skysight-inc/HackerNews huggingface dataset:
> Both the Toronto and Berlin studies found that people on foot, on bikes or taking public transport spend more money when they go to local shops and visit much more often than those who travel by car. In the case of Berlin, people who did not drive were responsible for more than 90 percent of weekly spending.

That makes perfect sense. People who drive far are looking for better prices. They will buy one or two things they know are usually cheap or often on sale and then get other things in some other store that's along their route to wherever they are going.

The walkin' locals are going to be the more captive customers.
They don’t have to have spiritual value; they also look much better. What they planted instead is pretty horrible.
> swapping out login pages

Hmm you’re right, I didn’t think of the scenario when they would give you the machine back in a tampered state.

I was gonna reply “well just wipe it once you get it back” but that assumes that I know it happened, so I’m still susceptible to the evil maid attack and such.

Also fully agreed with the last paragraph.
In the late 80s to early 90s as I attended college and then spent a couple of years following the Dead, I smoked pot, ate mushrooms, dosed LSD, and snorted cocaine on a regular basis. I also sampled various other substances along the way.

Several years later I applied for and received a Top Secret clearance. I fully admitted all prior drug use as part of the process. I was working for a government contractor at the time and was not a government employee.

At the same time I had a couple of friends who worked for a 3 letter agency and had prior regularly smoked pot. They admitted their prior use during the hiring process. This again was during the late 90s when attitudes towards pot were more negative than they are today.
Mice were available, just not generally that useful because so few applications supported them. Usually they came with a bundled paint-type program. IIRC, in the early days of Windows (i.e. 1980's probably into the early 90's) they sold bundles with mice since they were still quite rare for people to have on PCs. They were just another input peripheral you could buy like joysticks and digitizers. Getting software to work with them was another story...
> Renting a car (in the US) can cost $40/day.

I just looked up (on kayak.com) the cheapest rental car I could get tomorrow and it is $72/day.
But both apps are on the same user devices, presumably? If so I can see that splitting them protects against the 1password DB being compromised but not against someone getting access to a user’s phone (which seems more likely to me).
If India, China and all of Africa find a way to buy Russian oil and then sell theirs to Europe at an inflated price, everyone will be happy.
Why not? I got a patent on it. A method and system for representing a write-only data store.
under a different account that doesn't have the password to it stored in the password manager. yes.

I also use a standalone 2FA for access to me password manager.

Also, my work accounts are stored in a different password manager and THEY use 2 more different 2FA clients...

its starting to get a bit much tbh
If Ukraine will won a case in a USA court, then Russian oil can be confiscated by USA government (for USA government).
I am not an expert, but "Threat models in which a separate setup would have a benefit include only breaches of your password database itself." doesnt this mean that there is a big difference if the attack vector is by a keylogger? (Which can sniff the Database pw). Are keyloggers not a common thing for threats (I dont know)?
They’ve done that with Venezuela. Like capturing a tanker going from Iran to Venezuela, even though they theoretically should be able to trade.
Step back and draw a deep breath. Re-focus and now religiously document everything, runbooks, code comments, deployment guides, issues and outage reporting.

You only get to encounter a new codebase once. While everyone else justs accepts things as they are, very few will ask why. Some of the senior devs won't even know why certain things are the way they are. By documenting everything, for yourself initially, you will over time gain both experience and get one over on the complacent senior devs.

If a junior dev makes a mistake, it's more on the senior devs and managers to catch it, you're not expected to be supernaturally correct all the time coming into a situation with zero knowledge.
Mine definitely understands a few two words ones.

"Who's that" is something we always said when approaching someone we recognise, and now if she hears those words - even totally out of context, mid way through a conversation - she gets excited and goes to look out of the window.
If your password store is owned then the attacker has both your credentials and the second factor. So in that way, the password manager has sacrificed a security fail-safe.
It is impossible to find anything in Confluence. The search is useless. Anything that's not in my list of recently worked-on/viewed is basically gone forever.
The anchoring system was insane to begin with and would likely not have worked even if all these alleged software and computer problems had not occurred.

When you are a lighweigg tlander in a very low gravity of a comet, the last thing you need to be doing is shooting harpoons at the icy ground. The harpoons are not going to stick well/at all and the very act of firing them is going to send you careening off back into space.
At uni, one professor used to say: "spreadsheets have all of the problems of software engineering, but none of the solutions"
it's not consistent between confluence and jira. they don't listen to requests for improvements (best example is ctrl+[ / ctrl+] for indent / outdent).

the latter is forgivable, the former is not.
In my experience, the best work-work is the side projects.

The things people did not know they needed. Or knew they needed, but could not get. Or sometimes even articulate.
thank you for saying this -- I thought it was just me!
What you're missing is the fact that EU sanctions specifically exempt Russian gas, oil and coal.
There is a possibility, but I believe, if anything, it's either very far away or even completely impossible.

I'm not a strategist, and trying to stay as far as I can from politics, but unlike Russian invasion of Ukraine, where other countries utter strongly-worded sentences while buying as much Russian gas as they can get a hold of, Chinese invasion of Taiwan will not end well for China. Taiwan plays a vital role in semis, electronics, communication equipment. Nobody is particularly dependent on anything unique to China, on the contrary, China imports a lot of resources and food. Once this is cut off or made prohibitively expensive, China's economy will tank and the following social unrest will be unacceptable for the CCP.
Thanks for the history lesson. Yes, I know the rule from high school. Newton however did a much better job in making his name live forever. And they all succeeded in erasing their questionable behavior from lectures. Money can buy a lot.
> (as, automating a password phish + an MFA phish + logging in with that info within 30 seconds + navigating to the change password and remove MFA screen + phishing for a second and third MFA code to change the password and remove MFA is near-impossible)

Well...

You get the MFA phish for free with the password phish, because the user actively expects to be prompted for the MFA code.

Automating a login with the information is easy, and automating the requests to change password and remove MFA is also easy.[1]

Phishing for followup MFA codes is a real obstacle, but probably not that difficult - assuming the source of codes is the same TOTP secret that was used for login, you can just tell your victim that their login failed and they should try again. That's a routine flow and it's unlikely to cause any alarm.

[1] Among other things, there are decent odds that you can't remove MFA because of e.g. a corporate policy. But you can just automate whatever it is that you want the compromised account to do, and do that.
“Repugnant to the nature of a straight line”: Non-Euclidean geometry
For those struggling to google what PIP means in this context (as I did), PIP means Personal Improvement Plan. Being put on python pip sounds kind of funny though.
I spent $4205 on car expenses last year, not including fuel (since I'd pay fuel separately on a rental car as well). That's for two cars (spouse & I), so I'll say $2100 per car.

The cheapest rental car I could find (searched kayak.com) is $72/day.

So, renting could only be cheaper if I used a car less than 2100/72 = 29 days per year.

But that's not counting cost or inconvenience/time of getting and returning that rental car. The few times I'd had to rent a car I've had to get an Uber ride to get to the rental place and then back home, so that adds another $20 or so to the rental.
This sounds awesome. And credit to the team for creating such a nice platform. The 3d api looks real nice, and simple!
Same in Belgium. Agencies first email new offers to their registered users, then publish on agency websites, and only afterwards publish on immoweb.be.

There are sometimes rare jewels published directly by individuals on immoweb.be but the bulk of the offers is trash.
Well the people who used to be excited about Flash certainly were not excited about any of the things mentioned above.
The Clean Air act in the US is a good example.
this impressed me too. Might be an indication to put these in front of every use as they access the page - that's my design two cents for the day
95% of the security of TOTP stuff is that users have no freedom in implementing it and thus cant mess it up. There is no equivalent of having "hunter2" as your password when the user doesn't choose the secret. They cant reuse secrets across sites if they dont choose secrets.

Every other realistic threat is not helped by TOTP. There is some threats that in theory TOTP can help with, but dont given how it is used on the web.

* phishing - just as easy to phish the token

* trojan on your computer/shared workstation - just steal the session cookie or take control of browser remotely

(For U2F/fido keys/webauth based 2fa the situation is a bit different, but almost nobody uses that)
It's not like some scientist wannabes made up some stuff to be on BBC. They really found some evidence and started saying meaningful things.
To be fair I hadn't verified it was still true when I wrote the message, and I'll admit all I've seen recently is reference counted languages. It was definitely true when I was exploring C garbage collector options for my projects but that's almost ten years ago. I just checked the wiki and it seems Crystal uses Boehm.

You use Java's GC right? Or is there something custom in there now?
Many will automatically just believe this now because it says BBC and science. Poor journalism, they should put clearler disclaimers that this hasn't been peer reviewed at the top
Atlassian services are still down, 5 days and counting
How to increase your attention span
Startup Generator
Exactly. The thing I have is whatever device I'm using right now - could be my PC, my work laptop, my phone, or any other system I can plug a USB stick into. And the thing I know is - well I don't really know it at all - it's whatever whichever device I'm using spits out when I tell it to tell this other thing what I supposedly 'know'.

And then the remote system, trying to be ultra-secure, says "ok we'll send you an email/message and you need to confirm that". But that third factor message comes in on the exact same device I'm using for both the first factor and the second factor.

It's all just security theater.

Conceptually, it kinda makes sense. Like when using a credit card, require the name on the card, expiration date, billing address, and CVC instead of just the number.

But in practice, eh. We have nothing similar to the financial system to catch fraudulent ID usage. So it's all just extra annoyance. For practicality, almost everyone will end up with everything just being a single factor.
> If I decide to use one of their templates such as AGPL and then I add more terms and conditions, it is clear I'm trying to add restrictions.

And you are free to do that. But you cannot call it an AGPL license any more, especially if it clashes with the original intent of the AGPL license - to provide users the right to the source of the software, to modify it, and to redistribute it commercially or non-commercially under the same license directly or indirectly (SaaS).

The court also partly endorsed this position by asserting that Neo4j was doing false advertising by claiming its software was "free and opensource" because the changes made to the license invalidated this.

> Are there copyright on license templates themselves?

Some commenters have claimed here that they do, but they are also "open source". I don't know about that. But I am sure FSF has valid grounds to argue that if one of their license is changed to invalidate their original intent, such license shouldn't be referred to as an FSF license (like GPL or AGPL). That's what Neo4j was doing - they were calling their license "AGPL with Commons Clause". And even the judge pointed out that this was false advertising.

Which makes sense - Firefox is opensource, but if you modify it to include malware and redistribute it as Firefox, Mozilla will obviously not like that as you are damaging their brand. (Ofcourse, that would be a trademark dispute, not a copyright one).
A counter point to this is that spreadsheets bottle-neck the sharing of data and introduce data cleaning issues.

Most spreadsheets are built with the mindset that it is the end of the dataflow. However, at some point, this data needs to be shared forward. This might not be the original intention, but the more important the report is, the more important downstream use-cases become.

This is when spreadsheets become problematic. One can say that it's the owner's job to keep it compatible, but thinking of keeping it compatible isn't what normal spreadsheet users do.

Some issues I've seen:

* One can add a column easily/ rename it. This breaks any data sharing because now, downstream reports break. (In many cases, the data could have been added as a row instead of a column (new status code, etc.)

* Data-types are not enforced. Nothing prevents entering text into what should be a number or even create a completely new status code. Again, automation downstream breaks.

* Important info is usually not included. The spreadsheet is the latest representation of the data, so in many cases, attributes like the time-period (because it's implied) and unique identifiers (skus most frequently) aren't included.

* Maintaining compatible dimensions across different domains is not a priority for a spreadsheet owner. Finance may group countries differently than Supply-chain, which means they'll always see different numbers and argue that their number is correct.

Source: work at a Fortune 500 company, that has way too many excel reports (with critical performance metrics) and combining them to get an accurate view of the company performance is very labor-intensive and error-prone.
Orthogonal to your point perhaps, but the problem with tech is that monopolistic megacorps are the ones who are both delivering that helpful content to you, and the surveillance technologies, dark-pattern Skinner box digital addiction devices/platforms, and whatever other negative things associated with tech.

Maybe we need antitrust action just so we can better separate the “good” software companies from the “bad” ones.
Is it open source? If not, is there any way to integrate with you?
HP ScanJet Music
what if generative content destroys the business of creating real data along the way
Given all the drawbacks of passwords there isn't really an alternative to passwords for me. For example, what do you do if you only have 2-factor auth and you lose access to all your devices/docs? e.g. when you are on holidays?

PAKE supports in the browser would be awesome. Some applications for it:

https://www.researchgate.net/publication/325142389_AuthStore...

(swap the proposed PAKE for OPAQUE)
If it is write-only, what is the point.
what is the cost of reading, what was written?
I feel it's perfectly normal to mess up as a junior. It's part of the learning process.

What does NOT feel normal to me, is that you are just assigned stories and that there seems to be no one who's there for your questions, double-checks your work, and shows you the ropes.
Places I've worked before, new employees would always be given a buddy - a more experienced programmed to act as help and mentor. Someone who could take a junior under their wings.
That wasn't done out of kindness either - but purely for business reasons: new employees get up to speed faster, become more efficient, and there's less costly mistakes, when someone is looking out for them.

The biggest problem I see with the no-help approach though, is that the fear of making mistakes creates a company culture that stifles innovation.
This sounds scarily similar to descriptions of brains dealing with incomplete information. Good thing brains aren't keen on rationalizing prior beliefs in the face of new evidence or believing spurious things.

Oh. Oh dear.
It's a hilarious tragedy that the person you're responding to has the definition of 'tragedy of the commons' backwards in their mind
Business as usual. Make a big noise and bang your fist at the podium, then ignore it behind the scenes. At least Europe won't run out of gas.
It's only the obvious solution in the sense that it's not really a solution but it comes close enough that memory often doesn't leak fast enough for it to matter for short running programs.

A drop in garbage collector (like Boehm) makes your toy language instantly production ready. Basically code generation and garbage collection are the two things that make language implementation tedious. That's why so many languages are on top of Java or .Net. Implementing a language on those platforms is almost trivial because it solves both code generation and garbage collection.
The ads still exist in the places you have paid for them, in litterally every example you gave. Netflix shows are giant ads. YouTube content has litteral ad reads in them. Newspapers - lol.

You can get ad packed content free, you can get ad-free content, you can get paid content that has ads, or paid content that is ad-free.

The "I paid for it" input has zero weight when it comes to determining if the content has ads is sponsored, infuenced or otherwise paid for.
You can even make music with the sounds. On youtube there are various people doing this, like Paweł with his Floppotron.

https://youtu.be/G-X-p0C0Uas
So a business
As an example, mailing lists are likely to have a header like "list-unsubscribe: <mailto:list@host.com?subject=unsubscribe>", which enables email clients like offer easy unsubscribe buttons.
How hard can it be to pick a name that doesn't clash with a common data structure?
I can't escape the feeling that if an apartment ends up being bought by a person who learns about it hours or even a few days ahead of others, then it was priced too low and the seller left money on the table.
How is "This is 40-50x faster than a naive C implementation of nested loops on my machine, " that possible/Do you know how this was achieved?
To the OP, this is a great post, I endorse it as a tech lead / senior dev myself.

Your experience is not unusual, it seems that many tech companies are terrible at onboarding not only juniors but devs in general. It seems almost like a systemic problem to be honest. Many companies are good at this but too many aren't.

I think one thing that might help is more industry focus in CS degrees. CS is great but a "year in industry" and vocational training would be welcome for many as part of their training. Data structures and so on are great but until you've worked with the plethora of tools and processes you will encounter on day one in the industry, being thrown in at the deepend will be baffling and overwhelming. CS degrees and most day to day work as a dev are very different. A practical heads up on things like cloud infra, monitoring tools and CI/CD pipelines (to name just a few things) would be good.
I love X1 carbon, I'm addicted to it :)
Explaining Git branches with a Lego analogy
> The biggest vector MFA protects against isn't really brute forcing (though it helps there); its password phishing. This is literally the only reason behind why Google's "account compromises dropped to zero after we required MFA internally" thing is a thing.

To be clear, there are phishing resistant authentication methods. Specifically:

1. Kerberos
2. Mutual TLS
3. Web Authentication

All other authentication methods (passwords, SMS, TOTP, QR code scan) are vulnerable to phishing.

Google's announcement about dropping to zero wasn't about adding just any new MFA (they already had MFA) but in mandating Web Authentication.

Some people get confused about phishing risk because passwords are vulnerable to passive phishing (e.g. log to file to attempt later), while the other mechanisms on this require active phishing (connect to a service in an attacker's browser, and parrot that authentication flow to the legitimate user). These active attacks are becoming more common, as you would expect.

Password managers greatly reduce the susceptibility to phishing because they care about the site that one is currently on; the person will have to perform different steps to release their password (or TOTP) to the wrong site. There is a proposal to put semantic tagging in SMS challenges such that platforms will only offer to auto-fill on the specified site for the same reason.

However, the three authentication methods above do not have user overrides such as manual SMS code entry - they simply won't work. You instead need to instead compromise the service, fronting application or hosting infrastructure/certificates.

That isn't to say that the phishing-susceptible secondary factors doesn't help the site in other ways. There is simply no good way to guarantee that someone isn't reusing their email and password on several other sites until the password shows up on a breach list. This is especially a problem for corporate logins (using corporate email addresses).

However, such secondary factors don't provide any benefit to the user with good password hygiene.
Don't worry, you are not the first person to think of this. See https://en.wikipedia.org/wiki/Dynamic_window_manager or even start reading at https://en.wikipedia.org/wiki/Window_manager
If it weren't for the source, the cringy Matrix references and sensationalist writing would have made me dismiss this without much thought. The Wikipedia article on Eurodollars and some others make all of this sound a lot more mundane.

So I'm confused. Does anyone know, or have a better source, whether there's actual cause for concern?
I think 'products replacing spreadsheets' is not the right angle. Spreadsheets are great but not for everything.

I think there are a lot of mis-uses of spreadsheets. When users record list type data, long-form content, relational data, etc within spreadsheets, they are probably better off using an app - they, or their IT team can build.

I once seen an enterprise org process where a health and safety check was completed on a clipboard. That user would go back to their desk, push that data into excel, another user would write a script to push that excel data into MySQL.

There are many use cases where spreadsheets are perfect - building financial models.

For transparency - I am the cofounder of a no/low-code tool called Budibase. I am also a happy spreadsheet user.
https://github.com/Budibase/budibase
> corporates finding and exploiting loopholes

Not sure how preventing half of Europe's economy grinding to a halt and Joe citizen freezing their butt off because of natural gas supply running out can be characterized as "corporates finding loopholes"
https://news.ycombinator.com/item?id=30956175
"One Less to Go" on the code page.