skysight-inc/HackerNews huggingface dataset:
If my primary device is compromised and my master password is compromised and the device that I use for second factor authentication into my password manager is compromised then the secondary device that I could use for 2fa codes is compromised. For most normal people, storing second-factor codes in Bitwarden alongside passwords is marginally worse at worst, and inconsequential at best.

Yes, if you use a bad password manager that is fundamentally flawed (like LastPass) then all bets are off but that's not an argument against the principle of storing 2fa codes alongside passwords in a password manager.

I doubt there's a single Bitwarden user on earth who has ever suffered a security incident because they store their 2fa codes in Bitwarden, that's how inconsequential this risk is.
thanks for pointing this out. i knew not to get excited everytime something is posted on the frontpage.
"When he couldn’t put his double major in English and history to use"

"I’m sick of partying. I did that already."

whether or not you are right about the impact of policy choices, you still can't ignore personal responsibility as well. if you party your way through school to get a useless degree, then double down for a law degree you don't (or can't) use for unspecified reasons, i don't see how any policy is going to have a different outcome.

the idea that if all you did was get a college degree, didn't matter in what, and you were on "easy street" hasn't been true for at least 30 years before he graduated, probably never was.
"Soon": Get the process going, ankle monitor strapped and movement of suspect restricted, continue the law enforcement investigation, and make additional charges if violations are identified.
I was using JB Mono until recently I started switching to Iosevka - it's narrower and provides more horizontal space. Both fonts are great.
Putting your 2FA into your password manager doesn't "reduce" it to "something you know". It proves it was "something you know" all along. If it can be put into a password manager, it's "something you know", regardless of what the intention is or was. Intentions don't drive what things actually are.

On a related notes, "passkeys" are also "something you know" for the same reason.

However, that does not mean that TOTP codes are useless. Not all "something you know"s are created equal. However, I shamelessly put my TOTP codes into my password manager. Just because some people mistakenly identified it as "something you have" doesn't mean I need to pretend they are correct. It just inconveniences me for no security gain.
We use nextjs because we want to optimize the page for SEO and crawlability. If you don’t need your page to be crawlable (eg a dashboard behind a login), then there’s a good chance you don’t need nextjs, and pure React will indeed be simpler.
Just because you categorize something as a leisure activity doesn't mean someone shouldn't do it with an objective in mind.

Daily creative writing, journaling, (trying to) learn to dance, reading books in Spanish when I'd get more enjoyment reading in English. These are all things I've done with goals in mind beyond leisure. In fact I don't particularly enjoy them enough to do them without an objective, else I wouldn't have had to go out of my way to do them.

You don't enjoy everything or else you wouldn't have to try at anything.

> When someone binge watches a new TV series on Netflix no one asks them what skill they were trying to sharpen by enjoying that media.

But they weren't demanding this of anyone else. It was an objective for themself. You are actually the one demanding something of someone else just because you have different preferences. ;) Is that a great mindset?
It seems cool, but why the mandatory 24 hour auto-delete?

edit: I guess if it took off, you'd incur storage costs :thinking:
I suggest reading the actual report linked in the article. You don't need to change the amount of total visa numbers. Tesla has requested over 3% of the total allocation, around 2000 visas. These are typically decided by lottery but I imagine a friend in high places can make sure that lottery leans more your way then it originally would.
There are a couple of differences:

1. While a password manager should associate a TOTP seed with a domain and only fill codes on that domain, the codes are still visible to you. A convincing phishing attack might trick you into manually entering a code into a fake page. Passkeys don't allow this.

2. TOTP codes are derived from a seed shared between the client and server, so an attacker who gets read access to the server's database could generate your codes. With passkeys, the server can only validate a signature, not generate them.
The primary reason I used 1password + 2FA at both my business and in my family is really simple: 1password creates a shared 2FA process. That is, I can create a 2FA login that someone else in my team or family can also access.
Yes. "A communist state" is an oxymoron. Communism is by definition stateless. Government/governance, sure, but without a state. Rojava would probably be a better example of communism (in practice) than Soviet.
Check out this video at the 22:20 mark. The goal he’s pursuing is to have the LLM recognize when it’s attempting to make a factual statement, and to quote its training set directly instead of just going with the most likely next token.

https://youtu.be/b2Hp0Jk9d4I?si=SwfKJrck5_0LPgTH
I bounced off Midnight’s Children the first time I tried to read it, but that was probably 10 or 15 years ago now. I’m in between books at the moment, so your comment will push me to put it on the top of my list for the new year :)

Girl, Woman, Other is one of my overall favorites from the last few years. Th character work is phenomenal. Do try to read a hard copy, rather than on an ereader, if you can. The book uses punctuation and the layout of text on a page creatively, and I’m not sure how well that gets preserved in an ebook.
I disagree with the experts here. There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault. At best, this is a lateral security trade-off that you are paying them to provide. View the 2FA feature from a software marketing and sales lens. Can you see how it's just feature creep, driven by competition doing the exact same thing?
>Your huddled masses yearning to breathe free,

Woefully out of date. We don't even politically understand the concept of freedom anymore. Hell, just look at how much of our jurisprudence is pinned on the "Interstate Commerce" clause, which somehow applies to purely Intrastate commerce.

Furthermore, the vaunted "freedom" provided nowadays is the freedom to die for refusal to accept the current yoke of the "captains of industry" who ran off with the reins of our legislative, executive, and judicial branches.

The United States is post any ideal expressed on that plaque, and too afraid of the people already here to even live up to it's founding ideals as written. The only way anyone wants to get anything done is to ship in people who ultimately won't suffer the consequences of the work they're doing, then weaponizing the output of that work against the group of people here who refused to enable them in the first place.
The prediction markets are mostly illiquid and filled with degenerate gamblers trying to turn a 0.01 into a 1 so they overestimate tail chances because of the financial incentive. Because of the long lock-up period, you can't arbitrage it with better knowledge: i.e. a 7% can't be turned into a 1% because "by 2030" locks you up for a really long time for small value.
> The Constitution also says the courts interpret the law

Which clause?

If you read it, I think that you’ll be surprised to find that it doesn’t actually state anything about interpretation. It was in Marbury v. Madison that the Supreme Court invented the doctrine of judicial review.

I actually agree that the power of interpretation is implied by having a judicial power at all, but it’s not in the black and white text.
Sounds useful for urban planning and architects.
And if the entity doing it is a big enough company.

It's interesting to imagine the legal landscape if/when this technique is applied to MPAA/RIAA content, and everybody is sharing the foundational model plus the "prompts" that will have it make "your" movie.
Mostly agriculture, mining, and (re-)moving rock.
Unless the page gives you a captcha before the TOTP, which it definitely should.
The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password. Your point that if you've already decided to enter your password then entering the 2FA code isn't much of a hurdle is sound, but from the perspective of a user of 1Password, it is indeed very surprising (and rare!) when I try to log in to a page and find that 1Password won't show my log in because the domains don't match. It happens, usually due to some cross-origin login flow, but it's rare. So I think the claim isn't false, it's just based on a premise that might not factor in for different people.
No tool is perfect for every job. That said, the positioning of the RTK unit is crucial. Possibly look for a mower which can work with multiple RTK units, or reposition your existing one for better coverage.

I find that even though signals get significantly weaker under trees, mine still works wonderfully in a complex large garden scenario. It will depend on your exact unit/model, as well as their firmware and how it chooses to deal with these scenarios.
Except there isn't a good general understanding. Quoting [3] from Wikipedia's entry at https://en.wikipedia.org/wiki/Terrorism :

> "The ordinary current use of the word terrorism is much too wide. That is to say, if we list all the different phenomena which are at one time or another described as terrorism in ordinary conversation, or in ordinary newspapers, or by ordinary politicians, we will end up with a huge rag-bag of not very similar items . . The disadvantages of trying to construct an ordinary-language definition based on current usage can be seen, too, in the plethora of conflicting definitions occurring in philosophical and political literature. Thus philosophers for instance disagree about whether or not terrorism is wrong by definition or wrong just as a matter of fact; they disagree about whether terrorism should be defined in terms of its aims, or its methods, or both, or neither; they disagree about whether or not states can perpetrate terrorism; they even disagree about the importance or otherwise of terror for a definition of terrorism."

If you're going to be pick at nits, you need to be aware of the nits.

Violence used to extort money from a person/group of people is not generally considered terrorism, but your definition says it would be.

Violence against combatants is not generally considered terrorism, but your definition says it would be.
It's not hardcoded, reissbaker has addressed this point.

I think you are misinterpreting what the argument is.

The argument being made is that LLMs are mere 'stochastic parrots' and therefore cannot lead to AGI. The analogy to Russell's teapot is that someone is claiming that Russells teapot is not there because china cannot exist in the vacuum of space. You can disprove that with a single counterexample. That does not mean the teapot is there, but it also doesn't mean it isn't.

It is also hard to prove that something is thinking. It is also very difficult to prove that something is not thinking. Almost all arguments against AGI take the form X cannot produce AGI because Y. Those are disprovable because you can disprove Y.

I don't think anyone is claiming to have a proof that an LLM will produce AGI, just that it might. If they actually build one, that too counts as a counterexample to anybody saying they can't do it.
Kavout is excited to announce the launch of Smart Trading Signals for cryptocurrencies, including Bitcoin (BTC), Ethereum (ETH), and 160+ other assets. This new feature helps you identify high-probability trading opportunities across crypto, stocks, and ETFs—making Kavout your ultimate tool for smart trading.

With over 100 premium signals across daily, weekly, and monthly timeframes, Kavout empowers traders to make smarter decisions. Signal categories include Trend, Momentum, Volume, and Volatility, designed to spot market direction, price acceleration, and trading activity.

Holiday Special: Save 25% OFF all plans with code HOLIDAY25, plus up to 40% OFF with annual subscriptions (ends Jan 1, 2025).

Start trading smarter with Kavout today!
While it’s regrettable you had someone you trusted betrayed you, the lesson is more of never share your password manager with others.
Relevant article:
https://www.epicweb.dev/why-i-wont-use-nextjs

Discussion at the time:
https://news.ycombinator.com/item?id=38018217
Enjoyed his roundup in the "Shoving Ducks into Everything" section.

DuckDB is a great tool. In April 2020, the creator of DuckDB gave a talk at CMU. In the beginning he makes a convincing argument (in 5 minutes) why data scientists don't use RDBMS and how this was the genesis of DuckDB. Here is a video that starts 3 minutes into the talk (where is argument starts): https://youtu.be/PFUZlNQIndo?si=ql9n2QuBlAEuGIqo&t=204
Kind of agree. But pervasive downvoting by folks who don’t understand the subject is a form of forum rot. The risk is only that we expose the rot. Not such a terrible risk, because either the owners notice and fix the problem, or the forum continues to rot. In the latter case karma points wont be desirable in the long run.
I'm pretty damn sure it's not impossible to do. Will it require changes to the police force, including in funding? Yes of course.
Unmask Alice by Rick Emerson was a very enjoyable read.

It's about Beatrice Sparks and her unique genre of fake teen diaries, of which Go Ask Alice was the most famous. It chronicles her whole-cloth invention of tragic teens who succumbed to whatever the current panic is consuming late-to-mid-twentieth-century concerned suburban parents: from accidentally becoming acid freaks to ritualistic satan worship to HIV/AIDS.
What's the concentration cutoff at?
iCloud syncs passwords between your devices.

If someone can login via your Apple ID, which means that the person knows username/password, and can also convince you to provide them with 2FA code that gets shown on your existing device, they can just add a new device to your account, and get passwords to sync to it.
Weren't there at least two high profile presidential candidate assassination attempts in 2024?
An interesting example of this is:

There are 6 “a”s in the sentence:
“How many ‘a’ in this sentence?”

https://chatgpt.com/share/677582a9-45fc-8003-8114-edd2e6efa2...

Whereas the typical “strawberry” variant is now correct.

There are 3 “r”s in the word “strawberry.”

Clearly the lesson wasn’t learned, the model was just trained on people highlighting this failure case.
Did you know you were going to use Ruby before Applying? Just wondering.
[1] https://en.wikipedia.org/wiki/Green_Revolution_in_India
[2] https://2001-2009.state.gov/p/sca/rls/rm/31553.htm

<quotes>
Low productivity: In the context of India's rapidly growing population, the country's traditional agricultural practices yielded insufficient food production. By the 1960s, this low productivity led India to experience food grain shortages that were more severe than those of other developing countries.[1]

The effort was in fact an adoption of America's agriculture land grant system for universities on Indian soil. It helped launch what we now commonly call India's "green revolution." The U.S. Government, through the United States Agency for International Development (AID) and the U.S. Department of Agriculture, partnering with the Ford and Rockefeller Foundations, helped establish five state agriculture universities in India - including the Punjab Agricultural University - PAU - in Ludhiana. This was a significant joint intellectual and scientific effort: American universities sent educators and agricultural advisors to India to work side-by-side with Indian scientists and students. At the same time, American universities welcomed a corps of Indian agricultural specialists to American university campuses where they could learn first-hand about the technologies we employed in productive farming, ranching and crop science.[2]
</quote>
These kinds of posts are always fascinating to me, as someone who had to move heaven and earth to get a graphics tablet and a PC that could run XP and Blender c. 2006. It's not like we were in particularly dire straits financially, and were on the more rational side of "overly sheltered" (having known people who couldn't attend school clubs or who had a parent hovering over their shoulder every time they got online), but the freedom and access some of y'all had is just... hard for me to fathom. Like, whose credit card were you using??
Just because something is publicly accessible on the web that does not mean it is in the public domain and free of copyright or other restrictions on use. Big Media - and many smaller players - have been fighting this battle for decades but generally winning because the law is relatively clear in this area in most places.

There is absolutely nothing in the law in my country - or probably most countries other than possibly the US - that says you can grab whatever you like if you can find it online and do whatever you want with it. And in the US the potential loophole is fair use and that has been controversial for a long time since it's clearly in violation of the global copyright treaties to which the US is also a signatory so something as big as AI might be enough to get other countries to push back significantly where usually they turn a blind eye.

So if OpenAI is doing that then I don't see how they are not in breach of copyright in much of the world. I would experience considerable Schadenfreude if that resulted in epic scale lawsuits because I don't think the use of "training AI models" as a means of laundering copyright infringement is a positive step. Like the search engines that started including significant parts of the original content directly on their results pages it's a distortion where the people who actually do the creative work are not the people being rewarded for it.
Zelda Majora's Mask's Improbable Blue Dog Win Analyzed [video]
The author of this article is unaware of the possibility of an audience who has no idea what the use case looks like for a short temporary token to be stored in a semi-permanent store like a password manager; what does it do? How does the token get there, and how is it used? Does the password manager infrastructure have access to the stream of tokens so that it populates the latest one, and fills it in for you when you're authenticating? Obviously any manual step in handling the token via the password manager will be worse (or no better) than just entering the token manually into the authentication dialog, so it has to work that way?
What does that mean and how is it relevant?
I think their point was that it's less phishable from the perspective of needing the attacker to try logging into the site with it in realtime instead of being able to just store the password for some later time. The needed concurrency makes it more difficult (if only slightly).

I'm curious though why you don't think TOTP or similar are good against credential stuffing though, would you be able to expand upon that?
Ghostty Config Generator
Tourism itself is quite destructive both to local communities and to nature. There’s a reason tourist hotspots are increasingly anti-tourist, and national parks are now forced to ration out visits via a lottery. While I agree that a virtual environment is less impressive than the real thing, it’s not a difficult argument to make that it is actually much better for the world to have digital alternatives.
The most common 2FA mobile app that isn’t a password manager is Google Authenticator.

Google Authenticator doesn’t export the seeds or store the seeds in the device backup, or sync them, so when you lose or upgrade that phone, you lose all your TOTP. This is bad.

Also, TOTP in general is bad, because it is easily phished, just like passwords. Using a password manager to store TOTP cuts down on phishing risk as it won’t input them into the wrong domain site. Copying them manually from a different app is still vulnerable to phishing.
Well said, that’s exactly what I meant.
I don't think that's true at all. 2FA has been a popular solution for many years, well before the addition of TOTP support to the popular password managers.
> There was no major effort to fork off MongoDB, Neo4j, Kafka, or CockroachDB when they announced their license changes.

AFAIK people didn't take MongoDB seriously from the start, especially with the "web scale database" joke circulating. The Neo4j Community version has been under GPLv3 for quite some time, while the Enterprise version has always been somewhat closed, regardless of whether the source code was available on GitHub (the mentioned license change affected the Enterprise version).

Regarding CockroachDB, I must admit that I've only heard about it on HN and don't know anyone who seriously uses it. As for Kafka, there are two versions: Apache Kafka, the open-source version that almost everyone uses (under the Apache license), and Confluent Kafka, which is Apache Kafka enhanced with many additional features from Confluent, and the license change affected Confluent Kafka. In short, maybe the majority simply didn't care about these projects very much, so there is no major fork.

> It cannot be because the Redis and Elasticsearch install base is so much larger than these other systems, and therefore, there were more people upset by the change since the number of MongoDB and Kafka installations was equally as large when they switched their licenses.

I can’t speak for MongoDB, but the Confluent Kafka install base is significantly smaller than that of Apache Kafka, Redis and ES.

> Dana, Bohan, and I worked on this research project and startup for almost a decade. And now it is dead. I am disappointed at how a particular company treated us at the end, so they are forever banned from recruiting CMU-DB students. They know who they are and what they did.

Call me a skeptic, but I can't see this as a fair approach. If your company fails for whatever reasons, you should not recruit the university department/group/students against your peers (I can't find that CMU-DB was one of the founders of Ottertune).

Wrt Andy, here are [1] somehow interesting views from (presumably) previous employees.

[1] https://www.reddit.com/r/Database/comments/1dgaazw/comment/l...
It's not a good thing at all that what manages the secrets of my digital life is hardware based... on the hardware of one single vendor
> What is heavier a liter of bricks or a liter of feathers?

>> A liter of bricks and a liter of feathers both weigh the same—1 kilogram—since they each have a volume of 1 liter. However, bricks are much denser than feathers, so the bricks will take up much less space compared to the large volume of feathers needed to make up 1 liter. The difference is in how compactly the materials are packed, but in terms of weight, they are identical.
There was some incorrect information in that post, which was later followed up on by myself (I work on Next.js) – Kent linked back in his post (https://archive.leerob.io/blog/using-nextjs)
Yes, it quickly became clear that at least in the US the majority of the population will not accept any restrictions until (at least) there are bodies literally piled in the streets. And probably not even then, IMO.

Will be a grim scene.
> At enterprise scale, locked down marketplaces don't work. They act as an forcing factor for larger organizations to build in house because no one wants vendor lock-in or to lose money via an arbitrage.

But you can say exactly the same thing about large companies publishing (consumer apps) in the App Store. Why would they want vendor lock-in?