skysight-inc/HackerNews huggingface dataset:
Remind HN: Chrome 57 Doesn't Trust StartCom or WoSign
TL;DR: If you still have StartCom or WoSign certs, you should update them yesterday.

Chrome 57 now reports the big scary "Your connection is not private" message for most StartCom or WoSign sites. This includes, "Attackers might be trying to steal your information," with the code NET::ERR_CERT_AUTHORITY_INVALID.

Even if users click Advanced→Proceed... to continue anyway, any cross-domain StartCom/WoSign requests will simply fail with net::ERR_INSECURE_RESPONSE (status 0).

In Chrome 56, this only applied to certificates issued after Oct 21, 2016, but starting in Chrome 57, it applies to all sites that are not part of the Alexa 1M, regardless of when the certificate was issued.

Unfortunately, it's not part of the Chrome release notes. The best resource I found on the issue was at https://forums.whirlpool.net.au/archive/2605051. It refers to this commit:

commit	e719fc626a3b9a528bf226b704785bcb24d07868
author	Ryan Sleevi <rsleevi@chromium.org>	Fri Jan 27 21:14:49 2017
committer	Ryan Sleevi <rsleevi@chromium.org>	Fri Jan 27 21:14:49 2017
Restrict the set of WoSign/StartCom certs to the Alexa Top 1M
Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.
BUG=685826

If you've been putting off your updates since the earlier discussions[1][2][3][4][5], then it's time to kick it into high gear and update your certs.

If you missed all that, https://wiki.mozilla.org/CA:WoSign_Issues enumerates the issues, and https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html summarizes it at a high level.

[1] https://news.ycombinator.com/item?id=12389573
[2] https://news.ycombinator.com/item?id=12444590
[3] https://news.ycombinator.com/item?id=12617659
[4] https://news.ycombinator.com/item?id=12787029
[5] https://news.ycombinator.com/item?id=12841860
You really do get used to it. First time I got into a light plane, I had exactly the same reaction as you - it was all gobbledegook. By the time I took my first proper lesson, I'd started reading the textbook, and it was mostly making sense. Within a few hours I was fluent, and things like this recording made sense.

The big thing is understanding the vocabulary, and the things they're likely to say. It's called the "pop-out effect" - once you know what you're looking for, it's much easier to find it. You can think of it in Bayesian terms - an increased prior on certain words and phrases makes them much quicker to detect.

(I will also say that many people find American aviators/ATC much harder work. They use less standardised phraseology - perhaps because they don't have so many different native languages all crowded up into a small airspace. See if, eg, Amsterdam or Dublin is easier for you to understand.)
What does my Facebook data say about me? I found out using Data Selfie
Strangely I do not see this said in discussions about Uber, but I think they are operating in a way on good publicity and the false premise of Uber being ride-sharing, which is not really the case.

Compared to other services in this market, e.g. taxis or buses, Uber has a significant portion operation costs implicitly discounted and/or indirectly subsidised. Uber drivers are self-employed, which in many parts of the world has lower tax rate as opposed to employment contracts (which is pretty common for bus drivers). Uber cars are registered as non-commercial vehicles with less restrictions inherently increasing utility value (a family can have one car used for Uber and weekend driving, but having a Taxi car may very likely result in the need for another car) and non-commercial insurance rate despite increased accident risk, which results in elevated overall risk of non-commercial vehicles which all (non Uber) drivers must share.

Bad press for Uber may result in law changes that level the playing field and either increase operation costs for Uber significantly increasing their burn rate or lower operation costs for their competitors decreasing Uber's attractiveness and revenue thus increasing burn rate.
I don't think so - I think that particular accolade goes to https://www.emishealth.com
451 Research: WINGS, Blockchain and the Tao of DAO
Over a Third of Websites Use Outdated and Vulnerable JavaScript Libraries
I don't think that asked what it is. Probably meant which rather than what.
Coca-Cola Funds Scientists Who Downplay Diet's Role in Obesity
Why can't they run the same water through the reactor again after the water cools?
NIST Gaithersburg will be closed on Tuesday, March 14, 2017
> Microsoft Surface 4 Pro/Surfacebook, the only pen interface in the history of computing that I found wasn't an unusable laggy pile of shit.

You should try the Apple Pencil. Reviews, comparisons and anecdotes put it considerably ahead of the Surface in accuracy, latency, parallax, pressure sensitivity and tilt detection:

https://www.youtube.com/watch?v=VMA25CqKcn8

Surface Pro 4: Fails on the lowest pressure. No tilt detection at all? No wide color gamut. Bulkier device and potentially noisy/clogged fans?

I also remember seeing/reading that the Surface Studio screen "ripples" under strong pressure.

----

On the iPad, in some apps like Procreate, you can even control effects like the direction of motion blur by tilting the Apple Pencil around (rotating its back end in the air) while keeping the nib on a focal point.

You could also use the iPad + Pencil as a drawing tablet for native Mac or Windows apps:

https://www.duetdisplay.com

http://astropad.com

P.S. Wait till Apple's March event if you're planning to get a new tablet.
Liking something doesn't mean it's not part of the problem (see google).

You don't like facebook messenger, you like having all your acquaintances in one place (same could be done with federated xmpp).

You don't have to share anything personal to be profiled with a stockpile of data (see metadata), actually you have to take active counter measures to limit that. But even though you are not forced at gunpoint you are manipulated into being part of the mess (be part of the walled garden or be separated from your acquaintances, be online or lose some of your social interactions).
This looks nice too! Very intuitive interface. Thanks!
This is great!

One point I would like some clarity on is the migration process. Assuming I use this for a production application, how do I maintain changes of my model schemas, and how are these migrations applied? Can I rollback?

I think a solid story on these would make a library like this extremely attractive. (One of the reasons Rails enjoys developer mindshare is it's amazing migrations workflow).
>It can be as simple as Arrays vs. LinkedLists; where Arrays have zero cost access and LinkedLists have high indexing costs, but low constant time insertion costs where you don't know the content length.

But then in the real world, arrays can still be faster than lists even when you're inserting a lot...

https://www.youtube.com/watch?v=YQs6IC-vgmo
This is really lovely, thank you!

Possibly like a lot of other folks here, I discovered this phenomenon of "radio chatter" over "ambient electronic music" via http://youarelistening.to/ - I find it so helpful for concentration.

I came up with my own improvised "mixing desk" using tabs in a separate browser window (makes it easier to separate from your main work. The most common tab URLs are:

http://priyom.org/ - For listening to numbers stations (uses websdr below!)
http://websdr.ewi.utwente.nl:8901/ - For basically any shortwave transmissions
http://www.broadcastify.com/ - Various scanner feeds from all over
http://www.broadcastify.com/listen/feed/11888/web - A fascinating repeater that I love listening to

And finally, I overlay one or more of these over my own Spotify playlist of ambient sounds. It's public, so I'll plug it here. I put this on random and use a crossfade of 10 seconds.

https://open.spotify.com/user/n_sonic/playlist/5tEUDt2X2QB0S...

Once again, thanks for this! Will be recommending it to folks today.
Basic tips for Android apps debeloper
What's New in Apache Ignite.NET 1.9: TransactionScope, DML, LINQ
> wordstar -> turbo pascal

working with wordstar meant the turbo pascal editor was easier to use. [0]

[0] http://www.freepascal.org/docs-html/user/userse32.html
Lenovo Makes Troubleshooting Your ThinkPad Easy with New Diagnostic App
Nuclear waste "recycling" is a bit of a misnomer. If you read the article, the fuel rods, and that is the only part that is being "recycled", is just a small part of the contaminated material that needs to be handled. You're not recycling the reactor rubble, the contaminated water or soil. And reprocessed nuclear fuel is not like recycled glass or aluminum that can be reused an almost infinite number of times - nuclear fission always produces waste products like iodine or cesium, which cannot be turned in to fuel again and need to be disposed of.

Even when you leave out the fuel, dismantling a nuclear reactor is a challenge in itself. Even the "safe" thorium and potential fusion reactors leave highly contaminated ruins behind. Read about the THTR-300 if you're interested. The German AVR reactor is also a dirty mess that nobody knows how to clean up, even though no major nuclear incident happened there.

When thinking of nuclear waste, most people think of spent fuel rods - plutonium and uranium. Those are easy to handle, they're solids, they're comparably small and you put them into molten glass. But storing an entire contaminated reactor building, that we don't know how to do other than do like Chernobyl and just cast the whole thing in concrete.
I agree. I've read the whole article and still wonder why I should stop using JWT.
Yes, that's what I meant, thanks!

I edited the parent for clarity.
Clickable:

Best Chrome 57 resource I found: https://forums.whirlpool.net.au/archive/2605051

https://wiki.mozilla.org/CA:WoSign_Issues enumerates the issues

https://security.googleblog.com/2016/10/distrusting-wosign-a...

Past discussions:

https://news.ycombinator.com/item?id=12389573

https://news.ycombinator.com/item?id=12444590

https://news.ycombinator.com/item?id=12617659

https://news.ycombinator.com/item?id=12787029

https://news.ycombinator.com/item?id=12841860
MacroSolve: Donald Trump Jr owns a patent troll
Serious question: will terminals ever support P3 color? Maybe that's too much to ask for?

https://webkit.org/blog/6682/improving-color-on-the-web/
https://webkit.org/blog-files/color-gamut/comparison.html
It all went wrong when symmetric bandwidth dial-up got replaced by asymmetric broadband. It was a fatal blow to self hosting.
Google App Engine: Google fixed 30 of 707 bugs reported in the past 12 months
Ask HN: What old technology do you feel could do with a revival?
My recent comment[1] on the remarkable thread[2] got me thinking about the ideas which in my opinion did not reach their peak before they were obsoleted, not due to technical merits but due to business factors.

I see a lot of people who assume that all of the latest technology is a superset of all the advances that came before it and that everything we have today is better than whatever was created before. What kind of examples prove this assumption incorrect.

In terms of devices, I think these are things that were very innovative, useful and sadly do not have an suitable replacement today:

a. The palm pilot or any of the PDAs for that matter
b. The nokia 900
c. The nokia 810
d. The pebble

[1] https://news.ycombinator.com/item?id=13865714
[2] https://news.ycombinator.com/item?id=13865108
When you say unbearably slow, do you mean the actual DNS resolution, or the Admin interface?

An Rpi3, even a Rpi B or zero is plenty good enough for DNS queries! The Admin interface has been a bit of a bugbear for a while, but we are working on some massive improvements for the 3.0 release (coming soon™)
Wonder if this can/will replace CMake for cross platform builds.
Ask HN: Do you touch type?
I've been programming for over 10 years and have always typed with just 2-4 fingers.

I've been trying to touch type recently but am absolutely struggling.

Just wondering if it's too late for me to learn touch typing after many years sticking with a bad habit.
The problem is, every single time a "extremely rare and unpredictable" nuclear catastrophic event happens, we say the same thing.

The exact reason why we should avoid nuclear in the medium term is that the events that caused, are causing and will keep cause those accidents are all unpredictable. The cost in consequences for our planet is still too high and will remain that high or increase until we will be capable of "de-radioactivize" things
Yes, but isn't that a prerequisite for political success?
> They can mitigate against badUSB by only whitelisting

I'd say just don't run a graphical environment or, if you do, lock it. With a normal password, good luck to the USB thumb drive that pretends to be a keyboard.

As for booting, well, don't have it in there at boot time.

As for malware in the files itself -- I don't think that's the point of this project. It says "if you don't trust the transport medium (i.e. USB)", it's not about the contents.
On my home server/NAS, I use rtcwake to sleep the computer for a few hours, then wake up, check if there's work to do, then sleep again. I'm not sure if it'd work with a Pi, though, since its hardware is different from a typical motherboard.

Alternatively, you could use something like an Arduino, and connect it in some way to an independent camera. Since it doesn't need to process the picture, you don't need a powerful processor or MBs of RAM.
I use stateful JWTs for session management, storing them in localStorage. If someone can exfiltrate the token, they will get a week long authorization, as well as some identifiable information (username, name and role).

Probably I can achieve the same overall system with cryptographically secure session cookies, that are persisted in a database, or other store that is accessible across multiple servers. I guess it would amount to the same thing.

Originally I implemented it because:

* My systems are SPA's. Totally JS dependent from the word go.

* I felt like there would be some advantages to being able to establish certain claims without verification. Say for display purposes prior to server comms (show a list of multiple available sessions for example)...In practise this hasn't really been true. Generally I find in the end I am always checking and verifying anyway - without any huge overhead.

* I've always had a sort of fuzz of uncertainty about Cookies. They always felt a bit out of my hands. Thinking it about rigorously of course, people can switch off JS. They can switch off persistence.

* All my user's local data can be persisted in one place, rather than having to store a reference in the Cookie and then lookup in localStorage. In reality though the code for this is pretty trivial...

So overall while I don't know how right he is, I feel like maybe he has a point. Why not just use cookies?

Maybe it's just because as a JS dev, I want everything to stay within a JS universe...and for some reason Cookies have always felt outside of that to me.
As a C/C++ build system it's severely lacking in features. CMake is orders of magnitude more useful.
I'm a big fan of mechanical watches, but I think the market nowadays is too much about limited editions and unnecessary flamboyance. How many different "limited" Omegan Moon Watches are there, for example?
I spent one hour in a sensory deprivation tank and you should too
How to set up the perfect modern dev environment on Windows
WordStar for word processing, Dbase for database management and Lotus-123 for spread sheets - those were the days.
I'm not commenting about Drake or its usefulness, but concerning (GNU) make :

* you can specify several inputs & outputs per rule

* you can specify which script interpreter is used ($SHELL), and python can be it. See https://www.gnu.org/software/make/manual/html_node/One-Shell...

* downstream make can indeed be interesting. however you can try to build all ultimate targets ans let make sort out which ones can be avoided

* fs support is best done at the os level (https://wiki.apache.org/hadoop/MountableHDFS, not sure about timestamps)

and

* "everyone" "hates" gnu make, which means everyone knows it.

(edit :format)
“I don't have time for Social Media” – Buffer to the rescue
Leg hats. Dan Grover knows what's up.
Grow Now 9 Growth Hacking Ideas That Work No Matter Your Industry
Because it's highly radioactive.
Thanks, I think this is the most clear cut analysis of values at play.
Using dotPeek's decompiler and symbol server to investigate an IIS crash
If the population does not want to be part of the country, one cannot just annex the territory in the modern times.
When I did my PPL one of the instructors gave us a CD full of recordings that we could listen to to train our ear for it. Matching that to transcripts helped - and it also helps once you know the lingo, since it's mostly a limited set of words and the phraseology has a specific structure.

For example:
Altitudes and flight levels:

3,500 is spoken as "three thousand five hundred".

13,500 is spoken as "one three thousand five hundred".

But other numbers (like times, directions, etc) have every digit spoken, for example 10 minutes is "one zero minutes" or wind direction 220 is "wind direction two two zero". Speed reading would be something like "one niner zero knots" for 190 kt.

The sentence structure is also relatively strictly defined, for instance at an unattended airport you would always transmit in this order:

(1) where you are

(2) who you are

(3) what you intend

(4) repeat where you are

So you'd say something like:
"Swartkops traffic(1), small Jabiru Kilo India Tango(2), left downwind for runway one eight, touch and go(3), at Swartkops(4)"

This kind of strict structure and limited lexicon does make it understandable after a bit of practice, since you are expecting certain words to show up.
I always preferred YYYY-MM-DD. Sorting filenames etc. makes more sense this way.
> For people who believe code isn't literature descriptive names are wasted characters.

Data point: I do read code like books and I can't stand longAndMeaningful variable names. Rather, cut to the chase.
What an odd law. Anybody aware of the reasoning behind this?
I mean the liberal use of "literally".

Also, you've been trolling all over this thread.

You're 'examples' are anecdotal, or not fleshed out with details at all.
Wechat built its initial traction by having voice memos as a first class interface element in its app. There are entire communities of illiterate Chinese communicating using purely voice memos/stickers.
Devistating and consuming memory and executing it off the stack
“Rich already answered that” – a collection of Clojure design FAQs
There will be multiple translations. Developer won't even know what platform they are developing for. It'll be serverless.
> 'aeronauts', literally meaning 'being born into air'.

<pedant>Incorrect. The suffix -naut is from Greek naute^s, meaning sailor. Of course it may be that the Chinese phrase used does mean "being born into air", but then the article should say that</pedant>
Quoting:

For folks that are going to say,
"well people have the right to
refuse rentals in their homes".
True. To an extent. There are
Fair Housing laws that may apply
under certain circumstances ...

I thought the whole point of AirBnB was to be disruptive, and ignore regulations, and not have to obey the laws that hotels have to obey and thereby, well, something. Things like this will happen.

And yes, he can tell his story, but it won't change unless it's legislated. AirBnB can't have it both ways.
It's too soon to say. If he does end up serving a constituency, it'll arguably be one that's been long underserved. But personally, rueful cynicism is about the best that I can manage.
What even is the use case for USB sticks these days? Compared to just putting the files in Dropbox.

If I found a USB stick, I would just bin it.
This is very relevant to me. I'm a struggling, unpublished novelist with a handful of half finished books and a moderately successful writing app in the windows store, which I use myself. Every time I sit down to write I find myself making notes on how to improve things or sometimes fixing bugs and deploying new versions instead of writing. As a writer, it's probably the worst decision I ever made. As a developer, it's the thing in most proud of (which is also kind of sad since its so very basic)
Several projects are trying to achieve this: freedombox, yunohost, cozy cloud, sandstorm.io, ...
You're saying investors would be concerned that they are hiring for diversity, rather than from prestigious schools?

What do you mean by "avoid diversity at the cost of job performance" - are you saying diversity improves performance?
Ask HN: What style for an image-resizing service?
I'm building an image-resizing service (long story).

I was wondering what style is better for the URL-based API. If your image is https://example.com/images/logo/test.jpg, which one is better:

https://app.imagekick.io/example-com/images/logo/test.jpg/resize/500x/flip/hoz/

https://example-com.imagekick.io/images/logo/test.jpg/resize/500x/flip/hoz/ (can be CNAMEd to images.example.com)

https://imgk.io/example-com/?src=/images/logo/test.jpg&width=500&flip=hoz

Passing the image as a GET parameter makes it easier to import external images:
https://imgk.io/example-com/?src=http://external.com/images/dog.jpg&width=600 versus https://app.imagekick.io/2y789/fetch/http%3A%2F%2Fexternal.com%2Fimages%2Fdog.jpg/resize/600x/

What do you guys think..? I personally like the URL-based solution because it's somewhat quicker to type, and the operations can be chained. Passing instructions as GET parameters makes it easier to specify external images.
I had a Brother daisywheel printer for my Superbrain, and I didn't like the options for chapter headings in text, as they didn't stand out enough for me. I wanted them to be bolder than normal bold. With the daisywheel I had only one font, not like a matrix printer which had all kind of fonts.

One bold tag around text like (b)example(b) made the printer retype that text one time. It turned out that (b)(b)(b)example(b)(b)(b) resulted in four times typing "example". This was hammered (literally) into the paper, so on the backside you could see and read the text as well. Using capitals, varying degrees of bold-repetitions, I could get what I wanted.
That's fine for you, but it doesn't change the point at all, which is that for most people, City is far from what they'd consider the centre. That Mayfair was on the outskirts a couple of hundred years ago is not particularly relevant. Startig in the late 18th century, Charing Cross[1] has increasingly been considered the centre, even occasionally being used as an official marker.

[1] https://en.wikipedia.org/wiki/Charing_Cross
The city is pretty central as far as I see it. Although I agree
for shopping, touristing and (perhaps) dining, the centre is
more westish; there are good historical reasons why such
places have names like Westminster and the West End.

In terms of modern London though, I take it as defined by the M25, and on that scale, the everything from Greenwich to White City is pretty much central.
My supervisor has one of these and it does look amazing. Can't really justify the cost for myself right now though. Hoping reMarkable lives up to the hype.
Pardon my ignorance, but I don't even understand his point. I wouldn't even have bothered with a class at that level of abstraction.

If I find repeating if statements throughout my code I put them in a method, end of story. Pseudopython:

def logging(logger, message):
if null == logger:
return
if null == message:
return
logger.write(message)

I don't understand why the author would even bother with more than this, given his example. Also note that I used two return (disguised goto's) as guard statements to check the conditions before I do anything.
Sell My Boat Online – AutoBuy