Hacker Newsnew | past | comments | ask | show | jobs | submit | andrewSC's commentslogin

Have you considered https://authenticator.cc/ ?

I realize it is amusing to even consider offloading OTP generation to a web browser extension however, if `$work` doesn’t want to provide you with the correct hardware (e.g. Yubikey, NitroKey, etc.) there are boundary-respecting alternatives


I just got a little more excited ;)


What a fun little website!


Every time I stumble onto it I have to resist not buying five gimmicky things.


My favorite is the Short Sided Ruler.

Perfect for April 1st.


I'd honestly love to know what framework, theme, or stack is being used here! Looks incredible--great job!


Hi! I am the developer of Retr0's portfolio. I used nextjs for the framework, with framer motion + gsap for animation. The blog is powered by hashnode headless api with serverside rendering.


Awesome! Thank you for the follow up and great work!


Am I missing something here or is inference going to be painful given the "low" memory bandwidth compared to, say, HBM2E?


273GB/sec with good FP4 performance should be fine for developers playing with inference. This isn't the kind of thing that you'd use for inference workloads supporting millions of users.

I'd like to see a inference benchmark vs the strix halo, which has better memory bandwidth and costs 2/3rds as much.


I guess since these devices aren't meant for production throughput, but rather about having enough RAM for local experimentation with large enough models, it's an ok tradeoff at this price point...


Have you seen anything with 128GB of HBM2E at anywhere near the DGX Spark's $3,000 price point?


The AMD Radeon VII has 16GB HBM2 and sold for $700 in 2019. I don't know how that would translate to today's HBM2E's pricing like if its price change follows that of GDDR's.


I honestly can't say I have however, that doesn't mean it couldn't physically exist/happen? Perhaps a "little" more cost but I'd be willing to bet people would gladly pay the premium for such a device. I'm also very curious to know what the BOM for an A100 actually is as well as HBM2E per GB.


Wait. Doesn’t this mean you’re just giving PFAS to the blood recipient?


Yes, but their blood/plasma PFA concentration won't change at all unless your blood has extremely high PFA concentrations.

Even if it did, the average blood/plasma recipient is more concerned about "not dying of blood loss" than PFAs.


Not necessarily. I visit our local medical vampire every 3 months to drain a pint due to high levels of ferritin (hemochromatosis issues). I asked what they do with the blood. They destroy it by ashing it. The tech said they do this with any blood drawn from someone with a known disease state. So if phlebotomy becomes a common treatment for PFAS loads, I'd guess the draws would be destroyed. I hope.


He/she has probably lost some PFAS recently, if in need of a transfusion.


As a user going on 5+ years now I just wanted to say thanks! Reassuring to hear the team is passionate about what they’re building.


What was the tool used to generate this output?


That looks like whois, available on most Unix versions.


I literally setup an alias last week in O365 Outlook using the pattern a.b@c.com? I’ve been able to receive and send using the alias as well. Maybe this is a new feature/behavior?


I may have misunderstood the parent comment - with gmail, you can add dots anywhere in the mailbox and it all goes to the same place (standard gmail, not workspace)

e.g andrew@gmail.com, a.n.d.r.e.w@gmail.com and a.....ndrew@gmail.com all are the same user and will go into their mailbox (which I have used to avoid the + stripping that some sites do)

andrew@outlook.com and a.ndrew@outlook.com are two distinct users.

Obviously if you control the domain or use a provider who supports it you can add an alias with punctuation but then you might as well just use e.g ebay@c.com to track the email source.


This is the correct set of questions to be asking. I’m a little more than surprised there aren’t some defined processes and automation around high viz workflows/stuff like this. When are people going to take cybersec and opsec seriously? Esp. In big projects?


Computer security requires humans to do 500,000 things perfectly, and one slip up means everything they did was worthless. It turns out, humans aren't perfect. The result is inevitable: there is no such thing as computer security.


On the one hand, yes.

On the other hand, a 15 months old token that's still alive... that's pretty damn incompetent.


Yeah but my point is they probably did the other 499,990 things right, but will get no credit for it.


This isn't an individual issue, this is an organizational systemic issue. It isn't on the individual to "do better" or not make mistakes. Even if they had made a PAT, there should be an org level policy that PAT tokens can only last x-days where x is very short (as an example, PAT tokens should be banned).


Not allowing long-lived, powerful tokens is so basic that I'm skeptical they did very much right.


And the logs are gone for both GitHub and docker hub. We should assume anything that could get compromised is compromised.


...There is a reason why those crazies that tell you to build everything from source you personally audit, and to read everything exist.

Y'all want the convenience of "can't someone else just gimme something that works"? Which is fine, but you have to verify the thing is what the other person claims it is. It's the curse of high-trust systems. They are only as trustworthy as the least trustworthy member.

We've done everything we can to rope in everybody. Everybody includes people who are actively malicious to the ecosystem as a whole. Thus the high-trust system has raced to the bottom in transitioning through a low-trust system, to eventually zero-trust; as computer networks in all their forms are just too juicy a set of targets to leave untapped by malicious/selfish actors. The only defense is everyone looking out for themselves on top of everyone else. It's fcking hard. It's a slog. It makes the act of maintaining computing systems that much less sexy. It's also what keeps you* safe from the wolves in sheep's clothing.

My journey in computing has branched out far and wide, only to crunch back to a narrow set of tools that I can vouch for personally. My trust of the denizens of the Net has plummeted, if only because the spaces in the cracks where belief rather than knowledge lie are just such fertile ground for skulduggery now.


I think the inefficency of zero-trust can be applied to many other things in life.

Like

> The only defense is everyone looking out for themselves on top of everyone else. It's fcking hard. It's a slog. It makes the act of maintaining relationships that much less sexy.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: