skysight-inc/HackerNews huggingface dataset:
I found that sites (like fb messenger) which block URLs to certain sites can be easily bypassed by using HTTP Basic Auth with empty credentials. I built a small service (https://rot13.akhil.cc) that takes in a rot 13'd URL and redirects it to the original with HTTP Basic Auth. The nice part is that the credentials are cached, so visiting it again won't show the dialog.
VOIP gateways upended that end to end accountability. I suppose the baby bells could just refuse all calls from VOIP gateways further relegating them to irrelevance. Good luck ever convincing a cell phone provider to do that.

Actually if phone providers would prefix calls from VOIP gateways with an asterix then I could set up a rule to just force all of those to voicemail by default. Would probably kill 90% of the bogus calls. Hell I'd pay an extra $5 a month for that feature.
HN... Where all the techies use a janky website up talk about their non-janky web projects.
The 4% rule may not be entirely reliable. See: Ben Felix’s YouTube video on the topic. I’d be aiming for a 2% rule and holding some extra cash (call me paranoid).
Just taking what would normally be a unit test and having the input values be generated. Some examples:

1. I have a test for encryption/decryption functions. The data that's provided for the plaintext, additional data, and key, is generated. The assertions are:

assert_ne!(plaintext, encrypted_data);

assert_eq!(plaintext, decrypted_data);

assert_eq!(aad, decrypted_aad);

etc

2. I have some generated integration tests. For example, in our product, there are certain properties that should always hold for a given database entry. I generate a new entry on every test and have the fields for that entry provided by quickcheck, then I perform the operation, query the database, and assert that properties on those values hold.

So to answer your question, yes. Sometimes you want to check a concrete output (ie: "this base64 encoded string should always equal this other value) for sanity, but in general property tests give me more confidence.

I find it works particularly well with a 'given, when, then' approach, personally.

edit: I'll also note that for the base64 case I'd suggest:

a) A hardcoded suite of values.

b) Generate property tests.

assert_eq!(value, base64decode(base64encode(value));

As well as things like "contains only these characters" and "ends with [=a-zA-Z]" etc.

c) Oracle tests against a "known good" implementation.
>This has many flaws that make it impractical

Just because something is simple doesn't make it impractical. Not every application requires a complex auth-flow.

>As every request is a login request, effectively

This is the case with basically every single Authentication flow in existence...at the end of the day, no matter how and where credentials are verified, there is a token that has to be sent with every request and verified server side.

>hard to easily build account recovery flows

Why?

> UX of logging in/out is browser-dependent and confusing for users

Its a display with username/password and one or 2 buttons, one of which says "Login", the other of which says "Cancel" or something similar. How is this confusing?

> it can't integrate well with other auth systems

Why?
Yes, that's very nice and all, but what does it have to do with saving the planet? Even if you don't need to have a job to survive, how do you go about helping? I'm not trying to be sarcastic, I'm genuienly curious.
Wittgenstein: Enemy Territory would make for a great game, actually.
well yes, of course! the problem with suburbs is precisely that people like them. they're a societal trap, a clear example of negative externalities
I don't see anything wrong with a convention "to log out, close your browser" especially for little internal utility pages.
I use Fastmail, and everything is great (for me) except one very annoying aspect with Contact sync.

I’m unable to sync only manually created contacts via carddav. If I sync contacts to my phone, I get every automatically created contact also showing in my contact list, which is basically anyone I’ve ever sent an email reply to.

Somehow Gmail handles this - I think they simply exclude the auto created group from being exported. I asked Fastmail support about this and there is nothing in the works to allow it.

I hope someone from Fastmail has a fix coming for this, or some other suggestion.
Interleaved Gradient Noise: A Different Kind of Low Discrepancy Sequence
If you cite the test you’re referring to, then I’ll tell you why it doesn’t apply to the title of a literary work in the public domain.
> The reality is that streetcar companies were already unprofitable

What seems to me to be a good takedown of “public transit must be profitable or be dismantled”, or “the US post office must be profitable or be dismantled” is: How profitable is the US military?
> The Go toolchain actually supports emitting instrumentation for LLVM's libFuzzer with -gcflags=all=-d=libfuzzer.

Sweet, that's a smart approach.

> Okay, and so? If this ends up making fuzzing more popular and easy-to-use, I frankly don't care if it was added as a library or deeply integrated into the toolchain.

I don't care either because I don't write Go, so just the fact that it's supported is nice for me since it encourages this in languages I do care about.

But if I were a go developer I might care a lot about how my language evolves, what's built in, what's a library, what the capabilities are, what tools I can integrate with, etc.

It sounds like they've done a pretty good job with regards to this implementation though, happy to see it.
1. You could do the same in a BasicAuth system.

2. How is validating the session-cookie validity different from validating the username/password?
Seat belts and motorcycle helmets shouldn't be mandatory in countries that don't have public healthcare, but they should be mandatory in countries with public healthcare because everyone else is paying for your medical treatment and seatbelts and helmets reduce the cost of your medical treatment.
Both. They offer us search and we offer them ads. They have to both at a high enough technical level in order to succeed.
I don't write much in Vim script, but what are the implications for my beloved, carefully tended .vimrc file?
"mnm" enables a safer, better, decentralized email network. It's open source (and not blockchain).

https://mnmnotmail.org & https://twitter.com/mnmnotmail

Because SMTP will not be fixed, here's why: https://mnmnotmail.org/smtp.html

---

Related protocol projects in development include:

https://mathmesh.com/

https://en.wikipedia.org/wiki/Dark_Mail_Alliance
So what would a mainland hospital be able to do what they can’t do? Using what supplies they can’t get in advance?
I waited 6 months for delivery of my CPU, then immediately had to wait for the RAM.. HEDT woes..
Somehow DAOs remind me of hives in "Terra Ignota".

But in the books, they still had Europe as one nation state left. The rest was consolidated into a handful hives, virtual nations with specific agendas.
> Despite the title, we do still need a small backend for writes. Every time a user modifies the data, they will need the POST to your server, which will modify the SQLite database. This leads us to the big question: how do we update the database? Cloud object stores like S3 do not allow partial file updates, so what happens when your database becomes 1 GB or larger?

> For me, the solution was lying inconspicuously in the SQLite source tree: an optional extension that allows you to multiplex a SQLite database across multiple files. Choose a chunk size, and your database will be automatically broken into multiple files as you add data to it. Now, you can just use a tool like rclone to copy the parts that have changed, instead of the entire 1+ GB database.

> This is not just theoretical. The technique above is how I built ANSIWAVE BBS. The entire BBS is hosted on S3, and every time someone writes a post, the SQLite database is updated there.

I strongly recommend authoring a tutorial on your discovery and submitting it to HN. I don't think most folks, myself included, realized that AnsiBBS was using SQLite range requests, or that you figured out how to update a multi-gigabyte SQL file in production.

You’re on the cusp of something big.
Not to mention radiation from the ground, which can be significant in some locations.
From the article:

> Some scientists believe rogue planets can form from the collapse of a gas cloud that is too small to lead to the formation of a star, or that they could have been kicked out from their parent system. But which mechanism is more likely remains unknown.
My use of the term privatized means a defense sector that can sell its weapons to anyone who can pay for them.

Been reading Major Barbara?

CUSINS. What on earth is the true faith of an Armorer?

UNDERSHAFT. To give arms to all men who offer an honest price for them, without respect of persons or principles: to aristocrat and republican, to Nihilist and Tsar, to Capitalist and Socialist, to Protestant and Catholic, to burglar and policeman, to black man, white man and yellow man, to all sorts and conditions, all nationalities, all faiths, all follies, all causes and all crimes.
Seconded. It’s one of the best apple varieties ever.
That's exactly the same with HTTP Basic Auth. Set the cookie and skip checking the credentials.

Another user even mentions doing exactly this: https://news.ycombinator.com/item?id=29762073
Do we know what Wittgenstein himself would have thought of this? Did he have opinions on "intellectual property" regimes?

Did the "intellectual property" regime contemporaneous with him writing encourage or discourage his output?

I mean, there's some thought that Giuseppe Verdi reduced his output when copyright was introduced: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1336802
Aligned Autonomy
>Over the last two decades, the major American growth stories have been Silicon Valley (consumer internet and software) on one coast and Wall Street (financialization) on the other.

I don't think California deserves this label anymore. I propose we rename Silicon Valley to "MetaSoft" valley.
They're typically 1.5-2x more expensive than other apples here (eastern Canada) depending on season
Since the site is struggling, here's the videos in top ten order:

https://youtu.be/i4p_x0S5bmQ

https://youtu.be/TXk-Oc35oN4

https://youtu.be/bVbPmFpspXc

https://youtu.be/q_JqmwwbtpA

https://youtu.be/yC5kHTsmXqQ

https://youtu.be/zWr63p3gsM0

https://youtu.be/LFvOzXUMXwM

https://youtu.be/jb29X2SrgDM

https://youtu.be/CePZ6vwYOYQ

https://youtu.be/a7LUNyMvGqU
> Nothing new so far, Steamboat Willie isn't scheduled to enter the public domain until 2024. And considering only the properties that Disney actually cares about, Snow White has until 2032.

It makes me wonder if they will push DeSantis for president just to extend copyright?
The nature of this specific bug isn't something related to hard date stuff, like leap years, leap seconds, DST, or time zones. It's just that they formatted version strings as YYMMDDHHMM (e.g. 2201010001) and tried converting that number to an int32, causing an overflow once 2022 struck.

Date bugs are hard, but this one isn't.
Yeah, there are a bazillion UIs (and most have stopped being updated) but nothing that comes with like vim/gvim. I might have looked at neovim if there was a neovim/gneovim but that isn't the case. I am okay with Lua. I am okay with Vimscript and Vimscript9. So neither of those is a pusher for me.
Which comes first, "2021-W52-6T15:10.4" or "20220101T151115.1-05"? Lexicographic sort between those two ISO-8601 date/time strings will get it wrong.

Did you mistake ISO-8601 for RFC-3339? Even there lexicographic sorting isn't guaranteed, since you can have a pure date or a pure time or a date-time combined, and there's a choice between "T" and " " to separate dates from times in a date-time but it's much more likely to work than with ISO-8601.
Adobe Audition is good for this, but I'm sure other free offerings like Audacity can do it. In Audition you can sample a quiet section of the audio to fingerprint the type of noise and then apply that noise reduction across the whole track.
I'm kind of burned out on exoplanet discoveries since they're a dime a dozen nowadays but this title caught my eye because I've been rewatching Star Trek DS9 recently. The antagonist in the latter half of the series is the Dominion empire which is unilaterally controlled by a race of hivemind-y shapeshifters called the Changelings. The only time we get to see most of their species is on their home world, a rogue planet somewhere in the gamma quadrant.

I've been fascinated by the idea of detecting rogue planets ever since and it's incredible they found so many. Unfortunately, it looks like their detection method might not be useful for older (billion+) or rocky planets (from the footnote):

> The exact number of rogue planets found by the team is hard to pin down because the observations don't allow the researchers to measure the masses of the probed objects. Objects with masses higher than about 13 times the mass of Jupiter are most likely not planets, so they cannot be included in the count. However, since the team didn't have values for the mass, they had to rely on studying the planets' brightness to provide an upper limit to the number of rogue planets observed. The brightness is, in turn, related to the age of the planets themselves, as the older the planet, the longer it has been cooling down and reducing in brightness. If the studied region is old, then the brightest objects in the sample are likely above 13 Jupiter masses, and below if the region is on the younger side. Given the uncertainty in the age of the study region, this method gives a rogue planet count of between 70 and 170.

That said, this is exciting news!

> The study suggests there could be many more of these elusive, starless planets that we have yet to discover. "There could be several billions of these free-floating giant planets roaming freely in the Milky Way without a host star," Bouy explains.
Pink Lady was my favourite apple until I happened upon a Lady Alice!

https://en.wikipedia.org/wiki/Lady_Alice_(apple)
Huh? HTTP Basic Authentication doesn't use PBKDF2 (or any other key derivation function).
Congratulations on your multiple offers! I'm still deciding whether to commit to this journey (of sorts), and your detailed guide that you wrote for your friends is what I was hoping to receive so I don't get "lost". Thank you for your gift!
> Yeah this also means that you need to update your compiler when there's a vulnerability instead of just a single point release in a library.

Has updating the Go compiler actually been an issue for you in the past? To me, with Go's stability, it's never been more disruptive than updating a library in practice, so I don't see much of a difference.
> doesn't work well with password managers, how to new team members learn the password, no easy way to rotate passwords when offboarding

This is where LDAP and similar are really strong. Unfortunately a lot of companies know that and charge big bucks for this simple feature, often hiding it behind "enterprise" subscriptions where you need to contact them for pricing.

It's also the reason why companies love Exchange and the rest of Microsoft's ecosystem.
> For Marxists everything happens because of "the capitalist class".

No, for Marxists in the period of developing capitalism the main driving force was conflict between the capitalist class and the pre-capitalist aristocracy, and after that through the present the main driving force of change is the conflict between the capitalist class and the laboring class.

> Truth is that the Westphalian sovereignty is actually a precious concept.

“Precious” is subjective; it means nothing without qualifying to whom.

> It implies in itself the right to self determination for the peoples of some place.

It justifies itself that way, and yet is, in practice, the most formidable barrier to self-determination that exists in the modern world.

> Regardless of how much the Marxist arrogance despises them, many classical liberal concepts such as Westphalian sovereignty, rule of the law and open societies are really precious achievements.

Marxist theory doesn't despise them so much as despises the quasi-religious end-of-history view of them; classical Marxism views them as important steps of progress that nevertheless aren't the end of progress and must be transcended.
Perhaps neovim isn't the Truth to which we all aspire, or care about. Certainly there are many, many ways to do things that are not newovim. If someone chooses one of those ways, 'why didn't you use neovim's way' isn't a serious question.

(Can we stop hijacking Vim threads? Submit a FPP about neovim.)
This era in computing is hot right now. Lots of us remembering, sharing our stories and the more the merrier, in my view.

I like that you are including current information and efforts, such as "A Mind is Born" demo production. Cool.
Germany Celebrates Christmas
Censorship... Such a beautiful thing, gives people time to think about life. Seriously, this is some 1984 BS. Also, if they are going to prevent you from posting it should say so before you start typing not when you go to submit.
Yeah… I heard a lot of either revolting or heartbreaking stories. But also some great and uplifting ones.

I will not lie - the moment that you are perceived as Chinese, a lot of people can become assholes. Unfortunately, there is way too much nationalistic propaganda around.

But it’s also a place full of amazing people too. People who will appreciate you for what you are. I wouldn’t write off the whole country. But you do have to develop a thicker skin, unfortunately.
I feel like this is a missed opportunity to use a name like scan4log4j
Eh this is a niche issue. I bet less than 1% of people answering NPS have ever heard of "NPS".

The only way this would be a meaningful effect is for a dev tools or similar product where your audience is the HN audience.
It's good to give it a read so you're familiar with the concepts, but then remember where the list is, or archive it so you can return to it.

Later down the line, you're going to encounter a problem and one of the ideas in the list will be helpful in framing the context of your problem. It may or may not help in finding a solution, but it can help articulate the problem to other people.
Bejing Bunker City
Biking in Tokyo is more casual and for short distance, people don't bike to work, they bike to the nearest train station or shopping street. It is very different attitude, there is no need for helmets, the speed is low and there are no dedicated lanes, most traffic is mixed with pedestrian traffic. I find it much nicer than the lycra culture of biking in countries like the US or Australia, but each biking culture makes sense when considering the different environments.
Show HN: Send Secure and Anonymous Messages
Not sure how I missed this, thanks!

Am I correct that the latter mechanism can lead to a wider variety of planet compositions, since you have the wind off the forming star to blow off lightweight layers depending on how close to the star formation happens?
What do you mean my significant?

See also: https://news.ycombinator.com/item?id=28912557
Posets aren't numbers either.
One word:
Monetization.

If I can get you to use my hardware to do computations you were perfectly capable of doing on your own hardware given the same code, you're more liable to be comfortable paying me rent. Throw in that web apps have a lower barrier to entry in terms of grokking libraries written in a systems programming language, and you have the "Software Engineering world being dominated by Web Dev".

Sad, isn't it?
“Mizuhiki” Japanese knot-tying giving connection to cultural heritage
and the cars that are there are smaller, with special kei car classes being smaller still.

Meanwhile in NA the market has shifted to ever larger and larger pick up trucks, which are more and more dangerous for pedestrians.
She likely has an empathy deficit disorder, which is typically a component in narcissistic personalities and those with Asperger’s.

To your credit, you recognized your empathy has limits; while having empathy is crucial for functioning socially, so is self preservation.
Need Alpha Tester for Elaxer – Connecting Friends, Building Memories
No, the Granny Smith is an eating apple (for instance this BBC Good Food page -- https://www.bbcgoodfood.com/glossary/apple-glossary -- lists it in the eating apples, not in the cooking apple list with varieties like Bramley). It might not be to your taste, but some people like it. I have other varieties I prefer but I'll happily eat a Granny Smith if that's what's in the fruit bowl.

Edit: in fact, I just picked one out of the fruit bowl. Yes, it's not the sweetest apple in the world, but not everything has to be. And the crunch of biting into it is good.
Is this true? As a case study, Boston’s population is about 700k, call it a million people living in a genuinely urban environment in greater Boston, of a metro area of 3 million. I think there’s more suburbanites than urbanites in most American metros.
Lua is probably way, way faster. Does that matter? It could matter. It would be awful if it did matter, and you chose wrong.
Usually, you'd be right, but actually, no it wasn't tough it seems that way now ;-)
This is, of course, paywalled, so I can't read it.

Does this article mention this as a side-effect of Trump pulling out of the Trans-Pacific Partnership (https://en.wikipedia.org/wiki/Trans-Pacific_Partnership)? Seems very relevant to any such article, and also very relevant to USA economic activity with respect to China.
How many people have died from nuclear testing?
In 2019 I was building in a side project, an oss platform to make your bookmark links public while I was learning React, but I lost my job and I had to stop. This year, I would love to start again with this project and I would love to get help and feedback.
Repo:https://github.com/zakokor/pegao
Thanks
>I wonder if there would be an audience for an HTTP Basic Auth 2.0 spec.

Yes! I remember in the early aughts, IE6 would present this cool login screen [0] for (what I think, but may be remembering incorrectly) HTTP Basic Auth. I always wanted to do that, but didn't really understand anything other than making basic HTML pages.

It could help improve security. It's a ubiquitous login screen that makes it really obvious which domain is requesting credentials - no need to check if the page looks off to detect possible phishing. Oh and you wouldn't run in to the issue of accidentally logging in on the sign up page!

[0]: https://blog.stevensanderson.com/2008/08/25/using-the-browse...
Here is one hand,
And here is another.
There are at least two external objects in the world.
Therefore, an external world exists.

As if there would not be hands in a simulated world!
Can u share the book title and author please?
You seem to be struggling with the fact that objective morality is a social construct.

It's not about WHO makes the decision. It's about the inherent quality of the decision being made irrespective of who makes it.

Of course it's your choice to drive your car into a wall at 200km/h, but in the way society uses the word "objectively" and "true" it is objectively true that driving into a wall at 200km/h is detrimental to your well-being. And it is objectively true that in doing so you are making a bad decision.

In the same way that is objectively true that seatbelts save lives, it is objectively true that vaccines save lives. Therefore not doing what's conducive to your well-being is a bad choice.

The metrics, measurements and methods used to arrive at these conclusions are as objective as empiricism allows for.

>Those who don't want to vaccinate also choose to do so because it improves their well-being

Yes. They using the exact same words. Are you convinced by their arguments? I am not.

What I am convinced of is how intellectually dishonest they are in parroting words without bringing evidence to the table.