skysight-inc/HackerNews huggingface dataset:
cheeky one: "Cabin Noise during Acceleration with Ludicrous Enabled" (https://service.tesla.com/docs/Public/om_media/plaid_reactio...) :D
> There is also abuse. India is also using AML laws (forced by American led FATF) to crack down political opponents and human rights activists, as per Amnesty

Similar situation here in Brazil. Former president got fined, people started donating money to him to nullify the fine and government started "auditing" those donors. They literally weaponized this AML/KYC bullshit into political persecution.
I mention in the original comment that there are several exceptions (in copyright law), but these are for specific purposes. However this is not one of them. If it was, you could literally apply the same reasoning to any piece of software in the planet.
What was their argument?
> In fact how the funk do I know YOU'RE not the undercover North Korean agent?

If he's a undercover North Korean agent and you leave your computer unlocked for he to steal data, you'll likely be fired. So you should be thankful that he's not one in this particular hypothetical scenario.
Ah, here we go again
It's traditionally very easy to download all the posts of Blogger blogs with a single HTTP request.

If the format is nameofblog.domain.tld, then to get a JSON feed of all the posts, something like

curl -sA "" https://www.blogger.com/feeds/nameofblog/posts/default

This has worked for many years.
Orion rescinds RTO order after staff rebels, hijacks company email, calls Media
Everyone has USB-C monitors.
Yeah, it's over. Avalonia has blossomed into a functional framework in the time it's taken for MAUI to get to wherever here is. It's basically a drop-in replacement for WPF in terms of controls, to a degree that honestly surprised me. The default styling isn't that sexy, but you can change it, just like WPF, so I'd say it's mission complete as far as ordinary apps are concerned!

I think Microsoft has given up on facilitating application development beyond VS and C#.
Study: AI recognizes the tempo and stages of embryonic development in zebrafish
I've since moved from SOGo to grommunio[0]. It's Activesync support is great, far better than SOGo, and supports MAPI for Outlook and they'ved just released EWS support for Apple Mail / Outlook for Mac. Couldn't be happier. The other parts are fairly standard, rspamd, postfix etc.

[0] https://grommunio.com/
It's mind-blowing how much stigma there is around native browser features. The web has been around for a long time and there are "out of the box" solutions for many things folks sometimes try to re-invent.
Thanks so much! My kid needs to learn French (Montreal) but the way they teach it here is awful and I'm afraid turning her off the language. The only thing she really liked so far was a bande dessinée called "Lou". I'll give these others a try before the education system turns her off la belle langue forever
The article is based on another article which cites a message board and concludes:

> Unfortunately, the account that posted it couldn’t provide much in the way of evidence. When asked for any shred of evidence, the account reponded: “trust me, bro.”
Just as an aside Odin (https://odin-lang.org) has all of these things and does not stray far from C otherwise. It's a delightful language.
I'm curious what were their reasons - it's hard to imagine how localStorage would be "more secure" than http only cookies.

It's not a zero-sum situation. There are risks and vulnerabilities in every approach, that's why we as web devs take advantage of multiple safeguards to ensure safety when sensitive information is to be transmitted over the wire.
> I believe it's been proven that Binance traded against its customers and manipulated token prices on its platform.

Can you cite this? I'd like to read more about it.

> Crypto exchanges are less like stock exchanges and more like casinos where the house is guaranteed to win in the long run in bets made by customers.

I agree. Binance skims so much money from every transaction it's not even funny. Truth is a company in their position doesn't even need to run a dishonest operation in order amass vast amounts of money. They just need to let it happen.

> Maybe that's the deal that Binance's happy customers signed up for, but I don't think regular retail investors could be expected to understand that's how it works.

Well it sure as hell wasn't for lack of warning. I've told people not to get into the shitcoin casino. To their faces. They still got into it. I simply don't have a lot of sympathy for these people when they get liquidated.
But aren't HTTPonly coookies stored in a SQLite db, and have no password attached in Firefox or Chrome?
It would be impossible for them to force me to blindly accept a government issued ID card as true, and it would be insane for me to comply with such a demand. The same is true here, I won't run a browser or OS that complies with these regulations and as far as I can tell, they can't realistically make me.

The problem is if companies like Apple and Microsoft that make proprietary operating systems are forced to comply by the threat of import bans, etc. That would make their less technologically sophisticated customers vulnerable to completely unnecessary risks. The EU might not think the risks are unnecessary because they gain "sovereignty", but that only helps the EU and their member states, not 99.999% of the people who live in their territory.

Ultimately, I don't think this will be implemented. They can scream "sovereignty" as much as they want, but everyone else has an incentive to resist, and it would be even more harmful to their perception of sovereignty if both Microsoft and Apple say no and the EU faces the choice of either banning 99% of computers on the consumer market (and still be unable to force the remaining open source alternatives to meaningfully comply) or backing down to foreign organizations after a public confrontation.
That would probably be commercial. The term NC is actually a real can of worms. Either genuine non commercial work (government or non profit but they can be commercial) or as an evaluation/ prototype licence.
Nothing soured my (already negative) opinion of Crypto as much as regular conversations with a Crypto VC. Every time we spoke they were either sceptical or very excited about something that, to me, was obviously a trivial example of 1 or more classic scams. Whether or not they were excited about it didn't seem to track with the scamminess.
His reasoning is that good guy’s AI will counteract bad guy’s ones or a an AI that has developed his own objective against humanity if that happens, which is I think a reasonable argument.
It would be helpful if the post not only told you what to _not_ do (especially when it is a frequently done thing) but offered any sort of alternative.
But then I need a cookie banner /s
The way I see it, the problem is almost closer to social engineering than SQL injection.

A manager can instruct their reception team to only let people in with an ID Badge, and they already know they need to follow their manager’s direction, but when someone smooth persuades their way through they’re going to give a reason like “he said he was building maintenance and it was an emergency”.
Great game! I am not a musician and very far from perfect pitch (I would say I am closer to the tone-death end of the spectrum). I also have no interest in training my ear. Still, I had a lot of fun playing the game.

I had to replay a lot of times the tune and my versions to be able to get it right in three attempts.

One feedback is that I would like to be able to play more times a day. Unlike Wordle, your game has a few interesting variations. In particular, the instrument options. I would like to keep playing with it to explore those options. I imagine other people would like to test the hard mode as well, to see if they can get it right with the replay limitation. But after playing the first time to understand the game, you can’t explore more.

Finally, I personally would like to choose the music genre of the puzzle. I would likely choose classical music, so it would also add some discoverability aspect on a music genre that I enjoy.

Anyway, congrats on the well done game!
>Its why AMD won against Nvidia.

Won how?

>Nvidia still has no real answer to AMD's success

Which success? Answer to what? Are you from a paralel multiverse?

In this reality, it's the other way around. Nvidia is making so much money from the AI hype than AMD is the one trying to play catch-up.
Big tech wouldn't exist without Linux. Why aren't they forced to contribute?
Android games fully written with the NDK, not Android games in general.
I'm curious, how do you feel about PowerShell?

I think it's quite amazing in that it's basically the scripting language for dotnet. I love that it allows for interactive usage of dotnet libraries.

To me it has the feel of a lot of the dynamic languages from the past, but in a framework that acknowledges types.

I've been using it for finance/economic data stuff lately. For example:

https://github.com/dharmatech/net-liquidity.ps1

The only downside is a lack of a Pandas-like library for it, so I occasionally reach for Python for larger datasets.
> it straight up doesn't work as a money

I've gotten paid for services via Monero.

> money that's simple, easy, fast, and reliable

That was my exact experience with Monero.

Ever tried to set up a Stripe account for GitHub Sponsors? I literally had to open a new bank account for that. With cryptocurrency, you just generate a private key in your wallet app.

> A decade after bitcoin, no-one but crooks and when-moon fanboys use it.

Yeah, that's kind of my point. It's tragic. I don't understand it.
Thanks! I thought I’d never read these posts again, brings up memories of a gone by era for me. Back to reading blogpost now.
> More like 0.5%. A literal drop of water into the ocean of western wastefulness.

If we accept the analogy, 0.5% of the oceans is 5 100 000 km³, which is quite a bit more than "a literal drop": https://www.wolframalpha.com/input?i=0.5%25+of+the+volume+of...
Well put. Following that line of thought I’d say that by now crypto has shown that you can never trust a system, in the end you have to trust the people behind it. I find people to be more trustworthy when they go to jail if they do wrong.
Event Data Recorder (Car Black Box)
He's also a guy who doesn't need to work for Stripe, he could easily find something else to do.

It's a stretch to say he has his opinions because he is supporting the existing financial system.
Big tech would be using BSD instead if the lawsuit had been clarified before GNU/Linux took off.

How much did UNIX vendors, Apple, Sony and co have contributed to BSDs?
Seems to have gone badly for the 4060 & 4060 Ti specifically though, as they're at the same performance level as the previous gen 3060.

People could buy a 2nd hand 3070 for less money.
You need it for local storage too if I’m not mistaken.
In my opinion there are 2 good approaches:

If you really need to use JWT-s then store the refresh (just normal UUID looking token that is validated on the backend) token in a httpOnly cookie and JWT in local/session storage, use 10-15 minutes expiration and you are somewhat OK on logout= (the XSS is still maybe exploitable). On logout make sure to invalidate the refresh token.

In my opinion a better way is to just use a good old encrypted/signed/httpOnly/sameSite UUID=123 cookie, convert that to a JWT in your APIGW/BFF when talking to backends.

I would not try to cram JWT-s into cookies they are too big, but maybe these days nobody cares about the extra bytes
The problem with using Microsofts stuff is that is half baked all the time and it's hard to fix. I have made an Xamarin Forms app and it was hard to do things that were not basic.

Just use the web platform unless you really, really need to do something specific which cannot be done as a web app.
While writing games in any programming language is a very rewarding experience, I have found HTML5 Canvas and JavaScript to be very effective for writing games as absolute beginners too. If sound is needed, there is Web Audio too, all available right within the web browser.

It is quite possible to write simple games without using any external JS libraries by sticking to first principles only, e.g., drawing simple shapes with fillRect(), simple collision detection algorithms, generating simple tones using OscillatorNode, etc. Here is one such game I wrote sometime back: https://susam.net/invaders.html

Also, if the entire game is written as a single HTML file, the game becomes immediately distributable too. All one needs to do is host the HTML file somewhere or send the file to someone in order to share the game.
I find it interesting that you can find stuff like this even in biology: When you shiver in cold weather, your body is basically doing the same.
Meanwhile, a marketing manager at Google: "We keep cranking up ads, and they keep buying premium, it's working".
Cookie based session logins like everyone used to use?
Offpunk 2.0
As the other commenter mentions, lecun had a terrible track record when it came to LLMs. All his predictions at the time of what LLMs cannot do were proven wrong.

His research at meta is in analytical methods of AI so I'm not surprised. LLMs were seen as anathema to him as he could not comprehend the capabilities that would come from simply scaling up a suitable architecture with compute and data.

It's quite remarkable how confidently incorrect he was proven to be. Now he's going for round two on his takes with AI safety. Clearly he didn't learn his lesson.
I'm keen on decentralised cryptocurrencies, particularly ethereum, and I am fairly pleased about Binance's problems. What I'd like to see succeed is easy to use wallet apps running on an ethereum zk L2 with low transaction costs, social recovery, account abstraction, stable coins, and most transactions happening peer to peer on decentralised exchanges.

Centralised exchanges are not about cryptocurrency or decentralisation or democratising access, or innovating money to be programmable, they're just about finding yet another source of risk for people to play with in exactly the same ways we've been playing with risk in tradfi for millenia. Pretty boring.

Still, I assume that Binance's woes are at least partly because of an antipathy towards all forms of finance not controlled by the current system, and so the fact that they are taking down Binance probably doesn't augur well for the chances of my preferred outcome succeeding either.
And set the SameSite attribute to strict to prevent CSRF
I've been exploring best practices for session storage, and it seems like using HTTP-only cookies the only secure choice.
However, I've hit a roadblock when trying to implement a login feature within an iframe, especially with Safari disabling cookie functionality in iframes. This has left me pondering alternatives for secure user authentication within iframes.
Has anyone encountered a similar challenge or found a workaround? I'd love to hear your insights and experiences!
Pretty much. Also lack of real competition.
There's a huge difference between physically transporting a large amount of cash and disposing of it usefully without being detected versus electronically moving it around the world and exchanging it for fiat currency entirely anonymously.

Here's a clue: one of those is hard to do and massively increases your risk of being caught, and the other actually enables further criminal activity which would not otherwise be easily possible.

So no, not just like USD.
Usually this kind of enforcement attempts to reimburse victims, or failing that, goes to general funds. Anything else is a moral hazard for enforcement (eg, USA local police confiscations)
Sources at: https://github.com/animotionjs/animotion
That's why it was a power hungry hog.
Has anyone try using this to create e2e tests?
This post is about XSS, not JWTs...

> For security reasons, it is advisable for users to log out from a web application once they have completed their tasks

No, the application should be resistant to XSS instead. Online banking and such are automatically logging out to prevent someone stepping away from the device and another person abusing the logged in session.

> Frequently, when a Logout function is present in the application and is implemented with JSON Web Tokens, the application stores the JWT in an insecure location, such as the JavaScript code itself or the local storage in the user’s browser

This claim is as valid as "Frequently, when a Logout function is present in the application and is implemented without JSON Web Tokens, the application stores the plaintext password in an insecure location". The storage location is completely independent of whether it's a JWT or not.
I do not like my hammer hard!

I do not like a face of shard!

I like to whale upon a tool

A shattered hammer is not cool!
As a side question (or rather, what I expected the central point of the article to be instead): how are you supposed to actually use JWT?

The point of JWT vs opaque tokens is that you can just inspect the token itself to derive permissions without hitting any sessions in DB, right?

This means we need a short-lived access token (5 min or so?) so that sessions are revoked in a reasonable time if the token is stolen somehow (this is already scary to me TBH, someone can still do horrific things in 5 mins of intrusion time, but that's another story). Now my question is... how do you even handle the refresh token then?

I understand that long-lived refresh tokens means you can actually go to the DB/microservice/whatever and check if the refresh token has been revoked (via log out for example) since they'll valid for much larger intervals, so you can afford the session lookup... But if a refresh token is long-lived, what is the difference from having an actual long-lived access token? You'll still be handing out access token for a while. I can't see the difference here.

What am I missing?

EDIT: I could see the point if the threat models for both were different (e.g. having access tokens in memory, refresh tokens in a super safe vault, like e.g. ChatGPT would need to do for actions) but having both refresh+access tokens in the same threat model seems like it does nothing to me.
Yeah! And how comes that YU-NO – the visual novel GOAT – is mentioned nowhere?
I would find it largely unsatisfying to "solve" the Wordle in one guess by simply using the same word every day until it inevitably came up. When I play, I always pick a random word to start without really considering whether that word has already been a solution. It happened once that I guessed the correct word on the first try and it felt pretty incredible as the chances of this are so low.
Oh fuck off.
This energy and thinking inside the appsec community (of which i am a working member) is the reason the local _pizza company_ feels the need to have a 12 hour timeout on my mobile phone. Just implement a decent content security policy and then you can have the best of both worlds: stateless backend without having the (incredibly minor) risk of having your jwt token stole on my goddamn pizza website.
Farmers in New England would have loved this. Miles and miles of stone walls just hidden in forests/woods.
Three decades of experience talking here: If you don't see a vendor like Microsoft using a GUI framework for at least 50% of their new applications, then you've made a terrible mistake in adopting it yourself.

Microsoft uses Google's framework for their own applications: Electron.

Yes, you heard me right. Microsoft, a nearly 3 trillion dollar company, uses the framework of a competitor for their own desktop applications.

Teams: Electron.

Visual Studio Code: Electron.

Azure Data Studio: Electron.

Now, let's make a similar list for Microsoft MAUI apps!

Umm... err... hmm...
Cryptocurrency was meant to reduce the number of people you need to trust to an absolute minimum. Ideally, the only people you'd have to trust would be world class cryptographers.

The whole problem here is people reinvented the entire financial system on top of it. Exchanges are really just banks in disguise. They do fractional reserve banking, they offer cryptocurrency loans, they even have savings accounts.
look at any web client based authentication system like firebase or amazon cognito from FAANG companies.
Cognito by default stores it in local storage, and firebase stores in index db and local storage.
You can switch to cookies, but it is not possible to set httponly flag because they are client based (js based).
And that's the tip of the iceberg.
Probably a generalization but in my experience many IT security people don't seem very pragmatic. "No you can't do that" but no alternative. "No don't use that cipher" but can't tell you the correct one. "Don't use equipment that doesn't receive firmware updates anymore and doesn't support newer encryption standards". "Don't allow mDNS" so no more printing from smartphones or presenting stuff from your laptop using Miracast? It gets tiresome really fast.

Edit: yeah sure downvote me into oblivion. I'm not throwing away perfectly functional equipment because it doesn't support the latest and greatest ciphersuite. I'm also not planning on a being a roadblock on everything, it's balancing act.
Adamant – An Embedded Software Framework
Your refresh token does not need to be a JWT, it needs to be checked once in a blue moon and a server side round trip is OK
Both cookies and localStorage are usually stored in an SQLite db…

localStorage is totally accessible to any JavaScript running on the page, so your session can be completely hijacked and used later.
Very good list.
> I would not try to cram JWT-s into cookies they are too big, but maybe these days nobody cares about the extra bytes

Why does the length matter compared to when they are sent with cookies or with a special header?
EU governments will be even more subject to pressure from the US. I don't understand how anyone could doubt they will comply with every request from the US government.

The difference is that the current decision makers only have power because other people trust them voluntarily. That makes them accountable, and it means a whistleblower can do much more to limit the damage by leaking the fact they are giving after to US pressure.

A government can impose its will by force, so it is much less accountable and doesn't have to worry about the consequences of its decisions nearly as much. There is nothing I can realistically do if I object to a decision by a government unless I'm a large political donor because governments don't need my consent to operate.
The lack of logout and XSS are problems, but I ran into a couple apps that completely forgot to expire sessions due to lacking framework support. In nodejs's cookie-session and @google-cloud/connect-firestore sessions never expire. This issue impacts downstream software including, awkwardly enough, Google's Passkey demo apps. There isn't interest in fixing this.

Make sure your app is actually using a JWT framework, not a lesser version, and implements basic security practices.

[1] https://github.com/expressjs/cookie-session

[2] https://github.com/googleapis/nodejs-firestore-session
But I already pointed that out in my question. You didn't address my actual concern.
You don't need consent for strictly required cookies for functional purposes. Assuming the user actually logged in on your website, you don't need a banner.
And yet every criminal out there seems to be using USD. Funny how that works. Maybe we should ban USD too.