skysight-inc/HackerNews huggingface dataset:
Google Authenticator was I believe the first available TOTP app, and is by far the most popular. It used to be open source and have no connection to your Google account. Many people installed it years ago when they first set up MFA, and have just been adding stuff to it ever since because it's easy and it works. Even for technical users who understand how TOTP works, there is no obvious reason it appears unsafe to put all your tokens in the app (until you read this article).

Look at the MFA help page for any website you use. One of the first sentences is probably something like "First you'll need to install a TOTP app on your phone, such as Google Authenticator or Authy..."

It really did used to be the best option. For example, see this comment from 10 years ago when Authy first launched:

> The Google Authenticator app is great. I recently got (TOTP) 2-factor auth for an IRC bot going with Google Authenticator; took about 5 minutes to code it up and set it up. It doesn't use any sort of 3rd party service, just the application running locally on my phone. TOTP/HOTP is dead simple and, with the open source Google Authenticator app, great for the end user.

- https://news.ycombinator.com/item?id=6137051
Why pay if the free version does the job?
It's a pretty strong message that the effect has not been proven. I was personally under the opposite assumption, having seen reporting on some of the earlier research.
Is any of these full PC emulators usable as a library? I've been looking at a few of them lately (DOSBox, Qemu, others) and I have the impression that their UI is tightly coupled with the emulation part :(
Llama LORAs are very customizable, and range from "almost full finetuning" to "barely taking more VRAM than GPTQ inference"
The other thing folks haven't mentioned is that things like the esp32 have support from thr Arduino IDE and a bunch of other software stacks that make it way easier, and significantly lower the barrier of entry to use these things for non-professionals.

Professionals choose chips/modules based on an entirely different set of needs/requirements and wouldn't use this module for say, a new embedded product.

It's cool, but kind of sits between 2 niches....
Are the claims of deepfake and intimate knowledge of procedures based of the sole testimony of the employee who oopsed terribly? This is a novelisation of an events

Retool needs to revise the basic security posture. There is no point in complicated technology if the warden just gives the key away.
Nothing fundamentally stops a postgres implementation being equally performant as something like Qdrant.

Fundamentally, an index’s performance is based on the hardware and the algorithm and the quality of implementation. Any optimizations Qdrant can make, we can also make.

We will be benchmarking ourselves against all of the other standalone database options as well and we’ll be working to try and outperform them. Excited to share those once we have them.

We are curious – what are you most concerned about? SELECT time? INDEX size? Latency? Throughput?
Not a Supabase user, but to my knowledge -- no. Except for a set of blessed extentions, Supabase only supports extensions that are written in "trusted languages" (ie. supported by pg_tle), and Lantern is written in C, which is currently not supported.
One possibility would be to just call the employee and record their voice. One could pretend to be a headhunter.
> Very sophisticated attack, I would bet most people would fall for this.

No. If you think people at your company would fall for this, then IMO you have bad security training. The simple mantra of "Hang up, lookup, call back" (https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...) would have prevented this.

Literally like 99% of social engineering attacks would be prevented this way. Seriously, make a little "hang up, look up, call back" jingle for your company. Test it frequently with phishing tests. It is possible in my opinion to make this an ingrained part of your corporate culture.

Agree that things like security keys should be in use (and given Retool's business I'm pretty shocked that they weren't), but there are other places that the "hang up, look up, call back" mantra is important, e.g. in other cases where finance people have been tricked into sending wires to fraudsters.
If a game must be “playable” before it’s ready, they’ll implement a degraded mode that isn’t as immersive or fun. WoW did this but only because downloading updates takes so long.
I see more and more complaints about bugs, anyway. I use it all day every day without issues, though. Not sure what to make of that. It’s not that I don’t believe those who are affected. I’m just not sure one can conclude that it’s getting more buggy with each release. Maybe the number of unusual use cases increases with popularity?
You could still bankrupt someone then by reinstalling a vm & game, depending on how they identify a device
And Putin is actually peace-loving — he'd love to grab land peacefully, without any resistance! It's just bad Ukraine who doesn't get that...
> with guilt on both sides.

That is kind of crazy if you take into consideration that one side invaded the other.
Sophisticated enough that I’d just suspect the employee unless there was additional proof.
This is misleading for several reasons. The FCC defines broadband as 25/3 mbit up/down, which is not fast. Also it doesn't take into account latency which is a major problem with geostationary satellites. So plenty of those 40 million with "broadband" are going to want to switch to better service anyway.

Your first article concedes as much:

> Even though rural areas are more wired today than in the past, current infrastructure does not support consistently dependable broadband access in many rural areas. This lack of reliable high-speed internet access has come to the forefront of discussions about navigating remote work and school during the coronavirus pandemic.

Your second link states that there are 1.7 million satellite internet subscribers in the US. But Starlink already has that many subscribers, so it is clear that the market size is much more than just existing satellite users.
well ok, you could say it's a lossy format for capturing physical movement, which it certainly is. My point is that it is not a format for capturing music any more than a score on a page is a format for capturing music. Both are instructions for a performer of music (one machine, one human), which is a very different beast.
If you have a pond with 1000 fishes, and each year the population of fish doubles, you can remove 501 fishes/year for quite a while. You are clearly in an unsustainable situation, yet it will take time for the population to completely collapse. These limits are in the sense that we cannot stay above forever, not in the we cannot go above ever sense.
Hey, try heating up that ruby! It'll turn darker as the bandgap moves toward the IR.
You can shift your dip with a hair drier.

It should move from ~1.15eV at room temp 75F/25C to ~1.10eV at 120F/50C, which should be about 35nm longer.
Sophisticated... ok

I mean it's a great reason to use U2F / Webauthn second factor that cannot be entered into a dodgy site

https://rakkhi.substack.com/p/how-to-make-phishing-impossibl...
We’ve done it! wavtool.com
Eh, yeah. Once had a service provider promise their new API would “easily” handle our needs (I still remember the tone the sales rep used every time he said easily; it so reliably came out sounding the same every time, it seemed practiced).

3 months of integration dev later, we start load testing, the external API fails spectacularly. They tell us to redesign to use their old batch API 35 days before our deadline. We tried, failed, ate shit with our customers. Provider was too big to pick a fight with. Startup failed.

Welcome to software engineering.
> Can't name one art model you could run on your GPU from a FAANG or OpenAI before SD

Google published dozens to promote Tensorflow:

https://experiments.withgoogle.com/font-map https://experiments.withgoogle.com/sketch-rnn-demo https://experiments.withgoogle.com/curator-table https://experiments.withgoogle.com/nsynth-super https://experiments.withgoogle.com/t-sne-map

The list goes on. Many are source-available with weights too.

> can't name one LLM with public access before ChatGPT, much less weights available till LLaMA 1.

Do any of these ring a bell?

- DistilBERT/MobileBERT/DeBERTa/RoBERTa/ALBERT

- FNet

- GPT2/GPT-Neo/GPT-J

- Marian

- MBart

- M2m100

- NLLB

- Electra

- T5/LongT5/T5-flan

- XLNet

- Reformer

- ProphetNet

- Pegasus

That's not comprehensive but may be enough to jog your memory.
https://archive.ph/YCaAz
Not all websites offer them.

Hell, no bank I use (several large and several regional) support generic totp. Some have sms, one has Symantec VIP, proprietary and not redundant.

Edit: since I'm posting too fast according to HN, even though I haven't posted in an hour, I'll say it here. Symantec is totp but You cannot back up your secrets and you cannot have backup codes.
There’s a lot of ways to get clips of recordings of someone’s voice. You can get that if they ever spoke at a conference or on a video. Numerous other ways I won’t list here.
This is mostly based on my experience in the past with Lua circa 2015 when I developed a GUI using Crank Storyboard Engine and needed to write some stuff in C because the Lua equivalent code was too CPU-intensive.

If I remember correctly, Lua is a stack-based VM. What this means is that every piece of data has a corresponding location on a stack data structure in-memory. Function arguments are pushed into the stack as-needed and popped in the function context, and vice-versa for the function return values.

If you wanted arity-checking in this context, you'd have to confirm that you got exactly the right number of elements on the stack, meaning there would be an extra branch in every function call. This might reduce performance if the branch predictor gets it wrong. Plus there would need to be extra instructions to count and to check the count for each pop off the stack in the context of the function call.

This is from the perspective of calling C functions in Lua, so it's probably more complicated for the VM itself when it's running native Lua code.
If you can't show that a specific breathing exercise is somehow better than an essentially random breathing exercise, then it doesn't matter what kind of breathing exercises you do.

If you can't show that a breathing exercise is better than e.g. same time spent on stretching, then there's not much point in doing (separate) breathing exercises at all.
Probably wasn't a "deepfake" just someone decent with impressions and a $99 mixer. After compression this will be more than good enough to fool just about anyone. No deepfake is needed. Just call the person once and record a 30 second phone call. Tell them you are delivering some package and need them to confirm their address.
I’m always extremely suspicious of “we care about climate charge” arguments that always argue for exactly what the group has always wanted to do.
Tesla has invested over $1B in their global fast dc charging network. Taxpayers are contributing to accelerate the electrification of light vehicle transportation due to the climate change crisis. Public private partnerships are very common.

The network is successful because they are the benevolent dictator who built and maintain it, and it has rigorous uptime and availability, versus other networks. This soothes range anxiety of buyers, selling more Teslas (as well as any other EV model that has Supercharger access).

https://www.npr.org/2023/09/10/1187224861/electric-vehicles-...

https://highways.dot.gov/newsroom/biden-harris-administratio...

https://electrek.co/2022/06/16/study-finds-more-than-fourth-...
Completely agree.

I think there's something to be said for time-shifting predictable large energy consumption events to points at which you're producing more solar energy than can be stored.

Scheduling an electric water heater to run at noon until 2pm for instance, depending on the insulation and size of the tank might be enough to provide all the hot water you might need for 24 hrs. Likewise, for electric car charging.

But there is definitely a minimum battery bank size requirement for maximum efficiency, especially if this is an off-the-grid setup where you can't rely on the grid to act as infinite excess storage.

Without batteries, you're either overproducing (and therefore throwing that power away by backing off the MPPT point), or you're underproducing (and therefore browning out). Therefore, you have to size your solar array for the worst case spike. AC locked rotor might be 30A for instance -- better make sure you're producing at least 7.2kW (~9.5kW of solar+) at any time the AC might flick on.

The higher the peak-to-average of your daily load, the more inefficient your setup will be. In our 9.5kW array example, this means any time you're consuming less than that, you're paying for panels that are effectively offline.

I think it's an interesting problem to solve, with a lot of variables. If the limiting factor is $ vs. roof space vs. ROI vs. 99.9% uptime, you might get different "optimal" answers.
pgvector is written in C and is supported by Supabase. There's nothing inherent preventing Supabase from supporting Lantern.
I've been thinking along these lines for a while. The whole "factors of authentication", where higher=better is no longer a good summary of the underlying complexity in modern authn systems.

We need better terminology.
Well the famous joke is "Emacs is an OS that lacks a decent text editor." (Yes Evil mode exists)

Emacs can do basically anything you write an extension for it to do. It can be your calendar, your email client, your rss reader or even your git gui on top of being an editor. Emacs can do so much that it's daunting to start using.
They're just 9% away from giving 110%.

Good hustle!
But when the conversation is about pricing, the word "dropped" there sounds like it's saying that Unity dropped their prices, which is opposite of the fact.
Came here to also praise the 2400c. I finally restored mine to working condition just last week after finding a donor screen from a parts machine.

Excellent build quality thanks to IBM Japan who thankfully incorporated the inverted T arrow keys, a first for an Apple notebook, which still persists to today's MacBooks. The 2400c excellent build quality also doesn't suffer from poor hinges like the PowerBook 500/5300/1400c models.

The processor is on a daughterboard allowing the 2400c to be upgraded to a G3, and the modding scene out of Japan has brought a ton of interesting upgrades like translucent cases and keyboards.

The main problems the 2400c suffers from are leaky PRAM batteries and other issues causing the dreaded Green Light of Death (GLoD), where the machine won't boot without hardware replacements like a new processor card.
One thing that is left out it to use unphishable MFA like hardware security keys (Yubikey, etc).
When comparing to Iframe our JS-based solution better adopts to the existing page layout due to the fact that it embeds into the existing page DOM (when iframe lives in it's own DOM which brings many limitations). Also it loads much faster than any equivalent iframe solution
Don't forget Terra as well: https://terralang.org/
> why this triggers such skepticism

I know it does for me - because the people who claim to believe in it the most don't actually live their lives as if they actually believed it. Don't get me wrong, I'd be happy to do whatever I could reasonably do to create cooler summers and less smog, but I've never heard any actual concrete proposal beyond "vote democrat".
the untenable position

I have received your letter of this date containing the terms of the surrender of the Army of Northern Tangentia, as proposed by you. As they are substantially the same as those expressed in your letter of the 8th inst., they are accepted. I will proceed to designate the proper officers to carry the stipulations into effect.
> Retool needs to revise the basic security posture.

Couldn't agree more. TBH I thought this post was an exercise in blame shifting, trying to blame Google.

> We use OTPs extensively at Retool: it’s how we authenticate into Google and Okta, how we authenticate into our internal VPN, and how we authenticate into our own internal instances of Retool. The fact that access to a Google account immediately gave access to all MFA tokens held within that account is the major reason why the attacker was able to get into our internal systems.

Google Workspace makes it very easy to set up "Advanced Protection" on accounts, in which case it requires using a hardware key as a second factor, instead of a phishable security code. Given Retool's business of hosting admin apps for lots of other companies, they should have known they'd be a prime target for something like this, and not requiring hardware keys is pretty inexcusable here.
I wonder what are the practical concerns of loading up an AMD laptop (or I guess one of those mini PCs) with an APU/integrated GPU and allocating 70+GB of ram to them as VRAM.

Wouldn't that, in theory, be what consumer LLM users want? A mid to low range GPU with tons of VRAM?

Or am I missing something here with regards to memory bandwidth? (sort of started this discussion a while back on the localllama lemmy: https://lemmy.ca/post/3910263?scrollToComments=true )
In my company, such a communication would never come via a text, so that would be a red flag immediately. All such communications come via email, and we have pretty sophisticated vetting in place to ensure that no such "sketchy" emails even arrive in our inboxes in the first place.

Additionally, we have a program in place which periodically "baits" us with fake phishing emails, so we're constantly on the lookout for anything out of the ordinary.

I'm not sure what the punishment is for clicking on one of these links in a fake phishing email, but it's likely that you have to take the security training again, so there's a strong disincentive in place.
> So I strongly lean towards it being earthquake lights, which is a documented phenomenon.

Or, you know...UFO's.
Well, the dev thinks different and this is what matters.

And WASM by itself works quite well by now, even on older devices, but not really on stock browsers. The question is more, how will be the whole experience of an autocompiled wasm project with UI? This is hard to get right and debug, if not right.
Not sure if it’s still the case, but a few years ago I was traveling and staying overnight near St Louis, and was shocked to find that it actually required a prescription there, but only in the county that St Louis was in.
> I'm surprised Google encourages syncing the codes to the cloud... kind of defeats the purpose

Probably so when you upgrade/lose your phone you don't otherwise lose your MFA tokens. Yes, you're meant to note down some recovery MFA codes when you first set it up, but how many "normal people" do that?
More energy only takes you so far. Unless we leave earth

https://dothemath.ucsd.edu/2012/04/economist-meets-physicist...
Bibata: Open-source, compact, and material designed cursor set
We're talking about anything produced in the last 5 years.
If your morals are immoral, sure.
Yeah I definitely imagine certain genres sounding off due to the rhythmic nature of computer timing. Jazz doesn’t follow rules like that so good jazz has these timing idiosyncrasies that make it sound the way it sounds. That and a ridiculous obsession with adding half step and quarter tone intervals.
Just curious - how are you able to determine which companies have my data?
Because the goal for taxpayer subsidies is to encourage behavior (or needs) that the government has decided they need more of. Europe wants more EV chargers. Simple as that.
I'm trembling at how much you're ignoring me!
Amazon literally just bought them for $8bn

https://variety.com/2022/tv/news/amazon-mgm-merger-close-123...
Have you looked at the WAF from AWS? I am using it on one of my sites to add a rate limit and it was reasonably easy to implement.
Just finger in the air, based on events and social media comments since 2020 election

Like I could say "tens of millions" of Democrats would still support Biden even if deem mental unfit for office, against Trump

* At leat 30% of the voters, on both sides, of 2020 will not be moved by any new fact

* In recent polls half Republican party still supports Trump. The Trump saga is so beaten up at this point, you would really have to believe Trump to keep it going

* This new indictments help Trump, by giving media coverage. And because distrust between authority/justice and Republicans

* This post analysis PDF also shows that the most liked, and retweeted, tweets are from verified accounts that support Trump views

So between 30% and 50% of 74 million people seems to support Trump's views

But to complete my original point, the bots identified look like budget "news channels", that also parrot those same views. That rightfully, or not, get labeled as "conspiracy theory" and "fake news"
it works but requires local network connections to be enabled which I assume is the "leak" they note
my dumb comment was dumb
Seems more like charging for new instalts. But how can you charge for install instead of sale? One user could easily cost more than what the game cost.
IntelliJ IDEA 2023.2.2 with support for Java 21
A "cook house" burned down from me a couple months ago, so there's clearly still domestic cooking going on here (Cali hi-desert around JTNP).
I mean, have you talked to Akamai?
The workaround I've seen is to issue a user two 2FAs keys, one for regular use and one to store securely as a backup. If they lose their primary key, they have the backup until a new backup can be sent to them. Using a backup may prompt partial or total restriction until a security check can be done. If they lose both, yes, there needs to be some kind of a reauth. In workplace context like this it's straightforward to design a high-quality reauth procedure.
I disagree. I appreciate the level of detail, but I don't appreciate Retool trying to shift the blame to Google, and only putting a blurb in the end about using FIDO2. They should have been using hardware keys years ago.
What about libvirt?
The solar fridge thing is one of the more interesting points.

For my own off the grid setup, I went with a cheep high efficiency chest freezer ($200) and converted it to a fridge using a replacement thermostat. It's about 10x less expensive than the equivalent DC fridge, has much better insulation, and does the job. I then spent a tiny fraction of the savings on a couple of extra solar panels to cover any loss in conversion from DC to AC to DC.
> being against a war that should not have happened in the first place

I'm glad we could find common ground. For a minute there I actually thought you were shilling for a warmongering dictator.
Apple no longer appears to be able to keep a consistent focus on the Mac. They have some really great fits and spurts in particular areas (e.g. hardware, they’re absolutely nailing it with Apple Silicon at the minute) but it’s far too common for widely-reviled issues to linger unaddressed for literally years.

The new System Settings is an obvious one; Sonoma hasn’t really touched that at all despite its glaring issues. But Notification Centre has been borderline useless ever since they redesigned it back in what, Big Sur? I saw a Mastodon post recently [0] that highlighted how bad it is today compared to the old design, yet it’s barely been touched in 3 years.

macOS is stable and established and unlike iOS a lot of people rely on it to do actual work, I would rather them not mess with stuff than half-ass it and leave it unfinished.

[0] https://mastodon.social/@marioguzman/110997716755684188
Ooh, cool! Will definitely have to give that a shot.
What was the regulation? Wouldn't spy on protesters at the behest of Macron?
I'm surprised we're not seeing much about the Unity announcement in here
Zero Trust is such a bad branding for how the architecture works. It's just "always prove" architecture.
A man who engraves on pinheads and razor blades (2011)