skysight-inc/HackerNews huggingface dataset:
Thanks to HTTP Public Key Pinning (HPKP), this is no longer a threat:

HTTP Public Key Pinning, or HPKP, is a security policy delivered via a HTTP response header much like HSTS and CSP. It allows a host to provide information to a user agent about which cryptographic identities it should accept from the host in the future. This can protect a host website from a security compromise at a Certificate Authority where rogue certificates may be issued for your hostname.

You can read all about it: https://scotthelme.co.uk/hpkp-http-public-key-pinning/

And here are web-based tools for examining and generating HPKP hashes: https://report-uri.io/home/tools
And the advice will become "make sure the browser bar is not yellow", and everything will be safe by default, and everyone will be happy.
I'm assuming they published it on medium as a blog post targeting the tech community because they were trying to persuade potential future employees that Amazon is a good place to work.

What it actually shows to me is that Amazon really is a horrible place to work. Splattering internals from employee files onto a public forum in order to smear them (because none of those smears actually refute what those employees said) is the same underhanded tactic Scientology uses to smear critics, who happen to be ex-members.

I for one would never, ever work for an employer willing to use such despicable tactics.
We need a hub for software in science
Not surprising at all.

Hands down, Google Apps (not Gmail) is the best hosted email service for businesses. That's why companies use it. It's so good that wasting precious engineering resources on reinventing the wheel makes absolute no sense whatsoever. Oh, and don't forget email deliverability, spam detection, and a slew of other features that your cobblestone of postfix, dovecot, and roundcube will never even come close to reaching feature parity with.
That should be a feature in Starfighter. 'tptacek?
Measuring Australian cloud oktas with satellite images
Billions in Change: A documentary on inventions being designed to save the world
If you use the Cloudflare style delegation of SSL authentication signing to a trusted auth server, it can be simplified. The individual servers only holds the public cert and a private internal secret, one server holds your certificate private keys.

That server would be used to keep track of your domains and certificate status and which servers are authorized to work with which domains, etc... Also easier to backup.
The article I've linked documents why it wasn't supposed to be a spam server. Specifically, it seems that the author had a financial interest to keep the server, not to push the spam and burn:

"Earlier this year I moved my personal email from Google Apps to a self-hosted server, with hopes of launching a paid mail service à la Fastmail on the same infrastructure. I've done this before, and this server was configured perfectly: not on any blacklists, reverse DNS set up, SPF, DKIM and DMARC policies in place, etcetera. (Side note: https://www.mail-tester.com/ and Port25 are great for checking your setup.)

I had no issues sending to other servers running Postfix or Exim; SpamAssassin happily gave me a 0.0 score, but most big services and corporate mail servers were rejecting my mail, or flagging it as spam:

- Outlook.com accepted my email, but discarded it.

- GMail flagged me as spam.

- MimeCast put my mail into a perpetual greylist.

- Corporate networks using Microsoft's Online Exchange Protection bounced my mail."
People focus on different priorities. I don't think it's hard to understand. They just care less about privacy. Scaling is more important to them. And your emails can be encrypted on your client side if you want to. Just make sure those encrypted emails aren't so suspicious that they want to crack them.
They collaborated with the NSA to develop an exploit in the SSL implementation used in Outlook.com.

From the Snowden documents;

July 31, 2012

Microsoft (MS) began encrypting web-based chat with the introduction of the new outlook.com service. This new Secure Socket Layer (SSL) encryption effectively cut off collection of the new service for FAA 702 and likely 12333 (to some degree) for the Intelligence Community (IC). MS, working with the FBI, developed a surveillance capability to deal with the new SSL. These solutions were successfully tested and went live 12 Dec 2012.
OK. But which line is which? Which database is the orange line? Which database is the blue?
surf provides a minimalist interface but isn’t really in the same class as Dillo and NetSurf. It’s a full‐fledged WebKit engine, while these two use their own custom, lightweight rendering engines.
Thanks, that article was indeed much better to understand what's going on. Still, as mentioned, high-speed gearing of the kind does offer some design challenges, but apparently its all secret sauce.
The US doesn't have a data protection law, nor a general privacy law. "Trade secret" protection and regular copyright are all you have.

Edit in response to downvote: OK, there's the https://en.wikipedia.org/wiki/Stored_Communications_Act . Whic prevents them from 'divulging' the contents of the email. However, it doesn't prevent automated processing (as used by gmail advertising). So you can see where this is going: is it illegal to ask the computer for a count of the uses of the word "merger" in emails belonging to users of a particular domain?
Is there merit for a lawsuit? There are legitimate reasons to use UK VPN from UK. And there will be at least couple of persons that are affected.
The game definitely leaks information, I got better at every try -- this was the 4th attempt:

Your returns were 329.0%, against the stock’s 139.7% and the S&P’s 14.7%.
You outperformed 100.0% of players, ranking #1.
Visual diffs on every deploy
This reminds me of Midori[1] which I loved using while I was on ElementaryOS[2]. It was such a refreshing change from years of using bloated Chrome and Firefox which they still are, more so.

[1] http://midori-browser.org
[2] https://elementary.io/
> Vanilla Windows ships with PowerShell.

This is a relatively recent development, and PowerShell itself is not popularized among Windows user yet. If you've begun programming in the last 5 years then you may get some good habits; those who started earlier probably followed the path 'angersock described.
Quite the accomplishment is a major understatement, if it is true.
None exist. So far the best solution is to use Emacs with [2]

* merlin-mode, for autocompletion

* ocp-indent, for external code formating... think running gofmt on every enter press (surprisingly, it's fast enough unless your file is 2k lines long)

* tuareg-mode (everything else, REPL etc.)

* flycheck-ocaml for syntax checking

The "real" IDE plugins aren't even close and that's saying a lot since the hodge-podge of addons I just listed isn't

The default Emacs user experience is awful so if you're a Vim user, just install the "evil" package and enable it inside Emacs by doing M-x evil-mode, then you have Vim inside Emacs. Or use Vim, but the experience isn't as complete w.r.t. tooling[3]. There's always Spacemacs as well[1].

[1] https://github.com/syl20bnr/spacemacs

[2] https://github.com/the-lambda-church/merlin/wiki/emacs-from-...

[3] https://github.com/the-lambda-church/merlin/wiki/vim-from-sc...
It's different from one AS to another. I've spent a lot of time maintaining reputation for my IP at a certain major ISP (no bulk email) and I'm still getting blocked from Google and others.

Then I got a VPS at Linode (for some other purpose), installed Postfix and emails were just working - no SPF or even reverse DNS set up.

IP reputation IS a thing.
IBM has invented a cloaking device to conceal military vehicles
> ... generalization without first hand experience is not fair IMO.

Totally agreed. Maybe I went a bit too far there. Of course there are some brilliant people in those companies, no doubt. I have interviewed at a bunch of them, and I don't see why a company would not send some of their best programmers to interview people.
I'm sure they're not opposed to it. It's a work in progress!
I tried a while back to get this to build for OSX but gave up after a few rabbit holes.
Kickstarter darling Pirate3D delivers only 40% of its total orders
3nder announces $500,000 Seed funding
Author here. I like Prolog, and you might enjoy my https://github.com/darius/pythological. Here's an excellent free book: http://www.mtome.com/Publications/PNLA/prolog-digital.pdf

But the first draft of the article was already stuffed too full without even trying to go past propositional logic; it had to be cut, not expanded.
BTW... here's a playlist of MicroPython / micro:bit status videos made during development and at PyCon UK: https://www.youtube.com/playlist?list=PLzCYc445IVNQimtxAlPpa...
I would just like to point out the irony in using 'LE' as a short for Let's Encrypt, as 'LE' usually gets used for shortening Law Enforcement.

(Also: Congratulations and well done, Team Let's Encrypt!)
Please do share those stories. You don't have to be Richard Feynman to write something interesting and entertaining!
You could run it on a laptop to get the cert, then install on the server. But right now it remains an invite only beta until they get ready for general availability
True, I agree that this case is not spam

And the 'hints' are pretty strong it isn't

At the same time sometimes there are some gotchas that people might not be aware (and things that the big providers have to deal with and that to them are sign of spam - this should definitely be more publicized, however they want to protect this because of the actual spam senders)

Now, if their domain previously sent mail, then now it gets from a new domain this might make warnings go off

Politely contacting those email providers might help

One small anecdote: I've had Gmail flag (legitimate) mail from 'google.com' not only as Spam but as Phishing as well.
Focusing on actual processes in the brain may be a more objective discussion than discussing "free will". For example, is the human brain driven by reinforcement learning? is dopamine part of the reward loop? how does curiosity fit in? Are there tipping point effects in neural networks? What about noise, or even quantum effects if you were trying to model and predict an outcome?

Regardless of one's position, that's an objective discussion with questions that can be tested, with useful results that could help develop a general AI.

Contrast that with a discussion about "free will", a suitcase word with numerous polarizing definitions. It's like walking into a minefield of bias and enmity. And frankly just as much strident opinion from "rationalists" as from the religious. And I ask, where is that going? What's the result such discussion is driving towards? Is the discussion really analyzing a real physical process in the brain or is this a values discussion masquerading as logic?
Why are placebos getting more effective?
Interactive eLearning Experiences
If you check his post history he basically just blanket denies everything relating to the Snowden NSA leaks and accuses people of believing in 'magic' when they discuss the agency's capabilities.
Not sure why you are downvoted, for presenting what amounts to the leading theory of free will. ( Compatibilism, the view that free will is compatible with determinism is the most popular theory of free will among philosophers.[1])

[1] http://philpapers.org/archive/BOUWDP
> Politely contacting those email providers might help

Really? Anybody who tried contacting Google and/or Outlook.com to claim some e-mail server is legit cares to comment? Is it possible? Is it different than what the article I've liked claims:

"The standard response from all of the above boiled down to this, from Microsoft's Postmaster Troubleshooting page:

- IPs not previously used to send email typically don’t have any reputation built up in our systems. As a result, emails from new IPs are more likely to experience deliverability issues. Once the IP has built a reputation for not sending spam, Outlook.com will typically allow for a better email delivery experience.

How to build a reputation for not sending spam when they're already flagging, bouncing, or deleting my mail was unclear."
It doesn't even support CSS2 properly (e.g. paragraph justification, em, etc). And despite claims of being blazing fast, as an user my experience is that it is very slow for more complicated pages, whereas for websites that are almost just plain text and images it beats any WebKit/Gecko browser out there.

It's great for Googling when debugging your code or reading HN when compiling, other than that I'd stick with <your favorite browser>.
to make TLS actually secure? http://www.theregister.co.uk/2015/10/19/snmp_bughunt_turns_u...
I love Dillo. It reminds me of when I was ~14 back in the mid-to-late 90s and learning C++ with a copy of Visual Studio 97 my dad "got me from work". Back then things were very different and teenage me wrote a pretty nice browser from scratch with the exception of some networking code.

Back then a browser was just another application on your computer, almost like a calculator something. It was just a tool. Now the web browser is probably the most complex bit of software on your computer. Crazy how far things have come in the past 20 years.

Also it is great to see FLTK in use, it is a nice little toolkit albeit not the prettiest :)
It's a shame I don't get 2000% returns in the real market. But I also don't invest 100% of my portfolio on every trade. I guess that's where I've been going wrong?..
Unless whoever gets the domain name after you doesn't want to be on the archive. Then all the history will be deleted.
> ..when the UK leaves...

Really? You feel that strongly that the people of the UK will vote to leave? Whilst there is vocal support for leaving, there are also a lot of level headed people who understand the benefits of being part of the EU.
I would absousbly love for immigration to open to anyone who has job offer over 65k+. That would eliminate the idea of immigration for cheap workers

What I hate is specific targeting of tech industry professionals.
Read-Only OAuth Scope on GitHub, Please?
Pruning Software Episodic Memories Using Extension Points in the Probes Open API
I'm also a dev on this (anne) we've had a question, are the scaling containers running locally on your machine? The answer is yes, we just display what's happening on your machine on our portal
Solar powered car to drive 1500 km on a single charge
> There's no way I can be convinced that we can ever trust a for-profit corporation to manage a prison.

I don't think they should be trusted to run anything that constitutes a public service, be it prisons, transport, utilities, health and education.

'For-profit' is the MO of private companies. Service takes a very distant position at the back.
This is why HTTP Public Key Pinning was created as a way to tell browsers to trust only a particular certificate, not just any certificate that was signed by a CA in the browser's trust store: https://news.ycombinator.com/item?id=10418144.
As a non-US citizen, this shocks me, even if it shouldn't by now.

Does this indeed make it legal for a "chief corporate espionage officer" at Google to have a handy little dashboard of competitors inboxes? Can trade secrets only be defined by courts retrospectively?
It's not a solution for low-traffic personal email servers. I've tested 3 domains in Postmaster Tools and for all 3 there's no data (I've added them a month ago or so - there should be data already)

No data to display at this time. Please come back later.
Postmaster Tools requires that your domain satisfies certain conditions before data is visible for this chart. Refer to the help page for more details.
Once you have a grasp of the fundamental mechanisms of the universe(cause/effect, logic, etc) you quickly see that certain, socially-defined terms are irreconcilable with the facts of reality. Namely they, the three major and thorny ones, are ideas of God or gods, supernatural phenomenon and ideas of free will.

These three ideas just don't fit with the facts. If an entity was powerful enough to create everything, what created IT? If supernatural phenomenon were real, why isn't there solid evidence of its existence, and if it exists on a plane beyond the material then how could it ever affect the material plane we inhabit? Finally, if you accept that the universe follows certain predictable, immutable laws then you must agree that with enough information any future or past state could be predicted or recreated. Humans and their minds live within the constraints of this physical universe, thus any potential future state of mind or behavior could be predicted from the previous state(s) that human was in. All moments arise from the moments before them. There is absolutely no gap there to shimmy in ideas of "free will". I was born at a certain time, place and in a certain community. I had no choice there, but the die was cast and everything I ever become will be constrained by those facts. I will never be able to magically pull myself out of this causal chain.

I would like to add one more thing, to counteract the possible easy pessimism that a realization like this could have on an individual. One day I realized that ghosts weren't real. As a child, this was a burden lifted from my shoulders, as I could rest easier knowing no unpredictable and unfathomable force was going to accost me as I slept. One day I realized that there was no God. I suddenly felt freer than ever, and less self-conscious in solitude. I don't live every day in anxiety about the "lack" of these two delusions. It happened once more with free will. I realized all things belong to a causal chain possibly extending into infinity, and I was just a pattern at the tail end of this chain in time. I suddenly felt more compassionate for every other human, lodged as they are in their station . You and I can't help what we have become, what we came from or what we will be. Even knowing this, I live intentionally, not drowning in a sea of slavish fatalism, but instead with the keen knowledge that I too belong to the causal chain, and that through evolutionary machinations, my mind can suspend disbelief and still feel it is directing the future toward a desired state.

The paradox is difficult to rest in, but it has given me a powerful tool, another paradoxical belief, that I can control my future by knowing that I simply arise from what has past.
I'm all for native desktop and mobile applications, but in this case I'd actually love a web app - enter your domain, get certificate.

Downloading a tool, reading man page, works out of the box only with apache/nginx - ehhh, seems like a lot of work, considering some comments touting 'user friendliness' compared to StartSSL.
You don't consider somebody writing their own browser from scratch to be frontpage worthy?
Slides Framework Based on HTML, CSS and JQuery
The frustrating thing about this is that we're starting to see companies that make google accounts mandatory.

I've already been in the position of being told "make a google account or lose your job" once. I chose the job, I have rent to pay. But I really don't want a google account, and critically, I _do not_ agree with googles terms of use.

Unfortunately, there's no way for me to flag to google that I have made the account under duress, and thus I will be subject to their data fracking techniques against my will.

Facebook was talking a few years ago about developing Facebook for business, I can see that taking off like a rocket too.

I'd really like to see some federal level intervention on the topic of employers strong-arming employees into legally binding agreements with third parties.
> Age of the universe: ~13.8 billion years

If the age of the Universe is 13.8 billion years, I wonder, what was happening 13.9 billion years ago?
What about 13.8^2 = 190 billion years ago and even before that ?

Kind of mind bending, but time seems to be infinite (at least to us) so at that scale, the life of Earth is really a blink of an eye or less.
Where would you put the possibility of random events? I do think it's a real possibility that things on sub atomic scale behave randomly or at least stochastic.

If that is true, then no amount of information can predict the future.
https://en.wikipedia.org/wiki/Local_field_potential

One of the most important ways the brain communicates is actually not just ionically through chemo-ionic channels but through summed wave activity. This is especially important in sleep and also during long term potentiation of circuits.
Could you please elaborate and provide links about what happens then? This sounds important, yet I have never heard about these things...
You're right. I too was disappointed. AFAIK, not a single pillow has made it to the front page of HN. And we're all still waiting.

They should definitely rename to avoid further confusion (not to mention the false sense of hope).
Adam Curtis' article on the competency of these people is entertaining and contains some really quite disturbing information about the incompetency of some professionals in this field.

http://www.bbc.co.uk/blogs/adamcurtis/entries/3662a707-0af9-...

I don't always agree with Curtis, but his articles and documentaries are always worth the time.
Some of the highly English-speaking countries, like the Nordics, might be a good option.

Better act fast though, before the UK "brexits" the EU. I have no idea how difficult it would be for people(/me) to keep their(/my) address and company in the UK in that scenario.
I don't see the problem here. You use third party products and services all the time in your professional capacity.

If your employer wants you to have a google account, i assume you'll use it for some job-related things. So it doesn't need any of your private data/usage profile (use company address/phone nr etc).
Good to see they are finally addressing the root cause of the problem.
How entrepreneur first put a car mechanic booking service in the fast lane
Do you have any recommendations on which CA is good for EV certs (that work in Chrome)?
Something that saved me a lot of time recently is that from the network request list, you can right click the request and "Copy as cURL" to get a full cURL equivalent command of the request.
Can someone who's tried the client confirm if it's possible to get a key/cert out of it without having it mess with my configuration files?

I'd like a manual mode, as years of sysadmin work have made me extremely skeptical of tools that try to automatically modify config files.
> there has never been better time to use dropshadow, gradients, and transparency via CSS. But nobody is using it.

Just because you can do these effects doesn't mean you should.
Please feel free to checkout Devarist, it's an app we built for exactly this purpose.

https://devarist.com

It's for capturing quick daily notes, supports Markdown, Screenshots, export, daily standup view...
For offenders who can't pay it's a pint of blood or jail time
> self-signed cert which CloudFlare will not verify at all.

Why would they do that? I never used this feature of CloudFlare, but it would be only logical to require you to upload the cert so they can verify against it in the future.
IncrediBuild offers visualization of your build process (Linux and Windows) https://www.incredibuild.com/
That's not true at all. I question it when people post conspiracy theory stuff with no evidence whatsoever. HackerNews is not that type of website, and I hope it never degenerates into it.
In case the main intermediate cert has been compromised and must be revoked, the alternative intermediate cert is already signed and can be used immediately for desaster recovery.
Ok. I will invest 1$ in random startup for 1/1000000000 of the company - congratulations we have a new unicorn.
PCE Macplus Emulator Running Mac OS System 7 – PCE.js
There's no legal concept of abandonware, and even redistributing it is illegal. It's just that, well, it's abandoned because nobody wants to take legal responsibility right now. That situation can still change when a copyright holder sells it to a patent/copyright troll later.