skysight-inc/HackerNews huggingface dataset:
Back in those days, Windows had an absolute lock on the industry for several reasons:

1: it was the incumbent

2: there were no hardware drivers for any other operating system

3: there was software for Microsoft operating systems, and no useful software for any other OS

4: Microsoft has legal contracts with the hardware manufacturers which required that a icense fee be paid regardless of whether or not Windows shipped with each machine.

5: probably more reasons

As an outcome of the above it turned out to be impossible for any other OS to get a foothold on the PC. It's hgard for people to understand now, but there was still an opening for some other OS to get a foothold.

In the end, another OS turned up and started making major headway on the PC. It succeeded against Windows in the way that such battles tend to be played out - by playing to a different set of rules. That OS of course was Linux and its rules were to be free, to have a collaborative development model, to be server focused, and to have the fortunate timing of being at the start of the era of connected computing. I remember being startled that I could get a free operating system by buying an issue of a computer magazine at the newsagent with a CDROM on the front containing Linux.

Eventually the seemingly impossible happened and an OS came along that beat Microsoft on the desktop, or at least competed effectively with Microsoft Windows - and that of course was OSX. And OSX against succeeded by playing to its own rules. No need for hardware drivers for every device under the sun because they it only ran on Apple hardware. It had applications from the Macintosh user base (and Microsoft), and turned out to be a really nicely integrated and functional OS (IMO).

Its a pity GEOS didn't make headway, at the time I really wanted SOMETHING, ANYTHING to give Microsoft effective competition because it looked back then like it was going to be 1,000 years of Microsoft in first place with no second, third or fourth place runners up.

BeOS also gets points for having a try at competing with Microsoft.
Quite a few links and sites offline - e.g. the top network tool, the top text tool.. :(
> It's been 17 years since 2000. Whatever security hole you may have used (if any) has long since been patched. The weak cyphers used in some SSL versions which you may have depended on are mostly gone (certainly from high profile targets).

I very much doubt he was even doing anything that clever. Since it was a corporate network he probably just had their corporate CA certificate already built as part of the company machine images / build scripts. He possibly might not even have been aware this was happening if the IT department was large enough that different coworkers managed the desktops from himself.

The "I can't disclose much" argument on a 2 decade old hack is effectively just saying "I can't remember the details" or "I wasn't directly involved in setting up the proxy". Either way, while much has changed in the last 17 years, the practice of some businesses installing their own CA certificates on company assets has been a fairly standard way for corporate proxies to intercept HTTPS traffic. And a great deal less trouble than relying on SSL vulnerabilities since you already own and deploy the destination hardware+software anyway.
CM-Alliance’s breach management workshop is awarded respected GCHQ certification
> 1) internal corporation services, websites and webapps

If not for hostname validation, how would you even /know/ that you're talking to the "internal corporation service" rather than someones MITM proxy? And how would you feel if people on the same LAN could see and modify all your interactions with those services?

2) services that run in a local private network like on a Raspberry Pi

Depending on the type of service you may or may not want TLS. If you visit the service by IP address and specific port anyway, you can easily add an exception for your internal IP. This will never be used like so by non-tech-savvy people.

3) webapps which are served via public HTTPS website, but need to talk via CORS to local unsecured services

I cannot think of any reason to /not/ want to use HTTPS on this. It's horrible how things like the Philips Hue bridge work and rely on insecure HTTP to control your home lighting.

Don't blame browsers for warning people for their insecure systems and appliances. Instead blame their creators or manufacturers as they're the ones who can fix this situation.

edit: formatting
It's 5M Concurrent Users. And Google-size services can't be built with just a language. It needs much more work to do.
How do you feel about the security of the products? 20 year old PHP versions and the company itself was scammed out of tens of millions of dollars. I see good reviews from bloggers on the hardware, but the company doesn't seem to have made security a priority.

One recent example, there are plenty more out there: https://www.theregister.co.uk/2017/03/16/ubiquiti_networking...
> AFAICT, one cannot.

I believe so too. OpenPOWER and RISC-V show great promise but I am not aware of any significant tape-outs for either (and not to mention you have to have consumer motherboards et al that are compatible with the chipset).

The nice thing about OpenPOWER is that there are many distributions (openSUSE is one that I know for sure) that provide some support for ppc64le and thus the transition shouldn't be too painful from a port-the-distro perspective. RISC-V also will have similar support once it's merged into the mainline kernel and also once distributions have significant confidence to spin up some QEMU build images for RISC-V.

> I'm willing to pay more for processors that aren't thus afflicted. Is anyone at AMD, Intel et al listening?

I am inclined to believe that the reason is economic rather than them just being evil (that doesn't mean that it's not a horrible misfeature that mistreats users, I just don't think that the inclusion of ME on consumer hardware was an intentional decision). Intel ME is "required" for enterprises because sysadmins want to be able to control all of the machines they provide their employees (you can have varied opinions on whether that's ethically acceptable, but that's the reason).

Given that consumer hardware generally comes from the enterprise world after it has dropped in value, I would not be surprised if Intel ME was left in consumer CPUs simply because it was cheaper than removing it. There's also the (weaker) argument that an enterprise should be able to use Intel ME on a BYO-device system, but that strikes me as unethical.

You might be willing to pay extra for Intel ME-less CPUs, but have you seen what the bill is for a full tape-out? There needs to be significant market demand for something like that.
I didn't say that. Very common mindset error to put words in someone else's mouth.
Not really. You put nginx in front of Varnish and terminate your TLS there. It's not that much more work. Hint: make sure you have an X-Forwarded-For entry in your nginx config. Your root location would look something like:

location / {
proxy_pass http://localhost:8082;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Port 443;
proxy_set_header X-Forwarded-Proto $scheme;
}

Assuming your Varnish setup was serving on 8082.
Hacker News Corpus
> I once had a volume knob widget on my task bar that used 4 meg of ram. Somehow I feel it could have been done better.

Yesterday, I decided to finally retire my old self-written 'sticky notes' utility, and migrate all my notes to the built in Windows 10 Sticky Notes.

* My note app: ~3mb whilst running.

* Win10 Sticky Notes: ~22mb whilst running.

22mb might not be a lot of ram, but I do struggle to understand how it's using that much memory just to display small squares with text in them...

...

Anecdote: Two hours later, whilst trying to copy-paste text from one note to another, I lost the text completely, and Sticky Notes crashed... ~sigh~ back to my crappy app then...
Not sure, but maybe Google is just using some readily available set of topological data? The hole, being man-made, would display as flat in the same ways that do the buildings of Mirny.

I know for a lot of places, Google use fancy algorithms for extracting information about buildings and trees, and those algorithms never cease to amaze me. Anyway, Mirny is clearly not one of these places.
"You typeset all your lecture notes? I'm not sure this would benefit a student."

The poster is doing this in addition to actually writing the notes - I've done something similar. Sometimes I take the initial notes on a computer. Later I hand-write them once or twice. Once immediately and once later on to narrow focus down on things I was having more trouble remembering.

The biggest benefit is that such a system gives some repetition. For me, this repetition is superior to only reading notes because I wind up working with the information physically as it changes form. I do get better results in some subjects if I work plenty of problems in addition to this - for example, foreign/second language and maths.

The only times I've found this sort of thing generally unhelpful is with things like music, art, and physical education/sports. These rely on a lot of muscle memory, and it is hard to get by writing.

The common thread in all of these is practice and review. The main difference is in the way they are carried out.
Five-question survey on software documentation, win $500
Metal is fine and supported by all relevant engines, thanks.

As the name says, DRI3 was yet another attempt to improve the whole performance stack on Linux.

As mentioned, I did my share of FOSDEM sessions.
I didn't notice the author, thanks for pointing out. I remember passing the time between college classes reading Bad Astonomy in the computer lab. In 1997. Over a decade for sure...
That's a cool observation. You could then forget about this whole event and remember it again at the age of 90 and write another comment saying "I remember back when this was discovered"

Human bodies are very chaotic in their responses to stimuli due to the ability to react to old old memories...
How to Install Microsoft PowerShell on Linux or OS X
I did also mention that for fast time to market it is indeed a good idea to use already available tools. By the way writing a distribution layer is not that difficult. Many companies/startups with scalable back-ends that are not using Erlang/OTP have already done it. The point is scalable software requires knowledge and Erlang/OTP is not going to magically solve it. But it seems many fans are trying to promote it such that it is a magic tool that is going to make a shit software become a hyper scalable one. Just look at the comments below that how people have gone crazy.
When I want to be super productive I'm listening to The Lord of The Rings Soundtrack. It feels like I'm doing some epic coding things. Just imagine when you are doing git push while there is Themes Of The Rohirrim playing.
Kind of, because it is built on top EGL so everything is done via the 3D stack.

On X there is a mixture of X protocol, 3D stack and the interactions among all possible combinations.
FYI to the OP, the website shows a blank page when JavaScript is disabled.
If there ever was a fire-sale. Thrustworthiness, get it while its red-hot.
For Google to do this, there is a competition aspect to it. Pop-unders compete with Google.

That said, something needs to give. Particularly disturbing is news sites. Otherwise reputable news sites are willing to put up the sleaziest "monetization" on their sites. Pop unders, pop overs and extremely dishonest advertising, especially under the "native ads" umbrella. Many of these are advertising fake news, fake products, fake customer stories.

There is such a thing as advertising standards, where advertising standards. It works differently in every country, but the mechanism is generally 2-fold. (1)Some sort of advertising authority regulates the media side: they can complain/accuse TV stations or print papers. (2)Regulated industries (drugs, financial services) have a regulator that holds them to advertising standards. This part still works, but no one seems to have the ability/jurisdiction to complain about online advertising.

At the very least, I'd like to see national advertising standards authorities ban the use of certain ad aggregotors on local news sites, if they violate advertising standards. Many of these ads are ilegal anyway, I think.
By which the author means "massive-scale internet company". Needless to say, it's possible to be an "internet startup" without becoming a publicly listed behemoth or selling yourself to one. It might be more difficult now to build a massive-scale internet company from scratch - and perhaps antitrust regulation of internet companies needs tightening. But it's much easier now than a decade ago to build an internet-based business that allows you to do interesting work and have adequate income.
Build your own Android auto headup display
Something like (assuming you've reviewed the terms of service):

apt install letsencrypt
letsencrypt certonly -d example.com -d www.example.com -m you@example.com --agree-tos

And then add a weekly cron job with:

letsencrypt renew

You need to stop your server for these actions, though I'm sure there are ways to avoid this.
Authentication bypass on Uber’s Single Sign-On via subdomain takeover
The duct tape holding the internet together
Yeah. Linux is not like that any more.

Try Linux Mint. The only configuration you will do is to enter your username and password.
Big Software
Anyone can easily find me on the net and I don't need to have fun speaking with lawyers.

Believe me or not, I don't care.
Already posted comment on FCC website supporting net neutrality and urge other people to do so as well.
I feel you. I'm also stuck with IE11 for the time being. No CSS variables, no ES6 symbols. Babel takes the edge off it but there's still plenty we're missing out on for the time being.

Not so long ago, we had to support IE8. Before that, IE6. If you go back a little further IE5 for Mac was the biggest pain point. Before that, Netscape 4 and IE4, which were often mutually incompatible.

There will always be a legacy system many people have to support at any given time. But over time the number of people that has to worry about it will shrink along with its market share. You probably don't see many support tickets about Netscape 4 these days anymore.

Having these standards today means the next generation of legacy browsers will support them when you're stuck with them in the future. That you're not chasing the bleeding edge doesn't mean you don't benefit from these advancements, just that you'll do so with a delay, and likely far less gradually than those privileged enough only to care about the evergreens.
That's a silly assertion and needlessly hostile to Fedora.

I have tons of experience with all the major distros and Fedora is my pick for desktop use. I don't work somewhere with an RH contract, I just like it. There are other good desktop distros but Fedora suits me. It's a good blend of cutting edge and stability, it has very good docs, has a large community, and it is 100% open source (I can still choose to install proprietary stuff if I need a driver or something, and there are usually already rpms in a repo for it if I do).

So, "hi", you've now met someone who uses Fedora willingly (enthusiastically, even).
MySQL has caused so much pain with their decision to make latin1 the default encoding.

I've seen so many PHP apps that store UTF-8 encoded text in Latin1 fields, and it kind of works, until you correctly configure your client library, or try sorting the data, or check for equality...

The problem is so common, that the popular MySQL client app Sequel Pro even has an option to set the encoding to "UTF8 via Latin1", which tells the server to output Latin1 but then treats the result as UTF-8.

So once you learned this the hard way, you'll change the db encoding to utf8, and you'll be glad to have finally fixed the encoding mess, only to stumble across the fact from the original article that utf8 is not really utf8 in MySQL --- oh the horror!
SSL 1.0 wasn't even supported by many of the earlier builds of Internet Explorer on Windows XP, with SSL 2 getting deprecated around the time of XP. Even SSL 3 - the last of the SSL protocols - has now largely been deprecated bar a few misconfigured servers.

Furthermore TLS 1.0 has been supported since XP but even that is now in the process of being deprecated.

So your attack, if it did depend on SSL v1.0, is so outdated that it's not even worth mentioning. And certainly not in the way that you announced "let me tell you it is quite easy to MITM by any company owning part of the connection."

(Please excuse me using "Windows XP" for approximate timeframes. I can't remember the exact year for when these protocols were phased out but I can remember which devices we had to support).

edit: It was bugging me that I didn't really know much about SSL 1.0 compared with the later protocols so I decided to do a bit of reading. It turns out the reason I don't know much about SSL 1.0 was because it was never publically released[1].

Which makes me even more puzzled about your anecdote as why would you even want to run an SSL 1.0 proxy when even back in the year 2000 no devices were supporting it. Either way it's certainly not proof of the ease of which SSL can be MITMed.

[1] https://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_1...
Being a human photocopier in maths/physics lectures was the worst thing about university, when you're 6 blackboards behind. That was in 1999, hopefully it's changed now.
When I access that playlist, it shows the video is not available.
The Outlaw White Walker Porsche 356B Is a Perfect Mix of Old-School and New
Alphabay Exit Scam
What is AT&T's stand really on net neutrality. They were the ones who started this whole thing and now they have come to forefront to join the protests. Old school cable companies are just hypocrites who are adept at creating artificial moats to justify their lack of innovativeness
All of the above plus System of a Down, Limp Bizkit, Linkin Park and various other nu metal bands.
> I don't really consider law research and public policy research as real research

That's the topic of the article. Could you be any more disingenuous?
Here are the apps you can get without spending a single penny
> JVM - Bytecodes only for Java

Although it should be mentioned that java language semantics are largely (depending on how you measure them :-) absent from the jvm. (Default methods were a very unusual change in that respect)

And, as you say, subsequent history has weirdly inverted the JVM and CIL. The former is a lot less 'J' and the latter is a lot less 'C' ;-)
You know there are discord bots for bridging between IRC and Discord?

Pretty funky :-)
> Metal is fine and supported by all relevant engines, thanks.

thanks for the laugh
What is CollectNode?
http://hello.p5js.org/
A sieve is literally a filter...
No, they only get a graph of the volume of each slice. They have to do this many times and compute something like a Radon transform (computed tomography) to reconstruct the shape.
Will Apache Spark Finally Advance Genomic Data Analysis?
Libraries don't implement ES, JavaScript engines do.

And JavaScript engines don't implement ES editions, they implement ES features. These features now have a five stage process ending with their inclusion in the next edition of the language spec.

Most engine vendors want to be on the bleeding edge, so they start implementing features long before they are fully stable.

The reason the editions are symbolic at this point is that they are just snapshots of the collection of features that have reached stage 4 by the time they are published.
Well it's my lan, and I can decide what I trust and what not. For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs.
If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https.
Yes absolutely.

If I have to I trust the company's CA in a special browser profile that I only use for working with their internal tools.

For just a few tools it's often simpler to just trust those specific certificates, though
I wanted to check it out. Installed sox on Ubuntu 17.04 and it's not working

sox FAIL formats: no handler for given file type `coreaudio'
Chill stuff/Wave music

https://soundcloud.com/dvrksea/youre-in-my-life

https://www.youtube.com/watch?v=O4w7vgHnrYA

https://www.youtube.com/watch?v=g1yBhxn7H5o

Can't listen if I'm venturing into new territory; learning requires quiet. Otherwise it's Wave music. eg wave, vaporwave, synthwave, witch house, future funk, future beats etc
other countries like the US? haven't you heard of episodes of warrantless mobile phone searches at airports?
> Starts sounding like a government that enforces contracts, so that's not entirely new :)

The difference is that you can cryptographically verify the correctness of the enforced contract. You don't "Trust", you "Trust, but verify".
FCC has already received more than 6 million comments. Ignoring the voice of millions of citizens just shows what real motivations of Trump backed Ajit Pai is and whose interest they truly serve. And the worst part is they are doing all of this in the name of 'Restoring Internet's Freedom'
You can only send strings to webworkers in javascript. Without shared memory you have to send a serialised copy of your data to the other process which then has to deserialise it. In most cases this is perfectly fine. But if you have a lot of data then moving it around might take more time than the computation itself. In this case you're forced to use shared memory.
HN has two very divergent opinions on JS but the people who hate it really hate it,and the people who like JS may outnumber the ones who hate it but you can reliably expect people to complain about Javascript on every HN thread about it. JS is third in dislikes on there (Java is actually the second-most hated language, who knew?), so I wasn't technically correct but I was in the ballpark.
It has to change enough to the point we call it something else. It's agreed by most analysis of Earth System Science that we are going to need to "grow less" from a capitalist/contemporary economics perspective. Our view of production right now is the same since the industrial revolution. So yeah, if we are going to keep on something close to the capitalist framework, it is not enough to change circumstances but the framework and its view of progress itself. So call it what you want, but we need a fundamental change in our economic system to survive climate change without killing half the world population.
To be fair, ES module semantics were not part of ES6. ES6 only defined the syntax. The appropriate semantics for implementing ES modules are currently still not 100% stable last I checked, especially because of Node which had its own module system already that needs to be unified with ES modules somehow without breaking everything or making it awkward.
Fluentd + Logz.io + Docker