skysight-inc/HackerNews huggingface dataset:
OV certificates are even worse. The verification is a hassle and it's extremely difficult to distinguish OV from DV. Try to figure it out. The only way I'm aware of is to make sure the `Policy Identifier` [1] of the certificate is `2.23.140.1.2.2`.

I've also never had a good experience with the validation process from any of the CAs. They often push anything that's not immediately discoverable back to the applicant and expect them to do the leg work. I've had both Comodo and DigiCert do this to me in the past. Here's an example from DigiCert. This happened this year (2022).

> First, As part of the verification process, we are required to confirm the registration of your organization with the local registering authority.

> We have attempted to locate the registration records using online resources, however we have not been able to locate such a document. If you are aware of any government based search tools for your jurisdiction that can be used to locate proof of the organization's registration, please reply to this email with a link and instructions for locating that record. Once received, our validation team will confirm the record and proceed with the validation process.

Really? To me that seems like someone who isn't familiar with my jurisdiction because they don't know the process. What's stopping me from sending them a link to a fake, official looking site? It seems like an invitation for social engineering. Code signing certificates are the same. It's infuriating.

In my experience, they look for your company on Google Local (or whatever it's called now) or similar and if they can't find it they punt it back to you. I think the whole process is worse than nothing because it's selling a false sense of security for anyone who believes the marketing.

From a customer value standpoint, I'd rather pay for a DV certificate where the value comes from helping me to set up proper CAA records to prevent mis-issuance as well as certificate monitoring for any potential lookalike domains. Of course, the margins on that probably wouldn't be as good.

Thankfully I only deal with one place that insists on buying expensive certificates because "they're better". Just for fun sometime go look at the TLS certificates used by all of your local government websites and try to figure out what they cost. Then factor in the labor for multiple people to coordinate annual renewals and manual installation. It's frustrating.

1. PDF Warning: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...
Ask HN: Who's Investing in Startups?
We regularly see the successful "Who's hiring" and "Who wants to be hired" threads here. I thought it could be interesting to introduce "Who's investing" (and "Who's raising") threads.

So let's give this a try.

Please state what sectors you invest in and at what stage (check size and global/US only could be helpful).

Commenters: please don't reply to posts to complain about something. It's off topic here. (copied from "Who's hiring")
Please elaborate to those of us who have actually experienced the “swap swamp” within the last year, in the 2020s, and who have enough systems knowledge to properly instrument this stuff. Are you gaslighting us?
This shouldn't be downvoted, it's true.

There's nothing wrong with creating good drugs and therapies, and this looks cool, but if it doesn't stop transmission it's literally not a vaccine.

EDIT: I'm wrong. I would have been right for the wrong reasons in 2018, but now vaccines are "any substance that generates antibodies that produce immunity to disease".
SpaceX is betting on Starship to launch the next generation of Starlink satellites, so I’d be very surprised if it doesn’t reach orbit in the next 1-2 years.

Re-entry, landing, and full reusability could easily take several more years though.
Just finished The Dawn of Everything by David Graeber and David Wengrow - highly recommended if you're into human history.

You've probably read some variation on this idea: our simple hunter-gatherer ancestors lived an egalitarian life, until we discovered agriculture and started down the path of hierarchy, domination and all the inevitable ills of civilization. This book does an expert job of picking that argument to pieces and presents a tome of empirical evidence to the contrary - the story of our ancestors was far more complex and interesting.
It seems to be a fault on Google's side, and not Linode's. It's like blaming the car when the road is closed down.
>True, but chase.com.swag.ru is not chase.com

Your reply is missing the point and the difficulty of the topic.

Yes, _you_ know "chase.com.swag.ru" is wrong but the harder computer science question is: "How does a web browser deterministically evaluate if "chase.com.swag.ru" is not the real Chase bank the web surfer intends to reach?"

In other words, the FireFox/Chrome browser doesn't have a function such as:

if (ask_7steps2much_if_domain_is_real_instead_of_fake("chase.com.swag.ru")) then ...

The generalized way that's been attempted is Certificate Authorities being hardcoded/whitelisted inside of browsers, etc. This helps for encryption to prevent MITM attacks but has many loopholes for identity verification. LetsEncrypt dv certs are more helpful for encryption. In contrast, something like EV certificates was trying to help with trusted identity.

But it looks like EV certificates were not a UI signal used by most web surfers so Chrome/Firefox dropped the visual indicators: https://www.google.com/search?q=chrome+firefox+remove+ev+cer...
Because the keys never exist "on disk"? Why isn't every password manager pwned on every persons machine is what you're asking it seems.
I've had a similar experience recently as well in re-discovering OneNote. I use it along with my Boox tablet and I made a video of it in the Boox sub-reddit: https://www.reddit.com/r/Onyx_Boox/comments/sq2msd/sample_of...

My idea is that there are basically two types of Notes; First type is to free-up working memory; example is solving a math problem and with pen and paper is much easier compared to doing it mentally. These types of notes are short-lived and are rarely referred to again since they've already served their purpose. In computer analogy, it would be the RAM.

MS OneNote is great for this type of notes since there is low friction in getting started with writing and can easily dump all sorts of stuff in it. It reminds me of the blank white bond paper used as scratch during math exams.

The second type of Notes is akin to the Hard Disk. In the Math example, it would be the Textbook which contains the principles which are important to refer to and to study.

In a Textbook, structure is highly important since it's main purpose is to be read and so it is optimized for reading rather than writing. From my experience, MS OneNote is not so great for this second type of Note.
I am a sooo great Investor! I invest money in ETFs because all my neighbours do so.....
This statement is also disingenuous. Anecdotal but from my experience those I’ve known with COVID that were not vaccinated and we’re not hospitalized.

This is part of where vaccine hesitancy comes from, it seems like you’re injecting something that’s almost useless (I won’t say it is yet) as it seems those who are healthy (read no underlying conditions, known or not) don’t have issues.
I used to go outside of my office and sprint as fast as I could for as long as I could, then cool down with a walk around the block. Then I switched jobs and everyone could see me if I did this so I got embarrassed and stopped. I feel like it really helped, maybe I need to get back into the habit, especially since I’m working from home.
Chaos Mesh Moves to the CNCF Incubator
If the caller can authenticate with the services, I think you can write some rego that does something like this. I'm interested in what the flow looks like. Does the caller talk to A first to initiate this delegation?
Lol, yeah that's a good question. I guess that goes for just about anything including our thoughts on the topic. I guess that's up to the reader.
If you thought things were better before LetsEncrypt, I'm afraid you were mistaken. They weren't the first to provide free DV certificates, and even paid certificates aren't immune to crises of identity. Troy mentions the EV certificate issued to "Stripe, Inc" which caused so much consternation back in the day.

Not to mention that it's never been difficult to get a certificate for a dodgy domain, especially when doing so made a phish more likely to succeed.
These kami are at least in theory supposed to be controlled by other humans, though. Even in myth that's a bad situation because the people controlling them never seem to have ambitions that don't involve someone else suffering, somehow.

The capricious pixies owned themselves and acted for their own (perhaps inscrutable) motives.
Seems not knowing the struggle with the note system. The struggle eg ## which is not really the note above because the # and b is not perfect. Bath well pieces probably not in his understanding. Not really a music theory.
You should use the Show HN prefix in the title for posts like this.

Ask HN is for questions, but this doesn't seem like a question, rather using HN as a marketing place.
> A library that let's me focus on business logic rather than boilerplate or implementation details is one that I want to continue using.

React is the exact opposite of that. Endless boilerplate, abstractions and unwritten rules. As the reality of large projects sets in, they look nothing like the starter examples.
I've built my own authz too many times. The prospect of having a standard framework to do this is encouraging.
> What are "[email protected]$$ snapshots"

Looks like it was fixed, as it now reads "bad@$$ snapshots" for me. From reading another related article[0] I guess they didn't want to write "badass":

> (...) and completing the snapshots code and that the Bcachefs snapshots design is "badass."

[0] https://www.phoronix.com/scan.php?page=news_item&px=Bcachefs...
I thought this was an Apple TV bug but you're right, it only happens in YouTube. Really shoddy stuff.
> I'm not sure what Stadia's limits are but I can imagine that being a pro if more than one user can use the library at the same time.

I wrote 4 in my previous comment but it turns out that the limit it actually 6 (4 was the limit for the number of controllers on the same device, so split screen in other words).

You can play all their games and they can play all of yours. At the same time. (Edit: there is also something called "Ubisoft+ on Stadia" which gives you the entire Ubisoft catalog for rent for a monthly fee. I am not sure how this interact with the family sharing.)

The limit is that if you are playing "Game A", your family member cannot unless another family member has also purchased it. So you could say it counts the number of licenses purchased and makes them all available to everyone.

If the limit for "Game A" is reached, clicking on it will propose you to buy the game for yourself or kick one of the players (I have not tried it, I hope it asks for the consent of the person playing).

The exception being what they call Stadia Pro games, which are free games offered to people who are on the paid membership. Those there's no limit as long as everyone has claimed them with their pro accounts. However I think it's important to say that the Stadia Pro games are available to the entire family even if the individuals are not on the pro membership, in which case it also counts the free licenses claimed.

It's also important to say that every player gets their own instance of the game. So if I buy "ExampleMMORPG" and my sibling starts the game, they don't see my characters. They get to create their own and have their own character limit.

You can also turn off sharing for certain games. So if you are binging "ExampleMMORPG" and you don't want anyone else to keep you from playing, you can make sure your spot is reserved. Or if you play a violent game and don't want you kids from playing, you can. Which reminds me that this is all connected to Google Family's child account features. So you can limit the amount of time played per day, the age rating of games, etc. You can also set privacy settings for child account, stopping them from being able to join or create groups, enter voice chat, etc.
UI is really slow. I wish that anyone takes QT or GTK backends for DOM+wasm seriously. More work should be delegated to the UI components. X-Windows was ugly... but there was a clean separation that was useful.
Aserto takes a hybrid approach. It runs a hosted control plane where you configure your user-directory, authorization policies, etc. But the authorization logic itself can run alongside the application that uses it, ensuring high availability and low latency.
Comparing the Descendants of Mandrake and Mandriva Linux
> Weight lifting is not aerobic, it is anaerobic.

Heavy low repetition lifting is anaerobic, but around 15-20+ repetitions with lighter weights it becomes aerobic.
You can create rules which take in to account that there is a temporary grant, you do need to account for that somewhere in the form of accessible state. This could be achieved using the tenant level resource state, which is immediately updated and can be referenced from the rego rule.
Aserto is based on a few open source projects: OPA [1], policy CLI [2], and Open Policy Registry [3].

Architecturally, the Aserto authorizer is packaged up as a docker container and deployed as a sidecar or microservice in a customer environment. The control plane typically runs in Aserto's cloud (although you could run it on your own if you needed full control of the end-to-end solution).

[1] https://www.openpolicyagent.org/

[2] https://github.com/opcr-io/policy

[3] https://www.openpolicyregistry.io/
On MacOS 10.15 Preview, I drew an "annotated" black box over a paragraph that was recognized as text. I exported it in two ways, 1) "Export as PDF" and 2) Print -> Save as PDF. Both results did not include the underlying text under the box.

That's not to say it's definitely not there, but it's at least something.
I was fully prepared to say 'memory usage' as a kneejerk to Electron. But I decided to open System Monitor real quick and it turns out my 1Password 7 instance is using 201MB itself. Another ~30MB if the helpers are included. My machine has been on for about a week and I invoke 1Password a lot throughout the day + have about 500 entries.

How much memory is yours consuming (assuming you're using 8)?
They're being downvoted for making unsubstantiated claims about security vulnerabilities, and for not understanding the benefits of avoiding copy+pasting.

> And as you say it doesn't even really offer any benefit over cutting and pasting from the CLI.

It saves you from the fact that every application on your system, and some browser extensions can read your clipboard silently with no way for you to know. It saves you from phishing attacks from gіthub.com (note the i is a cyrillic i), it saves you from misconfigured permissions on your ssh folder, and from any "nosey" pip/npm install scripts that you might run on your development machine. It also means you don't lose your ssh keys in the case of data failure.
It's like any muscle.
Start with something small that feels very risky, but isn't. Maybe 5hr-per-week unpaid tech work for a charity you enjoy, or a 10hr-per-week paid gig. Buy and sell some stuff online for small money. Do things where, even if you failed COMPLETELY, it wouldn't really affect your life.

Eventually you'll find that your universe of "acceptable risk" has expanded. Previously risky things won't feel that way anymore.

Extreme risk tolerance is a skill, but it comes from a lifetime of trying things, having them fail, and finding out that actually it was okay.
I don't really follow android much anymore, so does anyone know how this would compare to iOS's privacy systems?
A huge problematic deficiency of 1Password is that it lacks literal multi-line text field types.

The items in its database let you define custom fields for them, but there is no literal multi line text field. There's a "File" type, but you can't simply define fields with multi-line text values. However, every item has exactly one built-in "notes" field, but that's actually styled markdown text. And you only get one. And its name is always "notes".

It would obviously be extremely useful to be able to define an arbitrary number of arbitrarily labeled multi line text fields that are not interpreted as markdown text.

It boggles my mind that 1Password doesn't support this. What were they thinking??? It makes it a real pain in the butt to store ssh keys and certificates and a lot of other types of information in 1Password.

A single markdown "notes" field just doesn't cut it. It's not as if it's technically challenging or a security risk. It already has a "notes" field, so just turn off the "rich text" feature and allow me to make my own! I would have thought it was a pretty obvious and often requested feature, but as far as I can tell, it's impossible!
No, you're conflating different things.

I'm sure Japan, through their crimes, earned the hatred of many countries in Asia which welcomed the atomic bombings as retribution.

But the narrative I'm mostly arguing against is not that many welcomed the bombings, but the specific American narrative that there was no other way and that they "saved Japanese lives".

If you want to argue the Japanese (civilians and all) deserved it, that's a separate conversation.
My question is: if Japan would have done that, would you consider it a war crime, or an atrocity?

We can use phrases like "neutralise the enemy", but the reality is, hundreds of thousands of civilians were killed in order to defeat the enemy.
Passwordle
For the phenotype? (e.g. "I am proud because I am attractive?")
The first two risks are unchanged, a failed and recovered Little Boy always carried the same risk. Three, what if they ignored the bombings? And four I think you misstated, but how do we know a single more allied soldier didn't die because we dropped it on a civilian target?

I've read "The Making of the Atomic Bomb."
I think it is hyperbole not a real assertion, it is a weakened version of the virus which is the original basis of the concept of vaccines, pre-mRNA
CC-BY 4.0 is a perfectly good open license for non-source-code. OSI lists licenses for code, which is why it doesn’t list CC 4.0 licenses.

Finally, go check out the license for the OSI website. It’s CC-BY 4.0, same as this.

It’s not even at the degree of sleight of hand as treating dy/dx as a fraction. It’s perfectly cromulent, not abusive of “open source” and perfectly in line with the principles.

I know the HN community is huge on being negative and stuff but come on, man. If you’re going to be all “abuses the term open source” and shit like that, at least bother to have some basic knowledge.
True, most Gen-Z ers know nil.

First they should try Perl as if it was a tuned up AWK, and then,
read the Orelly Perl books as if they were a religion.

https://docstore.mik.ua/orelly/perl4/index.htm
I have in one of my applications a background job that basically does the following:

- Some quick database lookups (~ 10 ms total)

- An API call (depends on the time of day, but between 500-800 ms)

- Another quick database insert (~ 20 ms usually)

The job only needs a db connection for about 5% of the total runtime of the job and can give the connection back to the pool while the API call is running. Many mailer jobs in the system have a similar db-to-api-call ratio.

(Also, I am of the opinion that all but the very biggest sites should not have any problems with db connections. Get a database that handles tons of connections gracefully like MySQL or use something like pgbouncer when using Postgres. Having low connection limits should not be a problem in 2022)
Yeah but again, no one is blaming anyone for the root cause here. Only for the handling.
Yeah, there are the heavy squeezers, but they are quite rare. Otherwise even women can shake hands.
That doesn't sound right, even if the composition fails to be a monad it's still a functor so there's no reason you couldn't keep composing with other functors (in particular other monads).
Pre Covid my entire team would go on walks once a day, even when it was cold out. I really miss those 15-20 minute excursions, I feel like we all really bonded during our walks and it was a good opportunity to hash out weird things about work and complexity since we had nothing better to do than pick each other’s brains.
It should be. If your company has a lax attitude to WFH or is even fully remote, then it may even be better than going to the office. I know some extremely high-performance companies that swear by WFH. Like Coinbase, GitLab and a few others out there. You'll hardly have issues in companies like that.

If however your company is a bit more traditional, then you run a risk that, psychologically, your manager think more about the people he sees at the office in person, and less about the people he only sees through video chat. This will hinder your career progress significantly.

In general, a good rule of thumb is: the more your career growth, or potential growth matters to you, the less "wiggle room" you have, and the more you will simply have to accept certain terms and conditions. For example, if you think it is unacceptable for you to attend the office, and your prospective employer wants you at the office at least a few days a week, then it is obvious that you will not be able to choose them, and you'll have to go with another employer that won't place that big of an emphasis on office work. To this end, it is obvious to conclude that your career growth is going to be more limited the more constraints you throw into the equation.
It makes sense though?

If you're browsing via HTTP there is no expectation at all that what you are doing is secure.

If you have a problem in HTTPS, you are expecting to be secure, you might not be. Hence, a warning.
No. Go look at Ragas in indian music.

“Ragas are precise melody forms.
A raga is not a mere scale nor is it a mode. Each Raga has it’s own ascending and descending movement. And those subtle touches and uses of micro tones and stresses on particular notes like this…”

Microtones are less than the difference between two adjacent pitches in western scales and are discernable, even to people like me who have a hard time telling adjacent pitches apart.
Jazz theory is a way of condensing down and describing to each other what a collective group of musical geniuses did across multiple years.

I don't think theory is strictly necessary, there are great musicians who don't know anything about theory. Theory should never be used as a way of gatekeeping or deriding people's efforts to build things. However, unless you are also a musical genius who has spent decades honing your craft, there will probably be some benefit from learning from the people who came before you.

It's not necessary essential, but very little theory is essential. You can technically be a great game designer without ever looking at other games, you can technically be a great UX designer without learning UX rules. The rules just make it much, much easier to get to that point -- because the rules allow you to more quickly learn from a large body of extremely talented individuals who shaped the entire genre.
The author mentions that they've contributed to Puck, which is a comical example of this: https://puck.news/

Open up the side menu and you'll see you can select each of Puck's area of interest:

- Hollywood

- Wall Street

- Silicon Valley

- Washington

It would be easier to describe these as "bubbles".
Interestingly, the site itself is built with Gatsby, which scooted into their negative/unpopular quadrant this year and is ranked in their "C" tier.