skysight-inc/HackerNews huggingface dataset:
I’m disappointed, but I can’t say I’m surprised. I once tried to contact their support team after getting effectively locked out of my account, only to have the support form return a 5XX error upon submission. I dropped them right then and there.
How does one adjust for uncaught criminals?
I have had this problem, and failed the security check when I told them I had to look it up. Which was a little silly because I just hung up and called back and did it again with the list in front of me.
Then they try to keep you using the system longer
I don't think I have a donate button on GitHub. I think I had one on my blog. I never got anything. I don't think anyone visits the GitHub pages I have either.
What does HN community feel about Google chrome's internal password manager compared to third party ones?
"Grafanista"[1] irks me more.

1: https://grafana.com/blog/2022/07/29/inside-grafana-labs-my-f...
> he thought Reporters would like him better

He thought right. If there’s one takeaway from this whole debacle, I hope people realize that the mainstream media is inherently dishonest and there’s no reason to trust them by default.
Sure it’ll result in a lot of issues for minor sites, but most critical services mandate 2FA. So just don’t keep your password and 2FA in these services.
If you're a lastpass user, might be wise to avoid logging into lastpass until they update with a resolution - if the attackers got into the build server they could craft attacks that would exfiltrate passwords after user decrypts
In my experience, this usually works, especially with banks.
Nice work!

“We don’t hit girls” was an unqualified demand, though.
> If there was something that you could have done yourself to prevent or stop it, would you refuse to do it?

I still don't know.

"Do you go Ender's Game on the bully?" As an adult, I don't want to condone violence, but at some point, it seems like there must come a point where one must stand up & defend oneself. The problem is that you'll very likely get in trouble for it — self defense is not a defense in the eyes of public school administrators. (Aside from Ender's Game, there are some good episodes of SG:SG1 that touch on this topic. It is complex even for adults. The permissibility of violence in this situation is likely conditional on authority figures having turned a blind eye to the situation. The level of nuance here probably exceeds what I'd expect a child being bullied to be able to command. The other problem is that bullies don't always operate alone, and a fight one decides to pick might not be a fair one.)

But like I said, it's besides the point: to a degree, yeah, you should teach children to have a "thick skin". But "thick skin" only gets the child so far: it can fend off mild amounts of verbal abuse, but I do not think a child can be effectively taught to deal with repeated, long-term verbal abuse, social ostracization, and physical abuse, and to deal with the emotional consequences thereof. At that stage, bullying is a failure of adults to discipline, in so much as it is allowed to happen and moreso and in particular, to persist.
I sometimes wonder how long until we come full circle by integrating enough features in a browser to make them fully replace your usual everyday OSes.
Only web apps have dependencies?
He cashed out $300M in FTX's last funding round. So where did all that money go?
Will never understand why people use managed password management services when things like the KeePass KDBX format exist.
This is years ago now, but every ampersand in my passwords came across wrong. I can't recall if it was missing or url encoded, but even passwords weren't safe.
99. ..% of "real" applications are bottlenecked by I/O, be it disk or network or synchronization (as in, waiting for something else to happen)

If you're not in a HPC or heavily resource constrained context you can safely ignore the performance implications of choosing whatever programming language you like.
That the other guy is evil, and that’s the only other choice, isn’t Apple’s fault.
Note that you should not generate a random password like D27fX$0f7RyD for your security questions. These are designed to give to a human operator on the other end of a phone. If an attacker calls up the account recovery line, gets asked for a security question, and just says "heh, I think it was a string of random characters", there's a decent chance the human operator will let them into the account. As you say, use an actual word string (passphrase) generator, which is a bit less susceptible to this attack.
I think Tesla will be fine as a company with a different CEO, and some shareholders may wish for that, but the current valuation is entirely because of Elon. If he goes the value of the company will plummet back to the realm of a car company. Things like endless future demand and super scifi things about to be released by the end of the year will suck the magic out of the stock.
I haven't tried, but I am not on the phone with support much as I go to great lengths to avoid calling haha. The one time I had to verify my security question, I told the representative that its a long, random character string and they waited for me to open up my password manager to read it out to them.
Krita has those features. Sure it would probably be better if more people worked on Krita, but I'm often pleasantly surprised by the new features they implement.
Isn't the pension fund for regular people?
Agree. For example, changing solder mask color can affect component placement accuracy and solder bump size.
> why on earth has he agreed to do so many damaging interviews

It seems to be working, at least on some margins. Even here he has his defenders.
> those that lost money in FTX weren’t consciously in on the con, but instead had (vastly) exaggerated expectations about the future of crypto?

I've said multiple times on HN that I consider blockchain to be the most economically important invention of the last 500 years, e.g.:

https://news.ycombinator.com/item?id=14633148

https://news.ycombinator.com/item?id=18574399

But the reason it's exciting is, among other things, because it should radically drive down the cost of borrowing money. So yeah, I'm probably literally on the most bullish person on crypto on HN, but that's why it's so easy for me to see how the folks chasing those double digit interest rates on FTX aren't exactly the innocent victims they're being portrayed as.

I'm hardly an economist, but even the most financially illiterate people know that interest rates should be vaguely proportional to risk.
Passwords suck. Move on to something better.
I see this a lot, and I'm not sure why people are so confident about it. Lighter, thinner, more durable materials are a huge upsell and focus of ongoing product development in eyeglasses, and that's to save 10 or 20 grams. The lightest VR headsets are still an order of magnitude heavier than eyeglasses. Closing that gap while also addressing the resolution and battery life issues with existing headsets is going to require breakthroughs.
Is the answer wrong or right? It can be either five or seven…
Time for hardware tokens based on DNA, so that nobody gets online unless they are exactly and uniquely who they are, and fully trackable from all points of contact. To get in, you must have the token. Bad actors lose access similar to jail time. Unless they can hack their DNA to be unique again, they don't get back in except on parole or after punishment.

My guess is this way of solving old problems may create new ones due to that pesky problem called human nature.
They probably consider the electronic version more "modern". Even though it contains a non replaceable, non rechargeable battery.
The one where you can just launch chrome and click the eyeball icon to see what the password is? Or does chrome have something fancier I am not aware of?
In all fairness, there is more than just cost when choosing a provider. Elastic has had higher uptime than the AWS alternative. I had to switch off AWS Elasticsearch hosting because it kept going down.
I’m not familiar with that program, what about the UI is especially bad/weird?
Apple's CSAM detection is based on known image's hash. Removing their own shoot images is very different task. How to detect? Maybe just based on geolocation?
I've certainly heard people speculate that would be the case. I always just put together 2-3 words unrelated to the question, e.g. my first grade schoolteacher is "Antique Campfire".
Apple is still on the hook for support if you disable that option, either because that's what you wanted, or because someone from Microsoft Support called you and told you that you needed to disable it so he could remove the virus.
Indeed. It's up there with Andy Jassy's recent announcement about upcoming layoffs at Amazon that ends with "we should all be very optimistic about Amazon’s future. I know I am."

https://www.aboutamazon.com/news/company-news/a-note-from-ce...
This was endless comedy for sure. The jank of the game only added to its appeal.
That's your response? That polling is transparent because both sides will just turn it into a game of CoreWars, and may the best argument win (at CoreWars)?
Gun Death Rate Nears Three-Decade High, with Men at Most Risk
The people who were completely obnoxious when anyone tried to warn them that monkey JPEGs going for $500k was nutso, have now flipped to obnoxiously playing the victim.

It was the exact same way on The Motley Fool boards after the dotcom crash. The crowd that was all "Well you may have your facts and figures, but my CMGI keeps going up and up and up, so PPPPPTTTTHHHHH!!!", instantly pivoted to "How can you kick me when I'm down like this? Do you enjoy suffering?"
Pick your three favorite movie characters for which there is a lot of information about them (name, town where they grew up, age, dog with a name, etc.). Rotate through these three. Append the name of the service. Dog's name? buddylastpass

There will be no reuse, because for Facebook it would be buddyfacebook or dugfacebook, or something else… but you will always be able to guess it in three tries. A computer system doing some kind of pentest isn't going to parse out the "facebook" or "lastpass". A human might, but that's why you rotate through three names. At the point where you have a human targeting your account and actually thinking about your inputs you are probably !@#$ed anyway.
Coffeezilla also points out that SBF is consistently lying about almost everything, and there is no evidence to support this claim beyond "this is what he says".

I'm not saying he did or didn't, just that the source is ehhhhh.
And to make sure Microsoft has a squeaky clean reputation for them and their parents...
I think the difference is that the totality of morality is supposed to come from the state in Fascism.

A well functioning society necessarily ought not legally forbid things that I consider immoral, which allows for personal autonomy with regards to ethics.
I've done something like this with my bank, I tell them it's a bunch of nonsense because the security question recovery is just a variation of a weak password so we'll need to validate me some other way. They always can
not only universal surveillance, but swift and accurate justice.

We cant even manage the latter a dedicated judicial system.
The Verge has more information [1]

"This comes just months after LastPass confirmed that hackers had stolen some of its source code in August and had access to LastPass’ internal systems for four days before getting detected. It looks like this new attack is connected, as Loubba says it determined that hackers gained access to user data “using information obtained in the August 2022 incident.”"

https://www.theverge.com/2022/11/30/23486902/lastpass-hacker...
C++ fits the bill as well (!)

I wager that you can get pretty far with compile-time macros, even as rudimentary as C's, to encoder a fair bit of generic monad machinery.
It seems like VSCode Remote SSH has a license which grants you access for development usage (https://marketplace.visualstudio.com/items/ms-vscode-remote....)

Seems like a landmine of licenses.
I've feel similar. I've been quiet quitting at work. For me, I feel the biggest demotivational factor is that my career has never built off of previous roles/tech. It's always start over in a new stack. All the knowledge is basically thrown away. And also that management has screwed me over.
I'd never heard of this cclyzer tool, thanks for sharing. This looks really interesting. Know of any other tools for C/C++/JVM static analysis that folks might not be aware of?

At the moment, I use GCC's -fanalyzer, the LLVM sanitizers + static analyzer, FB's Infer, and PVS Studio.
Then i might just have forgotten it (which i stated as a possibility). I haven‘t used it in at least 10-14 years (wow, i‘m still a noob in so many things after all this time in the matrix).

Back then i might have been more fascinated with the „FOSS alternative“ and more eager to learn… but even back then it has never felt intuitive.
Glad to hear people still enjoy & use GIMP.
Just the usual semi-annual LastPass related compromise.. nothing to see here..
Isn't DNA more of a "username" than a password?
Eating well is a portal into Proust’s “In Search of Lost Time”
> You need an "agent" that has genuine motivations and some concept of an internal experience.

Don’t you just need a more complete model of such an agent? I agree you can’t get such a thing by training on text.
I've had good results from refusing to play this security theatre.
Carburetors are awful. Stop blasting fuel into the air.
DNA is easier to lift from unsuspecting victims than it is to hack your alphanumeric code. Thought theft at scale with DNA based systems would be hard. Unless, you’re the government, in which case, good luck.
I've felt this same way for a while now.

What I find interesting (and hard to reconcile) is how society loves to reward the intangible, derivative, overcomplicated stuff, and ignores the foundational things. The overused (and valid) example is "compare swe to teacher compensation".

In truly fractal fashion, this is also true within our own industry:

Build an engine capable of running an ML model very fast? Meh.

Take that, and layer an API on top, and charge $$ per image-generating call? Shut up and take my money.

I don't have an insightful mental model for how to deal with this, except to note that this pattern is prevalent in all human occupations -- the "higher up" you are in the "value chain", the more derived/bullshit-y your fundamental contribution to society is, and simultaneously, the more $$ you can make off of it.
Just in time to give a boost to passkeys. https://fidoalliance.org/passkeys/
Anecdotally I've heard of this type of social engineering working. It's probably better to use some randomly generated real words. Another poster suggested diceware.
They do (and Windows on the older x86 based devices), but since the move to Apple Silicon, combined with a lack of availability of the specs, it becomes harder and harder. But OP is talking primarily about iOS, where it is impossible to run Linux (or any other OS)
This gets dismissed every time it's brought up, but I agree with you that it probably has stunted its growth considerably.
The idea could be that it is a foothold in the home; if it becomes popular you can sell add-on devices and create a services ecosystem around it. Unfortunately voice assistants mostly get used for very simple tasks like setting timers.
Imagine a card game with a deck and two players. The deck knows which player got which card. Each player knows its own cards and the ones on the table. The deck should not run in the browser of one of the players because that player could inspect the status of the deck and know which cards were handed to the other one.

To answer your question: maybe, but for almost any game you need a trusted third party that holds the secret state of the game. A third browser somewhere or a headless server?

Exceptions: complete information games like go, chess and checkers. Everything is public.

Games with a dice like backgammon starts to be problematic because how can one player trust the dice of the other player? A shared random seed would let them know in advance all the rolls.
Much more detail
https://www.quantamagazine.org/physicists-create-a-wormhole-...
The idea that socialisation with unsocialised cretins is important, is one of the biggest pieces of marketing spin that I feel keeps schools operating, children and teenagers when allowed to form groups and cliques are fucking animals, they will engage in the worst kind of behaviour. There is a big difference between socialising your child, which can be done through a whole host of methods, and throwing them into a shark tank filled with animals.

As someone who was bullied at school, let me assure you, the only socialisation I received from the experience, was an appreciation for how fucking horrible humans can be.
Basically the entire password manager space is the result of "security fatigue". Telling everyone that every single unimportant website they log into requires a unique high security password makes people use bad solutions that make their security worse, like storing all their passwords in a cloud-based single point of failure.
You change the environment where people to some extent live their lives. Stripmalls never hurt anyone either by that token.
That is an interesting fact, thank you. My point was a different one - and not a serious one… but anyway. Thanks for the stats!
There are 3. But I suppose it is not the best written puzzle.
Lastpass announcement: https://blog.lastpass.com/2022/11/notice-of-recent-security-...
This is a pretty good video about it
https://www.youtube.com/watch?v=1JaPzJKycxc
It's usually not a money thing, it's that the customers are usually unable to maintain the service internally resulting in extremely outdated, insecure, and poor performing versions of your product everywhere generating a lot of support issues and bad vibes around your product.
I just create a new imaginary dog.
At the minimum, the desired outcome is that they shouldn't talk about "taking personal responsibility" when there's none to be seen.
Save a cup from the end of the first filter and taste test against the first cup from the new filter?
Then maybe point to the blog posts rather an AMA that clearly doesn't contradict anything that I said before stating "this is an obvious lie"? Yes, they worked on the project without making revenue initially. Was it that good then?
Sure, that's is what it looks at first, but then if you look closer you see:

- Hiring compliance officer, who was on tape helping his former boss get away with fraud[1] (and that was not recent revelation)

- Using self deleting messages and encouraging others to use them, for important discussions [2].

- Alameda research having backdoor into FTX, just so they could do stuff without rising any red flags [3]

There are other things that point into direction of fraud, but this are the main 3.

[1] https://nypost.com/2022/11/20/ftxs-ex-chief-regulatory-offic...

[2] https://d1e00ek4ebabms.cloudfront.net/production/uploaded-fi...

[3] https://www.wsj.com/articles/alameda-ftx-executives-are-said...
Arti 1.1.0 is released: Anti-censorship support
I'm not sure if they fixed it, but in the past any process that was running in your user account or admin on your PC could dump the plaintext of this trivially, for many years.

Reply to @jeffbee: You basically have to have that threat model, because ordinary users are running dozens of untrustworthy processes on their machines. Real world security has to assume the user is not a security expert.
Multiple devices? Central management? I use KeePass so I don't know, but I assume there are valid reasons
Don't forget the classic play (used on both sides) of denying there is a problem instead of stating that the cure is worse than the disease.
This is boring flamebait. We all know there are differences in employment contracts between different parts of the world. This comment adds nothing to that discussion but a useless insult.
Indeed - a Nintendo Switch would be a perfect remote controller for robots if only Nintendo let you actually write code for the device you own!
Seems like they might not do it in unison.

Probably a big prize to defect once people start to catch on that it sucks.

(I will certainly shop pretty aggressively if they do shit as stupid as you describe there)
> banks don’t need your deposits to create new money. They just do.

Yes, exactly. The key phrase here is

loans create deposits

When you take out a loan, the bank conjures the casino chips from thin air and increases the numbers in your bank account.

Eventually the bank's reserves at the central bank need to be a percentage of their liabilities
Scientists use quantum computing to create glass that cuts AC need by a third
I've been thinking about switch statements lately which is what this article essentially talks about with regard to efficiently switching between behaviours based on syscall

If you think of virtual functions in C++ which are function tables and switch statements in interpreters and emulators and pattern matching in Rust as essentially jumping to code based on data or state is a fundamental part of computing.

Unfortunately it is slow.

I thought of the possibility of a language that has a switch statement that automatically turns into a compiler. A bit like a futumura projection. You use the dynamic switch and you get a compiler in return.

I think Pypy's Rpython is essentially a JIT compiler generator.

I want to define relationships between objects and send messages between them. Even though files, sockets, pipes, containers, processes are all objects, the interfaces between them are all different. You need to use a different API for each. I think REST is a step in the right direction. Imagine managing files and sockets and operating system resources with REST.

The ultimate destination of OOP is this idea we can wire up objects based on their relationships to other objects and instruct them to behave according to some pattern.

One of my ideas is to think of every object as a while True loop that handles messages to behave in different ways.
No, those are absolutely essential Adobe Photoshop features. Having a different set of tools to accomplish a specific goal is fine because, bear with me, GIMP is not Photoshop.

90% of the complaining that always happens in these threads is Photoshop/Irfanview/whatever users, coming in and assuming that the purpose of GIMP is to reimplement your favorite image editing software for free. That is not the goal, and it never has been. As long as you keep pretending anyone intends GIMP to be a Photoshop clone, you'll keep being disappointed.

After _three decades_ I can no longer blame anyone but the complainant.
Android is Linux w/ Malware … omegalol
Given your comment, you may like : https://www.templatemaker.nl/en/

No use for iPad though...
Vertical Slicing of user stories is the practice that everyone in Agile knows about, but so few really practice this well. Doing this practice well is one of the best ways to deliver value and to do that faster than about anything else you can try.