pseudo0

> Aimmy was designed for Gamers who are at a severe disadvantage over normal gamers.

> This includes but is not limited to:

> - Gamers who are mentally challenged

Hope it was worth your dignity.

Seriously though, the whole point of ranked matchmaking is to give you a fair game with people who are similar in skill. If you compete without cheating, you will get matched up with other casual players instead of "sweatlords".

McDonalds might be premium compared to a roadside food stall, but it's on the low end of the spectrum in first world countries. Anywhere I have traveled, McDonald's was just the emergency option if you just really needed food that wouldn't give you food poisoning.

Also, poor people absolutely eat there. All those poor people working there get free food and employee discounts, others use the app, or they eat there once in a while as an alternative to more expensive restaurants.

The signed assertion includes the clientDataJSON, which contains the origin of the relying party. Assuming the server properly validates that assertion, it should prevent the use of a phished assertion by a third party.

https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

Agreed, they unfortunately seem to have gone the vendor lock-in route. The big players don't have export utilities for passkeys, despite it being technically feasible and pretty straightforward to implement. That's a pretty major gap in the spec, there should be a standard export/import format, and vendors should be required to implement it in order to be compliant.

It's probably possible to extract passkeys from a rooted Android device, but it would definitely be out of the grasp of 99% of users. I have not looked into it in detail, but I'd expect a Frida script hooking the keystore decryption function would get the raw data, then it would be a question of interpreting whatever proprietary format Google is using for their password manager.

It cuts out the necessity for a password manager browser extension to handle stuff like autofill, password generation, etc. Those extensions have had fairly significant vulnerabilities in the past. So you're reducing the attack surface, as well as getting a cryptographic guarantee against phishing (the signature the client returns include the domain that sent the challenge).

Edit: The other great part is that the server just stores your public key, so it's idiot proof on their end. It makes a breach effectively useless, since offline cracking is impossible.

The TL;DR version in my opinion is that passkeys are quite similar to a SSH key pair, like one you'd use on GitHub. Basically you generate a key pair, the server stores the public key, and the client stores the private key. When you want to authenticate, the server sends a challenge, you sign it with your private key, and send it back. The main debate is over how to manage those keys after generation.

- Backups: It depends. It seems like the big players (Google, Apple) are pushing an implementation where your passkeys are backed up either in the Google Password Manager or iCloud keychain. That way if you lose your device, you can recover your passkeys the same way you recover your other phone data.

- Storage: It depends. Google and Apple are pushing phone implementations where passkeys are protected by a hardware security module of some sort, either the iOS keychain or Android Keystore. The private keys can't actually be stored in the HSM though, because you need to be able to back them up. So the passkeys are stored encrypted on disk, and the decryption key is stored in the keychain/keystore. Other options include passkeys actually stored in hardware (eg. Yubikeys, but then you can't back them up) or 3rd party password managers.

- Login: It's pretty seamless, just click "login with passkey". The browser handles finding the right passkey, and part of the signed challenge includes the domain the passkey is for, preventing MITM-style attacks. There's also a whole separate thing for authenticating a session on a different device via scanning a QR code or Bluetooth.

Here's a good fairly high-level breakdown of how it all works, if you want some additional detail: https://webauthn.wtf/how-it-works/authentication

The key takeaways:

> There were more than 1 million international students here in 2023, up 245 percent from a decade earlier and 60 percent since 2019. Canada, a country of 40 million, had roughly the same number of international students last year as the United States, a country more than eight times its size.

> Immigration Minister Marc Miller said last month that Canada would for the first time set targets for the number of temporary immigrants. He had already announced a temporary cap on undergraduate study permits and increased the amount of money that international students must have to study here. The ministry also barred students in programs run by public-private college partnerships from applying for postgraduate work permits. Some, Miller said, run “the diploma equivalent of puppy mills,” offering poor curriculums in exchange for the prospect of permanent status.

This isn't just a housing or infrastructure problem, productivity is also tanking. These strip mall college degrees are effectively worthless, and these programs function as a backdoor mechanism to suppress the cost of low-skill labor. Why invest in automation or equipment when you can just hire more cheap foreign workers?

Apparently they provided 72 hours advance notice to neighbors (who probably tipped off the US and Israel, given the US warnings of an imminent attack). The Iranians presumably expected the information to leak. The US also had naval and air assets parked in the region to assist. It's hard to imagine a more favorable scenario for the defender. That makes it rather dangerous to try to generalize the performance in this instance to future events.

It also makes this whole exercise seem like dramatic saber-rattling rather than a serious effort to damage Israel's military capabilities.

> Iraqi, Turkish and Jordanian officials each said Iran had provided early warning of the attack last week, including some details.

https://www.reuters.com/world/middle-east/iranian-notice-att...

That's the whole point of Section 230. Service providers generally have immunity with respect to third-party content posted by their users. If a user posts something, it's their speech, and the user is therefore held responsible for it, not the website. Section 230 is what makes an internet of user-generated content possible.

https://www.eff.org/issues/cda230

If you think a website is doing something illegal, you can report it to the police or the FBI, depending on what type of crime it is. Kiwifarms has a US corporate entity controlled by a US citizen, it isn't like this is some tor darknet market hosted in Moldova or something.

Generally though sites aren't responsible for their users' speech, so if someone does cross the line, that would be on the user, not the site. As long as the site responds to any lawful subpoenas, they would stay in the clear.

I'm a bit annoyed by it. Censoring "lawful but awful" speech is the thin edge of the wedge. An existing precedent of censoring legal websites reduces my confidence that Wikipedia will be able to stand up to censorship pressure (including from its own editors) in the future.

> The NIST also is dead set on people using only PQC or classical crypto, not a wrapper with both. That is stupid IMO.

Yeah, this is rather baffling. After SIKE got broken, you'd think they would have realized the importance of combining these new cutting-edge candidates with something reliable.

Main discussion thread here: https://news.ycombinator.com/item?id=39865810

Backdoor in upstream xz/liblzma leading to SSH server compromise (openwall.com) 1848 points by rkta 5 hours ago | 654 comments

It seems like the logic for the lawsuit is that Snapchat and other advertisers had something in their ToS with words to the effect of "thou shalt not let our competitors packet capture our traffic" and Facebook induced the customers to breach that agreement. The Wiretap Act stuff seems like nonsense though. If the consumer installed software with their informed consent to record their phone use, that's not illegal wiretapping.

I'd assume they were referring to Google's image generator Gemini, which was generating historically inaccurate images of "diverse" European monarchs, founding fathers, and WW2 Nazis. Eg. https://www.telegraph.co.uk/news/2024/02/23/google-gemini-ai...

Breaking it down by time, men spend close to twice as much time on leisure computer use and gaming. Nowadays most people play a game once in a while, whether that's Farmville or Wordle, so time provides a much more useful measurement than simply "have you played a game".

https://www.statista.com/statistics/502144/average-daily-tim...

That doesn't really make sense unless they have a way to flag higher-risk charges and route them to a processor that is more risk-tolerant (and usually more expensive). Eg. I could see segmenting the charges for the first month or two into a higher risk bin, and then moving recurring customers into low-risk bins on processors with cheaper rates.

People commenting online are generally giving their opinions, not making statements of fact. Statements of opinion are not defamatory. My opinion is that given the evidence in the article, this guy was probably was selling fake vaccination passports. I also hold the opinion that OJ Simpson is probably a murderer, despite his criminal acquittal.

News organizations generally try to split their coverage into fact and opinion sections. It would be inappropriate to insert opinion into a factual article, but they can and frequently do weigh in on legal matters in opinion sections. The bar for defamation there is usually actual malice, so in reality it's extremely hard to prevail in suing a news organization for defamation.

I think his point was that Australia does not specifically enumerate a right to bear arms. That makes it much easier for politicians and judges to erode liberties in the name of safety or "think of the children". Eg. Australia, Canada, and New Zealand have done mass firearm bans or confiscations in recent years, while the US has largely resisted similar efforts to restrict civil liberties.

Your "steelman" is embarrassingly bad. Why play devil's advocate if you're going to do such a bad job of it? Here's an alternative:

- As a form of fair use, models learn styles of art or writing the same way humans do - by seeing lots of examples. It is possible to create outputs that are very similar to existing works, just as a human painter could copy a famous painting. The issue there lies in the output, not the human/model.

- Provide comfortable office jobs for people in economically underdeveloped countries, categorizing data to minimize harm for content moderators worldwide. One piece of training data for a model to filter harmful content can prevent hundreds/thousands of people from being exposed to similar harmful content in the future.

- Reduces or eliminates unpleasant low-skill jobs in call centers, data entry, etc.

- Creates new creative opportunities in music, video games, writing, and multimedia art by lowering the barriers to entry for creative works. For example, an indie video game developer on a shoestring budget could create their own assets, voice actors, etc.

- Reduces carbon emissions by replacing hours of human labor with seconds of load on a GPU.

From the article:

> The decision follows a move in December 2022 to bring in a larger number of recruits who score very low on the Armed Services Qualification Test.

It sounds like they really are just scraping the bottom of the barrel. The Navy is not a competitive employer right now given the ops tempo, living in close quarters on a ship, and poor compensation. Even for those who are inclined to join the military, why pick the Navy over the Air Force?

It's because a driver can do everything right and still miss a cyclist. Humans aren't infallible, and driving is an extremely complex task. In many cases it's an issue of bad road design or cyclists not following the rules of the road. For a driver to be held criminally responsible they have to be negligent, eg. using a cellphone, speeding, distracted, etc.

From my own experience interacting with cyclists on the road, the riskiest situations I saw were ones the cyclist created. Eg. Running reds, doing 15+ mph on the sidewalk, lane-splitting, etc.

Enterprise was the early 2000s prequel, set before the Kirk original series. It wasn't bad but it got badly overshadowed by Battlestar Galactica.

It's a neat historical anomaly but it is not very practical for most people to bank at. You have to be a North Dakota resident, they have one physical office in Bismarck North Dakota, and they do not provide online banking.

> Because of our unique structure as a state-owned bank, it is the Bank’s policy not to compete with the private sector for retail deposits. Therefore, convenience products such as debit cards, credit cards or online bill pay are not offered. BND has one location at 1200 Memorial Highway in Bismarck, North Dakota.

https://bnd.nd.gov/public/

There are plenty of examples of younger people with obvious bad results. The one going around on social media right now is Erin Moriarty who plays Starlight on the Amazon show The Boys. The issue is that some combination of too many procedures, poor choice of procedures, bad luck, and bad surgeons can result in an obvious uncanny valley effect. Once someone winds up in uncanny valley territory, it seems near-impossible to correct.

https://knowyourmeme.com/memes/erin-moriarty-plastic-surgery

I have only played Palworld for a couple hours, but so far it's completely different from Pokemon. The core gameplay loop involves building a base and capturing pals to help you gather food, stone, etc. It's more like Valheim or Ark with an anime-inspired aesthetic.

Those examples are quite a stretch as well. There are 900 Pokemon now, many inspired by preexisting animals, mythological creatures, etc. Nintendo does not own the concept of a sheep (Mareep) or pterodactyl (Aerodactyl). Or Ekans, which is literally just a snake with the name spelled backwards.

I just responded to how you originally framed the situation:

> I understand that immigration of unskilled people is a little off from the "skilled immigration" pipe dream and less convenient, but are people really that confused about the slightly longer term and exponentially scarier cost of no immigration?

In the case of Germany (and Europe more broadly) the unskilled migrants typically arrive as asylum seekers. So when we look at the data and the facts on the ground for how unskilled migrants integrate into society, and if they make a positive economic contribution or not, the population being studied will largely be asylum seekers from MENA countries.

So far it has been a bit of a disaster. Sweden has done a 180 on immigration policy, Denmark has tightened its rules, Merkel tarnished her legacy with her complete mishandling of the migration crisis, etc.

> Reports from the Open Society Foundations

Sorry, billionaire advocacy organizations aren't credible sources on the issues they are trying to influence.

https://www.pewresearch.org/global/2016/08/02/4-asylum-seeke...

73% male, 83% under 35 at the peak of the migration crisis. I think my characterization was pretty fair.

> According to USA for UNHCR, 40% of individuals arriving in Europe by sea in 2019 were women and children. In 2022, over 159,000 people risked their lives trying to reach Europe by sea, with more than 2,400 reported dead or missing.

That number should be 0. Guess how we can make it 0? Eliminate pull factors that incentivize migrants and allow NGOs to aid and abet human trafficking. Australia had a similar issue with migrants arriving via ship, but through effective policy they have virtually eliminated both arrivals and deaths.

Most non-Western migrants are male, 18-30, have no knowledge of Danish and minimal education. Women and children generally wait around in UN refugee camps rather than take a long and dangerous trip to Europe. You aren't getting children, you are getting adults who will need years of remedial education to function at a high school level.

> How do weak labor force participation rates indicate an oversupply in labor?

It means people either can't find work, or the work available is so unattractive that it is preferable not to work. In a tight labor market employers will offer better pay, flexibility, hire less desirable workers, etc.

OECD stats linked below, for ages 24-64 it's under 80% for OECD countries on average. And that includes part-time and underemployed workers.

https://data.oecd.org/emp/labour-force-participation-rate.ht...

This take is completely ludicrous. If anything, first-world countries have a problem with an oversupply of labor, as demonstrated by stagnant real wages and weak labor force participation rates. Automation will only amplify this trend.

Also, Denmark has studied this issue extensively and found that "non-Western" immigration actually imposes additional burdens on the state, costing over $10k per year per migrant. Having a young population that doesn't work is even worse than having an inverted population pyramid, and that's without getting into the qualitative damage to social cohesion and trust caused by mass migration.

https://www.thelocal.dk/20211015/denmark-says-non-western-im... https://archive.fo/DU17J