skysight-inc/HackerNews huggingface dataset:
> "Don't put the app inside Docker", when that's the whole point of Docker.

I'm afraid you misread the article. The article mentions that the whole point of a Docker image is to deploy the application, but it "shouldn’t include the actual application code itself". The article is focused on local deployments to test and debug code.

The whole point is that the Docker image has everything to run the app, but instead of being forced to rebuild a Docker image every time you touch a source file, you just mount your local workspace and run whatever you wish to run without wasting time rebuilding anything.
Elon Musk Hates Ads. Twitter Needs Them. That May Be a Problem
The joke all were thinking, but were afraid to type out. Kudos!
Ask HN: What have you been playing lately?
I'm just celebrating a successful deployment of something I've wanted for a long time. It's already being effective and it's not even rolled out yet.
Point-Shoot-Operate, this is the same method we use when operating submarine nuclear power plants. Years later I still do it when doing anything hazardous.
Why would it be x86? The OS isn't the holdout there. Android even supports x86.
Can they say how many of those deaths were FROM covid or even WITH covid versus those caused by pandemic response?
Hm. This means that any domain name registered for a friend, client, project, etc. must be registered indefinitely IF a domain email address was used (and said email address is deemed to be "important").

Feels like there is a product offering here...
The goal here is wireless, a single thinner cable would be better but it's better to not have to worry about wires at all. And I'm not willing to set up a facebook account just for a Quest.

The Vive Wireless Adapter (VWA) is a PCIe card (single slot/low profile/mitx length). The output from the card is an SMA connector with a RF signal that goes to the antenna, max official length is 2 meters (and it isn't another SMA on the other end, it's hardwired into the antenna, so you have to use an extension, meaning multiple SMA connectors in the middle). I've seen people use some fairly long extension cables, but that attenuates the signal somewhat. It's probably fine but it's undesirable.

There are USB wireless adapters (TPLink makes one iirc) but generally they are agreed to be an inferior solution in various respects - higher CPU usage, higher latency, worse signal quality, a green bar on the top, etc. This is basically an ideal use-case for WiGig, it was literally designed to be a wireless display transmitter, and that's what the Vive Wireless Adapter uses inside, it's actually an off-the-shelf Intel WiGig card. The TPCast uses a much lower-bandwidth solution and compresses it much harder and that requires more latency, more oomph on the PC, and still gets a worse signal quality.

But, the WiGig card only has a short cable to the antenna. Solution: put the card in an enclosure and mount the enclosure on the wall, run the cables to the PC. Problem: thunderbolt also only runs 2 meters. Solution: optical thunderbolt cables. The rest is solvable from there.

The other reason I haven't raced into it is that HTC hasn't kept it up with the newer hardware. The Vive Pro has a higher-res screen and the VWA can only run at (iirc) 3/4ths resolution. It's still a better screen, there's less Screen Door Effect, but when you're talking about dropping around $1000 to get wireless working flawlessly and tucked away into the walls, it better be fucking flawless. On paper the WiGig actually has three channels and should be able to send on all three at once, but this doesn't seem to be implemented...

Honestly the TPCast is probably a 90% solution, it probably chokes on the Vive Pro as well but maybe for $200 instead of $1000 that's acceptable. But it's tough for me to accept "good enough" when there's a technically better solution. The VWA is an absolutely ideal solution here. At one point there were some updates pushed that looks like Valve was working on it, but (with apologies to South Park)... in typical Valve fashion, "they just sort of got high, and wandered off..."

And then, the Index is just an all-around better headset... but it doesn't have a wireless solution at all right now (apart from maybe the TPCast?). It kinda sucks, drives me up the wall that there's no "perfect answer" here. Every solution has some large downsides.
Chart omits liquified anhydrous ammonia. Its volumetric energy density is about half of diesel's, with a somewhat better mass energy density. You need bigger tanks that can hold back a bit of pressure, and new plumbing disinclined to corrosion.

It also omits liquified hydrogen, which is inconvenient to handle, but not much moreso than liquified methane.
This was my first computer:

https://en.wikipedia.org/wiki/TI-99/4A

You had to use Hex to make sprites. It didn't have peek or poke so I was so jealous of the Vic-20 and Commodore 64. I recorded my programs on a tape player.

This is the computer I rented time at the library on:

https://en.wikipedia.org/wiki/Apple_IIe

They had a TSR-80 Model III at school I got to play:

https://en.wikipedia.org/wiki/Voodoo_Castle

https://en.wikipedia.org/wiki/The_Oregon_Trail_(series)
No, each registration generates a new key pair; but maybe:

> The signature counter is a strictly monotonic counter and the intent is that a relying party can record the values and so notice if a private key has been duplicated, as the strictly-monotonic property will eventually be violated if multiple, independent copies of the key are used.

> There are numerous problems with this, however. Firstly, recall that CTAP1 tokens have very little state in order to keep costs down. Because of that, all tokens that I’m aware of have a single, global counter shared by all keys created by the device. [...] This means that the value and growth rate of the counter is a trackable signal that’s transmitted to all sites that the token is used to login with.

http://www.imperialviolet.org/2018/03/27/webauthn.html
You'll need to generate the key on a less secure host to do that, though, which partially defeats the purpose of a hardware key in the first place.

As far as I understand, "real" HSMs (i.e. the expensive, rack sized type of security key) sometimes offer the ability to export their root key to other models by the same manufacturer using a specific ceremony.

Arguably this also significantly weakens the security of the keys protected in the HSM, but at least it does not automatically expose it to software.
https://en.wikipedia.org/wiki/Decline_in_insect_populations

There are a lot of very plausible explanations to work through before you have to consider something exotic like EM sensitivity.
Are there any additional issues with CSRF? I assume if websites are already protected against CSRF then there are no problems and if they don't have CSRF protection then they already have a problem they need to fix.
Love the Shop app. But one major compliant is that there is no email verification. So I get notified of every order that accidentally used my email address (common Indian name @ gmail.com). Wish I could only be notified of orders that I placed.
It made more sense to me for using a PiHole on my phone. I didn't want to expose a VPN port on my home network, and didn't want to deal with trying to tunnel VPN through SSH.

And the EC2 instance I installed it on was already being used for other toy projects, so it's not like it cost me anything. The additional egress bandwidth is likely fractions of a penny.
receiving synced key material in RAM significantly alters the threat model. Apple's current passkey implementation does not, at any point, handle unwrapped key material in the operating system. I expect all other implementations to follow.
Boeing Plans to Move Headquarters to Arlington, VA., From Chicago
What if the friendship ends!!
Could you say a bit more about this?
On Repl-Driven Programming (2020)
And no visible drunkard! Take heed, Yorkshire!
Informally, Google, Alexa, and Siri, so collectively GAS.
You can see the source directly, rather than the article [1].

The gist of the misunderstanding is that there are many more things that register as "expenses" when calculating net loss without burning your cash pile. Stock compensation just happens to be the biggest one.

They had $10.21mm in revenue in 2013 and $3.82mm in 2012. [page 4]

$9.94mm net cash used in 2013. $3.5mm in 2012. [page 6]

[1]: http://web.archive.org/web/20141031201145/http://investor.fb...
Yeah I've been thinking about that too. Something I've been wondering about is tying things to the ACL file through something like "capabilities"[1], but this would probably require a fair bit of per-service hacking. I think it'd be worth it, but it would be a lot of work. The main problem here is that Tailscale ACLs only really have "can connect to port" as the main capability they provide. I think I could end up telling the nginx-auth proxy if the person is a network admin or not (I'm not sure if that capability reliably shows up in whois responses, will need to check), that may be a starting point but it certainly won't scale.

[1]: https://github.com/tailscale/tailscale/issues/4217
"Routing everything through your laptop" is not how Tailscale works. I'm not sure where your understanding has gone wrong so I can't really be more helpful.
I understand this quite well, I've felt this myself in the past too, that feeling of being "not in the club". Thanks for your explanation. One does get over it, and one also learns eventually that it's something not restricted to race / sexual orientation etc., it can be similar just with a group of people from a certain neighbourhood etc. But having it be based on race can be hard for a kid in the "out" group. How to deal with that, basically, to learn to let it roll off your shoulders, to learn how to navigate your own position in a group, is a lesson to be learned, sometimes not easy to get the intricate ins and outs of how to behave. I completely get it.
On Deck cuts 25% of staff, scales back accelerator
Knowledge is like a house of cards
Depending on how it's implemented it could still use the same mechanism, couldn't it? (genuine question)

For me the question is if this is a webauthn thing in general or a security key thing (to include the domain in the challenge to prevent phishing)
As mentioned in the article, this technique is used in New York City's subways, too. I have a lot of problems with the MTA, but they're still stellar by American standards.
It's because of those pesky tests. If they stopped testing, no one would have it.
It's easy: generate high-entropy passwords automatically; don't let the users set their own.
> Since there is nothing genetic about fingerprints

While it's true that even identical twins don't have the same fingerprints [1], it's not true that there are no genetic factors in the general shape of fingerprints [2]. I agree that it's unacceptable if a fingerprint reader isn't good enough to distinguish identical twins based on the differences in fingerprints though, as those should be the most similar fingerprints possible, essentially setting a floor on the minimum uniqueness in the problem.

It seems like they would use identical twin derived validation data sets to ensure this.

1. https://www.nytimes.com/2004/11/02/health/the-claim-identica...

2. https://www.mcgill.ca/oss/article/did-you-know/you-inherit-p...
This was from a recent conversation I had in the world. In Canada, by someone I later discovered was regularly posting rants and shaming people and businesses on Instagram. They essentially accused me of drawing from hypothetical strawmen to paint myself as a victim, but all I said was (it's important that I said this after saying this is outdoor public space is basically a safe space from discrimination) "If a white straight man harassed or attacked someone because they're X, that's not ok, and they won't be welcome to stay. Do you think it would be ok if someone did the same, but they happened to be Y attacking someone because they're white or a man?" and they dodged the question, which to me justifies the question in the first place. I don't feel unsafe as whatever I am, and nobody should be made to. Seems like a pretty liberal viewpoint.

I'm sick of people getting sucked into right wing YouTube and then trying to rope me into the most boring imaginable anti-cancel-culture shit on one side, and I'm also sick of the surprising reality of what they're pissed about actually sometimes happening, possibly as a result of both groups' own polarization. Not a lot, but enough to vibe me out from being around them, not remotely enough to be prejudiced against any particular identity. It just happens sometimes, it's a form of social grandstanding, and it's very tiresome.
https://en.wikipedia.org/wiki/Pointing_and_calling

It's mentioned in the article, but NYC subway conductors do this too. There's a black and white striped board that indicates where the conductor's window should line up on the platform and they always point to it when stopping at a station.
You didn’t. Don’t worry, I can spot an advanced persistent troll when I see one. You still have a little 8kun on you that you forgot to shake off before you rolled that HN account. You’re not that good, either, because really I left that comment partially to smoke out that you’re refreshing old threads constantly just wanting your opinion to be loved. Satisfying to be right.

That’s why I talked past you. You’re irrelevant and transparent in your motivations, and a smarter site would have already flagged you for stirring a political flame war and stoking racial and socioeconomic divisions with nothing clever or unique to add to it. I read the troll right away. (Tip: You’ve encountered a better one, as evidenced by your comment.)

How precious, you lived in Europe for four years and run your mouth like an enlightened world traveler. You made sure everyone knows that, too, like it’s some kind of mark on your resume and somehow dismisses your arrogant American perspective of explaining the world to the world. Meanwhile, some of us got out of Soviet Hungary and have been to more countries than you have states, and still believe the world can be better. Crazy, I know. Hard to understand from the keyboard cavalry.
Honestly wasn’t very difficult to outbid them based on salaries I’ve seen.
If you use the same public keypair across many unrelated sites, an observer could blah blah blah
> There isn't be a need for a phone.

You might need an "EDIT3", I'm afraid, because "isn't be" doesn't make that sentence much more clear.
Cryptographically speaking it's signing a challenge, not encrypting a value (which would be a public key operation), but generally speaking yes, that's the idea of it!

One of the things FIDO adds beyond a protocol for "plain" hardware-generated and stored keys is the idea of attestation, i.e. authenticators being able to express statements like "keys can never leave this authenticator" or "this key requires PIN or fingerprint verification" – all assuming you do trust the manufacturer.
anyone not using focus follows mouse is living in the past!
Ugg, I hate that. On Mac OS as well. Windows 8 had something like a 10px border that looked great. Tried to do the same on linux - modify some defaults - and it worked for a while until... it stopped working and I haven't been able to fix it.

But seriously - just make that configurable! Then everybody can be happy with their own settings. But no.... the new hotness is no usability for anybody.
I completely agree. I have used macOS since 2007 and the only thing I have really used as an extension is Alfred in place of Spotlight (although nowadays I am just using Spotlight). I am very happy with the UI as it is (on Linux I used everything from WindowMaker, KDE, GNOME, to tiling window managers).

Also I have many friends and family members who use macOS and I think none of them have third-party programs installed to modify the UI. So, you won't see them posting here about the extensions that they use.
Ah, my mistake.

I do traffic mostly in compiled languages. But for many dynamic language apps, excluding the source code is not an option.

In terms of skipping image rebuilding for local development, just run the app locally without Docker. That important option should always be available to the developer.
Your pushing it a bit too far if you say that JIT is interpreted.

To answer OP, if you replace "dynamic" by "untyped", Forth qualifies. And it actually can go where there's no JIT to save your A from the "just throw more hardware (and software) at the problem" mindset.
Who would be cruel enough to expose the masses to OCaml?
I heard of this technique, but unfortunately I don't see how it can be easily applied in software engineering/devops.

Also, I now realized that aviation checklists seem to tend to be done similarly with gestures - at least from what I saw on YouTube, not sure if that's representative or only used during education (?)
Maybe in the far future, but in the near- and medium- term the same backwards compatibility that you believe (a little unfairly, I think) has hobbled Javascript will keep it dominant. If existing web applications can't be bothered to update to support ES6 or Typescript, what will make them rewrite in Web Assembly? New applications will, maybe, but it's a very, very slow change, with so many opportunities for new events to change the conclusion.
Stanley Parable Ultra Deluxe

Grim Fandango

The LOUD mod

Halo Spartan Assault + Strike

I keep a blog about the stuff I've been playing: https://theandrewbailey.com/index/Gaming/
This isn’t as much of a gotcha as you think. Python is slow because the language is so dynamic and simply has to do more behind the scenes work on each line. It’s not impressive that a language that does less is faster. What’s impressive is that a language that does more, like JS on V8, is faster.
> For example: the military industrial complex commands huge budgets despite having produced nothing of value for the last 50 years.

I think some Ukrainians using javelin anti tank missiles would like to have a word with you…
I use computers for media production, Chrome, and VS Code. Considering macOS is a Unix with a UX that is more or less targeted to creative types, it means that I don’t have to do anything other than installing a few apps and homebrew to get a system that does 99.9% of what I want. macOS then becomes a mouse cursor and a few touchpad gestures. The UX customizations I configure are in the programs I use, not the OS. macOS’s UI therefore provides the least friction.
on a lark I compared it to "dogecoin", the results surprised me https://trends.google.com/trends/explore?date=today%205-y&ge...
more like 2 years

they do know about it (I had a friend who was a PM there), but it's low priority...
I have no idea to be honest. I'd assume CSRF protection is kind of a mandatory part of the internet at this point.
now some apps grab keys from the browser like "control-F" won't give me a native search modal dialog - instead providing their own search widget. Things like this break experience of the web for me. Combine that with tridactyl which i prefer to use to navigate around and it's even worse.

My addon list isnt that big either... it's just that I disable a lot of things as well, like webGL and other stuff. Suprising number of sites needlessly use these things.
AMC Order Confirmation Pages Are Indexed by Google, Exposing Sensitive Info
Proprietary, and it was 20 years ago, I don't remember what the tool was anymore. I doubt it is still available.
"Let me stay on point ... by straying off point"

Sorry you couldn't stick with it.
The names for the various bit rates vary between authors and standards.

I believe that the least confusing names would be:

Data bit rate = the rate at which the data bits provided by the user are sent

Signaling bit rate = the rate at which bits are sent over the physical communication medium

The 2 rates are not the same because the user data bits are encoded in some way before being sent. The signaling bit rate does not have any importance, except for those who design communication equipment. For the users of some communication equipment, only the data bit rate matters.

The data bit rate is equal to the signaling bit rate multiplied by the ratio between data bits and the corresponding encoded bits.

For example, for USB 3.0 (single link Gen 1):

Signaling bit rate = 5 Gb/s

Data bit rate = (5 * 8 / 10) Gb/s = 4 Gb/s

Data byte rate = (4 / 8) GB/s = 500 MB/s = 477 MiB/s

5 Gb/s corresponds to 625 MB/s, but for a signaling bit rate it is completely useless to convert bits to bytes, because groups of 8 bits on the physical communication medium do not normally correspond to bytes from the data provided by the user. Only for the data bit rate it is meaningful to be converted to a data byte rate.

For USB 3.1 (single link Gen 2):

Signaling bit rate = 10 Gb/s

Data bit rate = (10 * 128 / 132) Gb/s = 9.7 Gb/s

Data byte rate = (9.7 / 8) GB/s = 1212 MB/s = 1156 MiB/s
i cannot find any examples of this kind of port, can you share a link?
How would you add a new key at a later point in time (i.e. after your initial registration of e.g. a main and a backup key, after having lost the main key and wanting to add a new backup/main key)?

The FIDO/WebAuthN model does by design not include a stateful/centralized authority that could maintain the required state for any such solution.
The answer is that people confuse operating system with operating environment.

OSX is a wonderful operating system - which is to say, it’s Unix but I can print things and use WiFi properly. I can edit a pdf, etc.

OSX is, in many ways, an absurd operating environment.

If you need any proof of this, just click the little green dot in the upper left of an open window…
Another one might be "Lord of the Flies", it really has spine chilling moments.
So, apparently, vimeo has better support than youtube (not informative, but at least they DO something). Duly noted.
If you get this working, please do email me at xe at tailscale dot com. I'd love to document this so that other people can benefit from it.
Is there any field or subject where people don't routinely take a dump on each other's work? Or am I just being overseinsitive, too easily vexxed?
Can I use the webauthn API to have the user confirm arbitrary actions or only authenticate? Like, what if I send a different challenge every time?
This has already made HN front page twice: https://hn.algolia.com/?q=https%3A%2F%2Fwww.atlasobscura.com...

Also tosh seems to post many new stories to HN every day. Seems like spam?
The exhaust doesn't have ammonia. The nitrogen really likes to link up, giving up protons to do it. You would be left traces of unburnt hydrogen.
While I'm generally a fan of YubiKeys too, I've had one break without warning. Backups are highly recommended – you can lose them too, after all.
I think most slender 18 year old girls rely on the protection offered by strong (or strongly armed) people regardless of far advanced weapons technology is.
I killed a Yubikey in my pocket (without washing) after four years. Get two and keep the backup safe. https://adam-p.ca/blog/2021/06/backup-yubikey/
For most firms that run web services, developer time (the engineers’ salary) is 10x or 100x the cloud bills.

They'll choose Ruby over C++ any day for purely financial reasons (obviously there are more consideration, but if it had been only about money).
They don't exist yet, not fully. But what you _really_ want to look at right now is WASM as a replacement for Docker.

For example:

https://developer.okta.com/blog/2022/01/28/webassembly-on-ku...

https://training.linuxfoundation.org/blog/how-wasi-makes-con...
I wonder what goes into deciding what to point. For example, if you watch this clip, you can see the conductor doing 300km pointing at different parts... https://youtu.be/lB4_G9l3mdY?t=158

But I can't quite figure out what.
The single threaded leader is multitasking among their various teams!
Amazing work on Caddy!