skysight-inc/HackerNews huggingface dataset:
> You can log into a password manager from the browser. Now you’re completely pwned.

Can you elaborate here?

My point was that your phone is a single point of failure if you use it primarily for both your 1password account and your TOTP generator. Compromising the phone gives you access to both apps. And I mention that this can still be mitigated. One of those ways is through adding a password or biometric unlock to your TOTP generator app (as you point out). Or you use a second device like a yubikey. But the point of that paragraph is that combining passwords and totp codes into your password manager is a single point of failure. Separating the passwords and totp but still using just 1 device, can also be a single point of failure.
> Well the West could simply stop the Genocide today and prove them wrong.

How could the West stop the Genocide in Ukraine?

> Throw in Bush and Blair and others for war crime trial. It is absolutely marvellous to think that the West which plundered millions in the last two decades has any more decency than Putin. Not that Putin is benign, but the West collectively have more capability and have used it as far as they can.

So let's roll back - why didn't Saddam get trialed for war crimes? It's like you seem to forget who Saddam was, what he did, and what capacity he had.

"Not that Putin is benign" is quite precious, a man committing the largest genocide we've seen in Europe since WW2, just because Ukrainians exist.
Yes. And to spell it out explicitly: this is yet another instance of a big company willingly complying with demands by a authoritarian regime.
I created https://uiino.com (painless planning for your app with AI).

As a product studio, we spend hours brainstorming and creating user flows, feature ideas, and edge cases. I prototyped a solution on a weekend and now we use it daily, saving time.

We released it publicly after a few months. We work on it every Friday, finding it enjoyable.

P.S. Got a startup, app, or website idea? Just describe it in plain language. Uiino's AI will generate your story maps in under 10 seconds. It's FREE! (No account required!)
A night club map of Harlem, 1932
The article does not really resolve the ambiguity with 2000s which usually means 2000-2009, not 2000-2099.

That said, in Finnish language people never count centuries. It's always "2000-luku" and "1900-luku", not 21th and 20th.
Indeed, but in the same way that code reviews and QA testers can't catch all defects. Perfect is the enemy of the good. Swiss cheese model: https://en.wikipedia.org/wiki/Swiss_cheese_model

Apple's (flawed!) review process still catches a lot of bad actors. Not all, and it has false-positives. That doesn't mean it's useless.

The (legit) question is: is Apple also using security as an excuse to make more money at the expense of customer choice? Because Apple absolutely doesn't need to be the only entity performing this task — I don't trust Epic, I think their business model is predatory on gambling addiction, that doesn't mean they would be incapable of performing the same kinds of security review — and while Apple's smooshing of all the different expenses from API development to review and hosting and processing fees into a fixed sales percentage is convenient, it does make it harder for competitors to emerge for each of those separate tasks.
It's the first time I've heard of that NUMMI factory and it's ... kind of ironic. Because, pretty sure we taught Japan/Toyota/others all there was to know about Quality re: TQM and TPS ... and now companies are partnering with them to get back some of that lost luster? That's... hilarious. Maybe we need to be obliterated and build all over from Ground Zero like they did.
> I really, really like that I can, more often than not, take a program I wrote decades ago and it will still run properly.

"Cool kids" languages like Python and Rust really put in the mind of people that a program written two weeks ago must be upgraded to run on the new version of the compiler or interpretor. Meanwhile there always have been languages like C# or C where a codebase from 15 years ago will compile and run just fine.
There are only 3 tough problems in engineering;
1) naming stuff
2) off by one errors
Skip – Dual-platform app development in Swift
https://www.cnn.com/2024/04/02/tech/us-government-microsoft-...

https://apnews.com/article/microsoft-cybersecurity-hack-raim...

https://abcnews.go.com/Business/microsoft-corporate-emails-h...

Threat intel team is supposed to be watching the hen house, they are doing a bad job. Fundamentally they are doing their job using insecure products and insecure services.

You say "highly regarded" I would say that "poor choices reflect on you (the threat team)". The one good apple in a barrel of rotten ones isn't going to save a thing.
Could they even do that without giving up their Irish tax shelter?
Postgres is usually completely happy enough with UUIDv4. Overall architecture (such as allowing distributed id generation, if relevant) is more important than squeezing out that last bit of performance, especially for the majority of web applications who don't work with 10 million+ rows.
Get meal kits delivered. You still do >80% of the cooking but it takes out all of the planning and shopping.

I was lucky(?) to grow up with a great cook and gardener for a mum, so I'm not even really sure how you exist without doing this at least. Pardon my naivety, but what do you eat...? Is everything unwrapped from plastic or from the local takeaway joint?
https://youtu.be/SsoOG6ZeyUI?si=T-VZpE6AeBimyoOE
> I just don’t understand why product market fit isn’t established and revenue found before launching

Founders often profit more from funding rounds than revenue or exits so the incentives are not aligned toward a profitability outcome
Relevant background: https://www.perl.com/article/announcing-perl-7/

That got a lot of attention four years ago. Larry Wall had approved changing the name of Perl 6 to Raku the year before. I don't think it's controversial at this point to say the Perl language will never see big changes. The only people still working on the language do so because they want to keep running the language they have now. That's fine, but as described in that article:

"The new features crowd has to deal with a longer boilerplate section in every program, and newbies wonder why they have to include so much just to create a program so people on StackOverflow won’t hector them over missing pragmas."
I don't see those as realistic. Session interception largely isn't a thing anymore, unless we're talking about nation-state levels of attackers, and if the service is storing your password unhashed then I sincerely doubt their 2FA is configured in a secure way anyway.
My high school history teacher taught me a trick. Just subtract 1 from the century to get the correct year. I never remember if it's subtract or add though, so I'm trying both with 21th century and see if I'm right first.
The parents food advice is not competing against wholesome meals, it's competing against a bag of chips and a beer for dinner.
Amen (or similar)
Is this supposed to be some portmanteau of "chicken" and "exercising", which wants to be "chickencising"?

All the search engine hits for "chicken-sizing" point to that article, or else to material about measuring and sorting chickens.
Buy Google junk?
Yeah, it's stable.

I have perl stuff written literally 20 years ago, that still works without issues, even on modern computers. If you need something to do the job and in ten years be called "legacy codebase", then do it in perl... because if you did it in python, you'd have to fix the 2.6->2.7 stuff, then 2.7->3.x stuff, and maybe even more than that. If you did what people here on HN like, so, use a 'language of the day', you'd have code written in ruby (now rust or go or whatever), which very few machines have installed by default now.
The question is whether or not Google, either in its bank accounts or as X, is the best steward for funding innovation. One could argue that it isn’t, and they should’ve paid that cash out in dividends and leave their shareholders to do such work.
>PowerShell faced extreme opposition at Microsoft, and its creator Jeffrey Snover was demoted for pursuing it.

That makes me sad. The dude is absolutely brilliant.

Awesome post!
Reg. Gmail marking Ente verification emails as spam and showing the "Similar messages were used to steal people's personal information" warning.

Not an engineer/experienced with email deliverability, but, I _did_ feel something off when I received the Email verification code email (which too was marked as spam by Gmail). Thoughts/observations:

1. The email body is very minimal, which could be a good thing, but,
> it did not have the usual trust markers/indicators - no brand logo or name at the top,
> a generic envelope/letter icon/image as the largest visual item in the message
> just a single "Use this code to verify your email address" line in the message body (except the "ente.io" link at the footer)

2. I did a quick comparison between the Ente verification code emails and some recent verification code emails from other products (Backblaze, Google, Instagram, IBM Security..)
> none of them were as barebones/non-descript like the Ente emails.
> They had descriptive text that provided a bit of context ("you recently signed up for an account at XYZ with PQR email address, and this code is required to...")
> They had the brand identity (Name / Logo) prominently somewhere in the beginning of the message
> AND most of them had the company name, registered address, and contact details in the footer. (Adds accountbility/trust?). Some even had links to privacy and support pages.

3. I believe you must have already explored the BIMI, VMC route for the "gmail blue tick".
Eh. We mostly went with IDF since we run all our products on ESP boards. I really like their abstraction layers.
Are we certain that it's _not_ a decent choice for a typical web app? I'm tempted to swap it into one of mine and see how it behaves. Even if some operations are internally slower, that might be offset by having zero network latency to deal with

It would be nice though if other DBs made extensions this easy. There are a handful of package managers for Postgres but they're not generally supported on managed platforms like RDS.

Anyone know if there are comparable options for SQLite? Seems like an obvious thing that should exist but a quick search isn't showing me any
What are you expectations of Google X based on? in other words, what are you measuring against? Are there similar research ventures pursuing moonshots that are doing better?

Your comment was pretty harsh. Google X has been around for what? only 14 years? The number of projects they funded and the researchers they employed during that time frame is great initiative and admirable on its own.
I'm like you but without the cooking together with my spouse, which we learnt early in our relationship is not a good idea
> a modern sysadmin role

As a sysadmin, I feel attacked. DevOps is not a modern used version of the sysadmin. It's a different shade with different expertise to apply to a slightly different field that what a sysadmin does. I've seen devoperators who don't know how to manage a server and I've seen sysadmins who don't know how to write scripts. One is not more modern or superior than the other.
Whats wrong with PHP with laravel for a web project? How is it worse than say python with django?
You're right to be distrustful.

It's easy for people to read the law — or worse, opinions about the law — and mistake this for knowledge. One of the benefits to me for ChatGPT is that it gives me a stick to measure against: I know it's flawed because of how it writes code, and I know it will be that level of wrong about law too, and I also know that it's wildly better about law than I am. This makes the degree of my own ignorance much more intuitive, and reminds me that I can't just look at the text of the law and go "ah-ha!"

While I suspect you're right that Facebook will attempt this, I suspect they are much like Apple when it comes to not really believing that the EU is serious, and it will explode in their faces — a few years back, Apple put in rules for advertising privacy ID, which (while acknowledging my ignorance above) didn't seem too different from what the law required, yet Facebook was very unhappy about this.
> The key leaking doesn’t seem like a realistic security issue.

But it is.

If you have a password in a system, you want to rotate it regularly or at least have that ability (for example, when angry colleague leaves).
The Dao is beyond words. The reality is ineffable.
Not one so deep, no.
These are the main threat models to be aware of:

1. Credential phishing. Where you store your TOTP secret doesn't matter.

2. OAuth phishing. Where you store your TOTP secret doesn't matter. (This also runs right through FIDO and has been growing in popularity for about a decade now: https://www.trendmicro.com/en_us/research/17/d/pawn-storm-ab...)

3. Data breaches. Where you store your TOTP secret doesn't matter unless your password manager backs up online, that's what gets breached, and the data isn't properly encrypted. Which has happened.

4. Malware. Where you store your TOTP secret matters. This is why U2F and FIDO2 have a user presence test, but the real-world value here is overstated. Malware can always just steal your tokens.

5. Physical access. Where you store your TOTP secret matters. If you care about security though you'll have other measures in place to keep someone with physical access out, which is enough against basically anyone except governments.

Summary: A "true" second factor doesn't really matter. What matters is deciding which scenarios you care about and making sure you have security you'll actually use given those constraints.
Compile-time JSON deserialization in C++
Hello! I wrote this short blog post about using pattern-matching-like template metaprogramming to deserialize JSON at build time - please let me know what you think (especially if you see improvements)
Not just that, but cook kids change their languages weekly! HN is full of threads named: "<existing software> written in <language of the week>", and we all know how many people use that emacs fork written in ruby today, and how many will use the one written in Go in 10 years.
If this is novel and as reliable as I feel like they're claiming it to be, then this might be really big for svg-rendering in the web, absolutely amazing!
Thank you so much! I made some good progress tonight. Finished bringing up the system with all of our new electronics, and in the next six months we’re going to start building a small fleet of them!
You do realize that X isn't just meant to be Twitter.

Have you heard about X's new AI project?
Every annonymized communication strategy that touches state owned isp as endpoint is bound to fail. which is why starlink is such a game changer.
Ask HN: Which programming podcasts do you listen to?
Hi HN,

I love listening to programming or programming-adjacent/technology podcasts while I do chores, I would like to find more!

Please share your favorite ones!

Here are mine, in no particular order:

- CoRecursive

- ADSP (Algorithms + Data Structures = Programs)

- Two's Complement

- Darknet Diaries

- Lex Fridman (some episodes with programmers and programming language creators)

Im having a hard time finding ones not just hypong the next framework, but any of your favorites I'd love to hear about!

Edit: CppCast was my favorite, but its no longer as fun without the original two ;)
I think this is cool, but how sure are the authors that this is side-channel safe? There is a similar (modular, high performance, zero-dependency) library in Common Lisp but it can't give side-channel guarantees due to how some Common Lisp compilers implement integer and arithmetic functions

https://github.com/sharplispers/ironclad
PyGWalker: On-the-Fly Assistant for Exploratory Visual Data Analysis
That is cool! Would love to see how it works with FalkorDB as the Graph Database for the knowledge Graph https://github.com/FalkorDB/FalkorDB
syntax or something like that.
You do realize the article is from a British publisher?

I guess there's some irony in a verbose comment that misses the point when complaining about verbosity in journalism.
Years ago, someone would say "It is quite easy to write Python code that works just with all Python versions since 2.6. Easier than writing any Perl code..."

Then 2.7 came out.. and 3.0...
The number we put on the cake represents the number of "years old" (i.e. the number of birthday anniversaries) not the number of birth days someone had (obviously). Zero year-olds are 0, one year-olds are 1, ...
I have good experience with

https://github.com/pivotal/LicenseFinder

This produces BOM with versions but rather than out of date it focuses on licenses which comes handy during acquisitions due diligence. Supports many languages
Factory-programmed ones are for systems supporting secret key import, i.e. Microsoft Entra ID . It is not for replacing your Authenticator apps (although based on the same algorithm, TOTP).
As someone with anxiety (diagnosed) and a strong bit of OCD (diagnosed) of the particular flavor that makes cooking *very stressful* I am grateful for Huel and use it for many of my meals. Relatively reasonably priced, good-enough tasting (better with added spices and such), low stress, low commitment, way healthier than eating out for every meal.

I second this recommendation.

edit: to be clear, I mean their "ready to eat" or "just microwave" meals. Their shakes are good too; but the microwavable meals are where they really shine, in my opinion.
BB(5) = 47,176,870
Most of my web apps are built around tabular data.
You’re talking about the ethics of giving patients placebo medicine. That’s not what I mean.

I mean that I don’t understand why there isn’t more research into how the placebo effect works and whether there’s ways to make it work better. Reading other sections of the wikipedia article you linked, it seems to me that researchers have been stuck at “is the placebo effect even real?” for decades and few try to figure out how it works and why, and whether it can somehow be amplified. The answers to such questions might well influence the ethics discussion but “we really don’t get how it works so better not prescribe placebos” is a very unsatisfying stance to me.
Free will and the hard problem of consciousness are orthogonal concepts.
Completely unconscious automaton can have compatibilist free will and reverse. Compatibilist view does not require consciousness (in hard problem definition).

> which would you prefer?

Prefer is action, learned habituation response. There is nobody inside to see be aware of it according to Dennet. Simple control system with thermometer controlling heater has preference to homeostasis with certain temperature. Consciousness is illusion according to Dennet.

Just because I can verbally express my preferred state does not imply I'm consious.
> This is a bit of a pet peeve with anonymous Internet writing, but: are we supposed to know when you were at university? Do you know when I was? Why not state something like the number of decades or whatever?

Does it matter? I tend to read it as "haven't touched it/had any use for it since university".
they have ipads in 3400
There is some basics in cooking that is not too complicated to learn and master through practice (given we eat at least 7 to 21 times a week).

Like heat, seasoning (salt, pepper), fats etc

There really is the same notions at the base of every recipe. There is a lot of books and videos that cover those basics. In a month of time through observation you can start to develop a skill that will be useful literally for the rest of your life in a most direct and enjoyable way.

Given we are exactly what we eat, it can be so rewarding that it’s really worth the effort. The challenge of learning how all those chemical notions fit together is almost on par on the challenges of learning in IT in some way.

Please take the time to learn the roots, you will be able to cook without thinking really simple and amazing things in a small amount of time, you will never regret it.
> I really, really like that I can, more often than not, take a program I wrote decades ago and it will still run properly.

That wouldn't have changed with Perl 7, because Perl 5 would have been put into "long term maintenance mode". In fact, backward compatibility would have been even stronger, because all the changes would have gone into Perl 7.
PokéAPI
There are systems supporting WebAuthn as the primary method, such as Gmail or M365. The systems requiring OTP or SMS as a backup are just examples of bad security design. Still, even if you have OTP as a backup, and FIDO2 as primary - it reduced phishing attack surface to a certain extent
To each their own. I find them all edible but they’re all worse than literally any meal I’d be replacing them with.
It is also: only we can use it against our opponents.
This is called cloud fronting, and cloud services are slowly starting to block this tactic. If it still works, it won't keep working for long.
There are people in China who find wanting democracy just as abhorent as you find hate speech. It's a different value system. I'm sure they'd make similar arguments.

Again, political speech isn't just speech you happen to approve of.
It's gotta be an exceptionally awesome video to beat written text though. I'll take mediocre text over good video any day.
And you can tell based off all the other comments on here that you and I are in the minority on liking that it's stable. Even with all its faults.

I, too, have 20 year old perl scripts that still run fine.

I randomly have to bang my head on my desk over bs with python and php incompatibilities between versions.

Pets perl
Yep, as someone who has printed thousands of these damn labels in the past, this is the answer.
Great if you're not in the UK :(
Why do people eat 2 meals a day? Any other animals do that?
The first app store approved is Altstore PAL: https://rileytestut.com/blog/2024/04/17/introducing-altstore...
The cooking part has never been the stress source for me. It's the cleaning and prep time. Those stress me out hilariously badly; and, even if I use the dish washer (which is wonderful and I do use), I'm only one person, cooking for one person. I don't have the discipline, focus, etc, to meal-prep; and, I don't make enough of a mess to run the dishwasher every day - .. though arguably it would *still* take less water than manually washing.
Zero-based arrays are counter-intuitive for a while, but if you deal with a lot of data, you typically realize that it's a small price to pay to make manipulation much easier in many contexts. For instance, if you have a ring buffer of size N and an unwrapped position P, the wrapped position is:

Zero-based: P % N

One-based: ((P - 1) % N) + 1

It might seem trivial, but each +/-1 is an opportunity for confusion and a bug nest. With zero-based arrays, it's often the case that the only required +/-1's are when producing and consuming human-readable one-based text.

The next stop on the zero-based epiphany train is the realization that a convenient way to store a range is a { first, first_past } tuple. The size of the range is (first_past - first). The whole-array range is { 0, size }, while a simple empty range is { 0, 0 } (zero is often the default initialization, simplifying things further.)

Both elements are indices, so they can be similarly manipulated, compared and range-checked, making many 'if' clauses easier to think about and verify. If there is a bug, it often ends up being harmless because of the arithmetic properties of this scheme.

Once you start dealing with multiple ranges, the advantages are even more obvious. Two ranges are adjacent iff (first_a == past_b || first_b == past_a). The intersection of two ranges is { max(first_a, first_b), min(past_a, past_b) }, which is nonempty iff they overlap. An array of M adjacent ranges is stored as a uniform (M+1)-tuple.

This realization has become so second-nature for me that I'm probably overlooking four or five even better examples here.