skysight-inc/HackerNews huggingface dataset:
> The address bar should show the domain name only, or the EV identity when that's present, and the browser industry should adopt practices to push usage of EV SSL everywhere. Only EV SSL is a feasible approach to get the actual, legal, verified identity of a server operator on the users screen in a reliable and scalable way.

EV certs have their place, but I'm not sure they're better than a URL that you're familiar with. For example, Natwest uses an EV cert which displays as "The Royal Bank Of Scotland Group Plc" because it's part of a larger group, but the actual legal name of the firm is "National Westminster Bank Plc".

Additionally, what happens when we get companies in different sectors with similar names? If there's an "RBS Applications Ltd" that gets an EV cert which was later compromised and used for phishing I wouldn't suspect it was wrong.

> Kill re-authentications dead. Google was talking about this internally around the time I was working on the account system there, but I don't recall if they ever did it. For as long as web sites routinely ask users to re-authenticate at seemingly random times users will type their password into any page that looks right without thinking. Only by making authentication a very rare event can you start to convince users to take more care over checking the site origin. I think Facebook has got this right: I don't think I'm ever asked to sign in to Facebook unless I'm using a new device, but lots of websites don't.

And what do we do with the problem of users leaving their computers open and exposed for short periods? I Like GitHub's sudo feature, it helps ensure that sensitive actions (adding SSH keys, adding access tokens etc) require a confirmation.

An alternative could be to require a 2FA-only confirmation rather than a password check.

> Teach UI/UX designers about the dangers of designing user interfaces where attacker controlled content isn't strongly visually separated from system controlled content. In this era of personalisation and theming there's really no reason why things like the Gmail attachment icon needs to be placed right next to the content of an email with the same generic white background as attacker controlled content. Give it a semi-transparent background and set users up with a wallpaper-esque theme by default and it gets a lot harder to put things in a message that look like UI widgets.

Completely agreed on this. The rollover animations and other features that seem to be declining in use with the advent of flat design are also a great help here, because you can't achieve that sort of interactivity with an image.

Worth noting that I suspect there would've been some tells anyway with this sort of attack. The cursor would've been wrong over the entire image (hand not just over the button) and any subtle click animations wouldn't have worked.
My thought exactly when I read this kind of articles. Am I that old that they don't teach those simple concepts anymore?
World’s biggest carbon capture project from a 240MW plant begins
Show HN: The Bus Stop Bus
Yes? I'm not sure what you're getting at...
Just came back from Tokyo and realized how much I miss riding my bicycle in Singapore. The city is just not made for bicycles. It would increase the quality of living by a wide margin since Singapore is so small.
Ask HN: How viable is it to run Linux in a VM, on a laptop?
For the past five years I have been doing most of my work from a Thinkpad X220 running Kubuntu Linux. However, some aspects of the free software environment start to annoy me. Now I am really tempted by this year's Thinkpad X1 Yoga with an OLED screen. I could just use Windows for much of the time (OneNote with that stylus sounds great!), but I would want to have a full fledged Linux around for hard work like programming and data analysis. Dual booting is not really an option if I want to use Windows for more than games. It has crossed my mind that I could just run VMWare or VirtualBox with a Linux distribution of my choice on a second virtual desktop. Does anybody of you run such a setup on a daily basis? Is it "fast enough"? How does it affect battery life? Will interoperation via shared folders be "smooth enough"?

The alternative would of course be to get a Mac. But I am extremely partial to the Thinkpad keyboard and trackpoint and Apple's most recent design decisions have made the Macbook Pro less attractive to me.
Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.
except 1) esc isn't a function key (right? right...?) 2) the buttons are (as one commenter here pointed out) too easy to hit accidentally and to hard to hit intentionally.
My personal gripe with Elite Dangerous is that the initial learning curve is a pain in the ass. I'm all for escalating challenge -- especially if it means that the jump from "hey, this is fun to play around with" to "I'm out in the border regions, alone, looking for adventure" is intense -- but with Elite Dangerous, I felt like the starting experience dropped me WAY into the deep end of the galactic pool, without much in the way of explanation about the "why" or "how".
Let's not beat around the bush here. These guys are government authorised death squads. Many of them are psychopathic or deeply scared by what they've seen and done. They learn to treat the enemy as subhuman. That leads to a lack of respect of the dead and any war conventions. Is it really so surprising that this was the outcome?
There was "Lisp critic" file floating around, but I've lost track of it. I don't know of any other tools.

I haven't used the one you linked to yet (thanks for the link!). Seems like it could be useful.
Project Data, 0.8 released
AngularJS 2 vs Aurelia
What line of work are you interested in?
What I'd like to see is something similar to Windows 10's "tablet mode"

An action within the UI to switch to a more iOS feel for use as an iPad style device, and vice-versa to a more Mac style device.

I imagine both macOs and iOs would have to drift more towards each other but that could be a suitable hyprid, and the prospect of actually having a fully functional Mac in my pocket that can be my phone on the go, and be plugged into a monitor later as my workstation is appealing.
Hmm. Interface it with Kerbal Space Program and a mod like MechJeb.

"Alexa, launch to orbit at 120km."

"Alexa, deploy all solar panels."

"Alexa, match planes with target and plot an intercept."

"Alexa, orient the ship in a Sun reference frame facing down, zero degree roll." (Can I call that "reference frame Sun-Down-Zero for short?)

"Alexa, switch to atomic engines and plot a bi-elliptic transfer to Moho at the next window where total delta-V is under 6 kilometers per second. Then aerobrake to an equatorial orbit at 60km, plot rendezvous with Fuel Depot M50, and dock."

> "I'm sorry, Dave, Moho doesn't have an atmosphere so I can't aerobrake." (ship flies off on an impact trajectory with the Sun)

hmm ... okay maybe that's just a little too complex :b
David Bowie's Mac App: like a dream state; or getting stoned out of your head
Flushing the Toilet Stops the Train (2013)
ahh ok got it thanks
Nope. You can use three instances of number 2, all arithmetical operations and elementary special functions that are taught in high school.
Introducing a Cordova plugin for Fastlane
Ask HN: How do you juggle your primary job while trying to create a startup?
An interesting view of how parking affects Houston is at http://www.citymetric.com/transport/what-bombs-did-rotterdam...
Bowie quote here:

"It’s almost like a technological dream in its own way. It creates the images from a dream state without having to go through the boredom of going to sleep all night; or get stoned out of your head. And it will give me access to areas that I wouldn’t be thinking about otherwise"

http://www.youtube.com/watch?v=pDmb_aR_OnY

found on: http://www.7luas.com.br/all/research/researchblog/verbasizer...
So Rust essentially has the same design issue that Python had before PEP 328?
I would argue that it is probably a good idea to print out all your passwords every month or so as there is not much risk attached to it (thieves do not usually look for these things).
It doesn't necessarily have to be about size. The goal is to let the browser paint the above-the-fold content without any external round-trips. Using the least possible seams sensible, especially if you do it on every page. This lets caching work as intended for the majority of the CSS.
Space makes me feel super insignificant in the universe.

Then add Alexa's pretty much soulless monotone voice.
It may be just me, but none of my browsers actually seem to render the example grids correctly... (Chrome does better than Firefox)
Interesting question. I'm wondering if there's some hand wringing over at Intel about refresh cycles. Moore's law isn't what it used to be. My experience in large, non-tech companies is they've tended to follow a 5 year refresh cycle. But, a 5 year old server is still useful, and not terribly power hungry these days. I could easily see a decision to stretch that out to 6.
Adobe Reader update auto-prompting to install a Chrome extension with telemetry
The Twitter thread says the image is embedded so I guess will still show?
> The chief requirement is just to not screw up a good thing.

I think Sam went way beyond that and took big steps with things like open ai

> a YC insider he gets to invest at the earliest stage for the best looking start-ups

Sam was investing himself before joining YC as CEO. I can find only https://www.crunchbase.com/organization/hydrazine-capital/in... but there might be some great investments missing from there.

Disclosure: YC founder and fan of Sam's work as CEO
We tried this in Firefox for Android and user outcry was so bad it had to be turned off almost immediately.

There's some tricks now to make sure the domain is visible and highlighted, but IMHO not enough to be safe, especially with the address bar scrolling of screen on phones.
Responsive Web Design Tips and Tricks for 2017
The idea that we're treating name resolution differently by different applications is... Crazy. I can't even begin to imagine all the ways that is going to fail.

The idea that users would have to be careful not to enter a .onion domain into non-TOR software is also crazy. Of course they're going to do this, and they're going to do it often.

And relying on applications not to asking publicly for resolution for .onion domains is laughable. It's going to happen a lot.

As others have noted, they should have implemented new protocol names instead. All existing software that doesn't follow these rules would simply do nothing (or return an error, as is appropriate) and only applications with actual support would attempt to do anything.
Wix abandons WordPress GPL editor fork for original MIT, blocks relicensing
Where do you see v3 is no longer officially supported?

This is from their blog when they announced Bootstrap 4

"When we shipped Bootstrap 3, we immediately discontinued all support for v2.x, causing a lot of pain for all our users out there. That was a mistake we won’t be making again. For the foreseeable future, we’ll be maintaining Bootstrap 3 with critical bug fixes and documentation improvements. v3 docs will also continue to be hosted after v4’s final release."
I don't think so, I'm not sure how it could.

One of the tweets points out that something like lastpass would help with this as it wouldn't allow you to autofill your password (as it's not on the google the domain), but then you could get it manually from there anyway.
It's also a very weird narrative.

If he is really so passionate about fighting sex trafficking, he should be building something that solves that problem, not just another social networking app and using that story to get attention.

I finished reading the cartoon and was like "wtf did i just read?" It felt like one of those viagra ad spam schemes you find in various comment sections on the internet where the commenter starts out writing something that sounds very relevant to the story, and in the end somehow segues the narrative into "buy viagra and cialis here https://blahblah"
I downvoted most of the subthread as it was completely off-topic. I didn't come here to read this garbage.
What problems are you facing? It renders correctly in my latest Chrome.
Exactly! :)
If you're goal is a UI with widgets for a dashboard then yes, using Bootstrap makes no sense.

To be fair, if everybody took a little bit of time learning basic CSS nobody would need bootstrap either, especially when rendering differences between modern browsers hardly exist AND the fact that bootstrap doesn't support older browsers anymore.
Some of those servers are fantastic value when you get them from a ex-stock supplier. I was seeing 8 thread and 64gb ram boxes for ~£125. If you are building a dummy cloud these are great to play around with.
We're not tracking your users.

As far as you're allowed to admit by NSL's, you mean :-)

Intentions != Guarantees
Would you put "filling in the rest of the stack" as another finger of death? There doesn't seem to be good consensus on that bit.
This guy has an interesting YouTube channel

https://www.youtube.com/user/enyay
Think I would have preferred $HOME/lib/go/ on UNIX ...
Pretty bold claim to say the most popular framework has no future.

I guess most websites are "very simple projects" for your standards. Not everyone codes full fledged JS applications with whatever you do. I am certainly not a beginner and I like BS and I think it still has a very bright future ahead. BS 4.0 is the prefect framework for the average modern website. I am sure Foundation and other Frameworks are great as well, I actually never really compared. BSs devteam is highly active and the amount of exposure it gets and the fact that I know how it works makes me stick with it.
Asteroid Flies Between Earth and Moon 2 Days After Discovery
> They are concerned about being elected, that's it.

Politicians are clearly incentivised by election, but saying its their only concern is generalising and reductionist.

The rest of your comment makes a lot of points, but broadly seems to assume that I'm claiming that private companies have no place in transport infrastructure, which is not the case. My point was that "the market" meaning an unmanaged build-it-and-they-will-come approach would not be optimal, in response to my parent commenter's "an easy thing for a market to fix".
No. A man-in-the-middle phishing attack can ask you for your second factor and pass it through to Gmail.
always used http://vimcasts.org/ . So glad someone made neverssl
I have something like the Ogio Renegade RSS[0]. I'm not sure the exact model but it looks like that one. I received it for free from my last job and it is amazing. The best backpack I've ever had.

[0] http://ogio.com/backpacks/renegade-rss
I assume the costs of repairs and spare parts would also enter that equation.
I was think more of a specific mail scanning process for images that look exactly like UI elements, with some fuzzy match.

If it matches, flag it with the usual warnings.

It feels like there's at least the potential to explore options.
Right, I almost never manually enter passwords on the web. If LastPass isn't automatically filling the field, something is very wrong.

It's a nice extra security check, in addition to the primary benefits of using a password manager.
My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices.

^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used in that order (0 code on first login, 1 code on second, etc.), and the page informs the user which number they're on.
That's assuming the attacker could log in with it before it expired, isn't it?
I live in a city I would consider fairly low-crime. The police hand out a lot of traffic tickets. My fellow citizens recently voted in a measure to hugely increase the police budget (in part for some of that shiny military equipment) while denying one to expand our small library. This seems like a pretty big waste of money to me, since the police don't add much to quality of life past a certain point while a library definitely does. Too many voters seem to act against their own interests too often these days.
Bili| London | Full-time | Onsite| CTO Full stack developer| https://bili.uk.com/

Bili is a unique online platform which enables teachers to connect their students to peers abroad to communicate regularly and with purpose in a secure environment. Since launching in September we have a user base of 45 schools across the world, and over 3500 students.

The website is written in PHP with a Laravel framework, and we need to bring development in house as we refine the product, move towards automation of partnership creation between schools, and monetisation. As the first technical member of the Bili team, this role requires both leadership in terms of strategy and innovation, and work in the trenches bringing these innovations into reality.

Please find job posting at : https://unicornhunt.io/jobs/cto-at-bili
Yes. With U2F the recipient of the token is verified by a machine. With TOTP/HOTP it is verified by the user looking at the browser address bar.
IMHO javascript should never have been allowed in the address bar or even inline in an href. The first time I learned about this feature of a browser, I was thinking 'security defect'.
Well, when the attacker attempts to log in via the stolen credentials, they would get the 2FA check, and you would get an SMS.

Normally this would alert you to the fact that someone is logging in to your account, and would stop the attacker since they lack the 2FA one time pass. In this case though, since you've already fallen for the "I'm trying to log in to Google again", the attacker will probably fake the 2FA screen as well, and you'll merrily type it in.
I'd say the data: url part is important, as it lets you construct much more plausible looking contents for the address bar. The standard "check it's google.com" would probably fail for a lot of people.

How many people really know that you can put a whole webpage in the URL?
Servers pulled from prod in many companies will do just fine for dev/test/staging environments - I'd bet the answer here is more complicated than any given # of years..
Yes, but as per the standard TOTP codes are valid for a window of 1 minute.

TOTP barely protects against phishing. What you want is an U2F key as the second factor. It's not like they are expensive anyway (usually 7-15 Euro) and quite some large services support U2F tokens already (Google, Dropbox, GitHub, Fastmail, etc.).
Well I am actually to lazy to explain it to you. If you would be truly know BS3 or are really interested then you would see the improvements right away.
Visual Studio when I'm doing .NET stuff (mainly C#). I love it and I have not found a better IDE (though my next one is a close rival). Now, I've started working with Elixir in my free time and have started using VS Code and I absolutely love that too. It is close to topping Visual Studio.
I wonder if the usage of plain-text mails would reduce phishing or increase it?
I've been looking at hammerspoon recently and would also love to know how!
From your replies to me, I was beginning to think I was being trolled, but I see you probably simply have not experienced the full unpleasantness of urban driving, in which people violate both the rules of the road and common sense for motives, not just through a lack of awareness. From my experience and informal discussions, I am very confident that people weigh the presumed motives and purpose of other drivers in their predictions of future outcomes - in fact, when I am in urban traffic and not alone, discussions of other drivers' motivations and likely behavior do come up.

Now, I do not doubt that if all (or most) vehicles were autonomous, things could work as you describe (though traffic might flow more smoothly or efficiently if vehicles could signal 'intent'), but that is not how it works at the moment, and the transition is probably the hardest part of introducing autonomous vehicles.
Your First Programming Job
Besides what mike-cardwell says, TOTP relies on a shared secret, while U2F uses challenge response authentication. Even if a MITM captures the (encrypted) challenge-response sequence, a new authentication requires a new challenge-response.
To be frank I think that's a bit naive.

These attacks are a numbers game. There's a low cost to sending the emails and a much larger payoff.

Education helps, but it's still possible to catch people off guard, tired, new users etc.

Anything that can be done to flag these emails as spam, or increase the cost to the attacker helps.
Assuming the attack is the same as what jhardcastle experienced, the email is propagated by sending emails to those who have received emails from the victim before. Alternately, it would be a known sender sending you that email.
I assume you're using the type of 2FA where this is not the case. We are discussing the type of 2FA where Google does ask you to enter your number. I.e, TOTP. When I log into Google, it asks me to type my 2FA number in.
Thanks for mentioning that. For more information on GitLab issue boards please see https://about.gitlab.com/solutions/issueboard/
I do not...but I have 0 sales (many trials though...perhaps, spam bots may be screwing up my event tracking in google analytics). My product solves a pain-point that I know developers have and there is already a market for it so I didn't bother doing research and just built an MVP.
Section 194 J TDS on Fees for professional or technical services – Taxin
Simplified answer:

Biggest one benefit is the ability to align vertically and center vertically
It does not prevent this if the image is attached to the mail.
Agreed - I think simply highlighting the data:... part of the URL with a vaguely scary colour would help.
The Conjuring 2 Blu-Ray Review
I meant by "very simple projects" static websites and dynamic websites that have very limited dynamism, pages. But something like Semantic UI, you can rely on it to build complex dynamic structures with sensible and good looking defaults, If you want more, it's very easy to customize without conflicting Semantic files with your customizations.
Fake stock market to figure out the value of memes
https://github.com/twbs/bootstrap/issues/20631

Essentially they've stopped working on v3. I don't think they used the words "no longer supported", but that's kind of what has happened.
Why don't just put a little frame around embedded elements like pictures, etc? Maybe with a little icon indicating the type.
Gamers typically use VoiceAttack[1] for voice control in gaming. It uses the built in Windows 10/8/7? speech recognition system and layers macros and basic programming on top of it.

[1] http://voiceattack.com/
There are also other interesting uses for odd word lengths. For example, many UARTs support word lengths from 5 to 9-ish bits (some do more). This is commonly used to implement out of band signalling for protocols running over these, eg. using 9 bit words, where the ninth bit tells whether this is the start of a command frame. More handily even, in most MCUs this is already correctly separated, ie. there is a byte register with the lower 8 bits and then there is a different register for the remaining bits.
Reminds me so much of competitive programming
A SASS API just for the grid system or for all elements?

Do you know where we can learn more about this?
HealthTech trends for 2017
TL;DR: 2D Ising phase transition realized in a material
Which is why I said potential rather than actual. Having users terminate their connection at Cloudflare always adds an extra layer, and a dependency on a US corporation and therefore subject to the US legal system.

It's not totally ideal. But I'm glad to hear you're trying your best.
You shouldn't use Chrome