skysight-inc/HackerNews huggingface dataset:
I hate that HN users downvote concepts they disagree with.

One can agree that rotation is good in theory and bad/annoying in practice (due to laziness). We can only argue about how much of an impact it makes, but it certainly does not reduce the security.

We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier.
I’m sure I already know the answers from experience after becoming obsessed with KPIs as the solution to startup problems to seeing how companies just game vanity metrics. But could you provide some examples of why it doesn’t work in a school environment?

My best guess: It is possible to weed out non-productive KPIs, they are still extremely useful for breaking down reality distortion fields, but it takes an honest and thoughtful person with a good grasp of both the business and how the stats are collected - combined with management buy in. I have a feeling highly bureaucratic gov organizations won’t have either the talent, iterative approach, nor incentives to actually find the right metrics that matter.
I think the main thing missing from this simplistic analysis (which I would tie back to Dawkins' "The Selfish Gene" and the gene-centric view of evolution it proposed) is that organisms don't need to just replicate themselves, but also their environments. I mean look at lichen. A small colony of organisms from completely different domains of life and they would die without each other yet that algae would obviously prefer to replicate the fungi it partners with over some other species of algae. Bison need to keep grasslands healthy, worms need to keep the soil organisms alive, mycorrhizal fungi need to keep plants alive, plant roots have a large toolbelt of chemical dances it does JUST to cultivate the specific soil bacteria they like, our gut bacteria have it in their interest to keep us humans thriving and interacting socially, myrmecophyte trees attract and support ant life, capitalism needs to replicate artificial scarcity, parasitic plants like dodders actually provide a whole host of benefits to its hosts like acting as an above-ground communication network, beavers practice "niche construction", most "weeds" occupy a specific niche where they grow in disturbed soils only to "work themselves out of a job" by conditioning the soil to better health allowing for ecological succession to take place (e.g. dandelions decompacting soil), and your dog would very likely kill another dog (extremely genetically similar as they are) in order to save your life.

In the 1990s a cholera outbreak in South America created an interesting natural experiment. In some countries it was a deadly disease that spread through waterways. But in places with better hygiene, it couldn't spread through those typical pathways. So it eventually evolved into a much milder form in order to allow people to go out and socialize so it can continue to spread

This is why every single deadly pandemic has been zoonotic in origin. The black plague, covid, hiv, etc all came from other animals. It's a matter of maladaption. All the diseases that have been closely associated with humans for thousands of years have instead evolved to... not kill us. Some of them even became an essential part of our microbiome. Even herpes, a rather ancient human "parasite", actually plays some beneficial roles in our immune system. The microbial universe is a prime example of how organisms need not only replicate themselves but also the environments in which they thrive
This is how stats lie. Success is based on measurements across short time spans because that's the only way to reliably correlate features to behaviors. There's no good way to measure the impact of a bad decision across years or decades, so the dark pattern gets away scot free. The only thing stopping it would be a particularly impactful survey or focus group, or worse yet user outcry.
I'm not sure I get the issue people have with autofilling passwords, instead of making the user copy and paste.

Every password manager I've used associates those credentials with a URL. One of my accounts used to get them confused, because the company offered a dedicated login page and login via the home page on separate subdomains.

So that feature might make it harder to get phished by adding friction. And if an attacker has malicious code running on the legitimate website, how would you know?
Hello! I’m the creator of picoCAD - thanks for the nice comments.

Happy to answer any questions about it if you have any.

If not, feel free to check out my patreon! :D
https://www.patreon.com/johanpeitz
Books usually will not tell you what kind of cheese the moon is made out of. Properly prompted, ChatGPT will.
All we need is for crypto exchanges and brokers to be regulated by the SEC just like other securities dealers. Exchanges have to have a national exchange license. Brokers, dealers, and exchanges have to be separate. Customer funds have to be held in bank accounts. Cash gets FDIC insurance. Crypto assets held by brokers get SIPC insurance. FINRA regulates people in crypto and can discipline them. Everybody gets formal audits.

You can still lose money because something you bought went down. But you don't lose assets some broker was just holding for you.

Japan does it this way, since the Mt. Gox episode. FTX Japan users are getting their assets back.

The SEC has the authority to do this right now. They won a lawsuit back in November.
They've been holding off on bringing the hammer down on unregistered crypto securities that hadn't been shown to be frauds yet. They have no reason to hold back any more.
> Even if you move all of their code and mandate that they have a shell company in the United States, and you mandate that none of American data ever goes to China, they can ignore you. You validate that every request only stays in the United States? How do you validate that there's no communication between the two systems?

> The state they operate in is going to make whistle blowing very difficult, not ever allow proper auditing into the state apparatus which ultimately controls the company.

You can have auditing and whistleblowing on the US entity (and include a promise of asylum in the whistleblowing protection), and big fines if they ever send data offshore.
It should be safe to assume that Dockerfile create the same (or really similar) image everytime. So builds should run the same in different machines.
Google says Firefox is making it hard which is also a very convenient way to force users to use chrome (and log into their google account to enable the feature because… why?)

Other video conferencing software like jitsi meet doesn’t seem to think it’s too hard for them to implement as blurring works perfectly well there without chrome or logging into google.
> seriously believe

Of course not. They're just never going to admit they're doing a bad job, and need a messenger to shoot.
Some banks so this: you need an id (not your account number), a password you chose and a code the bank gave you when you signed up
I suppose if the height of achievement we are targeting is "elementary school administrative assistant", then, yes, perhaps our under-educated, grade-inflated students are well on their way to ride that wave of success. But if we are hoping for something a bit more ambitious in the domains of medicine, law, or engineering, I think our students will in fact one day discover that, yes, the jig is up.
Math tests are hard to game.
Passkeys, which are getting closer and closer to prime time. If you think about it, key-based auth is already highly recommended and utilized in many scenarios (like SSH, signing data, certificates, token authentication for use between servers, etc.)… this just makes that accessible to users.

The vast majority of people don’t even use a password manager, and use variations of the same password everywhere. That’s really unsafe. Passkeys are always unique.

Another thing is phishing. The big issue with phishing is how easy it is to make a website or popup look identical to a different service. And if it’s believable enough and the domain is hidden, you’ll put in your real password. Passkeys fix that because they only work on the site in question. No danger of leaking it to someone else!

So this will make some huge improvements in security. Basically taking care of the very basic things most people don’t do. Password managers solve many of the same problems, but are potentially less convenient in some scenarios. (Obtuse password requirements, password field not working with paste, etc. it’s just a 3rd party workaround.)

But like you said, the social aspect is still a huge problem.
I really don’t understand why they didn’t just encrypt the whole records.
Not only smoked meats, any meat/fish/poultry cooked at high temperature (above 300 ºF) contains carcinogenic substances [1].

[1] https://www.cancer.gov/about-cancer/causes-prevention/risk/d...
You don't see a difference in openness between a proprietary programming environment and an open source language using an open standard drawing API?

Are you maybe saying canvasses are a step back for accessibility? Because I do see that problem (though hopefully it will be addressed).
> if [...] the domain is hidden

When is that?
One of my first hardware|software projects was a hair cutting robot, that was the early 1980s.

[1] https://books.google.com/books?id=V1l3QgAACAAJ

https://www.elizabethsbookshop.com.au/shop/fauna-and-flora/a...

[2] https://www.youtube.com/watch?v=6ZAh2zv7TMM
Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation.

Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services.

Side note: I despise rotation as much as the next guy, but I can see the value in it. If users used password managers, generated passwords and not reused passwords, then we wouldn't need such rules. But alas 1234567890 is a common password.
Shameless self-promotion, I made a similar thing in Quake: https://youtu.be/xVLtnKyRSb4

I love this write-up, especially the interactive diagrams at the end. My vid doesn't go into as much detail on the actual circuit design, but like the article it uses a bunch of BCD ripple-carry adders. For output I use standard 7-segment decoders. As noted in the comments there are faster ways to do logic in Quake which I overlooked in my research, but to my knowledge noone has made a circuit this large before. I've put the source code on github for anyone that wants to take a deeper look: https://github.com/matthewearl/q1logic/
> it certainly does not reduce the security.

Yes it does. The more often you have to pick passwords, the more likely you are to pick weaker ones.

> We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier.

When a credit card is about to expire, doesn't the new one the bank sends you usually have the same number?
Just let teachers do whatever they want with periodic evaluations, if the teachers suck move them around. Do the same with students. The shuffle will get the good teachers with good students.
Yeah I thought the same. I don't think 1Password is immune to security issues. However, after seeing several things I did not like in LastPass development, I decided 1Password was the safer bet. Knock on wood, they claim they've never been hacked and I hope it stays that way.
Author here. As you can see in the closing lines:

> I really hope that passwordless login will make some steps forward in the next years

But, in the meantime I wouldn't despise passwords THAT much, if the policies were not stupid. Using any kind of SSO (e.g. login via Google or MS or Apple) puts multiple accounts under the umbrella of some internet giants; if at any time they revoke your account, you risk losing access to multiple other unrelated sites (not to mention the fact they'll know even more usage patterns).
If you randomize the types of questions enough every year, the best preparation for passing would be to just teach the general subject.
> I don't think that is how it works.

Well, simply put, you are wrong.

> Someone has to guaranty that $250 million will be paid if SBF skips town

Yes, they do. Technically, the court could accept that guaranty from SBF himself, alone, and with no property given in security. It has, however, not chosen to be that trusting.

> The person guarantying the $250 million has to prove to the judge they have $250 million to pay in the event SBF skips

No, they don't. Federal law permits unsecured bond, fully secured bond, and anything in between, optionally in combination with nonfinancial conditions, so long as the court is satisfied that is sufficient to adequately insure appearance.

In this case their is a bail amount, partially secured, multiple sureties (who probably don't have sufficient assets to cover the $250M, but that's not actually the point), and a raft of nonfinancial conditions, and the court is satisfied (the fact that prosecutors also approved the terms probably helps there.)

> If a bail bondsman is used SBF would have to pay the bail bondsman $25 million to give that guaranty to the court.

Probably not in New York, given that while 10% is the maximum premium for small bail amounts in New York, it asymptotically approaches 6% for large bail amounts. But, in any case, a bondsman has not been used, so this is irrelevant.
The Amiga supported both chip and fast RAM, precisely to solve the problem you're talking about. What you mention here was at most an issue with your particular machine, not a limit of the platform itself.
You both have a point. For my own career I found the advice of Oliver Burkeman helpful, who put it in a very apt and actionable sentence:

> When stumped by a life choice, choose “enlargement” over happiness.

The good part is that there‘s still a lot of jobs out there who both enlarge you and make good money. They‘re just harder to find.

https://www.theguardian.com/lifeandstyle/2020/sep/04/oliver-...
What will you do if Google decides you’ve broken some terms of service and you lose access to gmail and all other Google resources? You are giving them the power to disable access to non-Google websites. And you’re ok with that?

HN is littered with people who’ve experienced Google bans. An article hits the front page about it seemingly monthly (and those are only the ones that get publicized). It happens again and again. You have no recourse. There is no one to call. There is never an explanation.

I’m not here to convince you. To each his own. If you dont care about the privacy leaks, then surely you can overlook the risk of losing access to your non-Google accounts whenever Google decides.
One way to tell if it's an AI chatbot is if it doesn't make any spelling or grammatical errors.
Write docs religiously or not at all
Maybe Nix[0] is what you want. It is founded for providing a way to produce reproducible builds.

[0]: https://nixos.org/
Okay. Go ahead and form that organization and let us know how that goes for you.
This is a great example of serverless machine learning with modal.
This is such an overly cynical answer. I've used ChatGPT for recipe suggestions many times now, based on ingredients I have available, or what equipment I have - and to make adjustments to the recipe and measurements. I can use natural language, specify flavor profiles or regions and it will suggest something great 99% of the time.

Already 100% preferable experience than using Google and digging through links. It's value is already evident at this early stage - and it's only going to mature.

I dont know if you're just being contrarian, but you cannot have "unconditional trust" in anything on the internet. If you're unconditionally trusting google search results you've got a bigger problem than ChatGPT.
I did something similar, but targeting macOS on x86_64, so a lot of things were available through catalyst:
https://github.com/zydeco/aah

I abandoned it when macs with Apple Silicon were announced, only some simple apps could run (GeekBench would crash through the Lua test iirc)
> Visual Studio Code can even operate in "remote" mode where it tunnels into a Docker container or Linux server and acts as-if the remote target was the local machine.

Of all things in this comment this one is the funniest, because Emacs was able to do it for years (decades?).
Aside from the phishing issue, which I don't find convincing anyway, auto-filling vs. copy/paste is a choice between browser extension security and clipboard security.

Personally, I use 1Password without any browser extension and I choose to copy/paste my password from the 1Password app into the password field on a website. Usually I type the username/email manually.

If my clipboard is compromised, then an attacker will get only the password for only the current website. They won't even know the username or website it's associated with.

On the other hand, if a browser extension for my password manager is compromised, the impact could be much more severe and widespread. In some scenarios an attacker could read my entire vault.

Also, if my clipboard is compromised, then probably so is my entire OS, in which case all my browser extensions are too.

This is my personal preference, but frankly I think it's just bad advice to use a browser extension with your password manager, and especially bad advice to use one with auto-filling behavior.
I found out, when I started using spell checkers, that my spelling isn't as good as I thought it was. Embarrassing.
"Works best with Safari and Chrome".
Welcome back to 2003.
Sounds identical to the results of a google search in the era of blogspam.
Biggest financial data breaches of 2022
It's possible with Paylib here in France.
>U.S. has the most violence-ready population of young men on Earth, and it's not close

Can confirm. I have seen South Park.
That doesn't seem right. Homeschoolers are required to take standard tests at the end of every year. I'd imagine private schools are the same and the truth would come out then.
Python malware starting to employ anti-debug techniques
The big question is why haven't standardized tests been under the same pressure as school grades?
It's too variable. A teacher has a variety of classes with a variety of children that changes completely every year. The outliers are enough to impact the metrics significantly but leaving them out paints an unclear picture. As well you have additional high variability of an individual students performance at any given time. This variability is greatest in the non-outliers which matter the most.
I love the idea in principle but, this is a tough sell. As much as I want to delete traditional social network apps (Facebook, Instagram, etc) from my device, I simply don't see that happening. Most people willing to pay $8 / month will want something out of it and as a result, it will be used mostly by professionals and content writers (as evidenced by the showcase in the home page). IMO, this is better suited to compete with public social networks like Twitter and LinkedIn. I wouldn't use it as an alternative to Facebook or Instagram, which IMO is far more detrimental to society than Twitter or LinkedIn. In an ideal world, I would like my friends and family to get off of FB and IG to use something like this but, I don't see that happening.
He did, but if it were not extortion then the person running it would come back with a "no" rather than a counter offer.
Only for the next week.[1]

Forget "discounts". Show me the final price as delivered with all fees and taxes included.

[1] https://www.cars.com/articles/tesla-offers-7500-discount-on-...
> Do folks like Zinger seriously believe

Folks like Zinger believe whatever the narrative prescribed by the institution in which they're very comfortably ensconced require them to believe. In this case we're dealing with someone that directs the education of teachers and awards UC Irvine credits, which automatically deliver higher teacher compensation as per their union contracts. You won't be surprised to learn that these courses are rather easy and short; typically just sitting through a few lectures.

It's a racket, and you're listening to a racketeer.
Depends a lot on what you are trying to accomplish.

The inability to get something akin to VT220 terminal access and shell scripts on a POSIX-based system without resorting to a virtual machine (a la WSL2) is a deal-breaker for me. The steps for using scripting languages (e.g. Node, Python, Ruby) is typically entirely different on Windows than it is from all other server and desktop platforms.

For those who can spend their time nearly 100% inside an Electron-based or Java-based IDE however, it matters a lot less whether that IDE is running Windows, MacOS or Linux.

> On Windows, x86 and x64 Linux Docker containers run in process isolation at full speed, unlike on Macs where there is CPU emulation required.

You do realize they didn't require us to all burn our old Intel-based Macintosh computers, right? Apple even still sells Intel-based Macs.

Windows requires emulation to run aarch64-based containers. Except on Windows for ARM of course, where presumably they run full speed but those x86/x64 containers above require CPU emulation.
IQ is actually trending downwards in developed countries for the first time so, "yes."
Is there any way to join the waitlist for the software?
Apt install g++-10 installs Clang-10 instead of g++-10
Unfortunately there are so many ideas that will "never" gain ground. People are still stuck with the user/password paradigm and it will take some serious push to move to something like Passkeys, which is obviously the best if implemented correctly (i.e. provide a fallback when using a non-own device)

We need a push like it happened for HTTPS, which became widespread in less than a decade, but that basically means Google has to push for it.
Isn't what you're describing simply "being a friend" with an encyclopedia? Why would you want to create a machine to do that if we're made like that?

In a sense instead of training a machine you could steer yourself to become that person. Call it being a life coach or a pastor. That's a lot less hassle than actual, true artificial intelligence (which needs to be invented as of yet).

I'm genuinely curious, not trying to piss on your parade or anything.
> Now if I encrypt my portable SSD with the same password that is a problem. It would be trivial to brute force.

Probably not so trivial. It's very likely (disclosure: I'd need to check, but I'd expect that to be true in 2022) that the actual encryption key of your storage is a randomly-generated key, which is then protected with your password and a very slow decryption algorithm, so that bruteforcing is not so fast. Still, single dictionary word + two ciphers won't be terribly hard to decrypt for a really interested party.

But the point is that such attack requires physical access to your device (unless some other network hack is performed), which is a kind of 2FA.
Yup. I always thought that people who spent all this effort cheating would expend less effort if they just bothered to learn the stuff. And besides, you get a bonus from having a bit of pride that you did it honestly.
What does tiktok offer in that respect that youtube or just about any other social media platform supporting video couldn't also provide?
ok.....

You are talking about city infrastructure and stuff that I'm not talking about. If you want to have a utterly completely different conversation about tearing down every single house and every single road, and do a big do-over, I guess we can do that.

But I'm just talking about how poor people can buy a tuna fish sandwich, dude.
I think the biggest reason here, especially for GP, is that ksmb3 already exists now (and it existed for a few years), while your tiny smb3 does not exist yet.