skysight-inc/HackerNews huggingface dataset:
I think I'm mostly confused about academia really. I get it, it's a nice and easy format to quickly share one's thoughts, so masses are there. Now people who need to speak to the masses (celebrities, politicians) are also there. But academia should be different as I though. Post like this one seem to be rather belonging to a mailing list or a specialised blog or whatever good format that were invented on the internet. Instead it is composed as a series of linked SMS-sized messages on a walled-garden type of platform.
and exactly once delivery, and exactly once delivery.
I use an nVidia Shield and a TV as a dumb one. It was really good until Google decided all Android TV devices would have to use their bad UI with their homepage full of ads.
If it's true spam (no dmarc or spf even) then they just have software guessing every possible combination of characters in an email. They do not need an address.
Still, overall better than the situation of having to install a plugin that may or may not be available or working fully on your system. Plus security concerns of running sometimes obscure binaries on your system to access web content.
I could explain
but it would take
way too many comments
Gemini and Gopher seem to be quite different from the intention of the small web. One is a retro-computing thing, the other is a mission to focus on people rather than organizations
Any idea what the actual details are?
I've just logged in to my account and had to "claim my offer" this then said I'd get an email from yubico.
I just want to know the prices and what the limitations / difference to standard yubi keys are if there are any.
Because you're only storing the invalidated tokens and you're only storing them for the length of the token's lifetime (expire the redis key when the JWT expires)

So instead of storing all session tokens indefinitely, you only store invalidated tokens for a short period of time.
Looking at the comments of the people who hate MrBeast, I suspect a large amount of them do disagree with compensated labour. It's like MrBeast has become an avatar for capitalism in people's minds.
And yet broadcast TV has existed for decades, supported entirely by ads, with no tracking or spyware involved, and with nothing restricting our ability to fast-forward through commercials.
That seems like a stretch

Mobile stations are usually very well prepared for power redundancy
I mean, the more complex the world become, the worse our choices are in free market, since we don't see the long term consequences of some decisions. For instance, getting a streaming-service subscription is convenient for the consumer, but in practice it seems like making a customer binary (either on board or out) has made content more a race-to-the-bottom.

In the end, I think that gatekeeping of some kind can increase both quality and the tastes of the average consumer. The fact that it's hard has led us to abandon it completely though, similarly to how people say now "the government can't make anything".

I also know that I'm a weak creature, and could use some external help to not deliver me constant temptations. If you see content as food for your mind, I find it easy to binge junk, only to be left with a feeling of emptiness after a while.
If you are using a cookie and managing the session expiration on the server, you can kill it anytime.
They clearly didn't have even a basic one, considering the racist word. Implementing one may be relatively ineffective because if you get blocked you just change up the word by adding spaces, characters, unicode, etc. Clbuttic scenario problem.
I don't want to run a web browser to run a desktop app. I don't care how useful it is to run JS and HTML from a dev standpoint it's an absolutely absurdity that my desktop app has a CORS vulnerability.
Well, clearly it should have an accompanying mobile phone app. Those are clearly going to stand the test of time and be picked up by generations to come for pure enjoyment.

Sarcasm aside, this is the fundamental issue of software enhanced or required real world objects. Ten years ago the words "get the app" on some thingy-wazoo in a store basically screamed "won't work in about 4 years". I don't see how IoT will ever really take off without some form of stabilized long term interfaces, and you'd think basic IoT interfaces and support would have coalesced but... no.

Now that I have a kid, I look at toys in the amount of years they can provide fun, constructive or otherwise, and reflect on the toys I used to have. Legos, hot wheels cars, and stuffed animals are basically the top three. Everything else is basically junk.
The hands throw me off. The same with the cat holding the remote... never thought that hands on animals would be able to trigger my uncanny valley response, but here we are
The overwhelming majority of JWTs have an expires field. That's not the issue.

The idea is that you have a disgruntled employee with a token that expires in 5-10 minutes. You don't have invalidation checks, so what damage can that employee do in 5-10 minutes? Keep in mind for many companies, exporting a client list is a big deal.

Why would you not have validation checks? The point of a JWT is they're stateless. When you get one, if you have the key, you can validate it without access to the auth service.

If you take your JWT, and then are using the claims to check the database, it is 100% functionally the same as a session token.

JWTs are not something you issue to use on your own service. It's for another service to verify the user on their service based on a factor coming from your service.(yes i'm aware there are other uses)

If the only thing in your payload is a session_id or a user_id. Stop using JWTs.
However much money your imagined society gives out people will still gladly do game shows for extra cash. Unless you want to be honest and say no one should have even a single extra penny to spend how they please
I think they are trying to point out that a "session ID" is typically a key into session data stored on the server side, where the token is usually not just a key, but all the session data stored client side. With signing and other mitigations intended to keep that from being dangerous.

>Why were sessions inadequate

I suspect there are more reasons, but one is likely CORS and the tendency for the auth infra to be separate from the app infra.
I used to drink heaps of coffee - a mug or two before work, two or three takeaway cups from the amazing 'Algerian Coffee Stores' on Dean Street, Soho. And then a filter or two in the afternoon.

Then one day I had a panic attack, not a terrible one, but I felt pretty shocking. The next morning I had my coffee, and the panic came back. Every time I drank coffee I felt the same.

I lusted after coffee, I had blinding headaches and would wake up thinking about coffee for a month or two. Even knowing what it would do to me, my body was desperate for it.

After about 6 months I could handle one small coffee again without panic, and now I can have two or three a day without issue - I've not tried pushing it further, but some days when I'm stressed, even a second coffee will leave me feeling a little overwhelmed.
I was significantly creeped out that my state was issuing COVID passports with JWT.

Especially when I signed the opt out form requesting to not be placed on the database.

Especially 2.0, when I called the database, and was told that my records could not be deleted.
Hydrogen is not an energy source as such. You have to use energy to make it, incurring losses, then incur still more losses when you burn it.

It is, at best, an energy storage mechanism, not a source.
JWTs aren't even hard to argue against in terms of logic. What is hard to argue against are developers whose theology includes JWT.
Regulators and the resulting internal legal & compliance folks sometimes create some really perverse incentives. Mostly they are in the business of telling people what NOT to do. Rarely can you get them to approve in writing a course of action of what TO DO. A lot of "just asking questions" vibes.

I once worked on a phone app which would give internal users the ability to make certain transactions while away from the desk. It was the mobile version of something they had on their work PC.

Compliance's concern was it could be used while overseas where subject to other regulators. It was pointed out to compliance that these same users were using these same phones to make voice calls to execute the same transactions, for decades.

Having to enter the information in electronically rather than over a phone call is demonstrably better from a record keeping & being compliant perspective. It turned into a case of bringing existing practices more "into the light" was actually considered worse than the status quo.
I suppose, but generally the solution is a refresh token with the JWT having a very short expiry to the point where adding a timestamp would be superfluous.

IMO the only flexible way is a denylist of tokens or JTI which adds the burden of more infrastructure.

My take is to use an opaque token unless you are using OAuth and paying someone else for all these extra capabilities, at which point things become easy.

ex. If you are using Firebase Auth or Auth0, they manage the token revocation for you so the problem sort of melts away and you are left with only benefits of JWT. Just have to blacklist the JTI claim and it'll automatically be denied in the future.
To answer this, I'd need to see the header to the email, excluding your actual email address of course. The header would allow me to see the context surrounding it, which might offer some insight. Otherwise, who knows. They might have just sent spam to millions of generated addresses, and tracked the ones that didn't bounce.
Love it. This reminds me somewhat of a similar issue I saw in 2012, where Cheezburger.com went down over Thanksgiving weekend because we had no deploys for more than 80 hours, and an accidental per-server cache filled up in about that much time. https://jacob.jkrall.net/turkey-day-down-time
The "vulnerability" apparently was depending on a IP block on a systems, and having many accounts with 'pizza123' as the password.
I'm sorry. I missed that. Can you please tell me again?
Agreed, and those "get to it later" aspects are a good tease that there really is more going on. Hiding them isn't necessarily better.
Agree. I'll rethink this. Thanks! :)
> Yes, Every single byte (No mp3's, its all opus) opus with a bitrate of 16 for audiobook/podcast (thank god for those, I can have an entire library of a podcast and its less than a gigabyte. Stick to less than 720p for videos.

If you're... ahem... sailing the seas, it can be easier to find 1080p h.265 copies at 1.5-2.5GB/each than it can be to find 720p or lower compressed with a high-efficiency, high-quality codec like that. The 480p or 720p rips available may well be larger than the 1080p version.

The quality on those h.265 rips isn't even terrible. Better than Netflix's 1080p streams (which is damning with faint praise, since those are WTF bad, but still, it's pretty incredible how decent they can be in such a small file size).
If you get accused of Rape and get a trial, it costs $25000 for the lawyer. A lawyer quoted me that when I asked, post-lynching, when I finally got counsel like 11 years later. That's the price! Guess the price of college has been going up a bit fast! And by the way, financial aid won't cover that. Lawrence Lessig put it best when I asked him to help me lawyer up, "it's a rich kid school." Although in that case it's no better, there's extortion, feminist professors with hundred million dollar diamonds hidden in their house they covetously look at. Billionaires kid? You don't want this hitting the papers right? And like they specialize in getting the billionaire father to doubt his son. They got my father doubting me screaming why did you harass her and I told him a tiny bit of the evidence to get him to stop threatening me. And he instantly went and told the dean, which meant I couldn't tell my own father any of the disgusting wanton slut evidence I had way too much of.

Yeah there's lots of street fights here. So one way of communicating it is I used to wear flip flops but after two aggressions (one of them rape extortion) I hate myself for having backed down on--strictly because I was wearing flip-flops--I never wore flip-flops again. I like running shoes, those are much better. Dude never wear uncomfortable shoes not even to meet the President of Russia. Suit yeah but with sneakers. Of course! Once you get whacked, you never go back!
thanks! will try there
Can't think of a thing with a better benefit to cost ratio for a than providing school children a free meal. It's very cheap and it sucks very much if isn't done.

This applies on society, government, municipality, village, family - so many levels.
Because you can use another service where you pay in money instead of attention like Apple products and services. Let’s not pretend like there aren’t many other alternatives
The one thing that I appreciate over a real concert versus a recording, is attention. At a concert, I'm forced to close my phone, sit up, and pay attention. There is nothing else there to do, so I do.

At home, I don't last 5 minutes listening to a recording. I'll pick up a book, my kids will walk in, and before you know it we'll have Netflix on.

Come to think about it. There are surprisingly few concerts on Netflix. Seems like an easy niche to fill.
A chrome process normally takes up about 100-200MB RAM. Are you running 8GB/200MB=40+ different electron apps at once?
> typically people pay for things that they want to see continue existing

That makes things even easier. I don't really want surveillance capitalism corporations like Google to keep existing. Therefore I won't pay them for anything, not even with my attention. "Minimally just" has nothing to do with it. Any data they have on me, they took despite my best efforts to deny them. If creators can't make it work without exposing me to this evil, that's OK too. It was never meant to be.

> signed up for their Patreon

Yeah, I think this is the way to go for creators. They get paid before they create for the act of creating. This is the only thing that makes sense in the 21st century. Outdated stuff like ads and copyright needs to go, if they refuse we'll force them out with amazing world changing technology like uBlock Origin, Sponsor Block, Ad Nauseam and the almighty ability to copy that every computer inherently possesses.
> Now it's really hard to argue with architects / developers why cookie authentication / bearer token makes more sense than JWTs.

Because that's a nonsensical argument? JWT is just a token + validation. Nothing more. You can use JWTs in cookie authentication, you can use them as bearer tokens. The only thing JWTs are doing is carrying a payload and signing it.

Now, if you want to talk about Oath2 or OIDC then maybe there's a different argument to be had.
This is an underrated comment by someone who clearly understands what it is like in these large banks.

I've spent 20+ years with various banks and it is obvious when i read comments about "banks" those writing have near-zero experience.

Expanding on the change control for just a second.

Imagine that one arm of the bank (Say ATM's) only releases updates once per year and so they can spend days filling out the CR's, chasing approvals, etc.

Their change is also very visible outside the bank and needs to be carefully vetted. They then create "processes and controls" around this.

Now, imagine working for "Capital Markets" where you need to update your system constantly to stay competitive, but also have the banks change process enforced on you?

You need change management, but the banks processes are overwhelming and inflexible...

This "one size does not fit all" pattern is very common in Banks (i would imagine in any large org?).
If the password is changed then the encryption on the JWT is no longer valid though. So it is unusable at that point.
A lot of people saying it's over for traditional movie-making - lmao. I look at these and see nothing but uncanny valley artifacts, and I don't think it will improve much from here.

It's like self-driving cars. They use almost very effective statistical models, certainly better than our previous models, but they never seem to shake off that "almost" and become truly effective.
Sorry for getting out of topic somewhat, But how many users would benefit if Mozilla gives many more ways to install extensions from unfederated source? That sounds like browser malware disaster from 2010s to me
Indeed - it's not hard from a research point of view - it's hard from a compute perspective because adding one more dimension requires hundreds of times more compute.

Even then, these videos are only like 50 frames long - and a real movie you would want to be hundreds of thousands of frames long.
I mentioned The Economist. I think The New York Times is pretty decent as well. For technology news, I don't think there's a single magazine source though Technology Review isn't bad for a broader view. I'm not sure there are any good business magazines these days though some sites are better than others. Individual columnists and newsletters like Levine.
Agree with you. It turned into an "everybody can start a business" magazine to appeal to more readers. In the process, it lost it's luster.
const fights = await db.fights.get({ cardId: 9, titleFight: true });

translates to

select * from fights where cardId = 9 and titleFight = 1;

Confession: something about ORMs has never clicked with me.. none of them ever seem simpler than SQL.
I'm pretty sure some places do have weight divisions for football. I know for certain that one of my wife's cousins had to change to a different nominally-age-based division because he was simply too big for the division he was in. So the fact that these are team sports doesn't completely preclude weight-based or height-based partitioning.
The redis cache with invalidated tokens will be much smaller than storing all sessions.

And you can expire the invalidated keys faster (set the invalidated key expiration to the expiration of the JWT)

Not many people revoke sessions, but a lot of people create sessions. Much more efficient to only store and check revocations. The rest can be stateless.
Oh, I totally was not questioning the legitimacy of the statement - most of my work is not in service of producing software that is sold. My work is instead a mess of bad practice to just get something accomplished for others.

More generally speaking, I wish more people were like this creator - unafraid to just dive in and get stuff done. I have done a little bit of teaching introductory programming and one of the things I emphasized is that "works but is suboptimal along some professional measure" mostly rounds to "works" even in professional settings.

Part of my actual day job is working with non-professional software developers and helping take "non-professional" prototypes to "better" implementations. Having a working prototype is often a much better starting point that a poorly specified set of requirements . . .
You can't heat homes with nuclear, that is the problem - you can't build them close enough to dense cities to make district heating viable due to the accident and terrorism risk.

Yes, you can use nuclear power for electric heating, but well... France shows at the moment why this is a particularly foolish idea, their complete inability to keep their historic NPPs running and the new ones actually built (Flamanville...) is causing a lot of strain on the entire European electricity and even gas market, because German gas peakers now have to compensate for the lack of French NPPs.
Aren't there companies specializing in providing top secret cleared service staff, such as janitors?
> The syntax href="../" specifies that we are referring to a file in the directory containing the current file.

".." navigates to the parent directory of the directory containing the current file.

"." refers to the directory containing the current file.
If you treat the JWT as a random token and check whether it is valid in your central database every time, then yes, it behave like a random token and you can invalidate it very easily (just remove it from the list of valid tokens). But then, why use a JWT instead of a random token?

If you treat like it is supposed to be treated and check the cryptographic signature instead of going to a central database, then you can't invalidate it (at least before it expires). You can ask the client to remove it, but what if they don't? (eg. they are an attacker)
I just watched the Brandi Carlisle live IMAX show last night and it changed some of my opinions on this. Incredible sound quality better than any concert I’ve been to, and a live experience surrounded by other people.
PostgreSQL 15 RC 1 Released
I think the killer app for FHE is an Ethereum-esque Globally distributed VM (yes eye-roll I hate Crypto/Blockchain nonsense as well). To me that was always the big interesting concept behind Ethereum, running some sort of code with persistent state. Obviously no free lunches so we gotta pay for that somehow to incentivize people to pay for power on computing equipment they aren't personally utilizing. But somehow "crypto" got caught on the literally first example of a distributed systems correctness: debit/credit of synchronized accounts.

I feel FHE combined with slightly cheaper cost might enable things like community run server-less apps that have user state stored and processed by untrusted nodes with persistent state stored and accessible only by the data-owner. E.g. a simple excel-esque web app which only serves the UI while State and calculations are running on this hypothetical system at no cost to the apps creator with me paying only for exclusively my usage. They provide the code but no one but me can extract my data and the results of any computations, and for the privilege I pay the system.

I miss the days of upload and forget software that just relies on client resources and so require little upfront investment from developers, I feel FHE plus distributed computing could enable this.

I am aware "Web3" claims to want this future as a concept but the cost and utter lack of confidentiality (I can observe all data to and from a contract as well as the sender/receivers identity) makes it a super-niche borderline useless VM. For distributed governance sure, it's a public ballot box (the preface to the first distributed systems example, a single account with credits), but for any application/user data absolutely unacceptable.
Same here. To disable the logo, press mute 3 times to bring up a secret menu.
> MV2 should be supported even after the shutoff.

You meant the non enterprise shut off? Brave committed to MV2 as long as it's in Chromium.
Throw a session ID in the JWT and do the same thing.

JWT has a freeform payload that can literally be anything you want. Nothing about it prevents you from using a pattern like this.
Just curious because I don't know enough about this stuff - what kind of fingerprint would you be looking for in the header that could tell you whether they knew the address ahead of time?
I can say that I (like many others) have built a thriving career on Clojure. I like to change jobs every couple of years, and I've never yet had any trouble finding a Clojure job I'm excited about (and I only consider well-paid remote jobs with friendly teams with companies doing something I feel good about). The community is mostly active on the Clojurians slack (currently ~24,000 users) and clojureverse.org.

So -- it's a niche for sure, but a very successful niche, and one that many people are very happy in. There aren't a ton of jobs out there relative to, say, Python, but there are also fewer people competing for those jobs, so it works out fine for individuals. It can be tricky to find your first Clojure job, but I think that's true in most languages.

I plan to stick with it for the foreseeable future, because there's no other language that I like nearly as much, or can be nearly as productive in.