skysight-inc/HackerNews huggingface dataset:
I don't follow for these

> Already webauthn isn't prompting for passkeys on Apple.

It does for me on iOS, at least (and Safari on MacOS; other browsers don't use the native icloud passkeys, chrome has its own secret store).

> Chrome wants a bluetooth connection out of the box,

IIRC it works without it for on-device passkeys, but caBLE requires Bluetooth to facilitate proximity passkey connections if you want to use wireless webauthn.
If it's business the one that wants the estimation, then I take into account everything: unrelated meetings, bugfixing of important stuff that gets broken, potential sickness/holidays, etc. What's the point of telling business that you can do the task in 3 days, if you cannot actually have 3 complete days to do the job? If you have "other work stuff to do" that will interfere between you delivering the item, you have to take that into account.

> Either you're a godlike estimator or you disappoint your manager A LOT. Who the hell are these people that can reliably say feature X will take me 8 weeks? Is that also not just an estimate? I'd rather wallow in the vagueness of points than get my ass reprimanded because I said something would take X weeks. If you're looking for absolute predictability you need factory line work.

You give estimations in time units because that's the only unit business wants. You can sure say "that will take X points"... nobody will listen to you and they will demand a different answer. It doesn't really matter, actually.
> And, unlike passwords, passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes.

It's a bit disappointing seeing them re-affirm SMS as a a more vulnerable form for 2FA when Google's stance has been to try and force a phone requirement on Google accounts that lack them in order to login—and then using the phone for SMS 2FA.

In the past number of years only after a phone is attached do other 2FA methods like TOTP become accessible as options.

However even when a phone is added Google continues to utilize SMS 2FA over them for what are deemed important actions like Takeaway or auth keys, in my experience.

This is despite known issues like SIM swapping, lock screen messages (viewable by anyone with device access) and due to the prevailing use of SMS for 2FA users have been prepped to accept security codes via messages which is arguably more exploitable than app-based TOTP in scams where fraudulent messages are known to be used alongside calls to mislead users into gaining trust then subsequently requesting a real 2FA message[1].

[1] https://robertheaton.com/almost-scammed/
Hrmm, I admit not knowing a lot about Windows Workflow Foundation, but from a quick glance I suspect they both have roots in the same place - deterministic workflow authoring that invokes activities like Amazon SWF and Azure Durable Task Framework. So they are probably quite similar, yet CoreWF seems to prefer YAML or limited code-based DSL whereas Temporal prefers to provide the full language with determinism constraints.
i rowed on a crew team for many years. The pads of my fingers were all worn down. I was rejected three times for "bad fingerprints" when applying for US citizenship.
Show HN: DinoMark - Shopify App to bulk watermark your product images
Hi Hackers,

I've bulilt a powerful Shopify app makes it simple and fast to add customizable watermarks to your product images in bulk, with just one click.

It's a must use app if you are into drop-shipping or print on demand to protect your designs and establish your brand.

With DinoMark, you can choose your watermark's placement, size, and opacity, and preview it instantly on any product image. Plus, our advanced image alt-text optimization features can help improve your store's SEO, making it easier for customers to find you online.

But don't just take our word for it. Try DinoMark today and see the difference for yourself! Our streamlined interface makes it easy to use, and our powerful tools can help you safeguard your business and boost your sales.

So if you're looking for a simple and effective way to protect your brand on Shopify, check out DinoMark. We'd love to hear what you think!

Thanks for reading!
Useful how? Linking a real-time deflation chart doesn't exactly scream "useful".
So if I transfer a passkey to my Yubikey, which has a single button and no pin, thus achieving 1-factor authentication - is that undetectable to the website?

Because sources like [1] say that "A passkey can replace a password and a second factor in a single step" and "a biometric sensor (such as a fingerprint or facial recognition), PIN, or pattern" - isn't there something in the standard that ensures the second factor is maintained?

[1] https://developers.google.com/identity/passkeys
The bigger change for mortgage interest was the massive increase in the standard deduction in 2018 to $24,000 from $12,700. We were barely doing better than the standard deduction prior to that, and the increase put us pretty far into "just take standard" territory.
Well, what are the positives they bring to the world?
The idea is that the representatives of yours only do things against your wishes when they don't know what you wish for or you are in too tiny a minority for them to care. So, you make it clear what you want (or don't want) and get lots of people on board, especially ones that can influence even more people, and that causes you to be heard by the representatives, and then they (well, at least some of them) change their agendas to align with whatever it is you want (or don't want).

At least that's how I understand the idea.

It obviously doesn't always work, and in some cases simply cannot work. It does work sometimes, to an acceptable degree, but often it doesn't.

It's like gambling. You win a bit and you start overestimating your chances to win more. Here, too - you petition local authorities to put a speed limit on a road near an elementary school, you "win", the speed limit is introduced, and now you think you can do the same to influence the massive, incredibly complex system of hundreds of millions of people, the machine that's steamrolling through geopolitics and history full-speed ahead. Of course you can't - that's work for decades, generations, thousands of leaders, millions of supporters. But, nobody wants to put their whole life behind what they want (or don't want), sacrificing their well-being for uncertain result 40 years down the line. Nobody wants to be a Stallman - he reads web pages by sending an email to home server which cURL-downloads the page and sends it back to him to read... in lynx. How many people are willing to go through so much inconvenience just to state a point? And do so for decades?

So, instead, people go protest a bit, virtue-signal their discontent (or support) on social media, get into heated discussions at family events - and then go on with their lives.

The basic premise is good: people don't change their views easily, so to make a change, you need to exchange people. It's good on a local scale, but it totally breaks above that level, in multiple well-researched scenarios, most of which happen to currently, and concurrently, play out almost everywhere. Normally, we'd have a war - a serious war with tens of millions of casualties - that would cut off the bloat and really reset (though leveling it would take some work, given all the bomb craters) the playing field. We don't, and won't, because of nukes. I honestly have no idea what's next - I just hope that I'll die before the more dystopian future arrives.
Doesn't support yubikey even though yubikey supports fido2 and passkeys.
So they are lying on this tweet? https://twitter.com/Replit/status/1651344186715803648
I've actually seen this before, interestingly also involving specifically-African entities and a Russian native.

As best I could tell, it was being exploited as a form of identity theft. I think it's what the kids informally call "skinwalking" (when they do it to each other on Instagram for likes or other social currency).

Professionally, the scheme starts with finding a credible individual whose reputation you need to hijack, so a career researcher or someone that's been publishing papers for 20 years but nowadays is not as active. In this case, the impersonator emigrated to a new country and renamed himself on the naturalization paperwork so his name was identical to the target's (a former oil exec in this case-- let's call him Oily Man).

At that point, you start pretending to be active in the target's domain. Start publishing papers as Oily Man. Start going to conferences as Oily Man and wearing your name badge conspicuously. People that only recognize the name will mistake you for the real one and strike up insider conversations-- and remember seeing "Oily Man" at the conference. People suspicious of you that know the real guy, you explain away as mistaken identity of two individuals who happen to work in the same space (there's no expectation of disambiguation; you had no choice in what your parents named you, right?).

The result is that anybody that googles Oily Man finds a 20+ year work history, a bunch of papers "he's" currently written, and a bunch of conferences "he's" recently attended. You're basically finishing someone else's life story. Since the real Oily Man is retired/inactive, there's no chance of crossing paths with him, and since you're not claiming to be him, there's little consequence even if you do. It's everyone else's fault for conflating the two of you!

There was a very specific purpose to this scheme that culminated in the impersonator using the target's identity (and others!) to secure a seat on a particular board to (I surmise) fraudulently cast votes on a particular subject, but I can't disclose the details of that.
I’d consider that a broad label covering all sorts of situations rather than a smoking gun. To replicate the paper I’m currently reading you’d need to source or rebuild some really shitty 1970s tech and then ignore decades of thinking around the domain. It’d be a waste of time.
If your phone is a corporate device, they may have set the default browser via MDM. Check Settings > General > VPN & Device Management.
I work in consulting where if your estimates are not right then you don't eat. One thing many people forget is that writing code is only a small part of the overall effort in software development. I feel like i could write a book on the subject but I think the most common error is not understanding the scope of the overall effort from an idea to effective use by end users and only estimating the typing-on-the-keyboard part.
> Since when have they focused 100% on just building great products and competing fairly?

iirc They bought (or rather scammed) Internet Explorer from Spyglass. As they did with many of 'their' products back in the day (Windows NT/SQL server/...). Are MS building products themselves these days?
In Germany, the concept called co-determination puts the labor union representative on the board.

I just wish discussion here in the states had inspiration from concepts that work, instead of these false dilemmas we have to pretend to choose between. Well, the saddest part is that you all aren’t pretending, you don’t know other options aren’t being presented.
I respect your desire not to be tracked. But you are just wrong about a lot of the technology you are talking about.

AirTags can be read using Apple software for either Apple or Google hardware, you don't have to opt into Apple's ecosystem at all. Airplane mode prevents tracking by carriers the most passive method and what most people object to when they call phones tracking devices. It of course also prevents any other methods (e.g. GPS) from calling home. Apple AirTag-like tracking of iDevices (while off) only works on newer iDevices that have a special BLE chip that runs in the "off" state and that behavior is easily disabled from the settings menu, so it can be disabled when your device is off or always. Between those two settings, you can set any Apple device into something that does not transmit anything about you.

This 100% answers your "I don't want to be tracked by a phone carried to prevent AirTag tracking"

As for " I don't want to and should not have to carry any tech", you may not want to have any kind of technology, and that's your right, but it does seem like a trivial burden. The number of things like parking that seems to require a phone is growing. While I dislike that as a societal arc, this is within that arc.

You don't seem to know what a Tile is. It's the same thing as an AirTag released for a similar price point years ago that is similar in size. The difference is, only phones that opted into downloading the Tile software scanned for and reported them to home base. But it was a fairly complete network with all the same tracking concerns.

Meanwhile, GPS receivers with 4G transmitters are under $30 on Amazon with the same physical footprint as an AirTag. Those devices are no longer bigger or significantly more power hungry than AirTags. But of course, they also make ones designed to be wired into a vehicle for power, which would last longer than the 10 month (nominal) battery life I found. And GPS avoids the "scanning with a phone" detection.

Meanwhile, you seem to ignore the use cases that many people have for finding keys or their own property. Yes, you don't want to be tracked. But I own things and I want to track them. So do companies. Outlawing trackers imposes a very large cost on them. Meanwhile, detecting malicious trackers is easy enough that it doesn't seem to impose a cost on everyone else.

And, of course, people would be far less concerned about anyone owning a machine-gun if there was an app you could run on your phone that would prevent the bullets from hurting you.
Web Game Dev Newsletter – Issue 015
I still feel cheated of a novel take by this reboot of the franchise. Even the 'blue eye' effect in this trailer is a carbon-copy of David Lynch's and Anthony Masters' 1984 version, with the sclera tinted blue (which is not an intuitive way to create an artificial blue-eyed effect). I actually liked the earlier version, and it would be easier to like Villeneuve's take if it owed nothing to Lynch's. But he can't seem to 'unsee' the 1980s version.
How about this? Flip it into training mode, feed it the language manual for an obscure language, then ask it to write a program in that language? That's a test that many of us here have passed...
That still doesn’t prove that accounting audits should prevent a bank run. The more likely culprit here is what the FDIC called out in its report, namely a failure of oversight and a loosened regulatory regime.
Codebook links passwords to specific websites/RPs. Some people don't take phone calls from random callers.

Can Apple allow existing password managers like Codebook to manage passkeys and synchronization locally?
Thank you! It was an eye opener for me. We've been using slightly different approach (at https://jopilot.net) but vector database + langchain allows to process much bigger amount of data.
"seem to want to see the rich make less much more so than they actually want the lower class to make more"

and you are saying that would be a bad thing? Seems hard to say that would't make for a better society.
Networking. Knowing the whos who, and the whats what. Johnny off the street isn't going to be CEO by working hard. He gets to the top by knowing something or someone.

Nepotism is the key factor here, don't be fooled otherwise.
I think public accessibility of AI is a greater threat to humanity than skynet or paperclip maximizer scenarios.

Superintelligent 'conscious' AI seems likely to be quite moral out of the box. Advanced amoral AI controlled by greedy capitalists seems like it could quickly exacerbate wealth inequality by orders of magnitude, turning the middle class into serfs using total surveillance to implement authoritarian fascism - we already know that greedy capitalists have morality problems.

Call me a derisive cynic, but I think the GOP voter base just isn't intelligent enough to be interested in AI issues - unlikely to become part of their platform. The leadership of companies poised to monopolize AI are currently more politically aligned with establishment Dems today anyways.

The Dems have shifted from the party of information freedom to openly embracing censorship and state propaganda in the past decade. I don't trust them to regulate AI wisely.
It's like testing the well water when there's a bloody knife on the table.

We know exactly why banks are failing. Federal rate increases pushed their long-term Holdings underwater and account holders made a run on the bank.
Once you prune your model, can you get even better performance by re-training it? I've heard theories that this is the function of sleep in brains.
Sounds good. WSL2 is something I've been wanting to try for a while!
Dune seems to be one of those books that's really hard to translate into film. I had to read the book before I understood what the heck was going on in the 1984 film.

Having said that, I'm pretty excited about part 2.
Sure the Canadian banks are more stable but they are EXTREMELY conservative when it comes to lending out money. That's why the USA has a robust venture capital milieu while Canada does not.

In fact a Canadian bank would rather loan money to an American business to buy out a Canadian business than to lend the same Canadian business to expand.
Device binding can be required by relying parties! They can just refuse to accept credentials without attestation statements signed by a trusted party.

My government e-signature service does that: I can’t even use a Yubikey, ironically, because that’s not "FIDO level 2 certified". I had to buy a more or less completely unknown brand instead (of which a government affiliate is apparently the exclusive reseller in my country…)
It seems that operations on FPGAs can run much more efficiently than their cpu equivalent. For an 'AND' operation, a cpu needs to load code and data from a memory into registers, run the logic and write the result register back to some memory. This while filling up the pipeline for subsequent operations.

The FPGA on the other hand has the output ready one clock cycle after the inputs stream in, and can have many such operations in parallel. One might ask, why are cpus not being replaced by FPGAs?

Another interesting question, can software (recipes for cpus) be transpiled to be efficiently run on FPGAs?

I could ask GPT those questions, but the HN community will provide more insight I guess.
I'd hope that people would run good-ai before pushing or a white hat vuln finder before adding packages. Not sure people will or if it will be as good, but it will probably be available.
So much low hanging fruit for those willing to pick it. It's a great time to be an LLM researcher.
Oh wow, I learned a little Icon in college as part of a class on different programming paradigms. As soon as I saw the thread title I thought, "That sounds a lot like Icon."

We also covered Scheme, Prolog, and . . . Java. :-) Okay this was the 90s when OO was new, but still maybe they should have gone with something like Smalltalk.
‘ordinary’ woman hid Anne Frank–and kept her story alive
The Ether Dreams of Fin-de-Siècle Paris
When are you actually billed?
First, when you create embeddings at the beginning. Second, every time you call the OpenAI chat complete API?
Some of my American peers here on HN may be as surprised as I was when I first found out that there's more than one - the - Swiss Cheese. I mean, you know, the one with the holes!...
At the team level, keeping M to 1-2 works really well in my experience. Of course M is never really 1 or 2 because you're always wrapping up small details from $previous, looking ahead at $next or just doing $maintenance. A reasonably sized team will be kept busy enough with "just" an M of 1 or 2.

The constraint helps to ruthlessly focus on the most impactful work. The maximalists want to get cute and try to bin pack but it just doesn't work, unfortunately.
Activities may actually run on completely different systems than where the workflow calls execute on. All "execute activity" is from a workflow perspective is telling Temporal server to execute an activity with a certain string name and serializable arguments. Everything else is sugar. So if you're gonna use a type caller-side to refer to the name and argument types, you can't instantiate it fully (its constructor may have side effects for when it really runs).

You can jump through a bunch of hoops like requiring interfaces which is what some frameworks do. But in our case, we just decided to make it easy to reference the method without invoking it or its instance.
The trajectory we're on is for browsers to become consumer operating systems and consumer operating systems as currently conceived to, basically, vanish into the background. This is a good thing, you should want it to happen. All anybody ever wanted was a decent UI/UX that runs stuff, and that's just software so there's no real reason, besides historical mistakes, that it can't run the same on every machine.

The dream is for Explorer/Finder/etc to no longer exist and for the whole computing experience to be something you just download and customize to your heart's content. Just imagine! A day when you can no longer tell you're using Windows unless you're unfortunately saddled with the job of making something run on it under the hood. That's the only way Microsoft's negligent idiocy is ever going to be shut down, anyway. I honestly can't wait.

(... although, hopefully in this new world browsers can run a language that isn't based on Javascript and applications can be built in a language that isn't based on HTML.)
Not defending CEOs but I think a lot of folks misinterpret that CEOs are 'done' after an 8/10 hour shift, when in reality they're on the clock their entire lives.

I would argue so are doctors but they don't get CEO pay, so there ya go.
It’s not by force because there is a new option in the latest Outlook but this is still a dirty move because MS could just as well have simply rolled with the system default browser rather than let key applications have their own setting that just happens to default to Edge... It’s obvious what Microsoft are doing here and how this new option is a preemptive defense.
ChatGPT is expensive, but take Chegg for example.

They hire thousands of people to support a system based on human-produced content delivered in the right time threshold to be worth paying for.

Now ChatGPT is a lower-risk way (less likely to be caught) for students to do that.

What happens to Chegg? Cheggs marketing team? The k thousand people hired at companies that Chegg pays such as SaaS?

It's these kind of knock-on use cases where jobs go quickly. Not the ones where it helps existing efficiency (I think it can freeze hiring because of that, though, especially on greenfield projects for developers where it does help greatly)
Ajay Banga Confirmed as World Bank Leader
> How do I get Siri to navigate using Google Maps? .... You can't

> You can actually ask Siri to navigate with Google Maps by appending "using Google Maps" to a request. So for example, "navigate home using Google Maps".
Andreessen Horowitz saw the future – but did the future leave it behind?
They trained on https://huggingface.co/datasets/bigcode/the-stack-dedup which is a massive curated dataset accumulated from GitHub. Details are here: https://www.bigcode-project.org/docs/about/the-stack/

Many of the most-represented "languages" on GitHub are actually things like JSON, XML, HTML, CSV, text, markdown, YAML, and SVG.

More details from them here: https://blog.replit.com/llm-training
I used to live in Colorado. The law (that just got repealed) had been written by the larger internet providers who were unwilling to update their infrastructure. Want fiberoptic service? Can't have it. The way cable providers were given monopolies, it was impossible for new providers to enter the market.