skysight-inc/HackerNews huggingface dataset:
No need to apologise, it is a pretty logical thing to assume.

We have flown of course but more often we will drive as we usually break the journey up visiting friends and family in Barcelona and Valencia on the way.

It takes longer to drive obviously but it is a more relaxed journey than flying. Plus as we don't have any time restrictions such as with a hotel booking we can just take our time and if we decide to stay a few more days for whatever reason it doesn't require any changing of flights, etc. Also means we don't need to hire a car for our stay.
i have this problem with posts that puport to answer "how-do-i-do this" questions on Windows and other desktops:

me: how do i do X?

them: just click on "find" and then...

me: but where is "find"??? i have quite heavily modified desktop.

if these people posted a screenshot instead of describing the gui interaction in text, i could almost certainly work it out.
I appreciate that there is at least one other person on earth who shares my skepticism of many popular MFA implementations. A lot of them add more inconvenience than security. "We sent a code to your email" is particularly heinous.
Your hypothetical meat eaters are stuck at the side of the road where they ran out of petrol.
There isn't much difference between expulsion and putting them in an asylum, no?
I met a guy who succeeded with just vanilla JS (or whatever they call it now)

Even said there were almost no cross browser issues.
Wow! I'm impressed!

Have you actually gone down already the rabbit hole that is the history of computing and alternative approaches to what we have today?
99% of their users, even 99.99% might be programmers, but I was involved with a project where most of the contributors were lawyers. Most of them could only use the GitHub web interface ('edit file', not even the VS Code one) to make changes, so making it easier for them to use git push would be advantageous for everyone involved.
I was talking about first-party cookies.

Third-party cookies don’t have this ambiguity, they’re unequivocally bad.
I agree Laravel is a great framework. I use elixir Phoenix as well (similar philosophy). But that doesn't seem like a good model for a desktop app, especially when there are tools like electron where you could build a SPA. The whole route based model makes a lot of sense for web, but on a desktop?
Are you aware that iOS supports PWAs, and recently implemented notifications for them?
I definitely have a M2 Air with 32GB. The point stands, but you aren't limited to 16GB on the Air
fingerprint works, no? (e.g. “Built In Authenticators) everything else kind of silly if so
The idea with client certificates is that they'll live in a secure keychain and never leave it. The API exposed by whatever manages them will expose functions of the key (authenticate, encrypt) but not the key itself. If the implementation is decent, you'll authenticate every request, so it isn't possible for requests to be forged or credentials stolen unless you've got a vector to attack the OS's keychain.
In 2023 the classic understanding of what is right and what is left have changed. The left now seems to define itself as whatever the governing elite societal conventional wisdom seems to be of the moment (as long as the classically understood to be leftist political party is in power) and they see the right is whatever runs contrary to that agenda. Much of the worldviews that are now being branded as right, alt-right, or “right adjacent” is nowhere near the historical understanding of right leaning political views, but because they now run counter to CW, the proper 2023 insult is to brand those things as “right”.
Another vote for Carhartt shirts. I'm large and it's difficult to find shirts that fit well. Their shirts are cheap and last me years. Also if branding is an issue for you, it's very easy to remove the patch on their pocket t-shirts.
Unfortunately, what you link doesn't answer how they will prevent it being used to create walled gardens.

It's just an open question, and as such, it does seem it's an afterthought, when it should be front and center if anyone care for an open web.
Precisely this.

I'd argue that ALL wars are foundationally resource wars - in contrast to the limited scope of what most historians would point to as "resource conflicts" that are more acute conflicts.

Iran-Iraq is a perfect example of this

1. Proto-states of Iraq and Iran claimed monopoly access to the Shatt Al Arab [1] river starting 3000 years ago (the original resource conflict)

2. These proto-states eventually signed a treaty in 1937

3. Iran stopped abiding by the 1937 treaty in 1969 - because they wanted fewer constraints on their use of the resource

4. Iraq and Iran then agreed to the Treaty of Algiers in 1975

5. Iraq kicked off the first derivative conflict by invading Iran - because they wanted fewer constraints on their use of the resource - this time funded by the Kuwaitis

6. The second derivative conflict started when Iraq invaded Kuwait to cancel the debt it had with Kuwait leading to the....

7. Third derivative conflict called Desert Storm

The desire for greedy monopolization of resources to the exclusion of others - based on a fear of persistent and forever scarcity is the ACTUAL root problem. There's plenty of river to go around as was proven time again with treaties, but greedy avarice rules the day and the entirety of the Levant has handicapped itself with these repeated insane wars based on fake scarcity.

[1]https://en.wikipedia.org/wiki/Shatt_al-Arab
> Nobody gets to decide what's more or less sensitive

That's simply incorrect. Everyone gets to decide.
Out of an infinite number of possibilities that are encompassed by "we lack the data to answer the question", you picked lab leak as a strawman, which is very interesting.
Is the internal discourse aware of “cleanroom” or has that institutional memory disappeared?
They meant “linear.app”, not Jira, and “copy” instead of alternative.

There’s currency in this type of knock off. Find a well executed closed source app, clone as open source, pick an alternative pitch “the Jira killer”, then raise YC because open core is the fashionable argument.
You have a somewhat textbook view of the problem. That's okay, except it's wrong like most textbooks. At least in a practical sense.

The key mistake I think you made is here:

> I dont think i'm missing the point. if mortgage is a lot cheaper than renting, nobody would rent.

You're forgetting the people who own the capital. Yes, in theory, there's an arbitrage here. One that has been fully abused by landlords for the last decade or more. Here's the rules:

1. Possess enough assets, capital, or goodwill to get a loan

2. Buy the house below "rent-rate"

3. Rent the house above "rent-rate"

4. Get $XXX nearly risk free since people need a place to live

In this sense you could view the insane rise in house prices as the market becoming "arbitrage-free" to use the term as loosely as possible.

The problem is at step (1). The average citizen cannot capitalize on the opportunity. The average citizen scrapes together somewhere between 4% and 20% for the house and lives in it. That's a substantial amount of someone's savings. There's no arbitrage. The only thing that they get is some theoretical money back between the rent price and their mortgage. In a practical sense all the owner did was lock in a rent price. Most people cannot even capitalize on the interest rate arbitrage that is available because again, I emphasize, you need to live somewhere. To capitalize on it you need to sell your house and buy somewhere else cheaper (e.g. another state). I don't think it's hyperbolic to say this is extremely difficult and likely impossible for most people. Myself included.

You also didn't discuss the problem of housing being an investment at all. The fact my mortgage has gone up $100 (due to property tax) but the apartments I used to live in are now $1400 more expensive says there is legitimately exploitation of the market going on. In the stock market this kind of front-running is illegal. The current strategy is:

1. Buy up enough houses to drive market price up by suppressing supply

2. Keep supply low

3. Artificially increase rents to increase profit margins

In the stock market this is very illegal. In fact there are numerous cases of this occurring throughout history in the futures market and people have gone to prison for it. If we're unwilling to fix the problem perhaps the SEC has a few rules we can adopt. Still doesn't stop the problem of exploiting the lowest level of maslows hierarchy of needs. This is probably one of the places where the free market cannot address both concerns. There are no amount of first time buyers whose total capital could out-capitalize Blackrock and Vanguard. It's simply naivety to believe that average citizens are causing housing to become unaffordable.
Really hard to tell if this is sarcasm.
Yep. And it's often not solvable by just sending the email again: I've more than once found cases where an app's email provider is particularly slow and the tokens arrive late no matter how many times I send them.

Bonus points if each email has a new token and only the most recent one is valid, because then you're stuck trying to remember how many times you clicked the "email me" button. Is this the right token, or am I waiting for one more to come in?
They are demonstrating a fundamental flaw in the logical reasoning behind the original Drake equation, that is robust to specific choices of distributions, or parameters to include or exclude.

Anytime you multiply a large number of uncertain probability distributions, the resulting posterior will have most of the probability mass near zero. This result is not sensitive to which distribution or bounds you choose. The Drake equation is nonsense, because it is effectively assuming certainty about every single term- and that is the only way to produce a result much higher than zero.

When you are multiplying seven unknown together, you can be fairly certain that the result is close to zero without knowing the value of any of the terms, unless you have some real information that none of terms can be near zero.
A TOTP code must be marked as “used” immediately after processing it, so an attacker using a keylogger would have only a few seconds at most to use the code, assuming the user typed the code from the password manager instead of copy/paste.

The protection offered for TOTP in a password manager is from people who reuse the same password on multiple sites and some other site gets hacked. In that case, the attacker would not be able to login, regardless of having the password.

Also, once a system is so thoroughly compromised that the attacker can install a key logger or dump a password database, that system and all the user accounts are already completely compromised.

TOTP at this point is essentially a forced password that changes every 30 seconds instead of an actual additional factor, however in many cases that’s good enough.
What muscles does your treatment target? It's pretty surprising to me that it helps with headaches. I'm very curious, and very interested in getting rid of headaches of my own.
Indeed. I have converted my mother to 1Password and it’s working great for her once she got past the initial learning curve.
> Rather than allowing a user to set their own password, passwords can be issued in exactly the same way as API keys are now: a high-entropy password is randomly generated by the issuing website, and the user is shown the password once only and asked to record it. If the password is lost, a new password must be generated using the same process.

I don’t understand that logic. Normally, systems generate API keys and show them to a person _knowing_who_that_person_is_.

I, when I lose my password, the system can generate a new one for me even when I’m not logged in, how can it know it’s doing that for me and not for someone claiming to be me?
In the keylogger case, it still makes the attack more complicated -- they need to steal your login before that code expires, so rather than passive password-harvesting it has to be an immediate attack.
A complex way to do a spreadsheet
I'm a mobile dev, so I have both an iPhone 13 Pro Max that I rarely use, and a Pixel 6 Pro that runs GrapheneOS, which is what I prefer. Diffr't strokes.
An “Earthscraper” InterContinental Hotel Built in an Abandoned Quarry
> That's just a fact.

No,

> That's, like, just your opinion man ;)
It's not completely unreasonable point. I do see it's a very different type of work compared to mine. But I learned that life is not about doing something you love, but learning to love what you do. So I'm game to try something new.
I’d argue housing should be first in that list, since it represents almost 50-70% of a poor persons gross income. Food is critical of course, but beans and rice with occasional road kill are cheap and can sustain someone nutritionally.
Yes, I am confident that we have avoided that specific pitfall because as I mentioned we do not ever re-serialize the JSON.

However, thinking on it more, there is one thing Groxx mentioned that has given me pause, and that is "Numbers don't have a specified precision". This could be an issue in the future if, for example, computers suddenly use 128-bit numbers and JSON implementations start to actually use such numbers. It's an edge case that might result in incompatibility with clients that use 64-bit numbers. So we'll consider the possibility of changing the serialization format after researching this more.
By “bunch” you mean the entire SRE org. I felt like it was a good setup, but I also felt that the long-term strategy of reducing the access necessary to operate the infrastructure was a good one. But why not both, as the child in the meme asks?
While you can't memorize it (memorizing a fair amount of entropy would take an intelligent human quite some time), you can of course store them offline (it's just a key). Today's initial implementation on macOS restricts exporting, but that is supposed to be added according to reliable Apple devs: https://hachyderm.io/@rmondello/110329118270492669
Might as well use client certificates at that point. Along with TFA, if we don't have users choose passwords, then just issue a client cert and have it installed in the browser, would probably require some new web standard.
Sure, you could even reduce phishing attack success rates to nearly 0% by having users authenticate with a sample of their DNA.

Does that mean it's a great idea?

What about losing the yubikey?

In any case it's a different matter when it comes to high stake scenarios, in which case I don't mind something slightly more sophisticated.

But not as the default for everything.
*[2022]
(Author here:) I strongly agree! It should not require an understanding of the kernel's execution logic to be able to understand the limitations of shebangs. I think this is stupid design and I perhaps should've highlighted it even more as such.

A couple years ago someone attempted a patch to the kernel that would at least fail loudly in the case of oversized shebangs. This ended up causing problems for NixOS which, being Nix, already was using oversized shebangs with lots of long nix-store paths. They were previously being silently truncated but still working, and suddenly all those scripts failing caused a lapse in backwards compatibility! So the patch had to be undone and we haven't gotten anything similar since.

See https://lwn.net/Articles/779997/ for more info.
I really don't like the part of me which eagerly leaps at confirmation bias. It doesn't help me, it doesn't help my "allies", it doesn't help the world.
> He has a notebook of passwords, that's how he works and he won't change.

A notebook in a locked safe is the most secure datastore for 90 - 98% of the population - depending of how deeply you distrust NSA.
How was it misleading? By his own admission he didn’t take the vaccine.

Do you agree it is fishy that a for profit Pharma company would choose to forego a market of 1.38 billion customers simply because they would have been required to do local clinical trials? I find that troubling. Why don’t you?
I use two services that do the same, so it is not completely uncommon. Both services don't require frequent login, though. One service is a DNS provider and the other a learning platform where the primary way of interaction doesn't require a login at their platform.
I like Debian's ML policy about this:

https://salsa.debian.org/deeplearning-team/ml-policy/
If you are going to build a team you will probably select for people you know and trust first, so choosing from people in your network is a natural way of doing this. This is literally called 'networking'. If it isn't a startup this can become a problem as the hiring process should be more open for everyone otherwise you won't be able to get a job anywhere without knowing someone from there first.
Eh from their perspective google services are in prod, not on the internet.
I am interpreting it as an n-dimensional graph (let's say 2D for simplicity), and the axes may be something like "speed" and "scale", or "cost" and "risk", or whatever your parameters happen to be. The solution is somewhere in the space defined by those axes, but you don't know where it is yet, and you don't want to lock yourself in to a single point too early. The axes themselves could be anything. You are choosing what to care about. Ideally, it should be informed by understanding your users, your stakeholders, your domain, your market, resources, available technology, divine inspiration, etc., but it's an important decision that is probably completely contextual and is part of the design process.

I could be wrong, this is, as noted, just an interpretation.
I've switched between academia and industry several times in my career (which some academic friends of mine claimed was not possible).

Professorial hiring committees are often silly since they demand outrageous things yet the
pay is laughable. Since I have a lot of hiring experience as a research director in industry, I saw a lot of talent that I would try to grab, but that academic colleagues did not consider a good enough match due to the limited fit with the desired profile, even if that meant re-advertising and wasting another year.

While what you say about hiring committees is true, I would still not recommend to talented scientists to let all that deter them. If you have the passion for science, give it everything - so that you can say on your deathbed, "at least I tried"; any other life choice probably won't let you go in peace (who wants to
think "what if...?").
As someone who typically rejects/hard-passes on products with the SSO tax (sometimes even when there’s budget/will to go with the SSO-included tier), I really appreciate the lack of the SSO tax here.

The era for security and in particular identity and auth management to be pay-to-play is long over and I appreciate when projects and businesses are honest about that.
Yeah, there was a lot of work on logic in both India and the West in the medieval period, which was very influential in later thought, its just that what we conceive of as the "modern" form of logic only took shape in the 19th century. But reading medieval tracts on logic is fascinating.
> What you're looking for is client certificates.

I agree with this, but...

> users are too stupid to use them

they are. Key management is not trivial.
Hmm. Photo to SVG to FontForge. What am I missing?
- Corporate firewalls don’t like people visiting .so Somalia URLs. Wouldn’t have this problem with .com. We had to fight hard for domain reputation.

- Back in the day communication between us, our registrar, a middleman registrar in Germany, and SomaliNIC wasn’t too good. We weren’t notified of a takedown report and got DNS blocked by a bunch of ISPs offline for 8 hours. Even figuring out what happened on that one was baffling.
But then there are apps like Discord which log you out of the app if you don't use it for X days.
What I learned is CP/M, the first versions of MS DOS, including this MSX-DOS, did not have directories. Just a flat list of files. Weird.
It puts the resulting file into /usr/local/bin. You can run it without sudo if you already can write there for some reason.

Or, define $DESTDIR if I'm reading the makefile correctly.
> I never had code where I was like, oh this has too many comments.

It happens. Even worse is when the code has been updated but the comments have not. I've picked up the habit of double checking comments with git blame.
It varies per person, but for me, surprisingly, muscles in the occiput, temples, and around the trapezius. It was amazing for me to realize that tension in my shoulders, back, and neck could contribute to headaches, but it really is all interconnected.
There is one incorrect statemement that really bothered me

TOTP and passwords are not the 'similar' because TOTP is a secret generated from the 'key' and is only valid for a short time period

this make usage of that secret vastly more challenging for attackers, especially at scale.

I've seen real attacks where passwords are stolen, it is impossible to keep track of that. However for TOTP since the attacker has to login NOW, you can very easily detect anomalies of a new IP addr with many successful logins for different accounts

Or to put it differently, when you capture a password it is always valid credential but for TOTP, it requires more advanced infrastructure(automatic logins, save tokens)

and even then the token will eventually expire, with password you can generate infinite tokens
I see your point - I suppose it was quite snarky. My take is (and I suspect the same as the people who upvoted my comment) that the comment was disregarding another persons feature request/preferences based because the did not match his/her own. It is an, in my experience, attitude not uncommon - and it (unfortunately) gets my blood boiling every time.
Humans have 85-100B neurons in the brain and another many more in the spine and other CNS bits.
> Always talk about a second application. For each abstraction, the “app” is the layer above it. For example, a filesystem is an app for a block device; TCP is an app for IP. You should be able to describe the functionality of a layer without ever referring to the specifics of the app (e.g., you don’t need to know what a file is when talking about an SSD’s internals).

This is so true. It’s very common to see infrastructure being built in terms of the application that will run on it instead of designing the application to run on the infrastructure. A lot of brittle, unmodifiable messes are the result of this.
Or like a convenience whipped cream dispenser. Quantity and geometry certainly makes one more volatile than the other, but the number alone isn't all that far out.
This is only true if you’re very selective about which threats you want to acknowledge.

If someone breaks into my house I’d rather they just got my TV and some belongings rather than my life savings.
I don't think you give the right weight to BORING,that's the issue here.

I have 2 hours of gaming per day during the week if I don't have anything else to do, which is rare, so it translates more to 2 hours once every 5 days (weekend is ad-hoc).

10 minutes is roughly 8% of that time, so if the game doesn't hook within 30 minutes (that can be with a nice intro, with a FUN tutorial, or throwing me into the gameplay) it gets dropped unless I have a strong referral from a friend.

That being said, most videogames I play have skippable tutorials. Not sure if that's a new problem specific to AAA, i rarely play those (although returnal on pc was very recent)
AWS NAT Gateway pricing is so outrageous that smart people came up with a peculiar hybrid:

https://www.lastweekinaws.com/blog/an-alternat-future-we-now...

I wouldn't use it in production (some companies do, for internal things) but the very fact it exists speaks volumes.