skysight-inc/HackerNews huggingface dataset:
Founder of keygen.sh here. Thanks for the mention. Bummer you didn't know of it before, but I'm really working on improving SEO so hopefully that'll change for the next person. I actually checked out the source code for Lunar awhile back while digging around seeing how devs use Sparkle, since I've been working on an integration there for auto upgrades, along with a Swift SDK. Let me know if you ever hit a point with your licensing server where you want to check Keygen out. I'd be happy to chat.

Also curious -- from your OP re: Crystal:

> It’s been a joy to work with it! The standard library for working with strings, JSON, YAML and XML is top notch. Type safe and extremely fast, very important characteristics for a licensing server that is queried hundreds of times a second.

You said you're doing ~$3.5k/mo in licenses for Lunar. Where's the licensing volume coming from here? Keygen handles licensing for hundreds of products and millions of devices and I very rarely hit 100 RPS even on a busy day, so kind of curious how your licensing is setup to produce that much volume. :)
Search near your location at:

https://coinatmradar.com/

https://www.bitcoin.com/bitcoin-atm/

I've been seeing them occasionally in big cities since 2014-15 though again it's never worth it at least for me - the exchange rate is typically pretty bad and I'd rather wait but go through a low fee/feeless option.
Great project. Amiga forever! ;)
Probably browsers will remove it anyway and deal with EU in court if they make a stink about it.

As it is, browser companies[0] are the sole authority on what is and isn't a valid CA. At least the EU leadership is elected.

[0] and let's be realistic here, this means Google.
If you want to propose a non-state currency which can rival state-backed ones, solves problems, etc. please go ahead.

crypto ain't it
it is pretty racist man

europeans arent more "important" than other people
This is a super useful resource for anyone writing libraries that need to be compatible with a range of "all currently-supported versions" of something. I use it all the time.
Presumably the browser vendors could require this new EU thing and a certificate from someone they trust.
It occurs to me, I'd be interested in my browser tracking the root certificates it uses and has encountered, and present me with a report of them. I've been interested in curating my cert list personally before, but without an idea of what certs I am in practice trusting (and not just in theory), it's really difficult to know where to start. You're presented with a list of a couple hundred or so root authorities with little more than their name to go by. I could get a real jumpstart if there was 80-90% that I simply never encounter and could easily see that.

One way browsers could push back at least a little on this would be to make cert auditing like this easier, and, if not already possible, potentially expose it to extensions. Preferably with a brand new "manage certificates" extension, which the browsers are welcome to and/or invited to festoon with whatever dire warnings about security they like. (It's hard, if not impossible, to create an interface to improve security like this that can't also be used to tear it down.) Giving enough visibility into the cert process that an extension could flag "hey, this is a new root cert you've never seen before" would be nice too.

Obviously, my metaphorical grandmother isn't going to be interested in this, but it could at least start a more community-oriented "conversation", in the form of running code, around what cert authorities I trust, rather than the browser coders.

I'm not looking to see if this already exists, because if it does I'm sure someone will know exactly where it is and what it's called and can link it to me, and everyone else reading. Please do, if it already exists.
"The 24h time notation specified here has already been the de-facto standard all over the world in written language for decades. The _only_ exception are a few English speaking countries, where still notations with hours between 1 and 12 and additions like “a.m.” and “p.m.” are in wide use."

Wierd fact : some African countries close to the equator have time from 0 - 12 as the hours of daylight. 02:00 is what most people represent as 08:00

If something states a train leaves at 02:00, ask what that means.
Iso is not ambiguous, but be careful not to miss the train until we have world wide adoption.

Technically "The only exception are a few English speaking countries" is incorrect.
Maybe with pseudo elements (::before,::after) and gradients?
Show HN: Securing Services with Pipy and OpenID Connect
Hackers News hug of death? :)
I trust the people I implicitly have to trust (browsers could backdoor your browser, so why would they trust a dodgy certificate). I don’t trust a government, especially not my own, to handle certificate authority selection without involving politics.
What do you expect the E.U. to do that Google or Microsoft isn't doing already?
This is the reason oligarchs were individually sanctioned.
Hoping the browser vendors will enable this only for EU users, I want nothing to do with bad CAs.
Dr. Bronner's, the Soap Company, Dips into Psychedelics
macOS is a Unix. Is WSL2?
Well, yeah. In a run on the bank situation the ability to withdraw money is going to be limited. But I was talking about widespread intent.
Archived: https://archive.ph/BAQ5h
Ok, but at this point I could have just gotten Ruble in the first place no?
You sound like you think you're disagreeing with me, but that's actually my point. There's no point in charging by a metric so disconnected from either the costs or the benefits of the software. It makes sense for AWS to charge that way, because it is in fact directly connected to how their resources are being used.
The whole article is about mandatory certificates, of course that is basically taking control of the most widespread encryption in use today. Encryption that has its weakness in the chain of trust, which the EU wants to have an influence on.

So yes, this is essentially handling encryption if the EU indeed wants to enforce mandated certificates. If you want to discuss technicalities and the problem of key exchange we can do that too.
So your team is the perfect candidate for the paid version, and doesn't see the value.

I agree with others that Postman created limitations just to justify a paid version. Those types of services/apps rarely succeed.
in-group preference, aka implicit racial bias, is still racism.
The funny thing is that's how it's done I guess they also forgot to read their emails.
My personal T480 is silent most of the time. Though I now have an M1 Mac from work, and my next personal laptop will likely be an M1 as well based on my experience with it so far. Not just the chip: Apple finally created the perfect form factor IMHO, with just the right screen aspect ratio, port options (Magsafe plus USB-C charging!), and keyboard.
I think Windows being a product of a big company also played a role. It mainly came pre-installed on most device. Because Microsoft pushes for it, and user, especially the non-technical one, won't bother to install something else on their machine. So, for most computer user, there is just no other choice.
Also interesting that average age of people in the line was about ~30, I have the feeling that a large part of the population (older people) have no idea what is going on.
Are staff allowed to accept terms and conditions for apple?
The firm Camerfirma is provided as the poster child of why the EU can’t be trusted with the QWAC issuance rights - because it (EU) has been shown evidence of malpractice on the part of Camerfirma and failed to revoke its QWAC CA status. But looking at the page linked by the article, it seems Camerfirma’s QWAC CA status has in fact been withdrawn? The article doesn’t make this distinction clear. Or do I misunderstand?
It's been pushed by WikiLeaks on Twitter to be used by Ukrainians.
Due to some people believing that WikiLeaks has been hijacked by Russia, they do not trust the app.

https://twitter.com/wikileaks/status/1497314070738911236
Tldr: we’re fucked
A bit meta so maybe not exactly what you're after but The Nature of Tomorrow was super interesting (a book about books about the future).
Brazil’s largest crime syndicate built a global drug empire
It’s fairly clear they misunderstand the domain:

> An algorithm is isn't going to be able to clear up miscommunication more accurately than the person who receives the message.

The whole point isn’t accuracy. Grammarly improves the clarity and accuracy of the message so another person doesn’t have to. The recipient can focus on the message, not applying their superior ability to clear up miscommunications.

So, I tend to agree with you. Whether or not this person has tested Grammarly is somewhat irrelevant because they clearly don’t understand why it exists.
It always frustrates me when people make false equivalences between techno-economic and socio-political tasks as though they are zero-sum. Let's take homelessness in California as an example. It's a problem that requires zero new technology and zero new expenditure to largely solve, but does require the social and political willpower to actually build more affordable housing to the point where cost of living is reasonable and temporary loss of a job doesn't force people onto the street. But Californians overwhelmingly don't want this. NIMBYs vote against new high-density housing all the time. Cities in California are actively fighting tooth and nail against Newsom's housing bills. How exactly would spending less money on scientific or exploration pursuits solve this? They are activities in entirely different worlds.
Seen this before with google. I accessed a "sensitive" scope so I needed verification and I'm almost 100% sure this was offshored to some sweatshop. You had to send them a video showing how your app used the scope which I did and in fact had to do multiple times to get the app verified. The whole process was stressful and poorly handled by google.

The sent me an email saying there was a broken link on my homepage (a link to the blog at the bottom of the page which was also at the top). In the email they sent me all the links to google were broken. I asked why did it matter if my website had a single broken link and how this affected using scopes, no response.

The don't speak to you and always send you back pre-canned messages, I got one saying my app was still in development, so communicating in this manner is really difficult.

Btw in terms of security almost all the scopes are sensitive in their system so anything other than login you'll have to go through this process.

I welcome extra security but the process was terrible.
Also countries with whom they can just use CIPS, the Chinese alternative to SWIFT. Seems much more straightforward than crypto for most.
Ask HN: Books/Blogs/YouTube channels you follow as a back end developer
Hello HN!

Can you suggest me some of the best content out there related to web back-end development. I am not looking for any language/framework specific resources per se, more like conceptual/theoretical if you will.

Thanks in advance
russia has a massive amount of gold reserves

In the long-term, the Russia Gold Reserves is projected to trend around 2400.00 Tonnes in 2022 and 2420.00 Tonnes in 2023, according to our econometric models. Gold Reserves are country's gold assets held or controlled by the central bank.
There are several problems with this idea. The first is that of scale - the list of companies along with their associated products and proven-correct official web site(s) would be a nightmare to maintain. I would not trust it to be accurate just because of the scale. One possible solution would be for the company registration with government to include a list of web sites, but then you have the problem of merging company registers from multiple countries, and trusting government. Secondly, allowing volunteers to provide updates to this list allows an attack vector. Thirdly, it is trying to solve a problem that doesn't exist.

It's still best and simplest for a certificate to be tied to a domain, not a company. The last several years has shown that attaching a certificate to a company is ignored by users and doesn't add any security. Attaching a certificate to a domain is something that can be done with a high level of security and assurance, but attaching it to a company (or product) cannot be as securely done, and is information that is less useful.
Both are equally important because either one will break the security. The CA problem is the harder human problem to solve though.
As I understand it, it's not a signup as such. Account details are stored locally only. It wouldn't make much sense to require signup for an app whose whole point is to be decentralized.
I worked for a Fortune 200 company at the time, where there were frequent internal debates over which desktop software products to standardize on for corporate licensing and such. PageMaker and Ventura Publisher were the two leading contenders for desktop publishing. I personally strongly preferred Ventura Publisher, since having first done DTP using nroff/troff on Unix, it worked in a very similar way. You could work with the raw text and formatting tags used by Ventura in your favorite word processor and then open the file back up in Ventura. As the Wikipedia article states, Ventura made it almost automatic to have a high level of internal consistency in the document format, because, well, it worked like nroff.

"It produced documents with a high degree of internal consistency, unless specifically overridden by the user. Its concepts of free-flowing text, paragraph tagging, and codes for attributes and special characters anticipated similar concepts inherent in HTML and XML. Likewise, its concept of "publication" files that tie together "chapter" files gave it the ability to handle documents hundreds (or even thousands) of pages in length as easily as a four-page newsletter."

https://en.wikipedia.org/wiki/Corel_Ventura
Browser vendors have an incentive to maintain trust, it's their stock in trade. If they screw up, it directly affects their bottom line because people will move elsewhere. Their goals align closely with my own.

A foreign government (or even my own) has somewhere between zero and weak alignment with my goals. There's little reason they would want to choose good certificate authorities and strong reasons why they would choose ones their intelligence agencies can backdoor. Why should I add them to the chain of trust?
Carthage Gradle Plugin
I can recommend The Elements of Computing Systems and the accompanying website https://www.nand2tetris.org/

Not a game but a pretty good read/work through.
With this plugin you can use dependencies via Carthage in your Kotlin Multiplatform Projects
Hey, nothing keeps you from managing your trusted certificates on your machine, right? Maybe this initiative can even highlight some issues regarding dubious CAs and make people care about whom they trust more explicitly.
The bet sizing isn't totally implausible if the rest of the data is accurate:

The article implies he started out on double-zero machines with a 5.3% house edge. Assume 1 roll per minute and a Kelly-sized bet:

- It'd take on average 87h to 50x your bankroll at a 2.7% edge (half the supposed house edge). You're on average approximately doubling your money with every win, so he _might_ have just gotten a few more wins in the night than expected, but that would be very lucky.

- It'd take 9.5h on average to 50x your bankroll at a 7% edge (1.5x the supposed house edge). That's very achievable in a long night, and you're approximately quadrupling your bankroll every win, so just being a little lucky with a single extra win would drastically cut down the total time.
> The Adam Smith Institute’s proposal has come into some criticism. Sen. Bernie Sanders (I-Vt.) tweeted in response, “Hear me out, because this is a far-out concept... what if instead we just made the wealthy and huge corporations pay their taxes here on earth?”

I like Bernie Sanders, but this kind of exclusive fallacy is not productive. Taxing corporations on earth and divvying up the moon aren’t exclusive. We can do both. And the moon plan doesn’t impact our ability to tax on earth at all.

I’m not sure if Sanders is against the plan on some other reason and just saying this to distract, or just knee jerk reacting.

I’ve noticed how there seem to be these shade throwing arguments against things where instead of arguing on merits, some superficial negative comment is made and then discussion is skipped over, assuming it’s bad. Eg, “I noticed this plan doesn’t have any elbonian authors…” (plan is written by a single person).
I’m not sure what I’m supposed to see, but all there is is a pitch for an end of life app and a link to GitHub and other supporting sites that talk about a project vaguely but don’t provide any content or examples.

Is there an issue with a data store or does the site not work in Safari (iOS)?
iPad + Pencil + Apple Notes. There’s always a note that is shared and updated for the grocery list and any planned meals for the week. If I’m going to cook a dish for the first time I’ll probably just follow the source whatever it is closely but keep an eye out for things that I know are odd about my specific setup. For example if I need to sear something, I ignore the temp suggestions and just go for what I know works on my range and pans. If the recipe seems hard to follow or if the steps aren’t well organized for my time in the kitchen I’ll read over it a few times, then reorder all the steps to make it flow more easily. Then I’ll also take photos and doodle any relevant alterations. But mostly cooking is a low tech process for me.
The median US citizen's savings is around $5k, and the US is the richest country on Earth (or so I'm told) [0]. So, my point stands: Most people don't have a lot of savings, and don't have the luxury to just save money for a later date.

0: https://www.valuepenguin.com/banking/average-savings-account...
GitHub: https://github.com/hoppscotch/hoppscotch
If you can then sure it's not for you.

However, not everyone can receive or send rubles as easily to/from the west especially after the SWIFT and related bans. Either way, it doesn't hurt to have the extra option.
I would have though a simple HTML web response suggesting "The market is currently closed until tomorrow." would have worked well as their current server response.

I'm generally curious as to what's going on here, only because I went to their web site expecting to find the MOEX was closed, but instead found their site appeared to be down.
I have zero trust in the intentions of browsers, and at least a little bit in the EU. Now what do we do?
I don't really understand how the EU can enforce this. If the major browser vendors threatened to prevent their browsers from being able to be used in the Eurozone over this they would have to back down because without the big four browsers almost every single person in the EU would basically be unable to access the internet. It would cause chaos. All four companies are based in the US as far as I am aware so it's not like the EU could do much about it.

As an English citizen I sure as hell wouldn't want this to happen though.
Cool, I didn't even know comments could be deleted! I appreciate your reaction.
So, I think there's two classes of homelessness: transient and chronic.

Transient is the class that would be fixed by adding more housing. It's when you leave an abusive spouse and have nowhere to go, or you miss one too many rent payments.

Chronic is the class that has some more fundamental concern that leads to them being homeless. That's stuff like chronic physical or mental illness, substance abuse problems, etc. That needs more support than just a home.

https://www.homelesshub.ca/solutions/prevention/addressing-c...
We do have a close-up view of a similar galaxy - our own. While the milky way, which is a part of our galaxy that does not resolve as individual stars, is not exactly bright, it appears quite a lot brighter than Andromeda. (It would appear brighter still if not partially obscured by dust in the galactic plane, which we are viewing edge-on. In particular, it blocks most of the galactic core.)
Seeing on the far side of the moon – Works in Progress
Looking for Strapi CMS hosting solution?
Hello everyone!

I'm conducting a little survey here.
Who's looking for a fully-managed hosting solution for #strapi headless #CMS? What are the features you would like to have for such a product? How much are you willing to pay? Thanks in advance for your answers.
If you're a fan of the noprocrast flag, I'll also recommend reading HN through https://serializer.io/ which shows you only what's new on the top list since you last visited. It lets you "clear" HN much faster and helps you avoid burning another 20 minutes reading threads you've already read.

I'm not affiliated with serializer but it's totally changed my life.
>but the certificates themselves will not necessarily be "less secure" - which the layman typically interprets as "cryptographically weaker".

Less secure is more about trust than the crypto algorithm...

The strongest algorithm with no trust in the authority issuing it, is useless.
It's open source[0] so possible to audit. So yes it's legit.

[0]: https://github.com/briar/briar (mirror)
I don't generally use browsers of these companies, but if they break the chain of trust they would damage themselves as much as any user. I believe in the self interest of these companies and the understanding how the effectiveness of TLS is reliant on trust. I would trust Google more than Microsoft that likes compliance a little bit too much, but since both want their browsers established, any compromise to security would disqualify them immediately. The EU has ambitions for surveillance as far as I know.
well generally i recommend Fedora as being rock solid and also includes cutting edge (but not bleeding edge) linux infra.

but i suppose any aarch64 distro
I’m always amazed at HN posters undying trust of government with respect to technology which has repeatedly shown itself to be corrupt, inept and has never taken the time to think through unintended consequences.
The RRP is also there to appease retail partners selling direct to the public
Past discussion:

"Show HN: Endoflife.date – Site with EOL dates of everything" https://news.ycombinator.com/item?id=20033728 (248 points | May 2019 | 80 comments)
https://news.ycombinator.com/item?id=30499572
Historically google and apple has followed mozillas decisions on CAs most of the time (google didn't even have their own program for a long time). I think it is still somewhat accepted that if you get approved by mozilla you will probably get approval from apple and google pretty soon. MS can be a bit weird though IIRC.
Basically: Land Value Tax set to 90%+ of rents. But it would take close to a generation for it to start shaking out in the efficient ways.
I tried very hard to convince the hoppscotch devs to adapt something like .http files so they could be stored in version control. Only a few tools get that right.

https://github.com/hoppscotch/hoppscotch/issues/870#issuecom...

Sadly I don't think they never understood the actual goal of it. And just added github to sync to or something like that. Which isn't what I was looking for.

I use IntellIJ and the http client does it and it works very well. But sadly the rest of the http client is annoying just basic stuff like reading the response is always a few more clicks than I want and compared to Insomnia so much harder.
>> I don't know why people would want laptops at 16:9 at all.

I don't believe almost any of the HN audience does. The vertical crampiness of almost all the laptops is what makes a second monitor practically mandatory for me.