skysight-inc/HackerNews huggingface dataset:
NordVPN Linux does not enforce 2FA even it's enabled in user settings
Security problem: Linux version of the NordVPN client does not enforce 2FA (Two factor authentication) even it is enabled in user settings.

After installation there the Linux NordVPN does not EVER verify the 2FA code. This is what happens:

--- snip ---

memyself@mylinux ~> sudo su

root@mylinux:/home/homeuser# nordvpn status

Status: Disconnected

root@mylinux:/home/homeuser# nordvpn login

Please enter your login details.

Email: homeuser@mailservice.org

Password: *******

Welcome to NordVPN!

You can now connect to VPN by using 'nordvpn connect'.

root@mylinux:/home/homeuser# nordvpn connect France

Connecting to France #742 (fr742.nordvpn.com)

You are connected to France #742 (fr742.nordvpn.com)!

root@mylinux:/home/homeuser#

--- snip ---

That log is from Linux Mint 20.2 with all the latest patches, kernel and latest version of NordVPN Linux (3.10.0) (normal apt upgrade process done for everything). Username, hostname etc. have been just modified for privacy purposes.

Also note note, this happened on the first run on that Linux computer so 2FA should've been enforced. But at in any point does the NordVPN client call for 2FA token. :(

Now, a honest question:

Who does not see this as a potential security hole here?
It's the NordVPN server who should ensure that not ANY client can log in without correct 2FA token if it's enabled.
Now a Linux client can any time login if correct credentials are known.

It seems that the the 2FA is implemented on the client side completely. Which is not the correct way to do it. Fake spoofing NordVPN clients start to arrive which can bypass 2FA on any account.

Windows and Mobile NordVPN clients seem to enforce it, but if the 2FA verification is done on client side then the whole meaning is nullified.

Btw, this happened when I posted the above msg in r/nordvpn

FeedbackSorry, this post has been removed by the moderators of r/nordvpn.Moderators remove posts from feeds for a variety of reasons, including keeping communities safe, civil, and true to their purpose.

Mopping a serious problem under the carpet?
They will find a way. We are nothing if not resourceful when our lives are on the line.
I can imagine loading and unloading a sub full of containers to be more difficult than an open-top cargo ship
We've proven we don't deserve the freedom of speech and we will be censored and regulated by private corporations. The Internet made people worse humans and not better.
The best YouTube interface I've yet found is the commandline "mps-youtube" (mpsyt) utility (https://pypi.org/project/mps-youtube/)

Unfortunately, it's been all but entirely crippled through API limits.

When it did work, what it allowed was:

- A terminal text-only interface.

- The ability to search by keyword or publisher.

- The ability to restrict to music, or all videos.

- The ability to set playback preferences (audio only, video, preferred resolution)

- The ability to create current or permanently saved playlists. These could be edited down from the search results.

- Runs on Linux, MacOS, Android (under Termux via pip), and Windows (Cygwin or WSL). On Android, it permits backgrounding video or listening to audio only.

- Accrues no user history.

- Recommendations-free.

And the killer feature:

- The ability to play through a curated playlist from beginning to end.

(It also suppresses advertising, which is a plus in my book.)

You could also download directly from the utility (audio, video, or both). All state are retained locally, there's no need to have or use an account.

For topics of interest, I would stack up 5, or 10 or 20, or 40 videos, and roll through them over an hour, day, or week. It was really marvelous.

As noted, YouTube killed it through their application API control.

mpv offers the ability to play back either a single video, a (separately maintained) playlist, or a channel or YouTube playlist, and is my usual go-to. It's also useful on other sites (mpv uses the youtube-dl utility which supports a whole slew of video and audio sites and platforms).

Absent mpsyt, what I'll frequently do is use YouTube's site search or a third party (e.g., DDG video search) to grab a bunch of video URLs, and either play those from the commandline (mpv will take multiple arguments) or as a saved file (useful for restarting later). This gives an ad-free experience as well.

But for YouTube itself, mpsyt was amazing.
The Explore page seems to be globally-curated stuff not based on personal taste, so it seems like the opposite of recommended.

And is that the main page for you? When I open the website or the Android app I get "Home". "Explore" is a separate tab. "Home" is pretty much filled with recommendations from channels I've watched recently, no corporate stuff (excluding ads).

I do see the issue of recommendations being flooded with one topic you've watched recently, but I generally don't have too much of a problem with it. When the recommendations stop being relevant/interesting to me, I tend to shut off YouTube.
Ebooks have been genuinely life changing for me and I will continue to enjoy them as long as I can.

Just the ability to control font face and size alone is a huge benefit I find it increasingly difficult to live without, with my shitty eyes.

There's also the matter of access. Project Gutenberg, for a huge part of my childhood when I wasn't as well off, gave me access to TONS of books I would never have been able to afford, and many I wouldn't have access to anyway. I am not only forever grateful, but also willing to overlook any imperfections and enjoy the medium.
The same thing happened to me with plants. I knew nothing about plants last year. Now I tell people I was radicalized by youtube into a house plant and pepper plant obsession.
QQ is actually just pronounced like QQ in English. If I remember correctly, it was first popularized by a type of candy - call QQ candy, which I think is where the soft and squishy meaning the OP referred to came from.

Next was QQ the software, I think inspired by the name ICQ, developed by WeChat's developer, Tencent. Prior to smart phones and wechat - QQ was the dominating platform
That's surprising to me... is it because handling the variance in buoyancy would require massive ballast tanks? I was thinking the primary blocker would be the sheer complexity and cost of the technology required to go under the water rather than on it for a long period of time.
I think it’s about being the dominant player or not, as a long time employee of a very very well known and large company once complained to me “We care about the user experience, but only when we’re not doing well”. Gitlab will continue to impress as long as GitHub exists - I’d start to worry if gitlab “wins”
I don't have specific info, but generally:

- VDOMs in general have poor performance; they perform unnecessary computations in the diffing algorithm, and even well-designed ones perform extra DOM manipulations, compared to deliberately-written code.

- The Rust WASM files would come out pretty large; a few hundred KB for a minimal app. This is better than some packages using React + common JS dependencies like Lodash and Moment, but with much room for improvement

- DOM manipulation calls made in Rust via WASM(currently!) don't have any performance benefit over the native JS API
A small nit: I think Google’s customers are actually the companies paying for ads. Its an important distinction and probably explains why their search results’ quality has gone down
See this for example - https://www.ginkgobioworks.com/wp-content/uploads/2021/05/Gi... They had 18% revenue growth in 2020 but project 75%+ revenue growth through 2025. If you do a regular IPO, you can't post numbers like this
It's one thing to flinch immediately, another to let this stand. By now there has been enough time for Mountain View to lock any Russian IPs out of Play Store moderation and to reinstate the apps unilaterally, with a clear statement that no one below the C-suite will be able to undo the decision. Otherwise, the org chart is clearly inverted.
Nicely worded and I completely agree. For better or worse, individual choice is being bludgeoned to death by today's irrational zero risk mentality.
Full ride scholarship for 100k? You can't even pay 2 years of tuition at many schools with that, but I get your point.
I did a solid for an archaeologist once in the Middle East and so stayed in the dig camp awhile.

It struck me how eager archaeologists were to get to work, and how happy they were in the field. Hot as hell, dusty, disease ridden, flies, bad food. And they were ecstatic.

They were all poor as fuck though, so there are trade offs.
Does chess really require high max V02?
I could be wrong but just firing up a modern web browser is going to use more ram than that. Theoretically if you shut down the browser and opened the app you would be using less ram? Personably would not be worried about ram on a modern device and electron apps run on most OS’s so a good choice overall.
Nah, it’s just old-school vaccination. Like chicken pox parties, but dumber.
Yes, I think you are correct actually.
You can consult with a doctor, just like you can consult with a lawyer or a HVAC specialist, but the ultimate decision is yours because you bear all the risk.
In the vast majority of cases high BMI maps pretty directly to obesity, the number of bodybuilders hanging out in the obese and morbidly obese ranges is a vanishingly small number in comparison to those overweight.

It's easier to just let the bodybuilders not take the shot - given that's their right anyway - than to use bodyfat % or some other measure as the prerequisite for boosters, even if those measures more specific they end up less accurate (hope I'm getting those terms right)
According to this article: "A CDC advisory panel meeting, slated for next week, will delve further into who will qualify for the additional dose."

https://finance.yahoo.com/news/fda-panel-votes-against-pfize...
Sure but you could argue that the ability to "apply oneself" is fundamentally just another neurological character trait also rooted in one's physiological characteristics which stem from your environment (family, socioeconomic background, etc) and your genetics... neither of which you had any control over.
Are you talking to me or the person calling me a liar? Trolling is not allowed, and a preponderence of the evidence shows the other person to be trolling (using false statements and not correcting them, calling others a liar, not engaging in meaningful debate, avoiding legitimate questions while continuing to attack, etc). I have full confidence in the mods here.
That at least acknowledges that it's an unsatisfactory situation, OP's conversation didn't even have that level of awareness.
> So this will force the issue of launch air traffic control which appears fairly primitive given that the US only has 2 launch locations.

It's at least three, is it not? Vandenberg, Wallops, the Cape?

Edit: there's also Kodiak.
>In fact it's your job to get the salary you want, not your company's. The best way to do that is to negotiate up front or leave for a job that will.

Sorry I wasn't clear enough. You shouldn't assume random strangers are in fact passive whiners. My comment was based on my experience demanding an decent salary and then leaving for an even larger raise. I've changed jobs four times since getting my degree.

The problem is your BATNA. You can't get a better deal than what someone thinks yours is. Flat out lying or even misleading someone is bound to come back to bite you in the job market, more than say, buying a car.
This is so true. I once had someone explain the problem very concisely: we tend to believe the things we hear frequently, even if we're the ones saying them. So we need to pay close attention to how we talk to ourselves.
It's an especially thorny issue for medical stuff because if you insist that all people do X and for some people that makes them sicker, you haven't actually achieved zero risk. You've just traded one sickness for another and maybe that's even worse.
As with most other studied diseases, the real risk factor comes not from high BMI per se but rather from excess visceral fat. This is linked to metabolic diseases like diabetes. Subcutaneous fat is much less dangerous.

https://www.researchsquare.com/article/rs-880193/v1

But it's expensive to measure visceral fat accurately. So from a public health standpoint BMI is a good enough proxy.
> 1) I want to suffer the pain of buying a car as rarely as possible

It is not that bad as of 5 years ago. You can email various dealerships and ask them to contact you if they are willing to sell at $x. If you are more desperate, you can ask them to email you their best offer. I was in and out in about 2 hours, just filled out forms based on what was discussed in the email and browsed on my phone in the meantime.

You can even see the inventory online at the car brands' websites. Although that may have changed in the last 18 months due to extreme imbalance in supply and demand.
I don't get it. If the article is true, then we shouldn't see any cars for sale by enterprise or hertz. What am I missing?
They'll be out of the way of surface ships.

But how will they be out of the way of each other?

Solvable problem, but not without some complexity.
This. The answer to congestion isn't more cars that are smaller and slower, it's better public transit.
The internet was a bad idea.
They could roll it out to everyone and just select/boost the data from the safe drivers.

Smells more like they know this release is risky and want to minimize the PR risk.
One Hiker’s Peak of Desperation
What makes you share such an unrelated anecdotal story here?

Seriously? Is it 'telling 'cute' stories to distract from the black box youtube algorithm that creates white supremacists' -time? It comes across as incredibly unempathetic, gaslighty and dismissive, posting on a thread that is discussing an important societal problem; especially using the word 'dangerous' in the sarcastic way in which you used it here.

It's frustrating that the readers themselves have to replace YouTube's cryptic and doublespeak-y 'borderline' label in this article with the word 'white supremacist' and/or 'alt-right' to get the real picture.
> submarines have the interesting property of being more efficient that surface vehicle because they leave no wake. A wake is a set of propagating waves that require energy to generate and this, naturally, is felt as drag by conventional ships.

This sounds off. Conventional ships experience drag when they try to go forward and there's a bunch of water in the way. When they shove that water out of the way, it has to go somewhere else, and meanwhile some other water has to flow into the space where the ship used to be. That motion of the water generates the wake.

But all of that applies just as well to submarines moving below the surface of the sea, or cars driving around within the atmosphere. If a car passes by you, you'll feel wind blowing after it. That is the car's wake. And when a submarine tries to move underwater, it runs into exactly the same problem as the surface ship -- there's a bunch of water in the way. How can it possibly move without generating a wake?
Hang on - those weren’t import restrictions though - those were extant FCC regs that US domestic OEMs needed to comply with too.

I argue that if Acorn designed the hardware ready-for-localisation then this would be a non-issue.
Wonderful triply-nested trolling, thanks for the laugh!
Okay, that is pretty crazy. I mean resistors aren't that big after all :-). Of course when the great resistor/capacitor shortage hit I looked into building a manufacturing plant in the US. It would have been surprisingly affordable however I was warned off by all of the environmental hate that would come my way if I tried.
A government agency with specific reviews periodically. Alternatively something akin to the chamber of commerce— a public private partnership.
> No good doctor would judge a patient's health solely because a single metric, namely body temperature

That's a good example because as Strathern's formulation notes, the problem lies in make the metric the target. It would be folly to think that reducing a patient's body temperature to the normal range is sufficient for curing illness. GE's Jack Welch famously focused solely on the stock performance as a measure of success. It worked, by that measure GE was wildly successful. By almost any other measure Welch destroyed GE https://www.bnnbloomberg.ca/jack-welch-inflicted-great-damag...
A 1°C difference is about 2°F. Not that much more granularity and in practice we just round to the nearest °C and it gives a pretty good idea. It’s like inches and pounds: purely a matter of habit. OTOH, using °C makes much more sense for other reasons.
Counterpoint:

In my household we have about 6 or 7 axle failures. One King, a Cruz, a Sally, a McQueen, and I think something I'm forgetting.

Otherwise on the whole the metal Cars series has been excellent over here. Through the Mack race track thing (since re-sold) and a couple other bang arounds, these look pretty good to me. From floor to sandbox to hosing down, I'm surprised how well these have held up.

Generation 1 was plastic. I get that. Gen 2 - 3 has been pretty decent manufacturing. This Gen 4 has a lot of plastic but the color-change hot/cold water trick is nice for bath time.

Please pardon the pontification, but I'm sorry you haven't enjoyed the Cars universe as much as some others. Also the level of destruction you describe is, uh, probably a different thread. You'd be surprised the resale value on those "thousands" to people who kinda sorta have fun collecting them all.

All I can say is: thank goodness I can stream Herbie movies on Disney+
IIRC they had announced they weren't going to IPO in 2020 several months prior to that change. So I wouldn't assume they just didn't realize the work involved until October. Maybe they post-poned the IPO earlier in the year because they decided they wanted to find the right person for the job.
the idea that consumer psychology is relevant at all is a deliberate effort by the industry to mislead. Recycling will never matter, not buying a new phone will never matter, that's why they have focused public attention onto those things.

collective action, largely regulation and government intervention, is the only way anything will ever change. And yes, pricing those externalities in is certainly going to make prices increase, and if your iphone costs 50% more then you'll have your "personal incentive" to hold onto it longer as well, if that's really the hill you want to die on.

phones don't matter in particular, though, and the price wouldn't go up 50%. And broadly speaking electronics are good on climate in general, climate change is largely due to energy consumption and things like not commuting are easy wins in terms of personal energy reduction. Sitting at home on your xbox tonight is way better than you driving to a concert, sitting in your home office is way better than you commuting 30 minutes each way to work twice a day.

But it's something that is near and dear to people so of course that's the thing people who are opposed to climate interventions choose to focus on, because what if it meant you had to give up your phone, is THAT what you want, huh!?!?!? Nah, I want companies to be forced to make efficiency improvements and emissions capture technologies that they don't do because it's not economically viable and nobody's forcing them, I want farmers to be forced to use low-methane-emission feeds that they don't do because they aren't economically viable and nobody's forcing them, etc etc.

Cumulatively that stuff won't add up to even 50% except for a handful of goods probably. It's just something industries use to drag their feet.
Yes, something is managing my memory. Just not GC, and not reference counting (which is also GC). As I said.

C++ has destructors, and owning pointers (called "unique_ptr"), and also arena allocators for when those are useful. Rust has its Drop trait and analogs of the other things. (Use of arenas with Rust standard library containers is approaching maturity.) They make memory management automatic and wholly painless. Both languages offer reference-counted GC for places where that is helpful, but such places are rare, and where used typically burn an unmeasurably small fraction of runtime, with no "pauses".
It can handle a pre-determined amount. Just like all gearings. :-)

There's definitely a tradeoff here, but I imagine there are plenty of applications where it makes complete sense.
Thanks. I'll keep that in mind.

I was asking them those questions to validate my answers and learn better ways to tackle those questions in the future.
Awesome looking forward to checking this out. FYI the header spacing looks a bit off: https://ibb.co/HzMNCJZ
Ask HN: Vetted homeschooling resources for kids (5-10) to learn coding?
My wife and I are embarking on a year of the nomad lifestyle, and homeschooling our kids aged 7 and 9. They are both interested in learning about programming computers. There is a plethora of options, so I wanted to draw on the wisdom and experience of HN to highlight the best of what's out there.

What courses, apps, methods, have you found most worthwhile for introducing your kids to programming?
> a disease that causes literal brain damage

For a tiny tiny fraction of the population! You forgot that bit.
Check it.

Teller, E., Wood, L., & Hyde, R. (1996). Global warming and ice ages: I. Prospects for physics-based modulation of global change (No. UCRL-JC--128715). Lawrence Livermore National Lab..
How much of her $100M+ fortune has she donated to charity? Almost none that I can see. Bill Gates and Warren Buffett have committed to giving nearly all their billions to charity but Paul and Nancy Pelosi are using their $100M+ to establish multi-generational trust fund wealth for their children and family.
This would be great. Would save so much cost if there was a standard for component, for a lot of apps especially internal business applications, building and maintaining component libs just adds so much cost over and over. At some point the web should ask how many component libs is really necessary.

We’ve been working on Lowdefy [1] which might be useful if you are looking to build apps by just focusing on the interaction / data binding of the application.

[1] - https://github.com/lowdefy/lowdefy
Hmm, not sure what caused it to end up there, but I removed it from the blacklist. It still doesn't seem to want to index the domain however, probably CDN-related.
True, I always seem to ignore wallops. Adding a civilian run launch facility is new though.
100% confidence no way, not yet, but arguably it’s a small step in that direction. Building hardware with no backdoors is impossible unless you’re talking 70’s era technology. There’s a long list of reasons why
Awesome! Can you recommend some intro resources to help someone get started? What worked for you? What didn’t?
Building a RISC-V PC (2019)
I'm afraid that just like we have very simple web sites built with large SPA/frontend frameworks, we're gonna soon start seeing those same, but now built with WebAsembly.

Let me be first saying that just like you don't need React, Ember, Angular, etc. to build your site, you also don't need the WASM as well!
That's an interesting perspective! As someone considering seed, do you consider it a useful thing to pursue Rust as a frontend language in its current form and given the state of the ecosystem? Obviously you decided to go pretty deep exploring this topic and eventually went a different route but I'd be grateful if you could share some insight here.
"First get rich; then, publish".

If that's not a law, it should at least be a rule-of-thumb.
Congrats! Great to see this from inception in 2014 to news recently that they work with Moderna to scale synthetic DNA vaccine production to global demand. I like Part Deux of their revenue stream: royalties. Taking equity stakes in spin off bio-engineered consumer products. And the best part for a biotech startup, faster regulatory approval than pharma ;)