skysight-inc/HackerNews huggingface dataset:
A public domain name costs the price of a coffee (and less than a raspberry pi) and you can get a certificate for free with Let's Encrypt. There is really no reason to resort to a private CA unless you want to MITM your client's connection.

You don't need to expose your server to the public internet to use let's encrypt. I use DNS authorization and it works perfectly.
You would be surprised.

For one, Fedora is the open, no contract, version. And yes, tons of people use it, including on the desktop.

Second, even for the "enterprise" version, tons of businesses use Centos, which is kind of like RHEL with no contract. It's immensely popular.
The article is not mentioning that QE flooded the capital markets with money globally.

Money which mostly sits idle (they are so desperate that they buy bonds with negative interest rates).

This over supply of money and the lack of investment targets, eased raising of money for VCs.

More money, more VCs, more funding, more pressure on VCs to deliver returns, less interest in radical new ideas.

In other words VCs got an incentive to look for proven business models to invest in.

That also explains the success of angel.co.

I think the bigger problem is that capital allocation for new startups is broken. There is so much free capital in the market, and only a tiny percentage makes it into startups, globally ca $120bn per year. Compared to trillions of dollars floating free in the markets, that's a drop in the ocean.

Venture activity is also concentrated in a few places. It isn't widespread enough.

-> capital allocation for new ideas is ineffective and inefficient, the current model of investing isn't sufficient anymore.
All US patents have the same standard. Among other things, they must enable one of ordinary skill in the art to practice the claimed invention without undue experimentation.

For SW patents, if your invention uses machine learning but is not inventing a new kind of machine learning, there is no need to describe how the ML package works. It is a black box.

Similarly, a gadget patent does not need to describe the metallurgy necessary to make aluminum sheet metal or how to make plastic.

The same standard applies to biotech patents. Though, some biotech patents require proof or disclosure of experimental results (e.g., gene sequence listings, etc.) this is because some bio inventions would be very difficult to reproduce without the extra information.

Trade secrets are not protected from independent discovery. Reverse engineering is generally fine, though it may violate your license or the DCMA depending on the details.
Naive Bayesian Algorithm
I dislike intranet CAs because they allow your company to intercept and play MITM with every other website you visit (except for certificate-pinned websites)...

I'd prefer that Chrome write "insecure" if there's a non-public CA in your chain.
Local packet filtering with IPv6
Users are tuned to seeing green icon, and secure as trustworthy. This is over a decade of UX towards these. Suddenly seeing "Not secure" will definitely have an impact on engagement. (I know we're both guessing -- we'll have to wait for concrete numbers to make a call). I'd mark the engagement change at around 10%, and 20% for any site that is login/payments related.
Your quote is incomplete, the next two sentences are an important part of it:

" How far away is it?

Over nine billion light-years away."

To see the light of a star that far away is indeed "incredible" as in "so extraordinary as to seem impossible".

The following paragraphs then explain why it appears to be legit (" Then I read the paper, played with the math a little, and, sure enough, this appears legit.").
Oh, I don't know. JK Rowling rewrote Charlie and the Chocolate Factory and added wizards and no-one's complained. :p
...but those services, served over HTTP, are not secured and can be spied upon by your insecure Chinese webcam or by the 3% of routers that have a malware, isn't that correct? So the browser should display so, it's up to you to ignore the warning.
Tell me about it.

It's even worse as a Mac user. I'm currently in the process of replacing my aging iMac with a new one and since I need about 1 TB of storage and won't allow any spinning drives, Apples wants me to pay about 840 € for upgrading the default fusion drive to their 1 TB SSD, which is of course very fast storage, but painfully expensive. I'm actually considering opting for the smaller 512 GB SSD and getting an external 1 TB SSD from Samsung later.
Knowledge and tools to protect your privacy
The quality of programmers working for companies like this is terrible. I'm talking about programmers who claim to "know" C++ because they used it once during a computer science project and just managed to avoid getting segfaults too often after lots of trial and error. Writing a small, effective program has been a sign of competence forever because we know that you can't "fake" it. You really have to know what you're doing.
What video? I'm on mobile and there isn't one in the index page. "Request desktop site" is not honored either, as usual.
Charging for receiving is mad. Are they chargign for receiving letters as well? You can make someone pay by sending sms to them, this is crazy and evil.
Sure, absolutely - but that hole is already there. Is there any way to use it for generating energy somehow?
> eventually, hopefully, I'll disallow websites that don't have HPKP with long expires

I doubt HPKP will ever see wide adoption. At least not in the form it has now. It's just too damn easy to bork the config and take your entire site offline with no way to remedy that error.
Lennart Poettering is not the only systemd developer.

This is a point that bears repeating, so I shall.

Lennart Poettering is not the only systemd developer.

In all of the discussion of Lennart Poettering's reaction to the User=0pointer gives superuser rights bug, almost no-one has looked at the other systemd developers. I have had to point out several times Zbigniew Jędrzejewski-Szmek's reaction, which was to work on https://github.com/systemd/systemd/pull/6300 .

Or you might want to look at Martin Pitt, the systemd developer who famously turned back off systemd's widely problematic DefaultTasksMax setting, for Ubuntu. https://news.ycombinator.com/item?id=11675133 https://anonscm.debian.org/git/pkg-systemd/systemd.git/tree/...
I don't know who downvoted this; I'm stating facts.
This Video Shows How a Drone Creates Airport Chaos
GitHub now uses Kubernetes
RubyMine Tutorials
Wes? ;)

Also, ditto - Prog and power metal seems to kickstart my brain and has often helped me out of nonproductive slumps.
The thing about electron is, there's a time and a place for it.

VsCode is an excellent use case for electron - a complex cross platform app with a very quick release cycle, a large plugin ecosystem and a requirement for display and processing of a lot of different types of markup.

But I've also seen a tray notification app worn in electron. It didn't even have a UI. There's also an sd card formatter, and a "quick" launcher.

Devs who wasn't to release some tiny single function app like this should rightly be ridiculed for using electron, but more complex stuff (gitKraken etc) should get a pass. Building a large, complex editor is hard work
> I don't know who this analysis is aimed at...

I can answer that - this is a slightly edited version of something Avery wrote internally when we were both working on wifi routers for Google Fiber. Imagine that you wanted to explain to someone why it's hard to build a good wifi extender/repeater (and therefore why you need additional headcount to do so).
You're loosely describing the 2nd attack I mentioned but overlooking the issue of the SSL handshake. You cannot perform your attack without having the server's private key, which as name suggests, is privately stored on the remote TLS endpoint. The private key is used to confirm that the client has received the websites certificates without getting MITMed. Since you don't have the websites private key you cannot use their public key in the way you described.

The workaround for that is to create your own SSL certificate for that website (this will create you a public certificate and private key). Which means you will also need that new certificate CA signed otherwise the client (who's own SSL validations you cannot remotely disable like you implied) will give the user a warning about an untrusted certificate (the message will vary from client to client). This means you either need access to the targeted client to install your own CA certs, or you need access to a compromised signing authority.
The problem is not and has never been the syntax. It is the tooling. No build tool. No way to generate a new project. Do it yourself docs. No templating system. Macros ala C. No package manager. Building releases was a dark art.

It is now getting better. But it was a really steep curve to adoption.
Warn: mysqldump is broken (5.7 and json)
Netflix joins Amazon and Reddit in Day of Action to save net neutrality
Sorry but I have to call BS on that. I always bring my own device and never have bypassed certificate errors. A company will either have certificates for their own apps (commonly running on specific subdomains of their own domain) or have their own internal CA that you can trust on your own device.

Certificate errors on "internal" web apps are just as bad as on the rest of the internet.
There's also the metric expansion of space to consider:

https://en.wikipedia.org/wiki/Metric_expansion_of_space

"galaxies that are more than the Hubble radius, approximately 4.5 gigaparsecs or 14.7 billion light-years, away from us have a recession speed that is faster than the speed of light. Visibility of these objects depends on the exact expansion history of the universe. Light that is emitted today from galaxies beyond the cosmological event horizon, about 5 gigaparsecs or 16 billion light-years, will never reach us, although we can still see the light that these galaxies emitted in the past."

So we may be able to see light from objects that are further away today (if they still exist) but when they emitted the light they were closer than that.
It's arguably more secure than letting cloudflare do it (adding a new party doesn't make the chain more secure) but it doesn't have to be more secure than using githubs cert. It's just that you can't use githubs cert with your own custom domain.
> My student society for example

> need to expose critical internal services on the public internet, some of which contain private user data.

The heck? Are they aware of this? Might you get sued for this?
Saying sorry is:
always the right thing to do
not an admission of liability
acknowledges that something could have gone better
the first step to learning from what happened and
preventing it recurring

This is very, very wobbly advice if you're dealing with a difficult client. I have had a number of situations where my natural English politeness has led to my offering apologies for situations that are 50% or less my own fault, and clients have leapt on this and translated it into everything being my fault. I very much steer clear of using the words "I'm sorry" or "I apologise" now, and usually opt for fairly bland passive voice phrases like "I appreciate that there has been some degree of frustration", followed by a summary of what both parties can do to improve matters.

I also just flat-out disagree regarding liability, though I presume this must refer to a specific legal perspective in this particular context.
And why would I trust a company I work at to be able to sign certificates for every single website on the internet? Especially if I need to install that root certificate on a personal device?
Probably the same reason you have people using XML for supposedly human read/writeable config files: it's hip.
It's already a bit of a pain, as at a dollar or a few dollars a month it's approaching or over the cost of some servers I want to run.

But I expect things will continue slowly being replaced, as more switch over the stress on IPV4 lowers.
I think its less about a hard limit and more about comparing to other apps out there that do the same thing. Music players for instance. 1by1 < foobar < VLC < Songbird / Spotify
This is a great book and unique. I am impressed he ported his demos.
If you trust a company's internal CA then aren't you trusting them to issue certificates for every website and not just their own? Isn't that dangerous?
Does that mean Hilton makes 15€/day injecting users who don't secure their traffic?
It depends on what they're used for but I agree that many companies seem to spy on their employees this way.

Commonly I only allow internal CAs for specific internal websites and not allow them to MITM just any website. On occasion this meant not being able to use the company's wifi and deal with 4g instead.
Snap and Blue Apron Continue to Plunge
PCI Data Breaches: Keeping High-Risk Employees at Bay
> “The personal, as everyone’s so fucking fond of saying, is political. So if some idiot politician, some power player, tries to execute policies that harm you or those you care about, take it personally. Get angry. The Machinery of Justice will not serve you here – it is slow and cold, and it is theirs, hardware and soft-. Only the little people suffer at the hands of Justice; the creatures of power slide from under it with a wink and a grin. If you want justice, you will have to claw it from them. Make it personal. Do as much damage as you can. Get your message across. That way, you stand a better chance of being taken seriously next time. Of being considered dangerous. And make no mistake about this: being taken seriously, being considered dangerous marks the difference - the only difference in their eyes - between players and little people. Players they will make deals with. Little people they liquidate. And time and again they cream your liquidation, your displacement, your torture and brutal execution with the ultimate insult that it’s just business, it’s politics, it’s the way of the world, it’s a tough life and that it’s nothing personal. Well, fuck them. Make it personal.”

― Richard K. Morgan, Altered Carbon
Payday Loans for People on Benefits – Sufficient Cash Deal
Do you feel that there is a difference in innovation between software and other fields?

The obvious next steps you are talking about are usually only obvious in hindsight.
Unfortunately, on a German QWERTZ keyboard, to get "[" you have to press AltGr + 8.
please report back!
Mikrotik is also as cheap as it gets.
Even if you could I would highly recommend against doing that, given that this would grant you access to every https connection that isn't hpkp secured.

I actually have all webservices in my home network secured by https, all you need to do is click a cheap vps, install nginx and tinc, and then proxy /.well-known/acme-challenge/ to your internal servers. Either setup domain or ip hijacking so the public IP is routed inside your lan. Done.

If I can do this for me and my cat in my spare time, you can do this for your university.
Besides the file size restriction of 1.4 MB, I agree 100% with the requirements for good OS software. Portability and ad/junk-free is most important.
You're not quoting text, you're formatting it as code. Just put "> " instead of indenting.
LANs should be included. It's just as bad as using most websites without TLS.

Maybe this helps forcing companies of IOT-like devices finally take security a bit more serious.
The bad faith element is almost impossible to prove. It certainly isn't met in the Cloudflare case.

Certainly, experienced patent litigators are very unlikely to file a case that would be considered in bad faith.
I seem to remember the main reason people ran GEM was because it was bundled with Ventura DTP software.
How is "no whitespace" an advantage for a human readable file format? You could write JSON with zero whitespace, but you wouldn't because whitespace is absolutely necessary for human comprehensibility.
> You're going to have the same questions with any other language too. Very few companies get to write clients, servers, and everything else in one language that never updates.

Then I don't see much difference between Go, Java, ... vs Erlang except they are simpler to learn plus finding Java, NodeJS, ... devs is much easier. What was the point of using Erlang? It was supposed to solve a problem for us, but we end up of solving the problem ourselves.

What I'm really trying to say is: integrating a mainstream language like Go, Java, C++, ... with a messaging layer like ZeroMQ (or something else) and adding some reliability features is going to be easier than introducing a totally new language (with a totally different paradigm) into the stack.
UFO disappearing inside another before both vanish' leaves viewers baffled
Oh, yes. You're right, only 40 cols. My memory cartridge failed me this time.
Or for smtp and imap traffic to do a downgrade attack (STARTTLS downgrade). The committee that set encryption to be optional and downgradable in modern smtp/imap over TLS should be placed against a wall. In the history of moronic decisions... All that to save a port.
How is a gateway serving a configuration page at 192.168.1.1 to internal users supposed to eventually get an HTTPS certificate for that address...?
The worst case is that the money has to be repaid - how would insuring against that be prohibitive? If there's a 20% chance of invalidation, inventors take a 20% haircut.

But the invalidation chance will not be uniform, and the risk assessment done by insurance companies will bring the right kind of market forces to bear against frivolous patents.

And even aside from the economic impact, it's quite simply the right thing to do. If you shake people down with a government enforced monopoly that turns out to never have legitimately existed, keeping that money is immoral.
'Nothing works' is not an exaggeration? This is purely irrational, not to mention I don't experience any of those issues you mention, nor other ones that take more than a tiny fraction of my development time (eg shutting down and rebooting while drinking coffee if updates are needed). Sorry Windows doesn't work for you, but it works well for me and my clients (and my bank account and their satisfaction levels).
Just saying but most companies that search elixir dev do not go in this website. They immediately go for the community. Faster, easier and you get more consistent results.

Difference between hiring "someone that knows it" and "a good dev interested by it"
I know that, but, if you take the approach that having a prevalence of one group in some positions is a wrong, then you have to ask: is a wrong from 130 years ago a valid justification for a wrong today?

That's why it's a slippery slope.
Sonnet: World's Most Advanced Off-Grid Communication Device
If kids fail to learn social skills and how to deal with society, they will pay a steep price once they reach adulthood.
Messenger bot you don't know till now 2017
Considering the current perspective, 8 USD is good for Bangladeshi. AFAIK the current scenario is worst than that. Companies actually want to hire engineers 10k BDT which around 124 USD!! Same goes for upwork. The whole tech market looks totally unstable right now.
Search on hex.pm is not great and can definitely be improved, but we are currently at the limit of postgres full text search afaik, unless there are some magic things to tweak. This means we need to switch to other technologies to improve the search which is a bigger task.

But regardless of how good search is it wouldn't find ryal_core when searching for "commerce" if that word or any similar is nowhere in the metadata. The description for the package ryal_core is "The core of Ryal." which doesn't do the search any favours.
We have something called 'Fuck It' days that allows any member of the team to walk out and have day to get back on track. We have almost unlimited of these (at line manager's discretion) who intervenes if you take too many which indicates an underlying problem. It works for mental health and a whole host of other purposes. For me this is the best perk ever, i have availed it 2 times in the last couple of years, both times it made a marked change to my mental state. It is amazing to get up and go 'fuck it' i am going to movies instead and be able to do it with zero emotional baggage.
Tech Companies Protest Against Stacked Odds to Save Net Neutrality
p5.js and processing.js are really for educational and artistic doodling, not for commercial web design.

There aren't many applications where d3 or raw js wouldn't be a more performant solution for commercial graphics.
they have been seeing that for months now ( i see it often too on sites that are slow to change). I have not heard anyone complaining about loss of traffic. It's becoming transparent to the users, imho, like the EU cookie prompt.
What's the bottom line for someone like me building simple cloud applications without specific hardware requirements? I tend to look at CPUs as black boxes. Will my Digital Ocean / Linode / whatever VMs soon have a better price-performance ratio?
Https has googles bully pulpit behind it and even though https has its issues it pales into insignificance compared to ipv6's "problematic" design choices
That's a great article. All involved crypto currency should read the comments.
Most of the blame falls to npm Inc for bending over backwards to a corporation for a bogus trademark claim they weren't even involved in.

Sure, left-pad being deleted was what resulted in most people's problems but this was just the fallout from npm Inc forcibly reassigning an actively used package name from a major open source contributor to appease a company that didn't even threaten them directly.
> But Zuckerberg recognized the significance of touchscreen mobile devices and pushed his engineers to make mobile apps the top priority across the company

Ugh. No. I still remember the days when Android folks were complaining that there isn't a Facebook app for them and the response from FB was that the one in iPhone was not really official FB app, but just happened to be made by one of their engineers in their feee time.
Yes, venv is supposed to be part of the stdlib in Python 3. But that is not the case on Debian. You need to install the python3-venv package to get it. That's what I and that Fedora page are talking about.
Cyber-bullying relatively rare, says study
There is one. It is complicated.

The easiest way to prove obviousness is to find printed publications that describe the claimed invention. For obviousness, multiple printed publications can be combined as long as they are in a related field and there would be some kind of motivation for one of ordinary skill in the art to combine what they disclose.
MS Windows EternalBlue SMB Remote Code Execution Exploit
Oracle's Cloud Strategy: Ruthless or 'Byzantine'?
5 Years of Bootstrapping Our Company and Why We Don't Want to Be Google
Imagine if this line were applied to another large heterogeneous organisation like the US Government.

I am less concerned about waterboarding in Guantanamo, which represents a miniscule proportion of the Federal budget, than social security which brings help to tens of millions. And anyway, Guantanamo is in Cuba (not even US soil) and those journalists ought not to have been talking to those prison guards.
A couple of years ago I did the Introduction to Mathematical Thinking course on Coursera [1]. Even though I found it hard, I enjoyed it and learned a lot, and I feel I got some insight into mathematical though processes. Recommended.

[1] https://www.coursera.org/learn/mathematical-thinking