skysight-inc/HackerNews huggingface dataset:
In case you haven’t seen it - the TreasuryDirect password policy is almost comical. There’s a screenshot in the repo.

The website disables the password input field (and password managers with it). To “type” your password, you have to use some on screen button-based keyboard monstrosity.

If someone wanted to make fun of password rules, this would have been great satire. But no - this is actually how you buy bonds from the US treasury.
I really hope it's a bowling-ball-sized black hole so we can start slingshotting rockets off into deep space.
Both buying a house and investing elsewhere are very sensible options.
> Put on your wired headphones. Sit down (e.g. on the bus.) Now try taking off your shoulder-strapped bag to hold it in your lap, without first taking out your headphones.

Well what I used to do when I had wired headphones was run the headphone cable under the bag so to speak. As in put on my headphones and then put on my bag. You just need to make sure you have enough slack in the headphones above the bag strap, which... I dunno I never found difficult. I just habitually put on my bag second, or would place my ear buds in my shirt/cups around my neck at least before putting on the bag.

Don't get me wrong it's nice for that to not matter with wireless, it's just the way you've phrased this implies to me putting the headphones on first and bag on second so the bag strap sits on top of the headphone cable never occurred to you and honestly that is confusing me
Why does a federated sign-in solution for a third-party web app need to authenticate to the homeserver or access Matrix APIs on the users behalf?!

That’s exactly what you want to avoid.

The bot can still get things shared by the user like username, avatar, 3pids and pubkeys.

Can you give me a use-case that my proposed solution is insufficient for due to inability to impersonate the user to the Matrix homeserver?
A research paper "Investigating The Reproducibility of NPM Packages"[0] found that "Among the 3,390 versions of the 226 packages, only 2,087 versions are reproducible". (Coincidentally that paper was published in September 2020 too).

There was an earlier project called "Trust But Verify"[1] which tried to detect discrepancies between published NPM packages and the corresponding (inferred) tag/commit in the source repository, but sadly it doesn't seem to have gained traction.

Interestingly, the "Gold" standard of the Core Infrastructure Initiative (CII) Best Practices guide[2] is to have a reproducible build, but it is only "SUGGESTED that projects identify each release within their version control system", so presumably packages are free to indicate which commit they are built from in an ad hoc out-of-band way, which may not be amenable to automated third-party checking.

[0] https://people.cs.vt.edu/nm8247/publications/icsme-camera-re...

[1] https://hackernoon.com/what-if-we-could-verify-npm-packages-...

[2] https://bestpractices.coreinfrastructure.org/en/criteria
Days of Rage (2017)
> You could message the owner of phone directly through a URL. The request would be handled by server on phone!

I know it's not like a web server on the phone or anything, and likely questionable to mention it at all (since I made it), but I made a thing that lets you send notifications to a phone (or desktop) via curl [0] via a simple PUT or POST. It's definitely not a cool protocol since it's simple HTTP, but it's in the spirit of other Unix tools since it's just one thing to do one job.

[0] https://ntfy.sh
It even fits within the game world in terms of using a whiteboard to plan a heist.
What do you believe the data will say about my statement? Will the data disprove it?
A one-time appeal to billionaires
Yes, a worthwhile YT subscription.
That's your preference. However from a safety standpoint it is better to return an Optional[Int] or pass a NonZero[Int]. These two checks eliminate an entire class of runtime errors from ever occurring and that is a quantitative metric that is definitive.
A big difference between the rubygems and npm ecosystems is that most gems tend to have a lot less dependencies themselves that JS packages do.

Looking at a Rails project I've got open, it has ~100 gems in the Gemfile, and 200 gem dependencies overall.

Compare that to one of the Typescript + React projects I work on, which has ~200 dependencies in package.json and 2300 packages in node_modules.
Nobody really knows what'll happen with housing.

There are a lot of people dumping in cash, hoping to double their investments in a span of a couple years. Many are successfully doing this.

There is also a growing percentage of people who are being completely priced out of housing due to it becoming a wealth exchange among the rich.

Can housing prices keep growing infinitely with fewer and fewer actual people buying them? When the last recession hit, a lot of people thought no, it can't happen and things will level out from here on. It turns out prices did simply keep going up and up.
Awards awarded by.. other people.
Just watch what you like
Those are PRNGs, not hash functions.
Or build a Dyson-sphere like machine around to capture its energy and power humanity for ages
>Red Notice is #1 with 149 million hours viewed

This number is so large that it makes me question the accuracy. The movie is 115 minutes so this is 77.6m views if we assume that everyone who streamed it watched the entire thing and only watched it once. It looks like the most recent numbers say Netflix has 209 million subscribers. That would mean 37% of the global Netflix subscriber base watched this movie in the first few days after release. That is literally unbelievable.

It isn't directly comparably to theatrical box office numbers, but the total viewers would likely translate to at least the 2nd biggest opening ever for a theatrical release. That would be a ridiculous accomplishment for an original movie. There is not a single non-franchise movie in the list of top 50 biggest openings ever[1].

And before anyone responds, yes I understand that the assumptions I made would impact these conclusions, but the assumptions are working in opposite directions, at least partially cancel each other out, and are mostly just used to show approximate magnitude.

[1] - https://en.wikipedia.org/wiki/List_of_highest-grossing_openi...
Not sure.. It was such a terrible movie, even half an hour I tried to watch will require therapy to forget.
Twitter just changed their flow that breaks autofill from iOS password manager apps and also breaks with autofill of the username and password and TOTP authenticator code on the web browser with browser extensions. This is a big company with massive resources.
A few people have objected this line:

> [The lesson is] not about making friends with the right people

As making friends with the restaurant owners and the delivery guys was absolutely the key to my friend's success. To which I 100% agree. So I made it clearer:

> [The lesson is] not about making friends with a developer

The point I am trying to make is entirely different: our friendship didn't force me to write the code the way it was written. The limitations we had did. And it's possible to do it with non-friend developers as well: just limit the budget.

If a client comes to me with detailed scope of work and unlimited budget, I will make sure to build something truly amazing and earn a new house in the process. That's just how human brain works. But if they approach with a limited budget telling me to do the best I can, I might build something good enough to launch.

Now that comes with a different problem: most clients will want more after you have done your best for the budget. That doesn't necessarily mean they're bad people. Friends will do the same. Don't remember for a fact but probably my friend also asked for some more stuff, to which I would have said no. Ability to say no is absolutely crucial, be it with clients or friends. Better people than I have written on the matter so I won't bother you further with my thoughts on this.
Everything about this just seems to scream of wholesomeness, and wholesomeness is boring as hell.
We've banned this account because it has only been posting flamebait and/or unsubstantive comments. That's not what this site is for.

If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. They're here: https://news.ycombinator.com/newsguidelines.html.
You're right that the bulk of them will have been resolved... but... given the sheer continuous volume of them for Netgear, does that actually help?

It seems there will always be enough undiscovered or unresolved vulns "in flight" to compromise it on demand.
> Shockingly few people really know what they're doing.

Unfortunately that includes the people who think their NIH wheel will be much better than the existing one. In fact, the Dunning-Kruger effect would suggest that people who don't know what they're doing are disproportionately likely to be in the latter group.
> The way our cities are designed also plays a role - mostly they're designed around the automobile

+ kids who can't drive suffer
ARM is merely a commercially successful microarchitecture that turned out to be good at being optimized for mobile application.
After Trump was elected, economic optimism among Republicans went from 15% to 74%. Democrats economic optimism dropped by half.

The main thing that matters for perception is the person in charge.

https://www.cnbc.com/2016/12/09/optimism-on-economy-stocks-s...
Sure?
https://news.ycombinator.com/item?id=29249325
Squid games isn't remotely gory. In fact it's only a slight step up from nothing. There was only one gory part and that was the glass game.

The old days where baddies died without a drop of blood were pretty bad. It was just cheaper.

The show is good. It's not amazing, but it's good and it wouldn't have made sense to use olden style of "no blood, ever".

And I'm actually quite squeamish, so understand that.
Yes. They also don’t come lightly preseasoned for $reasons that have to do with aesthetics and cost, so you need to season them “from scratch” like people used to do with cast iron once upon a time. (All the cast iron pans sold today come with a “starter” seasoning because of how porous cast iron is - otherwise your butter would stick until you got a seasoning going.)
Shameless plug: You can use https://volt.fm to search Spotify music by genre.

Just use the search bar or browse artists/tracks/users to discover new genres.
I'm surprised that nearly 30 percent of households earning under $15,000 a year don't face severe housing cost burdens.

Although, do we expect that group of people to be able to easily afford housing in a good economy? I would guess that this group has a tough time affording housing in any economy.
Types don't make you write better code. In my opinion TS makes writing bad code easier because intellisense. Every TS project I have worked on is as messy as the JS projects.

I have nothing against type systems. I have years of experience with C, C++, and Java. However, I happen to think functional programming is a lot more "game-changing" and TS makes writing functional code more difficult. But hey... types are enterprise so it must be good.

I would truly appreciate it if our industry would dedicate more time to training both new and senior devs to write better code instead of chasing the every popular/new language/framework/build-tool that promises to solve all the things.
Generated types are fine (if a bit cumbersome) when you trust input. When you don’t, “parse [don’t validate]” and produce static types at the place where input becomes a known quantity.
Biggest social equalizer I've seen, especially in NYC/Chicago.
upvoted, happened to me, and I had two kids from her. The moment she knew she could do it, she used ALL the power the laws gave her, and until today I am harassed by her. Not worth it, never again. Marriage is the biggest scam we were miss-educated about.
If the person you're replying to didn't turn it on and it's on, it's not opt-in. That's opt-out.
Why can't we try the app directly without logging?
The Catholicism in this piece seems tacked-on; it has much more to do with the Philip Agee phenomenon, and with criticism (no doubt well founded) of the CIA's Cold War role as an instigator of war. Agee, ironically, was turned in part by his experience of the oppression of Catholic liberation theologists in Central America.
Canadian banks are the most profitable in the western world, because we pay the highest fees in the western world.

A lot of it is hidden - Canadian banks charge outrageous sums of money for foreign exchange fees. Credit card interchange fees are reliably a full 1% higher than in the US. e-Transfers are intentionally limited in size so that banks can still make their money on credit card payments etc.

Interac is a bank-owned monopoly, and merchants eat astronomical fees even though it's nominally "free" to send an email money transfer to your plumber.

The more you dig into the Canadian banking ecosystem, the more you realize how powerful it is and how much rent-seeking is really going on.

The amazing part is that they've convinced the average Canadian that this oligopoly is actually good for them. Marketing works!

Anyone working in the financial services space, however, understands that the reality is really much darker than people realize.
To be fair to Musk, this is not "Ending World Hunger". It is ramping up palliative measures that don't solve the root cause and entrenching that further as the "solution".
I'm appreciating some of the attempts of SQL injection

https://plan.cat/~yes
I worry about these second-order effects too. Is the eventual aim that 2FA will tie packages to people's government IDs (either via their phone number, or some sort of biometric system)?

Before we start gatekeeping Free Software development with a "trusted developer" system, we need to make sure that this system supports pseudonymous identities, so that people don't have to dox themselves (even to their own government) to be able to make contributions.
How would that fix the issue? There’s no timeline here, it could have been vulnerable since day 1. All you’d be doing is inconveniencing your devs.
That's why I said "oversimplified". Is there someone willing to pay them more at the moment? Why not? Is $20m per actor a universal constant? That's how inflation works.
My anecdote is much older, but problems with reachability on .0 addresses was reported at Yahoo as well; I think .255s also had issues, so even in wider than /24 subnets, vips would not be assigned with last octet 0 or 255. From what I recall, it seemed to be CPE like modems and sometimes wireless routers that were blocking packets to (or sometimes from) the .0 and .255 addresses, usually under the guise of security; but it didn't seem to be ISP routers, or at least not often.

RIPE Atlas can be useful for testing (my node just hit its 5th birthday!), but this might be something better tested with random clients. If you can convince someone running a speed test site to include a .0 test, that may be a way to get a little more coverage; or if you have budget, you might be able to make something work with web ads that beacons to a .0 and a .something else, and count the returns, etc.

EDIT: I hadn't seen the EC2 reachability test; it's got some nice test addresses like 100.24.0.0 and 107.22.255.255, so that seems pretty comprehensive. It would be interesting if someone at AWS can share statistics on if there are significantly fewer images loaded from .0/.255 addresses than otherwise; and if they can narrow that down by AS or otherwise. Publicly would be great for my knowledge, but at least sharing with the ietf would be useful for decision making.
The word “Milpitas” sounds kinda funny in Polish, honestly, in a hard to convey way.
By far the most frustrating password-handling sin I've encountered is when a website silently truncates the password field to some fixed length.

This is especially bad when you use a password-manager, as the password-manager will remember the full length password, which will be different than the truncated password the website is using. This wouldn't even be much of an issue if each website was at least consistent about truncating passwords, but often the account creation page and login page have different behavior (e.g. the account creation page truncates your password, but the login page doesn't, allowing your password manager to happily enter the full length password on the login page, thus resulting in a login failure).

The first couple times this happened I was perplexed, but I've been burnt by this so many times now that I've resorted to opening up my web browser's devtools on any account creation page to check the password <input> for the maxlength attribute (because yes, many websites don't even mention the maximum length).
That points to the underlying problem: a crap standard library. If extremely common functionality has to be outsourced to (short but) completely non-obvious third party modules, the standard library has failed at its core task.
I'm amazed at how a hyper-violent show like Squid Game could become a mainstream global megahit. But still, I know many people who haven't watched it because it's so violent. Same with Game of Thrones and Breaking Bad (though I find those shows far, far less disturbing than Squid Game).
Wholesomeness does often end up being boring, but hopepunk is almost the antithesis of wholesome. It's about how working hard, getting your hands dirty, and making hard decisions can lead to a better world.
I haven't thought much about the significance of the week creation in genesis, but it's a good point. I kept expecting some alternatives,
Maybe months by the moon and then numbers for the days but no day names?
Until you use your credit card. Interchange fees in Canada are a full 1% higher than in the US, on average. You pay for this in higher prices on goods and services.

Or until you buy something in USD. Foreign exchange fees in Canada are a multiple of what they are south of the border, and Canadian banks ruthlessly protect this business by refusing to bank money service businesses that compete with them.

Canadian banks are the most profitable in the world, and they're really good at making customers think they're not paying that much for the pleasure of feeding the oligopoly.
Yes there are trucker pumps in the USA and those have different fill rates - 10 gallons is just the consumer pump rate
The author wants feedback. Well, the article by Tong which is mentioned here https://math.stackexchange.com/a/2092943/124777 gives a deep and surprising reason for the relationship between surface area and volume.

The referenced paper is currently available for download at https://www.maa.org/sites/default/files/0746834257453.di0207...

The same explanation is given by a video by Mu Prime Math on YouTube: https://youtu.be/cCwD38lw4ow

IMO arguments involving the apothem of a polygon are obsoleted by Tong's insight. It becomes clear that it's just a coincidence that the "natural" parameterizations of these regular shapes give a neat answer.

The basic observation that area scales as the square of a representative length, for any shape, comes into this discussion as well:

The Pythagorean theorem: what is it about?
Alexander Givental

http://math.berkeley.edu/~giventh/papers/eu.pdf
Nebula Hackathon 2021 is live now
How is that the 'antithesis' of wholesome? It sounds more like the plotline of a Sunday sermon, or a Disney movie

Or is this another situation where the original word is stolen from its vibe and repurposed solely for its meaning?
I'm reminded of some classical movie where the guy, having been wrongfully imprisoned or something, decides to make a comedy because people need to laugh during dark times, not be reminded of their struggles.

Though I think we need solutions more than we need upbeat, feel good stories of some sort. I just don't know how one finds that thread to pull.
The Insurance Industry Embraces Artificial Intelligence
This from the article:

The original quote (from 2012) is from another former mayor of Bogotá, Enrique Peñalosa, and it reads:

Una ciudad avanzada no es en la que los pobres pueden moverse en carro, sino una en la que incluso los ricos utilizan el transporte público.

That roughly translates in English to:

An advanced city is not one where the poor can get around by car, but one where even the rich use public transportation.

-

I think the mayor is referring to a city being safe enough so that even the rich can public transportation. In many parts of Colombia public transportation was too dangerous for the rich as they killed and/or kidnapped. The rich used to travel in armored vehicles with protection in Colombia.
Netflix Top Ten
Why Health Care Workers Are Quitting
What a thought provoking point. Advanced cities are good enough that the people who could pay for more are still happy with the same.
For context, this is not the well-regarded CSPI (Center for Science in the Public Interest) that's been around for 50 years. This is the right-wing "think tank" CSPI (Center for the Study of Partisanship and Ideology) that was created about a year ago.
One of the best engineering (and life) tips I’ve learned is to beware anyone selling silver bullets
I've been using JS on and off in various incarnations, and this sort of blows my mind. First because I don't think I've ever seen that approach used anywhere, and second because it would probably take me upwards of an hour (possibly a day) to work out whether that would actually work.
Hey don't listen to me, I only lived there for 35 years. But maybe listen to some professors of supply chain management instead:

https://www.cbc.ca/news/business/bc-floods-rail-impact-1.625...

A large part of Vancouver's food comes from the Fraser Valley by truck -- through two municipalities that are now under water. The mayor of one of whom is already wondering whether farmers will be killing all their livestock.

It's a fuck of a lot worse than a cancelled snowboarding trip.
Fortunately there is an option (--ignore-scripts) that prevents all code from running at install time, and there are solutions if specific scripts do need to be run. Such examples are so rare, though, that there is an active proposal to make this option the default.

https://github.com/npm/rfcs/pull/488
It doesn't even need to wake up over and over if you set up the LDR to trigger an interrupt to wake it up.

Just put it to sleep indefinitely, and set it to wake from a pin change interrupt.

You'd need an RTC as well so it can log the time though.

For example a STM32L031 uses 0.5uA in sleep mode.
This is a science project, not a commercial offering. The goal is to prove that it's possible to build a quantum computer that can do something that's intractable on a classical computer.

Unrelatedly, I find it hard to believe that, if a technology were invented that could do quantum simulations in a few minutes that take a week on a classical supercomputer, people wouldn't find economically valuable applications for it.
Maybe I just had bad luck but my two most recent Asus Wi-Fi routers are dead, unsupported, and no Linux/OpenWRT.
> Especially people buying condos; a big part of the point is that a lot of the hassles are taken care of for you.

I sometimes wonder about that. For what it costs in ongoing condo fees, you could pay someone to provide exactly the same level of worry-free maintenance on a regular house.
Yeah, I understand some confusion there. Perhaps it's getting wider. On the right side it was White Nationalism coming out of the shadows. The politicization of vaccines (which prior to covid was more the domain of soccer moms (falsely) worried about autism.

Sure on the left you've got LGBQTXYZ rights but that's been a thing for some time. I'm kinda drawing a blank here so feel free to share.

This divide is no organic accident -- it's being actively promoted. Team Red vs. Team Blue is a master stroke in ye olde divide and conquer game.