skysight-inc/HackerNews huggingface dataset:
> The interface also does not provide access to the private keys ever

There are both statements all over this thread, "the private key is inextricably bound to the device" and "the private key can be backed up". This seems to be an attempt to declare both the problem with theft and the problem with lost devices as solved. Except, they are mutually exclusive: If the key is bound to the device, I can't back it up. If I can back the key up, it can't be bound to the device and can be stolen.

There is one way to get both, which I assume Google is offering here: Have the key inaccessible to the user of the device, but allow some cloud provider access, so it can be automatically backed up to the cloud.

That's all fine and good, but now you're dependent on the cloud provider not playing games with you. And you still have to authenticate to the cloud provider in some way, e.g. to add a new device. (And have to do that in a way that someone who stole your phone couldn't just do the same)

> The other thing to consider is what your threat model is. If you're worried about someone stealing your phone and building a realistic model of your fingerprint or scan of your facial structure, you have to ask what the alternatives are. For example, it'd be a LOT easier for an attacker to use a hidden camera or drone to record you entering your password

You can also view this from a different angle: Phones get lost all the time, sometimes stolen. It's statistically not that unlikely that your phone will get lost at some point and the people who find it may not always have the best intentions.

If a phone is in the wrong hands, it's much easier to gain access to the phone using fingerprints than it is using passwords: There is a good chance some usable fingerprints from you are still on the device cover itself. Sure, an attacker would need some resources to take the fingerprints and build something that can be used with the phone's sensor, but if enough people use fingerprints for auth, attackers will streamline this step quickly.

That's bad enough if it grants "only" access to the phone itself, but now it would also grant the attacker access to each and every online account.

Sure, you could race to deactivate keys - if you remembered to setup alternative login methods before, because otherwise it's you now who cannot login anymore.
Purdue was recently ordered to pay 600 million for their role in getting large swaths of America addicted to Oxy.

Alex Jones just got ordered to pay nearly a billion for playing a character on an online TV show.

Let that sink in.

Love em or hate em, a billion dollars is absurd.
Fair, I was thinking in the context of state/local regs…but you get my point.
The technique works for either
Remote work in general seems like a preposterous idea many folks .. even after being forced to do it, they can't really wrap their head around how it works, or why some people like it
It's like tech debt, you have to clean house once in a while because there is no natural tendency to do so.
Good, so you agree that this is probably not fake?
This will be missed and was a really nice growth hack. The following scenario just worked so well:

- Setting up phone for relatives

- Replacing Android Messages with Signal

- “So this is the App to send and receive SMS, and you can also send me and many others secure and free messages on there”

My optimism for Signal becoming mainstream just faded...
Not necessarily, assuming two nxn matrices are functionally defined as all 0's printing them takes O(n)
What Google's Mobile Ad Monopoly Looks Like, but What's Missing?
I pulled 1M+ apps from the stores and crawled their app-ads.txt to see some trends in programmatic monetization for mobile apps. Maybe it's a bit game heavy but interesting to see what was (and wasn't) there. I'd love to do more like this, so if you have any questions let me know and I can make further reports. Eventually would like to release a small public dash.
When I said other side, I didn't mean the exact other side of OPs view about long covid. I meant the other complete side of the covid spectrum.. aka the anti vaxers.

Maybe I wrote it poorly, technically English is my second language although I've been here for a long time.

My point is, these singular personalized emotional data points exist all over, on both sides of the spectrum. That's all.

Regarding me being coy... Sure, I'm so coy I'm taking probably the most hated position on this site. I suppose I should just open with "As a covid vaccine sceptic, " and have people shut down instantly instead.
To be best, I don't believe this:

> We will however absolutely refuse to use whatever app you ask us to if we’re am not using it already.

First, because there's a first you use every app. Second, because if you do chat with someone without imessage regularly, you'll want to upgrade to something. If you refuse because of tech... you didn't care enough about that person to begin with.
> it was a reverse engineered client which is against Instagrams ToS

...and perfectly legal in many parts of the world.
Gravitational binding at a local level is stronger than the metric expansion of space. In the vast voids between galaxies it has a pronounced effect.
Ah, you're right. I thought it was ironic that you made the same mistake the previous comment did, but that isn't the case. It wasn't clear to me the first time I read your comment.
It seems the client side is baked into browsers rather than being something which leverages a local implementation for key storage.
One of my goals this winter is to clear my head of as much OOP dogma as I comfortably can, fill it with as much DevEx thinking as possible, and read Christopher Alexander, A Pattern Language, from that frame of reference.

My very hot take is that we will start referring to everyone who bought first editions of the Design Patterns book as the Lost Generation, because we have completely misinterpreted Alexander's work, as it could apply to software.
Most people in Europe only replace their phones when they die, get stolen, or lost.

Other than a few lucky ones, we aren't big fans of contracts, replacing phones every two years, we enjoy our pre-paid variants, and only replacing them when it actually is required.

Even when we use it for more than just SMS and calls.
> Now try this

Sure- the auto-refactor won't work here, only the typecheck, and that's the desired behavior in this case because the intended use of 'a' is not necessarily known at that point in the code. Which is the point you're making I guess, though I have to say, in practice this is an unusual case that I never really see; usually if I'm creating an enum-string it's directly in a function call, typed object literal, etc.

> as far as the type system is concerned, enums are more than simple strings

enum MyEnum {
Foo,
Bar
}

function test(val: MyEnum) {
return val;
}

test(MyEnum.Foo)
test('Foo')

I was surprised to find you were right about this; I expected the above to pass checks, but it doesn't. TypeScript actually does treat the enum as more than just its underlying value. So that's interesting- and that's the first reason I've really seen to use these

But I think I still prefer plain values, for myself. There's just something that feels right and pure about using plain JSON-like JavaScript values, and then overlaying types on top of them that have no effect on their behavior and don't obscure their underlying representation. You know exactly what you've got, it's maximally duck-typeable, it's unchanged when it gets (de)serialized, it all just feels better to me
UBI is generally thought of as a solution to rising AI. The taxes would come from the corporations generating income from AI and redistributed towards the people, in a sort of "fake" market economy, because the alternative is that the rich own all assets and their economy grinds to a halt because consumers don't have money to buy the corporations' goods anymore, which also causes the corporations to fail too.
> It is a rare case of restless legs syndrome that is severe enough to make the risk of prison time or the sex-offender registry look like a reasonable tradeoff.

While I understand the rest of the article, as someone who has been through opioid-withdrawal induced RLS a few times in my life, this is really downplaying how horrible it is.

The RLS alone would stop me from sleeping for a week or more. You lose your mind. It’s horrific. I can understand why someone with a severe case might be willing to take that risk — though from the sounds of it, a lot of prescribers aren’t explaining that risk to their patients.

As an aside, for those who are unaware, RLS is induced by opioid withdrawal because chronic opioid use disorder/abuse down-regulates your dopamine receptors. Our dopamine pathways have wide reaching effects within our bodies and minds.
Not in most European or African countries, majority is on pre-paid, and phones only get replaced when there is an actual reason, not that two years have gone by.
I agree entirely -- so long as the intent is entirely performance-based and not as an attempt to short-change the employee, the employer can be justified in parting ways.

However, this entire conundrum points to a flaw in the vesting structure. The one-year cliff might be better composed of a series of smaller monthly vesting events that begin slowly at 9 months, grow to a peak at 12 months and settle down to monthly vesting at month 15.
> Canadian cases that have nothing to do with American laws

Do a search or watch LibsOfTikTok to see what's happening in the USA.

> I don't think displaying a picture of your family is "a lead-in to a forbidden topic".

It is if you're hoping to be asked about it. Watch the LoTT videos. Some of those teachers say they're just waiting for their kids to ask about anything queer-adjacent.

> We should let them do the job for which they studied and were hired.

Many parents are/were teachers and have equivalent education. They agree that schools bypassing parental safeguarding rules is unacceptable.

> How do you feel when people who know nothing about your industry tell you how to do your job?

Lol, you've met my manager I take it? But I actually like it though because I'm a consultant at heart and explaining and guiding is more important than pedantically providing what I was asked for. If the teachers were willing to explain their PoV maybe the parents would support their teaching but secrets can't be accepted.

> They are the experts in teaching, we should let them teach.

They're experts in phalloplasties and puberty blockers which is why we should give them secret and unfettered access to children?

The same people who want trans-identified male athletes in female sports and washrooms are saying exactly the same thing about child surgical transition, "All the science supports this". It's pretty hard to take them seriously when they say William Thomas has no advantage against female swimmers since he changed his name to Lia or that chemo drugs produce a perfectly reversible delay in puberty.
It’s still a small enough team that I’d collect my thoughts and discuss the issues with everyone in a meeting
Juxtaposed with news of huge layoffs from meta, Amazon and Intel, this headline feels like something from The Onion.

Alas our prime minister seems determined to outdo the US when it comes to recession. "Hold my beer..."
As they say, great power comes with great responsibility.

Fortunately, we already have systems of mandatory education in place. Just add Responsible Energy Use 101 to the curriculum.
I’ve upgraded a large application all the way from 5.2 to 9. It does take a long while, but is well worth it in the end.

They provide an upgrade guide which is pretty comprehensive.

Im not saying it’s simple, but it certainly wasn’t as bad as I imagined it would be.

Good luck getting through it!
This article goes through a bunch of ways to get both biased and unbiased random numbers by using a variety of methods, some of which use division: https://www.pcg-random.org/posts/bounded-rands.html

Those examples are all relatively low-level. Many high-level languages provide a floating point interface on top of such an underlying integer pseudo randomness algorithm. This is the reason why much high-level code use multiplication to get a ranged value.

This post goes into some detail about how the V8 JavaScript engine creates a [0, 1) floating point pseudo random value from its underlying integer pseudo-random algorithm: https://v8.dev/blog/math-random
I think you'd find --- criminal liability aside --- that you'd be on the hook for more than the lifetime earnings of a Starbucks barista and the cost of medical care and a seeing eye dog.
There are too many boring comments that says new technology is a garbage. Let's talk about Fb and MS partnership.

It seems that MS HoloLens targeted customer is going to migrate to Quest Pro. Will HoloLens sunsetting, or just a new target platform (like MacIE)? I heard that Fb hired many engineers worked on HoloLens, so MS no longer able to develop HoloLens 3?
I don't think this is possible. The browser doesn't allow other backends for key storage.
You misunderstood my argument. My argument is that if forced to use Rust (given, say, a tectonic shift in the coding world where Rust becomes dominant - something many people are clamoring for), most average developers would have a difficult time writing secure code, because they'll have to keep a higher level of complexity in mind. Productivity is irrelevant. This is the classic trap of not being able to measure thing ABC, so you measure thing XYZ and assume that it's the same.

TL;DR: Let's see what happens when average C programers are forced to use Rust. Will their code be more secure? I see no convincing arguments one way or the other. Only measuring XYZs.
oh damn, that's worse than i thought it was.
It depends a lot how strong/leaky the abstraction layer is. For example nodejs and PHP are less leaky then the abstraction layers (frameworks) applied on top of them. So the more layers of frameworks stacked on top the faster it is to get a working demo, but the harder it will be to maintain.
> Most of the world has some amount of socialism mixed in.

Why do people keep misusing the definition of socialism. Do workers own the means of production? If not, it's not socialism. Now I'm not a socialist but I'd like the words we use to have meaning so that we all know what we're collectively talking about.

Social benefits and social democracy != socialism, people should just use that term instead.
The copyright law in many countries contains a specific interoperability exception that explicitly allows such cases to enable "information exchange".

"Courts have recognised that reverse-engineering is important for public benefit and to encourage inventors and businesses thereby maintaining healthy competition in the market".[0]

[0] https://lexinsight.wordpress.com/2020/06/08/achieving-intero...
I lost my sense of smell and taste which was really upsetting, but got it back in about 11 days. No lingering issues either.
Wow this could be incredibly useful for a lot of applications. I’m excited to see the new wave of tools this could spawn.
I would like to propose that if your organization has trouble making root cause analysis into usefully actionable information, that their codebase is also a mess. Because at the end of the day I think the same skills at looking at the interface of human and process are required for successful decomposition of logic to soften the interface between human and technology.
Ultimate Online was a weird thing for me. I never played it, or EverQuest. I never had a good rig. Back then I had this dilapidated compaq presario with windows 93 that I would play shareware cdrom games on- we lived in a swamp in rural Michigan. Internet was only a thing if you were lucky. I would get pc gamer from the local grocery store and I would fantasize about playing these games on the internet. Print was my only portal to the world of the internet. Eventually I made friends with people who had it though.

I don’t even like video games anymore but back then it seemed like a whole new world. Now it seems like the butt end of a joke. However, I am no longer a teenager.
As others noted, Meta is misleading here calling an alternative client a "clone", and the site accepts this naming, but HN shouldn't.
Looks like the URL for this post should be this instead: https://dheatattack.com/
You can't sync between yubikeys so not sure what that would add to the mix.
15th phone in total, would be fairly average for someone who has had mobile phones for 30 years. I suspect that's what the GP meant. Smartphone adoption is still not anywhere universal and many, many, are still on their first smart phone since a few years back.
Make sure that you terminate early employees on good terms. Have a termination agreement in place so if investors or employees reach out, you would have neutral or positive feedback. Make sure your termination agreement follows the law and is not ones sided, (or it would not have any effect as such agreements are not enforceable). Make sure that your HR and HR only can provide feedback regarding that employee. Oh, you don’t have HR? You probably done a lot of things that are illegal and opened yourself to lawsuits. Have you been paying him market salary? If you’ve been paying sub-market salary don’t even think going after the stock.
Correction (you probably know this but for the rest): it's "inetd" not "initd".
can the employee be terminated but part of that termination package is the assurance of his vesting at the right time soon?

in this case he's now a headache to keep around
> I'm not really familiar with the larger issue, but the scaling method is easy as long as you have an easy way of producing a uniformly distributed random value between 0 and 1. That's not so easy to do

It's plenty easy to do. Start with 1.0 then fill the mantissa with random bits. For a flat distribution subtract 1.0. For an "every float is possible" distribution count the leading 0 bits in another chunk of random, and subtract count+1 from the exponent.

You'd probably want the former for a situation like this.
Well, Microsoft did invest over 1 billion into OpenAI.
This is zsh specific, but here's something I've been burned by enough times that I specifically wanted to mention it: save your history in a file other than the default one. Why? Because if you increase the history limit, and your profile isn't sourced for any reason, the shell will read your history file and use the default history size, clobbering everything that's there. If you use a non-default history file this rogue shell (missing your settings) will dump its history into the default file and leave your custom file untouched.
If I give you a million dollar and then steal it back a day later, I feel like you should not pay taxes on it.

Same thing if I give you a million dollar, you buy expensive X thing but the seller goes bankrupt and never delivers anything.
The Stack Behind a Production Level Rotating Proxy Service
Background

Proxies API is a rotating proxies API that developers use to fetch hard to scrape data at scale and consistently. We auto-rotate millions of proxy servers, and also handle auto retries, rotate user agent strings, handle cookies, CAPTCHAs behind the scenes.

The Constraints

The service has to scale to millions of URL fetches a day without lagging on speed and should work out of a single API like this.

curl “http://api.proxiesapi.com/?key=API_KEY&url=https://example.com"

The Architecture

The architecture looks somewhat like this.

A more in-depth look at this architecture is provided in this article.

Load balancing & Serving

The whole infrastructure is on Amazon EC2. The load balancer plays a significant role in calling the right service based on just the variables passed and the API KEY that holds some secret information like what pool of servers are assigned for them etc.

Our plans have higher concurrency as customers pay more, so we need to pass them to more reliable, dedicated servers as they have higher concurrency needs.

Luckily amazon elastic load balancer can make this using rules you can set, which look at the URL patterns and direct them to different pools of servers intelligently.

Without this exact combination of facilities, we would not have been able to create it all using a single API call without compromising speed and performance somewhere.

We use Apache if there is a need for HTTP servers. Many of these are super optimized to be able to crawl data concurrently using multiple cores. We will soon write an article on how we can get the most amount of crawling ability out of Apache instances.

Proxy Components

For CGI, we use a combination of Python and even PHP where required.

Memcache is used to monitor and throttle concurrencies gracefully, so some rouge code by one of our clients doesn’t bring down the entire setup.

As I described earlier, most of this throttling happens in the way we route out requests from the load balancer.

We use the Node Js/Puppeteer library extensively as an interface to connect to Browserless docker instances located on multiple servers. Browserless is optimized to run as many ready-to-go instances of Chromium as possible, so there is no lag in loading any of them for our clients.

Database

We use good old MySQL in a Master/Slave configuration to hold user info, cache info, millions of proxy info, quality metrics for each, etc.

Maintenance tools

We have a pool pruner that’s written in Python running as a Cronjob. Uses Scrapy and Scrapyd extensively in making calls, monitoring, benchmarking, and pruning proxies from our database.

We use the Beanstalk library for Queues. We use Datadog for monitoring and PagerDuty for alerts.

The author is the founder of Proxies API, a proxy rotation API service.

This article originally appeared here:https://www.proxiesapi.com/blog/The-Stack-Behind-A-Production-Level-Rotating-Proxy-Service.php
> trying to basically reinvent the workings of an entire programming language and migrate your Ruby apps to these new tools/runtimes/typecheckers/whatever

Facebook is probably the best example of this with PHP and Hack [1]

1. https://en.m.wikipedia.org/wiki/Hack_(programming_language)
You could’ve found out in 5 seconds if you had looked at https://github.com/ziglang/zig but instead you decided to make this useless post
I remember making a website for our guild, I think we were called 'The Immortals?'. There were some big guilds out there, I seem to recall one called FuckTards or something like that...
Surely in this situation a framework is pretty much your only choice?

Trying to do this yourself would be very complex and stop you from writing your actual app?
> That's the conventional wisdom. The rust team's theory was that they could make it work. They did.

They didn't. Does the rust compiler support continuous analysis required by an IDE?

> That's not the case for rust.

Funny. Rust analyzer blog would have us believe that they have their own parser and analyzer.
It is often the case that bookshops and the like are not paying commercial rent. Either the shop-owner owns the building or the actual owner is happy to charge them less than commercial rates.

The building may also be have problems that prevents the owner renting it out to a "full price" tenant.
I will just sit over here nodding along and not making any eye contact with anyone who mentions unit testing frameworks...
What kind of kindergarten did this guy go to?

'In kindergarten, we all learned Gödel’s First Incompleteness Theorem, which given a formal system F, constructs an arithmetical encoding of

G(F) = “This sentence is not provable in F.”'
My Father, the Good Nazi (2013)
Most of the time it’s because you get to live in a city and then also get to drive an hour and go hiking/skiing in the mountains or go to the beach. It isn’t very complicated.
Why younger people are heading straight to TikTok (instead of Google)
https://archive.ph/QzIeu