skysight-inc/HackerNews huggingface dataset:
> It depends on how a web site implements it, but keep in mind that everything that makes it easier to recover from a lost key also makes your account more vulnerable to attack. So having backups of your passkey keys is a really good idea. But those backups don't have to be in the cloud. You could keep local copies on your own devices, or even print the key on a sheet of paper and keep that in a safe.

Obviously this isn't bad advice, but it is the reason I won't be diving into passkeys any time soon. Firefox Sync (the original version) had this philosophy: it's perfectly secure but if you lose your key, you've lost your bookmarks, history, and anything else that gets synced. For non-power users this is a catastrophic failure mode. For power users this still happens and it sucks. I was at Mozilla during this time and the failure modes of Sync were impressively common, even among employees.

Nobody expects to lose their backup. If you were a victim of hurricane Helene, it's entirely likely your safe is gone and all of your devices are destroyed. If that also means you've permanently lost access to your files or email or whatever, that's really really bad. And completely within the realm of possibility!

Obviously you can't fix this with cryptography alone. But it shows that passkeys can't be implemented as a full solution.
The Analogue 3D drags the fondly remembered N64 into the 21st century
Under US law, for works created by companies the term is a flat 95 years from publication, so MS-DOS 6.22 will become public domain on January 1 2090.

You and I will likely be dead.
> If something is on there it is most likely by design.

It's a common mistake to overestimate the 'bad guy'. The Chinese government, like all other large human institutions, certainly does plenty of dumb stuff.
Hmm I would say should be doable by ai models. Will add some clickable topics / tags to the top bar
I'm not sure what you mean? It simply lists existing tags from all my blog posts, so they've already got my seal of approval as I've used them before. I could add "number of times used", but I've not needed it. It's not synthesizing or hallucinating new tags from content. If I want a new tag, well, I think it up myself, though after many years of blogging it's not a common occurrence.
Daily reminder that the world is still on fire.

http://encyclopedia.uia.org/en
I recommend privacy.com. It's bulletproof. Single use card? Check. Merchant-locked? Check. You are in control. It costs $0.
Can't tell how things are looking on desktop right now, but after seeing it on mobile I wish texts had a bit bigger font.

Otherwise it's a nice job, congratulations.
Implementing Regular Expressions in TypeScript Types (Badly)
You misidentify the core problem, or at least why it is a problem from a business perspective.

The problem isn't cheating itself, the problem is players feeling like they have been cheated (and thus not buying micro transactions in the future).

If you can limit player action to things that look plausibly human, less players will feel cheated and will be less likely to drop out.

This system would be put in place on top of existing systems and if implemented as I have described could be done so fairly cheaply from a operational perspective (getting it off the ground will require a good bit of dev time).

If you had ELO based matchmaking (that dropped matches where the player performed far below what they had previously done to prevent sandbagging) a cheater with "perfect play" would end up only playing against other cheaters after a time.
How exactly do you get someone to give their passkey private key to a bad actor?
Two main ways: first, as I said in my original comment, you don't reveal the key when you use a passkey. So at worst a phisher might be able to get you to sign a challenge that they are facing to get into your account once, but they would not be able to re-use your credentials to get in again or to get into another site. And second, in a proper implementation you would have a separate key for every site you want to authenticate to, so a phisher would not have to merely phish you, they would have to mount an MITM attack on an HTTPS session (or find some other way to impersonate the site they are trying to phish your credentials for). That's not impossible, but it's orders of magnitude harder than impersonating a site through a typosquatting attack.
Ironically, probably just sleepiness - I was posting from bed with an infant that wakes up periodically. Sadly WiFi is not opt-in in my bedroom :-)

It was Finnair from Berlin to Seoul, via Helsinki.

Edit: I found a YouTube video showing a version of this feature from 8 years ago, but I think the one I saw was a bit more refined: https://youtu.be/5-CrsPAZslg - still, interesting that it's this old and I haven't seen it anywhere else.
I'm very jealous of the cegep program, as a resident of neighbouring Ontario. For all my Quebec friends, it just seemed like an amazing way to test different experiences before committing to a degree. In addition, the work you do in cegep counts towards a bachelor's degree, so french students end up finishing their degrees without losing a year.
> Also, Apple's fear of I/O

How many other VR headsets do you know of with print support?
The title is from the original article (https://petewarden.com/2024/10/16/ai-pcs-arent-very-good-at-...), the URL was changed by dang: https://news.ycombinator.com/item?id=41863591
I just got an iphone and the whole photos thing is absolutely garbage. All I wanted to do was look through my damn photos and find one I took recently but it started playing some random music and organized them in no discernible order.. like it wasn't the reverse time sorted.. Idk what kind of fucked up "creative process" came up with that bullshit but I sure wish they'd unfuck it stat.

The camera is real good though.
But that's not a problem with passkeys, that's a problem with Firefox Sync.
the ARM SME could be an interesting alternative to NPUs in the future. Unlike the NPUs which have at best some fixed function API it will be possible to program the SMEs more directly
My favorite visualization:

https://youtu.be/8W7bGOGsbbk
Just to be clear, encryption to hide from broad government surveillance is one valid use for encryption (which WeChat doesn't have), but it is far from the only reason for encrypted communications. Common theives, abusive exes, or overbearing employers are a few others that immediately come to mind.
The big picture which everyone is missing is that we need 'peaking' gas plants to cover the shortfalls over the next 10-20 years until grid storage catches up. There's no commercial incentive for these to be built, so they'd be at the expense of the taxpayer, and they would be sending GHG into the atmosphere. The 'bad news' is if this capacity isn't built, renewable output will drop enough for blackouts to become common, potentially causing more coal/gas/nuclear to be built, and sending back the progress of renewables by a few years.
From Geometry to Algebra and Back Again: 4000 Years of Papers
Almost! The "nouns" are manually entered words/phrases that I want the system to automatically emphasise throughout the post. I would miss many instances of words whilst doing manual markdown formatting, so it's another case of automating annoying and error prone work. My code is on GitHub, but it's just a small Jekyll plugin that uses regex to automatically wrap specified phrases in emphasis. Nothing groundbreaking, but a useful time and error saver!
I know it’s a lot of work but this would be great and it may give readers a deeper understanding into security in general.
Phishing relies on visual confusion to get people to enter their passwords on a site that isn't the one they think it is.

WebAuthn credentials are bound to the issuing domain, so the user agent will not supply a passkey to a domain other than the one it should go to.
nbb is is babashka for node - https://github.com/babashka/nbb

babashka was created to mitigate JVM slow startup. It's great for system scripting, automation, etc., basically a lightweight Clojure.

I think any programmer would benefit from learning a bit of Clojure. It's really nice for dealing with data, automation, etc.

I once had to scrape hundreds of videos from a website, and I was pleasantly surprised how quickly I was able to get it right, after setting up Puppetter and Cljs REPL, I interactively, from the REPL "clicked through" things controlling the browser, and created an async pipeline that opened hundreds of pages, looking up for video metadata and delegating the task of fetching videos to yt-dlp.

After learning Clojure and Clojurescript, I felt like all these - Python, JS, and Java are overrated and needlessly messy. I'm so glad I don't really have to directly deal with them daily. Even Lua, which before I had no problems whatsoever, and really enjoyed using, suddenly felt like "meh," and I'm glad there's now Fennel, which is not Clojure, but is very similar to it.

It's been years since I made anything mobile-native. I'll have to be choosing between React Native via Clojurescript and Clojure-Dart - which is very nice.

I am very excited about Jank-lang, can't wait for it to hit the first production-ready release, it will open some new possibilities.

So, I guess, I wasn't completely honest in answering what my "go-to" language is - I really don't care, it's just a matter of picking up a Clojure dialect for it, which itself being a Lisp dialect, is a choice among many other flavors of Lisp. Want to be a true "polyglot" coder? Just grab a Lisp.

I can understand why Lispers are often perceived as "crazy ones", it does sound crazy - "How is it possible for a single language to get absolutely everything right?". Well, no, it doesn't get "everything right", but at the very least the ideas it exposes you to can shield you from having to memorize the weirdness of tons of other languages.
The total size isn't so surprising to me, many have large archives, but why would it all be local to your main or external drive instead of just loaded on-demand over IMAP or whatever?
Again, ya’ll are living in a different world. Passkeys doesn’t have to support your use case, you’ve already got FIDO 2 keys for this. Physical keys have been readily available for over a decade from yubikey and the market penetration for consumers is basically zero.
I agree. Here the use of SASS is inherited and I don't see much benefit in redoing it.
Are you talking about the people listening or the person speaking? I was talking about the former, whereas you seem to be talking about the latter.
Games lay out one game.

Document readers lay out every possible document.
Snapdragon touts 45 TOPS but it’s only int8.

For example Apple's m3 neural engine is mere 18 TOPS but it’s FP16.

So windows has bigger number but it’s not apple to apple comparison.

Did author test int8 performance?
Windows 11 24H2 update prevents clipboard history feature from working
Glad you like it, but it's a million miles from my ideals. I want my content to be under my control and free to read without obstruction. My blog loads hundreds of times faster and uses far less bandwidth than a Substack newsletter blog.
When is the AI bubble expected to burst? Any forecasts or timeframes—whether short-term or long-term—being proposed with high or low confidence?
Won’t help with restoring metadata, but if you add books by using the “email to kindle” feature it will keep them in your library through syncs
> might have

The article proceeds to mention 3 other examples of public figures going even further and not facing consequences. This is a nothingburger.
We used them at a bulge bracket investment bank and they failed miserably...
One thing I wish the tech companies would do is to use LLMs for junk moderation. At least to flag potential junk.

Meta uses they LLMs to summarize comments already and can do this, yet they choose to allow obvious crypto scammers, T-shirt scams, “hey add me comments”.

A simple LLM prompt of “is this post possibly a scam”, especially for new accounts, would do wonders. GitHub could likely do it too.
I always thought that the main point of NPUs is energy efficiency (and being able to run ML models without taking over all computer resources, making it practical to integrate ML applications in the OS itself in ways that it does not disturb the user or the workflow) rather than being exceptionally faster. At least this has been my experience with running stable diffusion on macs. Similar to using other specialised hardware like media encoders; they are not necessarily faster than a CPU if you throw a dozen+ cpu cores on the task, but it will draw a minuscule part of the power.
"and forking the standard" isn't necessary if you're not going to implement it.
Minor correction (I'm assuming it was a typo) -- the secret for the passkey should be the private key. The server stores the user's corresponding public key.

Based on my (limited) understanding from reading the page:
1. Server generates challenge, sends a challenge
2. User device signs the challenge by encrypting with its private key, returns the signature.
3. Server verifies the signature by decrypting with the public key.

As you mentioned, the private key (the only thing that can generate a valid signature) isn't leaked.
Those new service sector jobs: get paid to respond to HN comments
What we really need right now is "black hole" of information. A place where you can push stuff, but retrieving is impossible until that time when ironclad legitimation can be automated.

Insane that only examples of me myself ever doing anything is in printed copies from 1970's. In National Archives where some aunties still believe that Internet is just a passing fad.
It’s directly against their priority of influencing you to only purchase ebooks through their monopoly. Whether anti-competitive, anti-user practices are malicious or just a consequence of capitalism run wild, I don’t think there’s much of a difference
What non-uniform field of neutrinos would one expect? I seem to recall that neutrinos come from every direction. Perhaps some stellar event like a nova? Otherwise the image would be the same everywhere, as the sun is relatively uniform.
Very cool! If it had existed a handful of years ago I probably would be using it. I started out using Forestry which was pretty cool, then was closed, at which point I decided to edit everything locally.

But I'll keep an eye on your repo. Good luck with it!
I have a kindle that just displays the book cover. Are you sure it’s not just a setting?
Is WeWork a Theseus' Ship? [video]
News dropped this week that the WeWork that has come out of bankruptcy is going a slightly different route, partnering with other coworking space operators instead of opening their own space everywhere.

In this interview their CEO shares that the idea is to allow members to book workspaces even in cities whether there are no WeWork locations.

Would love to hear your thoughts on whether this is indeed a wholly different WeWork, or the same WeWork that ran aground last year?
Student was punished for using AI–then his parents sued teacher, administrators
No you don't. The open source project is here. You can self host and try it easy - https://www.fluvio.io/docs/fluvio/quickstart
Just FYI, this is now a Kindle option too. https://www.amazon.com/b?ie=UTF8&node=23435466011
Why would I want Android on my e-reader, again?
> I hope this was in violation of the regulation: surely you can't invent a new mailing list that didn't used to exist, add me to it, and require me to unsubscribe from it individually.

Exactly, this is the core of the problem. Thought I am grateful for the "unsubscribe" option... I am putridly disgusted by the humiliation of unsubscribing to something I never subscribed to in the first place. It's just awkward and sleazy all around. Put simply : if a name is to be added to such a list, it shall require the consent of said person a priori, a new consent must be made per each list, with blanket future consent strictly banned, and secondly mass solicitations for consent also banned.

To those of you who live in California, I expect many, I would advise in these cases to invoke the CCPA act i.e. (a) "give me all the data you have on me" (b) "delete all the data you have on me". You need to ask (a) first, then given that, then ask (b). If you imply you want the data deleted, they will just delete it and say "oopsie we can't provide you the data", so it's important to perform this sequential order. If Californians did this at mass scale I would imagine there would be a lot of positive bleedover to other states in limiting this behavior.
I will second that the Kobo Libra Colour is an excellent device. To me it's the perfect reading device. To anyone using Calibre with it, make sure you get the Kobo plugin that transforms epub into kepub when sending to device. It normalises text size, margins, and so on so the reading experience is consistent no matter where you uh... procure your library from. I reconvert all my epubs anyway, but that step is critical.
That sounds like an interesting approach.

I am curious about the details of how you do it.
It depends on your security risk profile and the type of passkey provided. The passkey's response describes if the credential is transferrable or not, and if the user has been positively verified as present.

They're as secure as having your password + 2FA in a password manager.
No one has the storage capacity necessary to store that much audio content, let alone video.

Furthermore, the incremental benefit over traditional ad targeting via search or web history is probably pretty marginal, and not nearly worth the effort/cost. All of these scenarios (Jake Jacobs' wife, Jeff Jone, Jennifer Smith) are already going to show up in a traditional search history, why would an ad company go through all that effort to get data they already have? This is real life not a Mission Impossible movie.
If you know that you need to offload matmuls, then building matmul hardware is more area efficient than adding an entire extra CPU. Various intermediate points exist along that spectrum, e.g. Cell's SPUs.
Small discussion (21 points, 8 hours ago, 13 comments) https://news.ycombinator.com/item?id=41861818
kindles have displayed the book cover on the lock screen for approximately the last decade.
LOL. AI generated the image. But as far as I understand AJ wrote the rest. But it's a dry subject. I am curious what makes you say it is an AI generated Ad?
My comment, in retrospect, came across needlessly aggro and dismissive, and I apologize for that; the downvotes were justified and I don't know what frame of mind I was in. Your comment struck me as a complaint about circumstances though rather than interest, to which I'd say have at it, do what you want to do with the tech you want to do it with; I just personally can't relate to the temporary lack of novelty during a commute seeming like a sensible reason for spending so much on this particular kind of device that doesn't really seem to serve another purpose. A steam deck, iPad pro, portable gaming system perhaps, all kinds of others, but the AVP seems like a bit out of scope somehow. I personally bring along a Nintendo DS, or a book, or whatever else, but I'd kind of think if my commute was so sufficiently long and dull that I'd want something more substantial, I'd just really start looking into a much bigger change.

I've taken the train across the Canadian prairies, and my god is that dull, but I just chatted with people, did a bit on my laptop, looked out the window since there always is one, read, used my Gameboy. If I wanted to completely immerse myself in anything but the train experience, I'd just fly, it's cheaper anyway
I run an app that Serves a small, specific demographic.

We get about 50% [obvious] spam/scam signups (only 5 or 6 a day).

That’s pretty sobering, when you consider that it’s a very low-profile, unpromoted, region-locked (US, Canada, Ireland, and India), iOS-only native app.

We vet each signup manually.
Yeah every hour on the YouTube app. Probably a google feature though. Ha
It's a problem for anything where you need to manually keep backups of key material. It's why so many cryptobros lost millions (billions?). If you expect the average person to keep their passkey backup stored well enough to avoid the possibility of physical disaster or losing access to their Google Drive, you've set them up for failure. And when the stakes are losing access to your online life, that's a catastrophic design flaw.
> Common theives, abusive exes, or overbearing employers

as I commented on other thread, they don't even bother with network protocols.

They just mandate install spyware on your end devices. So E2EE won't help here.

Chinese Android ROMs are notorious for this. Even the phone manufacturers are collecting data
Similar to my comment above, there is a difference in having programs that follow closely with communist ideals and having a government or state that labels itself as communist.

I don't have stats for Switzerland handy but did look up Australia earlier. About 4% falls into there state-managed housing programs. That isn't nearly large enough to rival what the Soviet Union had for example, but the design of the system does seem to match with many communist goals. That is by no means a claim that Australia is communist, just a comment on their public housing program.
If you actually want to block emails, you need an email security gateway or some control over inbound anti-spam policies (ie pay for Google Workspace or another email service). Consumer email is not intended to give you full control.
If you believe that the progress is achieved when the masses have it the worst, then the deteriorating condition of the American middle class will naturally help it. What's the point in this accelerationism with allies as casualties then?
DJB's rant wasn't even great at the time and technology has advanced since then. Sadly, a bunch of people have gotten a pretty wrong understanding of IPv6 by reading it. And of course DJB has neither updated it nor deleted it.

NAT64 is indeed a form of CGNAT, but everyone today is behind NAT44 so it's no worse. And remember that you can do P2P over native IPv6 so you're better off in that way. Networks like T-Mobile that use NAT64 today are seeing >50% native IPv6 traffic and <50% NAT64 traffic. Eventually the NAT64 traffic gets smaller and smaller and when it hits ~1% you could decide to turn it off.
I have no programming skill at all and I don’t know a ton about ArchiveBox except I set it up and ran it for myself for a while, so I’m asking as an innocent, ignorant and curious geek, but is this something that could be adapted to peer to peer distribution or some other means of making it simultaneously as private and local as you want it and as distributed and bulletproof, uptime wise, as possible?
I went through the CEGEP system in Quebec and honestly credit it with giving me the skills necessary to be successful in university. My high school was very lenient and gave me a lot of flexibility to work on personal projects, and overall that worked out great but I was definitely lacking the grit necessary to dive deep into topics I couldn’t quickly understand.

CEGEP provided an excellent transitionary structure where you had both more responsibility for your actions and results, and also a forgiving safety net. You’re forced to do near-university-level study of subjects in an environment where the professors are able to hold your hand a bit more, will tolerate late assignments, and if you screw up it won’t permanently tank your future academic prospects.

The tuition at CEGEP was free. You just paid a few fees to the school and the student union, which added up to about $120/semester at the time. This made it a lot more palatable to try out a math- or science-heavy stream and switch out of it if you decided it wasn’t something you’d want to continue in university. The gen ed classes were also great.
According to switch setting it appears the cat is unable to provide power via USB.