skysight-inc/HackerNews huggingface dataset:
Every freaking time I get a new phone I forget the step of porting my authenticator keys. Wow, is it ever a drag trying to set them up again. Often, you need to do zoom calls to verify your identity. Takes days. This is the type of thing that will push almost everyone towards SMS. Also, it's easy for users and developers, and no one needs to learn anything. Solves these issues and we are good to go.
The alternative is to educate the users. People use SMS because they've been coerced into believing it is secure, and had the wool pulled over their eyes for $reasonsToGetYourData.
Anxiety can be much more than "I should be doing things but I'm not."

But the inverse is definitely true: procrastination is just one form of anxiety. There is no deep meaning behind it, though diving into the root of this anxiety can be quite tricky. In my case, it was both because of brain structure (I have ADHD) but also because I felt I should be doing things that I really, really do not give a damn about, but society told me I should. Medication and stopping trying to be who I am not were crucial for me.
You can see their logo on their website - https://www.20thcenturyflicks.co.uk/

There is also Street View - https://maps.app.goo.gl/SiJXmz8wYWaN9KNC8
It's pretty simple - there are people who don't have smart phones, plus people who couldn't manage to install/use a TOTP app. Something like ~10% of users probably fit in that category. So either you offer them no protection (if 2FA is optional), no use of the service (if 2FA is mandatory), or ok-but-not-great protection (if you allow SMS).

(In reality, some users don't even have SMS (no cell phone) - so automated voice calls can be offered too. Those without any phone at all...will not be considered as valid customers, in most cases.)
> Revolution is what the would-be proletariat persistently, but perhaps delusionally, assumes it will win

Occasionally, it does win. I think Marx tends to have a point about the inevitability of this given persistent class conflict, but this could play out over centuries rather than something we'll ever see.
Thanks for the reply. I had no idea people used practitioner in a derogatory way. If anything I thought it was a little hoity-toity , so that’s good to know :)
When he got close to what he wanted, he started lying about everything and anything. Eventually I realised he was trying to commit real estate fraud, and trying to illegally take over property through a series of stratagems. The lying was the giveaway. He just couldn't stop lying.

Anything and everything you asked him, he was:
- always the victim
- going to get his lawyers
- subtly threatening violence
- demanding something strange or bizarre, like documents he didn't need access to.

For people not used to it, it was a shock. He seemed affluent by every standard.
CatVM: There and Back Again [pdf]
See also Three Christs of Ypsilanti
Or, crazy idea, we do not give minimum wage paid retail sales reps the ability to control access to the online accounts of hundreds of millions of people.
Nope, I didn't equate him to Hitler, I just used a well-established example to anchor my claim "always have, always will" in history.

Musk's ambition is ultimately limited by Article II of the US constitution. So I feel pretty confident saying that he'll never reach Hitler's level.
The BF3 is a DPU, not an SBC right? Or can it be operated without a host? I'm curious about your setup.
I'd have to look at the code, but a DSA modulus is much larger than a P-521 modulus. Maybe it just happened to line up nicely?
I'm not touching it unless I have a way to export my passkeys and migrate them wherever I want.
That's just one of many. eg

+ https://github.com/jeffpar/pcjs

+ https://js-dos.com/

The Internet Archive even has a copy of TP7 that you can run in a browser: https://archive.org/details/tpuve
Usually rails-to-trails conversions happen in places where running a railway no longer makes sense. If it made economic sense for a railway to be there, the owners wouldn't be selling or donating it back to state for a conversion.
"In an interview with Foreign Policy, a NATO official said that Ukrainian first-person-view drones, known commonly as FPV drones, were responsible for two-thirds of recent Russian tank losses."

https://www.businessinsider.com/ukraine-drones-russia-tank-l...
Yes. Why are banks with TOTP so rare?!
So looks like FCC is implementing some new rules to protect against SIM swapping and that's taking effect on July 8, 2024. Though from the press release, I'm not quite sure if that'll protect the customer from a carrier employee being the bad actor.

https://www.fcc.gov/consumer-governmental-affairs/fcc-announ...

https://docs.fcc.gov/public/attachments/DOC-398483A1.pdf
Correct. Every time I've seen P-521 in a professional setting, it is the very first thing I check for.
Yes, I meant the phrase respectively! Apologies for lack of clarity.

My first computing programming class was called Computer Math. With not even a soft math emphasis.
1Password does passkeys, and they exist on multiple platforms. I assume they are not the only non-Apple/Google password app which can do this.
It always surprises me when very smart people start anthropomorphizing AI like this. I understand it shouldn't — they likely have a more developed Theory of Mind than most of us, and assuming HADD is a thing, it makes sense that their focus would be tech instead of gods or conspiracies.

Still, I think it's irresponsible, and that there's a straight line from Mr. Hinton's fantastical framing to a "successful" (in that grifters will get filthy rich preying on the praying) version of Way of the Future.
Historically, this has been hydro from surrounding states (like Washington, but also from Canadian BC). I'm not sure what it is today given current water challenges.
What's your advice to someone who lives this dynamic? I've experienced it, and felt it slowed down my career trajectory. I want to make a change in my story and will try my best to listen.
> 100 micrometers thick

1/10 of a millimeter. Thick foil (perhaps 4x generic Al foil).
TOTP is a compromise, like everything in security, and one that’s fairly secure. Until we reach a point where hardware tokens or virtual passkeys become mainstream (and their related usability issues addressed), we will be stuck with the “something you have” factor needing to temporarily move into the “something you know” factor via the the TOTP. The fact this expires within 30 seconds makes the attack vector more limited, also unlike an SMS code that providers use to verify you while on the phone with them, you never give this code out (found on a separate app) to a person on the phone, which helps separate this particular factor from SMS.

The truth is that, while it offers superior security, hardware tokens and virtual passkeys are not accessible to the masses one way or other. This is a problem that should eventually be solved but nearly all prior attempts cannot supplant the ubiquity of passwords.
Actually I maybe misspoke and I might go further than that and say that services shouldn't be allowed to make any requirements about how hardware tokens work. This means if someone wants to use a software token that should be supported.

And also I think this is why the passkey standard is bad, it sets rigid hardware requirements and the manufacturers will use this to drive planned obsolescence. If Apple and Microsoft have their way we will throw away $1000+ phones and laptops because someone found an exploit in the TPM that requires physical access.
Ah the fine line between fascist:

“if you died you were weak and deserved to die”

vs nazi:

“you are weak, you deserve to die”
> Fossil production and consumption is still increasing.

Are you talking worldwide? Or in the US? Because in the US and many other advanced economies total energy consumption is still increasing, but the total amount from fossil fuels is shrinking.

At a certain point it is going to no longer make economic sense to continue to build new fossil fuel based energy production (it already doesn't if externalities are accounted for).

It is a big hill to climb, but as the saying goes, "people vote with their wallets". Economic forces are pretty hard to resist.
In the cases I've witnessed, therapy would be pointless. They are sociopaths, pure and simple.
having up-to-date data in a world where models are updated to data as of 6 months ago doesn't seem that relevant. especially when that up-to-date data is, who is Elon calling a pedo today.
anecdote for anyone else reading about Covid related tinnitus - I've had hearing damage related tinnitus for a decade. Got Covid in April '22 which caused my existing tinnitus to 2-3x in severity, lasting a couple months before it either reverted to baseline or I got used to the new normal. Very scary experience. The CEO of Texas Roadhouse famously committed suicide due in part to severe post-Covid tinnitus.

For anyone struggling to cope with Tinnitus out there, one thing that has helped me immensely is Zen meditation. Doesn't make it go away, but builds up a control over attention with which you can cope much better.
Phishing emails don’t usually ask people to do something illegal, though.
> A/B test different resume formats

I've heard this advice a few times now, but how can you possibly know whether any differences in your resume actually result in different outcomes? Unless you notice a really extreme difference in success rate over a long period of time, it seems like the sample size is just too small to draw any conclusions.
All things equal, one is far more exciting: https://www.youtube.com/watch?v=ceijkZQI1HM
I had the ability to swap numbers for 3 carriers as a minimum wage paid Radio Shack employee.

It was just a web form with a few boxes to fill out based on customer provided info followed by enter.

Even when ID is checked, a decent fake ID is like $50 these days, and grants access to wealthy bank accounts.

At the time we were heavily incentivized to speed run anything that did not generate a commission so checking ID carefully if at all was not high on our list of priorities.
A couple of question:

- It seems the library is not published on nuget.org? (e.g. there isn't a single .csproj in the repo for contributors to jump into the project) Is there a specific reason to this?

- PicoGKRuntime is written in C++ rather than in C#. Was the performance a consideration for this or some other type of requirement?
> They're out of lives to spend and frankly, they should accept a diplomatic solution.

Maybe, but that’s not an argument against giving them military aid.
I have mine in Bitwarden but I didn't think carefully through this, I just used what I had. It looks like Vaultwarden hasn't yet added support so you can't rehost without Bitwarden but you don't need Apple or Google.
It's not a huge market, in practical terms it makes more sense for retro-inspired games to use a modern engine with self-imposed constraints rather than targeting an actual retro platform, but some developers want to go that extra mile. Another example would be Goodboy Galaxy, an original GBA game which had a very successful Kickstarter and can be bought as a real working GBA cartridge if you want.

https://www.goodboygalaxy.com
there are plenty of options for 2 factor apps that don't require login. in fact, even Google's authenticator app does not require you to login. you can use it locally and store the codes locally.
Or a government, many do this too
Americans like to believe they live in a high trust society. That must be why things like this are even possible. It brings convenience (and I guess profit, as time is money) but the trust required is very high.
The Missing Guide to AWS Lambda Logs
The state of the art really has advanced. In 1987, awk and grep seemed genuinely advanced. Now, people regularly write entire compilers from scratch.
You'd want something like this:

Truncate(
SHA-512(0x01 || message || private_key)
|| SHA-512(0x02 || message || private_key),
bitsNeeded
)

Two separate hashes, with domain separation, that produce an output of at least n+64 bits (if it is to be reduced mod 2^n - k, for some small integer k). In this case, 1024 bits reduced mod 2^521-1 is safe.

Even better, though, is to just use RFC 6979 and not implement it yourself.
I don't think anybody consciously looked at 9 zero bits and thought this is fine, but it rather looks like unfortunate effect of plugging old code into new algorithms without proper verification.
Solid.

Pun intended.
Storage costs are something we are going to be looking at soon. If we can reduce our cost of goods sold, it is possible to pass on savings to consumers.
A request is a task on the board. Usually it is a bit of work which can be accomplished in up to 2 days. If takes more than 2 days, then create a separate task.
For the Pro plan, it states "2 requests at a time" which means I'll have to work 2x harder to complete 2 tasks during the same time frame I would complete 1 request in the standard plan.
In subscription model there's no concept of "business day" and "weekend", every day is a business day. So if a client creates a task on Friday evening, for me it is still up to 2 days to complete it regardless if it's a weekend or not. Usually I try to deliver as soon as possible and to keep the high quality at the same time. I value client satisfaction and believe in long business relationships and a word of mouth.

Also, in SwiftAppLab client portal (Login button), I use Breeew for tasks and subscription management (see more at https://breeew.com/).
By the way, Breeew was built by an indie hacker and the tool is pretty powerful, convenient and user friendly.
I was surprised to see kickstarter at 21k USD to produce new NES cartridges. That system is older than most people living in the US.
I use Google Voice for this reason, so that you need to authenticate with my google account to modify anything related to my phone number. It's not perfect since there is still an internal forwarding number they could sim swap on, but it would require them associating the two numbers first, and I don't use my t-mobile number for anything outside being the forwarding number for google voice.
This is actually a pretty good comparison. It's like the $50 lock on your front door. A determined burglar can pick the lock or smash the window, no problem. But it's better than leaving the door unlocked.
Maybe that excess could have been used to offset the regular power outages we're seeing here in CA? The demand is zero when the power is out.
Anti-semitism wasn't a major factor in European history until the (second-ish part) of the 19th century, for the simple reason that the European Jewish population wasn't that big of a presence for hundreds of years. Once the Enlightenment and French Revolution happened and once the Jewish population started to get some rights (which gets us into the 19th century) then things changed.

Yes, I do know about the very unfortunate anti-semitic acts carried out in German cities as part of the First Crusade, but that kind of proves my point, starting with the 1200s-1300s the Jewish population throughout (what would later be called Western) Europe stopped being a thing.
KeePassXC: Enabling Passkey Support https://keepassxc.org/docs/KeePassXC_UserGuide#_passkeys

KeePassXC Passkeys Without Big Tech! https://www.youtube.com/watch?v=L7uXFJfxf80
I divide locking systems into three classes:

1. Can be opened without tools

2. Can be opened with generic tools (e.g. hammer, hacksaw)

3. Can be opened with specialized tools (e.g. lock picks, liquid nitrogen)
Which part of your comment do you think I failed to read?

Frankly, a secure password alone, with no second factor, is "drastically" better than a secure password with ability to change that password by SMS, as is frequently the case (a quarter of the time, per that research). So set up LastPass or 1Password for your aunt.

As for "protects her from 95% of the attacks she is likely to face", that's a number that doesn't jive with my experiences as CTO of the second largest bank in the world.

Your claim is "Because most customers, most of the time, are not under a targeted or even semi-targeted attack."

On the contrary, most customers are under automated attacks, and SMS plus password leaks lets that takeover be fully automated.
That's the beauty of it: you just keep adding solar, wind, and batteries. And with battery cell manufacturing scaling up [1] [2] [3] [4], I would expect utility scale storage deployments to skyrocket (pushing out fossil generation).

This was always the future, it simply arrived earlier than expected.

[1] https://www.bloomberg.com/news/newsletters/2024-04-12/china-... | https://archive.today/8Dy4D ("China Already Makes as Many Batteries as the Entire World Wants")

[2] https://www.pv-magazine.com/2024/04/12/catl-unveils-first-ma... ("CATL unveils first mass-producible battery storage with zero degradation")

[3] https://www.spglobal.com/marketintelligence/en/news-insights... ("Lithium-ion battery capacity to grow steadily to 2030")

[4] https://www.eia.gov/todayinenergy/detail.php?id=61202 ("U.S. battery storage capacity expected to nearly double in 2024")
Please tell me this doesn’t happen in medtech too
Fair points, especially the one about harming hackers. I am already behing a CGNAT and I got used to not being able to selfhost, I guess that's why I didn't think about this in the first place. It's true this is a huge issue
For reference: https://www.pivotaltracker.com/blog/2024-03-12-subscriptions...
"Here are pre-packaged PR points why to not pursue further antitrust action against the 21st century's largest monopoly who also pretty aggressively avoids paying their fair share in taxes."
Edward Snowden Is Among Those Sounding the Alarm over Spying Expansion
Why do you not use capital letters in the typical way?
State tax officials are using AI to go after wealthy payers
The wording:

>That being said, I explicitly give permission for anyone to use, modify, and distribute all _my original code_ for this project in any form, with or without attribution, without fear of legal consequences — unless you plan to submit your app to Apple’s App Store, in which case written permission from me is explicitly required.

so they're not doing that
An open source platform for a programming challenge hackathon
Lol Martha Stewart has $400m and she got done for $230k worth of insider trading.

And Matt Levine every now and then talks about a guy making a few million a year insider insider trading a few thousand and settling.
I know everybody says how bad SMS 2FA is, and how we should replace it with the next cool thing $BIGCORP invented (thus requiring you to have an account with them, which only defers the problem).

But couldn't we pressure the telecoms to improve it?

I have an idea that would make SIM swaps way harder to execute. Namely a website that wants to authenticate you should be able query the telecom for some kind of SIM card ID. This would happen before sending a 2FA code.

With such a feature it would be easy to store the SIM card ID in a database when enrolling the phone number. Later when the user tries to authenticate and the ID does not match what saved before, the account is locked out. For enterprise accounts you would need to explain yourself to IT and for personal accounts a fallback 2FA would have to be used. Alternatively the authentication would be delayed for a few days to give the legitimate owner of the SIM card time to react.

Another thing that could be added on top of this is to send a SMS to the old "inactive" SIM, alerting the original owner of the attack.

EDIT: To add to this, here are some advantages of SMS 2FA over time based OTP or passkeys:

1. My grandma can use it with her dumb phone and poor digital skills.
2. Your SIM card will most likely survive if your phone is destroyed due to water or physical damage. (Sadly not true for eSIM)
3. You can dictate an SMS/OTP code over the phone, or forward it to somebody you trust.
4. Banks can append a short description of what you are currently authorizing. It can tip you off in case your computer is infected with malware, or you are victim to one of those TeamViewer scams.
This has been going on for 5+ years, and there is an entire community behind this.

Typically, teenagers ranging from 14 - 19 will select targets, or “targs” to conduct a “Sim Swap” on.

Desired targets are often individuals with “rare” or “OG” handles on social media platforms, as they’re worth a lot of money. Or, individuals with large crypto wallets (Think: Coinbase, Binance, Etc)
oh, my apologies. I both use this mode and searched for the above functionality on the above link "to be sure" before commenting, but I guess I missed it.

In my feeble defense, it's hard to confirm a feature is missing T_T;;
Goddess also, actually.

https://en.m.wikipedia.org/wiki/Srinivasa_Ramanujan

Check section "Personality and spiritual life".
Indeed, that is what Sebastian Haffner argues in The Meaning of Hitler: In December 1941 he abandoned the goal of world conquest in favour of the Final solution–exterminating the Jews [1].

[1] https://en.wikipedia.org/wiki/The_Meaning_of_Hitler
Who should take over, and what powers would you grant them?
In the most simple scenario where you inject something inert (literally anything for that matter) into the exhaust stream, you increase its momentum but decrease its velocity. That means higher thrust but at the same time lower ISP. For this fusion enhanced engine here they don't seem to get anything from the fusion process energetically at all, which makes the numbers extra weird. We'll have to wait and see if this whole concept even works.
> just about everything can be reduced to computation,

This is not a precise statement. What is meant by "reduced" and "computation?" "Computation" in often used in a hand wavy manner similar to how some people use "economics" to gobble up everything.

Computation as defined in computer science is, first and foremost, not an objective phenomenon, only a formal model (inspired or meant to formalize "effective methods") that can be simulated using various natural phenomena, but primarily using pen and paper. But there is nothing objectively computational going on in those natural phenomena. An abacus is not counting. A mechanical computer isn't adding. An electronic computer isn't really computing, because there is no objective phenomenon known as computation, except as a mental operation. We call something a computer for only one reason: it can be interpreted in a computational manner.

Another feature of computation models is that they are formalizations. Formalization, by definition, involves "desemantification", leaving us with a residue of gutted forms and some syntactic rules to work with. Formalization lends itself to mechanization.

I am reminded of an adjacent observation of Russell's on the subject of physics. Physics intentionally ignores everything about reality that doesn't yield to mathematical description. That's part of the method, and indeed, a good deal of the particular success of physics, and the physical sciences in general, is due to this approach. To declare that physics is all there is is shear selection bias. You confine your investigation to only those things that physics can handle, and then declare that, because physics has been successful handling such things, physics is all there is.
Most users? Seriously doubt it.
It's an interesting question, and on the face of it, yes, the Nazi's probably would have won with the Jewish people on board. Similar arguments can be made about their invasion of Russia, given the support they would have received against Stalin without their accompanying genocide.

The big but in this, is whether they would have gotten there to begin with. Picking on the Jews was a huge cash/property grab, which was used to buy their support with general German population. Are the Nazis still the Nazis without the genocide? Do they even end up wanting to start a war?
In a way, this is similar to many meditative techniques.