skysight-inc/HackerNews huggingface dataset:
Ask HN: 2FA hell and continuous, passive biometric (re-)authentication?
How do you best handle authentication in high-security environments (ie. with PCI or HIPAA compliance issues) while still enabling people to get work done?

Consider this situation:
Zero-trust network (via Cloudflare) where the endpoint computer is specifically registered and managed.

Different customers and dev environments live on completely separate systems in multiple clouds; connecting to each one requires connecting through RDP through bastion via browser, or in some cases first connecting to a bastion host and then RDP again to the final destination, both requiring a password + either DUO confirmation or yubikey with PIN entry.

Logins timeout after 15 minutes of inactivity. This happens quite frequently (>10 times per day), because one may switch focus between remote systems or between a remote system and the local machine (to look at email, browse the web, work in Office, have a meeting etc.)

Assuming that policies for authentication timeouts cannot be changed (they seem to be driven by third-party 'standards'), the only solution I can imagine is to have biometric authentication that could automatically handle at least re-authentication requests without any user intervention (and before actually locking any computers).

This ought to be able to be be done either through FaceID on laptop itself, or even with a standalone device with its own camera or 3d face scanner. But the critical thing is that it should happen passively, after an initial (daily) login.

How does this not exist? Or how else can this be solved?
While a good rant is always appreciated, I don't see how forcing people to install an app or having an online form (which will very probably ask for your email anyway) is any better. And to avoid abuse, email masking services work quite well.

It's just funny that with Communick I have a whole Discourse site setup because I was anticipating people weary of giving out email addresses, but in the end the majority of my customers just prefer to solve issues by email.

One could dream of a world where XMPP is relevant and that most clients support its HTML submission capabilities, but this is also not the timeline we're in.
They didn't invent the smart phone, they made it accessible.

They didn't invent the tablet, they made it popular.

They didn't invent the laptop, they made it a status symbol.

They didn't invent mobile apps, they made them ubiquitous.

They don't invent much, but they improve it through industry-leading design (usually) and market it and willingly lock you into it.
are we really at a point where “software developers should be competent in math” is a hot-take?!

If most engineers truly are not familiar with basic math notation, the solution should be to teach more math to engineers, not purposefully explain things in a less formalized way.

~~I KNOW I used the terms developer/engineer interchangeably, don’t kill me~~
Or just use PHP and done.
oh wow that's gorgeous!
Unrelated, never understood why people say "free as in beer", beer is the opposite of free! I think it'd be more accurate to say free as in water or free as in air.
> with a body consisting of URL encoded data

The e-mail client decodes the URL encoded data. So you actually see plain text. The encoding is only done for the purpose of passing the data from the browser to the e-mail client.
I built a toilet occupancy light for the office. We had a long office with a single toilet, so built a battery powered closed-door detector on one side, and a mains-powered sign that indicated whether the toilet was free or not.

Very reliable, ESPHome was never an issue. This was circa 2018.
At that time you even had bitcoin faucets that gave you 0.5-1-5 btc to play around. Or you could just run a miner on your gpu and get 50btc if you ran it for a few days or so - a ton of people probably have those on some partition on an old laptop or sth.
Yeah, that's the one I meant. It would've been fine if he was the only one using Tor, but:

- Guerilla mail let the FBI know it was being accessed with Tor (or they saw it in the email header)

- You have to login to use Harvard wifi with your student account, which means they could see who was using Tor.

If anything, Harvard wifi is the honeypot.
Yes, see Amazon HQ in Virginia.
Anything can be made better for 3x the price.
I would say that SMS and invasive email services are sketchier than using .xyz.
I also think that the "self-hosted" requirement is an over-reach. It would be sufficient to require some standardized commodity that can, in principle, be self-hosted, but is available in an equivalent form from multiple unaffiliated third parties. E.g., a WebDAV folder.
RISC-V moved to Switzerland because many of their members are Chinese and it was looking like that was going to be very complicated if there were US sanctions on Chinese tech firms.. not because of some fear the US would interfere in the actual running of the org.
That's a nice history lesson but sideloading alternate appstores (namely F-Droid) on Android works great and Apple shouldn't be allowed to forbid the same on iOS. And I don't give a damn about the "grandma conned into sideloading scam apps" scenario. Grandma is getting scammed over regular phonecalls already anyway.
I can empathize with the author after moving away from Toronto almost 20 years ago, so much from when I was a teenager is gone. I'm not "from" where I live now, and where I'm "from" no longer exists, I just feel perpetually detached from everywhere now.
As a senior dev I’d love to mentor, but my imposter syndrome tells me that I don’t have anything meaningful to share because all my success has been a fluke
Surely the ethics are more complicated then just following robots.txt or not. The intended usage counts, and that isn't captured in robots.txt.
Some of these folks are definitely not qualified to mentor anyone.
Hope it will not hurt your productivity
> They could have IPO'd for less money ;) Then they wouldn't have needed to squeeze so hard.

In retrospect maybe, but 2020s was the time of scaling a company and you needed capital to do so.

Could it be that they fell victim to bad market timing and if the markets would have continued to be like 2019-2020, their shares would be at $160 and not $32?
Part of the trouble with 3D printing is that its utility is limited if you don’t know how to design, and not everyone wants to learn.

If you have no CAD/modeling experience, making something custom is limited to the simple variation available in the software, or you just buy off the shelf models. 3D printing skeptics said that 3D printers were just for making worthless junk.

There’s an opportunity coming with an LLM-style text-to-model generator. I saw one recently and it is pretty exciting.
Don't worry, some of the people on this list probably have nothing meaningful to share.

e.g. a university student (2025 grad) who is working part time is in this list.
Rust's async/await design makes a lot of sense when you consider its primary goals (C interop, low level control, zero cost abstractions, etc.). Sure, perhaps most of us should be using a language with different constraints as opposed to Rust.
AI Pin and Personal Assistant Hardware
I mean, do we really need to assume a preconfigured basis in order for wealth and power to be “incentivized”? They’re pretty self-incentivizing and built into human societies. On the other hand, I think you’d have to figure out some pretty radical rules and enforcement strategies to decouple the incentives from wealth and power. That presumably would require both wealth and power. Seems internally inconsistent.
I only got a proof-of-concept working, but I made a board that would allow payment for arcade games and pinball machines over wi-fi without disabling the coin slot. Free-play can be enabled by sensing the P1 and P2 start buttons. Security was an interesting puzzle because the 8266 ran out of memory when trying to host an SSL stack, so I went with HMAC signed messages.
How not to release historic source code
It's worse: there are regulations (called "sanctions" and "KYC") that force companies to pull the rug.
Interesting point. But, does the data contain enough information to perfectly model the generative process? Maybe even a very complex and capable model like "the human brain" would fail to model the datset better than large transformers, if that was the only thing they ever saw.

You and me can model the dataset better, but we're already "pre-trained" on reality for decades.

Just because the dataset is large doesn't mean it contains useful information.
I was wrong. It was a joke. Please don’t tell the phone manufacturers this. I want my phone to last at least a few years.
India's ICICI Bank exposed credit cards to 'wrong' users
I disagree. _I_ think that when companies become a "necessity" like this, they end up resting on their laurels because they won the economic game. And what happens next will happen regardless of regulation or not: They will begin their long but steady decline into irrelevance.

I state this as a huge Apple fan since 1984 when my family bought the first Mac: The best things to ever happen to Apple were almost dying in 1997, and (essentially, despite the M chips being fantastic technologically) losing the PC war (which I will argue was not due to price, but to 2 things: 1) failure to embrace the AAA gaming market and thus the mindshare of the next generation, and 2) re-closing the Mac platform after it was open, which it only did because the news kept reporting only on the impact to Apple sales and not the overall Mac market, which was actually growing at the time!)

> And don't get me started on non standard USB

Do you mean Lightning? That was a massive improvement (both physically in terms of design, by being reversible and supporting higher voltages as well as being durable) on both mini and micro USB and came out long before USB-C existed. And to this day, Apple devices are STILL some of the few devices that fully support the USB-C spec, as opposed to all the Chinese crapware that uses a USB-C plug but will fail to charge when plugged into anything but a USB-A charger because someone picked the cheap way out.
A preference for level two is what got us a general theory of relativity and, subsequently, working global positioning satellite technology. Having a cognitive bias toward visual presentations of planes in 3D and higher space leads to techno-scientific stagnation.
The initial version of ripgrep was absolutely a rapid prototype.

I do rapid prototyping all the time.

I'm not saying Rust is good for game dev, but the idea that Rust cannot be used for rapid prototyping in any context is a myth.
> The Hubris IPC scheme is deliberately designed to work a lot like a function call, at least from the perspective of the client.

That's a bona fide remote procedure call, isn't it?
It’s not advanced alien technology because it doesn’t work like advanced alien technology.
Ok, you’re building a service that scrapes e.g., property rental websites to find entries that are trying to scam naive renters.

The property websites are incompetent to solve the problem, or don’t care, but either way they sure don’t want you scraping their valuable data.

Is it still unethical?
There is Mitogen [0] that helps a bit. Their website also kind of explain some of the issues:

> Requiring minimal configuration changes, it updates Ansible’s slow and wasteful shell-centric implementation with pure-Python equivalents, invoked via highly efficient remote procedure calls to persistent interpreters tunnelled over SSH. No changes are required to target hosts.

Then of course python itself is not very performant and yaml is quite the mess too. With ansible, you have global variables, group level variables that can override them, host level variables that can override those, role level variables, play/book level variables that can override those and ad-hoc level variables that can override all of the above. I am telling you, it can get incredibly messy and needlessly complicated quickly.

As I said though, it's still the best we've got even if not optimal. So I think it's a good idea to implement it to at least have something.

[0]: https://mitogen.networkgenomics.com/ansible_detailed.html
> Sorry for the lag.

No worries.

> It feels to me like we're arguing the same corner but we don't have a common language.

That's possible. It's actually a deep philosophical question. Do planets "solve Newton's equations of motion" when they move? On the one hand, they move in ways that correspond to solutions to those equations, and so one could say that they "find solutions" to those equations. On the other hand, the process by which they do this is pretty clearly radically different than what a mathematician does when they solve equations.

> So you're a roboticist?

I used to be. I've been out of the field for over 20 years now. But back in the day I was pretty well known.
Apple grew from Big Brother into it’s own Big Sister
"....why doesn't that throw in every EDA tool?"

This would require repetitive SPICE simulations, or basic rule checking at the very least. Nobody does full SPICE simulations at the board level however basic input/output port checking (usually in the ERC check) does get performed. Even with RF designs, you carve out the piece you need to examine or design and simulate that. For the chips I've worked on, the full chip would get a SPICE simulation that would take days/weeks but this was for more R+D oriented mixed signal designs. I guess what I'm saying is the simulation of a circuit is best performed as a deliberate, iterative step in the circuit design process.

When it comes to layout however, you do get hints from the DRC checking tool (Design Rule Constraints) that will tell you if your trace is drawn incorrectly based on the DRC constraints and nowadays sometimes from an EM simulation that can be run in the background.

Completely automated design especially for analog will most likely never be a thing for the other reasons you list. However, I already can use "known good" circuits and modularize them for reuse which does speed things up. This is critical in the ASIC world due to the large hierarchies in the design. Modular reuse is also a growing tool in the PCB world. Cadence now has a very nice module/reuse tool that can even detect and create modules to prevent you from having to redraw the layout for a sub-circuit multiple times if its not instantiated as a module already. I always like when more people want to get involved in HW, but what the OP is showing largely exists in the form of TCL and SKILL scripts in current EDA SW packages.
Maybe the article should be titled "Self-hosting forms, the n8n way" then, because if I was working with a dev who did this I would definitely question their sanity.

But as an article about a cool way to utilize n8n, this is fair, and perhaps even elegant.
This, and the fact that correctness and safety and stability aren't quite as important in game development, or even game engine development, as they are in other fields where rust is applicable, is why I purposefully happily use the powerful, futureful, well established, copiously documented C or C++ libraries I need, instead of tge Rust alternatives, for almost everything. It works extremely well for me because I get to leverage the power and amazing ecosystem around things like dear imgui or sdl2 or opengl or physx, while being able to use rust, which grants me essentially a cleaner, even more modern version of C++ with all of the features I love from ocaml, in a way that restricts any weird crash or memory safety errors to the places where I interface with the lower level libraries, and sometimes not even there, depending on how high level the bindings are. It's honestly pretty nice for me.
I love that! Now I am seriously tempted to hack up the control unit of my Fully and get it into Home Assistant so I can adjust the desk with a slider on the laptop for ... reasons.
You have neatly summarized why I feel strongly that the Internet has become a liability to humanity. I have no illusions that we can shut it down or walk away… but on a personal level I am trying harder than ever to remove it from my own life. If I can stay off Reddit, well, I can eventually remove it all I think!
I like this idea, any recommendations on specific CO2 sensor modules?
Show HN: I built a drop-in replacement for deprecated Google QR code API
Since Google QR code API seem discontinued maintain (404 when you call the API), I built a drop-in replacement for it. Please try it via interactive docs.
Should I split it into dedicated sub domain, like google.qr-api.com
Now, if we just add Sloot's compression technique, we can include an entire movie library on a single cartridge! https://en.wikipedia.org/wiki/Sloot_Digital_Coding_System
Writing out the constraints. The starting point was an admin_notes table to start with, where each note initially had the same fields; we later added different categories of notes, where two of the categories had fields that were only meaningful for that category. What I did was add nullable columns for all of the category-specific fields to the table, with constraints to make the category-specific columns only have values for rows of the appropriate category. The type looked roughly like this (using Rust syntax) [1]:

struct AdminNote {
id: String,
text: String,
category: CategorySpecificData,
}

enum CategorySpecificData {
GeneralRequest,
InitialRequestForm {
appliesToBasicRequestDetails: bool,
appliesToSubjectAreas: bool,
appliesToAttendees: bool,
},
SupportingDocuments,
ConsultSession,
AdviceLetter {
appliesToMeetingSummary: bool,
appliesToNextSteps: bool,
},
}

Setting up the constraints took about 30 lines of SQL just for those couple of boolean fields on some of the categories, you can see the details here [2].

As far as making this a Postgres extension - I'm not sure how useful it would be when the application language doesn't have a notion of sum types. Thinking about it, what might be more useful would be a language-specific library for data validation/constraints that sets up the database constraints as well. I'm not sure, though.

[1] We weren't using Rust, this was in Go, but I figured this was the most succinct way to summarize it. Our GraphQL schema for this type was basically the equivalent of this.

[2] https://github.com/CMSgov/easi-app/blob/main/migrations/V164...
I use it to monitor my water meter in Home Assistant and have one sensor that reads various values (e.g. water temperature) from our domestic water heat pump via Modbus. The latter one could also be controlled with the ESP, however writing to Modbus makes me feel a little uneasy (that is mostly due to lacking documentation by the manufacturer, who apparently outsourced the firmware part).
This has nothing to do with the classic Apple vs Android debate. It's about Apple's practices of pushing people to purchase the iPhone even if they might not want to.
The main problem is all the kooks who will dispute an overdue payment by citing the Constitution, the Flag Code, and the Magna Carta. You can’t have support staff engaging with these people.
No I really don't think I am.

In fact 98% of the revenue on apps come from free apps.
I built a little robot that props open a door when the av cabinet gets too hot. It has a temperature sensor, two fans and a linear actuator. It even has a small webui so I can manually enable/disable cooling. Been working for several years.
I would think you’d also at least have to be patio11, Inc., with business liability insurance and documented processes. No individual is going to be trusted by any company that would care about this threat model.
One possibility could be that they actually never achieved product market fit: They went viral with their free offering, but those were just users not customers.

1. When it came time to pay, they actually didn't have many customers.

2. The price-points at which they were selling licenses at meant customers would need to be among the Fortune 5000: their sales cycles are long, complicated and expensive
If you have a noble intent, you ask the webmaster for permission to use the data. Surely if they agree with your assessment that your intent is indeed noble, then you'll be given consent.

I run a search engine and an internet crawler. I do this all the time. To this date I've never had a webmaster that didn't permit my crawler access when I've asked nicely.
If I hit "submit" on a form and I saw it start to open a new Gmail tab in my browser, I'm going to close the new Gmail tab before it even has time to finish loading. (Or same if I saw it opening Mail.app.)

I'd just assume the site was trying to trigger some kind of spam e-mail or something.

The idea that I'd fill out a form on a site, then submitting it would open my mail program, and I'd then have to hit send there, and then close my mail tab/window (not to mention exposing my e-mail address to the site when maybe I wouldn't want to), is some of the worst UX I've ever heard of.
Here is another interview:

http://www-optima.amp.i.kyoto-u.ac.jp/ORB/issue21/interview_...
He’s right that “open” isn’t necessarily good. “Sharing” sounds nice but also leads to fragmentation and distraction.

Android chose an “open” model and ended up failing on its primary goal as a mobile OS experience, even if some components of android went on to be popular for other applications. It led to chaotic device fragmentation, nearly every major Android vendor going bankrupt , and Google running effectively a charity unit (Pixel) to keep it alive. It only carries on with search engine subsidies.

Apple chose “closed” to the chagrin of hacker news “experts”. But the truth that “closed” iOS is a very lucrative, high-margin business.

“Open source” sounds nice, but as we’ve seen, many dedicated open source developers end up burned out and under-compensated.

“Open” can be a good thing, but is not a guarantee of producing positive outcomes.
This is utterly false: https://www.youtube.com/watch?v=bnBsIAiZfFc

You could always edit artwork in iTunes. Indeed, you could import albums from your own CDs and not even use the iTunes Music Store at all.
Nope, you are: I never said the consumer base size is strictly zero, what I'm saying is that it's not the market driving the pursuit of this technology (as can be seen by the low traction compared to the enormous expanses it incurs on Facebook and Apple) but the ideology of technological inevitability, and the desire of the big corporations to create a new market from scratch in opposition to consumers preference (who aren't really interested).

But there is “no market” in the sense that it's just a heavily subsidized product (except the subsidies come from private companies and not from the public sector) and if it wasn't driven by this multi billion yearly subsidies, the product would not even exist.
Sure, open 5 tabs named mod.rs, so which mod are you in?
The fact that 100% of the CPU is being used, and multiple systems are executing in parallel, shows otherwise.