skysight-inc/HackerNews huggingface dataset:
> Passwords are bearer credentials and as such, they are not a meaningful layer of defense when in the custody of even a modestly competent system administrator.

Again, you are avoiding my argument. Passwords, even pin codes have been a meaningful layer of defense for half a century. You can argue that they are weaker and propose stronger methods such as paddhphrases but you arr arguing against passwords when your real argument is against "what you know" as a factor of authentication.

> As I'd said, you need to look no further than annual threat reports to see that credential theft is the most common avenue of abuse - by a lot.

Are you a middle manager or executive by chance? Because I respond to incidents as a matter of routine and I very much know how much passwords get phished or cracked. You know what solved the problem: adding even the weakest layer of authentication like SMS. Now, there are many better altetnatives for a second factor of auth other than SMS as there are for passwords as what you know being a factor and I am open to that discussion. But what you are saying is you don't get why a weak layer of defense is needed so you want to get rid of it.

> The threat landscape certainly changes but the economics of computer fraud and abuse remains largely the same: attack the most vulnerable link in the chain for maximum profit for the least amount of cost

Again, it's not a chain. Your mindset is a flawed way of thinking carried over from physical security (think "cyber killchain), which is perimeter focused, that's where the chain analogy comes from.

Modern security, having learned from the past few decades is such that you have many layers of chains. The user's knowledge, as weak as it is, is one such layer. Removing it plain and simple is a reduction in your security posture. See, the critical thing you need to get is the relationship between layers od chains as opposed to links in a chain is complementary not symbiotic.

Persistent threat actors will get past any layer of defense. If ransoming your company gets me a few million dollars, as a criminal there is not a whole lot I wouldn't do including physical attacks (there are even untargeted campaigns where threat actors drop or mail USB drives en masse).

> the human and her portable password (and other forms of exportable factors, roughly in order of security: SMS-based, HOTP/TOTP apps, email magic links, Duo-style "confirmations").

Great, guess what that means? They spent all that time and effort to get past a password and now they face a yubikey. The difference in cost to threat actors is at least geometric. They can't just steal a yubikey or compromise your phone, now they also have to steal or guess your password.

By removing user knowledge as a factor, you are making it orders of magnitude cheaper for a threat actor. And you think that is fine because the latest and shiniest methods of authentication, unlike past solutions will never ever be defeated and you will never face insider threats or threat actors willing to spend more to profit off of you.
My only explanation for that may be because Python has more severe and commonly occuring issues?
Pixel Wrangler: HDMI to Whatever
I'm only interested if you have to activate it by saying "Hello... Numen..." ala Seinfeld.
They should. Big business means you front the costs to do proper business. if you make billions and cannot do your legals....too bad. that money will be theirs soon
That isn't what a reporter should do, though. They should report on the news and related information, not just their favorite narrative. I'm not defending shitty reporting, just pointing out that the "bare facts" approach is ridiculous.

Knowing stuff is hard, reporting on stuff is hard, understanding what is read is hard. The solution to these problems is not, nor could it be, restricting one's attention to the "bare facts." Indeed, these are often quite hard to identify and agree upon. We should expect and cultivate a little sophistication in ourselves and our fellow citizens.
White Castle's reputation is not for large burgers. Nor for premium-quality ones.
The main problem is caches. macOS can actually clear caches when you run low on disk space or uninstall the app, but, only for sandboxed apps.
Some info here, claims a 68020 at 50Mhz (@10 MIPS) can just pull it off:

https://eab.abime.net/showthread.php?t=78994

Might mean an A500 (@1.4 MIPS) could do it if you were happy waiting 10-15 minutes for the audio of a 3 min mp3 to begin.
Place yourself into a live NBA game
Yep, but in practice Seniority comes either from experience or time in the industry. So you'll undoubtedly meet seniors that won't try to find that balance.
You're mischaracterising what I am saying. You're talking about 'over architected' systems. That doesn't represent how I work or anything I am advocating. Types are composable, when you design a system or sub-system, make sure those types are constrained to represent the smallest set of values the sub-system needs. Then those types can be composed with other types to make larger systems. You start small and build out with composition, you don't need to architect some epic type-schema in one sitting.

It's really not that hard to do (well in FP languages anyway) and ends up improving throughput for any coding task due to the reduced need to constatly check if something does what you think it should do.

> The best solution is usually to not give in to either extremes, but find a well balanced approach somewhere in the middle where you have some sane restrictions designed into the types to prevent the most obvious bugs.

That isn't the best solution, it's a solution. As I mentioned in another comment [1], it's about risk, and how much you're willing to take on as a developer and as a team. I work in healthcare software, I want it to be right, because I don't want my fuck-ups to kill a patient. But even if I didn't, I'd still prefer to write code this way because it is sooo much easier to manage the mental model of the code-base, especially when the code-base is super-large.

> but not enough that the whole house needs to be rebuild if a little requirement detail changes

That isn't my experience at all. If the whole house needs a rebuild when some little requirement detail changes then you're doing it wrong, sorry. One thing that can happen when using sum-types instead of inheritance, is that adding a new case to the sum-type requires you to go and consider all pattern-matching usages of it. This can be painful, but it forces you to consider the impact of your change. I believe this to be a good thing and compilers usually help you here anyway. This trade-off is captured in the Expression Problem [2]

[1] https://news.ycombinator.com/item?id=34847326

[2] https://en.wikipedia.org/wiki/Expression_problem
Do you know that they ended up at a “profiteering” price point, or are you just assuming? And you do have to pay the team of researchers to go on a speculative hunt for a cure for a super low incidence disease, if you want them to do it again in the future. If you then turn around and seize the results, you’re not encouraging them to take the risk next time.
Cashless society in Switzerland? People to vote on keeping cash forever
Ask HN: What's stopping you from implementing Istio?
This raises the question of whether corporate "death penalty" verdicts should be enforced. Corporations are just a collection of assets, as their management will remind you when they are bought and sold (even though they are portrayed as "persons" when "speaking" with money).

This is outlier example, but why should any corporation that created an environmental disaster not pay what a complete liquidation of assets would yield, if that is less than the cost of remediation? Asking for a friend in the railroad business.
Post a hi-res scan of your fingerprints with your name and address, and see what happens - it might be a learning experience for you...

Note: I don't actually recommend you do this - it opens you up to the very real dangers which you're claiming don't exist.
I would differ that Rust would not be a better choice than Rust.

Seeing Rust as a system programming language only is missing the bigger picture (IMO).
The Gravediggers: How Eliminalia, a reputation management firm, buries the truth
Honest question, there's a lot of posts here about people finding the office distracting, but does anyone else think working from home can be equally or more distracting?

I honestly used to feel bad when in the office if I was on Youtube or Instagram, I just didn't really do it. But when WFH I could have unlimited access to anything without people knowing, even porn if I wanted.

I also remember the feeling of having others around me working pretty hard and kind of fed off that, like I wanted to be part of a team who was delivering and while I still have that feeling, I feel less guilty if I slack off when remote and I notice the whole team going through waves of slacking off, and then someone pulls the team back together to be motivated.

I have strategies to get myself into working and I can be productive, I'd argue I often am productive because I care a lot about where I work and what I work on, but it's not just "magic" that I'm just sitting in my room at home and all of a sudden I'm ultra productive? I really have to work at it, especially if I'm not working on something exciting. People also come distract me, neighbors ,friends, family even delivery people etc.

Slack and email are for me, huge productivity killers and distractions and still are if remote or on-site. So that distraction has never gone away for me.

I think being a productive remote worker is a skill that I'm still learning and an investment I have to make, my own office renovations, furniture etc, and I've been doing it since before the pandemic.

I hate to say it, but I think most people know deep down inside and are admittedly defending WFH as by default being better from a productivity standpoint when really, it's probably just better on a personal level and so they want to keep it. I think that's fine because I agree, if I had the choice, I'd be remote too, forever. I'm just not really sure people are being entirely honest with themselves and their motives and it would be refreshing to see a bit more of that honesty shine through without the constant, "I'm just more productive at home by default, I work 10x harder and more hours etc".

It would be nice to live in a world where employees and employers just said, "You know what, who cares about the productivity aspect so much, let's just embrace the technology we create to make our lives better and embrace working from home even if we actually do take a 10% productivity loss", it's wishful thinking but it would be nice :)
lots of them leave crud in HKLM/System and HKLM/Software, as well as I think HKey_Curent_Config

I dont mind the per user settings crud, I do mind the system wide crud, because it can make reinstating the app to resolve an issue fraught, and I have to go manually find whatever opaque keys were set and remove them.
I ran it on my PinePhone for awhile, and it was really nice interacting with the base system, though I eventually moved to Arch.
At the simplest level it’s really just the lawyers who operate in the court (barristers) versus those who operate outwith it (solicitors). It’s a bit more complex and couched in tradition but that’s the gist of it. It’s actually from the same etymology as the “Bar” in the US, as in “admission to the bar” or “the bar association”. It represents a person who has “passed the bar” in the courtroom, separating spectators from participants. It’s just that the setup is a little different, with most solicitors not having a right of audience in the court.

Another difference in Scots law - no barristers but “advocates” instead.
I just really appreciate the candid GTD attitude you guys have.

Having just spent 2 weeks migrating from Notion to Obsidian, investing dozens of hours obsessing over various features that save me <5 minutes/day, your “marketing” style clicks with me.

While I’m not a prospective user (my workflows now require local storage and I’m too pot committed to return to the harmonious simplicity) I’d be keen to play with Grug, break some stuff, and maybe send you referrals when you’re ready.

Any plans to integrate something like Whisper for dictation/transcription?
Why does he have to imagine? He can see the results of their work.
As soon as I saw interviews with the Nikola guy (https://en.wikipedia.org/wiki/Trevor_Milton) I started shorting. What a rollercoaster that was.

When Hindenburg published this gem:
https://hindenburgresearch.com/nikola/

I literally started screaming with joy like a lunatic at my phone in the middle of the street.

Turns out... even an obvious obvious obvious fraud can keep going like
wile coyote for prolonged periods of time. Do not friggin recommend.

I also have been trading the Turkish lira for over a year. Also do not recommend as they flat out cheat and gaslight on.. frankly historical scales.. as well as get foreign currency under the table from fellow despots.

If you're wondering what the hell would possess me: at some point they started making schemes like "citizens it is your patriotic duty to sell us your gold jewelry so we may smelt it, we will give you a great price promise" -- the list of shenanigans got so long and comical and the central bank balance sheets so iffy I couldn't help myself. It is very true that western media under reports this, they might mention the out of control inflation but don't explain how the country is run by clueless mobsters.

Being correct directionally is not nearly enough. Be very careful. This Adani thing mostly bounced back already, unless you're willing to be very patient as it unfurls over literal years you very easily could lose money despite being right.
GOOD. Sms is NOT 2FA!
At least you can do that when you are not the one managing them but can't fire them.
Remote working was a big threat to influenza and other virii,
but with so many employees requiring return we will get our flu back in no time.
Again, I don't give a solution because that is not within the scope of the paper.

Can you come up with a solution?
That's handy to know, I wonder if they're easily obtainable outside Japan.

(I've been thinking for a while it's time I paid another visit to Akihabara, that's almost a perfect excuse.) :-)
Ask HN: How to reduce malicious free trial abuse?
I'm starting to get a ton of dedicated malicious spam free trial signups at my fintech startup, these don't appear to be robots so I don't think a CAPTCHA will help. They use the service aggressively during the free trial but don't pay. IP bans won't help either, they seem to come from a large number of IPV6 addresses. Here's what I'm considering:

1. Phone number / SMS verification.
2. Credit card required to start free trial

Any other ideas?
Playing devil's advocate: since the operating system mostly abstracts the underlying hardware, when programming with a high-level language, an IBM mainframe running Linux and a MIPS router running Linux are both closer to an AMD64 desktop running Linux than the same AMD64 desktop running Windows. And Windows is a particularly annoying case, since its native API is so different from the Linux native API (and details leak even when using API wrappers, for instance removing a recently-created file can fail on Windows because some other process like an antivirus grabbed a handle to it).

But yes, I agree that a nontrivial fraction of the objections to making software run on Windows (or Mac) is for ideological reasons.
I'm going to add this tactic to my book it's genius
Thanks for the kind words!

No idea which customer you are :), but if you ever want to have a chat or have feedback, ping me!
I don’t have to imagine. I changed my last name when I got married, as many people choose to do. It’s not a big headache.

You could also do it for another reason than marriage. The effect will be the same. And it’s easy to do. Whitewashing is definitely a lot more involved, especially if it goes beyond right to be forgotten requests.

I feel like most people realise this. I know people who have changed their names to “reinvent” themselves and no longer be associated with their past. Famously, witness protection programs also work like that sometimes. It’s just the most efficient and common sense way to give up one’s old identity.
Every executive I know (public or private) discusses everything remotely sensitive over voice or Signal now. Sending anything over email is insane given the number of lawsuits going. Just look at the recent layoffs at big tech - class actions everywhere. You aren’t going to detect corporate fraud very easily.
"support" means two things. On the one extreme end, it means "provide commerical support for a product", on the other end it means "permit it to happen". I wouldn't support anything in the first sense, but if I would maintain a popular package I would strive to support as much as possible in the second sense.

In my experience, keeping code general and cross platform is a great way to ensure correctness. Especially in C(++). I can't count how many bugs I caught by cross compiling Linux code on Windows, or with different compilers, or different architectures. Usually the kind of sleeping bug due to undefined behavior or wrong assumptions that kind of worked but might blow up a long time later.

In most projects, if somebody provides a small patch to make my code work for their use case, and it's not too much trouble for me, and my tests pass, then I'll gladly include it. I'll not "support-support" it, but I think one should support it. At least if I open-sourced it because I want it to be useful to other people.
Midnight Commander (mc), it's a bit like XTree Gold on DOS.
An immediately invoked lambda pattern, but, check out how ugly that was compared to:

let value = if a { true } else { match b { 1 => false, _ => undefined } };

And notice that because now we're a function our relationship to the world changed, how does your immediately invoked lambda do this?

let value = if a { true } else { match b { 1 => false, 2 => return foo, _ => undefined }};

With expression syntax returning from the function we're in is fine† but in your lambda you can't do that, you need control flow logic outside the lambda to handle it.

† You might wonder about the inferred type of this expression since it might return. The type of the return expression in Rust is ! aka Never, which is an empty type. In the same way that N + 0 == N in integer arithmetic, any type plus an empty type is the original type again in type arithmetic, so the type of the expression isn't altered.
This is a weird one to me. To not consent to having your fingerprint scanned yet continuously doing so seems questionable. To do something for years without issue and then sue long after the fact doesn’t feel like justice.

It feels to me that providing your print to begin with without coercion fulfills consent. I understand that the need to keep one’s job can be seen as coercion but I am confident the percentage of employees that actually objected at the time was negligible.
You can discuss how the judges are replaced, but according to the WaPo the reform abolishes all checks and balances:

https://www.washingtonpost.com/world/2023/02/14/israel-judic...

"On the table are several bills amending Israel’s “basic laws” — legally equivalent to constitutional amendments — which would grant Knesset lawmakers control over judicial appointments, eliminate judicial review of legislation and allow parliament to vote down Supreme Court decisions."

The last part means that the 51% always get their way, which a supreme court is supposed to prevent.
Again, they are self-selecting. No one gets to vote on their replacements, in practice no one gets to vote on the people who vote on their replacements. It's crazy to talk about "empirically strengthening democracy" without recourse to the actual functioning of the actual supreme court.

Just because someone writes a paper complaining about the Polish government firing holdovers from a literal totalitarian regime, or noting that communist regimes usually gut all organs of government when they take over, you don't get to extrapolate to wildly different circumstances and say "thank god no one gets to vote on this, it would be Very Dangerous For Our Democracy."
Not from what I have seen. For example phone-app based auth has your phone as both what you have and the code you enter or button you press as another factor but in reality that is just one phone. I have seen a place where you can take over the org if you steal one guy's yubikey. Windows hello has a pin for what you know but then it authenticates the device with TPM instead of you separately as a user. But at least windows hello requires you to remember a pin other methods have secrets generated on the fly which I am certain are phishable or just use what you have alone as a factor of auth.

I mean, at least have users define a multi word passphrase with no complexity condition or expiry.
> Civ series felt empty after a while

Want to replay your favorite old map from Civ 7? Sorry, the servers have been turned off, back to Civ 17 and the Season 3 Persons Wonders and Specialists pack for $79.95...

Not everything has to have "multiplayer elements".

Keep great single player games offline.
No, really, it is just a sandwich shop. All those shops could be sold off to pay a fine for this violation. We need to stop thinking a corporate entity and/or brand image deserve to be protected from the consequences of lawbreaking. This is the misperception that makes white collar crime, which is often several orders of magnitude more damaging in monetary value than street crime, published far less than the size of the crime would suggest.
The three judicial appointees can veto any selection, and are by far the most cohesive and only long-lived subgroup of that panel. In practice they run the show.
Because it's not a useful term. It's a piece of political jargon used to dismiss an idea as crackpot.

It's meaning isn't specific and will change depending on who's using it and in what context.

I'll weekend my understanding, if I hear a definition of conspiracy theory that doesn't contain an ad hominem assessment.
Huh. I didn't read the article as being about the pyca/cryptography-on-rust controversy.

I read it as using the pyca/cryptography-on-rust controversy as a jumping off point to discuss the difference between platforms-supported-by-the-toolchain, and platforms-supported-by-upstream-software, and whether users should expect to consider all platforms-supported-by-the-toolchain as being supported by all software written for that toolchain. Or not. And how far authors should go to help users on "niche" platforms they don't have access to.

(Might be the 2.5 rewrites making it easy for different readers to come away with different conclusions?)
That strangeloop talk inspired me to explore a lot of things, including my methodology for writing command phrases that are phonetically distinct and succinct.

Glad to hear Talon is still around! Their slack has grown and they really seem like they have a product now.
It's because they're unaware and need to be made aware.

Rich folks focus on certain things like reusable straws or driving a Tesla and think they're doing the world a favor while they consume 2000x the natural resources. Things like a plaid tesla or electric hummer are selling the appearance of environmentally friendliness, not the reality.

The point of this is to call people out on their hypocrisy, keep people honest, and to keep people in the real world.
> Remote makes upskilling, onboarding and knowledge transfer much less likely and harder

Uhh, why? Zoom calls still exist, you know? We can also communicate through writing and ask questions. What matters is the willingness to acquire this knowledge, not the method used