skysight-inc/HackerNews huggingface dataset:
From "Physicists use [Huygens' mechanical oscillation] 350-year-old theorem to reveal new properties of light waves" https://news.ycombinator.com/item?id=37226160 regarding "Bridging coherence optics and classical mechanics: A generic light polarization-entanglement complementary relation" (2023) https://journals.aps.org/prresearch/abstract/10.1103/PhysRev... :

>> This means that hard-to-measure optical properties such as amplitudes, phases and correlations—perhaps even these of quantum wave systems—can be deduced from something a lot easier to measure: light intensity.

Which contradicts the article; though, high-fidelity polarization measurement should then also be useful.
> but the truth is many Apple users won't see those features for years, until their devices break

Yet another case of iPads being held back by their software. IIRC, iPads have slower replacement cycles than either iPhones or Macs.
I authorize you to be authentic!
Okay I'll bite...

This post doesn't seem to address microservice architectures at all? For me, this is the primary reason to use JWT's -- so you can pass authentication ("claims", or whatever you want to call them) through your chain of microservice service-to-service calls. If you don't have microservices then there's much less reason to use JWT's.

I'm not saying the article is a strawman exactly, but it does seem to miss the primary use case of JWT's. At least, the way I've used them in anger.

Also, the "JWT's can be insecure if you use the wrong library or configure them incorrectly" argument, while having some points, seems to me more of an argument that you should really do due diligence on any libraries you use for security. The better JWT libraries are not insecure by default.

I wouldn't use JWT's if I were making a monolith, but there are lots of companies who (for better or worse) use microservices.
what would you do?
And script, instead of "app".
Yeah, if your butt isn't in the saddle, you're standing to race up a hill. I've always considered aerodynamics to be a weird consideration for saddles. But that manta saddle looks wrong to me; like it's gonna end up putting a lot of pressure on the perenium and groin through the raised ridge. What am I missing?
I mean Specialized and Fizik do not market them as Men's or Women's saddles. They're just another saddle offering in their lineup which may or may not work for any individual.

> Specialized has since advanced the Mimic technology with its Mirror saddles, which use 3D-printed polyurethane to fine-tune the densities in each area of the saddle and further reduce pressure on the sit bones. The company no longer markets its saddles according to gender, as men also love the Mimic and Mirror models.
Paraguayan here. Nice to see a good article talking about Yerba Mate.

A nitpick on Tereré. Tereré is usually the ice-cold version of mate. You drink mate with hot water, tereré with ice-cold water as a refreshment.

The practice of drinking it with fruit juice or some sweet beverage is mostly prevalent on northern Argentina. Here it is mostly viewed as a sacrilege. You drink your yerba mate, whether hot or cold, unsweetened (unless brewed as in cocido; in that case, sweetening it is accepted).

Tereré is something almost essential here in our scorching hot days. What a blessing!

In case you wonder, if you want to get an idea of yerba mate's taste, think green tea. They're not equal, of course, but there's some similarity.
I don't think it's a service around me, as cycling isn't particularly popular in Scotland given the weather...however it may be worth phoning up and checking if any of the bike shops in your area do 'saddle trials'...where you can take the saddle home for a week or so and actually try it out to see if it suits.
but JS is the only answer to client side interactivity without hacks, there's nothing to be convinced
I have ridden centuries on a few different Brooks saddles, and I personally had a lot more numbness problems with them (male genital version), but I have had better luck with Terry saddles (with a central cutout). They were developed for women riders, but also include a few men's models. I would say people will have to experiment, not just with the type of saddle but also positioning on the bike, getting a taller stem could help shift your weight back on the saddle, onto your ischials, for example; or raising or lowering your saddle (knees permitting).
> By just using a “normal” opaque session token and storing it in the database, the same way Google does with the refresh token, and dropping all jwt authentication token nonsense.

Not only is this true, but most actual deployments of JWTs just have you swap a JWT (ID Token) for a opaque session token.

That said, I really like having a JWT signed by an IDP which states the user's identity because if designed correctly you only need to trust one party IDP. For instance Google (the IDP) is the ideal party to identify a gmail email address since you already have to trust them for this. I created OpenPubkey to leverage JWTs, while minimizing and in some cases removing trust.

OpenPubkey[0, 1] let's you turn JWTs bearer tokens into certificates. This lets you use digital signatures with ephemeral secrets.

[0]: https://github.com/openpubkey/openpubkey
[1]: https://eprint.iacr.org/2023/296
physical books weren't just given away to anyone who asked back then, so getting a copy of one is an achievement in the first place so the assumption is if you got it, you read it and by reading the title out loud he's saying I know what's in those books, like the anarchist cookbook
There are saddles which work better for some women, but they do not work for all women and are not exclusively for women.

> Specialized has since advanced the Mimic technology with its Mirror saddles, which use 3D-printed polyurethane to fine-tune the densities in each area of the saddle and further reduce pressure on the sit bones. The company no longer markets its saddles according to gender, as men also love the Mimic and Mirror models.
Ugh, this is RFC1918 all over again, but worse.

IPv6 has none of these problems by design: use it.
IWC Unveils Ceralume Luminous Ceramic Watch Technology and Prototype
My spouse was diagnosed with Parkinson's disease. His symptoms included excruciating calf pain, muscular aches, tremors, slurred speech, frequent falls, loss of balance, and trouble standing up from a seated posture. After six months on Senemet, Siferol was given to him in place of the Senemet. It was also at this period that he was diagnosed with dementia. He began seeing hallucinations and became detached from reality. With the doctor's approval, we stopped giving him Siferol and chose to try the Ability Health Center PD-5 protocol, which we had previously investigated. After three months of therapy, he has made significant progress. The illness has been completely contained. There are no symptoms of persistent twitching, weakness, tremors, hallucinations, or muscle soreness. The PD-5 Protocol was obtained from abilityhealthcentre. com. Though you still need to determine what works best for you, I thought I would share my husband's story in case it could be helpful. Greetings and prayers
The cost of the Channel Tunnel (by car) is determined by what the market will sustain: the only alternative to move a vehicle is a ferry. The train is a bit faster.

A more realistic comparison is something like Villach in Austria to Edirne in Turkey, which is 1400km by road, and €259 one-way for a car plus €149 for one person (https://www.seat61.com/motorail-trains.htm).
It depends on the kind of data you work with. Many kinds of important data models -- geospatial, sensing, telemetry, et al -- can hit petabyte volumes at "hello world".

Data models generated by intentional human action e.g. clicking a link, sending a message, buying something, etc are universally small. There is a limit on the number of humans and the number of intentional events they can generate per second regardless of data model.

Data models generated by machines, on the other hand, can be several orders of magnitude higher velocity and higher volume, and the data model size is unbounded. These are often some of the most interesting and under-utilized data models that exist because they can get at many facts about the world that are not obtainable from the intentional human data models.
If you go on the Fizik website, their saddle filter includes gender.
housing _is_, unfortunately, considered an investment for many people that cannot make relatively-significant money otherwise. (note: i am also against the housing-as-an-investment school of thought.)
Yt.chat: summarize any YouTube video with GPT-4
Hi :)

I just deployed yt.chat, now available for everybody to summarize (and discuss about) any YouTube video with a transcript. It uses OpenAI API and you can summarize up to 5 videos per day.

If you want to summarize more or to use your own configuration and models (like Mistral), you can also install it locally on your machine (a Docker setup is available and recommended).

Hope you enjoy!

https://yt.chat/

https://github.com/Fonction-Labs/yt-chat
Can you explain why switching the names would be better? I don’t get it
I am just the opposite. I started using Git not long after it gained traction outside of the kernel project. Of course, it was primarily geared toward working in the terminal then. Some years later I had switched to Emacs and gave Magit a whirl. Even after going through quite a bit of its copious documentation, I just never felt comfortable with it. I guess I don't like being that far removed from the actual goings on with the repository.

I've since switched to Vim and happily use git at the terminal prompt. I doubt that will ever change as the interactive interface of various Git commands has improved.
> so you can pass authentication ("claims", or whatever you want to call them) through your chain of microservice service-to-service calls.

This is a misconception about so called zero trust. You can't "just" pass the same token to someone else. They can use it to impersonate or misuse the token later. While you are going to say that "my microservices will not impersonate users because to each other, they are all trusted," you have run directly into the difference between trusted and zero trust.
> Identities can backfire though because people who don't identify as your identity have different ideas about that identity than you might.

That can be true, and I think it's particularly common with imposed, rather than adopted identities. In fact, people having particular ideas about you that aren't necessarily true is the reason a lot of imposed identities exist in the first place. There's not a lot you can really do about it. I suppose you can try very hard to not identify with anything, but that's not always an option, and even when it is it would be a very lonely existence.

> And in general, I think people who make $IDENTITY the main feature of their personality will have difficulty outside of that one social group.

Another way of saying that is that people who aren't well rounded will have trouble in a lot of social situations. I agree with that, but I don't think it's a problem related to having identities so much as it is someone restricting themselves to a single focal identity.
British Museum gems for sale on eBay – how a theft was exposed
What kind of backward compatibility are you imagining? If you say "with ipv4 addresses", how are you imagining that would work?
Most rice cookers work very well without any manual monitoring

https://youtu.be/RSTNhvDGbYI
New evidence that conveniently shows up now that SA is showing signs of getting cozy with China.
Don't Worry about LLMs
Can you describe how you'd make it more backwards compatible? I often see comments like this, yet nobody can work around the fact that you're limited by 32-bit source and destination headers in V4.
When to Use Fancy Words
(blog post author here)

No in fact, it is so much worse! I do agree we should use IPv6, The ending of the blog post says as such :)

> If we are going to start using address space that might not work for all users, it would be wise to pick the address space that we already have a considerable head start on getting accepted: IPv6.
> If you don't have microservices then there's much less reason to use JWT's.

Fair point. This post assumes a single database which opaque tokens can be mapped to. That said, a lot of smaller webapps are and should be monoliths.
> That is not my experience, except in the rare case of a linear read (in which CSV is much easier to parse).

Yes, I think duckdb only reads CSV, then projects necessary data into internal format (which is probably more efficient than parquet, again based on my benchmarks), and does all ops (joins, aggregations) on that format.
Try using it. It just shows their entire range of saddles no matter which filter you select.
I Am the Golden Gate Bridge
There's never going to be a universal "you are male, so you CANNOT use this saddle", or vice versa... but there _are_ saddles which are marketed and designed to _more likely_ better suit men or women.

There is no saddle that is universal for anyone...so it seems like you're arguing a case no-one actually claimed?
Growing up in the 80s, kids usually weren’t diagnosed with autism unless it was severe. There’s no cure/medication, so seeking an official diagnosis is of no real benefit. But many people eventually connect the dots as adults, maybe do some reading, and suddenly make sense of their struggles and behaviors. Are they really less ‘valid’ than those with an ‘official’ diagnosis?
So that's a no then.
Cite a single instance in which "something happened" when someone ducked into the 7-11 for a snack or a bathroom break while refueling. You'll have to dig for it, as such issues are vanishingly rare.

Fact is, this practice is universal, at least in the US where latches are provided on the pump handles.

Fact is, 99.99999% of the time, it's fine.
Is it comfortable to ride with no hands, sitting in a fully upright position? How does it compare to a wide plush seat like ones on cruisers?
Isn’t JWT plaintext? Just remember your security controls

https://owasp.org/www-chapter-vancouver/assets/presentations...
At least five interesting things to start your week (#38)
A Single File Ruby on Rails Application
My plot to pretend systemd doesn't exist has been foiled once again!

Agreed that it would be impractical to actually use these. Maybe for linknets?
"Authorize" and "Authenticate" are excellent words. They go back to medieval times and haven't changed meaning too much.

Everybody knows what an "authority" is. It means they have power or capability.

Everybody knows what authentic means. Something that is proven to be genuine.

The difference between the two concepts, as they are used in crypto systems are specific, important to get right, and also inherently intertwined, confusing, and subtle. I'm skeptical that changing the words would help.

It's one of the many reasons we have the saying, "Don't roll your own crypto."

Trust and verification are just hard problems.
Networking software and routers without ipv6 should be considered a security issue at this point and should have CVEs assigned against them. It's amazing how we deprecated unencrypted http across the internet but still use the equivalent for ip addresses.
I suspect that list isn't exhaustive. Searching the Cobalt repo shows support for more tags, including <img>. It also supports an on-screen keyboard (likely the platform-specific implementation) as well as game controllers and tilt sensors, so there is support for collecting user input.

It is certainly meant to be a constrained platform for apps. Think of it as a subset of electron, intended for "six foot views" (i.e. television).
As someone that is just attempting to get a better understanding of this aspect of a tech stack, when you say many apps don’t need Auth0 what is the actual alternative for the whole user authentication story?
Well, I imagine, if we're taking the opinion of the article as fact, Auth0 must be able to scale to enterprise levels, i.e. have so many long-tail accounts that it approaches Facebook/Google scale.
I am in a software services company for more than 15 years. And to be honest, a lot of these big topics have always been some kind of sales talk or door opener. You write a white paper, nominate an 'expert' in your team and use these things in conversations with clients. Sure some trends are way more real and useful then others. But for me the article hits the nail on its head.
Yes, it does. It does to
recoup costs, even decades later, and it does so because the alternative is a ferry, and so they can charge this price.

Also a lot of the cost is load/unload time.
I know both pretty well, indirectly or not. Given how much they can influence your energy and "will to live" I don't think they'd pair well with having to fight for your life.
I 100% know it's a preference/style kind of thing, and I know the React/Node isn't perfect and comes with it's downfalls, but I whenever I have to code in anything other, I just miss the visual/mental model aspect of having your tsx code basically identical to your actual html.

The mental load of going from this to

func main() {
component := Page{
Children: []Component{
Div{
Children: []Component{
Button{Name: "Test button"},
},
},
},
}

to this

<Page>
<div>
<Button> Test button</Button>
</div>
</Page>`

or going from this:

const main = () => (
<Page>
<div>
<Button> Test button</Button>
</div>
</Page>
)

To, well... case in point, exactly the same thing is just so nice.
I'm sorry to recommend you that, but i have experience with homelessness. You have two temporary solutions:

- join a group of squatters (hopefully you already know someone) until you get your bearings. The less ideological ones often squat old industrial properties, or long-abandoned houses (its rough in winter, but in Portugal you should be fine). You might meet some Urbex guys, they're nice and always fine with finding squatters.

- Live in a "big enough" car. You absolutely need to rest on a completely flat surface. I knew someone who got the back seats down and put a wooden plank on it. If you're less than 1.80 and don't move on your sleep, you have a lot of choice (the diagonal is nice), else it might be a bit more expensive.

A very short-term solution is squatting with a close friend, but you shouldn't abuse it too much, it strains relationships.
> All these terms are just so unintuitive for a mere mortal like me. Energy? Power?

Yeah in fairness I think most people never have to deal with these units and they're used interchangeably colloquially.

kW = power. This is a rate of work. How quickly work is happening. Intuitively, cycling hard = high power, cycling with low effort = low power.

kWh = energy. 1 kWh is literally 1kW for an hour. If you are cycling pretty hard with a power of 0.1 kW for 10 hours, you have generated 1 kWh (0.1 * 10). If you cycle inhumanly hard (0.2 kW) for 3 hours you have generated 0.6 kWh (0.2 * 3).

That's it. Now some examples:

* Solar panel peak power. This is the maximum power output of the solar panels. For cycling it would be the hardest you can possibly cycle. Apparently the record for cycling is 2.7 kW! (But not for very long; unlike solar panels people get tired.)

* Battery capacity. This is in kWh. They store a finite amount of energy. If you have a battery containing 10 kWh you can eek it out slowly - if you only draw 0.1kW from it it will last 100 hours. Or you can dump all the energy in half an hour and it will output 20 kW.

The only really complicated one is battery factory output capacity, which approximately 0% of journalists understand. This is measured in Watts... because if you produce 1kWh batteries, and you make one per hour... 1kWh/ 1h is 1 kW! In other words if the batteries from the factory magically came out fully charged and you just used them as a power station without recharging them, then how much power could that power station provide? Yeah that one is a bit confusing.
Need? Maybe not. But it's a time saver out of the gate.
It's a good idea. The article conflates authentication with authorization. Your application can authorize many different ways, most do. You can use your session for authorization - your application can decide what a person can and can't do. But facts about the user's identity never change, like their uniquely generated ID in your database, and that's what gets stored in Keycloak's `sub` field, so it's fine to use that for trading a token for a session cookie. Their password does change but that's Keycloak's job, is to turn passwords into authentication tokens.

The JWT always stores facts about the principal (aka who or what is doing something), and those don't really make sense to revoke or whatever anyway. Stuff that will never change over time. JWTs can optionally store something like a `role` or similar fact that may change over time, specific to your application. Those facts can be used to decide what you can do in your application, that's authorization. We could talk about when and how that should be done, but it would be too nuanced for these evergreen JWT blogposts.
So people should not use the abbreviation when it isn't clear. Problem solved, no renaming needed.

If people are too lazy/whatever to use the full word, they are going to be too lazy/whatever to change to a different word entirely.
> According to Johnson the US has never endorsed the ICC because it's a "direct affront to our own sovereignty. [...] We don't put any international body above American sovereignty and Israel doesn't do that either," he added.

God I have developed such a distaste for political opinions. Everyone thinks they're right and everyone sees the various maleficent actors in others.

[0] https://www.jpost.com/international/article-802290
Ilex vomitoria
There are other states where you're not even allowed to pump your own gas at all for "safety." (Two, although I understand that Oregon has walked it most of the way back.) Like prohibitions against unattended filling, these law have no statistical basis.
Might be a little naive but this looks to be mostly exploited by blindly trusting user input which pretty much always should be avoided
Burger King to Launch $5 Value Meal to Hit Back at McDonald's
As an insecurity person I sort of like the name clash. I’m not smart enough to keep those things separate, so realistically, if I’m giving somebody the ability to authenticate I’m also giving them authorization for normal account stuff.
Surveilling the masses with wi-fi-based positioning systems
You need to ask central authorities to issue you a public IP, and almost certainly a domain name as well. I don't see how requiring a TLS certificate on top of that changes much.
Depression in men presents differently (anger instead of hopelessness) and is likely to go undiagnosed because of that and the taboo against men making negative emotional displays.
Every time I am dealing with containers, I wonder myself about the irony of Linus discussion with Tanenbaum.
Browser sessions are not the only authentication scenario.

> absolutely no one who is not Google/Facebook needs to put up with the ensuing tradeoffs. If you process less than 10k requests per second, you’re not Google nor are you Facebook

What's the magic property that flips when you pass 10K requests per second? Are we sure it's at 10K requests per second, not 8K? or 5K? In general, at that kind of scale I'd think JWTs would become less appealing - AWS operates on IAM for example.

And why are Google and Facebook the best examples of companies who are operating at scale? There are different kinds of scale than just 'ad auctions per second'. I would imagine the access management concerns of, say, JP Morgan Chase are at least as complex and challenging to scale as those of Facebook.
If the speakers are not set too loud, you don't need the algorithm at all.
Yes, that is US doctrine, but Iraq and Russia are hardly comparable.