skysight-inc/HackerNews huggingface dataset:
My favourite stupidity is related to self-service password reset questions.

You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use.

I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right?

Well, I was overseas with just my phone available to me, and one of the banking apps refused to let me use my valid password without also entering my password reset answers!

They misused the value I was only expecting to need for a reset for access.

I was totally locked out of my bank account with no recourse until I got back home and could look up the gibberish string used for the answers.
But there is a heavy multiplier on that O(1) with the default hasher in Rust. My benchmarking has shown that FNVHasher gave me a 24% decrease in execution time over the default hasher. My use case had a high likelihood of a poll on the hash indicating that there was no match, and I got a near doubling of speed just by setting the initial capacity sufficiently large.
> ...instead focus on getting the code correct the first time

This is a threshold that real-world contracts don't typically have to achieve. They leave lots of details out, or vaguely defined, because the odds are low that that part of the contract will have to come into play, and it's not worth the extraordinary effort and time and expense to negotiate every tiny very-unlikely-to-happen case.

To quote Lawrence Lessig [1]: "Often obscurity is a real value. Obscurity is what you want... In principle we should be negotiating all of these [possible things that could happen to our deal]... What contracts do all the time [instead] is they create these fuzzy or vague or ambiguous places as a gamble... And if it turns out [that this .002% occurrence does] happen, we'll ask... a judge to figure them out.

Also, if you're just going to replace one immutable contract with another, you're back to meatspace and re-negotiation, which can be time consuming and expensive.

[1] MIT 15.S12 Blockchain and Money, Fall 2018. "Smart Contracts and DApps" https://youtu.be/JPkgJwJHYSc?t=3543
Here is a great article to read on why layer1 blockchain scalability isn’t sustainable long-term (for any layer 1): https://polynya.medium.com/why-rollups-data-shards-are-the-o...

When reading about competing blockchains, it’s important to figure out if someone you’re reading values money or decentralization (and therefore individual’s digital autonomy once we enter the Metaverse). Polynya (Liberosist on Reddit) is in the same camp as me - we want the most permissionless, secure, and censorship resistant solution. As an Ethereum Dev recently put it they want to build in the MSIT secure, decentralized blockchain and as long as Ethereum is the only one providing that, they’ll keep building on Ethereum.

It’s hard to understand which protocols are the most decentralized and secure because blockchains have gone from being built for decentralization, to being marketing machines. No one really writes about things like the importance of state receipts for blockchain validation, how many chains remove those due to the storage overhead, and how users lose a lot of self-reliance when that happens. I think they largely don’t write about it because most users nowadays just want to get rich and don’t care about decentralization, but I hope that changes and people realize that we need a neutral layer to store digital assets that we actually own as the Metaverse becomes a real part of our lives over the next 10-20 years.
We wear seatbelts. And bras.
Thanks for the kind words, my goal is to make note taking portable and delightful.
This is so wrong it's astonishing, web 3 is build build using principles and designs that are decades in the making, literally 30-40 years of cryptography, zero knowledge proofs, game theory, and advanced mathematics. It's incredible that these ideas and academic papers are finally becoming real. The web 3 movement is very inclusive, but technology moves forwards not backwards.
In one of the pictures I believe I see a hang glider. I am breaking my brain trying to figure out the dynamics there. Maybe it's simpler than I'm imagining, but what happens as you fly "up-rotation" at speed?
I mean it was pretty competitive almost two years ago, but AMD made a huge leap since then. Not sure why saying a two year old CPU is outdated is a controversial take.

https://www.anandtech.com/show/15578/cloud-clash-amazon-grav...
Just anecdotally, I only hear about long Covid on HN.
The entirety of the four-year undergraduate curriculum is centered around great books, and there are no specific majors.

https://www.sjc.edu/academic-programs/undergraduate/great-bo...
Basic SQL Alchemy Performance Tips for Newbies
In the Rakudo compiler for Raku that I just tried its "chars" count using the default EGC counting is 2.
Unfortunately people like you (and me), who actually have strong passwords, let alone who understand in any detail what constitutes a strong password, are a tiny minority. They have to design for the lowest common denominator.

And even those of us with strong passwords, and a strong understanding of cyber security, are vulnerable to phishing and other attacks, that can be defended against by using MFA.

Obviously MFA can be taken to ridiculous "ten factor" extremes. But sticking with, or going back to, just passwords, isn't the solution.
At a minimum, according to my Chinese source, Beijing was also affected (though Shanghai was not). They had to wear masks, sanitize, distance, close schools, economy tanked, etc. It lasted for about a year and we never heard much about it, much as today we're being told that China only had 4,636 COVID deaths. That is, what you saw in other countries hardly even qualifies as an epidemic, unlike what my friend saw in China itself.

Wisely, the Chinese government appointed the same guy as last time to deal with the pandemic, but the dude is now 85 years old, so my friend is not sure what they're going to do next time.

Ironically, we also appointed "the same guy", but our guy is so inept he let swine flu run completely unchecked and kill tens of thousands of people (a performance he tried but failed to repeat when he, in the beginning of the pandemic told the US public "there's no need to wear masks"). He's also famous for telling people that AIDS can spread through "household contact" [1], and for suggesting that people take a fast tracked drug (AZT) as an AIDS prophylactic which was later found to have severe side effects [2]. Does this remind anyone of anything? How he managed to last 30+ years in the government given this "track record" is a mystery to me.

And if you believe stats coming out of China, you might also be interested in some Louisiana swamp land I have available for sale.

[1] https://news.yahoo.com/video-resurfaces-fauci-warning-househ...

[2] https://aep.lib.rochester.edu/node/49111
I acknowledge this explicitly in the original comment. I contest "JavaScript optional" as it implies JavaScript is, well, optional for users. I think this misleads about HTMX's capabilities, construction, and purpose, and seems easy to read as having bad intentions vis a vis <noscript>.

I admit my emotional disdain for this type of framework calling itself "modern" coloured my original comment strongly enough to perhaps make it less clear I am primarily upset about <noscript> being implied as a free capability of HTMX.
GitHub even completely omitted the login button on their top page (I think it has one now).

I used to google "github", hit the first link, only to find out there was no way I can login, google again with "github login".

This was one of the worst UX I have ever had on the web.
I am a big proponent of getting rid of the age-segregation as is it is now and widening the age range, but I'd like to see a citation on Denmark teaching Algebra later and the data on this. I read turn-of-the century math books that are years ahead in rigor and subject matter, and that seemed to fare well. There was a lot of stigmatizing of AP classes by the great "equalizers", but let the kids who can excel, excel. I am not at all a believer the "leave no child behind" philosophy. Even college-educated kids we hire now seem to be behind the group just 5 to 10 years younger in common sense, math, writing, history, and problem-solving skills, at least in the interviews I have given over the past 15 to 20 years. The odd superstar shows once in a while, but they will always thrive in any situation. Personally, I grew up with a lot against me, but I pushed and was pretty much self-taught, and I like to think I did good. I don't believe in trying to administer or legislate intelligence. Instant facts from Google does not equate to knowledge and wisdom.
If all of these companies, as well as faang are below market, who pays market rate? Who pays above market?
You want https://webamp.org/ .

There's also https://skins.webamp.org/, which, while looking at first glance like an image gallery, actually loads each skin into the fully-interactive WebAmp client as a way of previewing the skin.
People who care about user experience hardy ever talk to people who care about security in large organizations. That's how we end up with experiences like this.

Ring (Amazon) made me call them to reset my two-factor app sync. They asked me to send a bill to the address of my home via my email as a proof that this is really me and not just someone who have my password and access to my email. I asked what's the point of this if it's not really me but it's someone who has my password, has access to my email and can go login to the utility company to get a copy of my bill after reseting my password there too? They agent literally said this is the script they have to say and they don't know...
Is launch costs one of the main variables? If so, I have a modest suggestion.
Another popular saying: the definition of insanity is doing the same thing over and over and expecting a different result. Tell us again about all the awful things that will happen in the future and all the huge sacrifices we need to make today to prevent them so that people can shrug yet again and go back to ignoring you. We can either live in a fantasy or accept reality / human nature for what it is and actually start being productive.
> I assume everyone participating still feels it is a net positive for them to do so.

No, I don't, and I think some of the other people who think that are probably wrong.
Awesome - just a heads up, the discord invite link in the doc has expired.
> You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use.

> I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right?

But then you have to trust that "somewhere safe" is actually as safe as you think it is.

One alternative is to use them like mnemonic code phrases. So perhaps your answer to "What's your favourite animal?" is not really an animal, but maybe Cthulhu, so as a (somewhat overkill but illustrative) example maybe the answer would be "Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn"
> Flaws, once known, can be remediated. I don’t think macOS has bulletproof security but I’m sure glad Apple keeps updating it.

My point is that a piece of software does not need an upgrade procedure if there exists a way to install a newer copy without touching the old one. Trying to build an upgrade procedure when there is always the option to install a newer version this way (especially if it can seamlessly access the older version's state) is at best over-engineering.

> Out of curiosity, how does this typically get exposed in dApps (or wallet UIs) built on Stacks?

This is being done right now with Stacks' on-chain naming system, which is realized as a smart contract. The new naming system does not need to import any state from the old system in order to resolve pre-existing names, nor does the existing naming system need to be disabled, because the new system is instead able to call the name resolution method via this "run read-only code on the chainstate as of this block" feature. The past is immutable, so future changes to the state of the old system beyond a predetermined sunset block (defined in the new contract) will not be visible to the users of the new system.

Consider this example. Suppose the name "alice.btc" was registered at block 1000 (hash 0x123) in the old system, and suppose the new system was deployed to use all the state in the old system up to block 1001 (hash 0xabc). Resolving alice.btc in the new system runs code to the effect of:

(let (
(alice-rec (at-block 0xabc
(contract-call? 'SP000000000000000000002Q6VF78.bns name-lookup? "alice.btc")))
)
;; Do something with alice-rec
)

Internally, the (at-block) function runs the given code body with access to the system state as it was as of the end of block 0xabc. The system state is represented internally as a set of key/value pairs indexed by a forest of authenticated hash tries which make it efficient to query a key as of a particular block (see https://github.com/stacksgov/sips/blob/main/sips/sip-004/sip... for details).

Suppose bob.btc was registered in block 1002 (hash 0xdef). The above (at-block) call will not resolve bob.btc in the old contract, because its state was written after the sunset block 0xabc.
They wont be held in contempt, the court will decide the case in their default. That's what happens when you don't appear for a civil lawsuit.
It appears to be a copy of this article [1] from The Conversation (the original was published under a Creative Commons license, so I guess that's fine).

The Conversation is backed by a number of well-known universities and foundations [2], and the author seems to be a real professor [3].

Of course that doesn't mean it's not nonsense. But probably not generated by a language model.

[1] https://theconversation.com/how-to-hide-from-a-drone-the-sub...

[2] https://theconversation.com/us/partners

[3] https://www.sandiego.edu/news/biography.php?profile_id=2082
It's funny because it's strikingly similar to .NET web forms' original (and utterly trash) implementation of AJAX.

Everything that is old is new again...
My belief is that people generally quarantine after they show symptoms, so the dangerous period is the presymptomatic phase, and the length of that phase appears to be similar between the vaccinated and the unvaccinated. So it's possible vaccinations don't majorly lower R.
Based on the content of the last DjangoCon, it seems HTMX is the way the Django community is going.

Anyone have thoughts on HTMX vs django-reactor (which is a LiveView port)?
At least you admit now that it actually is breaking the law.
Tails should be able to sue Facebook then, right? https://www.schneier.com/blog/archives/2020/06/facebook_help...
Seems reasonable. They don't even require a pubic hair sample.
This is how you come up with security suggestions like "Let's just email the user a one time password on every login" which gets suggested here perennially.
All of the comments so far are about security and UX, but I read this more as a parody of the ever increasing bloat of university administration and burdens placed on faculty that go beyond their core expertise (and some mild digs at wokeism)
Is money bullshit? It's a shared myth
As far as I can tell, Zuckerberg's true talent is being thrown into situations he has no life experience to handle and appropriately picking the right people to surround himself with and listen to.
Neocortex
Everybody doing startups should pick up and read Venture Deals. It explains the various tiers of stock well.

PS the last VCs who funded us have a 2x preference (we were out of options and it was the only money on the table.) In retrospect we should have just shut down and gotten a few years of our lives back.
One of the Sean's :)
Yes. Page 7 in the document.

https://think.ing.com/uploads/reports/IIS_New_Tech_Cryptocur...

The more unstable the country, or higher inflation - the higher penetration.

I'm surprised people still ask these questions. It this not painfully obvious?
Nonsense, practice says otherwise. There might be not much incentive for gaming console hackers other than bragging rights, but incentives for state-level actors are monumental. They either can do it and keeping it quiet or they can't. Or maybe it's too impractical. Show me one article where someone claims to have extracted a key from a proper, modern smartcard.
I was curious, so I searched that typewriter ad.

Turns out there are a whole bunch of copycat sites with that ad too.

https://www.google.com/search?q=The+Remington+Portable+Typew...

The ad in itself doesn't actually sound nonsensical. Remington did make portable typewriter models, though I didn't find any pricing information. I'm also not sure what's meant by "all stores except Jamaica." I don't know if Jamaica in this case means the country or the NYC neighborhood.
The article concludes the opposite.
A push notification is still a context switch so you're really only saving the time to find your authenticator app.
Yeah, got this book and the problem was also a classical one.
What else would you expect a bank with an inflation mandate to say?

"sorry we are criminals, but it's for the best"?

You could try to pick a source that's at least not entirely biased.
The big issue with this article is that once you take a deeper look at any of the examples, they are complete BS.

A good example is Filecoin:

> So, for example, you have things like Filecoin, which describes itself as “an open-source cloud storage marketplace, protocol, and incentive layer.”

If you actually look at the finances for Filecoin, it costs the network about 10x times more to store data than the centralized alternative Backblaze. Who is going to pay 10x more for storage?

The reason for this cost discrepancy is obvious once you look at the technical details of Filecoin. Because of the decentralized overhead, the mining requirements are ridiculous. Just look at https://docs.filecoin.io/mine/hardware-requirements/. 8+ core CPU. A powerful GPU. For a data storage node!

Details for the cost computation for Filecoin:

Computing the cost of the Filecoin network is quite simple. https://filfox.info/en reports that miners are being paid 326,077 FIL a day to store 13.673 EiB. This is 0.0229 FIL/TiB per day. Which corresponds to 0.687 FIL/TiB per month. Which is $34.84 / TiB per month. For a single copy. So you probably want two at $70 / TiB per month.

Backblaze is $5 / TiB per month for a redundantly stored copy.
Right, but those aren't things an RCA is meant to address. The RCA identifies the specific method of failure. It's the starting point on your process improvement. X failed because Y, why did we allow Y to occur? The answers to those questions become deliverables.

An RCA doesn't handle those things because another section does. That way each team involved can look at what the issue was and how their team can prevent that. The authors solution eeks of a central committee that tells you how you could have prevented it, and they're often ineffective.
Do you have any investments in bonds?
Shut down this scam already!
>Clash is not HLS

i don't understand - how do you generate the bitstream if you're not generating verilog or vhdl first?
Well that already exists, Grovers algorithm is provably faster than any classical algorithm.
> verifiers need to have a copy of everything.

Hate to break it to you, but if your consensus rules permit forks, then there's no getting around this. A fork can be mined arbitrarily far in the future that builds off of a block arbitrarily far in the past.

We intend to partition state by application, for applications that are willing to trade smart contract composibility for more block space: https://gist.github.com/jcnelson/c982e52075337ba75e00b799421...

> But then again if you're building it on top of the literal money fire that is bitcoin, who cares about scalability and resource use!

Show me a more resilient blockchain and we'll build on that instead. Popular systems see lots of usage; news at 11.
No, it's more like TPM or fTPM it seems to me. Similar in purpose, not similar in structure. And external TPM are just as vulnerable.
dupe:

https://news.ycombinator.com/item?id=29319434
I've got the same question. My guess is that, unless there's something to keep the air stationary relative to the station, you're going to get what looks like a tailwind which gives you plenty of extra lift, but an outside observer will see a headwind pushing you with the station's rotation keeping you from going into a true free fall.

I really want to hear from anyone that disagrees because there's got to be something I'm missing. Ultimately we probably just need to do some testing.
I feel you are being overly pessimistic. We can still accomplish substantive change, we just need to know how to market it. A message of collective sacrifice doesn't resonate with a society like ours because we don't view ourselves as part of a collective; we are individuals. You need to alter your messaging to fit the existing culture. Changing your messaging is far easier and effective than changing the existing culture.
Very interesting. How did you deal with the issue where the old API had some feature X that wasn't supported in the new API but some customers depended on feature X?
They support oppressive regimes with their products and services, thereby suppressing public revolts and preempting civil wars that doubtlessly would claim the lives of many. Very noble of them. /S
I treat all security questions as if they are just an additional password. I use a password manager and store a random string for each required security question.
how about username / password, no rules, and that’s it
On EverRise 2.0 I make $7,000 a month in staking. Initial investment was $7k. So that’s better than any bank anything.
Hope the Aptera safety testing comes back better than these older cars. Aptera and similar aerodynamic, (hopefully) inexpensive cars are really a nice middle ground between hefty Teslas and EV motorcycles.
I think crypto-detractors and crypto-advocates alike would benefit from reading this article. The truth is always somewhere in the middle.

Crypto is neither a tupip mania scam nor a magic solution for everything. One thing's for certain, it isn't going away anytime soon.
If someone scrapes your clipboard or records your screen for example, this still adds a second layer of protection.
Math is the closest thing to magic that actually exists (and we can work on).
Adapting a design system to work for the Metaverse
They're not really desirable on cruise ships at the end of the day. They gunk up quick and don't really have a great view even clean since you're either in harbor with probably silty water, or at speed in which case it's just fairly dark turbulent bubbles that you can see.
The most insane security question I've encountered is on united.com where they have you select your question _and answer_ from a dropdown.