skysight-inc/HackerNews huggingface dataset:
Old Microsoft was super aggressive and alpha. Not sure about the harassment though. It's now a calmer behemoth.

If travis is the hero of Uber who employees rejoice then him stepping down would be a death blow to the Company.

At this point Uber has got fuck you money to keep on burning employees. Employees have golden handcuffs that don't come off until IPO.

The best people can do is not get a job at Uber. The existing employees start quitting en-masse or a major internal data leak. The revolution needs to come within Uber.
> Very poorly chosen example, because "No Japanese and dogs" signs are incredibly common across China

Funny you should mention that. The relation between two people is actually quite friendly except political occasions. Also the Japanese hate is due to the world war 2, not racial. In fact we are one race.

> "洋鬼子" literally means "foreign devil".

'devil' is a strong word. It's more like 'foreign strange men'.
A lot of the devil here is in the details. You need long term life support that Dragon hasn't proven yet. Deep space communications on the transmit and receive side. Abort scenarios for most or all phases of flight. All of this is untested and requires a huge amount of engineering and manufacturing work. Since this will likely share the same design as the NASA-contracted capsules, these systems will need to pass muster with them. And they don't cut corners.
6 Tools to keep your marketing team connected and productive
We detached this subthread from https://news.ycombinator.com/item?id=13748377 and marked it off-topic.
HN should really ban throwaway accounts on sensitive threads.

In any case, if you don't at least know that the response to your comment will be that allegations of harassment more often result in retaliation against the accuser than punishment of the accused - between the multiple Uber fiascoes, Casey Affleck, Brock Turner, etc. - then I find it hard to believe you're trying to listen in good faith.
In Latin there are cardinals, ordinals, and also distributives, frequentatives, and according to some people multiplicatives (tres, tertius, terni, ter, triplex). Their meanings are something like:

three, third, three apiece, thrice, triple

These answer questions like: How many apples were there? Which one of the apples did you want? How were the apples distributed to the children? How many times did you count the apples? How has the apple population grown since last year?

At least for small numbers, English seems to have a distinctive form for each of these except for the distributive. But Latin will have many of these distinctive forms even for large numbers, like sescenties 'six hundred times' and octingentesimus 'eight hundredth'.

Edit: there's also some specialized vocabulary for fractions such as quadrans, sextans, octans, and even specific fractions like dodrans (3/4) and quincunx (5/12). But I'm not sure that these patterns are productive (generalizable) for larger denominators. Per Wikipedia, it looks like they're not, but quite a few have specific names:

https://en.wikipedia.org/wiki/Roman_numerals#Fractions

(I'd never heard of most of those! ... now I remember learning about the distributives for the first time at a spoken Latin event and remarking that numbers sounded surprisingly complicated in Latin, to which the organizer replied "dimidiam partem nescis!" 'you don't know the half of it!'.)
Rails Real Time Chat Application Similar to Messenger – Part 1 [tutorial]
He uses his "intellectual" status to make political commentary and pass it off as fact. He contradicts himself again and again to whatever stance aligns with his political allies.

I'm on my phone now so I can't find the best examples but just take a look:
https://twitter.com/kevinwglass/status/818465909996134400
Cities and communities can also contract the RCMP instead of managing their own police forces.
Blatant sexism is quite high bar. IMO, most of it is in grey area where whoever is thinking that way can easily deny everything. There is usually aspect of being unsure whether you are really discriminated against or whether it is that you are really doing something wrong and needs improvement.

In any case, it is good you took the opportunity to speak up. Even if the company does not change anything, knowing that it is not all colleagues who consider you to be less helps to put things into perspective. For me personally, when something similar happened, it mattered a lot. Not just felt better, but really made difference in how I seen my position, how I was confident afterwards and how I trusted colleagues in general.

I am trying to say that the action like yours may have positive impact on colleges even if you did not seen it.
Please don't use uppercase for emphasis. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html.
Changes to Ragel in Response to the CloudFlare Incident
It depends how much the data is worth. That's really the problem.

Suppose you're a college dorm network. Then you can't justify TLS MITM because the risk of your MITM device actively creating a security hole that leads to all the students' bank passwords being stolen is greater than any benefit from centrally monitoring the traffic in that environment.

Suppose you're a highly classified government research lab. Then you can't justify TLS MITM because the bad guys are skilled foreign government agents and you need to isolate the network from the internet.

And there is no happy medium because the risk and cost of having all your TLS-secured data compromised scales with the target value. The higher the target value the higher the risk created by the MITM proxy, all the way up to the point that you can justify isolating the network from the internet.
So, essentially the same way SSH works?

The main problem I'd see is training users to get that initial trust phase correct. Too many wouldn't try to parse the info given and just click Trust regardless (or run away from every site with the warning).
Any links to the correct downloads?
I don't think mine is losing money since it's been in a family trust forever. But most landlords aren't making any money. Everyone has owned properties forever and taxes are really low for them. If you're in that position it doesn't matter but it doesn't apply to a rent or own debate for current renters or potential homebuyers.

But yes most landlords out here are lucky if they break even. They take tax write-offs and hope for appreciation. Cap rates in Cali are super low and prices are really high.
> Hardly identity thief material.

Audio messages can be used to train a system which then will be able to mimic the voice of the child, almost indistinguishable from the original. AI of this kind will be commodity (i.e. easily accessible by criminals) pretty soon if not today.
Yes, but the point was if you're not born wealthy you probably have a better chance of becoming wealthy than becoming a NASA astronaut.

Also, why do some people think being born with money is somehow bad, but being born with intelligence and drive is good? Aren't they both down to luck?
I like Apple's approach, where HomeKit certification requires that the device use some form of secure transport to communicate with iOS.
Yeah, it does. Do you think a short delay might be help?
IoTTDWAMBTPCHGOOBOABS

'Internet of Things That Don't Work Anymore Because The Company That Made Them Has Gone Out Of Business, Oh, And Because Security'
Def not dorffort
I guess the reason I feel it's different than "stupidity" is I think of that as a trait, whereas this thing feels like a new (or at least increasing) behavior.

Not like "you cannot derive basic conclusions from simple inputs because you were unfortunately born without ability to do that", but more like "you refuse to derive basic conclusions from simple inputs because _________________."

The reasons aren't clear and are possibly complex and subconscious, but it seems more about refusing to do the basic mental processing, despite having the capability to do it.
This is the part that really hits me. When, in a meeting, Mike#2 says to "stop being a whiny little bitch"

Yet Torvalds says worse all the time, and he's a geek hero. I sense a double standard here, and I'm not sure why.
(I'm a Google SRE. My opinions are my own.)

That's not what our 20% time is for, and 20% is way too small a number for that purpose. "20% time" (the way we use the term) is for personal/career growth/scratching itches.

Time spent on building systems that make our service better is my primary job. Manual remediation ("toil") is something to be tracked as a dangerous antipattern that must not be allowed to take over.

Toil and oncall response should be less than 20% of my time, together. At least half my time should go into engineering projects. If the level of toil is in excess of 50% of team activity then I would expect only percussive intervention to get the team out of this situation.
I just upgraded code in my app (https://commando.io) that stores some user preferences from $.cookie (jQuery Cookie) to Store.js. Worked flawlessly.

As a bonus of switching from cookies to local storage, now requests don't send along those values anymore to the server.
>If the officer demands that you turn on your device but the battery is dead then it mean that you are unable to comply. Ah ha! A clever loophole that no one has ever thought of before.

Yeah....about that:

http://www.etihad.com/en-us/before-you-fly/us-preclearance/

All guests travelling to the US, UK or Canada from Abu Dhabi International Airport are required to turn on all electronic devices in their possession prior to boarding. Guests must ensure that all electronic devices in their hand luggage or on their person, including mobile phones, tablets and laptops, are charged to minimize any potential disruption to their journey.

Abu Dhabi Airport does not have a facility to store devices, which cannot be powered up and Etihad Airways cannot take responsibility for devices which are left behind.

This requirement is part of enhanced security measures by the authorities of these countries. Failure to do so may result in not being allowed to take the device(s) onto the aircraft or being denied access to fly.
Yep, I plan to add this functionality soon.
Nice writeup - good to see a solution proposed, rather than the same complaints about 'how TLS is broken'!

That said, the key flaw that's raised at the start of the article (how do you know that amazon.de is Amazon) is not really solved with this solution. You still need a trusted third party to bootstrap that first visit.
Confirmed in IE.

MS Edge however doesn’t crash. It refuses to show the page, but the debugger shows what looks like a normal JavaScript exception during a JS function call. Edge catches that exception just fine.

> Microsoft Edge and 32-bit IE 11 should behave similarly

No, google, they should not. The two are almost completely different.

Live demo: http://const.me/tmp/test.html

Call stack from Edge: http://const.me/tmp/edge-stack.txt
Gitlab CI builds down
1) So I boot my new phone, connect to some coffeeshop's wi-fi and navigate to some HTTPS site. The coffeeshop's captive portal intercepts my request to show me a TOS page, sending me their public key instead. Now my browser has that key remembered for that domain, and will error when I visit the real site.

2) Key rollovers are accepted silently if signed with the previous key. So an attacker who steals the key can sign their valid ones forever, right? If the server can invalidate previous keys to reduce that risk, what happens when the attacker uses that feature themselves against the actual site owners?

3) How is TOFU better than previous proposals like Perspectives and Convergence?
Yea, I found their website : https://www.zotero.org/ Available for Windows, Mac and Linux. So no mobile apps at all, Pocket apps are great so that's a good reason to choose them over Zotero.
It would be progress for the savvy and regression for everyone else, but I still like his thinking here even if it's ultimately a mistake.
> The author mentions that you can tell how much of the hashes match because the compare function exits early if they do. This might be true, but it doesn't give you anything.

I think you may be confused. The article discussed two cases initially:

1. Username and password hash.

2. Naked string used in a SELECT query.

The latter case is where the timing leak can occur. That password_verify() is constant-time is just a nice-to-know defense-in-depth feature, not a must-have.

(Disclaimer: I am the author.)
Check out the awesome rules for Arabic:

https://en.wikipedia.org/wiki/Arabic_grammar#Numerals

> Numbers behave in a quite complicated fashion. wāḥid- "one" and ithnān- "two" are adjectives, following the noun and agreeing with it. thalāthat- "three" through ‘asharat- "ten" require a following noun in the genitive plural, but disagree with the noun in gender, while taking the case required by the surrounding syntax. aḥada ‘asharah "eleven" through tis‘ata ‘asharah "nineteen" require a following noun in the accusative singular, agree with the noun in gender, and are invariable for case, except for ithnā ‘asharah/ithnay ‘ashara "twelve".

Note that this is just the introduction and doesn't purport to set out all of the rules... (!)
This is a common mistake in pretty much any language that captures a closure inside a lambda: C++, JS, etc. Unfortunately, debugging this the first time takes 20 minutes; the next time, it takes 0 seconds.
>Look at North Africa and the Middle East... so much of the conflict now is driven at least in part by climate change.

I haven't seen this claim made before, do you have any links to read more? I was under the impression that nearly all of the conflict is driven by things like terrible government structures and ideological extremism (e.g. ISIS).

>Climate change isn't just sea levels rising, it's changing climates; some places with desert will green, some green places will turn to desert.

Right, but that's why I pointed out that countries with advanced agriculture technologies wouldn't be impacted nearly as hard and those are the same countries with the means to geo-engineer.
Oh yeah, a gain of +100 points is just insane and it would be difficult to predict what that society would even be like. I was just trying to suggest that +4.5 to the mean might also have potentially big effects.

As for why China isn't farther ahead - IQ isn't everything. They modernized pretty late in the game, and operated under a profoundly stupid economic system for a good part of the 20th century. I believe that their current government is pretty corrupt, but I'm far from an expert.
This is great feedback!

In addition to this, I think numbers really help with the soft skills of listening and producing - since the actual number of words is rather small but you can mix and match them in an unlimited number of ways. You can't just understand most of it and flub your way through the rest.
Having spent a few years dabbling in TLS stuff recently... I have some comments.

This article is really about PKI more than TLS, and what it means to be a user's agent ("user agent"). Forgive my critical tone in advance, it's just that proposals like this need to go through the wringer...

> you are supposed to be certain that you are communicating with the website you intended to visit. the green padlock in front of the URL in your browser tells you TLS is securing the connection. But this reasoning is wrong.

No, it's not. It's correct to reason that the green lock (as implemented by most modern browsers) indicates a secure connection to the site in the URL bar. Now, whether that site is behaving virtuously... is a different matter, and not one that TLS is designed to solve. It also doesn't mean TLS is broken. (TLS is quite good, especially the emerging 1.3 standard. Qualms with TLS usually end up being about PKI, which is the best thing we've got widely deployed right now, whether you like it or not.)

"Intended to visit" -- when we look at the browser as the role of the user agent, or in other words, a program that is supposed to act helpfully on behalf of the user -- the browser infers intent from what the user tells it to do. If you have a private chauffeur and you tell him to take you to such-and-such place, he will go there, even if you intended to go to such-another place. Oops? Maybe agents who know you really well could double-check with you if they think you meant something else, but do you really want your browser to know that much about you?

> The real solution: get rid of certicificates

This is ridiculous. Certificates make possible the cryptographic exchanges that guarantee confidentiality, host (and client) authenticity, and data integrity. Don't throw away the single most valuable component of modern Web security.

> Being able to tell that we are visiting the same website as before allows us to establish a trust relationship with that website over time. With every positive interaction, our trust increases (and with every bad experience, our trust drops). We don’t need the website’s name for that.

This isn't about TLS, this is now about PKI and trust model issues. Yes, there are various trust models and each have advantages and disadvantages. We went with PKI for the wider Internet because it fits the mold best when connecting machines to other machines at scale. In contrast, WoT and other models (including TOFU) work better in small groups of people or machines in semi-controlled environments (e.g. TOFU is manageable with your small-medium-sized fleet of servers).
We aren't interested in timing attacks on username+password, we're interested in timing attacks on authentication schemes that only involve one string (i.e. ONLY a token).

Simply hashing it before a lookup may be sufficient.

However, it's actually easier to reason about separating the search operating (which leaks timing information unavoidably) from the validation operation (which shouldn't leak timing information if we can avoid it) than relying on a hash function to blind the operation completely.
Mike#2 has been in the company for longer than a month !
The same way, except SSH is generally used for a small number of hosts that the user itself (or their organisation) controls, so there's some chance for out-of-band verification.
IANAL either, but the author seems to have missed the point of the "I don’t know my password it is in a password manager which I can’t access" one (or, indeed, the blank device — but this one has numerous advantages). Yes, this will piss off CBP and they will punish you for it, and especially I wouldn't recommend it if you're not a US citizen but are desirous of entering the US. But if you're a US citizen, CBP isn't about to risk their position in court: they will not detain you indefinitely for noncompliance especially when you have an entirely plausible (and true!) explanation for your inability to comply.
Yeah it's in a family trust and they haven't done any major renovations. Taxes are lower than they should be. But even if taxes were zero, it still wouldn't make sense to buy this place for 2M+ when rent is only 4500. For 4500 rent you need to be around 900k max purchase price. If it's an investment it should be way less, like 450k.

I've rented 4 different homes in Cali and 3 were owned by family trusts. The one that wasn't made nothing and she ended up selling to get out. I rented that house for $3600/mo and she got 925k for it.
Not poisoning ourselves with lead is great, but I'm not sure that the younger generations today are the smartest in human history - http://www.sciencedirect.com/science/article/pii/S0160289613...
"Narcissistic Crazy person who might end civilization due to something he just saw on Fox news or because someone dissed him on Twitter" seems to be missing from the latest set of boxes.
I wonder if the timing was intentional at Google. Top level technical talent leaves, Google throws a party for him, then suddenly it comes out after the Uber scandal that he's involved in similar proceedings?

Someone at Google was angry about the departure.
In this photo from 2012, he's inside the Shuttle White Room at the end of the Swing Arm on Pad 39A: https://flic.kr/p/bzh1Ju
Who's the goto "freedom/privacy marketing" organization (EFF seems to be legal only)? This is an excellent propaganda for freedom opportunity. It involves a creepy invasion of privacy targeting children. Needs to be used in a massive campaign against (insecure) IoT ASAP.
If the savvy want this they can already have it, it's just a matter of removing the certs from the browser's CA store.
The terms "nonprofit" and "not-for-profit" are unfortunate misnomers. Like any other company, nonprofits can offer gainful employment and will eventually bankrupt if they never turn a profit.
There's many explanations why you would post a "false story" despite being "reasonable":

- "Amy" might not think she's lying at all, but a combination of misunderstandings and POV-blindness can quickly turn an "awful" story around to a banal situation

- "Amy" isn't necessarily looking to "reinforce the narrative" - it is certainly possible that they just want empathy or attention(which is practically guaranteed, see this thread). You could parallel this with the hoax hate crimes that were reported once Trump was in office - they would all hurt the otherwise legitimate point that bigotry is on the rise, yet the people still did it, quite often claiming that they were going through a rough patch and wanted some sympathy and attention.

- Even if "Amy" was lying, they may be relying on the impossibility of Uber to defend themselves. If they aggressively pursue the claims, they will receive a ton of backlash for harassing an alleged survivor.

> I just don't see anyone with any brains trying to create a false narrative to smear Uber.

The case doesn't have to be a "false narrative" - boosting a shitty situation beyond its actual levels is certainly a bonus to any Uber competitor, or anyone who dislikes Uber. It may absolutely be the case that Uber has a systemic problem; or alternatively, they have had an unfortunate clump of scandals, boosted by their unpopular business practices making it easy to believe that Uber really are monsters. At that point, it's easy to pile on any accusation, people will believe it, and it hurts Uber.
We form opinions far too fast and blithely assume that the only possible viewpoints are those that occur to us after 30 seconds of thought (plus the one or two viewpoints fed to us in the first article).

Once a person publicly expresses an opinion, it is very hard to change. We just fight and rationalize from that point on, digging in deeper.

And no, we bay area NPR-listening NYT-reading folks are far from immune.
Design a Perfect Search Box
Up Close with the 'New Psion' Gemini
Newest revision 12/2016 of that report:

https://www.lazard.com/perspective/levelized-cost-of-energy-...
Putting keys from popular websites would increase centralization: content will be moved to Facebook and the likes to avoid the warning.

This TOFU thing could be useful with self-signed certificates (like those shipped in servers' BMC).
No matter what, you have to trust someone, and any method that requires first-time click through every time on every new website is bound to exhaust users, resulting in them clicking through blindly. At least a certificate violation is a rare enough event, although as mentioned, it can potentially be corrupted by the CA. Regardless, you trust the browser implementation.

A better solution might have browsers try to intelligently identify suspicious looking URL's (including URL's that start with a popular, external URL, like paypal.com.notpaypal.cc). As for the actual certificates themselves, perhaps this is a good application for a Blockchain technology, with certs being created by website owners and submitted to a Blockchain by a machine assigned to the DNS name that wants to create its cert. But in this case, we still require DNS which is built on trust... so perhaps DNS could also be put on a blockchain. How? I don't know. But until we figure that out, we have to rely on various organizations to provide trust.