skysight-inc/HackerNews huggingface dataset:
I've said it before and I'll say it again (and yes let it rain downvotes):

I don't understand this whole discussion and maligning of passwords.

You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user once they replace their phone or it breaks or for any other mundane reason.

User picked passwords (1FA) are and will always be the single best solution that has ever existed for authentication, considering everything from security to usability and practicality, wholistically.

If I sign up for some crappy service that I'll barely even remember a week later I should be good to go setting my password to "asdf" and that's everything I need to log in.

Fuck everything else.
https://news.ycombinator.com/item?id=36717356
We've been using Redmine since about 2010 or so. We use it daily for ticket tracking, light PM tasks, and documentation. We've considered moving away from it for years, but our customers love it. These are customers that are extremely large financial institutions and the only thing I can figure is that they are forced to use larger, more complex systems internally (or with other vendors) so they see Redmine as something simple to work with when interfacing with us.

I think it's a great app with a huge amount of flexibility from UI to plugins. It's easy to use, performance is quite good on even lower end hardware, and there is decent documentation if even sometimes dated. We have customers and our internal teams using this app every single day, day in and day out, and it just stays rock solid stable for years on end.

That said, upgrading this thing is an absolute nightmare. And if you need to upgrade the underlying OS you're going to have a bad night or 5. The database design is very abstract so writing ad-hoc queries or trying to fix something manually via the db is not fun at all. I'd seriously rather stub my toe in the middle of the night on an amish made coffee table, twice, than touch this thing on the back end for any purpose.
It’s time to make money appear out of nowhere, ignore the long history of abuses in such places, and pretend the courts are going to do a 180 and suddenly allow what was unconstitutional before.
I like this article because it forces us to recognize what secure users are really doing already. I haven't created my own password for something in ~8 years, since I started using LastPass and 1Password. I have no idea what my password is on any site, never see it, can't even type it on a keyboard reliably.

Looking forward to them being replaced with passkeys.
systemd was hardly the only one working on the problem. It was actually not even first.

It just won.

And it's still not ideal. Not even close.
How Oppenheimer weighed the odds of an atomic bomb test ending Earth
> What do you propose, NATO escorting ships bound for Odessa and getting in an open armed conflict with Russia so that South Africa and other friends of Russia, avoid food shortages?

Yes. Fuck around and find out. Russia does not have the military capability to fight another war. They'd be complete idiots to attack a western warship. They would simply lose. You don't need to declare war to destroy a ship attacking yours.

Russia's threats are as idle as their constant nuclear threats.
we have less invasive solutions available already
Yes. Like I know people that have 100% bought-in to a single architecture -- all Google or all Apple -- who use the suggested random passwords built into the cross-platform-browsers of these platforms. But if you're not a single-platform cloud-account all the things person it's much more difficult.
Well, the voting on this question and the other replays could explain why most code in the wild looks like it was written by people who don't know how computers work… Sad, but this here is quite telling imho.

I don't say that you need to be an expert on low level programming to write good code (sometimes this is even a hindrance as quite some of these people are prone to the premature optimization anti-pattern) but one should imho know at least the basics and have a high level overview of the low level stuff.

But frankly the reality is that even people who struggle with mere syntax, people who have no clue whatsoever what's going actually on, "contribute" code way to often to the corpus that you need to deal with in professional settings.

</rant>

Edith thinks I should at least praise the great article we're commenting on here!

Very nice write up.

The only thing that I miss a little bit is a kind of "disclaimer" that what gets presented is "just" the result of a market race, and not how computers need necessary to work like. Not going into the details of possible hardware architectures and implementation, but even on the "user facing" level (the operating system and application layer) things can look very, very differently. Just as an example: https://en.wikipedia.org/wiki/Genera_(operating_system)
You have it backwards- the traditional Drake equation relies on unfounded priors, and by using a Bayesian approach they have avoided that problem. Instead of making up terms from nothing like the Drake equation, they are able to represent only the data we actually have, and leave the rest uncertain.

The priors are carefully encoding the actual information they have, and incorporating the extreme lack of prior knowledge as uniform or nearly uniform priors over an extremely wide range for the terms we have no data on.

That is the basic takeaway here- with almost no knowledge about a large number of factors (as the Drake equation is constructed), there is an extremely high chance that once of those unknown factors is actually nearly zero, even when your expectation value for each (e.g. what would have been used in the traditional Drake equation) is relatively high. N (number of civilizations) therefore approaches zero, even if there is no single term that you are pretty sure is near zero.

The Bayesian approach here allows for a rigorous representation of our (extreme lack of) knowledge and gets to the truth of the matter: civilizations face a huge number of possible bottlenecks, each of which we know almost nothing about the probabilities of. This means, there is a strong chance at least one of those is a massive filter, even if we don't know which.
They already know it's not viable, that's why they tried to take the whole country. The South-East Russian border, as a whole, is very hard to defend; one of the main objectives of the campaign (and arguably of the long-running Donbass "insurgency") was to solidify control of areas that can act as better buffers, protecting Crimea as well as the current Russian border. That's also the premise that Russian diplomats tried to put forward for talks: "we leave you Ukraine as an entity, you leave us the strategic bits of it that we need".
you shouldn't be putting complex arguments in a shebang.

it's there to tell where the interpreter for the current file is.

shebang can't even handle more than a single argument on its own. if you have `#!/bin/program -args somescript`, it will divide it into ['/bin/program','-args somescript'], which is almost never what you actually wanted. ( this is linux specific, shebangs aren't necessarily universally portable between all unices )

if you want to do something complex, make it `#!/bin/sh` and then `exec` from the current file with whatever arguments you need.

one thing that link doesn't mention is that you can use env to lookup an interpreter via the current path.

`#!/usr/bin/env python3` for example, will find whatever `python3` the users is using, without having to know where it is.

this can be useful for scripts that you will be running from virtual environments, for example, which work by overriding the PATH to the python interpreter.

you wouldn't want to do this with anything installed, however, since you wouldn't want installed programs to let the user control what interpreter to use. instead, you should just use an absolute path.

there is an option in env, -S, that can be used to parse a command line from a single string specifically to handle this limitation.

after years of avoiding much trickery in shebang lines, it seems like a questionable practice at best.
That assumes the situation where the password hashes are stored in a way that is less secure than the actual data that the attacker ultimately wants access to. That must not be a very common situation.

The passwords will not be of any use on any other system. This would eliminate password reuse.
So we're back to the apparatus being the baddies, right? That's what we're talking about. They're accountable to no-one, they can't be voted out --only Congress, who seem happy to abrogate their powers can rein them in, yet seem unwilling. It's this that Jefferson, Eisenhower, JFK and others warned us about and we've only allowed them deeper penetration into power.
Well, don’t take it in the wrong way… I do agree that it’s important, and I’ve personally always made sure to learn lots of theory and do academic and other types of research. I agree with you that preparation and knowledge are super important.

What I was trying to say is that you get a really valuable perspective from actually working on a field. You get that plus you see how others work, possibly more senior engineers. Mentorship in the workplace is really useful for example. You also see real code and different practices and ways of working.

I wasn’t trying to be dismissive… more like encouraging. Some people feel that they really aren’t prepared, even when they get to a point where they are. It was more about that than about laziness. I value theory a lot, myself.
The role of the Ataturk Dam is something that I rarely see mentioned in this context.
Yeah, this discussion is really weird. An actual air gap would be great for security and a huge pita to work on. This half-assed fake airgap seems like a bunch of security theater that's going to make people's day to day jobs a lot more annoying
They are really unpractical at the moment, but so were peltiers and solar cells when they first started out. Now those technologies are robust, effective, and practical.

With enough research, perhaps these will also be practical. I think a MEMS implementation with chip scale devices might fit the bill if suitable materials can be discovered.

Since these are basically capacitors, If we say Dt is 1c and the single cycle density is low, we might be able to use MEMS to get a MHz cycle rate and layer them 100 thick like NAND. Then you’ve got an extremely high thermal flow (millions of cycles per second) and 100c Delta—T in a device that can be produced at chip-scale.

Peltier devices can’t unlock this process, since their base efficiency is so dismal that you would just be creating a heating element.

I don’t know if any of this is possible with -this- device, but it is meant to be an example of how modern technologies can create unexpected outcomes from humble processes, when the efficiency of the granular process is high enough.

If this could leverage MEMS in a similar way to how massive parallelism revolutionised power MOSFETs, it would be a fantastic tool for humanity.
> You're saying animal -> human transmission of a human virus is equivalent to animal -> human transmission of a new virus.

You're making up an entirely arbitrary distinction.

> The palm civet SARS spike protein RBD did not gain the ability to bind human ACE2 many times.

You have no idea if this is the case. Most of these small outbreaks were not analyzed in detail (or even known about until well after the fact). The evidence shows that the virus was able to jump from animals to humans numerous times, and possibly spread in small clusters.
And sometimes it depends on the environment outside of the computer.
Wouldn’t child tickets address that problem?
I no longer trust the FBI and see them as a partisan political paramilitary organization. They are more like storm troopers than police. Joe Biden in is by far the worst President in American history, I’m not sure our Republic can recover from the horrors. I’m not sure we would want to if we could, it’s gone too far now to go back to how things were.
Hi! I'm the person who made this thing!

Thanks for reading and thanks for all the corrections, in glorious Hacker News fashion. It's definitely a pleasant surprise to see my project here. Putting the "You" in CPU is still very much a work in progress — I was hoping to polish it a lot more and even add some more content before posting on HN later next week :)

Some backstory on me: I'm 17 and left high school a year ago to work full-time at Hack Club (https://hackclub.com/). I've been programming for as long as I can remember, and started homeschooling about 6 years ago to focus more on that (and my other interests).

Since I'm entirely self-taught, I haven't taken any college systems classes — and while I had picked up a lot, I wasn't happy with my answer to "what happens when you run a thing." So I let myself spend a shit ton of time actually learning as much as possible. What I found was that:

1. Operating systems and hardware are really fun to learn about!

2. Wow, online resources on this stuff are terrible.

A decent portion of my research ended up at PDFs of lecture slides from 2014, or StackOverflow answers that were, in fact, incorrect or vastly oversimplified.

So, I wrote Putting the "You" in CPU to hopefully provide a better resource to people who wanted to start teaching themselves all this stuff! While I don't provide perfect coverage (still need to write a couple paragraphs on SMP), it's a lot better than most of what I've seen. I also had fun drawing and making diagrams for the first time, I think I definitely got progressively better and I'm really proud of some of the drawings in the latter few chapters.

P.S. The whole thing is open source on GitHub if you want to look under the hood: https://github.com/hackclub/putting-the-you-in-cpu
Most large corporations in America have a weird incentive structure problem. Nobody cares if the real work is done as long as their own jobs are protected.

This obviously means that if a savvy exec is putting the heat on the VP, the heat will transparently propagate to the lowest level leaf nodes worker. None of the middle layers take no responsibility ever. The managers will even go to the extent of firing the leaf nodes than admitting failure.

If the incentive structure were changed so that management gets fired first, everything will get produced automatically.
I am definitely not an infra engineer, but I see it as an attempt to fix problems that have accumulated over decades as standards calcified and no single vendor was able to improve due to interoperability issues. Some of these things can’t be tackled without a full end-to-end solution, hence the full server. It doesn’t mean components couldn’t be swappable in the future, but at the beginning it’s best to develop on a narrow set of hardware until a solid baseline of stability is reached. Sort of an Apple-like approach for large scale servers.
India ban of rice export is partly because Thailand and nearby countries are also expected to have a bad crop this year which will put pressure on Indian rice prices. The first year probably should not be a problem but if it carries on to the next year then it could be bad in term of prices.
I think that most people can come up with more effective ways to annoy someone.
I’ve been making Salt/Corned Beef [0] since I visited London a few months back. It also requires a long brine cure.

[0]https://www.jamieoliver.com/recipes/beef-recipes/homemade-sa...
No way! I had forgotten!!
> Chapter 4: Becoming an Elf Lord

Clearly this is targets only people with multiple PhDs in electrical engineering and computer science.
Sad he did not live to see it due to Covid.
> Who built the pre-existing buildings? I somehow doubt that the feudal lords were pre-building the houses landlord style.

Yeah some building is going on. But a lot is getting passed down or rented out to other people when people die. If I remember correctly the Crown essentially seized all land with the Magna Carta and then diced it up as they saw fit and anyone in any existing dwelling was forced to pay or booted out.

> Today, that's the responsibility of the landlord

Er no it's not. The developer builds the property. The landlord buys it and rents it.

> Today, that's the responsibility of the landlord. I doubt that back in the day the serfs would be contacting the lord if they had a leaky roof.

Yes, this is true. But many landlords will also refuse to pay out to get certain things fixed. On top of that, you're also not allowed to modify the dwelling you live in if you want to see your deposit again. Which you probably won't because they'll make up some kind of reason not to give it back to you.

If you can't see the similarities to how medieval aristocracy and modern day landlords are bullying the rest of society for their own benefit and extracting the same proportion of money from them, then I can't be arsed to convince you.
> No... you don't. You specifically said you wanted to do this without allocating and minimal copying. That's a different problem than "just iterate over lines in a file."

Yes, of course. The point is iterating over the lines of a file given the aforementioned constraints and not “implementing Rust’s Iterator abstraction”. Whether or not Go or C have iterator abstractions is immaterial.

> Of course it does. The GC manages the lifetimes for you. In your C code, you manage the lifetimes yourself and likely rely on the caller to not fuck things up.

GC only manages allocations. There are no allocations here to manage.
I'm not sure I would call it technical merit, but sentiment and reputation do play a role in negotiations. No cloud provider wants to be perceived as having a weakness in terms of security compared to its closest competitors.

There are debates about risks when large companies move to the cloud - in some industries more than in others. Opposing groups within companies as well as competitors' sales people will be looking for weak spots to make their case.

In isolation, incidents like this don't make a difference. If it looks like a pattern that would be bad for business though.
You can use mTLS client certificates (kept in the system key store) in browsers this way; but the UX is pretty hard to get right, and certificates nearly always have to have an expiry date to deal with the compromise-able nature of keys imported into the system key store.
This article is the very embodiment of how I think about authentication! I once tried explaining to a top-brass security professional at Microsoft why mandatory, SMS-based '2FA' wouldn't be an improvement over simple passwords - they just didn't get it. I wish I could have shown them this essay.

Legitimising 'Risk-Based Authentication' as a strategy is a big mistake in the software industry. It allows criminals to sit on compromised credentials, trying different combinations of accounts, user-agents and IP addresses until they get the jackpot: a website decides this time that there is 'low risk' to the login attempt, and the bad actors are in. When you make security-critical decisions with statistics (in this case, whether to permit a login attempt), you are essentially guaranteeing that there will be a certain proportion of breaches, because you set the risk threshold!

Our efforts as an industry should be in making sure that credentials are not stolen in the first place: better and more widespread encryption, phishing resistance (with UX that supports that) and low-level security audits of encryption software and hardware are just a few of the areas where research and development would be valuable.
The guys preparing to intentionally cause a nuclear disaster at the largest nuclear plant in Europe, committing genocide on an immense scale, and perpetuating an offensive invasion into Ukraine are indeed the big bads, yes.
And to a degree, the latest one runs a modified iOS which is a modified macOS if you go back far enough.
If wonder if it has something to do with shared libraries
A randomly generated pass-phrase can be both secure and easy to remember/write down.
Personal Access Tokens are intended for fully automated access, such as a deployment pipeline. They are not intended for daily use, and step 4 even explicitly says "Need an API token for scripts or testing?".

For regular pushing you are expected to use a SSH key, and those are far easier to add.
I started a project using LangChain and quickly realized it wasn't actually doing a whole lot. There are threads you can find on here and on Reddit where people call it utterly useless.

I think that may be hyperbolic; at the very least it helps one build a mental model and understanding of how to build these kinds of apps, and it can provide some shortcuts for fast development.
There was this Chinese proverb from this kung fu manual this old martial arts school printed that I used to go to. I had this saying "invest in loss". I immediately fell in love with that saying but every time I go to cross reference it online I never hit anything. Is anyone familiar with that Chinese proverb?
Agriculture which is used to feed the animals. Look at soy in the Amazon, most is used in the meat industry
What I most want from a Confluence alternative, and I have a few poor ideas how this can be solved, is a way to manage stale content. The Confluence spaces I work with are dumping grounds of old, often misleading, information.

Deduplication guidance, reports on untouched content…I don’t know how to fix this, but someone surely can solve it.
The scale of the Syrian civil war would not have been possible without substantial foreign assistance at the onset.

You can look at reports of weapons seizures along the Iraq/Syria border in the lead up to the conflict.
But Syria was doing fairly good economically circa 2010?

According to world bank[1] Its GDP per capita was competitive relative to the region. It was ahead of Turkey, for example, and far better than most its neighbors (except Gulf countries).

[1] https://data.worldbank.org/indicator/NY.GDP.PCAP.CD?end=2010...
While I agree with both the approach and result intuitively, the assumption of uniform unknown priors feels like it could be a huge source of errors
It's also valid to make a comment where a bunch of developers might see it, and hope one of them agrees and has the time and skills to do it.

Or maybe just to reach someone who never used bugzilla and doesn't realize it's light-years better than jira or rally.
> moreover it's not just the US but also a problem for most Western countries. If it's not reversed soon then it'll be irreversible and the West will be fucked. A reminder of the know-how that we've lost.

This became very apparent in europe after the start of the war in ukraine.
The west needs it's own manufacturing to keep its global significance. The short term greed of globalization has resulted in a massive geopolitical blunder.
They do this to the accounts you use to communicate simultaneous with an attack on your reputation, i.e., when being able to to communicate suddenly becomes critical (for defending yourself against the allegations).
Apologies for my assumption you would fly there. And yes, I can also always mention worse examples, and those people probably can too. That's one of the cognitive dissonance reduction mechanisms that got us in so much trouble.
When the prediction is so bombastic as to prescribe a near future without doubt and be completely wrong then yes, that would be hysterics in my book.
A.P.Ershov: Aesthetics and the Human Factor in Programming (1972)
I was thinking if you were using this as a client for a server-based database. If not, SQLite could certainly be the right choice.
This is the entire point
No one loses sleep about root causes. Most people tend to only care about the symptoms that result from it.