skysight-inc/HackerNews huggingface dataset:
> I thought the 2FA all the big services have is so that they will deliver you your encrypted vault, rather than another layer of encryption?

Correct, 2FA is protection in addition to your password manager. So if someone gets your unsealed vault they cannot log into any services without also compromising your second factor. 2FA is not for further cryptographic hardening of the vault itself.

> The real threat is that you're putting your password for decryption into a proprietary blob with an internet connection and auto-updates enabled. It might be sending your password random places now or maybe at some later point.

If you use Chrome and Safari your passwords are going through a proprietary blob with an internet connection and auto-updates enabled. If you use extensions for your browser they likely can steal all of your passwords.

Nothing can protect you if you don't trust any of the code you're putting your secrets into, although 2FA with some USB devices cover a mind boggling range of threats. A keylogger and screen capture combined wouldn't be sufficient to bypass them.

> Note that even a source-available password manager doesn't really solve this issue if it's not self compiled

Are you compiling your browser from source after verifying every line of code it contains? If so what makes you think you can trust your compiler?

You have to trust something. Choose your threat model. Choose your risks. Live your life.
The is an error in the title - it was supposed to say "no fame".
What does operating locomotives have to do with making sure the thing you're building follows all the rules and has appropriate safety factors and such?
There were bombings almost every day in the US in the 1970’s.
Facebook’s news feed in 2006 was not even remotely what’s being discussed in this branch.

It was a simple timeline of all of your friends’ actions. A raw chronological feed.

The outcry it caused was because it felt like stalking. The following dominance of Facebook did not have anything to do with people’s “revealed preferences” in favour of the algorithmic instrument being discussed (which individually selects content to appal or otherwise engage you so that you spend the most time and generate the most ad profit). News feed wasn’t that instrument—until MySpace went away and Facebook had users reliably locked in.

Facebook didn’t win because users liked the algorithmic news feed that maximises corporate profits by amplifying troll takes and aggravating our psychological well-being, Facebook won before that. It’s important to get the causal relationship right.
+1 1Password is really great, the best among the available options by far imo. Most of the negative commentary about it doesn’t matter (I personally prefer native apps to electron apps).

The complaints about it being a subscription are weak - software doesn’t exist in a closed system. Keeping up with all the platforms and the OS updates etc. takes perpetual maintenance even if they shipped zero new features.

And the features they do ship (family vaults, built in OTP) are really useful.

It’s a refreshing escape from the “free” ad-driven hellscape many of the HN commenters complaining are probably employed by.
Agreed, for a sufficiently hard definition of hard real time.

Hard real time gets a lot of theoretical attention, because it's sometimes provable. Whether the decisions you're making by the deadline are sensible and not, say, cranking the horizontal stabilizer all the way down when one of the angle-of-attack sensors is broken, are far more consequential in most systems than missing a tick.

Companies definitely shoot themselves in the foot by focusing so hard on the hard real time constraint that they make it 10x harder to reason about the actual behavior of the system, and then they get the more important thing wrong. I've seen this in a few systems, where it's almost impossible to discover what the control loop behavior is from reading the code.
To some degree that can be faked: https://github.com/artiebits/fake-git-history
I get their goal with the pricing comparison table, but it makes it initially appear like this has an actual cost (when in reality they're just saying all you need to do is put this on a cheap VPS).
Does it have GPU acceleration yet?

EDIT: apparently it does!!! https://asahilinux.org/2022/07/july-2022-release/ Not perfect of course but this is surprisingly good progress in a short time.
It's for Mr. John Siracusa. Plus people who want a modular computer, but I don't know how modular would an M* Mac Pro be.
Yea, definitely people should have to put way more their free time just because some people are cheap on their RAM

but there's solution even for those: fork it :)

I hope the people complaining about electron are the ones that at least put money where their mouth is and donated to those projects if they do expect native versions
Rudders are coated with anti-foul paint which is unlikely to taste good to anything.
What a shit show, glad you made it unharmed.

After going through something like this do you feel you could ever trust a self driving car in their current state ?
Electronic Funds Transfer — an electronic transfer from a bank account.
I don’t think your reading of history is correct at all. There were plenty of attempts to unseat JS in the browser - ActiveX, Flash, Java, Dart.

Only Google attempted it with Dart, and then they got tired and gave up, because the team was (presumably) minuscule compared to the team working on JavaScript in the same effing browser.

Funnily enough it was the same team! Lars Bak led a small team to build V8, and then when that was a big success, he had enough clout within Google to design a new language that could improve on JS, so he took most of the same team and they created Dart.
Yes, I'm not touching that until it is at least a few more years older. Being on the bleeding edge doesn't pay off if you just need stuff to work.
> was immaculately conceived, walked on water, turned water into wine, all things that you and I know are inconsistent with reality.

All those things are completely consistent with reality. Every year there are virgin births[0] (not immaculate conceptions[1], which is a term specific to the birth of the Virgin Mary herself), water turning into wine[2], and people walking on water[3].

I think what you mean is, the specific details of those miracles, as described in the Bible, have not been observed since, and they would have required a succession of extremely improbable quantum events. No one disagrees with the notion that those events were scientifically unlikely, but unlikely events are still consistent with reality.

[0] https://en.wikipedia.org/wiki/Parthenogenesis [1] https://en.wikipedia.org/wiki/Immaculate_Conception [2] https://en.wikipedia.org/wiki/Irrigation [3] https://en.wikipedia.org/wiki/Snowshoe
I think I've explained that above - it's not having to be rigidly tied to a schema :)
Resistance in the engine isn't a major source of power loss. RPM should be whatever is optimal for the power output. You don't reduce highway fuel consumption more and more by using a higher and higher gear because then the engine is running below its optimal rpm for efficiency.
The ACLU now only protects those they agree with, and Nature will only publish conclusions they like,

It's a mad world. And this is basically driving moderates into the arms of the authoritarian strongman who at least doesn't deny that water is wet.
> not everyone has 32GB of RAM.

Developers making desktop applications should be made to use anemic ~10 year old computers so they know what their application will feel like to common people. Builds can be done on a headless server with plentiful ram; the requirements of the build environment needn't factor into what computer a programmer is given to test their work.
> How will I schedule meetings?

I suggest using a calendar.
> Why does 1Password always bring so much controversy in discussion forums?

It's because 1Password was targeted at tech enthusiasts at the beginning and has migrated to a mass-market product over time. The desires of the tech enthusiast group differ (on average) from the goals of a mass-market consumer product. Every time they switch away from something enthusiasts value (perpetual licenses for a specific version, optimized native apps) the early adopters get upset. The average user doesn't care all that much.

> If you’re making six figures writing software and think $3/month for a cornerstone of your security suite is offensive, you need to grow the fuck up, frankly.

For me, it's not about the cost. It's about managing one more subscription. My credit card bill is full of little monthly subscriptions, and at this point I'm tired of adding new subscriptions at every turn. Subscriptions aren't a big deal for the first 5-10 services, but once you're juggling 20+ recurring charges for things that don't really need to be recurring charges, it's tiresome.

I would gladly pay a premium to have a one-and-done license (for a specific version, just like they did in the past) that didn't add yet another monthly payment for me to manage and another system I need to update when I get a new credit card.
So I spent the last couple of hours on this. Pulled out all the shared_ptr and make_shared bollocks, played a couple of tricks with ld to embed the PNG images into the binary (since I don't do Windows or macOS, I'm OK with that), add some external references to these embedded images, created a CMakeFile that will figure out if you have SFML installed on the system etc.

Looks better already!
I'd use it :)

Writing tests is tedious, and this reminds me the nicer bits of Selenium IDE (which I otherwise don't miss).
I’m entirely unclear if an ARM-based Mac Pro would look anything like the old Mac Pro.

Well. Actually. If it would look anything like the late lamented cheese grater Mac Pro. I worry it would be a lot more like the trashcan Mac Pro.

Because for a long time, the Mac Pro has meant expandability. Lots of RAM slots. PCIe slots. Drive bays. Big-ass GPUs. Something adaptable to pro work flows, namely audio and video capture and production.

Is anything like that possible with the Apple Silicon system? I think it’s extremely unlikely they’d support GPUs. And I really don’t think they will support old-fashioned RAM—they seem to be all-in on directly-on-die memory. And PCIe cards? Shrug? No idea, because we’ve not seen anything like that yet.
I'm honored. :)
Perhaps? I remember the article arguing more comprehensively why a different order would be beneficial, but maybe I am just misremembering
>You must be a project manager,

Nope. :V

>but you spent years studying to get a computer science degree

Nope. :V

>later on started a family

Nope. :V

>decided to get a job in Human Resources.

Nope. :V

I'm just a stereotypical self-taught computer nerd of the 90s and early 2000s who saw how lean and effective software of yore were and yearn for those days.

Seriously, we have mundane access to tens and even hundreds of GB of RAM and 5GHz of CPU and what do we use it all for? To try and keep the stuff in the background happy, usually Windows or Chrome in this day and age.

The better hardware becomes, the worse software becomes to waste the hardware even harder. Fuck this noise, I want my childhood computers of badassitude back.
I don't know why they say 10x developers don't exist.

In my company, some people merge 600 PRs a year, and some only merge 50 PRs.

When you look at the performance, there is an obvious correlation between good performance and PRs.

They fix a lot of random stuffs in adjacent areas and finish their main projects.

Of course, this correlation is not true 100% of the time.
1Password has been good to me. I did have a strange encounter with their customer support last year; I had asked whether it might be possible to have native support to show when a credential was set up to use Sign In with Apple, or Google sign-in, etc. Their customer service didn't even consider the suggestion, advising me instead that using single sign-on solutions was a security risk. At the time I thought the agent was just confused, but with hindsight I realised it might fit a password manager's agenda to keep people using an email, password and 2FA combo, perhaps with an eye on whatever other solutions 1Password may have in the oven.
What a naïve and narrow opinion your throwing onto other humans. There are as many reasons for anyone to use electron as there are not to. You may not value the use cases a developer may choose Electron over native solutions.

It's very vary poor outlook on other people to think their lazy and incompetent. I'm sorry you hold these values but please try and get out of that toxic mentality your publicly showcasing here.
It makes sense that creativity requires solitude. If you are constantly exposed to ideas from other people, your mind will become primed to popular ideas and your output will be more likely to be derivative.

My theory is this; when everyone in your group thinks alike and members are highly attuned to each others' sensibilities, they tend to be careful to not offend each other (and they tend to be good at it) - this means that more safe ideas and fewer risky (potentially offensive) ideas will propagate throughout the group. Over time, due to the low exposure to risky ideas, members of the group become accustomed to an increasingly higher degree of safety, which feeds into the vicious cycle of increasing sensitivity, intolerance, self-censorship and dullness.
Sounds like all that stuff which is now fighting over z-index, "implemented" by people with no clue at all, will be fighting over the top layer soon, when the people with no clue at all start throwing it together...
Not a single one! I suppose I occasionally see friend requests from unknown users, but they don't actually convey a message or achieve any possible advertising goal.

That said, I only communicate with a couple dozen close friends on snapchat so perhaps a more active user will get spam.
It is waste if you could do the same thing without a full chrome instance. Because then that memory could be used for something entirely else, like the silly chrome instance required by some other electron based app…
> the constant Electron whining is boring and probably quite duplicative in their forums by now

I would take this as a signal that, in the eyes of many of their users, it's not fine.
I and many others will never stop critiquing software, especially commercial software, sorry. I really don't understand your reasoning. Just sounds like "shut up and go somewhere else". How about you ignore the comments you don't like and happily continue to use the software.
I don't think I buy that. I think we're doing pretty good at identifying, for example, what constitutes sexual harassment in the work place. I'm really not sure what the hesitation is, to be honest. Seems like a given that you don't have the right to just keep fucking with someone who has asked you to stop.
Allegedly France is also big on industrial espionage, but this doesn’t get as much press since they’re a key NATO ally:

https://www.france24.com/en/20110104-france-industrial-espio...
Their Mac app (version 8 built with electron) had a nasty bug in it where it would consume 80-100% of single core CPU and when made aware, it took them over a week to push out a patch.

Whatever they think they're doing taking a native app which rarely (if ever) had such regressions and rewriting as an electron app, they've embarked on a boondoggle.
The password journal is probably the safest providing the passwords themselves are strong. The likelihood of someone compromising your mom's passwords online are an order of magnitude greater than someone breaking into her house and copying her journal.
Note the official open source version requires a subscription to get a license key. Most people choose to run an alternative server written in Rust called vaultwarden.
Not despite, most are unaware it is even owned by them
> individuals or groups whose goals are contrary to the good of the human race

These types of exaggerations are part of the problem.

It would be fine if by that you meant supporters of totalitarian regimes, but I often hear this type of language from people who think that using pronouns in the conventional way is genocide.
The controversy for me isn't that they moved to a subscription model, its that they moved to a cloud only model and completely broke their offline-sync yourself vaults. Its that they maintain an almost hidden version that allows you to keep using your offline vaults, but it incompatible with and separate from their cloud vaults (really counterintuitive if you accidentally stored some stuff in the cloud vaults). The browser extensions for their older offline vault keep breaking as they are only incentivized to move you to the subscription model one.

There are plenty of people and organizations that I prefer the Teams, family and subscription model for.

Its just a bad experience. And yes, their audience has also used Keepass, Bitwarden and others, and see 1Password as the one capable of not fucking it up but simple did any way?

I get it that they don't see an obvious way to do subscriptions that people can't circumvent. It just also brings a lot of skepticism for what other economic pressures are going to guide their decisions, and when.
Is Point Nemo closer to space than land?
Are transactions supported in that solution or in the mentioned Datalog related ecosystem? I have built my own similar reactive inmemory triple store with typescripts type safety, but then I realized I still need transactions which are a bit of a pain, because transactions are bundling the otherwise separete triplets, so the atomic, independent logic of triplets and related effects breaks a bit. (I am sure it's solvable.)
Yes, 2FA/MFA is almost always just an access control measure over who can retrieve the (in this case encrypted) data from the server.

TOTP is based on a shared secret that client and server both know (so inherently a compromised server can just skip it). For webauthn and similar, the token will sign a specific challenge, incorporating the site name and a counter value etc. The server stores the public key, but the check can be disabled.

The real risk is the auto updating client and the integrity and supply chain of the code it runs - unless you actually audit the client code, there's limited value in compiling it yourself. If the attacker can ship you a compromised signed binary, assuming the company is competent in their setup, they've compromised a development environment, code review environment, code signing environment, perhaps a CI/CD and testing environment, and then the release distribution environment. To get you to compile and install their dodgy source only requires a compromise of their development environment, as very few organisations will slow down their routine development cycle enough to add significant barriers to this one layer being compromised (as it has to be done for every commit checked in, every dependency changed, etc.)
Sure: the LDS church teaches that pre-marital sex is a sin, and engaging in it is grounds for the termination of a variety of spiritual privileges, depending on the judgement of a local church leader. The legal freedom to live by that belief makes it a cultural right afforded to any practicing LDS person in the US.

A scientist could perform research investigating the impact of those teachings. They might find that it negatively impacts the ability of LDS adults to form healthy sexual attachments with their spouses, even though marriages are prized by the church. They could then publish those findings in a credible journal.

An anti-LDS government official in control of education in some state (say, California) could take those findings and use them to justify a new policy that all LDS children are required to attend sex-ed classes in school, and threaten parents with visits from child protection services if they refuse. Depending on the local governmental structure and voter demographics, this could pass into law relatively quickly.

Thus, a researcher's decision to publish has led to interference with LDS people's cultural rights.

There aren't many examples of human behavior this sequence of events couldn't apply to, if local powers (or distant ones) were so inclined. Do you think it's irresponsible for scientists to consider that?
Thanks for the info.

I just need browser integrations to work and for it to be open source, I was pretty surprised how well the autofill works on Android. No way am I putting my passwords on the cloud, that makes zero sense to me.
The outages have made me want to move, but this announcement puts it on a faster timeline. This probably won't affect most of my paid apps (we'll see how free staging and review apps in paid pipelines fare), but it does tell me they don't care about proper notice and make me worry I'll find myself trapped into having to migrate on their schedule versus when I have time, sooner or later.
As someone who has been using 1Password from almost the very beginning, I think the issue with the forum stuff is trust. If you're trusting a company to store your passwords and credentials in the cloud, then there's a certain level of transparency and openness that's required. I also have not had any issues with the subscription model, despite using standalone vaults for as long as possible, and the performance is fine for me on v8 (but I also have the newest Macbook with max RAM so that might not be the case for people on older/less-capable machines).

I, personally, am not happy about the way that this or the subscription update have been handled because, to me, it makes me question how they would communicate something far more serious. If they're delisting forum posts because of a decision to not update their app in the Mac App Store yet, how can I be sure that they won't delist forum posts when they have a data breach? How can I be sure that they're not obfuscating other things that are more important than forum posts to try and sweep bigger issues under the rug? It's like the old adage goes - "If you're willing to lie about something that doesn't matter, what are you willing to do about something that does?"

These moves are forcing me to, at the very least, start looking at a new password manager. 1Password is still the best, in my opinion, in terms of features and usability but that won't always be the case and transparency and respect for your users are far more important to me than niche features. If I can't trust your company over something small, there's no way I'm going to continue trusting them with some of the most important info in my life. I currently use both LastPass (not a fan) and 1Password. I'll be re-evaluating KeePass and Bitwarden because of this.
and yet, they did either arrive at that same conclusion or did hear you, because it now knows if one uses a Sign in With Google and stores that fact in the Item: https://blog.1password.com/sign-in-with-anything-browser-bet...
I don’t like it - I regret the purchase. Don’t you ever buy things you’re excited about only to find out it’s not what you hoped?

I’m just not furious is all - and not nearly as furious as folks who… didn’t buy the product. Me being disappointed in a cool toy is hardly a problem worth discussing.
The problem is not these things fighting with each other, but fighting with the webpage design. It's fine if a contact form pops up over an email opt-in form, if the contact form is the more recent thing someone tried to open. It's not fine if the contact form appears behind the website's navigation menu because the website template designer gave the menu too high of a z-index value. Separating these third party overlays from the webpage is the improvement this offers.
This was once a Simpsons joke.

The religious extremist (Ned Flanders) said "there a things we don't WANT to know. IMPORTANT things!"
Yeah this is simply FUD—I'm seeing 118MB myself and that's with a decade worth of passwords and other info in there.
Made me think of this https://www.youtube.com/watch?v=4Ru8DMW-grY