skysight-inc/HackerNews huggingface dataset:
The definition of a spec is "an act of describing or identifying something precisely or of stating a precise requirement."

OAuth2 is really just a collection of suggestions. Here's some examples:

* What field should the token be passed back as?
* What are the token + auth URLs?
* Should there be a separate profile URL, or is user data passed back with the token?
* What field is the email address passed back as? The user's name?
* Are refresh tokens used? How?

These are just things I literally ran into today. There's hundreds more things like this.

And on top of that, pretty much every single OAuth provider requires custom code: http://passportjs.org/
Super easy to make delicious pasta: 1.5 tbsp olive oil, 1 tbsp colatura, 2 cloves minced garlic, a bit of dried pepper flakes, a handful of parsley, 120 g pasta. Cook pasta, mix ingredients in a bowl, combine while hot. No need to cook the sauce!
Dan, I know you are not to blame for this but I hope you can at least forward the sentiment.

I was at MozFest last year, with one of the execs on stage talking about Mozilla's efforts to "free the web". He went on and on for 15 minutes about it and I swear, the only thing on my mind at the time was how Persona had been gutted. Today's web isn't "free" if a core part of it is behind Facebook and Twitter.

> People loved the idea, but relatively few folks were willing to actually back up that belief with action.

Either Mozilla is full of it when they say they fight for the free web, or they massively misunderstand how important it is to get rid of proprietary authentication.

If this is Mozilla's stance, Mozilla's belief, then Mozilla is the one not backing it up with action.

Edit: Followup thoughts: I cannot get behind the way Persona was dumped. Firefox had an atrocious market share for many years, but devs didn't dump it. Persona can't revolutionize the web by taking down Facebook and Twitter in 24 months, and it's not good enough? Grr, there were at least a dozen other ways to stop spending as much effort on it without outright killing it.

> Maybe my attitude was a common one, and doomed Persona to a chicken-and-egg situation.

Yuuuup: https://bazqux.uservoice.com/forums/190752-general/suggestio...
I made a Facebook and Twitter OAuth libraries, and I can see it sucks. Twitter's PHP library that is linked on thier documentation is based on a really heavy OAuth library and it's old a bit that most things their aren't need and it seems to care that as long it works it's fine.

Facebook OAuth isn't complicated since they don't look to care about "security" as much as Twitter do (or just Twitter trying to implement every OAuth specification blindly). But again Twitter trust you with thier Token for life while Facebook is for a while...

So I agree with the author except on the part when he said he came up with a good alternative which is just a step behind.
Ask HN: Is there a browser extension that re-flows heavily paginated articles?
Readability and similar extensions reflow pages, but I haven't found one that pulls clickbait all onto one page yet, despite widespread hate for unnecessary pagination.[0] Am I missing one, or is it too challenging to have an extension understand so many unique templates?

[0] Discussion of pagination blues here: https://news.ycombinator.com/item?id=4605904
Yes, he certainly is vocal :)

http://blog.expensify.com/2011/03/25/ceo-friday-why-we-dont-...
In college I attended a great talk by Herb Wilf that was his foolproof plan for writing a combinatorics paper: Basically, find two sequences on the OEIS that look unrelated and prove a relationship between them.
The entire spec, yes, is big, but the part you actually need is not that complicated. I implemented the IdP for the new york times (there's quite a bit of third party shit plugged into the nytimes.com web experience that we wanted to be transparent to users) in a few weeks as I recall, and I'm not some coding super-genius. (It was kinda hacktified and minimalistic, but it worked at scale. ¯\_(ツ)_/¯) Most of our counter-parties were up and running in a week or so. Compared to the abysmal quagmire that was our ecommerce code, SAML implementation was a total milk run.
It's mentioned by another commenter, but being cut off from the US financial system, even for banks with no presence here, is a blow that many institutions cannot recover from. The dollar is the world's reserve currency and it allows the US to exert enormous influence.
I have really enjoyed Kendo UI but am now just getting into a world beyond jQuery based frameworks, what were you comparing Kendo UI to that you liked better?
Isn't a "private blockchain" just called "a database"?
Yes. And the same is probably true of the browser you used to post this. Also, the OS it's running on. It's the price of being "evergreen."

It's worth thinking about why we've accepted this tradeoff. The cost of evergreen software is that we put all our eggs in one basket, and watch the heck out of that basket. The benefit is that we solve a huge set of system administration problems that would otherwise be ridiculously impractical.

One metaphor I like to use is the difference between the Soviet and American design styles in aerospace. The Soviet way was to build systems with loose tolerances that worked okay even when parts were a little out of spec. The American way is to build systems with precise tolerances that work perfectly when everything is right, and fail catastrophically when it isn't.

There's much to be said for the Soviet style, and indeed it might be summed up well in Postel's law. But as the problems you're trying to solve get harder (like keeping all the world's browsers updated), it doesn't scale very well. If we compare the problems we can solve with manual upgrades and Postel's law, to the problems we can solve with automatic upgrades and rigorous protocol validation, there's no contest.
"You’re 55 Times More Likely to be Killed by a Police Officer than a Terrorist"

http://www.washingtonsblog.com/2015/03/youre-55-times-likely...

http://www.theguardian.com/us-news/2015/mar/04/police-killed...
Legality aside, how do US citizens (loosely defined as people who were born in the US decades ago) who do not live or work in the US have any moral obligation to pay taxes to the US?
Colatura, nam pla and nuoc mam are all modern equivalents of garum/liquamen and are made in much the same way. The recipe for garum is on my ancient Roman cookery page http://web.onetel.com/~hibou/Apicius.html (scroll down).

Lea and Perrins Worcestershire Sauce may contain anchovies but has many other ingredients and bears little resemblance to garum. Other brands (e.g. Heinz) even omit anchovies.
Feminist?
Wait, can you use Polymer components? I was under the impression they still didn't work on mobile browsers. Our did they finally fix that?

For now I use Material Design Lite. All the beauty of Polymer without the framework forcing you to do all that weird stuff.
I use PageOne, works well on many sites: http://globalmoxie.com/blog/page-one-safari-chrome-extension...
I don't think there is a test that is going to tell you that you should "pursue programming". It comes down to whether you enjoy programming or not, and if you can see yourself personally doing it as a career. I have seen people who are excellent coders and analytical thinkers, yet have no interest in programming as a career. They are much happier in project management and other roles. On the flip side, I have seen people that have a strong desire to be programmers, yet have little "aptitude" (as you define it above). However, they have found niches where they excel at programming by working hard and overcoming their own obstacles.

With that said, there are many coding sites out there where you can compete against others. TopCoder and HackerRank are two that come to mind off the top of my head.
I've always wondered how much of the gap comes from a near total lack of male teachers in K-5.
https://news.ycombinator.com/item?id=10320551
For what it's worth to the people saying "we (as in the US or the international community more generally) have no interest in this and shouldn't trample on sovereign nations," I respect your opinion and your disdain for heavyhanded, imperialistic behavior, but don't ignore the evils that these banks perpetuate. They are opportunistic and protect and facilitate some of the worst people on earth, including arms traffickers and dictators who commit atrocities against their own people. Maybe exerting pressure against these banks isn't the right solution, but I have no sympathy for the sort of people who helped the Sudanese commit genocide, and anything that works against them I'm inclined to support.

http://www.bloombergview.com/articles/2015-10-20/shh-credit-...
I love that you emailed him!

Urbit is 100% open source, and (as you mention in your other post) probably a good fit for implementing Xanadu on top. Our filesystem satisfies a lot of the requirements.

Want to build it? Great. We'll happily help.
Open Access Is a Human Rights Issue
The first video really impressed me. It genuinely looks like he is depressing a 3D button into the screen. I was pretty skeptical of the name "3D Touch" at first, but that video sells the idea better than Apple did.
I despise clickbait.
Is there a lessons learned / recommendations for the next attempt writeup?
In my experience talented early employees tend to take a tremendous amount of insufficiently-compensated risk. The founders can of course lay them off at any time, dilute them, give them paychecks that bounce, outsource their jobs after a year or two, sell so much equity that employees stay underwater or barely in the money, etc. The founders take a lot of risk themselves, but they are in control, and they usually reward themselves for it. Whereas volumes could be written about early employees at successful companies who maybe got a solid bay area house downpayment out of their stock options, after working 60+ hours a week for ten years.
I read it as "don't bother with details, just use this thing here that does a lot of other things but happens to have a lib that might do it".

I think it's absolutely a good idea to use battle tested code, but you need at least working knowledge on what you're doing to apply it properly. Same thing applies for crypto in general: you generally don't implement it yourself, you generally use battle tested code, but you need to understand what you're doing. The idea that you can eliminate any of these steps and have something working properly is wishful thinking.
How We Handle Do Not Track Requests on Medium (2014)
I'm curious, a few years ago many bullies ended filmed on youtube, were your stories long before kids carrying smartphones ? I wonder if that helps too. Lots of witnesses can store evidence nowadays.
This article was pretty all over the place, and had too many speculative, opinion based quotes. Shouldn't this problem be handed over to the CDC? The writer briefly alludes to the fact that gender inequity may be related to gender roles, which are a construct. Yes, the CDC should study gender roles.
California Leads the U.S. in Digital Privacy
This will blow away the cursor position:

User enters: `1245|`
Navigates back: `12|45`
Enters 'a3': `12453|`
Instead of: `12345`

There are a ton of "gotchas" in this. Pretty frustrating.
Not sure if writing such a long blog post and updating blog post to comments is best use of time for a CEO of a startup.
I read the Koblitz/Menenzes paper a second time, and again it doesn't really discuss the possibility of a kleptographic vulnerability. Yes, it discusses weak curves and the possibility of extant or (NSA-internal) speculation of a classical or quantum analysis technique at length - but those are fundamentally different from a security standpoint.

A kleptographic vulnerability (one which cannot be exploited without breaking a cryptographically strong problem) is entirely different from the plain "ECC believed strong but actually weak" situation. Once the latter vulnerability is known anyone could break it, but the former vulnerability is strong even if the theoretical basis for the backdoor is discovered.

It's the same fundamental difference between building a computational-theoretical hard algorithm and security-by-obscurity. The NSA is not dumb enough to bet on their trick remaining obscure - that stuff inevitably gets rediscovered, whether it's 5 years or 20 years. But it's easy to precompute E in the DUAL_EC_DRBN algorithm, while it's cryptographically strong to try and reverse it after the fact. Trapdoor functions work like one-way secure hashes (eg SHA) by design - easy in forwards, computationally infeasible (as a design goal) in reverse.

The patent on the concept of using that as a backdoor (although not in that exact phrasing) was filed in Jan 2005 [1] (years before the selection of the NIST curves in FIPS 186-3) and it's reasonable to believe the NSA would know of the existence of the backdoor since the filing at a minimum - if not before. It was published for public comment in 2007 [1] but didn't gain much publicity until granted in 2013(!) [2] after Snowden had gotten the disclosure train rolling.

If you have a specific page/paragraph reference you'd like to cite: please do, it's a topic I feel strongly about since the consequences of a compromised kleptographic backdoor could be rather extreme for anyone who uses those curves.

[1] http://www.google.com/patents/US20070189527

[2] https://www.google.com/patents/US8396213
Here you go: https://news.ycombinator.com/item?id=8831419
Let's be fair to Mozilla. Pocket is a separate company, and Hello is definitely not worthless in the grand scheme of things... merely less useful.
"It’s a sentiment that’s so common, it has it’s own Twitter account."

So does Texts from Dogs.

Twitter is not a good measure for anything.
A live alternative to quantum spooks
The Smart 3D Pen Lets Your Imagination SOAR
The User's Mind Is Full
They create companies that are broken from inside, and just pumped with marketing money.

Most traditional VCs don't touch Rocket companies, they raise funding from oligarchs, old school industries trying to go "online".

[1] www.livemint.com/Companies/rYKC6HjnShogjE62jO5lpK/The-trouble-with-Foodpanda.html - Pretty typical of Rocket companies. Fake numbers, related party transactions, skimming money.
My point, which I didn't explicitly state, is that maybe instead of demonizing the rich for tax evasion we should be doing more to help the poor and middle class achieve these same ends. Obviously, building a strong economy and job creation are much more important, but lowering taxes and allocating the money the government does have, should be important goals going forward.
When they travel, they may take advantage of visa-free entry into many countries, negotiated through treaties with the US. If they get into legal trouble abroad, they enjoy consular protection from the US State Department. They enjoy the right to vote in US elections, and the (at least theoretical) right to move to the US should they fancy it.

If they really aren't interested, it's a pretty straightforward process to walk into the nearest embassy and opt-out: http://travel.state.gov/content/travel/en/legal-consideratio...
US citizens benefit from the passport and the effects of American foreign policy on that passport.
Those are valid reasons to leave, but they do not equate "shitty place".
"WhatsApp Web requires Chrome or Opera"

"Google Inboxbeta only works in Chrome"

I’d say things are just as bad as before
https://wiki.mozilla.org/Identity/Persona_AAR is a pretty good place to start.
Take Two Hours of Pine Forest and Call Me in the Morning (2012)
"Can anyone suggest a few problems with max completion times for each that will let me know for sure?"

I'm not sure if timed problems are a good way to assess yourself. Being able to solve programming problems quickly comes from (1) experience from having solved lots of problems before and (2) experience with your languages and environments. If you have a lot of aptitude but little experience, you may not be able to solve problems quickly.

"What's the fastest way to tell if I'm cut out for, and should pursue programming?"

I don't know if there's a fast way that can give you a meaningful answer. I'd suggest spending some time (at least several months) learning more about programming, working on some problems you're interested in, and seeing whether you become a better programmer over time.
I think part of it is that with IM clients you're mostly talking to a closer group of friends first then random strangers next so whatever your group chose you would use but there was no strong incentive to join with what everyone was using because you'd just be chatting with unidentified strangers if you moved out of your friend group into chat rooms.

Also the barrier of entry is really low and there's minimal effort in using two or more IM clients running, you could have both running and easily jump into whichever had the group you wanted to chat with. And unlike social media, like Myspace vs Facebook (when they were still competing), participating in both wouldn't mean uploading everything twice.
My guess is that most things---good and bad---have a disproportionate effect on boys.
Either way, what do we do with people who take a chance on their own volition and lose perennially? Do we compensate for losses to keep things equal?
This started off well, with lessons like paying attention to cost-of-acquisition and encouraging collaboration between product, sales, and marketing teams.

Then contradicts itself a few paragraphs later:

> Don't wait for the data. Don't pretend what little data you have is more significant than it is...

> “...act decisively on those [opportunities] that excite you, and move on,” says Barrett.

Then straight up devolves into jibberish:

> Clear, direct language helps, but isn’t a silver bullet. Authenticity and relevance are three-dimensional variables, so timing and response workflows are most critical.

Yes, clear and direct language, such as "authenticity and relevance are three-dimensional variables..."

Plenty of valid points in there, but it's wrapped in so much BS that I'd be ashamed to link to it.
Except - they also serve as a safehaven for wealth created in countries where its very likely to be confiscated by totalitarian and unstable governments. Think Nazi Germany, Rhodesia/Zimbabwe and unfortunately, possibly, hopefully unlikely - China.
Why do you think it is a good idea to make things "social" at the OS level? That seems like a very strange abstraction policy.

And how is this system "politics-aware"? I'm not even sure what that would entail from what basically seems to amount to a collection of esolangs.
Google Brain Residency Program
I think aptitude is overrated compared to overall drive / obsession. You should pursue programming if it's something you want to pursue.

Do you like solving problems? How stoked are you when you figure out the cause of your bug? Would you pursue it even if it wasn't lucrative?

Project Euler has some good puzzles, they are somewhat math related but cover a lot of interesting concepts and can be fun to work through.
Please avoid gratuitous negativity on Hacker News.

https://news.ycombinator.com/newsguidelines.html
You know, you're one of the people in the best position to start a "New Persona" project — it's not something just anybody can pick up. You know what went right and wrong in Mozilla's approach both on the social and technical side. You also know how to best leverage the existing Persona userbase (eg keeping some backwards compatibility).

I would love to donate my time for a cause like this and I know I'm not the only one. Shoot me an email if you ever go through with it.
Interesting, unsure why you were downvoted here. I completely agree that tax evasion is a global problem. There's a fantasic book called "Treasure Islands"(http://treasureislands.org/) which goes into it in detail. Showing how multinationals and the very rich structure their affairs so as to avoid the bulk of taxation (while not actually living in these offshore jurisdictions)

Is it right? It's reasonably legal (the difference between evasion and avoidance is a very grey thing). According to the book linked above, we give less in aid than countries lose in not being able to tax effectively.

Not quite sure how you fix it, probably fewer laws and more transparency. But it'll be quite the fight, there are more than a few $$'s at stake.
Study links insecure maternal attachment to math anxiety in children
The objective of the justice system is not reformation and education (well, maybe on paper that is the objective if you limit scope to the juvenile system). It's "paying your debt to society" for what you did wrong, i.e. punishment.
They are still hot :-) I wore a suit to work (in Japan) every day for 5 years. Having said that, I really liked wearing a tie in the winter because it actually kept me quite a bit warmer. Now because I work from home, I will often wear a jinbei or yukata when I'm working. I don't actually own hakama right now, so I'm not sure how they compare to trousers in every day use. I've worn them before, though, and don't recall them being overly warm. I think it would be a bit strange to wear hakama at home, though...

This thread really piqued my interest because when I first started wearing Japanese clothes I was a bit self conscious. But Japanese people always told me it was fine. Now, if I walk down to the izakaya in my jinbei and geta, I'm just like all the other old guys in the neighbourhood ;-)

I experienced quite a lot of racism from expats in Japan who thought it was unacceptable for me to have Japanese friends, watch Japanese TV shows and read Japanese books. They kept saying, "You will never be one of them. They will never accept you." Eventually I had to distance myself from that community.

The other day, one of the neighbourhood children was playing with their friend. The friend walked up to me and tried out their English. The neighbourhood girl said, "Oh don't bother. He's Japanese."

Home is not always where you were born.
About+Us+/+Promo+Codes+2015
Yep- don't get me started:

* Do access token expire and need to be refreshed at all?

* Are scopes used?

* Appropriate header values?

* Can redirect URI be overrided in auth request (my personal favorite)?
The problem is fundamentally that the most top-security ever possible is an offline piece of paper locked in a Mission Impossible-resistant bankvault that only the President has the capability to open.

But then you can't actually use it to do anything and its existence is purely a downside. And you can't put it online - in any fashion - without exposing it to some possibility of compromise. Whether that's by one-or-more sysadmins who take a massive bribe (compromising two decades of SCI-level USG secrets => name a number and we'll pay in Billions), or users who can perform sidechannel attacks, and so on.

Everyone knows what happens once you expose real systems to real users/admins (should be read as "attackers"). You cannot design a black box that miraculously requires no administration and is not vulnerable to any sidechannel attack when your threat category is state-level actors.

I actually suspect the NSA does fall into the category of "altruistic actors" here. Their number-one concern is making sure that nobody can decrypt the things that nobody should be reading. I don't think they're above pulling a kleptographic backdoor if there's a computationally-strong guarantee that nobody else can break it (perhaps while learning a hard lesson about socially-strong security) but at the end of the day I do trust that they won't be broadcasting State Secrets in something that will be publically accessible within a decade.

When dealing with a state actor like the NSA you need to reverse Hanlon's Razor - they may be malicious, but they're not stupid. They know when the jig is up and it's time to cut their losses.