skysight-inc/HackerNews huggingface dataset:
This isn't an area I know much about so I'll stay out of the main conversation, but would like to point out that considering you wrote "completely unrelated to privacy" in your first comment, following it with "It is related to privacy, but its not the whole story. Thats what I am trying to say." makes me unsure what your point is or if you actually mean or understand it. Sorry for being blunt.
Airplane.dev raises $32M in Series B funding
Session ID: Server has a list of valid sessions. Compares your session ID to its own list. Have session token? Access granted.

JWT: Server doesn't keep a list. Someone comes with a JWT, which is signed by the server. Server grants access purely on the fact that there is a signed token.

JWTs are useful if you don't want to sync the server-side list of valid session ids (many microservices for example).
Not at all, but imagine having to perform 10.000 multiplications on numbers of 10.000 digits just to encrypt "This is my password".

And that, differently, for each access (write and read) to each cell in the table.

Not what you would say feasible right now.
With deep learning you'll eventually be able to just have a very realistic avatar that looks and sounds like a real person. Might eventually be hard to tell if people are using something like this or not.
> FHE (fully homomorphic encryption) provides quantum-secure computing on encrypted data

Today, if I understand it correctly, that means the encryption can't be broken on a computer with resources < whatever is required to calculate the square root of 16 ;)
Give companies a score to gamify, but then act surprised when it's gamified
https://dilbert.com/strip/2022-09-19
My experience with the open source TV software is that they're all buggy and terrible. I don't really want to be tech support for people in my family complaining the TV doesn't work because the software is janky. I'll just keep the Roku TV software and do some DNS blocking and that will be fine.
From what I hear there are several options, most promising seems to be a combination of some sort of batteries for buffering a few hours at most and Hydrogen for seasonal storage. Googling will probably provide you with several studies on how to do stable grids with 100% renewables, I know I've seen at least two in the past.
> Thinking that "human beings are born worthy of a happy peaceful safe life" is childish - the world doesn't owe us anything, and if we want to continue living on it we have to earn it.

That's just, like, your opinion, man. But, IRL there are plenty of people that require care-taking, who we never expect any labor from.
Not as far, I know here in Europe. Why should they. For sure, they have batterys for one hour or so. But there is no second electric connection, to a diffrent electric grid. Something like that does not really exist, because our electric grid was not planed in mind for a such situation.
I think the most trivial mechanism is to have your own subnet for developers that maybe has fewer restrictions. Not really a DMZ, but perhaps skip deep package inspections. Most tools can be configured to allow self-signed certs, but it is still a lot of hassle, especially for test systems. In exchange the dev subnet should only have restricted access to the rest of the internal network. But lacking convenience here is preferable to not being able to download some dependencies.
Meh, basic auth is a secure mechanism. There are some threats, but they are comparatively low compared to your account being managed by big tech. Didn't take long before I got my first Microsoft account banned because I just didn't want to share my phone number.

I think this is a move to get more people on the MS identity platform. I use that too for corporate stuff. There are advantages here with a corporate infrastructure. But I really think oauth2 will introduce many security issues simply because users (devs) don't know how to handle tokens and because identity providers don't deserve much trust.

No API access for you if you do not register your App at Microsoft. That means you have another key or certificate to babysit.
Cui bono? The argument about "who benefits" is going to go on for quite a while, but I'll agree with you that this doesn't seem to benefit Russia at all. If all actors involved were perfectly rational, Russia would be near the bottom of my list for suspect.

Of course, all actors are not perfectly rational, and Russia is notably irrational at the moment, so I guess they can't be eliminated from the list entirely. Still, I don't consider them the most likely.
The other difference is that anyone can do them. I don't think you could have competitions about things that are at all useful and necessary that are accessible to everyone.
Money is an issue, but not the main one. When "The Message" is more important than anything else, people eventually tune out.

Same thing is happening with Hollywood and that has little to do with money - at least as far as production. "The Message" is more important than solid storytelling so people are checking out.

Seems to me the way out is to get back to basics. Stuff your opinions and indoctrination and just report the facts or tell a good story. Guess these industries will have to totally collapse before they reset back to something more reasonable. Oh well.
N00B wallets: Send NFTs and airdrops to anyone on the internet
> I can guarantee you that most people aren’t buying extra devices to watch TV when the apps they use are built in.

No shit, the reason you jailbreak a tv is to put apps on it that were not built in (or remove apps that are intrusive.) This is just like saying that people who are happy with things aren't unhappy with things.
This is a really misleading article. It skims over lots of practical issues with FHE, such as the cost of the extra work which will severely limit its applicability, and more critically, the necessity to use the same key(!!) to encrypt/decrypt every input and output. It also conflates FHE with quantum-resistant encryption, simply because most FHE algorithms currently use lattice-based math, and a 2006 paper observed that no quantum algorithms were known that could outperform traditional computing for lattice math. Not a very strong claim, imo.

It goes on to grossly overstate the extent to which current IT systems are at risk as well as the extent to which FHE would even address actual IT threats. Plus, anytime anyone claims something is “provably secure”, they are leaving out crucial parts of the system, like the interface with humans or key rotation.

And then there’s the part where the author is a VP of business development at a company that makes FHE hardware. Sigh.
NFTs aren't dead. This CryptoPunk just sold for 3,300 ETH / 4.45 million USD.

https://cryptopunks.app/cryptopunks/details/2924
Supposedly from Thrax (https://archive.ph/JWwmN):

>I am releasing 6,737 employee records from their WordPress database, among other things such as posts (including unpublished drafts), configurations, and more. We were not able to gain access to customer records as these were likely stored in another database. The data includes emails, password hashes for some users (WordPress format), and a few other things. Hell, I think there's some Auth0 shit hidden somewhere if you want to do anything with that.

>The articles are written through a WordPress instance hosted at wp.fastcompany.com - which we found the origin IP of and totally bypassed the HTTP basic auth, leaving us with only WordPress authentication. Thankfully, Fast Company had the ridiculously easy default password of "pizza123" on a dozen accounts, including an administrator account (sorry Amy!), so we got in there really easily. We were able to exfiltrate a BUNCH of sensitive stuff through there - Auth0 tokens, Apple News API keys, Amazon SES secrets (we could literally send email as any @fastcompany.com email with this access), etc. We also found a HTTP basic auth username/password, which happened to work for wp.fastcompany.com, meaning we didn't have to go through hell to access it anymore. We also found a Slack webhook, which we could've used to pull some bullshit, but we didn't want to bother.

>Remember the Auth0 I just talked about earlier? Well, they had an access token in WordPress that allowed us to not only grab the email addresses, usernames, and IPs of a bunch of employees, but also create our own account that we gave admin privileges to two portals: Wonton (wonton.fastcompany.com) and the management portal (manage.fastcompany.com). manage.fastcompany.com was under HTTP auth as well, under the exact same username and password as wp.fastcompany.com (in fact, this site is what the credentials were originally for). Once we logged in with our account (which they still haven't deleted after days, by the way), and basically let us do a fuck ton of funny shit such as push notifications to Apple News users, mess with the site, and much more. Wonton was fairly boring, just listing a bunch of bullshit that they hadn't used since 2020-2021.
It makes sense if the initial startup of an app is expensive, memory is cheap, and creating new windows is fast.
Interesting VR Flight mechanic. What do you think?
I don’t want to think reality is a simulation, but wouldn’t our everyday experience being generated by a neural network be far far simpler to achieve than a universe of infinite minuscule atoms all interacting.. like ozcam’s razor is pointing towards our lives being a realistic dream.

Like in 10 years you could plug this tech into high end VR and get a prompted reality dynamically generated that would be indistinguishable from our own.
I was thinking it would be a good idea to buy an actual encyclopedia on CD or as a download, because then you'd have vetted information, but it seems all of the old encyclopedias either no longer exist, or are online subscription services only.
Good faith-ly asking here: What, if any, are the political arguments against government-provided 3 square meals a day for kids provided by default? Breakfast, lunch, and a little pickup baggie to go home with. The kids who don't need it/don't want it can just opt out of the program, but the floor is everyone gets to eat. I'd gladly pay more taxes even though my children aren't at risk.
Since when were session tokens ever a bottleneck? That's a problem I've never heard of on any scale. Yet again, JWT seems to be trying to solve a non-problem. Session tokens don't even have to be stored indefinitely. If a user isn't active for a period of time (even 30 days let's say) then the session token can be removed. Or, if memory truly was a problem for session tokens (not sure why honestly), transition tokens to storage after x amount of time and bring them back into memory when the user is active again.
U.S. Moscow Embassy security alert warns Americans to leave Russia
Well, it's not about compute power and whether you can run things on-prem.
It's about sharing, synchronizing, and collaborating on data.
That's where PETs open up new opportunities.
In the ideal world this would be a two-line wrapper that just calls cat on the given url
> I don't think it will improve much from here.

Any more specific reason why you feel this way? Curious
Try to build a virtual hallway/watercooler. We use slack for this, and worked very intentionally to encourage people to post what they were working on in their respective channels, and to reflect conversations in slack threads.

This led to the team being able to observe what other people were working on, to occasionally "overhear" something that was relevant to them and hop in.

We also encouraged people who jumped into video conferences to drop the meet in the slack thread so that other people, if it mattered, could hop in. Though not always appropriate (we have plenty of private ish meetings) that makes it easier for remote people to engage in the random happy accidents you get from a physical office.
I feel you on the social elements. I find keeping a tin of breath mints and sharing them creates a similar social atmosphere with friends and colleagues, that shared time to mull over thoughts or chat, similar to a smoke break. Morning walks/runs also create this I find.
A coach airplane seat? Depends on your body type maybe; I've done this with the 14" (and the 16" Intel) multiple times. Just don't set the screen angle such that it'll get caught by anything on the seat in front of you.
And yet, with modern browsers - since firefox - cmd + W closes a tab, cmd + Q closes the browser. So even Windows users don't find it that strange.
I find the layout that browsers use really annoying, and the way HTML and CSS are used to modify the layout very unintuitive. To get something to show up on the screen in the way you want, you have to keep changing lines of code and experimenting until it finally shows up the way you want. This is really annoying and unnecessary.

Tools like PowerPoint and MS Publisher have allowed (for decades) the ability to just drag and drop anything you want onto a screen, save it, then send it to someone, and it will display for them exactly how it displayed for me. Text, pictures, sound, video. And it supports clickable hyperlinks. Which was the entire point of the web! But for some reason, web browsers are 10,000 times more complicated than these other ancient tools.

If we really want to make the web less braindead, less bloaty, easier to use, we should throw away the annoying crap we have now, and start from scratch with something that is just easy for the average person. We don't have to regress to text terminals and Gopher, or just use browsers without JS. We can make something new that is both easy and useful.
Congrats @josevalerio

So rad! I built an experiment a while back to do exactly this (https://onassar.github.io/experiments/boomerang-webhooks)

It's awesome to see this productized. I had the same annoyance: setting up and managing cron jobs.

Good luck with the launch :)
SMS is standard and available on every phone by default. Again people’s personal choices, many of which have alternatives, are not meta’s problem.
> I don't think it will improve much from here

That's a bold prediction. Why do you think that?

The first thing I thought was the exact opposite. This isn't very good, but it's only version 1. Motion pictures are less than 150 years old. In another 150 years I bet virtual filmmaking will progress a lot.
JWT is a token, often stored as a cookie.

This is both true and also misses the point. Session Cookies are ususally stateful. In other words, the server validates the session by querying a service or database. JWTs however are stateless. You don't query a service or database to validate the service. As a consequence if the JWT is not expired and is still using a valid key there is no out of the box way to invalidate the JWT. You can build custom invalidation measures on top of JWT but it's not a natural consequence of the design in the same way that a session cookie is.
Writing and automating a newsletter in Markdown on Mailcoach
"So what" is that pretty much everyone I know, poor or not, would do it. It's $500k for hanging out in a house reading and digging in the garden all day for 100 days and occasionally having kids mess with you. That's not necessarily easy, but it's a hell of a lot easier than the other things I'd have to do to earn $500k in four months.

I think you're getting offended on behalf of other people, when most of the world would think it was a sweet deal. This is just reality TV for people who were born after 2000, except the prize is better, the format is shorter, and it's less cut-throat. Nobody's kidnapped, there are no victims, and "sick games" is a bit of a stretch.
they are very frequently children (teenagers)
What We Know About Monkeypox
Yeah I was worried about bioavailability. I already use ZMA and Vit D, I will check out Thorne. Thanks!
The list of companies where unique emails have leaked either through sale or breach is long...

Adobe, Dropbox, Tumblr, Last.fm, DailyMotion, Abbreviations.com, Filesavr.com, 1and1.com - these are just from the last day or so as I deleted so much spam from before.
> Both a session ID and a token are random strings clients send with requests to indicate who they are. Why were sessions inadequate, and how do tokens solve this problem?

JWT tokens are not random strings. They contain claims about the bearer that are cryptographically signed to prevent the bearer from altering them.

https://jwt.io/introduction
First time I’ve heard “martech” used. Reading these comments, it seems like “martech” consists of email spam and content management systems. Cool, but I don’t see any differentiator between martech and regular old tech that justifies the existence of martech as a term.
Audio quality is about what you'd expect from a lathe cut record. That being said, since it is so hard to get vinyl pressed these days I could see a small run of cut singles being something artists could sell as a novelty for die hard fans. Neat!
I think you can get by with 5gb or so if you're only building for one platform. But if you select Android, iOS, sources, etc it can get big
At least the one that employs the author of this article.
An update on our hosting setup
> nucl... ah no that's bad

The madness factor of nuclear power - safety, waste, availability factor (France!) - aside, nuclear power is economically even worse than brown coal [1, page 8], once you include externalized costs such as teardown, maintenance of the permanent waste dump sites or the insurance that an NPP would need without the taxpayer guarantee.

[1] https://www.bundestag.de/resource/blob/887090/1867659c1d4edc...
Here's one stone: 99 Bottles of beer, in 1500 languages

https://www.99-bottles-of-beer.net
- ETHOnline Finalist

- Polygon — Most Innovative
Cryptographic is all about privacy of data-in-transit and data-at-rest. What you're discussing is peoples lack of understanding of (or appreciation for) threat models, or taking a "countermeasure-first" approach to security/privacy.

To my understanding, FHE is designed for the threat model where you don't trust the machine you're calculating on to know the data you're calculating.

As for the argument that it can spew out garbage results or false data and no one would be the wiser, when the encrypted data is provided by you, it's pretty easy to validate when something isn't correct. 100,000 passes on predictable data outcomes for example.
Most main base stations have diesel generators, not second power grid.
Except for interfaces, record classes, type parameters, class-level annotations and javadoc. There's probably more I'm not thinking of right now.
Was a bit confused that "Category n Hurricane" means exactly cat n, whereas "Magnitude m Earthquake" seems to mean at least magnitude m.
The users password isnt involved with the encryption of JWTs
How is issuing a JWT implicitly mean that they are storing it in a database? Couldn't they have just... not stored the data... but can still validate it?
Nice! I might use this in a side project. I don’t see a license, though. What is it? :)
Free school meals for all kids could simplify a lot of things. Obviously it could be paid for by an income based tax. Nation wide tax makes most sense to me.

It's the cheapest & easy way to help these kids get nutrition. It benefits society more than the cost.

It also prevents the need to waste money on lunch cards, payment systems & some poor lady having to manage & collect payments.
There's nothing actually wrong with session ids in a cookie. It's that JWT was the new hotness and a buzzword. Now there's a lot of cargo culting around them.

JWTs are a signed claim that your service can trust, and use for authorization after just verifying the signature.

A session id, you need to take the id and look up your session in some mechanism on your backend.

JWTs are great for different services saying 'yes, this connection is actually this person, trust them.' Inter-server communication, oauth, etc, are good examples.

Session ids only work for the issuing service. Django sessions, php sessions, etc, are good examples.

One of the biggest problems with JWTs is that a lot of people are ONLY storing a user_id, or a session_id in them. On the server the decode the token and proceed with the standard session_id workflow, still hitting the db.

Invalidation is another thing. You still end up hitting the database, and if the JWT is only ever used by your own service, why bother?

Then there's people just shooting themselves in the foot and not actually signing them and just trusting them without any crypto signatures.
If you do this you get 0 value from using a JWT over a regular session id. It's simpler and likely less work to just not use a JWT in that case.
Our schools serve pretty awful meals here (fairly shitty US state), but it was hard to say no to them when they were free due to Covid policies, and man, just the logistical improvement of not having to worry about having stuff on hand for lunches and getting it put together and packed in the morning and making sure the lunches made it into backpacks and into the car was so damn nice. That's like 25% of the getting-the-kids-around morning stress just gone. Made things way more chill.
I believe GP is referring to user password not the encryption key. Rotating the encryption key would invalidate all previously minted JWTs. A user changing their password would not because it is not used to sign the JWT, therefore the old JWTs would still be valid until expiry after a user changes their password.
I don't think that biggest issue with central auth database is its size.
Led by the US in nominal, absolute terms
They weren't building the first space telescope or particle accelerator in the world either. I'm not quite sure what the thinking behind pulling that one out like a trump card was.

And believing silicon technology process shrinks and new processor designs that take advantage of it is nothing much new betrays an unfortunate misunderstanding of these technologies. Smaller and faster to you looks like your phone or PC get a little cheaper and faster every few years. The technology that enables that is staggering. These push the limits of materials science and chemistry and a bunch of fields of physics relating to electronics and photonics. Designing the chip requires again pushing boundaries in hard problems in computer science and mathematics to model and compile and optimize and verify the logic.

The two most complicated machines ever made are the microprocessors on the silicon chips, and the factories which make them -- a single one of those costs double what it took to build the LHC at CERN, twice the GDP of Somalia. And that does not include all the R&D cost to reach the point they can be built.

The supercomputer required predicting these things years into the future and intercepting that technology. Intel ran into unforeseen delays in these things which derailed the supercomputer. Not all that surprising that such efforts don't always go smoothly. There are 3 companies left which can manufacture high performance chips, and many that have fallen. There are only a handful that can design high performance CPUs and GPUs.
No, that means apple which is a US company tucks its tail between its legs and starts making iPhones in the US for US/europe customers and wherever else it wants if it wants to compete outside of the US. Apple specifically makes most of its iphone profits from the US and it is a mainline product for a trillion dollar company that is taking money out of the US consumer into Chinese economy so it isn't bullshit at all.
Pretty cool!

Some other similar tech for those interested in tools like this:

Zeplo https://www.zeplo.io/

Boomerang https://onassar.github.io/experiments/boomerang-webhooks