skysight-inc/HackerNews huggingface dataset:
Show HN: Passphrase generator that makes an absurd-but-memorable story
I wanted to share a simple tool I just released:

Tool: https://strongphrase.net/

Source: https://github.com/blanchardjeremy/strongphrase.net

## Background

I have been researching password security and got interested in diceware passphrases (https://www.eff.org/dice). Though the original xkcd comic claims that it is somewhat easy to remember four or five words and turn them into a little scene, I often find it pretty hard to remember the diceware passphrases. (It's taken weeks for me to finally remember it).

I found this tool (https://getapassphrase.com/generate/) that generates phrases that are more memorable passphrases (original source from Ryan Foster: https://github.com/openidauthority/getapassphrase). I liked the tool, but I didn't like the interface, so I rewrote the whole thing in React and relaunched it at StrongPhrase.net (http://strongphrase.net/).

## My goals:
* Make the interface a little more intuitive for basic users
* Educate folks who are new to security about passphrases, passwords, and password managers.
* Learn more myself about entropy, password cracking, and current cracking capacities/times/costs.

Example passphrases:

* evil juror obtains thin moths
* drunk niece and greedy goose clean tall book
* emotional boxer and concerned virus acquire 45 smashed baskets

I find these a lot easier to remember because they are easier to visualize as a scene! (The downside is that the passphrases are longer to achieve the same level of entropy.)

There are many other formats that have varying amounts of entropy. (You can click the "show all 18 formats" in the top right.)

I am more of a security hobbyist than an expert. So this project was a chance for me to deepen my learning. Some of my key personal takeaways:

* Cloud computing is powerful - I started the project thinking that I'd focus on "time to crack," but a few sources (1Password blog: https://blog.1password.com/cracking-challenge-update/, Jacob Egner: https://jacobegner.blogspot.com/2020/11/password-strength-in...) convinced me that because cloud computing power is so widely available, if you have enough money, you can rent a lot of power and crack much more quickly.
* When passphrases are relevant - I already knew passphrases were designed for passwords you actually type. But I found it useful to really get specific about that list: password manager, laptop login password, and perhaps something like Google that you might sign into on new computers from time to time.
* Develop my sense of "how much entropy is enough" - The cost to crack table (https://strongphrase.net/#/table) on the site was helpful in this inquiry.

Curious to get feedback/input from this group! Thanks all!
"Idiocracy" Predicted the Future
It killed a whole fleet of processing unit in our lab back then which had been all put in service at the same time, ran 24/7 and then failed all within the same night.
Extra points for:

In a way, it's more accurate to say that the signaling system can infer where trains are because it knows where they aren't.
Yes, it is a mechanical system that invokes stochastic processes within deterministic bounds to accomplish a specific, complex outcome. Given sufficient knowledge, it can be mapped and its functions defined.

I believe that summarizes transistors, cells, and forest-to-sawmill machines.
Heh, sheesh, the prompt must've been "Give me a TED talk about an ATM glitch". Looked up the author, hah, he's got a Wikipedia page listing his blandly unremarkable career, and looking at the edit history, it looks like he was the one who created it...
"Just because you're paranoid, don't mean they're not after you..."

-Kurt Cobain, Nirvana (Seattle)
A rare Show HN game that works perfectly on mobile, like an app. Good game too. Well done.
This seems really neat. However, I'm on a Mac M1 with a stock install of DosBox-X and it seems like all the examples run incredibly slow even when I crank up the cycles to emulate a Pentium 100mHz (~60_000 cycles).

What would be nice is an example JS file called something like "bench-p100.js" along with an expected framerate range you should be seeing assuming running on various Pentium 100mHz systems (DosBox, DosBox-X, bare metal, etc).
I sometimes read the GitHub issues, lots to learn.
Location: Pittsburgh PA
Remote: Sure
Willing to relocate: Yes
Technologies: C#, Angular, React/RN, Swift, Go
Résumé/CV: https://www.linkedin.com/in/xmagee/
Email: alex at magee dot us
Isn't that basically what the article is saying?

The article is using the vocabulary of sociology, where "legibility" in reference to the state is a well-known concept. The article specifically references Seeing like a state and James Scott's other writings, but he's not the only one to think in terms of such concepts. Foucault's idea of the Panopticon is very similar - it's about the state maintaining control through the citizenry always knowing that they're watched - while Habermas's idea of a "lifeworld" ("metis" in this article) which is "colonized by expert systems" is the same phenomena.
You mean me, the aerospace engineer, who has published in this field, doesn't know how satellite constellations, link budgets, astrodynamics, the orbital environment, the systems engineering, and the other minutiae of this, doesn't understand the tradeoffs in building these things? What do you know, in a professional capacity? Tell me you're in this field, or piss off.

Tell me how big is space. Like, is it as big as the back of a giant tortoise upon which the flat earth moves? Is it bigger than a bread box, a telephone box, or a TARDIS? Wat is it???
I wanted to add a side note that I don't believe that all insurance types make sense in every situation. For example, I was presented with the option of buying pet insurance recently. I make enough that, for any given problem my pet might have, I can cover the expense. As such, there is no "catastrophic outcome" that would cause me serious financial harm. That, combined with the fact that the code of pet insurance is slightly higher than the expected cost for everything my pet needs, means it doesn't make sense for me to buy pet insurance. As such, I chose not to.

Admittedly, having it since we got her would have wound up saving us money overall, since she's had two CCL surgeries (at ~6-7k a piece). But the decision we made was based on expected cost and averages; so the choice me made was (effectively) a bet that didn't turn out to be the right one. But it generally _would_ be the right one given the facts we had at the time we originally got her.
I would suggest to use an LLM chat to generate ketogenic recipes - works well for me.
Just check what cloud costs you may endure. Serving static CDN files is cheap. Dynamic image resizing costs. I use the simple img tag as I am not interested in that optimization.
In this case, the company was providing a service that was needed for millennia - building temples.

Their structure seems to have been like a private corporation, with special rules and efforts to maintain their ideology and culture. They had the ability to expand outside the current leading families when necessary, though.

When they hit the recent hard patch, they pivoted, but didn’t scale back enough to survive until the next great leader showed up. They fell into the hands of modern corporations, and we all know how that turns out.
It's literally what it is. You for some reason think transformers are unique to language models - boy are you late to the game https://en.wikipedia.org/wiki/Transformation_matrix

A CSS matrix "transform" is the same concept.

Same with tile engines & game dev. Say I wanted to rotate a map:

Input

[

[0, 0, 1],

[0, 0, 0],

[0, 0, 0]

]
Output

[

[0, 0, 0],

[0, 0, 0],

[0, 0, 1]

]

The function is a "transformer" because it is not looking up some rule that says where to put the new values, it's performing math on the data structure whose result determines the new values.

> Not quite sure about "it's not based on rules" when your code has things like:
>
> const MATCH_FIRST_MODAL

Totally irrelevant to the topic. This is the chat interface itself which mostly just parses questions into cursors to be completed. You would be a fool to think ChatGPT has no NLP or parts-of-speech analysis. text-ada-embedding itself uses POS.

> Pretty sure your examples in the video are also cherry-picked

Fantastic detective work, you caught me. But just to confirm - why not just use it yourself? npm i next-token-prediction

Here is an example you can run very easily in Chrome, so you don't have to rely solely on your amazing bullshit detector: https://github.com/bennyschmidt/next-token-prediction/tree/m...

Don't forget to log the completions to prove that they aren't broken down by token, and instead just doing key/val lookups or text searches as you said.

> What really happens is, one of the hardcoded regexps transforms it to "Paris is"

The only thing you got right - that questions are transformed into sentences using conventional NLP in order to complete them. This functionality is what makes it a chat bot that you can ask questions.
How to deadlock Tokio application in Rust with just a single mutex
There were many reorganizations, bankruptcies, government interventions, and other churn in the last 20 years. Something came out with the same name, but the primary owner is currently Italy's ministry of finance. Whether the company "survived" is a good question.

It's like the Hudson's Bay Company, which claims continuous existence since 1670. That's really a unit of US mall operator NRDC Equity Partners, which acquired Hudson's Bay and switched to using that name. They also own Saks Fifth Avenue and various other department store chains.[1]

[1] https://www.nrdcequity.com/timeline
> what about the billions of uneducated rural people today that get along fine without treated water and don't drink wine or beer?

Less than 1 billion now without reliable nearby access to clean water[0], and "get along fine" is dubious - an estimated 1.4 million people died in 2019 from unsafe drinking water, sanitation and hygiene (more than 500000 from drinking water specifically) [1].

[0] https://www.wateraid.org/uk/what-we-do/water
[1] https://www.who.int/publications/i/item/9789240075610
Why are scrapers so popular nowadays?
They seem against any nay-sayers, so I’ll respect that and bite my tongue.

The silver lining is that, their idea (which they later reveal that they “forgot to mention” will also include full banking support and the issuance of cards) is very complicated and will require years of non-stop planning and paperwork before a single customer can be onboarded.

This isn’t handing your friend the keys to a jet and letting them fly a plane, this is your friend wanting to enroll in pilot school. It’s good to try, and, if you realize it’s not for you, there’s nobody harmed as a result.
Bluesky is decentralized, it's virtually impossible to ban this thing once it gets enough nodes running around the globe.

Not sure if it's better than Twitter for censorship.
Redefining words like that makes the resulting explanations misleading outside the narrow circle who already know enough to be aware of and understand the redefinition.
I've never seen a Bitcoin ATM that didn't have multiple warnings about fraud and scams. I also see similar warnings at store checkouts and near the gift cards.

Somehow people still fall for the scams. As long as the scammers are able to keep victims panicked, no amount of warnings will help.
Location: NYC, Philly, Chicago, Boston, Preferred. Open to others

Remote: No, Hybrid preferred but open to full time onsite

Willing to relocate: Yes

Technologies: Java, Spring Boot, Bit of Angular, Veracode, BurpSuite, Wireshark, Artifactory, K8s, Docker, Splunk, AWS Services, Atlassian Products, Terraform, Helm Charts, Git, and more.

Résumé/CV: Available Upon Request

Email: <HN Username> @ proton.me

For the past 4 years I have been building security tooling that internal teams can make use of. I work closely with other teams to help improve the security posture of their apps. I help write documentation and host department wide presentations to educate others about web app security and steps they can take to make apps more secure. I took on the responsibility of managing our H1 Bug Bounty Program which previously was failing SLA targets by 10+ months and managed to bring it down to days. I have helped mentor interns and junior developer and also been active in conducting pair programming interviews for future candidates.
What you get from me is a go-getter, self-motivated individual. I am always looking to improve not only myself but also my work.
Just for your information: when calculating trig functions, you first modulo by 2 pi (this is called range reduction). Then you calculate the function, usually as a polynomial approximation, maybe piecewise.

But if it supports larger floats it must be doing range reduction which is impressive for low cycle ops. It must be done in hardware.

It doesn't surprise me regarding denorms. They're really nice numerically but always disabled when looking for performance!
i have 10,000IU vitamin D (they contain K, too, though) pills. they're very small. The same size as the 600-800IU ones - although instead of having an amber liquid inside, they're almost solid yellowish white. The medium is coconut oil, which explains both the solid and the color. Anyhow my point is, 10,000IU isn't a significantly "large" amount of the active ingredient. they're oval-ish, so hard to measure, but i think they're under 1/4" in all directions.
Playdate Game Zero Zero: Perfect Stop
Stripe used to have really simple docs: paste in some js, paste in some example code on the backend, and you’re good to go.

Now it’s really really confusing. Payment intents are confusing. Figuring out which part of the docs I need is confusing. Figuring out the limitations of the self hosted checkout pages is confusing. The pricing is confusing. There’s narrative for one-click checkout that is comparable to PayPal (I guess there is “link” but seems like a separate thing?)

Give me a thing I can copy and paste. Give me a hosted subscription management page.

Finding a way to allow legal businesses to operate would be huge, though my impression is that you get yanked around by banks a lot.

Don’t nickle and dime me on features. Make it easy to get reports out.
Negative, representatives do not control their clients - they are the middleman that can explain process and likely result, but they are not the clients.
It's interesting to see African input methods taking inspiration from a Chinese IME, RIME. Would like to know more about this!
Most people don't know anything about how the banking system works. Anything beyond "you put your money in it, and you can take your money out with an ATM" is lost on most people. Checks are even more nebulous - it's an IOU that might be valid, or might not be. I still don't know why "post-dated" checks exist, or why my scribble on the back of a check suddenly makes it transferable.

Over 20 years ago, I bought and sold many items through online forums, and checks were common forms of payment. The prevailing advice was to wait a week or so after deposit for the check to "clear", meaning it was valid. Most young people have never used checks and have never been given this advice.
With QR code and modern banking system, this is more convenient for customers than ever. Customers can make order online, choose QR code direct bank transfer as the payment method, the store then display a QR code (containing the amount, charge ID and relevant bank account info) and the customer just uses their mobile banking app to scan the QR code and authorizes the payment. 5 seconds later, the online store gets a webhook notification from their bank/processor showing the payment has been received, along with the charge ID to finalize the order. The QR code payment system has been very successful in other countries but not in the US yet.
US Seizes Venezuela President's Airplane in the Dominican Republic
hey this bug is fixed! thanks
Immunity debt is simply not a thing. Just like the notion that a few weeks of masking (at most) somehow gave rise to long term speech issues. [1][2]

[1] https://www.salon.com/2022/12/04/does-your-immune-system-nee...

[2] https://www.explainxkcd.com/wiki/index.php/2557:_Immunity
From the screenshots in the article, it looks like people are then transferring the money using online services. There are no limits I know of to how much you can spend on Venmo etc per day, so it could be life changing amounts.
Because publishers don’t push structured data or APIs enough to satisfy demand for the data.
TikTok - let's teach you how to commit plain old check fraud and call it a "glitch" for clicks.
Iranian writer is sentenced to 12 years after tweeting a dot at supreme leader
In case they need to figure out what exactly they need to do: https://news.ycombinator.com/item?id=30650828
On Remixes, Covers, Adaptations, and Maps
I'd say scrapers have always been popular, but I imagine they're even more popular nowadays with all the tools (AI but also non-AI) readily available to do cool stuff on a lot of data.
Most Sudanese people are not involved in that.
I’ve noticed that my ads get far more specific when I have mic and camera access enabled for Instagram (which is required in order to post stories with certain features). In fact, I’ve often (correctly) realized I accidentally left access on after posting due to a hyper-specific ad relating to a recent conversation.
Got it, but why is it booming now and often it’s a showcase of llm model? Is there some secret market/ usecase for it?
Location: Sweden

Remote: Yes

Willing to relocate: Yes

Technologies: Physical Hardware/Google Cloud, Rust, Python, Go, PostgreSQL - basically any "DevOps tools".

Résumé/CV: http://linkedin.com/in/jharasym/

Email: jharasym [at] linux.com

I'm currently working as a non-founding CTO for a small-ish AAA game company (my reports: 34, company size 51) where I have built a team that is really solid- it hurts to leave but I'm very open to becoming an IC again.

My background is classical sysadmin (sysadmins who could write C and Perl) and I was trained by former Google SRE's over a decade ago. Since that; I've shipped multiple AAA video games (The Division and The Division2, VtM: Bloodhunt) where I focused on online infrastructure in mixed environments (Windows, Linux, BSD). I've navigated politics of 20,000+ person companies and consistently delivered in companies of <100. - before games I worked in SaaS and e-commerce products in highly secure environments.

I would ideally find a role in working with hard problems related to orchestration of physical machines (as eking out efficiency and automating awkward things is where I find the most joy), working in a high trust environment where I am expected to be self-motivated. I work with a very high degree of pride and this can be a blessing in many situations as I have always gone above and beyond what is needed and adapted to needs to get the best solution available.

I am adaptable, and hardworking, my only true desire is to be proud of what I do.

I'm willing to relocate anywhere for the right job, I have worked fully remote before and have a good working setup, but in the early months I find it much better to be able to synchronise context face to face.

I'm a dual British and Swedish citizen, if that matters at all.
Is it possible to achieve good results using the open source models for scrapping?
When the cost of making a change gets close to zero, it's easy to keep fiddling endlessly...
This paragraph suggests that some children are affected more than others:

> Her charity has found 1.9 ­million children in the UK – one in five – are struggling with speech and language. The problem had already been building before the pandemic, especially in disadvantaged areas.
That's a cop-out, not an explanation. It's not like anyone expected new physics or ET to be the explanation; of course it was going to be some interaction of complicated systems.
Love the illustrations, really great usage of excalidraw!
I know the entertainment industry is obsessed with reviving old franchises, but this is going a step too far!
There's a very steep tradeoff between the approachability of a macro and that of its expander code. Look at Rust macro_rules!, or Scala macros, or Template Haskell. A formal grammar can define a strongly-typed deeply hierarchical data structure, but the code to drill in and map to a different deeply hierarchical data structure by hand seems to become a nightmare. Even Scheme hygenic macros are noticeably harder than "take a macro call as a list, use quasiquote to return a list that starts with PROGN" which makes it actually feasible (if risky!) to start cranking out macro expanders.
One that is not mentioned here but that I like as a general principle is that you cannot have exactly once delivery. At most once or at least once are both possible, but you have to pick your failure poison and architect for it.
thank you very much for the failed replication!

it's interesting, my machine is fairly similar—ryzen 5 3500u, rustc 1.63.0, luks on nvme. is it possible that rustc has gotten much faster since 1.63?

while i agree that it's not the most important test for day-to-day use, i don't agree that it falls to the level of nonsensical. how fast things are determines how you can use them. tcc and old versions of gcc are fast enough that you could very reasonably generate a c file, compile it into a new shared object, dlopen it, and call it, every screen frame. there are some languages, like gforth, that actually implement their ffi in such a way, and sitkack and i have both done some experiments with inline c and jit compilation by this mechanism

i do agree that the syntactical choices of the language have relatively little to do with it, and your rustc measurements provide strong evidence of that—though perhaps it is somewhat unfavorable for c++ that it commonly has to tokenize many megabytes of header files and do the moral equivalent of text replacement to implement parametric polymorphism
Although I agree with all the issues you raise, I think the confusing nature of the pricing is by design.

Stripe's fee model probably makes serious bank, because it's quite non-transparent and basically nothing is provided for free. Want even the slightest extra feature? +1% of your revenue (and repeat)
Way to make some of us feel old, lol. It was a common enough acronym when it was a very common service.
To scale such an approach you could have the LLM generate JS to walk the DOM and extract content, caching the JS for each page.
Finishing is super important. Just focus on completing a version 0. Then, you can improve it if you feel like it. It doesn't have to be perfect, just finished under a reasonable timeframe.

Not finishing and endlessly moving from one project to another is bad because it prevents you from making meaningful progress. You end up spreading your efforts too thin and never see the results of your hard work. This can lead to a lack of closure, decreased motivation, and a cycle of unfinished projects that never reach their potential. Moreover, without finishing, you miss out on valuable feedback and the sense of accomplishment that comes from completing a project, which can be crucial for personal and professional growth.