skysight-inc/HackerNews huggingface dataset:
Has anyone ever told you to shut the fuck up and sit the fuck down? You’re NOT a good moderator despite what people say and this reaction ought to prove it to you. People like you NEVER bother to deal with any reactions other than “I’m great and everyone thinks so!”

I don’t think you’re great. I don’t think you’re doing a good job. At this point I don’t like you.

Serve your masters, servant. You have no morals yourself.
> half a million workers collectively emitted the equivalent of 134,000 tonnes of carbon dioxide in about the first year of the pandemic

So, less than the amount they breathed out?

A typical human exhales about 1kg of CO2 per day, or 365kg per year.

500k of them mean 182,500 tonnes of CO2 per year.
Used to be TV back in the day, no? Not that this isn't happening but bad parenting has been a thing forever going all the way back to prehistory.

As always blaming the medium seems a bit short sighted. Who are the people controlling all these apps and social media sites? They're not run by aliens. And who are the parents letting this happen? There seems to be a much larger problem with society as a whole. The problem isn't the tech, it's how we use it. And if kids are developing more and more mental problems, maybe there's something wrong with the adults and how they run the world those kids are born into. "My child's brain is like a sponge", is what I often hear parents say. Feed them toxicity and that's what you get.
Shifting responsibility to the individuals is not a new strategy.

They may market it like they're concerned but I won't be surprised to see the companies take it to their advantage soon enough.
I use https://rectangleapp.com/pro and really enjoy this app (I paid for it, it gets a lot of updates/fixes).

It mostly takes care of snapping and resizing windows with hot keys, but has a less obvious feature in preferences to use mouse.

My setup is:
CMD+SHIFT will move any window under mouse pointer
CMD+SHIFT+CTRL will resize any window under mouse pointer
I'm not a huge fan of this book, if I get a book like this I'd expect it to focus on the standard library and not third party libraries.

On the other hand it says "real world" OCaml and as far as I can tell that really is how OCaml used so It's hard to blame the author.
Storing your keys in secure hardware on a phone is almost certainly more secure than storing a key in software on your desktop hard drive.

If you don't trust your hardware, it's almost always game over. Desktops have devices running dubious firwmare as well, but at least with a hardware key store, the window of compromise ends at the time you update – a stolen key stays stolen forever.
It fits the narrative of getting employees back into the office; because WFH employees are unproductive, just look at this study.
I'd use it for basic process automation, airtable data IO, triggering marketing campaigns or slack bots, etc.

It's a heavy weight feature request but if I could lean on it in the way I lean on Prefect.io now for spinning up cloud workers on demand I'd use it for a lot more.
Usually it ends up being a phone number or an app (on a phone). The first is to link to govt id and the second is that plus all the spying an app does.
It's intended to be an open-ended question and discussion!
C and Python are not black boxes to each other. The entire python interpreter is literally a C API. You can create pyobjects, add heterogenous PyObjects to PyLists, etc. So evewrything in Python can be introspected from C.

Turned around, Python has arbitrary access into the C programming space (really, the UNIX or Windows process it's running inside), so long as it has access to headers or other type info it can see C with more than black box info.

Most python numerics is implement in numpy; the low levels of numpy are actually (or were) effectively a C API implementing multiple dimension arrays, with a python wrapper.
Correct! Many python users don't know about this and similar libraries that assist with data types. Numpy has several as well.
Games: LotRO, Urban Dead, Pardus, Flare

Music: Random mixes from my ~10000 song library. Or my guitar.
What? No.

I always play on and played on PC.

Something I tried for a while, but it did not stick much mostly due to lack of time (and interest)- emulating old comsoles like Nintendo 3DS on laptop and playing them with a USB controller.

I just wanted to check out the Zelda series. I played one for a while, but the game has glitches.

I will return for more when I have time.
True, but it appears to have been updated last year, I for one wasn't aware of it.
Have you had a look at F#?

It has great GC piggybacking on the huge amount of efforts going into dotnet, each release since dotnet core has just gotten faster and faster, not just GC but many parts of the ecosystem, see e.g. https://devblogs.microsoft.com/dotnet/performance-improvemen...

Pattern matching is first class. See e.g. https://docs.microsoft.com/en-us/dotnet/fsharp/language-refe...

I haven’t programmed with traits, but sounds like interfaces which you can have records implement.
https://gist.github.com/robertpi/2964793

Function signatures are usually not needed due to the type inference algorithm, so while it is statically typed, you often don’t need to write out the types of functions.
Do you have any reference material for this? A quick Google search for "Point-Shoot-Operate" finds nothing. Very fascinating to see this used in the USN!
He's basically paraphrasing Greenspun's Tenth Rule: "Any sufficiently complicated C or Fortran program contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of Common Lisp."

Photon has, by construction, proven that it is possible to define fullstack web UIs as pure functional expressions despite crossing the client/server boundary, and this is done without adding in all that extra "React.js-era web framework stuff" (the travesty being discussed in this larger thread), instead using only the composition semantics of lambda that were established many decades ago. The best explanation of that is this 10 minute talk: https://news.ycombinator.com/item?id=31217448
The downvotes are because it's so incredibly stupid that one must hope it is a trolling attempt, or intended as a deadpan joke of some kind.
Well, for starters folks tend to code expecting 0.1+0.2=0.3, rather than abs(0.3-0.2-0.1) < tolerance_value

Raw floats don't get you there unfortunately.
That is a scenario that is a lot less likely than some service having losing control over your password. If you are concerned about it, you can always write down the password into a physical notebook.
Markdown Notes New Tab
At least it ain't Clojure.
Why not draw.io/diagrams.net? That used SVG which it embeds in pngs so they always render faithfully, and can be edited online, in the desktop app or directly in VS Code via a plugin.

That has dramatically better support.
using it since then, still works fine. And for macos - BetterSnapTool.
IIRC they monitor arrival and departure at various levels and times. Speed levels, braking, location @ time, etc. In the video she says "yosh" / "yoshi" after each which is like "(X) is good"
USB-Cereal – Simple Debugging for USB-C Devices
The standard library is quite small and not very usable for modern production applications. As an example a lot of the list manipulation functions are not tail-recursive because the tail-recursive implementation is less elegant.
Polyphasic Sleep – Steve Pavlina
I tried WebVM but it feels a bit slow. Do you think performance could be improved by supporting native wasm binaries? Something like wasm-*-linux compilation target.
That was a piece of information I missed, then! Definitely a nice usecase to keep in mind.

For me, I'm often either (1) sharing diagrams outside of github (e.g. email), as well as (2) generating a bunch of diagrams based on code or whatever, rather than defining a diagram in a markdown file. There may be better tools for those usecases. Those were what I was trying to do last weekend, too.

But I've definitely passed on adding diagrams to my .md files, or sighed at needing to add yet another imgs/ dir and files to a repo folder. My toolbelt now has another thing hanging off it!
> This does not seem true among my group

Well not true for my "group" either.

Before people in my (erstwhile) small town knew me, like they knew me and I did not knoe them.

Due to my achievements and I frequently posted on FB. I enjoyed recognition.

I abandoned fb, and that "recognition" has went away.
totp on gh doesn't "secure your dependencies" in any meaningful way though. For example npm and rubygems and dockerhub, and pretty much any other library packaging system don't pull code from gh, so the code on gh doesn't need to match the code in the library you are actually installing and running.

git secures itself. You can't "sneak" malicious code into a library if you can log into a dev's gh account. All you can do is add commits. It would be an obvious commit and the dev wouldn't push it to their package host.
It was cruel to expose JS to the masses.
As far as my understanding goes this sealed secret is device specific and connected to the TPM master key. That would mean you could pass it around, but you'd need to have the blob on the device itself to actually use it.

The problem is that you need private/public key pairs that are synchronised across devices for FIDO to work properly cross-device. When you register an account on your phone, you need that account key on your desktop to use it there, and that's nearly impossible without some kind of key sharing mechanism.
Shopify has been around for a while—since before Amazon became the everything-retailer that they are now. It started out of frustration at the myriad annoyances in trying to get set up using osCommerce and other tools of that generation.

(Disclaimer: employee)
The systemic repression of non-white-males for many, many decades/centuries?
I didn’t realize there’s a pro version so thank you for posting this. I’m going to give it a try and will pay happily if it improves my workflow.
He know's about the [spice melange](https://youtu.be/pEQREIDUJ88)
That's an interesting issue, thanks for linking. I could see something like this working well:

location /auth {
...
proxy_set_header X-Required-Caps $required_caps;
...
}

location /grafana {
...
set $required_caps "grafana.com/read,grafana.com/write"
auth_request_set $auth_caps $upstream_http_tailscale_caps;
proxy_set_header X-Webauth-Caps $auth_caps;
...
}

I.e. pass the caps through an nginx variable up to the `/auth` location, then out to `nginx-auth`, then nginx-auth passes all(?) of the user's caps to the upstream.
Seeing that they raised $500M in 5 rounds, they were probably just paying the difference themselves, there never was real parity

The fact they were bought for the same value as their series E valuation 6 months ago also doesn't say good things about their cash flow. Imagine every new employee these past 6 months just got $0 profit from their options/RSUs (assuming there was some double trigger)
This video is a good explainer: https://www.youtube.com/watch?v=2qanMpnYsjk
- postfix/dovecot

- matrix

- nextcloud

everything a family needs.
As much as I might like features of smartwatches, my favorite watch is a skeleton style mechanical watch my grandparents bought for me a number of years ago. Watching the teeny tiny gears moving around is somewhat cathartic.
Sorry not a web dev or programmer, didn't realize that! Well then, that would be cool to enable.
OTOH, the way to increase its profit is to add features, not take them away: If it gets out of your way when you're trying to check the agenda for your PTA meeting, and shows you a clean photo album of your family reunion, there's nowhere to slip in sponsored posts or ads.
This might be true for cryptocurrency transaction initiation, but in the WebAuthN model, what's the benefit of having a screen?

The result of a WebAuthN challenge procedure is almost always a session cookie (TLS channel binding if you're really fancy), so the only thing that an authenticator could display on your screen is "do you want to authenticate as user x to website y", which arguably does not add that much value.
SMS should not be considered a 2fa, TOTP or a youbikey is the minimum that you should be able to advertise as 2fa.
Show me a TOTP implementation that doesn’t require a phone number to sign up for or initialize…

IME, they not only require a phone number at setup but, further, reject VOIP/twilio numbers.

This shows that it’s not at all about security, but about slowing (but not solving) their brutal, unrelenting, spam and sock puppet problems.

EDIT: Thanks - very interesting. I guess I am jaded by my experiences with 'authy' and twilio, etc.
Phel v0.7.0 Release
Stopgap solution until they fix it: change it to name+shopify @ gmail

You might need to make it more unique if someone else had that idea.
Off topic, but the whole "let's just remove the 'e' from a word that ends in 'er'" naming trend needs to die.
Is there a way to list this blacklist? I have several computers which haven't received updates in years and I strongly doubt that the internal blacklist has been updated.
In theory, yes. In CPython, apparently not. In PyPy, yes.[1] PyPy has to do a lot of extra work to permit some unlikely events.

[1] https://carolchen.me/blog/jits-impls/
Yeah, agreed, it's a cool API.
Using Vue is a long way from selling your soul -- if you want to make a bloated monstrosity of a website, you have to do far more than just use Vue.

That said I think it's a pity if a static website doesn't work at all without JavaScript.
The analogy is fun. If you believe something false, everything you build upon it is also questionable (though not necessarily false - it might be true for other reasons).
Personally, I would find it far, far more useful if it maximised the window rather than full-screening it. At the very least, having it configurable would be nice.
The measurement can be influenced by practice. The g factor—the thing IQ tests are designed to measure—appears to be immune to practice, though I am not sure how this was determined.

Similar tests, like the SAT and GRE, are designed to work even with practice. They have other problems.
Cloudflare has an active Discord group where developers share their experiences with the new toys. It's been a great source of fresh intel re Workers for me, and there's an r2 channel as well. Could be worth your time to check it out https://discord.com/invite/cloudflaredev
Peru to close 40 military bases in VRAEM, a.k.a. ‘Peru’s Cocaine Valley’
A few times a team member has tried to get everyone on board with Mermaid.

In the end draw.io/diagrams.net wins out as embeds the diagram in the header of a PNG, so it can be rendered by everything and edited in many ways, including the web, the desktop app or the VS Code plug in.
Also, potato peels are delicious.

I don't peel my potatoes before making mashed potatoes or french fries, and they're tastier for it.
How's that going for JPEG2000? HTTP2? IPv6?

Not saying they don't have adoption, but to this day you are debilitatingly limiting yourself if you ignore the older ones, and their cruft.
This post could be satire, but it sadly isn't
This is a great technique to enhance focus and spot details.
After I read about it the first time I thought that must also work for other things.
Since then, during particularly hard sessions of of debugging or (code) reading, I use it to physically point at code/text. Sometimes with both hands. It forces me to actually pay attention to the thing I point at. In this way it also helps spotting tokens that would otherwise be skipped, like the double "of" in the third sentence of this comment.
Physically following some data, control or logic flow by tracing it out can also help to avoid losing the proverbial "thread".
It's a good psychological operation for anything that requires a bit of extra care. If you're having a stressful day in general it can help to call off your next steps and ensure supportive/guidance structure for your day is available.

(In terms of vehicles, I like to use it when my caffeine is coming up to speed on a long road trip starting in the early am in the desert, when passengers have just fallen back asleep)
It seems like Haskell minus the laziness and enforced purity. So really, far less cruel :)
Ah, sure, if your use case allows registering multiple keys that is indeed a good way to solve it. Unfortunately that's not always the case (as pointed out in other threads).
I think if you are checking the host header on the server there is no problem. But I think if you are not checking the host header then there are some cute DNS rebinding attacks that will let an evil website perform arbitrary actions on behalf of a user if they are tricked into navigating onto the evil website. i've seen this same attack on sites hosted locally where authentication is assumed because only the localhost can connect to the site. DNS rebinding breaks this assumption. i think there is a similar thing going on here.

the good thing is a lot of stuff kind of implicitly checks the host header. like if you are using vhosting (without a default) then you have an implicit host header check even if you didn't set it up explicitly for security.

EDIT: and of course if you are using HTTPS then it should not be an issue because the server will not be able to serve a certificate that matches the hostname.
How is this a win for you? Now you can blindly trust any github account now that they are 2fa to update their dependencies? That assumption doesn't make sense.

First the dependencies don't have to live on github or they could have been added by a non 2fa before this change

This is going to lock many out causing fewer packages to be updated meaning things are less trustworthy on github

People who use 2fa are not related to the same group who updates their dependencies
HN karma farming. It's very addictive.
That is why Chart 3 is especially ironic, it shows productivity recovering before hours worked. (I wouldn't over-interpret this though, I don't know how any of these statistics are calculated.)
I think someone once said dynamic langs must cheat to be performant. Jitted runtimes are just interpreters cheating.
411 submissions in the last 30 days, no kidding!

The posts don't seem excessively low quality at first glance - indeed a lot of the submissions get at least some discussion / votes. But it does seem like the kind of content that's simply copy/pasted from maybe other aggregators, or selected from previously submitted HN content.

The account is 12 years old, so I'd expect it would have been booted by the mods at this point if it was undesirable.

tosh, is your posting automated?
Yes, others can tell bigoted jokes, or joke around in a bigoted manner, where he cannot.
It's always going to be a never ending battle unless you self-host everything. Just gotta go to the best one and be willing to backup and switch services when it gets too bad.
Apple should buy Netflix and combined they should focus on only few, extremely high quality shows.
I just use different accounts for work and private stuff.

For me 2FA is super annoying because I run my browsers in private mode and I restart them multiple times a day, so I have to sign in quite often. It effectively makes it much harder for me to keep my privacy.

Not to mention loosing the freedom to log in to my accounts from everywhere without needing my devices. Things do get stolen/lost/destroyed and that is a more realistic threat for me than getting my password stolen.
If you can phish the pw you can phish the totp. People type it in right after they type in the pw.
> WHILE also saving them money on unemployment insurance payments

In Texas, severance package has no impact on unemployment payments. I was laid off once with 3 months of severance pay and also got full unemployment payments.

In my current tech company, there have been many layoffs, they all usually got 2-6 months of severance.
I operate large chillers and high pressure boilers in two different plants. I started my own point system, as my company doesn't have one. I also count different valves which I have memorized so as to be extra safe. When there's a power failure and I have to bring everything back online, my system is very helpful.
A number of the other comments explain how to configure the UI to allow for similar functionality; e.g… with 3 finger drag.

I found the article to be a little odd… awing at 3rd party apps basically replicating baked in features.

Although to be fair I am super meticulous in going through the accessibility and gesture features to get the UI feel just right for my tastes. MacOS, to me, feels like a clunker out of the box.
> One of Holland’s last projects for Netflix was The Queen’s Gambit, an expensive period piece that sources say was mocked as “Holland’s Folly” by some in-house. According to sources, Bajaria and her staff were dismissive and even unpleasant to the team that worked on it.

What a hellscape to work in. I got on Netflix very briefly, just to watch that show. I can't think of any reason to get back on.
Pulumi looks really promising. Finally we have some real IaC and not some IaData. Good job for what you guys have accomplished so far! Is there any plan to add libs for the Elastic stack?
Conformant is a word you introduced, they didn't say that.
If you're as crazy as I am, it looks like oauthtool+gnupg2 can do TOTP via the command-line on Linux as well. I think it's just another function that my homeserver will take over (or maybe a container). At least I can easily integrate this new info into my backup system, unlike apps on my phone...
> But I'm responding to GP that said biometrics are a username, not a secret, which I agree.

If you were sending an actual copy of your biometric data to the remote authentication service, then maybe you could make that argument.

But that never happens, no FIDO biometric device sends a biometric fingerprint that could be reproduced by a different device. The device authenticates you with biometrics, then uses that data to unlock a private key, which is then used to answer a challenge-response request from the authenticating service.

If you don’t the device, then it’s pretty much impossible for you to correctly answer that challenge-response, despite being in possession of the biometric features that device would use to authenticate you.

So you can’t use your biometrics as a username. Because the device measuring the biometric data pushes that data through a mono-directional, randomly generated (at device manufacture), hash function, that exists within that device only. Take your biometrics else where (I.e same device type/model but different physical object), and you’ll get a different output even with identical inputs. Which would be a pretty useless username.

> I'm not sure something you are counts as a security factor.

You should take that up with NIST then: https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/m...
I wasn't in the room when the decision was made, but my understanding from reading both the Steele Dossier and the published Mueller report is that Mueller drew considerably from the Steele Dossier as a way to understand where to consider targeting the investigation early on, and then expanded elsewhere after they had identified that most of it was not actionable intelligence. Mueller's investigation ultimately resulted in several convictions, so where there is smoke there is fire, but in this case the fire was burning oak wood and the smoke smelled like mesquite.