skysight-inc/HackerNews huggingface dataset:
It's worth noting that many services that offer longer session length also have tools for managing those open sessions and alert emails that geolocate IP addresses using those sessions. I'm sure the big boys do all kinds of statistical (AI if talking to marketing) analysis on session usage metadata (current IP, browser fingerprints, time of day) to try to determine if a session token/cookie has been compromised.

All that is a lot of extra effort and UI work for a web application that doesn't have the same immediate access expectations as a web email client or social media. Besides, many users use a password manager that autofills, so login isn't that painful as long as the 2FA persistent setting is respected.
I hadn't heard the Irish Republican Army had started an incubator.
Geohot vs. Yudkowsky AI Safety Debate [video]
Often it’s because your JWT hasn’t expired, your IP matches previous, and so you’re authentic. Local storage is local storage whether it’s electron or browser.

If your JWT was close to expiry and your IP address is different and your user agent or headers are different then it may force to re-authenticate.
Browsers need to provide a way for sites to query if the device has a pass code or not. The lost device threat is a top reason for short session cookies.
Touché. If you wouldn't mind sharing where you're from and what you consider a good example of satire in your region I will take my own advice :-)
Why GNU su does not support the `wheel' group (2002)
NIST dropped the password change recommendation a while back [1] but it still lingers on. The staying power and long tail of this deprecated advice is unfortunate, to say the least.

I don't personally agree that short sessions is bad advice, but Phil Venables has an article that you might enjoy, "Ceremonial Security and Cargo Cults" [2]

[1] https://pages.nist.gov/800-63-FAQ/#q-b05

[2] https://www.philvenables.com/post/ceremonial-security-and-ca...
> I have no idea why you'd want a typed environment variable setup.

Because you want to know what type your variables are?

Of course, in this case you do know, they're strings.
Interesting, didn't know about single-method-interfaces.

There are lots of singletons in OO. I find it useful to add static metadata (not state) to them, without having to escalate them to a class. I guess Java has decorators for the same purpose. I'd really like decorators for functions in TypeScript though.
I think you're interpreting this wrong. What line in this policy prohibits the DoD but doesn't prohibit all other militaries?
In my case with Intel hardware, how I make 100% sure that it's activated is using a program called intel-gpu-tools, with it if you run intel_gpu_top as root you'll get the video acceleration stats shown to you. Pretty sure Nvidia has something similar but am not sure about AMD.
Lost Disney UFO Documentary: Alien Encounters from New Tomorrowland(1995)[video]
> Are shared computers without user separation a thing? If so, these shouldn’t be used to access web applications with sensitive information at all

Shared computers at the library are still the only way some people can access the internet. For others it's the only way they can navigate sites that aren't mobile friendly (gov't sites, etc)
They also expire cookies in Safari like clockwork, forcing you to login again to almost everything.

Very annoying. Supposedly it prevents tracking, but it's just annoying.
The author writes “I've also since learned that the way Japanese developers write Ruby is very different from the Ruby you'll typically see in Rails, or many other popular Ruby gems.”

What would be some examples of “Japanese-style Ruby”? I can find some articles comparing Ruby to Japanese but I’d be interested in full code repositories that would fit this description to go and take a look. I can’t think of good search terms for that.
Usually on family road trips you don't get to decide when you're going to stop for a bio break. So with an EV you end up stopping twice (or more). With an ICE there is usually a gas station at the first stop.
There’s nothing stopping Meta from selling their models to the DOD, but if they do, we will never hear about it.
I partied for 5 years and got a masters and that cost me around $20k in loans (Of which zero was tuition, it was basically mostly the rent, books, food, and drinks).

If given the choice I'd do it again of course. Even if what I ended up doing had nothing to do with what I studied I'd do it again. Even if you told me that if had started a developer job at 18 I'd now be making twice what I'm doing today at age 45, still do it.
> at the very most, 8x faster.

My 64 core server setup says otherwise.

> Is it really worth it?

Yes, very much so.

> If this makes it even slightly more difficult to develop Python for normal people

It won't. Pure python code will very likely not notice a difference.
Our whole frontend is built in elmish which is different from Native, but it can tie directly into FuncUI (Avalonia) from the elmish interface.
> 1: A short compromised session is still a compromised session. The duration usually does not prevent the attacker from achieving their goal.

Need a citation on that “usually” part. A short session duration most definitely:

* Makes it less likely that when an attacker obtains a session token that is is unexpired.

* Gives the attacker less time to use a valid session token to move laterally into (potentially) unfamiliar infrastructure.

The trade-offs, of course, are:

* Poorer UX, and potentially driving users to attempt to bypass approved tools and/or security controls

* More interactions with the authentication system, which, depending on the auth system and the attackers motivation/capabilities might actually let them harvest more credentials.

But, in any case, I’m not aware of any research that short session tokens don’t thwart attackers use of those tokens, and the idea is, to put it mildy, counterintuitive.
The need to train/tune a model, in this case LLMs, is assumed to rely on the requirement for grounding and running on the edge or offline. This need will vary by use case.

With log file analysis as an example, training a model may increase the model's ability to deal with outliers, through writing regex which is placed in the indexing pipeline. In this use, tuning a prompt isn't going to help much, given the foundation model might have no idea how to parse a given field in a log line no matter how you put it to it in the prompt.

Tuning models also serves other purposes, such as removing guardrails introduced in the training data by others, and customizing the self referenced material the model "knows" about, such as its name, creators and the "personality" presented to the end user.
I’m using snippets all the time, e.g. there are snippets for express app, telegraf bot, Intl stuff, frontend boilerplates, etc etc. I could map or abbr these and map placeholder jumps, but that quickly becomes unmaintainable and typo-prone. Snippets are great in that you can just paste existing code and parametrize it, then update when needed.

Also I dislike the fact that you have to actively prevent these expansions instead of actively triggering them.
15-20 days that usually included sick days, and with high levels of pressure NOT to take any of them.

plus this is HN, so "every company I've ever worked for" is almost certainly a white collar STEM gig -- which ain't 90% of the country.
It is similar to when the roman empire collapsed here in the UK - why didn't the local people just live in the houses the roman left?

Well they couldn't afford to run them for a start, and the businesses and trade that had made the areas profitable, disappeared too.

I imagine for these houses that the double edge of location and risk will keep most people away. Would you move in if you didn't know if your neighbours were about to be all cows or a new factory? And what about if the nearest road ended 3 miles away?
I don't understand this or see any data for it. My house going up in monetary value doesn't help my retirement. Owning a place to live does.
FYI there's others that use and talk about the Asus ROG flow z13 acronym on https://www.reddit.com/r/flowz13/

It's too weird for me, and yet I keep considering it as it's one of the only tablet PCs currently out with 32GB ram and can run Linux without too many headaches.
>>> Is this the side effect of Gmail's dormant account deletion rolled out last week?

IIRC, they haven't started to actually close the accounts just yet, so I doubt it's related.
The proper way to handle the problem is to tie session IDs to more than just a cookie or other fixed value; so that if they get exfiltrated they cannot be used without reauthenticating.

For example, the Session ID becomes "IP address + session token + browser ID" or something, then if I get your token, and even if I can mimic your browser fingerprint, I'd still have to be coming from your IP.
Based on what exactly? The linked article prohibits activities, not entities. Unless the CCP doesn’t use it for spying and military uses and the DoD wants to, this makes no sense.
Where does anyone live that they even see their neighbors to greet? Not here in the suburbs.
This looks really cool.

In the past I used lanterna (https://github.com/mabe02/lanterna/tree/master) to develop a text UI for a critical process at the trading firm I worked at. It was essentially a process that would take updated market data and handle things that changed between the last trading session and today - like symbol renames (PCLN to BKNG), changes to market cap that make it change what "category" it fell into (they were based on market cap and volatility measures etc). Things of that nature, that the realtime system didn't handle but happened too often or were too hairy for us to just handle manually.

The system had a desktop UI component that was oriented towards use by our trading staff. We didn't really have notion of a "server UI" and the server was headless.

Nobody at our firm was a frontend developer, just backend, systems and data programmers who occasionally dabbled in frontend. So web UIs were very simplistic or highly specific to their use-case, we had no shared tooling.

In 2023 with things like create-react-app and whatever next.js does, I probably would've opted for one of those. I could've made another desktop app but I wanted to be able to easily get to this from a shitty ssh connection over tethered 4g when I was on-call. So X11 forwarding and RDP were out. So i looked around for a TUI-builder in the project's language, Java.

What i really liked about Lanterna was that it had a Swing-based implementation which meant I could easily run it from IntelliJ, and that would let me iterate rapidly, and then in production I could run it in a terminal via SSH directly on the machine the server was on (which had certain advantages).

I'll keep an eye on this to see if I can think of anything neat to build on it. I still generally don't like web apps because they feel like they take a lot of effort to get something compared to a functionally-equivalent product built in something non-browser-based like a TUI or desktop GUI.
> Every time I see an article about a new place where microplastics have been found (blood, brains, babies), I feel like this is a battle we already lost before we even knew it was a battle.

Now imagine all the other battles we started or lost already and aren't aware of at all
What is a furry, and why did that man have a fox tail?
The difference between micro and nano is that nano's keyboard shortcuts are pretty opinionated, while micro's are the ones used by most (GUI) applications nowadays: Ctrl+S for saving, Ctrl+F for find, Ctrl+Z for undo, Ctrl+Q to exit etc. etc. There is also a helpful hint at the bottom of the screen that you can press Alt+G to see the shortcuts, or Ctrl+G for some help.
Both Google and Microsoft have world-class security teams. But Google is run in a more effective way (so fewer instances of the right hand not knowing what the left is doing) and has less legacy to lug around, it also suffers less from the innovators dilemma (for now, at least).

It makes a big difference if your stuff has been designed as a web based service from day #1 or if you are required to talk to anything and everything on prem and off prem as well as in the cloud. The attack surface of a typical Microsoft enterprise product is absolutely gigantic and the fact that they do as well as they do is something to be appreciative of. That said I don't want their stuff anywhere near my company.
> So... going back to the point: If expiring sessions is terrible UX (and it is) and it's not stopping attackers (and it's not), why are you doing it?

Everytime I get into this kind of discussion, the answer seems to be "because it makes me feel better". Which is why it's so impossible to actually change someones mind about it and thus we have security "experts" (or worse, non-technical managers) making life miserable for thousands of users.
Exception based error handling is so bad and unsafe that adopting functional error handling with Either, Try etc as implemented by functional addon libraries for many languages, while not yet common, in time it will become the new default even in OO languages. (just like it's been the default in functional languages for decades)

Functional error handling types are much simpler, safer and more powerful.

Simpler because they don't rely on dedicated syntax- they're just regular objects no different to any other object.

Safer because unlike exceptions, they force callers to handle all potential outcomes, but no more. (no risk of ignoring errors and no risk of catching a higher level of error than desired, ubiquitous bugs in exception based error handling)

Powerful because they support map, flatmap, applicative etc, making it easy to eg chain multiple computations together in desired ways, which is unwieldy and bug prone when using exceptions.

> What is wrong about dedicated syntax

It adds complexity to the language! It could be that, when learning Java, Kotlin and any other language, we learn that methods return what they say they do... and that's that. No weird dedicated syntax and magic, special treatment for returning anything other than the happy path, and the HUGE complexity that comes with it, eg the dedicated syntax itself and how it behaves, differences between checked and unchecked exceptions, hierarchies of exceptions etc etc.

> Exceptions are easier

But that's the point, they're not.

Exceptions based error handling is unnecessary, hugely complex, doesn't compose at all, obfuscates or straight up hides what can go wrong with any given call, so leads to countless trivially preventable bugs... I could go on. And after decades of use, there's still no consensus about what exceptions should be or how they should be used. Exceptions are a failed experiment and I have no doubt that in ten years, Java, Kotlin and many other languages will acknowledge as much and move away from it the same way Joda Time outcompeted and replaced the horrible Java date and time library.
Ha, I thought the same thing.
I was referring to rolling coal [1]

[1] https://en.m.wikipedia.org/wiki/Rolling_coal
Agile detractors like myself may find this amusing : "agile doesn’t fit in the context of this particular project, because the client changes priorities very frequently."
One difference is that Slack would not work if it logged out automatically after 15 minutes of inactivity. They would lose most of their customers. The only realistic risk to the user from Slack's point of view is that when the user walks away without locking the computer, someone might read or write Slack messages.

Sensitive applications still lock after X minutes of inactivity even on desktop, because the impact of someone else using your computer carries too much risk. One example of this is password managers, where they sometimes require a password or a biometric to unlock after a short period of inactivity.

You'll see the same pattern in web applications. I haven't used the web version of Slack in a while, but I remember that it didn't force me to login that often.

I think one of the reasons why many choose to have a short session expiration time is that they either can't or don't dare to do a proper risk assessment and just does what their competition seems to do.

There may be technical reasons too. Web applications do have a higher risk of accidentally leaking passwords through low security and hostile actors. Reducing the TTL may not fix the issue, but it will at least reduce the window where an attacker can make use of a stolen token. It may not matter much if you have a dedicated attacker, but it at least adds some resistance.

Creating a secure application takes time (acceptance from business) and experience (junior developers) and many don't have either.
I wholeheartedly encourage others to have a browse around the author's other stuff, here's one I loved:

http://dpk.io/moderncomputers

Here's an index of articles:

http://dpk.io/articles
It listed sources for all statements, but not for the link between them which it either got from an unlisted source or is something it came up with on its own.
It's also a great example because the public perception is heavily biased. If you look at the statistics, the vast majority of trains come on time. And have working AC. And are actually quite pleasant to travel with. It's fantastic how much train connectivity exists in Germany.

But a few cases of delayed or canceled trains, pushed in the media since it's easy to beat that horse, thankfully picked up by opposition-party-of-the-day (often those that were in government just a few years prior), and everybody talks as if no train is ever on time. And you can expect that car industry lobbies like that development too, without starting conspiracy theories here. (Tbh, if I was PR responsible for a car company, that's where I'd direct some funds..)
Show HN: Autonomy – free book about future alternatives(auto-translate needed)
It's probably valid JCL. :-)
The type system is fun right up until you are using it to its full ability in generics..then you look at the 5 lines of 'type logic' you spent the last day debugging and ask yourself how you got here.
In the UK, giving birth tends not to be determined by vote. (Compared to e.g. the US, where "forced birthers" have voted for such legislation)
Short sessions are obscurity...not security. If you use a serious website like Fidelity's, they don't let you do anything impactful without an authentication challenge. You could have logged in a few seconds ago...want to tinker with bank accounts? Challenge.
It sounds like you could benefit from having your own dedicated IP pool in SES.

https://docs.aws.amazon.com/ses/latest/dg/dedicated-ip.html
Adansonia Grandidieri
Ask HN: EU-based cloud providers that offer managed databases?
What are your go-to cloud hosting providers in the EU that offer managed database (PostgreSQL or MSSQL) instances?
This is pure PR. Don't be fooled
SDKs for AI Agents
Hah! this was cool to discover.
Yes, because as a populated city it’s very young: it virtually didn’t exist in the 19th century while London was the most populated city of the whole world at the time. Even in the 1930s London had 300x the population of Riyadh. You have to wait until the 1980s to see Riyadh have more than 1M inhabitants.
Show HN: Practice coding interviews with tips and solution analysis with GPT
Original Study (with pretty charts!): https://news.gallup.com/poll/509543/saying-hello-linked-high...

Interesting, "No meaningful increase in wellbeing is seen for additional neighbors greeted beyond six."
There is no protection against the use and disclosure of deidentified health information as regulated by PHIPA or the IPC of Ontario. The IPC has clarified through guidance that deid data is not protected however the act of deid constitutes “use” and therefore must be through an approved means. These scenarios are approved exceptions to patient consent for use.

Some institutions and systems have internal policies that add exceed PHIPA. For example ConnectingOntario which is the closest thing to a provincial EMR only allows access for direct patient care (i.e. not even REB approved research). Some academic hospitals also add approval requirements for the disclosure of deid data to other institutions or on credentialed access repositories.

I started my medical career in Ontario and this is done all the time for things like publishing case reports, online (or non-institutional) lectures and case banks (e.g. on the publicly accessible Radiopaedia).

Not sure what you mean by whistleblowing, this is completely legal in both Ontario and the US and in my opinion entirely ethical (for the most part).

I’m not saying it’s a good idea or ethical to use these exceptions to consent for posting marketing materials on TikTok. The CPSO which regulates physicians may still find the action unprofessional/unethical for reasons not related to violating the law, but their standard is different (“behavior unbecoming of the profession” and “behavior that degrades patient trust in the practice of physicians”).

On a side note I think I’m getting old but what does “ETA” mean (other than estimated time to arrival)?
Well I notice that alias from the propolis repo :).

Thanks for the heads up. Will probably ditch this effort.

Really want to play around with some of the oxide stuffs but it’s hard with illumos not supporting nested virt.
The `value={state}` / `onchange={evt => setState(evt.target.value)}` dance you do instead also fits the "programming with attributes" paradigm, which was my point.
One of the authors here. Disclaimer: Massdriver, YC W22

First, this is Dave & I's personally opinion, not the view of OpenTF.

This isn't an attack on Hashi's founders. We don't know them, we've just watched a ton of videos over the past few days trying to understand them.

This is three things:

1. an uncomfortable feeling for my co-founders & I, realizing that the even the most passionate founders' image will eventually fade from a for-profit company

2. that we, as a community, may be at a point that we have to seriously look at any open source tool we use at work that is not a part of a foundation

3. calling out some of hashi's bullshit about their commitment, their change has far reaching impacts on the broader open-source community.
I’m not the parent, but exception declarations are IMO necessary for a stable API contract. It’s exactly the same reason why return types are explicit. The actual issue in Java is that you can’t abstract over an arbitrary-length list (sum) of checked-exception types (variadic type parameters) (with the exception of rethrowing from multi-catch clauses).
> As part of the Gallup National Health and Well-Being Index, saying hello to more than 1 neighbor was shown to correlate with greater self-perception of well-being.

So this wasn't a study. As far as I can tell, the results can just as easily be summarized as "people who report higher well-being are more likely to greet neighbours."

This is probably just the article to blame, the quotes they pick use words like "correlation."

I find the five vs. six distinction rather interesting though. What's up with that?

> Averaged across five dimensions that included career, communal, physical, financial, and social well-being, the increase which greeting a neighbor had led to around a 2-point increase on a scale of 0-100 up until the sixth neighbor, at which point further greetings had no measured impact.
Perhaps because people realized that the pixel inflation is at some point counterproductive. If you can't distinguish pixels, what difference does it make?