skysight-inc/HackerNews huggingface dataset:
Cloudflare and others believe [1] the risk can be much reduced by new, carefully enforced issuing policies on the part of certificate authorities.

The vulnerability of SHA-1 isn't that it's feasible to generate an input that will produce a checksum of your choice - it's that it's feasible to generate two inputs that will produce the same checksum. This is orders of magnitude easier, due to the to the birthday problem [2].

The SHA-1 the certificate authority generates to sign isn't just for the private key in the certificate; it's also for metadata like the URL and the powers the certificate grants. So to successfully exploit the weakness of SHA-1 you not only have to find a collision between good and evil certs, you also have to get a CA to sign the good cert without fiddling with the metadata and hence changing the SHA-1.

The proposal is that CAs should start systematically adding a random serial number to every cert, i.e. always fiddling with the metadata, so it's impossible to choose the SHA-1 the CA will sign. So even if you find a collision, you won't be able to get a cert issued that lets you exploit it.

For example, maybe I know that sha1("the public key for good.example.com is asdfqwerzxcv and it isn't a CA") = sha1("the public key for evil.example.com is rtyufghjcvbn and it is a CA") = 7d97e98f8af710c7e7fe703abc8f639e0ee507c4 and if I ask a CA to sign the good cert they give me a signature for 7d97e98f8af710c7e7fe703abc8f639e0ee507c4 and I can copy the signature onto the evil cert. With this proposal, the CA would instead only agree to sign "the public key for good.example.com is asdfqwerzxcv and it isn't a CA, and the CA's random number is 994782906" and because I can't control the random number, I can't control the SHA1 of the cert they issue to me.

Unfortunately CAs have a poor track record of complying with their own issuing policies, so some people doubt CAs could be relied on not to mess this up.

[1] https://blog.cloudflare.com/why-its-harder-to-forge-a-sha-1-...
[2] https://en.wikipedia.org/wiki/Birthday_problem
New Global Growth Projections Predict the Decade of India
"I'm thinking this won't apply very well to situations where everyone has a positive expected return. Like most real-world organizations, companies, etc."

Don't understand your point. In the experiment, the low ranked persons get a positive return.

It's just that, the return, it's determined, not by the investment in the cooperation phase, but by the position in the hierarchy.

How that doesn't apply?
It must be technically possible to prevent a drone from flying below a certain altitude. Probably one of the many features that will be added to drones in the coming years.
Do the links provided tackle the reproductions of the experiment, or just Rossi's experiment?
I also think many entities may try to stop people from proxying or submitting requests for others, even without sharing the actual keys or credentials.
It was an official TV-video-quadcopter from an Italian local TV company. The FIS was initially okay with it. The quadcopter operater has a pilot license and was suposed to fly only in a specific corridor with no visitors nor athletes underneath. Though, the quadcopter (intentionally?) left the corridore several times in the minutes before the crash (for better videos?).

https://translate.google.com/translate?hl=de&sl=auto&tl=en&u...

Just last week a new unproofen airbag system seriously injured an athlete [edit: still under investigation]. The new airbag system was from the Italian company Dainese. The athlete suffered a 3 times vertebral fracture which maybe ends his young career.

https://translate.google.com/translate?hl=de&sl=de&tl=en&u=h...

http://www.dainese.com/eu_en/newsdetail/D-air-Ski-official

http://www.dainese.com/eu_en/athletes/ (the athlete in question isn't featured on the website anymore)
It does sound like that's about zero-sum games, but there can also be competition for the rewards of positive-sum games. If we collaborate to produce 100 pounds of bananas and you take 70 pounds and I take 30, that's evidence of a hierarchy even if I also come out ahead.
I suspect cultural differences here; if a kindly barrista took the time to explain why their drinks were obscurely named, I'd take the time to courteously explain why this is broken, and why I wouldn't be returning.

Grumpy, I know. I just loathe obfuscation for the sake of marketing. Guaranteed to mean I'll avoid that store. And no, I don't use Starbucks.
Case 1) isn't that they access the site in plaintext, but that they don't get access at all. Case 2) could easily be that their credit card gets emptied.
With the push for HTTPS everywhere, those old devices won't get content at all.
No, you are able to see it in our website. Ofcourse it is not a full report what we provide, but to get the idea is quite easy.
Every move will be recorded: the machinic police utopia in 18th-century Paris
Am sure when the first cars hit the road, similar news made it to the newspaper front pages then.
Ambari looks nice from the outside but it's some kind of zombie that is full of os-specific stuff, opaque puppet stuff, python, java and even brings nagios and ganglia to the party. If it works it's probably fine, have fun debugging that stuff through.

We are happy with https://github.com/saltstack-formulas/hadoop-formula and PXE booting an image.

You can configure all aspects out of a single pillar file.

Still full of warts but at least you have full control.
>> 2. The splitting phase is not influenced by the collaboration phase (I can't avoid to note that you don't choose to apply this insight to start ups).

Vesting is supposed to serve that purpose by allowing a co-founder who doesn't contribute to be fired. Certainly it can be harder to fire a non-performing co-founder though.
Looking forward to decent surfing outside the main surfing geographies (Pacific Ocean).

I've always wondered why more locales didn't simply copy the standing wave in Munich. Seems easy to copy.

https://en.m.wikipedia.org/wiki/Eisbach_(Isar)

Sure, it's not a barrel, but it's still a commercially viable way to enable surfing anywhere.
Size is such a tiny concern. I'm surprised people make such a big deal about it. When all of your images use the same base, it's only a one-time cost anyway.

And there are FAR more important concerns:

- Are the packages in your base system well maintained and updated with security fixes?

- Does your base system have longevity? Will it still be maintained a few years from now?

- Does it handle all of the special corner cases that Docker causes?

That's why I use https://github.com/phusion/baseimage-docker
I smell a language problem when the cited problem is only the automatically added boolean checks.

Note that scheme (Racket) has explicit #true and #false values, and the type Boolean contains only those, while most other dynamic languages define booleans as nil or null or 0 as false (some even ""), and everything else as true.
So you don't have to add type checks for a sound system, only a NULL/nil check, which is done in the op, and does not needed to be added for each argument or return value.

So it's only a problem for soundly typed scheme and some other obscure languages with explicit booleans, such as my potion, but not for most other dynamic languages, which have the NULL checks in the op already.
Only very few specialized ops which permit no NULL args need this check.

I smell a typical Felleisen. He hates types.
I don't see whats the hurry in deprecating SHA-1, when for things like RC4/weak DH/SSLv3 there wasn't such a hurry, even though for those cases they were known broken.
Ask HN: Books you read in 2015?
I'd like to know which books HN read this year. Did you like them or hate them?
How would that help? The obvious solution would be to have strict corridors (which it sounds like they had in theory) for drones.
I imagine this is going to have implications reaching beyond just professional skiing. I won't be surprised if other governing bodies follow suit and ban "drones" as well.

I'm also really interested to know more about how this could happen. High end, professionally operated drones don't generally just fall out of the sky.
Perhaps this is possible with a software update, but it doesn't fix the standards to which the drone was mechanically constructed.

Other commercial flying objects are rigorously safety tested for their ability to remain in the air despite different mechanical failures. Without the same standards applied to drones, we are likely to continue to see near-misses or full accidents happen. (Note: I'm not weighing in for or against drone regulation)
Well, you said you disbelieve these things on the ground of them being too good to be true.

I get that people are more likely to exaggerate the likelihood of success of some technology if it seems extremely promising, and thus one should be more skeptical of those... But given all the other information available, that's a very weak proxy. You can make your own opinion by looking at the science.
Unless it's a helium balloon I think you are not considering gravity + batteries.
Hi David, I'm glad to see that your time in Italy went so well!
During regular flight, sure. But if it's unstable and crashing?
With parametric polymorphism and generalized algebraic data types, you could:

(0) Give every process in the pipeline could its own input and output type, rather than forcing all processes to use strings.

(1) Enforce, statically, that only "compatible" processes can be composed. For instance, if `Foo` is a process that outputs integers, and `Bar` is another process that takes strings as input, then `Foo` can't feed its output to `Bar`.

However, this is involves some rather tricky type hackery (so-called "type-aligned sequences"). Hardly a good fit for a language with Go's design goals.
It did, and the auto industry invented the term jay walking and ran a newspaper campaign against them.
Google Begins Testing Password-Free Logins
>the weak typing argument is a little... weak.

I think you contradict this in the rest of your comment:

>Javascript is poorly designed because there are these rules you need to learn and because there are some language features that you just don't use.

One rule you've mentioned:

>using === over ==

Which is a result of weak typing. So maybe weak typing is a language feature "that you just don't use"? Which, according to you, makes weak typing a reason why JavaScript is poorly designed.
That would be useful if it could be applied to normal red-black trees and sorting. As in, respectively, the efficient, destructive algorithm which inserts into a tree, rendering it temporarily unbalanced and non-red-black, and then fixes it up; and an internal quicksort on an array.
Church Pastor Sings His Creepy Christmas Horror Song
This. Perfectly agree.
And we got driving licenses, mandatory insurances, traffic rules etc. A lot of this already happened to drones and more will.
Isn't the nvidia blob used through a Linux compatibility layer?
No kidding! Thankfully brew makes this more pleasant.
I think the title should be updated a bit here. When I read "drone nearly hits" I imagined it flying by and getting to close on the way passed. The video shows it crashing to the ground with some force. It isn't clear whether this is under its own power (so an issue in directional control by either a pilot error or equipment fault) or due to loss of power (so it hit the ground due to gravity). Either way it could have done the skier quite some damage if it had been just that little bit closer.
Sure, and as a result cars' mechanical safety and operation became regulated.
Make it fly before you attach the engine
For entirely too many words about the various types of camera systems used in 2D games, see: https://docs.google.com/document/d/1iNSQIyNpVGHeak6isbP6AHdH...
Has anyone actually been killed by a non military drone yet?
the url didn't work for me. got an error.
Google is working on a Telegram competitor with Bot features and AI
If you will be in San Francisco I would highly advise you to go to the UCSD and in particular see the School of Engineering building :) http://cdn.sandiegouniontrib.com/img/photos/2013/07/14/jacob...

You can also visit the place called Razor Point its really beautiful!

And to observe a sunset over Pacific Ocean is a must do! I am not sure about the weather in March but that side is really famous for its waves) so dont loose a change to have some surfing)
There are number of primate and human studies that suggest that we value perceived justice and fairness and just offering positive expected return is not enough.

A Theory of Fairness, Competition, and Cooperation
http://qje.oxfordjournals.org/content/114/3/817.short

https://epub.ub.uni-muenchen.de/726/1/Fehr-Schmidt_Handbook_...

Justice- and fairness-related behaviors in nonhuman primates
http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3690609/

Chimpanzees play the ultimatum game
http://www.pnas.org/content/110/6/2070
Bad risk taking drone pilots are incredibly irritating, because they will ruin it for the decent pilots.
> It's well established that conservatives/republicans donate more to charity.

Liberals solve social problems through taxes and big government, instead of donations.

Neither side may have a monopoly, but one side is far more effective than the other at solving social problems.
How to hire the best people you've ever worked with (2007)
I really wish I could downvote/flag some things here sometimes. Basically a "this article is not worth anyone's time".

The page is some drama around a guy insulting someone for not wanting to say why he won't offer to give away his domain name (lighthouse.com).

To the 12 of you who upvoted this, I want my 3 minutes back.
Show HN: XmasTime – Video Calls with Santa Claus
We've recently released this app that let's you make a video call posing as Santa Claus. We have a promotion video on the website: http://www.xmastimeapp.com.

I would love to get feedback from the HN community on this, so we can improve it for next year's Christmas.
Direct link to app store for you who prefer that: https://itunes.apple.com/us/app/xmastime-video-calls-santa/id1064761800
Everything I needed to know about software development I learned while working maintenance in a power plant:

1.) If you have to call in outside contractors, expect it to cost too much, and be done incorrectly, so you'll have to go over it again yourself.

2.) Investing in good tools saves a lot of time and money in the long run.

3.) If you let the cruft build up without cleaning it out once in a while, it can bring everything to a screeching halt eventually.

4.) Talking about doing things doesn't get things done. Somebody has to go out and get their hands dirty actually doing it.

5.) It's easier to schedule your work when there is a regular, defined schedule of interruptions (9AM coffee break, 12PM lunch, 3PM coffee break) versus random ad-hoc interruptions.

6.) Some operations really need locks to safeguard users and data - i.e. make sure you've locked out the circuit on the wood chipper before you climb in to replace the knives...

7.) Respect the old geezer who has been around forever and had their hands into every component of the system. They know not just how the system works, but why things are the way they are now, when that differs from the original spec. Ignore their wisdom at your own peril.

8.) Most people don't take a lot of pride in their work, and will try to do just enough to get by. If your life depends on something, make sure you trust the person doing it isn't in "good enuff" mode. Then check it again anyway.

9.) Paid overtime is a great incentive to management to have people get shit done during normal hours. Calling workers in off-hours should be expensive and rare.
Because they get less than half of the doubled pot?

...re-reading, it sounds like the pot is actually set to double the threshold rather than doubling whatever's in it. Which means the way I was trying to calculate things out won't work, but also explains why the splitting phase behaved like it did.
>Due to bureaucratic BS, the city can't buy the site and therefore they can't turn it into a subway station.

The environmental review process really wrecks projects like this. It's also a favorite tool of NIMBYs, especially in California. City getting too dense for your taste? Let's argue it's bad for the environment, even though urban living is better for the environment than sprawl and the housing will be built there instead.
Judge rules Kim Dotcom can be extradited to U.S
I finished "Thinking Fast and Slow" by Kahneman - A slow read, but a good one. He talks about the intricacies and surprising observations about how me take decisions.

"Logicomix" - A brief "history" of logic, its not always historically accurate. Did I tell you its a graphic novel?

"Show Your work" - Aston Kleon - A short motivating read about sharing ones work, he makes some good arguments for sharing the process as well, not just the product.

Picked up "Coders at work" - read two chapters, a great read so far (I know its pretty popular one amoung HN)
> My career has been all about designing programming languages and writing compilers for them.

Anyone knows which languages/compilers the author has worked on?

(I'm not trying to validate its arguments, it's just out of curiousity)
Transformy blog: Transformy just got better
It maybe true that there is something of a cargo-cult around science, but it is still far from religion. We accept that a scientific fact may change, as better evidence comes in; and that these are discovered facts without exclusive ownership.
Some concepts are conveyed using language, others fail to be conveyed and are the focus of the attempts of humans to innovate in the use of language. The personal experience of love is one of these that has kept poets busy for a few thousand years!
Curbing Undesired Network Usage in Your Office
Repost on HN? Can't be..

Seriously, though - we need more "ads" like this one :)
Same hypothesis applies to health care. Insurance causes providers to raise prices with confidence that it will get covered. Same applies to car repairs. A little scratch can cost 100s of dollars even though its labor and material is just a fraction because insurance has obligation to fill in the gap after co-payment.

While insurances have provision that they will not pay above some fixed globally agreed cost but this upper bound is high enough to generate huge margins while eliminating competition to reduce the prices. On the top of this there would always be upward pressure by outliers. I'm not sure what economic model can bring the price competition back while still allowing safety net as well as quality of service to consumers.
Restaurant trolls thieves
Can you not flag the submission? You appear to have enough karma. If you don't have a "flag" link under the submission then your flagging privileges may have been revoked and you should contact the mods.
No real entrepreneur wants to be acquihired. It's a massive loss of freedom.
Make that 16.

Also, here's that guy. https://www.youtube.com/watch?v=MGkoBfFkCf4
Funny story, heard Marc Andreessen once saying:

During the early days, whenever a horse cart came in opposite direction to a car, the car owner was supposed to disassemble the car and hide behind a bush before the horse came near.

We have come a long way :)
I don't recomend it, but you could use different domains for static vs dynamic.
The problem doesn't seem to be hierarchy, but that it's expected to climb it.

Some people are good in management, some aren't.

But if you're long enough in a job, you have to take on a management position to get paid more or to make decisions in your favor.

Yes the payment thing isn't a big problem in the IT sector, senior engineers often get paid as much or even more than managers. But the decision part is still a problem. Often you end up with stupid ideas you have to execute and the only way to change them is to get rid of the manager, because he won't consider he failed...
Digital Mars C, C++ and D compilers
I'm pretty new to Docker, so I'm curious about "a project with 75 gems/packages and a couple of native extensions that need to be compiled"...

Is the common procedure in the Docker world to build an application image that includes all the build tools that were used to build native dependencies? That seems like it does generate a pretty large image.

I figured I'd take a three-step approach to my first node.js app in Docker:

1. Build an image to build my dependencies. This uses the same base image as step #2 will, but installs all the development tools and libraries (eg. build-essentials, libpq5-dev), and then outputs a .tar.gz to a shared volume containing my node_modules folder.

2. Build an image with my dependencies; imports the runtime versions of any libraries (eg. libpq5), imports & expands the .tar.gz generated by #1.

3. Build an image with my application, FROM the image in #2.

The process is optimized by having the automation check for the existence of #2 by hashing the contents of the relevant Dockerfiles, and the package.json list of dependencies, and doing a `docker pull` with that hash to see if I've already built #2. If so, my build just needs to build #3.

It's a bit more complex (Hello, everything in Docker-land), but ends up being pretty powerful. But your post makes me think I've over-complexified it a bit.
as a non game developer, LÖVE was the only framework using which I was actually able to create a small game . So simple it hurts.
Could Snagglepuss Teach Google a Thing or Two About Teaching K-12 CS?
Wow, it was news for me that athletes wear airbags.
Pretty sure finishing school is not considered a gap of employment. Also, Could put Self Employed/Finished Degree then list the 4 years and list the projects as bullets underneath. Similar to what I did.
> I went looking for a pure-Python NoSQL database and came across TinyDB…which had a simple interface, and has handled everything I’ve thrown at it so far!

Why would anyone need a simple NoSQL? Why would you go the NoSQL route if it isn't a HUGE complex database?
Did you try using Google before asking? I didn't get to hit return on my iPad before I had the answer since he had a Wikipedia entry:

https://en.m.wikipedia.org/wiki/Walter_Bright
No it isn't. It's called copyright infringement.
Two great books:

- "Functional Programming in Scala" by Paul Chiusano and Rúnar Bjarnason

- "Big Data: Principles and best practices of scalable realtime data systems" by Nathan Marz and James Warren
IBM Watson: How It Works
Ready Player One. by Ernest Cline.
Brilliant geeky read (fiction) :)
It does. The way it works is you can either type in the item-code if you know it, or you can type in search letters which will prompt a browse screen (which is again highly keyboard-friendly).

The way it happens in places with low number of SKUs (< 10k) is people who're new typically search a lot in the beginning, but over time, they'll learn the most frequently used item-codes without any deliberate learning. They also get really fast at the keyboard. This was my experience building DOS-based POS software for small supermarkets and grocery stores.

If there are a much larger number of SKUs, or if the item-codes are provided by the manufacturer (like in the automobile spare parts business with 16-digit alphanumeric item-codes), you have to key in them manually.

A paint store I built software for had a huge number of SKUs, but they were renowned for their customer experience. This was made possible by putting new employees through a training whose qualifying test is to key-in a bill of materials at a really fast pace. They also chunked item codes into well-defined easily-learnable categories. This was the grouping: [Manufacturer, Product, Packing, Color, Code]. There would be < 20 manufacturers, of which only 4 or 5 are frequently used. Same for product. Packing and Color were more of attributes, but were easily learnable and helped uniquely identify a product.
Looks like the italians have something against us austrians..