skysight-inc/HackerNews huggingface dataset:
Yeah, this is not an attack itself, just one of the most common post exploitation routes to easy profit. So common that if you have amateur people who try to pirate things, cheat at games or click on the big flashing red banner ad, they're almost certain to come across it and they're almost certain to have common accounts stolen.

Using even a separate password manager, even an integrated one like LastPass raises the bar beyond this extremely basic level and takes it from easy target to medium target, eliminating every common stealer malware I've seen. This definitely doesn't rule out targeted ones of course, like you say, on an objective level there doesn't seem to be much of a difference. At a practical level though based on what's in the wild for non targeted attacks, it's huge.
I prefer client certificates to passwords when logging into intranet sites, which is just a couple of clicks as opposed to typing (password managers with auto-fill could also be used), but having a system to generate and provide the certificate is not simple. You would somehow have to authenticate and identify the user before you issue a certificate for that person. That "somehow" is usually using a username and password already provided to them (most likely for the system login, which is separate from other applications wanting to use client certificates). Installing directly from a issuing server to the browser is ideal, IMO. Other channels for providing the certificate come with more issues on the security and usability fronts.

There's also a big difference in where the certificate store is and which browsers share it. For example, on Windows the certificate store is managed using Internet Explorer and the same is also used by Google Chrome. Firefox, on the other hand, has its own certificate store (including trusted CAs). So even if you deploy a system to provision client certificates, non-tech users may find that the site does not work on a certain browser depending on which browser they did the initial certificate generation and import from.

Exporting and importing certificates into different browsers is quite easy for techies, but you'd have to provide step-by-step instructions with screenshots for others. And God forbid a browser/system's certificate management interface changes, and you'd have tons of tickets coming to support.
WordPress optimization – here’s how I improved my website performance
I don't think this is realistic since people love reposting stupid viral stories that don't have anything to do with reality. Stupid will find a way.
50 Things To-Do for a Happier Life
> I would increase the contrast of your fonts to make it a bit easier to read

Changing it from 300 weight Lato to 400 weight of the same font would also help.
I occasionally have to use friends' devices to log into various sites, unfortunately.
Jpeg2000 has nothing to do with Apple per say. It's an open standard managed by the Joint Photographic Experts Group (part of ISO). Not even sure if Apple even participates in the group.

WebP on the other hand is a proprietary format developed by a single company, an implementation of which is made available under an Open Source License.
This! The UX is downright horrible, but the lack of logout functionality kills most of the extra security we get from client certs.
yep, as soon as I saw facebook integration I quit.
Level 3 seems to no longer be exploitable. Firefox 45.5 here automatically %-encodes the characters into the src attribute.
I'm pretty sure most XML handling libraries would use &gt; - never seen a raw > used in XML (though possible I might not have noticed).

Edit: Forgot to say thanks for pointing that out!
Ask HN: How do you get your news?
So, after the election, the biggest feeling that I have is I'm living in a bubble. I feel out of touch with 50% of Americans. I think, regardless of what side you're on, that rings true for most of us. The realization of how much bias there is in the reporting world (and in my social media bubbles) has been pretty humbling for me, and it makes me feel like I can't really trust the places I get my news from.

I'm trying to take steps to improve how I get my news. Here's my reading habit right now: Every morning I scan through HN, Reddit and my Facebook feeds. Once a week I read the Economist and the New York Times. And I have a great work environment that shares insightful articles through our chat tool, so I get most of my good stuff from there.

But, on my own, I rarely find well thought-out articles that analyze political issues. I just read headlines and blog style articles.

So, for those of you who feel like you have a good, unbiased grasp on current events and politics... how do you get your news?
There will be cake at the end of the test.

The cake is a lie.
I am 75j.
Telegram doesn't require your phone to be online. I have a telegram account the number of which has never been used with the smartphone application.
Brian K. Vaughan's comic Private Eye [1] foreshadows what might happen if this dataset is breached. The premise is the digital cloud "bursts" - all private data is suddenly dumped and searchable - forcing people to completely abandon their identities and assume new ones - changing their name, appearance, re-starting their careers, etc.

When you consider this in the context of technologies like Voco [2] and Face2Face [3] that can fabricate a speech or make a fake "hot mic" video from a public figure, it makes you wonder if we'll ever be able to prove things are __true__ in the future, and what the value of our identity is if it can be shattered beyond repair due to negligence from a third party. What do we do then? How do you cryptographically sign yourself?

[1] http://panelsyndicate.com/comics/tpeye
[2] http://www.bbc.com/news/technology-37899902
[3] http://www.graphics.stanford.edu/~niessner/thies2016face.htm...
Its frustrating to be law enforcement in this day and age. But that doesn't justify throwing up hands.
> kidnapped, caged, tortured, or killed

> kidnaps and cages

Nope. Assuming what you asserted later are indeed facts, they only covers 50% of what you claimed in the original sentence. Still half of what you claimed is not grounded on facts.
We already have that on Linux courtesy of Firefox switching to GTK3.
Obat Kuat Tangerang Obat pembesar penis tangerang vimax tangerang hammer of thor tangerang http://obatperkasatangerang.com
this app appears to be at least 2.5 years old.
So although the government is a real threat to citizens privacy, unregulated private actors are much more dangerous in my opinion.

Companies don't have a monopoly on violence and complete control over you life as governments do, also, they are not unregulated or above the law - this company for example is probably breaking several laws. Spy agencies on the other hand, regularly break laws with impunity or have the laws rewritten to allow unlimited storage (as recently in the UK).

Governments are a much bigger worry when it comes to saving internet history as they have greater capabilities for capture and storage, and a simple policy change in 20 years could make everyone who visited a certain site a criminal liable to deportation or imprisonment.
I'm startled to see warrants required for unintended computer access - 'hacking' as this article calls it. Somebody can put a virus on my machine without repercussions. But FBI can't.

Since when did computer contents become protected? Does this mean my blog is protected by 'freedom of the press' in the US?
Quote from the Telegram-FOSS Github Page: "Telegram is a messaging app with a focus on speed and security..."
why are heap allocations bad for performance?

1. You have to call to your allocator. Then do some type of search for free memory, of the approximate size. Then flag this memory as used. Then mark the remaining memory in that block as unused. Then mark the internal books to match the new layout.

This is done efficiently, but modifying these collections take time. AND IT STILL FASTER THEN:

2. Calling the kernel to MMAP in new virtual memory, adding that to the pool, and well restarting this process all over again.

Allocation time is a big cost, and there is work to make allocation lazy by default in the Rust Compiler at the minute.
So I guess using opera as your browser with its free vpn will be a problem

http://www.opera.com/computer/features/free-vpn
Not just his first tweet, Twitter's first tweet.
Just nitpicking a little. It's not the contrast that needs adjustment. The font color is almost black which should give sufficient contrast on a white background.

The font width is very thin however, and it would make it more legible to increase the font width in the body text.
The logical end point, if you think it through, is scary for technology. There will be a battle for a time where legislators play cat and mouse with technology and privacy companies. But as each new hole appears, they'll invent new laws to close them off. This wouldn't be so bad except for the problem that encryption is math and short of making math illegal there will always be a hole. Factor in steganography and it just gets worse.

But this doesn't mean that technology wins. Rather, it makes the loss even worse, because it means the laws will ultimately have to be defined in reverse - rather than outlawing encryption, they will have to outlaw inability to decrypt. That is, it will be the end user's responsibility to ensure that authorities can decode data you transmit. Transmission of undecryptable data will be a crime, in and of itself.

Apart from the obvious dystopian consequences, this will impact progress in technology tremendously - suddenly it won't be possible to just invent a new data format or protocol any more. Doing so will put you at extreme risk of being interpreted as sending unauthorised encrypted data. So data formats will have to be registered - to send data in a new format you will first have to register a codec with the government and probably yourself have to be licensed. This will have a severe chilling effect on innovation. Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high.

It's a depressing picture but given the trends of late I don't really see it going any other way. Only some extreme swing back towards individual rights over rights of the state will change its direction. But terrorism seems to have set in as a permanent tool for governments to grind away at individual rights.
List of scientific papers found in OpenJDK source code
It doesn't seem to address the problem of migrating data from one version to the next.
> "As a company, our commitment to social justice is core to our mission and well established. And our policies in this area are long-standing," Twitter said.

In the week they verified the Muslim Brotherhood.

A twisted version of justice the 10% Saudi Arabian owned company, Twitter is pedalling.
Telegram Desktop[1] app is different from the native OS X app and doesn't have secret chat functionality

1 - https://desktop.telegram.org
But most people don't know what happens to their data, and many don't even know that they're being tracked when the opt in to provide "anonymized usage statistics".

Of course it's a completely different if the government forces total surveillance, but the impact on people's privacy can be just as bad or even worse.
I literally cannot be bothered. There are 3 kinds of sites:

- Important
- Useful
- Trash

Trash sites all use pretty much the same password. It's terrible but who cares?

Useful sites all use a standard root with prefix/suffix

Important sites (basically my email since that's the unlocker to everything else) just has it's own unique.

I imagine an attacker could probably post rude things on my linkedin and steal my neopets account? It's a downside risk i'm willing to take in exchange for not having to flick into another program which I have to install on all my devices etc etc etc.

When the government comes for me I'm screwed anyway
It's not a compiler optimization step. Your code will through without the plugin: https://github.com/threepointone/markdown-in-js/blob/master/...
First traffic, now this. Next up, how busy is your train?

It's not clear how they get the data for this. Assuming it's the same tech as for minor road traffic then it probably uses Google's location services on Android devices.
I am surprised nobody has mentioned the FIDO Alliance and its Universal 2nd Factor, or it's successor work by the W3C. They're actively working on 'killing passwords'.

U2F originated from Google when they wanted better 2FA for their internal services and they partnered with Yubikey to create the hardware. In a two years study it has been shown to be faster to easy, less prone to user error and more secure[1]. It's basically a client cert on a USB stick, but the standards allow for forms of other hardware as well.

U2F is a FIDO 1.0 standard, the 2.0 version is now being worked on by the W3C Web Authentication Working Group[2]. Microsoft has launched support for a draft of this spec in Windows 10 and Edge under the 'Windows Hello' banner[3].

[1]: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys...

[2]: https://www.w3.org/blog/2015/11/w3c-fido/

[3]: https://blogs.windows.com/msedgedev/2016/04/12/a-world-witho...
I'm sensitive to this concern, but remember that the phone number you register with Signal doesn't have to be your real phone number or identical to the phone number of your primary Signal device.

You can just get a VOIP number or burner phone somewhere in a relatively anonymous manner, register it with Signal on your android phone, and go about your business if anonymity is an important requirement for you.
"Because it's just too hard to get anything of interest done in XSLT"

I thought the point of XSLT wasn't really arbitrary processing but to transform XML into other formats (mostly, but not always, other forms of XML such as XSL-FO) - and it was reasonably good at that.
Logistically this is a difficult problem to solve. I know when I was a kid I had absolutely no problem getting into websites I wasn't supposed to be in. Most of them were as simple as just lying and saying I was born twenty years earlier. I also had no problem finding people's stash of Playboy magazines (oh? You think I can't reach that shelf?).

So do you use something that has your name attached to it like a national ID or credit card? One, credit cards can be stolen, and secondly having to give your real name to these websites will have a cooling effect even among legal adults (although that might be part of the idea).

And then, what about websites that aren't hosted in the UK? Does UK have something similar to the great firewall of China or are they just planning on building one for this?
Show HN: Zenkit – Productivity app of List, Kanban, Spreadsheet and Calendar
> If your certificates aren't stored in the clear (either passphrase secured or on a physical token), then you can solve the public machine problem and logging out.

Sure, but then you have to distribute physical tokens to people, and most people will not buy their own tokens. And once you've built a protocol to get a passphrase-secured cert from an arbitrary provider, you have the same problems the likes of BrowserID had with convincing browsers to adopt it. You also have to deal with building a protocol for updating certs as they expire, and other hard problems with key management.
And I am also 75j. My 75j account is getting a 'You're submitting too fast' message, so I'm doing all this on Tor.

If you can't see the message from '75j__throwaway' that I posted initially to explain this, change your showdead setting to 'yes'. If you need any more proof that I'm not Danielle, then I'll do what I can. But you're wrong, and a bit of a prick.

EDIT: Here it is actually, the message that I posted as '75j__throwaway' a few minutes before these 5 other replies:

Do you geniuses know that it's possible to make more than one account on HN? I'm going to dig up older accounts to prove it. I make throwaways constantly here, though I've never used them deceptively.

Unfortunately the oldest I could find is 4 years old and I can't log into it. However, it contains posts about living in Phnom Penh (which if I haven't alluded to with this account, I can prove) and linguistics-related stuff, which I recently mentioned studying in college:

https://news.ycombinator.com/user?id=ledge

I did find some other less old accounts that I can log into (12-4, ooooo00000, trill1, o0o0_ooo, dcacaac), and I will now proceed to login and reply with each one to this post.
[Watch] Stunning video of snow tire flying off a SUV on Ontario highway
> How do you cryptographically sign yourself?

Now that's a problem whose solution deserves a unicorn valuation
The interview was pretty interesting. Sacca's description of how they make it hard to follow what's going on, even though they know first, sums up why I don't use Twitter. Twitter always feels like I'm walking into the middle of someone else's conversation or inside joke. I rarely have enough context to engage, but people who like to just be loud, or talk to themselves, or don't have a clue can go to town.

Maybe I'm doing it wrong.
Oups! sorry about that. Alongside with the support community, we have a FAQs module. The two makes a smart help center (FAQs and community). You ended up on the main help center landing page where there are two pricing schemes . One if you use only FAQs $5/mo and the other if you use both (FAQs and community) starting at $29/mo.
Is it too late to return 2016? It's clearly defective.

How long until...

"Anexprogrammer was clearly a suspect individual. He used A&A, a UK ISP, widely considered sympathetic to terrorism under the thin guise of blogging about preserving privacy. The ISP has even provided information on how their users may circumvent the law and expressed the opinion it was a bad idea!

It gets steadily worse, Anexprogrammer often used a VPN, from an overseas company who made a feature of logging nothing, another technique widely used by terrorists to evade our beloved leader's protections. He even admitted to viewing online pornography, illegal in the UK, where performers appeared to be actually enjoying themselves.

He was also suspected of being a believer in climate change and is known to have signed a petition against fracking. The 20 year maximum security sentence for illegal circumvention of logging is considered lenient."

May the "one bad actor" that goes in there and gets the entire database please dump the histories of the politicians asap?
Aside from what the other reply said: heap allocations do incur management overhead and are prone to things like fragmentation. Stack allocation is literally a single add/sub micro-op.
16 Tools Every Content Marketing Strategist Has to Know: Process
They are probably going to make more from the Mario iOS game coming out in 2 weeks. That requires zero ramp up of production and a couple of TV ads could make it the new "thing" everyone plays.

The target demographic with money today matches exactly with people that played those games as a kid. A lot of people would "pass" on the legacy looking console at a store but would tap away $5-10 on a phone without thinking about it.

I really hope they step out of their closed garden and port more games to iOS/Android. Mobile games can be the gateway to more people buying their systems, old or new.
Did they restore his followers from a backup or do you keep them through suspension?
I've been doing this for years and it is indeed easier to remember. You won't be keeping all your passwords in your head in any format if you're using a unique password per site or service as you should. But you occasionally have to buffer them mentally between your password manager and the input box (especially on mobile), and the same number of bits of entropy are infinitely easier to copy correctly in this format vs something like "?G[G6n|4".
Sorry about that, it's only a quick way to get started and a lazy way to have its avatar and bio autofilled. We'll add the email signup very soon.
> The availability of hardcore porn to young adults is a genuine problem

Why?

And who took it upon themselves to establish this as fact for the rest of us?
Vue.js 2.1 Released
But who defines the line between "transform" and "arbitrary processing"? One language's transformation is another language's arbitrary processing. If XSLT doesn't know how to format dates for Eskimos, and I have an off-the-shelf JavaScript or .NET date formatting library that does, how does that make my requirements cross the line between "transformation" and "arbitrary processing"? It's a failure of XSLT to not offer Eskimo dates as a transformation (or a way to call a library that does that), not of me for requiring an Eskimo date transformation.

DSSSL was extensible in Scheme, so all transforms had access to arbitrary processing, by the standard.

XSLT was not extensible in any language, so Microsoft went ahead and made a non-standard extension that integrated JavaScript, Visual Basic, C#, and all other IScriptingEngine/.NET compatible languages, much in the same way standard HTML web browsers like Internet Explorer integrate scripting languages.

"The languages that you can use differ between the MSXML and .NET implementations. In MSXML (from version 2.0 on), you can use either VBScript or JavaScript. In .NET, however, you can use any .NET-supported language including C#, Visual Basic, JScript.NET, and even JScript, as before. The ability to use strongly typed languages like C# and Visual Basic .NET makes this an even more attractive opportunity." https://msdn.microsoft.com/en-us/library/bb986124.aspx

Lots of people got lots of work done with Microsoft's non-standard scriptable XSLT, because they believed it was just too hard to get anything of interest done in standard non-scriptable XSLT, but worth paying the price of being locked into Microsoft's ecosystem.

I think it's better to forget about XSLT entirely, because it's a long lost cause, weak and ineffective at what it was designed, and use JavaScript and libraries like XPath to transform XML (and that goes squared for JSON), to reap the advantages of the latest JavaScript engines and libraries.

If Jolt is meant to be a language-independent standard, there should be a definitive reference implementation in JavaScript.

(in reply to arethuza's reply:)

Yes, I'd rather have all the great things you can do in domain specific languages like XSLT (like XPath, CSS, RegEx, etc) packaged up into nice libraries I can call from JavaScript, instead of being big complex hybrid frameworks that call my little snippets of JavaScript, like Microsoft's extended XSLT.
Efficient representation for Web formats
Just to echo... Amazon S3 with CloudFront. No contest. CloudFront has free SSL too. Then AWS Lambda to provide dynamic content via Javascript / API if needed.

If you want to get fancy you can even attach it to your domain root (example.com vs www.example.com) using Route53. Which is impossible with many static hosts. Although that requires a hosted Route53 zone which at $2 might very well be 100x your hosting costs.

I use Jenkins to generate the website itself.

Edit: Only downside is if your traffic spikes you have no control over the cost. There is no upper bounds. With that said, it would take a tremendous amount of traffic to balloon the costs to anything worth worrying about. And at least you can be sure your website will actually stay up.
Shopify’s Frenzy – Sell to the most loyal customers in a new way
Alternatively, if you're competent, there are so many better and safer crimes to commit.
I feel like I've seen a startup doing something along these lines, which will probably die now that Google did it.
Right, but Signal is privacy for my dad. He can't remember his email, let alone his email's password.

Different apps for different categories of users.