skysight-inc/HackerNews huggingface dataset:
Show HN: Passkey auth library for web apps
Hi Everyone For the past 6 months or so I've been working on a passkey authentication library/framework. What motivated me to do this?

Every project I've worked on required authentication - typically username/password + two factor auth. Doing this properly is hard, making the process frictionless is even harder. Auth0, AWS Cognito etc. have become pretty bloated over the years and you're kinda locked in.

Passkeys are both secure (much more so than passwords) AND frictionless. There are a few libraries out there (e.g. SimpleWebauthn - which is great) but due to the cryptographic element, they have pretty specific backend requirements e.g. Node 20+.

I wanted to offload the backend aspect to the cloud, so devs using Cloudflare, Vercel, .NET, Django or anything else could adopt passkeys. Whilst the main focus is passkeys, I've also included some broader authentication features.

Demos: https://passlock.dev/#demo and https://d1rl0ue18b0151.cloudfront.net (SvelteKit project)

Features:

- Passkey registration & authentication

- Biometrics (e.g TouchID, FaceID)

- Social sign in (currently only Google)

- Mailbox verification mails

- User management console

- Audit trail

Features I'm currently working on:

- JWTs (Verify auth claims locally)

- Notification emails (e.g. Login from a new device)

- More browser/device workarounds (Browsers often don't comply with the standards!)

- Starter projects/templates for different frameworks

At some point I may release a self-hosted backend (probably as a Docker image). For now I'm hosting it myself, but AWS have been awesome, providing me with a load of credits

I've built a starter project/template for SvelteKit, and I hope to develop some more. I'd love to know what tech stack you're using so I can put together some samples. Regardless of whether anyone uses Passlock, I really hope we can all move away from passwords and start adopting passkeys :)
It has gotten really terrible , some examples :

1. Site diversity is non existant . Nearly every term results same handful sites. Proof [0]

2. Actual blogs are not shown in serps . I have to use blogger and wordpress in search term to find blogs but it exculdes all the blogs that are not blogger or wordpress .

3. Way too much focus on reddit compared to all other forums. Its like both people and google both forgot forums other than reddit exist.

4. Too many non related articles .

5. Got too many seo optimized junk ? Just go to page ten or twenty . Turns out google now capped search results to a few hundred . And bing ? The pages become irrelevant at the later pages.

Workarounds I use :

1. Adding hackernews does improve my serp that are related to to tech .

2. limiting my search results to a old date/month improves the serp .

3. Marginalia [1] and kagi occasionally helps .

4. Sometimes I use absurdly long keywords .

5. Sometimes i use a search engine from here [2] to see if it gives better results or not which usually turn out to be not .

6. Yandex sometimes work but not always .

In short : The current search quality is terrible and finding smallweb ,forums and blogs are even more difficult .

[0] https://detailed.com/google-control/

[1] https://search.marginalia.nu/

[2] https://seirdy.one/posts/2021/03/10/search-engines-with-own-...
Thanks god i live in the EU and not in a late stage capitalist hell hole XD
Media Query Checker
I'd tend to agree with your understanding of the path Rust's development took, but it is certainly not clear cut which led to which. I am certainly willing to be corrected (my memory is getting rough at this point in my life), but I remember the bifurcation of mutability and alias-ability being present in Graydon's original pitch deck, which existed as a prototype with garbage collection being expected to exist. Then after some work, I thought the language devs realized that with some extra rules, which became the lifetime semantics, there was a feasible method for not requiring a garbage collector, but still remain fairly free of manual/explicit memory management by developers.
I’m becoming more of the mind that humans communicate more like birds or whales. There’s a general sound or frequency that everyone is humming. The spam isn’t fodder, it’s the collective “song” of humans at the moment.

I don’t think people say anything unique, and LLMs are proving it. We’re all kinda humming the same tunes. It’s why you won’t read anything new here or anywhere, you’ll read the same old story or hear the same old song.

I guess I’m saying humans in general communicate with spam, a buzz.
Yeah I think they’ve drawn a bright line and people keep insisting this device should be more capable, but Apple _does not want it to be more capable_. They just don’t. They don’t see it as a productivity device (though they often advertise it as one for some reason). It’s like… productivity-lite. A device for unserious people to do unserious things.
Thanks, I made them with GarageBand and Audacity, I think. The check sound is made from a recording of my girlfriend with added echoes ;-)
> There's a reason the EU doesn't have many successful companies

I'm sorry, what? What could possibly make you think that?
I won't buy meat at Walmart. The couple times I have, it looks great in the package, but when you open it, half the weight is a big fat cap on the bottom. I've seen it happen several times. It's often cuts that should go to a grinder or other use, but not fit for use as a steak.

I avoid fresh produce at Walmart as well, mostly in that the selection usually kind of sucks. There are more and better options around. As to Butchers, there isn't really a dedicated one near me, have to drive halfway across town. But a local grocery chain does have Butchers, but special cuts usually take a few days to get in.
Because it's easy to do and gives people a sense of creative expression.

It gives them an easy "sense of pride and accomplishment".
The ultimate spam engine would be one that figures out how to bypass account creation and reputation systems.

Just like here on HN, some random can create a hundred accounts but their green username posting AI junk isn’t going to rank them. Nor will the various spam detection algorithms around networks and user behaviour be suddenly bypassed. Nor will user reporting if they do get ranked.

The “write believable texts” thing is only one small portion of a very complicated problem.

The only real usecase is a human using it to juice their own feeds or paying decent $$ for real accounts (there aren’t that many on the market IRL). Which isn’t automated spam that we need to fear taking over the internet. That doesn’t scale.
So why haven't I or anyone else here with Androids been hacked already, if it's so "simple"?
Rice has a methane problem that a startup is promising to fix
Can we please bring back the one-click "Disable Javascript" feature in the Develop menu?
That raises some very important questions: what is the cotton-candy/human crush depth equivalent? How much buoyancy would I have?

Like, can I swim in this cotton candy planet? How deep can I get in the cotton candy clouds or will I just sink and get candy crushed?
Probably just to sell the account. There is a market for social media accounts that already have 1000s of followers.
This all sounds very good for open markets and capitalism. As a consumer I should benefit, and well-run hotels too, I suppose, if I were ever to stay in one.
Hacker News/API: Documentation and Samples for the Official HN API
I think the European countries are more "capitalist with benefits" than "socialist". They have strong governments and better protections for the lower classes, different campaign financing methods (which influences who can run and win), stronger regulatory bodies, sensible welfare programs, nationalized healthcare, etc.

But they're still fundamentally capitalist. Their revenue comes from the taxation of capitalist ventures. Very few of the means of production are owned by the people or state. They just do a better job of skimming off that top and putting it to social use. A lot of East Asia is like that too.

The social democracies in Nordic countries are a bit different though, with Norway's state owning or partially owning some of the enterprises that drive their GDP. But there is still private ownership there.

The US by contrast prefers to let the rich keep their money at the expense of everyone else. And they use some of it to buy off the political class, so there's no incentive for the politicians to change the system, especially when both major parties are corrupt and conspire against third parties gaining power.
This is like saying "startups have no clear financial motivation, they just gather customers and bleed money"

The purpose is always money and influence. There's rarely someine in "for the lulz"
Floss Weekly Episode 782: Nitric – In Search of the Right Knob
Even before that the Nazis used IBM machines to create a pretty efficient analog database of the Jewish population to track and murder them.

An evil regime didn't even need computers for a database to be dangerous, computers just made it much more efficient and scarier.
It's a milestone, not a barrier.
Exit a Page Quickly
agreed... we should rename it sadtech
Good update from the previous one. Atleast they now have data and information till October 2023.
> We know Tik Tok was used specifically for these effects.

I know no such thing, and this is the first I'm hearing of anyone saying it's used for social upheaval, denial of consensus reality, or sabotage.
Sounds like you’re not out in the “real world” enough if you think that. At least it’s absolutely not what I observe offline. But online sure; because most of it is algorithm driven
I strongly agree with almost everything Federico complains about in this article, especially file management like you mention. It is a pain point. It doesn't mean iPads aren't great for a lot of these things.

I have different nitpicks about any system I use; it doesn't disqualify it from being legitimately good for X task.
TSMC says can make next generation chips without ASML's new machine
Who's idea was the singing AIs? What specifically did you want to highlight with that part of the demo?

I imagine that there is a lot of usage at the HQ, human + AI karaoke?
You want to hire a 120k/year person to maintain 10 GPUs?
Intelligence, incremental/online learning and autonomy are the things that need to be solved before these would be capable of general tasks in an unstructured setting (e.g. domestic use).

I seriously doubt we'll ever see humanoid form factor robots used in a domestic setting, and even in a factory setting the form factor is basically a gimmick. Why does a factory robot need (or want!) legs when an upper torso on a wheeled base would do the job better?!
> So, in general Claude still beats newest GPT-4o model in software development category, right? [1]

I'm genuinely curious to which extent widely published benchmarks can be used for this kind of assessment. The exercises this benchmark uses seem to be available in https://github.com/exercism/python/tree/main/exercises, and it seems that there are solutions at least at https://exercism.org/tracks/python/exercises/series/solution....

Overfitting used to be a concern when it came to comparing ML models, but it feels like it's not being talked about that much anymore, is it? What if one model has the exercism solutions in its training data, but the other model doesn't, is the comparison still fair? If it solves 70% of the exercism exercises correctly, would it perform as well on similar prompting for unseen problems (which are more likely to be what I care about)?
Thanks for the response! I'm going to try some of your workarounds, particularly the search results date.

It would be cool to have a search engine that folks specifically on public forum results.
I think if you use them out of the box, they won't generate the alerts. If I understand Apple's data model correctly, once I paired them to my iPad for the first time, they were enrolled to my iCloud account, and then the tracking system was enabled.
That's a very weak form. The way I use "agentic" is that it is trained to optimize the success of an agent, not just predict the next token.

The obvious way to to that is for it to plan a set of actions and evalute each possible way to reach some goal (or avoid an anti-goal). Kind of what AlphaZeros is doing for games. Q* is rumored to be a generalization of this.
There’s a middle ground:

For cloud-like provisioning experiences and paying by the hour you can use DigitalOcean, Vultr, or alternatives.

Deploying GPUs? Something like CoreWeave may be optimal.

Want inexpensive costs for dedicated hosts? Hetzner, OVH.

There are many, many advantages to using AWS but equally many alternatives that are viable and which aren’t “doing it yourself” in a hardware and network sense.

None of this is to say DIY is a terrible choice either and everyone’s got an opportunity to consider time (initial setup; ongoing maint), costs, and also expertise and ability to do a good job.
> A professional developer does thorough work when it matters, and cuts irrelevant corners that aren’t worth wasting time on.

I think the most pertinent question here is: whose time?
IMO a bigger problem is that the social media giants will be perfectly happy to allow AI-generated content as long as it makes them money. My Facebook feed these days is a graveyard of nonsense loosely connected to things I clicked on once. The AI generated text is useful filler for them.
Yeah if they had to ask the question twice as it wasn't listening, on social media and the press it would morph into "how it couldn't understand".
Naturally, in a large volume of normal conversation, the most common words are going to repeat most frequently (see Zipf’s law). Therefore, getting a lot of input is still (a form of) spaced repetition, just not a conscious one.

In fact, it has been hypothesized (Krashen’s input hypothesis) that adults also acquire language subconsciously through input. We just spend less time on it than children.
The usual way that barriers were implemented was to simply stall the CPU pipeline. So yes, they do indeed have blocking semantics. IIRC mfence still does stall the pipeline on x86, but I think the CPU is a bit smarter for locked instructions.
The way AI is being positioned as a cure for the problems that AI caused (or at least massively exacerbated) in particular makes it feel like a racket. Google is becoming unusable due to LLM-driven content farms? Try our new LLM-powered search engine instead! It may not work very well but we've made sure to completely destroy the traditional way of finding information online so you don't have much of a choice.
I'm not sure why this old post showed up, but I'm here for your 8085 questions :-)
On iPadOS 15, I can find no Multitasking selection under Home Screen & Dock, as described in the 9to5mac article (2020), which specifies iPadOS 13.
VMware Desktop Hypervisor Pro Apps Now Available for Personal Use
Sure, but it's a large sample based on self-report instruments.

This is definitely evidence, but I do share the OP's concerns around controls and would regard this finding as somewhat likely to be biased by the kinds of people who both a) have internet and b) are willing to respond to a really, really long poll.
Interplanetary File System
Maybe earth could look like this if we put enough satellites in orbit.
> yet (most) people did the right thing and disclosed their finds responsibly.

How would you know? I'm not a security researcher and still know that there were always multiple avenues for selling vulns, and most weren't public.

So really, what makes you think you can make that statement with any kind of confidence?
Not recently, but since 2013 or so it declines constantly. Still, I'm able to get what I need, but it became so cumbersome. Someone did search engine optimization, I guess :)
Poe's Law?

https://finance.yahoo.com/news/us-spy-chief-cannot-rule-1627...

> Lawmakers have long voiced concerns that the Chinese government could access user data or influence what people see on the app, including pushing content to stoke U.S. political divisions.

https://www.npr.org/2024/04/26/1247347363/china-tiktok-natio...

> National security is at the heart of bipartisan concerns in Washington motivating the law. Lawmakers say they're worried the Chinese government could lean on ByteDance in order to use TikTok to suck up Americans' data, surveil them, and spread false and misleading claims to U.S. voters.
It felt like a videogame for me
Firefox search update
(Materialize CTO here.)

> It's becoming more mainstream with Materialize, which is technically open-source, but they are quite aggressive with pushing their expensive cloud and offuscating on-prem usage.

Quick but important clarification: Materialize is source available, not open source. We've been licensed under the BSL [0] from the beginning. We feel that the BSL is the best way to ensure we can build a sustainable business to fund Materialize's development, while still contributing our research advances back to the scientific community.

> Quite underrated, it has so much promise.

I'm glad you think so. We think so too. One of the best parts of my job is watching the "aha" moment our prospects have when they realize how much of the complex code they've been writing is neatly expressed as a SUBSCRIBE over a SQL materialized view.

[0]: https://github.com/MaterializeInc/materialize/blob/main/LICE...
Lithobraking is a favorite of mine.
And yet the watch still requires you to pair it with a phone. They could sell standalone watches without a phone and will cellular service. They won’t though and Apple’s statements about environmentalism are b.s. for this an other reasons.
Super interesting, but the the article has no explanation.
What technology is used instead?

ASML NA lithography from the current generation with upgrades? (most likely)

Nanoimprint lithography from Canon? (extremely unlikely)
> What can one even do with a clusterfuck like this?

Distribute it on another domain if it's because of "Automated ban may have been issued due to cracked software distributed elsewhere which may connect to original domain?"?
I think the question isn't so much whether Apple users want multiuser support. Rather the question is whether Apple wants customers who can't afford to buy one of each sort of device for each family member.
text-wrap: balance

As someone who appreciates typography, that's a very nice addition.

Off-topic: I can only hope that both "text-box-trim" and "margin-trim" come to all browsers soon, since they would be meaningful improvements in web typography.
In all seriousness I suspect that’s our present. How many people feed bullet points into ChatGPT and get it to write out full paragraphs, only for the recipient to take the paragraphs and ask ChatGPT to summarize them? We’ve invented a uniquely bloated data transmission format that exists just for appearances.
The iPad's Sins
Tesla labour dispute triggers Nordic sympathy strikes
Tornado Cash Developer Convicted of Money Laundering
This is bigger than the greed of any group of people. This is a technological sea change that is going to displace and obsolesce certain kinds of work no matter where the money goes. Even if open models win where no single entity or group makes a large pile of money, STILL the follow-on effects from wide access to models trained on all public data will unfold.

People who try to prevent models from training on all available data will simply lose to people who don’t, and eventually the maximally-trained models will proliferate. There’s no stopping it.

Assume a world where models proliferate that are trained on all publicly-accessible data. Whatever those models can do for free, humans will have a hard time charging money for.

That’s the sea change. Whoever happens to make money through that sea change is a sub-plot of the sea change, not the cause of it.

If you want to make money in this new environment, you basically have to produce or do things that models cannot. That’s the sink or swim line.

If most people start drowning then governments will be forced to tax whoever isn’t drowning and implement UBI.
Tile likely won't support Android Find My Device. Builds satellite-based network
Study supports theory humans evolved to run long distances to capture prey
I almost never use Google Search for real queries anymore. ChatGPT is where I get most info these days. For businesses it's Google Maps. For everything else it's usually Wikipedia or reddit. A generic query on Google with no qualifiers is just going to get you SEO spam -- and that's after I manually blacklisted many sites (quora, etc.)
The internet already isn't truly anonymous with how people actually use it. People are logged into a bunch of accounts that are traceable to them and also rarely mask their IP. With how much stuff I've paid for over the internet there's probably a double digit number of companies with my entire name and current address.
I'm about to move into ARM development for a new-ish AI accelerator. Until now, I've mostly developed for x86.

In preparation for this, I've been reading up on ARM's looser memory consistency model, and C++'s rules regarding this. It's been pretty eye-opening.

I'm looking forward to seeing how much that ARM codebase takes advantage of the weaker guarantees that ARM permits. It seems like a trade-off of scalability vs. correct-code complexity.
Why is an FPGA not used in a mobile phone?
Prompt injecting their own article would indeed be an incredible show of incompetence by the New York Times. I'm confident that they're not so dumb that they put their article in their prompt and were astonished when the reply could reproduce the prompt.

Rather, the actual culprit is almost certainly overfitting. The articles in question were pasted many times on different websites, showing up in the training data repeatedly. Enough of this leads to memorization.
Tesla is sued over emissions from California plant
If I have this right, what you've built is this, storing M items in M / N nodes where N is the radix of the array?

0 1 M / Nth node
[ N elem ] [.] -> [N elem] [.] -> .... -> [M - (M / N) elem] [null]

And so if you want to index the `i`th element you chase the pointers

index (node i) :
acc = 0
while acc + N < i
acc += N
node = node.next
return node.array[j - acc]

Or something like that? You can do better using a B tree and exploit the fact that you don't need keys to just store pointers in the branch nodes. This reduces the number of pointer dereferences in large arrays.

For example say you have N = 8 and there are 1024 elements in the list, you would need 127 pointer dereferences to reach the end of the array. In a B-tree you only have 3. (double check my math, I might be off by one).

This is the typical implementation for immutable/persistent vector types. If you keep the links between leave nodes at the bottom of the tree, you've got a B+ tree and have fast iteration through it as well.
> Siri was the "glimpse" and ChatGPT is probably the reality.

Agree. Can't wait to see how it'll be...
> This theater made sense when Covid was mostly lethal ...

So you're saying it never made sense? What does mostly lethal mean?
"put the donkey, where the owner of the donkey wants you to put the donkey" - egyptian proverb

i dont know how much money this company was making, and why it couldnt invest in both backend and client facing communications

but, on the other hand, being client focused and continuously delivering client facing feature, might be the thing that keeps the revenu streams coming

in other words, i used to always take the dev side in stories like this, but overtime i learn to be more sympathetic to the clients, i have been in situations where the devs overestimated the value of cleaner architecture, its a financial service, not a software company, i think the real solution would have been to completely outsource the software development
I loved the Jane's series of combat simulators! My favorite was Longbow 2...

https://en.wikipedia.org/wiki/Jane%27s_Longbow_2
Why would you live translate phone calls? Also, whisper.