skysight-inc/HackerNews huggingface dataset:
It was pretty clear to me that the comment was a description of the respective characteristics of glibc and musl in terms of security, while avoiding any conclusion: glibc has heap hardening, which is good for security, but a complex codebase, which is bad for security. Meanwhile, musl is small and understandable, which is good for security, but with a naive codebase that lacks hardening, which is bad for security. Which is better is intentionally left to the reader to avoid flamewars.
Three women contract HIV from dirty "vampire facials" at unlicensed spa
This is interesting. It appears they implemented some of the concepts in Firejail or Bubblewrap into their version of Node. I hope more people just use Bubblewrap [1] so that when bugs in the sandbox are fixed everyone gets the fixes.

[1] - https://wiki.archlinux.org/title/Bubblewrap/Examples
Isn't the zip support in explorer the stuff written by Dave Plummer? I would imagine MS has the rights to that already, and if they don't, I'd imagine Dave would, and I'm sure he'd be fine with it being released.

He has lots of YouTube videos about the zip stuff.
I'd like to know whose control Amazon should be in ... according to this labour union.
> Lusitanian and hispanic horsemanship owes a lot to the moorish influence..., and therefore they do a lot more to put a handle on a horse

This is arguable, as one of the earliest surviving records of horsemanship in Portugal was by Dom Duarte, a king who reigned briefly around 1280. His influeces are directly from Xenophon ("nothing forced is beautiful," etc). For the prior millennia, horsemanship had spread westward and then southward from the mongols. Islam had fantastic influence on architecture, math, language, music, and all aspects of culture, but horses were something more received for them. It has also not persisted, as outside buzkashi played by arabs and throughout central asia, their horse culture has not evolved. Especially not since the renaissance when the italian, and then french, and spanish high schools developed.

If horsemanship were indeed their advantage, the kingdom of Jerusalem could not have been established either. It's fashionable to say europe was uncivilized but for its invaders, but its horsemanship predates islamic invasions.
That's disappointing: the European Commission has 100k followers on Mastodon (https://social.network.europa.eu/@EU_Commission) which seems enough to justify the continuation of this project.
WhatsApp Business web for your desktop
OLED screens work fine during the daylight, but the problem is that I afraid to increase the brightness in order not to burn the screen.
Pricing tends to be a spectrum. If I’m just getting a report which interprets some commonly-used scanners, that’s cheap(er) — this feels like a “Box Check” test if I gave it a term. When someone’s going beyond scanners and digging into source code to find issues — that’s often more valuable. Bringing specialized knowledge about cryptography to evaluate our implementation? Also more valuable!

Beyond pricing have you thought about your differentiation, or what’s special about you? Are you able to do web applications, but i.e. intending to be focusing on industrial control systems, financial systems? Are you going to be comfortable auditing C# or Rust and identifying issues? Do you know a lot about Kubernetes? Are you focusing on cloud environments, if so, are you more specialized on AWS, Azure or GCP?

Next thing I think is important to be able to answer: why award the business to you over Deloitte, or over a smaller shop with a good reputation like Cure53, Trail of Bits, TrustedSec, etc? Perhaps you’re a prolific speaker in the security community at Black Hat, Defcon, CCC, or something?

If you’re going to be a one-man band, does that rule out engagements large enough to require 5 people for a month? (Sometimes engagements are urgent and multiple people sure helps them go faster).

Good luck on the new venture.
Why is it not innovative? It is a new way of government and citizen interaction, which sounds like it is well worth the attempt. Since it didn’t catch on, the citizens voted, but offering a new communication channel for citizens doesn’t sound like it belongs onto the long list of EU critique
UK's Investigatory Powers Bill to become law despite tech world opposition
The big problem is that most passkey providers do not support actually giving users their passkeys.

As the article stated: "I want you to remember this quote and it's implications. Users should be able to use any device they choose without penalty."

As you've pointed out:

>> Backups: It depends. It seems like the big players (Google, Apple) are pushing an implementation where your passkeys are backed up either in the Google Password Manager or iCloud keychain. That way if you lose your device, you can recover your passkeys the same way you recover your other phone data.

and again:

>> Storage: It depends. Google and Apple are pushing phone implementations where passkeys are protected by a hardware security module of some sort, either the iOS keychain or Android Keystore. The private keys can't actually be stored in the HSM though, because you need to be able to back them up.

How can I get my passkeys and back them up on my own storage media? (e.g. USB drive, encrypted cloud storage, burn to a disc, etc.)

How can I import passkeys generated elsewhere?

If you cannot backup or import the passkeys, then you do not control them. They are not your passkeys--they belong to Google or Apple, etc.

And as the article states, in most cases these passkey providers do a piss poor job of managing their passkeys that they claim belong to you.
People layed off (about 10,000) in Jan 2023 were still on the books in March 2023. Termination didn't take effect until April.
Societal norms changing, government policies, free access to birth control, universal sex education, taxing the wealth of people who have too much, etc. It’s easy to implement once enough support is gained.

This likely wont happen in my lifetime. It will only change when the change is forced. When we’ve made too much of the planet a toxic waste dump then people will be forced to change.
Is this in reference to tucows?
Macs have numerous weird issues that seem to be beyond Apple to fix. My pet hate is that there's no easy way to just create a new file in Finder. On any sane operating system you'd just right-click and select "create new text file", etc and it'd create one. Macs give you nothing.

And that's before we get into WTF is going on when you hold shift and the cursor keys in a text editor. Sometimes it selects forwards like you want, but sometimes it inexplicably starts to select baskwards, selecting words and the entire paragraphs.

It's like certain key parts were written by someone having a bad day who just thought "this'll piss them off".
I know my data is skewed toward gift giving (I have an Etsy shop), and my sales number are not in the millions or even the thousands (but almost), so take what I say with a grain of salt.

Looking at my data, in the last 12 months, only ~60% of my sales go to the person buying the product. I don't have any fraud or refund requests for the last 12 months, so... I'm not sure if "the vast majority" is accurate.

Hell, 30% of my Amazon purchases go to family members, or friends. Some in other countries because it is cheaper to buy something on Amazon and have it ship to another country than trying to buy it locally and ship.
How can it be dead if "All that is left is for philosophers to propose thought experiments that make you think" is what it was always doing. That is philosophy, so if that is all there is left, then it continues on doing what it does.

And of course somewhere along the line, maybe "make you think", causes someone to think of something new and it turns into a new science. And of course, once it spawns a new science, it will no longer be called 'philosophy'.
Let me put it in terms of tech so the audience here can relate better:

The computers we have at home and in our pockets are inferior in quality to enterprise servers and mainframes, but everyone has computers and nobody is willing to go back to simple Casio calculators and slide rules.

The meats we have at home are inferior in quality to artisan meats, but everyone has meats and nobody is willing to go back to eating other people's refuse (I'm aware organ meats are perfectly fine food, but let's be real for a moment) and porridge every day.

Our access to food today is nothing short of utterly insane to people just a century ago, and rightfully noone is willing to let it go.
(this is an amazingly succinct 1-liner of a complex issue. bravo)
Looking at Tesco online in UK: there's a soy protein 'mince' a £3.72/kg. Beef or chicken mince at £5. Quorn mycoprotein at £8.33. Beyond Meat at £13.

Out of the 5 vegan and 8 vegetarian options, only the soy protein is cheaper than meat.

I might replace one meal a week with the soy protein, but I'd be concerned about long term effects of phytoestrogen, especially on growing children? Mind you many foods have some hidden soy 'bulk' nowadays.

https://www.hsph.harvard.edu/nutritionsource/soy/ relates to understanding of health benefits/detriments of soy.
Out of 10 horses there might only be a single winner, but if there are enough horse collectors there might be a lot of transactions.

Remember sometimes they joy comes from owning horses and being in the race even though horses are (almost) completely undifferentiated for the untrained eye.
I wonder if there could be a tiered system where a "dumber" LLM fields your requests but passes them on to a smarter LLM only if it finds it confidence level below some threshold.
I've noticed a few websites I frequent have quietly started using passkeys (or something very similar) outside of the normal channels. My bank now asks me to go through a second factor on my phone app that seems very similar to how passkeys work and Outlook has a similar login flow but with an additional 2 digit challenge code for some reason.

With both of these I have little sense of what is going to happen if I lose my phone or switch to a new one. So typical passkey problems.
Most important feature imo: The effective "password" being sent over the wire is essentially some hash(secret, uri). Think about the consequences for phishing!
they used to have a bug a few years ago and some windows got to be placed outside the visible area when switching displays. there was no direct way to drag them back and restarting the app most of the time did nothing, as it reopened in the same place.

there was a button somewhere on the display settings that had the purpose of moving every app to the current active screen, that one saved the day.
> I can backup and copy a passkey without restriction ...

We were so very nearly there with U2F... I did extensive testing and you can have a U2F (Fido2/webauthn) device deriving it's private keys, never leaving the device's HSM, from a BIP-44/BIP-39 seed. You write 12, 18 or 24 words down (out of a dictionary of 2048 words) and with these words, you can always reinitialize another Ledger Nano (a cryptocurrency hardware wallet but I didn't care: I was after the U2F "nano app").

It just worked. It was beautiful. My seed were written on paper sheets which I'd store in a safe at the bank / at my parents' home, etc.

As a bonus the hardware device would display, on its little screen, if you were enrolling or login (a useful info) and, for known provides, it'd display the name. For example "login to google?" / "enroll to dropbox?".

Pure beauty.

Then sadly this trainwreck that passkeys are happened, greatly lowering not only the security of 2FA (someone is in control of all your keys and they can be "backed up": what a concept!) but also making you lose the ability to backup your own keys/seed.

I do really hope at some point we see a future "passkeys nano app" for hardware devices on which the user is in control of the master seed used to derive the keys. It worked for FIDO2/webauthn. I hope it'll work again at some point in the future for passkeys.
Show HN: I made a platform to build background workflows via Node.js
The idea was to make the development and deployment of background workflows as easy as possible. (Think of some long-running AI processing, generating PDF reports, and similar).

I believe this could be a game-changer for many developers out there who need to manage background processes without the usual hassle.

Your feedback will be invaluable in helping me refine TurboQ and make it even better for our dev community.

Thanks so much for your time and thoughts!
Yeah, because Mac used to : as the separator... but, : is also an extremely commonly-used character that I have off wanted to put in a filename.
Meta's stock crashed 10% on announcing $10 bil extra in annual capex (All in GPUs)

Meta does not have unlimited financial firepower to release models for free. Its like saying you can't compete against someone who burns money. In theory true, in practice the 'someone' can run out of money.

Chinese models can get state backing. Mistral has French state backing etc. There's plenty of money to go around for huge technologies like this.
I gave up on passkeys after running Google's passkey demo and getting started example. They impement session expiration client side only. I reported it, but they said it had been reported already and they didn't intend to fix it. Seems a little careless for a tool promising improved security.
IIRC, Squeak By Example is heavily Morphic centric, which is going to immediately diverge from other language Getting Started sections. Not sure if one exists but a Getting Started that focuses on just the Workspace, the Transcript and data processing might be a better introduction to those with experience in more traditional languages.
I know you didn't but at this point I don't understand what you mean, or I'm really wrong on my interpretation on your use of the "non-conforming" qualifier.

I'm confused by your comments so I'm trying to clarify by making things more explicit.

To me, "non-conforming" here means LGBTQIA+. "cis" is the closest thing to "conforming". "trans" is pretty much "non-conforming". I suspect we are not agreeing on this. What do you mean by "they" and "non-conforming"? If we don't agree on those words, it most likely follows that I don't agree with your following sentence "This results in the discrimination you speak of."
> Money can't make a guilty man innocent.

Possibly, but the legal system does not deal with guilty or innocent. The legal system deals with probabilities (e.g. probable cause among others), deals with attempts to display intent, deals with interpretations of human language, deals with emotional arguments, and many other things that are not deterministic. Money most certainly can influence those aspects.
Your way of thinking is "sick", some kind glass-is-empty malaise, and you need to find a cure [1].

If you think art is perfect the way it is, you're not dreaming.

I want a thousand science fiction epics. The world only has Star Wars crap and bad Dune adaptations.

I want to take what's in my mind and put it to audio-visual, and play it for myself and friends.

I don't want the tech and art of today. I was born too early. I want what's next.

I have so many dreams, and for just once, I'd like them to start coming true.

This tech is a first glimpse over that hill.

[1] (Sorry, I'm not attacking you. I just wanted to use your language to grab attention. I believe this is too negative an outlook for something that will have incredible use cases.)
> I’ve avoided passkeys so far because I just don’t have a good mental model of them.

OK, so the simplest way to understand is to first know about the previous generation.

U2F keys are designed to be used alongside a username and password, as a more secure replacement for phone apps showing 6-digit codes.

In U2F the key has a hardware 'secure element' where secrets can't be extracted, even if you plug it into a compromised machine. You get a separate public/private key pair for every account and website (so it can't be used to track you between websites) and that key pair can be used to authenticate with the website. A physical button has to be pressed to authenticate, keeping it secure even if an attacker has control over your keyboard and mouse. The browser integration takes care of letting the USB key know which website is asking to authenticate. U2F keys have to be used alongside a username and password.

For a variety of reasons U2F keys never really took off. Partly cost, partly the 'what if I lose it' issue, partly lack of uptake by websites, partly difficulty using them on mobile, partly competition from 'log in with google' type systems.

So the trade group behind U2F said "Hey, maybe we could just emulate the hardware secure element in the smartphone's OS? And while we're at it, we could save the username, and use fingerprint/faceid instead of a password, eliminate that tedious button press, and automatically back up the public/private keypairs to the cloud". They kept a USB option about for the sake of tradition, but it's on life support.

So that's the mental model of a Passkey: It's like an impossible-to-clone USB hardware secure element that does challenge-response authentication to websites. Except it's emulated in OS software, and is no longer impossible to clone.

Another way of thinking of it is: It's very similar to using the 'Log in with Google' / 'Log in with Apple ID' buttons you see on many websites, you're authenticating to a service by proving you have access to a cloud account. The implementation details in the background are very different, but the result is broadly the same.
No: https://en.wikipedia.org/wiki/Cult_of_the_Dead_Cow
It truly feels like the space race in terms of building LLMs right now. Question is, who lands on the moon first?
AFAICT they call it a success because the users were happy with the quality of service, and close it because noone wants to fund it. If that reading is correct, then the 40 are happy to use a server paid for out of someone else's budget and think the admin has done a good job, but don't want to become the new admin or pay for running the server.

It reminds me of many stories of open source projects: Happy users — who don't want to pay or take over the work.
Doesn't even mention that MacOS will silently downgrade you from 60hz to 30hz, and then when you notice you'll need to unplug and replug everything, change HDMI cables, try a different adaptor, etc etc and then once you finally figure it out and fix it, it will happen again a few days later.
Just the fact that it’s connected poisons the well.
Move over SPOT, this robot dog comes with a flamethrower
Just a heads up, I'd recommend you to post this one again as a "Show HN:" with the url in the url field (links in text submissions are not clickable), this may get more traction than the current post.
Yes, the biggest problem with this mere mechanistic picture is why anything should move at all. The csci view is essentially a divine command one: the machine runs because of it's 'program' which is somehow external to the machine. But this is a metaphor/illusion for programmable devices like electronic computers, which breaks down for the actual universe.

The universe must be inherently dynamical, ie., not mere discrete states that change by rules, but properties whose nature is to interact with the world...

This is why the abstract mathematical conception of "computer" cannot describe anything physical: mathematical objects do not have temporal properties; they do not change.

This leads to the illusion, for electric devices, that the change is extrinsic to the physics of the system since we can specify the algorithm (somewhat) abstractly. But it isnt.. your pieces of meat, are in the end, the causal power which moves the liquid crystal, electric field, etc.
> MacOS is notorious for this. By default, it would only run binaries signed with an Apple-issued certificate. You can bypass this multiple different ways, of course, but that requires knowing that it can be bypassed in the first place.

What do you mean? When I compile something with a myriad of different language stacks or compiler toolchains, I'm not aware of an Apple-issued certificate ever being involved and those binaries run just fine.
Couldn't you strip void down to the bone? Or is it still too big?
Maybe. Meat consumption isn't declining as of yet.

Let's start with treating animals with respect, don't feed them (literal in some cases) trash and take hygiene way more seriously. We have a pretty good idea how disease spreads, and still there is a large fraction of farms, feed and livestock processing facilities that are absolutely disgusting by any standard.

It's not just gross, it greatly facilitates the spread and crossings of disease. We simply can no longer allow these facilities to exist: too dangerous for consumers, and food security as a whole. And the animals themselves of course.
It is the scalability. A motivated well-funded bad actor could reek total havoc.
> it is "putting security above all else"

Easy peasy. Just don't ship anything.

Duh!
> there is no reason I shouldn't be able

ios is a walled garden since day 1 it's hardly surprising and I doubt it'll change any time soon
I'll note that most of the comments refer to a different era of The Onion, known as the "Funny" era.

The more recent years have been referred to as the "Meh" era, reflecting the repetitive humor, recycling of jokes, and general lack of energy.

Every once in a while, I check back to see if The Onion got funny again. Still hoping. Maybe this purchase will be the catalyst, the peeling every onion needs over time.
I definitely read it differently, but maybe I did misunderstand them.

The commenter's focus on hypocrisy reads to me more like they take issue with the US calling China out for this rather then justifying what China is doing because they aren't the only ones.
Crazy that they would only increase the version number by this little then. version numbers truly mean nothing...
« Our mission is to grow the GDP of the internet. »

Why say this kind of crap? Everyone knows their mission is to be profitable in the payments space.
The guy is an Indian refugee from Uganda, where his family were expelled out of by Idi Amin because of ethnicity and religion. So somebody who has witnessed discrimnation and racism at a young age. When such an individual with childhood trauma finds himself in charge of the justice portofolio in a socialist government calling themselves liberals, what you get is Pre-hate-crime.
Woah, this is amazing! So tired of having to pay VPNs or Akamai to not have insane packet loss to other peers. P2P is coming back!
I respect anyone who uses Slackware, but the lack of dependency management seems tedious.
Nearly 1,300 stores are closing across the US in 2024. Here's the list
Isn't the universe the only computer in some sense?

All of the compute power we have is just an arrangement of matter to have the universe perform computations for us.
I've got ziliions on issues with SystemD. The first one, trying to shut down the machine.
I share your view. I also go past it, seeing most of the beneficial aspects of data science and AI as key blocks to building better, incrementally adaptive systems that simplify distribution of goods and services.
Ah, good to know and thanks for the link, I hadn't seen that yet.
This feels like it would have been edgy and cool 30 years ago.