skysight-inc/HackerNews huggingface dataset:
I look forward to that, but as it stands currently, only Google and Apple's password managers are supported. All of the support documents mention its tied to the OS and linux support isn't planned. The table on this page shows there are no plans of "Local user verification" or "Passkey sync" when using Linux.

Additionally it also states that to access the passkey, you need to log in to the given Google account.

"Passkeys generated in Chrome on Android are stored in the Google Password Manager. These passkeys are available on all other Android devices as long as Google Password Manager is available and the same user's Google account is signed in."

https://developers.google.com/identity/passkeys/supported-en....
London, NYC, Lugano, Singapore. Wait… Lugano? I mean I know it’s a nice city in Switzerland but?
Or use a third party password manager where you can export the keys to some other storage if you wish, or apply other security measures to access those keys?
> Are there any opensource projects attempting to build ChatGPT-like models like what Stablity has done?

There are open source Large Language Models (GPT-NeoX-20B, for example).

Running them (and even moreso, finetuning them) locally takes quite a bit of GPU and associated RAM.
Last but not least, now, even in private browsing the public key used could easily tell which device you are using.
Look on the bright side: implementing, supporting, and fixing this over the next decade means job security for everyone here.
I think you missed my point by taking the example too literally. I'm saying that being well-educated (in a classical sense -- deeply knowing Latin, Greek, Philosophy, Mythology, etc) used to be considered impressive. It would dictate your value, socially, to a large extent.

That has transitioned to being good-looking, along with the amount of your wealth and how you spend it. Education and intellectual endeavors are no longer in the mix.
Sounds like we've tried a lot of the same things!

I was asking it to generate an image and encode it as Base64 -- failed miserably. Then it turned out whatever image I had it cook up, the Base64 version would be the same malformed string.

For "legal advice" it was super helpful in finding sections of the legal code relevant to my query. It also happily returned cases where rulings where the accused was found guilty and not guilty -- but searching for these cases in the archives of the courts it claimed they came from found no results.

The way I understand the reasons behind these.. anomalies? hallucinations? is that this is precisely how this model works - it constructs sequences. For natural language, it works well enough, but if you need to deal with facts, then it can easily stray into a dream world.
I bet a large fraction of HN didn't know anything about Twitter's moderation; this is normal. I also bet a large fraction of HN did know.
Tom Clancy Speaks at the NSA (1984)
If you think all of the news orgs you just listed have a particular slant, then you'll have a problem. If you don't see a slant because you honestly believe they are neutral or you just happen to agree with them, then of course there's no problem to see.

I'm not saying any of those have a slant or not. I'm just seeing how it's pretty obvious there's going to be public perception problem with your list
> or any other password manager that supports passkeys

Hopefully they will allow third party password managers to provide these to the desktop browser, even on Linux. This seems to be how 1Password etc. are planning to support passkeys.
What is the business, if you don't mind me asking?
Thank you for adding this explanation! It helps catch the mistaken assumption one might make, that "adding X does not imply the compiler's source code also immediately starts using X".
I don't see a problem with this either. If companies want to charge for some opinionated blog drivel about their market predictions or how work-from-home is bad for the economy then so be it, at least it is obvious that those are biased... but to pay for fear porn in regards to current events is nonsense.
Then use your own password manager that supports passkeys?
But it is more of a language model rather than a coding model?
Is there anything like Blender Nodes, but for data modeling? It's an amazingly powerful system. [1] The learning curve is still fairly steep in terms of having to learn all the nodes and how they interact, but you can't make a syntax error.

[1] https://www.youtube.com/watch?v=7EeIsUErzLE #nodevember - Simon Thommes - Procedural Shader Showreel (Blender)
I can confirm this. Poodles work well, I have one on me now.
It's just jaw-dropping how naive passkey has been in trying to pretend browser implementers can do the right thing for users, when the vast epic & total security threats you describe are so readily & obviously apparent. The unwillingness to support real security keys as is the case with linux is just further fuel on the pyre of what a shit not-actually-pro-user attempt this new regime really is. It's all so mediated, so centralized, in big cloud shit.

There's this anti-user mania that users will fuck everything up so we absolutely cannot let them do things like export keys. But this chicken-little sky-is-falling pretense just keeps being an excuse for bad tradeoffs that in no way favor real actual people at all.
It's hard to speak for Apple why Safari is where it is.

Pro: battery life

Con: lagging behind on some features
Best to just be cautiously optimistic I suppose. It’s not like there’s much choice.
I see a lot of negativity and skepticism in the comments, and I think it's worth saying quite strongly: if you're reading comments on Hacker News, you're a power user, and you already probably have a good password management system. Either you're superhuman and memorize thousands of different passwords per site, or you have a generator or other system for generating unique passwords and storing them. You may also have security keys, TOTP generation, and an innate ability not to be phished.

The reality is the vast majority of the globe does not have any of these traits. People create bad passwords that are reused all the time. People willingly disable 2FA for convenience, or get phished. In attacks over the summer, we've seen people take bribes to just give over passwords and 2FA codes. Passkeys are predicated on a 2FA-by-default philosophy that solves a lot of real-world problems the vast majority of people have. This is a huge win for normal people who use an Android phone or an iPhone in the default configuration and just need to login to places. It may feel like it's too heavy of an instrument for you because your solution is more convenient and well-understood, but most people struggle with this on a day-to-day basis. In my book, passkeys are still not perfect, but they definitely are better than passwords for 99% of the world.
In principle, none. In practice, many websites will check the user agent and flat out refuse service unless it's one of a pre-approved list of implementations, regardless of whether it would work or not.

This has been happening for a long, long time already, for many browser features, and such "standards" pushed forward by the major mobile vendors will only make the problem worse.
This idea or effect has been around for Astro and even 10 years old video camera. What is new ?
So websites will have whitelisted platform support instead of using the Webauthn / FIDO standard that Google, Apple, Microsoft, 1Password, and others are supporting?
For imgur on Android, I use ImgurViewer[1], which can display images using apis from a bunch of different sites (imgur, Reddit, gfycat, etc) as well as anything that ends with a common image extension. It's a far superior interface, and ability to swipe it away makes it more seamless, like it's just part of the app you opened it from.

For the browsing in Firefox, there's multiple extensions you can use to add the referrer and get the image directly instead of a redirect (see [2], though I'm not sure if it works on mobile)

Alternatively, use Rimgo[3], an alternative frontend to imgur. This page also lists several ways to automate redirects from imgur domains.

[1] https://github.com/SpartanJ/ImgurViewer
[2] https://addons.mozilla.org/en-US/firefox/addon/referercontro...
[3] https://codeberg.org/video-prize-ranch/rimgo
I log in to devices I don't own using a password+2factor. I have a long but memorable password that I just type in. I don't have some obtuse password where I require a password manager to log-in, I refuse to use the suggested password that chrome generates. What is the point of a password I don't remember? I am going to link this helpful xkcd comic https://xkcd.com/936/ that was published August 10, 2011 that is still relevant.
Maybe we're having different experiences on the web, but I've found that there is _significantly_ better support for security keys on the web than there is for Passkeys. Many sites will give the option to use either but only registering security keys actually works.
I actually really like Chrome, well Chromium, despite the negative perception about Manifest v3. I truly hope that they work out the kinks quickly enough to resolve some of the concerns. I do get that the new API in some ways is safer for the average user, but there are power users that should be able to do what they want. Unfortunately, ad-blockers go against a business model that is central to Google. Despite the changes possibly being in good faith, it has only harmed their public perception and they may never recover from that unless they try to address and resolve the concerns publicly.
So then the problem is worse than people thought.

I am glad that you agree that this is such a huge problem, and it is a good thing that now more people are away of how extensive it is.
Lol. Architects have little do do with those, that’s builder grade dreck all the way.
Password+2 factor sends your password across the wire to the website, and trusts that website and the path between to handle it securely and not store or log it anywhere.

Passkey never sends your private key to the website you are signing in to.
Sure, he argues for stronger anti-trust enforcement.
The threat model: a device is stolen, the credentials there are poorly encrypted, credentials retrieved, used to access your bank account and siphon off all the funds.
How would the application work? Someone submits photos of a person and their parental candidates to determine the likelihood?
Another terrible thing coming to my mind, by definition you will probably not have 2fa when you connect with passkey.

So, now think about Google chrome feature of "backup user passwords" that they always try to have user enable automatically without noticing. And that is not e2e encrypted so they can access any of them along with your wifi passwords.

Will they not save the passkey there for sync with other chromes? Because otherwise it will be directly game over for the normal user. Any google employee or gov or hacker will be able to connect to your accounts even without 2fa. A lot better for them that the current situation with passwords and 2fa.
Kadaza, founded in 2008, is a visual web portal
I’m shocked that what everyone said would happen is happening. It’s insane that we aren’t shifting to EVs (which transmit energy by power line vs oil pipelines). It was one thing when we didn’t have the technology, but now we have the tech and the capital markets to make it a reality.
> continues to go unchecked as though it were law, which it is most certainly not.

On the contrary, Andrew, corporations are chartered through a particular state's corporate code. In every case I'm aware of, the shareholders are the ones who own the company. The "stakeholders" (employees, customers, neighbors) have legally defined rights, which do not include ownership. So it most certainly IS law.

From https://short-facts.com/how-many-major-corporations-are-ther...:

The US Constitution was interpreted by the US Supreme Court to allow corporations to incorporate in the state of their choice, regardless of where their headquarters are. Over the 20th century, most major corporations incorporated under the Delaware General Corporation Law, which offered lower corporate taxes,

These 181 CEOs: did they have any rule-making authority? Or was that result just the opinion of 181 people?

What about all the corporations and single-proprietor businesses that were not part of that? Or the state of Delaware, whose laws govern most of them? Not to mention the Congress and the courts.
It's really not -- at least not in the finer things, which is what we're talking about.

Yes, you can enjoy pistachio ice cream; feel free. But the Louvre doesn't choose what it puts on its walls randomly. The curators don't shrug their shoulders and say, "Well, I mean, it is relative."
Well if we're making up things that websites haven't done yet then yeah I'm angry too.
OK, let's play with the analogy of Type I vs II thinking, and we apply our understanding of the transformer architecture. If we directly ask ChatGPT to decode the text, it is relying on its Type I system. That is, it never has any internal thinking about the question. The only place to inject "internal thinking" into the transformer is to allow it to ponder upon its previous output. The following prompt correctly answers the original question:

> Print the substitution table for ROT-13. Then decode the following text: jul qvq gur puvpxra gur ebnq?
Definitely not. Different products.
How many days til this clogs in fire season?
Aurora Droid was great, but it hasn't been updated since March 2021. I prefer Neo Store:

- Neo Store (GitHub): https://github.com/NeoApplications/Neo-Store

- Neo Store (F-Droid): https://f-droid.org/packages/com.machiav3lli.fdroid/
I mean, obviously all of them have slants. I am saying that generally well respected media organizations exist right now without depending on ads, and I don't see what ads-supported media organizations add over that, except variety. Opposing slants are also represented: Xinhua News and Russia Today will survive without ads. I just didn't list them because they are less respected.
> Overall, I don't really see too much that would cause me to gasp with horror.

I didn't "gasp", but, silently blocking an esteemed scientist is indeed horrible.

He, and who knows how many others, presented sensible analyses against extended lockdowns in schools. This dissenting view, like with the lableak theory, was systematically blocked from ever reaching journalists eyes, and thus from reaching parents minds.

The harm done to an entire generation of children is very real. The opportunity cost from wasting vaccinations in children is very real. The discussion was warped, and the narrative was rammed down people's brains. There are second-order effects with that kind of brain power-washing at mass scale.

This wasn't an isolated incident either. Literally millions of posts were removed and shadowbanned to various degrees. No one at any of these companies has suffered any semblance of accountability in any form.
VF happens at google and other big tech as well, probably even at a larger scale. And they have a right to do so, but once a complexity reaches a certain level, they should be considered publishers and be fully responsible for content, just like a newspaper editors are.
UK businesses sue Google over lost ad revenues
No, the vast majority of mass killings in the US are by right wing extremists, resulting from the vast number of calls for violence from right wing leaders and social media posters. Misinformation and mass delusion like QAnon is way more prevalent on the right. And so is denial of reality like Alex Jones' attacks on Sandy Hook parents. Where are the equivalent of QAnon and Alex Jones on right?
The article doesn't specify how the backup is encrypted, but it says that in can be decrypted with a PIN or unlock pattern. These are weak keys and can be easily bruteforced by Google.

Also if you get banned from Google then you might lose access to your keys.
That is the purpose of 2 factor. 2 factor + password matches those same goals. I am not worried about transmitting my password on a device I own to a website I trust. If I am infected with malware, my 2 factor and separate login recovery email will keep me safe. I understand the theory of using SSH like public private keys to move one step away from passwords, but the reality is if I don't have control over the private keys, they are not my keys. Not having control over my private keys outweighs any benefits I would get from using WebAuthn.
sorry, I meant to comment on politics rather than your individual situation - I have no grudge against you as an individual, best of luck with your business
Tell me you live in the Midwest without telling me you live in the Midwest.

Sorry if that's wrong. This was a feature of my boyhood, but I've never seen it in California.
Sure, if you want to use Chrome + Google password manager.

The linked article does say that they will support other password managers on Android at least. And Webauthn/FIDO can be implemented by other browsers and password managers as well.

If Google doesn't let third party password manager extensions on Chrome desktop provide passkey support, then that's pretty bad and we'll probably hear from 1Password and LastPass about it since they are also part of the FIDO alliance.
> Accustomed to being always at the top of his class, Heisenberg found it hard to accept the lowest of three passing grades for his doctorate

What part of "passing grade for his doctorate" did he not understand? And certainly it's not entirely bad to learn how to deal with something less than complete success occasionally.

But it seems to me like he correctly optimized his efforts. If he had scored higher, it would have meant that he had wasted time and effort that could have been better spent working on things he was actually interested in – like his eponymous uncertainty principle.
I have found the same. I was asking it yesterday about calculating rental yields for our rental property. Usually it understands the context from the whole thread, but I found myself repeating myself a lot when asking new questions about possible scenarios. This is at odds with how well it knows the aws-cli, ffmpeg and yt-dlp… and bash. My productivity at the command prompt has skyrocketed… but it really flounders with doing financial calculations.
Not quite, but close. They'll convince website owners that for "security reasons", they should refuse passkeys that came from third-party password managers or anything else open source, and instead only accept ones that came from something remotely attestable to be theirs.
What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"?

The FIDO alliance also consists of far more companies than just "Google, Apple, and Microsoft", although they're certainly members. https://fidoalliance.org/members/
Thanks for all the hard work you and your colleagues put into Julia!
I like keyoxide but i really hope we are not subject to bullshit misuse of submissions like this ever. Hiss boo!
Also my submission is a "dupe," but it was posted before the thing it is duping. And second, Washington Post broke the story. At the time of publication, there was not FTC blog. And the only other news outlet that had the news was Bloomberg, but its story was yet to hit the web and was only available to Terminal subscribers.
Yes, the secrecy does matter. I think can immediately think of two big reasons:

1) We should censor for how things are said, instead of what is said. When censorship is carried out secretly it will inevitably trend towards abuse. One of the examples given in these leaks is that @DrJBhattacharya [1] was secretly put on a trends blacklist because of what he was saying. He's a well spoken doctor and Stanford epidemiologist, but he publicly spoke against the political measures being taken against COVID, such as lockdowns. So he was blacklisted. That's just so incredibly wrong, and enabled only by secrecy.

2) Again with the goal of adjusting how things are said, instead of what is said: If you think somebody is an idiot, saying that accomplishes absolutely nothing besides sending discourse to the level of a dumpster dive at a cheap seafood joint on a hot summer day. By contrast, engaging in good faith and simply discussing the topic not only keeps the conversation healthy, but might even actually change some minds. Secretly censoring the shitposter does not really encourage him to engage in a more productive fashion, because he may not even realize he's behaving a way that's not really considered acceptable, let alone attempt to correct it.

---

Literal spam is a different topic, and I think conflating the two is disingenuous. Doing things like blacklisting doctors because of what they say has little to do with banning somebody trying to impersonate other accounts and spamming 'give me 1 and I'll give you 2' crypto scams.

[1] - https://twitter.com/DrJBhattacharya

[2] - https://www.nytimes.com/2022/01/04/briefing/american-childre...
I mean if costs go up and Taiwan gets invaded there may not be an option to pay more. It’s either that or you don’t get chips.
That's amazing and exactly the spirit I was thinking of - thank you for sharing!
What Is “Escape Room” and Why Is It One of My Top Genres on Spotify?
It's generally assumed investors can read. https://blog.twitter.com/en_us/topics/company/2018/Setting-t...
Wonderful idea, thank you :)
Constructed international lingua francas like Esperanto, Ido, Interlingua, etc.

https://en.wikipedia.org/wiki/List_of_constructed_languages
> With WebAuthn, nothing can be exposed.

With solution proposed by Google, the keys are stored on the phone. If an attacker gains access to the phone using one of numerous vulnerabilities in Linux kernel, they can bypass any biometric locks. And PINs are short, so they can be easily bruteforced.

The better solution is a physical hardware key that doesn't have tens of megabytes of ponentially vulnerable code and is not controlled by Google.
I was browsing music on Spotify and kept seeing this "Escape Room" genre label on what seemed to be very divergent artists. I noticed that particular bands connected to genres such as industrial, hip hop, noise, pop, indie, lofi, jazz, IDM, psychedelic and punk were all being tagged "Escape Room". I found this all very curious, so I consulted google and found this article.

The genre is one generated organicaly from spotify-users' listening habits. The spotify reccomendation algorithm grouped these artists together, despite being quite different on the surface. The article discusses the everynoise.com site, which is a very interesting and useful tool that maps all genres on Spotify. I've used this tool in the past. I looked up "Escape Room" on everynoise and found that many bands that I listen to are in it, mostly along the outside edges of the cloud, but a few toward the core.

I never noticed many similarities between some of these bands, so I found it very interesting that spotify was able to lump them all together and find commonality between them.
How are you supposed to make use of those backups if Google decides to unperson you?
Very next submission is about they keystone pipeline being shut down for yet another huge huge spill.

https://news.ycombinator.com/item?id=33917471
Does it still create a unique ID on install and send it to Mozilla?

The only possible use I can see for this is user tracking.
std::midpoint does different thing in terms of rounding, therefore comparison is not fair.
Try Here Maps. I think you will be pleasantly surprised. Supports offline as well.
That's the purpose of the 2 factor. The "private key" used to generate the 5/6 digit pin stays on my device and isn't transmitted.
Then why bother with Webauthn and the FIDO alliance instead of just making this part of Sign in with Apple / Sign in with Google? That seems easier for Apple and Google if their plan is to be the only sign-in providers.