skysight-inc/HackerNews huggingface dataset:
These are the major ways networks can set up IPv6:

https://www.ictshore.com/free-ccna-course/dhcpv6-basics/

You can see the easiest one will be SLAAC since you don't have to set up anything but IPv6, but you should be able to see that you can't SLAAC someone a single address. So one possibility is they use DHCP to do it -- DHCP on v6 is pretty similar to IPv4, and can give out single addresses. Another possibility is something called route-filtering. But these are both more complex than SLAAC, so it begs the question why would the sysadmin do something more complex when something easier is (well) easier?

In addition to move your packets around, the ISP needs to know about you moving those packets around, and this typically feeds into accounting and compliance.

One way ISPs do accounting is by monitoring traffic on a link level: This usually involves setting up some database to poll the networking hardware periodically, for example using SNMP polling: https://www.ibm.com/docs/en/networkmanager/4.2.0?topic=mecha... -- this information is then sent to the departments that need usage information.

Another way, is kindof lame, is to do it by assignment: Instead of monitoring the traffic you generate, they arrange for their DHCP-v6 server to trigger an event, for example using SNMP traps or more frequently, by reading the syslog output for ip addresses.

Not knowing anything about Poland except I like your food, but knowing how sysadmins are: my guess is that the move from IPv4 to IPv6 was motivated by trying to reuse some of this accounting/compliance (or configuration) infrastructure the ISP had to build for their IPV4 network. And if all your ISPs do it, well, maybe it's because they all used to be one ISP or the sysadmin-club in Poland is pretty small.

All that being said, something I have seen a few ISPs do in rural UK is interesting: They give you a router which does the NAT locally-- it used SLAAC to establish IPv6 and then it's running a link-local address for me. The effect is the same, but doing NAT carrier-side (or any other kind of connection tracking) is expensive, and more-so for IPv6 (all the addresses are bigger), so even if they gave you a single address, your ISP might not NAT'ing you in their network, but instead gave you a box that NAT's you by default. And if you have (root) access to your router, you can check if this is the case, otherwise you can buy your own router and see if you can swap it. The reason one company gave me for this is that it simplifies support and that "you know what you're doing anyway" so unless you know that you're being NAT'd inside their network, you should check because you might not be.
What kind of attack does it make possible that is impossible without TOTP in the password manager?

I'm not considering online password managers which IMHO are inherently weaker than local ones.

If somebody steals my laptop the passwords database is protected by a master password anyway.
Just roll them in a nice soft blanket. I have one that keeps me warm even in plain winter. We can add a hot chocolate cup and that should do the trick.
No special level of dedication needed. I'm one of the many who run my own email infrastructure and it is very little work. Nearly none, really, aside from initial setup.

However, I don't run it from home over residential ISP connection.
>“After everything I’ve been put through, I am still a huge believer in Tesla, Elon Musk and electric cars,” Roman told CNBC. “I hope my story reaches the powers that be at Tesla and they make necessary changes so this does not happen to their future clients

...why? I never get people who say stuff like this after being fucked over, over the course of multiple years no less
Right, that's also roughly what I default to (because Platonism seems to have more unnecessary complexity/hypotheses). The actual nature/ontology of abstractions isn't entirely (or at all) solved by that (e.g. https://plato.stanford.edu/entries/abstract-objects/).
I agree to the other comment, that there should be some controls or at least a documented release process to prevent changes to prod without a review.

I must say, that I don‘t fully get that example with the prod account. Sounds like it is a larger place where the ‚ticket‘ went to some other team to e.g. change some configuration of the prod stage. If we‘re talking about changes to the code, there should be code reviews from which you get feedback and can learn from it.

Overall, there seems to be a lack of well-defined processes and basic documentation and little awareness for onboarding tasks.

Even if no one had done some of the things you were tasked to do before - could you have asked the other devs how they would approach the task? Are there some dailies in which you can describe what you‘re doing and get feedback from the team?

Going forward, maybe try and identify one of the more experienced devs to build a more trusted relationship and try to get answers to your open ‚basic‘ questions from them. If you‘re afraid of annoying that person, rather batch a few questions and ask them in one session than asking small questions all the time, I‘d say. Depending on how well that goes, you might go further and tell them about your situation as you did here.

Since there doesn‘t seem to be documentation of e.g. the release process, you could write some and get a review for it, saying that you‘d like to prevent similar mistakes in the future.

Finally, if you don‘t find a way within the current team and you start every day in agony, find a new place and prioritize one which feels like it has a more welcoming culture.
To be fair, less entropy means those floppies will last longer - so the heat death should marginally raise the their expected lifetime.
Fietsdock – Fast and safe bicycle parking
Gosh the wysiwyg editor is so, so, so bad. I still can’t believe it’s so bad.
I think it’s a decent enough balance for most people.

It’s still something you know plus something you have. If your credentials are somehow intercepted, you’re still covered.

Presumably it only falls down in the event your machine is fully compromised at which point you have bigger things to worry about.

With that said, it’s worth having separate 2FA setup on your actual password manager.
Show HN: I made an emoji URL shortener
If Microsoft was developing Office today as a greenfield app, it would surely be Electron based.
Years ago I had a Doberman / German Shepard mix that I paid $25 for at the San Jose flea market. An incredibly smart dog that never pooped or peed in the house, even as a puppy. She would just wake me up in the morning when she had to go.
Holy... completely with a "habitat" bullshit.

> expected to cost $546 million and be completed in 2026.

> Construction is expected to create 2500 additional jobs and generate $1 billion dollars in revenue annually.
I’m not as convinced that “coherent” or “more connected to reality” will be how the value of mass market content will be measured in the future, which makes some of these issues less of a problem for the content generator.
> slient most

silent majority?
Ask HN: What is the best or your go-to TOTP/2FA Standalone Open Source App?
The Backdoor That Keeps Russian Oil Flowing into Europe
They exist in the platonic world, and we access them. That's what neo-platonism in Philosophy of Mathematics is about.
The whole thing you know. / thing you have is very outdated thinking. It made sense as a way to explain it 20+ years ago when 2fa was primarily done with physical RSA fobs, but it makes no sense in the modern world of TOTP, password managers, etc.

For one thing, TOTP any it’s nature isn’t tied to a thing I have. Heck - you could build a TOTP token web service accessible from anywhere, it’s just an algorithm.

Secondly, if you’re using a password manager, you likely don’t know the password, so that part doesn’t fit either.

And if you insist on still fitting that square peg into todays round hole: The thing I know is my password managers’ decryption key, and the thing I have is my laptop / iPhone.
My experience is very similar, but I can believe that write-only or even single-read scenario could extend the expected lifetime to said years.
andOTP on Android and pass otp plugin on laptop.
Where exactly are people supposed to store their recovery keys? I get that theoretically it’s supposed to be cold storage.

Suppose you’re actually targeted by government, and you want to protect access you only have two possibilities.

Store it in encrypted cold storage that people that are targeting you have access to or forget them altogether and lose access yourself.

I feel like people have forgetting what is actually being protected from.

Most MFA apps on iOS either store the keys in iCloud Keychain or some some third party sync service or not at all when your phone breaks.

I think the threat model isn’t well thought through at all.

An offline encrypted keystore doesn’t in fact have a worse security characteristic than most options listed above.

And yes theoretically an hsm is better but realistically speaking I think a physical key that I carry around every day isn’t almighty either.
You are definitely right, I have added them to the readme
It does make you question what type of person is fascinated with murder so much that they lie and fantasize about it.
Designer Creates Solar Desalination Skylight Produces Drinking Water
Electric car charging points hacked to show porn in Isle of Wight
Disabling that is a checkbox away in the settings. Coincidentally, I really like the glide effect and wish it existed on macOS.
So do they actually provide the newest hottest proof-of-writing even? Otherwise they’re just plain scam!
Being 'taught' or following tutorials, working on what your manager was told is important for $$$ are all the death of joy.

The excitement you hear about comes from personal discovery around things of interest to you (possibly only to you) and the feeling that you really understand something not widely known, so that you could bring it out and use it for something.

Even esoteric cases are all connected to a single underlying reality underneath, as you improve and gain understanding by your own hands pieces of what underpins everything, you will find unexpected connections even in your mundane work-stuff.
"Filter artisans" I suppose.

It is impossible to tell how many times I tried to filter out something in Jira only to have everything since before the times or absolutely nothing and needed to scratch that and go back to the defaults. Or hunt down the email with an exact link to the issue.
There is a completeness, character, and story to an album that you don't get from disparate singles. It's a shame and I feel like it takes a lot out of music just bashing out occasionally "one size fits all" singles, especially in the mainstream/pop sphere.
It sounds to me like you landed into a team that wasn't prepared to train you. A junior dev is often a great opportunity for some seniors to take on a role as a mentor and stay active as a developer as opposed to a manager, but a new team member always puts pressure on a team temporarily, and new juniors require more attention than seniors.

This requires motivation, capability, and opportunity from the team members. Maybe no one cared, maybe no one was capable to, maybe no one had time.

You should have received more active immersion from your team from the beginning. Since they let you down, you still need it. If they seem unwilling to admit that maybe they are partially responsible for you still needing help, you might be better looking for a new team that sees collaboration as a two way street. I think you should be seeking mentorship.
You have great self awareness and identified what you can do to improve (raise things sooner if stuck, ask more questions). But it sounds you are just not in a team that will set you up for success even if you do it. They seem to assign tasks well beyond your comfort zone, they don’t mentor you, they don’t have guard rails, I am guessing they don’t have infrastructure as code / mature ci/cd or branch protection policies if a junior dev can break production. As others said, if you can find another team, I would do it.
Another example of an overpriced cloud service when a faster and cheaper solution is right in your CLI in the form of /dev/null which provides an equivalent service without the network latency and the bills!
It’s definitely not easy early on in your career or even later not knowing what you don’t know.

My initial recommendation would be to reach out and ask to pair program on either your tickets or your teammates.

Another things that’s helped me personally is writing down steps for processes for non trivial things and referring to it when the task comes up. You could also keep a high level log of the things you’ve done and how you did them so if it comes up again you’ll have some context to refer to.

As far as the production issue it seems like your team doesn’t have a good process in place or documentation so I wouldn’t put the blame on you. It’s the whole teams fault when something like this happens. And it’s a shared responsibility to prevent others from going through the same thing in the future.

You have the right attitude and intentions, Hang in there and you got this! Whether it’s with this team or another.
Privacy Problems in the Genetic Testing Industry
> I feel that for this to be a surprising revaluation to someone seems to me to indicate a lingering of the archaic notion that god created man in his image, and therefore man was different from beast.

I think a more interesting take on the article is that dogs do NOT process woofs like we, and they, process human language. It seems to suggest that there is a qualitative difference between speaking and barking, and also (as stated in the article) that dogs picked up a new set of language skills only by listening to us, which is super cool and in a way the most dog-like thing possible. In that sense I'd say that human and beast are proven different by the experiment.
The "New GitHub Issues" (beta) is very actively being worked on, with monthly feature updates and blog articles and everything. Highly recommend to try the beta.

https://github.com/features/issues
Fwiw it's great that you're seeking other perspectives and I don't think those errors were on you at all. Agree with a lot of what everyone is saying in general. Sounds like bad systems and bad culture. That being said keep working on yourself and learning. I would also recommend reading books like the effective engineer and following software engineers on twitter like Gergely Orosz. The more experience you get and the more you talk to experienced engineers the better things will get.
Eastern Europe is the one being attacked. Not India.

It’s pretty obvious that the 2 would have different responses.

Also, if dependence is irrelevant, then why is the EU a continuing to buy Russian gas? To the tune of $35bn since Russia invaded Ukraine, compared to the $1bn they’ve given Ukraine?

I don’t blame them for it. I can understand that it’s pretty much impossible to unravel those decades of dependence in months, and trying to do that immediately will likely be counterproductive.

And India recognizes the same about its own Russian policy. They know they need to move away, but they also recognize the dangers of doing so in a thoughtless and rushed manner.

Further, unlike your conveniently specific black and white thinking, other countries like those in the EU (which haven’t said anything to India), the US (which has tried diplomatic persuasion but has not threatened any negative consequences), Australia, Japan, etc, all understand where India is coming from. And even though it is their duty to at least try to persuade India to shift its stance, they know it’s not gonna happen and understand why it won’t happen at such short notice, which is why they’ve been neutral to supportive.
One use case for password managers is account sharing among multiple people. Password managers make more money if they support that use case, which provides legitimate value in companies and families
I agree.

I use password manager for passwords.

Use my phone for lower security TOTP codes, and a hardware key for things I was slightly more secure.
This suddenly reminded me of the floppy-disk raid: https://web.archive.org/web/20080117032102/http://phoenix.cc...

You've got to wonder how it would work if taken to the extreme: rack after rack of floppy drives filling an entire data centre providing a glacially-slow S3 service.

Can you imagine the noise? It would be... glorious.

The linked article used these compact drives: https://www.amazon.com/External-Floppy-1-44MB-FDUSB-M-V1/dp/...

They're 5.75 x 4.25 x 0.75 inches. So if you mount them vertically like in high-density storage arrays, you can fit 25 of them into the width of a rack, about 7 rows from the front to back. So... about 175 per layer that is about 4 RU high including the space for the controller board. You can fit 10 of these layers in a standard rack, for 1,750 floppy drives total per rack.

Let's see... that's 2.52 GB per rack! Seek times are variable depending on the floppy drive model, but 250 ms is approximately correct for the average. So about 7,000 IOPS total per rack. Not too shabby!

A decent sized data centre might have 1,000 racks. So a "cloud-scale" floppy drive object storage system might have 2.52 TB of raw storage. However, you have to divide that by three for the redundant copies, so we're back to 840 GB of usable storage capacity per floor, but with an impressive 7M IOPS.

To put things in perspective, that's directly equivalent to a single modern laptop SSD drive in terms of both capacity and IOPS. Except that the latency of the SSD is 5000x lower.
Lets see who’ll have the last laugh! (Full disclosure: an early backer of S4)
“ Should I be writing reminders to myself to always double check everything? Should I write down the steps to every process?”

This sounds like it’s your first job so people should be forgiving and helpful. If you are at big corp (since you mention PIP) then why isn’t there a better onboarding?

Anyway yes you should probably be writing more stuff down. A lot of what you’re learning isn’t taught in class which is the processes and dynamics of the actual team and company.

So a lot it would be new and an adjustment period, not only to the job but work life in general. Adjustment to my first job was hard. Being in the same work space for a full work day was difficult when friends were just studying. Interacting with people twice my age. Being the youngest person in the office.

With this new environment comes new difficulties so what comes as common knowledge or second nature to experienced employees can be confusing or hard to grasp for first timers. Having said that, not grasping this or acting forgetful or needing something to be explained multiple times can come across as incompetent or often rude. When that’s happened to me in the past it’s given me the impression of “this person clearly does not give a shit or is stupid because this is the 5th time I’m explaining it”.

So yes I recommend taking good notes.

Other strange flags is your Manager being away for so long. This whole post reads as things you should bring up with your manager. Not having a manager around since December may even be something you want to bring up to HR so you transfer teams.
The names of foods are often... merely suggestive of there culinary use and fairly divorced from their scientific taxonomy. Consider that most of the "nuts" in a container of mixed nuts... aren't nuts.
I've spent a lot of time in both the registry and config files. The big advantage of config files over the registry is you get encapsulation for free with config files. With the registry the system, apps, hardware, etc. are free to (and do) spew their config entries across the universe. Searching for a magic registry key in HKLM or HKCU is a special kind of awful I don't care to revisit.
I keep TOTP separate on my phone. Password database will be decrypted in memory after it's unlocked and can be dumped with sufficient privileges.

You could argue that an attacker with access to copy the password DB can intercept OTP as they are entered, but that seems much more work than running off with everything at once.
IIRC one of the reasons why Tesla/SpaceX are so successful is that they give a lot of voice to the engineers that really work on the products.
> What if someday the content generated by ai is actually more useful/higher quality than the human generated content

Mission. Fucking. Accomplished.

https://xkcd.com/810/
Your laptop is a second factor device. You don’t need to reach for your phone to log into anything with 2FA. Use a program on your laptop so you can get a TOTP code with a keystroke.
Not if you’re open about withholding it. That”s the approach we’ve taken.
The assumption is that your password manager is only accessible on physical devices that you have authorized. The stored data is encrypted and will only decrypt upon being authenticated by whatever means you have setup (i.e. password, fingerprint, face id, etc.). The only way for a potential attacker to utilize an OTP generated by your password manager would be to somehow gain control of the physical devices where the password manager is installed and authenticate themselves as you.

As I understand, preventing such a scenario is not the purpose of MFA. Rather, it is to prevent the scenario where an attacker either attempts to brute-force guess your password to a particular application (or figures it out in some other way) and now is blocked by the inability to get passed the "enter the OTP code from your authenticator app" question.

---

The scenario that you ask about is a valid concern. It is just not the same concern as what is solved by OTP/MFA.

One area where the notion of separation of keys makes more sense is cryptocurrency, where if you have any serious investment in it, it is advised to set up a multi-key scheme. In such a case, even if somebody were to be forcefully required to allow a physical attacker to gain access to their password manager, there would still not be enough information there for the attacker to steal anything.
Not to mention their own version of “not quite markdown” markdown. It infuriates me to try and format text in any atlassian product because of that. I don’t know a single technical non manager person who enjoys or likes atlassian anything.
Regd, India buying oil from Russia, while I personally disagree with the decision and think it’s ridiculously short sighted (the long term value of the lost goodwill by doing this will be orders of magnitude greater than any money saved by buying Russian oil), to put it simply, there are no sanctions on Russian oil.

There is absolutely no reason India shouldn’t buy Russian oil. Especially when the EU continues to do so.

The only country that has any standing complaining about Indian purchases of Russian oil is the US. And they haven’t complained about it because they recognize the hypocrisy of criticizing India buying a few millions worth of oil while not saying anything to Europe buying a few billions worth of oil.