skysight-inc/HackerNews huggingface dataset:
Same here. It seems like they are very narrowly optimizing for the extremely rare case of a person who simultaneously:

A) Is fooled by a phishing attack

and

B) Is not fooled enough to manually copy-paste credentials from their password manager after noticing that the autofill didn't work

Does a person like this exist somewhere? Sure, if you interview 1 million people, I'm sure you will find 1 person like this.

It is very, very strange to me that the security "experts" are narrowly optimizing for this specific user and downplaying all the risks related to their recommendation.
Are you really proposing for JS developers to learn another stack? Only half-joking.
For some sizable amount of the user base, assuming they can even be convinced to use a password manager in the first place, not being able to also store 2FA codes in the manager will become their excuse to not use 2FA codes.

A great expanse of users (note, not normally the ones who frequent HN) see all these 2FA codes, and passwords as well, as just an irritating impediment to accomplishing whatever goal it is they wish to accomplish at the time.
Side question, why does anyone subscribe to the WSJ in the first place? Who's doing this? It just seems like a propaganda outlet

Every time I read something written in the WSJ, I wish I could un-read it because it deliberately tries to mislead people
That's a version of a classic financial-advisor scam.

It operates on a similar mechanism: a set of predictions is sent to large number of marks. Roughly half the predictions are in the money, the set of marks is reduced with each successive round to those who's previous "predictions" were accurate. At the end of the cycle, there are only a small number of marks left, but they're given the option to subscribe to future predictions for a handsome sum. Of course there are no further predictions....

There's also the apocryphal physician's trick of predicting a baby's gender (back when this wasn't trivially determinable in advance). The doctor would verbally give their prediction, and write it down in an envelope. Occasionally the parents would recall a different answer, but opening the envelope would confirm the gender of the infant.

The trick of course was that was was written was the opposite of what was said. When what was said matched the delivery the envelope wasn't opened, so the secret was safe.
Safari on iOS only shows an empty page. Is this one of those Chrome-only sites?
The math is the proof of concept when an attack costs that much money to pull off. Or the various papers that show successful attacks on reduced-round versions of the hash.

Do you not accept those? What would you accept as a proof of concept?
You make a good point, as we should remember the many times the US and other countries imprisoned nonviolent political dissidents. However, I think when comparing the USSR, I think the magnitude and severity are distinct.

Comparing them on a binary basis runs the risk of making no true Scotsman errors, and easy to do as google powered amateur historian.
If you store both in one place, it's similar to 1FA. In such case it's a lot better to just use passkeys (where supported).
Realistically, 1) the model will be one of a small number of available models which can be tested against, 2) LLMs converge on similar predictions, so even an "unknown" model can hardly be considered cryptographic. The advantage of using an LLM this way is the ability to hide an information stream in an innocuous looking text, in the form of subtle deviations from the most likely next word. Hence, steganography.

Incidentally, this technique is actually an old one that has already seen use in magic shows and confidence tricks; two people who wish to communicate covertly, such as a magician and an "audience member", can exchange small amounts of information by varying the wording of simple responses: "yes", "that's right", "quite so". This can be used to, for instance, discreetly reveal the value of a card that the magician is "guessing" through "ESP".
Propaganda generally enjoys free speech and freedom of press protections in the EU, it's not as such a basis for this kind of media restriction.
I Earned $625 (and Counting) with My Bookmarking App
Your profile has made me curious. May I ask you if it was the MBA itself that made you come to this insight? It's so uncommon to see an MBA holder with such views.
> A convincing phishing attack might trick you into manually entering a code into a fake page.

Sadly, for a far too large population of users, a convincing phishing attack will be successful, even if the tech. is flashing ten different warnings of "this is a phishing attack page" at the same time. You can't "technology" around human nature for a subset of the population.
Wasn't that because they had backed up their password vaults to LastPass' cloud service?

I use KeePass, never upgrade it, and only back it up to my own cold spinning drives. If malware stole my local vault I'd be in trouble, but it's more convenient than keeping my passwords on paper.
I think the one-year time horizon prevents it from being hubris. :p
My format is

MM/DD/YYYY (i.e. 1/1/2025)

$sets x $reps $weight $name (i.e. 3x10 135 Bench Press)

I uploaded the log file to ChatGPT and had it spit out a Python script to parse into JSON:

```
for line in file:

date_match = re.match(r'^(\d{1,2}/\d{1,2}).\*?$', line.strip())
if date_match:
# construct a new workout entry
# continue

exercise_match = re.match(r'^(\d+)x(\d+)\s+(\d+)\s+(.+)$', line.strip())
if exercise_match:
# insert new exercise into current workout
# continue

```
How do you spell that? ;-p
I just died. I guess I am getting old and need to play more strategy games hehe.
On one hand, spammers can easily create accounts beforehand.

On the other hand, it might discourage legitimate new members posting for the first time, like when they notice their work is highlighted here, or a long time lurker who feels empassioned to respond to something.

Spam doesn't seem like that big of a problem right now. Between green names, downvotes, flags, and @dang, I think we generally do a good enough job of filtering out and preventing them from floating to the top. I'd rather have a few bad ones get through than dissuade someone new who's earnestly trying to post.
https://en.m.wikipedia.org/wiki/Ryan_Wesley_Routh

https://en.m.wikipedia.org/wiki/Thomas_Matthew_Crooks

Indeed. But since they're right wing guys attacking Trump, it seems to have faded from the conversation. Also they failed.
The US government was also recorded (and confirmed) as dumping TONS of covid misinformation throughout the entire world. Leaks from a defense contractor showed as much.

https://www.reuters.com/investigates/special-report/usa-covi...

Helping a local org give thousands of covid shots to seniors, people living in congregate housing, etc# was not easy because there was a lot of resistance from these communities due to the massive amounts of scary information out there.

If you want an example see this:
https://www.researchgate.net/publication/360815298_Foreign_M...

It really felt like there was literally nothing wholesome on anyones feeds for almost an entire year. Limited exposure from all non-profits i know of in my community. Significantly reduced views, deleted posts, erroneous flags, etc#.....

Meanwhile, everyone in every neighborhood gets nothing but images + videos of people dying or getting sick from "the jab", "5g", "the mark of the beast", etc#

Most of the women running these non-profits are former executives, local gov't officials, or workers in DHS or other like agencies. They're not stupid and incapable of "getting a message out". Something is and was seriously wrong w/ operation lightspeed.
Because for things like the Putnam questions, we are trying to get the performance of a smart human. Are LLMs just stochastic parrots or are they capable of drawing new, meaningful inferences? We keep getting more and more evidence of the latter, but things like this throw that into question.
Shakespeare on Power
Are there any reasonable attacks against AES-GCM-256 where the key is a mix of a randomly generated 128-bit key and a password? If not then I have no concerns about an attacker cracking my 1Password database.
I've been working on something Redis-y over the holidays, and it has reinforced my view that it's the epitome of a 20%- 80% tool.
I've always used the 20%, but anything beyond that sounds useless unless you've encountered the requirement in a production environment.
The challenges Redis has been solving for years, never really touched the research/academic community (even the 20%).

Even in the various taxonomies of DBS in the research literature, Redis was mentioned with a wave of the hand as an "in-memory" database, which undersells the important (for me) part of the "data structure" server.

Putting the "database" after Redis could be a marketing misstep. Because it puts you in the is-it-sql territory.

TL;DR: Redis is mostly appreciated by practitioners (web) developers. Academics find it lacking a theoretical foundation, so... meh.
Would be very interesting to have a look at this app that you wrote using only LLMs. Mind sharing the name?
I also FF on Linux.

But I always redefined A and D as strafe-left and strafe-right.

I literally did not know the keyboard shortcut to strafe, because I have probably literally never used it.
I've built my latest project[1] with Next.js and it's often felt pretty hectic to use.

App vs. pages router, accessing cookies requiring different APIs between the client-side and the server side, env vars being accessed via `process.env.NEXT_PUBLIC_*` which gets rewritten into literal value of the env var (so if you access `process.env` directly you're very confused).

I guess I was hoping that I'd be able to write code which would work on either the client-side or the server-side with minimal changes. But that's not what I experienced. For what Next.js does provide, it doesn't feel worth the overhead and the learning required to do it "the Next.js way".

1 - https://onlyhumanhub.com
If someone hacks 1Password, they will get access to all your accounts. Whereas if you moved TOTP off 1Password, that hacker would no longer be able to access your accounts.
> There was and is absolutely nothing wrong, and quite a lot right, by having the 2FA program completely separate from your password vault.

Did you read the article? That's what they say.

> For maximum security, you can store your 2FA token elsewhere ... but for general purpose use, storing your 2FA in your password manager is an acceptable solution due to the convenience benefits it provides.
Part of why I avoid password managers that use their own cloud system. Storing my vault in a regular cloud database, not a password-specific one, to me makes it much less likely my vault will be compromised.
Remember week 58 of "2 weeks to slow the spread"? It would be lovely to have a public health establishment that was competent, science based and trust worthy but they showed themselves to be dishonest and beholden to hysterics.

EDIT: And don't forget the spicy dash of left wing politics that they added to all their decisions. BLM riots were ok, church gatherings not OK.
Yes. The goal is to emulate that with different substrates to understand how it works and to have better control over existing self-replicating systems.
Where does it clarify that manufacturing includes personal use? I did read it over a couple of times and I couldn't find anything that says that, at least not in those words.

However, it may be that the suspect violated a different section of the law:

It shall be unlawful for any person to store any explosive material in a manner not in conformity with regulations promulgated by the Attorney General.

The suspect may also have violated the NFA, by manufacturing destructive devices without appropriate permitting or record keeping.
There are production uses of MongoDB (Stripe comes to mind).

But it is certainly not a popular choice there.
last week we had to double AWS-RDS database CPU, ... and the biggest load was from AmazonBot:

the weird is:

1. AmazonBot traffic imply we give more money to AWS (in terms of CPU, DB cpu, and traffic, too)

2. What the hell is AmazonBot doing? what's the point of that crawler?
The attacker doesn't need to literally be sitting at a keyboard, that can just be automated.

> I'm curious though why you don't think TOTP or similar are good against credential stuffing though

I have written about this before, but looks like I lost the article somehow. https://web.archive.org/web/20210219185711/https://blog.cmpx...

Imagine you reuse the same password everywhere, and are sick of credential stuffing attacks. You ask your friend for advice, and your friend tells you to just enable TOTP when available, explaining that when there is a data breach you will be safe.

That is obviously bad advice, the vast majority of services do not use TOTP and you will have to race attackers to change your credentials quickly at dozens (hundreds?) of services. I think a reasonable person would say that you have not "prevented" credential stuffing.

A far better solution is unique passwords, it works today with all service providers.
Thank you for doing the right thing and crediting the original Doom Captcha creator on the github repo. My expectations of the software industry in general have been at an all-time low lately, so this was nice to see.

The original from a few years back:

https://vivirenremoto.github.io/doomcaptcha

https://github.com/vivirenremoto/doomcaptcha
Good point about it being similar to passkeys.

But why would it be better to use passkeys?

Because don't sites with passkeys generally still allow you to fall back to password, since it's common for people to lose their phone and then lose their passkey? Whereas sites with 2FA obviously don't, and have more complicated/secure recovery mechanisms?

So seems to me like 2FA (TOTP's) are currently vastly better in practice?
Axum 0.8
Russian gas era in Europe ends as Ukraine stops transit
I work on a CMS using NextJS (PayloadCMS) and NextJS is hands down the worst piece of technology I have ever had to use.
If you look at a lot of their evidence it's a bunch of memes, if it goes to trial it'll be an interesting case to read for sure.
It was clear to people paying attention to the hard numbers by February 2020 that Covid was no threat to children and non-elderly adults without risk factors like obesity, which led to the rational decision to treat it as a non-risk. If something bad comes around that is actually killing healthy adults, they would stay home.
Failure Stories: How Your Company/Employer Failed
There are so many stories out there in the wild of how someone succeeded in starting a company or how it overcame challenges to become a success. I'm interested in how companies failed, in any capacity, please detail your experiences in what happened during your time working for a company and what made it fail. Some specific areas that I'm interested in are:

What did the owner do when the ship was sinking?

How did employees react when they caught wind that the company was doomed?

What did the employees do in the final days before the company closed?

Your feedback is appreciated, and I have a story about how a company I worked for failed, but would love to hear others.
You know what the issue is? People are so focused on being able to scale their idea to billions of users before they even start building it. So someone today would start using Kubernetes for their website with 5 visitors. I've seen many students use Nextjs for websites that could easily be written with plain html + css, and some chart library.
In 1972 the leap second was created.

This has made a lot of people very angry and been widely regarded as a bad move.
> Did you read the article? That's what they say.

No, that's not what they say. If you read the text that you just now quoted, you will see that it says "storing your 2FA in your password manager is an acceptable solution due to the convenience benefits it provides". Clearly the writer of that text believes there _is_ something wrong with having 2FA completely separate from the password vault: it is less convenient, to the extent where they are happy recommending this horrible approach to laypersons.

In addition, if you go and read OP, you will find that they talk about the potential of losing access to your TOTP codes stored in Google Authenticator. So that's another thing that counts as "something wrong" with storing 2FA separately from password vault.

So there's at least 2 things in the article that count as "something wrong". So they definitely didn't say that there's "absolutely nothing wrong".
Like speech, equity compensation...

AR-15s are actually not banned in many parts of the EU.
There are probably lots of people doing exactly that, who are running meth labs or dealing drugs like Fentanyl with minimal scrutiny from federal law enforcement.

However, instead of going after those criminals, the FBI has placed its focus on sending a SWAT team to arrest someone who downloaded the wrong 3D print file or ordered a spicy plastic gun accessory on the Internet. That’s a disingenuous application of the law by people who have an agenda, not an approach that’s actually intended to reduce harm.
And a whole slew of common chemicals used in harmless synthesis, and in many countries even things like common knives.
Reread my comment carefully. I don’t care why people won’t obey. It’s just clear that they will not obey.
Ah, yes, the market distorted by different EPA fuel standards for cars and trucks.
I always think the it interesting how the paradox of tolerance gets interpreted as a an instruction and endorsement of intolerance, opposed to an actual paradox.

It also takes as an assumption that intolerant ideas outcompete tolerant ones, opposed to reach some equilibrium solution or the opposite.
Early GUIs look garish because the designers could not apply color theory even if they wanted to, given the hardware of the time.

The only reasonable alternative would have been to go monochromatic like early Mac, X-Windows (all those stippled patterns!) I guess Microsoft felt that people wanted color more than they wanted aesthetics, and the market backed them up in spades.
Answer truthfully I guess. Tell them about the things you did then, and why you left them out (not relevant for this position). If you're at the stage where you are answering questions about your CV you have your foot in the door at least.
As long as an LLM is capable of inserting "9.99 > 10.01?" into an evaluation tool, we're on a good way.

It feels a bit like "if all you have is a hammer, everything looks like a nail", where we're trying to make LLMs do stuff which it isn't really designed to do.

Why don't we just limit LLMs to be an interface to use other tools (in a much more human way) and train them to be excellent at using tools. It would also make them more energy efficient.

But it's OK if we currently try to make them do as much as possible, not only to check where the limits are, but also to gain experience in developing them and for other reasons. We just shouldn't expect them to be really intelligent.
> However, the examples you give, like Jan. 6 or militia incidents, don’t align with your routine mass murders implication

That's my point: there's loads of "apolitical" school shootings and much less "political" violence.
Employer.com acquired Bench Accounting in under 48 Hours
As others are saying in the comments, this feels like a bit of a useless post – it claims to explain what went wrong but actually never gives any explanation.
RE3 was a reverse engineered product. It used the original source and logic to derive an ABI compatible implementation. This has always been a grey area-outright illegal activity. It's the entire reason Compaq clean room engineered (or, at the very least, claimed to) their BIOS all the way back in 1982.

Every time I hear people complain about this, I just have to roll my eyes. Go do a clean room implementation like OpenRA and you're legally pretty safe. Use their IP and you're just asking for them to easily shut you down once you catch enough attention.
When a new key is generated, how can you be certain that the old key is securely deleted?
China steps up drive to break Boeing and Airbus grip on plane market
Frankly, you can make it with 3%. It just takes longer.
> They don't work on the CSAM. They are a cloud provider who makes CSAM reports.

--- start quote ---

If you sort NCMEC's list of reporting providers by the number of submissions in 2020, then I come in at #40 out of 168. For 2019, I'm #31 out of 148

I repeatedly begged NCMEC for a hash set so I could try to automate detection. Eventually (about a year later) they provided me with about 20,000 MD5 hashes that match known CP. In addition, I had about 3 million SHA1 and MD5 hashes from other law enforcement sources.

--- end quote ---

Somehow this isn't "working with CSAM or CSAM databases", oh well.

> Apple said in their paper that they don't send anything that is flagged.

This is literally addressed in the article you pretend you read.

> https://www.nytimes.com/2024/12/08/technology/apple-child-se...

I don't have access to this article. How does it show that people working with CSAM say Apple's implementation is a good idea?
I don't know about that - but I would like to forbid submissions until you hit 50 karma points, so you can demonstrate that you actually contribute to HN instead of just using it has a soapbox to promote your own content.
Shows the importance of chain of thought! Forcing it to commit to an answer without deliberation is not playing to its strength.
TOTP tokens aren’t really MFA anyway. They are just another type of password that is more protecting against bad password practices and other compromises. They deliver multi-step auth.

Tokens that increase the trust level of an authentication come with additional controls (tamper resistant hardware, passcode, etc)

For normal people, a FIDO token delivers the highest level of security and integrity.
well you'll need integrations to have the WASMised doom tell you when a monster gets hit, or when you died. you need to worry about which keyboard events to pass in, etc. i know it's not super hard but it's definitely the more exciting part of this, vs all the "make the title text bigger" stuff that's in the chat
Complex FE builds (anyone who tells you that JavaScript is an interpreted rather than a compiled language is lying — at least as used in 98% of modern apps).

Overreliance on SPAs.

Software that works fine on the developer’s 6-month-old high end workstation and like molasses anywhere else.

The subscription model for EVERYTHING.
I think the only exception is that if the pandemic kills primarily children, and at high rates. We don't care much about the elderly or even the middle-aged, but our society as a whole has a pretty strong "think of the children" attitude that would guarantee strict and prolonged lockdowns in that scenario.
Bluetooth keyboard to the rescue!
there is a way that "predicting the next token" is ~append-only turing machine. Obviously the tokens we're using might be suboptimal for whatever goalpost "agi" is at any given time, but the structure/strategies of LLMs is probably not far from a really good one, modulo refactoring for efficiency like MAMBA (but still doing token stream prediction, esp. during inference)
Or maybe some of the newer generation will take time to update Linux to be more competitive with macOS for developers. Could be a long term win for Linux fans.
my bad I should have read closer
Thank you for pointing this out. I've addressed the issue, and it should now be fixed in version 0.2.1, which is available for download on the website. Please update to the latest version, and let me know if you encounter any more problems.
That’s usually something your ABI will describe in fairly precise terms, though if (as in your example) you want non-naturally-aligned fields, you may indeed want to both use a packed struct and prepare for alignment faults on less-tolerant architectures.