skysight-inc/HackerNews huggingface dataset:
Counterpoint: Meta is rumored to have 3 or 4 headsets coming down the pipeline for the next 3 years, and those headsets need mass-production research, games, firmware, OSes and more. Yes, it's a lot of money. Once you consider that a lot of it is going to fund game studios and thousands of software engineers, I don't think it's a terribly far-fetched figure.
> I want to avoid having to fetch my backup key every time I want to setup a new account. The backup key is kept offsite and thus inconvenient.

As stated, you can have as many backup keys as you like.

Thus you are not limited to two keys.

Buy one more key. Keep one off-site and two on-prem. Rotate them once in a while to keep the off-site one fresh.
2Fa is an excuse for we want more sales channels.

You can put an auth cookie in a browser and achieve 2FA for 99% of use cases without bothering anyone.

But nobody does that when they can use 2FA as an excuse to force people to install their app or hand over more personal information.

No reason 2FA can't be just two passwords.
That still breaks SafetyNet, because it checks if the bootloader is unlocked, which it has to be to install a custom ROM.
Even native apps are often broken when you enable "large fonts". I've used large fonts since forever and even now are using 1440p on 32" screen (I'm not wearing glasses or anything).
The blog is all but done.

Or, ABD, if you will.
It would need a funny driver and since that stuff is big parallel image processing it's easy in HW but if someone has a netbook or cheap/old Celeron crap it would peg their CPU to do the demosaic and color correction.
Nope, nothing has changed! You can still MITM with BGP in the exact same manner! BGP is like SS7 -- once you get access to use it, it is wide open and completely insecure and no effort has been made to use it. All its security is predicated on the idea that anyone with access will have too much on the line to abuse it, and responsibility for monitoring announcements for your own IP is considered your own problem. Ask around -- how many people in your social circle of admins keep track of rogue announcements? How many would notice if this were going on?

More colocation facilities in the US and Europe now do prefix filtering at egress - but this matters little, as there are still quite enough that don't. In contrast, there's virtually no prefix filtering in Africa or Asia (remember when an accidental BGP announcement from Pakistan killed YouTube worldwide?)
They have 38 million members, $1.7B/year in revenue, offices in 50 states, and ~2200 employees.
Why not just ... print out or write down the backup codes?
Piedmont's gold: Why this Italian chocolate rules
Hired onto a project as a specialist. Funders had hired a project manager also. Project manager wanted to use technology X ( which has long since faded ) instead of well entrenched and dev-hireable technology Y because technology Y had not yet entered the trough of disillusionment and anyone who could honestly say they had managed a technology X project could 10x their hourly. Money was ignorant about this level of detail. PM won, as they do. Whole thing a money pyre.
Yeah, but V8 is Chrome's engine, which _is_ in competition for fastest engine against Safari, Firefox & Edge (although Edge isn't much of a competitor anymore).
> What is SO effing hard about drawing within the screen on web?!

It’s because the web’s layout primitives don’t compose well. There’s no easy way to say “this is a full-width container and nothing inside it can go off screen.” As an obvious example, any descendant of that container can use fixed positioning and do whatever it wants. But there are subtler examples that are easier to fall victim to. The way to fix this is to built your own higher-level layout primitives and have conventions or tooling to enforce that you compose them only in approved ways.
Ask HN: How to emulate 2FA hardware in software?
The threads about FIDO and GitHub requiring 2FA have shown that many people are concerned about various issues with hardware keys. Examples of the concerns are: lack of convenient backup, cloud backup, privacy, centralization, future readiness (if the hardware's support is discontinued), not being open source.

A solution to this would be to emulate the 2FA hardware in software running on the same machine as you're using to log in - so it is not 2FA anymore but 1FA.

It would be at the cost of security, but at the benefit of allowing users to keep doing as they've been with regular passwords.

So what software solutions exist for emulating things like FIDO, WebAuthN, YubiKeys, etc.?
No.

It doesn't help that it struck me as drawn-out and disjointed.

Worse - I never got the sense that the public would much care if the facts that the DMSA is keeping secret could be freely published in Britain. Nor (post-Snowden, and having read about some of America's secret gag orders) that the UK is up to anything all that bad (by the modern-day western world's very low standards).
They still need your password. The SMS alone is insufficient. Supporting SMS as a second factor (whether primary or backup) is perfectly adequate for almost everyone’s threat model, and generally far superior to not supporting it as regards avoiding account lockout. (That’s Fastmail’s position, which I thoroughly agree with.)
But remember that you still don't get security updates to the OEM's proprietary drivers with custom ROMs.
Actually I wanted to point out that there is a pyright LSP server interacting with Monaco that would highlight those kinds of error. It is not that unintentional!
They do private events for your friends you're already connected to well.

However, they don't do social private groups well at all. For them it's all or nothing. Meetup, unfortunately, is still used for that.

They either force you to do all private events or all public and broadcasted events. Theres no way to maintain a community or a LUG on FB.
Thanks, the shift to subscriptions made me skip the remarkable 2. I just need a simple large ereader to read arxiv papers at the park or the beach because the ipad doesn't cut it in the sun. I'm hoping the kobo will do.

I also saw that a new software update made the elipse much more responsive and from a detailed review that i saw it has one of the better eink displays (high refresh rate and no banding)
I assume based on your bio, that your country is the Netherlands? The US is 236x the size of the Netherlands, so you can imagine getting something to a customer in 1-2 days requires a more complex and extensive logistics system.
This is just silly. Teens aren't married. Competition for relationships is absolutely a thing.
[[Zoho mail free for 5 addresses.][https://www.zoho.com/mail/zohomail-pricing.html]]
Setting up the MX records has good tutorials so it all doesn't end up in spam.
also there are wildcards, so that 5th account help@domain.io can receive admin@ service@ boss@ sales@ .. all those.
I suspect as of Big Sur that Apple were intending to release touchscreen Macs, but the changes to the OS in future versions makes me suspect that they then changed their mind.
They do not give a single argument to show why they need to require 2FA, the same way they did not provide an argument for removing git password login. The more they will annoy users the more it will create space for a new service to compete with Github. Thanks Microsoft.

The biggest problem with Github in my opinion, is that personal accounts are usually the same as the one we use in the company we work for. So we are mixing personal and professional security
> Frances Haugen, a former Facebook executive,

Wasn't she just a product manager?
Does this imply that every service you connect to knows your unique identity?
Spending a weekend or two writing a Scheme that beats Python in performance has been a pastime for computer science students for at least a couple decades now. I'm not sure that I believe that a performant Scheme implementation has more complexity than e.g. PyPy. In fact, I'd wager the converse.
Yes, very true. I think sometimes you may have to do extra work like calculating hashes, but that can likely be taken from the B2 response if it's compatible with R2 or calculated beforehand.

Couple that with the low latency KV and it all shouldn't be too hard to get going! On that note, I hope the overall latency of R2 isn't too bad. I assume it'll all work with CF caching though. B2 was never too good in regard to latency.

I wonder... would the TOS allow storing a huge video on B2, proxying it on the fly to R2, redirecting the user to that, then deleting it afterwards? It does say you'd be charged by gb-month stored...
> My argument for why we need the Singe Page Applications(sarcasm inside) [0]

[0] https://williamkennedy.ninja/posts/
>but I actually work with students on a daily basis.

I hate to be the one but what's your sample count? What does, "I actually work with students on a daily basis" mean? Are you a teacher in a high school? University? Do they intern/co-op at your company?

I attend a few schools for part-time things here and there, and I'm exposed to students aged 14-70 regularly. Politics are involved as a means of an identity, even if they realize that they are powerless to do anything.

The lack of critical thinking for any given saucy subject (most recently see Roe vs Wade) means that the opinions people hold are generally prepackaged from whatever sources they obtained them from and are internally congruent† - they know things here and there about a given subject, but externally nonsensical given the situation that the person is in and what they ought to focus their attention/time towards - they are, for lack of a better term, wasting their precious time away getting baited by professional media con people with attention grabbing headlines and memes.

† Best seen in person as a dialogue between two or more people where you're aware that their source material was written by one person in an essay (or a tweet roll) form, but has been changed to be a kind of a ping-ponged conversation where each person takes a turn to continue the over all narrative. (Better put: one big agreeable circle-jerk.)
Okay, subreddit created: https://www.reddit.com/r/encrypted_gb_codes/

I mispelled gh as gb, but that makes it more memorable (Great Britain, world war II spies, the cryptonomicon partially taking place in the UK, easy peasy).

Okay, so where was I? Right, the encrypted backup codes! Here is the code

encrypted = []

secret_key = input('secret key: ')

try:
for index, character in enumerate(input('secret to encrypt: ')):
encrypted.append(ord(character) ^ ord(secret_key[index]))
except IndexError:
print('Your key is not big enough to securely encrypt the secret!')
print('Go play cryptopals to see why using XOR that way would be bad')

print(''.join(hex(i) for i in encrypted))

Aaand the secret is live on reddit. For redundancy I need to plaster this everywhere (hiding it in public key exchanges would also be easy!), but this will do for now:

https://www.reddit.com/r/encrypted_gb_codes/comments/uj1fll/...
What I mean is: with modern hardware keys you literally can't trick a user into approving a remote login, or a login to a fake domain. It's not possible unless you can control the domain that the user is logging into (say you've got code execution on their machine or compromised their network and broken TLS, attacks which are significantly more complex than phishing). Hardware keys enforce that the device can only authenticate against the real domain, not a phishing domain. The core of this is a real improvement of how 2FA works at the protocol layer, rather than simply a change to how the user interacts with the device.

Hardware keys also require that the key can only authenticate a local session, so there's also no risk that your "hardware key tap" can be captured and used by a remote adversary who doesn't control the local computer.
I guess I'm the OP. Sorry my comment didn't help you; please let me know what you need.
1. Don't own a printer

2. Don't want my hand to cramp

3. I'm being silly, everyone should use MFA
> It's easy to feel like, "at ${year - 1} I was such an idiot, glad that's over now."

Reminds me of an old "Red vs Blue" video about tattoos. [0]

One of the arguments presented against getting tattoos was:

"You are an idiot, and I'd like to prove this mathematically. Take your current age and subtract 10 years. Were you smart back then? Hell no, you were an idiot. And you're still just as much of an idiot now, it's just going to take you 10 more years to realize it."

[0] https://www.youtube.com/watch?v=b2pSt2gACrc
Suppressing information to prevent someone with an opposing view from using it doesn't seem honest at all. It does not inspire confidence. Nor does it present an image of impartial research.
The ideologies often line up with politics: the Constitution is a 244 year old document with a heavy emphasis on economic liberty and protection of personal and property rights. Interpreting the Constitution according to its text and original intent will naturally lead to conservative outcomes.

I think that interpreting the Constitution by its literal text yields interpretations different from interpreting according to original intent. And that the literal text reading does not align all that closely with mainstream Republican or Democratic positions.

Consider the text of the First Amendment, for example.

"Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances."

No abridgment of freedom of speech or of the press. Pretty clear as text. Yet the Sedition Act of 1798 was never overturned as unconstitutional. Nor is there an exception in the plain text for "unless it's obscene" or "unless it's a lie" yet there are Federal laws limiting obscenity and fraud and other kinds of speech that were never struck down on First Amendment grounds. Some such laws were passed in the lifetime of the original framers of the constitution and others are in force today. Some state level blasphemy laws remained in place until the 20th century [1].

As I see it, either the literal text reading of the Second Amendment protects private ownership of machine guns just like it does bolt action rifles and revolvers, or handguns are no more protected than machine guns, whose private ownership was limited by the National Firearms Act of 1934 and then outlawed for all but affluent collectors by the Firearm Owners Protection Act of 1986.

A maximal-individual-liberty interpretation of the literal text of the First and Second Amendments produces a United States in which there are no Federal laws against publishing pornographic videos of minors, nor against private ownership of anti-aircraft missiles. (Among other startling developments.) That's closer to a fantasy of a certain strain of libertarian than anything aligned with mainstream political factions in the United States, either contemporaneously or at any time since independence. The original framers were (at least mostly) not libertarian libertines, devoid of communitarian feeling, while the literal text gestures toward an uncompromising individual liberty that would be equally outside the Overton window in 1792 or in 2022.

[1] Though it's fair to consider that, pre-Civil War, states had more latitude to pass laws that the Federal government was Constitutionally forbidden to pass.
I wanted to get behind this more but there were a few sections that had me doubting.

1. It says the UK media largely ignored the Snowden leaks due to a D-Notice - the source supplied didn't really back that up and it didn't sound right to me. Maybe someone can share examples of Snowden-leak-related stories which would have been in UK public interest but were only covered abroad?

2. It says the Steele dossier is largely discredited - I wasn't aware of any discrediting, let alone total. I don't know why the author thought this spin was necessary for the article.

Edit to add 3. It says that a D Notice was used to suppress a link between Sergei Skirpal's handler and Orbis Intelligence, while the only sources provided negate that
Are there any existing implementations I should be aware of?
I could anything I wanted by putting together “turds.”

You could, but it wouldn't be very good. Perhaps you noticed, but many others share your opinion and have in fact done that exact thing, and the results are not very good, which to me personally is completely logical and understandable.

The above is not obvious to you?

It’s like those old people who complained that mp3 wasn’t as good audio as whatever. They’re right but it doesn’t matter.

Thank you for providing a good example of what I wrote earlier: throwing pearls before swine who are not capable of understanding it to be able to appreciate or pick it over "good enough". IT is a shitty industry, and your example illustrates, in part, quite well why that is so. If I live to see my retirement, it will be one of the happiest days of my life because I won't be putting up with that kind of shit any more.
>In a letter sent to brands Tuesday ahead of the 2022 NewFronts digital advertising conference, more than two dozen civil society groups said marketers should secure commitments from Twitter to retain its most critical policies, including on civic integrity and hateful conduct, and threaten to withdraw funding if Twitter does not comply.

>"As top advertisers on Twitter (TWTR), your brand risks association with a platform amplifying hate, extremism, health misinformation, and conspiracy theorists," the letter said, adding: "Your ad dollars can either fund Musk's vanity project or hold him to account."

>It offers the latest example of how some advocacy groups have leaned on the immense power of corporate speech — and specifically digital advertising, the lifeblood of many tech platforms — in attempts to shape tech companies' behavior. It leverages years of growing realizations by the ad industry that brands can face reputational damage if their ads appear next to white supremacist content or other harmful material.

https://accountabletech.org/wp-content/uploads/Letter-to-Twi...
Human life is messy, and mandatory controls risk doing more harm than good.

To your exact "generous" example, a decade or so ago we suspected my great grandfather might be in trouble (didn't call his son at the normal time, couldn't be reached, wasn't home when we went to check), and we eventually found him nearly dead from hypothermia after he'd slipped trying to move a tree out of the road and couldn't get back in his truck. It was in the middle of nowhere and would've taken at least ten minutes just to drive somewhere that had some kind of landline or cellular connection to call an ambulance out, and we instead drove roughly 113km/h on a 48km/h road to get him to the hospital (limit was so low because it's super windy and steep, not because it's residential). We got him to the hospital 10-30 minutes faster than the soonest he would have been in an ambulance otherwise and more than an hour faster than how long it would have taken for the ambulance to arrive and get him hospital. I don't know if the extra time made the difference, but I wouldn't want to have to fight some kind of mandatory speed limiting if I had to do that again.

If it could be disabled (maybe even every time you start the vehicle) I'd be a lot more okay with the idea -- kind of like how traction control usually does what I want but once in awhile I need to disable it to get out of a hairy situation when it doesn't quite understand what's happening with a foot of snow and patches of ice on the ground.
Hmm really? How do you do that? The `rem` and `em` CSS units do not reflect iOS font-size settings if this is what you mean (I don't know about Android).
And here it is, perhaps the actual issue: TED talks. And everything else, that is, all of the information of the information age, including social media.

Life for kids and everyone is drastically different from what it was just a few decades ago, because we have drastically different access and exposure to information, in general. This has changed the human experience.

I suspect it is because I have not looked hard enough, but I do not see enough about how much this has changed us. We try to pinpoint specific aspects, like social media, but I rarely see discussion about how just the raw exposure and access to information has changed us.

The value of knowledge is decreased, because it is accessible to everyone. This fact changed how people find their place in the world, find meaning and purpose, make social connections, etc. How much did this change us? I believe it has completely altered the human experience. Technology only hits this hard a few times every 1000 or so years. Gunpowder, printing press, electricity, internet. We're in the midst of a big shift now.

Here's an example: consider magic and sleight of hand. Until easily accessible information, the method of 'doing a trick' was arcane knowledge. This was the case for thousands of years. Knowledge was generally obtainable, but you had to go out of your way to get it. No adult believed in magic, but the fuzziness around the knowledge was enough to allow the audience to suspend belief that something wondrous happened.

This aspect of wonder is now rare. To what degree is the lack of access to wonder a root cause of the decline in teen mental health?

For what it is worth, I was that person in 2007 who warned everyone I knew about social media, for the exact reasons we are now discussing.
Could you explain that further? How do tax havens incentivize sanctions evasion or money laundering?

As far as I can tell, they’re just the most attractive places for such activities thanks to their low taxes. Laundering your money in Scandinavia probably wouldn’t be more difficult, it’d just be more expensive.
My actual preference is LTSV. Then all that needs escaping or encoding is a quote since a tab or newline inside the quotes is different from one outside the quotes. And I prefer encoding to escaping generally, since it's easier for someone else to come along and build a fairly naive parser.
Drug laws are severe in Russia. I’d double check my inventory before flying if I had a slightest chance to make a finding like that. Considering this, “semi-forgotten” sounded funny. A local probably wouldn’t get off so easy.
First you need to invent a password manager that can be properly used? The one I have runs on my computer and trusts everything else I've ever installed not to have put in a mechanism to observe memory allocated to my browser.
Signed up to HN just to say that I signed up to Patreon to support him. Thanks for sharing.
No, this is actually "Safari on iOS" isn't broken, and allows the user to remain in control (thankfully).
But that's where the design of Facebook gets in the way. With Twitter, I can follow someone without them even knowing. Facebook requires sending a request and then having that request accepted. I interact with many people on Twitter that I'd never consider sending a request on Facebook. For me at least, there's not much of a gap between those I'd send an email or text and those I'd send a Facebook request, and even for them there's not much of an advantage of Facebook over the alternatives in 2022.
Your insight is remarkably well-written. I wish we could see our bodies in the same way, all of the time. The world might be a kinder place overall. Do you meditate?