skysight-inc/HackerNews huggingface dataset:
I've gone through the process of auditioning a bunch of rust webservers as well and came away with the opinion that of them all, Axum and Tide have the best interfaces and features. We went with tide, and I still believe that it is the _easiest_ to use in most cases - just with a few quirks that need to be changed and features added (or in some cases just be made public). Sadly however it is not very actively maintained and I fear for its future as that compounds with less and less people choosing it over time.

Axum by comparison has a very active community, but I found it's request handling and middleware concepts much less ergonomic. If you're debating between rust webservers it's worth taking a look and giving tide a chance. The async-std choice hasn't been an issue for us at all either.
Nice work on the interactive elements in this guide, they're delightful!
User-approval isn't the only metric by which features are judged. No one liking it was obvious as there's no user benefit. If it results in increased revenue/recurring users/valuable ad displays, that's different.
This is useful when you have multiple methods to authenticate.

Maybe this user should be redirected to an oauth2 identity provider or maybe they should enter a password.

Good implementations of this will have a hidden password field for password managers to fill along with the username. You'll still need to press enter twice though.
This is for SSO reasons. When you enter your email address they check whether SSO is activated for your email address (or whole company domain) and will redirect you. It is better for usability than requiring your users to enter some random password or keep the password input empty.
The [Heise method](https://www.ryanheise.com/cube/heise_method.html) is essentially that, but formalized. No algorithms to memorize, just understanding how the cube works and using that to solve it.
> Hey Siri, text Fred <pause> I'm on my way but stuck in traffic, eta 4 o'clock

That only works well if you have an accent it recognizes, if you're speech is clear (not slurred, not lisping etc), if you don't stammer, if you don't have any verbal tics that you don't want to show up in the message, and if "Fred" is actually a simple unambigous name.

Otherwise, at best when you want to send a message to "Ioana" it may end up sending a message to "Anna" that says "I'm, ummm, oh my way! and stalking traffic ate a what was it like 4 like maybe 4 and you know what <pause>" (followed by the "4 o'clock" that will no longer be included).
> Pulling the trigger of a firearm does not require any skill or practice.

Learning and practicing how to correctly pull the trigger is probably the single biggest improvement to accuracy a new shooter can make. The difference between the right way, and the way everyone is born doing it, particularly with pistols, is HUGE. And it does take practice.

> Because bullets travel much faster than arrows, a gunner can aim in a straight line, which is easy.

Outside of being right next to your target, knowing your bullet drop and compensating for it is absolutely a part of shooting.
This article reads like Jane Street’s PR work.
Excellent game, well done! Love that there’s a new image daily so I can choose to spend a small amount of time each day but I won’t get sucked into a non-stop treadmill.
As opposed to violent and ruthless miscreants beating the password out of you?
I think they want to do to the world what the president tried to do to Sri Lanka: https://www.economist.com/asia/2021/10/16/a-rush-to-farm-org...

i.e. rush the world into some globalist, "sustainable" future as soon as possible and never mind the impact on the regular people. As long as Davos man can still swan about to conferences in a private jet it's all good.
> If I needed something I'd go and buy it, don't need some pushy sleazy salesman trying to trick me.

In 2021, more than $285 billion was spent on advertising in the United States. Why? Because while you might think you have an "If I needed something I'd go and buy it" mentality, the evidence has clearly shown that most people can be influenced to buy things other than what they already recognize as a need.

Door-to-door salesmen are a form of advertisement of services, and for certain industries they can be more effective than print ads, billboards, etc.

Not that I necessarily like having my day interrupted for a sales pitch; I almost invariably don't answer or turn them away.

But I'm just saying that if you have ever responded to any form of advertisement, the "If I needed something I'd go and buy it" line is probably missing the mark.
How many hunters are using subsonic bullets? Back when I used to live close to/in the wilderness with many hunters around during hunting season, we heard gunshots almost every day, doesn't seem too popular to use those types of bullets if they are "almost completely silent".
Usually it is to detect the user is registered to (or their domain is mapped to) an account with SSO or Social Auth and prompt them for that login mechanism. If the user is being required to go via the SSO provider, it makes sense to ask for the email first before they input their password so that they can be redirected it neccesary.
But there must be a subset that isn't? A perfect sized human resource footprint to match earths carrying capacity?

And I'm not aware of any current physical limits to space colonization? I thought the main limit was energy, and the sun has a lot to give for a while.
This estimated my lichess rating very closely. Really impressive!
The only “legit” door2door I’ve seen is when a contractor will be in the neighborhood working on one house and he has someone mention it to the other houses if they want to get in on it (think tree trimming, etc) at a discount because they’re already there.
The Python framework FastAPI does this too. I think it does so because it's convenient, easy, and it's one less line of boilerplate. You trade off flexibility for having a very clean and simple "happy path".
Are they unrelated?

The article is about a tradeoff between security and user experience, claiming that a given practice is bad experience without any security gain.

The Ashley Madison leak shows that there are plenty of vulnerable users who are not educated to even "the most basic" things to do to protect their privacy.

It's also a question of user experience to protect users against themselves, or against threats they don't know about.

Saying "it's up to the user to do the right thing" isn't really helpful in the context of discussing account creation/login UIs.
I've been using Notion since it's inception, but after reading this I think I'm ready to take to jump to Obsidian. I want to own my notes again, and I've found Notion to not be as configurable as I want it to be in recent months. Any suggestions from people who use Obsidian in their workflow?
If you follow the Emacs-devel mailing list, you will see many of the built in modes adds support for tree-sitter to various degrees lots of languages are already on the list (C, Python, Javascript, Bash, JSON and CSS).

It also includes some new language-modes which has never been part of Emacs before (like typescript).

I'd love to see C# on the list, but that might depend on me having the time to land production-grade major-mode, so that might end up happening later rather than sooner.

Anyway, from what I understand what has been merged so far should all be available as part of Emacs 29 once released.
Downrated?! You think there are terribly many people trying to get into government who aren’t in it for money, power or social media success? These define the us republicans for example.
And if the thugs are pointing a gun at you and demanding your password are you really going to say no?
> Unfortunately this assumes that there's no other way for an attacker to discover whether a username/email address is registered for a service. This assumption is incorrect.

Security is never perfect, it is always about making it annoying enough that people don't bother. So yes, there are other ways to see if someone has an account. But odds are the person attacking your site is not singling out one account to hack, they are trying bulk attacks with many accounts. So you avoid leaking info to not give the script any more ammo on what else to try. And hopefully the attacker will move on to some site that did give it more ammo.
"You have been successfully added to priority wishlist!"

Sign-up pages can't be Show HN, see https://news.ycombinator.com/showhn.html
Perfect timing.
I'm working with tailwindcss, not by choice.
And all good tailwind templates, buttons, styles are for purchase. I guess that is why I gravitate towards boostrap when I can.

But this site is helping a lot. Thank you.
If it depends on large amounts of computation, how can it be considered more efficient? If it's precomputed, then it's again pattern matching. If by algorithm you mean the sequence of rotations, then yes there is a small upper bound that speedcubers typically exceed in solving any specific randomization. [I never liked that some call a fixed sequence of moves an algorithm.]

Rubik's Cube solution unlocked by memorising 3915 final move sequences[0].

> For the first time, a speedcuber has demonstrated a solution to the Rubik’s cube that combines the two final steps of the puzzle’s solution into one

[0] https://www.newscientist.com/article/2334632-rubiks-cube-sol...
While I agree in general that this is the better way, it’s in the end out of the sites control. The could notify the user, but cannot implement any measures that can help to protect the user. Avoiding information leaks is under the sites control - you just need to consider whether you can truly avoid this leak.
For some reason I got all opinionated about fans and settled on delta as my preferred brand. I think because delta actually had data sheets. The cool thing is that digikey has the exact fans I want, the downside is that the fans digikey sells have no plugs.

I tried once to terminate it myself but I was too cheap to buy the correct tools, so that did not go well. and am now a bit bummed about the whole thing, I found a vendor I can trust to sell me real delta fans.. and they have no plugs. sigh will probably stick with nocturna as a good second best.
FTX Flipped One Trading Firm’s Risk Obsession. Disaster Followed
They're not locked out, they just might have to pay retaliatory tariffs. The whole issue is countries that institute such mercantile tariffs in the first place tend to be exactly the ones where elites do not believe in export-driven growth, and pursue failing top-down schemes that increase their own petty influence within those same countries.
tree-sitter creates parsers, e.g. for programming languages, config formats, etc.

Emacs modes can use those parsers on buffer contents, e.g. for syntax colouring/highlighting, finding matching delimiters (e.g. moving the cursor over an `if`, and having all the corresponding clauses (e.g. else/elif/fi) highlighted), for contextual editing (e.g. escaping " when inside a string), etc.

This can be remarkably tricky to get right; e.g. consider languages which can splice expressions inside strings (which can themselves contain strings, containing spliced expressions, etc.)

Using tree-sitter should make this easier and more robust (i.e. less time spent implementing parsers; more time spent implementing features!). I think it would also allow grammars to be re-used across different tools, which should improve support for obscure/niche languages.
Should All Genetics Research on Intelligence Be Off Limits?
Try grid too - unless you need flexing, it's simpler than flexbox, even for single columns or rows.
Children of Men, the 2006 film by Alfonso Cuarón, depicted a dystopian future where nation states had broadly collapsed, triggering mass migration to the only country which retained a viable system of governance, albeit under a form of fascism, the United Kingdom.

It's a great movie, I hope it is not prophetic, but it is hard to see how it might be otherwise
According to that link, Wikileaks said they thought those documents were (1) published elsewhere, (2) not noteworthy and (3) unverifiable. When they were published elsewhere, no one cared, even though they related to Russia during a time when the US media was running all sorts of stories related to Russian corruption. I don’t see the problem with Wikileak’s behavior on that one.
Of course I meant "automatic forwarding" rather than manually forwarding everything, missed to add that word there someone, corrected :)
While I get it why Amazon, Microsoft, and Google (?) might want to reduce development costs for voice interfaces, it seems like Apple is locked in to supporting Siri since one of its products, the Apple Watch, really needs Siri to get full value from it. I like to go about my day without carrying a phone (if I don’t need to take pictures) and the Apple Watch is a great compromise that allows getting calls and text messages, but at the same time is not intrusive as an iPhone. No one sits in a restaurant staring lovingly at content on their Apple Watch, ignoring nearby people and their environment.

Pardon my getting a bit off topic, but it is interesting to see the “belt tightening” by FANGs: it seems like everyone is cutting excess staff and looking hard at which products make money and which are money losers. This may seem like a good thing except for newer product categories like AR/VR that will need a lot of experimentation to get right.
That's a US intelligence outlet. Still interesting, of course, but not a substitute for WL.
If that voice assistant were self hosted in the little device, I agree. But those simple interfaces are connected directly to a significantly larger machine that literally knows everything about you and half of everyone you know. It's not unheard of to expect it to be more useful than setting timers and playing music.
We have, in some cases. In some nature preserves in the US hunting is only allowed with a bow and arrows. (And you still need a license, of course.)
As mentioned in other comments, you can't escape scarcity. If everyone became a millionaire overnight, would there be enough mansions for everyone to buy the next morning? How about PS5s? How about steaks? It's wishful thinking and politicization to pretend otherwise.
I think his argument even generalizes to literacy in general. Remember that reading and writing skills don't develop naturally (as opposed to spoken language). They require a large educational investment, and used to be reserved for the wealthy and the privileged.
My grandmother suffered Alzheimer’s, but wasn’t ready to leave her home, so my uncle moved in with her.

She called him at work to ask for her checkbook… two men had knocked on her door, convinced her that a tree on her property needed to be cut down, proceeded to cut it and leave it there, then demanded $400.

Uncle rushed home and ran these guys off, refusing to pay, but it was a dangerous scam. All it would have taken is one to distract her while the other helped himself inside the house.
With this approach, I imagine slightly less technically savvy users might be confused as to whether a new account was actually created before they were also informed of the old account. In other words, they might not know if a new password they entered is also usable for the original account.
Just to add something different to the replies, I listen to a lot of rap, hip hop, indie and instrumental metal.

I used to use YouTube but it's a bit distracting for me so I have created a 6 hour playlist that I hope to make 20 hours
Budget.
South Korea and Ghana were at the exact same place 50 years ago. South Korea’s leadership were largely competent, so they’ve industrialized and used trade to become one of the wealthiest countries in the world. Ghana has not had nearly as good leadership and institutions, so they haven’t.

Everyone constantly blames the West for all the problems of the world. If trade was really that deleterious to developing countries, you wouldn’t see the rise of China happening at all
I like it, but I will say I found 28 very frustrating... There's not enough detail in the picture to get the top row -- the entire row is basically 3 very similar colors, and there's no good hints... You basically have to determine the positioning by looking at the artifacting of the background.

The cat one was enjoyable though!
Michael Lewis FTX Book Landing at Apple
>The leaks definitely came from GRU hackers

Evidence?
Would any of these have been the same people? Like is it conceivable the same family lineage in Paris 0-1100, or even 2k years to now or would the war, conquest, etc have changed the demographics considerably?
Also it requires a login to do anything with. Add another check mark on the Honeypot theory
> because the residents dislike the gunshot noises

It's not the noise. It's a safety issue -- setting off firearms within city limits is a lot more dangerous than bows. They will often close off a park or wooded area to the public during hunting; managing the area where a stray arrow might end up is a lot easier than managing the area where a stray bullet might end up, especially with well-trained archers.

I've never heard of commissioning, though. Usually there are more than enough volunteers.
> Does it matter given that browsers can remember the username/password anyhow?

No.

The only thing that matters is having two public APIs: one that creates an account (failing if the account already exists), and another that checks if the password matches the username for an existing account. If you have those two APIs then there's no benefit to the second refusing to elaborate on whether the login is wrong or the password is wrong, and it might be useful to users.

However I'm not convinced. For many applications I think a better solution is to merge password-recovery with sign-up: Ask for the email/phone number, then send them an email to confirm which logs them in at the same time. That link, then creates the account if it doesn't exist. This way, no information is leaked, and you don't waste resources creating accounts that never get used.

If you want a fully knowledge-based authentication system, you won't have password recovery, but you might not need usernames at all: I have an app like that, it uses webauthn/client certs/a couple other tricks to authenticate devices, and has one UI function to "log in on another machine" (by taking or displaying a QR code), a separate UI function to "share this view with another user" which creates the user (or selects an existing one that this user created), and a third function to add an existing user (using a meetme code). It only matters what users call each other, not that there are two (or more) geocar's in the system, and so the login API in this system doesn't need to differentiate between an invalid or expired code, nor can it reveal the existence of any internal account IDs because the client never actually sees them anyway.

HN is a social space though, and in this case the username represents some kind of land reservation, so it is important to know if land is taken before claiming it, and it's in this scenario I think I can agree that the login API should tell you if the username is wrong or if it's the password. But I don't think Amazon or Shoprunner more should be like HN even if I usually like it here.
The problem is there are more different combinations I might want as a shortcut then I have time to program/remember. I can remember something like a dozen commonly used shortcuts. However when 5 years from now I arrive home at 2am (for the first time in several decades, but it will probably happen at some point again in my life) will I remember the correct shortcut - and assuming I do, is it up to date with whatever changes have been made to my house?

What about the shortcut for when I need to leave at 3am for some reason. then a different shortcut for when it isn't just me, but my whole family leaving at 3am. An still another for my son having to leave that early.

Jeeves can figure it out when I arrive at 2am so I don't need to program it.
> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address.

So why not just send an email upon signup with existing email and just show success on signup? I'm guessing email would state that you already have an account there, maybe you need to reset password and email would provide instructions. Using this approach there would be no leakage of information and you can inform the user someone tried signing up with their email.

Edit: This would work only if only email is required for signup, but it would not work with usernames.
No, but that way I keep my fingers AND (if lucky) my head.

But if my fingers are my password, they could either force me to unlock right now and have the problem that it locks again after some time of inactivity (depending on the impl on the other side), or take away the fingers (instead of a password) with them and be able to unlock as often as they want (and the fingers not rot) :)

I'd rather them take some knowledge and not harm me, or rather: make the harming part less likely.

tldr; my point isn't about keeping the account save, but about the potential risk of injuries to my body.
IME, no. It's safety. I guess other places might be different.
Google "helpfully" ignores the quotes sometimes too. They're not the hard and fast rule they used to be.

I preached the Gospel of Google when the competition was composed of web rings and Altavista, but Google in its infinite wisdom has abandoned the advanced user with changes of this nature.
That's a lot of cherry picking, but the author doesn't really explain why according to him the inferior guns replaced the superior bows
I've read the MOP too. I seriously doubt that this is the case. There is a lot just below the surface in CLOS that a casual encounter would not reveal. This post [1] by Joe Marshall gives a taste of how these features can go unnoticed until you need them, then you appreciate CLOS for these things.

[1] CLOS!? https://www.ca.crh.com/host-http-funcall.blogspot.be/2013/07...
Am I missing how you reshuffle to play another round?
How not to think about cells
Depending on your particular service, there's a better alternative for not leaking the existing account. A service I worked on previously was super sensitive and we didn't want to leak the existence of an existing account. What we did instead was asked for the email on the first page of signup, we verified the email was active by sending an email and a link to continue signup. If they already have an account we'd inform them in that email that they already have an account.

This way, the attacker actually has to have access to the email in question to know that an existing account is present on the service.

If you do the whole signup process on a single page and validate the email there then yea, you're gonna have a rough time.
Yes and no, books are fab but words from the genuinely wise can save you a lot of otherwise wasted time so I always appreciate for knowedgeable advice as well.
From what it looks like, Twitters revenue was advertisements and a huge chunk of Twitter's workforce was appeasing advertisers (ensuring that Disney / Mars wouldn't be shown next to porn) as well as sales reps who sold such packages to advertisers.

These sales people are now gone (or in the process of leaving) and suddenly Twitter finds it's $5 Billion/year ad revenue in danger.

It's not engineers who need to go out there and convince Disney / Mars / GM / Honda or Kellogg to run $million ads on Twitter. It's just sales.
Off the top of my head, I cannot remember any site I use that works that way (which is also basically what TFA is suggesting to do as a trade-off implementation)
> Why the hell is this site not https? This looks like a honeypot to me

How does TLS vs No TLS weight in on your suspicious if something is a honeypot or not? It's as trivial for three-letter agencies/black hats to setup as for trusty individuals/corporations.