jkeisling/hacker-news-corpus-2007-2022 huggingface dataset:
So what do we do to fix the broken CA system? Particularly in a case where a bogus certificate is issued by an intermediate CA that rolls up to a root CA that is included in all the major browsers.

It seems to me that we have several building blocks available and it may be a combination we need:

1. CERTIFICATE PINNING (HPKP) - example: http://tools.ietf.org/html/draft-ietf-websec-key-pinning-21 - if a browser had previously pinned the certs of affected sites then it would have known that it was going to bogus sites and could have displayed a warning or prevented the user from going to those sites.

The challenge with pinning is that somehow you have to learn what to pin before you visit a site, either by having the pinset or certs pre-loaded into the app/browser or simply by doing Trust On First Use (TOFU). Additionally, if the first use is to the site controlled by an attacker, the cert that gets pinned in the browser could in fact be the attacker's cert, which could make recovery difficult.

Which brings us to...

2. DANE/DNSSEC - http://www.internetsociety.org/deploy360/resources/dane/ - with DANE (RFC 6698) you put a fingerprint (or an entire cert) into a TLSA record in DNS and then sign that with DNSSEC. A browser or app that supported DANE could deal with the TOFU issue by doing a DANE check to verify the cert that it is receiving from the web server. This would then effectively bootstrap the cert pinning process by providing a way to test the validity of the cert.

Because the DANE TLSA records are entered by the owner/operator of the domain and then through DS records are tied into a validated chain-of-trust up to the root of DNS, it would be difficult for an attacker to subvert this with his/her malicious TLSA records.

But we have a third layer to help...

3. CERTIFICATE TRANSPARENCY (CT) - http://www.certificate-transparency.org/ - CT provides a way to log all the issued certs and have browsers/apps check those logs through an auditor. When the browser gets the TLS cert, it also gets a signed cert timestamp (SCT) and can use that through an auditor component to check if the cert is valid. The challenge is that right now only some CAs log issuance of certs and only some browsers/apps check via an auditor. (I also don’t understand myself exactly how real-time CT is, but that may just be that I need to understand the SCT mechanism better.)

To me these three different components can work together to provide a higher degree of trust: cert pinning to help with the speed of connecting to frequently-visited sites; DANE to help with the first use/key learning issue[1]; and CT to provide another means of checking the cert validity.

Comments?

[1] And yes, DANE could be used to store entire TLS certs separately, but right now I’m looking at how these pieces could be used together to give the maximum efficiency and security.
You can definitely survive a nuclear war -- but you might up envying the dead.
Article is total BS. Author seems to think that private businesses should be forced to publish anything some crackpot submits. Sorry, on my own website, I'll only publish what I want to. Here in America, that's what we call freedom.
>not an existential threat to humanity ... [but] it would be a humanitarian catastrophe unprecedented in human history, as the global economy breaks down and regions are pushed back on their own resources. This could easily kill more people than the war itself, particularly in densely-populated areas, but I would expect things to stabilize at a technology level of maybe the late 19th/early 20th century and start back up.

So, it's exactly as destructive as I think. I get it - some people focus on the worst case scenario of a human-species-ending nuclear winter. I'm not actually particularly interested in how likely or unlikely that specific outcome is, as the "lesser" outcomes are plenty horrifying enough, and don't call for a general downplaying of nuclear attacks like this.
It might be, but have you also validated the microcode executing it?

Or the Verilog/VHDL for the logic gates used by the CPU, for that matter?
Often it's more helpful to use one guess you know will not match, just to eliminate or split numerous cases at once. If trapped with _IGHT which could start with many letters, a guess like FARM would reduce your guesses in a single move.

This also helps avoid or escape focus on an expected pattern that may be wrong (premature convergence.)
I feel like the idea of the Chinese "ghost city" is just plain false. You can label any new development this way. A typical housing development could have the title "Crazy Americans Build Ghost Houses". This is just urban planning and development being implemented.
I've used F.Lux for a bit as part of my sleep cycle; but had to stop. It gave me intense headaches and really really strained my eyes. In the end my optician advised me to stop using it.

YMMV of course but do take care :)
Agreed that it is a catastrophe all the way around.

Unfortunately, morons can kill people. I hope there are serious changes in the psych tests for these positions. People who are careless playing with explosives shouldn't be allowed around them -- but that doesn't make them any less dead when they go off.
IF the free market is a "Good Thing" AND Big Government and Big Business can AND you are able THEN Go start a small Business
END
Aspirin is recommended to prevent blood cloths on planes. You should also wiggle your toes and flex your legs at least once an hour. My brother, who has had a blood clot, gets up and walks the length of the plane and back at least as often.
I'm getting an error message while attempting to register, too.
"With Farmville on the iPhone, you'll be able to farm anytime, anywhere."

Be afraid. Be very afraid.
Upper left corner is the area with most calories and least caffeine. Lower right corner is most caffeine and least calories. Hardly a useful graphic though.
For anyone interested in urban gang dynamics I highly recommend David Kennedy's book Don't Shoot. I recently read it and it contains some amazing insights into misunderstandings that communities of law enforcement and urban neighborhoods have about each other and gangs which leads to rational but wrong behaviors that perpetuate those misunderstandings, along with some brilliant ideas to change those dynamics with examples of those applied ideas working in multiple neighborhoods across the country.

http://www.amazon.com/Dont-Shoot-Fellowship-Violence-Inner-C...
Static linking OpenSSL is probably not a good idea
Windows still uses the hosts file in windows 8. I did a little looking around and it looks like Windows Defender automatically removes some hosts from the file.
> I wonder to what degree technology has played a role.

Since 2008, other than smartphones, what has really changed in tech?
My attempt at motivating schemes: http://www.win-vector.com/blog/2014/12/lets-try-to-motivate-...
It is racist to imply bikes are stolen by Poles and probably also to say that a shitty bike not worth selling round the corner for £20 is worth hauling all the way to Poland.
As someone else in this thread has pointed out, that was a decision by 9th U.S. Circuit Court of Appeals, not the U.S. Supreme Court. From the article: "The U.S. Supreme Court has never squarely addressed the limits of the Fourth Amendment in the context of airport searches."
I actually built a feed-builder: http://ffnetupdates.inklesspen.com/

Sign up (no email or password, just a UUID), track as many authors or stories as you like in one Atom feed. It will let you know when wordcount changes even if there's no new chapter, or when your favorite author has a new story.
Honestly - I don't think that Digg's issues were necessarily size-specific as they were both architecture and community specific.

Digg had a hell of a lot of momentum in the space - but they were too focused on trying to polarize interests around the articles that were submitted - and much much less focused on the community that was providing the interest.

The beauty of reddit (much more a /. approach) was to provide as free a forum for the opinions on submissions. Digg really was submitter focused (which I believe to be too emulative of traditional media) - whereas reddit does an excellent job of the true meta discussions that would occur if you had a crowd in a public square that were presented a story on, say, a billboard and documenting the ensuing conversations.

Reddit truly emulates how people in a quorum would act. Digg tried too hard to play both the publisher and consumer side of media, with too much publisher bias and we see where that got them.
I'd say it was the two galaxy sized bubbles immediately above and below the plane of the Milky Way that were just discovered but they used the Fermi Gamma-Ray Telescope for those.

http://www.telegraph.co.uk/science/space/8125127/Giant-space...
http://en.wikipedia.org/wiki/4chan
what are good places to share a link?

The main vertical I'm focused on right now is tech:
http://tech.rawsignal.com/

although I built other verticals that seem to be working already. Not sure where to share it that would interest people who like tech.
"There are some people who, irrespective of the work they put in, who will never be able to learn somethings."

Yes, and we waste untold billions of dollars and years of people's lives supposedly "learning" things they could not care about less and will never be able to apply, due to the fact they will not actually learn those things. All this due to corporations demanding a piece of paper certifying the acquisition of certain kinds of knowledge, knowing full well that they piece of paper means no such thing.

In short, you were doing your small part to perpetuate an insane, wasteful, corrupt system.
What a joke. Things like this – and the rhetoric on his site – make systems programming look like more of a dark art than it actually is.

If you're a programmer, should know how your computer works; if pointers are too "hard" for you, you're in the wrong business. You're settling for mediocrity and belittling your own intelligence by assuming you're not capable of tackling this stuff the same way everyone else has.
I like how even though it is pretty clear that the target is Iran's uranium enrichment complex with centrifuges running at 600Hz - 1200Hz, they explicitly avoid mentioning that. That shows considerable professionalism, as obviously there is no factual evidence of that (and most likely there won't be unless one of the authors decides to confess).
The problems with GPU rendering and MacOS are myriad even outside the M1.
Hard disks are typically sold with 1000-based units and memory is typically sold with 1024-based units: the market is inconsistent, and therefore so is the user interface; if you by 512 MB of RAM you get 512 MiB, but if you buy 1 TB of disk, you get only like 0.9 TiB, and so if you have a UI showing you how much space a file takes up it should (sadly) likely work different from a UI showing you how much space a process takes up :(.
You don't need to rate movies or even have a Netflix account to get this data. For this particular example, go here (found by googling 'the social network netflix'):

http://dvd.netflix.com/Movie/The-Social-Network/70132721

You'll see they suggest {Beyond the Sea, Into the Wild, The Blind Side, Good Will Hunting, and Prefontaine}.
In that case, a question along the lines of I'm curious why... would have been perfectly appropriate. I don't see why just comes across as I know better. But perhaps English isn't their native language.
Maybe it is behind the paywall but one interesting technique used by Red Bull is that they marketed themselves as a hard drug.

Red Bull is actually a rather tame drink. It has a lot of caffeine, but not more than a typical cup of coffee. It has a few fancy ingredients like taurine, but these don't amount to much. If anything, the most harmful/addictive ingredient of it is sugar, and the actual "energy" part of it.

But it is the way they marketed it. It "gives you wings". They have representatives give out the first dose for free at schools. It is associated with the rave subculture. It is sometimes consumed in association with alcohol. If people didn't know it was just a soft drink, they would think about something like ecstasy.

And it worked. People bought these overpriced soft drink cans as some kind of forbidden substance with powerful effects, kids loved that. I was one of these kids BTW.

I worked somewhat too well as government banned them in some countries, before they realized wasn't as harmful as it sounded, so they reverted to taxing it. Fun fact, in France (I don't know about other countries), they made a special tax for energy drinks, defined as soft drinks with more than a certain amount of caffeine. As a response, Red Bull silently reduced their amount of caffeine in order to stay under the limit, making it barely higher than a typical soft drink.
> the US gov went full on war against torrent websites and closed every one of them no matter how small

A teacher in a Soviet provincial day care center tells the children: “The Soviet Union is where the best hospitais are found, the best schools, trains, airplanes, the best factories, the best candy and toys…” Some of the children cry out, “We want to live in the Soviet Union!”

Must be nice to live in US that had victory against torrents.
Yikes.

https://www.notion.so/Privacy-Policy-cd4b415950204a46819478b...
AWS is pretty likely to consider that abuse, in my experience.

If you can VPN or send on an alternate host to the third party, though..
Not as destructive as the alternative -- pitchfork economics.
I hope the distinctions will be of short term relevance. Car ownership and usage seems very inefficient. Think of how many hours one is actually used compared to the material and space it takes up. Dense cities should continue increasing transportation infrastructure (roads, autonomous vehicles, bikeways, and walkways) both in scale and quality so that everyone uses it by default. Then these distinctions matter as much as what brand/model of train I take.
> If we can be shown Pocahontas and The Patriot...

I don't think schools should include either of these, either, beyond "we're having a relaxing movie day as a treat". Certainly no one should base their understanding of American history on them.
> Something will happen in relation to lunar resources.

Lunar what now? I mean, I thought the stuff over Taiwan was a little over the top, but... this is just satire, right?
"...With me, on the contrary, the ideal is nothing else than the material world reflected by the human mind and translated into forms of thought."" -Marx, Afterword to the Second German Edition of Volume I of Capital.

"The question of the relation of thinking to being, the relation of spirit to nature is the paramount question of the whole of philosophy.... The answers which the philosophers gave to this question split them into two great camps. Those who asserted the primacy of spirit to nature ... comprised the camp of idealism. The others, who regarded nature as primary, belong to the various schools of materialism." (Marx, Selected Works, Vol. I, p. 329.)"

-https://www.marxists.org/reference/archive/stalin/works/1938....
I hear you on this but I think it crosses the line from 'ethics' to 'activism'.

The ethical concern would be, "don't build a racist AI system that assumes black people don't pay back loans". This could be mitigated by removing race and clear proxies such as zip code from training data, but it doesn't necessarily break your cycle, because the poverty and social problems are real and exist regardless of whether the AI considers race.

The anti-racist approach, on the other hand, would specifically require incorporating race so you can perform affirmative action. Maybe that's good for society, maybe there's a debate about how much and in what way you do it, who pays for it, etc. But it's left "ethics" far behind and become "politics" at that point IMO.
You can be fully in control of your own OpenID if you want. Just host it on your own domain/server.

Or even easier: use delegation. Add some meta tags to the header of your blog (or any HTML page under your control), and sign up for sites using your blog URL as your OpenId.

See an example at my domain (the content is currently blank, but the meta tags are in the source code): http://jmh.id.au

I can sign up anywhere by typing in 'jmh.id.au', and it uses myopenid.com for login. If for some reason I didn't trust myopenid.com I can change providers by editing that page. So I'm not tied to any one provider.
I don't like the idea of having one identifier which can be used to tie together all information about me - because linked data provides an unwarranted amount of power to people who have access to it.

I think 'an internet drivers license' would basically become an ID card.
California isn't going anywhere, but they probably wont be the cats meow for the next 10 years

I don't know if the VC data includes angel investment. And, while I'm sure it's a much smaller amount in terms of total dollar figures, there have been several hundred startups funded in the Valley this year.

Granted, most of those will fail, but if even 20-30 of them succeed (10% success rate), that will be a huge boom to the California economy.

Not only that, but we're going to be seeing a number of really interesting exits/huge acquisitions in the next few years: Facebook, Twitter, Yelp, Linkedin, Zynga et all... If 2 out of those 5 goes IPO, that will add tens of billions of dollars to the economy.

Companies like Google, Apple, Cisco, Intel, etc... are all doing quite well.

Nation wide, companies have an estimate of $1.4 Trillion dollars of cash on hand, and they really don't want to hire. but, as soon as the economy starts to rebound, they are going to be interested in growing fast, and merger and acquisitions are typically one of the fastest ways to do that. $1.4 Trillion buys a lot of small recently funded startups.

No, I think California is going to be doing just fine in the next few years.
That's fair enough I guess (I'm one of the persons who commented about the money & IP factors.)

However, there are literally millions of problems like this that you could choose to solve for your own challenge. As I see it, this specific problem is interesting enough but not especially so compared to the total set of possible computer-oriented challenges. Except for the fact it's being offered up with competition, fame and fortune as a reward.

Also, the IP factor seems to imply you can't, say, release an open source project with your winning algorithm and let anyone go away and use it. It seems you have to assign it entirely to the NSW RTA when you're done. That's actually the part that grates on me the most, it seems a lot more "contractor ethic" than "hacker ethic".
Techcrunch titles are getting longer, but I don't know if that trend stretches out to the web at large.

So I did a quick survey of my blog ( http://www.puremango.co.uk ) which has been running for 6 years.

Here is a graph of the results: http://i.imgur.com/l2iKC.png

There's a slight upward trend, but I'm certainly not seeing as direct a correlation as there is on techcrunch (but then they have more data)

So perhaps this is the result of a particular editorial style rather than a wider trend. Worth investigating though.

If you have a wordpress blog, here's the SQL I used:

SELECT post_title, post_date
FROM `wp_PREFIX_HERE_posts`
WHERE post_type = "post"
ORDER BY post_date ASC

Then I just took it into excel with the following formula to count words:

=LEN(A1)-LEN(SUBSTITUTE(A1;" ";""))+1
Excellent example of how to write about technical subjects for a general audience.
> All too often, that path leads to abusing veterinary supplies... and telling the world how awesome it is to do so.

The grandparent poster listed an example of election day incorrect information, the person you responded to listed an example of a politician stating incorrect information. Whether it's a good example or not is highly debatable but ad hominem style attacks don't help your argument.
Battery life isn't a huge concern for me, there are outlets everywhere these days, even on planes, but user-swappable SSD and RAM are absolutely non-negotiable for me, as is the ability to run Linux natively, and actual function keys. Macs are unusable.

That said if I'm not doing number crunching I can easily get through 4 hours or more and that's plenty good for my use case.
I live in Brazil, therapy and meds here are pretty expensive.
I usually spend a whole Brazilian minimum wage (roughly aroung us$200 - us$300) on therapy and Vyvanse per month.
Wage gap here is pretty big so as I work in the marketing/tech industry I can afford to do so as dealing with my ADHD is my priority now.
I receive around 7x our country's minimum wage per month as a parameter.
If a modern take on Delphi I definitely would like to try it; I used Delphi for more than a decade and yes I miss it.
To be honest, I'm sure all the features of Laravel I use could also be done with external libraries, but researching and finding something suitable, hooking it together, configuring, integrating it into my project is something I am unwilling to spend time on.

I write code to solve problems for my company, so building a framework is very low on my priorities. I'd rather just use something that is ready on day one.

Maybe it's not to everyone's taste but I like the fact I can just get on with trying to build my product.
We don't specifically numerically measure them but we have seen our defect rate go down noticeably. The changes are also quite minimal with very little developer overhead being required - using a service architecture requires writing a factory and class definition once... using a query repository is about the same.

The biggest advantage we've seen though is in onboarding time. The more purpose driven and modular our code gets the quicker it is people pick up on each individual module types structure and new devs can start experimental coding quite quickly.

For me, personally, the ultimate attribute I value over everything else in a codebase is minimized maintenance costs - we have a few corners of our codebase that have extremely brittle automated tests that require hours of labour to execute the simplest of changes in and they're on our fix list. But the stuff we need to change frequently can be changed quickly and safely so our bug fix turn around is relatively minor. I'm actually in the middle of upgrading us from ZF2 to Laminas and this work is probably going to last about three weeks (with a bunch of the most annoying fixes coming out of Doctrine and their fanatical devotion to `final`ing every class under the sun - thanks guys) which honestly seems extremely reasonable to me for bumping two framework versions.

I'm also really not personally a fan of ORMs because the query building tends to make DB performance harder to tune and I loathe the performance implications of ActiveRecord approaches - but they're components I've built into our infrastructure to support other devs and I can comprehend their appeal.
> According to a blog post written by AtariProtos’ Matt Reichert, “Until the mid 1980s, most games were only credited to the company that published them. In a fast growing market, studios wanted to make it more difficult for competitors to poach talented programmers by keeping their identities hidden. This practice is why we don’t know exactly who conceived and programmed Aquaventure, along with many other titles from the early ’80s.”

Oh that's rich, coming from the company that pioneered the responsible policy of suppressing developer credits from the games they made.[0]

[0]https://www.pastemagazine.com/games/easter-eggs-the-hidden-s...