skysight-inc/HackerNews huggingface dataset:
It's nice, the only problem I got with omg.lol is that Wayback Machine archives are unavailable for all domains. I'm concerned that this part of the internet won't be saved for others to see in the future.
I wish everything would work with my yubikey as-is.

Instead it’s the Microsoft Authenticator and it’s different MFA styles:

- sometimes faceID is enough

- sometimes I need to select a matching number in a list of 3

- sometimes I need to type the number myself

- sometimes I need to type a TOTP from my phone to my computer (much worse)
I used to use Lastpass with MFA, only for them to leak my vault and completely obviate 2FA. It irks me to think of the cumulative hours I lost on entering those codes, though I still think 2FA(+) has value. You can do something relatively painless like 1Password, where my device stores my secret (I only use the odd 2-3 devices after all).

Lastpass is in and of itself a solid argument against the infallibility of a password-manager-only approach.
I agree in spirit but not in practice. I don't think a website should be trusted to generate a random password - leave that to browser infrastructure (which includes extensions).
Agree lots of sites still don’t support passkeys, but we’re getting there slowly but surely.

In a corp setting, just your idp for SSO requires it. Azure/Entra (Microsoft idp) will support next month. Okta supports today. For those who use Auth0, it’s two checkboxes in your tenant config to enable.

https://passkeys.directory

https://passkeys.2fa.directory/us/

https://janbakker.tech/prepare-for-passkeys-in-entra-id/

https://www.okta.com/press-room/press-releases/okta-launches...

https://auth0.com/blog/activate-passkeys-let-users-log-in-wi...

https://news.ycombinator.com/item?id=38521663
You're reading way too much into the cities I mentioned! I work remote and have been city-hopping to places where I have friends and family, and none of my friend group are in tier 1 cities. I would love to do a long stay in LA and NYC in the future, but they're excluded from the housing program I use to bounce around.
To me the point is that very few countries - if any - have true separation of religion and state, because religion is usually culturally embedded in a huge variety of ways. But it's easier to see the ways that the state upholds certain religious practices from the outside, because when you're inside the system, you don't notice that embedding fully.

The US is another good example of this: there is a constitutionally enshrined separation of church and state, but religion figures heavily in everything from money to the processes of Congress. From the outside, the US is a fundamentally Christian nation, but it seems like there are lot of people on the inside who see that differently.
they are fido2 keys like yubikeys, though the added feature set is a bit different: titan does more resident keys / passkeys, but no extra features like the yubikey 5 series
“For example, I’ve been using a password manager for the last two years, and now all my passwords have been generated automatically. This means that if you steal my password you’ll only have access to one of my accounts.”

At risk of stating the obvious, this misses the point of MFA.

Password managers are not an alternative to MFA. Also, how do you enforce the usage of a password manager such that you can confidently remove the requirement for MFA?

The whole idea is to protect the one account. If you “only” lose one account that’s still a bad day. Service1 has no ability to protect Service2, so protecting all of your accounts is not something MFA tries to solve
> give a shit.

This is probably the best advice I heard in a while.

On a slightly different note this is easier said than done specially if you have suspected adhd and live in the UK where you have to wait years before getting proper treatment.
I'd been hearing about bluesky enough that I thought it was operating normally.

I don't understand why you find that language hyperbolic. Yes, I find requiring an account to see a post to figuratively stink, as in, it makes me want to avoid. A choice to decline something is not rage, and I find it strange to try to paint it as such.
That this plane was maneuverable despite a massive engine explosion that took out 65% of its roll control surfaces is absolutely a victory of the engineers of that aircraft. I was shocked when I read that.

Sheer dumb luck was certainly involved. Those discs could have cleaved the plane in half to say nothing of the humans in its way but somehow missed most of the plane entirely. We definitely need to count every single one of those blessings. It's hard not to be positive when such an episode ended with zero fatalities, zero injuries even.
Bitwarden (as well as Vaultwarden) supports Passkeys as well now. You can even export the keys!
Yes it did to a large extent, although I think some of the function key defaults were a bit different, probably from older Borland apps.

But by and large converging on a singular CUA/MDI interface from Mac OS, Windows, IBM, Motif, QBasic, and TVision, in the late 80s.

While not everyone got there 100% it did help tremendously that one could sit at a Mac/Win/Dos PC, Unix Workstation, or IBM mainframe and understand the application level interface immediately.

We're sadly losing that as "smart" people decide to hide things from "dumb" people in terms of interface design.
> It couples online and offline

That's kinda the point, as it makes it more difficult for account theft.

Online only solutions are either:

* knowledge based (and problematic for many people due to data breaches and common passwords, though perhaps not for OP)

* public/private key based and not widely supported

> It can be replaced with other solutions

I love my password manager and think it is a great solution for me. But I'm a tech person and know other people who a password manager would be horrible for. Even 1password, what I'd consider to be the leading password manager for "normal" folks has only millions of users[0].

Let's be generous and suppose they have 9M and all in the USA. That's only 2.7% market penetration. Not exactly a mass market solution.

0: https://www.businesswire.com/news/home/20230919527858/en/1Pa...
> it can generate TOTP codes along with remembering your password

Absolutely correct, if you pay. Which is their right, but I'd argue you shouldn't have to to get such a basic convenience in the digital age as "just works when I want to log in".
I must add a data point to the contrary: I'm a longtime Firefox user, and ever since they switched to the new Quantum core [1], issues like hanging or crashing (especially with a lot of tabs open) have practically disappeared. Over the last few years, I've consistently had hundreds of tabs open (with up to 100 active) with no problems whatsoever (three different laptops, all running Windows).

[1] https://blog.mozilla.org/en/mozilla/introducing-firefox-quan...
Those that make money from it won’t let it happen
I love ESPHome. The declarative language makes it fun and easy to do so many little tasks like this. Used with Home Assistant it makes it easy to create graphs of everything. Do I NEED to know how much water my tree consumes? No, but I like seeing it anyway!

When controlling physical systems I try to limit the damage they can do with simple interlocks. For instance, the relay I added to control my central heat is in series with a conventional thermostat which is set for a few degrees above pleasant.

Likewise, you can splice a float switch in line with the pump's power cable, positioned so it will cut off power if the water level nears the top of the tree stand. This will prevent the flood when the software decides to rebel against you.
https://archive.org/download/rollerblade/rollerblade.mp4
They have capacitive moisture sensors too
Cambridge did a great study on how 'real' these credits are
https://www.cam.ac.uk/stories/carbon-credits-hot-air
The thing that annoys me most is that there's no reason MFA needs to be tied to your mobile device, and I have to pull it out every time I'm signing in somewhere on my computer.

Just let me have an MFA program like Authy on my laptop, or even make it a Chrome extension. It would be so much more convenient.

MFA is not generally trying to stop the use case where someone steals your laptop while it's open, it's trying to prevent the case of someone stealing your password remotely.
Aka, we're getting old.
The trees are planted and farmed specifically to be Christmas trees. If nobody bought them, they wouldn’t be planted in the first place, so the act of cutting down then disposing of a Christmas tree has no net impact to the overall tree population (barring the small amount of Clark Griswolds out there who get their tree from a forest somewhere rather than a Christmas tree farm).
Nothing laughable about it.

It's comparable on a core to core basis with the first AWS Graviton server chip that was deployed in 2019, only four years ago -- except this has 64 cores while the Graviton has 16.

It's also comparable to current x86 chips with 16 cores that cost about the same but use a lot more electricity. Each core is about 1/4 the speed of the x86, but you get four times more of them, which is fine for many server or HPC workloads.
If you can prompt GPT to write a blog post and you feel the results adequately represent your views, why not just post the prompt? "paste this into chatgpt 4 for the expanded version"
Fair enough. We would need to wait and see the actual piece of legislation and I assume they wouldn't single out these institutions otherwise it would be too easy to contest at the state supreme court.

Here's the text to the amendment and, for now, it's just about allowing the state government to start taxing private institutions of higher education (not museums nor other non-profits though): https://www.nyassembly.gov/leg/?default_fld=&leg_video=&bn=S...
Using a local password manager isn’t MFA. How is that verifiable to the authentication service?
> One caveat: I hate non-TOTP MFA. It's either proprietary lock-in or less secure.

Agreed. A particular pain point for me is Apple's proprietary (or SMS-based, even worse) iCloud 2FA, it's just awful. I would use TOTP/HOTP for it in a heartbeat if given the option.
If omg.lol is an oasis, this post was a stranger offering you a sip. What a refreshingly nice and personal post!
Other than a few awful providers such as AWS, 2FA isn't limited to a single device. Put it on your cell phone and your old phone you upgraded, or a cheap old phone, or multiple yubikeys, etc.

If one is lost you grab a second device.
Yeah, damn. The killer feature for me for my YubiKey is TOTP stored on it + passkeys, but the latter is (as you noted) quite limited. The former is too but I’m yet to hit that limit. Having both is super useful I find
No comparison to be made.
without a browser plugin or something better than human eyes to verify domain matches, password + totp are phishable / mitm-able in an online attack
Actually, seven, not two.

Six times throughout the book, and once in the Epilogue. Again, see the Notation section.
IMO you don't have MFA if your codes are generated by your password manager.
Even the OSS trainers/finetuners themselves don't really know the use case for their models. They just hot drop them and move on, lol.
Collapse of the Tacoma Narrows Bridge (1940) (2016)
Sadly even Google Chrome allows an Administrator to mark certain certificates as trusted which disables pinned cert enforcement.
Except for all of the events that reset basis, like death.
Agree, non-TOPT MFA is a scourge.

It's criminal that Google requires you to set up a phone-based or proprietary MFA before you can switch to TOPT.

Your phone number isn't something you "have" - it's something you're renting from another big company, and their security has obvious reset holes made to cope with unsophisticated users, therefore is worse than a password managers.

The only workaround I've found that is non-distracting is to have a dedicated phone-to-web/email system... Google Voice works for this if you're US based.
thanks for feedback everyone!

changes i'm gonna make:
1. allow to configure & print calendars directly from the website - here I anticipate I'll spot some cross browser hell but we'll see how that works
2. i'll add habit trackers - something very much wip is visible under https://useminimal.com/habit-trackers
3. i'll think about weekly calendars and planners

once I have more themes I'll add a paywall with one time payment to access everything with no time limit ie. every year you'd be able to generate new calendars etc. the 'simple' theme will be always free, maybe more
Just to make sure it's clear to everyone who's commenting about how great this is - in return for UAE paying to protect Liberia's forests, it gets to burn more fossil fuels while claiming to be reducing its carbon output. Not sure whether this is bad news from a climate perspective, but it certainly isn't good news.
Is there a reason for that or they just haven't been archived yet?
All software construction involves essential tasks, the fashioning of the complex conceptual structures that compose the abstract software entity, and accidental tasks, the representation of these abstract entities in programming languages and the mapping of these onto machine languages within space and speed constraints.

Git solves the deeply complex problem of distributed version control. Most complaints about git are actually complaints about the essential complexity of the problem, not the accidental complexity of the tool used to solve it.
You're on your way!

Part of the joy of process control is thinking about all of the ways that things can fail. Adding to your woes...

Relays can fail, and it's actually a common failure mode for them to get stuck in the "closed" position, meaning that your pump runs forever. I learned this the hard way controlling heaters.

Amusing anecdote: I wanted to set something up to water my tree while my family was on a trip, and I ended up with a large pail of water next to the tree and a siphon tube running between them. Totally passive.
Ye maybe you are right. I would not even try to catch a mouse by hand myself. And I have no clue how a lion would compare to a house cat in hunting a mouse.

But your dogs, do they hunt with their feet? I don't think dogs use their claws like cats do, making it really hard to get to the mouse? Like, dogs can't do a slap like cats and humans can?
AWS started supporting multiple keys last year.
Show HN: Butterfloat 1.0: Knockout-inspired web view engine with RxJS and TSX
There are never enough web frameworks right?

I wanted to explore a different fork in the road from an old classic, Knockout, but in a modern context with modern tools.

We’re in a very ko.computed-inspired web today: Signals, Runes, Zones, and more. Most modern web view engines use some versions of these things to try to dependency track imperative-looking code.

I felt like the missing path from that fork in the road was the rest of Knockout: a binding language focused on orchestrating lots of little observables.

Because it is using TSX as its compile time the Developer Experience looks a lot like modern React with hooks. It’s simpler: it’s not a Virtual DOM so components never “re-render”. Just KO some observable bindings. If you squint there’s a thing that looks like useState and one that looks like useEffect, but one is just RxJS observables and the other is a parameter to the component, there’s very little hidden state and it all should be easier to reason about than modern React. At the very least, it should be easier to unit test components.

There are other advanced scheduling features inspired by modern React. Like classic React it is just trying to be a view engine with none of the rest of a framework.

But it also doesn’t lose sight of the Knockout inspiration. I upgraded two old Knockout projects of mine, which was part of why I got the build a view engine itch. The Knockout view models got a little more verbose but still greatly resemble their Knockout selves. The views in TSX have a bit more differences from the HTML files they replaced, but the bind language also looks like a clear relative and I think a time traveler from the Knockout era wouldn’t be too confused looking at the codebase today.
I wonder if they can cut the top off and let the rest grow
SMS MFA is ridiculous and should not be a thing. Phones are very unreliable (between trying to daily drive a PinePhone in the past for a while, and AT&T's device whitelist after the 3G shutdown, I've been through a lot of crap).

TOTP seems fine to me. Can run it on various devices without a SIM, including just using a password manager like keepassxc on your computer that lets you copy paste the code. Sadly this all gets dumbed down and obscured so most people don't realize what TOTP is or that standard things are being used. We get told to download Google Authenticator or Microsoft Authenticator and keep it on our personal phone against our wishes forever. Hating MFA is quite understandable when it takes this form. Plus some of these TOTP apps make it hard to back up the data for use on another device, making a lost or broken phone rather catastrophic.

Tip, when presented with the setup QR code on a site, decode it and just put the secret into your password manager instead of a phone app (in keepassxc right click an entry and it has a TOTP submenu). Can also be handy to save an image of the QR for later (do at your own risk of course, this is sensitive data) in case you need to set up TOTP again.

People will probably argue this is less secure than letting it all live on your phone, but it still saves you from the most likely threat: websites being hacked and leaking your password. Also it's still protected by your password manager password, which should be unique and only accessible locally.
Besides, it doesn't shine at syntax highlighting, either! In the sense that it doesn't add anything that the traditional text-based algorithms embedded in practically any text editor can't already do. For example, if I declare a variable called "something", it should highlight all successive occurrences of "something" in a remarkably different style than "somethink". And the "a" in "sizeof(a)" should be rendered differently when it's a variable and when it's a type.
I deal with #1 by having two YubiKeys, and registering both
Does someone who has phone-based MFA and a phone-based password manager lack MFA?

Does it matter if they're in the same app?
Unfortunately, in my experience, there is lots of MFA out there that doesn't support TOTP (many providers probably don't even know it exists).
I used GEOS on the C64, it was, and still is an astounding programming accomplishment.
Doom used to be more popular than all of Microsoft.
Location: Mumbai, India

Remote: Yes, I can work in Asia/EU timezones and early east coast US timezones.

Willing to relocate: Occasional visits only.

Technologies: Python, PostgreSQL, Docker, Ubuntu.

Email: vijaykumar[dot]tater[at]gmail[dot]com

Résumé/CV: Available on request via email, but most details on linkedin experience

Github: https://github.com/cabecada

LinkedIn: https://www.linkedin.com/in/vijaykumarjain/

Hi, I am database reliability engineer who works on all aspects of keeping the databases (100s of them) up and running. I have used configuration management tools like puppet to deploy complex postgresql architectures and have experience with databases as big as 60TB and shards, backup of those shards, upgrades etc.I had a good reputation on not leaving any incident open which arise due to sudden bump in traffic, bugs, system issues etc and ensured minimum or no involvement of app developers in issue resolutions. I help answer queries on postgresql slack and citus slack (basic only). I have experience working in all the timezones in the world across my 14+ years, but for this role I would want to sleep at night unless its an oncall/incident.
I have exposure to on prem systems/ bare metals, self managed virtualisation and microservices but using mesos/docker and AWS using theforeman. I have tutorial awareness of AWS and Kubernetes and Ansible, but I read a lot of code and have history of understanding most of the relevant infra stack in a couple of months without any hand holding.
If you have read till here, Thank You for listening. I am passionate about postgresql and troubleshooting incidents to root causes.
Disclamer: I'm working on it.

But yes, I think we can.

Almost everything can be better:

* Merges/rebase/branch management.

* Project management.

* Diff.

* Large files.

* User management.

* Partial checkouts.

* ACID semantics.

* Binary file management.

* User experience, including making it accessible to non-technical folks.

* A bunch of others.
I was referring to no license. I was referring to this statement

> There is zero practical difference between "free and source available" and "open source" for 99.99% of users.

"Free and source available" is not a license. Without a license it is copyrighted.
It blows my mind how prevalent smartphone-based MFA has become. People should be far less willing to comply with vendors' demands for mobile numbers under the guise of improved security. SMS 2FA generally worsens your security posture by opening up new and more convenient vectors for taking over your account[0].

What's especially shocking is when I encounter employers insisting that I setup MFA using a smartphone. Even employers that should clearly know better, working in security-sensitive areas where employees are developers with commit rights to cloud software/operating system code, making lucrative targets. There's a lot of cargo-cult negligence out there.

Fortunately there are better approaches to MFA. MFA is not the problem, smartphones and cell carriers are just raging dumpster fires.

[0] https://en.wikipedia.org/wiki/SIM_swap_scam
> the computer keeping the broken engine running

That’s on purpose, you don’t want an automation decide such a drastic move as shutting down an engine. That’s the pilot’s decision.

> absence of any physical kill switch to stop the engine

There is, you shut down the fuel flow with a valve. But that “kill switch” was damaged.

> An hour being generously available to go through ALL the checklists to clear the notifications

Again, pilot decision to do it if time is available. Isn’t it safer that way?

> pure randomness in debris flying the way it did

Well that’s the nature of the failure. It’s like complaining that which HDD fails in a datacenter is random.

> outcomes for all possible trajectories of debris,

Yes it’s not public data, but all positive trajectories are analyzed at the design stage, and structural and systems components are kept segregated accordingly.
Rainforest conservation can hardly be described as being "done right" when it is paid for by selling/burning more fossil fuels elsewhere.
I use Aegis authenticator on my phone which supports export, I import them into gnome authenticator from where it is incredibly fast and easy to get the code into a web application login:

* Press "windows" key
* Type the first letter or couple of letters of the name of the code, press enter to copy (which also closes the expose style view and returns to the previous application)
* Paste

Very smooth, with this setup I have no issue using 2fa with codes.

Not sure if it can be simplified to this extent on other operating systems / window managers
The part I was suggesting does not apply is the statement "Focus on getting the critical path right and creating a good experience, and then get it to customers for feedback on where to go next."

Most software engineering is about making sure the happy path works well. When lives are on the line, you need to also plan to minimize the possible damage that can happen when things go wrong.
still vulnerable to password db leaks
FIDO passkeys are the way to go now. It's saved to your password manager and just needs one click to authorize your login.
Have you played with finetunes, like Cybertron? Augmented in wrappers and retrievers like GPT is?

It's not there yet, but its waaaay closer than the plain Mistral chat release.