skysight-inc/HackerNews huggingface dataset:
The common thread in all of these recent attacks (Uber, Twilio, Okta, etc) is the “phishability” of the authentication methods involved. Remote attacks like this only work when you can socially engineer an employee and phish sensitive credentials like a password from them (or a SMS one-time passcode during the MFA step).

What’s head-scratching to me is why tech-forward enterprises haven’t been faster to adopt unphishable forms of authentication like WebAuthn. WebAuthn supports both built-in device biometrics like FaceID/TouchID and external hardware keys (eg YubiKey), which are inherently incapable of being phished — there’s no text-based secret for an attacker to deceive a user into sharing with them.

I’m biased as I run an identity and access management company (stytch.com), but I hope more companies will consider integrating WebAuthn to support unphishable MFA.

Today, WebAuthn introduces some nuances that can discourage a B2C company from supporting it today (e.g. account recovery with lost devices), but it’s a clear win for corporate network/workplace authentication and B2B apps. I believe some of the lack of adoption is due to complexity to build (more complex than traditional MFA) and cost for off-the-shelf solutions (Incumbents like Auth0/Okta require ~$30k annual commitments to let developers use WebAuthn). If you decide to build with Stytch, WebAuthn is included in our pay-as-you-go plan (https://stytch.com/products/webauthn)
Ah yes, the toxicity of "let people be themselves in peace".
Working on (actually just got my v1 up last night) a price monitoring tool for a bunch of local stores. Trying to prove they are price fixing.
The “Flame of the West”? The best hope for the side of light to fight back the hordes of darkness, a.k.a. migrants crossing the border?

But, come on, if they wanted to come up with a LOTR name for an all-seeing eye on top of a tall tower, Barad-dûr is RIGHT THERE.
> No amount of propaganda is going to convince an average west European or American that Russians are good guys who just wanted to protect Russian-speaking people in Ukraine.

It's a tough sell indeed when government-controlled prime-time TV shows in Russia promote genocide: wholesale destruction of Ukraine's civilian infrastructure to deprive them of electricity, heating, food and medicine, to drive 20 million refugees to EU.[1]

[1] https://twitter.com/JuliaDavisNews/status/157049364928437862...
Can someone explain the use of the word "vaccine" here?

My layman's understanding of medical industry is that a vaccine is only useful against a "virus". Has the word "vaccine" turned into a generic word for "medicine" in many cases?

They state "vaccine development strategies" as their motivations, but seem to skip over the idea what the actual definition of a vaccine is, but then allude to it by stating "drug-vaccine conjugation" after already stating (as fact) there is such a thing as "METH vaccine development strategies".

Maybe I am just too much an outsider, but the past 20 years I feel like a vaccine can cure more than it could in the past...
Wanted: A serverless solution to exchange IAM access for access to VPC resources
That's the core problem with Section 230: It was passed by fools who didn't consider that profit enters into things. Advertising is, ultimately, just speech. So what happened was they passed a law worried about users posting offensive forum/blog comments, but it is used to protect companies that serve malicious ads (Google, Microsoft, being absolutely top offenders) for profit, but claim no responsibility because they didn't write the ads.

Any content served to a platform in exchange for any sort of revenue, the platform should be liable for the content of.

Note that there's no meaningful distinction between a "tech company" and an "internet service provider". Google operates Fi and Fiber, Comcast operates email and streaming video services, it's just service providers ultimately, and Section 230 is a giant gaping immunity hole for holding any of them responsible for business decisions they're well aware is malicious.
About 8 years ago I was working with a retailer who had started selling on Amazon.

I don’t know if they still do this, but Amazon would detect if promotions for the products occurred on other sites. Amazon would instruct us to lower the prices to match or risk various penalties. I do not remember the exact penalties, but this article seems right.

Amazon would also detect those prices fast. I always assumed they had their own web crawler that checked for it. I saw some retailers trying to obscure their non-Amazon promotions, to make them less detectable by the crawler. E.g. splitting “Discount” into individual <span>’s

The page is skimpy on details but https://www.amazon.com/gp/help/customer/display.html?nodeId=...

> We constantly compare Amazon's prices to our competitors' prices to make sure that our prices are as low or lower than all relevant competitors
One of the many problems with Airbnb is that a host can tack on crazy requirements and you're blackmailed into doing them for fear of getting ding'd your Airbnb rating.

In a perfect world, there's be some sort of "rights" as a guest where hosts couldn't demand the customer do so much cleaning or at least only make a guest clean if there's no cleaning fee.
Pyramid Scheme Pro Max Plus Ultra 2022 v2.0: Electric Boogaloo
Interesting. I always thought it was an editor. Given it can preview I’m guessing they’re working towards a web editor too.
Great point. People still confuse primary colors and click-and-drag with easy learning.

But here's how everyone understood a computer would work, before they saw anything else:

GREETINGS PROFESSOR FALKEN.

Hello.

HOW ARE YOU FEELING TODAY?
Yeah, but if you have a lump sum of money it's still better to invest everything at once if you plan to hold it for decades. Vanguard has a good paper on that titled "Dollar-cost averaging just means taking risk later". And as you get close to retirement, you need to be mindful about sequence of returns risk.
The story itself is kind of wild in Prop K's case: https://sfstandard.com/politics/san-francisco-housing-todco-...

>“I never imagined that their cloud services or Prime video are more revenue than all the stuff I buy from them,” Elberling said. “I never imagined that to be true.”
Great.

One of my favorite investment strategies is to sell options, so I'll sit back for the decade and collect theta.
Sure but to an external observer it matters, especially if my country is explicitly supporting their cause.
Really? I mean, it's all staged/planned. In his earlier videos, like the electric guitar one, even the spark is fake and edited in.
Arch is great as a hobby, the problems only come up if you also want to use your computer for other hobbies. I installed arch on my laptop back in 2010 and it was a worthwhile learning experience, but these days I use Mint with the Liquorix kernel and it's fantastic for regular desktop usage and gaming.
Those of you who wondered (like me) how the (possibly) copyrighted music might have so easily and seamlessly reached your ears, behold: https://github.com/captbaritone/webamp-music

Also: https://github.com/captbaritone/webamp/blob/master/packages/...
Pay another person to work 40 hours and now you make $9200 instead of $8000. By hiring them you are losing the work you would have gotten for free. As you said there is a limit for how many people are willing to work for free so you shouldn't get rid of the ones willing to work for free.
It doesn't happen very often because odds are you also connected your neighbors and they are drawing enough power to trip one of your breakers.

It does happen though, which is why linemen normally short out any wire they think should be dead before working on it. (or they apply working on live wires rules for wires they think are dead)
one big problem with pickle is that deserialization might fail if the object serialized evolve
Exactly.

You order it from Amazon, you pay Amazon, it's shipped in an Amazon box, and arrives on an Amazon truck, but they aren't liable for anything because you didn't buy it from Amazon.
All I know is that from the various (now former) Twilio employees I’ve met this week who are looking for jobs the company lost some immense talent. There are some absolute gems available if you or your business has openings.
I've faced the same issue regarding buy-in. For some reason, lots of users flat out refuse to use asciidoc. I think this reaction is purely anxiety around having to 1- learn something new (a new language) 2- to do something that most people find unpleasant (writing documentation).

> but it also has a lot of syntactic complexity and idiosyncrasies

I don't think that's true; for basic usage, which is probably 90% of what people use, Markdown and Asciidoc syntax are basically the [0]same (AsciiDoc is also compatible with Markdown's syntax)

For advanced use, Markdown syntax has to be augmented via one of the many "flavors" (i.e. no real advanced features out of the box) and these flavors usually mean typing raw HTML directly in the documentation.

Asciidoc advanced syntax on the other hand is available out of the box for whoever wants to use it, but you don't have to use it.

[0]: https://asciidoc.org/#compare
This is a pretty partisan political piece seizing on a sentence fragment at the end of a press release.

I understand the desire to want to know more here, like, what did Jeff Lawson mean specifically?

Call me crazy, but maybe the right thing to do is not get bent totally out of shape over a press release and instead just ask, "Jeff, what did you mean by an antiracist lens? Could you explain more about that?"
One of my favorite (!?) FBI anecdotes is that one of the cartoonists who was syndicated in the original print version of The Onion, managed to have one of his characters make a joke about bombing the WTC get published the same week a bomb went off in the parking garage. Dumbest luck. He got to have a nice chat with some men in black about that one.

I totally understand why they would need to dot some i's and cross some t's on that one but the bonsai kitten thing is just inane.
That was the point of the second sentence. The trick is getting there.
For a very few milliseconds you were an electrician - they don’t call them Sparky for nothing, after all.
Meritocracy has its issues as well. A lot of people got 200 points from private schools and tutoring that may not be available to a lot of the disenfranchised.
Yes, the story is long. Yes, there are many Russians in Ukraine, especially in the East. Yes, there were some alt-right people in Ukraine, too. No, none of these justifies starting a full-scale war, killing thousands of people.
Just posted a Sneakers story yesterday:

https://news.ycombinator.com/item?id=32858840
Ask HN: Is there a DALL-E or library for image sets?
does anybody here know where or how i can use a set of images to generate an image which represents the average of the set? like if i feed it 100 apples and wanted it to output a unique version of apple?

I do not know what this is called but that's the behavior I would like to implement if anyone knows which language/libraries support this kind of thing could you tell me in the comments please?
The lifting-and-dropping process from transactional stores into analytics stores is usually the first step in analytics data pipelines. This appears to fulfill that initial ingestion step specifically for Google BigQuery. A lot of times these days this ingestion step is ran through some third party service: Fivetran, Stitch, Matillion, etc. Similar to AWS's offerings for Redshift, this looks like Google's "native" ingestion tool for BigQuery.

I'd be curious to know how it handles the wrinkles Fivetran effectively solves (schema drift, logging, general performance) and if it does so at a much cheaper price.
You don’t build a business with real infrastructure without money and a value proposition.

YouTube isn’t a non-profit, and society isn’t entitled to take what they want from it without acknowledging and respecting the terms YouTube makes its infrastructure available. There are other outlets for more “commons”-like tube experiences, notably PeerTube.

The value is in YouTube though, and I know that bothers some people, but it doesn’t bother me. I’m not screwing myself by paying them for a subscription: it’s called trade. They have stuff I want, I have stuff they want. If I value something, I pay for it or trade for it (e.g. Wikipedia, the Internet Archive, all private property by the way, somebody owns their servers too, they’re just a different type of corporation).

I think it is fairly mercenary to take a moral stance against paying money for something that you like. I know that there are people I watch who make their livings through YouTube, some of whom are buying houses or getting married because they’re able to with this income; and for others, it’s just a side gig or a hobby. They’re not getting paid when you Adblock, but they are getting paid for the aggregate views that I and others give them.

If you think our views aren’t un-reconcilable, don’t tell me that I’m being irrational or that I’m “screwing myself” by paying for something I want to see continue to exist simply because I’m not bothered by the idea of people taking profits. If you can’t do that, then take my offer to agree to disagree. I’m not bothered by your outlook, but I don’t share it in common with you.
Yeah, Tyler did an amazing job.
> They could also have just cooked up some ostensibly race-neutral metric that resulted in their desired outcome, […]! The EEOC even offers advice to business owners on how to arrange such a scheme:

>> If certain groups of employees are affected more than other groups, determine if you can adjust your layoff/RIF selection criteria to limit the impact on those groups, while still meeting your business's needs.

>> For example, you decide to lay off the most recently hired employees due to budget constraints. Female employees account for 30% of your workforce and 85% of the employees scheduled for layoff. Determine whether you can adjust your layoff criteria in a way that allows you to meet your financial goals while also reducing the impact on female employees. For example, you might determine whether alternative layoff criteria, such as employees' profitability, productivity or expertise, would enable you to reach the desired financial outcome and result in the layoff of fewer female employees.

That’s nuts. The US government literally suggests companies to cook up fake metrics to achieve desired results.
> Programming BASIC was a lot like programming assembly language in terms of how the GOTO and GOSUB keywords worked.

One of the things many people fail to understand when they criticize GOTO and GOSUB is that it is essentially an expression of what is happening at the hardware level. Modern languages didn't really do away with them. They simply added a layer of abstraction that made it easier to develop reliable software. Unfortunately that abstraction also has overhead, which as problematic when you had a few kilobytes of RAM to work on with early personal computers. I would imagine that it was also problematic on the early multi-user systems that BASIC originated on. It isn't that GOTO is evil. It simply became less necessary for developers to use it in high level languages as technology improved.

Of course, the other thing that made spaghetti code inevitable was the line number based syntax. Until development tools improved, people were basically plopping new statements in random locations because they needed more "space" between existing statements. Yet line numbers were used in early systems since the BASIC REPL also served as a line editor. (At least on personal computers. I'm not sure how it worked on mainframes.)
You can just talk with them to figure out something high impact that they would like to work on.
Would recruit Richard D. James and Max Richter (former FSOL) and maybe Nils Frahm to score it. Floria Sigismondi to direct or at least DP, or Jolie to self direct. Writing team members from For All Mankind and Mr. Robot. Cameos by everyone. Easter eggs by Parker Warner Wright. It's so close to reality already it becomes an ARG pretty fast.
I re-watched Sneakers a few months ago based on comments like this. I didn't really enjoy it when it came out and I didn't enjoy it this time either. Not sure why it doesn't work for me.
Everything new becomes old. Everyone might not like the names Pentium or Celeron now, but in the future we can all not like Intel Processor.

That seems like short-sighted marketing.
And even for the deduction case, the standard deduction is now large enough that I'd be surprised if the percentage of those itemizing deductions vs. taking the standard deduction to be quite low double digits. In fact, I wouldn't be shocked if it were single digits.

IOW, send me my Norwegian-style postcard with the amount I owe, and quit catering to corner cases. (Oh, wait, Intuit's profits probably aren't a corner case, eh?)
That is insane. Firing someone because of their skin colour is racist, by definition. There is no way to present that as somehow “anti-racist”. The adjective “Orwellian” is over-used these days, but this literally is “some are more equal than others”. Up there in terms of hypocrisy with “freedom is slavery”.

Admitting to this in writing is bonkers. I hope they’ll get the hundred lawsuits.
10% per year, not 10%.

6% in 16 years is utterly pathetic.
this is a massive pay cut for anyone working at a growing company. you lose so much potential upside with the stock if you keep “buying in” each quarter/year instead of once at the beginning of a 4 year grant and hoping it goes up.

this looks like a great way for companies to protect themselves from spending too much on employee stock compensation and frame it as a gift of choice
Heart Aerospace unveils new electric aircraft, Air Canada invests
The presenters in Defcon seem like they enjoy what they do, for example.
Ah, so criminals that get busted follow poor practices that lead to them getting busted. Not sure what this has to do with criminals at large, you know, the ones that do stuff like use a safe phone when traveling abroad.
It seems you may be mis-reporting this behavior.

I pay for YouTube Premium, do the steps you describe, and do not see that behavior.

You must be in another browser session that's not signed in to your Premium account. You're in incognito or on second browser. Just sign in to YouTube to fix it.
That is an interesting use case! The solution you propose, could work.

I've also been meaning to add support for webhooks as well, so you could trigger plugin functions by calling an HTTP endpoint. It's a small step from having messages on a queue and triggering webhooks from them.
100%. The common thread in all of these recent attacks (Uber, Twilio, Okta, etc) is the “phishability” of the authentication methods involved -- as you mention, the unphishability of WebAuthn is what makes it particularly compelling.

What’s head-scratching to me is why tech-forward enterprises haven’t been faster to adopt unphishable forms of authentication like WebAuthn. I’m biased as I run an identity and access management company (stytch.com), but I hope more companies will consider integrating WebAuthn to support unphishable MFA.

Today, WebAuthn introduces some nuances that can discourage a B2C company from supporting it today (e.g. account recovery with lost devices), but it’s a clear win for corporate network/workplace authentication and B2B apps. I believe some of the lack of adoption is due to complexity to build (more complex than traditional MFA) and cost for off-the-shelf solutions (Incumbents like Auth0/Okta require ~$30k annual commitments to let developers use WebAuthn). If developers decide to build with Stytch, WebAuthn is included in our pay-as-you-go plan and can be integrated in an afternoon(https://stytch.com/products/webauthn)
But why not hire someone else to do it full time so you have full time + part time.
Yeah, sd-the-script-directory pre-dates sd-the-sed-alternative by about 6 months. It seemed like such a good name at the time :)
Both yes and no, they have smaller ones, but in some cases that's like saying "I'm going to run my 500 acre farm with this lawn tractor". It's big because bombs can be big and it needs lifting capacity. It also works in a variety of environments like water, fire, etc, sometimes they're hitting them with or using fire hoses from them. Tether is for several reasons including not running out of power or not losing connection while you're, you know, diffusing a bomb.
I flagged it because it's political hot air. One can be suspicious of Twilio and want to know more about what Jeff meant without (as my Aussie friends say) "chucking a wobbly".
That's the one.

It's for wrappers around existing CLI tools.

Still feels experimental, but it's a nice idea to get objects from e.g. robocopy without dropping into regex and parsing it yourself.
No, your first sentence presumes that the Kremlin propaganda is truthful. Putin's ambitions have nothing to do with neo-Nazis in Ukraine, as his own writings over many years reveal. It's imperial ambition.

Ukraine was smart not to get rid of Azov. Putin invaded once for made up reasons, no reason to think he won't do it again. Ukraine's understanding of fascist Russia's true self was correct.
enforcing a MSRP is usually illegal though. it's called "manufacturer's suggested retail price" for a reason.
> how is that GDPR compliant, don't ask me

Publishing observations about public handles on a public website, which handles are published publicly by same public website, could fall afoul of the GDPR... how?
Yeah I can see the choices NGINX making being to minimize classes of errors Rust tries to help you with at compile time, which was where a lot of their speed/memory benefits came from. Will be interesting to see the code once they open source it.
Google Compute Engine has a free tier. The developer experience isn't nearly as smooth as Heroku though.
Might be worth pointing out that this is thanks to Sketch publishing specs[0] for their format, making it easy to write importers/exporters for. As far as I know Figma has yet to do this, so anything that reads Figma files is likely reverse engineered and prone to breakage when Figma inevitably changes their undocumented format.

If I were searching for a Figma alternative, its file format being documented would be a priority because otherwise, one is subjecting themselves to some degree of lock-in.

[0]: https://developer.sketch.com/file-format/
>>Why would a tech company be any better at handling data securely? More engineers doesn't mean better security.

True, it is not a necessary relationship.

My assumption is that a company with technological founders and strong engineering contingent has at least a FEW people who have at least encountered issues of digital and network security before - someone who might raise a flag here and there. So, a slightly greater likelihood of some responsible decisions.

But for non-tech companies, the general attitude I've seen is hostility to whatever IT they have, whether outsourced or insourced, as it is a cost center and generally seen as the scapegoat for whatever inconvenience happens related to any tech, and either wholesale ignorance or active misunderstanding of tech issues.

So, when a responsible and knowledgeable engineer brings up the idea of "maybe it isn't a good idea to store all this info, or at least we should get expertise on how to handle it..." it seems that the likelihood of getting an actively hostile response is higher.

That said, there are plenty of sociopathic execs flocking to run tech companies who will even more actively seek to harvest maximum customer data and 'screw 'em if we leak or sell their stuff'.

So, maybe a minimally effective assumption.