skysight-inc/HackerNews huggingface dataset:
I wonder if there would be an audience for an HTTP Basic Auth 2.0 spec.

Some of your criticisms aren't exactly accurate though. "Sending a password on every request requires care to avoid accidentally logging passwords" applies to almost every login system ever made. Unless you use browser-based hashing with JavaScript, but that has significant known flaws and doesn't add much security.

And "Every request needs to do password validation, presenting additional load on the authentication systems/datastores" also applies to almost every login system ever made and HTTP Basic Auth doesn't make this better or worse.
The students faking diagnosis for scripts are screwing themselves over by playing with fire. They literally can be down regulating their endogenous dopamine release and become dependent on stimulants to feel normal, therefore effectively giving themselves ADHD.

I witnessed this in med school students trying to get an edge on their exams and competing against classmates.

Be careful abusing neurotransmitter altering stims if you’re neurotypical, you may just get exactly what you asked for…
Yeah this is because the USA has offloaded making all its stuff to China. With this in mind the USA CO2 number is even worse than it first appears.
Do these form like stars (as the primary mass in a cloud collapse?), or do they form like solar planets (secondary masses around a star) and get ejected? If the former, is there any mechanism for ejecting light elements to produce something like a terrestrial planet or are these inherently gas planets?
Well, i'm not sure if click-once works outside of windows.

It's a great experience in Windows though. We have multiple internal applications running on it.

Although it's not a one size fits all solution. But internal apps that can leverage windows are extremely quick to setup with the winforms/click-once combo.

Shared network drive and everyone has an installation + auto update mechanism.

( But i guess that combo isn't popular here )
yep, exactly. When Facebook changed their name to Meta, people were looking for a good acronym for the biggest tech companies.
Neat idea. Interested in this as a user - will reach out :)
>These aren't ironclad rules, but they are each a piece of gathered advice that hold some truth in some context.

This is spot on. There is a time and a place for these "laws" which is sometimes forgotten. Don't be dogmatic about following them. They will be detrimental to a team following them blindly.
I use it as a captcha.

It's great for keeping crawler bots out, and easy enough for humans to get past.

Once a user logs in, I set a cookie, and the user is not prompted for the auth again.

The beautiful thing about this scheme is that the cookie is always sent, so I can create a rule which bypasses auth when the cookie is present.

Basic Auth is one of the most supported features of HTTP, supported even by Mosaic. There's one Chrome release, I think 65.x, which screws it up when used together with gzip and requires a page reload after authenticating, but that's the only exception I know.
I'm running a FOSS project building a Todo and collaboration (web) app. It's kind of a mix between Todoist and more pm heavy tools like Jira or Asana. It has the usual stuff like lists and tasks and then a few nice things beyond that like Kanban, Gantt and sharing capabilities. Written in Go and Vue js. We're always looking for people to contribute in reporting issues, fixing bugs, adding features etc.

Check it out here: https://vikunja.io

There's a bit commercial potential for it, given the enormous amount of paid project management tools out there, but I'm not really doing a lot in that direction right now. You can purchase a SaaS subscription but very few people do. Most of the users are people who self host.
An interview with Justin Uberti: RTC past, present, and future
What outstanding problems in web development does Rails 7 solve?
Something I’m practicing more often is to keep something dead simple and then later adopt a library or some higher abstraction when necessary.

For example, just handling a websocket myself before later using some sort of library for it.

In the past my concern was that I’ll have to make breaking changes to some protocol or message structure. But I’m learning now that it’s actually a good thing: it makes me think about how I’ll evolve and grow without the answer being “just preemptively grow it so you don’t have to think about it.”

And naturally I’m discovering that the basic tools go far further than I expect and sometimes I never need to pay for that abstraction at all.
you can tell a 4 digit zip code has a leading zero that was removed though

Only if you're 100% sure your date is completely clean. Only very rarely is this the case, especially with ZIP Codes because the data almost always traces back to human input.

The initial query may be quicker, but then you have to compensate for the missing digits elsewhere, likely multiple times. You have to consider the expense to the whole system, not just to one query.
Needs to experience a chainsaw massacre.
I don't see why that couldn't be cached.
More context: https://en.wikipedia.org/wiki/Here_is_one_hand

TL;DR:

Descartes (and others): We can't know for certain that the external world exists.

GE Moore: "Here is one hand, and here is another. There are at least two external objects in the world."

Wittgenstein was pointing out that this doesn't address any of the actual claims. (I think "agree" is a confusing word to use in the translation. "Know" would work better.)

EDIT: I'd also like to throw this Moorean SMBC sub-comic because I love it and it's relevant: https://www.smbc-comics.com/comics/20100512after.gif -- from https://www.smbc-comics.com/?id=1879
> I think that attitude is in itself completely a cultural product of the sort that Dan talks about, and which Mark Fisher lamented when he talked about the consequence of the neoliberal era to cancel any concept of the future.

The fallacy of “rapid growth forever” has been repeatedly asserted multiple times in history, to be knocked down each time. The last time we went through this was with Japan, where, in the early 80s, the prediction was made that Japanese would be twice as rich as Americans by the year 2010. And then their real estate bubble crashed and they lost a couple of decades. China today is like Japan in the early 80s with an even more insane property bubble.

The developed world keeps developing, just at a far slower pace than the developing world. If China avoids the middle income trap and reaches developed status, then they will experience slow growth just like other developed countries do. But rapidly aging demographics is a huge challenge for China to overcome in sustaining its current rate of growth before reaching developed status.
And its very doubtful that is all Exchange is doing with it. Likely they have a large list of definitions to compare and track.
I'm working on a platform for writing and publishing web-based/html books (not epub or pdf) over at pagespace.app (invite-only for now). Aiming for a sort of Substack for longer writing with one-time purchase and subscription options.

Always looking for collaborators if anyone is interested in the space. The stack is Elixir + Vue 3 + ProseMirror/TipTap + Stripe on Kubernetes for the moment. Authors welcome as well.

I've tried the Startup School co-founder matching, but no luck on there yet!
https://www.startupschool.org/cofounder-matching
That's not necessarily true, because you can combine it with cookies.

This is actually exactly how I use it: HTTP Auth is the first step to get in, then set a cookie which bypasses HTTP Auth in future sessions.

Effectively, it is a captcha.
I think you could make a similar criticism about construction and architects.. Why would an architect care about burning their limited years to establish themselves on renovations of the vast quantities of older and uninteresting house stock and why we care about software that we can rarely be paid for?

I'm sure many a homeowner is annoyed that they can't get a great architect to do their renovations, yet few are annoyed enough to influence the market.
Cosmic Crisp apples weren't available commercially when this was written [1].

[1] https://www.npr.org/sections/thesalt/2017/05/03/525421226/wa...
And how should governments react to people dodging taxes, really? Should they just stop collecting them and cease to exist?
Surely that would show up on the dosimeter?
> Basically, non-local control flow is dangerous (...)

This is the crux of the error you're making. Exceptions are not about control flow. Exceptions are a transparent and clean way to handle exceptional events. Exceptions are not intended to, say, handle the status code of a HTTP requests. Exceptions are intended to handle exceptional and potentially unrecoverable errors in a safe and controlled manner, such as failing to allocate memory, regardless of where and how they pop up.

Therefore, suggesting classical C-style return codes or specialized monadic types to handle results as alternatives to exceptions completely misses the whole point of exceptions and, more importantly, all the classes of problems they are designed to eliminate.
Boskoop is very popular in Germany , e.g. for baked apples.

https://en.m.wikipedia.org/wiki/Belle_de_Boskoop
I find a lot of libraries don’t make the underlying systems easier to use per se, they just map a lot of use cases to configuration instead of code. I would rather just use the code hiding behind that static configuration.
Serverless Authz.

Think of an authz (not authn) solution that can be plugged into next.js's serverless API (REST and GraphQL) easily through a javascript library or middleware.

At the early stages, still working out the feature set and roadmap, but looking to build a simple MVP that provides immediate value to SaaS builders.

Looking for like-minded engineers with domain knowledge in other areas (not necessarily technical) that can see how this solution may be applied more broadly.

I'm a former SWE at Google, working at a startup now, and running my own ramen-profitable SaaS (SheetUI) on the side.
Sure, patronage systems worked on a small scale. I don't think they would work in our society.

Yes, not all art or literature would stop, but the number of people who could pursue it as a profession would drop precipitously.
Before that “all mechanical” vehicles will be illegal on public road
> And "Every request needs to do password validation, presenting additional load on the authentication systems/datastores" also applies to almost every login system ever made and HTTP Basic Auth doesn't make this better or worse.

Not true. Once you get authenticated you can store that in a cookie with expiration, or any number of other ways to reduce load on auth services.
In fact, this question on the website makes no sense at all. The montana as well as the SF readings are within the noise of the sensor. ugh. sigh. FUD.

"Q: Wait a moment... why are Montana readings quite a bit higher than in California?
A: SF Bay Area is a coastal region, while the other location is up in the mountains - which means that there is less atmosphere to stop cosmic rays. The difference in measurements is quite substantial, around 40%. If that freaks you out, consider that a commercial flight easily exposes you to about 300 µR/h!"
I agree, and my state's criminal code even specificies that "Necessity" is a legal defense.

> A defense that permits a person to act in a criminal manner when an emergency situation, not of the person's own creation compels the person to act in a criminal manner to avoid greater harm from occurring.

https://lawshelf.com/coursewarecontentview/necessity-and-dur...
Ambrosia is one of the best for eating - last all winter if stored cool, firm and tastes just like a honey crisp (slightly less sweet).
The debugger is hard to beat, the rest of it is a bit crap.
They aren't numbers, easy.
It's actually an interesting discussion. After thinking about it for a bit, it seems like Google is a search company fronting for it's own ad business. In the early days their core technology probably was search but at this point it's likely adtech. At this point it doesn't matter if their search is bad (it's probably better if it is bad, as more time is spent seeing ads) as long as they are the dominant/default search engine for the general public.

There are a lot of opportunities for a better search engines but very little incentive invest into making it so.
You can also enforce HTTP Basic Auth on only sensitive URLS while allowing images and css, for example, to be downloaded without auth.
Even if there are places where it's 95% or even 99% windows, I don't think we should force the 1-5% to change their OS or deal with VMs (if you can even get graphics passthrough working) or have to work in the school computer labs.
Alire (https://alire.ada.dev/) can do the toolchain install now. It's pretty much like cargo, and can also be used to select from multiple toolchain versions.
Weber, Max (1978). Roth, Guenther; Wittich, Claus (eds.). Economy and Society. Berkeley: U. California P. p. 54.

https://archive.org/details/economysociety00webe/page/54/mod...
"Just because you're forced to accept an inbound number doesn't mean you don't log where the number came from -- the peer service provider at the very least."

And then what are you supposed to do with the peer service provider data? How the heck does that help an operator?

The whole point is VOIP and the porting rules broke the implicit trust relationships that used to exist, and the low level call routing protocols don't have a solution for that - because it could have never been a problem before VOIP and the new porting rules.

Until the underlying call routing protocols for long distance get enhanced, this problem isn't going to be fixed any time soon. And I'm not holding my breath on an overhaul of what is fast becoming legacy infrastructure. And in a VOIP only world establishing trust will be no easier, maybe harder, than doing so with email today - so that's not the answer either :p
Here’s an English version from the same site: http://www.qprc.jp/index-e.html
Im not sure how they calculated this, I work in Finance for a Equity Research team that covers MSFT and while we estimate Cloud Revs for each, MSFT doesn't actually break out Azure revs. It's part of MSFT Intelligent Cloud which also includes: "several products other than Azure, including SQL Server, Windows Server, Visual Studio, System Center, consulting services and support."
I now know there's a name for the category of my Zoom pull cord.

https://twitter.com/lanewinfield/status/1339257875034566656

I've never sold it and I don't plan to sell it. And it's definitely because of Chindogu rule 5 and definitely not because hardware scaling is very hard.
Just to give more context, he's a redux maintainer but he writes about several different subjects, Redux, React, Git, Applications in general, etc...
He makes long and thorough posts, with lots of details and great analogies.
Also: https://what-if.xkcd.com/29/
Yes, thank you.

I do think the original 14 years is a trifle short. Maybe 14 years, with a cheap 14 year extension, and then one more very expensive 14 year extension. Then you can get long-lived film franchises, etc, while works that are commercially irrelevant enter the PD relatively soon.
I’ve got a desktop it sucks just as hard on. That just makes my feet warm instead.
yep. Amazon is obsessive about customer service, and Google just isn't really.
Why should cities be expected subsidize rural and suburban living? Those higher infrastructure costs are rural and suburban problems, no need for states to transfer tax revenue simply because cities make more money for less infrastructure costs.
A nice alternative to VPN (especially when you don't have a root to set it up) is using ssh tunnels: ssh user@server -D 1234 and Firefox with socks proxy set to 127.0.0.1:1234 (e.g. using Foxyproxy addon, though possible without it via the Firefox network settings). Then all Firefox trafic is exiting on the server side (including DNS requests).
I have a few webpages that have to be protected this way, due to an external client that only supports HTTP Auth. I’ve actually been pretty happy with this setup. I have nginx configured to use subauth authentication so I can still have external username/passwords stored in LDAP, etc. It’s been a surprisingly good combination.
Yes. It's also very US-centric.

China has four times the population of the US, a comparable GDP, and isn't finished industrializing yet. If anything, digital technologies have strengthened the nation-state in China. China used to be too big for detailed central government control. "The mountains are high and the emperor is far away." Today, high speed rail and networks cut through the mountains, and Beijing definitely is monitoring what's going on in the outer provinces.

Fifty years out, the US may be a comfortable but lagging backwater like the UK, living on memories of empire.
Crypto still relies on the real banking system to feed real cash into and out of their system. States have tight control over the banks.

If crypto exchanges/standards don't want to do KYC, they won't be able to interact with the real economy.
Because married women takes care of kids? I genuinely don’t understand this question…

I guess this just serves an example how western mindset and our mindset in Asian countries are just different. Even the questions seem weird to us.
https://en.wikipedia.org/wiki/.sucks_(registry)
It's not designed around cars, but it is designed around motorbikes! Worse in many ways, although perhaps not in terms of "scale".
I do the same, e.g. to expose static resources like API docs in an S3 bucket to the world (you can configure CloudFront to check Basic Auth). However, at some point you run into issues (doesn't work well with password managers, how do new team members learn the password, no easy way to rotate passwords when offboarding, etc.).

Now I want to upgrade to a proper OAuth wall. Some server needs to act as a reverse proxy that has permission to access the private resource but checks your identity as a, say, Google Apps user.

Assuming a private bucket on S3, what's the easiest way to accomplish this today?
Twitter automatically reselects sharing of phone number during signup [video]
What sort of background is needed to work on the little projects ?. I have very less experience in compilers but I am super interested in learning about compilers and wasm.
https://en.wikipedia.org/wiki/Monopoly_on_the_legitimate_use...
I'm a little lost, what makes it a good comeback
The end of life for BlackBerry 10 and BlackBerry OS is January 4, 2022
> AIUI you would be able to reproduce Steamboat Willie verbatim

The cynic in me suspects that even this might be challenged. Is there anything specifically preventing trademark protections from applying to unauthorized verbatim reproduction, and only derived works?
They’ve actively gotten worse. I should have clarified that my “I remember when” comment applied to 5 years ago, not 15. Reverse progress on that timescale just isn’t acceptable IMO. MAUI is supposed to fix it, but I’m not sure they’ll have a developer community left to use it by then.
in my admittedly limited experience, korea seems to make great suspense, intrigue, and twist-of-fate romance dramas, while japan seems better at the quirky and the heartwrenching.

china seems better at historical/costume dramas (wuxia/xianxia being my current streaming obsession), especially for the costuming (obviously), sets, landscapes, and cultural history. they're not great for plot (holes out the wazoo), editing (quantity over quality), or writing/dialogue (uneven at best). they all lean much too heavily on tired tropes, like love triangles and (weirdly) amnesia, but are still really entertaining on balance.

i've been on the look-out to see when wuxia/xianxia really crosses over in popularity with american/english-speaking audiences, given that it's basically the chinese version of the cowboy western, simple morality tales set in (seemingly) simple times. star wars, a westernized takeoff of xianxia (but in space) seemed like a logical stepping stone, and crouching tiger, hidden dragon (one of my all-time faves) even made the leap, but didn't establish a wider popularity for the genre. shang chi, marvel's recent and modernized foray, doesn't seem to have made much of a splash either.
Blankly - Rapidly build and deploy trading algorithms for any exchange
The infrastructure costs in cities are more expensive but service many more people and economic activity, they are amortized much more efficiently than a suburban bridge to nowhere.
Because write once, run anywhere is a compelling concept.
Yeah, the balance of sweet and tart that you would expect from an eating apple is missing from Granny Smith, because that would be lost when you dump it in a pie crust with a cup of sugar. It also explains why the apple is so firm, because it's expected to soften when baked. You can eat it raw, I just don't know why you would.
Why I Live In a Shed
> There's one Chrome release, I think 65.x, which screws it up when used together with gzip and requires a page reload after authenticating

Fortunately, that Chrome version is dead in the water (unlike Chrome 49, which is the last version for XP and Vista)
Walking around Toronto, Canada, I've noticed that it's getting harder to find street signs. Their placement is for drivers in cars, not for people walking.
Your entire comment reeks of upper caste privilege. How can you blame 70 year old practice of reservation compared to a 2000-year-old practice of caste discrimination towards cementing of the caste system. Reservation is to increase representation of the backward castes in the higher strata of society and not to help the "poor". All the Supreme Court Chief Justices have been Brahmins. There are barely 4 Bahujan ministers in the cabinet. Reservation is about more than mere "helping" those who are "underprivileged". Upper castes need to first understand that.

This is not denying that politicians are exploiting the reservation system to gain votes and remain in power.
With bonus link to author's home decor recommendation, toward the bottom. Such clarity! Such brevity!

Aw hell, here it is here: https://lcamtuf.coredump.cx/geiger/
Radon should not be that bad, unless combined with smoking.

Source: live in Finland and have read the health authority info on subject.
Thanks for taking the time to answer!
On tablet it’s too tiny as well.

It did seem like for most of you pr demo about half the screen is blank. I think you could easily reduce the resolution by 1/3 and not confuse the demo at all.
previous discussion: https://news.ycombinator.com/item?id=29742682
>In nearly all of my letters over the years, I’ve lamented the idea that consumer internet companies have taken over the idea of technological progress: “It’s entirely plausible that Facebook and Tencent might be net negative for technological developments. The apps they develop offer fun, productivity-dragging distractions; and the companies pull smart kids from R&D-intensive fields like materials science or semiconductor manufacturing, into ad optimization and game development.”
I don’t think that Beijing’s primary goal is to reshuffle technological priorities. Instead, it is mostly a mix of a technocratic belief that reducing the power of platforms would help smaller companies as well as a desire to impose political control on big firms.

I have to agree with this mindset. Technology is neither good nor bad, but it could be used for bad/good things.
We should strive to progress society forward and we need to be careful with profitable distractions.
Implementing magic email sign in links is more straightforward and secure.

You implement a login route which takes an email address. You symmetrically encrypt the email with a secret key from an environment variable, and send a link to /login?secret=<email-ciphertext>. This route handler checks that the ciphertect decrypts into the email, and if true, save the ciphertext as a cookie and check that it decrypts to the right email every time you require auth