skysight-inc/HackerNews huggingface dataset:
Done my usual ritual of temporarily enabling JS with uBlock Origin to view the page, and was trolled heavily. Bravo!

SPAs have their place. They fail when a webpage that can be done with HTML & CSS alone is 'appified' and requires JS to view.

Many webmasters over-engineer a website with JS bells and whistles, which is terrible for accessibility, often adding fake loading spinners to give the illusion the page is loading new content, when the content is already there.

Also you see artificial delays & animations when you scroll, AKA 'scroll spying' with content jumping onto the screen, because, hey, you can do that, but it doesn't mean you should!
I think they're referring to attestation (https://fidoalliance.org/fido-technotes-the-truth-about-atte....), which requires that attestation certificates be shared with a minimum of 100,000 other devices in order to ensure they're not unique IDs.

Maybe the parent misread the spec as saying a _maximum_ of 100,000? Or something?
Existential Optics
I think the argument has already been made for 2FA often enough though. So they probably just assumed everyone had heard it (wrongly perhaps?).
A great way to annoy a big chunk of your site's users too. Classic dig own grave.
Learn to use your body. Learn about how your body makes movements happen. Practice them. Improve your mobility, learn how it works. Learn about strength training. Practice it. Learn about cardiovascular fitness. Work towards it. You have so much to learn built into your own being and biological processes . You can even get technical with it. Limited ankle dorsiflexion? Go skim a meta analysis on how to improve it. Want to learn powerlifting? Learn about the methods used to improve your total or work towards a perfect squat. Your body is never finished. Learn about it and how to use it, and you’ll always have something to learn.
> but you are not aware of the deception, then perhaps it isn't spin

You are quite right that I am lacking complete awareness, so I think it would behoove the author to at least link to something to back up their statement, and without sourcing it does feel like spin.

Similarly, there's a section of the article where the author suggests D-notices were used to suppress a link between Sergei Skripal's alleged handler and the Orbis Intelligence company whose founder wrote the dossier. There is again no souring or backing up this allegation. I didn't understand here either, why the author is using these unsourced points to discuss D Notices
I’m going to need to work this out soon. I picked up a pair of new YubiKey 5Cs yesterday with their sale. I’ve been using a YubiKey Neo for years for U2F, TOTP and GPG.

Moving the GPG key is easy - though I might try using the FIDO2 support in SSH instead. However for every TOTP and U2F key I’m going to have to re-enroll the new keys… It feels like there should be a better way.
What? It loaded for me.

C. Norris
That sounds accurate but truly horrible.
Really? Because I am a woman tech interviewer at a large tech company and this happens to me a lot.
That's another point in favor of drones: you can skip field maintenance and do it a the home base and deploy/recover them at time of mission, en masse. Human soldiers has to maintain their equipment in the field/forward base - which is a different set of logistical problems
brilliant work in every aspect, really blew my mind
Climate sceptic thinktank received funding from fossil fuel interests
Thanks for signing up! And thanks for the feedback. It's clear that discoverability is an issue with the site in its current form. We hope to add some features to improve that experience very soon.
Isn’t Amazon all third party now though?
Yes, it could be that, but anecdotally I see significantly less bugs on cars during summers than during my childhood. The grill, windshield, etc would have dozens of lovebugs after a short drive on an early summer day. Now they're rare.
I think I'd pay for a prime^2 membership for an Amazon without all of the bullshit.
My presentations use the defaults on Impact - big fonts, black on white, no border, no decoration.

From time to time people complain and say I need to "get with it", but not a single person has complained they couldn't read them from the back of the room!
Check out https://storeleads.app – should have close to 100% of public Shopify stores, plus other platforms if those are interesting.
+1000XP for the use of "shibboleth"
Yea, same here. I didn't see any of the TV tropes in my high school. The sports jocks also tended to be in the top of the class academically. The most talented artist in our class was also the league and division champ cross country runner. Our valedictorian and the rest of the top-10 were active in the band, in sports, on the student council, in yearbook, everything.

The divisions were not between nerds and jocks and preps and band-os and artists: It was basically people who did things and people who didn't do things.
Node.js 18 core ‘node:test’ module
> why is the current web designed to let server owners control our experience?

Because the most popular web browsers ARE created by some of the largest server owners (i.e. Google).

To address this, make sure your site works with simple browsers, like Links and lynx.
Hah, what does that mean? Grow up and start exploiting kids? No thanks. I don't need to recruit kids to fight culture wars for me
To properly judge a candidate, don't assume, don't hide requirements; If you're willing to filter them out on it, tell them up front what you're judging them on. If they still can't or won't comply, your filter might be reasonable, otherwise it's unfair.
First, they don't. There's a HUGE CS faculty shortage. CS faculty positions outside of R1 are insanely hard to fill and the average quality of faculty tends to be quite low. Some lower tier colleges and universities will hire tenure track faculty out of online masters programs with no teaching experience. Even then, faculty searches regularly fail. The bar is rock bottom. (This isn't meant as a bias against online programs; the salient point is that if your masters was online then you almost certainly have zero in-person teaching experience even as a TA.)

Second, most people aren't rational economic actors and even those who are have a myriad of objective functions.

Some common reasons people stay when they could get much higher paying and lower stress jobs:

1. Immigration.

2. Work life balance. Not unique to academia, btw. I know ex-FAANG SWEs who make $70K/yr because they can get the job done in one or two days a week from a van and want to spend most of their life in the mountains.

3. Immigration.

4. Some people actually enjoy teaching and view it as a life calling.

5. Immigration.

6. Ageism. A 50 year old who spent 20 years in academia is going to have a hard time getting back into industry.
This may be a naive question (I have very little knowledge about building languages and compilers): Would this be possible in Python by introducing a keyword like `final`? Any object, variable, method that is marked final just has to be looked up once by the interpreter, the re-fetching the article describes doesn't have to happen again. Trying to change a final thing results in an exception.
How does 2fa force you to give them more data?
Unfortunately, Mermaid can’t render to SVG without a full browser rendering engine. This was my biggest complaint about Mermaid.

There is a command line tool, but it downloads a browser renderer.

Hopefully someone will let me know if this has changed since I looked :)
Oh, yeah I see that. I would like to see the whole history of the opinion github style. Would also like to be able to use git blame.
What is the point of being frustrated by referencing important things. For most of the world, colonialism is one of the most important things that ever happened, as it directly affected most of the humans alive.

Would you be similarly frustrated if an article on recent history references WW2?
I don't think it's entirely stupid.

Eg math problems solved in class would be solved as a group so everyone learns the process, and homework is for problems which use those same concepts, but require more careful thought. Most of my math skills were solidified by solving challenging problems like that at home. Simply learning the concepts in school was not enough to build a deep enough understanding, but adding in a good homework component took me from having trouble handling basic algebra to unwittingly deriving basic calculus in an exam when faced with problems I didn't realize weren't intended for me.

Homework as just mechanical work intended only to take several hours per day is pretty stupid though.

As another point, how many of us truly shut out work when at home? Many of us still end up spending a few off hours a week programming personal projects or just reading up on and learning new technologies. I think homework serves a similar function for kids.
I mean if you move the goal posts then sure but the argument was about if the activity occurred which it does.

---

FB has never claimed (in court) that CA violated any agreements they had with them. The only comments they've made are PR speak to obscure the fact that CA acted within the rules (hence why FB needed to update the rules). The only court cases that arose are against FB* for sharing data with CA they shouldn't've.

Per-FB's policy there are only a few things worth talking about.
> (7) If you use any partner services, make them sign a contract to protect any information you obtained from us, limit their use of that information, and keep it confidential.
> (9) Don't sell, license, or purchase any data obtained from us or our services.
> (10) Don't transfer any data that you receive from us (including anonymous, aggregate, or derived data) to any ad network, data broker or other advertising or monetization-related service.

7 - This is my understand as to what happened. CA didn't turn around and release this data.

9 - Doesn't apply as nobody claims Kogan sold the data to CA.

10 - Doesn't apply as CA isn't these things.

* Technically the FTC did also against CA but it was literally _just_ because CA also recorded the User's FB ID [2].

[1]: https://web.archive.org/web/20180329131546/https://developer...
[2]: https://www.ftc.gov/news-events/news/press-releases/2019/12/...
I like it!

For other players: you can pull and push pieces around if they do not align into proper lines by themselves. Clearing lines works!
Not that I know of, but you should definitely at least enable a second form of 2FA like the recovery codes OR a second security key, then print/write/store the file/key somewhere. If you lose your primary, then you can use that secondary. Never just have 1 form of 2FA without a fallback.
I have setup for myself and my parents that all mobile Safari sites automatically go to reader mode. Reader mode does not prevent zoom, copying, etc.

It's just one click to remove it for form-based websites (a few steps to whitelist if you're going to use that web form a lot), but the readability for the vast majority of websites is drastically improved.
Show HN: Markdown Notes Tab
Someone should tell their recruiters...
Autism or at least high functioning autism is characterised by poor theory of mind.

ie. you have defective/poor/inaccurate models for understanding how emotions effect thoughts/behaviour and the other way around. More or less the same thing as poor emotional intelligence.

If someone would tell me that they have a little bit of autism I would interpret that as them having poor emotional intelligence.
It’s capital intensive! They have a huge moat that has been developed for two decades. People are really understating the problem.
Bindings might be better but that doesn't necessarily mean that ViewControllers are an anti-pattern. Is there a better way to do it in an non-declarative OOP way?
> - Can Apple/Google/Microsoft ever block/ban my account, preventing me from logging into my bank, etc that use FIDO login?

You don't need an Apple/Google/Microsoft account to use WebAuthn on another website, it's based on the biometrics on your local device. Syncing that credential across your devices with the same account is just an optional extra feature.
I have a feeling this is more to do with developers being lazy than a problem with SPAs.

I wrote my own SaaS product a few years ago as a SPA, using php backend and basically jQuery front end. It runs on a namecheap shared hosting server for $5 a month. It loads faster than 95% of the internet because as I was learning from YouTube and stack overflow, my #1 goal was to be fast. So it was.
Thanks for the context - I didn't really understand you though - why do you say the actual specifics were mostly false, while also saying the Congress investigation verified some parts and couldn't verify others?
Firstly, PKI generally doesn't have a key distribution problem because keys never get distributed; they get generated in-place, certificate signing requests are sent to certificate authorities, certificates are signed and returned.

Secondly, in the TOFU model that applies to WebAuthn, you don't even need to have a certificate authority - you can self-sign.

The problem is really, as alluded to another comment, that if you share a single certificate across multiple sites then you are sharing a common tracking id between them (e.g. your certificate fingerprint).

Logout is also a user experience pain point unless the certificates are stored on e.g. a smart card that can be removed.
That’s awesome! Happy to lend any ML/infra expertise to this effort
>2. It says the Steele dossier is largely discredited - I wasn't aware of any discrediting, let alone total. I don't know why the author thought this spin was necessary for the article.

If you aren't aware of it, that's on you. Frankly it amazes me that people still think it's real.
I would disagree.

He did everything reasonable. Spend a good amount of time and resources on this project.

He clearly acted on the thought I have had plenty of times: I should just start my own nft token and become rich.

I might have struggled way less from a pure technical standpoint but I would have tried it very similar.

This gives my mind a good feeling and I appreciate his effort.

It also explained to me how you create nfts.
> If Nim can work with numpy it's a plus

Nim goes further there by removing the need for tools like Pandas and numpy. You don't have to write code in "Pandas-style" because native Nim is equally fast and sometimes faster.
You are right, and I should have worded that way. I can see how what I said makes it seem like no one is there, and they just burn through the list until they find someone.

Yes, the "on call" person is actually there, and if for some reason the team knows in advance that the EBUG cannot attend for whatever reason, THEN they go down the list for the next available "on call" EBUG. All of which happens before the game starts.

My team has had the same main EBUG for years, and he even runs his own Youtube channel if it piques your interest.

https://www.youtube.com/c/BonesyTV/videos
PSA: you should ALWAYS download the recovery codes when you enable 2FA.

Reading a lot of "phone broken; locked out of account" comments here and I don't know whether they understand that local one-time only recovery codes should be downloaded and stored safely (maybe even printed and stored in a safe, I do not know). If you lose access to your 2FA device, use the "recovery code" option and use one of your recovery codes to unlock your account.
Yep I have found a job there. And as a hiring manager I've gotten a ton of great candidates from it too.
The SPA meta discussion is so tiring.

The bemoaning of them in absolute terms is absurd. The examples of "here is an app with a few lines of javascript so you don't need an SPA" / "I wrote my blog without using a framework" is even more absurd. And the more complex "just server side render it then" is a hell of "idea guy who doesn't have to do the thing" problem.

The whole ordeal is now more drama and than worthwhile IMO, and I don't think anyone reading this stuff is making these decisions.
How is the day-to-day experience of browsing the web with JS disabled by default (genuine question)? I feel like I would attempt to browse JS-free and then get frustrated with the number of pages that don't function without it. Possibly similar to using DDG and constantly having to !g every second search.
I think a good compromise is to allow organizations to opt to require 2FA in order to access their repositories, and allow individuals to opt to require 2FA for write permissions in their repositories (public or private).
If you sign up using one key, do the other keys work with that account? Unless it does, you're greatly increasing the complexity of creating new accounts anywhere.

That's basically what I'm getting at. Do I need to do significant amounts of extra work to keep an off-site backup in another state?
We need someone like Homakov again (https://arstechnica.com/information-technology/2012/03/hacke...) so people can access their own repositories without this bureaucratic nonsense.

If you have a strong password, is that really the biggest security threat? I highly doubt that. 2FA is used to get unique identifiers and data mine people.

It is a breach of confidence that large parts of the open source scene has trusted GitHub and now has to jump through new hoops practically every year.
It’s true they are double dipping but a seller in some random video said they liked to have their listing show up twice to increase engagement. This is for an Etsy seller though so yea Etsy also does ads too
"People using those devices are not our target demographic."
Worse, there are no "best" cables longer than 0.5m: any longer than that, Thunderbolt 3 requires active cables which don't pass non-Thunderbolt data beyond, IIRC, 480 Mbps.

As someone who spent many years using a mix of 25/50/68/80-pin fast/ultra/… single-ended, LVD and HVD parallel SCSI devices, however, USB-C/Thunderbolt cabling still feels like a breath of fresh air.
I use the kinda hidden three finger dragging gesture that you can activate like this:

1. Choose Apple menu  > System Preferences, then click Accessibility.
2. Select Pointer Control in the sidebar. (In earlier versions of macOS, select Mouse & Trackpad.)
3. Click the Trackpad Options button.
4. Select ”Enable dragging,” then choose ”three finger drag” from the menu.
5. Click OK.
Wish you could change the key combo for this, I've been using a long-abandoned tool called Zooom2 to do this with `fn` (and `fn` + `control` to resize`) and fear losing it on my next Mac if it's an M1.
Most attacks are social engineering. Everything else, to the best of my knowledge, does not target passwords
Related:

Show HN: 7GUIs in Vanilla HTML, CSS, JavaScript - https://news.ycombinator.com/item?id=28600804 - Sept 2021 (56 comments)

7GUIs - https://news.ycombinator.com/item?id=24958725 - Nov 2020 (56 comments)

7GUIs: A GUI Programming Benchmark (2018) - https://news.ycombinator.com/item?id=21883306 - Dec 2019 (16 comments)

7GUIs – A Notational Usability Benchmark for GUI Programming - https://news.ycombinator.com/item?id=15703230 - Nov 2017 (6 comments)

7GUIs – A Notational Usability Benchmark for GUI Programming - https://news.ycombinator.com/item?id=9050480 - Feb 2015 (17 comments including "Very cool to see my master's project here on hn")
With a sufficiently programmable hardware key, yes, you can back up the secrets. See an enumeration of methods in [0]. Be careful if you plan on doing this; make sure the tradeoffs make sense to you. You probably want to do the programming from an airgapped, trustworthy Linux machine.

Beware that if you do this and lose your primary key, or if it is stolen, then an attacker can impersonate you. Setting up multiple unique keys is probably more useful in general, even if it's more cumbersome.

[0]: https://dmitryfrank.com/articles/backup_u2f_token
I think Skia's PDF render support isn't fully compliant with the specification, and that's a Google product with dozens of Google engineers working on it.

Can you comply with a subsection of the specification?

I guess my point is that nobody will care to create an app with attention to the hundreds/thousands of programming tasks required for full compliance with a 600 page specification...
One folklore story we grew up with as kids was as simple as,

you misbehave -> some stranger called “Bag man” will come take you in a big bag

I don’t remember ever being actually scared of it but remember it since ever my memory had formed.
perl 11 is dead. It was never much more than a mirage by a few people outside of the Perl community. It was definitely not something supported by what is now the Raku community.
Thank you for responding. You have built something incredible. Also, I really like how you have incorporated gifs in the documentation.

Wishing you all the best luck!
This is a form of McNamara's fallacy. In reality, the data you are looking for is impossible to obtain. In practice, causing traumatic events is obviously unethical. Then, even if you had a proper study, there would be so many confounding factors that basically any conclusion is worthless. For instance, listening to an e-book on the subway is obviously different than discussing your emotions and response to the book. From first principles, it seems rather intuitive that if you expose anyone to a story of a trauma and discuss possible coping mechanisms, then that person is better prepared to cope with that trauma. Of course, being exposed to the thought might be traumatic itself (a kid might come to the realization that their dog is actually going to die) but if they react so poorly to the thought, how would they have reacted to the actual event? Intuitively, much worse. I'm all for data driven decisions, but our shared human experience can be a tremendous guiding light for things that are difficult to quantify.
> If this happened to my kids today it's very likely someone would be charged with a crime (rightfully so).

I have a sadistic stepdaughter who did similar-- on one occasion, I caught her catfishing lesbian girls and publicly accusing them of sexual abuse. From talking to a few of her (now ex-)friends, this was not an isolated incident. Enough of her lies caught up to her that she ended up changing schools, crying victim the whole time.

Kids these days know how to exploit privacy laws, be it HIPAA for their Munchausen-by-internet campaigns or anti-wiretap laws to conceal their targeted cyberbullying.

Evidence obtained from someone else's phone is generally inadmissible, so anybody positioned to discover such activity is going to have trouble reporting it.
Integrating SafetyNet and maintaining that integration represents real work and therefore money. It's not like one line of code, it's a pretty complicated protocol and set of flows that require support in both client and server. If there was no actual problem to solve, why would organizations that are famously much more concerned with money than tech politics spend their money in that way? I really doubt McDonalds cares about the freedom to modify phones one way or the other.
> whether you factor in the cost of maintaining that software over time

In many cases the largest cost indeed
According to the new york times:

> Was the dossier a reliable source of information?

> No. It has become clear over time that its sourcing was thin and sketchy.

https://archive.ph/2fHH5

This was on page 1 of google for "steele dossier", and the title is "Why the Discredited Dossier Does Not Undercut the Russia Investigation", so it seems to be pretty widely accepted that it was a bunch of nonsense.
Typically, said goalie is from the minor league (AHL) and not the EBUG.
It isn’t. $AMZN accelerated capex in the last two years to meet the demand brought on by Covid. They even over built, but have also launched Buy With Prime to open up their logistical infrastructure as a service. It takes a long time to get where $AMZN is at.