skysight-inc/HackerNews huggingface dataset:
The lesson is not to "avoid" the cloud, but to not be "dependent" on it. Doubly so if the service provided is one that keeps you locked in and can not be ported over.

So yes, I feel comfortable with my strategy of having backups on bluray disks + S3. If AWS goes down or decides to jack up their prices to something unacceptable, I will take the physical copies and move then to the dozen others S3-compatible alternatives. I am not dependent on AWS.

But I am not interested in using Google Authenticator or Lastpass because that would mean that I am at their mercy.
I strongly suggest anybody commenting about the situation of 6 months ago to play this:

https://en.wikipedia.org/wiki/Beer_distribution_game

At 2020, a lot of people were saying that no, the executives on those companies know about the problem, of course they'll be able to avoid it. Yet, here we are. (Anyway, the game is supposed to be played by people that were instructed about the problem. But you can try it with naive people before instructing them too. It doesn't make a difference.)

TSMC specifically may be able to avoid it. They are in a different market from most players, with less players that maybe are close enough to act to avoid it. I still wouldn't bet on it.
Structured Logs Are Useful, And GPT Make It Easier
The biometrics aren't authenticating you. They only unlock your phone, which stores the private key used to authenticate you.
> In other languages at that time the for loop was written in terms of a range, but without a strong range abstraction such loop is really primitive and limited in applicability.

That's a good thing: it gives you a clear syntactic marker for "this loop definitely terminates". There's already a full power anything-goes looping construct: `while`.
I was fairly sure we all are :) It’s seemingly found its part in the common web devs toolbelt. Perhaps not universally adopted, I believe it’s still regularly applied to systems with non-trivially large clients/fe-apps.
so you didn't read it but are sharing meta-feedback?
The Monty Hall problem is a fun one to code up, and yeah, there are otherwise smart people who refuse to believe it.

I coded it up in F# https://github.com/jackfoxy/LetsMakeADeal to convince one of the founders of a start-up I worked for. He just grunted and walked away. Pretty sure he still doesn't want to hear about Bayes' Theorem.
What would your employer's motive for spying on you be?

Might an external attacker be interested in the work you're doing for the client? For example, are you working with cryptocurrency? Countries like North Korea like to steal that stuff for sanctions busting.

If I were you I would bring this up with your boss. If that conversation leads you to believe that your employer is trying to hack you, I would probably quit. Otherwise your employer should know; this could be a good time to invest in countermeasures against an external attacker.
In one of my groups leaders decided to reuse google suite accounts. It was really difficult for me to accept the account from a other person. Google sent multiple notification to other person phone, had to unlogin, configure two factor authentication, the other person had to ignore warnings about Linux access. It was nightmare.
PIN for secure module with throttling and max wrong attempt count is indeed safer than a password you can brute force offline.
That does seem circular in Google's case, no? What cloud storage?
You have to possess the device and the PIN, so yes, it is quite a bit more secure.
https://news.ycombinator.com/item?id=37081306

They pulled the rug out on a lot of people and people tend to hold grudges. Community edition is peanuts compared to using an open source tool you _could have_ fixed your own bugs with by creating PRs or adding features with PRs. I used to be a huge hashicorp fanboy... _used to_.
I think there's going to be an issue with people forgetting passwords they lasted used 5 years ago. Recovery needs to be much better thought out.
How about having a free version that is size-limited? Or did you have that?

I'm wondering why it happened the way you describe? Was the free version perhaps too good?

Or is there simple psychology at play where people perceive something as having more value when they have to pay for it?

If something is given out for free it looks like they are giving it away because they can't find paying customers?

I assume free is good for non-professional customers but those will never pay because they don't REALLY need your product. Professionals know they get what they pay for and are willing to pay it because it will help their business?
This sounds great. I could imagine it takes inspiration from (or could take inspiration from) programs like Dreaming Spanish, a series of videos that are ranked at different levels of Spanish. The philosophy behind the programs is that what is most important is the active consumption of another language, like by listening and trying to understand. That actually our intuition that we need to work on generating the foreign language, by speaking or writing it, hasn't necessarily been shown by research. Instead, actively consuming another language at a level at or very slightly above your current level is perhaps the best way to become fluent at that language.

In terms of the content that you're creating, I always thought it would be very interesting to have leveled plays written in the target language. I always thought that reading how people actually speak might be more useful than reading prose.
When you get a duplicate of your SIM card you can then verify it is you with a SMS code.
There are also security questions and alternate email you can configure just in case.
TFA does not suggest that. Even if a coin is biased towards the side it started on, this wouldn’t carry over from one flip to the next.

It would be important to start the flip on the same side, but that’s doesn’t make the second flip dependent on the first
I use fastmail.com because I wanted to use my own domain. They're not free - make of that what you will.
They are saying losing phone + revealing pin is harder than exposing your password/phishing/social engineering/cracking.
And then? get asked for a unique pw that you havent typed for ages or a duplicate pw that you use for everything?
384 dims. we're using: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v...
Google launches Flood Hub in the U.S., which predicts when rivers will flood
They changed to the BDL from the MPL https://www.hashicorp.com/license-faq which in FOSS culture is considered a dick move.
This has nothing to do with your face is the simple answer.

If your platform uses face scanning, you can read how it protects you from that.

For FaceID on iOS, it uses additional sensors beyond just a camera.
The point is more so that the pin unlocks a key on your local device and that key is much stronger than the password the typical user would select. Plus it is site specific in a way that your typical user does not do with passwords.

So it's making a system weaker against offline attacks if someone steals your hardware in exchange for making it stronger against phishing. This is probably the correct tradeoff for most people.
And management consultants solving every problem in the world by adding a “AI” box in their powerpoint flow diagram.
There are enough games to play, https://www.macgamerhq.com/opinion/macos-metal-games/
Thought that as well, but try to imagine someone bellowing the word over the incessant clacking of teletypes and it _almost_ works ...
or to fax/email/send in government identity documents.
Depends on the recovery mechanism. Providing a government credential with a live selfie is the gold standard. If a company doesn't support that, they're being cheap at the cost of security (you can perform such an identity proof for ~$1-2/per successful proof through a vendor like Stripe Identity or ID.me).

Passkeys solves for digital identity compromise (credential theft or stuffing/spraying), but you must rely on other mechanisms (such as a I mention above) if you want to elevate identity assurance higher in the event of credential loss.

(consumer IAM is a component of my work at a fintech; auth/creds security, passkey rollout, high identity confidence when an account is recovered, etc)
I've done my own startup calculations for this. You shouldn't provide a heavily used openai wrapper below 30$/month/user. That will be likely a loss leader. At 46$/month it starts getting profitable for me.
Simpson's Paradox lives here.

On average, this might increase security (the vast majority of users are terrible at using passwords).

For proficient users who use passwords securely, this is an acute drop in security (if forced to use).

Forced phone number 2FA has the same effect; in Big G's case forcing phone number 2FA is anti-anonymity disguised as security. In this case, it's a bid for biometrics.
Valve is more concerned with meeting games were they are, not where they hypothetically could be. In the case of Linux (more gamers on Linux than Macs, although it's close), Valve has additional reason to care because they view Linux as insurance against anti-competitive behavior from Microsoft. Clearly they don't feel the same way about Macs (makes sense, because their Windows customers could more readily switch to Linux than Macs). So if gamers are already acquiring Windows/Linux machines to play games, why should Valve waste their resources trying to bring about a hypothetical reality where gamers choose to buy Macs instead?

It's not Valve's responsibility to engage in pro-Mac activism. It would be weird if they were doing so.
It is multifactor authentication. The second factor is a private key stored in your device.
You make a comparison with dentistry.

Monitoring a patient when you are next to them is one thing, but it’s quite another to monitor a patient in another room with equipment that can’t contain wires and is running cables at 10ish metres long.

Sedation adds about 50% more time to a scan and anaesthetics doubles or quadruples scanner time while also adding the cost of anaesthetics, prep and recovery, which is huge.

Doing scans without sedation is preferable.

On a well run MR, patient change over is 1-2 minutes. Coil setup takes longer and varies between scans but for 20 minutes of imaging I’d expect bookings to be 30 minutes. The 20 minutes doesn’t include pauses between scans, SAR cool down and sequence prep time (which are all hard limits and staff can’t really improve them).
It's as much work as protobuf. How about Chronicle Wire, can you add that?
Is it hard to remember the one password you use for all Google services everyone's already been doing forever and will still have to do for every other site? When's the last time anyone even had to log into Google on any device? I'm signed in everywhere all the time and it almost never seems to expire...

My desktop doesn't have a camera, fingerprint reader or touch screen...
Scheme in the browser: A Hoot of a tale
That goes both ways. What was the price then to get a botnet with 10k nodes making 1k requests / second? What is the price today?
Anything with working IMAP so you can use your own client. So, not Protonmail or Tutanota.
> it usually involves being able to dynamically scale up your bandwidth and compute power to cope with the incoming flood.

I don't think this is right. If you have a meaningful amount of bandwidth, dynamically scaling it is getting a connection upgraded in weeks instead of months. If you don't have a meaningful amount of bandwidth, you're rely on your provider(s) to have enough bandwidth and again, they can't expand quickly.

> Some can be TCP SYN flood, to just open TCP connections and exhaust available ports.

If you have a tcp stack from maybe 2003 or later (so excluding macos, unless they changed something in the past four years), it will have synflood protection, with syncookies. In the event of a heavy synflood, your system will send at most one syn+ack per incoming syn, and actually accept connections on the incoming ack. Yes, you miss out on detailed tcp options, but it's not that big of a deal, unless the volume impacts your available bandwidth.

Also, as a tcp server, you can't meaningfuly run out of ports; your one listen ip:port can connect to all ip:ports, if you have the memory for it. You'll probably run out of total accepted sockets, but there's no real resource limit on partially accepted connections, because of syncookies. It can be much more draining when DDoS clients actually hold connections. But it's often simply about volumetrics, and it's easier to generate a high volume of SYN packets than to hold a connection.
Marked. Mark my reply: No, they won't.

For score keeping, let's define "soon". Does "by the end of 2025" sound reasonable?
Totally agreed. I'm biased because I learn languages to mostly read texts in original languages. Narratives with well-crafted prose can have hundreds of years of linguistic and stylistic histories, as well as contemporary vernacular, which can tell more about a language than just understanding the plot of the story. I don't think that can ever be fully replaced by an LLM.

There are thousands of short stories at every level of language understanding for nearly every language in existence. I would be more interested in using AI for the languages that don't have these. (say, endangered/extinct languages, oral languages, etc)
>But there is really nothing that "normal" AI requires that is bound to CUDA. pyTorch and Tensorflow are backend agnostic (ideally...).

That's true, but the current bottleneck in AI/ML is memory size+ bandwidth. NVidia with their cuda really is the most economic game in town right now on both the Low "hobbyist level" end (nothing beats 2x used rtx3090 setup in value for money), up to "high end" (h100 is still the best generally available card). Some interesting "unified memory" competition appears on the horizon(Apple, AMD), but both are still far from where nvidia is.
That doesn't sound normal to me. You should tell your client that someone might be trying to hack them.
So why not just have a password that then unlocks the passkey? I already have a password manager.
...yes? I don't know what that podcast is on about. These games are very popular and still updated. TF2 was n particular has been updated several times in the past few weeks (https://www.teamfortress.com/?tab=updates) and has a healthy player count (https://steamcharts.com/app/440).
No? You wanna expand on that?
Good news that you can’t bring someone’s face to google and ask for access to their account…

Please don’t insert commentary when it’s clear you don’t know what you’re talking about
> I'm similarly similarly surprised it took this long for this attack to surface

As with most things like this, probably many hundreds of unimportant people saw it and tried it out.

Trying to do it on Google, with a serious effort, that's the wacky part.
Actually, I'm not sure this is mostly about a mathematical vs computational perspective. Let's look at how entropy is defined.

It's not just the number of possibilities, it's how likely they are. For example, consider two functions:

A: 1% chance of 1, 1% chance of 2, 98% chance of 3
B: 50% chance of 1, 50% chance of 2

The entropy of a distribution, in bits, is:

H = - sum over all possibilities of (p * log_2 p)

So for A it is:

H_A = -(2 * 0.01 * log_2(0.01) + 0.98 * log_2(0.98))
= 0.16

And for B it is:

H_B = -(2 * 0.5 * log_2(0.5))
= 1

So you can see that A has lower entropy than B, because it's more concentrated.

For continuous distributions this is defined with an integral instead of a sum, but it's the same idea:

H = - integral from -inf to + inf of (p * log_2 p)

Whether there's more entropy in a sample drawn from a uniform or normal distribution, then, depends on how wide your distributions are. Consider:

C: uniform distribution from -1000 to +1000
D: normal distribution centered on 0 with standard deviation 10
E: uniform distribution from -1 to 1

We then have:

H_C = - log_2(2000) / log_2(2) = 10.97
H_D = 1/2 (log_2(2pi * 10^2) + 1) = 5.15
H_E = 1

Note that continuous and discrete entropies mean different things, and their values can't be compared directly. That H_E and H_B are both 1 is not meaningful.
Congrats on the launch!

Continuous profiling is a game changer and once you use it on your production systems you can't do without it.
I understand that this is the prevailing wisdom (and it makes a ton of sense). But that’s exactly what the article is arguing against.
It at least avoids the user being phished or being compromised by reusing passwords.

But it seems in this case the account recovery is just using the password so the passkey is mostly convenience and maybe Google trying to move things away from passwords more than a complete change.
I see. So really this is public/private key authentication and the face/pin/fingerprint etc is just the typical device unlock stuff.
I've yet to really beat on it but it's quiet for its size with a typical laptop like fan sound under load. The dual port 10Gb intel nic doesn't seem to add much heat though I purposefully went with an SFP card in order to use cooler running fiber SFP's (A copper SFP runs burning hot vs a warm fiber SFP).

A brand new dual port 10Gb SFP card costs like $100 USD. Used is far less. I also wound up realizing that when it comes to 10Gb, copper can be more costly than fiber and uses more power per port. So I only buy SFP+ gear so I can use one of many interfaces: copper, fiber, DAC, etc. Fiber and DAC cables are cheaper and use less power. I have a ~$250 USD 8 port Mikrotik 10Gb SFP+ switch and also bought a few cheap 10Gb mellanox SFP cards for my server, desktop and work bench PC for like $30 each off ebay (I use them in Linux and FreeBSD.)
Small movie studios, if they make good content, people will go and pay to see.

It's no different. If people pirate it, word of mouth spreads and people will go and see it.

No one really buys music anyway, artists make most of their money from shows.

Sharing is normal behavior, the whole concept of piracy as stealing is bananas. No one has a right to charge for every single copy of something in existence, not when it can be easily duplicated. It's entirely at odds with human nature.
Incus 0.1: Canonical's LXD 'containervisor' with Ubuntu integration stripped out
Bi Ponsel
It is an interesting take, especially as many progress-obsessed people also complain about global warming, pollution, eradication of species, deforestation, etc. Is that progress?

Also those "non-sentinent animals with rudimentary tools" did have quite some culture, and technology. Not in today's sense of course: no personalized advertisements with goebbelsian tricks to trick people into wasting even more resources and destroying our environment even more. They only made rudimentary tools like composite bows, tools for horse riding and taking care of animals, etc.

I'm also sad to hear that people before 1960 were just a kind of animals in your opinion, and if that is the measure, many people around the world still are.
If the US was an IMF country it would be way off the reservation. The amount of outstanding debt is massive, and I don't think any of the older models would be able to handle it.

If anything, today's environment negates the reality of "crowding out."

That said, the debt will be at an "unsustainable level" when people stop buying it.
Reminds me of this wondeful scene in Ronin:

Everybody has a limit. I spent some time in interrogation... once.

They make it hard on you ? - They don't make it easy.

Yeah, it was unpleasant. I held out as long as I could.

All the stuff they tried. You just can't hold out for ever.

How'd they finally get to you?

They gave me a grasshopper. - What's a grasshopper?

That's two part gin, two part brandy, one part crème de menthe...
> 30% fee for apps

That’s only if you publish through the App Store. A developer who publishes on their own website doesn’t pay any percentage fee, though they do pay 100$ a year for the developer account which allows to sign and notarise the app. A developer who publishes on Steam pays 30% to Valve.
Twitter (X) CEO Linda Yaccarino drops out of the WSJ Tech Live conference
Apple antique aficionados can boot to the future with OpenCore Legacy Patcher
1963 ASCII was upper-case only, and many early terminals (notably for Unix, including the Teletype 33) were upper case only. `stty lcase`, which maps upper-case input to lower case, existed early — https://www.tuhs.org/cgi-bin/utree.pl?file=V1/man/man2/stty....
You can associate multiple passkeys with your account. Your account can have a passkey that is synced across Android/Chrome, and another passkey that is synced across Apple devices and browsers.
iOS isn't relevant to Valve due to the way Apple chooses to do business, so why bring that up?
I've never seen an API get as much hate from big tech as OpenGL got over decades. It started with Microsoft trying to kill it, and now Apple. The proprietary alternatives are not really even that much better. Just vendor lock-in for the sake of vendor lock-in.
They don't give any source or anything; the way it's worded sounds ambiguous enough that I suspect it's not that 50% of their code is generated by Copilot. Is there something a bit more convincing elsewhere?
Who would?
These are not arguments against steelmanning -- these are arguments against doing something else and calling it steelmanning. In other words, this is strawmanning steelmanning.
Finger prints and face scans are better replacements for user names than passwords.

I had read some good things about YubiKey, but I don't think I could get it to work on my corporate computerr.
Yes, that's mostly it.
They guy had a personal net worth of ~$100bn; lost all that and $8bn of other peoples money. The prosecution have cracked open the books, turned every single employee, and this is their smoking gun?

I will at least say, "goes to character", is absoultely an excellent and as I see it the only logical answer. If however, they have to play that game and that is all they have then they are going to struggle to make a legitimate case.

Maximum entertainment value from the sidelines will be not guilty with all the other FTX employees having plead out!
A password I can write down. A phone can be lost/stolen/black screen.
Congratulations on the launch, it's been great watching your journey so far.
Sure, PINs can be long and alphanumeric on most phones these days.
> maybe Google trying to move things away from passwords more than a complete change

Google wants to be a gateway to everything else you do.

The next step is to get other platforms to accept Google passwordless auth.
Always remember that passwords are protected by Fifth Amendment and similiar laws in other countries, but there is no law prohibiting officer to put your phone in front of your face to unlock it.
Does this work with Linux Desktop ?
Hollywod and big budget movies are not particularly great, it's true. There's a few exceptions - Dune and Don't Look Up, off the top of my head.

But there are great movies still being made. You just have to look fairly hard. The last few years have seen some brilliant films like:

* Everything, Everywhere All At Once

* Nobody Knows I'm Here

* Portrait Of A Woman On Fire

* Argentina, 1985

* The Banshees Of Inisherin
The post mentions eBay as a site using passkeys. eBay's implementation on PC accepts Touch ID, while Google's implementation did not the last time I tried it.
The only time the GP is false is when companies are reinvesting profits in a way that makes it look like costs.

But relative changes in revenue are much more impactful than relative changes in profit. This one is obvious, because revenues are much larger and bounded at a minimum of 0.
Powershell since Windows 10 defaults to require code signing. Developer mode lets you change that back to running local made scripts.

Otherwise there are also settings that allow locally created files but block downloaded powershell files using NTFS alternate data stream tags.