skysight-inc/HackerNews huggingface dataset:
My favorite part is when they're in front of the supermarket.

"... By Grabthar's hammer... what a savings."

It's like he's contemplating his entire acting career and questioning how he got to this point in his life.
So the real question is, can a MITM intercept connections to boxen you frequent to exploit this? Or is it limited to connecting to hostile honeypots?
Does this affect mosh?
You learn broad in a small company and deep in a big company.

Which is better depends entirely on the problem.
I feel like TypeScript users get a lot of oppurunties to submit small pull requests for JavaScript libraries, then.
The new Clojure web site is live
True Object-Oriented and Immutable Java Web Framework, 0.31 Released
Pascal had already failed to take off by the mid 90s, as I recall, so the damage had been done.
20th century BBS operators wore eye patches and drank rum and sailed the seas on wooden ships. The DMCA would not have saved them, so pre-DMCA cases where they lost tell you very little about what would happen to Google or Verizon without the DMCA.
Employees are very rarely motivated EXCLUSIVELY by profit/salary.

Fixed it for you :-)
I'm just quoting OFFICIAL SOURCES here.
No, the roaming in Mosh is unrelated to OpenSSH's roaming feature.
Does it strike anyone else as bizarre / poor form for an experimental feature to be enabled by default in OpenSSH, which is normally very conservative with option defaults?
TL;DR IIRC, add

UseRoaming no

to your ssh_config systemwide or add

Host *
UseRoaming no

to your ~/.ssh/config. It's a client bug: no need to change sshd_config.
Tested quickly, doesn't look like it. Host key checking happens before the roaming stuff.

That doesn't mean it's limited to hostile honeypots, if it turns out that this is easily exploitable it'll be a complete shitstorm with sysadmins getting owned left and right with rootkits implementing automatic exploitation.
The problem isn't that "some value" can't be extracted. The problem is that the value that can be extracted is bounded by my actual problems. Nest can't fundamentally transform my house heating experience into some sort of delight; at the absolute limit, all it could possibly do is cut my heating bill down to $0. Which would be amazing, but it can't do that, of course.

Other IoT possibilities I see tossed about have even worse possibilities; Nest is probably already the biggest possible winner. If you eliminate 100% of the time I spend turning lights on and off, you've basically had no impact on my life. If you design a glorious IoT refrigerator that somehow requires 0 additional time out of my life to feed it data (which is a negative) it still has to face up to the fact that my "display" showing me what I have which I can get to by simply opening the door is superior to any practical front-mounted display. There's very little room for any sort of IoT water-use optimizer, certainly nothing a startup could wedge into and make money. What can the IoT do for my washer and dryer, play tunes off of Pandora while I'm loading them? My cell can already do that.

I don't need an Internet of Things. I need a Robot of doing Things, and if it's hooked up to the internet I rather expect we'll still see it as "a robot" rather than "an IoT device". (I don't think I want my robot live hooked up to the internet anyhow.)

And just to be clear, I'll say again I totally get it for commercial and civil use, so I'm not just down on IoT in general. (I'm down on IoT security in general, but that's a separate problem. Sort of. Close enough for now anyhow.) It just seems to me that the vast bulk of the IoT story involves being not physically proximal to the IoT device (and, indeed, note how the core Nest use case of "turning off the heat when you are not there" fits that to a T), and therefore, unless you live in a mansion, it's solving a problem a homeowner mostly doesn't have.
>Copyright is not a fundamental right. It's an artificial monopoly enforced by government based on promises of enriching society at large, by giving it back for free, in the future, after a limited period of exclusivity.

What right isn't granted by the government? We like to pretend that rights exist outside of governments, but the only right what a government gives is might makes right.
1000 Angels [video]
Why is it so hard to find a file in Ubuntu? (2011)
From the updated OP:

> The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers.
Absolutely!

Also, the inclusion of non-ASCII operators harkens back to APL. Mind mind isn't yet made up on whether I like this. I anticipate code being easier to read and harder to type. Given perl5's reputation in this regard, I'm optimistic I'll find it to be an improvement.
If an electric car is not an option for you, Toyota hybrids have pretty good track record.

http://www.transportenvironment.org/publications/mind-gap-20...
Super cool idea but I tried a few profiles, they all pretty much sounded the same. Maybe needs a bit of randomness with the username as a seed or something.
What was this experimental / undocumented roaming feature even suppose to do?
Disband all corporations > 1000 people.
ETA: I was way off... you can ignore this... :-)

cf. section 3.3.5 [0], which describes "Roaming (Suspend/Resume)". This is documentation for an application by a company called AppGate (later acquired by Cryptzone) that wrote {some|most} of the code in OpenSSH's "roaming_client.c".

This gives a hint of what the ramifications may be: basically, a MITM, who observed the initial session negotiation, can disconnect the client and hijack an active session.

> Roaming is a feature which allows clients to suspend the connection to the AppGate server and later to resume it again. The user does not need to re-authenticate when reconnecting. Indeed, the entire process can be completely automated and nearly invisible to the user. All established connections will remain alive while roaming. This feature is intended for mobile users who move around between networks.

> Technically, roaming is accomplished by closing the TCP tunnel when the connection is suspended. When resuming, a new TCP connection is made to the server and the SSH data stream is continued through this new connection. The user does not need to authenticate again, instead the client authenticates to the server, without user interaction, with the help of a random password which was made up when the user authenticated at the start of the session. In addition to knowing this password, the client must also know the encryption keys and encryption state to be able to reconnect. It is therefore impossible for a third party to break in and take over a suspended session.

I particularly like that last sentence.

[0]: http://download.cryptzone.com/files/download/AppGate-10.2.3/...
Apparently not possible with MITM.

"The authentication of the server host key prevents exploitation
by a man-in-the-middle, so this information leak is restricted
to connections to malicious or compromised servers."

https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-Ja...
I never understand comments like these. It's on HN because someone found it interesting enough to submit. It gained traction because enough someone's found it interesting enough to upvote.

I'm not sure much more explanation is required. If you disagree, you can downvote the story and / or not click through.
It's like he's contemplating his entire acting career and questioning how he got to this point in his life.

That's my favorite Rickman scene as well.

It takes a fine actor to pack 30 years of fictional history into a single line. I'll greatly miss his tremendous talents.
5 Things You Need to Consider Before Embarking on a Startup or Your “Killer App”
I've seen this idea used in machine learning as well.

There was a paper [1] whose goal was a binary classification of the center pixel in a region of interest. Interestingly, their results improved when they applied a foveal blurring surrounding the pixel to be classified.

[1]: http://people.idsia.ch/~juergen/nips2012.pdf
I've simply used https://github.com/mpeterson2/save-session.
The packets never go out of the kernel, latency seems fine on my BSD router.

What word should be after "through the" in your post ?
I thought this might be valuable. If you have any questions - I can pass them along to the author.
Oh yeah, performance-wise I'd say it beats either Atom or VS Code right out the gate. I just never managed to get an environment set up for what I needed to do at the time (ES6/Clojure[script]) so it wasn't much use.
Oh nice! that's a great idea, thanks for sharing
That was David Warner, who is still very much alive at 74.
No, for me this is absolutely no good.

First, pay by the article means I can easily go through the annual amount I'm willing to spend on "news" in just a few active months. Then I have nothing left for the rest of the year. I don't want to go through the mental effort based on each article and how it _might_ compare to others in the future in order to decide what to read, regardless of having to make that decision before or after I read the article. In other words, it may be a fine article on in it's own right and fully worth 25 cents. But not compared to all the articles I might read in a year. For example, if I have $150 per year for "subscriptions" that means I get 600 (25 cent) articles per year or 20 per month. Is this article worth it?

Second, as mentioned in numerous blogs, paying by the article creates a race to push more articles with just the minimum quality to get the pay click.
> Coding jobs have about a 2 year half-life. If they have enough funding to pay you for 2 years, regardless of whether or not they succeed, then it is as stable as any job, so just take the paycheck and do the work.

This may be true in SV and a handful of other areas, but it is far from universal.
What it was was an article from a news website. It described how protesters in St Petersburg had painted a giant penis on a bridge, so that when it was raised it could be seen over a wide area. It was just a jokey news story shared with a colleague.
The problem with slowing down is that there are 10 competitors who are not going to slow down. Each is trying something different, and we have to pick which option we want to do.

What management need is the answer to what to do, as quickly as possible. If they pick the wrong answer because of bad statistics, the company loses to the competitor who randomly picked the right answer. If the company makes no decision quickly enough, the company loses to the competitor who quickly randomly chose the right answer.

So given those constraints (the need for accuracy and the need for answers as soon as possible) what is the best way forward?

Remember: they don't pay us because math is fun, they pay us to solve their problems.
Ditto, there's something very funny about the voice of god being so jaded and deadpan.
My Fav:
Tell a person you're the Metatron and they stare at you blankly. Mention something out of a Charlton Heston movie and suddenly everybody's a theology scholar! May I continue uninterrupted?
"A simple barcode scanner where you check in new products you buy, and check out products you throw away."

Your homework, before you start too far down this road, is to start doing that right now if you haven't already. You don't even need a real scanner; just pretend with a stapler or something vaguely the right shape and weight. You should also go through your cupboards and just scan everything once to simulate the initial load. Then, I don't know whether you mean to design this for yourself or for selling to others, but if it's the latter, consider whether your customers will actually do this for any period of time. I'd also recommend faceoffs between two people, one pretending realistically to ask your system where something is (either literally typing it in somewhere or doing real-enough voice recognition that you can see the correct query came out), and one just looking. Even if I don't know your kitchen, if it's at all sensibly laid out and you give me a quick look around first, decent odds I still beat your system finding something on average, even if it's not my kitchen.

If you completely eliminate 100% of the time in a year that I spend looking for kitchen goods that I don't know where they are, you've brought me maybe $20/year in value total; if you make me scan everything going in and out, I'd pay at least $200/year not to do that. (Probably more if I really faced that problem.)

(If this is just a personal project, go nuts. Very educational, lots of valuable skill building involved, and it's always good to scratch an itch with it. But if you have any ideas of making money with it, then I suggest taking it seriously and doing some heavy market research and proofing before the tech.)
yeah, but I feel they have a reason to exist. Clojure exists because it has interesting ideas about immutability, and is a lisp. Elm exists because FP. This exists because... Why? They thought we needed a new syntax for JSX? They thought we needed another language that was kind of like coffescript, but different in subtle ways? I don't know, and I can't see what this is bringing to the table.
Andrew wrote:

> It's really up to the provider of the service in question to make the call. All we can say about crypto/tls is that it hasn't been thoroughly reviewed from a cryptographic standpoint. Whether that suits your use case or not is very much up to you.

That is still true. Of course, the implementation has been reviewed and beat on in production use more now than it had been in 2013, but the fact remains that there has been no systematic, independent outside audit focused specifically on cryptography. On the other hand, the cascade of "interesting" bugs since 2013 like Goto Fail and Heartbleed suggests that maybe the other implementations are not quite as audited as one might have expected.

As tptacek mentioned in another comment, Adam Langley is the primary author and maintainer for Go's crypto packages. He's also one of the key people involved in Chrome's TLS implementation and Google's use of TLS more broadly, and he's a significant committer to OpenSSL and the creator and maintainer of BoringSSL. You can learn more about his work at his blog, imperialviolet.org. Having Adam involved with Go's crypto/tls raises my comfort level considerably. It's not Joe Random (or Jane Random) working on the crypto code, as others suggested below. Even so, even experts make mistakes and it would be nice to get a second expert to go through it looking for problems.

For the most part Google does not use Go's crypto/tls for user-facing traffic. That is primarily a detail of Google's pre-existing serving architecture (we use separate servers to do that, much like putting nginx in front of your main server, and many engineering years of work went into those servers before Go even started). Because of that, Google has not really evaluated Go's crypto/tls one way or the other for that use. I believe we do run Go's crypto/tls to serve HTTPS on godoc.org, although I'd have to double-check. I certainly run it on swtch.com, rsc.io, and so on, not that there are real secrets in any of those servers.

I suspect the largest production user of Go's crypto/tls is CloudFlare. Maybe someone from there can say something about their comfort level or exposure.

Like Andrew said, it's really up to the provider of the service to make the call. You can have the same bugs as everyone else, or you can have a different set of bugs.
>>Also, drivers have the option to work at other networks.
>For now. I suspect that won't last long.

That would almost certainly change the driver from an independent contractor to an employee. I don't know if the Uber business model would survive that.
Not me!
The US Government Has an Internet Killswitch
... and those that you haven't established TOFU with yet
French government rejects crypto backdoors as “the wrong solution”
That's not correct though, MITM cannot exploit this. A malicious SSH server can exploit this during a connection though, but only after host key verification.
Why was this quote posted? To show that Bowie was a moron like Al Gore? In 2002 everybody knew the above quote. Honestly some people...
What's more, it was not documented in the ssh_config(5) man page. If it had been, I probably would have disabled it long ago when hardening my SSH config.

Time to head to the source to look for other undocumented options...

Update: my findings are here (scroll to bottom for the upshot): https://gist.github.com/AGWA/e92d4f5343be1f7a941d

UseRoaming is the only one to be concerned about. There are many other undocumented options, but they're all aliases for a documented option or are deprecated/unsupported.
That's exactly it, except each of them is not an XMPP network but just a single domain (there's only a single authority, so it doesn't make a lot of sense to talk of network). XMPP works exactly like SMTP in this regard: you can send a mail from a@gmail.com to b@fastmail.com just like you can (could, at least) send an XMPP message from c@duckgo.com to d@facebook.com
Non-closing html tags? Looking at the doc it seems it is using the same structure as hiccup or hyperscript except. What was the reasoning?
I think the markdown-preview plugin may have issues because once I get to about a 400-500 line file it pegs my i5 at 100% CPU and takes 5-6 real life seconds to enter a single character.

This is on Linux. Other than that, I would say performance is reasonable on all projects I've worked with (couple hundred files in a folder while actively editing a handful at a time).
>but towards the end it slides into the more religious aspects of Buddhism

Well, its a religious practice. This is like joining a Catholic choir and being surprised all the songs are about Jesus, and all the talk of melodies and harmony take a backseat to devotion.

As a meditator, I think this push to strip it down and reduce it to just a "stress remover" is counter-productive and will end in situations like yours where you feel the "anti-scientific" (whatever that means) aspects attacked you. The reality here is that meditators, especially teachers, can't divorce the emotional, spiritual, ethical, and even supernatural parts of their practice for Western consumers who just want a "fix me" weekend to go back to their busy, complex, and stressful lives. The larger point is to fix/change yourself so you don't constantly need "recharge" retreats.

I think there's been this failed experiment in the last 100 years to strip people of spirituality either by force (Communism) or by shame (Western Determinism/Materialism). As an lower-case atheist and non-religious person, I find it all incredible bleak and have been, over the years, working my way closer to the "softer" parts of Buddhism. I'm pretty much an agnostic with maybe some weak spiritual views now and its a good place to be. I don't think you can really expect Buddhists to strip Buddhism from meditation. They find too much value in it the same way I do. Secular/scientific "stress busting" techniques don't work compared to holistic life changes that yes include weird spiritual stuff and counter-modern ideas like living for the moment/experience and not giving into attachment, materialism, emotions, etc. We tried just deep breathing, we tried every psychological fad, we tried drugs, etc. They just don't seem to work very well compared to a serious change in lifestyle as described by Buddhism or some school of mediation/Eastern thought.

I see people stuck on endless skinner boxes on ipads and consoles. I see people fighting and killing themselves at shitty, stressful jobs (yours truly included), etc. I see conflict all the time and the inevitable race to a Nash equilibria that makes everyone unhappy. Samasara looks real to me, even if you interpret it as a metaphor. I don't think its cultish to point out alternatives to the Western idea of "being productive," or to add some "woo." Frankly, I'm not convinced some "woo" isn't real. No, I'm not sending money to Sylvia Brown, but I won't be a dismissive asshole when people talk about reincarnation, or how they think Vipassana or Kundalini brought them close to some important spiritual experience, etc. Funny how we dismiss these experiences, but ask any geek about LSD and he'll ramble one for hours how its pretty much spiritualism in a can and everyone nods in lockstep. Perhaps we're a little too dismissive of the soft parts of Buddhism in the West.
Release is here, with many more details, and other security issues fixed: https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-Ja...
I do not have any issues with Chrome.
Reminds me somewhat of Opa, http://opalang.org
OK, that was handled very quickly on gitter! Just use something like knex.js, duh.
A big-shot vc says we need inequality. What do economists say?
Please report back what you find!
"Visitors to Microsoft chairman Gates' new mansion in Medina will find themselves in an electronic Disneyland where they will be able to "call up" a favorite painting or photograph on combination TV-computer screens.

"Right now, only a billionaire could afford to try $80,000 monitors and $150,000 computer-storage devices (the house could have several) that may be needed to make this all work."

from "Bill Gates: 50,000 Computer Paintings On Call" (1991)

http://community.seattletimes.nwsource.com/archive/?date=199...
> Jesus ordained nobody either

Well, catholics say differently. "And I tell you that you are Peter, and on this rock I will build my church."

So, Jesus ordained 0 or 1 people, depending on your choice of tradition.
http://www.ghacks.net/2015/08/14/comparison-of-windows-10-pr...
Don't ever fix your `ssh_config` by appending stuff to the end of the file. The configuration syntax allows for block constructs without an explicit end marker (like `Match` and `Host`). Appending will cause all kinds of sadness.
Or: learning will be awesome, awesome earning will be optional :)
It's actually just one guy behind Sublime. Probably the reason why it is sinking.
Complete guess: handle changes of ip address on the client side.
https://github.com/openssh/openssh-portable/blob/e6c85f8889c...
Here you go
And two of those highways (87 and 280) are pretty decent sized barriers between neighborhoods and downtown. Ever try walking from Diridon to SJSU or the Federal Building? There's also a lot of historic housing south of SJSU cut off by 280.
Bill Gates: 50,000 Computer Paintings on Call (1991)
A New Code License at Stack Overflow: The MIT
The second one. There is no /etc/ssh on a stock Mac. (Although there is a /private/etc/ssh_config on mine, without the intervening ssh dir)
Readme.md points to GitHub.com/echonest/pyechonest/blob/master/README.md
curl "readme.md" -v

* About to connect() to readme.md port 80 (#0)
* Trying 216.146.46.11...
* Connected to readme.md (216.146.46.11) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: readme.md
> Accept: /
>
< HTTP/1.1 302 Moved Temporarily
< Server: nginx/1.6.2
< Date: Thu, 14 Jan 2016 15:24:33 GMT
< Content-Type: text/html
< Content-Length: 160
< Connection: keep-alive
< Location: http://github.com/echonest/pyechonest/blob/master/README.md
<
<html>
<head><title>302 Found</title></head>
<body bgcolor="white">
<center><h1>302 Found</h1></center>
<hr><center>nginx/1.6.2</center>
</body>
</html>
* Connection #0 to host readme.md left intact

this is weird.
“You must avenge my death Imba, ... I mean Simba.”
You're talking about a very simple widget. Autodesk is used by a huge number of companies for simple 2D drawings and complex systems.

You can't give your client a back of the napkin, hand sketched drawing in every case. You won't get your GCode without being able to see a drawing of what you're trying to manufacture. CAD beats out hand drawn sketches in almost every situation when it comes to manufacturing.
The 30TB debian packages wayback machine
The two easiest ways to learn how to solve a problem: looking at a system that does exactly what you want and copying it shamelessly, and asking someone who has already done what you're trying to do how they did it.