skysight-inc/HackerNews huggingface dataset:
I get the feeling that this seems to be a common issue with any authentication or authorization "standard" nowadays. When I had to implement SASL OUATHBEARER support, and I started poking around how to actually implement OAuth2 from the standard itself, it was similarly full of "here's several ways that you might do something, and whether or not they're supported by the provider is implementation-defined, and what you have to provide with the requests is implementation-defined, and where you go to find the stuff is implementation-defined."

And frustratingly for me--trying to implement this in the course of a SASL method as a client--there's not even anything hooked up in SASL that might have hinted at the client what to do. Which is insane because the entire point of SASL is to bridge the gap of "how to request authorization given username, hostname, protocol." It makes me want to retreat back into Kerberos as a better way of supporting SSO than anything invented in the decades after it.
This is going to be used to suppress political dissidents aka "populist/nationalist right" aka the new alqaeda

searching for CP is the original pretext
Notice: I think the vaccine is a good bet if you are over 18 and haven't had COVID yet. For the recovered? No. For children? No. Is it long term effective? I don't know.

Did the ending of the placebo control group after 2 months, nearly 2 years early, raise permanent red flags? Yes. Is there a significant chance that the vaccine will apply selective pressure to the virus leading to an escape variant? It's an interesting topic, I recommend exploring some of the lit and the current trends with Delta.

Now, back to the news media. Pfizer and Moderna alone will bring in over $50B this year. The budget for every news organization in all of America amounts to $10B. CNN's budget is < $1B. Is it plausible that the vaccine industry is applying financial incentives to folks at CNN to promote max vaccination? Given CNN's writings about the vaccine, often clearly false, I would be shocked if this weren't the case. I suspect for CNN the max-vax money must be a gold rush.
I super excited for any new FF stuff but this one mentions a lot of Windows focused (and some Mobile) - I'm over here on Linux where I've still got loads of pages that just lag. Hoping for some multi-platform JS updated soon-ish.

Side note: anyone know of any meaningful updates to Servo? Is dead? It had so much promise (IMO)
Layer 1 transactions are not necessarily 1 to 1 transactions. They can be settling millions of transactions in Layer 2 (lightning). It helps to think of layer 1 transactions as a settlement layer.
Is there a way to, even approximately, target the "social security system" issue with your vote? Or do you have to chose between 2 or 3 bundles of pre-chosen policies, the composition of which you had no say in?
Apple already uses ‘your’ CPU, battery time and network bandwidth for its Find My / AirTag product.
Why assume a state actor? Given the sorry state of DeFi contract security, it's far more likely that an enterprising hacker can gain a dominant staking position by pillaging and then staking ETH from buggy contracts.
I guess I have to tinker with the palette. Thought I didn't have to when the terminal supports a lot of colors.
You are citing a possible source of bias for three specific individuals.

That does not speak to whether the bias is present in their organization as a whole to the same degree as other publications you might more readily consider biased.
I'm a parent. It's weird seeing HN push against this.

This sounds like a feature I'd like
To be fair not sure that's the best guess :) there seem to be more female voices than men to me. Anyhow, I'd wager there's at least a 50:50 mix.
Number of trees is a bad metric, you need to know the amount of area available for gas exchange, which takes a long time to build up after a clearcut and 'old growth' forest is a complete ecosystem, something which a young planted forest can only aspire to become one day.

And that's before we get into the hardwood vs softwood differences in growth speed.
You do not seem to understand what was actually implemented.
I don't think it's implausible that I carry around a phone that has mail, contacts, calendars, photos, and private chat on it. And then, have a second, older phone that has like Instagram and mobile games. It's tragic.
This. Lots of SAML libraries don't fully implement the spec but I second what parent says. It does well for federation attributes.
Well, you had to figure it was named something in Japanese, right?

高崎山 appears to mean "tall, mountainous mountain". Monkeys aren't mentioned, though the name of the monkey preserve, 高崎山自然動物園 "Mount Takasaki Nature Zoo", does mention animals.
I think your points are mostly accurate, and that's why I led with the bit about the EFF calling attention to it. Something like this shouldn't happen without scrutiny.

The only thing I'm going to respond to otherwise is this:

>Fourth, but that's only because I slightly am a maniac, how can anyone unilaterally decide to waste the computing power, battery life and data plan of a device I paid for without my say so? (probably one of my main gripes with ads)

This is how iOS and apps in general work - you don't really control the amount of data you're using, and you never did. Downloading a changeset of a hash database is not a big deal; I'd wager you get more push notifications with data payloads in a day than this would be.

Battery life... I've never found Apple's on-device approaches to be the culprit of battery issues for my devices.

I think I'd add to your list of points: what happens when Google inevitably copies this in six months? There really is no competing platform that comes close.
Plus 90+ nuclear subs

https://www.globalsecurity.org/military/world/ssn.htm
Not sure if the CNN article is accurately representing the research, but it sounds like the social structure is mostly specific to female giraffes:
"Male giraffes, however, only associate consistently with their mothers."
White House snubs non-union Tesla at electric vehicle event featuring ‘Big 3’
It will be the parents who are deciding this - particularly if they are buying these phones.

If parents don't like this feature, they can buy a lineage OS type phone. If parents do they will buy this type of phone for their kids.
Because I had no idea Emacs is about that when I started (loooooong ago, almost 20 years ago) and by the time I found out I was already burned out. Sigh.

But I'll make time to migrate away, seems like it's time.
That's entirely GP's point: preferring to cater to those people affects the rest of us in a way we find detrimental.
Is this site critically slow in firefox for anyone else or just me? It's running at around 1fps...
Please post a link to where these weekend projects are
I’m fairly certain the age is different per region and hopefully tied to the age of consent (in this particular case).
Nobody wants to write or maintain SAML code

->

SaaS and other types of companies start solving this issue at scale

->

SAML becomes code that is mostly going through a handful of large companies that sell products in this space

->

since the protocol is now centralized, it can be updated to a better protocol
I already sent to eylenburg a small suggestion: after 2016 MacOS X is called macOS.
Buried in the 2700 page infrastructure bill
> then took on the existing alpha 4x her age, and probably larger;

Beating up someone four times your own age is only challenging if you're a child.
So what? When you don’t trust the actors running the system, it doesn’t matter if the crypto is perfect.

And right now, I don’t trust the maintainers of the CSAM database and Apple to do the right thing.
Technically speaking, if Apple plans to perform PSI on device (as opposed to what Microsoft does), how come that "the device will not know whether a match has been found"?

Is there anyone who's familiar with the technology so they can explain how it works?
I have presently have 3 gym memberships.. two of them I added during this last no-mask period.

One is probably dropping off soon (technicalities about where I live, etc., create uncertainty about the duration of that).

One is very expensive, but I love that gym, but it's less conducive to the workouts I want to do if I'm wearing a mask.

The cheaper one is closest to my house and the easiest for me to program with a mask.

I'm trying to figure out whether to pay the cancellation fees or hope for better times soon. It seems likely that I'll pay the break-up fees and keep the one gym membership because.. I agree with your prognosis. But I don't want to agree with that prognosis.
>1/3 of emissions come China which has an autocratic leadership accountable neither to its people or the global community.

China is doing proportionally more to combat climate change than we are.

>70% of emissions come from energy consumption. 35% of all emissions is electricity and heat

There are so many "easy wins" here. Better insulation and other end user improvements (e.g. heat pumps), stricter efficiency standards and mandates, carbon taxes on the most polluting industries and generation methods (i.e. make it unprofitable to restart an old coal power plant to mine bitcoin), etc.

>I'm not suggesting to do nothing, but a smug mentality of "people are just not willing to do the obviously right solution because they are stupid" doesn't solve anything either.

There's not an obviously right solution to everything, but there are obviously right solutions to many things, and we are still choosing not to do any of them.
What am I doing to fix it? Nothing!

I'm dependent, just as you say, and have no illusions about that.

Getting into this situation wasn't my decision (it was a collective "decision" of our society), and getting out of this won't be due to anything I'll personally do either.

The only difference between me and the average joe is having understood that we have a problem earlier than most.
I understand that there is potential a conflict of interest involved... but Unity's customers also want an improved product. It's a competitive disadvantage compared to unreal that they don't dogfood their own product.

Direct product flaws in Unity are more likely to push customers away to a competitor compared to nebulous business relations conflicts.
Legally: yes, federal law says that you have to be allowed to vote for the federal offices from wherever you last lived in the US (or your American parent, if you were born abroad but never lived in the US)

Reality: some states make it easy and will even let you vote in state and local elections, others make it inconvenient if you’re not with the military (have to request ballots every year, have to diligently watch for registration purges), and some make it practically impossible for non-military.

If you’re an American abroad having trouble registering and/or getting your ballots, your local Democrats Abroad chapter has someone who will help you out. Even if you’re a Republican ;)

I want as many US citizens abroad as possible to vote on a regular basis, even if they’re voting differently from me: our representatives will pay more attention to us if they see that we vote in larger numbers.
It's easy to do the math and show this is nonsense.

If a foot is a nanosecond for c, then 50ft difference is 50ns or about 10000x times smaller than the smallest difference. Even if the speed in a cable was 1%c, it's still under the proposed threshold.

Even so, try convincing my dad that it does not matter.
Solutions to climate change are not behavioral as some suggest here.

It’s about incentives.

Transitioning to carbon neutral energy is possible at the expense of businesses’ cost structure, ie. less competitive.

Same applies to building retrofitting, agriculture and other major carbon emitters.

There is no serious conversation about climate change without looking at nuclear energy; it is base load generation (24/7), cheap and carbon neutral.

Bipartisan federal mandates to scale nuclear energy is the only real solution to this problem.
Catching child pornographers should not involve subjecting innocent people to scans and searches. Frankly, I don't care if this "CSAM" system is effective - I paid for the phone, it should operate for ME, not for the government or law enforcement. Besides, the imagery already exists by the time it's been found - the damage has been done. I'd say the authorities should prioritise tracking down the creators but I'm sure their statistics look much more impressive by cracking down on small fry.

I've had enough of the "think of the children" arguments.
All data in China is already stored on servers that the CCCP has access to. Why would they need to invoke a convoluted hash match scheme when they can just perform broad checks on the data they can access?
That's why you have five topped off jerrycans in the truck bed.
> I feel like this argument really doesn't add much to the discussion.

Oh, I guess I should have just regurgitated the Apple press release like the gp?

> It runs only on a subset of situations...

For now. But how does that fix the problem of them using my device and my network bandwidth?

> I would be _shocked_ if this used more battery than half the crap running on devices today.

You think you'll be able to see how much it uses?

> Do you complain that Apple runs code to find moments in photos to present to you periodically...?

Yes. I hate that feature, it's a waste of my resources. I'll reminisce when I choose to, I don't need some garbage bot to troll my stuff for memories. I probably already have it disabled, or at least the notifications of it.
Arguably, the comment is off-topic, but TIL about bmw m1 :)
You're not missing anything. The author is rediscovering first-class functions, applicatives, functors, and monads the long way around.
Bernays' Battle Bots
Because "the market" isn't perfectly efficient at removing poorly functioning organizations thanks to various delays in the feedback mechanisms. Also, humans aren't 100% rational and are perfectly capable of perpetuating even the dumbest of corporations.

And even if they were, who's to say there aren't other criteria which wouldn't have greater influence on the success or failure than the directness of the Dutch versus the English euphemisms and couching.
There's different kinds of easy and hard. There's hard like chipping away at a complex technical requirement until you finally understand it well enough to make what looks about as good as you might hope to make it. Then there's hard like you've been debugging for many hours on a problem over multiple days, to finally discover that there is a typo in your test input.

Attending these sorts of meetings even a few times per week sounds like the latter kind of hard for me--lack of progress for no good reason and a special kind of hell to have to repeat regularly.
I experienced identity theft with Verizon, too. Way back in 2000. It was taken care of almost immediately with a single phone call. I had to mail in some proof of identity (photocopy of my water bill, IIRC) to verify that I did not in fact live in whatever place the account had been opened and that was that.

I get the sense that a lot of things that used to be easy to resolve, easy to deal with, easy in general, are actually quite painful and difficult today.
The native compilation feature that is now in the development branch makes this experience much better.
> For his next book, I suggest trying LyX and the book class with the Tufte layout for far less pain in the publishing process.

Can that stack produce well-structured, accessible HTML? Or are you suggesting that he still use HTML or Markdown as his source format, then use LyX only for the print version?
Gebru is not a Woz-level wizard like LeCun but someone who worked at Apple as an engineer and did a PhD with Fei-Fei Li cannot be dismissed as “not technical.”
The Librem 5¹ is both more powerful then the PinePhone, and is slated² to get RYF certification³ from the FSF.

1. https://puri.sm/products/librem-5/

2. https://puri.sm/posts/librem-5-update-shipping-estimates-and...

3. https://ryf.fsf.org/
> I want statistically significant proof of the correlation between working from home and company profits.

Let's start with statistically significant proof of the correlation between working from the open office and company profits. That game cuts both ways.

Or, simply let everyone work as and where they wish and apply the same evaluation and retention criteria to everyone. No need to discrimiante against one group.
Yeah, you need a lot, but the impact isn’t great if you take appropriate precautions. Also, solar photovoltaic doesn’t have that problem.

Again, I’m actually very pro-nuclear but I don’t think we should put all our eggs in the nuclear basket.
Speaking of Firefox performance, does anyone know what introduces pauses in page loading? A page of 900 bytes HTML, with 2 KB of CSS and a 33 KB background image, takes 918 ms to load. Only a third of that is network stuff (DNS resolving, TLS setup, etc.; adding up the 'duration' values). Screenshot of page with loading graph: https://i.snipboard.io/AcqWb4.jpg Notice the huge gap between HTML loaded and starting to load CSS, for example, where it does not appear to be doing or waiting for anything.

Seeing the title and initially glancing at the drawing where it says "reading XUL.dll" I thought they addressed this, as I noticed this problem a while ago and I figured it was something about this multi-process browser experience having to load everything anew or constantly do inter-process communication, but the post is actually about various other performance issues. Does anyone know what's up with this one?

Just to be clear, I'm not saying Firefox is slower than browser X or anything. I just happen to notice this in Firefox because I'm a Firefox user.
Surely not! I'm just saying I'm not surprised too much.
> Signal is still a centralised data silo where by default you trust CA to verify your contacts identify.

You can verify the security number out-of-band, and the process is straightforward enough that even nontechnical users can do it.

That's as much as can possibly be done, short of an app that literally prevents you from communicating with anyone without manually providing their security number.
His prose still kicks me in my teeth every time.

Thank you for sharing.
I'm sorry to put it so crudely, but this doesn't make any sense.

It does not cost more in 'communication' to convey a better idea.

Moreover, communications cost is marginal, so even in an very theoretical scenario in which 'more economic activity requires more communication' - it's not applicable.

"And if you're talking real economy, then we're talking actual real resources which are even more finite and scarce "

Again this is completely false.

Education, Entertainment, Legal Services, Financial Services, R&D - i.e. 'Services' are the 'Real Economy'.

The 'Value Add' provided by applied intelligence is considerably greater than the raw, natural resources economy.
We are still culturally American, and we still have family in the US. And if we visit, we pay taxes on everything while we’re there. There are taxes on the flight in, on the fuel we use, on the stuff we buy. And maybe we’d like to move back.

So why conflate being American with federal taxes and bureaucracy?

Maybe America should think about the benefits we expats provide to it while living and representing our culture and values abroad. We usually make a good impression on our country’s behalf, but everyone abroad is shocked to hear about the potential draconian penalties and compliance headaches our government forces on us.
So you can upload the colliding images to iCloud and get yourself reported for having child porn. Then after the law comes down on you, you can prove that you didn't ever have child porn. And you can sue Apple for libel, falsely reporting a crime, whatever else they did. It would be a clever bit of tech activism.
As a counterpoint, I did not like this book and learned much more efficiently from the postgres docs
Well, they forgot to account for adiabatic heating of that cold air getting pulled out of the upper atmosphere, which would have made it quite hot when it hit the ground. If I recall, that cold air was the central threat in the movie.
You are mistaken about the cause of the the Boston Tea Party. It was not about taxation without representation; it was about lack of taxation on tea from the East India corporation (which the King and his friends had a financial interest in). Many of the people protesting were owners in the local tea companies who's product was suddenly undercut because the King did not want to lose money on teas that were not selling in England.

The "no taxation without representation" was a slogan applied after the fact.
Although that seems to make sense, eagles, and most birds of prey generally have smaller eyes than humans and yet they seem to have excellent sight too? Easily 20/5 vision from what I remember for bald eagles.
What do you use to sync phone photos to your NAS? I like Google Photos' smartness, but I also want my photos on my Synology NAS.
> backlash is daft

Fighting to preserve a freedom is not daft, even if it is David vs. Goliath's bigger, meaner brother and his friends.
It is indeed a common way of parsing XML. Unfortunately, it's a bad idea when dealing with SAML.

SAML is a way for exchanging 'security assertions' - for example, if a Alice logs into the AWS Console with her employer's single-sign-on service, the SSO service gives Alice a signed document saying "The bearer of this document can log into AWS as Alice within the next 60 seconds and access accounts B and C" which she hands to AWS. The digital signature on the document is very important.

Unfortunately, SAML uses the 'XML Signature' standard [1]

The people who wrote the XML signature standard didn't just take an XML document and whack a PGP signature around the whole thing! They thought about use cases like 'what if you wanted to only sign part of a document' and 'what if, after signing, the document was processed by something that reordered the attributes' and 'what if you have signatures from multiple sources and want to collate them into the same document'. They decided they wanted to support all of them.

As such, it's entirely legal for a document to contain a valid set of properly signed security assertions and a load of different security assertions that aren't signed.

So SAML documents have to be parsed very carefully - if you naively check the document has a valid signature then read the assertions, an attacker can add extra assertions outside of the signed part of the document, granting them broader permissions than they ought to have.

[1] https://en.wikipedia.org/wiki/XML_Signature
Apple’s press release is a lie.

iCloud stuff already isn’t E2E and they already scan.

This system is built exactly to surveil the entire contents of your mobile device, cloud enabled or not.

Apple has burned years of social capital in 2 days.
Yes, I don't remember the actual ratios but it's much fewer representatives per person for citizens living abroad.
Unfortunately a big bulk of the data they profit off of is simply the ads and on-platform communication and behavior. Doesn't really matter if you use a different device if you still use the platform. Sure, it's slightly better, but it really isn't a silver bullet if you're still using it. And this is coming from someone who does this already.
Honestly after using Android for so long too, even just AOSP has gotten much more user hostile.

Running root used to be very simple and semi-sanctioned. Now you have to essentially rootkit your phone (Magisk) for it.

Most of the AOSP programs are abandoned (thankfully ROM maintainers update them!), and you have to deal with a lot of things not working with Google Play.