skysight-inc/HackerNews huggingface dataset:
There was a big issue with Payoneer's SMSs in Argentina under Movistar. I tried to rise the issue here in HN but got unnoticed.

There is an insightful tweet [1] in Spanish that is translated as follows:

"""
Well guys, the payoneer mystery is solved.

#PayoneerHacked

- The attacker compromised the gatway SMS used to send the 2fa to Movistar customers (the platforms use this to sneak the cost)
- The attacker saw 2fa messages passing from Payonerr to a Movistar phone number but had the problem of not knowing the email of the Payoneer user to change the password and make the transactions.
- The attacker, to discover what email was behind each phone, set up a phishing site to try to take ONLY THE EMAIL from there and with the email + the phone + the 2fa that accessed the compromised SMS gateway in real time, he was able to change the password, access the account and send money since I kept reading the 2fa that arrived on the Movistar phones.
- That's why the victims saw several real SMS with 2fa coming during the night that emptied their account.
- Even if Payoneer customers had fallen for phishing, they would only have had one 2fa stolen, and not all that is needed to log in, add an account and transfer.
This need makes it evident that the commitment to the SMS gateway existed.

- The victims of this scam lost their money because the last mile of the security stack was compromised.

Be careful, because Facebook, Twitter and others share the same gateways to save money on SMS.

Here I leave a screenshot of the SMS that arrived during the early hours of the morning to a victim and that the victim was never able to share in any phishing and that were necessary to empty them.

(whatever you read in the media... fruit, lots of salad and little sauce. here's the post)

Thanks to everyone who cooperated.
"""

[1] https://twitter.com/julitolopez/status/1748440685743587811
10 June or October 6?
And here I was, thinking of yet another type of sequencer :

https://book.starknet.io/ch03-02-sequencers.html
OTP can be social engineered, hardware keys can be stolen, who determines what constitutes a flaw?

Edit: also, do both pay in this case? The telcom and the service?
Speeding Up IsBlank()
I completely disagree. Using a corporate account for personal identification is a major failure of public infrastructure.

The US government should step up it's game.

An individual's identity financial transactions should NOT be determined by holding an account at one of 4 mega-corporations.

We should work towards something in this direction: https://e-estonia.com/solutions/e-identity/id-card/
All the best. Keep the rubber side down.
Not everyone has (or wants) a phone or to grant control of their life to a cell phone carrier
How to Enable WebXR on Apple Vision Pro
How to cache data using GDB's Python API
Maybe SIM swapping shouldn't be so easy in the first place.
Do you happen to know how AirNav gets their info?
Are you still finding clients for static websites and Wordpress? I got out of that game six years ago and am considering getting back in as a side-hustle. It seems though that most of that freelance work has dried up.
Can you provide some substantive evidence on that? Just curious if you actually have a good example, or if you bought into the other PR.
> that’s one of the big punchlines in relativity

It's kind of funny that the actual big punchline is that light speed matters at all. There would be no meme of "reaching lightspeed" without relativity, despite that meme originating from relativity specifically mentioning lightspeed as something you can't reach.
I understand it’s a naive statement, but in order to log in into your email you would end up relying on some other sort of 2FA. And we’re back to square one to relying on SMS, because UX of other authentication flows has irrecoverable flaws.
Nice, will take a look.

Right now I've focused on the following more general integrations:

VectorDBs - These include established providers like qdrant / pgvector / weaviate / pinecone / chroma. I’m also happy to try out lantern.dev if anyone is interested since their offering appears quite good.

Embeddings - I will embed your data with Jina-V2-base as part of onboarding. Alternatively, happy to use OpenAI if you supply keys (or I could take a crack at figuring out Cohere’s API).

LLMs - I can integrate with Anthropic / OpenAI / Hugging / Mistral / SciPhi and I am open to exploring any other providers that are relevant.
It baffles me that we all services haven't defaulted to something like Google Authenticator or similar. Users should be given a choice.
It's a double-edged sword. On one edge there's the risk of greed, but it's also unparalleled in incentivizing and rewarding ambition.
In a universe where every action has an equal and opposite reaction, why not make those reactions argue about it?
So who out there is running an investment fund that's looking to make a much more reasonable rate of return off successful but slowly growing companies? Because I would put money into that fund.
We're largely on board with the same problem's we're trying to tackle, and I most certainly understand why you're making these criticisms of these trivial examples and our current implementation. You're right to - these simple designs aren't where designing PCBAs with code will shine (we expect!).

Currently when you discuss configuring a regulator, it's beholden upon the designer to understand enough of the internals to configure it because, in our opinion, schematics aren't well suited to designing things that are configurable and plastic - either in topological terms, or in their parameters. Our hope isn't to abstract this complexity directly by using code, but rather because code allows the workflow itself to change, for a well tested and trusted configurable block to completely abstract the internals such that a designer can forget about it (like a tested piece of code). We want to bring configurability on this "trusted" scale in from the physical world of modules to the world of highly descriptive code. It's a tall order, I'll indeed admit!

It's also well worth nothing that while at the moment we're running lean on the visualisations, we do agree they're an extremely potent tool to convey the topology of a design at a glance. We expect we'll be adding a visualiser which should be used to gain familiarity with a circuit, diff it for review and understand it from a system level (by viewing topology by interface type etc...) - unlike current schematics that implicitly hold so much content via the positioning of components.

Thanks for the detailed comment!
YouTube Claims an Apple Vision Pro App Is on the Roadmap
Yes having an SMS sent to a number you no longer own is great UX.
> The one thing it could be useful for is creating net connectivity for large numbers of pin to pin connections, like DDR memory or PCIe buses. Schematics for these end up looking like large data tables anyway, and can be tedious to create and prone to errors.

This is a good example. I'll expand it to include such things as breaking up the symbols for a large FPGA (say, over 1000 pins) into multiple schematic blocks and managing them as the schematic design progresses. Very often you have to move pins around within the same block or between blocks just to arrange them logically or align them with whatever they might connect to.

For example, take the output of an FPGA bank and connect it to the input of an HDMI transmitter chip. You would want to align the red, green, blue, clock and control pins so that you can connect them with a bus that looks right. If someone reading this isn't clear, imaging arranging the pins on each device in random order where, for example, the first chip has R0,B8,R1,G5 and the second chip is R0,R1,R2, etc.

This kind of thing is tedious and painful.

The way we solve the problem with Altium was to write code that allows us to fully define an FPGA (and other IC's) using data entry in Excel. One turn of the crank creates all symbols and PCB patterns and exports into the libraries. This took something that was a days-long torture to maybe 45 minutes of work. After that, if you need to move pins around, it takes minutes to update everything.

This is also an example of why a text file based approach would not be as useful. Entering data in Excel is very easy. Editing it is just as easy. In some cases you can even copy and paste from datasheets and easily edit or rearrange. I can also write formulas to generate sequences of pins, etc.

Having to manage this in a text file would not be as slick. Over the years, I have found that Excel, coupled with VBA code, is a very powerful tool for schematic entry and PCB design.
Funny you should mention that, I implemented an S-expression based language spelled using JSON for a dynamic configuration use case. It was actually not terrible for a day or two of work, but it was a far cry from a general purpose production grade configuration language due to lack of tooling, intellisense, and a small stdlib. Also, many people found the syntax foreign and confusing; not a deal breaker but just another hurdle.

FWIW I agree with you, but driving adoption would be hard.
GitLab's not too surprising, they're a very valued player in the open-source space.
"Don't fall in love with your job. The business is not in love with you."

Hallelujah brother - well said.
I heard that one night after a performance in college, John Cage returned to his room, where his roommate heard him laughing, “I did it! I fooled them again!”

What a character.
> everything is about showing your thought process and your steps

You probably did well at a US college because you came from a system that actually provided you with critical thinking and reasoning skills. Instead of a system, like the US, which is rife with route memorization and multiple choice tests.

I would imagine the opposite experience would be much more difficult (assuming what I remember from studying German is actually correct).
I was interested so I looked up some numbers: $0.3 per kwh in California * .005Gb mp3 (3m at 128kbps) mp3 * .06 kwh/Gb for internet traffic = .00009 dollars in energy to sling 1 song to your device. Heavy margin bands there for the traffic estimate especially, but Spotify probably has a 95%+ cache hit rate so I think they would struggle to come out worse than the physical disc.
Kinda cool, I'm out of my depth here. What would be some interesting things to do with this once it was built?
The Fight for Air Superiority in the Aegean
> And so far as JS Bach is concerned, it's pretty clear he was a mathematical thinker even if it wasn't necessary deliberate in his composing. Maybe it was?

Sure it was: read Gödel Escher Bach
"the “substantial bonus” which would be paid to me was “thanks” for the critical role I played in starting the company."

Based on situations I've seen before, I'm guessing this "bonus" was probably actually attached to some legalese that required signing that exempted the company from any wrongful termination legal action, etc. etc.
Its fascinating how the interest and energy around a project like this manages to be self-reinforcing. The idea on the face of it is quite nonsensical: building a machine to make continuous droning sounds for years at a time. How likely is it that the song actually would play to completion? The fascination is that it is not impossible that the effort will succeed, and its already gone far enough to be quite amazing in the attempt. And in the process its achieved a completely new way to experience music. That last part is both shallow (its a pretty boring way to experience music, and its hard to call it music at that time scale) and deep (with this performance, a chord change is opportunity for ceremony and news releases: its an event!).
I didn’t know you could interact with pages like that so easily with Chrome extensions
Great, go ahead use your email address rather than a phone number then!

If the author's point had been that there should be a non-SMS option, I would not have commented. But that wasn't their point. They thought it should be removed as an option from everyone. It's just an amateurish idea, completely ignoring the real world and the tradeoffs.
What does that mean, though? Does Deno create an HTTP server in Rust directly?
Archived: https://web.archive.org/web/20240205225601/https://www.thegu...

Court decision, full version: https://www.judiciary.uk/wp-content/uploads/2024/02/Miller-j...
Well that got me thinking. You could stand up a third party verification service and sell the offering to companies that don't want to be bothered with authenticating the user. Something like Okta (I know, bad example when talking infosec at the moment) for real life.
You don't even need the wormhole. You just accelerate away to relativistic speeds then turn around and come back. It doesn't matter which direction you're going, just that you're going _fast_.
That’s what I have been saying for years every time I have an opportunity, last one few days ago https://news.ycombinator.com/item?id=39247480

But it won’t happen, that phone number is NEEDED to be tied to your identity for a lot of reasons, that’s why banks (where most people have their real identity) are still requiring a phone number.
I've not followed the German hackers who I tracked. A couple years ago, I heard that one or two of them were active in the Chaos Computer Club, at least they showed up to a meeting and described what had happened to them.

Every now and then, I think about doing a talk on "Stalking the Wily Hacker 40 Years Later". It'd be fun, but I'm not sure about a venue.
Or if you’re just traveling. I’ve been logged out of accounts while abroad and with no access to SNS.
> I worked 80 hour weeks

I don't know how the work culture is there but that seems completely insane.

I've said it many times and I'll say it again. The first thing I tell anyone that enters the work force: Do not play the hero. You don't have to save the world. You will only be rewarded with more work. Put that passion and energy into something you created and own and control.
The paper quality of the charts is quite nice. Very good choice for some gift wrapping.
I recommend the audiobook in particular for this book.
Mozilla's abandoned web engine 'Servo' project is getting a reboot
How did the bank “make” you do this? Does your country only have one bank?
Why are you forced to have a cellphone? You're free to visit the branch anytime you like.
Indeed. Have you read the rest of the series? It just gets crazier and crazier.
how many people do you know who use 100% stock sway? certainly some people _do_. if you just want the DE to be a minimal part of how you interact with the device. then there are those who install aftermarket app launchers, swap in a different bar with media widgets, configure a dynamic background like conky, use a customized screen locker, etc.

sxmo is meant to be hacked like that. unfortunately though, as your experience shows, sxmo _has_ to be hacked like that to be usable. there isn't really so much of the "i'll just use 100% stock sxmo" the way there is sway.

ditch sxmobar. use waybar, or whatever you're comfortable using on desktop sway. hopefully the clock formatting is easier to tweak there. change the input shortcuts (drop a custom sxmo_hook_inputhandler.sh in ~/.config/sxmo/hooks or wherever). for power, i like "click power once to put phone in the unlock state; click power twice to put it in the screenoff state." doesn't matter which state you're coming from: single tap power, single tap it 3s later, you'll always end up in the screenoff state. making the shortcuts idempotent like that solves like 2/3rds of the race conditions i think you're seeing.

after twisting and pulling at it for a week to get it to actually be a DE i'm legitimately happy with, i feel sxmo has but three components which are game changing, and worth preserving: 1: bonsai, the daemon which maps button presses to actions. 2: lisgd, the gesture system (if you use it). 3: sxmo_appmenu.sh, i.e. its menuing system. the first one is actually its own, separate package: take a stock sway installation, install `bonsai`, configure the mappings, and you've got what you're familiar with from sxmo but without any of the other baggage. same with the second one. the third one, unfortunately, is not so separable from "sxmo" proper. mayhaps someone will do that someday and instead of installing sxmo, you'll instead install sway + bonsai + lisgd + "sxmenu" and it'll be a bit less coupled, a bit less buggy. i don't think sxmo is likely to evolve into that on its own though. it'll probably be that a new thing fills that "sxmenu" space instead.
It's not that they were preventing the local database unlock, they were preventing acquiring a credential to the server in order to sync any changes to/from the central store. As mentioned in a sibling comment, it's was also specifically the login endpoints that were labeled as bogus, so my suspicion is that any credential acquired before the incident may have continued to work

My 1Password for Linux was emitting `Some(Status=500)` on the console, so I'd presume they botched a rollout and then just rolled it back. Unknown why it took an hour, but maybe it's the old adage about 59 minutes to find the bolt, one minute to replace it

I don't know if 1Password/AgileBits publishes postmortems nor if they'd be of sufficient detail even if they did
What We Lose with the End of the Shuttle Program (2011)
The other big problem I see to getting buy-in from non-networking people is the lack of good sources on how to prepare and roll out ipv6. It takes forever scrolling through pages of documentation that go through the history of ipv6 and the ipv6 numbering format. As though the world needs yet another primer on how long groups of 0's can be dropped to make ::1 be a valid address. Just link to Wikipedia's page explaining ipv6 addressing and move on.
So in your opinion the sinking of the Moskva does not herald the end of surface sea power (within land-based defense range) in the missile age?
https://adds-faa.opendata.arcgis.com/
This is the setup that would prevent that scenario. Out of flight envelope, the second pilot, ( the automation ) would take over.
At https://openadapt.ai/ we are using LLMs to automate repetitive tasks in GUI interfaces. Think robotic process automation, but via learning from demonstration rather than no-code scripting.

The stack is mostly python running locally, and calling the OpenAI API (although we have plans to support offline models).

For better visual understanding, we use a custom fork of Set-of-Mark prompting (https://github.com/microsoft/SoM) deployed to EC2 (see https://github.com/OpenAdaptAI/SoM/pull/3).
If you don’t have your phone; if you’re abroad and don’t have SNS; if you’re in a building with no service; if you changed your phone number, they all suck.

Also, another valid point is that often times it’s hard to tell what’s a legitimate SNS message and what’s phishing. Their phone numbers are always gibberish and sometimes change between requests.
That’s a problem with the user, not the protocol or the system, users have been and will be always the weakest point, but they are accountable for it if it happens, not the case for sim swap attacks.
If you want to explore/understand the velocities of these relativistic apples, look into the Velocity-addition formula[1].

1: https://en.wikipedia.org/wiki/Velocity-addition_formula
An open source retrieval augmented generation (RAG) framework:

https://www.github.com/jerpint/buster
you're absolutely right, charts and plates. it's fun to realize how much aviation terminology comes from boating.
Controversy after US pornstar Whitney Wright visits Iran
Isn't the real issue here that your competitors had the authorization to see the contracts you had with other customers?
Thank you!! That's just about the workflow as where we lie today - albeit without the full suite of potency we're working towards.

I haven't actually used Onshape, so I'm not intimately familiar with their constraints system. Thank you for the recommendation, I'll have to check it out for some hints.
Climate change and acidification have the same main causes.
Very interesting, have you attempted to backtest to see if the LLM forecasts are accurate?
> While the composition officially started in 2001 - it began with 18 months of silence, and the first notes only rang out in 2003.

That's one way to launch an MVP!
Private surveillance drones will take flight Monday in St. Louis
I guess once you get to a certain point, you need to hire engineers that have strong SQL skills in order to scale.
> which allowed the firm to make its first eve trades

Ever?
Exactly, it wouldn’t be hard for the mobile providers to require sms confirmation and/or written authorisation before a number is ported out.

I don’t know if it’s government law or phone company laziness getting in the way of SIM security, but giving up on SIM security seems nonsensical and silly. Fix SIM porting security.
Threads now reaches more than 130M monthly users, up 30M from Q3
Isn’t that the system working as-designed? We don’t really need to blast the alarm for a few stalks getting bent out of shape.
Dry? It's been raining like crazy this year...
I'm interested if that's physically impossible or just currently technologically impossible
I worked for a storage startup in the South Bay in the late 00s which did something like this. After staff crunched to deliver the base operating system and kernel controllers, management gave across-the-board poor reviews to all IC staff to justify no raise. Those with the ability quickly left for greener pastures; Google hired some of the best. Only those who had to (work visas, lack of experience, etc.) remained.

The product, being a v0.1 release implemented in C, was of course plagued with data corruption and poor performance. It read /etc/password from disk on every file access. An uninitialized int caused indirect inode corruption every ~millionth write. And so on.

Because of the poor product quality, they lost multiple opportunities, including a bid for early Facebook photo storage. The company never had more than 250 customers and ended up being sold to a Valley stalwart. The CEO and VP Eng were paid out handsomely, of course; preferred converted stock tranches or whatever. My options from 4 years of employment ended up worth $500.
I absolutely hate SMS verification. Email providers want sms verification, my corporate Microsoft account wants SMS verification to login on PCs and then it also wants Microsoft Authenticator verification ! What it really wants is me to “stay logged in” all the damn time. On my Mac, outlook needs to relogin to Gmail in safari every damn time I clear safaris cache. What the god damn well hell.
What if I changed my phone number? I’d lose access to almost everything… wait is that the point ? CIA ? NSA ? KYC ?
Cmon ! The internet used to be fun, but now it’s just a hassle
Even commercial designs will cost-optimise. There's no need for extra complexity if it costs more and has lower reliability, unless they're going for planned obsolescence.