skysight-inc/HackerNews huggingface dataset:
passwords are not fine.

my user agent should do otp on my behalf with clean, hassle free and reliable ux. my secrets should auto-rotate on a regular schedule and i should be able to force a rotation at any time in the event of a compromise. the existence of a relationship between myself and any party i wish to authenticate with, or knowledge of authentication events shall remain private between myself and that party exclusively. in the event of a catastrophic loss of control over my digital identity, i should be able to work with a partner to quickly prove my physical identity and regain access to my digital one.
You are not if you use 2FA.
Earlier comment - https://news.ycombinator.com/item?id=36584908
I believe they are saying that education should be available to everyone.

TIL that public good has a specific meaning similar to that:

https://en.wikipedia.org/wiki/Public_good_(economics)
Very cool keep up the good work
the email lists many reasons to continue libjpeg-turbo development which are still relevant if a new (let's say better for the sake of argument) image standard exists:

> expanding SIMD coverage to new algorithms or instruction sets or CPU architectures, supporting less popular new platforms, improving the APIs, hardening security, improving fuzzer coverage, enhancing the build system, improving automation, etc
I never understood that feature and just hide it. We already have bookmarks right?
Prompts the question, who's working on a publicly transparent level up of this:

https://www.spglobal.com/marketintelligence/en/campaigns/met...

Visually present all the exploration and mining in the world and add to it visualisations of the resource costs of extraction and the downstream uses of that material in a manner that ties into global climate factors.
For a layperson, the passwords are easy to understand and provide enough ways to shoot themselves in the foot. Unless you are an expert, password hygiene can rarely be accomplished.

For a layperson, passkeys are difficult to understand, but provide out-of-the-box hygiene and security.

Passwords are not fine. What we need is better explanation/education of passkeys.
It's not for industry, but I keep mentioning it because it's so surprising and little known: The Nintendo Switch uses a home-grown microkernel. It's not UNIX-compatible, fits into ~30K lines of code IIRC, and everything from the USB to the Graphics drivers are sandboxed in userspace. (Too bad NVIDIA's Secure Boot code didn't match Nintendo's standards.)

https://en.wikipedia.org/wiki/Nintendo_Switch_system_softwar...
Ask HN: Search engines that don't limit number of results?
Are there any search engines that don't limit the number of results you can retrieve?
It's not being a parasite if the author willingly chooses to give his work away for free. It is also not the tragedy of the commons, since the tragedy of the commons refers to consuming a finite resource. A software library is not a finite resource since it can be copied indefinitely.

This is the author choosing to work for free (which is fine), wanting to get paid (which is fine, and I do suggest he does charge for his software), and this thread making up an alleged ethical obligation to pay for something which has a price tag of zero.
The court ruled its unconstitutional to have a law forbidding gay marriage. They did not make a law.
I always find it funny that a thing can be an "industry standard" even if nobody supports it.
Fair enough, but if this were actually sufficient then the US wouldn't have a law saying they can require US based companies to give them the data without regards to the laws of their countries the data is actually being taken from.

However I don't see that, and thus Europeans familiar with the relevant cases give “dominance of Americans” as the reason.
Works fine in Europe in my recent experience. It was pretty poor fifteen years ago.
There is no reason the web server needs to have access to the database file, the application that needs it should be running under a different user.
You can see many QNX related changes in Qt that is often used in cars:

- https://code.qt.io/cgit/qt/qtbase.git/log/?qt=grep&q=QNX

- https://code.qt.io/cgit/qt/qtdeclarative.git/log/?qt=grep&q=...
> The Civil rights act did put restrictions on literacy tests used as a form of indirect discrimination.

As a prereq for voting. But getting accepted into a university isnt a right. And obviously universities discriminate against the illiterate.
Zoro.to: Largest Pirate Site Suddenly “Acquired” & Rebranded
So they allow Threads-to-Mastodon, but they key question is whether they allow Mastodon-to-Threads. The former is just a way to recruit users to their platform, while the latter gives access to their platform without being a user.
Hmm good point, I didn't think about that - it's a complex issue I guess
You live in the most puritan country in EU. Polish women have to illegally (because your country made it illegal for pregnant women) cross borders to have medically necessary abortions and then they will be persecuted if they return.

Anyways, I never had to produce ID when I bought alcohol and cigarettes while I visited Poland.
If I were just using text editors, I would do something similar. However, many people do other things with computers besides edit text. DCC applications are obnoxious on displays larger than 32" and reducing the window size just leaves you with little border areas for multitasking. It's just sloppy. So 2x 32" is a pretty obvious choice here.
> 2. People don't have their phone on them all the time (and some don't even have a smartphone).

Even if people have their phones all the time there's always a possibility that components on the device might suddenly fail.

The charging port in my iPhone stopped working on one May morning and thus device died. I temporarily lost access to most of the apps incl. 2FA code generators for about a month. Luckily one of service centers was able to find component and replace it cheaply.
I have a friend who tutors and teaches music privately, and he runs his sessions very much like this.
Sure. Super high level.
Resources are concentrations of some mineral that could be economically extracted.

Reserves are the economically mineable portions of those resources.

There are a bunch of levels to each, with varying levels of confidence.

I can drill two holes, 500m apart and by pure chance intersect nothing but lithium at same spacing between 10m-20m. I could theoretically say , you know what I think between these two drill holes it’s all lithium. It’s 500m spacing and according to grades I think we have 500ktons of inferred lithium resource here.

But for instance let’s say I did some more drilling and was confident I found a resource that indicates it has 1million tonnes of lithium in it. However, it’s located in the middle of Sahara desert, where there are no roads, water sources, or infrastructure of any type.

Just because it’s there doesn’t mean it’s economical to mine it (right now). So even though it is a resource it’s not a reserve.

To define something as a resource there is a lot of room for interpretation. Lots of statistical inference, and a bit of art meets science. From public company perspective you can announce you have calling a promising resource, but if you get it wrong, there’s a lot of leeway.

Calling something a reserve is a big deal. Not only are you extremely confident of the size, shape of the resource, but you have evaluated its economic viability to get it out of the ground and have determined that it’s net positive. You lie about this, and you are in trouble.
I mean, i dont think "elon musk endorses this statement as true" is something that wikipedia would want. Elon musk is not a good source for what is true about elon musk (not picking on musk specificly. Most people have motivation to not be fully truthful about themselves).

Ultimately i dont see what benefit all the blockchain stuff has. You need to bind identities to wallets anyways, why not just skip the middle man and have people make endorsemdnts directly? Like the main benefit of signing would normally be non-repudiation, but it seems like this is a case wherd repudiation would be beneficial - we wouldnt want to keep an endorsemdnt that was repudiated.
there's a bit where it says: "I just won a talent contest, do you think your insurance product would help cover a party that I'd like to throw for me" which is pretty decent.
Their product basically got sherlocked by Microsoft when they released Github Copilot, no?
If you're using the docker container it really shouldn't matter.
“No Way To Prevent This”, Says Only Nation Where This Regularly Happens
Not saying it is morally correct to use Google Analytics. But I still find it amusing the Nordic countries see it is OK for everyone to know everyone's else salary while it is not OK for Google to know your IP.

https://www.dailyscandinavian.com/income-tax-transparency-no...
Ask HN: How about this landing page?
This is the first landing page I developed with vitepress, do you think this page makes all the features clear.

https://hamsterbase.com/
I think meta makes much more per customer, and few people would be willing to pay, say, E100/yr to pay for Facebook without ads
I guess it's the time of the week to post my "Passkeys misconceptions" article:

https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

To answer the article's points:

> While the tech is great, the problem is that nothing supports these new-fangled methods of authentication.

Should we never switch to anything else, then, because nothing will support it until everything does?

> Multi-devicing for authentication is a poor user experience. Even having to go click a link in your mailbox sucks.

WebAuthn doesn't require multi-devicing.

> People don't have their phone on them all the time (and some don't even have a smartphone).

WebAuthn doesn't require a phone.

> New users don't understand these methods of authentication.

New users don't understand how to safely use passwords either. If we're going with max usability, we might as well get rid of passwords and just use usernames for authentication. Otherwise, we should compare like to like, and the usability of passwords is not worth how insecure they are.

> They're generally much more complicated to implement than a basic email/password combo.

Yes, it's much easier to implement something insecure than something secure. This sentence is disingenuously omitting all the impossibility around actually making passwords secure, ie using a different password for each site, 2FA, password length restrictions, etc.

When it comes down to it, Passkeys are orders of magnitudes more secure for a small usability cost over completely insecure passwords. To say anything else is hostile to security.
I don’t think I’ve ever seen ads on messenger. Where do you see them?
A large number of fediverse instances are defederating preemptively to prevent the obvious spam and embrace-extend-extinguish.

The fediverse will never be as big as corporate social media, but that’s a feature. Meta can keep the dopamine scrollers and influencers and ads.
>UC Santa Cruz publishes online to help guide prospective applicants.

>“To receive a high score under the terms set by the rubric,” the complaint alleges, “an applicant must express agreement with specific socio-political ideas, including the view that treating individuals differently based on their race or sex is desirable.”

In what universe is being patronising desirable?
Yes, if you sign up in the Downloads sections (found in the header menu), there are individual downloads for neurons and connections (and other parts that make up the whole thing).
I set up a demo Wordpress site with a weak password and eventually found some new entries - most of which stylistically match AI generated content.

In the old days I would just get some garbage with max one sentence decorated with multiple exclamation marks. Here I got 500-word essays.
I think you’re right. If they can prove that is the intent I think that would demonstrate that its illegal. But merely by effect, not buying it. Any way of choosing that is not by race, which is a legal requirement, can have very unequal outcomes. If its by effect then choosing by grades and test scores is illegal.

I wonder what would cause a university to both pursue affirmative action to meet diversity quotas while also actively trying to discriminate against minorities via legacy admissions.
Absolutely, for some. Language models could satisfy this need people have for social rewards. Imagine a chatbot that masqueraded as a group of adoring fans online who respected you and made you feel like a famous high-status individual? People would love that. If that happened, it'd be par for the course in the history of modernity. Consider the role restaurants play for the middle class. You don't have to be a literal king or noble lord to have people waiting on you and serving you. Yes people know the power is illusory. But they still pay to go to restaurants. People who act abrasively towards each other online have this tendency to assume that AI will behave the same way as them. But the underlying impulse I think has more to do with a desire for social status and influence, and AI could offer us a more effective and pragmatic means of giving it to them.
create a landing page with a signup form (just an email is fine) and on the landing page state what you are offering, what your product is, what your SaaS will do, etc. Gauge interest that way. Bonus: Think of a price you think is fair, double it, then add it to the page and gauge interest.

Then post it to hacker news ;-).
While Toyota has been busy looking for silver bullets that will solve imagined problems, Tesla has been scaling hard with good-enough technology. Their Q2'23 production is a hair under 2 million units per year, so they're already a mid-size OEM (the size of BMW, MB, Audi, etc).
Illegal under the GDPR: consent to storing or processing personal data that is not necessary for performing a service cannot be a prerequisite to performing a service.
> no openable windows

Yep, I'd call that a significant inconvenience (for a home that someone like me lives in).
I think in the short term its cheaper for these scam call centres to use "local" English speakers (in practice many of the employees are fresh-faced out-of-towners looking for their first job) than it is to dev and maintain an entire GPT pipeline. It will require a level of completely different organisation and sophistication than what is currently in place. Right now outside of running the dialler and internal off-the-shelf packages to manage their workforce these orgs are not particularly tech literate as evidenced by the YouTube channels that expose them.
Blackberry 10 was so nice. I bought a Z10 at launch, UX-wise the best phone I ever had. Used it for I think 3 years and would go back instantly with a modern device and better app support.
It had gesture control years before Android and iOS introduced them (it was copied from MeeGo though) and the unified inbox is still miles a way from everything else.
Snapchat is losing $300M USD every quarter. Unless they find a solution they’ll be gone soon.
It is a good product, so we're tying to put our org in a position to pay for it. But I really don't like this model of intentionally frustrating or obfuscating whether it is open source or not, or not listing/hiding what is or isn't in enterprise vs OSS versions. For example, the fact that starting off open source (assuming you succeeded running the maze of figuring out how to run it), explicitly blocked the path to goto enterprise is a shame, and seems like a bit of a missed business opportunity.

We'll probably see more of these faux OSS projects who hoped for some community/network effect from being OSS to translate into either strong donations or considerable uptake of their enterprise/cloud/managed versions go this route.

To be clear, fully support charging for and paying for SaaS. Would just like be able to know what is in front of me when making build/buy decisions.
You are stretching credibility when you talk about 6 months to retrain from GA to some other analytics tool. 1-2 weeks is much more realistic timeline considering standard industry terms and similarity between tools.
When I was young I would devour anything I could find mainly science magazines since books were so expensive. Any educational TV too but we never had cable TV until I was about 12 years old. School was still not all that interesting it was fundamentals it wasn't until high school where it got harder and more interesting.

I think boredom played a huge part in my learning. 1970s and 1980s at home there wasn't much to do. Any new material or idea was like water in a desert. We didn't know it at the time it was just normal.

Even early days of home computers it was all you on your own learning how to fix anything. Even early days of Internet it was just on for a bit and log off even shut down the computer and cover it with a cover. Now it's 24/7/365 stimulation home or outside walking from a fire hose of knowledge.
Well, if you take it so far as death, I can even argue that even death does not stop you from exercising your freedom. You just don't deserve to live if you dare to redistribute my software in a way I don't like.
The problem is defining what a "restriction" is. As an example, The Government of India pulled the same tactic as Red Hat in this case. Enrolling in India's biometric Aadhar program is "voluntary", but it is mandatory to do a lot of basic things - like filing taxes.

Red Hat is doing the same thing, threatening to cut off the relationship if you decide to exercise one of the GPL's freedoms. Counts as a restriction in my book.
I get where they're coming from. It kinda reminds me of an old-school iOS app (pre-iOS 7, before everything went all flat design). The skeumorphism, the arrows in the menu, the big black borders on the menu. The layout, styling and font kind of reminds me of the jQuery era (but of course, I was primed to look for this stuff by the GP comment).

None of what I'm saying is criticism BTW. Just observation.
> Typically people seem to largely get far more engagement with a far smaller number of followers on Mastodon

Are we talking about mastodon or threads? Do you think Threads won't have an algorithmic feed?

It obviously will, so this point is only relevant to mastodon, which is still 100x smaller than twitter.
Leonardo da Vinci's Largest-Ever Online Retrospective
There's life outside the United States, and $100/month is a decent chunk of a junior's salary in many parts of that. Two places I worked at migrated off Microsoft products to FOSS solutions for that reason alone (I was fortunate enough to initiate and complete this process for one of them) — something that has zero business sense according to most HN commenters.
I wouldn’t call this amusing at all. That’s consistent with a commitment to protection of the common citizen. Salary transparency benefits the worker.

If I know my colleague doing the same work makes more money than me, that gives me leverage to request and receive a raise. If I know the CEO of my company makes 1000x my salary, that gives the workers collective bargaining leverage.

The only people who benefit from keeping their income private are the wealthy.
It continues to boggle my mind how so many tech folks just don't seem to understand that "maximum scale" is not everybody's idea of success, and that not everything is built to "take over the world".
This is also something I feel strongly about. I absolutley disdain any product or vendor that promotes "passwordless" (like bitwarden!). For typical web auth, you can't do better than passphrase+FIDO2.

Device secrer only methods like passkeys and anything biometric+tpm without non-pin knowledge factor if auth are cancer. Skip thid bandwagon if you can help it.
> Hallucination is a separate problem, which is solved by using fine-tuned models.

They won't solve the main cause of hallucination: prompt has zero connection to generated text other than probability.

ChatGPT do not generate answers, it comes up with something that looks like an answer. There is a good chance it is the answer, but you can't guarantee it.

I believe this particular problem won't be solved, unless researchers teach machines how to reason. But then we would have greater concerns than hallucinations.
100%. The major tech publishers (O'Reilly, Manning) use Asciidoc and for good reason. The tooling today is absolutely fantastic too. I'm writing my new book with IntelliJ IDEA and it's such a pleasant experience.

My last two publishers required Word which was a nightmare. I maintain some docs in markdown which is OK but pretty limited when it comes to the advanced stuff.
Do you have an example of that happening before? Every exodus I've seen is just the most vocal bubbles jumping ship for political reasons, but once the dust settles ends up being just a rounding error.

Companies can and do die, but rarely (if ever) because a niche on one end of the political spectrum has a tantrum. Have you considered that what you call consensus might just be within your bubble? I don't know anyone who cares.
Can I pair this with adversarial deep learning to develop a way to trap these in my kitchen? I live in the Midwest and they are like a plague of locusts but tiny and annoying and strangely aware of countermeasures.

Or maybe I can apply fruit fly Roko’s Basilisk and threaten to simulate fruit fly brains in agony if the flies don’t leave me alone on the theory that since I am able to simulate a fruit fly brain I am fly basilisk?
https://www.amazon.es/Smoking-Liadora-cigarrillos-metal-70-m...
Oh, sure, but a LOT of websites are static html pages — or, at least, should be.
Why your team needs a daily reading program
> The Google VRP Team recognized our work by awarding us a $500 reward for uncovering this vulnerability. They believed the impact on the application wasn't severe enough to warrant a larger reward.

Exposing email and private keys of GCP accounts only gives you $500 reward? WTF. Google being Google I guess.
He may referring to mini LED, a backlight which enables more fine-grained local dimming.

As for burn-in, this doesn't seem to be an issue in smartphones for many years now, and monitors are also not normally used with damaging high brightness HDR content like OLED TVs. My guess would rather be that OLED monitors are too expensive, maybe because they have much higher PPI values than TVs. (A 55" 4k TV has only 80 PPI.)
> I just give you two books that you've read and you tell me which is better. Do this loads of times and eventually you have a solid ranking of every book you've ever read. Aggregate everyone's rankings and you have a much more robust system then "please rate this book out of 5 stars".

We've done exactly this with Flickchart - https://www.flickchart.com - presenting the user with two movies at a time and letting them choose what, in their opinion, is the better film. We then aggregate everyone's rankings to generate a combined chart of the best films of all-time that's always in flux and changing.

We take into account each user's total number of rankings (refinement), and the total number of movies they've ranked (breadth of knowledge). We also use time as a factor - given that something that just came out has had less time to be "an all-timer" than something that has existed in the world longer and had the time to be experienced by more people.

We created this way back in 2009 and are currently building the next-generation of it on a modern web stack. This new iteration is also more modularized so we can expand more easily from just movies to other domains (books, games, music, TV, etc.).
I can’t wait for internal review and independent investigation of the Irish DPC. If there was no bribery involved I would be surprised.
I still use and barely see any outrage on it. I am just selective with who I follow and stay in the feed where I mostly see tweets of who I follow.

I agree with GP, it’s very easy to stay out of outrage sight.
I don't care about GDPR
Think about HN posts as a lightning rod for communal discussion rather than a pure show-and-tell and it makes more sense.