skysight-inc/HackerNews huggingface dataset:
> Protonmail with SRP and 2FA where a attack has to pretty tricky stuff but you still get a e2e system is far better then what we have now. Its a far more involved attack to just look at your old emails, and its easier to detect.

Can you explain how this is better than Google End-to-End? (Which isn't completed, I know.)

Or even how it's worth implementing over regular webmail in the first place?

Extensions are obviously not optimal, for the very same reason crypto in JavaScript is not good: timing attacks, cache attacks, optimizations, secure storage (in-memory and on-disk), random-number generation, verifiability, ....

Protonmail suffers from that too. Except it's also subject to key exfiltration. Without an exploit. The server simply promises not to send malicious JavaScript.

It isn't significantly more involved for an attacker who has breached their servers to send malevolent code. It's also not easy to detect.

> We will never have a useable experience for all user if we do not accept compromises.

There are usable end-user interfaces capable of featuring secure cryptography.

Desktop applications. Mobile apps. Browser extensions. Hardware tokens (U2F).

Those can be audited. Inspected. Users can freeze updates.

Trying to implement secure cryptography in JavaScript that is fetched repeatedly from an assailable server is just asking for trouble.

> GPG is already not perfect and we should move away from it anyway

Yes, but that doesn't mean ignoring the advancements that have been made in modern security.

The most appropriate response to securing email is still this: Don't, use a secure messenger; or use out-of-band encryption. It's likely to remain that way forever.
Peter Thiel wrote an article along these lines..

http://www.wsj.com/articles/peter-thiel-competition-is-for-l...

"A monopoly like Google is different. Since it doesn't have to worry about competing with anyone, it has wider latitude to care about its workers, its products and its impact on the wider world. Google's motto—"Don't be evil"—is in part a branding ploy, but it is also characteristic of a kind of business that is successful enough to take ethics seriously without jeopardizing its own existence. In business, money is either an important thing or it is everything. Monopolists can afford to think about things other than making money; non-monopolists can't"
Floating gestures are great if you're not living in a world where the vast majority of your motions have nothing to do with controlling the device.
You are misunderstanding how DNS works. Just because I can get a google cloud name server to point example.com at my server does not mean I own the domain. The gcloud nameservers are not the authoritative nameservers for the zone unless the root .com registry points at them.

Google apps verification only asks the nameservers designated by the registrar for the domain.
The biggest problem I've had with side projects in my past jobs was that my employment agreement was all encompassing and I would require my employer's explicit permission to release the project. So I pretty much stayed away from them except as purely throwaway learning exercises.
Never click a spammer's "unsubscribe" links -- that just tells them they have a valid account. If you use a big email provider like gmail, flag them as spam. Otherwise, make a rule in your mail client to automatically file anything from their domain to the trash.
That's a good point. And it's really impressive how far you can walk without being exposed to the sky in central Boston or Singapore (or, I've heard, in Montréal).

Or the MIT campus with its tunnels (you can walk from building 1 to E19 without going outside, which I will probably do when visiting in January to avoid the cold weather).

https://whereis.mit.edu/
Let's break it down:

>> A few years ago, I wanted to make a product, but I wasn't very technical. So I decided to change that--I got technical.

You are a bad ass. I went from techinical recruiting to software engineering. In between I built a recruiting business powered by a Rails app that demanded more than I was prepared to give. That shit was damn hard, and only someone who has been through the business guy to coder guy transition appreciates how much of a bad ass you actually are.

>> According to my family, programmers are just "coder monkeys,"

They're being assholes and/or you are taking it too personally. I'm guessing you are simply stressed, and they don't know to be excited for you. Everything is taxing when you are exhausted, including putting up with people may simply be breaking your balls.

>> I want to make a tool for small businesses, I want to do it profitably, and I want to be proud of it.

Take care of yourself first. Your first paying customer may love you, rely on you, and wish you the best, but they ain't gonna pay the hospital bill for your self induced heart attack. They care about you, but not in the way you care about them, and you can't afford to be altruistic. Also, the majority of VC backed companies were funded because they had some combination of traction, relationships, expertise, and reputation you have yet to achieve. And if you want stress, take a few million now, hire people, and freak out when you realize you're going to run out of money before your product is worthy of the next round of investment.

>> "That's it? Anybody could have done that in a couple weeks!"

The Gettysburg address was written in a single train ride, and is only 272 words long. But it was written by a man who worked for years to build up the skill to create & deliver that speech to an audience that actually wanted to listen.

>> How do you do it?

Working my ass off, living off money I saved for taxes, and ignoring reality.

Ping me if you wanna vent. My email is in my profile. I'd be happy to listen, and I won't offer any unsolicited advice :)

P.S. I am a bad ass, too, which basically means nothing to anyone, except maybe you. Being the king of your own mountain isn't that impressive until it's tall enough that everyone has to look up to see the top, and even then, they won't understand what you went through to get there. It's good to be king, but it's also lonely at the top.
It's funny that I agree with you and my first instinct was to upvote (and I did). But I can justify that as being because "it's an interesting point that I think more people should read."

I think people will always want to be able to express whether they agree/disagree with things, and if you provide good/bad content buttons but not agree/disagree, a lot of people would just abuse the good/bad content buttons which would largely defeat their purpose. I agree that the ratio of agree/disagree should have no bearing on the order that threads are displayed. So perhaps the purpose of agree/disagree could just be to give users a way to express their opinions without compromising the good/bad voting, and maybe even allow users to find old content they agree/disagreed with.
Personally, I found them to be topical and slightly more engaging than text. They appear at the top of each section, so I thought of them as helpful summaries of each section as well as comic relief. I felt like they encouraged me to finish the next section instead of leaving the page early.
Right. For every startup that skips process and gets lucky there is a pile that rolled snake eyes and died.

Big companies aren't taking the chance.
Microsoft didn't create Haskell, though they did ultimately hire many of the movers and shakers who did.

(I agree that Go is a horrific mediocrity in comparison.)
yea yea!
I just tried this out and I like it. One thing I noticed was that the alert dialog boxes (eg. do you want to save query) all still have the ThingieQuery name on them - FYI.
And to turn it around, you might actually have the genes to be the best. But if you never put in the thousands of hours of quality work necessary to brush up against that genetic ceiling, you'll never know.

I find that this is case in >99.9% of the people who say they don't have the genes for something.
Thank you - the discount makes the pricing sane for a weak Australian dollar.
Metal lyrics idea:

I OFFER MY ROTTING REMAINS
AS A GIFT TO TO THE FOREST
FROM MY UNBURNT BODY
COME FORTH A SAPPLING

Would work really well as a Melodic Blackened Folk Doom metal song
You say _a_ lie and _the_ truth is pretty easy, but you're coming from the position that there is always one truth and there can be many lies.

Our culture expresses truth and falsehood as a dichotomy in which there is only one truth and many falsehoods. This is not real, though—it's just something that exists in your mind. You could choose to look at it another way, and if that was how you were taught and it was idiomatic in your language, then you would also say it was easy.

Here your intuition is not shaping your understanding of truth and falsehood—culture and language have shaped your understanding.

So whether you're learning to express truth and falsehood idiomatically in a language, or whether you're learning how to use articles or not use articles, it is only easy or hard depending on how your culture has shaped your perception of things.
Big companies tend to not take that chance even when it's worth taking though. Not everything is mission critical but the procedures around them pretend they are.
Counter-argument: GNU was a copy of an existing reasonably well-engineered and well-documented solution, in almost every piece. Sure, GNU utilities often improved or extended the standard, but the design already existed. Further, GNU is a system of many discrete parts. Each piece could be built by an individual without tight interdependence on other pieces. That's an MVP. Small, useful, pieces, that add up to something bigger.

I believe GNU is evidence of the opposite point you're trying to make. Unless your point is actually "think big, but build in small, manageable pieces", but if that's your argument, that wasn't how I understood it.

Ambition is not antithetical to building in small pieces. In fact, I think most people have to start small.

While we're on the subject, I'll quote another kinda famous first announcement:

Hello everybody out there using minix –

I’m doing a (free) operating system (just a hobby, won’t be big and professional like gnu) for 386(486) AT clones. This has been brewing since april, and is starting to get ready. I’d like any feedback on things people like/dislike in minix, as my OS resembles it somewhat (same physical layout of the file-system (due to practical reasons) among other things).

I’ve currently ported bash(1.08) and gcc(1.40), and things seem to work. This implies that I’ll get something practical within a few months, and I’d like to know what features most people would want. Any suggestions are welcome, but I won’t promise I’ll implement them :-)
I have honestly looked at all of these but I really dont think you can get any meaningful "brain work" done on these, maybe others can - I just definitely can't!
Feeling a little disappointed for buying Intellij IDEA
Does darkpatterns.org support api query? There ought to be one available so that various tools can be built. For instance, a browser plugin to warn users upon visiting dark pattern websites
Care to share what tools you installed all of that with? I think you can still do all of that in Powershell...
It has WLE200NX a/b/g/n PCIe with antennas (all from PC Engines), plus an Alfa g/n 2000mW adaptor at the end of a long USB cable, positioned for better reception in another building ~150 feet away (n devices are mostly fine without it but especially old b/g devices had a hard time). Before that, wifi had been managed by an RT-N66U, and a repeater had been required to reach the other building. For my setup the APU2 actually replaced 3 devices which had previously been required: Erlite-3 router, RT-N66U, plus repeater. And more to the point, replaced 3 key network infrastructure devices, all running different commercial/closed software, with a single device running a security focused Linux distro and open source boot firmware.

As to load, it manages just a household's worth of machines, maybe ~10 wireless clients and ~10 more devices on the LAN side. The load on the machine is effectively zero. I would personally be confident building such a setup for even 100 clients. The 2 PCI + 2 USB3 offers many expansion options and the SoC itself is tens of times faster than most home routers.
Rumors about Samsung Galaxy S8
The problem with YoY compares is the Apple Watch was on an 18 month update cycle. YoY makes sense for something that isn't regularly updated, or that updates every 12 months.
It depends on the project. If this is critical code, 9/10 times it might not be an issue to let it slide in favor of getting the release out early, but that 10th time is a disaster. Weird things start happening and you don't know why and the team dealing with the fallout may not even realize which change caused the issue.

So now there's a lot more disruption and a ton of frustrated people throwing way too much energy into finding what ultimately ends up being a one line mistake.

After a few rounds of that you decide that if it's going to take 6 days, it's going to take 6 days.
DoorDash announces Drive, delivery platform for orders outside its marketplace
An ever-apologetic, yet demanding complainer.

The entire world should bend to your will, and court your color blind deficiency, and yet you curtsy to the possible perception of a non-neutral, gender-specific rant.

Honestly. Who fucking cares? Just say your piece, and dispose of the chivalry, since it too is technically sexist. Wallow in the reality that someone will be annoyed by such pretentiousness.

Meanwhile, color coding can use HSB models to still permit differentiability via brightness contrast, and font weight, when coding. It's not like us color coders are ignoramuses, you insensitive clod!
Running? I wear loose-fitting athletic shorts; a phone swinging around in my pocket is really annoying. I'd have to get an armband.
I think he essentially ignored the question, and the reporter. In that case, it wasn't an interview.
> This is a bit of an aside, but related. What's the appropriate response to someone who continues to post civilly and substantively but unceasingly on a topic, even when asked not to? Is it a type of trolling? Is asking them to stop silencing their voice? Or some sort of "agree to disagree"?

Probably to just stop replying to them. Sum up your thoughts and respectfully let them know that you've made your point as well as you can, and that this will be your last response. Or, the site could have a feature to block certain users for a period of time so that you just don't have to see it.

> Another issue: when do some topics go beyond the pale and must not be tolerated? Is there such a point?

Not for me, though I know I have a radical view on what should be the limits (or lack thereof) of freedom of speech. In reality though, there are certain types of speech that are illegal and so I understand that moderators will do what they have to in those situations.

I've also been thinking about these things. I am making a real-time reddit clone for fun and I am trying to strike upon a system that keeps discussion civil and substantive with as little need as possible for moderation. Not saying that every place on the internet should be a haven for freedom of speech though, and I really appreciate what dang and the other mods do here. By and large, I have few complaints about how HN is run and they've come up with many good ideas for algorithmically cooling down the flame wars (e.g. not allowing immediate replies when discussion gets heated).
Tangentially reminds me of the HP RPN calculators that my grandfather gave me. So much fun programming them in BASIC :)
OT: I was about to post that women (Shirley) are bossy, but then I pretended that the named individual is Sam and the entire tone of the comment shifted immensely. It was as if the big boss was making this comment. And big bosses are never looking into things of this much detail, which gave more importance to the task.

There is something that isn't right here. I am not sure why I am feeling this.
Granted he was one of the world's best two or three mathematicians at the time.
I just find everything so convoluted in Powershell, don't get me wrong its much less painful than using cmd but compared to a bash shell I find myself tearing my hair out! I think things would be easier if I was a .NET coder but im not and I miss the basic simplicity of things like `where` from bash vs having to create an entire script to just find executables on the path!
Does the term “bootstrapping” only apply to a product business? Or does it apply to a service-based business as well?

If it applies to service businesses as well, I know in my case one of the biggest stresses is dealing with the actual operations side of the business. Especially getting new customers.

In my case, one of the most effective things is to learn how to tune out the noise. And by noise, I mean all of its many forms - social media, comments from friends/family, anything that distracts you from the real work of your business.

I'd encourage you to stay independent and go as long as you can without taking funding. Keep complete control for as long as you can.

Have laser like focus on making a good product, and serve your customers well.

It'd be cool to talk with you further, and hear about your work. Good luck.
What Happens When You Just Give Money to Poor People? (2013)
Thanks for the link to Neomake - Neovim is still a first class citizen for it, and it was a pain to get it working on Vim (and several bugs for Vim have been filed, debugged and fixed in this process).
Irrigation has more or less removed drought as a major issue in the US. We build city's in deserts and grow crops practically independent of rainfall.

This is currently based on unsustainable water useage patterns, but there is also little point to leaving water underground.
OK, I love turkish coffee so i may be picking up one of those at some point.
Regarding distros: Arch has it.. ;)
> The process is fine, but sometimes shit is broken and you need to fix it now and clean up the existing mess later.

A problem is that most minor changes in the big picture are thought of as being critical things that need to bypass the process in the short term.

It's not just this case that seems to make sense. It's that there's dozens or hundreds of other similar critical patches that need to bypass the process.
Catholics have to bury their ashes in a cemetery which requires a non-biodegradable urn. It costs a lot of money.

Ridiculous they don't want you to spread your ashes.
Take it further - introduce a "darkness rating" like Google's old pagerank value. I wish Google would punish websites for doing this stuff.
BBC – Horizon – 1996 – Fermat's Last Theorem
+1 to the team that's been doing a phenomenal job on the project... These days I'm just an email answering machine :)

But yes, JLab is shaping up quite nicely, opening up a lot of interesting possibilities. For advanced users/early adopters I think it's time to start playing with it (and filing issues for anything that's broken/sub-optimal, we really want to provide a great user experience with it once we hit 1.0).
CSAIL system: users design & fabricate drones w/wide range of shapes/structures
Yes it acts as a sort of firewall between the two systems. But at that cost you may as well just have 2 systems. One off grid and one grid-tied given you have the space.
Ask HN: What will be the mouse for AR?
Arch has it: https://www.archlinux.org/packages/?name=neovim
The -git version in AUR: https://aur.archlinux.org/packages/neovim-git/.
My favorite one of those was Android 6's "share my location and the wifi ssids of everyone around me with google button" on a Nexus 5.

It had a [don't ask me again] checkbox that when set greyed out the option to disagree.
Demo YouTube:
https://news.ycombinator.com/item?id=13118902
I don't get this, whatever happened to a hot fix in minutes, and then a proper fix 6 days later? Have we forgotten how to do this? Together with some other reasonable comments, I can't fault the process in the story, but I just can't get why they didn't allow a hot fix?

Then it would be a different title; It takes 5 minutes to approve the change to 1 line of code and rolled into production, and then 6 days to get an official patch - done in accordance with proper IT policy.
Five buttons total:

- two sets of buttons: agree/disagree & good/bad argument

- one flag button for inappropriate/abuse

Edit to add: karma calculations left as an exercise for the reader ;)
Agree with some other comments here:

Good:
Code review? Great. Boy scout rules enforced in legacy code? awesome. The QE analysis seems great!

Bad:
Failure to expedite? Fail. And without that there's no story.

Also at a high level, the fact that it is only 1 line of code is irrelevant. It's not closely correlated to the riskiness of the change.
I wanted to read this post but I couldn't get past the light grey font which was very hard to read. Illegibly thin and light fonts like this are borderline hostile to users, and frustrate me every time I encounter them.

I'm sorry I have nothing more constructive than that to contribute.
Show HN: Fun tool that cut my family and friends tech support time in half
I'm a very stupid and naive person when it comes to this kind of thing, but if I were such a founder, I'd be a little worried that such a VC would invest in a direct competitor to me if I didn't take their check. Of course, they might do that anyway (and other's surely would,) but at least I can imagine competing better if I had more funding.
So basically, try to group anything into smallest possible self-contained utilities, until you grow a pile of them big enough that your next project can be basically assembled from them...
How to pay programmers less
You should take a look at https://www.npmjs.com/package/irc which makes it easy to send, listen and receive on IRC connections in a Node app. Which of course you can include in a Gomix app :)
Clojure or Closure?

What language are they talking about?
I'm a .net coder, it's no better. I still use cygwin.
Thanks for the recommendation :) Unfortunately I've already seen several physiatrist MDs and gotten 2 epidural injections that didn't help.
Thanks for the thoughtful reply. I appreciate it. The tension between creating a sustainable, civil community while still permitting effective freedom of expression is particularly difficult, in my opinion, and a worthwhile goal. Different communities do have different standards.

I look forward to the Show HN for your project! :)
Vinyl snobs rejoice as study shows MP3s make music less pleasurable
I think they should look to 18f as an example of how to bring private sector folks in for a time. Just like a startup can't compete with Google/Amazon/etc on benefits and salary, so has to compete on different dimensions (mission, ability to grow, equity, etc), the government and the NSA have their own strengths.

Salary is not one.

I am no expert on the NSA, but I imagine some of their strengths are:

Mission

Scale

Advanced tech

Real world impact
these processes are beyond fixing. if you absorbed into a corporate monolith that values 'best practise' you'll just have to put up with it. however this really would not happen at any shop that is concerned with saving money.
I appreciate the suggestion! I will check them out tonight :)
As mentioned in the article, this is the Google Closure Compiler, which is used for compiling JavaScript. There is also the Closure Compiler (for compiling JavaScript) written in Java. As the title indicates, this is about a new implementation written in JavaScript.
A variant of this technique was briefly popular for "underground" sites around a decade ago --- someone would setup a site on virtual hosting with an unregistered (or registered, but pointing somewhere else) domain name, then disseminate that name along with the IP of the "hidden" host to those authorised for manual addition to HOSTS files; it was by no means secure, but quite effective at keeping out most of the population who don't know how these things work.
Technology is diminishing us