skysight-inc/HackerNews huggingface dataset:
> Yes, you are. If your adversary can MITM a datacenter, it's likely that a rouge cert can also be obtained from a trusted CA.

One cannot simply obtain a cert from a trusted CA. Hence how they become signing authorities. Granted it's not impossible to do, but it is very difficult. Certainly a far better assurance than not running HTTPS at all.

> If your threat model includes this kind of adversary, please don't use my script. You should also consider how funny would be to host a VPN and route your traffic like this in a network which you don't trust.

We're not talking local network here - literally nobody can trust the internet. Hence why CA's exist in the first place. This isn't some weird edge case threat model, this is something that's well known and already handled. And it's something that is already supported by Github but you are intentionally breaking.

> What would an adversary accomplish pointing a DIFFERENT short URL to a malicious script?

Do you really need that answered for you?

1. Clone repo
2. Publish their own shortened malicious URL in cloned repo
3. ???
4. Profit

It's called "social engineering" and actually quite a comment method of attack.

> I'm not careless.

Given this script is aimed at less-technical people, I'd say it's rather presumptuous to assume they'd even realise just how careless it is to run a script downloaded from an unverified source.

> But minimal distro images don't come with trusted CA certificates, so it's useless. Yes, I could install them. No, I don't want to.

That's an edge case. You can add a comment to disable the certs in that edge case - or better yet, instructions on how to install the CA certs.

Every excuse you make is really just a plea for your own laziness. "it's the users responsibility" - no it's not, you're providing instructions for them thus it's your responsibility to get those instructions right. "they might not have CA installed", so add a footnote about installing that. I mean seriously dude, Github have already handed you the tools you need securing the install - there's literally no good excuse for disabling them.
There are two species of white rhinos: southern and northern.

The southern [0] has one horn and there are an estimate of 20,400+ alive in the wild. Although they are still quite rare, they are considered the most common and widespread rhino.

The northern [1] white rhino is the one mentioned in this article and is much, much more rare. There are now only three individuals alive. I haven't found any confirmation, but I thought the northern was more popular by poachers because of the two large sized horns, instead of a large and small one from the southern rhino.

All in all, very sad we came to the point human beings have (almost, for now) killed yet another species.

[0] https://en.wikipedia.org/wiki/Southern_white_rhinoceros

[1] https://en.wikipedia.org/wiki/Northern_white_rhinoceros
With Chinese quackery behind the demand for rhino horn, and with China's increasing presence in Africa, I am really surprised that the Chinese government is not doing more to save the rhinos. If I were a high-ranking communist bureaucrat, I would see this as an easy chance to score points for national (and personal) prestige, yet there seems to be zero interest. Why?
Will Micro Businesses Die from a Thousand Tory Cuts?
The fact that these animals have been hunted to extinction should be evidence that their horn has no medicine value. If it worked we'd have rhinoceros farms.
I think your ideas are sound, but last time I tried the manual install I couldn't get it running. So that was disappointing. That was many months ago, a lot might be changed now. I'll need to find time to have an other look.

Anyway keep up the good work.
Why would a closed source client from a company known to be scummy (looking at what they did to uTorrent) be something anyone should pay any attention to? (FWIW I did check it out, but it wasn't better than Telegram, nor was it better when it was released than Signal is now.)
Yeah. I guess if you have Xcode installed it's even quite easy. Of course, push notifications won't work.

It's hard to trust anything after Snowden. I don't know why my smart phone wouldn't be spying on everything I say. If not now then next year.

Maybe for messaging, what's most important is decentralized anonymity. We can use code language to conceal secrets. For actual documents, we can use more trustworthy platforms, at the very least ones with non-secret operating systems.
A style guide for what ? Code ? Website ? Application ? Written articles ?
Unfortunately, distribution networks and related contracts are very complicated legally, not even going into local laws and other legalities. Netflix itself has a few good sized teams of developers dedicated just to creating tooling to help navigate the legal nightmares regarding distribution agreements and their streaming services.

I'm pretty sure the studios would much rather be able to have a very few global release channels than the network remnants they currently have.
Of course HTTPS is not at all secure due to that central source of authority enabling easy large-organization MITM.
Scala.js has a new website
I think it means that push notifications are delivered via google cloud platform
I'm assuming you mean FTP and other protocol links? AFAIK, all those respect the proxy settings and fall into the same basic security mental model.
I admire your perseverance T. The doctrine that the free market leads to truth is difficult to dispel.
Yes, but it is still harder to lift than something light
My town has two successful DVD rental places.
Their "hipster twist" is basically: quality movies, and an owner that can find something for you. They aim at students and established inteligentia. At its core, the service they provide is discovery.

(the town also has a surprisingly thriving arthouse cinema scene, so it's certainly a welcoming environment.)

As for the wall of nekkid: "Confessions of a porn store clerk" (http://www.amazon.com/Confessions-Of-Porn-Store-Clerk-ebook/...) is a fabulous read. It's available for free, too, but I found it worth the dime.
You should try thefabulous.co
Each client has a key pair, their public key can be published, such as via keybase.io, you get the public key, and send the message that only the corresponding private key can handle.

WebRTC is also a protocol, intended for, but not necessarily tethered to a browser. I think given the distribution level of browsers, it makes sense as a communication channel. Not that it's the best protocol option, but it's relatively easy to interface with at a higher level.
You may find it funny, but one of the motivators for Perl being made was to get a better awk, which is why it's highly compatible with awk syntax.
And (hopefully) the studios pay the creators. But realistically how is that different from me renting/buying a DVD or buying a ticket at the cinema?
It would be nice to find Signal on F-Droid for those of us who'd rather not be a part of the Google ecosystem.
You just have to love that name: WAPBL.
We don't run anything in VMs at the moment. I guess if we would we'd do it like we're doing with the containers, mount the drives into them. Do you guys run the search engine in VMs?
Northern white rhino dies in US, leaving only three alive
It's something that I was wondering: is there some kind of DNA library with samples of every species DNA, us included? I'm not a biologist but I guess with samples of 100 individuals it could be possible to "recreate" a whole species.
I agree: Canonical should make it easier for developers to strip the company's trademarks when forking their applications.

Canonical's relationship with the rest of the FOSS community always seemed a bit screwed up to me. They try to make Ubuntu the best Linux distro while ignoring what all the other ones are doing. All other distros seem much more friendly towards integration between projects, to benefit from the shared work, while Ubuntu most of the time paves its own way - there's a lot of Ubuntu only software, such as Unity, Mir, etc. that you just dont see in other distros.
Mulling on this a bit more - the profitability is further impacted from the inability to mine customer data on a secure app. Anecdotally, when presented with a free unsecure app vice a paid secure app, average Joe will go with the free app. Maybe there isn't a true demand like eps mentions
Theranos supported a misleading story around their tech. True, but startups by definition should evangelize a future vision.

What did I just read? That a medical services company should purposefully lie about their treatment or diagnosis to obtain higher valuations?

This isn't a tech startup, it's a medical services company. The bar is, and has to be, much higher.

"Fake it 'till you make it" does not, and should not, work in healthcare, and that's the Theranos story.
http://ethanheilman.tumblr.com/post/133488739430/is-playstat...

It seems that PS4 encryption is broken.
It's the archer, not the arrows. Bitcoin is just an arrow.
I'm sure people are happy to operate rhinoceros farms solely for the monetary value, which we know the horn does have. The problem is elsewhere.
Awesome lists are a good place to start.

https://github.com/lipis/awesome-style-guides/blob/master/RE...
Stress engineering in aerospace
> Telegram has broken crypto, doesn't ecrypt by default and the authors being arrogant about their broken crypto doesn't exactly inspire confidence.

I find this "because it's not 100% standard crypto it's broken" mentality here questionable. Surely innovation can happen in the crypto space without having to be signed off by the usual suspects? Last time I checked Telegram's crypto was not broken.

Of course it does not end to end encrypt by default. Most people do not want that given the disadvantages this has in the user experience.
That's complete rubbish. Anthropologists and historians use measures in terms of nutrition, health, life expectancy, child mortality and leisure time that apply regardless of the economic system in operation and track changes over time in order to characterize changes in lifestyle. You can set benchmarks to characterize poverty regardless of whether the population in question live in an agrarian, capitalist, Marxist or whatever system. Arguing that the massive objective improvements in living standards generated in capitalist economies somehow don't count on obscure technical semantic grounds is pure Marxist* sophistry.

* It occurs to me that it's possible you might not be a Marxist, but the argument you're making is one often put forward by Marxists, along the lines that capitalism by establishing monetary systems to measure capital establish scales on which poverty is measured and therefore create that poverty. Of course every Marxist society ever created has also used a monetary system to measure and allocate capital. But then Marx never, in any of his publications or letters, ever described how a communist economy would actually function so obviously building one has proven somewhat problematic.
Website seems to be down, heres a mirror: http://webcache.googleusercontent.com/search?q=cache:UvM4KhY...
> are closed source, so they are completely unverifiable.

They can still be verified by third parties if Whatsapp/iMessage wanted to do it.

No company can satisfy security purists, because they can't make a living out of it.

We have a secure messaging/voip app. Verified by a third party (they have the entire source code). We use the same protocol signal uses (Axolotl ratchet). You can install applications without app/play store and you can run the server on-premise on your own infrastructure. No google services are needed.

But all of that will still not be acceptable by "the community", because we are closed source and charge a license fee.
Websites down, heres Google's Cache: http://webcache.googleusercontent.com/search?q=cache:UvM4KhY...
I believe you misread or failed to read the rest of the paragraph. The author makes it clear this isn't just work.

I feel similar to the author's statement. Coding is my thing. In general, I really like most of my work. When I have writer's (coder's) block, it really, really, sucks. Right now, for instance, I'm sitting on some dynamite info and just need to polish up a proof of concept to show of some fun stuff. I even have clients 100% ready to pay for things if I can show POC. Yet several of these things have sitting around, somewhat planned or partially started, for months. That feeds back to itself and makes me feel worse.

And again, this doesn't mean just work.. Some of these things are things I'd do for no compensation at all, but purely for the fun of them. Being burned out and not wanting to do the stuff I want to do, thinking the one passion I'm competent at is slipping away - that's depressing and scary. And some of the stuff I want to do, like family related things, they suffer too, and those aren't even software-related, let alone work.
Assuming you mean CSS style guides these should keep you busy for a while: http://styleguides.io/examples.html
Not necessarily. Rhinos would only be farmed if they could be patented. Of course rhino horn has no medical value, but it could still be hunted to extinction even if it did.

On this topic silphium went extinct despite being highly useful medically [1].

1. https://en.m.wikipedia.org/wiki/Silphium
As a game developer I can tell you that safeguards are i place to bypass this encryption.
I have no idea about the details of this debate, but even so it's obvious that this article screams warnings signs - it's full of tricky strawmen and other fallacies.

For instance, it makes the absurd comparison between the supposed innate talent for language and a spiders web-weaving - spiders weave webs without examples, so why not kids? Spiders are about as poor a stand-in for a human as you'll find in the macroscopic world. Also, even if something is instinctual, it's hardly reasonable to assume that instinct will always overcome any situation, regardless of trauma, especially in a animals as impressionable as humans. Finally, just because an animal has an instinct and/or innate aptitude doesn't mean that practice is irrelevant. The girl that was held in a cellar until she was 13 only shows that either the instinct isn't absolute (no surprise there), or even just that the instinct still requires exercise.

Then there's the flatly false statement that dna doesn't have the storage capacity to store a universal grammar. Oh really? The human genomes codes for on the order of a gigabyte of data. AFAIH, there's strong evidence that there's not a lot of evolutionary pressure to keep genomes small, IIRC based on the observation that even small, competing microbes have dramatically varying sizes of genomes (when you'd expect smaller-genomed competitors to have won if it really mattered). For some context: A compressed wordlist containing 350000 english words is less than a megabyte. In general, grammars tend to be much smaller, especially if you consider that it's not claimed that a full grammar is stored, but at most the "basics" that can get rehydrated based on learnt language. Another poster in this thread claimed his 500 line python program can generate a good approximation of human language given enough input data. I wouldn't be surprised if a few kilobytes would suffice to describe the components from which any grammar can be built - much smaller than the full grammar itself.

There's another absurd misunderstanding of evolution in which the article manages to suggest that because evolution is necessarily continuous in the space of genomes, it thus must be continuous in the space of outcomes (i.e. language is so large a leap, it couldn't have evolved). I'm sure many creationists feel the same way about the eye - not to mention the fact that the article then proceeds to knock down some straw-men about when that language ability might have evolved according to chomsky (which is basically saying that because chomsky apparently doesn't know how language evolved, his other theory must be false. Really?)

I have no idea about the details here, but this article is about as unconvincing as you can get. He may well be right - I'm not a linguist, and to be frank I'm not entirely sure why the claim even matters (not a great sign for a scientific hypothesis). But I'm sure this article isn't making a lot of sense.
This exists in my neighborhood (Mission SF). Faye's Video & Espresso Bar... http://www.yelp.com/biz/fayes-video-and-espresso-bar-san-fra...
New Technique Can Identify Gender from a Fingerprint
I'm not a biologist either. I think the problem is that DNA breaks down when stored. And you cannot store it digitally, because the way the molecules are folded contains information as well (besides just the base-pair letters ACTG), and we can't sequence the folding yet. But like I said, IANAB.
Maybe you could delegate scroll events to a scroll area a few hundred pixels tall (or roughly the knob circumference?), and then bind the knob value to that area's scroll percentage.
From what my parents are telling me, my (one year) older sister was reading at the age of 4, and I was reading at the age of 3. Their technique was to read the books to the children with them sitting on the lap, so that they can see the text. One should also read the same books repeatedly, so that the kids are familiar with the text, and can match the words they remember with symbols in a book. They must also actually like the stories, so that they're not bored with the exercise.

My three younger sisters didn't learn to read so early, but it seems the reason was each additional kid reduced time the parents could spend per kid.
There have always been references... it just used to be books. O'Reilly publishing provided a mini-library on most coder's desks. There is nothing wrong with looking at reference materials. The only problem comes when you use it as a crutch, and never actually learn. I like to think that most people use it productively.
This is absolutely dangerous thinking. There are a lot of people researching crypto and making sure it's secure. If you're using non-standard crypto, you don't have that safety net.

They're using primitives that are proven to be insecure against certain types of attacks (non-checked DH, MAC-then-encrypt, etc). And their code seems to be not perfect (https://twitter.com/matthew_d_green/status/58291636575066931...).

Signal on the other hand uses a variant of OTR (https://whispersystems.org/blog/advanced-ratcheting/). Which was thoroughly reviewed, and mentioned in NSA documents as not-cracked.

You can't just invent something and claim "last time I checked it's not broken". It's not broken (yet) if enough competent eyes looked at it, and the more standard building blocks you use, the easier to make those claims. That is absolutely not what Telegram does. I really wish the myth that Telegram is secure would die.
You're right, I did miss that part.

That being said, I just find it bizarre that an essential police service is basically outsourced with officers who

"are compensated by neighborhood merchants, residents, and associations or groups who contract for services and who can also join to share in the cost"

Is it really that hard to just increase taxes/rates slightly in order to be able to provide this service across the board?
I am also a game developer, and I have recently been working on implementing a voip system in a game. Sony/X1 requires you to use an "approved" encryption scheme, but they don't actually require you to store the key with them, or implement a server relay(which would allow them to intercept all traffic easily).
Add a community for this, and you'll destroy Medium. Nice work!
Can really use p2p technology on a mobile? I assume it would be required to be actively online all the time and drain the battery. If it avoids being actively online, then all mobile users are leeches.

Federation or a central solution is more efficient, since it uses less resources.
It did. We can't forget that all that wealth we have around is mostly thanks to market economy. It's a powerful driving force.

But just because it's powerful, doesn't mean it goes in the direction we want. It did, mostly, for the better part of the last two centuries. But more and more, we now find ourselves at odds with where the market wants to go. This is the issue we have to deal with - our present economical engine becoming incompatible with a better future.
How good/bad is WebRTC for metadata and traffic analysis concerns?
I have new clock
Avoiding the Mega-Controller
Yep, but pretty much all games implement their own voip, in addition to system chat(Party Chat) - and while system chat can be forced to relay through MS/Sony servers, custom implementations in games do not have this requirement. They can also use different encryption to the system one.
Wouldn't the answer be then to set up a better site that isn't as cruel?

Has anyone tried?
It's frequently scarier than that. I've seen applications do the right thing by IDs and queries, but then attempt to audit access and not correctly escape or sanitise HTTP headers.

Literally, every single piece of information that an application receives is not to be trusted. Even if it's something you think you have set and have full control of (a cookie value), you're wrong... you have no control, and attackers can and will manipulate every field or property to gain a foothold.
Story from BBC:
http://www.bbc.com/news/world-us-canada-34897767
Ctrl+F Everett

...I thought as much
Another source, posted to HN earlier:
https://news.ycombinator.com/item?id=10613392
That was just such a great read, many thanks to the OP.

Nothing beats depth of experience and passion, to give you an insiders view.
So what? There are so many ways to be wrong, why introduce an entirely different one into this discussion? It's a false dilemma.
Would be nice to auto cook all meat when at a cooking station.
Circumcision is clear harm, removing bodily fuunction.

Only people witl a full penis know how good it is to have sex, circumcized men have less joy, but they dont really know what they are missing.

Ask for example any male who was circumcized as adult. Sex feels different.

Its mutilation, thats an easier word to spell as well.
Sharing docker images without a registry
Natural processes are the best way to cure depression. I battled depression for years, and I am so grateful that I managed to fight that daemon off.
For anyone suffering from depression,
I recommend something that has helped me a lot. It is James Gordon’s system at http://lookingupstuff.com/mentalhealth/2015/02/06/how-to-des...
He is a former depression sufferer, and teaches a totally natural 7 step process which relieves depression from your life.
Really? That's not what any of the doctors I've or people I've dealt with have said or act like. Even my psychologist (who can't rx) was fairly insistent that without medication there was only so far she could go and refusal to take it was a problem. Then there's the fact that a lot of people end up on anti-depressants and feel much better and are happy with the result.)

(Though I agree that mental meds are fairly shitty overall. Particularly anti-depressants and anti-psychotics. And they're really heavy treatments with potentially horrible side effects, so a talking therapy makes sense as it won't, for instance, cause your skin to die and fall off unlike some meds. Docs seem sorta-OK prescribing amphetamines in combination, but vastly more hesitant to even consider opiate treatment for depression.)
Great comment. Lots of meat here. I had no idea that Loveless had such an interesting story behind it. It's such a brilliant album that I'll never tire of.

P.S. Original, insightful comments like this never go unpunished at HN. Unfortunately, you won't last long here.
Unsure how these packages are generated. How safe is this system? What is it doing?

Browserify and Browserify CDN provide a similar service of bundling CommonJS-style javascript into self-contained files for the browser. Browserify also has detailed documentation and a large ecosystem of modules if you want to build your own bundles in a custom way.

http://browserify.org/
https://www.brcdn.org/