skysight-inc/HackerNews huggingface dataset:
> isn't securing this one major IMO attack vector an improvement over not doing anything about it

Unfortunately securing this attack vector is costly - in the sense of annoying the user with prompts and access grants.

This is why even on mobile as you noticed, only browsers require user confirmation before allowing webpages access to the clipboard.

You could maybe do something in between, like not allowing clipboard access to processes which don't have a foreground window visible to the user.

But in practice, this attack vector is not exploited. If you are targeted, it's much more likely that a specific attack against the password manager is used, since it will extract ALL passwords, and not need to wait for one to show up in the clipboard:

> KeeFarce allows for the extraction of KeePass 2.x password database information from memory. The cleartext information, including usernames, passwords, notes and url's are dumped into a CSV file in %AppData%

https://github.com/denandz/KeeFarce
I wonder if the word "Eucharist" was responsible for this word?
Is this related to switching the firmware on the Minitel 2?
The American chip industry’s $1.5T meltdown
Spent the last few months migrating to Vite. The Javascript ecosystem is exhausting and exhilarating all at the same time
The author of Nitter wishes Twitter didn't exist, they created Nitter just to make Twitter slightly more bearable.
Interesting, didn't know that, thanks! :)

In Danish we use the word "Ton" which is 1000 Kg, didn't realized that English has two words for it, didn't realize there's an emperial ton either :D
I see a bunch of corporate talk about how they use captchas but now it is a different type that is less difficult?
The provided link was fun to read (as a German). Personal highlights:

> German employers simply don't know what to make of an Art History major who wants to take a temporary job in an accounting firm before going on to medical school.

I'm still laughing.

I guess actually nobody knows what to make of an Art History major in the first place. That's one of the typical things one would study if your only plan in live is to become "a wife" (OK, today maybe also "a husband"), or when you have absolutely no clue what you want to do and need additional time to orientate.

Also nobody would hire an Art History major to do an accounting job. Never ever!

That's just ridiculous. You need professional training in accounting if you like to do accounting.

And going to medical school after getting an Art History major? Alone the idea is even more ridiculous than the idea that you could do an accounting job with an Art History major… You need almost teen years to become a full medic. Also getting into some of these universities require that you stand in line for quite some time, and have absolute top grades form school. The people that consider going for Art History study aren't the ones that would have any realistic chance to ever attend (a German) medical university.

So alone that sentence above is actually a kind of joke. But that's not everything funny in there.

> They may neither know what the Ivy League is nor know which university is more prestigious than another.

> In Germany, where you went to school is largely irrelevant.

Jop. And that's a big advantage!

Maybe not out of the perspective of some Dartmouth scholars, but most people on this planet agree that the anglo-saxon system for higher education is just complete madness.

The whole Bologna Process BS (which is modeled by the anglo-saxon madness) significantly decreased the quality of German's higher education, and at the same time almost invalidated the achievement of possessing an university diploma. Now everybody can get some "Art History Bachelor" degree, or some crap like that…

I strongly hope that we'll stop that madness at some point before our education finally hits the lows of the anglo-saxon equivalent!

There was a time that a German "Dipl.-Ing." or "Dr." title had some meaning. What you get nowadays with most "master" students are people that would miserably fail at "Vordiplom"… Also, "everybody" and his dog has a "bachelor degree" which makes it actually useless (and made just "regular school" out of university).
They could implement a virtual authenticator, emulating a TPM or security key and running entirely in software. Of course, this nullifies several advantages of FIDO.

Alternatively, and likely a much better option longer term, they'll need operating system support that provides them with APIs to establish trust between authenticators and export passkeys wrapped with keys corresponding to trusted devices, not unlike how these OSs provide APIs for integrating password managers today. A growing number of password manager vendors have joined the FIDO alliance, hopefully to help move this along. Establishing trust between devices in a Sync Fabric is also something that needs careful consideration if not a standard, since it's a huge target for phishing.

In either of these cases Passkeys from different vendors aren't interoperable.
This is a weird take. People get annual flu shots, despite far lower risks of severe flu illness, and have for decades. Not everybody gets them, but if you tell your 40 year old peer group "I'm going to go get a flu shot", none of them are going to bat an eyelash; it's just a thing people do. Do you... not get flu shots? I'm not moralizing it, but like, it seem kind of silly to avoid them. They take like a minute (you get them when you were going to the drug store anyways) and spare several days of work you'd otherwise lose to an extremely annoying illness. Get the COVID shot at the same time, for the same reason.
>For what it's worth, the terminal interface to the Spotlight database is "mdfind".

Yeah I realize that, but find is a stronger tool for the use case because it also allows wildcards to be specified in the name.

>your "find" will search in and below

Your "mdfind" will also search in and below the current directory.

find also has -depth which can be used to tell it to search only this directory.

mdfind has -onlyin to tell it what directory to search in, but it still recurses down. Does it have an option to limit this? Please do tell.

>for files that exactly match "somestring"

Well find also allows wildcards though. So not necessarily exactly… somestring is just an example.

Does mdfind allow wildcards?

Also find is fun to combine with grep to inspect file contents, especially since it has the -print0 option…

find . -type f -name "*.py" -print0 | xargs -0 grep somestring

Please tell me how to do this with mdfind, I would love to know!
I enjoyed programming in the 90s and early 2000s but I feel it’s turning again into tedious grunt work with scrum, agile, yaml configuration files and needlessly complex systems.
Watch the video linked below by psanford

1) How can I share the fingerprint keys between chrome and safari?

You don't need to. That's not how it works. Chrome and Safari and every device will have a different key for the same service (see video)

2) How do I share keys between different types of devices? (mac, ios, android, windows)

You don't. You authenticate and a new key is created on each device, possibly on each piece of software (Firefox, Chrome, Safari, App). To be more clear, when and if you decide to use a service from a new device or new browser you'll be asked if you want to login via passkey. If you have a passkey on another device you can (see video) use that to login from the other device (similar to how google asks viat the gmail app of you were trying to log into some other device or Apple asks across your device). After you authenticate you can then create a new passkey for this device/software you're using. This new passkey is separate from the previous passkey. You effectively have 2 passkeys now, one to login with one device/software, one to with a different device/sofware. (See video)

3) What happens if my devices are gone?

You follow whatever recovery procedures the service has.

4) What happens if I want to change my login (email to a new email for example)?

Unrelated. Your email is not shared with passkey. So login and set a new email

5) Is account recovery handled simply by a reset-email?

That's up to the site/service just like it is without passkey

6) It seems a validation step of the email is missing?

That's up to the service as well. They could require an email but that's unrelated to passkey
I, too, sit corrected -- thank you for the follow-up!
This would shift the inventives back to where they should be for producers.

The old box office/TV rating systems were relatively public. Content producers had clear incentives and knew there was an advantage proportional to viewership.
workspaces as on linux? seems incredibly similar conceptually
To some extent this already happens right? Popular fiction has its own laws for pacing, style of dialogue, tropes, the way characters behave etc. that is highly influenced from the canon of fiction before it and totally different to real life. Readers expect and anticipate this.
You're getting somewhere but still not complete. HDR formats we have today use 10bit or 12bit bit depths so that alone is a big difference. About the metadata, HDR10 uses static metadata meaning whole content will have the same metadata but HDR10+ and Dolby use dynamic metadata.

HDR content "will not" be HDR if you're playing it under Linux. It will however be HDR if you play it under Macos or Windows (keeping everything else like the screen and content same). There is no way around this right now. So in basic terms you will not see the dark blacks and bright whites under Linux.

> Edit - where HDR really is great is photography... You take multiple photos of the same scene with different ISO and shutter settings then stitch them together for more colours than would otherwise be captured. But a screen can either display colours or it can't.

It's the same for video or games really. With HDR you can record and display more details and contrast.

And that HDR photo you just described will not be shown as HDR even if your display supports HDR if viewed under Linux
It's not so simple there. To take it to extremes somebody who had literally perfect hygiene (to the point that he was exposed to 0 unintended bacteria/viruses/etc) would undoubtedly become gravely ill, and very possibly die, once being introduced into society at large.

Our bodies are extremely adaptive. A common example of this would be travel. If you move to an area with looser standards of food handling/preparation, then you're probably going to get sick - and possibly quite sick. Repeatedly. Then eventually your body will get used to it, and you'll find yourself able to comfortably eat just about anything.

So there's going to be some sort of a bell curve. Too much hygiene is bad for you. Too little hygiene is bad for you. There's some sweet spot that optimizes strengthening your body without over stressing it.
Rewriting history in general is pretty dumb that it’s allowed.
Without QM, molecules would behave completely differently and the chair you're sitting on would probably fall apart into a pile of atoms. Everything depends on QM.
Might change later but if you don't want to give them an email address here's a direct link:

https://www.youtube.com/watch?v=NiknNI_0J48
Simple answer is that apparently the examples are false, feeding the above string to the JS parser spits out the following object:

{
"subjevkos": [
{
"prefix": "first name ",
"jevko": {
"subjevkos": [],
"suffix": "John"
}
},
{
"prefix": "\nlast name ",
"jevko": {
"subjevkos": [],
"suffix": "Smith"
}
},
{
"prefix": "\nis alive ",
"jevko": {
"subjevkos": [],
"suffix": "true"
}
},
{
"prefix": "\nage ",
"jevko": {
"subjevkos": [],
"suffix": "27"
}
},
{
"prefix": "\naddress ",
"jevko": {
"subjevkos": [
{
"prefix": "\n street address ",
"jevko": {
"subjevkos": [],
"suffix": "21 2nd Street"
}
}
],
"suffix": "\n"
}
}
],
"suffix": "",
"opener": "[",
"closer": "]",
"escaper": "`"
}

tbh seems like a pita to clean up afterwards
It's interesting to see CI wait times as core engineering metric. I 100% agree, so much so that I'm building a product specifically to speed up CI. We have redesigned how hosted CI works focusing on speed as our north star. We don't have CI wait time - your test starts immediately and we run your tests super fast. How do we do it? We have many workers with your test environment pre-built so we can split your tests and start running your tests in seconds. If anyone is interested you can check it out at https://brisktest.com/, I'd love to hear any feedback from the community.
That’s exactly what I said, “to log in”. They’ve also stated in many places over time their interest to be the holder of keys for these things too, including as a reply to the parent of my comment :).
You should still be able to use alt="" to indicate that it is "decorative" and not meaningful imagery for a visually-impaired user.
That's true in the sense of "that's just how the world works", but it also seems like a really shitty state of affairs - a state that Twitter is actively pushing, for its own benefit and to the detriment of everybody else.
Apple: Je me souviens

User: not really
Sigh? I think the speed improvement is awesome.
Good question!

Jevko itself, defined by the spec, is not the same as a format based on Jevko.

If you use a plain spec-compliant Jevko parser you for this you indeed should have all whitespace included. Although it will look more like this:

{
subjevkos: [
{ prefix: "first name ", jevko: { subjevkos: [Array], suffix: "John" } },
{ prefix: "\nlast name ", jevko: { subjevkos: [Array], suffix: "Smith" } },
{ prefix: "\nis alive ", jevko: { subjevkos: [Array], suffix: "true" } },
{ prefix: "\nage ", jevko: { subjevkos: [Array], suffix: "27" } },
{ prefix: "\naddress ", jevko: { subjevkos: [Array], suffix: "\n" } }
],
suffix: ""
}

Now on top of that you can build a format that specifies what happens to whitespace, etc. Usually you'd want it trimmed if the prefixes mean keys in a map.

The simplest format/library that does just that is this:

* https://github.com/jevko/easyjevko.lua

* https://github.com/jevko/easyjevko.js

That will give you the JSON (or equivalent) that you expect (with autotrimmed keys).
> At least with Christ, I've got a (documented) resurrection to lean on.

From sources hundreds of years later, second or third hand quoting (mostly) illiterate witnesses, with a vested interest in telling a compelling and believable (for the era) narrative. Also, most of the adjacent claims from said sources cannot be proven or similar miracles reproduced, despite claims such events will be common given "faith as small as a mustard seed".
Their tutorial is incredible, everyone should take a lesson from Vercel on this: https://nextjs.org/learn/foundations/from-react-to-nextjs/ge...

Tell me:

1. What I need to know to understand this documentation

2. The before state (plain React.js)

3. The after state (Next.js)

I'm fucking sold, I'm going to use Next.js just based on how well written this documentation is.
Enable network throttling in your browser (to simulate the experience of people who can't afford fast internet) and see which becomes easier to read.
How exactly is this related?
Opening twitter.com on my phone reveals no fewer than 4 (FOUR!) obstacles to doing or seeing anything.

Log-in with Google pop-up |
“Use the app” nag box |
Cookie modal |
Log-in page

When I get bombarded like that I just “nope” right out
Surprisingly, my compile times with Next.js 12.3 have been really really awful. A simple CSS change takes almost 10 seconds to compile and I'd love to know why.

My app isn't complex, it uses Recoil, Tailwind and that's it. Compile times were better in v11 in my experience.
Nice decentralization.
> I'm all for accessibility, but let us decide when to implement it.

Which usually means never.
> with basically zero legitimate use cases -- the only use case I can think of is telling the browser certain actions should not push themselves onto the back button stack).

I agree on the "legitimate" part, but I suspect one of the main reasons is that Google and Apple both really want people to be creating SPAs that pretend to be real apps, and that's hard to do without being able to hijack the back button for navigation.
Yubikey is included - as a passkey.

They are more secure because they are different per-site and are public-key-based rather than secret-based, so they can't be captured and replayed later, a website compromise doesn't lead to further compromises, and they are phishing-resistant (e.g. paypa1.com can't request PayPal.com credentials).

Passkeys are meant to refer to primary-factor authentication, as opposed to using something like a yubikey as a replacement for SMS OTP or TOTP. The ability to discover available first-factor options for a web domain was something new in FIDO 2 over the older U2F-based keys - I'd expect any security key sold in the last three years to have at least limited support for discoverable credentials.

By default when someone talks about passkeys they mean multi-device, where you back them up (most likely to the cloud) and can sync/restore them to other devices. But modern Yubikeys (and current Windows Hello) support single-device passkeys.

Or to put it a different way - passkeys are meant to be a concept for something equivalent but better than passwords, not a proper spec in themselves. Hence the lowercase 'p'.
> college recruiting materials might well brag that at their institution, there were not one, but two computers on campus.

Our community college highlighted their Vax minicomputer by having a special window that showed all the flashing LED's to passers by. But when PC's became the "in thing", they felt embarrassed and covered the window with PC posters. Poor Vax, lots of memories together. It was an early lesson in IT = star-today-washup-tomorrow.
75% of the workforce should simply resign, no better way to vote than with your feet or wallet, IMO.
When we started in 2009, we did 3 major releases a year (enterprise software, deep vertical SaaS).

We now do monthly releases into production, with 80+% marketshare and 500mil rev just in my product line.

Scaling is hard, but doable. Takes a lot of willpower and fighting against gravity.
Wonder how hard could it be to add tiling support?
Yeah. NYT reporters don't show up here to answer our questions.
Hu Jintao: Fresh China Congress footage deepens mystery over exit
> as far as I know they are discouraged

Fwiw, this a fully stable and well documented API. It’s not even v8 exclusive, Bun cloned it for WebKit.

https://nodejs.org/api/n-api.html
That would explain why someone wrote IT shanties.

https://www.npr.org/2022/01/22/1074964815/opinion-sea-shanti...
Try https://webauthn.me/debugger. It will show you all the gritty details.
GraalVM comes with its own JIT the Graal Compiler [1] which I believe was what metadat was talking about. You are probably thinking about the native image generation which can cause issues with reflection and other dynamic constructs.

[1] https://www.graalvm.org/22.3/reference-manual/java/compiler/
Doubtful anyone would post anything here before there's time to write a proper RCA.
I wish my CTO even knew what HN was.
Is "learnings" a real word now
You're kidding yourself if you think software will account for less investment the next decade than it did during the last one. AI-generated artwork companies will automate entire sectors of the design industry. I suspect things like video advertisements, music, even whole movies and books will become AI generated over the next 20 or so years.

What's funny is a lot of people thought artists would be the last ones to become unemployed by the AI revolution but it actually looks more now like they might be some of the first.

With that in mind, perhaps most white-collar jobs that we thought were safe from automation won't be for long. Automated code-writing, and even requirements gathering also seems to be just around the corner, although I have more doubts about that (I'm biased though so who knows). These may eventually be reduced to prompt-input, no-code solutions useable by everybody.

Climate tech/strategies will obviously need to improve, unless we plan on living in a 500ppm CO2 world for a long time. So yes investment on the atoms front will increase, but I'm having a hard time seeing profitability in this space without whole sectors of the economy having their profits diverted by government in order to make this space profitable.

One single mineral-rich asteroid in orbit around Earth could be a huge boon to space tech and advancement. Serving both as a near earth launch and refueling platform, solar energy farm, and material provider to both earth and space-based industry. This seems a little farther out though. But with SpaceX advancements, all the pieces seem like they could fall into place very soon. We've already made contact with and diverted asteroids. All it would take would be some careful planning and moar boosters.
Yeah, agreed. I wouldn't say the most upvoted posts are always the highest quality posts.
There are currently 55 episodes available for $10 per month on paramount+ or $3 per episode via Apple’s TV app, or $30 per season for seasons 1 thru 3 in Apple’s TV app.

On Amazon, lower quality episodes are available for $2 each for seasons 1 thru 3.

The seller wants $30 per season and you are looking to pay $3 to $5.

The seller is also offering $10 to rent 4 seasons assuming you binge watch 55 episodes in a month. Or $20 in 2 months, or $30 for 3 months if you watch one every other day.

Looks like the options are there, just not at the desired price.
OS becoming unresponsive because of a network/IO error
If they weren't interested in making prestige TV then why buy HBO? That's the biggest thing HBO has going for it right now.
Trucking is all or nothing - once self-driving cars are working and legal, those jobs are gone.

AI art is not - jobs are already being lost in real time, users can create stock photos, logos, bespoke art right now. And more and more jobs will be lost as the AI improves.
FYI your "stateless and signupless demo" link isn't linking and copying/pasting the link didn't work.
I use both chrome and safari, and hate they don't use the same password store anymore (chrome used to just use keychain).
But on iOS, you can at least fill in passwords using chrome as well
Node-API – an API for building native Addons
Bummer that we have to wait for Svelte support, but seems worth it. Hope to see it bundled with Svelte Kit soon!

https://turbo.build/pack/docs/features/frameworks#vue-and-sv...
That's what it would be if the bad management was removed. The problem being fully under control is theoretical, so pointing out the real world isn't under control is not a counterargument.
> The last interview was with someone very technical, who had printed out a few pages of listings of the obfuscated C contest. He asked me to go through them and tell him what each program would output. I did not get the job.

It's nice to know that stupid interview questions are not a modern innovation.
That was exactly my takeaway. I'd prefer to pay a few bucks to stream a show and/or season for a period of time.
I've been thinking about CNN+ a decent amount recently and wonder if the primary issue with the product was that it wasn't primarily a live product. It's my thinking that the best aspect of CNN is when it covers live breaking news in a way that feels like the story is unfolding before the viewer's eyes. CNN+'s reliance on VOD content and news personalities is not that captivating. A product that revealed the raw journalism in real-time would be really compelling.
The only question I have is: how partial? I would hope they designed so it's impossible for a single change to affect the entire network.
This, and also there is the saying: "Never trust the frontend"

So in any case a string length check in the Backend should help here. Also if you get strings from a Browser Frontend, it seems unlikely you could create a payload of 2GB due to several reasons, one being string length limitations on the Browser side: https://stackoverflow.com/questions/34957890/javascript-stri...