skysight-inc/HackerNews huggingface dataset:
> I would hope that journalists conduct their research through better means than solely reading Tweets.

That's not a good reason to suppress scientists tweets.

Also, many of the best journalists of the past decades have been loudly warning of being shadowbanned, supressed, deranked etc.

> I don't think anyone would administer web forums if the government started telling them how they could and could not moderate posting.

A large part of these Twitter reveals show just how much government connections pushed extreme "moderation" (read: censorship) of specific issues.
She explained in the thread:

What many people call “shadow banning,” Twitter executives and employees call “Visibility Filtering” or “VF.” Multiple high-level sources confirmed its meaning.

“Think about visibility filtering as being a way for us to suppress what people see to different levels. It’s a very powerful tool,” one senior Twitter employee told us.

“VF” refers to Twitter’s control over user visibility. It used VF to block searches of individual users; to limit the scope of a particular tweet’s discoverability; to block select users’ posts from ever appearing on the “trending” page; and from inclusion in hashtag searches.

All without users’ knowledge.

“We control visibility quite a bit. And we control the amplification of your content quite a bit. And normal people do not know how much we do,” one Twitter engineer told us. Two additional Twitter employees confirmed.
That's a fair point. I think I was looking at it from the other perspective where the author was claiming that he had never approved a contract with Mojang and therefore deserved additional compensation which is pretty far from true. But I agree that Microsoft probably doesn't have a strong case here either and wouldn't gain anything from suing anyway.
To be honest, Google Maps has degraded in quality and popularity ever since it came out. Other options have become more popular, so I guess Google is going to combine this with Waze and try and make one final effort to become the best navigation app.

I think this is for the best of Google's interest.
Depends on the employer and how large/diverse the staff is.
- be a better husband. I came off as selfish and inattentive in recent months. This needs to change.

- Spend more time with my family.

- Find a way to better engage with my town and community. I grew up where I live now, but still feel a little disconnected.

- Continue reading. Started reading again, this year. Want to keep up with that.

- Join the 1000lbs club. This is the follow up to this year’s goal of a 135 overhead / 225 Bench / 315 Squat / 405 DL

- finally finish my PhD. Still waiting for my Advisor to finish his report…

- relax more, stress less about income
Twitter's current head of Trust & Safety has admitted that the posted screenshots were "requested"[1] from her. This clearly isn't a balanced report.

https://twitter.com/ellagirwin/status/1601084794288640000
I don't know where you get the idea that a mobile device is needed
There's a systemic component to this issue that perpetuates the status quo separately from men's attitudes toward changing their names, and that is that it is often much harder for men to change their names.

I am a man and married a woman, and initially we considered several options for a common last name that weren't just taking my original last name, including hyphenation, sort of portmanteau name-smashing, and a completely new name for both of us.

We were met (in the US, in SC) with confusion and lack of support.

Were my spouse to have changed her name, the process was literally as easy as checking a box when signing the marriage certificate. For me there was no such option. I would have had to go through a separate name change process unrelated to the marriage, and the government employees tasked with these processes just couldn't understand why I would want to change my name in the first place. When we asked how to accomplish it, the responses included things like "I guess he can change his name, just schedule your court date to justify why he wants to have a different name" and "wait, are you sure you want to change his name? Why?"

It wasn't impossible to do, but the friction caused by a system that expected my spouse to change her name as a matter of course ended up being enough of a barrier that we never went through all the hoops, or even uncovered what they all were. When we later had a child she took my last name (which was still easy years after the fact) so the three of us would have a common last name.
Bankman-Fried Misses Deadline to Respond to Key Senate Committee
> Instead of reducing bugs, these might be introducing new footguns.

Same thing could be/has been said about std::string_view or std::span but here we are.

Like you said, a bare pointer could mean anything. This at least standardizes this particular footgun in question (which means one less reason to expose bare pointers in your API) so we are supposed to pay extra attention when we see one of those, I guess?
Now the head of Trust & Safety is admitting the screenshots were "requested" from her[0]. This was hardly a balanced investigation.

[0] https://twitter.com/ellagirwin/status/1601084794288640000
Sure, but that works for passwords because you can copy-paste them from an external program. The WebAuthn API in question is built around using JS in the website's context to manipulate the passkey. [1] You have to hope that the browser gives a way for an external program to be involved in that JS API's implementation.

Looking at KeepassXC's WebAuthn WIP implementation, it works by injecting JS into the website context that overrides the default JS API to its own implementation instead. [2] I don't see any API in the chrome extensions docs [3] that could be used to customize passkeys, so I assume 1Password's passkey implementation (mentioned in other comments in this thread) does the same thing. I sure hope the browsers don't decide to crack down on it by making the API uninterceptable in the name of security.

[1]: https://web.dev/passkey-registration/#call-webauthn-api-to-c...

[2]: https://github.com/keepassxreboot/keepassxc-browser/commit/4...

[3]: https://developer.chrome.com/docs/extensions/reference/
If you don't mind sharing, would you explain how it is too useful for your work?
Let me get this straight. . . You think Google will provide hooks for password managers in Chrome and Android, and then “convince” website owners, presumably via super bowl ads or something, to detect and filter out passkeys coming from the password managers they did the work to enable?
Move over, Tempest: Japan pact takes UK-Italy fighter plan ‘global’
Ban evasion was a thing long before shadow bans. I've seen persistent users disrupt IRC channels for years, maybe decades. You can't reason with or befriend somebody who holds a grudge that long. Moderators will just have to deal with the problem repeatedly. Shadow bans at least minimize recurrence by taking away the immediate feedback.
> Unfortunately, ad-blockers go against a business model that is central to Google. Despite the changes possibly being in good faith

I don't think you've kept up with the way Google has treated certain extensions if you're still considering the possibility that it's in good faith

Anybody remember AdNauseam (still available on Firefox)? It's an adblock that doesn't just block ads but in the background silently clicks ads to create noise and make you harder to track. Clearly against Google's business model

It wasn't enough for Google to find some rules in their policy to exclude it from their app store. They literally labelled it as malware (completely unfounded)

Google's been pretty ruthless about this stuff
Well, as long as you are in fact consistent about the position that it is "(essentially) a message board that is used to sell advertisements", with the presumable implication being that it is unimportant, replaceable and/or not an important venue for political discussion - and therefore in particular it is not a big deal if it is run into the ground or flipped towards the cause of a political group you are opposed to - then your position is sensible enough. However, this whole discussion is happening against the backdrop of a seemingly overwhelming majority of people in this community and the wider political sphere in the US asserting that it is in fact a big deal, which is inconsistent with dismissing allegations of wrongdoing by an argument from fundamental irrelevance. The majority position on the importance of Twitter is surely worth addressing, and if you disagree with that, you'd do better to raise your objection about relevance to that, rather than to a minority opposition arguing against the majority about a different aspect under the shared premise of relevance.
>Being punished for exerting control over what is publish on your private web site seems to me like massive government overreach to me. I don't think anyone would administer web forums if the government started telling them how they could and could not moderate posting.

Just wait until you realize that corporations at a certain scale become a form of government themselves!
I've had that issue with maps TBH driving up and down 35 in Texas(among other things). Taking me off the interstate on a detour through the hood with a dozen turns, stop signs, speed bumps, unprotected street crossings... To save 2 minutes on a 4+ hour trip.

Bad Google!
ChatGDP
to be honest, you can already kind of see the writing on the wall in that quote, too. google wanted more control over the browser, I don't really think that's a neutral act, because they had vested interests in controlling a browser from the start. Of course google's reputation was a lot better back then, so people generally didn't question it too much.
I know this doesn’t help your current problem, but there should have been a list of permissions your were granting during the setup flow. Anything more than asking for your identity is the indicator that a site could cause you trouble, unfortunately.
Please define "shadowbanned."
I skipped Dart nearly completely. Early on I just read about it and concluded that it's pretty much 1 to 1 clone of JS just without some weirder parts. Since then JS and TS got massive development so I'm not really even keen on looking at Dart again.
Also open to debating the first crowd tbh having stakeholders with opposing mindsets is a positive value prop.
You’re doing the free beer versus free speech semantics thing.
> Same thing could be/has been said about std::string_view or std::span but here we are.

It's the first time I'm hearing this, and it doesn't sound like an opinion I've ever had. Those are just range-checked pointers; their ownership semantics aren't any different from those of raw pointers, and they're no less safe than raw pointers. In contrast these actually do have weird ownership semantics, and they have a propensity to introduce safety bugs into the common use cases that didn't exist before.
> What does this mean? Isn't JS blocking by default? Both languages have async support that you don't have to use...

To be clear on this, because JS APIs prioritize non-blocking mechanism to the expense of everything else (related to it the original sin of how JS interacts with a browser IMO), everything has to become async, even though in practice a lot of this stuff is happening sequentially anyways.

See this example Playwright test [0]. awaits everywhere. Because of how await works as well (Rust got this one right with postfix await), suddenly fluent APIs become awkward. You no longer have foo.bar().baz() but (await foo.bar()).baz(). (await getResources()).map(f) is not beautiful in my eyes.

And the core thing is that almost no code actually relies on concurrency in practice! So much of this is a consequence of the problem of JS not having good yielding semantics, and its interaction with the DOM in general.

Is this the biggest issue in the world? I guess not, but I very much dislike the aesthetics of this fore smaller chunks of code. I would really like a model with implicit awaiting in ~all the places that it exists currently.

I do agree that JS's anonymous function syntax is nice, and I miss it dearly in Python. Though here as well, I think Python comes up on top with all of its argument/keyword argument strategies. I get the options dictionary pattern, but dislike it.

And UI stuff is of course ... well it's easier in Javascript (though it requires its own infrastructure). There's no ways around that.

Loads of serious work is done in both language, I just think that JS is missing a lot of table stakes features given that there's so much attention to it.

[0]: https://playwright.dev/docs/writing-tests#the-example-test
It's a nice reminder that even the big players can make mistakes.
As this analysis so deftly illustrates, Malcolm Glados really is one of the best AI-generated/algorithmic authors out there.

There's a reason I own most of its books.
Why would it just be one of the first two options and never the 3rd option you presented?
I don't understand this, to be honest the more complicated it gets for the user, the more the user gets locked out by themselves. We need a simple username + password thing with an option for 2-factor authentication.

Not a madness of lock screens, passkeys, and all this nonsense.
Google shouldn't add this in Google Chrome.
While herb did a talk about `in` and `out` parameters, it is very different than this concept.
For some reason I thought battery life was more constraining than cooling in mobile devices?
I think it comes down to how limited our attention is. It is not possible to keep up with everything.
That's different to letting the person it was done too see it.
Can’t forget Interlagos as far as classic tracks go.
Not flying long distance does not mean staying home. Unless you live on a 500m radius island in the middle of an ocean with next land mass thousands of kilometers away.
Notion is very substandard in what it does to compete with airtable, or in other words, they do not compete at all.
Airtable is spreadsheets on steroids.
And notion has tables.
That model works until you have one mediocre or poor selling game, then you’re out of business. The security added by investors providing money beyond the immediate 1-2 game horizon gets you out of this cycle a bit. Of course it brings other problems with it related to game quality and decision making processes designed to satisfy shareholders instead of the audience, all of which is to say there are significant trade offs with either choice.
Define social media though.

WhatsApp is only messaging. I don't see any ads really.

It has 100% penetration because companies have still limited number of sms and mms, so nobody use those
It's all fun & games until you piss off the gatekeeper and now you're forbidden from traveling or pursuing gainful employment. Double-plus bad if they obtain extradition powers and can effectively confine you to poverty status.
¿Eso está muerto? ¡Di que no es así!
The problem is that it would be a confidence score that the words would follow each other in that order in a real text, which would be both way lower than the chances of them being correct (remember, the models are trained to reproduce their training samples), and also more correlated with what people were writing online than with the truth.
Everyone is heir to the same inherent flaws that plague humanity but smart people are less likely to practice self deception.

If you find yourself on average on the opposite side of the vast majority of smart people the first thing that is in order is self refection. While being smart doesn't make them correct the last thing that would be useful would be to dismiss the majority of smart folks.
Don't be so hard on yourself. Nearly all of just just wing it even if we sometimes claim otherwise.

Congrats on overcoming hurdles and delivering a product. Not all professional developers always achieve that.
Money laundering drove up B.C. real estate prices by 5% (2019)
The best practices about the length and uniqueness of passwords was based on the assumption that leaked passwords and rainbow tables could be used to compromise multiple accounts from a single compromise.

The current standard of storing salted passwords makes the uniqueness requirement of passwords meaningless. If companies don't properly salt passwords, then uniqueness and length became an issue again. Salted passwords are effectively the same as appending an SSH key to a chosen password and letting websites manage them. With properly salted passwords, even if everyone chose the exact same password, a compromised password database would be meaningless.

This is the reason why NIST changed its guidelines about how often a password should be reset. It also changed the guidelines for complexity rules of passwords.

"Q-B05:
Is password expiration no longer recommended?
A-B05:
SP 800-63B Section 5.1.1.2 paragraph 9 states:

“Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.”

Users tend to choose weaker memorized secrets when they know that they will have to change them in the near future. When those changes do occur, they often select a secret that is similar to their old memorized secret by applying a set of common transformations such as increasing a number in the password. This practice provides a false sense of security if any of the previous secrets has been compromised since attackers can apply these same common transformations. But if there is evidence that the memorized secret has been compromised, such as by a breach of the verifier’s hashed password database or observed fraudulent activity, subscribers should be required to change their memorized secrets. However, this event-based change should occur rarely, so that they are less motivated to choose a weak secret with the knowledge that it will only be used for a limited period of time.

Q-B06:
Are password composition rules no longer recommended?
A-B06:
SP 800-63B Section 5.1.1.2 paragraph 9 recommends against the use of composition rules (e.g., requiring lower-case, upper-case, digits, and/or special characters) for memorized secrets. These rules provide less benefit than might be expected because users tend to use predictable methods for satisfying these requirements when imposed (e.g., appending a ! to a memorized secret when required to use a special character). The frustration they often face may also cause them to focus on minimally satisfying the requirements rather than devising a memorable but complex secret. Instead, a blacklist of common passwords prevents subscribers from choosing very common values that would be particularly vulnerable, especially to an online attack.

Composition rules also inadvertently encourage people to use the same password across multiple systems since they often result in passwords that are difficult for people to memorize."

https://pages.nist.gov/800-63-FAQ/#q-b05
Essentially how GitHub works is, when you sign in with the app, the app requires knowledge and data from the user. For example a simple GitHub integration telling you how many stars your repos have, they may need read access.

When you're asked to sign in, it will show you, this application can:

1. Read and manage your stars
2. Read and manage your repositories.

Be very careful when granting applications access because they can misuse it like this. GitHub integrations should be verified for editing repos and editing stars of the user, but that's just my opinion.
What the congressmen did was illegal on their part. What Twitter did was at best unethical, but ironically, severely tampering with our election which the fake left seemed to be so upset about. The tweets weren’t propaganda, some of them were about Joe Biden being involved in illegal deals with eg China. The source information for this, his sons laptop, has been verified as authentic by for example the Washington Post.

There is no way to bend far enough to excuse what happened here.
??? Genuinely at a loss. You're conflating CEXs and DEXs to make a point about how "crypto does not prevent fraud". I said sure, if you want to include CEXs in "crypto" then "crypto" does not prevent fraud, but self-custody solutions like DEXs still do.
Vancouver Dirty Money Part 1 (250 pages), https://icclr.org/wp-content/uploads/2019/06/Gaming_Final_Re...

Vancouver Dirty Money Part 2 (360 pages), https://icclr.org/wp-content/uploads/2019/06/Dirty_Money_Rep...
cool!! share website link
The China edition launched in 2017. It has 500 million users as of Oct 2021. It's based on Bedrock Edition, not Java. This is 100% a Microsoft scaling thing.
how much karma do i need to downvote posts on hacker news?
Exactly. Elon is going for theatrics but none of the releases are big enough to break through to the average person. All of them together might but these scraps of news aren't doing it.

Also they cite these right wing personalities being suppressed but honestly there are so many of them, of course some will be flagged. I'm pretty left leaning and I'm struggling to even think who would be the leftwing equivalents of some of these names. We don't really coalesce around political personalities so who would there be to get flagged?

The presentation of these details is being done in such an overtly gleeful right-wing manner that it's hard to take it in objectively.
im addicted to spinach, red meat and kombucha halpppp
Oh, this is great stuff to know - thanks. I had my ThinkPad (X230) unplugged and it was down to like 3% after just 20-30 minutes. It used to last a couple hours, just a year ago. Guess the battery is basically on its last legs, which is unfortunate as I don't think Lenovo makes a battery for this model anymore... :\
I'm not claiming they're the same. What matters is that U2F is what many websites implemented, which is why those problems arose in the first place.

This time, websites will implement "Chrome passkeys", which will be almost-but-not-quite WebAuthn, just like Internet Explorer's box model was almost-but-not-quite CSS.

If there are only two or three major players and the standard is sufficiently complex, "standard" becomes synonymous with "what iOS and Android do".

But to answer your question:

> So, again, what about WebAuthn is proprietary or complicated?

The WebAuthn standard is 184 pages of A4 size. That's a technical document, the length of a typical novel. Are you seriously asking what's "complicated" about that?
The private keys are encrypted when synced from one device to another. The key for this encryption seems to be a short PIN or biometrics.

Is that true?

If yes, the platform provider can easily decrypt the encrypted keys on their servers.

If not, what’s the other secret known only by the user that encrypts the passkeys in transit? I hope the option of a password is provided.

Further, a closed source unverified password manager such as the iCloud Keychain doesn’t sound a great idea. I could use passkeys in Android (and if there is no external hardware key support), but not on Apple’s platform.
> However, this whole discussion is happening against the backdrop of a seemingly overwhelming majority of people in this community and the wider political sphere in the US asserting that it is in fact a big deal

I disagree with this, you are clubbing two groups together here. Yes, the wider political sphere in the US might be concerned because a billionaire can upend their carefully orchestrated social media campaigns. And I personally couldn't care less about that. For that matter, do you care about how well your favorite politician's next Twitter ad campaign goes?

Users in this community, on the other hand, are almost certainly technically proficient enough to back up their Tweets and quickly migrate to Mastodon or Tumblr or their favorite social network, should the need arise. In fact, dozens of us have already done so! For us, Twitter turning into Truth Social tomorrow would not be a Big Deal. This is consistent with my statement that the (probably) slightly left-leaning moderation on old Twitter was also not a Big Deal.