skysight-inc/HackerNews huggingface dataset:
What's wrong with super long passwords eating up CPU time? Can't imagine it is that prevalent with normal users and there are other ways to deal with it if it is a vector for a DOS attack (rate-limiting the number of registrations or logins, for example).

NIST says there's no reason to limit password length any more[0]:

"Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP or verifier SHALL be at least 6 characters in length and MAY be entirely numeric. If the CSP or verifier disallows a chosen memorized secret based on its appearance on a blacklist of compromised values, the subscriber SHALL be required to choose a different memorized secret. No other complexity requirements for memorized secrets SHOULD be imposed. A rationale for this is presented in Appendix A Strength of Memorized Secrets."

0: https://pages.nist.gov/800-63-3/sp800-63b.html
Git repo: https://github.com/nginx/njs

Examples: https://github.com/nginx/njs-examples

Additional resources: https://github.com/soulteary/njs-learning-materials
I don't know if you realize this, but complaining that "compressing all the cultures constituting "white" into a single category" is a problem, and then talking about "white Americans" in the next sentence as if that is a single cultural label is a self-contradiction.

The complaint two comments up about the "mild but persistent impression that white heritage isn't something to celebrate or positively self-identify with" is an even stronger one.

EDIT: downvote all you want, it doesn't take away the contradiction of insisting on hanging on to an identity of "whiteness" while denying the history behind it.
I still remember pronouncing it as nging-eks, not engine-eks.
Poor people have labour. Everybody labours in a company (except the shareholders) and then everybody is paid a wage and the shareholders keep the profit. Thus the rich get richer as the surplus value created by labour is kept by capital.

That's the core mode of capitalist production, better known as the M-C-M' cycle.
Yeah but I think this goes bigger than this. We might see Google Analytics now, but we're going to end up seeing problems with European companies using AWS, Azure etc. later on. _That_ might be big enough to warrant it.
The census exists to inform policy. If there is discrimination based on race, then we're better off measuring it so we can address it than burying our heads in the sand.

Of course, this may lead to targeted policies, just as insulin is applied to people with a diabetes diagnosis, and not to the general population.
Support USED to be great, ~2-3 years ago when I first signed up. I noticed around a year ago when I made a support request that it went way downhill. I get the impression that they outsourced it to India.
I was working at one of the cybersecurity companies and "not being another NSO" was part of internal discussion.

I won't name the company and use temp account deliberately for this comment.
Not just that, see how Louis Aggasiz's reputation is being hounded down in recent years. Renaming schools and pulling down statues of him.
“Petfluencers” are cloning their muses
> with readily available devices (e.g. my phone) and yet

I'm pretty sure it wasn't anywhere near ready to use five years ago when I wrote v1 of my webapp. And googling again, it's still not clear whether it would work on whatever random software setup some of my zealous-for-software-freedom colleagues use. With passwords I don't need to worry: if they can render the HTML+CSS (even the JS is optional, because some of my colleagues prefer NoScript), they can log in.
GP said: "You are free to share any data with Google that you wish." That is not consistent with GDPR, and that's what I was saying. And the Austrian court has confirmed that.

The court has not said that it's illegal to use GA.
>I'm not sure what you're trying to say here

but nonetheless you decided to write at length about it ending with a >Lesson: don't generalize.

Ok then.

>It's hard to see how you can come to the conclusion that one cannot hold both moral views and still be a good scientist or technical person.

It's hard to see how you cannot be sure what I was trying to say AND reach such a definite and wrong conclusion as to what it was nonetheless.

when I said
>>the people who devote so much of their time to ethical and moral purity, and searching out failings in others

I have to admit that I probably put too much work on that ', and searching' and I did use the word moralizer later which, I think in usage generally emphasizes the especially in the first entry here https://www.dictionary.com/browse/moralizer "to reflect on or express opinions about something in terms of right and wrong, especially in a self-righteous or tiresome way." but which obviously can also be used without the reference to self-righteousness.

That is to say that people who expend a lot of effort not just in being morally correct, which I suppose everyone should give some consideration to, but also hunting out the flaws in other people are probably too busy to do much good in other things.

I submit that Einstein was not a moralizer in the common understanding of that term, although he was concerned with morality, and he did not hunt out other people to spend his time correcting their morality, especially not in the years when he did his most important work.

Lesson: only end with a lesson if you feel that you understand what is being communicated, and if you do feel that you understand it don't say otherwise as that is likely to create misunderstandings for others.
FWIW I'm a developer, and I think password managers are awful to code against. They don't document their expectations (to the best of my knowledge), it's hard to test because you need multiple password managers installed, plus the browser's built-in ones. I mean, even the link you shared feels more like alchemy than engineering (through no fault of the author, I might add): "do it kinda sorta like this and then hopefully it'll work most of the time!"

And it's hard to figure out why it doesn't work when it doesn't. The feedback cycle is nonexistent.
Get Rewarded for Taking Survey
The EU institutions (that came up with this crap) are so bad at managing their hard & software (2 years in to the pandemic, their employees are still WFH on MS tablets with VPN connections that are super unstable).

I can't wait to see the clusterfuck of them trying to migrate away from MS.
Meh. I treated that site like every random site that requires a login that I think I'll use once: it got my 20 year old Hotmail address, a randomly generated password, and was accessed solely from my VPN IP.

The only reason I even set up an account was so that one of my Kodi extensions could hook into it.
It felt overly authoritarian to me as well, but I think that's part of the point. In all the examples the author did have the authority to say no.

In any sort of leadership position you should absolutely take advice and talk to people, but as soon as a decision is made you have to stop talking about it and just communicate the decision. It's more frustrating for people to think a decision is up for discussion when in reality it's not.
I'd argue that the very very wrong models for fallout generation and dispersal were an even bigger issue. If they hadn't gotten that wrong, no one would have cared other than the scientists in the near bunkers who had to change their trousers.
Same as it does with binaries in git: you lock them in the central repo. Git supports this with Git-LFS.

Without one blessed/central repo you can’t have meaningful locking obviously, but almost every git user works with a centralized repo.
> the downsides of a false negative and less than the downsides of a false positive

As a consumer, yes. As a founder, there is an opportunity cost to not founding the next Googlebook.
100GbE NICs are <$500, and 100GbE switch ports are $100-150.
I mean she openly admits to having never had a real employer, yet owns a house in the Bay and has an Amazon wishlist which her fans never allows to stay full for long. I've got total respect for online sex work as a means to make money, but I won't pretend it's not a completely different experience from having a boss, paycheque, and cubicle.

She also, rather famously, created a 'Date Me' survey in which thousands (yes, thousands) of men wrote responses about why they'd be a good enough partner/provider for her. I don't know anyone else, even other beautiful women, who get to experience dating in a way that puts them on a pedestal.

Finally, she has a series about how she was able to trip acid, provided to her for free, multiple times a week, for over a year. To me, this sounds like a pretty comfortable existence. I don't doubt she gets her fair share of unsavory messages, or even the odd in-person encounter, but I would trade my life for hers in a heartbeat.
I agree, the metagame is your career, and if you're playing the metagame you're incentivized to take projects that look good on your resume, leverage experience for the highest possible offer at the next job, etc. But "gamification" of your tasks at work is not a fun experience and is not a good way to manage a team. It leads to tracking "gamified" metrics that probably aren't closely tied to the success of the business/product.
My kids had friends (round 10 yo) who claimed they did not like the taste of water. That blew their minds since they'd been drinking water their whole life.

It is still the main beverage we drink, and there are still those who never drink it. Incredible.
A few months ago, I bought 2 10GbE NICs off Ebay to connect my main desktop and basement server directly. Since then, I've never seen a transfer between them that was slower than 120 MB/s, usually about 160-200 MB/s. (no RAID or NVMe to NVMe transfers)

Some advice: make sure you know the form factor of your NICs. I accidentally bought FlexibleLOM cards. They look suspiciously like PCIe x8, but won't quite fit. FlexibleLOM to PCIe x8 adapters are cheap though.
That's clever. We can already track the eyes.
Always Mount a Scratch Monkey
Most of the polls in the US tend to be done by American Jewish organizations such as the AJC. The AJC polls actually specifically ask about support for Israel.

Regardless all of the major Jewish denominations in the US (reform movement, conservative movement, modern orthodox and even most of the heredi movements these days) officially support Zionism. Now you have individuals in each group who may describe themselves as anti-Zionist, but it is a very small minority (although growing in the reform movement).

Among non affiliated Jews the percentage of anti Israel/anti Zionist Jews may be a bit higher but it is still pretty low. It’s no where near millions (you only have 6.5 Million Jews in the US).

Now none of the above means that there is not a large segment of pro Israel, American Zionist Jews who are against a lot of the current and previous governments policies when it comes to the West Bank and Gaza (or in general).

Heck I am a Canadian born Israeli, who is personally against a lot of the policies of the Israeli government. I quite often cringe at some of the comments and actions of some of our politicians. On the bright side it helps me chose who not to vote for
That wasn't a change, it was already illegal. Back in 2020 the data exchange with the US was considered illegal, and only recently did a judge speak out against Google Analytics specifically.

This ban also wasn't even by "the EU", it was an Austrian judge following existing EU regulation to rule on a court case.
It also creates bad incentives - "oh I need to commit every day? let me spread out today's work over the whole week so I can get a green mark for every day instead of shipping this feature that's ready"

Goodhart's law (https://en.wikipedia.org/wiki/Goodhart%27s_law) gets repeated a lot in threads like these but it's for a good reason.
Not immersion breaking, maybe mentally fatiguing? The point seems to be that your brain is expecting to have to change focus, and is "surprised" when it does not.
The best argument I know against expanding into yet another frontier is expressed in the Eagles song "The Last Resort". The basic message of that song, as I understand it, is that we ruin every new frontier we conquer. Or as the closing words of the song put it, "you call some place paradise, kiss it goodbye." So maybe the universe is better off if our damage is limited to our own little planet.

Then again, that song also said, "there is no more new frontier," seemingly ignoring space, so maybe Don Henley was just being overly pessimistic.
if you want to test these settings I can recommend `sudo systemd-run -p "DynamicUser=yes" -p "ProtectSystem=yes" -p "ProtectHome=yes" --shell`
but be in a readable directory like /tmp or you receive an error.
They made nuclear artillery shells and bunker busters. This indicates they are not sensitive to shock. Since the impact is a known force & vector, you can pre-deform the mechanism so the impact causes the geometries to be correct, and/or just live with reduced yields from less than ideal geometries.

They do not have public figures for any of the recent nuclear bunker busters, though its likely on the order of 100m based on the depths that various countries have claimed to have made bunkers. The main limiting factor for depth is what speed the materials can handle before vaporizing, how dense you can make the nose and how much mass your delivery system can handle.

Like you have said, nuclear busters are moot as putting 14000kg on someones dining table will still ruin their day without the political issues that nukes cause.
The problem with gamification is that everybody will try to game the gamification system.
Its probably been done before.

But, in this case, who did this test that none of the five major nuclear powers wouldnt cry out foul?
Great victory. I bet firebase crashlytics is illegal as well in EU.

The reason I uninstalled the hacker news app 'Materialistic' is because it regularly crashed and was probably unvoluntarily siphoning off pii data through the crashlytics module.
> When a company decides to use a product, it needs to ensure that product is legal to use in their jurisdiction(s)

This is the proximal decider. They’re predicting the decision of the ultimate decider, which remains the courts. Providers would have to make the proximal deciders comfortable that the ultimate deciders will accept their compromise.
What will it solve?
International airlines suspend some US flights over 5G uncertainty
There is currently an EU member challenging the concept of European law’s primacy

That's a charitable phrasing. As per Protocol 2 on the functioning of the European Union, article 8 [2]:

The Court of Justice of the European Union shall have jurisdiction in actions on grounds of infringement of the principle of subsidiarity by a legislative act, brought in accordance with the rules laid down in Article 263 of the Treaty on the Functioning of the European Union by Member States

What Poland did was declare nationally (government, and then a national court) that the EC was infringing on its sovereignty (principle of subsidiarity). But as the above text says, national governments don't have jurisdiction when it comes to matters questioning the primacy of European law.

[2] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12...
> But there are extreme factions of libertarians who really question things like "Do mothers really have a duty to take care of their children?"

You mean feminists?
Every cookie banner is a middle finger to your privacy. The law says "don't track people without consent" and the data hoarders decided to respond by making your life as difficult as possible.

Most websites don't need cookie banners. They choose to make you suffer through them. Take your anger out on those websites, not on sensible legislation.
Pegasus Spyware Sample
We are using bitwarden currently. It seems to work well for our purposes.
>It needs to be much cheaper than the weapon it's intercepting for it to make economic sense, also.

Certainly it would be nice if it were cheaper than the incoming missile, but doesn't it really just have to be cheaper than whatever the missile is targeting for it to make economic sense?
All big public DNS Resolvers are US-based. Google, Cloudflare, OpenDNS(Cisco). Quad9 is Swiss-based, so technicaly not EU-based.
Been eyeing it for a while now gotta admit. The desktop setup I'm looking at would be pretty expensive with both that and a thunderbolt dock. So annoying I can't get a thunderbolt dock with SFP+ directly instead.
The stickied comment on the post clarifies that you can block moderators and it will work as it does for other users unless they post a distinguished comment. That seems very reasonable to me. Your frustration is more with the decisions of the moderators to sticky those comments.
I’m a game designer.

The best thing you should take from game design in terms of how to improve work is the difference between extrinsic and intrinsic reward. Most gamification focuses on extrinsic rewards such as leaderboards, levelling and achievements. But really they should think about the intrinsic rewards of work and how to improve those. Doing the latter without the former is just running people on a treadmill towards burnout. Focusing on extrinsic rewards also has a lot of negative consequences more generally. People focused on them as individuals often do so to the detriment of the wider organisation. You see that with bonuses as well. And extrinsic rewards can result in lower creativity, less intrinsic motivation and even less satisfaction from social rewards.

Basically do the hard thing and make the work inherently better rather than the easy thing of adding hoops to jump through.
Is it time for Scientific American to change it's name?

Either they let this trollish (or outlandish) opinion piece through because they lack scrutiny and judgement, or they let it through to self-mock their opinion column, perhaps to try and defuse the E.O.Wilson debacle.

In either case, it is not becoming of the magazine of old.
Give Me $500 or the World Will End. Trust Me
Thanks for sharing this, TIL.

It's a very interesting attack, highly specific to the high-number of breaches, high password reuse environment we're in that enables at-scale password cracking.

I don't think it invalidates this advice completely. You should watch the talk and eventually add a global pepper (assuming it does not leak), and of course do the final bcrypt(md5(pass)) -> bcrypt(pass) migration upon user login.
> There is no denial that the subjective experience of free will is real

I guess I am loathe to throw something so essential and universal to the human experience out the window.

I think many people get into verbal and philosophic contortions because like me they find it difficult to accept something which goes against their fundamental experience, and yet unlike me they're unable to let go of a materialist reductionist view of the universe.

> reflexive defensiveness

Reflexive - that is to say not controlled by me. ;-)

As to my second point, I cannot show that. I believe without proof that existence has meaning, justice, truth, wisdom are good and to be sought, and ignorance, slavery, cruelty are bad and to be rejected.
> as the above text says, national governments don't have jurisdiction when it comes to matters questioning the primacy of European law

This is the essence of a divergence of theory and practice. The text says one thing. In reality, something else plays out.

I think the text will prevail. But that delay (and uncertainty) is precisely what I’m talking about. And it happens everywhere, with active regulatory arbitrage an all-but-admitted strategy of a significant section of the SME space.
Divide 10MT by the enthalpy of vaporization of water?

I guess it would be an estimate on the order of the estimate that the eruption was 10MT
To be fair, tap water in different places tastes different. If you're in a rural area of the US with well-water, what comes out of the faucet can have a strong rusty taste.
Four-day work week pilot launched in the UK
The Elizabeth Warren effect.
Adam Ragusea has a good video on why recipes aren't so easy to translate between imperial and metric: https://www.youtube.com/watch?v=TE8xg3d8dBg

It comes down to the fact that the ingredients we buy from the stores near us tend to come in nice round numbers in our local measuring system, and recipes tend to be tailored to that. For example, "1 cup of shredded cheese and 1lb sausage" may translate precisely to "236.9 mL shredded cheese and 0.45kg sausage", but your nearby store selling metric ingredients may have shredded cheese in a 300mL bag and sausage in 0.5kg packages. So you either measure very precisely and waste food (which makes the recipe a pain to get right), or try to use the local equivalent (and the recipe might not end up tasting the same as a result.) So there ends up being some "art" to doing a proper translation.
Pegasus Spyware User Guide [pdf]
For electronic devices, this would also mean the ability to load on your own SW on any processor. That means the manufacturer needs to provide the toolchain, relevant specs, and source code (basically whatever they used for development) in escrow. Additionally, many updates are now cryptographically signed which means you'd need to put keys in escrow that get released when support from the manufacturer ends (which itself has serious security implications since the escrow holder, in addition to the manufacturer, now has root access to all devices).

This is actually very hard to define. Ideally it would also include any code that's updateable including firmware, but then are you including things like CPU firmware?
OK, I'll play. Some qualities that are valuable in an engineer are curiosity, creativity, and general knowledge. If your nomenclature has a programmer as a software engineer and a software engineer as an engineer, then these qualities are also valuable in programmers.

If you ask an interviewee how GPS works and he says something about the cell phone sending signals to a satellite, you would want to pursue that further, at least to make sure that he's asserting that with a sufficiently low confidence.
This is true for tweaking and was certainly true for industrial automation.

However the danger is if you cut human input/involvement altogether. That is what AI will be if successful. Everyone except the business owner will be uninvolved (apart from futile protests).
Send RTP via TCP then, it will fix all problems you mentioned.

BTW what is so complex in RTP?
I love perusing GW's National Security Archive! And this doc, a declassified "study" from the peak of the Cold War, is the reason why. History from primary source material.

The most infamous file from the same period is Herbert Khan's RAND paper "The Nature and Feasibility of War and Deterrence"

https://www.rand.org/pubs/papers/P1888.html

All this informs current arguments for nuclear disarmament. But there's nothing to indicate anyone can predict how the addition of offensive cyber capabilities has changed the NC3 calculus.

Wargaming War Games: How Likely is Thermonuclear Cyber War?

https://www.youtube.com/watch?v=X_0mm8UkVOc
The thing that really bothers me is how little she actually discussed of Wilson's work. It feels like she read a few paragraphs on the more polemical aspects of his work and decided "yep, sounds racist, my chance to shine".
Does anyone know if there are any lock out mechanisms on accounts which stall access after x number of password attempts?
Unsurprisingly, many Brits agree with you. I've heard "don't complain; don't explain" invoked in the news more times than I can count in the past few years.
Never played the English version, but failed miserably in the Hebrew one.
Note that .NET 6 can use W^X now (and use it by default on ARM macOS). I agree W^X is an important security feature every JIT should support (V8, I am looking at you. Google, what's so difficult about this?).