skysight-inc/HackerNews huggingface dataset:
Realistically, how many hops are we talking? The dns mx record points to a server that handles mail for a user - anything beyond that point is that domains problem to secure - and it's relatively easy to do so. (The exception being aliased/forwarded addresses - but that's handled on the server side - and could also be set to force ssl/tls).

The sender needs a smtp server, usually "their own", and usually (today) supports tls/ssl.

Now the sender_smtp-receiver_smtp needs to enforce encryption. I really think we're at a point where forcing ssl on incoming mail would a) not lose any legitimate email, b) maybe block some spam.

Then, remove support for connecting to mail over unencrypted pop/imap/smtp for mail clients (probably except for localcast, to not break "known secure transport" like an ssh/vpn tunnel).

Since Gmail, outlook.com have effectively broken easy mail federation (oh, look a bad man had your ip a year ago, no mail for you, and no, we won't bounce it with an error, just silently drop it/file it as spam) - we have an oppsto be a bit aggressive in phasing out old rfcs that allow unencrypted smtp/imap/pop over untrusted networks.

I'll happily concede that patching transport security doesn't make email end-to-end secure. Then again, I'm not sure the Web is any better: ssl is hop-by-hop, clients keep a plain text cache on disk, along with a log of meta-data (and servers tend to log a lot of plain text meta-data too), client certificates are being phased out for http2...

Wrapping messages in s/mime or gpg actually looks pretty good by comparison.

Maybe what we need is a suggestion that if you email user+secure@example.com rather than user@ - only email encrypted to User@example.com (with user+secure@ as alt identity...) will get through?

Then muas could check to see if there's a gpg key for user+secure@, given mailto user@, in the directory - and transparently Encrypt by default?
It's enough. Even top end discrete cards can't saturate 16x PCI-E 3
because iirc the complaints weren't really 'we want upgradable pro machines'

That is totally untrue. The places I was complaints were all about upgradability. That's why many people still get the previous generation of Mac Pro's and upgrade the processors, graphics cards and add SSDs. My main machine at work is one of these, and feels just as fast as my Mac Pro 6,1 (the trashcan version) at home.
In established computer architecture terminology, speculative execution is reserved for speculating past branches. (Speculation meaning something that may not pan out...)
The only thing missing from this post is 'we take security very seriously'
I order it from the US and it was no problem. I'm in Switzerland. Payed some tax, but not enough to that it mattered for me.

It is still way better then the competition.
Would you please not post ideological flamebait?

If you have a substantive point to make, make it thoughtfully; if you don't, please don't comment until you do.

https://news.ycombinator.com/item?id=16092277 is fine, this is not.
Adjust the Brightness and Contrast on Your Monitor for Healthy Eyes
> Do you have any alternative that isn't isomorphic to affirmative action?

Possible alternative:

We need to embrace that all decisions we make are emotional, even the rational ones [1], and create a process that facilitates the desired change. I believe this can be done by hiring competent minorities into teams [2], where although they are a minority in general they will not be on their team. These teams should not only be that minority as you in a truly inclusive system can't define people by a trait.

Since its a minority you probably have to do some extra legway in facilitating matching these teams well to problems the the team members find interesting and that there are growth opportunities. However, that is an ongoing conversation you should be having at any rate.

By these teams being competent they will through normal work-conversations and collaborations open minds on how successful people look like. Very suddenly it will be clear that both nerdy and pretty girls as well as anyone in between can code well, and that people that talk and walk in ways that make you uncomfortable might actually be competent and give you a unique perspective if you truly include them in your conversation.

Yes, it is not flashy and won't make great campaign posters. However, it empowers individuals while helping those individuals deal with being a minority without it being a zero sum game. And then we can watch history unfold, like how asians went from being railroad grunt work to model immigrants.

[1] https://www.amazon.com/Behave-Biology-Humans-Best-Worst-eboo...
[2] suggested action by feminists and researchers like Francis Frei, although I am not sure they support this full proposal
This is of no real consequence except curiosity, but I'm at a loss to understand what "park" means in the title.

I don't even know what sense of the word is intended. Is it "park" like a city or amusement park that you visit, and the idea is that you enjoy a variety of different activities while you're there? Is it "park" like a ballpark, and the analogy is that sporting events take place there and each one of these topics is an event? Is it somehow "park" like a parking lot? Maybe "park" is a too-literal translation from another language where the corresponding word has a meaning that the English one doesn't?

I'm trying to guess based on context, but none of these really seems to fit.
It doesn't. Some of us got off Facebook years ago (or stopped using it). An individual abstaining didn't stop society from being manipulated the way this describes, FB's reach is too great.
> But the moment it becomes officially obsolete and shops have to justify paying special support contracts to maintain it...

Who even pays for a support contract for programming language that’s already done?

That’s like saying JavaScript is unusable because of all of the different versions. Nobody has to pay anybody to use ES3 even though it’s largely obsolete.
So how come in the US kids are diagnosed with ADHD 10 times more comparing to France? if it was so clear cut it should be equal all over the world.
> Since when have computers been “basically built for copying”

Digital computers (i.e. Shannon's Information Theory) was a solution for the S/N getting worse every time the signal was amplified. Shannon's solution of digital circuits allowed information to be copied without the limit. An important consequence of this was the marginal cost for copying information falling very close to zero. Or, stated in economic terms, information ws no longer scarce.

> computer

You're using a very narrow definition of "computer". Colloquial use of the word obviously includes a variety of technologies and concepts - such as Shannon's digital circuits - not just model of computation (Turing or otherwise).

> modern computers are effective communication device

You don't even need to consider {,inter}networking; the modern devices commonly called "computers" spend most of their time managing data. Very little time is spent doing any actual computation. I recommend this[1] lecture by Feynman, where he explains how what we call "computers" are are really closer to a filing system that stores and copies data (including the store program and most of the mechanics of computation).

[1] https://www.youtube.com/watch?v=EKWGGDXe5MA
keybase.io is another centralized third party which, like Signal, we should be trying to move away from rather than becoming more dependent on. By relying on the DNS (which is already trusted to make email, keybase.io, and Signal work), every service provider can be in control of the keys they are publishing.

Also, keybase.io, being centralized, isn't as auditable as the DNS, but admittedly there is work being done on both DNSSEC transparency:

http://blog.huque.com/2014/07/dnssec-key-transparency.html

and keybase.io publishing to the bitcoin blockchain:

https://keybase.io/docs/server_security/merkle_root_in_bitco...
The horse collar
Earth's Oceans Suffocating and Creating More 'Dead Zones': Study
"10 years is a long time. This was back when I still heard people seriously asking if the internet would last."

In 2007 the web, the mainstream part of internet, had been going on for 17 years. And the internet was even older.
If people thought 10 years ago that the internet could disappear, they think the same today and in 10 years as well.

" It was even plausible! Google was only a few years out from its IPO. Few people thought the internet could help elect a president (and I don't mean the current guy)."

Oh. Because without these two anecdotals event the internet couldn't last?

"A lot changed in the last ten years"

Not that much. Facebook, twitter and youtube were already around. The main difference is that we lost everything else. We have less and less choice. But it was already starting in 2007.
Having just recently dipped my toe into ranapshot I will chime in that it’s also very easy to configure, and has already saved my client’s bacon once avoiding a cloud restore process.
Preparing food requires using all my senses, using my hands and walking around, and helps me come into my body after a day spent mostly in my head.

In addition to Facebook, I stopped consuming refined sugar/corn syrup, refined flour and coffee.

My cognitive resources are clearly increased. Now I need to stop HN, Reddit and Twitter ;)
PEP-393 is a stupid compromise. They couldn't choose between UCS-2 and UCS-4, so they are using both. They are wasting tons of CPU cycles converting between them and single character outside of range doubles the size of string.

I don't fully understand the use case for extracting codepoints from strings, but they could have just added Java-like: codePoints and keep returning code units from old methods. This is CPU and memory efficient and 100% backwards compatible.

I think the problem is the same could have been done in Python 2 (with UTF-8) that would mean less reasons for Python 3.
I'm getting a lot of emails from people interested in the talk and can't possibly remember to let everyone know when it comes out. Please follow me on Twitter and stay posted there. Take the opportunity to create an account there if you don't have one.

Thank you for the support :-)
What if the real missed opportunity is not investing in yourself or a new business?
The direction of a branch isn't going to be known until a couple stages into the pipeline ("EX" in the classic RISC version). Ideally, the preceding stages in the pipeline will be fed correctly - that can either be the instructions immediately following the branch (as in the "branch delay slot(s)" found in some architectures) or the instructions at where the CPU thinks the branch will lead.
OK, that's what I thought. I thought the DMCA required something to be down for a certain amount of days (1? 3?), like you cannot just auto put it back up, right?
Advice to Californians Building New Homes After the Fires
How about "stop [acting] lazy"? 'Acting' has more of an implication of something you are putting on that can be easily changed, rather than 'being' which possibly implies something you are, that is not easily changed.
I'd agree, it was obvious what FB and Zuckerberg were from the beginning. But we all see what we want to and what we allow ourselves to see, so it's commendable that they are seeing it now and speaking against it.
Very displeased about this response.

> In yesterday’s case, we got it wrong, which prevented a publisher’s legitimate code from being distributed to developers whose projects depend on it. We identified the error within five minutes and followed defined processes to reverse this block. Unfortunately, the process was complicated by well-meaning members of the npm community who believed that a malicious actor or security breach was to blame and independently attempted to publish their own replacements for these packages.

No. Assuming everything in that excerpt is true (and I happen to know it's not, but that's not even relevant here), that wasn't the problem.

The problem is that NPM allowed packages to be re-uploaded by new authors after the initial versions had been spam filtered. Especially since allowing packages to be re-uploaded by new authors was the core issue of the left-pad debacle, and the one thing NPM said they'd fixed in response.

Let's summarise here:

1. NPM has a big issue

2. They claimed they had fixed it

3. They had not

4. In their post mortem they're pretending the issue doesn't exist

This guts any remaining trust I had in npm. Even if I wanted to trust them, they're not even admitting the problem exists; how am I meant to believe they're finally going to fix it? They've stopped even promising to fix this, and moved on to lies and denial.

Unacceptable. Literally. This is pushing me away from the node ecosystem because I am not prepared to accept this sort of weaponized incompetence from the primary package repo for node.
Yeah, about two years ago NPM stole a package name from an existing user and gave it to a company to use. The user then said that if he can't trust NPM to actually treat package naming fairly then he was just going to delete all of his packages[1]. This broke a ton of packages on people (in part due to "left-pad" disappearing), so the community went ahead and registered/uploaded all of the packages to NPM again.

Afterwords NPM came out with a blog post[2] where they went out of their way to take as little blame as possible and basically said it was the developers fault. They said they "stand by [their] package name dispute resolution policy, and the decision to which it led"- basically ensuring that no developer should ever trust their repository in the long term, as they'll happily hand over any package name to a corporate entity if that entity asks for it.

The weird thing is that they claimed to make it impossible to "unpublish" packages, so that developers could no longer rage quit their site, but apparently they didn't extend that new requirement to their own "security" systems.

[1] http://azer.bike/journal/i-ve-just-liberated-my-modules/
[2] http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm
I think a major security improvement for npm and other package managers using almost exclusively open-source/ non-compiled code is to require the source code be linked from a popular open-source platform like Github and then to take the package directly from there, to ensure the code can be audited and nothing else can be snuck in.
How is this better than signing outgoing email, and default to encrypt to senders who sign their mail?
I'd love you to go into more detail with this proposal. How would taxing ads be different than just taxing corporations?
Sure a legal audit is standard and usually much simpler than a full source audit for security, which has a complexity proportional to the project size.
For an average computer, you're neglecting the step where you install Linux.

Even specially enabling it is a real barrier in many ways.
Facebook can't be fixed
So, as an alternative to affirmative action, your proposing we create teams that are essentially ghettos for minorities, and suggesting that this will improve their respect amongst their peers?
The Future Location of Amazon's HQ2 Is Perhaps More Obvious Than You Think
Maybe it is a reference to the Rick and Morty episode "Anatomy Park". http://rickandmorty.wikia.com/wiki/Anatomy_Park_(episode)
The better alternative would be to improve the situation where the original injustice occurs, not sometime later in the pipeline.

E.g. affirmative action in university admissions assumes that members of traditionally underprivileged groups did not have the opportunity to display their full potential and will have higher peak performance than their current scores suggest.

While this is true on average and affirmative action is the best you can do if you are limited to influencing this single funnel in the pipeline, it also ends up unfairly benefiting privileged members within unprivileged groups.

If more wide-reaching changes are possible, e.g. ensuring that everyone has the same chance to actually learn something in school, affirmative action would soon become redundant, since the difference it aims to correct would not exist any more.
>"...Interviewer seemed miffed,"

Probably because you deprived them of the opportunity to feel superior because they knew the answer and you didn't. You probably dodged a bullet - would you want to work with someone that got "miffed" during an interview because you knew the answer to something?
Npm isn't ready for production use. If you're going to use it you either need to ship the modules you need or run it against a private repo of modules.
Video (polish?): https://www.youtube.com/watch?v=_Id9bFkjaDc
Google Can't Stop Getting Its Bikes Jacked
Key word: monopoly.

When you are big enough to control a market and de facto become a new layer of government, new rules apply.
Pretty long article that I doubt most will read in its entirety, if at all.

It was, however, a good read about social engineering, and I've summarized the points made and the solutions proposed below:

>Fear and anger produce a lot more engagement and sharing than joy.

>The result is that the algorithms favor sensational content over substance.

>Continuous reinforcement of existing beliefs tends to entrench those beliefs more deeply, while also making them more extreme and resistant to contrary facts.

>The Russians appear to have invested heavily in weakening the candidacy of Hillary Clinton during the Democratic primary by promoting emotionally charged content to supporters of Bernie Sanders and Jill Stein, as well as to likely Clinton supporters who might be discouraged from voting.

>We also have evidence now that Russia used its social media tactics to manipulate the Brexit vote.

>A team of researchers reported in November, for instance, that more than 150,000 Russian-language Twitter accounts posted pro-Leave messages in the run-up to the referendum.

>[B]ad actors plant a rumor on sites like 4chan and Reddit, leverage the disenchanted people on those sites to create buzz, build phony news sites with “press” versions of the rumor, push the story onto Twitter to attract the real media, then blow up the story for the masses on Facebook.

>Facebook and Google responded by reiterating their opposition to government regulation, insisting that it would kill innovation and hurt the country’s global competitiveness, and that self-regulation would produce better results.

>Polls suggest that about a third of Americans believe that Russian interference is fake news, despite unanimous agreement to the contrary by the country’s intelligence agencies.

Solutions proposed:

1) [I]t’s essential to ban digital bots that impersonate humans

2) [T]he platforms should not be allowed to make any acquisitions until they have addressed the damage caused to date, taken steps to prevent harm in the future, and demonstrated that such acquisitions will not result in diminished competition.

3) [T]he platforms must be transparent about who is behind political and issues-based communication.

4) [T]he platforms must be more transparent about their algorithms.

5) [T]he platforms should be required to have a more equitable contractual relationship with users.

6) [W]e need a limit on the commercial exploitation of consumer data by internet platforms.

7) [C]onsumers, not the platforms, should own their own data.

8) [F]inally, we should consider that the time has come to revive the country’s traditional approach to monopoly.
You didn't ask me, but since the topic came up: I met my girlfriend in an amateur orchestra we play in -- we're both violinists.
As Fabrice said, FirefoxOS was really the opposite --- doubling down on Gecko by making it the core piece of a huge bet. And it mean a big investment in Gecko improvements such as multi-process which eventually paid off on desktop.
Thank you for the heads up! Will fix when I get home
Could you provide a link to some notes and updated version of the class?
PREreview: Get it done sooner to avoid double review
Can't understand why it hasn't happened still.

https://github.com/npm/npm/pull/4016 - I read this as "it´s hard, and we don´t care." took them forever to look at and reject a patch that would have gotten the ball rolling
It's a reason, but not the only reason. In-order superscalar processors rely heavily on branch prediction too.
What would signed packages have achieved in this incident?

Who needs to sign the packages? The developers of the packages, right? Otherwise developer credential compromise subverts the entire point.

Which keys are authorized to sign for which packages? How to prevent credential compromise from affecting those authorizations?

What's the difference between a signed legitimate package and a signed malicious package?

If they introduced package signing, would packages would adopt it fast enough for users of packages to only use signed packages?

What happens when signing keys are lost or compromised? Do we need to use countersignatures from timestamping services as with other forms of code signing, so that CI systems do not break if a key is pulled?

I think this is very much not straightforward. npm+pgp may be well intentioned but seems grossly inadequate.
Formally verified kernels are pretty rare, and you can always have bugs in verification or side channel attacks that your proofs don’t cover, like speculative execution timing bugs in your CPU. (K)ASLR doesn’t defeat all memory bugs but it helps (a little). It is a very low overhead element of defense in depth that doesn’t require major code changes (unlike say, rewriting your kernel in a memory safe language).
Could be as in wildlife park.
This touches on some personal experience:

Since I'm reading HN of course I'm good at math. However, I don't really believe there is any such thing -- rather I had some good teachers, and father who knew math and who was willing to invest time explaining it to me, and something of a desire to "understand everything" which of course includes (starts with) Mathematics. Deep down I guess I think that perhaps when you get to Hilbert's problems _then_ you might be talking "hard math" but until then it really isn't that much to get your head around. You just need a decent teacher, time and effort.

So now I have two sons. Both I will say struggled somewhat with Math up to 7th grade when they hit a good teacher. By "struggled" I mean they got constant A/A+ but I had to put in significant work (as did they) to get them there. First son now in 9th grade gets continuous A+ without any help from me. Sometimes I ask him questions about what he's studying, and try to expand his horizons accordingly. The other son in 7th grade is still somewhat struggling but I can feel he is getting to a turning point.

Second son would often become disillusioned and say "I'm just not good at math". I can just imagine teachers and family members nodding in agreement. I didn't do that : I told him he just doesn't understand it yet but he will.

Anyway, my concern in this is : how many kids end up believing they're "not good at math" due to their teachers, family and environment? How many scientists and engineers (or just members of the public who understand statistics and interest rates...) are we losing because the idea that "math is hard" is so widely held and propagated like a virus?
For renters, the new normal: lower expectations and shrinking apartments
Society has always been manipulated. In ancient Egypt, priest calculated eclipses and used it as act of the gods to threaten people with them.

To change society, we indeed need to fix ourselves, but those fixes would be essentially getting rid of wanting to poses. Once that's gone, we can finally think ahead, but for that, countless steps are ahead of us.

( One of the first, in my opinion, should be a base income, but no necessarily in money; cover the physical needs: food, water, warmth, shelter; and motivate people to achieve something in order to gain anything above the basics, but remove the fear of lacking safety.)