skysight-inc/HackerNews huggingface dataset:
> The same thing you do if physical tax/medical/financial records get lost in a fire, or any other data for that matter.

The thing you fail to grasp is the resilience of physical records. Imagine Germany trying to take down England's records during World War I, one hundred years ago. The destruction of merely 3-5% of all relevant documents would have required the coordinated strikes of hundreds if not thousands of arsonists, all of whom would need to be part of an even bigger spy network. That's for England proper; you might be able to scale it up to Scotland and Walles, but it would be completely unimaginable to pull this off accross the whole British Empire.

Today, it might be harder to take down one hospital, but once you have gone that far, scale it up to national level should be pretty feasible.

> Imagine that your monoculture crop could develop immunity to a new disease within hours, days or weeks

You never have opened a priority bug in one of the big software companies, have you?
Robocalypse Now? Central Bankers Argue Whether Automation Will Kill Jobs
Microsoft finally pulls trigger on Cloudyn deal
Getting people to believe in the dangers of things they can not touch, taste, see, or hear is often difficult.
The Robotarium: A remotely accessible swarm robotics research testbed
Innovation through remote work and travel (aka why I’m taking off for a year)
There's no mention of Tumblr in that article, and 2100 people constitutes a large number but ultimately a low percentage of the folks who work for Yahoo and for all its subsidiaries.
I noticed a few typos in both parts.
Like that discussion a while back about early competitors to CSS like DSSSL. Imagine if, instead of CSS/Javascript, we'd just had Scheme. In fact, imagine if instead of HTML/CSS/Javascript... we just had Scheme.
My "JavaScript Definitive Guide" ordered from Amazon.de (and printed by Lightning Source UK, if I recall correctly) was of shocking quality too. I returned it and got a more expensive copy from my local bookstore, printed by Lightning Source International. Very sharp type.
5 Vital Tips for Building the Perfect Income Portfolio
MonkeyLearn and Zapier Integration
Do these missiles require a working communications network? If this goes on long enough, there might not be any way to launch them.
Go upmarket and sell EV certs or codesigning certificates.
This is not CVE-2017-9217, note.

* https://github.com/systemd/systemd/pull/5998

* https://news.ycombinator.com/item?id=14451642
> the staff had become “de-sensitized” to the risk of a serious accident.

Yet again serious problems happen due to the Normalization Of Deviance. We really need to find a way to create working conditions that encourage correcting problematic situations immediately before the behavior becomes normalized.

Regarding the management/other problems... I encourage everyone in ever industry that is ever involved with safety (i.e. most industries) to see Richard Cook's short talk about "Resilience in Complex Adaptive Systems"[1].

[1] https://www.youtube.com/watch?v=PGLYEDpNu60
Hackaday Prize – $250k in cash prizes, looking for hardware startups
I think most people learned programming by doing stuff, not by reading books. Basic, Bash, Perl, PHP, Javascript all agree with me...
Cool. It looks like git-meta stores metadata to make git submodule easier, and git-subrepo stores metadata to make git subtree easier.
LE really fills a big need for cert issuance for massive web hosts with custom domains (WPEngine, Hubspot, Shopify are all on LE) as it both greatly reduces the support burden of setting up certs for all of their sites and sidesteps some of the limitations of the legacy cert structure.
Sequel was the last one that I used and was the best one. I can't remember the talk..."ORM's are the Vietnam of programming".

You are right, very little of the ORM gets used in the end and one almost always needs to write custom SQL anyway (models don't always map 100% to app layer). Most importanly, as languages change, evolve or dry up it's easier to find or train new talent with SQL experience vs. a language specific ORM.
Defense may be the only game worth playing, but how will that work? Unlike the real military where civilians simply don't own the hardware, in computer security they do.

NSA isn't a hardware or software vendor, and the corporations that are don't have much of a profit motive to heavily invest in security. They aren't actually liable for problems unlike say a car manufacturer that releases a faulty product, which leaves what exactly... reputation that takes a hit? But every vendor has bugs and security issues and the market isn't really punishing anyone.

Is the future effectively an enormous government subsidy to profitable corporations (i.e. NSA and other US government agencies basically become extensions of corporate America's QA department)? Is the future heavy regulations to create the proper financial incentives and/or penalties so corporations start seriously spending on security?

It's easy to say "the government should do something!!" but what exactly will that look like?
Packt is very hit or miss. Some titles are awesome, and others read like a collection of SO answers and out-of-date official documentation.
> A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle.

> So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok.

It works quite differently -- the browser doesn't have to talk to Let's Encrypt at all to verify correctness.

How it works:

1. Browser connects to the server

2. TLS handshake, crypto-stuff

3. The server cryptographically presents the browser his certificate

4. The server's certificate is the server's public key, some attributes (like what domain names the cert is valid for) and a digital signature of all that stuff

5. The browser has a list of certificate authorities

6. The browser checks whether the digital signature on the server's certificate is valid and was made by a CA the browser trusts

7. The browser checks that the certificate is valid for the site it's currently accessing

8. Connection legit

The problem that the CAs (including Let's Encrypt) solve is not distribution of public keys, but rather trusting public keys presented by someone.

> But how did Let's Encrypt get the public key from the domain owner?
> I know they make the domain owner install some software on his server

What the ACME clients do is two-fold:

1. They put up some sort of challenge response mechanism. This is used by Let's Encrypt to test whether a client is authorized to rule over a domain.

2. They generate (or use) a "Certificate Signing Request" (CSR). A CSR is basically a digital "sign here" field. The CSR contains the server's public key, what domains it wants to represent etc.. The CA checks the CSR using the challenge-response mechanism from (1) and then signs it digitally. The result is a certificate, which is sent back to the client and installed by the client. The private key of the certificate never left the server.

> If so, why is the Let's Encrypt software so complicated and not just a 5 line script or something?

Well it doesn't have to be complicated. acme.sh is only five (thousand) lines of shell :)

There are a bunch of ways the challenge-response mechanism can work, and there are also a lot of other options, which add to the complexity, as well as installation routines for certificates, which support a bunch of different servers.

A specific case with "static" challenge-response could conceivably boil down to just a dozen lines of shell or so.
to support the Super Bowl for instance you'd have to be fairly sophisticated.

That is a good point. Good old cable technology still has some advantages. From what I can find the current record for a single live video stream is 4.6 million concurrent viewers, and the Superbowl consistently gets over 100 million.
Ask HN: How can I avoid whiteboarding interview questions?
Are there any tech companies that don't do whiteboarding interview questions? I'm looking for a Sr. Engineer role and most of the companies in san francisco bay area seem to focus mainly on writing perfect but meaningless functions on a whiteboard as fast as possible. I have +10y or experience and would like to leverage that for my next gig beyond just recruiters. Not necessarily looking for a big name, been there done that. Today I just want to work on a cool project with cool people and still get paid for that. Who cares about binary trees for an extra few RSU's and a free t-shirt? Bring your dog, free beer, brand new campus looking like a college town... It ain't gonna do it. I have a family, I'm in my mid 30's.

Thanks
But you would put just any old solar panels on a road: See what is happening at http://www.solarroadways.com/ - it addresses at least some of the issues you mention.
Probably a human bias for us. We can pick out differences in human faces easier, so we can tell the difference in the images.

Looking at those pictures, I'd say that the monkey brain puts on 10 lbs.
The company was merely rebranding products they had purchased. Reselling rebranded equipment has a long legal history. No one was being ripped off as you put it, they were being paid for their goods.

We just had a Supreme Court win for the right of resale in the United States over rebranded refilled printer cartridges. Should Lexmark now be able to go to court in Canada and get the refillers delisted in the United States? It's literally the exact same issue.
> I'm not sure why we collectively decided to lack courage

In this case courage is stupidity. Why waste time knocking out their power when we can spend that time making our power more secure.
You're like a web master with a downed site due to a DDOS going:

> Well I've DDOSed the attacker's site so its okay

no its not, you've achieved nothing. Get with the program; this is a defence world not an offence one.
>I am simply addressing the fact that it's perfectly fine and common to have hosts with a hundred VMs and it works flawlessly.

And that was never the point.
Removing DRM is no longer so easy, now that Amazon moved their titles to the KFX format. Last I checked, the only way to do this was a clunky workaround involving either not updating your desktop Kindle software past a certain version, or downloading directly from your account page. The latter option is unavailable if you don't own a Paperwhite.
What worries me is the precedent for each nation to be able to enforce it's idea of what speech is okay on google, for the whole world. Does google just have to keep exiting markets when they have a disagreement about something, or do they keep delisting any result internationally to not offend Russia, or India, or whatever market next wants something removed. It was simpler to say "we don't do that outside your jurisdiction" before this precedent. I have no doubt they will be able to figure it out on a case by case basis though, it just gets far more complicated.
> My math profs always admonished us to ensure foundations are completely watertight before advancing to the next thing in tiny increments.

Of course someone who gets paid to teach would highly stress learning tidbits slowly and excruciatingly. That's their economic incentive. Schools also stress learning detritus for "learning's sake", even if the very people who teach it can't properly explain what it's actually for.

I also have learned compsci with his similar methods of finding interesting areas and digging in. I know my programming knowledge has holes, and I fill them in as I come to them. I like to know how things fit together, even if they are cross-domain and seemingly disparate. I come on in, and go "see these two areas are pretty similar, let me show you what can be done". And then I look like a miracle worker, because I see the generalities.

Frankly, professors would be more useful to me, if I could purchase their time by the hour over issues I don't understand. I can teach myself most things. Sometimes, a professional helps with the jump-start to get a good grasp.
That's my personal test. It has nothing to do with established law. She is writing a blog; original rights-holder is trying to sell a house. There is no particular reason why either one should "win", as they are not in competition.

Attempting to argue that to a judge that does not employ the same boundary test is therefore likely to fail.

I get these types of responses all the time, whenever someone detects that I am crossing onto foreign turf. The law does not belong exclusively to legislators, judges, and lawyers. I am entitled to have an opinion that conflicts with established precedents. And as many of us are painfully aware, the law is sometimes an ass.
> I'm not entirely sure how we start to fix this.

This needs to be solved at regulatory level. High computer security standards need to become part of whatever work and product safety rules companies already have to follow. But that doesn't look like is going to happen soon, so as an alternative...

Did Maersk recover from that ransomware attack two days ago?

I sincerely hope they didn't. We need an economically meaningful clusterfuck to get people to pay attention.

Related: I think the only way for security to get taken seriously, by both companies and governments alike, is to have someone do some high-profile, damaging hacks "pro bono". Now I would hope such actors stay away from power systems due to risk of loss of life (don't want to disrupt traffic, or hospitals). But this was yesterday on Morning Paper:

https://blog.acolyer.org/2017/06/28/an-experimental-security...

I'd say industrial robots could be a good target. If someone started shutting down the plants of some prominent manufacturers of non-life-critical products, maybe enough people would lose money for someone to start treating it seriously...
Completely agree. If someone would make something like Windows Explorer for Mac, I would totally buy it.
I love letsencrypt but I wish they would hurry up with deterministic dns challenges. It would make securely automating certificate renewal vastly simpler and easier (especially for certs that are being used for non www serving endpoints e.g. mail servers etc).

I worry that at the moment there are probably a lot of systems out there that leave DNS API keys lying around on endpoints because it's easier to automate the renewal than write a convoluted two stage ansible role/play that delegates sensitive actions to the controller running the play.
1998 Internet Commercials :)
Here's hoping. Although I'm not sure how well it'll be received, given that (IIRC) there's not a single explosion in the entire series.

It might be interesting if they went in more of a direction of "House Of Cards In Space" rather than "Game Of Thrones In Space".
The multi-core matters more if you're going to call a laptop "pro", imo.
1. Agreed this is a problem, but it's not unsolvable.

A pilot project of peer review as a service could ferret out these issues and come up with solutions. Here's a couple of ideas: (a) let authors give feedback on reviews for editors to consider when assigning this reviewer to future manuscripts, (b) require public disclosure of who reviewed the paper (this presents other problems, but should at least be considered), (c) editors can bring on 4th or 5th reviewers as needed if authors/editors/reviewers feel it is warranted (after seeing all 3 initial reviews)

2. Time is worth more than money. Remember it's not only the PI but also the postdocs and grad students who are not productive while they work on review/resubmission related work. I bet many labs would be glad to pay this amount of money for a single review process.

The goal would be for single-review-per-manuscript to be able to replace journal reviews in most cases. Sure, some top flight journals may require additional review--and that's fine--but those should eventually be outliers, not the norm.

I don't agree about the perception issue for a reputable source which is providing a tangible product. The authors end up with a peer reviewed manuscript that is citable. Call it biorXivGold or something like that and you're done.

^^ This red team/blue team (peer review) on this idea is a microcosm of the best part of science :)
that's the kinds of insightful comments I come here for. Side note, I remember in a gift / greeting card shop growing up, everything had long numbers printed on a little sticker on the back, turns out the price was just the last 4 numbers (divided by 1000).
http://goldigger.io
> "If you're a tech person (indie developer?), put yourself in the shoes of the person being ripped off, and tell me how you'd justify letting the scam continue"

Because doing something is not necessarily better than doing nothing if "something" doesn't solve the problem. What happens now when Datalink registers a .org to circumvent the block? Equustek are back to square one playing whack-a-mole, having achieved nothing and have forced Google to damage their own product in the process.
Both Mozilla[1] and Google[2] are on the record as saying that they don't believe CAs should be the ones to detect and block domains used for phishing and malware. Both are also platinum sponsors of Let's Encrypt.

[1]: https://groups.google.com/forum/#!msg/mozilla.dev.security.p...

[2]: https://groups.google.com/forum/#!msg/mozilla.dev.security.p...
Regulate operating systems. Fund programs and research to work out how to create operating systems for our infrastructure that contain less zero days. Ensure we're the ones that find the zero days first.

The reason we're vulnerable is because we're unwilling to pay the cost of finding the exploits but people in developing nations ARE because they work for "less".

Right now our economies and systems reward those that fly by their pants and don't care for security. That is the problem. The free buffet of infinite growth from technology startups is the very thing that also gives us this pain and we need to learn to eat less.
Nice to have it here in my country and nice that this story was picked up, but worth to comment here that this is a brazilian branch originated by an australian initiative: https://privacyforjournalists.org.au/
from this organization: https://cryptoaustralia.org.au/

All of that is clearly referred at the story and at the brazilian website, so no call out here, just pointing the sources directly.
Mayer knew exactly what to do with Yahoo: convert it into money. That's what people wanted and that's what she did.
In the thread yesterday I asked tptacek:

Could you tell us/me about your background in this area? I looked you up, you seem to be a computer security guy.

Yet you are talking like you have pretty deep knowledge about biology and oncology, certainly more than I would claim to have.

Just wondering.

No answer there, maybe he missed it and will answer this time.
I can name at least one netsec guy who attributes his entire team's existence to the NSA calling his employer and doing exactly that.
True, but the developers of those open protocols have no or little financial incentive for the success of their standard. Traditionally closed protocols had the financial incentive. Blockchains are different in that way.
No offense, but you're showing off your lack of understanding. Some people do use Twitter to tweet at their fave celebrities, but that seems to be more of a minority use case. It is useful to tweet directly at brands, especially when you need product support, but again, it's a minority of uses.

In my circles, there's Weird Twitter for creativity. Political Twitter, which is now a dominant form of medium-length blogging where the punditry is broken up into 140 character paragraphs. Art Twitter sending out all sorts of photos and paintings. Cute Twitter for DogRates and other forms of reporting on fuzzy things. Twitter is still good for breaking news, and for on-the-spot reporting. Even great for weather. I live in a stormy part of the country, and hitting #kswx can be good on bad nights for getting reports from the people around me.

And, of course, it's the premier way for the leader of the free world to spit his thoughts directly at the public.

They may not have found any way to make money, but Twitter is a core part of internet culture. It's like Instagram, Reddit, Tumblr, etc., that it's so big, it can't be pinned down to just one aspect or another.
It would be a lot better without karma.
Snowplow Analytics - https://github.com/snowplow/snowplow
Pittsburgh has lots of wildlife as well. There have been so many rabbits this year. Almost any park is full of them, bike through and see them scatter. I've seen lots of turkeys around, and even walked up on one on the sidewalk.
In Windows Explorer I can just copy the address bar and paste it into another window.
Thus ushering in a new era of peace and prosperity for the termites scuttling through the ruins of human civilization. Sounds like a plan.
> Prolog-derived languages go even more nuts with ; and . than C-style terminators.

What do you mean by this? In Prolog, (;)/2 is simply a binary infix operator, so that you can write a term of the form:

;(A, B)

i.e, a binary term whose primary functor is a semicolon, equivalently as:

( A ; B )

where the semicolon now occurs as infix operator instead of at its canonical position at the beginning of the term.

In Prolog, you can always use the predicate write_canonical/1 to obtain the canonical representation of any term, which is completely regular. In the case above, we get:

?- write_canonical( (a ; b) ).
;(a,b)

This confirms that (a;b) and ;(a,b) denote the exact same Prolog term which cannot be distinguished at the AST level.

We have also several other ways to inspect the term, such as functor/3:

?- functor((a;b), Functor, Arity).
Functor = (;),
Arity = 2.

As expected, this again confirms that the primary functor is the semicolon in this case.

Further, the period '.' has a dual role as the primary functor for non-empty lists, and also to mark the end of a term.

For example, in a Prolog fact of the form:

hello(world).

The period states that the term is complete. If it were not used, the term could have continued for example like this:

hello(world) + universe.

In that case, (+)/2 is the primary functor, as can be verified with:

?- write_canonical(hello(world) + universe).
+(hello(world),universe)

Thus, '.' is used to mark the end of clauses, since each clause is a valid Prolog term.

If you want, you can always use the canonical representation of Prolog terms in your code. However, this would make writing and reading Prolog at least as inconvenient as Lisp, because you then have to write everything in prefix notation instead of being able to benefit from infix operators too.

For example, using prefix syntax, you would define a Prolog rule as:

:-(Head, Body).

whereas with infix syntax, you can write the exact same term equivalently as:

Head :- Body.

Similarly, you would have to write:

#=(X,+(5,3))

instead of using the typical infix notation for arithmetic predicates and expressions:

X #= 5+3

Note that since the respective abstract syntax trees are completely the same, Prolog remains at least as amenable to metaprogramming as Lisp even though Prolog supports more flexible syntax!
The graph of HTTPS percentage has some sudden massive dips a little bit ago. Does anyone know the reason for those?
Since we're talking about a case in Canada, it's also worth noting that the RIAA is also trying to exclude "fair use" from the renegotiation of NAFTA.

http://www.michaelgeist.ca/2017/06/naftacopyrightcomments/
You can't learn programming without doing stuff, but to understand what you're doing, you need to learn some facts - and books have one of the best, if not the best, ratios of learning to time spent.

(In fact I'd be worried to work with programmers who didn't back their experience in their primary language(s) with at least one solid book.)
Not defending O'R, but what conferences pay speakers' fees and reimburse their costs these days?