skysight-inc/HackerNews huggingface dataset:
> Sharing the session across multiple services is its own distributed systems problem with numerous security implications to be aware of and bearer tokens might be a good alternative.

JWT makes it possible to distribute the same access token across multiple systems, but so do stateful tokens. The security implications when you're using JWT for this solution are much higher than with database tokens. Let's look at this for a moment:

JWT Security Issues:

- Inherent design issues (alg=none, algorithm confusion, weak ciphers like RSA)

- Cannot be revoked.

- Key rotation and distribution is necessary to keep token safe over a long period of time

- Claim parsing needs to be standardized and enforced correctly in all services (otherwise impersonation is possible)

Database Tokens Security Issues:

- Timing Attacks against B-Tree indexes [1]

- Giving direct access to the database to all microservices is risky

The security issues with databases are ridiculously easy to solve: To prevent timing attacks, you can just use a hash table index, split the token into a search-key part and a constant-time-compare part or add an HMAC to your token. To prevent direct access to the database by all your microservices, you just wrap it with an API the verifies tokens.

The JWT security issues are much harder to solve. To prevent misconfiguration or misuse and standardize the way claims are used across your organization, you probably need to write your own library or deploy an API gateway. To counter the lack of revocation support, you either need to use very short lived access tokens (so your refresh token DB will still get a lot of hits and you would still need to deal with all the scaling issues) or set up a distributed revocation service (not easy at all). Setting up seamless key rotation also requires additional infrastructure that is not part of the hundreds of JWT libraries out there.

It's really easy to get a JWT solution that just works and scales easily, but if you really care about security — especially if you care about security! — JWTs are not necessarily easier than stateful tokens. They're probably harder.

> Apart from that, Google and Facebook don't even use JWTs between the browser and backends after the initial login but actually do have some sort of distributed session concept last time I checked.

Last time I checked (which was today for Google), neither Google, nor Facebook is using JWT for their access or refresh tokens. The only place I saw JWT with the ID Token in their Open ID Connect Flow, and they can't really avoid that even if their wanted, since this is mandated by the spec.

Facebook and Google don't need JWT. Scaling and distributing a read-only token database to handle a large amount of traffic is easier — not harder! — for these companies. Stateless tokens can be useful for them in certain scenarios, but even then, if you're at Google or Facebook's scale, why would you opt for JWT over an in-house format that is smaller, faster and suffers from less vulnerabilities?

[1] https://www.usenix.org/legacy/event/woot07/tech/full_papers/...
Rust-PHF generates efficient lookup tables at compile time using phf
This is one of my tricks when evaluating products going through some sort of transition from a legacy to a modern standard:

I mentally swap the labels[1] when reading their marketing or release notes. If it says things like "No longer crashes when using IPv6", then I flip that and read it as "No longer crashes when using IPv4". That latter statement is absolutely insane and would have you abandoning that vendor as fast as you can tear up the contract. Nobody bats an eye with the first statement! Why not!?

Azure literally had this scenario, where merely enabling IPv6 on one network would crash their managed PostegreSQL service on another peered network with no recourse other than rebuilding everything form scratch without IPv6 to roll the change back!

[1] Or a generic placeholder than encompasses both. E.g.: "Fix: Enabling the internet protocol no longer causes irreversible outages with your database service."
> Why have kids seemingly become unable to leave their phones silently in their pockets,

Social media.
In a vertical where the barrier to entry is not high, being first to market with something simple that people can extend can create a decent-sized moat.

The downside is that much of the code in WP core is effectively un-modernizable, given how much depends on things working a certain way. Key classes and functions haven’t been meaningfully updated in over a decade.
EFF and FIRE win right to participate in X vs. Australian eSafety Commissioner
The name's already taken for cloudflare captchas
I agree completely for this scale. I did want to point out that it's fairly easy these days to do the kinds of things one would do on a cluster, which I learned just a few months ago myself :)
I had the predecessor system GP2X. It was Linux-based with ARM CPU and GPU. It had a few native games but was mostly used for emulators. I had a huge commute at the time and finished SNES games on the train.

While common and no big deal today, this was back in 2006. There was no other way to do things like this. It was way ahead of its time.
Does this still work or did Apples mitigations stop this from working?
I've always considered myself an above average web developer, my friends would always have Wordpress websites, and ask me if I can just tweak a few things.

Without hesitation, I'd proclaim I could easily make those changes!

Then I'd load their site, load their plugin/theme code and css files, struggle for hours to get the desired effect, and even if I got it to work, I would break every other part of their site.

---

Denigrating anecdote aside, good job Matt, loved the story at the end.
> But, random chance can make things look like a structure on this scale.

You can never absolutely prove that something isn’t random. However:

Galaxy distributions are pink noise, not white noise. Large scale structures are less probable.

The Komolgorov complexity of large structures is lower than random noise, and lower Komolgorov complexity usually indicates some non-random process.

A random process is less likely to produce structure than a non-random process.
Hi Hacker News,

I'm excited to share Streaks 66, an AI-powered habit tracker designed to help users build lasting habits. We recently launched on Product Hunt and received 100+ votes, and now we want to bring it to the Hacker News community.

Key Features:
- 66-day challenges with customizable difficulty levels
- Habit Coach AI for personalized advice and motivation
- Reminders to keep you on track
- Share your results
- sync with iCloud, no need to login to use

We're dedicated to making habit-building simple, effective, and fun. I'd love to hear your feedback and answer any questions.

Check out Streaks 66 here:
https://apps.apple.com/us/app/streaks-66-habit-tracker-ai/id...

Thanks!
[Insert Office Space meme here]

7 options:

0. Take a break, vacation, or go on some hippie mindfulness retreat.

1. Change your frame to find a way to handle it, i.e., gamify it, measure it, make it a challenge, use it to gather industry intelligence and connections, and/or as a temporary evil to find escape from through other means. Remember that you own your work ethic, attitude, professionalism, and satisfaction level. In a some business contexts, some difficult things can be monetized and some companies refuse to monetize obvious opportunities. You will need to find a way to do (or automate) things other people find "extremely difficult" because there is often profit in it.

2. GTD + efficiency: delegate, defer, or trash tasks if and when they aren't essential to making impact you can get credit for and other people need now.

3. Smoothly move to a different job or different kind of job like management or as a business owner.

4. Cultivate hobbies and life outside of work.

5. Start a business (not a startup, because this is a unique and risky subtype of business) gradually on the side.

6. Be completely honest with yourself to identify your short-term and long-terms goals and your motivations to identify how you're going to make money and re-invest profits wisely.

Notes:

i. You're unlikely to get significantly rich quickly enough as an employee of another business without owning significant equity.

ii. Try not to waste much life on non-value-add activities. If you're engaged in some activity, be sure it has learning potential, upside, or both.

iii. Being a business owner doesn't make stakeholders disappear, but it shifts all of the risks and business judgements onto you.

iv. Winning the lottery is magical thinking. The behavior of buying lottery tickets is the single strongest signal of someone who is unlikely to be rich according to the data of the late wealth researcher and author Thomas J. Stanley.
Unfortunately that is no obstacle for some - see for example the misguided efforts to replace "master/slave" or "blacklist/whitelist". Those terms are similarly clear and not problematic, but there are people who are insistent that they must be replaced.
That's not strictly true. When I worked at IBM, they had a graduate program which quite literally fast tracked very high achieving college graduates straight into management ranks.

It was also the only time I've worked with recent college graduates that actually had a clue, instead of being complete morons needing a few years of experience in order to be useful.

It changed my opinion of college graduates, to "maybe they're not all idiots after all...". ;)
This doesn’t sound like it was written by a real doctor, or anyone who has worked in a hospital.

The way AI is shoehorned in is just bizarre… let’s wait until the medical field has figured out “AI” to unfuck their phone trees before we wring our hands about sci-fi surgery robots.
https://arstechnica.com/science/2024/05/the-atlantic-hurrica...
This is a lot of fun to play with, and it even runs on my phone. A couple of ideas - on mobile, using one finger to both zoom and pan means it's hard to navigate precisely. Maybe one finger pan, pinch to zoom would be nicer? Also, to reduce the flickering while moving, I think there are techniques you can use for less noisy selection of points. Or for a simpler solution, apply fxaa or smaa (or even just a mild blur) to the first few frames.
And programmers who work in those languages are more than welcome to use terms that make sense to them! There is zero reason to change terms that are perfectly clear to English speaking programmers simply because not everyone speaks English (or languages where English got its words from).
Are you thinking of git subtree?
Yeah, that works, because it turns out you were already in a long term relationship with that person.
It used to be very rare for DDoS providers to publicly advertise their services, you kinda had to know a guy who knew a guy. If you put up a website offering this service the Good Guys of the Internet would track you down and get your provider to take you down, or that provider would in turn get disconnected from the internet.

Now they hide behind Cloudflare who will refuse to turn over any information so that security folks can get them taken down. Unfortunately Cloudflare has grown too large that we can't just block all of it or depeer them like we would any other network that provided services to bad actors.
Two of the stories you submitted are from web domains that appear to be heavily scrutinized. Both hashnode and towarddatascience seem to be auto-killed by default.

Looking at the history of hashnode posts it is pretty obvious why. The first page when I click “past” only goes back four days and many of the submissions are “escorts in Lahore” type posts.

Why Towarddatascience is autokilled was not obvious but I suspect there might have been a run of low quality or spam or both.

My advice is to find better stories to submit. HN is an unusual place and getting the hang of it usually takes a while…good luck.

—— addendum

you say from other accounts

Having multiple accounts can create hard to resist opportunities to behave contrary to the spirit of HN.

You probably won’t be clever enough to game the system because the software and staff reflect a lot of experience.
Surely one of us is confused, but I am not lying. Here it is on the Census website. No where does the Homeownership rate depend on people. It depends on housing units.

> Housing Unit. A housing unit is a house, an apartment, a group of rooms, or a single room occupied or intended for occupancy as separate living quarters.

> Homeownership Rates. The proportion of households that are owners is termed the
homeownership rate. It is computed by dividing the number of households that are owners by the total number of occupied households.

> https://www.census.gov/housing/hvs/definitions.pdf

When we get to the bottom of this we should edit the Wikipedia article if I am wrong.

> The name "homeownership rate" can be misleading. As defined by the US Census Bureau, it is the percentage of homes that are occupied by the owner. It is not the percentage of adults that own their own home. This latter percentage will be significantly lower than the homeownership rate. Many households that are owner-occupied contain adult relatives (often young adults, descendants of the owner) who do not own their own home. Single building multi-bedroom rental units can contain more than one adult, all of whom do not own a home.

> https://en.wikipedia.org/wiki/Homeownership_in_the_United_St...
Generally, I think most people agree that directly editing live configuration files on systems is not the ideal way to manage systems. As for what to do instead, it strongly depends. On test or development systems, I suspect most people wouldn't bat an eye to just running Vim as root, but there are some other options:

- Use configuration management systems to provision configuration changes: Ansible, SaltStack, Chef, etc. (And yeah, when testing on development or test set ups/VMs, you might first try stuff with vim directly. But if you are pretty sure you know what you want, you can also just do it in the configuration management system, test it, and provision it.) -- This may seem overkill for local configuration but it's pretty handy.

- If possible, make use of features of your tools to require less root access. For example, in Nix there are various ways to move the Nix configuration for the system out of /etc/nixos and into a user directory, or some hybrid of the two. Maybe some services can be made rootless: either running as "user" services, or even under a rootless container.

- Make use of permissions or ACLs to give write access to a non-root user or group. Then you don't need to be root to edit or provision the files.
A compiler yields deterministic results though.
Given that alternative, which is leaving the money to the CEO, I agree with OP's approach.
You sound very condescending, fyi.

Just don’t use it. Why is it so important to disable it? It’s similar to saying “I don’t want to use pockets, hence I don’t want any cloth with pockets”.

It really feels like you’re fixating a bit on this.

Since your have omitted “6/ person returns iPhone and happily goes on with its life”, I assume it’s the least bad option for you still.

If you really want the level of detailed control you’re about, take a custom rom on android. It’s more work but it’s possible.
On second thought I take disagreement with defining a byte as 8 bits. I would say its de facto 8 these days but not always and has always been hardware-dependent. If I give you a random page of documentation from the last 70 years of computer history and it's talking about a byte, you have no idea if that means 5 bits or 12 or anything else.... which is why I think octet is useful here as it _always_ means 8 bits and always will.
You could do that without polluting the browser history
Tiddly Wiki?

I stumbled upon tiddly desktop, an app that runs tiddly wikis without a browser.
When dementia becomes too much to handle, this tool offers guidance
https://archive.md/4bnWg
Feels like this guy is signaling their CEO to stop stealing...
Should have used base65536.
I don't know why you're treating them as mutually exclusive. Single points of failure are as bad when it comes to organizations as they are with anything else. Internet Archive (the org) could stop existing with the flick of a pen. I don't think “Let Somebody Else Do It” is a healthy attitude to take, and I'm going to keep doing what I'm doing.

Plus for as great of a service as Wayback Machine is, it can be very unpleasant to actually browse. I dislike how it injects its own toolbar into every page (yes I know how to massage the URLs to get the raw page data, but it isn't browsable that way). Have you never encountered sites in Wayback Machine where certain pages were just randomly not archived? Or when you click a link and get a page from years earlier or later than the one you came from? Never encountered a page or an entire domain that was blocked from Wayback Machine? Why do you think I would get started doing something like this in the first place if I didn't find it more fun to browse my own archives than Somebody Else's?
Most wifi baseband firmware "helpfully" leaks the true eeprom-written MAC address in places like management frames and beacons:

https://news.ycombinator.com/item?id=13839540

As of 2017 the authors of the paper above found MAC leaks in a shocking 96% of all android phones. And the remaining 4% aren't proven to be leak-free -- they simply hadn't noticed any leaks by the time they wrote the paper.

Unless you have fully open-source firmware on your baseband, like ath9k_htc, there's really no way to prevent this leakage. Or even be sure if it's happening.

https://wiki.debian.org/ath9k_htc/open_firmware

With open source baseband firmware you can guarantee that the baseband never even has access to the hardware MAC address. You can even reflash the MAC address eeprom (on every boot if you like!)
So why isn’t the sky wizard giving people who wear makeup cancer?
Show HN: A New Kind of Chat Room
I’ve developed an application that reimagines chat rooms by integrating them with a world map. Each user can claim a rectangular piece of land on the map, referred to as a "banner." Users within close proximity are grouped into a chat room by the app. The banner’s size can expand or shrink based on the density of users in the area and the number of coins in the user’s account.
Key Features:

Real-World Interaction Model: Users are pseudo-anonymous, akin to real-world interactions. Coin balance determines user size and visibility ("stature"), while endorsements and other activities form a unique endorsement chart, serving as a digital representation. This allows for interaction without revealing one’s entire social or professional network.

Community Clusters: Users can form open communities based on real-world locations. New users can discover and join these clusters via heatmaps, without needing specific URLs or hashtags.

Initial Coins: New users start with 1000 coins. These coins can be used to endorse other users' content, earning stakes in the endorsed banner. When others endorse that banner, the original endorser gains more coins. This endorsement economy is experimental, and could eventually involve crypto tokens.

Useful Points:

Banner Interactions: Clicking on a banner opens it fully. A button with a chart icon on the top right flips the banner to display the activity chart.

Compatibility: The application currently works best on Google Chrome.

Heatmap View: Zooming out on the map reveals a heatmap of banners.

Side Panel Tabs:
First Tab: Displays a feed of content from the visible map area.
Second Tab: Contains the cluster chat.

Current User Base: At the moment, only my friends and family are using the application, so banners are predominantly found in the Chicago area.

For more details, refer to the white paper provided. I’m excited to share this application and look forward to your feedback!
base64 is the opposite of compressed. Does it actually apply compression before base64-encoding? Doesn't really look like it by watching the URL.
Why not? We tattoo all sorts of food animals, which is what they were originally bred for (and I can confirm from experience that they are yummy — they are street food in the Andes).

Not that I have eaten the ones bred for medical research. But a fun side point: we did drug program for which the FDA insisted that preclinical studies be done in mini pigs (similar to human skin) though our research program had been in guinea pigs. The Göttingen mini pigs, like many experimental program animals, are carefully inbred so you can get a group that are genetically quite similar. We had to do the study in Toronto because the labs in California claimed they were being outbid by certain restaurants who wanted pork short ribs.

I was (and remain) convinced that this was some kind of racist joke (among other things these kinds of animals are quite expensive), but multiple people swore it was true.

So maybe you have eaten an animal intended for scientific research.
> Similar systems were proposed in the late '90s/early 2000s (hashcash/micropayments) to combat spam.

These ideas indeed exist for decades.

> The big problem isn't a technological one, it's that it presupposes some "sweet spot" price (negligible for legitimate users, yet prohibitive for abusers) that has never been shown to exist in reality.

Advances in technology, software and hardware, make it easier and easier for that sweet spot to exist. That sweet spot, didn't exist in the past, certainly, but we are close right now.

One example that i think is useful here, is aluminum cans for fizzy drinks. Aluminum, a strong metal compared to cardboard or plastic or glass, is better at withstanding pressurized gases without exploding. The downside, is that it's more expensive. When manufacturing prices dropped down a lot, then it was feasible to drink half a liter of liquid and just throw away the metal. Aluminum still not free though, but the small price did worth it. Huge waste of energy as well to smelt all that metal and throw it away after 10 minutes of drinking, but it is economically viable.

One could manufacture Titanium cans, and drink even more fizzy drinks. But that's not economically viable as of today.

> you're arguably just moving the problem to DDoSing the payment processing / firewall mechanism.

Yes, the problem is moved elsewhere, that's the weak link in the scheme i described. The thing is that a flood of transactions still costs money. Blockchains cannot be flooded just with requests, they have to be flooded by transactions. Take a look at the article [1] which outlines some ideas. I don't agree with a lot of things in there, but it states the problem and gives some numbers.

The theory when it comes to blockchain deterring DDoS attacks (and other kind of attacks), is that there are not bad guys in general, just rational economic actors who use dirty tricks. When a dirty trick starts to cost money, and profit disappears from an attack, then the rational economic actor will stop the attack. The bad guy will resume the attack regardless of profit, but that's one of the axioms of the theory, that there are no bad guys.

[1] https://www.dlnews.com/articles/defi/ddos-attacks-are-an-inc...
Rockchip RK3399 and RK3588 SoCs

Just so people don't get confused, there is a huge world of difference between these two chips. They are not in the same category.

Rockchip RK3399 is 100% blobless. You even control the EL3 Trustzone Secure World! This is True Root.

Rockchip RK3588 still needs blobs in EL3, the highest privilege level. We've been hearing rumors for years now about "oh they'll open source it next month for sure" and it.... just. never. happens. Please stop spreading this rumor. Source or GTFO, Rockchip.
Here it is https://uis.brage.unit.no/uis-xmlui/bitstream/handle/11250/3...
WordPress is proof that clean code doesn't matter. Security doesn't matter. Out of the box performance doesn't matter. At least none of these matter if you are the 800 lb gorilla in the market and everyone else is trying to take a piece out of you.
An Introduction to Vision-Language Modeling