skysight-inc/HackerNews huggingface dataset:
This is a really nasty breach of the supply chain given how many companies nowadays consider IT to be a cost center - even capable engineering orgs end up using Okta because the cost of building and maintaining your own SSO especially throughout an entire business is seen as not worth the cost. This is another situation where the cheaper option (buy-in SSO as a SaaS) can be worse simply because you're actually buying into an enormous attack surface.
much longer than that sadly. now guess what most companies set log retention to?
Yes, you are right, I am working on removing the problem altogether but unfortunately it takes a lot of time.
Having the client record video is a good idea, thanks for the input. If you don't mind me asking: your clients send recorded video because you ask them too? Or because it is easier for them?
I wouldn't throw out the baby with the bathwater. I don't know how publicly it's acknowledged, but most people I know in security have always had a poor view of Okta's security.

On the other hand, I feel fine using GSuite for SSO because we have a much better view of their security.

That said, it sucks that everyone is so fucking bad at security. I maintain that it is not that hard.
LAPSUS$ has released source code to Bing, Bing Maps, and Microsoft Cortana
No comment on the dude calling me an "asshole"? I hate to say "he started it", but he clearly did. It irritates me when people show up with holier-than-thou attitudes, assuming others don't know what they're talking about (I'm referring to @david38, of course)
I'm glad you brought up the Roman dictatorship, because it's a great example of the way checks and balances worked in the Roman Republic. There were nearly 100 dictators prior to the 2nd century B.C.E. - often appointed in times of crisis - and not a single one attempted to seize control of the state. There are probably a number of factors that led to this (the fact that dictators were only granted their powers within the realm for which they were appointed; the fact that dictators could only last 6 months at maximum; the fact that dictators couldn't legislate; the fact that the tribunes of the plebs were absolutely outside the authority of the dictator; etc. etc.)

> Those checks and balances were simply not needed during peaceful times

There weren't any peaceful times. Almost literally. Rome was at war for all but 6 years of the entire Republic.
The hardware isn't the best. It has many usability problems. But if it will get traction, things will improve for sure. Not only Librem might get better phones out, but it might inspire competitors.
I wish I could justify using SQL more. It's just way too easy to use Dynamo. Unless my data is complicated enough to warrant a relational model, it's going in Dynamo.
Because auth is super hard? Have you tried implementing SSO for arbitrary OAuth2 providers?
I think one mistake is using the term “monolithic” in comparison to “microservices”. To a whole new generation of programmers (and a fair proportion of older ones also) it has a negative meaning somewhere approaching “a huge and growing mess of smelly unstructured, non-modular code”. It is a negative term invented to compare against the glory that be “microservices”.

I prefer to use the term “Local Modular Application” in lieu of anything better?
Sure man, blame the user.

How many hours did humanity lose trying to center things in CSS?

How many hours did humanity lose trying to understand if the size of a box is set by the parent or the child?

Why not admit that CSS has been a giant shit show since inception, and that !important is just another crappy band-aid feature in that mess of a toolbox?

I have been designing APIs for 15 years and I know people misuse them all the time. And I know it’s frustrating. I also know when I have been wrong, and if I were in the man’s shoes, I’d rather be sorry that I created that monstrous piece of technology rather than blaming the millions of developers who just didn’t find any other effing way than to set !important on a random property.
I'd be kinda shocked to find that Okta isn't anywhere in Microsoft, just given acquisitions. But yeah, no evidence that it's directly related.
Cloudflare CEO's response: https://twitter.com/eastdakota/status/1506143353544478724

(I'm aware he's often on here as well, hi eastdakota!)
This is not only about current headlines, it is the very same list of hybrid war tactics shared by two figures.

https://texty.org.ua/articles/105990/putler_en/

Originally published: 21 December 2018. Translated into English: March 2022.

It looks like history have taught us almost nothing.
It wasn't the device that was under attack but the communications between the app and server. Sure, there is an idea that everything your phone does ought to be known by its owner but that isn't how the phone or law is set up and the attacker had to find a security vulnerability to gain access.
Isn’t binary tree depth just simple recursion? Pretty straight forward from programming first principles without memorizing algorithms.
Ongoing discussion: https://news.ycombinator.com/item?id=30762520
RISC-V really is the heir of MIPS as it had those TLB tags as well.
I'm in Canada, and have electric heat. We've added a heat pump, being in a more temperate climate, but originally all the primary heat was electric baseboards with simple resistance heating. The baseboards still supplement the heat pump for rooms that we want warmer for example. Our stove is propane, but still needs electricity to run the oven's panel and glow plug igniter.

We're in an area (island) without a gas pipeline, so the choices are electric, propane (portable tanks or delivered), or wood stoves. Space heating and hot water are definitely the largest hits to the hydro bill, but we'd be in a tough spot if the power tripped off completely for every transient load over the average.
No, but there are both open source libraries, and complete authorisation servers. If you trust Okta, you can trust these, and embed them in your infrastructure. Auth only gets super hard if you try to be smart and deviate from best practices.
> virtually anything that isn't national security

So basically the unimportant stuff.

Like historical employee cafeteria menus and janitorial schedules.

Gee, great.
I don't think you've heard any Democratic President in the last 50 years argue that we should eliminate birthright citizenship.
Nobody said anything about state schools - focus on the main argument.
Russian Officials Acknowledge 10,000 Dead and 16,000 Injured
Webarchive of post updated in a few minutes:
https://web.archive.org/web/20220321131726/https://www.kp.ru...
It's a question of degree, and also one of context. In this case, he seems to have extracted a lot of value from somebody else's work without himself having created much that is new.
Can you link me to these open source libraries that will handle arbitrary oauth2 providers?
Because in both auth and email one can make a small screw-up that allows for a company threatening breach. As someone who has performed penetration tests for all of: companies that roll their own SSO, companies that use a third party SSO service, companies that provide third party SSO services, the failure modes for contracting out to a third party are a bit easier to manage if you are a small company, and chances are if your SSO provider is breached they are going to care about bigger fish than you.

For medium to large enterprises, the calculus is harder and there's going to be months of flame war trying to hash that out.
As someone in the tech community who fell into an obsession with Rome, I think my fall into it was mostly just familiarity. Out of all the great empires of the ancients (China, Rome, Persia, Khans, Greeks, etc), who is the most responsible for what I am today? I write in Roman letters and speak roman words thousands of years later. My ancestors from England lived in cities built by Rome and lots of American political culture is Rome-inspired. Heck, Cincinnati is named Cincinnatus who was responsible for saving Rome on more than one occasion.

The question isn't why are we obsessed with Rome. It's why not.
What about discovery of sites you don’t know about. The whole purpose of he internet is that we’re all connected, but you seem to want only an extended private network.
"Those who would give up Freedom, to purchase a little temporary Convenience, deserve neither Freedom nor Convenience."

I know that, but Librem it's still too rough for me. I hope it will get better in the next iterations and I applaud those who buy it now, knowing they are also funding R&D for better future phones.
Smartphones rely on stacking multiple exposures in very quick succession. They can do that because a smartphone sensor can scans extremely quickly. In a smartphone, it doesn't make a difference whether you take one long exposure, or several short ones and add them up.

But the bigger the sensor, the slower it scans. Scan & stack is not yet feasible for bigger sensors.

Besides, smartphone sensors need to do this to overcome their limited dynamic range. Bigger sensors are not typically limited by dynamic range, and hence don't need this.
AI Tales
> Naturalization is exceptionally rare in mainland China; there were only 1,448 naturalized persons reported in the 2010 census[47] out of the country's total population of 1.34 billion.[48] Acquiring Chinese nationality is more common in Hong Kong; the Immigration Department naturalized over 10,000 people between the transfer of sovereignty and 2012,[49] and continues to receive over 1,500 applications per year since 2016.[50]

https://en.wikipedia.org/wiki/Chinese_nationality_law#Acquis...
Wouldn't that be nice. Unfortunately we've got politicians with pockets to line. Progress would be antithetical!
95% of companies on the planet do not have the necessary resources or expertise to run a robust authentication infrastructure, and this one hack (which we really know nothing about at this point) doesn't change that fact.

If you are in the 5%, great! You are probably set already.

If you are not, overreacting isn't going to help anyone. There's no need to start writing user login code tonight.
I also backed this in 2018 and have not received it yet. Absolutely insane.
Security IS hard. Every single day there’s a zero day practically released.

Add in systems that were built for X and now doing Y. This is hard to get right. A single slip up will lead to you being compromised.
yes, seems like it could well be correlated to susceptibility by formation psychosis via propaganda ops.
Its expensive and keeping the expertise around and maintaining it was seen as not worth the cost.

The problem is motivation to break it trends up over time as the service gets more and more popular.

In some ways, if Okta can fall basically anyone can. Sometimes there's an advantage in being smaller. One would hope that the actual attack surface on Okta was smaller than the post seems to imply. That there is even any way to get full access to all customers would seem to be a critical failure.
And what if you need third-parties like a payment gateway? How do you do this without sharing PII?
From friends and former colleagues I know at least quite a few companies using tools like Tanium [0]. The Tanium client on the employees' machines (and on all corporate servers, containers, VMs) is still based on python 2.7.

It would be interesting to know Tanium takes to backport security fixes. I mean py2.7 was sunset 2020-01-01 [1].

[0] https://www.tanium.com/
[1] https://www.python.org/doc/sunset-python-2/
There was an HN poster a few months ago who claimed that memorizing the Python standard library made him much more productive.
>Very very few people can start from the abstraction and get TO a literate outcome without a lot of false steps along the way.

But don't writers face the same issue with their text? Am I the only one who writes more code than what ends up in a PR? Isn't that exactly what the Git history is for?
> Every single day there’s a zero day practically released

Yeah, people need to stop using memory unsafe languages. They choose not to.

> A single slip up will lead to you being compromised.

Not if you add multiple layers of security. Like sandboxing. Or mTLS. It's not hard to do that.

edit: Let me clarify. Security isn't hard generally, but it's hard individually, because you're drowning under everyone else making it artificially 10000x harder.
This is ridiculously reductive.
The monitor port on my Thinkpad X1 Gen2 does not work under X. It works with Wayland. It's probably because on Gen2 that port is driven by the NVidia card. On the Gen 3 it's driven by the Intel GPU.

By the by, Wayland is a definite improvement on X. It's noticeably faster, and handles scaling better. The lack of network transparency (eg, running gvim with X) doesn't matter because everything still uses X under the hood (via XWayland). I gather they have a workable solution or network transparency now, so the future is looking bright. It's just Gnome3 that's the problem.

I don't know whether it's a coincidence, but Gnome3 copied OSX's look and feel, and systemd copied OSX's launchd, and most of the development of both happens in the same company. There is even a launchctl. If they love OSX then fine, but I would have been happier if that had of scratched that itch by buying themselves Mac's rather than trying to copy them.
My 180 gram Android lasts days.
> If you are not, overreacting isn't going to help anyone. There's no need to start writing user login code tonight.

I agree. That being said, there's no need to write login code yourself. Trust on the existing, tested, proven OSS solutions and libraries available, if you decide to not rely on a provider like Okta.
" She has to recharge three lithium-ion batteries — which give a combined range of 80 kilometers (50 miles) — in her auto rickshaw twice every five-hour shift."

So you have to use three sets of batteries for 80kms. Sorry, but I would still use gas.
Cloudflare CEO: No evidence we have been compromised by potential Okta breach
Yes they are. For two reasons. The handlebars, and importantly the wheels are much larger than a skateboard [1]

The larger wheels make for a much smoother ride, and they handle bumps far better. You’ll pop over a bump that would send a skateboard into an instant brake.

[1] https://i.ytimg.com/vi/l9n5zWm0N5o/maxresdefault.jpg
Async remote jobs seems to be the key words to find something that fits for me. Thanks for the hint of remote/international consulting, will give it a try to search for this.

In the best case, finding someone from the opposite of the world would force async communication, I never thought of that.
This seems to be one of the more popular ones: https://www.keycloak.org/
I would say that the fact that his country is at war with a super power is more likely to correlate with the psichotic personality of the leader of the super power than with him being a comedian. He has inspired loyalty and drive in his people which is all / as good as a general could do now
> but most people I know in security have always had a poor view of Okta's security.

What are their usual criticisms? Genuinely curious. I've always hated their UI, their docs, and lack of real support but felt that at least they had security going for them. The last assumption might have been proven wrong tonight.

Also, what would be a reasonable alternative to Okta now that their nearest competitor, Auth0, was acquired by them. Is GSuite a reasonable alternative for SSO with multiple different providers and supporting SAML, etc.? Thanks in advance.
The broadcast media stopped being the way a huge majority of people got their news starting in the 80s with cable. So the US returned to normalcy, with large portions of the population absolutely hating each other. The post civil war era was also abnormally amicable. Conservative Democrats found it easy to work with liberal Republicans and their constituents would still vote for them out of tribal/regional loyalties.

Hating the political opposition is the norm, not the exception.
Could you expand a little? Of course a HN comment is not giving you full instructions on implementing custom authentication infrastructure, but that doesn't mean it's impossible or somehow "wrong" to do so, if you rely on established libraries and patterns.
Optionalitymaxxing and the Search for the Greenest Pasture
It's incredible in 2022 that websites are unavailable for 'maintenance' for an entire 2 days. Especially a multi-billion dollar company's website.
Here is an article from 2019, the World Bank data you linked includes up until 2018, anyway the article includes the gini coefficient sourced from OECD and it has Russia at #11 (.38), US at #9 (.39), and China at #2 (.51) out of the countries they included in their rankings.

This seems very close to the 2018 World Bank data you linked for Russia and the US, but as you will note the last year of available data for China with the World Bank is 2016 at which point the gini coefficient exceeds Russia.

https://www.google.com/amp/s/amp.usatoday.com/amp/39510157
Great. The plot-driver of the most recent Bond film is somewhat real.
Doing user IP address change detections as part of a heuristic vector for account compromise is sometimes a best practice and sometimes a great way to generate a bunch of useless noise, but I know which is less likely to break UX by integrating such a feature.
That seems to depend on how often you click such links, or something else I haven't thought of. I used to have your experience. Now I just get a person's profile pic and a logon prompt. If I uBlock zap that, there's nothing accessible behind it.
I tried it, and it was surprisingly usable. I am going to install it in my VS code and hope it supports C++!
Yes, I agree. You should substitute a mix of cognitive attributes for my original post's simplistic focus on IQ.
The second translation is a biblical reference, where a "Hiobsbotschaft" implies receiving news of a further tragedy, invoking the Old Testament character Job (Hiob), whose faith was tested by suffering great losses.

Unfortunately neither of these help to understand the English shoe idiom which I, as a native English speaker, have no clue about.
A problem in infosec is information dissemination. Lots of their criticisms are based on backchannel information shared over drinks. It makes it difficult to discuss publicly.

I wouldn't want to make a recommendation, but I'll say that my company uses GSuite.
Rather similar in Canada, where the suggestion was to tell the police that the trucks contain aboriginal people rather than largely white males.

An unarmed, native blockade over a pipeline being rammed through their territory gets an over-the-top response, from heavily militarized federal police.
It's also not legally correct. Just putting the words "privileged and confidential" on a document and copying an in-house lawyer doesn't render it subject to privilege.

That being said, the practice is incredibly widespread. While it borders on unethical, I'm yet to see anyone actually penalized for slapping P&C on every e-mail willy-nilly. At worst, courts just rule that privilege doesn't apply and that a document must be produced.

Even that is rare, for obvious reasons (if opposing litigants don't even know a document exists, how can they argue that the "P&C" label wasn't legitimate?).
So hire someone who does, or consult an outside company to do the work for you. You can get the expertise without necessarily having it in-house. There are agencies both big and small that can help you, including training your existing staff.

Yes, it's going to cost more upfront, but there are a wide range of options between "rely on a blackbox PaaS/SaaS" and "write and deploy everything yourself".
One possible route: a Microsoft employee using an Okta protected product/service.

That other product/service was compromised, which let hackers hack into MS employee’s computer, which gave them access to Azure infrastructure.
I've never done this, but it seems like an excellent idea. With the QR code, you could always reinstall to a different app.
Tepco urges power savings, warns of possible Tokyo blackout
Are you honestly asserting that a warming climate was the cause of the Bronze Age collapse without addressing 1177 BC and the migration of the Sea Peoples at all while insinuating that Egypt collapsed (it did not -- it went through hard times, but came through, and its the closest thing to a contemporary historical record we have)?

The sudden influx of nations on the march threw a spanner in a complex network of trade and intermarriage for regional stability. We have *zero* real idea why the Sumerian civilization was supplanted, or even where it originated from for that matter. Was it a language isolate because semitic groups became demographically dominant through natural causes? Were the Sumerians transplants from somewhere else? Did the Akkadians, Assyrians, and Neo-Assyrians rigorously stamp out ethnic groups? Zero idea.

It doesn't bode well for your position that you appear to be ill-informed also, and that you're asserting that a blip (because agriculture had no problems coming back to Mesopotamia after we have a reliable historical record again) in the climate also caused every other civilization in the Levant to collapse rather than 'we have a fragmentary historical record of the death throes of those civilizations against unknown invaders who pushed out (in the Levant) from a geographical position which happened to also serve as the transit corridor for trade, diplomatic communication, etc?", along with evidence for civil unrest, natural disasters, and a large number of factors which are merely contributory factors to a complex situation.

Honestly, please go read 1177 BC.
This is fantastic! I've been looking for a way to do this myself on my website https://pianogym.com!

Right now we rely heavily on MIDI input from the Web Audio API and it's been my dream to make it so any instrument can use the website!

You are so cool! Thank you for sharing this!
It is harder to build trust when you don't see and hear the other party. I totally get that and its fair honestly, a lot depends on facial and verbal cues. So I assume someone in my shoes would have to make extra sure to build trust by being responsive and delivering reliably.

It would probably also be beneficial to have some kind of proof that the work I claim to do currently is actually done, maybe invite the other party to the git repos or something. So if they wanted to, they could check on the status any time. I guess that might reduce some uncertainty.
I have built solutions that are a perfect fit to solve security issues at multiple companies, only to have them turned down because “management says we have to buy a vendor for this”. Incredibly frustrating, especially when they go with a vendor that is in all ways worse than the solution I was providing.
Log4j was memory safe. Tho I agree on mTLS and even would like most valuable networks to be connected only via an allow list of safe-ish destinations. It would make things a lot harder, and the logs of denied hosts would also be a nice warning.
I agree with you on not outsourcing authentication etc to a big provider like Okta, but OAuth2/SSO can get ridiculously annoying in large organization/s. If it's one app that you're dealing with, no worries. If it's multiple operating systems, multiple legacy and new apps etc, its a headache. Not that Okta particularly helps with that either though, it's a problem full stop.
Reading the Librem app docs it seems like apps are GNOME programs packaged with an manifest. I can’t find anything about app lifecycle.

To be able to conserve battery apps works differently than programs, apps can be suspended. That is usually the problem with normal programs, they are not developed with battery conservation in mind.

I wonder how Librem have solved this, perhaps in their scheduler, or intends to solve this in the future.

https://developer.puri.sm/Librem5/Apps/Guides/Design/Constra...