
"If you want me to have a phone for company purposes, give me one."
I thought the same. Might run into trademark issues if it's not affiliated.
Show HN: A cringe-worthy ROS1-like interface for ROS2
lol is this a joke? i can't believe people think there are any intelligent people on this forum
The article also names Berkshire Hathaway's Ted Weschler as someone who has a large Roth IRA. Weschler's response [1], which is linked from the article, is worth reading. He points out that decades ago he opened an IRA, just like anyone else, and happened to make some good investment decisions and got very lucky along the way:

> The magnitude of my Roth IRA is certainly larger than anything I ever would have imagined when I first opened my IRA in 1984 as a 22 year old Junior Financial Analyst making $22,000 a year working for W.R. Grace & Co...

> Upon leaving Grace, I transferred my IRA to a self-directed IRA account at Charles Schwab & Co., giving me discretion over the individual investment made in the account. Over the ensuing 29 years (through the end date you quote of year-end 2018) I invested the account in only publicly-traded securities i.e., all investments in this account were investments that were available to the general public...

> The investing success of this account has been a function of careful stock selection, exceptional luck and a multi-decade time period. To have a sum of this magnitude built up in my Roth IRA is certainly beyond anything that I ever expected but it was implemented in a way that was available to all taxpayers with an appropriately long investment runway, i.e., the result is exceptional but it is not the product of exclusionary tax strategies.

[1] https://www.documentcloud.org/documents/20971124-ted-weschle...
The foster system is rife with perverse incentives, and Canada is experiencing a population decline. Is it actually a perverse incentive to raise more indigenous kids in stable homes with guaranteed income?

And, this touches on a broader conversation about UBI. IMO, payments for the kid should start in the third trimester. Our society does not value stay-at-home parents nearly enough. It's a job, and a damned hard one at that. Doesn't do much good to give people a guaranteed income that's too small to raise kids on -- you'll end up with parents working multiple jobs and the cycle of poverty continues.
You might check on how New Horizons was implemented. They initially wanted to fly LISP, but (I think) they eventually used the LISP to generate C++.
This was to allow dynamic, model based re-planning when the craft was in the outer reaches of the solar system.
And it takes like 12+ hours to update....
Have an upvote from me; sorry that my lack of anything but a link contributed to the confusion here!
Apparently this will be a free and in-place update from win10, so maybe that is compatible with what they meant by "just updates", even if it is a redesign.
I used these all these systems, and even helped run a smart card conference back then.

The implementations were very lacking. As unusable as PGP for normal people. The banking industry took a hard pass on the whole thing for good reason.
Targeting proton/wine is fine. Windows could be considered as a application layer for games already. Most of the native linux ports are actually worse than running through proton/wine.
Seems pretty clear that he sold himself shares below fair value to make the contributions legal
You are right but I somehow do not see Chromebook as a desktop OS. Maybe I am wrong, but this is exactly what I mean by the convergence that is happening. MS, I feel, wants a lighter OS for masses. Chromebook is surely dominating this space.
Question: do these arguments not apply to any certificate authority system? Token (cert private key) lifetime, revocation lists, stale data?
I thought they denote a tree structure. At least that's how I remember it being in Scheme. You could follow the order of evaluation back to the root node. Something I wish was explained earlier, because initially I found all the parentheses confusing as Scheme was my intro to programming language.
I wish I could do this. Now the two are perfectly mixed on my work laptop.
I'm unsure how I feel about classifying an entire game engine as middleware. For most engines (Godot included!) building your code for a different platform is as easy as changing your target in a dropdown menu.

I'm also deeply curious as to exactly how many indie game developers are writing code that interfaces directly with these low level systems and graphics APIs. In my experience, building cross platform games (I've shipped from Unity, Unreal, Godot, and XNA/MonoGame) is trivial and the framework handles 100% of the complexity of porting. From the sounds of this comment thread, everybody is writing their game in raw shader language and then having to port that to Vulkan or OpenGL.
In the hypothetical example, they are providing wrong information to Google. If they provided no information, it would be a different story.
The cache can be redis.
The idea that America got rich from stealing and oppression is a pernicious myth that keeps other people poor.

Every country has plenty of stealing and oppression in its history—you can always point to that to reject the assertion that something different matters. If India was rich, you could point to all the stealing and oppression of the Mughals, etc. But you’re just pointing to correlation, not causation.

Countries that went from poor to rich in the 20th century, like Singapore, Taiwan, and South Korea, among others, without Manifest Destiny and all that jazz show your model to be overall simplistic. Singapore’s Lee Kuan Yew systematically made is poor nation into a rich one by copying the parts of Anglo society he thought was responsible for their wealth. And guess what, it worked!
Totally. And I didn’t mean to call you or your company out specifically. Actually sounds interesting.

Maps Street View of 1428 Bush St, San Francisco is more of what I have in mind. But maybe I’ve just passed that building one too many times.
I wish there was a way to do that natively with Firefox, whereby a whole profile is encrypted and password protected. Most personal things I do on work PC are through the browser, so if the profile were protected, it would be problem-solved.
Which, by the way, is pretty strong evidence that you will be the product (even if it weren't for the talk of "weaving in with your life" or whatever).
> internet connected NAS

I am guessing this is normal? My data backups are offline. The idea of making my backups read/write on the internet seems insane.
The only time this bit me so far is that once I had a weekly recurring for…two years. And one day, for some reason, my phone started RSVPing to it again. Except it was every instance of it that had passed…blew up my bosses inbox and made my phone useless for about an hour. It was the weirdest thing. Funny though.
Not trying to be sarcastic but looking at the child obesity rates and educational crises, medication rates etc; disease, malnutrition and lack of education are adjectives that also fit the US.

This is exactly why “we know the right way, why won’t you just follow it” is just as an imperialistic and honestly arrogant point of view.
Except for the fact that if you reward them then the children will not be birthed into poverty. You'll get more children, full stop.
QNAP's recent situation was hard to believe. Having only just fixed a significant SQL injection vulnerability[0], a spate of ransomware hit. It was originally announced to be this issue that people rushed out to patch[1].

It ultimately turned out to be a backdoor account[2]. Backdoors really upset me. Every reasonable "you can't blame people for mistakes" goes out the window when it's not a mistake.

Following the ransomware, they released an auto-installing malware remover. A Python script that detected one particular piece of code associated with this recent attacker. That malware remover was a python script full of vulnerable exec calls introducing multiple new RCEs.

[0] https://www.qnap.com/en/security-advisory/qsa-21-11
[1] https://www.qnap.com/de-de/security-advisory/qsa-21-05
[2] https://www.bleepingcomputer.com/news/security/qnap-confirms...
[3] https://www.qnap.com/en/security-advisory/qsa-21-16
why should I pay more for a luxury car when the SAME MANUFACTURER makes low-end cars, too?
I have a niche iOS app that makes between $200-400 monthly. I would sell it to someone who would continue to grow it because I would rather build new things than continue to add content to the app.
Don’t be so sure about the third-party auth providers. Even Auth0 accidentally allowed token validation bypass by specifying a weird capitalization of “none” for the algorithm. https://insomniasec.com/blog/auth0-jwt-validation-bypass
Simple session tokens are fine, always have been.
MDM is kind of a super admin feature on Android and iOS which allows for all kinds of things normal apps can never access. It's used by companies to manage company owned devices so they can do things like reset the password and remove the apple id lock when an employee leaves.

It's not that slack can wipe your phone, but that (it sounds like) slack can detect the presence of the company MDM setup which can wipe your phone and lock you out of the app if it is not detected.
I love it. We’ve used it for years.
Interesting, thanks for the reply. I think an analog clock that could set the time using NTP over wifi would be a 'killer feature'. Radio clocks just don't work that well in many places.

Getting a reply from (presumably) the source is what I love about HN.
LTT is gonna have a field day on this one!
If somebody is selling something it's because it's not making them money, and that's the end of it. Nobody would sell you a project for 5k that's generating 1k per month. People sell when either the writing is on the wall, or they can't finish the project and don't care anymore. Just expect that.
Jonathan Haidt’s “The Righteous Mind”, any of Dan Ariely’s work.
FF11 works fine with proton for me
microsoft is more invested in the javascipt desktop app craze than almost anyone. they have github, visual studio code, and teams all running on javascript, plus the office 365 apps, which are eventually looking like they'll replace the old versions.
Why are you ignoring the most significant difference with the other kind of IRA?
The next season of Black Mirror should just be stuff that actually happened instead of just plausible futures
It's the sudden urgency and staged-shock that's the problem. Framing it as the most important story for you to read today, even though it's been known and newsworthy for years, and 50% of the text was copied from the story that ran on page 16F 10 years ago.

Doing a few 10'x10' scans with GPR (which should never be trusted without ground truthing confirmation), then extrapolating it across a football field, and getting numbers that roughly agree with previous estimates isn't a breaking news update.
I don't think these arguments hold up:

> 1. If someone gets access to your token [after you're logged out] they can continue to access it until it expires.

The author goes on to say that "security is binary — either it’s secure or it’s not". So... Is the token secure, or is it not?

If we can't assume that we have the capability to transmit and securely clear a string from the client, the whole discussion becomes somewhat pointless because both methods of authentication are borked.

> 2. Blocking users doesn’t immediately block them.

If you want to block a user, why would you block the JWT? Block the userId, or some other identifier that isn't coupled to a transient authentication mechanism.

> 3. Could have stale data. Imagine the user is an admin and got demoted to a regular user with fewer permissions. . .

This example demonstrates that this would not be good information to store in a JWT and blindly trust. Store a user identifier (or another immutable and unique identifier) and look up their permissions with that.

> 4. JWT’s are often not encrypted so anyone able to perform a man-in-the-middle attack and sniff the JWT now has your authentication credentials.

Encrypting the token doesn't make it harder or easier to sniff a token or to re-use it. Assuming the author isn't suggesting that people are transmitting literal account credentials unencrypted, this is the same point as #1 above because encryption and signing are meant to prevent against other attacks.
I absolutely agree. That’s why I said:

> you could live with the possibility that tokens are valid for some period of time after logout because it usually doesn’t matter - generally you delete the cookie and the user is logged out, even if technically they could restore the cookie later. They won’t, unless you’re under attack.
I tried switching to Windows about 2 years ago from macOS. I found that the lack of a good replacement for Preview was a real deal breaker for me. I tried a lot of different things to make it work. It wasn't the only thing, but the fact that I spent so much time finding a PDF viewer/light-editor that didn't have adware, was free, and had enough functionality was difficult (in my case I was unsuccessful) on Windows. Hopefully they'll include a great PDF viewer/editor. Making PDF ubiquitous on macOS was a real smart move.
I recently read the book "Bourgeois Dignity" by Dierdre McCloskey, and it makes a somewhat similar argument backed up by serious historical research. The thesis of the book is that the respectability of inventing, doing business, "getting rich" etc is what has enabled standards of living to greatly exceed the historical (Malthusian) norm.

McCloskey talks about hope and courage (and not just "mere prudence") making a big difference, enabled by an encouraging culture rather than an elitist or fatalistic one. I think that it rhymes with your idea that "the brain should not do any triage" (if at a different scale -- social, rather than personal.) Your idea that the freedom to innovate throws off positive externalities is a core part of the argument.

I enjoyed the book a lot, and recommend it. It's a knife-fight from start to finish, but fun and funny and wide-ranging, worth reading just for the tour of its bibliography even if you don't like the thesis.
Crazyguyonabike – A place for bicycle tourists and their journals
You need to add some \[ and \] around the escape codes to tell the shell they’re non-printing characters. Otherwise, things like line-wrapping don’t work right. It’s not a problem because of your \n makes it irrelevant, but just a heads up for the future.
I flagged this post for the following reason:

Please don't use HN primarily for promotion. It's ok to post your own stuff occasionally, but the primary use of the site should be for curiosity.

The user's submission history is almost completely RedisLabs content.
Windows 11 to move to just one feature update per year
This. That's why they call them 'attack vectors'.

I disagree with the main thesis for why JWT is a problem. JWT isn't necessarily encouraging you not to hit the DB for user lookup. This is the claim the article makes as a problem with revocation.

It reads like a really long thoughtful article based entirely on false assumptions for how to best use it.

It's ok to carry around some encrypted state in your tokens for some uses cases.
Flatpak version of steam would be good candidate as anyone can install it on any distro (even non-glibc based ones)
I see, just a stricter bar of scrutiny

I think this outcome passes the stricter bar of moral, just, intended, and something others should learn from
Folks, buy 2 similar drives & backup stuff monthly to both & have your local workspace synced to another machine local or cloud using any tool like rsync, Cyberduck, iCloud whatever.
Show HN: Ziggurat event processing framework that powers Gojek
Sure — but the point is that given the evidence we’ve discussed so far, there’s no reason to believe de-escalation training is more normative than that disturbing seminar.
Proton does an excellent job! Something to consider is that many people (myself included) will offer consulting services to help get your game running natively on Linux with as little effort from you as possible. I personally offer that free to indie developers because I love seeing more native Linux support, but this kind of thing is often not very difficult for someone familiar with the target OS.

I'm curious as to what kind of game engine you're using where targeting Linux isn't as simple as choosing it in a dropdown menu as well, most modern engines support that very well.
If the JWT is saved as a cookie, you can delete the cookie and the user’s browser is safely logged out. The threat model is that a user or third-party could intercept and reuse the JWT after logout. Sure. But then a malicious actor could re-use a JWT before you logout from the app also, which is a much larger risk. Malicious browser extensions for example could hide that they’re making clicks or taking actions in tabs just as they hide ads from you. Don’t get me wrong, extensions are sandboxed, but… any sandbox can be broken. In the end, whether or not your JWT was revoked at logout doesn’t affect the risk of malicious activity all that much as long as cookies behave the way they should. And as long as your JWT has appropriate expiry timestamps.
Every country with employee protections allows for instant termination for gross infringements like you mention.
It is an ad. OP's recent post history are all Redis ads.
So what is the valuation? 3000 per year equals for 10 years 30k? (am not going to buy though)
Consuming from Kafka at Org Scale
but you're railing against the limits of epistemology then, not postmodernism, but ascribing your frustrations to the latter. the amount of things we can know with any certainty is (infinitely?) many, many orders of magnitude smaller than all the information in the universe, doubly so for sociopolitically-mediated information. postmodernism is simply a mechanism for understanding/coping with how little certainty there actually is.
Works until IT resets the passwords once a month and you have to renew access on your device, missing a meeting.
It subverts your expectations about clocks.
There are viable solutions to the JWT revocation problem:

1. Make JWTs short-lived (10 mins or less), and use refresh tokens.

2. Note that for many apps, especially native mobile apps, a user rarely, of ever, logs out. And you only need to keep a revocation list around as long as it takes a token to expire, so your revocation list is often VERY small and thus can be kept in memory.

3. Thus, when a user logs out, they make a call to your server, and you store the user ID and timestamp - any JWTs issued before that time are considered invalid.

4. Write this data to postgres in a simple table. Then, using postgres NOTIFY functionality to update all your servers with the in-memory revocation list.

5. When checking a JWT, you validate the signature and check it against the revocation list.

This won't work in all cases if for some reason your revocation list is too big to fit in memory, but even then it's easy to extend it to a backing store if you outgrow this solution.
Very interesting. The Retirement Industry Trust has a long page:

https://ritaus.org/how-to-avoid-prohibited-transactions/

It's also confusing. In their "do's":

> Don’t provide more than ministerial services (e.g., decision-making) to your IRA or IRA owned entity (e.g., no “sweat equity”);

But in the "Don'ts":

"Do consider using an IRA when you, a relative or friend starts a new business."

Here's another writeup around that provision by a CFP:

https://www.kitces.com/blog/self-directed-ira-prohibited-tra...

Key quote:

> "However, if someone establishes a self-directed IRA with the aim to invest IRA dollars into a small private held business that they control or own – such that the business entity, and/or their role in the business, can cause it to be a disqualified person – there is a risk that allocating IRA dollars to own that business can cause the IRA itself to become disqualified (and treated as fully distributed as a taxable event). After all, if the IRA puts money into the business, and the business then uses that money to pay a salary to the IRA owner (as an officer of the business), the IRA owner has effectively used the assets of the IRA to enrich themselves."

That addresses the self-dealing part of a transaction like this that would be a common-sense red flag. This is all clear as mud; I'm definitely confused enough that I'll be asking my CPA for a recommendation.
"The My Book Live device received its final firmware update in 2015."

A unpatched in 6 years linux device directly connected to the internet? What could possibly go wrong?

"There is no IoT, there is only the internet of unpatched linux boxes."