skysight-inc/HackerNews huggingface dataset:
The only real advantage I see here is having a dedicated storage for session identifiers as opposed to clubbing it with other non-essential cookies.

Everything else in the proposal isn't really required.

Considering this, simply choosing a standard name for session cookies suffices.

Browsers can give an option to the user to rejects all cookies that don't have the name "WebSession". This is already achievable using extensions like uMatrix.
A bunch of companies went to White House and promised they'd watermark their stuff.
If they develop a civilization, they'll want to develop technology that requires tiny parts (e.g. computers).
Cascade encryption is pretty common. I remember using 3 ciphers with TrueCrypt in the 2000s. There are some theoretical issues that prevent you from using cipher1(cipher2(x)) though. See https://en.wikipedia.org/wiki/Multiple_encryption#Importance...

In practice post-quantum encryption is always combined with normal encryption so this sorta thing should become even more common in the future.
No joke. Yesterday I found out PDFs can have forms with JavaScript.

https://tcpdf.org/examples/example_014/

How does this even work?
Yeah, you typically need some sort of hub unless you run Home Assistant. My understanding is that it doesn't need any hub for Matter support.
I use preview all day, every day, often with dozens of files open, including full scans of the full OED (each pdf 100s of MB). It occasionally will hang when I "print to PDF" with a large document, but other than that no issues to report for a couple years now on M1 and M2.
Fast radio burst detected 8B light years away
That’s not how publicly funded research works.

Most research projects are competitively funded by grant money on short timelines, and researchers are employed on fixed-term contracts. University professors with tenure are the exception rather than the rule. Research projects regularly get canned because priorities change or the work just isn’t sexy enough.
I was pretty sure mmWave was getting installed at large entertainment venues, this PR from a couple days ago says Verizon has mmWave at all NFL stadiums[1]. ATT PR from two years ago says ATT had mmWave coverage in parts of 39 cities and 20 venues [2]. I couldn't find recent T-Mobile PR on this topic, but I'm pretty sure they've got mmWave deployments too.

So... networks are deployed, and handsets are deployed, but mmWave network deployment is always going to be sparse and in places with lots of handsets, they don't all need to be on mmWave, those that are free up other spectrum for other phones, so everyone gets improved service.

[1] https://www.rcrwireless.com/20231019/venues/verizon-mmwave-n...

[2] https://about.att.com/innovationblog/2021/c-band-5G.html
The headline seems to be misleading. The article says you can invite up to 15 people to review your matches within 24 hours and they don't have to have Tinder accounts of their own. They don't have to be your mother, a family member or even a friend. You could, in theory, even pick random people whom you don't know to recommend matches for you.
Databricks Agrees to Acquire Arcion, the Real-Time Data Replication Provider
From a policy standpoint this is an easy thing to say, however tens of millions of americans get a pretty sweet deal as a result of this. To change it you need to make losers out of them so you can make winners out of others. These games of winners and losers is what makes health policy making very very difficult and resistant to change.
I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. It would be the equivalent of trying to self-host email.

Also - never having worked for a company that hosted their own - what's the experience like - with Okta, you can essentially SSO onto hundreds (thousands?) of different cloud service providers. Similiar if you self-host?
I was thinking about https://en.wikipedia.org/wiki/The_Feeling_of_Power
I had it for years, even had to get cortisone shots in the bottom of my feet.

The only solution that worked for me was stretching. When you are standing on a step, let your heel hang down as low as possible one foot at a time. Do this for both feet and do it with straight legs and bent knees multiple times a day. It only takes about a minute and does an amazing job of curing plantar.
D.C. Board of Elections: Hackers may have breached entire voter roll
It’s 1.4 acres 3 minutes from all the amenities of huntsville which I see has a hospital, multiple community swimming pools etc. the house has two kitchens so easily you can rent out a suite.

The house is not in the middle
Of the lot so you can Sell half the land.

Honestly looks like a good buy from where I’m sitting in BC.
I don't get why WebSession proposes to use authentication headers like WWW-Authenticate, when it calls out at the start that it's not a replacement for authentication protocols. If that's the case, surely it should just be using it's own headers to avoid confusion.
You said it man!*

I find the 'ethics' of everything complicated, lately. But, simple non-flashy action to just try to relieve some suffering is about as ... therapeutic as it gets - for everyone, I think.

It reminds me of that great folk tune, "Simple Gifts" (famously set by Copeland [in his style]). There's quite a bit to be said for the ideas of groups like the 'Shakers' (though strict celibacy for all does tend to be quite a headwind for perpetuation).

There is something very significant in the idea framed, for example, in the Christian Bible as "private prayer"** - the effects this has on the function and other characteristics of a person AND their community (which ideally is the world).

The mindset of as substantial a 'selflessness' as is possible for humans seems to make the world much more livable, simple, etc. (for anyone who practices towards it). It doesn't seem so common among people who become billionaires, though - this is not a dig at them at all, nor do I wish to end this comment on the subject in general. But, what's truly absurd and sad, to me, is that what everyone actually wants tends to get further away the more you cling to anything ... simply accumulate anything, including money.

* (John Turturro voice, always hear in my head, omit details as much as I can 'help myself' tho...)

** Matthew 6:5, for example - this is ending up rather 'Christianity-heavy', but the key messages are quite 'agnostic' IMO. I find them more-or-less in the 'useful' "spiritual systems" from all regions ...
> Perhaps it's profoundly unhealthy that Twitter changing its TOS or Musk unbanning some people and banning others causes you to grieve.

Why? People grieve all sorts of things—a community which was built up over a decade and is now falling apart seems a perfectly reasonable thing to grieve. What about that do you feel is profoundly unhealthy?
> It's unclear what legal basis Mazda has to order a DMCA takedown

There's probably none. They're probably just leveraging the high costs of a legal defense to bully individuals into submission. Corporations have armies of lawyers and can afford to spend years fighting in court, this guy can't. The threat of lawsuits is equivalent to a threat to set his money on fire.

Check out their "justifications":

> The automaker argued that Rothweiler's work contained code that violated its copyrights; used its "proprietary API information" to create more code

Seriously doubt that. It's not like they gave this guy access to their source code or internal documents.

> and that the integrations provided functionality identical to what currently exists in Mazda's own mobile apps

Not protected by copyright.
> your statement that midori was the colour standardized in law since the 1930s

In 1930, not since the 1930s. The 1930 law used midori, but it was changed to ao in 1947 after that became the more popular usage. The page you linked was about the current law.
For those who are wondering: The name is a reference to the 2021 movie "Marcel the Shell with Shoes on" https://en.wikipedia.org/wiki/Marcel_the_Shell_with_Shoes_On...
Ugly psychology truths nobody wants to admit
Personally, I'm fine with Google Workspace. IMHO, their track record for corporate auth, over the last what... decade... has been very good.
TL;DR: A web-browser-based, non-JS-exposed, request authentication scheme using signed requests.

I see some problems:

1) This is a stateful protocol: Bearer-tokens are popular despite their insecurity because they allow remote-services to be entirely stateless (and thus, scalable), but this approach requires the remote-service to maintain a database of current private sesion ids ("Looking up the corresponding Spriv for the session;") and storing the nonce of every request made ("while also checking to make sure that nonce has not been used before."). This will not scale (and could even be a way to DDoS a server by hammering it with requests from distinct sessions).

2) The requirement of a handshake: which means the first HTTP request a browser makes can't be pre-authenticated, which makes for a suboptimal user-experience.

3) Good luck getting browser-vendors to all buy-in to this; I'm sure Mozilla will be happy to accept a PR, but the other players (Google, Microsoft, and Apple) will all have their reasons to drag their feet on this, and that's assuming it's even in their interests to support this (e.g. look at how Google tried to kill Apple's Storage Access API).

4) The hard requirement for a browser-based UI restricts the kinds of session activities you can support, e.g. consider how larger-scale web-applications don't have simple, single-user sessions, but will support things like impersonation, delegation, multi-tenancy and tenant partitions - this can't be reconciled with how browser-vendors will only want to display (at most) a simple yes/no prompt or a list of known sessions.

When it comes to new browser-based security protocols, it's a triangle problem: Replay protection, Statelessness, No handshake requirement: pick any 2.

----

Request-signing can work, obviously we can't rely on whole-request signatures (because the body-length is unbounded and can be streaming); but using a time-based nonce with a remote-service-provided preshared key (which can be derived from the existing underlying TLS session without needing a HTTP handshake). ...but what value does this add when cookies+TLS already work fine for this purpose? Thus, this is why nothing changes in this area.

I'd very much rather see a "Cookies 2.0" ("WebCookies" to use the current nomenclature) that provides a way for a declared JS (just like with ServiceWorkers today) to run with privileged access to the user's cookie store (thus side-stepping XSS/script-injection problems; the "trusted JS" could be declared via a HTTP header) as well as (yet another) cookie flag, but this time to designate cookie-expiration-due-to-local-user-inactivity. Oh, and a proper DOM API for cookies like we have with localStorage, and not the horrible stringly-typed `document.cookies` property. I don't understand why no-one has seen fit to add simple `add(key,value)` and `get(key)` functions to it. Argh.
I’m definitely projecting a bit, but I find these generalizations harmful.

I work with people constantly romanticizing the good old days in my company, and being part of the new shitty days is not a good feeling. I’m sorry it’s different
This is not a serious answer. It’s very unlikely that “any self-hosted option” actually competes with Okta’s IDP solutions, has really decent security, has very good logging features, has behavior analysis features to detect login/session anomalies, and has security staff to respond to those threats quickly.

Saying “just self-host anything” makes a massive assumption that your company can afford to compete against Okta/Google for the same talent. Some companies can, but the vast majority of Okta’s user base can’t. You would be fighting against specialization and comparative advantage.

It might be possible that there are significantly better options than Okta, but I have yet to find them.
because some viewers have built in javascript interpreters. In the pdf it's just text labelled as a script
Oh wow. Thanks for looking into that. I'll have to fix this
Try SDXL. Find a good negative prompt, then just put a short sentence (starting with the kind of image, such as photograph, render, etc.) describing what you want in the positive prompt. It is much simpler and has fantastic results. Tweak to your hearts desire from there.

If you see a part of the scene that looks weird (and you know what it should be) add it to your prompt. For example, if you want "photo of a jungle in South America", and the foliage looks weird, add something like "with lush trees and ferns".
I'm sure I'm not reading the room well, but maybe don't seek to profit from an event that is ruinous to the wider world?

Better answer: read The Big Short.
Love this kinda data visualisation, where the users are in the context. Can anyone suggest any other interesting data visualisation in this line?
Whose mother doesn't already suggest "matches" in real life? No app required. I hope this signals the beginning of the end for dating apps.

You don't need an app. You need to get out more. There are only so many places to develop social skills with complete strangers as an adult once you're out of school, especially post-pandemic. With those skills comes the ability to find people for any purpose from anywhere. I can't think of anything more foundational to being an adult.
What if you could use selectors, media queries, and even shorthand in inline styles?

I created a library that provides this developer experience, but it's lonely because no one uses it.

https://artxe2.github.io/css-lube/
They use the difference between measured red and infrared light divided by the sum of measured red and infrared light https://en.wikipedia.org/wiki/Normalized_difference_vegetati...
Great retrospective of SumatraPDF from the author: https://blog.kowalczyk.info/article/2f72237a4230410a888acbfc... .
I think this is kinda cool, actually. My friends and I (male, female, otherwise) frequently discuss our dating lives anyway, and already show each other various profiles. Might as well make it shareable. IMO friends are often better judges of potential partners anyway, not being so directly in lust...
He has made some worrying decisions. Including much sitting on the fence on important issues, such as Brexit. I'm not wild about him getting in with a massive majority.
>>> older games can run with translation

Games are the most optimised code there is.

Translation layers might cut it with vintage games but not with anything modern.
I’ve never touched big iron. Can you contrast that with a script that calls a program with command-line arguments, perhaps with a cron job? I get that there’s more to it than that, but I don’t know what I don’t know.
Let's not be hasty, dear.
it's one thing to charge different prices per region, but quite another to disable the software or device just because i am moving to another country, or bought something while travelling.
Do you have a reason for why macOS doesn't make good use of big.Little?

As far as I know, it allocates background/low priority tasks to little cores such as OS housekeeping tasks. When you're on low powered mode or low battery mode, it automatically switches to little cores to save energy. When you need extra multithread power, it uses all cores.
Probably one of the only bits of software I miss from when I ran Windows.
"AI can improve society" reminds me of "Principles of Economics, Translated" (a great 5min video, https://www.youtube.com/watch?v=VVp8UGjECt4) - "\#5: Trade can make everyone better off." The same translation can be applied, methinks.
I've seen you mention this a few times but can't seem to find any information on it. I'm very interested in being able to use HAR files with MSW.
Soon we'll be searching for dates on Google, swiping right on sweaters, and doing research on Etsy. Is that the dystopia you want?
I only skimmed the manifesto, but I didn't see much about paranoia, infallibility, "worthless peons," nothing like that. It basically just said markets and progress are good, collectivism and stagnation are bad. That, along with his hypocritical NIMBYism, seems pretty standard for bay area techies who are lost in the sauce.

I don't agree with a lot of his manifesto. But I wish more people would write manifestos and try to fully explain their worldview instead of spending a lifetime reacting to other people's opinions. It's sad that we think they're inherently pretentious.
MacOS 9 was a dog's breakfast of an OS. OS X wasn't released until 2001, so until then all those Mac users were forced to run a cooperatively schedulding OS without even protected memory (!!). A typical PowerMactinosh's uptime was measured in the single-digit hours, not the weeks you'd get from NT, or months for a Unix box.

...there's no excuse for that given Apple's vertical-integration.
Maybe the best option will be just waiting for h264 patents to expire, just like happened with mp3s a while ago. On that note, does anyone knows when h264 expires? Or it's earlier siblings like avc? It also has the benefit of having vast access to an array of hardware decoders/encoders, although those might have their own can of IP worms.
"I'll say yes to this one... then try to seduce them myself at Thanksgiving."
The entire blog post is the stick-in-the-bike-spokes meme.

The man ate some laxative gummies, shit the bed, and is complaining that it took too long to clean up and all he wanted was to enjoy some candy, and how could anyone expect a layman to understand what the word "laxative" means anyway. The whole thing is just so obviously lacking in self-awareness & the intellectual honesty to admit that he caused his own problem in the first place.

My overall thrust is not that the support channel is red-hot and could have done nothing better, or that subscription management couldn't be improved, but the article's title would have been more honest if it said "I did a really boneheaded thing and Apple's support line could have been a little more helpful".

As to instant undo, it doesn't surprise me in the slightest that you have to call support to undo subscription changes with no notice. There's a very reasonable method that Apple has put in place to prevent this happening, and it's called "naming the thing what it does and you shouldn't click it and proceed through the payment confirmation if you don't want it to happen to you".
Good point. By the way, I checked out both projects above and starred them. Pretty cool!
Agreed. SumatraPDF is still one of my favourite programs, and I wish there was a Linux PDF reader which approached it. (Okular is probably the best, but it can’t remember opened tabs.)
They're called killer whales because they kill other whales.
I guess they didn't patent it in Australia.

I spent entirely too much time on ezone.com as a kid in the early 2000s. They were Shockwave games, and there was a minigame you could play when the actual game was loading.
I don't know what to tell you. I just checked again using Photoshop on my Mac, and the values you're reporting are just not the values.

The cap of the Tropicana bottle has hue values of 25-30°. Which makes sense, because it's clearly visually orange.

So the idea that any of the juice shows 32° is just false. That would be straight-up orange, basically the same color as the cap. But the juice isn't orange. The cap is. In fact, I can't find anywhere on the juice that is anywhere in the 30's, contrary to what you say.

The juice is not closer to orange than yellow. Full stop. It's yellow. Yellow like a banana. That's visually obvious, and it's clear upon exact measurement as well.

(The only thing I can guess is maybe you have some kind of night shift affecting color measurements on your display or something, that's making them redder than they really are?)
also probably a filter of values and stability against hot, which does not match the preferences of its userbase
Psychedelic Mushrooms Hit the Market in Oregon
Game loading time was especially a matter when optical disc or hard drive was used for games. Now such situation is somewhat ended at about 2019, so other devs only had a chance to implement it for a few years.
Telomeres: Everything you always wanted to know
So how will the almost as big EU stadiums handle the load?

(maybe the answer is europeans go to watch the game...)

I found it interesting that Puerto Rico gets the iphones with mmWave, but USVI and Guam don't.

Also noticed that nonUS/CAN phones don't support 600mhz, and that can make a difference when you have lots of obstructions (e.g. forest/concrete) if you're missing that in US/CAN. Your next available frequency will likely be be 850mhz - doesn't penetrate as well, and could have more traffic/noise on it.
It links a github repo, but that repo gives 404

Maybe the repo is set to private?
I think i was too young at the time to get that. An interesting point.
regulators allowed them to purchase competitors. bumble is a widely used alternative. they also don't really use cross-app synergies so it's difficult to call them anticompetitive.
EgyptAir flight 990 in 1999 is also suspected to be a suicide.

https://en.wikipedia.org/wiki/EgyptAir_Flight_990?wprov=sfla...
There's mjpeg for that. Is there any evidence anyone has streamed to such a platform over real video codecs? No there's not. People just make up endless shit to justify anti use cases.
For those answering negatively curious what your stack is?
probably more readable though. With the displays at the time you could see through even the blacks it was like 50% transparent when displaying a totally black screen. Means you could see through it but the images you put on the display needed to be fairly simple and .. id dunno 'blocky' because depending on what was behind the glass it could get very visually confused.
> I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP.

Not saying you can do better, just saying that you can get the same level of quality for free without paying for an incompetent & expensive snake-oil vendor.

But if you want a non-exhaustive list, there are a few lessons we can learn at Okta's expense:

Not outsource support to low-wage boiler rooms could be a good start - that's what got them their previous breach some time ago, and the current breach isn't that far off although it seems more down to the support infrastructure than the people themselves.

If you can, restrict access per IP address. Even better, if everyone works out of the office or VPNs into it, don't expose the service publicly in the first place. Defense in depth, something we seem to have forgot in the process of putting everything on the public internet.

If you see an existing session token suddenly show up with a different user-agent and IP address (not matching previous usage patterns or expected wifi-to-mobile handover), invalidate the session and ask the user to reauth again.

If possible, high-value accounts need to be IP restricted in the first place to known IPs or at least subnets (if the employee is on a dynamic IP).
I know of something in this area, but I was involved in it and prefer to maintain my pseudo anonymity. If you care to and email me at my username @ gmail I'll share over that channel.
I use MuPDF, which SumatraPDF is built on top of, I think. It is extremely no-frills, but it does the job.
Ooh, now there's one to consider ...

:)
you said it yourself; The statement about divorces caused by a lack of equality lacks evidence.
Good example of how the implementation of unnecessary restrictions, without proper consideration of how such restrictions would impede users, can harm your product. I hope all software doing the same on android (safetynet, prevent screenshots, etc) follow Acrobat reader into irrelevance.
I'm okay with risks created by UXO from cluster submunitions in the precision targeting of Russian bases. Such high-risk systems can be used responsibility which is why for calls for outright bans are myopic.