skysight-inc/HackerNews huggingface dataset:
> I wonder when I can just get a virtual yubikey built into my phone. No extra device. My phone is my device.

Last year, Apple shipped the first version of this: you can enroll your phone (or TouchID-equipped Mac) on sites like GitHub.com and it’ll use the Secure Enclave for WebAuthn secrets. I’ve been doing this since 15.4 came out and it’s great. Prior to that, I used a Yubikey 5 with USB and NFC, which is still handy since that’s where I store TOTP seeds for less secure sites.

Passkeys extend that idea further by allowing you to register once and have it synced rather than having to register every device on every site[1].

That last part is important because AWS has a huge barrier: the number of MFA devices you get is one, which means you either need insecure things like synced TOTP seeds or you have to be comfortable never losing your Yubikey. I have been asking our TAM to prioritize fixing that for years so backups can be a real thing.

1. Over simplified a little - hear Adam Langley at https://securitycryptographywhatever.buzzsprout.com/1822302/... for the right version
Beyond Poetry
Avoid SPOF's (single points of failure).

Relying on one dependency, Stripe, for 100% of your payments, would be an example.
Interesting timing, and good comms at a time when their former CISO is currently undergoing trial for not disclosing a previous incident
How can a prion be a quine? Is this a realistic thing?
Neopets acquires mental health app “Happy Not Perfect”
I don't have a specific alternative, but I think that if it's not possible to be effective in a role, one should decline it. It's possible to be an effective SWE while still writing (and hopefully also sometimes fixing) bugs.
I mean, that's how software used to be? Let's exclude anything cloud-based and assume no marginal operating cost of running purchased software.

Adobe Photoshop cost around $1000 in the 90s, and now it's like $25 a month? Back then you paid a discount to upgrade to latest version, and now it's generally included in the subscription. For professionals, the amortized subscription price is probably the same as the flat one-time free plus the upgrades, if not cheaper.

Some of the really expensive software I paid for in 90s and early 00s still has a flat one-time fee, such as Visual Studio or Final Cut Pro. Adobe and Autodesk have moved to subscriptions, but if anything that has made them more accessible to hobbyists. They were both charging ludicrous sums back then so the normies resorted to warez downloads.
Touché on the use, but you propose a non transferable wallet? Or will it replicate to other HSMs with certain credentials? Will the car dealership owner people them replicated cross availability zones or to diverse geolocations? And will the HSM replicate the keys to a hacked HSM if I get the signing keys from an employee of the HSM with a promise of 10% of the winnings?
WebAuthn (well, U2F, but that's essentially WebAuthn with a slightly different browser API and WebAuthn is backward compatible with U2F only devices) support has been on the YubiKey since the Neo in 2014 [0]. It's basically impossible to have a YubiKey that does not support WebAuthn. You do not need FIDO2 on-key resident credentials to benefit from WebAuthn.

[0] https://www.yubico.com/blog/neo-u2f-key-apps/
A fee per kilogram placed in orbit, refundable if the entire mass is deorbited as a single object, seems like a reasonable starting point.

If that fee is the entire estimated near-term cost to recover the object, it would also create incentives for entities putting large amounts of mass in orbit to focus on improved strategies for removal: if removal becomes lower cost than the fee, it's worth paying someone to recover your debris if a satellite fails in order to recover the fee.
What could you actually run on something like that? None of “normal” apps would be there for the various streaming services.

I guess it could be a plex front end but outside of that can it really do much people usually do with their TVs?
The 2022 Ig Nobel Prize Winners
Changing the monitor resolution doesn't seem good. A software upscaling (like lanczos, or ML upscaling if you like that) can be much higher quality than whatever upscaling (probably bilinear) the display does.
That’s a dangerous precedent to set. You’re essentially egging on today’s generation to “clash back”.

Colonialism isn’t the same as ancestral predator prey mechanics. Or, that we should reverse every unjust war waged in the world.

Some are just blatantly brutal. Simple. We owe it to our species to recognize mistake, apologize and make repairs.

Would Britain really say “it’s ridiculous. Things change. Move on” for forcefully castrating Turing simply because he was gay? Oh wait. No. They didn’t actually do that.

Some atrocities are just that bad. Things don’t change. It’s ridiculous. Grow a spine!
They actually use the reverse test to train the generator, and to score which image is most relevant to the prompt from the many images given by the generator. Dall-E does this using the OpenAI CLIP model.

You can see the mini version here using this exact logic https://wandb.ai/dalle-mini/dalle-mini/reports/DALL-E-Mini-E...
space roombas! (with space lasers!)

Can junk just be kinetically shoved into a low failing orbit at low expense/effort/energy like a cue ball in pool?
I'm not sure what makes you think that is the 'single innovative aspect' (besides, unless we're talking about Monero, most crypto transactions are not anonymous). One of the reasons I'm excited is for truly borderless transactions with friends and family overseas without every bank in the middle taking their (unknown ahead of time) cut. Even Wise incurs extra costs, as it doesn't support their native currency and USD/SWIFT is the only option. I'm absolutely sick of the unfairness built into the financial system and I get the feeling that much of the cynicism around crypto comes from a position of privilege.

Anyway, back to your point. Why should a layer on top 'eliminate' the layer underneath? Card companies did not eliminate cash.
The Logic of Collective Action (2019)
Note that this is a 2019 article based on a book first published in 1965 (revised in 1971).

Mancur Olson, The Logic of Collective Action, Harvard University Press (1971) (book) <http://libgen.rs/book/index.php?md5=63B1D140FD13A03F15BF8422...>

The concept has strong relevance to many areas, including political special interest groups, NIMBYism, labour organisation, and the free software movement.
Here’s Apple’s documentation from 2020: https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-...
I would like too. But games needs to load system libs (which are linked to a glibc), and games are not fully libdl-ized (dlopen/dlsym/dlclose). Additionnaly gcc static libstdc++ does not have a "libdl" mode, or even worse: it seems it links to internal glibc symbols. The glibc "should" be libdl clean, minus of few C runtime services I guess.

Basically, binaries of games cannot be "pure" and "simple" ELF64, in other words cannot load with any libc/elf runtime (musl/glibc/bionic?/etc) until there is the right symbol/version because of the static libstdc++ (some libgcc services too).

They would have to fork libstdc++, third-party libs, and fully libdl-ized them (in theory, it is easy brutal work).

c++ ABI is a nightmare, glibc symbol versioning is amok, well the devs of those components seem to ignore carefully that games have been available on elf/linux for 10 years.
As I said, my usecase doesn't involve implementing the commands--it involves reliably identifying executables in the arguments to many different commands.

I can't go rewrite awk, find, and sed with an opinionated cli module. I have to deal with the current reality.

(you're roughly describing what I already do, and it scales poorly)
Oh man Wave was great for the 5 minutes it lasted. It's Apache now right?
It looks nice. Will it give me direct access to the C and SDL APIs? Can I use my own SDL cdefs?
It's been too long. It would have been this course: https://catalog.sonoma.edu/preview_course_nopop.php?catoid=6...

There are some other courses you can find by searching "History of mathematics syllabus", such as this Berkeley one that has quite a few usable links and references: https://math.berkeley.edu/~wodzicki/160/
Rich Communication Services, I think. https://en.wikipedia.org/wiki/Rich_Communication_Services
They called them Passkeys. It's FIDO2 with resident keys only AFAIK though https://developer.apple.com/passkeys/
You can already see it with Google Ads. Some ads don’t get delivered if you don’t allow "create a profile on me". Now, if you think companies will ignore even explicit laws every time instead of finding loopholes, then yes, it’s useless. But at least for some part of it, it’s easily provable that they don’t.

Consent-o-matic is the extension that people use that do care about tracking (or believe that most companies will mostly follow the law, I guess).
It's absolutely frustrating how Apple is refusing to even come to the table on this. RCS is an unmitigated piece of shit, but Apple won't even propose an alternative.

And yes, the burden is on Apple here. They have the lock-in.
For every comment I’ve written here and clicked reply, I’ve written 10x more and just closed the tab. But that’s okay. Usually someone makes my point better than I ever could anyway.
It's a nice hack. I think this is how Woz did the Apple II paddles, too (albeit with discrete components and a timer IC). It sounds familiar.
Apple: "If you want to sideload, buy an Android"

Also Apple: "If you want to text Grandma, buy an iPhone"

My read into that: "People who run unreviewed code on their smartphones are so dangerous that we need to socially ostracize them from their parents"
In-n-out is worth crossing police lines, picket lines, maybe even enemy lines.
I am not surprised.

I am disappointed the American people is simply putting up with this healthcare situation. I don't think it matters if your doctors welcome room is fancy. Or they have 10 administrators replying to you within minutes. In the end you want to be treated fast and efficiently, and it fails.
But I digress.

I can see why paypal does this and I am glad we are planning on avoiding them in our back end.
>what is taking away basic consumer protections going to do to help you?

You define centralized control over wealth and the ability of an individual to send and receive payments to whomever they choose, without sanction, as "basic consumer protection", while I define it as unacceptable authoritarianism. Yes, it is true, an all-powerful governing entity that has complete control over how everyone sends, receives and stores their own money has the power to reverse fraudulent transactions, which is desirable in some circumstances. It also has the power to monitor, regulate, control and prevent individuals from sending and receiving their own money, as well as punishing them for sending, receiving, or trying to send or receive, money from those who are frowned upon by the controlling authority - which is incredibly undesirable.

>If you think there is some government conspiracy with the 'bankers' against you or your group

There's no conspiracy - this is happening right out in the open - and the powers-that-be are happy to brag about their unfettered power.

https://www.bbc.com/news/world-us-canada-60383385

https://www.wired.com/2010/12/wikileaks-congress-pressure/
As a remote contractor turned employee with adhd, I've stopped guilting myself about this and stopped really trying to hide it. I focus relentlessly on doing whatever it takes to get the shit I've agreed to do done in the time and way I can best do it. But I'm not moving to another country either.
I won't touch any web app because I'm perfectly fine using my Vimium shortcuts that I don't need them to interfere with a web app that could have been just a native app...
Silence in response to your comment is great evidence for its thesis.
That would not be GPL compliant (both v2 and v3), so would not conclude the lawsuit.

https://sfconservancy.org/blog/2021/mar/25/install-gplv2/
https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t...
https://events19.linuxfoundation.org/wp-content/uploads/2017...
> many applications do not support webauthn, full stop

You don't need the application to, only your IDP. Everything should be SSO from there.
> How do you work at a company like Uber and do something like click on a link in an email to claim a gift card?

This is bottom of the barrel phishing. Attacks against big companies get _far_ more sophisticated. Things like complete mocks of internal login sites, realistic internal emails. There's big money in hacking big companies, and plenty of shady characters willing to invest in a potential payoff
But that’s not how we designate authors in the field. When you’re discussing the various literatures in English, nationality in the political sense is effectively meaningless. Robert Burns was born in Scotland after the Act of Union of 1707, but no one refers to him as a “British poet.” He’s Scottish. Likewise, Heaney is an Irish poet, David Jones is a Welsh poet, and so forth. Those distinctions matter within the field of literary study, so it’s not really even a matter of being “pedantically” correct. It’s simply not how we classify authors within the various literatures that generally fall under the umbrella of “English literature.” To call Stoppard an English playwright (rather than a Scottish or Welsh or American playwright) has a significance in identifying the particular tradition within which he works.

Moreover, England, Scotland, Wales, and Northern Ireland are recognized as constituent countries of the United Kingdom. (And is should be noted that “Great Britain” only encompasses England, Scotland, and Wales—not N. Ireland. So it’s definitely incorrect to refer to a N. Irelander as “British.”) They aren’t simply states in the way Texas or Tennessee are. They are countries with devolved governments, and are recognized as such by the UK government. As such, it seems entirely fitting, even from a political and pedantic standpoint, to refer to someone as belonging to the particular country from which he hails.

E: Probably also worth noting, since we’re being pedantic, that OC’s comment that “the man is quite English” need not refer to his nationality per se. It could just as easily mean that Stoppard is culturally “quite English” rather than indicating which national gov’t issues his passport.
I tried both back in the day, and tech demo is exactly right (a really cool tech demo, to be sure! but still). The OS came with a simple task manager-type app that had two buttons on it that could be used to disable either processor (to demonstrate how it affected system performance, I guess?). Thought I, "Hmm, surely they wouldn't let you turn off both.." But nope; everything immediately halted.

By comparison, NeXTStep was quite polished, certainly by the time it was available for x86, which is when I used it.
What more is it, exactly? He and his family have billions fewer dollars.

Avoiding the $700M tax doesn't suddenly net them billions. The money is still gone from their family.

It was an altruistic move that was also done in a way that avoided taxes.
Especially when most museums and galleries in London (all of the UK?) are free to enter. It’s usually only touring/limited display special features that have a modest fee to see them.
I think you're seriously exaggerating here.

I'm 5'3" and haven't needed to take 'drastic measures' to find women interested in me, both in real life and online. I would say that the majority of women 5'4" or under don't consider my height a dealbreaker, even if it's a disadvantage (which it definitely is). Yes, taller women are another story, but the average height of a woman in the US is 5'4".

So why does my experience differ with the conclusion you've drawn? My guess: I have a pretty good looking face, a reasonably fit body, and I'm a musician. In other words, height excluded, I'm above-average in attractiveness. And that's evidently enough to take away the whole dealbreaker thing, if it existed in the first place.

I know it's an n=1, but your statement is so profoundly certain that an n=1 is enough weaken it.
The Last Member of an Uncontacted Tribe
I'm finding the text block with an overall left-to-right gradient surprisingly hard to read. Continuing from the end of one line to the beginning of the next takes more effort than it should. I'm guessing it's the abrupt change in color.

I've found the gradient text trend to be interesting for titles and single lines, but I don't think it works for multi-line text.
Why does anything send referrer headers anymore?
Markets are absolutely nothing like fundamental physical forces like gravity.

Read David Greaber.
What about the sophisticated ones that say, "listen to all or of options as out menu has recently changed." When you call back two years later the message is exactly the same. Why don't they make call handling software that has the menu items assigned to random numbers so that the menu is always different?
https://en.m.wikipedia.org/wiki/List_of_automobile_manufactu...
I suppose they could do this even with ports - they could have small adds pop up in the corners, overlaying whatever is playing. They could charge $5 a month to disable the ads.
I use an Elgato Wave:3 and AirPod Pros. Great combo.
Why would they? In the US at least, there is pressure at a social level to have an iPhone. My friend group clowns me on a regular basis for having an android and my green bubbles. What other business has that kind of pressure on anyone, especially teens and young adults?
You could say that the lowest common denominator of both of these methods is that, in both of them, there is an equation: you are either optimizing the equation, or part of the equation being optimized. You are absolutely being treated like a number on Tinder, after all.

But you can choose the system that gets you what you want, faster.

So, in choosing the lesser of two evils, choose the bar. Choose anything other than Tinder. Because pretty much any dating alternative to Tinder is better than Tinder.
Ask HN: Added to mailing lists without consent recently?
Is it just me or has there been a recent uptick in the number of companies starting up mailing lists and adding me to them when I never agreed to receive marketing material from them?
First, people have fundamental drives that can override logical reason. Gift cards probably aren't your button. Maybe your buttons aren't even ones that are easily poked at by e-mail, I dunno. But EVERYONE has buttons somewhere that make them exploitable, and a lot of them ARE e-mail accessible... maybe as easy as offering free money, which is a pretty common one, and it's why marketers have been obsessed with it for ages.

Another factor is that a lot of people have jobs where they're really busy and deal with a lot of e-mail from people with all kinds of bizarre communication styles. Catch one of them with the right e-mail on the right day, and you'll get a careless click.

Black hats get to try every day across lots of people, and they only need it to work one time against one person to score.
I'm reminded of PG's "How To Write Usefully":

> Should you explicitly forestall likely misinterpretations? Yes, if they're misinterpretations a reasonably smart and well-intentioned person might make. In fact it's sometimes better to say something slightly misleading and then add the correction than to try to get an idea right in one shot. That can be more efficient, and can also model the way such an idea would be discovered.

> But I don't think you should explicitly forestall intentional misinterpretations in the body of an essay. An essay is a place to meet honest readers. You don't want to spoil your house by putting bars on the windows to protect against dishonest ones. The place to protect against intentional misinterpretations is in end-notes. But don't think you can predict them all. People are as ingenious at misrepresenting you when you say something they don't want to hear as they are at coming up with rationalizations for things they want to do but know they shouldn't. I suspect it's the same skill.

http://www.paulgraham.com/useful.html
Now try sending that money overseas. Depending on the countries and currencies involved you may be in for a world of pain (personal experience). It's great if you don't have that problem, but once you do you start to really see how arcane, bloated, and inefficient the current systems are.
Comments on the White House report on the climate implications of crypto mining
Every concrete prediction Gary has made has been falsified. All of his others are insufficiently precise to be falsified.

His GPT-2 examples were thoroughly defeated by GPT-3. Horse riding astronaut is solved. Neural knowledge graphs are a successful thing now. Compositionality isn't solved, but progress is clearly being made.

If he was a serious person, this post could have been a few sentences: "No neural network will achieve <x> score on <y> metric on the Winoground dataset within the next <n> years". Simple, concrete, falsifiable. He has not done this, and one has to wonder why.
Uber suffers computer system breach, alerts authorities
In general a lot of products have not been pulling their weight and have been subsidised by other products. YouTubers have not been able to make a living off video ads for a while so they do in video promotions, external fund raising, getting paid to promote crypto scams, etc.

YouTube may want to fix things so content creators can just put out good content and get paid properly through the platform.
Indeed Many members in the Slack channel reported that they came to APISIX because its feature-rich, check its README, please: https://github.com/apache/apisix
For someone who claims to have worked in big corporations and accuses others of not having worked in them, you sure are optimistic about the capabilities of the average user. Not every company is Google.

For starters, how do you register the Yubikey? On Okta, this is a multi-step process with at least one non-obvious step, and one easy way to screw it up.
Porsche Goes Glamping: Iconic Automaker Launches Rooftop Tent
I have an Nvidia Shield and the latest Apple TV for media playback. These pair with a pretty expensive home 7.1.2 theatre system.

I’ve made my peace with software upscaling of video to match resolution/frame rate. At least the Apple TV does it pretty well. If you don’t you get a really annoying flicker as the display changes resolution. The shield on the other hand has really bad up scaling by comparison, particularly with frame rates so I just leave it on.

Far more important in my book is properly sending the raw audio out. I have a very expensive audio unit that will do a far better job upmixing the sound. Unfortunately the Apple TV doesn’t let me send the raw audio out.
Um, how do you use it? I've tried like five times and I keep bouncing off the project.
These are all symptoms of intentional ongoing choices not causes.
I'm not proposing anything, and I think these are hard problems. Potentially there are solutions to some of the things you say, but ultimately it's hard to escape the choice between trusting some entity and being able to lose your keys.
> being super defensive to avoid the most uncharitable possible reading.

Had my eyes opened recently by just how wild people can get with their inferences. Defense is impossible when you're asserting X, but also have to explicitly assert the entire universe of not-X.
Ask HN: Adobe-Figma acquisition–Why angry at Adobe and not at Figma for selling?
I understand why people hate Adobe in this case. Adobe is right up there with Oracle in terms of user-hostility and corporate greed.

But I don't understand why people don't bash at Figma for agreeing to the sale. It's not like they had no choice. They received a fat offer and decided to take it, knowing (like many of us) that their product will be screwed by Adobe.