skysight-inc/HackerNews huggingface dataset:
Interesting article but it relies primarily on people posting on Twitter that they have been diagnosed with depression. I have to wonder how many people with depression actually do this, and whether this ends up producing a rather unique and self-selected group who’s social media habits may not necessarily represent the “norm”.

And this from the introduction seems to be a bit of a simplistic conclusion:

> These results suggest that diagnosis and treatment of depression may focus on modifying the timing of activity, reducing rumination, and decreasing social media use at specific hours of the day.

I find this odd partly because the three things listed here are “actions” and don’t seem to contribute to “diagnosis”. I assume they meant that late night social media use may be symptomatic of depression but they don’t seem to actually say that (nor does this seem to be a strong conclusion to draw from this particular study?)

Secondly, it’s well known that reducing rumination is an effective treatment for depression and that’s one of the things that CBT interventions help to tackle.

So this leaves us with “modifying the timing of activity and decreasing social media use at specific hours of the day” (which appear to be the same thing).

Now there is likely something in this. Eg Trying to break bad late-night habits of reading social media instead of sleeping, but I’d also argue that this is more of a symptom of depression rather than a cause (though it’s definitely a vicious circle).

Perhaps I’ve just got my cynical hat on. I have to admit I haven’t read the entire paper so perhaps it’s just the intro that doesn’t do the best job of summarising the results. (Or I’m not being charitable enough in my reading of it).
It's the underpinning of the Web Monetization effort backed by Mozilla.

https://webmonetization.org

https://grantfortheweb.org
Circle Inversion
Tagging onto this
Here is a definition of "work" form Portugal[1]

If you look at vaccine doses per person over time, and graph of cases per person over time, in one of the most vaccinated countries in the world, you see not only no effect, but the worst effect happening at the most-vaxxed time. If they stop transmission the effect at this point is miniscule. If you didn't label the first graph, you might be tempted to blame it for the second graph.

(nota bene, vaccines show a clear effect in reduction in death.)

[1] https://ourworldindata.org/explorers/coronavirus-data-explor...

Actually Denmark has even more vaccines, and an even greater case uptick:
https://ourworldindata.org/explorers/coronavirus-data-explor...
A comment that stuck with me during the summer of 2021, when heat domes baked Sweden and Seattle and California and Greece were on fire, was that it was likely the coolest summer of the next decade.
I love simplicity.

the reasons you provide for using it are really strong, and I think it's a much superior option to prototyping leveraging oauth 3rd parties (which has tons of downsides).

It would be good to have a hard rule as to when you migrate, and what the reasons are (if a project has more than N users, if you store field X which is pretty sensitive, etc..)
Bitwarden has 0 issues 'autofilling' basic auth. It just passes the login credentials on connection and you never see a basic auth prompt.
Boeing 777 departing Dubai nearly had a major incident after takeoff
For 2, in many cases validating username/password requires hitting an external system. If you want to give your IT department a fun day, write a moderately popular internal web service that accidentally hits LDAP freshly for every single web request. It's really easy to accidentally do in some environments. Session cookie validation will typically only involve local resources.

For many of my internal tools I don't even bother with a database and just store it in local RAM, especially when I have no other database involvement, because having all sessions reset every few months during a reboot or restart is worth it to not have to stand up a database solely for that purpose. In that case it's just a quick lock&lookup in a map/dict/whatever your language favors to see if the token matches or not.
I think its important to note that while these things are largely true (though i'd say that banks have tight control over states [5+ time felonious JPM and friends, constant bailouts, etc]… esp weaker/smaller states…), there are instances today where people trade goods and services with crypto without "cashing out" (esp more so than a decade ago) through centralized exchanges.

A variety of credit/debt based decentralized stablecoins and dexes will take over in the long run from centralized exchanges and bank account onramp. Even centralized exchanges are trying to get exposure to defi protocols now that will eventually obsolete them for traditional functions for all but the tech laggards.
Only partially. If the client and server have an agreement on a hashing protocol, there’s no reason that the browser shouldn’t be able to hash as well and prevent the password from ever leaving memory on the client system. HTTPS is still vulnerable to many man in the middle attacks, and many corporate and business networks do deep packet inspection to decrypt https (they control the machines so intercepting the cert issuance and installing their own root CA is easily doable). Another issue is that improper logging on the server (or depending on the implementation, even intermediate load balancers) could accidentally leak the plaintext password. Client side hashing is a much better solution to this, and if it’s a native browser supported protocol, it would even work without JS.
> genius Trump only suggested injecting bleach

This statement is still grossly misleading at best.

(Especially because this lies about "drinking bleach" was actually spread by Joe Biden and repeated numerous times in left-leaning media.)

What he said is he suggested to study it. Which is fine. He never "suggested" injecting it or drinking it.

> nobody got hurt

American democracy got hurt. People belief in system is reduced.
https://www.ietf.org/rfc/rfc7617.txt
50 Years of Text Games: The End of a Journey
This looks interesting, though it's not entirely clear how it works. The docs go relatively in depth into the code structure, but it doesn't do much else.
"Stop passing plain passwords over the wire."

If you are using HTTPS, you are equally as good as any other login form.

Some have suggested using JavaScript to encrypt passwords before send - but in my opinion, this is generally stupid because it breaks support on browsers without JavaScript, and this doesn't protect you from the server at all because a hacker could just change the JavaScript to send plaintext copies somewhere. You are reliant on the server being a source of truth either way.
Everybody has a budget. Going red is just very bad. Sustainability is the keyword here.

A streetcar enhance economic activity and transportation, especially when built with proper urban planning, and may even make a profit.

With the profit, the public transit agency can use the fund to improve infrastructure with hopefully less political influence in order to further it missions.

You could of course make a trade off and not mandate the agency to be profitable and subsidize it, but it's a political tradeoff.
This shouldn't be a problem if you're invested. There's a reason the S&P went up almost 30% this year - a lot of it was an adjustment for the boost in money supply.
>> So I feel like I always need to be doing something and then when I do something I feel like I should be doing something else that is "better"

Keep a journal or sketchbook where you right down the ideas first as they occur to you, including notes on level of effort and resources required. Then avoid starting work on an idea that has not been in the journal for at least three months. As you actually work on something you will of course have ideas for something better to work on, but right it down in the journal and come back to it in three months. Ideas that still interest you after three months will be easier to stick with.
Technically as far as I understand the client side certificates and signing/revoking them through internal CA solve the same problems.

However I have yet to encounter such setup used in a professional environment for humans. Is the complexity of such approach just too high compared to LDAP and the passwords?
In addition to all the great points from parent comment above, one other important thing is that a web based application allows multiple people to use it at the same time. With (hopefully) proper authentication and authorization so each person has power to do what they need to do and no more and no less.

Think of all the apps you might use in a business context: CRM, e-mail, messaging, any shared database. All of these need real-time input by multiple people with the right access controls, and these are most easily built on a web environment.
Asking a bunch of hypotheticals isn't a great way to make your point.

The hypotheticals are the point. When you're thinking about how to live your life, to windsurf or to build your savings for example, you're considering hypotheticals because you have to make a choice about which one to do. All the others are hypotheticals because you end up not doing them. Planning is all about hypotheticals.
The thing is: it doesn't matter what me or you think about it.

There are food regulations in Germany and they need to be obeyed.
Maybe combining Lambda integration with CloudFront (CF)?

You could intercept every HTTP request before it reaches CF, check auth data and decide to let it through or respond with 401 already. The CF auth password could be kept as an internal secret. You rotate temporary passwords on Lambda environment variables (bit insecure) or using AWS Secrets Manager (very safe).

Requests successfully authenticated on Lambda level gets rewritten with the master CF password to make them succeed there.

It's a lot more trouble than simply setting up basic auth, but you setup only once and theoretically it works.
I sell onions on the internet. https://news.ycombinator.com/item?id=19728132
I keep coming back to read this every once in a while.
Yeah, I read the abstract and also didn't get this part.
I don't really see it simplifying a lot of internet. Everyone will make his custom login page anyway, you need to add links to registration, password recovery and so on. And sending password on every request, hashed or not, is just bad security, you need session token anyway.
The password is still revealed to the server. There are password verification protocols where the password is not revealed to the server either, which is much more secure as it means that you’re not at the mercy of whether the sever operator follows good security practices about not saving your password in plain text somewhere.
The light belongs to the Sun. Electric lighting is basically cultural appropriation
This is the actual truth that the politicians ignore or omit intentionally.

The date that marks the start of term is calculated by back-dating from the first missed period. Pregnancy tests will not work until a week or two after the missed period, at which point you are basically at 6 weeks from conception.

This law is absolutely a ban. Anyone who says otherwise is either ignorant or a liar.
> Yes, it might mean another 9 months to a year of lockdown

Oh goodness no. There’s a supply limit for medical professionals that will take half a decade to solve even with unlimited funding. And as this is a worldwide issue, not just an American one, you can’t just outbid the rest of us for migrant healthcare workers.
> Practice enough to transform your though process from "I'm nervous" to "I've trained for this." I probably over prepared, but I'm the kind of person who would rather show up too early for an airplane flight than to endure the stress of maybe missing the flight.

Congratulations on joining Microsoft several years ago! I like how you frame the benefits of practicing. I am totally with you on the showing up early for a flight. Pre-all those screenings, I once drove a family friend to the airport at 80-85+ mph speeds (never ever again!) so that they would barely catch their flight.
To me, even though the experts say otherwise, this feels very pre-2008. I know the experts are saying to have no fear... but that's what they were saying in pre-2008 too. I guess I'm too nervous to invest and that's on me.
Privilege separation for applications is not the same as having separate user accounts.

> but instead of simplifying multi-user support to a single user, we actually need to make it more complex to properly handle multi-user-per-process separation.

I disagree. This is such a small and vanishing use case that adding complexity for it is exactly what you shouldn't do.
> Just looking at the sheer amount of work gone to optimize ad clicking is insane.

It's circular -- while I think ads are absurd and am actively trying to remove as many of them from my life as possible, it's not like technologies that have been subsidized by optimizing ad clicking haven't come back around to help science out.
This is true in El Salvador, where bitcoin has the explicit endorsement of the state.

Elsewhere, other than dark web drugs and jpegs of apes, what exactly are people buying with crypto?
> Not enough people are vaccinated

Is it not the case that we essentially need to vaccinate everyone in the whole world within a small time period, like 4 weeks, to prevent mutation and vaccine escape?
Even if this is possible it is highly unlikely anything to change in the next 25 years.
Why speed of light can't be faster in optical fibers?
I've been working remote only for 20 years now, and don't consider any positions that require on-site/travel. Its become MUCH more prevalent in recent years, obviously. However I find a lot of my friends that HAVE jobs already are taking advantage of the new location freedom.

When they next look for a position, I fully expect them to be looking for remote only, same as me.
Video: Installing KaliLinux on a VM Using a ScreenReader
Disclaimer: I made this video.

To get this OS installed while dependent on a screen reader, some esoteric workarounds need to be employed in order to work around the barriers that currently exist in the installation process. I figured some of you might be interested in seeing in what ways one can wrangle an inaccessible interface into submission, but also how tiny oopses can stop all but the most determined dead in their tracks.
That's interesting. I've not really thought a lot about how Hacker News is social media platform. But it does fit the bill in terms of a virtual community for me.

I think of traditional social media as focusing on individuals rather than topics (like Hacker News or Reddit). Once you start giving power to individuals rather than ideas or topics, the community becomes toxic and unpleasant for me. Individual focused communities, where likes and followers determine value create deep centralization and power for those that wield it and frequently devolve into paid advertisements and/or product placement schemes. Topic based communities are of course not immune to toxicity and paid advertisement (as seen on Reddit). Despite that vulnerability, I've found the best social communities to be based on ideas and topics rather than those celebrating individual ideas/content.

I find the discourse and topics on this site to be excellent. It's absolutely my favorite site on the web. If Hacker News ever follows in the footsteps of Reddit by optimizing dark patterns for monetization, such as paid ads, I'll be deeply disappointed. For now, though -- thanks to all that contribute to making this site great!
I relish HN for its sanity and focus. Emotions and politics will inevitably creep in everywhere as we are human. (well, sometimes I'm accused of being a robot, but I promise my Vital Fluids are H20/carbon/iron based rather than Vulcanic or positronic...)

There is another site, that, um, starts with an A and rhymes with technica, that has gone completely the other way and used to be awesome and now is more politics than facts.

Very happy to start my day here.
> How is validating the session-cookie validity different from validating the username/password?

Validating codes is done with fast crypto algorithms, while validating passwords uses purposefully slow algorithms.
The issue is much more nuanced.

I will gladly take an FDA approved vaccine like any other for such reasons.

None of the available ones right now are. Yes even Pfizer isn’t as the approved Pfizer vax (Comirnaty) is not the same exact vaccine as the one currently available/being used.

Edit: In short, many of us fear that the regulatory processes that govern our healthcare have been hijacked by corporate interest. We all know this leads to corners being cut as that’s inevitably how businesses are run.
Good for you, but SV is a drop in the ocean on this issue and not representative of anything.
Well, "high" was meant in context of the title of the article as in "detectably higher".
I don't know that I'd hate it if I were a go dev, it would just be a bit annoying for a number of reasons.

For one thing I update libraries all the time so it's a very fast, simple, well worn operation. Updating the compiler is a bit more of a chore and I'm going to worry a bit more about the impact (since it's global to all code vs local to one package).

For another, I would want to make sure I had tooling that could tell me "is this library in use by service X". I don't know Go's story there, but I would hope it's trivial to do so for a library but I suspect if it's part of the standard library that may be trickier. If not, nbd.

It's a bad smell to me, but if I were a Go developer it wouldn't break me.

Perhaps ironically, until this native fuzzing package, upgrading the compiler if you had fuzz tests would be one case where things would likely break.
Looks great. One issue to note is that it's not supported in MacOS. I wonder if this is due to the MacOS API sandboxing changes that occurred recently?
California pushes composting to lower food waste emissions (2021)
https://news.ycombinator.com/item?id=29756714
Your suggestion is vulnerable to the https://en.m.wikipedia.org/wiki/Pass_the_hash attack.

Your suggestion is basically going back to the days where databases stored plaintext passwords in the database, just that the plaintext happens to be a hash.
I'm very interested. jamnvr at gmail
Science denial. It's not going to stop at 'a little warmer'.

https://skepticalscience.com/10000-years-warmer.htm
Oddly, the Web Monetization spec, probably essential to ILP adoption, doesn't indicate how browsers would contact an Interledger network site.

https://webmonetization.org/specification.html

https://github.com/WICG/webmonetization/issues/195
Which is a great boon for both Haiku and my old netbook. 9/10 times I'm using terminal, browser and Emacs anyway, and Haiku is stupid fast. Now if only wireless support was bit better...
you don't know you lcamtuf is, do you? I understand you're all worked up by his apparent misuse of radioactivity-detecting instruments, but... he's a bit smarter than most humans, I tend to give him some credit.

I suggest starting here, https://lcamtuf.coredump.cx/ personally I'm a big fan because of the Guerilla Guide to CNC, he has clearly researched his stuff.
I can understand why you're being downvoted but I think you have a point. Someone who drinks beer and listens to country music is not going to be doing neighborhhod dinners with orthodox jews. We can claim to be all multicultural and all accepting but we always seek out like minded people. Culturally homogeneous communities let people put their guard down and give people common ground to connect on. You could argue that we want to create a new type of homogeneous culture--one where nobody eats pork, nobody wears MAGA hats, people keep their religious beliefs to themselves, etc. but that's still a homogeneous culture.
I think you're right. The RGB values clearly show it's green-gray.
I’m moderately disappointed that CNBC didn’t take advantage of such an obvious pun
One of my favourite auth is the NTLM/SSPI which came out of the the windows NTLM world.

Users don't even see they are being asked to be authenticated, they are either logged in, or told they don't have access.

Works great in corporate world.
> I wish titles would indicate "for Windows" or something like that. Useless article for non-windows-users.

It also works with Ubuntu and Fedora, so not sure where you got the windows-only impression
Congrats! That is an interesting route to have a months-long "interview". I am assuming contract-to-hire is even more rare than QA-to-software engineer (only know of 2 personally who have done that).
"forced to overwork and underpay people in jobs which have suckers lining up to fill them"

The first half of your sentence is incongruent with latter half. If you have people lining up for the position, you are demonstrably not underpaying. What you wrote is merely an inversion of the "jobs that americans won't do" fallacy.

To bring it all the way around, it was only very recently that Spirit was underpaying people and could not get enough staff. Low and behold, Spirit doubles the comp and presumably attracts more people.
NR is antitrump. I don’t think they have much readership left (no pun) at this point.
Hello! Would like to reach out but don't know Microsoft products well enough to guess what their fiery email domain is. Do you mean outlook?
COP is my favourite too.. but it's worth mentioning a lot of the modern 'club' varieties that have come on market in the past decade probably do retain a lot of the favorable logistic traits but are also a far cry from the sorry later red delicious sports and actually quite interesting and yummy. See envy, jazz, pink lady, kanzi, smitten
I really enjoyed slime hand. It really brings home the potential of various haptic devices which will enhance our experiences in VR/metaverse.
happy new year. Caddy is such a great piece of software. It has great defaults 'out of the box' but at the same time doesn't feel like I'm drowning in incomprehensible magic. We need more software like this!
IIRC St. Louis has a similar arrangement with the surrounding county.

Addressing the context, though, Baltimore certainly belongs in any discussion of unpleasant downtowns. Altercations are a potential issue even driving (more so than walking actually). But there's also increasingly little to even walk to. The nightlife and culture all moved to the surrounding neighborhoods, now you just go downtown for the aquarium or the occasional bureaucratic necessity.
I am not absolutely sure if he flew to the French site with the Beluga or if this were different situations I mixed up. He told both. Him flying to France and him finding the Beluga experience pleasant.

So maybe it was me mixing things up.
Spend an hour to set up an OAuth2 Proxy (https://oauth2-proxy.github.io/oauth2-proxy/) instead.

You can use the one proxy for entire subdomains / unlimited number of apps. No plaintext passwords, scales well, open source, industry standard, and you get SSO for free. Hell, you don't even have to manage accounts! It makes your life simpler and it's more secure. You can't say that often.
F# has Units of Measure: https://docs.microsoft.com/en-us/dotnet/fsharp/language-refe...

There are libraries that implement this concept in other programming languages (C++, Java, C#, etc.)
This is a reasonable question on the discussion of vimscript. Does it make sense to have tool-specific languages like this anymore?

I don't love lua, but moving to a "standard" scripting language has a lot of value.

And neovim proves that lua is viable, so...
> If the client and server have an agreement on a hashing protocol, there’s no reason that the browser shouldn’t be able to hash as well and prevent the password from ever leaving memory on the client system.

Shouldn’t it be a proper challenge/response? Otherwise the hash is barely better than the password.