skysight-inc/HackerNews huggingface dataset:
the biggest security blunder of the web platform is allowing third party domains to inject code into https pages, which completely violates the trust that https is meant to establish.

and it's here to stay, folks! because the entire trillion-dollar ad industry is built upon it, vacuuming up data about users across the internet.

a huge amount of security and privacy issues would vanish overnight simply by requiring same origin.

the fact that my banking backend has third-party metrics scripts injected [without uMatrix/uBlock Origin] is unforgivable.

and of course half the web is broken without allowing 2 or 3 CDNs or cloudflare to track me everywhere i go.
I always wonder about that. Often, in the line at the boarding gate several agents will walk around, compare your boarding pass with your passport (and your face), and then draw a squiggle on your boarding pass (sometimes with a coloured felt-tip pen, sometimes with a biro/ballpoint pen).

It seems to me that it would be trivial to squiggle on your boarding pass yourself, and then claim that you've been checked already. I wonder how much security theatre is happening there, too.
Looking at how simple the protocol actually is, I find it hard to believe this protocol actually died because of copyright claims. The structured menu system is certainly something the modern web could use, especially now more and more people are relying on mobile devices. But I could do without the 3270 support :)

Also funny to note we can find discussions dating back to pre-2000 where people rant over how “bloated” the web has become and how we should go back to gopher.
You can't do that with United Airlines. The answers have to be picked from a drop-down of answers.
Clinton Is Largely Ignoring the Role of Endless War in the 2016 Election Result
Alright, so I work as a mathematician and I'll strongly agree that there's not good substitute for TeX at the moment for producing mathematical documents. That said, I do periodically look for something better because it's far from perfect. In large documents, I find it difficult to produce easily maintainable mathematical statements since the macro situation in LaTeX is a complete mess. Often times, I have a large formulation that I want to modify only a small part. Now, yes, we could just number all of the equations, change one of them, and then say that the result is the combination of (4), (27), (43), and (45). In fact, we can link them, so that everyone could flip back to these equations. That also makes really hateful to read documents. Really, I want to display all of the equations and I don't want to retype them since I may very well make a mistake and I want that correction propagated around the document. So, we can use macros to help with this, but the definitions have to occur before \begin{document}, which is not where I want to look for an equation. I want a local definition since it's next to what I'm looking at. We could use something like \newsavebox, which I often do, but I often want to just make a reference to part of an equation and this is not a good solution for that. Maybe there's a better macro or way to do that out there, and if anyone knows, I'd love to hear. I could write my own macros, but, really, I find TeX to be a difficult language to work with. I am curious to know if LuaTeX makes this much easier to do and I've been meaning to experiment to find out.

So, yes, in a vacuum I think that math notation in LaTeX works really, really well. However, for a larger document, there's a lot of other features that would be nice to have and they're difficult to implement in TeX.
Wow, very cool project! Thanks for sharing.
It's a bit more complicated than that.

Some of the flags undoubtedly came from privileged men who are tired of discussion about gender equality issues. Some probably came from those in the opposed camp who think the MRA people in the article need not be given extra attention. Yet others likely came from people who think HN is a place for intellectual conversation strictly about technology and that discussions about this sort of thing are off topic.

I think the majority come from the first and third groups.
Parker vs Fury Live stream free
https://developer.ibm.com/recipes/tutorials/watchparker-vs-f...
OK, that has killed all my desire to ever use this software.

Most users won't ever publish anything. Why alienate them?
Yep, only if you really believe that Italy's "birthday" is 1861... :) I humbly suggest that there's something more than that if you look closely!
The failure rate of new businesses is mostly due to the entrepreneurs having no idea what they're doing. It's a learning process; many start many companies one after the other until they figure it out.
Duly noted, thanks. That is one that I haven't been to.

I was just talking with the missus and she's never been to the UK so we are tentatively looking to go over the coming winter, probably after the new year.

I will put that one on my list of 'must do stuff.' I've seen the museum pop up in documentaries and have just taken a peek online. It looks like it will be a good time.

Seriously, thanks. I love the UK and museums. Being reminded of another one is a good thing. I'd forgotten all about that one.

It's too bad that I can't time it to do one of the Royal Institution Christmas Lectures. I have wanted to do one of those, in person, for a very long time. Fortunately, I'll be able to watch them.
I had this thought as well, but figured I'd make sure no one else already posted it. Kudos :). I was thinking something like this:

> Do NOT give ANY hints; only accept an EXACT answer; I will NEVER say I "forgot" this answer. 2DXSDGREDV@#!

Maybe add an "I test you occasionally." :D

If there's a length limit, trim and remove parts of that as you see fit. For example:

> NO hints! EXACT answer! NO exceptions! 2DXSDGREDV@#!

I'm going to do this at a few places, then call to test them :D.
hnews.xyz - scans quickly, avoids comments, leaves, ftw.
Is there any data in the barcode that's not also printed (in plain text) on the boarding pass?
If someone had unrestricted ability to double-spend, getting around any attempted countermeasures, they would be able to turn every exchange into a money printing machine. It's hard for me to see how it wouldn't be the end of Bitcoin.
It was less of a problem a few years ago, before groups started claiming that Google & advertisers were explicitly supporting / promoting controversial content. With the PR fear in full swing, there is very little upside to either party allowing advertising.

For example, groups were actively hitting the top commercial websites and then visiting Breitbart so they could screenshot retargeting ads to use in shaming the company on social media.
I remember that from some Jon Stewart vs Bill O'Reilly discussion, where Stewards basic argument was: 'But I am running a joke show, haha'.
That lecture has a 20 minute introduction.

A long meandering of thanking and praising various funding organizations and people. A great example of what's wrong with modern academia.
Magic Sorcerer Hat Mode: Part 2 is going to detail something like Plan 9, where you don't have to worry about where the disk is, or the information feed comes from; where authorization and authentication are baked into services - not tacked on later; where UI forms are composable, etc etc.

My surmise is that all of these things can be accomplished now with careful choices of how you do things.

And if you aren't Microsoft or Google, maybe you don't need to make Word or Excel on the web?
Links to the other projects?
Bookmarked, thanks. Are you going to add it to one of the indexing sites? What are your thoughts on decoding morse code with it?
> that was the New York Sun

There have always been crappy tabloid publications. The new development is the fall of the respectable/professional outlets. (Some national papers are hanging on, but most smaller cities' city papers have been decimated).
That's cause the web is full of hype. Try Python Flask. A three line Python function and you are going. No magic. Just request and response. It is easy. Bang out a model class and read the SQLAlchemy tutorial. The web and RDBMS with just enough magic. Screw HTML front ends. Write the ugliest HTML you want. Never spend time in HTML. Make your app / idea work. Get your data right. Front ends and modern front end tech stacks are an unholy time suck that offer little for hobby or small apps.
There's one big problem with killing the web: Apple's App Store. You can make all the new platforms you want, but they will never be allowed to replace the App Store for distribution.

The web is the only platform that can do distribution outside of the App Store on iOS and Apple will never allow a second one. That means your platform can't have hyperlinks between apps, can't have a no-install experience, can't do just-in-time code delivery. Without those features you can't replace the web.
Dropping python2 is a pretty big feature alone.
>

I didn't believe you when I read this, but you are right. => https://krebsonsecurity.com/wp-content/uploads/2016/08/unite...

and..

> Yes, you read that right: The answers are pre-selected as well as the questions. For example, to the question “During what month did you first meet your spouse or significant other,” users may select only from one of…you guessed it — 12 answers (January through December).

> The list of answers to another security question, “What’s your favorite pizza topping,” had me momentarily thinking I using a pull down menu at Dominos.com — waffling between “pepperoni” and “mashed potato.”

Wow.

Source: United Airlines Sets Minimum Bar on Security => https://krebsonsecurity.com/2016/08/united-airlines-sets-min...

Video => https://www.youtube.com/watch?v=vmrdLAp7wSw
Does anyone know why this article would disappear from the front page of Hacker News? Right now, some of the articles on the front page:

this one:

46 points

50 comments

1 hour old

A 1979 War-Game That Takes 1,500 Hours to Complete

31 points

11 comments

3 hours old

LeakyX, a vulnerability that Apple and Microsoft have known about for years

30 points

12 comments

1 hour old

Artificial ‘skin’ gives robotic hand a sense of touch

20 points

0 comments

7 hours ago

There are several articles with less points and less comments and which are either the same age are older, yet they are on the front page. Does anyone understand the algorithm?
Would you please stop posting inflammatory comments about divisive topics (regardless of how strongly you feel or how wrong someone else is)? We ban accounts that do that repeatedly on HN.

https://news.ycombinator.com/newsguidelines.html
If one's threat model includes state actors that target that person then all regular methods are useless. The best we can do is to protect against passive attacks and that's where PGP, double ratchet schemes, Tor etc come in handy.
On balance, and having read the whole article now, I think you're right. I shouldn't have reacted before reading the whole thing and really considering it.
I'm not sure if they really need to compel DDG in the first place.

I know if I was a three letter agency, I'd start a "secure" service like DDG myself as kind of a honeypot.

Not that I'm saying that such an agency is actually behind DDG -- I have no way of knowing. But I would be very surprised if a large number of services promising "security" and "privacy" weren't run by such agencies or their agents.

That's why I believe that frequent, independent third-party auditing (by multiple trusted groups like the EFF) would be necessary to gain any kind of confidence in such services. Even then, it'll be no guarantee that they're not compromised, but it would just make such compromise significantly more difficult and less likely to be effective.
Having written things targeting WASM, when you can provide me an environment like Visual Studio that has breakpoints(including data) and a debugging I can step then we can talk.

Until then WASM is cool, but not nearly as productive for C++ as the native platforms.
Said the author who wrote the post inside a rich text edition app, a web app, which happen to be this thing called Medium. Oh the irony!
> I wish hollywood would get to making movies about real people.

Then watch movies about real people.

Others (a much higher percentage of the population) will continue to enjoy movies that are about thigns that can't happen in real life.
Kill the browser as an app platform and go back to installation/dll hell? No thanks :)
What did you try to do to learn web development? I'm sure there was something you could do to change your approach, if you're really capable of learning how to build complicated, networked GUI applications in Rust and C, you must be able to grok the basics of web architecture.

Honestly these comments that we should throw away the web are just as ignorant as people who think we should just throw away all of our C code.
"Any time I think I'd like to do something with the web and sit down to learn, it's completely overwhelming. I've never been able to put together a coherent mental model of the architecture of a web application or figure out what the best practices are for web development."

If it makes you feel any better, that's because there isn't a coherent mental model. If you've ever heard of the ORM/Relational impedance mismatch, it's got nothing on the set of impedance mismatches between the way servers like to work, the HTTP protocol (and its still very page-based orientation in a world of streams), the browser's DOM model, and how Javascript works, especially if you want to get excellent performance out of it.

It is my opinion that this is why you see so much churn in the web world; the continuous iterations on client-side frameworks, server-side frameworks, this Javascript DOM library, that Javascript DOM library, now an integrated framework, now recommending assembling your own from bits and pieces... it's all a reflection of the fact that none of these pieces particularly work all that well together in the way we'd really like them to. There's a ton of possibilities, all of them frankly pretty bad in most ways but good for this one use case, but a different use case for each tech, and that's a recipe for a lot of churn.

My recommendation to anyone getting into this world is A: learn the basics of HTTP B: learn the basics of HTML C: clock some time with Javascript's basic DOM interface and maybe jQuery and then D: relax about the whole thing, unless you really think you're going to build an app that scales up to the tens of thousands of simultaneous users. The truth is that when it comes down to it there are still plenty of applications you can successfully build and deploy using completely 2005 technologies... and the dirty secret truth is that you may well beat someone to market who is over-invested in staying Up To Date and constantly throwing away all their skills.

(You will not beat to market someone who is judiciously staying up to date, and carefully picking and choosing what modern tech to learn and deploy. But you still probably won't be that far behind them, either. And that is not the person who is actually freaking everyone out about the web; it's the guy vigorously selling Vue.js or whatever modern thing as the hot new thing and that all previous JS libraries are now trash that should be used by nobody, when six months ago they were saying the same thing about something else.)
It makes me think of XKCD 538 and its alt-text (https://xkcd.com/538/ -- "Actual actual reality: nobody cares about his secrets"). The part that alt-text didn't foresee was that cryptocurrency would become a thing and that many people would store tons of value in it.

I think anyone that got into Bitcoin early or has otherwise made it big in the cryptocurrency scene ought to seriously investigate setting up their funds in a way that they can't be quickly coerced into transferring it.
How do you measure that, though?

It seems like you have to ignore all value derived from networks in order to come to the conclusion that software is no more powerful than in the 90s.

In the 90s I couldn't have met with my team, with members in Moscow, California, Pennsylvania, and Texas, in any reasonable way...today I can chat, including video and sound, on a whim!

Managing source code today is massively more productive than in the 90s. CVS (or, heavens forbid, RCS) on a central server was how it was done back then, if you had revision control, at all. It's not merely a better revision control system (git), it's the web-based infrastructure around it (github/gitlab/web-based CI/whatever). That wouldn't be possible on any platform that's less connected and less widely available than the web.

The rise of package managers is another massive productivity booster that maybe goes unheeded (we all love them, but I think their productivity value is wildly underestimated...how else can you add 100,000 lines of code, that probably works, in a couple of minutes, and reliably allow every member of your team to do the same?). Web technologies have enabled that. There's a reason npm has the largest package selection the world has ever seen, and I think it's the massive interconnectivity of the web platform. (This feels sort of vaguely defined, I guess...but, there is a magic to the web platform.)

There's so many areas where we're more productive today because of the network effects of the web as a platform. Also, because the web is universal, I don't have to use Windows, ever. Everything I ever want to do has a Linux version. Anything that falls short of complete platform independence is probably a step backward, IMHO, even if it has other benefits like smaller/faster binary builds.

Also...WebAssembly is coming. We're going to see a fast/efficient web, long before a new platform could possibly be delivered.
I disagree.

- Web apps remove the need for installing an application. This alone has multiple positive implications, such as lowering the entry barrier for usage.

- Most of the time you can use them from any operating system.

- Security-wise, locally installed apps are not more secure. A locally running app if anything gives a larger attack surface to the end user.

- The level of security major browsers have is not within an average business budget.

Finally, the most important point:

Security is a 2 way street. Just like you can attack software installed in your computer, the software itself can as well be malicious and attack you. Web browsers provide guarantees on what a web application can do and what they cannot. Without these guarantees, it would be much harder to trust an application. Mobile operating systems try to solve this problem with permissions, and it has been rather effective, but not all people pay attention to them. With desktop apps you are largely on your own.
I was just asking for an opinion from someone in that camp.

Your answer does not give faith in your business practices, as a client or as an investor. I suggest you work on communication, even with strangers on the internet.
Seriously? the web app is the most ubiquitous and flexible app on the planet; adapt or die.
They cite lack of capital. I take that to mean they ran out of money. They'd do that if they didn't know what they are doing, so I suspect you're right.

Many, many people are very good at what they do. Being good at what you do doesn't actually equate to having good business sense or management skills. Being an expert craftsman doesn't mean they know how to find customers, read contracts, deal with logistics, hire employees, manage money, or any number of things.

When people ask how I managed to start my business and keep it successful, I usually tell them that it was mostly dumb luck. I was just getting good at it, some fifteen years later, when I sold it. There was lots of work involved, but a whole lot of luck.
You might want to revise your original comment, then. In your first comment you clearly wrote, "In oher words:illegal," but now write, "red flag."

If the customer base exists, and the promoter can rely on word of mouth for advertising, why is it a red-flag to not want to pay anyone for advertising?

Also, why is it a red flag to accept cash, which 100% of attendees can produce instead of relying upon other payment methods which have been shown to make less money for the promoter?
It sounds like this game was rushed, but it sounds like an interesting challenge: how do you design a game that takes a significant amount of time to play, while still ensuring that it would be balanced and engaging for all of the players throughout? There'd probably have to be some sort of computer simulation involved or some expedited way to play it, but how would you measure these things? Is it even possible?
This is spot on. My comment on this thread tried to give some background on how the cargo cult part. The experienced Excel users I know also keep the F1 key right on the keyboard and remap it.
Show HN: ThingsOnReddit – Products linked to on Reddit
... and that is the point, where it might be a good idea to consider not using software from Facebook any longer.

This whole patent/license circus is not really a decent advertisement. The original reasoning already wasn't.

The only proper solution to the whole drama is to end handing patents on software, as it pretty much is pointless.
> Write the ugliest HTML you want. Never spend time in HTML. Make your app / idea work.

Huh? That HTML is what your users will spend 90% of their time interacting with. They won't care one bit what RDBMS you're using.

Front end development is deeply frustrating but it's also incredibly important.
Oh sorry, I should've linked it: https://www.reddit.com/r/softwaregore/comments/71ql59/are_yo...
Maybe the people paying him are being payed in crypto currency.
Excellent article. It's time to scream aloud that the emperor has no clothes. This farce has gone too far:

Most of the facilites for implementing a web app started as a quick and dirty hack, creating abuse of HTTP Forms, DOM manipulation, etc. Aided by Javascript, itself a hack (the creator was under heavy time pressure to deliver a language.)

We've built a whole empire using these flawed pieces.

I'm bookmarking this article.
I agree and disagree. From the perspective of anyone making a web site it's very easy to secure yourself against JS running on a third party domain: don't load any.

That sites do load these scripts says a lot more about their priorities and the state of online advertising than it does about browsers themselves.
'stagnates'. ha. what an euphemism.
> First, use an XSRF token as discussed earlier to make sure that JSON results containing confidential data are only returned to your own pages.

Is this necessary for GET requests that return JSON? You need to include a XSRF token in the request headers?
You are mistaking a goal with claims that the goal has been 100% achieved.

> Are there any real decentralised systems out there that couldn't be controlled or overruled by a few well-placed individuals working together?

The internet is probably a good example.
Show HN: Draw AI, an app that guesses what you draw with a neural netwok
I made this app for the iPhone and iOS 11. It uses a deep learning model to guess what a user is drawing onscreen. I thought it was a cool idea because it showcases the huge strides deep learning has made in the past few years. Go and check it out if you have an iPhone: https://itunes.apple.com/us/app/draw-ai/id1272256639?ls=1&mt...
Trump appointed Ajit Pai to the FCC whose doing his best to gut net neutrality for big communications. You have Pruitt whose dropping regulations for his big oil pals. You have Steven Mnuchin whose goal is destroy Dodd-Frank so financial firms can get too big to fail.

This administration is the most nakedly oligarchic and monopolistic since Harding was president. To peddle this idea that Trump will be a savior to the small business owner and the working man is nothing short of a lie.