skysight-inc/HackerNews huggingface dataset:
In a distributed system with a dedicated authentication service, you can have that authentication service validate every JWT at your infrastructures entry point, and then only allow requests with valid JWTs to go downstream.

Those downstream services can then perform all their authorisation checks using just the JWTs alone. They don’t need to reach out to the authentication service to validate them, or lookup permissions, that’s already happened upstream. If those downstream services need to call other services, they can just pass along the JWT, and it allows the next service to validate the request is performing an allowed operation, without having to contact the auth service, or perform user lookups etc to determine what’s a valid operation. It’s all encoded in the passed along JWT.

There’s also security advantages because the issuing and primary validation of JWTs can be isolated to a single well vetted service, that has very limited connectivity, and every other service uses JWT validation with public keys to perform permission checking, rather than endless user auth lookups. Those service would also have to contact your central auth service to get new JWTs issued, ensuring there’s only a single place in your infrastructure that holds the sensitive private signing keys, and has the ability to issue new tokens. Which means you have a single gatekeeper that determines what types of tokens other services can access, allowing you to enforce limits on those services, even if they don’t cooperate (maybe they’re owned by a different team). It also provides a central location to limiting the blast radius of compromises, you can mass invalidate tokens with cooperation from other services, and stop issuing new tokens to services that might be compromised.

Ultimately JWTs shouldn’t be used for “efficiency” or “performance”, but rather as a tool that allows you segregate sensitive authentication and authorisation infrastructure from all your other services, and prevent “normal” services from adding ad-hoc authentication and authorisation capabilities in way that’s hard to audit or control, without limiting their ability to enforce authorisation requirements.
These are all bad arguments which I've heard many times. Once your front end is compromised with an XSS attack, it doesn't matter if you're using cookies with session IDs or JWTs... The attacker can use their malicious script running in the user's browser to make calls to your back end server on behalf of the user since the session ID would be sent along with the request inside the Cookie header.

The only added 'protection' of the session ID with cookie approach is that it forces the attacker to perform the attack in-situ inside the user's browser... But that's the best place for the attacker to perform the attack from anyway so it adds no value at all. It wouldn't make sense for the attacker to steal a JWT and then use it to make a request from their personal machine using their own IP address...

Note that httpOnly flag when using a cookie also doesn't add much value for the same reason. The hacker doesn't need to know what the session ID is in order to be able to fully compromise an account and do whatever they want with it.

The main drawback of JWT is that you can't reliably revoke a token after it has been issued. The solution for that is a combination of:

1. Set a short expiry date.

2. Have some kind of 'isDisabled' (or similar) field on the account (or keep a blacklist of account IDs) which allows you to instantly disable a compromised account so it doesn't matter whether or not they have a valid JWT token.

Although the second point means you will need to perform a DB lookup of the account (which some would suggest defeats the purpose of JWT), it's a lot simpler to lookup an account record than having to keep track of a session object and remember to clean it up when the user logs out (while also handling all possible server failure/restart scenarios which would otherwise leave behind stale sessions); managing sessions on the back end can be especially challenging in multi-process and multi-host applications... This is where JWT shines.
No. Teaching it in elementary school doesn't do shit. Everybody knows this stuff.

The reason why a lot of people don't make reproducible research is the same reason why communism tends not to work.

In order to make it work you need to put incentives in place. For example. No journal publishes a paper unless the work has been reproduced by someone from a different institution.
There are lots that are good and made by many people. An obvious example is Blender.
Great idea. This is rolling out right now.
How so? Economies only exist because of scarcity. A post scarcity society would naturally have no need for an economy.
Also they spam you (daily) even if you ask them not to. Might be the thing where you have to unsubscribe from the email even though your account settings told them not to send you email (I think it stopped after I did that, although who knows if it will start up again at some point).

7digital was the other one but of course they are also now owned by the same company that owns Bandcamp (and have the annoying regional restrictions, possibly Qobuz does as well). Hopefully they will get their act together. The lack of regional restrictions (at least in most cases) is one of the best parts of Bandcamp.

If you happen to be interested in classical music there are several that sell FLAC (not sure how good they are). I think there are some DJ focused stores that sell FLAC as well, although with limited selection I think.
There have been "813 pull requests merged" in the 6 months between 12.2022 and 06.2023?
Yes, there is more than one maintainer and many of these weren't "code changes", but nevertheless: almost 4.5 _successfull_ PRs every day?!
That is true, but nobody knows for sure how much a movie will make. Generally you know the more you invest into advertising the more people will want to see it, but how much return exactly every dollar spent on advertising will generate won’t be known beforehand.

The job of studio executives is to estimate this, and based on that make choices. This is based on some amount of objectiveish data (such as market research and comparative trends) but also has a large component of guesswork. And this guesswork is where his personal preferences can colour his decision making.

In other words if he would know it will make a lot of money he would release it for sure. You are right on that. But it is not known, and perhaps the objective indicators are ambigous or borderline, that is where his personal preferences might make a difference.
An "advert" for a BSD-licensed open-source codebase? Pointers to a comparable OSS networking project, implemented in memory-safe golang or rust, would be appreciated. There is https://router7.org, but for a narrow use case.
Ha, agreed. It's interesting that the first article I clicked about hard mode seems to suggest that it makes the game easier and (at the risk of being snotty) shows that the author REALLY DOESN'T get information theory.
I only know about this one because it was parodied at the end of a Ren and Stimpy episode (Ren Needs Help!) and I thought it was the funniest punchline I'd ever heard.
It's always a little disappointing to find out that something cool was actually referencing something else but knowing that the president actually said this helps dull it.
Ah right, thanks. I've only used Scala 2. To what extent do Scala 3 enums give you what you want in the way of sum types? E.g. compared to Rust enums?
> but it is not immediately clear to me if posting a form cross domain will send cookies.

As sibling comment says, this is what SameSite is for.

If it's a POST form, SameSite=Lax or SameSite=Strict won't send the cookie.

If it's a GET form, SameSite=Strict won't send the cookie. SameSite=Lax might, I'm not entirely sure.
> Ultimately there has to be an off-ramp

Not if people start using the cryptocurrency to actually pay for stuff. That's the point of money, after all.
38) If I absolutely must ride into battle, I will certainly not ride at the forefront of my Legions of Terror, nor will I seek out my opposite number among his army.

This one makes no sense, surely evil overlords are invulnerable during the battle charge.

45) I will make sure I have a clear understanding of who is responsible for what in my organization. For example, if my general screws up I will not draw my weapon, point it at him, say "And here is the price for failure," then suddenly turn and kill some random underling.

This one is hilarious I didn't understand the direction until the last word.
I’m not sure it makes sense to say that RAW files look good or bad at all. They’re mostly sensor data dumps.

The point is darktable has terrible defaults and terrible usability to allow a novice user to convert the dump to a usable image. Images loaded into darktable are less immediately usable than default camera settings. This might be ok for experienced users, but it’s absolutely disastrous for newbs.
It's super compressed but it's the same super compression that is on any DVD so for any surround audio source a consumer would have it was perfect.

The only people who would lose out on using TOSLINK was someone listening to a surround SACD (not exactly common).

It was never updated for the higher bitrates on Blu-ray, so that's when it fell out of favor.
yeah, it's very wrong. Showing "vpn: true" (actually a regular residential connection), wrong city, region, postcode, etc. Just like every other service out there.

I don't see any way to report it though.
I do care because I've seen a few projects burn through politics.
> You can actually see how it works if you try. Unlike some central bank's political machinations

You can also see how those work, it's just that they're boring.

https://www.ecb.europa.eu/press/govcdec/mopo/html/index.en.h...

> They do not understand fractional reserve banking

Entertainingly the crypto people managed to immediately re-invent it, in several different forms, because it turns out to be inextricable from the concept of credit.
Lots of indie musicians are on small labels and often multiple small labels so looking at the other artists on the same labels is often a good method (link usually pops up in the upper left corner).
Just want to chime in, on a related note:

I once wrote a React app with was essentially a spreadsheet view, except each sheet was a "table", and tables could be related to one another via columns which were belongs to/has many types.

Writing the front end and back end for this was one of the most complicated things I've ever worked on. I'd love to try it again at my current stage of knowledge and experience.
Browser support has come a long way in this time period as well.

Now we have the tech, and the demand, why aren't there more competitors?
> - irregularly sized episodes matching the plot

This is the one I've been thinking about for a while. I'm not sure why the MCU or Star Wars aren't doing more of this. They've kind of figured out how do to different sized plots (Daredevil vs. Avengers, Rogue Squadron) but why aren't they more connected? Why aren't they doing more multimodal storytelling. Have a big blockbuster movie, a 90 minute heist movie, a prestige tv season about politics, one about the military. Have some books about complicated stuff, a video game about the actiony parts, tiktok and instagram as storytelling devices instead of martech, etc.
This is where services like Rdio (sigh), Spotify and Apple Music have done really well, in my opinion.

If I want to listen to some music, it’s practically guaranteed to be right there in the one music service I’m paying for.

If I want to watch a show or movie, there’s now a bunch of cognitive overhead going going on.

- Which app is it in?

- Do we have that one?

- Do we have a subscription?

- Wait, how do we navigate the UI in this app again?

- Why is there an ad? I thought we pay for this service!

- Oh, we don’t pay enough.

- Oh, this service is raising it’s monthly fee, again

For me, the creation of streaming music services completely stopped me from pirating music.

The current state of streaming video makes me want to pull out the old eye patch and take to the high seas again.
I ran across a number of podcasts for the blind whilst researching some questions related to this post. Those might have similar (or some of the same) programming.

Internet radio is also available for a tremendous number of stations. It appears that KUHF has a stream, though that appears to be the primary band, not the HD4 subchannel.

Looking at KUHT's website, I don't see DH4 listed among broadcasts: <https://www.houstonpublicmedia.org/ways-to-listen/>

Sight Into Sound does have its own podcasts: <https://www.sightintosound.org/podcasts>
So you say "julia and python tools aren't enough" but then proceed to only talk about Python and say a bunch of stuff that is completely inapplicable the Julia.

Do you know much about how reproducibility is approached in Julia? Maybe hold off on calling it a lie if you're not experienced in what you're talking about.
(turns out you can also edit in "~/.config/minosoft/minosoft/resources/Default.json")
The post that I responded to reads:

"You are allowed to do anything, until the law forbids it or stuff is regulated in a certain way. Looking at it from this point of view, the world immediately opens up for you."

You're speaking on the subject of allowable behavior and you describe your thoughts as a "point of view." That's not strictly matter of fact and it can be interpreted as a prescription. "Allowable behavior" is not the same thing as "behavior which isn't explicitly forbidden by law."
I always do a web project because it typically shows you language features that you wont see in "Hello World". It also shows me what the database drivers look like, if its painful to setup, and all that fun stuff.
Some confusion: HG Wells' time machine is said to not travel to the past. It travels both ways, repeatedly. Don't know why they said that.

The Superman reference to violating a directive to 'not interfere in human history' is strange - every act Superman does can be put in that category. Going back in time 15 minutes to save one person is not materially different from just, you know, saving one person. Which he does routinely.

In fact this author, setting themselves up as an arbiter of what is 'scientific' and what not, confounds 'traveling back in time' with 'traveling before the time machine was invented'. How is it different to manipulate events in a future timeline, than in the so-called 'current' one, or even one in the time before the traveler's birth? No difference.

And then this galactically confused statement: "In the larger Star Trek universe, time travel eventually becomes commonplace, leading to the “Temporal Wars,” after which the technology was banned."

How do you ban time travel 'after' anything? The entire statement is meaningless.

Anyway, the author set themselves up as a time-science arbiter, so my pedantic quibbling is no different from their own. In fact, maybe I wrote that article! In a different timeline.
And “more likely to be manipulated” too?
Cookies are sent with every request, including to every image or script file or style sheet etc etc. When sent as a separate header, you only set it to API requests.
Also temporary as well as permanent conditions.
Minimalist, macOS Screen Recorder
Massively unhelpful study which nevertheless raises an important point about the democratic system of governance - intelligence not being a factor in making critically important decisions - which would appear to be an un-smart way of doing things
I gave powershell a good try but I believe it sucks. too verbose and the syntax is too inconsistent.

trying nushell next, it looks very promising.
> the absolute magnitude of electricity demand wasn’t that different.

The magnitude of electricity demand increased by more than the entire state of most states' entire generation capacities.

I do agree, the main root cause for the power going out so bad was power was cut to natural gas processing which caused shortfalls of natural gas which couldn't be alleviated until things thawed. But in 2011, that would have just been overnight since it got above freezing every day. It took several days to get above freezing in 2021. Things are pretty different when it's below freezing multiple days in a row, and that just doesn't normally happen in most of Texas. It's pretty different having your highs be in the 20s versus the upper 30s and low 40s.

I've never seen ice accumulate on a pool in Texas. In 2021 it formed over an inch on my pool, and I never lost power. If that's not an obvious indicator the cold was way more I don't know what to tell you.
> the BBC has never really had a sustained drop in content quality

The article is about a Netflix sci-fi show. The BBC just point blank refuses to make those despite the enormous popularity of the genre; the history of BBC sci-fi is so tiny it would fit on a postcard. What little it has made is either meant for kids, or is a comedy, which nicely sums up the Beeboid attitude to the sort of people who like it. You can't experience a drop in quality if there's nothing to drop.

And in this we see the reason why the BBC, despite its enormous budget, is quite simply no threat to Netflix and never could be. The quasi-communist license fee approach insulates it from what people want so well that it can ignore the most popular type of TV show for ideological reasons and nobody even bothers to complain, knowing full well that it's pointless. 99% of the energy of the BBC's critics gets absorbed trying to push back against its bias in news reporting, leaving none left for trying to improve its entertainment output.
Never mind colleges, let's consider law, politics and business! Places that matter, where 'legacy admissions' are rampant.
It could be correct, it just depends. Also according to the comments banks do all kinds of weird things.
The United Slate (2017)
Years ago this headline was being spammed all the time by some vendor that was pushing something, just like you’d see “hiring is broken” spammed by triplebyte every day for years.
FWIW there is a big list of similar libraries / internal DSLs in nearly all Lisps, and nearly all statically typed functional languages here:

https://github.com/oilshell/oil/wiki/Internal-DSLs-for-Shell

e.g. points to another Haskell project, which may be old - https://github.com/jgoerzen/hsh/wiki

Which is related to the list of free-standing shells:

https://github.com/oilshell/oil/wiki/Alternative-Shells
Ok, do you realize that from you what you claim you can conclude that (software) copyright is useless? Go to https://news.ycombinator.com/item?id=38410176

_Anyone_ could get any piece of software, claim that they want to run it on their new-fangled "x85" instruction set, and, according to your rationale, you'd be able to just decompile it to a different programming language and distribute your translation as much as you want!

> More specifically, it's always allowed for DRM code (because by definition their whole goal is to block interoperability), any kind of proprietary file reading and any kind of porting.

For the record, you are completely misunderstanding the point. These exception allows you to perform RE to _understand_ the code in question for interoperability, not to strip it from copyright and start distributing it as if it was your own code. And in most jurisdictions such exception only becomes possible when it's the _only option available_ to interoperate. As this is _hardly_ the only option available to run this game on your platform (emulation, for example, is completely legal, AND you could RE this title to fix your emulator), this exception hardly applies here.
Availability and Use of F-35 Fighter Aircraft: An Update
> Oumuamua might be aliens

Yes, it has few properties which are unusual for natural objects, so it can be an alien artifact. Probability is very low, but non-zero.

> Here's a nice exposé on him and his shoddy work

I have no time for this audiobook.
The POSIX shell, like the 1988 version of the Korn shell before it, is able to operate with minimal memory.

In the case of ksh88, it was able to be compiled into a 64k text segment which was the maximum allowed on Microsoft XENIX running on an 80286.

This is a place that Powershell cannot go.
If it goes on for 15 minutes or more, it could be one of seven different problems: https://mindofmechanic.com/fan-still-running-when-car-is-off...

Cars are like people. Sometimes a quirk is normal, and sometimes it means your bottom end is gonna fall out. Gotta get regular checkups and hope you catch it in time.
Which is kind of the point... if we make AGI that it means we die. That is if the AI dormers predictions are correct.
good stuff. pretty intuitive UI
> If you do something obviously different, like freely distribute a modified Windows ISO as your own, I would expect to encounter some resistance.

And this is exactly what this Github repository is doing.

If you are arguing "abandonware", then this is no legal argument whatsoever.
In Switzerland as well. "Mur en pierre sèche".
The title should have been “Stop using localstorage for user sessions”.

JWTs have a lot of issues, but they do work without localstorage/XSS being involved.
Why 56k is the fastest dial up modem speed
Knowing nothing about the technical merits of the two groups, it looks like the repeated interaction between Loeb's camp and their critics has been:

1) Loeb makes a bold claim about some phenomenon and attaches extraterrestrial life to it. He chooses to do this in a way that will attract media attention, like a press release.

2) The press release gets picked up by media, because Loeb is a notorious Harvard professor. At least some of the media will phrase it as "scientists say...".

3) Other scientists, perhaps at universities whose press releases are mostly ignored by media, see this and say "hey, I'm a scientist too, we do not say that". They try to engage Loeb and over time escalate their criticisms from "civil and private discussions" to "public and somewhat insulting". They might feel justified in doing this because they see Loeb's mass-media communication as being at approximately the same level of technical detail; at a certain point, a technical argument is not going to attract attention or understanding of the seriousness of the claim being made, but a blunt criticism will ("this guy is nuts and does not represent his field").

4) Loeb describes 3) as a bunch of overly conservative cranks holding back scientists and directly analogizes himself to Galileo, predictably frustrating his critics further.

Like I said, I can't say anything useful about the technical details. But it seems like an important detail here is that Loeb has repeatedly chosen to try and fight this out using public opinion, and his opponents have found themselves somewhat awkwardly picking up and using similar weapons for maybe the first time in their careers, and are not enjoying it. This seems to happen a lot in modern science!
Tesla struggles with poor build quality and a lot of owners don't expect that, especially if they only listen to Elon Musk. Fixing the sounds won't sell more Teslas but a higher quality car would have already addressed them.
I have been a happy user of Ebitengine for several years. If you are interested in seeing the source of some games created with it, check out the awesome-ebitengine list.

https://github.com/sedyh/awesome-ebitengine

All of the games listed on my itch.io profile were created using Ebitengine, and they are all open source.

https://rocketnine.itch.io
The US military and the US as a large market you want to trade with make it legal.