skysight-inc/HackerNews huggingface dataset:
For passive phishing (e.g. setting up an identical website to the real one) stealing a valid TOTP token is trivial and such campaigns have already been spotted in the wild [1]

> if you think some rando can _phish_ a TOTP secret

Given the context this discussion is about (someone with a 1Password vault, storing unique passwords and TOTP secrets for each account they have) do you see any scenario in which a user gets his password stolen but not the token (or the OTP secret seed altogether)?

> Hello, dear sir, this is the USA IRS

If an attacker via a phone call is able to get the victim to (a) unlock their 1Password vault, (b) spell out their password for account X, what makes you think they couldn't get them to also (c) open their 2FA app and spell out their TOTP token?

> I previously thought that we were just having a difference of risk tolerance

The point I was making is that there are no security advantages to setting up a time-based OTP as a second factor for authentication if the secret seed is going to be stored in the same vault where the passwords are: might as well just forego this TOTP setup altogether and save the extra hassle. Or get a hardware second-factor (TPM, Google Titan, Yubikey, ...)

[1]: https://www.zdnet.com/article/new-tool-automates-phishing-at...
Your website adds an entry to the history on every keystroke. You might want to fix that (use window.history.replaceState instead of window.history.pushState).
>We had an event where DHH and a bunch of other cool people came out to support us.

I just found it amusing that you could interpret this in more than one way.
We have released a reference implementation that uses Lightway Core to create both a client and a server. It can be found here:

https://github.com/expressvpn/lightway-laser

Lightway Core is designed specifically to be embeddable and to work well on any platform without making assumptions about how that platform works (i.e. OpenVPN assumes a tun-like device).

The comparison to WolfSSL is a good one because it was inspired by their library's design. As WolfSSL is to SSL, Lightway Core is to VPN tunnels. Just like WolfSSL, how you use Lightway Core is really up to you.

For example, if you wanted to create a VPN that connects over Google Sheets or uses DNS messages, you’d be able to do that easily with Lightway Core.
if you don't trust the developer, don't buy it just like on web.

the more likely scenario is Paypal, Amazon etc. are going to provide SDKs and developer can use that for checkout instead of going through App Store.
> Only asymptomatic, more infectious people will be allowed in.

I don't see anything in the study that would indicate that people with the vaccine are more infectious than those without. Rather, the study says they are infectious.

The variable in this study was alpha vs delta variant and the result is that while the vaccine prevented the transmission of alpha variant it does not prevent the transmission of the delta variant.

This study does not address the question of whether those with the vaccine are more or less likely to spread the delta variant than those without the vaccine.
> johngalt.com [Ed. note: named after the protagonist of Ayn Rand’s novel, The Fountainhead]

Editor, Atlas Shrugged, please.
I wish you luck.

I hope the UK visa (and other safe havens?) is quick & easy enough?

I read an article the other day that CCP is not surprisingly taking advantage to get party members (e.g. spies) in so I really hope that doesn't um up the process.

The US is making this mistake with Afghanis but seems like there is enough political pressure now that at least we're getting them to a safer intermediary country. Not quick enough though.

It's our moral responsibility, just as it is UK's after their colonization and then abdication of power.
I would think the law is more concerned that the UK version of the service, is being paid for by a UK account registered at a UK address, and paying UK fees. It's still being distributed to the UK as far as every financial transaction is concerned.

But I see your point, it's a license issue. I guess Netflix's lawyers should sharpen their pencils, because what you described is already happening, because despite their best efforts, the VPN's have managed to remain ahead.
If I recall correctly that's number 13 "Bleu":

https://freemusicarchive.org/music/Komiku/Its_time_for_adven...

Check out the other Volumes too, they're all great
But for 1Password "us" was the general population, not highly skilled computer engineers.

We're not the primary target audience for 1Password, we just happen to fit under the umbrella anyway.
Recap: Saito Community Town Hall #2
The $12b described above is 120% of their BTC, then. To me, I view it as BTC that have no current USD representation in the ecosystem. They were transferred at a tiny USD per coin or something, so the total USD pressure was only $1000 and easily managed without any computer system realizing something big was happening.

So we have two major USD test datapoints: $1b (Tesla), $1000 (guy who bought 259864 BTC guy).

Swell. Let's add $12b to that list! It'll help understand what happens at 10^10 beyond Tesla's 10^9.
True. Which is why what always puzzles me is that cities like Austin or Phoenix are gaining population. It's so hot there!
They offered to pay a bug bounty to the hacker in exchange of having all the funds returned.

How much would they offer to him?
An Apple recruiter recently reached out to me. I am in a fortunate position to turn down opportunities, so I made sure to explain that I am not interested in working for a company that is at the forefront of enabling further infringement on people's privacy. If you are able to push back, do it in any small way that you can.
I don't think I'd want to live forever, but I think the time we get is far too short. I want to see an end to scarcity and poverty. I want to see thriving colonies on Mars. I want to see us figure out superluminal travel and visit other star systems.

Don't want to live forever means what? You can't know what your desire and wants will be in 20 years, let alone 100 or 500 years. It's like asking a person when they will go to a bathroom in 20 years.
BladeMasterJS – 2.0.2 – Cryptoblades Battle Calculator and Enhanced UX
The data according to Lockbit's website is not released yet -

Ransomeware site list -

http://ransomwr3tsydeii4q43vazm7wofla5ujdajquitomtd47cxjtfgw...
Maestral provides a universal binary on macOS, so it runs natively on arm64. The official Dropbox client is x64-only, so it needs to run in an emulation layer (Rosetta) on a M1. For something low-level as a file syncing service, that's very unfortunate. There are loads of request on the Dropbox forum to support arm64, but no sight of it being added anytime soon.
"krabouillator" likely comes from écrabouiller in French (colloquial/childish, to stomp and smash) that phonetically (and in young children) could be misheard or mispronounced as "krabouiller".

Source: was 5
About 2/3rds of their original letter was spent characterizing the system to warn kids about dick pics with on-device inference as an iMessage backdoor, which literally nobody serious believes.
Zero-knowledge proofs and Monero have so far proven effective. It is odd how on a tech forum, when you bring up utilizing technology for voting that you are suddenly downvoted.
Checking for CSAM isn't the issue. The issue is that Apple's system design easily extends to checking all sorts of other things - political dissidents, journalists, etc.

Not only that, it commits a felony when it transmits found CSAM to a party other than NCMEC (i.e. Apple itself).
Well, you have to physically open up the envelope to pull ballots out. You have to look up the purported voter in the registration database. Check--does it exist? Does the signature match? Did the voter already cast a ballot? Get second opinions on this data for auditability purposes. And when all that's done, now you can put it in the machine. Except maybe the machine doesn't like the ballot because the ballot had to be folded to go through the postal system, so now you have to spend time flattening out the paper to get the machine to accept it.

Let's say it takes a minute to process a single ballot. That means a single poll worker can go through a couple hundred ballots--500 is a nice round number-- a day. And all of this is going to be processed generally at a centralized facility at county level, and because of the pandemic, you might have 500,000 of those to get through. Even with 100 workers working those ballots, that's still going to take 10 days to get through everything.
You say that, but luxury real estate agencies representing multimillion dollar homes in Los Angeles will and do accept Bitcoin. It’s not just a PR stunt, I’ve seen many legitimate brokerages state they’ll accept Bitcoin (the article I link makes it sound like it’s only homes worth tens of millions of dollars, but I’ve seen it for homes as little as $1.2M)

Disclaimer: I have no stake in Bitcoin (0.00 crypto balance), but I did recently buy a home in Los Angeles. You’d be surprised how many sellers said they would treat Bitcoin as better than cash, as if competing for a home wasn’t hard enough already
IANAL but if you decided to pirate the content I could see a case for Fair Use [1]

[1] https://en.wikipedia.org/wiki/Fair_use
It validates the concern in their mind. I should have added that. It may depend on the conspiracy though. If your conspiracy is around government propaganda, it may objectively be validated by being countered by propaganda.
Netflix doesn't want to be spending time and money to antagonize its own customers. They do it because rights-holders force them to.
A slowdown of progress becomes as irrelevant as the passage of time. You'd experience more net progress anyways.

Regardless, it's still not a reason to die. You could argue that progress is meaningless with death.

Finally, progress being slowed down is something we can solve independently of death. I think it's a good idea to find alternative solutions to stagnation than literally dying - that's like solving an issue with your OS by throwing your whole computer in the trash.

Alternatively phrased, if power was already stagnated and concentrated, and you had a button to start killing a couple million random people like clockwork every year to "solve" this problem, it would be insane to press it.
If they're so great, why don't they make an appearance in the Dune series? More seriously, Frank Herbert did his research, but these do not appear (AFAIK).
I'm dying to know what other interpretation there is.
why can't these millenials just eat like... 70 less avocado toasts a day.
Neat idea, two thoughts:

On mobile, it completely breaks the back button. I had to swipe about 50 times and watch it letter by letter to get back here.

Secondly, what's the data source? I just tested 'segue' which counted as 1, which makes me think it's guessing instead of like, a word map. Just curious now.
Which "they" are you talking about?

If you mean Arizona, see Title 16:

> After the canvass has been completed, the officer in charge of elections shall deposit the package or envelope containing the ballots in a secure facility managed by the county treasurer, who shall keep it unopened and unaltered for twenty-four months for elections for a federal office or for six months for all other elections, at which time he shall destroy it without opening or examining the contents.

> The officer in charge of elections shall ensure that electronic data from and electronic or digital images of ballots are protected from physical and electronic access, including unauthorized copying or transfer, and that all security measures are at least as protective as those prescribed for paper ballots.
Evolution is already mostly over, and on the timescales that it becomes relevant we will have engineered ourselves far beyond our flesh shells.
Which 10?
This was the Astra-Zeneca vaccine, similar studies will have to be done for the mRNA vaccines.
Well it seems like simple logic no? If the vaccine decreases symptoms but not viral load, vaccinated are more likely to transmit it. Right? Maybe I’m being dumb again. Happens. :)
It's dangerous to see acceptance of death as a kind of virtue, I see many comments here showing that sentiment. The amount of funding dedicated to anti-aging research is very small, it's a tiny subset of funding for Alzheimer's disease by the NIH, $3.2b in 2021 down from $3.5b in 2020 [0]. I think it's precisely this line of thinking that explains the lack of funding and the extremely slow progress in this field.

Seeing death in a neutral light is wrong, seeing it as a virtue is absolutely sadistic. We need to stop this medieval way of thinking.

[0] https://www.nia.nih.gov/about/budget/fiscal-year-2021-budget
It's not quite that dire, as F-Droid will pop up a notification when there are apps that need updating. But yeah, you do have to tap through and confirm to get it to update, once for each app.
Inevitable doesn't mean good.
Glad you see my point. This article is about NF making this even harder, so it sounds like they are on it.

It is never about blocking 100% of things - if your wall is 99.99999% effective then you can claim to have done what you need to do to be compliant with your contract.
Overline works on the most common modern Linux default graphical terminals and is supported by tmux.

It’s great for terminal status lines.

As pointed out, this refers to the Linux framebuffer console.
woah, this is bonkers !
Since the key fact in dispute is whether the machines were connected to the internet, wouldn't it follow for an auditor to check all routers through which they could have connected to the internet. Seems like the exact thing a forensic audit should check. Since this is going through the courts, and in front of the judge. The judge will ultimately decide if the county is ignoring orders and impose sanctions. Ultimately, the judge could order a bailiff to seize the routers if they find the county non complaint.

Also since the states run their own elections and the Senate had broad oversight rights, the judge so far has ruled against the county at every step. The county is just delaying things really.
Ah ok, I noticed it was extremely blurry in the linked video, but didn’t catch them describing it.
NP.com: Rare 2-letter .com domain for sale
Bought on release, only driven by a little old hobbit on Sundays ... This domain is being sold by one of the original internet developers. Acronymic space probably NP complete.
Wait, so are you saying there's non-military people flying drones that are flying in other countries? Although I suppose that last bit is an assumption.
agreed.. i would think it would be much more effective than geoblock.
The same slack that had constant outages?

The same slack that thought secret URLs were good enough for security?

On a more serious note, I'm not sure I'd take advice from Slack on how to build a successful product when not only Teams but Discord beat them in the ground with less time and overall better product.
From what I recall, the hacker basically doxxed himself by accident by signing a message from his real wallet, linked to exchange wallets which presumably has his KYC info. From there, it was all over. Even if he could launder all that money, international authorities would find him. In fact, the writing style of his messages provide a pretty big clue where he is - Ukraine or Russia.
> by forcing apps on the iOS store to support Apple Pay and Sign in with Apple, me and my family are all the safer for it.

The legislation will still allow Apple to do this. It will force Apple to allow developers to give users a choice (in addition to Apple pay), to charge different prices for different payment methods.

You and your family will be welcome to continue paying via Apple pay if you so choose - the only thing that will change is you'll know how much you're paying Apple for the privilege of using Apple pay.
> "Just dumped all assets on [blockchains] BSC & Polygon. Hacking for Good, I did save the project."

It's a hot take, and a lot of people will write this off as pretentious and egocentric, but I believe him.

Big crypto as a whole has to stop.

The original intention of cryptocurrency was to be an experiment (!!!) with providing alternative peer-to-peer transactions that didn't rely on the value of a centralized economy. It didn't account for what would happen when a part of that load shifted to the network.

A lot of people have a hard time understanding the scale of the world's economy, but it's really something to behold. Each one of the world's 8-billion-some people need a handful of resources to survive, and to be conservative I'll estimate that the average human makes 2 transactions a day. That's 2 documented transfers, per person, per day. Those numbers add up very quickly, and if even a fraction of them start to pile onto a collapsing concept, there's no way it can sustain it. Hacks like this are an important step towards reminding people that "money" on the blockchain isn't actually money. You're purchasing a digital asset that now suffers the same issues that the stock market does, except the FCC can't do anything about it. And they shouldn't do anything about it, either. This smoking garbage pile is a great example of how such large, experimental networks can break down at every level.

I'll file it between "Exit Scamming" and "Hash Collision"
While more expensive, Leatherman Charge.

I have this on my belt and it comes out multiple times a day. I felt a bit silly at first having it on my belt but now I feel naked without it. Incredible handy to have + have to call out good replacement policy as I broke pliers once and they sent a replacement easily and no questions.
That's the irony of mtgox, it forced users to hodl that may have sold when they only 10x'd their money or whatever. Or otherwise lost it for good in non-exchange ways.
Actual impostors don't have imposter syndrome because they are talented at the only thing that matters to them: Screwing over everyone else for personal gain. And they have a track record proving beyond a shadow of a doubt that they know exactly what they are doing in that regard.

Talented people get imposter syndrome in part because it's hard to find good metrics to be confident in when people around you say "It can't be done" and then don't believe you when you say "It can be done. I know because I've done it."

Talented people often find their limits by slamming into a metaphorical wall at 100 miles an hour because they have so often heard "You can't do that" when they could that actually hitting their limit is the only real test. But doing that comes at a psychological, emotional and sometimes social cost. It hurts like a bitch and not something you want to keep doing.

It's easy to steal from other people. It's hard to study something for years, contemplate how it works, find a way to benefit without shafting other people.

And if no one believes you, no one adopts your thing. If it doesn't get adopted, you have no proof you are right.

Etc.

It can be hard to do something original in the real world. Much easier to be a con artist and to feel confident you know exactly what you are doing because all the other fools bought your BS and people are still buying it.
Exactly. There shouldn't be a private API to get your phone number. There should be a public API, and calling it should request permission from the user.

Of course, the app can refuse to function if you deny it...
The tracker mentioned here is only on the website. We will update the document to make it more clearly.
This is terrible news. I am thinking the push to subscription related to their recent fundraising round.

I am happy paying upgrade price for each new version of 1Password but I hate the idea of a subscription.

Dropbox syncing works well for me.

1Password has done almost everything they can to stop people from using the standalone version. I am disappointed and angry.
Timeline of events: https://docs.google.com/spreadsheets/d/11LUJwLoHX8ZCyfjhg5YZ...
Disks can handle 1 entire disk write no problem. Not sure what disks you're thinking of...
The article tries to imply that the hacker had a change of heart after a public plea to return the funds.

In reality, parts of the crypto community moved quickly to block transactions involving the funds and some security researchers claimed they had solid leads on tracking down the hacker’s identity. I think the hacker realized that if their identity was compromised then the legal system wouldn’t look kindly on someone stealing hundreds of millions of dollars.

Returning the funds and trying to portray the hack as a noble operation to identify flaws in the system is one way to try to re-spin the events as a positive. It appears they’re hoping to collect donations or some sort of reward as a sort of clean money takeaway.

It must have been a wild emotional roller coaster to go from securing $600 million dollars for yourself to realizing that you made a mistake that tied your real identity to the heist.
I read that book on a cross-country flight to see my parents, and it impacted me deeply.

We never know what life has in store for us, and the best thing we can do is to enjoy each and every day to the fullest.

Sooner or later, it's going to be our last.
I see what you mean by classes of problems. Some of the problems from the above links I know how to do (although working out might take some time and a pen and paper) and then there are some problems where I don't know where to start. I was just never taught how to think about numbers that way even though the link says those problems are for middle school children.
It would be much easier to bypass by using the pirate bay though, in which case Netflix doesn't get any money at all.

I think this is why they're doing it this way, at least they get paid. For Netflix it doesn't really matter which region a subscriber uses as long as they pay.

I think they just act against VPN use because the content owners force them to. They love trying to enforce their old borders in a digital world that has none. Personally I think they should be happy that users are going out of their way to pay for the content given how many alternatives are available. They even pay more for the VPN itself.

Really, how many users will go like "Oh blast, my favourite show is not available in my region, guess I better wait until someone inks a deal and allows me to watch it"?
Exactly. It may have been "virtuous" to accept death when it was inconceivable to solve.

Today anti-aging solutions are likely within reach should we concentrate research and funding in a massive push to solve the issue.

We ought to abandon our fatalistic outlook (that existed solely due to prior necessity) and sprint towards this goal with every fiber of our beings.
Excitedly bought pjg.com.au off the drop list. Because of the underline on the link, I assumed it was pig.com.au. Realised my mistake and made a list of companies with the initials PJG, pitched them, and sold the domain for 10x what I paid. Not worth the hassle all up! Looks like it's lapsed and been bought by a domainer since.
Stuff like that is really easy to say until you are actually on your deathbed.
I actually dont know enough about stablecoins to opine.

They may be fraud for all i know.

My issue was with the casual dismissal of inflation as some kind of necessity for a functioning economy.

My point is that is a priviled worldview of a typical elite that has never experienced poverty or real inflation in the flesh. Dismissing it as some kind of magic drug with annoying side effects shows lack of empathy for real consequences at the bottom 5th.

Are stablecoins better than central banks? Again, I dont know enough about stablecoins. But surely whatever answer that is out there does not include inflation or central banks as they exist today.