skysight-inc/HackerNews huggingface dataset:
Does the Apple keychain handle certificates? Because I thought we'd all moved on from remembering two or three passwords to letting software manage and synchronize those. It's been working flawlessly for a couple years now. Although at that point, a long, unique password seems to be about the same as a certificate.
Then have to design and print t-shirts, manage inventory and so on, track earnings, etc. Even when you can outsource that, it might not be worth the headspace for them.
I've seen images on the Netflix front page I wish I hadn't!

Back in the early days of the web it was a funny game for colleagues to email links to "hilariously" revolting images.

This is a "know it when you see it" problem.

What about art ? Bosch for instance...is that suitable for kids ? I think it's a healthy satirical commentary on human nature.

It's what we read too. I've read things in forums, out of nowhere, and suddenly I know something I wish I didn't know. That's life.

Maybe AI's can help ?
in the paid plan: https://neocities.org/supporter
So why not just current 2FA instead of certs?
Online Buisiness as an Investment
Client certs are great for APIs. I wouldn't use them for actual websites.
Global SMS and Voice Services Company
Client certs would be awesome but they're not for humans.

I was enrolled at the distance university of Hagen in Germany for a while and they require the use of client certificates for access to their online portal. There were clear instructions for how to create and use a client certificate but I suspect they have an advantage in that many of their students enrol in technical subjects or already have job experience. Compared to an ordinary website they also have the advantage that students HAVE to use the website and they're the only public distance university in Germany so there's no competition.

From a user perspective the client certificate is incredibly cumbersome. It's a file on your computer, so you have to remember where you put it and move it to new devices if you want to use it there too. It also means you're more likely to misplace or lose it though you're probably less likely to leak it compared to a password.

The instructions also largely boiled down to "use Firefox". In Germany Firefox has a huge market share and is widely deployed as the alternative browser in the public sector (although IE still exists due to contracts with intranet service providers). In other countries things look differently.

In Chrome the experience of using client certificates was even more convoluted and the university officially didn't support Chrome because apparently client certificates flat out didn't work in Chrome until fairly recently (i.e. a few years ago).

In terms of UX, creating and using password is trivial compared to creating and using client certificates. Of course this is mostly because most people do passwords wrong. Creating and using a secure non-guessable password is difficult (though services like 1password or lastpass have made it easier at the cost of adding a single point of failure) but it's still marginally easier than creating and using a client certificate.

The big difference though, is that insecure-by-default is not as big of a cost to a website or software as the bad UX of client certificates. Sadly the UX of client certificates likely won't get better in browsers unless more sites use client certificates -- so it's stuck in a Catch 22.
I've got my nick doubled as gmail account. Guess how many stray mails in moonspeak I get on a regular basis from China, Brazil and other weirdo locales?
The question remains, did you miss out on getting to know an interesting person, or did you dodge a bullet here?
It's funny: the article says some CS folks think the election might have been hacked. Then it says well there is no evidence of hacking, but some stats indicate something may be off. In my worldview, when you want to base an article and conclusion on statistics, you should probably talk to some statisticians, not computer security experts.
Here are some of the things that will not be classified by the BBFC (resulting in a total ban/censorship):

> Pictures and videos that show spanking, whipping or caning that leaves marks, and sex acts involving urination, female ejaculation or menstruation as well as sex in public, or showing more than four digits inserted into an orifice for sexual stimulation.
Exactly what I was thinking when reading this story.

And not only was each step along the way to the pencil a result of direct and carefully planned action, the side effect of pencils from rail cars is only made possible at all because pencils are economically viable. Otherwise they may not (still) exist.

There is a certain harsh reality to this free market—it does not favour quality or popularity or even efficiency.. The blade falls on just how much rent can be extracted at each step without nudging itself into oblivion. What is the practical difference (for a pawn like myself) between a system or a person giving directorial control over the allocation of resources?
What's the use of Chinese people getting access to Facebook if it's no better for speech than Weibo, WeChat or any of the other Chinese social network? I don't see any benefit at all here for the public. Not the Chinese public. Not the global public. The only benefits I see are for governments who wish to control and surveil their citizens, and Facebook. The governments get a nice automatic dissent control toolkit, and Facebook gets a nice payday from being able to enter the Chinese market.

I might sound like I'm being a bit hyperbolic, but I find it deeply scary that Facebook is applying its considerable engineering talent towards building censorship and monitoring at scale. Facebook has some of the smartest engineers in the industry as well computing power that only the richest governments can match, and they have a good shot at cracking the problem of doing efficient censorship at scale. China manages to scale its censorship by employing more and more people to censor. If Facebook builds a plug-in system that allows governments to censor automatically, then every country could censor like China, at a fraction of the cost.
With 2FA I have my password and pull out my phone to look up a code. So I still only need to populate one device.
lynda.com has some great courses on php by the authors kevin skoglund & David Powers. These courses are not free though and they are mostly about php.You will find courses covering html,css,javascript and a lot more there too.
PS I don't work for them I only like their work
Would you maintain that it is unethical even if the large majority of the people directly affected by the censorship think otherwise?

Do you think Chinese people are thinking "I sure hope Facebook doesn't comply with the government so that I can keep not having access to it and therefore keep not being silenced by it. Ah also, I really just wish Baidu/Weibo/Wechat/etc. would close shop already because they are censorship enablers.". My bet is that very few people are and while they're probably unhappy with the censorship in general, they are happy to have access to some form of social media.
Isn't the good thing about community support the people who help rather than the tool that's used to run it? You can't build a community of helpful, interested people in 3 minutes.
I specifically did not deny it was a sockpuppet. That was not my point.
Good thing you're not sucked into the systems of UPS. They refuse to talk to anyone not the sender or receiver.

I've got an annual delivery of an expensive watch in my inbox like clockwork every year.
Ethical Tech Giving Guide 2016
Blueberries are often fake! http://www.npr.org/sections/health-shots/2011/01/20/13308914...
Small piece of feedback but I would increase the contrast of your fonts to make it a bit easier to read (it's far from the worst I've seen but if you compare it to the DO community you link to, theirs is easier to read).

Also, the home view eg. https://slack.haash.io/ feels quite wide and is hard to look across to see the 'Date' and 'Views' which are all the way to the right. When you click into a question eg. https://slack.haash.io/151/how-can-remove-files-that-deactiv... this width seems good and is easier to scan.

Overall I like the clean and simple approach. Very little noise to distract you which is nice.
Increase the terror further by adding Jsonx to the mix: http://www.ibm.com/support/knowledgecenter/SS9H2Y_7.5.0/com....
Yes, in the context of getting high school kids acquainted with the emergent nature of economic order.

The shield/lode star thing: let's not go full politics. I'm not narrow minded... Let's just leave it at that :-)
> My point is not to demand "respect" or elevate myself above anyone else; I come from a pretty humble family and stayed that way for the most part.

I think you can demand "respect". It's not about being humble.
Yeah! Can't wait to be there, that's going to be awesome! \o/
Definitely want to join! MiFF1 was great success. Cant wait to see what you planned for this time :) See you in Feb!
Client certificates are doomed, looking into the future (think: keygen tag). Especially if you are using hardware tokens, and if you want to use them in TLS client authentication.

We have been doing this for years in .ee, and the user experience has been mediocre. And this is something we can not fix (browser vendors can). The future promises to be FIDO, but then again, this is a different model, that mostly addresses authentication ONLY.

I just started a weekend project to bring the hardware token based authentication to a state that it could be called "standardized", for the huge EU market, where very many citizens in different countries have a vetted PKI identity on the eID smart card.

Might be of interest. https://github.com/martinpaljak/x509-webauth/wiki/WebAuth The core of it is just a profile of OpenID Connect ID Token, with fresh browser extensions with native messaging support to facilitate actual communication to hardware tokens.
Please Mozilla never implement that!
Client certs have dire usability in browsers - it's impossible to do things like logging out, or using a public machine reasonably, managing certs across all your devices is extremely difficult, etc etc.

BrowserID (Persona) solved some of these issues by issuing short-term certs to devices based on a login, and designing an API for logout, but even the organisation that specced it out (Mozilla) never integrated it into its browser, so it failed on usability grounds.
Opticon London 2016 – top take-aways from Optimizely's AB-testing conference
Thanks for the catch, updated.

> Hope you'll have a copywriter look through all of it!

I'll likely put the proceeds from the pre-orders to a copywriter. I want the final copy to be best it can be.

I appreciate it!
Is there a reason why a web browser could not integrate imagemagick (or equivalent) in order to support a "kitchen sink" set of formats?

Why not have Amiga IFF images on the web? ;)
Why would we move to client-certs? You need to have a file and sync it between devices.. You might as well use a password manager and sync it between devices..
No, with 2FA, I need my password, and my phone. I only have to set up one device: my phone (or whatever other 2FA token). I don't have to go through my home computer, my laptop, my phone, my work computer, my friend's computer, etc. and set up my certificate everywhere just because I might need to log in to a website.
Italian railway company invests in hyperloop
Well, if memory serves, for the most part haven't most terrorist attacks been coordinated over either completely open channels or over non-technical channels? If I remember correctly, the Bin Laden operations were orchestrated via sneakernet, the more recent attacks in France were orchestrated with check-out aisle cell phones.

The technical difficulties law enforcement faces with terrorism and crime isn't that criminals are upping the ante with complex and difficult to penetrate technology; it's that they're methods are a needle in a haystack, ubiquitous devices and protocols that apparently law enforcement is just having difficulty filtering. Remembering back to a lecture I attended from an officer explaining the technological issues used in modern harassment and abuse cases, often times stalking would be achieved by purchasing a check-out aisle cellphone with a cheap plan, registering it with family tracking from the provider, then putting the phone into Do Not Disturb and hiding it in the victim's car or day bag, using the tracking to get an idea of where the victim went.

Sneakernets and system abuses like this are clever enough certainly, but they're not high-tech solutions for criminal activities. Most of the time just looking at a person's facebook account is enough to get the information you need to do something malicious to them or their property, and terrorists seem well aware of the ease by which they can operate in plaintext or on just normal phone calls. I don't recall any stories about terrorists using an IRC channel, for example, they're just using what they'd normally use.

Most of the surveillance security actions strike me as purely theatre - there's a difficult problem and a convenient scape goat, so rather than do the hard work, law enforcement and governments rely on a scapegoat. Unscrupulous tech vendors abuse law enforcement/government's lack of knowledge and pressure from the public to sell security snake-oil, promising them the answer to keep the people safe.

There probably is a good future where technology does help stop terrorists and criminals, but right now, they're not doing anything special or unique, just different than we're expecting, and apparently that's more than enough.
Well, tesla plays with that "solution for everybody" itself. They even have a solution for the beginning of mankind dominating the whole universe.
I'll add to what's already said:

You'd need to be able to maintain/deploy certs to all your devices in a way that's simple enough for non-technical users to understand; never mind the added requirement for safe private cert handling on each device.

Once you're outside of the browser accessing services, take banks for example, now I need a my browser to have the cert and my mobile apps individually to have those certs as well... or I have certs for the the browser and passwords for the apps (more complexity for the user). Sure my devices can have a cert safe or similar, but the apps/browsers would have to respect that sufficiently for it to be useful (hard enough to get my password manager to work with my phone apps well... certs... eek!)

Finally each browser, app, etc. may have it's own way of dealing with things... making for even more complexity.

I could go on.

Point is there's an awful lot of friction to make that work as simply as the less secure, but apparently socially acceptable, passwords we use today. Whether that should be "the way" or not is irrelevant... consumer choices include factoring in immediate ease of use, right or wrong.

I think there are better arguments for 2FA, since there is something approaching reasonable standards (most applications I encounter support Google Authenticator or that standard at least). You still end up with another ease of use issue, but that might a more surmountable one. (I do hate, though, that I have to use my 2FA on the device which I get my 2FA auth codes from... I understand why, but still...)

Of course, Hacker News is a start-upish sort of community... so maybe unified technology security management for consumers is the next big thing to be "disrupted". :-) Have at it!
Recording audio on mobile browsers in a cross-platform way still isn't solved yet (it's been years):

https://www.quora.com/How-do-I-record-audio-using-the-iPhone...

Remember, due to Apple regulations, any browser on iOS (including the Chrome app) is actually just a thin shell around Safari. It HAS to be Safari, no custom browsers allowed.

This really stifles progress when it comes to the many "bleeding edge" web technologies that are required for web apps to truly replace native apps.

Unfortunately, browsers are still far behind in general.
? Nothing prevent adding new words to Esperanto, the most difficult part is reaching a consensus but that's also the case for 'normal' languages: there are many new French word introduced by the academie Française which aren't much used (courriel instead of mail, pourriel instead of spam, etc)..
Everyone could have their own certificate authority on their person in a small usb device. You could even generate one time login creds if you were on a public machine.
Banking UX Design Challenges and Opportunities in 2017
Simple Cocoa Cake Recipe
Exposure – Event Analytics: Case Study. Part One
Well I don't want to sound more cynical than the OP, but the surface is actually what matters in the broader social context. Without shame, human society would be a violent anarchy. Some people have relatively good natures, but many do not. That is not even a criticism. After all, one cannot be ashamed of nature - only of the inability to control it.

Absence of shame is like power: it corrupts.

So whatever we call PC, we need something like it. That is my view.
Exposure – Event Analytics: Case Study. Part Two
Bullet dodged.
Warning Your Headphones Can Also Spy on You
Code Review Tips
SMTP Mail for All Developer (Send Unlimited Transactional Emails)
Thank you, I hear a lot about it. I'm trying it out this morning. That seems like a good recommendation.

https://github.com/tmux-plugins/tmux-continuum looks really nice as well.

I am interested in knowing any plugins beyond tmuxp / tmuxinator / teamocil that'd be worth covering in the book. https://github.com/tmux-plugins seems like a great resource.
How Extreme Programming Helps Us Make Extremally Great Software
Creative Web Design Concepts of Landing Pages
The DoD uses them across the board. Even civilian contractors get one, and they carry it with them all the time (it doubles as their ID badge).
Exposure – Event Analytics: Case Study. Part Three
As I understand it, Phabricator largely avoids the problem because it is primarily patch-based and not branch-based? How would arcanist handle a force-pushed branch without simply starting a new review process?
I just got an unsolicited email asking me to comment in this thread.
> The group of individuals handling this data are more than likely to be bureaucratically appointed rather than democratically elected.

Exactly what I was going to reply. There is no need for any conspiracy theories to acknowledge that in almost any democratic states of these days "states within a state" exist when it comes to surveilance and intelligence services. While political function owners come and go with each election, those organisations seem to be more structural conservative following agendas which reach beyond any legislative period.
Because the UI is terrible, both within the browser and the tools to generate and manage certs themselves. I implemented client certs for an internal API service and I quickly learned that even among a company of generally very clueful people, no one knows really knows how PKI works. No matter how much I tried to document the steps to generating and installing keys, users would have problems, and I would usually end up just doing it for them. The command line tools for PKI are generally very unfriendly, and terms like "private key", "signed certificate", "keystore" and "truststore" are basically meaningless to 99.9% of people, including other developers.

Not to mention that almost no one uses two-way SSL compared to standard SSL, making it very difficult to find good documentation and support for full two-way authentication. Most people assume SSL means server-only authentication and don't even realize client-authentication is possible. Many tools simply don't support it, or require obscure options to enable it. I found it difficult even to get a properly signed client certificate from a major CA, as the standard certs you get are marked for server authentication only.
One good reason is increased attack surface for security threats.
Input/Output – A new program to help improve STEM education
I agree with you in principal, but is also important to remember that policy != practice. For a policy against shared accounts, for example, there is no reasonable way to guarantee that Employee A has not given his password to Fired Employee B.
What do you mean by fingerprinting?
https://web.whatsapp.com/ only allows login through a cert (via a QR-code). Some banks also use this. A smartphone is used a a cert vault. Not a client cert in the traditional sense, though it's basically the same thing.
Love getting people into robotics. The problem is that this kit has two motors and some sensors that go into a car, for $199. Not much you can do other than drive or program the car. With starter kits like this one http://www.vexrobotics.com/starter-kit-with-controller.html
you get parts to build a number of different robots. Granted, it's $280, but the extra $80 gets you a lot more learning.
Hopefully, if they do that, they don't only audit electronic votes, but also all paper ballots (make sure that all ballots are legit (ie: if someone didn't vote, someone else didn't cast a vote for them) and no ballots disappeared)
5 points you should consider for your products, please share if you have others
> the people who are left committing the vast majority of crime do so in part because they're not good at long term planning.

Maybe. But your data could well be flawed. You've only got to watch any of these police shows on TV, and you'll see them pick up a drug dealer because he's driving a car with no insurance, or not wearing a seatbelt, or any number of other minor transgressions. I saw one the other day where a guy yelled obscenities at the officers as he drove past, which caught their attention and caused them to recognise that he was a banned driver. That's just a special kind of stupid.

If these are the guys getting caught, then the most obvious way to not get caught is to dress smartly, drive an insured and roadworthy car at a sensible speed, and generally blend in to the thousands of commuters that take to the road every day.

Equally, while the dumb criminals will look at the new bill and not be too concerned because they don't plan that far ahead, the smart ones have already been using VPNs for years. The really smart ones aren't even using commercial VPN providers - they're using offshore VPS services with a prepaid VISA, and a script to set up OpenVPN in a couple of seconds, so they can rotate providers and destroy the VPS every couple of months or so.
simple solution: there are two different languages that are pretty similar so let's just call them different names. suggestions? maybe python for v2 and some other snake name or python relative for v3?
Computer Scientists Say Strong Evidence Election Was Rigged
Yes, but tools matter.

Seems like a great service to help guide users into helping one another (at least more so than just having a separate support email and maybe a knowledge base).
Have you seen the horrendous security issues with ImageMagick lately (last one to get a nice branding and logo was ImageTragick (https://imagetragick.com) )? Browsers have a hard enough time already dealing with the few formats they currently support.

Now either they manually add trusted support for all the additional formats (which would mean basically rewriting ImageMagick, but without the security issues, which is really hard considering the huge amount of file formats out there) or they rely on an external library and risk something like ImageTragick to cause global machine ownage of never before seen scale.

No. I like my browsers to be conservative there, though JPEG2000 would be cool to have :p