skysight-inc/HackerNews huggingface dataset:
This brings up the larger view of the problem - exclusives.

If someone gets an exclusive review before the actual launch and doesn't even have the commodity to spend enough time with the product, that will absolutely have an effect to the review result.

The good old cool headed reviewing style like Anandtech, where they take the time, perhaps even wait for an software update or two, then state the verdict is more reliable. Or perhaps even some reviewers where they repeat the test after 6 months and review the unit how it stood the test of time and what's changed. That's proper, adult way to examine something.

But it sure as hell doesn't bring up all the marketing hype and SEO numbers. Modern media is SHIT.
I second a comment made below regarding https://matrix.org/. I've used IRC for years and still use it almost daily - but come on Mosh + tmux + ec2 just to have permanent chat history? I seriously can't advocate this crap to anyone in 2016. It's too little, too late.
tl;dr:

1) IAM instance roles have no security mechanisms to protect them from being read from any process on the instance, thus completely eliminating them from all Linux/UNIX/Windows permission systems. (The real reason for this is that instance metadata was a convenient semi-public information store for things like instance ID, but it was extended to also provide secret material, which was, at best, an idiotic move.) As the author points out, Xen already provided a great filesystem alternative that could be mounted as another drive (or network drive) to be managed with the regular OS filesystem permission system. (reading an instance ID is just a matter of reading a "file")... for some reason, AWS didn't leverage this and instead just added the secret material to its local instance metadata webserver.

2) the API calls are not fine grained enough and/or there are big holes in their coverage -- so, for instance, if you want to use some other AWS services, you can end up exposing much more than you intended.
> but don't those things require money?

Congrats, you've found the reason why a 100% decentralized web is more like fairy tale. The reason why vast majority of people use services like Facebook, SnapChat or Uber is because they are so easy to use. Good UX is not free, service stability is not free and new features are also not free.

People don't care about the underlying technology. If one wants a decentralized web, they must demonstrate a 10x increase, not a tiny bit shitty alternative service.
There's nothing funny about ';': it's just 'or'. Combined with '->', which means 'then', it essentially comes to behave like an 'else'.

';' has been in the language since the beginning, and I'm pretty sure '->' was too, but can't say for sure.
Do democratic/left/liberal states generate or attract more homelessness? Seems to happen with many other liberal city hubs.
The public zeitgeist is finally catching up with the realisation that being entirely dependent on massive siloed community platforms is not entirely in the users’ best interests

I see zero evidence this happening.
That's interesting, I could imagine using that in some sort of DevOps auto-configure situation, but DNS lookups aren't encrypted so someone malicious could rewrite the response and control what you execute.
> Yep, basically this, but with a super ugly regex

And where, if you don't mind me asking, have you ever seen a pretty regex?

> why learn something useful like regular expressions, when you can use some custom library with 1/10th the power!

Regular expressions are not that powerful anyway, but they compensate this by being highly unreadable and error-prone.

In very many cases you don't need 90% of the power of regexes - you just want to extract a certain portion of a string, without worrying about greediness, character classes, double-triple-quadruple quotation with backslashes and so on. Which is where `parse` shines.

And if you see that simpler tool like `parse` is not enough, my advice is to jump over regexes and go straight for `pyparsing`. Regexes are a mess, no matter how careful you are when constructing them. A proper parser is going to be a better choice every single time.
Fair enough, but I feel you're being a little pedantic since there are base extensions described which are required, and optional extensions which are not required. TLS is one of the optional extensions.

So I'll reframe my question and ask: Why isn't TLS a base extension?
> Why isn't encryption baked in by default?

There have been lots and lots and lots of discussions about that, but considering it’s just an extension to the existing IRC protocol, it’s not that easy.

But it’s easily possible to enforce SSL over IRC already.
Or better; assuming the URI is known before posting (it's not randomly generated on submission or encapsulates absurdly precise submission time) just post it to HN a fraction of a second before it's live. Nothing any script can do to beat you then.
Until AWS fixes this (which, as the article points out, may never happen), a chmod'ed 600 file (only readable by root) is actually much safer, even when STS auto-rotation is taken into account.
I run https://skysight.io/ , which does weather forecasting for aviation.
Good work, although already done: http://adenforshaw.com/smarter-coffee-machine-raspberry-pi-i...
Decentralized services have not been able to compete with their walled garden counterparts due to lack of resources and access to capital, as well as the coordination costs of federation. It's a structural and not a technical problem. I can't see how this will ever change.

Most decentralized services are open source projects maintained by volunteer developers. They are competing with centralized commercial projects with deep pockets and the ability to hire not only smart developers but also artists, testers, sysadmins, designers, marketers, researchers, and project managers - some of the things you need to deliver a best-in-class service to users. The odds are stacked against the decentralized service from the beginning.

Even when these projects attract commercial interest, such as Dat or Ethereum named in the article, it is not clear how their funding will be sustainable given that decentralized platforms are more difficult to monetize than centralized ones. And it's really hard to see Github as a "posterchild" for the decentralized web, since it is really a centralized service.
One-Nanometer Gate Dimensions for Transistors Have Been Achieved
Actually Google's DNS over HTTPS API is used, so it is encrypted and also secured using DNSSEC.
The Web interface, Vector, works surprisingly well. Last I tried it, it still lacked polish on the surface but it functioned excellently.
> like edition of messages (with a flag marking it as edited)

This works on Slack but only with their client. Use one of the bridges and you have no clue what's going on and they have a centralised system for this. Syncing that somehow across all servers in an IRC network, across netsplits and everything, is far from simple. You'd also need to do this retroactively somehow if a client received a message, disconnects, the message is updated and the client then reconnects, in order to present an accurate history.

> or a common way to have plugins/extensions

IRC already has a way to allow for extensions. Or do you mean client side?

> or tagging links as images

I'm not sure the IRC protocol should care about that at all. It's more up to the client to detect image links and Glowing Bear for example already does and can display them inline.
Title should not be "scraping from my cell"
but "scraping from any tracfone account without needing credentials".

I'm not even sure you can call this [1] a vulnerable API... it just plain public, with no authentication whatsoever.

[1] https://www.fastactportal.com/static/balance
Shouldn't "previous century" be 1900-1999?
Where the change will come is when we are no longer dependent on paying for network access. That will be the financial incentive.

A fully decentralized web would be delivered peer-to-peer via a mesh network or something similar. Anything else is a farce, because it's not just about who holds the data on the network, it's about the network itself. If any link in the chain of the communication can be controlled by some centralized power- it's not decentralized.

On a fully decentralized network, three things restricting freedom and privacy would be:

* the personal device used to (inter)connect, like malicious code hiding in firmware

* those controlling the power needed for the device

* those that can interfere with communication or alter data on the distributed network, either as a peer on the network, through malware/disruptive communication on the network, or those blocking communication

The problem with the decentralized web, though, is that when the web is fully free- if everyone stores part of the content from everyone else, then they could be storing things that are illegal and that they don't agree with. I personally don't want to participate in any network where I can't control what data is stored locally.
>people are looking for open-source clones so they don't have to pay.

I can't speak for others, but you are wrong on this point when it comes to why I want free software (FLOSS) games or any software. I want it so that I can see what's going on underneath and to play with it myself. I would be happy to pay to get a copy of the source code (under a free software license).

This game ought to be quite intriguing internally for any programmer who's read about it. It's full of stuff that's simply not common in mainstream games.

Please don't try to say that the desire for FLOSS is just about getting free stuff. It's not, and it does a disservice to people who would be happy to pay for a FLOSS version, or just programmers wishing to learn more and build upon the work of others.

And yes, it can be appreciated. But there's no harm in saying I'd appreciate it a lot more if it came with the freedom I would like.
There are a lot of building codes that are incredibly stupid.

For things like this (homebuilding) where the competition is heavy and consumers have a choice (within a spending limit), I feel only the most bare of safety requirements should be law. All other standards related to efficiency, "above-and-beyond" safety and design considerations should be met and advertised via certifications.

Almost every zoning law probably has a good reason behind it, ostensibly. Someone died in a fire because there wasn't a window, so every room needs a window, for example. But if we legislated like that for every accident, we'd be suffocated by regulations.
How on earth do you expert messaging editing to work. Are irc clients supposed to magically redraw the buffer and edit logs??!
You can already tell if a link is an image, because they're posted a link to an image..... Some irc clients already inline images posted....
Hmm, I didn't see the 3.3 spec which is still being developed, it looks like they are doing strict transport security as a base extension. So that would address most of my concerns I think. I would still prefer to see TLS required no matter what.
But if you visit my site, you wouldn't know if it makes money and how much. So you don't know if it's worth days of work copying it.
What is the rule against delivering a resume with donuts?
Learn how to write webapps in Go
ooooops, I didn't see that ... anyway, mine looks more complete so it wasn't 100% wasted time :D
Donald Knuth says he usually writes his book 1 page a day[0]:

Usually when I write a book I finish about one page a day, I mean if the book is 365 pages long it takes me a year, if it's 500 pages long it takes me a year and a half.

So its just normal to read it very slowly.

[0] - https://github.com/kragen/knuth-interview-2006
For the reason above, I'd say we should learn to treat an exclusively granted review or interview to be a sponsored post. Because an exclusive interview with Sundar Pichai is not substantially distinguishable from a paycheck in the long run for an ad supported blog.
Yes, I had already stated it was not The Secretary Problem. See that I used the phrase "a related concept ... serial ..."
Previous discussion: https://news.ycombinator.com/item?id=12657336
Halt and Catch Fire Episode Evokes Memories of Aaron Swartz's Predicament
It makes transferring the CSS less efficient, so probably not to be recommended.
There's a lot of neat stuff in IRCv3 to bring IRC up to date, but most importantly it is standardising a lot of the existing protocol and patching up some of the existing warts that make pushing IRC difficult - all while being backwards compatible.

Developing kiwiirc.com over the past few years to cover many different IRC servers in all different languages and using many different services/auth services has been a real pain. It won't improve overnight but these IRCv3 extensions making their way into many different IRC server projects are really helping to smooth things out.

There is currently a re-write of the Kiwi IRC project to experiment and make use of the entire IRCv3 extension set, along with some other features to make web based IRC clients just as friendly and modern as people expect from messaging applications today. This will be a huge boost to the millions of people using IRC via Kiwi IRC.

IRC is getting interesting again and IRCv3 is up there making a lot of this possible.
This is accurate.

Remember that even ELB's in AWS have IP's that change all the time, and this itself is actually a source of vulnerabilities from apps that don't respect DNS TTL's (as has been seen in the forums repeatedly -- apps get connected to the previous IP instead of the new one). It's probably safer to retrieve and verify the IP for each request, and just cache if the IP is 'safe'. (And just doing IP subnet calculations is non-trivial in most less-common languages.)

Also, request throttling should be maintained and HTTP verb checking, to prevent being turned into a proxy for other attacks.

Actually, any decision to accept an arbitrary URL should be carefully examined in light of how hard it is to do safely.
> Are irc clients supposed to magically redraw the buffer and edit logs??!

Who speaks about magic?

Just send a message with the original ID and make the difference. Mark it in the UI, and redisplay it.
Here in Belgium they did make that mistake. They issued green power certificates so people installing solar panels could receive some money.

After a while it became pricey and they needed to halt the program. Still they were obligated to pay those certificates to those who registered under that program. The consequence is that they needed to raise other energy taxes and a lot of families who are struggling are being hit extra hard.

The sickening part of the whole story is that we have big wealthy industrial families who have build complete solar farms under that program and pure for the certificates. Some are receiving 10 millions euro a year (for 20 years) and paid for a part by the poor.
You mention Google which is a search machine to gazillions of websites. Surely people actually want to be able to visit those sites!
I remember having to write assembly code (6800 series) for some of my tests. That was no fun. At least we got to use cheat sheets with all the op codes. I don't think its that unique having to write code without a computer.
I no longer make that kind of money through any side project but I did during ~ a year of college. It was one of the worst projects (coding wise) I made, and I made it all through ads.

It was just an Android soundboard app for a very popular TV show in Spain. You could tap a button and it'd play some funny sentence from a character from this show. Long press, you could share that sound.

Revenue model: a little ad bar on the bottom of the screen.

It grew from 60$/month to > 1000$ in around 6 months, only through word of mouth. That lasted another 6 months or so until the show became less trendy.

Probably not very sustainable as I was piggybacking on the popularity of the show, but it taught me that making money was 100% not about writing 'the bestest codes'.
> Syncing that somehow across all servers in an IRC network, across netsplits and everything, is far from simple.

Yes, it's not simple. But it's not impossible to do. And yes, it might not work in 100% of cases, after netsplits, but so what?
If anything I see the public and businesses going the other way toward the cloud to avoid the hassle of IT. For the average person a PC is a broken piece of time consuming junk that accumulates malware.

Edit: There's another comment in this thread where someone brings up the hassle of IT as a major centralizing force. Best comment so far in this thread.
Created http://encycolorpedia.com a few years ago, kind of neglected it until recently (it's looking very dated), a version implemented in Rust is 90% complete - cheaper to run (more beer money, thanks Rust team!) & more features than the node.js implementation it will hopefully replace in the coming weeks.
There are many millions of people who don't have the problems, that can be solved by mesh networks. They live in countries, where ISPs are not overregulated and are very competitive, bringing cheap high quality high speed internet to every household. In fact, those ISPs and the whole broadband market there emerged from similar communities of local networks you describe, except they weren't mesh networks, but wired networks.

And yet there is no decentralized web there either. Because it's not technology, that's stopping it from happening.
Looks like #1 for cable news right now, but compare e.g. http://www.adweek.com/tvnewser/scoreboard-wednesday-october-... and http://www.adweek.com/tvnewser/evening-news-ratings-week-of-... and you'll see that broadcast news totally crushes cable news.
That will inevitably raise a question, why people do not want to help themselves?
Well, most important is how inefficient the country is. All governments are corrupt: thats true in Europe, its true in Canada, but its 10x true in the US. It's no China or Russia, but its pretty bad.

Second, you said "resistance to supporting your own people". Well, even if you don't resist, thats very difficult because figuring out who "your own people" is, is nearly impossible here because of the immigration situation.

Regardless of stance on immigration, the fact is that the way to most efficiently reduce poverty will differ based on if someone has been here all along and got screwed, based on if they are refugees, or if they came by other means. You have to analyze the pipeline and allocate resources, people, and programs for both prevention, and for safety nets.

People make it so damn hard to differentiate and allocate logically, its impossible to be efficient there.

(Note that I'm a green card holder, I wasn't born in the US, so this is just what I'm seeing in polar contrast to my home country). When data is collected and surveys/analysis presented, most of the time everything will be mixed in without separating root causes (someone who fell into poverty because of medical bills, is a very different problem to solve than someone who came here being poor in the first place). And then there's the racism situation...

So authorities are left with 1 size fit all programs that get abused left and right, with corruption sprinkled in to make it harder. Yeah, its impossible to fix things this way.
> But why would you burn fossil fuels to make energy, then use solar panels to turn CO2 into batteries?

Because airplanes cannot fly on solar/batteries just yet?

Anyway, I agree with your main point.
>hard working kid from immigrant parents

Probably had to break a lot of rules to fit in/find their place in a new society
The trend in private (as in commercial, non profit etc) internet is exactly opposite. Why do you expect the public (as in state) to be different?
We pay almost 50% in taxes which I think is close to what you guys pay in Europe. The lions share goes to Washington where as far as I can tell it either evaporates or gets spent on very expensive jobs programs like the F-35. Our states do a better job generally and provide the bulk of the services. However in many cities and states the budgets are consumed by pensions leaving less for services each year. A person who works in government can retire with 80% pay at 55 after 20 years with their pension based on last 2 years. As people live longer, many people are collecting pensions for more years than they worked.

The problem is that we already pay a lot in taxes and we get poor returns on this money as it is. I think there would be more people willing to pay more if they thought money was the answer and it would help people. Most people think the money would just be wasted.

At the same time we also have large numbers of people who pay no taxes, 51%. So as our population grows, the demand for services increases but the percentage of tax paying citizens is not increasing.

We have a real mess here.
The topic's come up a few times: https://hn.algolia.com/?query=dating%20choice&sort=byPopular...

Or as decisionmaking: https://hn.algolia.com/?query=dating%20choice&sort=byPopular...
Black Mirror episode in 2013 had the same plot.
ISPs don't do that. That's your NAT/firewall.

Has anyone ever actually seen an ISP network that filters local traffic to other ISP endpoints? I'm not even sure why they would do that. DDOS almost always targets big things in the cloud so it would not help there.

Here (SoCal) traceroute to a host in the same local neighborhood is three hops.
> we should learn to treat an exclusively granted review or interview to be a sponsored post.

I agree, although unless the authors will state this in the headline, there's still the element of dishonesty left.

Or we start teaching the difference between ads/sponsored articles and true ones in schools.
Not a "side project" in the usual sense, but I teach as an adjunct professor (mathematics) every so often, and at a rate of about $1000 - 1200 per credit hour (depending on the institution) I can make a little under a grand a month after taxes. Teaching can be fun for many people, and I think it keeps me grounded in the fundamentals, where my day job is entirely application oriented.

The trick is that after a few times around, the courses require a bit less preparation.

Adjuncting is an absolute nightmare if you are trying to do it as a full-time job. But as a side thing for beer money when there is a staffing need? It's pretty light on stress. Since I am not gunning for tenure track (or even a full time position), there are little to no stakes involved.

Weirdly, I think the folks in my position (teaching as an adjunct as a side gig) along with the tenured full-professors on the opposite end of the academic spectrum are actually very similar in that regard.
11.5 hours != infinite

Improvement? Sure. 64k is more than anyone will ever need? er... 62k? Sure.

Infinite? I'm not sure that word means what you think it means.
It has to use the existing gardens as scaffolding: embrace , extend, extinguish. Your new service has to interoperate/sync with Facebook (using screenscraping or API) in order to access your friends and feed, and then it's up to the users to choose to migrate, edge by edge, to the alternate network.
I see it in some places. For example, my sister now avoids facebook and instagram because she doesn't want pictures of her kids on those services. Unfortunately, none of the decentralized and distributed services are easy enough for her and the rest of the family to use without help.
What is the point of having nukes if one does not use them to defend against icebergs?