skysight-inc/HackerNews huggingface dataset:
The hero of summer on the American River is a California man with a snorkel
I do not like it. AAAA is a good abbreviation for the necessary principles authentication, authorization, access and audit.

LPAA... Is just not right.
I can second GP.

I have always heard and used authz and authn (pronounced auth-z and auth-n). Bare "auth" typically was used to mean both, but IAM was more clear for that in specific contexts. E.G. you might say someone "authed" to indicate both authentication and authorization, and you might have an IAM team that handles both authentication and authorization.

FWIW, I lead an IAM team.
Ask HN: Evaluating Open Source: Beyond Stars, What Do You Look For?
Hey HN community!
Recently I've noticed a disconnect between GitHub stars and actual usability in some top-trending(#1) projects—no names, just a pattern I've observed. Stars don't seem sufficient for gauging project quality. For instance, a new project with thousands of stars last week doesn't work for many users(as per issues/community channel).

When you evaluate open-source projects, what metrics matter to you? Do forks (suggesting active use and adaptations), the number of contributors (indicating a healthy development environment), or open issues (reflecting responsiveness and ongoing development) influence your decisions?

Keen to hear which metrics you find most reliable to get into a project.
Access doesn’t cover everything though. But identify seems good
Spelling hasn't ever been tough for me, but it's like I think of words in their entirety, one unit that includes all the letters. When I type, even with just my thumbs on a phone, I'm not spelling the words out, but rather typing the whole word, which essentially has a specific series of movements to represent it.

How did you find out you were dyslexic, and how does it affect your perception of letters or numbers? I know very little about dyslexia, but it's certainly interesting that the only other person I've encountered who reads like I do has it!
> The discrepancy between the two curves can be accounted for by adding a dark matter halo surrounding the galaxy.

Funny. “This discrepancy can be accounted for by accounting for the discrepancy using the number fudging we developed specifically to account for the discrepancy.”

Discrepancy’s been accounted for, boss!
Yerba mate is good, but even if you're not into it, consider getting a bombilla (that filtering metal straw). They are exceptionally convenient for drinking all kinds of herb-based beverage: tea, roiboos, whatever.
Yes, and most authentication plugins for web frameworks provide the same things.
My understanding is the cancer risk is from smoked Yerba mate only.
Ore Energy is based in the Matrix One building, which is that in the photo

https://www.matrixic.nl/en/?companies=ore-energy-b-v
How do you fingerprint the requests? IP address?
Manifesto: Harnessing Space-Based Energy for a Sustainable Future
In an era where the demand for clean, renewable energy is paramount, we present a revolutionary concept: harvesting energy from space to power our planet. By deploying a collection array equipped with advanced energy conversion technologies at one of the Lagrange Points (L1, L4, or L5), complemented by Solar Power Satellites (SPS) in geosynchronous orbit, we can tap into the virtually limitless energy of the Sun. This manifesto outlines the vision, feasibility, and benefits of this groundbreaking approach.
Identity and permission are often closely related, and usually auth means both. If we replaced auth with permissions and login, I suspect we would still encapsulate the same overarching concept with one of those two words anyway. E.g. use the login module to add permissions to a user or use the permissions module to authenticate.
They don't. They still have to upgrade. But at least the service owner has options to run the services on their gateway and then pass the traffic back to the hosts behind on their internal IPv6 network.

And more importantly it means that if a client wants to interact with IPv6, they only have to upgrade their client, and not wait for everyone in between to upgrade too.
And the third half, “management” verbalizes the action therein.

Also, IAM has a cryptic assertion of ultimate authority: In Hebrew, . . . hayah carries the added weight of representing God himself: Yahweh, “I am.” [0]

https://hebraicthought.org/meaning-of-gods-name-i-am-exodus/
Experienced cyclists often replace all the contact points on a new bike to meet their preferences, including saddle, pedals, bar width, and stem reach. It's just like adjusting the height of the saddle to match your leg width, and replacing the stem to match your body/arm length.

You would have to know this before buying a bike, which most beginners wouldn't, and most bike shops don't want to offer this service because it costs money in parts and labor.
A big list of the best tiny games on the internet
Show HN: I built an API to detect and verify disposable or temp email addresses
Hi HN,

I'm excited to share a project I've been working on: UnwrapEmail(https://unwrap.email), an API designed to detect and verify disposable or temporary email addresses.

Features:

- Detect disposable email addresses

- Extract labels from email addresses (e.g., Gmail)

- Normalize addresses by removing labels or special characters (e.g., Gmail)

- Validate MX records of domains

- Check whether it’s safe to send to a given email to reduce bounces and maintain sender reputation

Why I Built This:

As the owner of an AI wrapper app, I've seen decent traffic thanks to SEO efforts + ads, and I've been able to convert visitors into users with free plans.

However, some users exploit these free resources by using disposable emails or Gmail’s "+" trick to create multiple accounts. This abuse costs me money, as I have to pay third-party AI API providers from my limited profits.

I couldn’t ignore this behavior, as it directly impacts my expenses. However, I also didn’t want to put my products behind a paywall without offering a free trial option.

To address this, I developed this API initially for internal use, and it proved to be effective that I decided to turn it into a dedicated service.

Try it now: https://unwrap.email

Note:
I understand the need for temporary/disposable addresses, but I can't afford to cover the costs for those exploiting the system.

This API is designed to help app owners make informed decisions based on the responses.

Thanks for reading! I’d love to hear your feedback.
https://archive.is/ZaWfP

> Curators with years of experience get as little as £12,000 a year and many complain they cannot afford to live in London.

Curious if that statement came from Higgs.

And possibly this incident inspired him to do later do the same.

Note the original article said this as well:

> He had been described by the UK government as “a world-renowned curator” in 2015 after helping to return a stolen 2,000-year-old statue to Libya. Dr Higgs later appeared on BBC’s Crimewatch to describe his work.
View transitions are the perfect candidate progressive enhancement. If the browser supports it, then the user will get the rich animations. If it doesn’t, then they get what they currently have.

And once other browsers starts supporting it, the experience will automatically work in those browsers too without you needing to touch a single line of code :)
I really like Arc, but I hate when I go through the file download context to choose a path and file name, then Arc renames the file. For the direct downloads, I’m all for it, but I wish it recognized that I chose a file name myself, so don’t rename.

Haven’t played with its tab organization, though.
Please forgive the bare bones writing...
It's in the oven
Of course they can't. But the point is that if a client wants to interact with IPv6, they only have to upgrade themselves, and not wait for everything in between to get upgraded. And the service can serve on their IPv4 gateway and then pass the traffic back to other hosts to server IPv4 clients.
HTML 5's error recovery pseudocode replaced the formal grammar that HTML 4 had, and in authoring I find it harder to take guidance from.
I can do that without getting a tattoo though.
Well, I would have no idea if a bounds check is eliminated at all (and who wants to care??), if it does not show up in profiling results.

Unfortunately for what I do I had to do this a lot. I guess that's also why I'm not seeing it in Go, never tried to write a query engine in Go.
No, they're still intertwined, unfortunately.

For example, Okta has a notion of whether a user is "authorized" to use the app, so you can end up being directed to Okta, prompted to log in, and then shown an authorization error. Users will often phrase this as some odd form of "not permitted to log into the app".

Further, Okta admins control the claims the user presents to the app, and those claims can often have authz implications. A "role" or "group" claim is the most obvious one.

I've spent endless time going in circles with Okta administrators who can't clearly delineate these two, or who don't understand what an "app" (Okta's term for a relying party) is, etc.
Very ironic considering one of their excuses on returning artifacts to countries of origin is “they wouldn’t be cared for and would be stolen”.
Ah, I see. Would this come at a performance cost? (My only experience with GUI editors is VSCode, which feels sluggish compared to Helix.)
That article describes the architectural features of the “Matrix ONE” building in the Netherlands. Matrix ONE appears to be part of an “innovation hub” where firms research things like sustainable energy:

“Matrix ONE is the largest of seven buildings that now make up the Matrix Innovation Center, part of Amsterdam Science Park, where scientists and entrepreneurs work on sustainable solutions for current and future problems.” [0]

Seems reasonable to me that they would use a picture of the iconic building where their company works, much as a firm in New York’s World Trade Center might post that iconic silhouette without implying the whole thing is theirs.

It’s not fake, although I see how it could be taken to imply they’re bigger than they are. Even so it signals that this enterprise is somewhat more serious than a crank in his suburban garage, for whatever value that signal conveys…

[0] https://www.mvrdv.com/projects/393/matrix-one
Identity and access seem much clearer to me. Not every identity determination is via log in, not every access check is purely based on permission. I will try and use identity/access/IAM instead of authn/authz/auth.
Emphyteusis
> People more qualified than a philosopher have argued many perspectives about DID diagnosis.

Idk why you'd think a medical practitioner would be more qualified than a philosopher of science about when it comes to methodological issues, but you're wrong.
The universe is not believed to have a center.
Jujutsu

https://github.com/martinvonz/jj
Awesome, thank you!

> The suggested pronunciation of JWT is the same as the English word "jot".

1 syllable instead of 5 FTW
Lete Sans Math: a sans-serif math font
Ikaruz Red Team – Hacktivist Group Leverages Ransomware for Attention Not Profit
While I also agree that authn or authz are perfectly clear,

> Why would you type the wrong letter when you mean the other one?

Really? Ignorance, laziness, rushing, fatigue, simple mistakes, etc.

What I think is worse is more letters doesn't save you. I've had some conversations where it has gone like 2–3 round trips before the other end realizes that "not" means not, and they mean … the other way.
Really interesting article on the real state of renewable energy generation. What sticks out is just how little generation the legacy 'major' energy companies are doing, compared to the increasingly decentralized smaller players. That's got to be great news for future energy prices and stability.
I don't like playing that card, but I am a physicist, a cosmologist actually, and I wrote in my last post how it breaks. And I used the qualifier "approximation" in my first post of this thread. If you don't assume homogeneity on large scales you don't get a big bang. Or at least I'm not aware of any of the routes you are talking about. Even observing receding galaxies does not necessarily imply a big bang, which is why the debate wasn't settled until the discovery of the CMB. Until then, the steady state universe was still viable, which is basically an eternally expanding universe.
Store reset_time per user. Use a message queue (or postgres notify) to push changes to this value to your apps. Check the user's token was created after the reset_time when validating it.

You would be required to keep a Map<UserId, Timestamp> in memory, potentially with TTL. Most systems can handle this easily for their expected user load. If not, you should have the engineering capacity to figure it out ;)

Logout button sets reset_time to now, as does revoking tokens. This would only allow you to revoke all tokens for one user at the same time, but this tends to be fine, since JWTs should be short-lived anyway and apps should deal with the expectation of them being expired/revoked.
Google's AI Overview seems to be spewing inaccurate, dangerous answers
Longer, if we allow “web application” to mean “anything with a login, on the web”. All those popular forums, likely also stuff like yahoo mail, even gaming services (yes, browser-based game matchmaking services existed in the 90s, Microsoft ran one, among others) probably just because anything else would have been needlessly complicated and expensive.
> Once the major browser engines support it, it's de-facto legal.

thats madness. just because the browser allows it, doesn't mean you should do it.
The FBI is investigating the sale of the gems to US buyers as well:

https://www.bbc.com/news/articles/c3gqq7xy5xdo

> The British Museum says of 1,500 items it estimates are stolen or missing, 626 have so far been recovered and 100 more have been found but not yet brought back.
Parsing structured environment variables in Rust
In addition to the other comment, PowerShell loads a profile script where a user may freely remove aliases or redefine them as they see fit. It's also a reason why my command line for executing PowerShell scripts includes -noprofile.
Or a weird lens effect. Gravitational lensing has a logarithmic effect doesn’t it? Theres the old joke about fitting a line to log scale data with a fat enough pen. These galaxies aren’t perfectly circular to each other.

I think the fact that the arc has a similar focus to the ring is going to turn out to be something.
What if you want to implement logging out all user sessions?

You'd have to store something somewhere, so you end up losing the benefits of stateless authentication.
But despite being inspired by them yours is still the first?
Hopefully they're cleaned somehow...?
Both. Sure we make huge progress in depression research and brain research in general, but there are so many environmental things happening, like yours for example, so just saying "oh yeah depression comes from that DNA" or "yeah that's just from your trauma. A lil therapy will heal everything" is just a bit short sigthed. So yeah, just saying that it's all very complex and we shouldn't really try to reduce this beast of a disease down to anything, because everyone has a different story. In the end I was just a little sarcastic, sorry
As I understand it, the platform is closed; i.e. you can’t get the word out any other way than buying the platform’s own advertisements. And even I am wrong, and you can, the overwhelming majority of people don’t look at anything else than the platform’s own ads for choosing what game – I’m sorry, “experience” – to play. The platform does not make it easy to see good games, only the top played games and advertised games. The platform lures developers in with the promise of a large audience and a chance to get huge amounts of money if their game becomes popular. But the only games becoming popular are those for which developers pay the most for ads. Therefore, it’s exploiting developers’ drive to make good games popular, by requiring them to pay for expensive ads.

Bonus: Now, since most of the developers on Roblox are kids, replace the word “developer” in the previous paragraph with “kid”. Does it seem exploitative yet?
The unbearable lightness of a simple photoblog: 1600pr.sh
I don't understand why would a magic wand or semantic gymnastics be required.

One can implement different kinds of permissions for a given resource. Including ones related to license or time constraints.
So Rewind expands the "locally malicious software" scenario from "it accesses all my files and it can monitor me going forward" to "it accesses all my files and it can monitor me retroactively for a few months and also going forward"?

That's a little bit worse but not much worse.
Actually building them, of course, is another matter entirely.
Humans with money are mostly just humans that got really lucky.
There Is Not Enough Electricity to Run 5G: Finding the Road to 6G [pdf]
Are you not on any chicken social media groups? If you're paying someone else to build something with, uh, curb appeal — fully painted, metal roof, nice hardware — $20k is real easy.
But the token is used over SSL and the only way to get it afaik is to hijack the client device or somehow hijack the server. The first scenario is pretty rare and the second is pretty easy to avoid. I don’t think that’s really an edge case that’s concerning for 99% of applications.
CuSZ: GPU accelerated error-bounded lossy compression for scientific data
The best graphical, modal text editor is Emacs.
No, just figure out how the AI ranks resumes and then reposition / rephrase existing skills & experience to match that.
At least somebody else here has a clue, thanks for representing!
Indeed.

I regularly try to ask them to give me fluid dynamics simulation code to see what level they are at. Right now, they can't do that kind of thing all by themselves, and I don't know enough to debug the code they give me.

But even without any questions about free will or consciousness or whatever, a sufficiently capable — not yet existing — transformative search engine (as it has been derided as) and a logical inference engine (which it isn't, but it can use) could have produced the Aclubiere metric with nothing newer than the Einstein field equations and someone asking the right question.

I do not expect transformer models to be good enough to do that given their training requirements, but I wouldn't rule it out either.
You can use a separate DB that acts more like a cache for revocations- usually something where you can set a time to live on the row equal to the duration of the token itself.

That keeps your application DB free for application load, while keeping your identity validation logic nice and snappy.

Of course, adding infrastructure may be intimidating, but most applications that face any real load are going to be using redis or something similar anyway at some place in the stack.
You can sort of convolute a reason why 401 Unauthorized is valid, based on the fact that most systems which control access to resources have a (often implicit) policy that users for whom the identity is not known are not allowed to access anything.

Therefore the request is unauthorized because the server wasn't able to authenticate the user. But that's still not consistent with 403 though, so it's not very satisfying.

But this also speaks to one of the nubs of the terminology issue. "Actors" are authenticated, "Actions" are authorized.
JWT is a great way to authenticate the person who is trying to log into your app. Once authenticated, you are free to exchange the JWT token for a sessionid.
https://informationisbeautiful.net/visualizations/snake-oil-...

Meta analysis on nutritional supplements
How are those pronounced?
What's the thing that bothers you most in a terminal app like helix compared to a regular GUI?
Deep Learning Curriculum
Yep. But in truth the alternative cannaboids are interesting on their own. That having been said I don’t live in a legal state but… it really doesn’t much matter anymore.
New material developed by MIT researchers able to block out sound
> upscale, and interpolate from 5 -> 30 fps

So it’s not really „restored“.

More like „artificially enhanced“
Publishers.
AI vs. a giraffe with no spots (2023)
It's milder in the sense it has less caffeine than coffee and is also more approachable to tea drinkers because it doesn't have as strong of a darker roasted taste.

Not sure if the other xanthines make up for that.
Was the inverse take studied? (Again, to clarify, my opinion is that the ratio of good/bad interactions on dating apps in a binary ranking system is roughly the same; that means if a man and a woman get 100 matches and the woman only finds 1 suitable, so does the man)

That's why bringing quality up in a conversation about quantity ratio disparities in the dating market is meaningless.

Quantity is objectively demonstrable. Quality is not (in this case at least). Your quality complaints about a partner are the things someone else would praise about them.

That's why every single response I've made in this thread is towards comments on quality as the equalizer/silencer to quantity complaints. You are proving my point by asking this question, not sure if you realize.

It's just a red herring meant to prevent the conversation from moving in a meaningful direction, meaningful as in it helps both sexes (for example, enforcing M:F ratios in dating apps). Mostly because the meaningful direction probably doesn't benefit (or rather, have as much perceived benefit for) most women as much as a one sided approach.

That's also why the implication that "women are the big winners of dating apps" is important.

Most women don't actually want them to change in favor of both sexes, they only want their own problems addressed. Not realizing that addressing the problem for both sexes would benefit both sexes probably much much more. Yes, I'm implying people mentioning "quality" want a relative gain in value, not a net.

And that's just human nature (see the trickle down economics reference next), if men were the big winners of dating apps, it would be the same.

By focusing on quality (a problem mostly only women experience because you need quantity/volume to have quality issues in the first place), all of the benefit goes to women, and the expectation from there I guess is that the perks "trickle down" to the losing side... Right.

Does this situation sound familiar? Also this has historically proven not to be true and in reality it is not true; I feel quite comfortable saying there are far more men who feel completely disenfranchised from dating than women. Femcels exist, but I'm pretty sure there are way more incels.

Dating apps should improve upon reality... Not exacerbate the existing disparities.

Interestingly enough, the example of a meaningful solution I mentioned before (enforced M:F ratios) would directly impact quality... Imagine an app where you sign up and have to wait for your account to be activated until the ratio of males and females in your area is made even by your acceptance..

That implies that when bad actors are removed their spot is filled... By someone who is presumably not a bad actor (or this repeats until someone who isn't a POS gets in and stays). You would probably also think twice about cat fishing or sending obscene messages to people.
I've seen https://en.wikipedia.org/wiki/AAA_(computer_security) because authentication, authorization, and accounting (audit trails) need to go together so often. You need to know who they really are and whether they're abusing the system.
I'm glad it works for you.

The lack of a saddle nose would be a problem for many enthusiast cyclists. Obviously people aren't sitting on the nose, but it's used as another contact point to control the bike at high efforts, when people aren't really putting a lot of weight in the saddle at all.
[dupe]

https://news.ycombinator.com/item?id=40492076
Withdraw most of my ownership in favor of Mark