skysight-inc/HackerNews huggingface dataset:
Ask HN: What's the best way to generate strong passwords?
I've just read a recent article by BleepingComputer[1] and the article says that "Password Length Does Not Guarantee Password Safety". I think we all know the XKCD about the very same issue[2].

So now I'm wondering: what even is the strongest way?

Currently, I'm using KeePassXC to generate all my passwords - and I always try to have as many characters as possible with special and uppercase characters, but my laptop and password database decryption keys are generated using EFF's Dice[3].

[1]: https://www.bleepingcomputer.com/news/security/the-top-5-things-the-2022-weak-password-report-means-for-it-security/

[2]: https://xkcd.com/936/

[3]: https://www.eff.org/dice
That's crazy. 60 and 120 are night and day. Moving the cursor around at 60 feels like of like waving your hand under one of those LED lights that "invisibly" strobe to save energy.
Our aim is to try and reduce the friction during development as much as possible, but still leave developers max flexibility to build any products they like without limiting their creativity.
Very common be it as a new employee or contractor.
> a gravitational phenomenon caused by the out of frame mass of other nearby galaxies

There have been papers published on this, but it is still speculative, so it's premature to say that this kind of alternative theory rules out dark matter.
It probably won't run Windows. But other operating systems, probably yes. Maybe Microsoft comes up with some sort of Windows Server DC Arm edition in the future so they can join in as well.
This used to be true, and I think is why we STILL don't see very many high resolution monitors targeting the PC market, but Windows 10 is actually quite good at resolution scaling now. It typically picks the right default and everything scales great IME
”Hey Siri, show the time-traveller something cool!”

…

“It works sometimes, I swear.”
Woops I meant HDD, can't edit it anymore.
Won't make a lot of difference, the CPU is so bad it would be your bottleneck here.
It's a baremetal sever available on their lowcost brand: https://www.kimsufi.com/en/
> but also quite a few other nations

That's a surprising amount of trust
It looks like they're using a WordPress plugin that disables a lot of stuff in the name of "content protection": https://wordpress.org/plugins/wp-content-copy-protector/

Disabled: right click, Cmd-A, dragging images (to e.g. save), and even highlighting text. Pretty awful.
I have a framework laptop (https://frame.work/) and really like it! I run Ubuntu right now, and do run into issues with fractional scaling, but I haven't seen any laptop properly address that on linux.

One downside is the battery isn't amazing. I usually get ~3-4 hours when doing development work and ~6-7 with light use.
> It's been two years, and in many ways, the data is still not in yet.

But we hopefully aren’t expected to hide until the data are in?
I remember for a long while everything was "Toy Story" quality in real time, the PS2, the PS3, etc. It never really was.

But at some point, we definitely passed it. The room is nifty, but mostly been done. But that is a pretty good person. Lip sync is a bit off somehow... I think perhaps just too overexaggerated in the motions. But I couldn't tell you from a still frame that wasn't a real person, in real clothes.

I also continue to find it amusing that we can build a person like that and sell it as commercial tech, but we still have to record people talking. (Though TTS has taken an interesting turn lately, after years of not much.)
This is prime bad PR. This is going to be an absolute shit show.
Almost every HPC center. Tech stack: Linux (RHEL-like); MPI as middle ware for distributed communication through vendor specific communication hardware (also called interconnect); shared high performance network filesystem usually setup on login node, scheduler like SLURM, IBM Spectrum LSF Suites or others to launch jobs from login node which accessed via SSH. This setup scales to tens of thousands of machines.
If you have a degree and a job that would provide you a pretty affluent life, then I question the motive of your youtube channel. What that is for every person is different and doesn't disqualify them from being legitimate but I will always start with being skeptical of these people.

I learned to beware the guy trying to sell you some incredible financial advice. If it was so incredible, he wouldn't have to sell it now would he?
If there is one thing you want from a 3rd party auth provider, it's trust - this is not the time to play word games.

I'd have far more faith in them if they were transparent about what had happened, what they're doing about it, and how they will make sure it can't happen again.

Instead, they are being weasels - I for one, will not be using their services again, and this behaviour is the reason why.

Here's another example from a couple of years back where they used some really weasely language to claim they weren't vulnerable to a CVE (spoiler: they were):

https://twitter.com/jonoberheide/status/1506280347306188805?...
When anybody says "Everything else is misuse" that is a very large claim because "everything else" includes very many things. Thus the burden is on them, or you, to give evidence to such a broad claim, if you want us to believe that the validity of such a claim.

I don't have a burden to prove anything since I'm making no claims except saying that whoever makes a broad claim should offer some evidence for it. The broader the claim, more evidence is needed, to convince your readers.
The more the company sees developers as a cost center (e.g. legacy companies who put developers in the IT org), the more they're looking for specific technologies.

"I need a dev with 7 years of Spring Bott!"

The more the company sees developers as a crucial input to innovation and building a more valuable company, the more the emphasis is on capabilities.

"I need a senior developer that's great at solving problems. I don't care what tech stack"

But in the second case, a core capability needs to be passing a typical developer interview. So you'll need to practice writing code in a time limit with someone watching you. You'll also need to practice designing a system.

^ it is dumb that this capability matters, but it's the reality today. There are some companies that interview differently where you actually build real-world things without someone looking over your shoulder, but it's not the norm yet.
News? Not seeing a single thing that isn’t biased far left nonsense.
For anyone confused in setting this up, the App is Twilio Authy in the Apple App Store. The logo in the app store has little contrast and the Adafruit blog post just calls it "Authy" which returns dozens of 2FA apps.
Maybe I’m just an unimpressed security professional but I’ve still not seen evidence I’d call a breach. At least not a significant one if you want to argue sublantics.

Workers at organizations get compromised all the time. This doesn’t mean their systems/products are compromised.
> Java developers are cheap and easy to find

As opposed to what developers that aren't cheap? Node.js? PHP? C#? Python? I have no idea what developer you're talking about here. Do you think JEE developers are cheap?
The Studio Display carries all audio over USB Audio, FWIW. That's why I didn't just settle on high-bandwidth DP-to-USB-C cable—the speakers are actually quite good
Bingxing Wang has a similar post about connecting a Pro Display XDR if interested in going down this road https://www.imbushuo.net/blog/archives/1006/
Talk is cheap if you aren't the one footing the bill. The investors are likely in the top .001% in spending money on investigative journalism, but if they don't spend even more money on it, they get to receive criticism for killing journalism from people who made more lucrative investments.
Strictly speaking, if I spin up a droplet on DO and install Appwrite on it, it won't be a BAAS anymore, correct?

Sorry but "self-host your own BAAS" is an oxymoron.

IMO, developers who chose Firebase do not want to manage servers.
Sounds like new leadership is needed. wink
Men are significantly more at risk of severe covid than women, if they actually cared about the risk of different demographics they would have also prioritized males. Applying a set of ideals in just the situations that suits you is called hypocrisy.
This is definitely an interesting problem, and I can see a place for it.

I want to comment (in ignorance because I don't know the techniques you are using) that there is more to detecting fakes or "misinformation" than just the digital attributes of the data. Specifically, confirmation from multiple sources, reputation of sources, and above all, consistency with a world model of how people behave. For example, if there's a video of Biden backing Putin, you could dismiss it as fake regardless of video attributes.

I think (and have been criticized for saying, why I don't understand), that education and emphasizing critical thinking are the biggest counters to fakes, not learning to spot them in feature space. I believe that whatever you make, sanity checks need to be a part of it, and not just blind flagging of true / false based on the digital attributes.

Thanks!
Exactly that. "how hard is it to fix this later" is what drives the ordering in the pyramid.
Sometimes you look for a missing planet (Vulcan) and turns out the theory is wrong. Sometimes you look for a missing particle to carry away momentum and indeed it is there (the Neutrino).
I suspect lots of small channels with only a few people in them. They have 5k employees, it adds up.
They give more technical details than the Okta post and probably even the Okta customer contact.

Eg.

> Cloudflare reads the system Okta logs every five minutes and stores these in our SIEM so that if we were to experience an incident such as this one, we can look back further than the 90 days provided in the Okta dashboard. Some event types within Okta that we searched for are: user.account.reset_password, user.mfa.factor.update, system.mfa.factor.deactivate, user.mfa.attempt_bypass, and user.session.impersonation.initiate. It’s unclear from communications we’ve received from Okta so far who we would expect the System Log Actor to be from the compromise of an Okta support employee.
I'm incredulous an auth focused company would do this without someone freaking out? Even my much smaller SaaS companies would react quickly to stop and rotate these if this happened.
Thanks for the explanation, I didn’t grow up in the west/US so we had no such thing or service. I just remember movies with big yellow books with contact or company information.

I would say most people would use contacts like “Joe Plumber” or “Maria Tinder”.

Truecaller is kind of a substitute for identifying spam calls where I grew up where there is no alternative. Also helps when someone is calling you and you want to avoid answering them.

Most people definitely don’t care that it’s taking all your contact info though the utility of the app is well worth it.
This is a write-up about how it works. I literally wrote detailed instructions on two ways to make it work
Regardless of thoughts on Thiel, the second link feels like a hit piece —- the entire article hinges on one paragraph “BuzzFeed News can reveal that in at least one instance during the summer of 2016, Thiel hosted a dinner with [white nationalist]… And then Thiel emailed the next day to say how much he’d enjoyed his company.“ How many other people were at the dinner? How many other people received this email? What were the contents of the email, i.e. was it a generic thank you? Left to suspect these details would make the story less interesting
aw, cmon, you broke the "False" chain ...
PowerShell has similar issues, see the various incantations you need to invoke in order to avoid brokenness.
This is not a tautology because it's not being used as a final explanation. It's called "matter" because the observational gaps appear to fit what would be some mass that we're missing and we think of matter as "stuff with mass". It's called "dark" because we can only observe it's gravitational impact and by all other observables, it doesn't show up.

> Dark matter works well because it's designed to fill in the gaps in our current understanding of astrophysics data.

"Works well" seems like you are looking at it the wrong way. Nobody is touting "dark matter" as a solution. It's the problem itself.
Show HN: Create Matplotlib visualizations from the command-line
I do lots of data analyses in the command-line and I was missing a simple utility to plot the output of a command (without having to script it). I like very much the Matplotlib API but I found no CLI to pipe data into it. So, I wrote MatplotCLI, a simple CLI that reads data from the stdin and allows to easily create interactive plots from the command-line. Have a look at the README for examples and recipes. Let me know what you think, thanks!

Some examples:

$ plt "hist(x,30)" < sample.json

$ cat sample.json | plt --no-show "hist(x,30); savefig('myimage.png')"

$ plt --no-input "
x = np.linspace(-1,1,2000);
y = x*np.sin(1/x);
plot(x,y);
axis('scaled');
grid(True)"

$ echo '
{"a":0, "b":1}
{"a":1, "b":0}
{"a":3, "b":3}' |
plt "plot(a,b)"
*OTP isn't much of a barrier. SMS would've increased the cost a little more. Both easily automated. I know retailers are trying to fight the tide, but they're going to need more than teacups.
Felt like a bluff to me. The claims were outlandish.
Hauntingly like C, isn't it.

- The floating point type you really want to be using most of the time isn't float; it's double. The %f in printf doesn't mean float but fixed (number of places past decimal), in contrast with %e (exponent notation) or %g (choose between the two automatically). However, at least unsuffixed floating point constants in C are double.

- C compilers accept extensions by default, even non-conforming ones; they have to be told to be ANSI.

Realistically, you can't tell vendors that their language implementation should only expose ANSI or ISO standard features by default, so that users have to hunting for additional packages to get the extensions.

A Commmon Lisp implementation such as, say, Clozure Common Lisp, is the Clozure Lisp language, first and foremost, and it has Common Lisp compatibility/conformance as a feature.

Just like GCC has a compiler for the GNU C language, first and foremost, which has ISO C conformance as a feature.

Just like the people in some region of a country speak their dialect, first and foremost, but can use the national standard one in business or other formal situations.
AI is not coming for analyst jobs anytime soon
It's also technical, the power modules are in the non-russian segments and theirs would be left without should they disconnect. That being said, the propulsion system to elevate the orbit is in the russian segments.
Pretty easy to automate this
I am not talking about these people using FSD on and off like it happens now with Tesla. AS it stands that would be a failure, it's just a glorified cruise control

I am talking about fully giving control to the car and preventing humans from interacting, after clear statistical evidence of autopilot being better than the avg. driver. Given that by definition the majority of drivers are avg. then society would be better off summoning Skynet and putting it at the wheel. It's a clear cut reasoning that works in theory.

Better than avg. doesn't mean that accidents won't happen though. Accidents will still happen and as soon as they start to happen the whole thing will be reversed. That's because people don't consider themselves the "avg. driver" and would rather bet on themselves being better than the avg. driver than the computer being better than that .

Even 95 yr old people consider themselves the local Lewis Hamilton.

You raised the example of FSD purchases, I cite you the counterexample of vaccines. Vaccines are much much much better than the immune system against COVID, if it were to be close you'd have much less adoption because skepticism is not linear.

When in doubt , people bet on themselves or the status quo. In this case the status quo is literally betting on themselves so you have a double effect there too
Every time I change the oil in my car it loses me money, but it's important to the overall function of the car.
That seems doubtful. Outside of a few limited, specific cases like the BRCA genes, that personalized medicine data has mostly turned out to be a disappointment and not actionable. Like if I find out that due to genetics my lifetime risk of rotator cuff injury is 25% compared to 21% for the general population then what am I supposed to do with that information?
It begs the question, what is your boss more likely to say YES to? 15% raise, or 15% self learning time? (For me it is NO to both, but the self learning time is probably more realistic)
MacPaw develops SpyBuster a tool that spots apps with servers in Russia
I'd been eagerly following Kotlin since it was announced in the early 2010s, and could hardly contain myself when I finally got to try it out in real life about a year ago. But... honestly, in 2021, it was underwhelming.

- Compiler performance, especially of mixed Java/Kotlin compilation, is spotty.

- Support and tooling maturity is way behind Java. I'm trying to use it with Bazel, but the support lags far behind the Java equivalents.

- Interop with Java libraries that use annotations or interfaces is maddening.

- Perhaps a matter of taste, but the `var` keyword is a blight, even in Java.

- for all the complaints about "== vs .equals" and that sort of thing, these are by now incredibly well understood pitfalls that are generally checked by static analysis, sometimes even at compile time now by e.g. ErrorProne

In the early days, when it seemed like Java development might stall because of legal hell, Kotlin was a breath of fresh air. But today now, Java is clearly on a path to cannibalize Kotlin's most valuable features. Record classes and pattern matching obviate the biggest draws of Kotlin, while maintaining the buttoned-up, no-fun-but-extremely-pragmatic rigor of the Java language.

Once the glow started to fade, I was left with a very boring, familiar question: what am I really gaining by using this new tool? Is it worth the cost? and on my list of problems I deal with daily as a Java developer, the problems addressed by Kotlin are now so far down on the list that it's not worth dealing with even the tooling friction imo. For me, anyways.
Indeed

"Bricolage", in a private context (typically DIY light home renovation) doesn't bear any negative connotations. In fact, several hardware store chains use the term (Mr. Bricolage, Brico Depot, Bricorama).

But using the term when describing a product or in a professional context is far more negative, often describing something which doesn't look well made or designed.
What telegram channel is this?
> the idea is that the gravitational constant actually changes at very high rotational speeds / centripetal accelerations

First, the MOND regime is not very high (large) accelerations, but very low (small) accelerations.

Second, the MOND hypothesis is not quite that the gravitational constant changes; it's that the form of the gravitational force changes--it's no longer the Newtonian inverse square force.

The key issue with this is that Newtonian gravity isn't our best current theory of gravity: General Relativity is. MOND as it was originally proposed is not a relativistic theory; there have been attempts to formulate a relativistic version, but none of them have resolved all of the open issues.

> this is why our Earth-based gravity experiments don't detect this because we're in roughly the same reference frame and don't see the effect.

No, that's not why MOND proponents say we don't detect the effect in Earth-based experiments. It's simply that we can't reproduce the required conditions on Earth (the net gravitational acceleration from all sources being small enough to get into the MOND regime).
I hear the word Tachyon so much in science fiction that I was under the impression it was a sci-fi word.
Profit at the expense of all else is toxic, in my book. The economic framework of capitalism doesn't absolve individuals of guilt, really. At the end of the day, a human being makes a decision.
Looks like Lapsus didn't do any damage and thus Okta dismisses the breach as not a breach - just like a proof-of-breach starting notepad.exe on compromised machine was at one of my old jobs dismissed because notepad doesn't do any damage. The security professionals today are the second sellers of snake oil after MBAs. Cue SolarWind with their it is ok for binaries' signatures to differ as they get deformed while being forced through the internet pipes :) Lapsus not being a "state level actor" denied that easy get-out-of-jail-free card to Okta.
Without proper separation of duties to limit blast radius, it's just as damaging as a software vulnerability. It sounds like that's the real issue here: Compromise of a support engineer lead to far more access than should have been permissible.
Hah, my other appearances on HN's front page have not resulted in a particularly long tail of fame.

But I actually really appreciate this comment. I'm just trying to have a decent monitor for work that I can also play games with sometimes in the evenings and would rather not have two monitors on my desk.
Nevertheless, the sentence begins with "they found that", so the sentence is false.

"They found that" means their findings include it. Which is different from their findings being consistent with it.
It's https://t.me/minsaudebr.
>Buzzfeed said quarterly revenue grew 18% year over year to $146 million. Profit rose to $41.6 million

It's not the organization, just the division.

News is responsible for the very good image that Buzzfeed has. Why do they give it up when they can finance it?
Modern Tegras can boot arm64 Windows. But yeah without a licensable Windows Server arm64 SKU, practical uses are quite limited.
Yeah by organization I meant "org" not the entire company.
I don’t know, man. If your looking to coast, sure, Europe or SA might be a good place to be a dev. If your ambitious the US is better, imo. And this talk about work/life is always so overblown. If you a work for a good company they’ll treat you well. My benefits:

Dental Insurance /
Free Breakfast /
5 days a week /
Free food /
Gym-Wellness Reimbursement /
Gym Discount /
Health Insurance /
Health Savings Account (HSA) ($1000 per year contributed by employer) /
Life Insurance /
Maternity Leave 16 weeks /
On-Site Fitness Classes /
On-Site Mother's Room /
PTO (Vacation / Personal Days) - Unlimited /
Paternity Leave 120 days /
Pet Insurance /
Sick Time - Unlimited /
Vision Insurance /
Transport allowance /
Phone Bill Reimbursement /
401k- 25% match on the first 1% of base salary /
Employee Stock Purchase Program /
Roth 401k /
Tuition reimbursement /

And these benefits are not even anything special, just standard. I work for a tech company thats not even in the top 25.

Your telling me you would rather make 50k in Spain with higher taxes, than what I have above with 160k?
I want to say Carl Icon's push to separate PayPal from eBay was beneficial. Not that PayPal stock has done so well lately, but it's a real company providing a real service now, and overall the calculus is positive

This doesn't really dispute your point though. Rules tend to have an exception or two.
Untrue, any valid access key pair set can call “GetSignInToken” and access the aws console.
Anonymous Hackers Fire ‘Warning Shot’ at Companies Refusing Pull Out of Russia
> Many think that Einstein's relativity has a more limited domain of validity than we thought.

I'm not aware of any significant number of scientists who think this. Even proponents of MOND acknowledge that they need to come up with a viable relativistic formulation of their theory.
You can use any 2FA app such as 1Password