jxcl

Is there any chance of Brexit being stopped, instead of just delayed?

You would need somewhere to generate the ATP. ATP doesn't flow around in our blood, but is generated inside cells for their own use.

https://en.wikipedia.org/wiki/Electron_transport_chain

Big ol’ block of text on the product page. https://www.apple.com/apple-card/privacy-security/

> Even Apple doesn’t know what you bought. Or where. Or how much you paid.

> At Apple, we firmly believe in your right to privacy. That’s why we created a unique architecture for Apple Card that generates things like your transaction history and spending summaries right in the Wallet app on your iPhone. Of course, Goldman Sachs will use your data to operate Apple Card. But they will never share or sell your data to third parties for marketing or advertising.

I think that the number that they show you in the app is different from the number on the card. They show you a number that you can enter into websites etc but there is a section for "physical card" that only shows you the last 4 digits. If this is stolen by skimmers then I guess they have to send you a new card.

For what it’s worth, almost every bank/card I’ve signed up for has this clause. Apple is the only one I’ve seen where you can opt out by text message, usually it requires mailing a letter.

I don't remember phone number being required while creating an account, they only wanted to collect it when enabling 2FA. If I recall correctly they had a little info button that said something like "we need this to start but you can remove it later if you _really_ want to."

Fastmail allows you to do this too. They have a long section in the documentation that strongly discourages it, and it seems like they will refuse to restore your account if you lose your 2FA, which is exactly what I want:

https://www.fastmail.com/help/account/2fa.html

>> Why do I have to add a recovery phone number to set up two-step verification?

> Keeping your account safe from attackers is very important. But so too is making sure you don't get locked out of your own account. We are aware that SMS is not the most secure of methods for 2FA, and has been deprecated by NIST. However, for the majority of users, the risk of losing their two-step verification device is far greater than the risk of someone hacking their SMS. If you lose your phone, the TOTP key is lost but normally you can get a new SIM card with the same number from your carrier. We therefore believe requiring a phone as a backup option strikes the best balance of confidentiality (no one else can read your data) and availability (you can read your data) for the majority of our users.

> Please note, if two-step verification is enabled, access to the phone number itself is not sufficient to gain access to an account: you still need two factors (your password AND the SMS).

> Advanced users that understand the risk may remove the phone number from their account once two-step verification is enabled. Once the recovery phone is removed from the account, SMS is no longer an option as the second factor for login. If you choose to do this, we strongly recommend you write down or print your recovery code and store it in a safe location, and that you set up at least two security keys or authenticator devices. Should you lose access to all two-step verification devices and not have your recovery code, you may be permanently locked out of your own account.

Well, because I consume most of my media at home, so I’d much rather store it there instead of having to stream it from the internet. But I also like listening to my music when I’m out of the house, so I need a way to connect to my home when I’m on a different network.

So my understanding is that ultimately the bank is responsible for any loss on my end as a result of someone breaking into my bank account, therefore I don't really care if my banks don't follow best security practices.

I guess it's probably more complicated than that, so perhaps someone more knowledgeable can expand on what I can expect to happen if someone steals money from my bank accounts because of one of the vulnerabilities in the article?

Accounts newer than 2 weeks show up as green.

https://github.com/minimaxir/hacker-news-undocumented#green-...

Converting wood to charcoal is a process that requires a lot of energy, so you'd need to keep that in mind when you make your carbon calculations.

When some aquifers are drained, they take many thousands of years to replenish, a heavy rain season doesn't really help with these depleted aquifers.

Here's a great video on Cody'sLab that explains how confined aquifers work and why they take so long to replenish: https://www.youtube.com/watch?v=tF4iCgxsZX4

It looks like they're not doing this, but it is also possible to see if your exact password is in the breach using an algorithm called k-anonymity:

https://blog.cloudflare.com/validating-leaked-passwords-with...

It could be, or it could even be that whatever process that brings code from development to production is less stringent on internal applications. Maybe people don't review the code as closely (or at all!), maybe they have fewer tests for internal code. "Internal only" applications almost universally have less scrutiny applied to them in my experience.

If a user has a bracket character in any field, it's OK to allow it, as long as you don't render it directly in any HTML. You have to make sure that when you render it you render it as `&lt;` or `&gt;`, which get displayed as `<`, or `>`, but aren't interpreted as HTML.

This bug probably existed because some developer thought "this is an internal application, I don't need to apply the same rigorous input/(edit: and output, as replies point out) sanitation as I do with normal sites because it's only accessible by VPN."

As a consultant that gets to see a lot of "internal only" applications, this is one of the misconceptions that me and my coworkers try to fight against. XSS is effective even if the attacker doesn't have access to the internal application, because it's not the attacker's computer making the requests.

> Technically speaking, Zoom could have abused dpkg post-install scripts, or pulled similar tricks, to install their malware server and leave it behind after the package was removed. Linux distributions aren't invincible to these shenanigans.

This is correct, but such a package should not make it into the distribution's package repositories.

It looks like it's too late for me to edit my comment, but I've been proved right. Putting a Noindex directive directly in robots.txt is frequently suggested, but this seems like definitive proof that that does nothing (at least with Google).

As far as I can tell the inception of this idea was that it was briefly mentioned by some Google employee in an interview. Maybe it was supported in the past or maybe he just misspoke, but I bet even now we'll see people still using this tag.

Google is also really generous with how they will let you spell "disallow": https://github.com/google/robotstxt/blob/59f3643d3a3ac88f613...

:D

I've been in disagreements with SEO people quite frequently about a "Noindex" directive for robots.txt. There seem to be a bunch of articles that are sent to me every time I question its existence[0][1]. Google's own documentation says that noindex should be in the meta HTML but the SEO people seem to trust these shady sites more.

I haven't read through all of the code but it assuming this is actually what's running on Google's scrapers this section [2] seems to be pretty conclusive evidence to me that this Noindex thing is bullshit.

[0] https://www.deepcrawl.com/blog/best-practice/robots-txt-noin...

[1]https://www.stonetemple.com/does-google-respect-robots-txt-n...

[2] https://github.com/google/robotstxt/blob/59f3643d3a3ac88f613...

I have been using fastmail with 2FA on the Android app for months now. I haven't had any problems.

That seems to have been the "common wisdom" for a while now, but I'm not so sure that it holds so much today. With everybody coming out with bloated SPAs is it possible that faster processors will start to be required for normal web work?

Edit: I'm an idiot. Ignore the below.

This article is about a company that was building bicycles to sell directly to consumers, not a bikeshare company.

As a commuting cyclist I usually prefer to ride in the street than in a bike lane. Protected cycle lanes are great only so long as nobody turns to the right directly in front of you. When there are cars parked in between the cycle lane and the car lane it's much easier for the driver to miss the cyclist, and few people check the cycle lane before turning right. I was definitely guilty of this until I started cycling.

Unprotected bike lanes between traffic and parking are the worst though. It's terrifying riding past cars any of which might open their door without looking and either cause me to crash into them or swerve into traffic and be run over. On these streets I will frequently ride in the car lanes as well.

  If I should die before I wake,
  All my bone and sinew take
  Put me in the compost pile
  To decompose me for a while.

  Worms, water, sun will have their way,
  Returning me to common clay
  All that I am will feed the trees
  And little fishes in the seas.

https://www.youtube.com/watch?v=LOJRiCHhciY

A fun artifact of deleting your facebook account is that all of your comments get deleted (hidden, I guess, is more accurate) too, which means that in old threads people who interacted with you now appear to be interacting with themselves.

My friend had a profile picture in which he was doing something silly with his eyebrows. I commented "Nice eyebrows" and he replied "You're just jealous." I've since deleted my account and now there is only one comment on this profile picture, by the person the picture is of, reading "You're just jealous."

My prior reading contradicts this idea.

It's my understanding that humans, being bipedal rather than quadrupedal, are more efficient runners[0]. Quadrupeds have the advantage over short distances [like dwarves, they are natural sprinters [1]], but their metabolism is not suited to endurance running. They lack sweat glands necessary to cool their bodies over long periods of exertion as well.

There are hypotheses of early humans hunting by purely chasing down their prey during the hottest part of the day and into hyperthermia.[2]

[0] https://en.wikipedia.org/wiki/Endurance_running_hypothesis

[1] https://www.youtube.com/watch?v=L4qZrPX60bw

[2] https://en.wikipedia.org/wiki/Persistence_hunting#In_humans

What does IC stand for?

I don't really think the choice of language matters that much.

I don't know Ruby at all but I have read through part of the book and can follow the examples pretty easily. Plus, I think I'll get more out of the book if I just use his examples as guidelines and have to do some mental work to translate them into the language I'm using.