Headsup to anyone who wants to reply:

While the black bar is not a "banned topic" or anything, bringing it up tends to produce heated disagreements, and at the worst possible time too (since the conversation ends up in the thread of someone who's no longer with us).

Devolving into meta flamewars is quite disrespectful, and creates extra work for the moderators as as well.

I suggested opening a dedicated thread the last time it was brought up, and that's here: https://news.ycombinator.com/item?id=14119519

Here's the last time the black bar was discussed in a thread it was used. You'll need showdead turned on to see all the offtopic discussion. https://news.ycombinator.com/item?id=14118290

I think it's because I'm tired, but I'm not following.

I login to $app with my password. $app bounces me to SMS. I then go back to $app with the SMS code.

So I needed my password with $app and the code from the SMS.

In the article, it looks like the code via SMS was never required. Uber sent it out, then allowed a login without it. I've seen something like this before, where companies over two factor auth via SMS, but also allow SMS as a password reset channel - which means it's not two factor anymore.'

But in general, you're right. The problem with SMS as a second factor isn't that it's not two-factor, it's the ease of compromising both factors at once. Hijacking phone numbers is disturbingly easy, and smartphones mean that you can steal one physical token and get both email access (for password reset) and SMS access (for the code).

I got the impression there was no password input. It's getting way too common to do phone based verification, and authenticate new phones by SMS codes.

If it asked for the password (does Uber use passwords at all?) then yes, I was just saying dumb things; please ignore.

If your Android phone is infected then 2FA effectively becomes single factor that is under attacker's control.

Question. There are several mentions of $gigantic_resolution either providing the same or less display area than $smaller_resolution.

Are there any hacks that can convince macOS (or the older versions of OS X described in this article) not to treat the display as HiDPI? Yeah, I realize the machine will abruptly feel like it needs a magnifying glass to use, but in a pinch (laptop on lap <2ft from eyes) it might work for some (insert standard disclaimers here about eyes being non-replaceable and needing to last the distance).

Also.

The late-2015 21″ iMac is ~$1.5k+, and "has a multi-core Geekbench score of 5623."

Then the late-2011 17″ MacBook Pro which is ~$1.3k checks in with a "9240 Geekbench score".

Is there some datapoint I'm missing here?

>Are there any hacks that can convince macOS (or the older versions of OS X described in this article) not to treat the display as HiDPI? Yeah, I realize the machine will abruptly feel like it needs a magnifying glass to use, but in a pinch (laptop on lap <2ft from eyes) it might work for some (insert standard disclaimers here about eyes being non-replaceable and needing to last the distance).

macOs already supports several resolutions higher than the standard 1/2native which is what Retina uses (half the native pixels at each dimension for twice the resolution).

IIRC, already the "default" resolution on newer MBPr with the touch strip is higher than the 1/2native (that used to be the default on retina laptops).

There are also apps like: https://www.thnkdev.com/QuickRes/ and http://www.madrau.com/ for more flexibility and full-native resolution even.

That said, the full native retina resolution on something like a 15" screen doesn't make any sense to me except for some special circumstances (maybe 4k movie viewing, but doesn't that already use the full resolution?).

>The late-2015 21″ iMac is ~$1.5k+, and "has a multi-core Geekbench score of 5623." Then the late-2011 17″ MacBook Pro which is ~$1.3k checks in with a "9240 Geekbench score". Is there some datapoint I'm missing here?

Yes, one is a GeekBench 3 score, the other is a GeekBench 4 score. Scores of 3 and 4 editions of the GeekBench suite are not comparable.

> Yes, one is a GeekBench 3 score, the other is a GeekBench 4 score. Scores of 3 and 4 editions of the GeekBench suite are not comparable.

Ah, that's what I was missing. Thanks.

>Are there any hacks that can convince macOS (or the older versions of OS X described in this article) not to treat the display as HiDPI?

You can change the display scaling directly in system preferences, I can crank mine all the way up to 1920 x 1200 scale (Late 2016 15"). Beyond that, there's QuickRes: https://www.thnkdev.com/QuickRes/

Another option is RDM, which is free: https://github.com/avibrazil/RDM

(RDM has never had an official home, I don't think, and I don't remember where I got my copy from. Think it was a link from reddit. So I can't comment about this particular version, which I found via Google just now.)

>> Are there any hacks that can convince macOS (or the older versions of OS X described in this article) not to treat the display as HiDPI?

SwitchResX and others allow you to use your Retina Mac at its native resolution

It's EXEs and JARs for the Internet.

Sure, it has a text format, but it's the equivalent of Lispified Java bytecode. (https://developer.mozilla.org/en-US/docs/WebAssembly/Underst... (uninformative but current), http://loyc.net/2016/lesv3-and-wasm.html (2016, from when wasm wasn't finalized, but has some good concrete examples that look like the wasm in the first link))

With this being said, it may actually be easier to figure out wasm than frameworkified JS since you can apply IDA-style reversing to it.

Open question: what existing tools and research are good at inferring the high-level behavior of stack machines? Eg, research papers, or (preferably open source) tools for reversing eg Java code. I want links I can throw at Ph.Ds.

>It's EXEs and JARs for the Internet.

It's bytecode. I'm not sure if it is a big downgrade from 100,000 lines of minified JS code.

>With this being said, it may actually be easier to figure out wasm than frameworkified JS since you can apply IDA-style reversing to it.

It may.

Obviously not open-source, but IntelliJ's decompiler is excellent.

I came here to say exactly this, and before doing so thought to ^F first. Heh.

The other two comments I see in this subthread are practical and pragmatic, but I also agree with your view as well. I would far prefer to pay the fees and have all transactions processed via the blockchain.

Although at the end of the day, pragmatism makes money...

The problem is that when you are putting money in Coinbase you are basically loosing your biggest asset on the btc network... trust; You have to fully trust that Coinbase won't transfer your btc's to another "internal" account.

Unsure if you can answer this, but this info is not utterly impossible to find by trial and error, so it's not concretely private.

Are you saying there's more than one 710 number? [Just Y/N]

Someone posted a reply to my comment a few minutes ago then deleted it. Proof: https://news.ycombinator.com/item?id=14531411 / http://i.imgur.com/HcU8NgS.png - yes, looks like Arc completely hides newly-posted-then-deleted comments, very probably for aesthetic reasons.

In a nice bit of timing, HN Replies (my HN notifier) grabbed the comment before it was deleted! It was interesting, so I'm anonymously adding it below:

--

> I have seen first hand a large VoIP carrier reach out to an ITSP because one of their end subscribers was scanning the 710 number space either manually or not. And it was within a few minutes after the scan started. This type of activity (and others too) will set off all kinds of alarms at phone providers.

  data:text/html,
  <style>img { opacity: 0.5; position: fixed; left: 0; top: 0 }</style>
  <body><img src="https://www.cl.cam.ac.uk/~fms27/vck/share1.gif">
  <img src="https://www.cl.cam.ac.uk/~fms27/vck/share2.gif">

Of course, I did this via the domtools^Wdevtools before experimentally trying the above, which happily works as well.

I think the reason the images loaded was because I was on a data: URI? Or am I misinterpreting CORS?

So, I'm trying to do what you do, entirely using browser tabs. It concretely doesn't work.

After 200-400 suspended tabs open and a browser chewing molasses, I tend to export all URLs to a list for One Day In The Magical Future™, kill my session and restart.

So yeah, I'm very interested to find out what rule system you use - is this bespoke, or using standard email client features?

Also, what email client do you use? I've been trying to find a medium between "old computer becomes unusable after >10 tabs are open" and "fast, native information-presentation applications (like terminals) are text-only and don't support images" for 15+ years.

I use Gmail's basic HTML mode 99% of the time. It... I can't say I like it. I want something that doesn't use Qt and GTK+, because I perceive more lag with applications that use these toolkits than I did with lightweight WinAPI apps I ran on Win98/Win2K machines with half the hardware capability.

Browser tabs were a different part of the puzzle, for me anyway. This is my preferred way of managing information:

* My email pulls new information into my digital sphere of awareness. * Browser tabs/history manage active context and mid-term working memory. * Bookmarks (poorly) curate resources for long-term information retrieval. * My git-backed repository of notes tracked my own thoughts and plans.

Fastmail, gmail, and my old university Outlook account all support creating rules, however I am not aware of any RFC standards around rules. My adhoc suite of scripts for pushing content to email is entirely custom.

I like Thunderbird, but it's a pig at 300MB memory consumption... however it's open source and does what I expect.

Sieve scripts (https://tools.ietf.org/html/rfc5228) are the standard for email rules; FastMail uses Sieve scripts internally and also allows you to write your own if you desire: https://www.fastmail.com/help/technical/sieve.html.

Oh that is so freaking cool, thanks for sharing!

FWIW, I do note the usernames comments come from sometimes, particularly if they're insightful.

Regarding the numbers here, I'd say there are multiple thousands, possibly 5 figures. The top article about Apple refusing to publicly backdoor the iPhone (https://news.ycombinator.com/item?id=11116274) got 5667 points. And sometimes my comments will attract a reply chain but not get upvoted, which shows that some proportion of people doesn't upvote here.

Objectively, yes, but in practice, doctors sometimes work 12 to 30 hour shifts, all while the medical establishment actively tries to educate that tired driving is worse than drink driving...