skysight-inc/HackerNews huggingface dataset:
Basically, Webauthn works by having the token sign some data using a per-website private key.

The default U2F/FIDO2 model was to use a single secret on the token, and deterministically generate a public-private keypair as required. At registration the token provided some opaque bytes to the website, and the website must supply those bytes back to the token when trying to authenticate.

Registration:

1. Token generates random seed

2. Token calculates public/private keypair by combining seed with global secret

3. Token signs registration request using private key

4. Token returns seed, public key, and registration request to server

5. Server stores seed and public key in user's database entry

Authentication:

1. User provides username

2. Server looks up user's seed and public key in user database

3. Server provides seed to token

4. Token calculates public/private keypair by combining seed with global secret

5. Token signs authentication request using private key

6. Token returns signed authentication request to server

7. Server validates authentication request against stored public key, and user is now authenticated

The biggest benefit of this is that the token is quite trivial to create as there is no need to store a per-website secret on it. One secret can be securely used to authenticate with an infinite number of websites without any security or privacy risks.

Passkeys use resident keys. This basically means that the seed is not stored on the server, but on the token. The biggest benefit of this is that you can also get rid of the username in the authentication process.

Registration:

1. Token generates public/private keypair

2. Token signs registration request (which includes unique token identifier) using private key

3. Token stores private key, together with website URL

4. Token returns public key, and registration request to server

5. Server stores public key and unique token identifier in user's database entry

Authentication:

1. Token looks up public/private keypair using website URL

2. Token signs authentication request

3. Token returns authentication request and unique token identifier to server

4. Server looks up user's entry in user database by unique token identifier

5. Server validates authentication request against stored public key, and user is now authenticated

And before you ask: no, I have no idea how this is supposed to work if you have multiple accounts on the same website either.
Then last part, I think, is the question. They could certainly … use a port with the same form-factor and eMarkers to indicate capability, submitting their new technology to the USB-IF as a proposition for standard/enhancement.

We already have, though, a glut of the pre-made components you talk about that cut every corner as close as they can-hopefully not so far as to start a fire, because you can’t sell to dead customers, but up to then? Go for it.

The number of implementations of PD has been a mess, with various chunks of a particular profile unavailable, inconsistently, along with no meaningful distinction between various versions of PD on most devices. Cables are often trash, and there is no certification for them required at all, until you get up to the point that Intel will smack you with a folder of lawyers if you try to call something a Thunderbolt cable without getting it certified. So we can all go out and buy just Thunderbolt cables and be sure it’ll work with everything else, and it’s all well and good until our wallet notices the hit.

Surely it can’t be that hard to just … check that stuff meets the standard, as in cGMP-style adapted to electronics (to the extent it isn’t already). Right?
Exactly why I clicked on it. Hopefully has more responses than mine did!
I wonder how our global lifestyle affects this too. You might have had a really dirty childhood in the UK and adapted to all the dirt and toxins there, but then you take a job in Nevada or something and you don’t have childhood immunity to anything there.

I’d love a study done on autoimmune disease prominence in expats vs local populations.
In 14 years I've got to work in greenfield projects exactly once. You are far more likely to end up working in a huge mess of legacy code...
Performance is absolutely a non-issue when modern "engineering" insists on running everything on underpowered VMs with high-latency network-based storage. Even if your language is truly, actually slow, you can get an instant performance boost just moving that workload to a modern bare-metal server (cloud providers basically ate all the performance improvements of modern hardware), or scale that (most likely stateless) workload horizontally if a single bare-metal machine isn't enough.
They’ve tried that once before and ended up here.
Yeah that is a pretty poor reason, thanks for the nugget though that is pretty interesting.

I could think of a bunch of legitimate reasons to want to ban it but they would also hit a bunch of other languages as a result - hence why I was curious how it could be so specific.

It wouldn't surprise me if LOC for LOC PHP written today is much more secure than JS because of the same dynamic, just JS is the one that is now on 80% of new code written by beginners.
It’s serious and actually tries to fix the company.
This is not true, Passkeys is the marketing term for Webauthn with resident keys.
I've always used my own linux laptop in contracting work...

Get differrent clients...
"What, did AMD switch to PowerPC?!"
That sounds very interesting, so you have a source for that? I could not find anything on Google searching for "life expectancy, gender and size".
There are staticly typed and gradually typed lisps. Clojure also has a similar concurrency to go with channels.
not only is the title misleading and click-baity (connecting to wifi is the only pre-requisite) the format of the blog doesn't format correctly (text and media is cut off on the right) . maybe spend less time writing misleading articles and more time fixing its viewability?
So, stick to canola oil over olive oil if you want lower omega 6 ratios. Stick to unsaturated fats over sat fats.

People who fixate on omega 6 and seed oils usually dismiss the downsides of saturated fat, as a rule. They will go on about the dangers of seed oil based on something that isn’t scientific consensus, yet the overwhelming balance of evidence against saturated fat doesn’t meet their
epistemic standard.

Always awkward to watch.
Does this help prevent supply chain attacks... at all?
Are you? Getting access to liquid LSD and the means to IM or IV it are certainly not typical, or anywhere near the prevalence of access to the oral form
Hmmm, maybe because the whole thing was marketing bullshit from the benginning?
They aren't there yet though.

Reminds me of the 2001 movie 'conspiracy' with how that all played out.

First you follow the vision, then when its untenable, and left you in a inescapable position, you redefine words and talk about what you aren't talking about.

Arguably you can't let robots take over a large portion of the jobs because rational pricing goes out the window, and you end up just like non-market socialist economies did at the turn of the last century. A lot of people generally get culled when food shortages occur.
I'd kill for common lisp with transparent green threads. It would be so great. As you noted once you use them you can never really go back. Of course, it will never happen because it can only be done in the compiler/runtime, not in a library, and the standard is frozen in stone, so that's that.

I've got some hope for clojure with that at least, thanks to it being jvm hosted.
I'd imagine this is to prevent one person from registering 200 accounts and automating the job via ChatGPT.
Does adopting serverless actually accomplish that? With servers you have a bunch of technologies to learn about that are abstracted away with serverless. Every person I know with ADHD in the IT field, not knowing many, is into servers.
Its dangerous to say "should be in person".

That team should decide based on their needs at the time whether meeting in-person will help them ship faster. It could speed them up or it could slow them down. Some work is just throwing a prototype together to demo (in person might help flesh out the right idea). Other work is investigative/diagnostic (multiple people staring at a screen, searching for a root cause will slow them down).
AI Beats Humans in Answering Healthcare-Related Questions
This. So much.

The naming of products has gotten really silly and useless, and I put this blame on Intel and Apple. Apple started down the path of Pro, Pro Max, Ultra, Max, and Plus. Remember the iPhone XS? Idiotic naming there. Intel, otoh, just started doing crazy numeric strings with a random character added to the end. And this was after bad naming schemes like "Core 2 Quad". Part of the issue with GPUs and CPUs is the need to do binning to make IC manufacturing commercially viable so companies end up with a ton of SKUs, but the other part is just bad marketing.

I know that advertising, marketing, and such generally have a bad reputation, but good branding, marketing, and advertising is essential to inform consumers about what they are buying (and thereby ensuring satisfied customers in the end), to differentiate products in the market, and to maintain a high quality brand image.

Honestly, at this point, it would be better for Apple to just say: we have iPhone, bigger iPhone, more powerful iPhone, and both bigger and more powerful iPhone. On the CPU/GPU front, they should just list the core count and the iteration number. For Intel and AMD, the better route would be listing the specifications and creating a short hand for these specifications for those who are well versed in their product offerings, but then re-introducing things like "Pentium" or "Athlon" for the highest volume SKUs that people are most likely to buy.

As regards the original article. Everyone already mentioned the TDP issue with the comparison between AMD and Apple, but Apple is also going to be introducing the M3. The rumor mill has it that the M3 will be a far more powerful product than M1 and M2, but this remains to be seen.
You are confusing Verizon's motives with Google's motives. Verizon disabling the bootloader on phones that users are still paying off, or bought at a discount together with special terms of condition, is something that might be defensible.

Google however made it so that any Pixel phone bought anywhere, even by customers who pay 100% of the price themselves with no carrier involved are not actually owned by those users until they connect it to the internet and Google blesses the device.
Yep. All their stock apps, including those that have no business having any kind of network access as part of their functionality, come with a privacy policy, show it to you in a modal on first launch, and quit if you decline it. The calculator app has a privacy policy, so does the clock, the media gallery, the file manager, and the local music player. I was also told that there are actual ads sprinkled throughout the system.

I'm highly doubtful that it's possible to sell a phone for the equivalent of $100 at a profit.
It depends on how you write the code and the compiler you use, but Lisp can be as fast as if not faster than C. But the main thing is that in Lisp it's easy to turn the dial between speed and other things you might want to optimize for like safety and debugability. Making C code memory safe is a lot of work at best, and actually impossible at worst.
This is a really good description of how the "mental energy meter" seems to work for me. It's almost impossible for me to tell what fills it and what drains it!

Yesterday, I spent the entire day ripping out some rotting boards from my deck and replacing them. I tore out 4 16' deck boards and another 12 4' boards from the stairs. Then cut new ones for all those and put them in.

You wouldn't think that a project like that would take 12 hours, but there were so many little subtasks that had to happen that added up to a ton of work.

I went to bed utterly physically drained, and was sure that I was going to wake up today feeling like doing nothing. Instead, I woke up at a reasonable time and went out to my yard to seed some grass. I just felt like getting more shit done!

Meanwhile though, there have been times where I finish up some big programming task at work and then have a day or two where I just can't get momentum.

I like weightlifting (although I'm a bit off the wagon currently). Sometimes, I get a huge burst of energy and focus from a session, and other times, I'm gassed and dead for the rest of the day.

Same goes for socializing. Sometimes after an event I get home and can't shut up while talking to my wife. Other times I feel like I drained all my social energy for the next week.

It's so strange how little contextual things make such a difference in whether the things I do energize or drain me.

> I got nothing.

Ditto ;)
Clojure's core.async channel concurrency is nothing like go's. You need to wrap your concurrent block in a macro so it can code walk to find explicit blocking points. That means these points need to be marked, and can't be in already compiled functions. That's an enormous limitation. Compare to go's which just works, no caveat.
The specification is open, so anyone can create their own implementation.

However, the implementation also supports attestation, which means a website is able to only allow certain "trusted" passkey implementations.
I have seen those articles, also note, each of those languages is the product of and has the backing of giant corporations.
Clozure CL and Allegro CL have native threads. I think SBCL and Wraith Scheme do as well, but I'm not sure.
> Do you think abstinence is part of opioid resistance, or that forgetting to take pills is part of hormone resistance?

Forgetting to take pills is already part of the measured effectiveness of hormonal birth control. It's included in the official statistics.

As it should be, obviously. Not taking pills is the easiest and most important way to resist their effects.
Communicating like you?
Subaru's exhaust note is the textbook definition of drone. To the point that people are sticking steel wool in their stock exhausts: https://www.subaruforester.org/threads/2014-stock-wrx-exhaus...

I get exhaust notes are subjective, but I've found Subaru owners are the only people who appreciate Subaru exhaust notes, and at which point it starts to feel a bit like a sunk cost thing.
> So a mistriggered security or regulatory function could cut off access to the account, followed by being cut off from your bank or other accounts wrapped up on that same passkey store?

In terms of key, it's either stored at the OS/browser level (Windows Hello), or at the hardware level (Yubikey). Imagine them as if there were SSH key files; You hold the private key(s), protected by a PIN/password and Google simply has the public key(s) to authenticate you.

Even if Google disabled the account, it still doesn't block you from using other stored Passkeys that are tied to other providers. The only place where you'd get in trouble is if these third-parties like the DMV used Google as their SSO.
I've really only seen people use them for external radiators like the MORA 420.
It's really low resolution, but I wonder what could be done with some super resolution techniques. Is the transfer function of these sensors well defined?
In diving, the main factor in determing air use (SAC rate if we want to use diving termonology) is work load. The more a person is relaxed and in rest, the lower the respitory rate will be. The more excertion a person do, like fighting a current, the higher it will be.

A smaller profile will also help in reducing drag. A smaller frame also need less air in their suit (both dry and wetsuit). This is likely however to impact resistance to cold.
The most important productivity tool that I use is Alfred[0] for MacOS.
Nothing ever came close to increase my productivity as Alfred did.
The two features that are essential for me are the clip board manager and the so called "workflows" which is basically a script launcher. The user experience is an absolute joy, it is deeply customizable and you can do pretty much anything you want. Just to name a few:

* encode / decode strings from any encoding to any encoding

* access Jira tickets by only entering ticket numbers

* instant access to all my dot files

* HTTP status codes explanations simply by entering the status code

* list and kill any process

* Docker management

* port killer: enter port and kill the service that uses it

* timestamp converter - from any format to any format

* UUID generator

* super fast access to 100s of weblinks (repos, miros, wikis, documentations, etc.)

It has a free base version but if you want to use the good stuff you have to buy a license for £59. I cannot recommend it strong enough, I even gifted licenses to colleagues, friends and family.
[0] https://www.alfredapp.com/
I think the outrage about this is a little overstated. Most people buying a $1000+ phone already have a wall brick of some sort. As well as a number of other devices to plug USB into.

If you want the convenience of another brick or wireless charging, the option is there.

As self-serving as it is for Apple, it is keeping more chargers out of landfills, and reducing the cost of shipping that extra weight.
Why not just generate random passwords for each site and store those?

That approach is susceptible to a man-in-the-middle attack. FIDO isn't.
There is already very much reduced need to invent a better plug that isn't backwards compatible because USB-C is extremely flexible in that you can negotiate what will go over the pins.

E.g. USB power delivery has already been ramped up several times to the point where it can deliver up to 240W (USDB PD 3.1)

That doesn't require any regulatory body to agree, just the USB Implementers Forum.

While there may well eventually be a reason to upgrade the actual plug, there should be resistance to that to encourage people to try to find ways to make it work that's backwards compatible with current equipment first.
Try out Dark Reader.
It’s not rumours. The introduction for the lightning port said it was a standard for the next ten years during the keynote.

I don’t think they necessarily meant it that literally, but this year will be year 11. So if a switch happens this year, it’ll be exactly fulfilling that public commitment
Magsafe 3 uses USB-C on the other end of the cable. It uses the support for up to 240 watts that the USB forum announced a few months before Magsafe 3 was announced.
You probably don't realise how fans can be a massive drag on productivity.

I was so mad about myself that I hesitated buying M1 for so long after buying one.

I've become much much much more productive on this machine, as I now longer feel this drag when I have to do something and then brace myself for the fan noise. I didn't realise that but I was putting a lot of tasks away just so that I don't get annoyed by fans.

My M1 Max has fans, but they are so well tuned even if they do turn on sometimes I don't hear them and most of the time they are off.

Given how much the fans are affecting productivity, I really couldn't care less if my compile time took 3 minutes rather than 20 seconds as long if it was completely silent, as I may have been hesitating for a couple of minutes to run the task in the first place.

Also it is such a comfort to have a meeting without having to say "sorry guys, these are my fans going off".

I also never noticed any performance issues. Anything I do is snappy, no hiccups and works regardless if I am plugged in or not.

I had situations with my Dell where I couldn't plug in and the anxiety that it could shut down at any time (battery meter wasn't trustworthy) was painful plus massively worse performance on battery.

Apple is a different league. As much as I hate Apple I see no alternative right now.
Yeah Beanstalk was pretty simple and decent for it's time.

I told anyone that wasn't comfortable with Cloudformation + Packer and wanted to be on AWS to use it during that era. At that time things were pretty binary, you used PaaS like Beanstalk or Heroku or you were off in the wild west where there was no standards at all. People were doing immutable AMIs on ASGs at the high end and then everything down to pet AWS instances w/Capistrano or similar tools at the low end.

These days things are different, containers were a big deal. If you target k8s your application is pretty portable, can be run locally in something like kind to integration test the infra components, etc. You can take it to the 3 major clouds and bring most of your ingress, secrets, volume, etc configuration with you.

For me k8s has been a godsend because for once I haven't had to learn a whole new set of idioms each new place that are all equivalent but different in their own special snowflake ways.
If you are talking of MS Office... I am afraid that yes, the various free/open alternatives (especially to Word) were a wasted effort (of course, it could be that MS made their products more affordable in part because they were worried by the possibility that Open Office etc. could become "good enough" to make people switch, but honestly, this March I got a perfectly legal copy of Office for Mac for less than 75 USD... and I bought it because I was asked to prepare some slide for a professional group and I preferred to buy the whole packet out of my pocket than risking issues with "export to Powerpoint" from Keynote).
The Architecture of Symbolic Computers is one of my favourite computer science texts ever.
I confess to not really pay attention to the Apple ecosystem. Does anyone know enough about these benchmarks and chips to really know what is going on here? Is this straight up a difference in conventional superscalar/multicore throughput and efficiency?

Or are is there an aspect of Apple to non-Apple comparison here with the compiler, OS, and library ecosystem? I.e. do any of the benchmark calculations get executed off CPU in the GPU or other "matrix" coprocessing units in the Apple SoC? I am only interested in comparing CPU to CPU or GPU to GPU, but would want to exclude software-based differences like different compilers or support libraries.
Well, that's exactly what I don't care about. Most languages have native threads. I want an actor runtime with transparent green threads, for example. Like Erlang/Elixir.
Stay far away from fathom. Bro culture bullshit at the worst. Don’t believe a word they say.
Until Google, or Apple, or facebook, or whoever is the passkey store holder decides to put up an interoperability wall, either through neglect, cost savings, or intentional user retention.

The big providers could provide cross company SSO (e.g. sign onto my google mail account w/ my apple identity) for all their accounts already, but for some reason that hasn't happened...
Yes it's a problem. There's something wrong with the way they've packaged it with Electron I think. If you use the web version in a browser it's much faster.

You can also turn their web page into an app with a few different Mac apps. I've used Fluid to do this but there's also Coherence and Unite.
I can't help but laugh at this when I think of how easy it is to imagine the exact same tenor in a post dismissing Kubernetes as newfangled, overcomplicated garbage.
The best way I found for the use of NVM in CI/CD
I've been working recently on providing nvm integration in Docker base images and on our CI/CD, with a target to make it work as easy for developers as possible.

I think, I nailed it, but... I didn't saw anyone else doing it like that and I wonder now if it might contain any non obvious flaws?
Oh, ok. Thanks