skysight-inc/HackerNews huggingface dataset:
The arguments against client-side TLS certificates boil down to complex UI and maintainability, but it does have its uses.

At small to medium sized companies it isn't uncommon to host a number of self-hosted services, such as GitLab, MatterMost, some wiki, perhaps OwnCloud, the list goes on. Securing all these services takes some non-trivial effort, even if you manage to get all services talking to your local LDAP server (we did!). Only recently GitLab advised users of the self-hosted solution to upgrade ASAP due to a security issue.

To cut ourselves some slack, we placed all these services behind an Nginx proxy. That proxy is secured with client-side TLS certificates. So if you try to access https://chat.example.com without it, you just get a friendly error message (actually, you get a picture of Grumpy Cat saying 'no', but you get the idea). With certificate, you get the service you wanted to access. You still need to log on with the service, but that's usually just a matter of doing it once and ticking the 'remember me' checkbox or something similar. For our users it just works.

Generating new certificates and revoking old ones is fairly simple for the administrators (couple of scripts, ample documentation).

The arguments against public use still stand of course, but for this scenario it is a great solution.
That making a big stink about getting downvoted is a good way to get downvoted more?
Nice idea, I like it. Not sure about the name at all. Sounds like marijuana distribution as as service :).
Seems like about time to do that, my Facebook feed is all about CLICKBAIT and VIRAL stories, which is so annoying.
You can actually make music with a laser cutter.
The new kid on the Smalltalk block is Pharo:

http://pharo.org/
Public Health doctors get the least respect/money? And arguable do the most societal good of all, essentially saving all of us from epidemics etc.
It takes a lot of organization to make them work in DOD, but in my experience it is worth it. From a dev perspective they are actually easier than username/password, as the client certificate DN is available on the server, so you can know the identity of the user very easily.
I would argue that the notion of "crime" is typically biased by the observed criminal acts. For example, criminal theft is usually thought to be some form of robbery, including everything from bank robberies to residential break-ins. However, wage theft, consisting of employers illegally withholding wages, is more than 2.5 times larger than all robberies combined [1].

It isn't that smart criminals don't exist. Rather, smart criminals don't fit our mental image of "criminals", which makes it harder to target laws against it.

[1]: http://www.epi.org/publication/wage-theft-bigger-problem-for...
I would argue the opposite, the only problem that has to be fixed is a method for distributing certificates, I use client certs for all my self hosted services, and a certificate is much more usable then typing passwords on any mobile device.
In another comment he claims he's been in HN for eight years but this account is like 16 days old.

It is a sock-puppet account.
I think you've got a difference in philosophy to contend with here. If I were a Linux Foundation developer, I would be extremely offended if someone suggested I patent one of my ideas. Software patents are ludicrous and extremely harmful to the software world. I would immediately quit any job which contributed to the creation of them. I can't speak for any Foundation developers, but I'd be surprised if very many of them felt differently.
My two cents: Which version of webp should Firefox support? There are 3 major versions, and the subtleties in the 'extended' webp is only traceable through the releases of Chrome.

further, how can I tell which client supports which version of webp? `Accept: image/webp` is insufficient because it doesn't tell me which version or subset of features this client uses. Take for example, ios9b1 where webp was thought to have accidentally been available through CoreImage. It only supported WebP basic. But how would a server know this?

Lastly, webp is not setup to be successful for the next set of requirements: it is 8bit per channel color only (can't do 10bit needed for P3 or rec2020). It can't do full chroma subsampling (4:4:4). And the list goes on. It was a good first start, but it needs much more work before it can break out of the Google grip and get wide support.
Pencils were used for 300+ years before the invention of affixing an eraser to the end.
I fail to see how placing an entire population's electronic communication under surveillance is a proportionate response to this kind of 'low hanging fruit' offender.
Joseph was very angry because everybody were using the name "joseph" yesterday.

Don't be angry!
He'd have done a bit less if he was 255.
There are three serious problems with this idea.

- Putting a patent application together costs time and money. Microsoft are better able to do this.

- Software patents have very little to do with who really first invented a technique. Containerisation wasn't invented by Linux either.

They have very little to do with actual software or innovation, mostly being a question of "what can we get away with at the patent office?" See http://arstechnica.com/tech-policy/2014/06/chinese-govt-reve...

e.g. https://www.google.com/patents/US6339780 : a patent on putting a loading animation on top of a browser, rather than as a distinct element. Or https://www.google.com/patents/US8255379 (location-based search).

- Patent-encumbering things is really unpopular in the open source community, because you need to give a patent grant to every user. So as soon as MS download linux, you've given them a patent license. Well done.
The straw man proposed in the "Why Native Apps are a Gamble" section equally applies to Web Apps. The 80% number for example probably isn't going to change just by making your App a WebApp.

Development is expensive whichever way you want to slice it. Write Once, Run Everywhere is equally expensive because you have to test everywhere as well so the economics aren't as straightforward as the article suggests. If it was Java would have won years ago.

A counter argument could also be made that a well curated ecosystem of 16% is cheaper to developer for than an ecosystem of 84% made up of a whole mix of different supported levels.
Nice article, although I would have liked to see a before/after summary bar chart of the benchmarks for all PRs as a whole; I'm curious how all these incremental improvements add up together.
Why an app and not a website?
Great to see they're finally getting this in, since it results in real-world download reduction and quality improvement for users. Depends on content of course, but it's especially great for certain game content, icons, etc. I was never convinced their arguments against it outweighed the benefit of adding it, and was greatly disappointed when they opposed it. Hopefully Safari are still adding it. (Edit, seems Safari may not add it due to lack of 10-bit color support)
Terrorists also have mothers, and eat apple pie. This is not about terrorists; this is about frustrated law enforcement who seek to break privacy to facilitate their efforts. When we see it that way, we see the emotional rhetoric for what it is - scaremongering to make enforcement simpler.
And it likely won't come back because of the lack of support for 10bit channels needed for P3 displays. Jpeg2000 (Apple's alternative to webp) does.
How to make your React components framework agnostic
https://lists.gnu.org/archive/html/emacs-devel/2016-11/msg00...
https://lists.gnu.org/archive/html/emacs-devel/2016-11/msg00...
Zero those log files
> I can imagine that if you "invent" a filesystem and everyone is enthusiastic & starts using it - you have the right to be paid for your work?

We tried this. It led to the current insanity with software patents and software trolls. I also don't see any indication that innovation would stop if patents didn't exist (see: everything done in the Linux kernel). The trade-off is clear: patents do more harm than good. Get rid of them.
> Secure messaging app Telegram […]
> Telegram, the security-focused messaging app […]

Stopped reading right there. I donʼt even know where to start dismantling this nonsense.
2FA would be nice, but for client certs, as others have said, the UI sucks. Once you have to share the same cert (or manage multiple certs on multiple computers) it becomes too cumbersome for most end users.

Apple Keychain can store certs (I believe), as can most password managers so there's that to help.

But, IMHO, the only way it could get widespread use is if the cert is stored on a physical token that you can connect to your different computers. In the style of the DOD CAC where the private cert never leaves the card itself. Back up the certificate before storing it on the card or USB stick, and then plug that into every computer you want to access. Downside: Without multiple tokens you can't use multiple computers at the same time (easily).
> it's impossible to do things like logging out, or using a public machine reasonably

Both of those are really the same issue, and they boil down to 'only use a browser instance you own to use a secure site, and don't share ownership of browser instances.' That seems pretty reasonable to me: indeed, anyone who uses a shared browser for private communications has already lost, badly.

The upside of not logging out is never having to log in.

You're correct about the pain of managing certs across devices.
Agree that the majority of users desire for anonymity is without merit, but so is requiring users to identify themselves.

If a user is willing to put up with a less useful and usable version of Signal - they should be allowed to use it without identifying themselves.

Beyond this issue, there are others that me show a troubling pattern. For example, Moxie has refused to post a "warrant canary" for US National Security Letters.

In spirit, I like Moxie, in practice, I feel like he's the captain of ship flying a false flag.
Wired is so sensationalist.
Talking to users
Bill and Melinda Gates to Receive Presidential Medal of Freedom
Fibrous != only cotton. Numerous tree barks, coconut husks, vines, hemp fibers, etc., at least one of which can be found globally could be used. One would more likely make a milk or or other natural glue to bind the two halves which was more common.
Skulpt: Python. Client side
PAIP: https://www.amazon.com/Paradigms-Artificial-Intelligence-Pro...

While it deals with classical AI techniques, it is worth working through this book. Especially the AI example chapters where Norvig teaches how to go from specification to implementation and iterate over the design to fix problems etc. Backed by Common Lisp which allows this quick iteration by getting out of your way, this book is one way to fall in love with programing.

Warning: Once you are done with this book, be prepared to handle the less powerful systems and I am not implying here CL is the most powerful programming environment.
This is misleading.

There are 14,000,000 tonnes of identified reserves. There may be more, we just haven't identified them yet.

Estimates for the Earth's crustal content range between 20 ppm and 70 ppm. Using 20 ppm and the mass of the Earth's crust being more than 2 * 10^19 tonnes, it would be (20/10^6) * (2*10^19) = 400,000,000,000,000 tonnes of Li.

So although we'll only ever be able to mine a small fraction of that, I still think it's safe to assume that we are not capped at 14 million tonnes.
I like the rule but enforce a yearly password change in my Windows environment. I'm just a little paranoid about cached credentials living on machines for long periods of time.
Yeah, figured as much. Look forward to that.
From a Guardian article a couple of weeks ago:

'He also rejected the idea that people’s news feeds are becoming increasingly personalized to the point that opposing views are no longer visible – a phenomenon known as the filter bubble.'

“We’ve studied it a lot. I really care about this,” he said, adding that in order to have a good impact on the world he wants people to have a “diversity of information”.

Source:

https://www.theguardian.com/technology/2016/nov/10/facebook-...
I've just set that up, thanks - the UX is brilliant, exactly what's needed to increase adoption. Of course, it requires that you've gone through the WhatsApp phone app setup, but I'm sure this model could be applied on an equivalent system - especially as smart phones are almost ubiquitous now.
I've done this once, as a client. I believe it was with startssl.com. Somehow I messed it up, I don't know, but in the end it was quite troublesome to get it working. And then I'm a pro user, so I consider myself someone who should be able to get this working.

Another problem is how to manage your keys between devices.

If this would be offered as an extra option, just like Gmail has 2FA, that would be great!
Twitter accidentally suspends its own CEO's account
But they have stickers and a gif bot, so normies are going to use that over Signal. And no issues with synchronization between devices (since it's just plaintext xD xD). Seriously.. "secure messaging app" doesn't even have secret chats in the official desktop client.
Which is great as long as every machine you log in from permits USB devices.
Communities don't seem to work on mobile at all.
Purchased. For me tmux is amazing but I figure I only use the basics so far.
Looking forward to reading this at the weekend.
Anywhere also means from any device, not just ones you own and have set up with your iCloud account. Mind you, I'm not saying that it's a good idea, logging into anything from anywhere willy nilly.
Why Pursuing Higher Degrees?
I reckon it is not busy-ness in absolute sense. But busy-ness relative to the rest of the opening hours of the place.
This is convenient. Thanks for the effort!
Hope it's helpful!
A million users isn't cool. A billion users though...
I don't think its recyclable in any efficient way - smelting wont do it, it has to be complex chemistry. More complex than mining was originally. So we're not going to do that until mining quits working.
I'm on the same boat.
I don't feel comfortable sharing CC details for a free service I might be interested to try (even though I won't have much time until next year to do something), and doesn't seem fair "cheating" the system using a fake one.
Signal-Desktop does NOT require your phone to be on! After initial setup, it can be used completely independently of the phone (it only talks to the phone for contact sync, not messages). The opposite is often claimed on here and seems to be self-perpetuating, but it's wrong.

(edited for clarification)
First I spit my coffee when I read that too, but let me play devil's advocate (because I pretty much disagree with the entirety of his rant) : he's pointing out that since it's technically feasible to write a Python 2 interpreter in Python 3, and since it should even be pretty easy since the two languages do not differ immensely, then the only reason why it hasn't been done and there's no -2 flag to python3 has to be an ideological reason, a manipulation by the core devs to impose their ideas by force.

It's extremely badly conveyed but that's what I got out of it by keeping reading.

I do disagree with him on all the rest though, especially strings. It didn't "just work" before, it failed silently and who knows how much disaster he or his readers have caused because of it. Now at least you can't be wrong anymore. For a language heavily used on the web, it's hugely important to understand where your strings are coming from and where they're going to, and how.

Besides, Python is not a frigging "beginners language". Just because Python (and admittedly especially Python 2) is generally easy to grasp as a first language doesn't mean it's its purpose, nor should it constrain itself toward this goal. It's used in a million of different areas, including pretty sensitive ones. It's now become a more mature language, reaching for exactitude and consistency. Just because Zac no longer has an easy toy language to point script kiddies to so they can "learn to program" by reading one website doesn't mean Python is to blame.
How about "Buy a thank you email"...

Shell out credit card, get email.
Apart from VPNs I can see the rise of plugins like this:

https://cs.nyu.edu/trackmenot/

Purpose of such tools is to add noise and obfuscate the traffic.
I would sure hope so. I managed to convince a company to allow paste in their login form by tweeting them this article: https://www.troyhunt.com/the-cobra-effect-that-is-disabling/

But I doubt most companies would be this reasonable if they have this level of stupid in their password handling.
Yes it meant to be a better replacement for classic forums that are generally noisy and hard to deal with. Haash works more like Stackoverflow when it comes to questions and stays very simple with tutorials crowdsourcing too.

For using it as a customer support, generally DO encourages you to publish your question on the community instead of going with private chat and support tickets as when the question and answer go public everyone else can benefit from it and most importantly find it in milliseconds when searching on Google.

another reason is that your need for creating docs out of repetitive support queries massively drops as the Q&A is your docs.
What do you see as the major problems with gerrit?
It's fun to know that almost every requirement usually gets solved by capitalizing the first letter, by prefixing or postfixing the number 1, but using the "!"... and that's what the majority does.
I use TMUX to split screens so I can edit nginx-conf and restart the server form the the same view.

That's probably the most basic usage for TMUX, but somebody please enlighten me, what are some 'advanced' uses? How much more than splitting screens is there? Honest question.
Anonymity isn't Signal's goal, simple as that. If you're looking for anonymous messaging, you'll have to search elsewhere.

OWS recently received a subpoena and fought to be able to publish it (and their response), the only data they could provide were registration and last contact timestamps.
Sorry about, we're digging into that
I'm for banning whatever you like then.
Telegram has nothing to do with anonymity and privacy, they are using phone numbers for registration.
True – I can look up passwords on my phone. But copying a certificate may be slightly more annoying.
What don't you like about it? (Just curious, I don't have much experience with it myself)
Out of curiosity. What is wrong with:
python -m SimpleHTTPServer
?
NASA Launches GOES-R Advanced Weather Satellite
In my experience (of people from the east coast), a lot of people want to move to Boulder/Denver because they're "young" cities (and pot is legal).
I think most of it is the fact that users know how the passwords are supposed to work -- basic "do-s nd don't-s" (e.g., do not give them out to "tech representatives" calling your home, etc.), how to change them, etc.

Certificates? Most are vague at best about them. Does closing the browser window stop access? Can you share certs? If your laptop is stolen did certs get compromised? How do you deal with compromised certs? Etc, etc. Ask a generic user something like this and enjoy the answers.

This is slowly changing -- as more organizations switch to cert-based authentication more users get to know and trust them which can lead to wide adoption for personal use.
Show HN: HFactory, Small library to create Virtual DOM elements factories
This is actually nicely done.
Israeli firm can steal phone data in seconds
not sure what you mean, I use the official app on OSX and it has the secret chat option. click on a contact, it shows you all the infos including "start secret chat"
My sister has been wanting to try out coding for a while, and this looks perfect for that.
Transactional NTFS
Hahahah, Illegal Substances as a Service aka ISAS.
It's a metaphor from Haashs on ruby, a collection of data :)
I'm using http://www.question2answer.org/ , how does it compares to it?

Q2A doesn't have:
- instant search
- Intercom integration
- Single Sign-on
Oh sorry, I don't have a proper one, just when receiving new interns/researchers. Most of our research tools run on Linux but it is quite easy to destroy valuable data, so a c9 sandbox works wonders :)
Per the offical docs, you are required to create an account on a phone to use the desktop version:

http://support.whispersystems.org/hc/en-us/articles/21507785...

__________________

What do I need?

1. Register and set up Signal Android or Signal iOS

2. Download and install Google Chrome or use Chromium

+++++++
EDIT: Having to buy and throw away a phone to use a service that's intent is to provide privacy is what it is; worth noting you revised your comment after I posted mine.
Amusingly, certain WWW browsers for the Amiga used DataTypes [0] to decode images so they would in theory support any format you like! Of course, the world was a much simpler place back then so I'd expect all sorts of security vulnerabilites to be present.

[0] a few DataTypes: http://www.monkeyhouse.eclipse.co.uk/amiga/boingbag/datatype...
If crows ever get the ability to use firearms, humanity is done for...

The level of machiavellian intelligence these animals have is scary.

These crows go so far as to poke these cats mid-fight so as to entice them...
If 'secure' is not the default, how can Telegram claim to be security-focused?
Not sure what's up with the A/B testing though. Plus pricing seems to change between a slider starting at $29/mo and a flat $5/mo fee.
It's one of the many peculiarities of XML: the "less-than" bracket is not allowed in text (because it could indicate the opening of a new XML tag), but the "greater-than" bracket does not need encoding when it's in text, because it's not ambiguous.
I don't think PWAs are quite ready on iOS yet.

"You may be thinking that PWAs are a non-starter until iOS starts to support the manifest standard and service workers, but I have news for you:

You can achieve PWA-like behavior with Apple’s proprietary meta tags.

There is a service worker polyfill for Cordova that will allow you to build a hybrid app for iOS, so you can get the PWA benefits without sacrificing an app presence on iOS."

Cordova is a JavaScript/HTML based app framework:

https://cordova.apache.org

So using Cordova means you have to submit an app and hence is not pwa right?

Can non native web apps on mobile get access to push notifications, the camera (low level like snap chat), the photo library, audio recording or touch the address book? As of today I don't think you can do these things without an app on iOS.

If you look at the top paid/free apps on iOS most of them are either multimedia heavy (Instagram, snapchat, Pinterest, etc) or games. Neither of these types of apps would work well with the current state of PWA.

That being said having a separate android/iOS team and shipping apps to two app stores is expensive and a total pain. I think that some major changes in the way apps get developed are on the horizon.

I think by looking at react/react native you can see where things are going. I.e business logic and API layer shared cross platform, cross functional teams that can work on 60-70% of your products surface with domain experts dealing with platform specific issues. That plus the ability to push over the air updates is going to change things quite a bit.

I feel this approach is valid even for large parts of nultidmedia heavy apps (sign up flows, pop up dialogs, etc) and could even be used in a hybrid approach with a pwa style App.
It is very scary. Google maps has the feature that tells you something is closed or about to close. If it's late, I get the info from the store website and know exactly when it closes.

Then I get in my car and pull up Google Maps. There has been times Google would tell me it's closed already!

I appreciate the assistance but think it should not be so confident in telling me it's closed. The average person may just forgo the trip. Maybe give the website to verify or give the phone number to call and verify.
People go to VT for college but most don't stay.