skysight-inc/HackerNews huggingface dataset:
Makes sense. I'm in the middle of finding a standalone office so I can do actual meetings and be productive, but it's tempting to keep the co-working space for exactly what you describe. One day here, another day there type of thing for when those things are helpful.
That's fair, a lot of GC languages use immutable strings. That said, all(?) of them have some form of mutable buffer, albeit some care would have to be taken to avoid accidentally turning it into a string.
Oh thanks for the warning, i never changed a card but good to know!
> where you don't rock the child to sleep for an hour, but you check in on them, gently touch them, talk to them soothingly for a little bit, and then you leave them for a little while. Come back in a little bit and briefly soothe them, and then leave again for a little while. As long as they know you are there. And you could stretch those periods out to see how the child does

You just described the Ferber method, a very popular sleep training approach.
If your passcode(s) on your device are longer than 6 digits, sure. As it stands, you can recover your iCloud Keychain by either[0]:

(A) signing into iCloud (Requires Apple ID Password) + approving the new device on an existing device that has Keychain access

or

(B) signing into iCloud (Requires Apple ID Password) + performing SMS 2FA + entering the device passcode of your primary device

The threat model here is where a nation-state actor enlists the full cooperation of Apple and gets Apple to hand over your encrypted iCloud Keychain, then gets Apple to siphon your Apple ID password next time you sign in. They could then use those two pieces of information to brute force the passcode on your encrypted Keychain data. If you have an 8+ digit passcode, or an alphanumeric passcode, that makes it exponentially harder to brute force.

With the long passcode, your only remaining threat would be Apple shipping malicious hidden code or an RCE in their product that allows them to force your device to approve new devices non-interactively, which would allow them to approve a malicious device the next time you approve your own new device for access to iCloud Keychain.

Or perhaps it's more likely that, when you're setting up a new device, Apple sends over the name of your new device, but with the public key/CSR of their own device, since iOS doesn't show a key fingerprint during device approval or anything.

0: https://support.apple.com/guide/security/secure-icloud-keych...
yes, the content is very different.
The Italian version is more like what the subject of this post is, Ørberg style.

The Italian edition is an expanded version of the original textbook, but they don't have permission to sell it in other markets.
Then for sensitive strings you wouldn't use the built-in string and have to build your own?

I'm not sure I see the issue, you just implement a memory-safe string class that manages arbitrary bytes, it's slower but that wasn't the goal.
My only complaint with Bitwarden is that the 1Password extension seems to have fewer issues automatically recognizing login fields for web sites. In most cases, that's an easy enough fix via custom fields in Bitwarden but the UX around that could be nicer.
I ran into this before, actually. As of about a year ago, Lastpass partially used cached data to generate some portion of exported data, but that cache is not diligently kept up to date.
That's too bad. I'm sure it can be optimised quite a bit. I tried to make it so it renders different amount of fish based on your screen size, but that's not a good enough way of determining resources available unfortunately. Suggestions are welcome.
Interesting, but those aren't very high stakes controversial opinions. People may strongly disagree with them, but they aren't likely to lead to a declined job offer, workplace difficulties or harassment. There are many stances for which making a public case is futile because people have strong emotional commitments around them. Would you still be public about them?
> That adds a taste of FOMO...

If your aim is to avoid the dopamine, I think encoraging FOMO is a bit self-defeating.

Perhaps limiting posts to daily, weekly, or monthly might make sense? Letting people work on a queue with scheduled posts could encourage thoughtfulness.
I just follow 2 (two) webcomics these days: Order Of The Stick (I guess everyone knows that one?) and Unsounded, which is pretty obscure I guess, but the author is incredibly dedicated to her project and the worldbuilding and charactes are really great. I also used to follow Erfworld before it sadly went on a permanent hiatus 3 years ago...
Yeah, I think it's true for most goods.
Different problem, but I was looking for a book a few days ago that was an absurd $33 for the Kindle version on Amazon. (Paperback was a buck or two more.) I found a PDF of the book on Google after combing through about 10 links.
Your pediatrician is ignorant about SIDS risks? They are much more likely to be informed about this matter than you, with your n=3 anecdote.
So is my evening G&T good for me, or will quinine not work?
To be pedantic, they're not saying the class is making things worse - it just doesn't do anything on .NET Core because it lacks cross-platform encryption APIs comparable to the ones used on .NET Framework. So it's basically just a String.

It's a little frustrating that their only recommended alternative is "just give us your secrets bro" though:

> The general approach of dealing with credentials is to avoid them and instead rely on other means to authenticate, such as certificates or Windows authentication.
Nice. Less of a SecureString and more of a SlightlySmallerWindowOfInsecurityString. TIL.
> What's interesting is he generally is aware of groups of people that should not do so, like those who are abused, but does not consider the possibility that everyone can become a target (through regime change for instance).

This is exactly right. You can hold a view that is perfectly acceptable within mainstream society right now, and find that 10 years from now that view is considered extreme or dangerous. If you have a public and searchable history espousing that view, you could suffer very really consequences as a result, even if you no longer hold that particular view.
Very interesting work!
Docking tails and ears is normal too. Male circumcision is normal. Locking people in cages for possessing certain plants, extracts, chemicals is normal. War and all of the murder that goes on in it is normal. Burning coal is normal. Limiting rights of women is some countries is normal.
Show HN: Advent of Code 2022 in 25 programming languages (a few days late)
Yes. Except unless of course you're not certain if the buffer you have your secret in was copied at some point. Maybe by the text control you rendered it in.
That's a great solution. I've been trying to wrap my head around canvas manipulation but it just gives me a headache and I prefer making quick prototypes. I need to learn it one of these days.
Deconstructing sBTC, The Whitepaper: Part 2 – A trustless, two-way Bitcoin peg
CRISPR Gene Drives: A Weapon of Mass Destruction?
Can you market outside of the country, where the ISP doesn’t have reach? Surely the product you have is valuable if the ISP feels threatened by it.
Yep, the thing I always tell new parents when asked about kids is that every single kid is different. Your kid might be a good eater and a bad sleeper. Maybe the reverse. They might be extremely needy or be completely chill and independent. This is especially obvious when you have multiple kids of your own. Some knowledge generalizes, but a lot of the personalized experience is different (e.g. what they respond to in terms of incentives or "training"). I was always about 10/90 in my opinions of nature vs nurture (90% nurture, 10% nature) but after having kids its so obvious nature is much higher than I thought. Not sure what the end ratio is, but I'd say at least 50% nature.
The measure of a good CEO is their ability to oversee an operation that “doesn’t speak finance” and/or to staff the executive ranks with people who can translate priorities into terms that can be reasoned over financially. When a company fails to do this the blame lies with the executive leadership, not the operational employees on the ground. This is supposed to be the reason executives are well-paid.
Whistleblower Rebekah Jones wins dismissal at a price
> Also, you could write a destructor that scrambles the memory location before the object is collected.

This assumes you can write destructor at all and that it's run deterministically.

> though you can probably force that to happen in most GCed languages

I'd actually be surprised if any GC'd language allows this. You normally need to resort to different kinds of tricks for RAII-like behavior.
Publicly freely available doesn’t necessarily mean that it’s legal for you to embed them in your website without some licensing agreement. (I’m assuming your site isn’t just a list of external links.) Just as a heads up.
> 3nm technology would feature an estimated 60 percent gain in density of logic transistors and reduce power consumption by 30 percent to 35 percent at the same rate compared with 5nm technology

I'm really looking forward to the new Gravitons and the M3 Pro/Max/Ultra MacBooks! and what they will be able to achieve.
'Unexplained' is a large portion of SIDS deaths. Folks trying to protect parents and the family from blame for 'preventable' deaths is also a thing.

As SIDS is better understood, and categorization is changing (addressed in the paper I linked elsewhere) the graph showing proportions of accidental suffocation/strangulation during sleep is rising while SIDS is dropping - but both numbers are adding up to about the same. (see total SUID death rate, Figure 1)

https://publications.aap.org/pediatrics/article/150/1/e20220...
Closed source requires a lot of trust in this case.
It has been asked a couple of times on https://old.reddit.com/r/AskHistorians
but not answered...
https://publications.aap.org/pediatrics/article/150/1/e20220...
> I can understand calling it foolish, I can understand calling it naive, but why are you calling it cowardice?

Because this is often a standard emotional response to very large problems. It's one of the reasons so many people (mainly conservatives) downplayed the risks of COVID. It can be mentally easier to downplay or ignore a scary problem rather than acknowledge it.
The Propaganda model proposed by Herman and Chomsky has been widely discussed on the left for 35 years, even if those discussions didn't mention it by it's formal name. So yeah it's nothing new. But to sum up:

1) Local media has a far right wing, pro police bias because it's customers are small business owners. Small business owners are pro police because they lose money from shoplifters and "bad" neighborhoods are bad for business. They're anti immigration because immigrants are over-represented among new small business owners and tend to outcompete established businesses. They're opposed to labor laws because they increase costs. They're opposed to estate / property / capitol gains taxes because they tend to have a large amount of family wealth. This is not to say that all small business owners are far right, it's just that they have a lot to gain from right wing policies.

2) Mass media tends to have a center left bias. This is because their customers are large national and multinational corporations, who are more interested in messaging and branding. For many reasons, the ages of 18-55 are considered to be the main focus of advertising, with 18-35 year olds being seen as especially valuable. Also, people who live in urban areas tend to have more disposable income. Finally, since what is progressive 30 years ago is often mainstream today, being left wing on social issues is generally a good idea. Imagine if the US only let 18-55 year olds vote, and gave an extra vote to people who were 18-35, lived in an urban area, or had progressive beliefs. That is the ideal media landscape for large media companies. Now there are limits, because large businesses don't want to promote pro-worker or anti-capitalist ideas. That's why the socially progressive economically centrist point of view dominates mass media.

Twitter is a mass media platform, and it must do something to promote center left tweets if it wants to be a profitable ad supported business. And it's more than happy to work with the government to further that goal.

If Elon wants to make Twitter into a privately owned microtransaction supported site, then we can expect it to boost far right wing positions - which is exactly what's happening.
Post Twilight I’m a huge unabashed Kristen Stewart fan. Saw her in some Olivier Assayas movies at the art museum and fell in love.
> 1Password claims are the same claims as LastPass

And the whole post is about things other than the claims.
Hi HN friends, happy almost new year. A moonshot for 2023 would be the launch of sBTC, a trustless 1:1 peg between Bitcoin and Stacks (a Bitcoin layer two), as it would unlock defi for all BTC holders.

This post is Part 2 of a series I've written deconstructing the recently released whitepaper and what it could mean for both networks.
> I would be interested to see some people write about this transition as I’m not sure if I want to export/import or start anew and move things manually.

Did it about 18 months ago. I was expecting it to be more cumbersome than it was. Export from LastPass, import to BitWarden, manually compare.

Simples. It all worked IIRC, though I only have a few dozen entries as I'm in the habit of clearing old ones down. Left LastPass going for a few weeks just in case, then closed it down and the data was deleted.

Edit: If I was doing it now, I'd do it from scratch and change every LastPass-aware credential as I go. That info is out there now; you don't want to be using it any more.
I had a friend that was very religious, he also had a blog about religion.
Me and a friend of mine sent him a series of profanities via email through an open SMTP relay, that seemed like it was coming from one of the parish leader's account.
I am very embarrassed now for doing that, but it was really funny in the moment.
Few people in Brazil dare to suggest there has ever been an athlete greater than Pelé. I don't think we'll ever see anyone else win 3 World Cups.
Are programmers any different from mathematicians or physicists in this aspect of using brain functions?

It takes similar logical skills like:

- Not knowing end result/solution of an equation

- Performing multiple operations to solve different parts of an equation

- Crafting an equation to match the observation (similar to writing a logical program to achieve a certain end result)

- Dealing with constants that never change
There's a pretty important note in the remarks, that you should not use SecureString in new code, as it only shortens the lifespan of the plaintext in memory.
If only reality was this simple.
It'd be more productive to contact the vendor(s) of the software unless the software has been developed in-house.
you could use a regex library not vulnerable to quadratic behaviour in the first place?
I used to think that as well, and I still agree that the root problem is neoliberalism, if not capitalism itself. But as long as they remain the dominant system, technology will be developed in service to their ends.

https://www.goodreads.com/book/show/60299346-scorched-earth
genetic/biochemical/immunological weapons are very real, they have graduated beyond being a conceptual future concern.
Spying on the scammers part 5 [video]
I'm not following, what's bad about that? Is that bad for Lastpass, or for SOC2/SOC3?
Time For The Planet - https://lnkd.in/et9T7UDY

Crowdfunded climate project incubator. Open source, B-corp non profit equivalent. Been going 3 years.
Yea, I can see that, taking a screen capture, at one point, I was recording my daily work activities (when I was a entrepreneur) to be able to back to, I rarely went back to them, but something about possession of being able to go back and check on something I did.
You're on to something...
> “The bigger concern is to establish some form of international agreement to prevent capable individuals or private corporations from responding independently — before a consensus has formed on whether it is safe to respond at all, and what we would want to say as one planet,” he said.”

This is a long winded way of saying “we don’t like competition, and allowing somebody that’s not us to do this could threaten our perceived legitimacy, therefore it must be suppressed at all costs.”
I mean, crypographically we’ve had solutions to those exact problems for 30 years.

PGP might not be very usable but it also had mechanisms to do this.

if you are scared of people copying the vault before they lose access to the storage: you’ll be very sad to know that this is already possible with the SaaS solutions.

if you're worried about people breaking the vault if they have access: then its even more of a reason to control the access.
Pele Dies
The system is fairly broken from my perspective. Especially, as the size of the financial institution decreases. We work with smaller customers.

At this small scale, everything is vendored out. Many times, 2+ different vendors will need to directly exchange something like a password for the bank's core system. Email is the preferred technique, typically with some theatrical secure email crap on top - involving yet another 3rd party in the secret exchange mess.

As you get into the scale of an organization like Capital One or BofA, you start to see more of that Hollywood-style credential exchange & control with multiple consenting parties, Iron Mountain trash cans, biometric doors and one-time passwords.

If you are concerned about the IT/security of your financial institution, you may prefer larger ones. These have more employees running just IT compliance than many of our clients have in total.

If you are concerned about bad customer service or losing access to funds, you may prefer smaller ones. Being able to realistically talk to a board member of the bank about a dispute makes a lot of people feel better about where their money is.
Maybe I'm biased, but I think cheering on the toll of remote work on cities is being sanguine. Cities have existed for a long time for reasons beyond proximity to work. Their decline will represent a decline in wider society. We centralize people and resources to give everyone better access to resources and economize on infrastructure. This pattern is as old as civilization itself. Bully for you if you can make off with the loot to the hills. As cliche as it sounds, we live in a society. Of course there will be winners and losers. But to me, the picture of wealthy, isolated, and spread out exurbs hoarding the wealth while cities languish in poverty is an incredibly bleak picture of the future. My hot take is that remote work is unnatural and has only taken off because of how laborious commuting and unaffordable housing have become in this country. Like others have said, many remote workers will still choose cities because of what they offer, and they could be much better places to live if we re-invested in them as such.
Decentralized Society: Finding Web3's Soul by Weyl,Ohlhaver, Buterin
Sorry, but you’re wrong. Not only wrong, but confidently and smugly wrong. You think you know best but haven’t bothered to actually do any real research on this topic.
> It would be helpful to have a book that is clear that the POSIX.2 shell is not Bash.

Maybe the one thing I love about Linux culture (compared to the BSDs, illumos, etc.) is that it generally doesn't require everyone to adhere to some high UNIX religion.

Writing a shell script of more than 50 lines is hard to do correctly. Bash sometimes makes that a little easier. And it's almost ubiquitous. Forcing new Linux users to learn a POSIX compliant shell, when they are only likely to be using Linux and bash, is simply cruel and unusual. Just as including only `vi` in the base system instead of `nano` is a silly self-own.

I see this unreflective question far too often: "Why aren't people using my system and using Linux instead?" And the answer is pretty simple, Linux at least made efforts to reach out to people where they were, in hundreds of low effort ways, whereas your system probably didn't.

"Everyone should be using Linux" and/or "should love the command line" is pretty silly, but just as silly is "people should learn the POSIX shell" first. A shell they are likely never to use interactively. Because of a hypothetical portability concern? It's nuts.
Cool sites, related, yes, agreed about "social bookmarking", but feels like, why do we create all of these "awesome list" for GitHub then, like that's a way to share a curated list of links, kinda like deli.co.us.
Musk is doing this now by holding up a refinancing of Twitter’s building by defaulting on the rent. Anyone with a big enough war chest can just stop paying, drag it out in court, and wait the owners out. And tech companies have some of the biggest war chests.
Rarely you can find sugar free flavored coke (around here cherry and vanilla seem somewhat common) but the only places that carry it are higher on the cost index.
Great. Can they fix the autocorrect so it doesn't mangle gene names? https://www.nature.com/articles/d41586-021-02211-4
The fact that this is so commonplace in my culture (USA) is frustrating and enrages me. As a parent, it is your evolutionary instinct to comfort a crying infant. They are quite literally helpless and look to caretakers for all their needs. There's a deep seated biological reason it feels bad to ignore it. The fact that it is so uncommon in other cultures should make this obvious. What are the odds that the rest of the world and entire history of humankind were mistaken the whole time, until some behaviorists came along and figured it all out in the last century? Talk about infants having "attachment issues" makes my blood boil. They are supposed to be attached to you. It is very much possible to co-sleep and then gradually transition them to their own bed. Yes, it is frustrating and will interfere with your sleep. This is one of the many sacrifices of parenthood.
Title 42 upheld by U.S. Supreme Court for now
Around here at least, most of the cool local places around here are in the suburbs. That's where you find 99% of the "ethnic" supermarkets (Polish market, Japanese market, Chinese markets, Korean markets, Indian markets, etc.), where you'll find the more authentic ethnic restaurants or bakeries, where you'll find the authentic bubble tea shops, the family restaurants, etc.

Not that you can't find any of this in the city (though almost all the ethnic markets are gone now), but the rent inside the city proper has gotten so high that you're often left with large chains and places that are trying too hard to be "hip."

In general I feel like I'm more likely to find a cool hidden treasure exploring the suburbs these days than exploring the cities.

And I don't think it's just around here. For example, I've noticed that many Chinatowns around the U.S. have moved towards the suburbs over time.
What a shame but no doubt another trader will quickly fill the space.

I love Akihabara, almost literally I've had to be dragged away from the place. Electronic goodies of just about every conceivable type can be bought there, many of which I've never seen for sale anywhere else.

For techies and nerds who've never been there I'd highly recommend a visit if you ever get the chance.
The part of the post about 1Password is basically "trust me, bro, a buddy of mine used to work there".
That issue seems the same in a GC language as it is in a non-GC one. Either way you need to know when you're done with the data and it's time to scramble.
From my point of view, both.