skysight-inc/HackerNews huggingface dataset:
I was thinking this as well. It seems rather promising as a partial replacement at first. Hope that this will offer solutions to the antibiotics problem long term.
Can’t read the article because paywall, but the cat cafe I went to in Tokyo was amazingly relaxing.
Ask HN: Integrating in society while working in Switzerland as a programmer?
Hi. I will be moving to Switzerland soon to work as a programmer. I would like to join a German language course, to be able to go through every day life in the local language. I have not studied German before, but I have the opportunity to do a course to learn the basics. Do you think this would be a waste of time?
Why Majuli Island 'India’s Largest River Island' Is My Favorite in India
Really great video by BBC. The little dance that bird does when fending off other birds is really amusing, the movements and symmetry of wings positions is something that is an art in itself.
Godot engine
> Is it possible to make Caddy deterministically use the capabilities of the ACME protocol to try the intersection of challenges you want to use, and the ACME server supports? No. It's not.

Very, very few ACME clients have a renewal mechanism that supports automatic fallback to a different challenge type. I know a couple and the only one I can think of is certbot, and even there that's only true if you use the standalone or manual plugin (the others don't support "--preferred-challenges").

However, if your question is "Can I make Caddy use the exact challenge type I want it to", then the answer is yes, as you can guess from the "-disable-tls-sni-challenge" flag. This is what most clients will let you do. No one is saying that those clients can't renew with manual intervention.

> The rest is fucking moot. My point in every one of these threads is that Caddy is presented as "it just works" until it fucking doesn't and you have the weirdest shit happening.

You're changing goal posts.

> With regular tools, it's expected that you have a clue what the fuck you're doing and configure it to meet your requirements.

Part of knowing what you're doing as a developer is knowing that you either have sane defaults or stuff is going to break for a lot of people.

> Inexperienced people may use certbot and end up needing to do something. Sure. But I don't expect inexperienced people to be managing production environment servers. Do you?

Are you implying anyone using the default instructions for certbot is inexperienced?

> You claim Caddy's defaults are better - thats an opinion, but the problem is it's not a "default" it's forced fucking behaviour. You simply can't tell it to operate sanely like you can with certbot + haproxy.

If you think you can do better with your own approach, by all means do that. Most people are not PKI or ACME experts and won't have the necessary knowledge to make all the right calls, so they're better off with a "managed" solution like Caddy.

To be clear: This is an edge case and I'm in no way saying the certbot team is incompetent because they did not foresee this scenario and handle it as part of the default setup. It's just silly to go on about how terrible Caddy is when they happen to have a mitigation in place.
What’s the Difference Between Comodo’s SSL and DigiCert’s SSL Certificates?
Although science shows fish do feel something quite like pain, and it can be dulled with drugs as in humans, there are nontrivial biological differences between that sensation and mammalian pain.

So I suppose it depends on one's definition for "pain."

The evidence for pain in fish: the use of morphine as an analgesic, 2003. http://www.appliedanimalbehaviour.com/article/s0168-1591(03)...

Do fishes have nociceptors? Evidence for the evolution of a vertebrate sensory system, 2003. http://rspb.royalsocietypublishing.org/content/270/1520/1115

Thermonociception in fish: Effects of two different doses of morphine on thermal threshold and post-test behaviour in goldfish, 2009. https://www.sciencedirect.com/science/article/pii/S016815910...

Can fish really feel pain?, 2012. http://onlinelibrary.wiley.com/doi/10.1111/faf.12010/abstrac...
if you actively install "tune up" applications, you are already a lost cause for badware. :(
Great job! You mention you left McKinsey, but Quantum Black seems to be a McKinsey company. Do you mean you left consulting and moved into an operations role?
A lot of Japan's embrace of robots is not so much due to what robots do, but due to what they represent: modernity, luxury, precision, etc.

For a nursing care facility, being able to tout a robot nurse is great for marketing. Whether or not the robot is useful is almost secondary.
Highly recommend this Stripe Atlas guide on incorporation: https://stripe.com/atlas/guides/incorporation
Too late for me to edit this comment anymore, but in order to avoid spreading any false rumors, I'd like to explicitly state that I have no reason at all to believe that Cloudflare in particular would be affected by this, and I do not wish to imply that customers of cloudflare would be at risk from this vulnerability. That was just simply the first example of a public CDN deploying user-provided certificates that came to mind.

The big public CDNs would certainly have the most impact from this, but also the most likely to get their cert validation right. I'd reckon that the risk is probably in the larger number of smaller providers that have their own home-grown cert automation for deploying user-provided certificates.

In fact, it seems a little odd to me to hear LE talking about collecting a blacklist of vulnerable providers to prevent from using TLS-SNI... TBH, how can you tell what providers will be affected... should that be a whitelist instead?
>An order of magnitudes less important consequence of the end of antibiotics would be the end of professional sports and possibly also amateur sports.

Nope. Penicillin was first produced in quantity in 1942. The first Tour de France was held in 1903. Six-day track racing dates back to 1878. The Bordeaux-Paris race started in 1891 and was motor-paced for most of its history - the riders would slipstream behind cars or motorcycles, achieving tremendous speeds. The inadequate brakes and tires and the poor road surfaces of that era made road racing far more hazardous than it is today.

Pre-war riders sometimes died from racing-related trauma and exhaustion, but most of them lived to a ripe old age. Antibiotic resistance is clearly a bad thing, but it has been hyped to the point of hysteria by people who don't take the long view. People didn't swaddle themselves in cotton wool before 1942, they just got on with life. Some of them died of sepsis, but poor hygiene was a far more significant cause than the lack of antibiotics.
All you have to do in this case is short Kodak though. Their price increase is a helpful proxy for crytpocurrency enthusiasm, in the regulated arena you mention. You don't have to short a currency directly.
I believe it's a little worse in New Zealand. When I go home, I get about 15 minutes in the sun before I start burning.

My father used to work with some Nigerian engineers who said that the sun stings a lot more in Australia and New Zealand than at home. I long thought that was the UV but I've since read that it's actually the infrared that causes the burning senstation.
...and will probably get paid by the mainstream media for it.
Javascript paywall? I disabled javascript through the development console and could read the article. Maybe a bit off-topic, but this could be solved better.
I didn't use QuArk, but I did use (and bought a copy of) Qoole[1]. I built several Quake2 levels some of which I released out into the wild:

http://www.jaruzel.com/apps/quake2/

I recently tried to get Qoole back up and running, but it really hasn't aged well. Making levels in it now, seems like way too much hard work.

--

[1] Qoole Screenshot: http://www.cs-h1.do.am/_ld/2/50880145.jpg
I don't think they are really equivalent. We are talking about Domain Validated Certificates, and for DNS and HTTP "attacks" you need to be able to serve content in the name/as part of that domain.

In this attack you need to be able to serve content in the "name of" a made up TLS name under an IP you share with the domain you attack (which is very common).
Caught paying for virtual love. A vulnerability exposes users of an adult VR app
There is at least two of those four-way yields in Stockholm, and yes, it is of course absolutely insane. In a regular junction you already have to

1) Yield to traffic inside the junction,

2) Yield to traffic approaching from your right.

In a four-way yield junction, you have to

1) Yield to traffic inside the junction,

2) Yield to traffic approaching from your right,

3) ??????? to traffic approaching from the left.

It breeds confusion and has no advantage over a regular intersection. Unless, of course, you count confusion as an advantage. Which you do if you drive the vehicle with the largest inertia around.
If it's not a counter to the parent commenter's suggestion that the ability to feel pain is widespread then I don't see the relevance of this line of discussion.
If you use caddy, you'll have other issues to think about anyway.

The DNS RFCs (and later the URL RFCs) standardize hostnames to be a set of labels, separated by ".", a relative hostname ending in a label, an absolute hostname ending in a dot.

If you are in a corporate system, your DNS resolver will try to append its domain to any relative hostname.

So in the domain kuschku.de, if I do ping lithium, it will resolve to lithium.kuschku.de, and use that IP address.

This feature is used for example by kubernetes' DNS resolver.

This also means that if I enter the domain caddyserver.com, and try to ping it, it will first resolve to caddyserver.com.kuschku.de (or caddyserver.com.svc.default.cluster.local).

Now, to avoid these unnecessary lookups, you can simply try to access caddyserver.com. — a valid domain, valid URL, and per RFC it should point at the original, outside of any corporate domain. Except, it doesn't work.

Nginx, Apache, IIS, as well as the GCP, Azure and AWS ingress system support absolute URLs. (And all major websites in the Alexa Top 1 million that don't use caddy or traefik also support this. As does news.ycombinator.com.)

Caddy does not support serving these (instead mholt recommends you just copy-paste every config rule you have twice), and the bug was closed as WONTFIX.
I agree that carbon is bigger, riskier, etc. But, in the early 90s, I was being educated at primary school to fight deodorant and watching educational videos about teenagers wearing radiation suits. All that raised awareness, but didn’t fix anything directly. Bans did, and they were relatively painless (compared to industry predictions) because viable alternatives existed. The effects were barely felt outside of a few industries, though I concede that some fridges had to retire early. But people mostly just continued as usual, and we don't need to make those videos any more.

It feels analogous (not a perfect analogy, obviously) to now.

We have huge campaigns promoting “consumer action” like better insulation, energy moderation & such. At the political/lobby/policy level, we have complicated solutions based on impossibly complex models of the world. They model human behaviour like fuel demand given some portfolio of tax/credit/cap/whatnot interventions (econometrics, basically), including the invention of new technologies. That model feeds into a climate model. It’s all tied together with a pathological ribbon of international politics. All along the way, all sorts of additional interest come into play from industry lobby to municipal transport plans to pet projects.

"Market based tweaks" are based on so many assumptions, many of them motivated in all sorts of unhelpful ways. As I hinted above, I don't buy the economics of price-based interventions at all, personally. Regardless, it feels to complicated to be a good idea.

I’m basically saying that I think simpler is better. We now have increasingly viable alternatives to carbon grid power and ICE engines. Put together a phase-out plan, based on bans. Subsidize the most severe (or politically connected) end of the spectrum. Tax, regulate or whatnot around the edges.

The important part of the “analogy” (IMO) is this: viable alternative=>ban. If alternatives exist, bans can work relatively quickly, painlessly, and with less room for "corruption" of various sorts (remember ethanol?).
>Historically, advertising was a small part of product cost. Today, in many industries from movies to drugs, it dominates. This runs up prices for everyone. There's an economic argument for limiting advertising spend.

Advertising spend as a share of GDP hasn't changed much at all on average over the last century:
https://www.bloomberg.com/news/articles/2014-03-03/advertisi...

And some say it has even declined in recent years:
https://www.mediapost.com/publications/article/273094/us-adv...

The strange thing is that it doesn't feel like that at all. Advertising has become obnoxious to such a degree that it renders many sites entirely unresponsive on some devices (like my aging iPad). I have stopped visiting some sites or reduced the number of visits dramatically.

The advertising industry and indeed the publishing sector itself is clearly on a suicide mission. Someone needs to save them from themselves.
You shouldn't be suing them, you should be thanking them.

Whatever your perceived status was before having a New Yorker article about the success of a commercial project that you helped create, after the article is published, it is definitely that of 'professional', even if the text of the article describes you as an 'amateur'.

Unless you manage to act exceedingly unprofessionally about the whole thing, say for instance, threatening to sue them after essentially being given free advertising.
I had a similar goal few years ago and decided to move countries and take up a job in a new industry.

It didn't quite work out for me in that industry at the end but I certainly did meet people outside by bubble + learn about how the industry works in a fairly detailed manner.

This is not the easiest thing to do, but I would highly recommend it if you have the chance!
From the wikipedia article[0]:

> Civil society including especially NGOs, played critical roles at all stages of policy development leading up to the Vienna Conference, the Montreal Protocol, and in assessing compliance afterwards.[64][65][66][67] The major companies claimed that no alternatives to HFC existed.[68] An ozone-safe hydrocarbon refrigerant was developed at a Hamburg technological institute in Germany, and in 1992 came to the attention of the non-governmental organization (NGO) Greenpeace. Greenpeace was given the patent, called it "Greenfreeze," and left the patent as open source.[69][70] The NGO then worked successfully first with a small and struggling company to market an appliance beginning in Europe, then Asia and later Latin America, receiving a 1997 UNEP award.

It describes how well it was adopted worldwide, except for the US, then:

> In the U.S., however, change has been much slower. To some extent, CFCs were being replaced by the less damaging hydrochlorofluorocarbons (HCFCs), although concerns remain regarding HCFCs also. In some applications, hydrofluorocarbons (HFCs) were being used to replace CFCs. HFCs, which contain no chlorine or bromine, do not contribute at all to ozone depletion although they are potent greenhouse gases. The best known of these compounds is probably HFC-134a (R-134a), which in the United States has largely replaced CFC-12 (R-12) in automobile air conditioners. In laboratory analytics (a former "essential" use) the ozone depleting substances can be replaced with various other solvents.[76] Chemical companies like Du Pont, whose representatives even disparaged Greenfreeze as "that German technology," maneuvered the EPA to block the technology in the U.S. until 2011.

0: https://en.wikipedia.org/wiki/Ozone_depletion
My "Hosting providers haven't, previously, thought of TLS serving as an individual user service before (though the Baseline Requirements do) and are having to work out the kinks of that." covers what you're trying to get at here.
I have almost no idea about the Ethereum system, but don't you have to pay to have your code executed on the global ethereum machine? Does that mean I have to pay to test run my code? or maybe after I deploy it?
I personally think there is a significant difference. The birthday messages I get on FB are worthless, but if someone sends me an email or a card that is worth something.

The connection via Facebook is so trivial and transient but it is better than no connection to people I'd have no contact with otherwise.

The people I email photos too will probably look at them a few times and may want to print them and will send an email response. Via FB it's all seen and then forgotten in 30s
Relevant quote:

"We weep for a bird's cry, but not for a fish's blood. Blessed are those with a voice." - Mamoru Oshii
Unfortunately, most billion dollar startups update their status pages post-hoc -- specially if the incidents last <15 mins.

https://status.slack.com/2018-01/d8cf1517de9ecfa8
Web App Security Health Check: All Vulns Covered
I had birthday yesterday. , Statistically by the life expectancy in my country, I'm now closer to death than to the date of birth.
And yet, what makes me feel old is the idea of writing games on top of ethereum.
You can use the test net.
I have a i7 5500 so I am also interested in this.
Broadwell is a shrink of Haswell (22nm->14nm), a "tick" in intel terminology.
So Broadwell users might not be that lucky?
Let’s see what happens with AMD.

It’s vulnerable to Spectre even to Variant 2 but they define it as a very low risk what ever that means and only issuing fixes for Variant 1.

It looks like the second variant of Spectre the out of bounds check is the culprit here; if AMD isn’t vulnerable at all it would be great but to me it looks like they are sitting on the fence to wait and see where the exploits go.
Funny Clips 2017| Pakistani Funny Clips
Bugsnag snares $9M Series B, now gives you a software stability score
L0 is only used by speculatively executed uOPs, before they are actually committed. Therefore anything that reads from L0 has to be speculatively executed too.

So if the uOP populated the L0 was reading from kernel memory, then it won't be committed. And subsequent uOP read from the L0 won't be committed either. So you can't get timing information from them.
You can run your code on a test network:

http://ethdocs.org/en/latest/network/test-networks.html
I'll chime in from the other side as a maintainer of a mid size project at a foundation (eclipse foundation, 8k stars, 4k forks)

We get a ton of drive by contributions of people scratching their own itch. That's most of the 3rd party open source contributions out there.

Beyond that, folks I've hired (we're an OSS company) have been grad student hobbyists that started (and stayed) remotely.

Those have also been my best hires.

I wouldn't feel "guilty" about not contributing to open source.
These projects aren't built for altruistic reasons.

If you want to contribute, do it to learn something and get something out of it. Make interests align.
That keeps it interesting for both parties.

I wouldn't feel "obligated" to do anything as a single developer.

There's only 24 hours in a day, people have kids etc..
Amazing Videos of the World – Surprising Videos
Uber to pay $3M to settle driver service fees class action in NY
ANCESTRAL LINEAGE DNA TESTING
TI introduces DLP for headlights
DragonFlyBSD Posts Initial Kernel Fix for Spectre – Phoronix
> The concept of pain is universal to any life form

Plants respond to anesthetics, some can react to touch/electricity/heat with rapid movement(thigmonasty), they can sense when they are being damaged, some can even display short-term memory.

But do they feel pain? They have no pain receptors. They have no nervous system. They can feel pressure/vibrations, and even respond to it, but that's it.
Innocent growth of technical debt
Good news - unlike the cookie thing, GDPR mandates that you be able to say no. The cookie thing was pointless because it gave nobody any meaningful choice - "click Accept on everything, or don't use the Internet". GDPR is going to make "Let me use your site, but don't use that fact to track me" an option they are legally required to offer. I cannot wait.
Layering graphene creates sensors for energy-efficient IoT
One of the requirements listed [1] as being needed for exposure to this for the provider is:

Users have the ability to upload certificates for arbitrary names without proving domain control.

When you say you were right, are you saying Cloudflare allows that?

[1] https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...
I agree that public education campaigns are not a solution; but you expressed a lot of skepticism about also the economic interventions short of a total ban on carbon-emitting fuels. Before a ban becomes practical, other methods must be used to reduce usage, and economic interventions like taxes, alternative energy incentives, and properly-designed carbon markets have proven effective (though that last seems pretty hard to get right).
Intel Posts Updated Microcode Files for Linux – Phoronix
You can run it in a JavascriptVM.

This an online IDE to play around with Ethereums Solidity language: https://remix.ethereum.org
You can if they are maintained. Most dedicated bike paths around me have ripples in the surface from tree roots and have never been resurfaced since they were built. Using a road bike with skinny tires on them is bone jarring at low speed.
Nvidia, Intel, AMD and Qualcomm Offer New Chips at CES
GtkRadiant and Trenchbroom are modern brush editors
The thing is, in the Netherlands, you could not use a stop sign for that, because a stop sign does not mean "stop and then crawl out into the intersection while maintaining eye contact with other drivers", it means "stop and give way to the road with the higher priority". A proper traffic code should always provide a consistent way to approach any given sign.

If there's no working traffic lights and no stop signs, a different set of rules come into play.
Same story happened to Starcraft 1, in which Blizzard revamped their Warcraft-2 lookalike game to a more isometric view to match something the competition seemingly did.

https://www.codeofhonor.com/blog/starcraft-orcs-in-space-go-...

"At some point I talked with Mark and Patrick about how Dominion Storm knocked us on our heels, and they let us in on Ion Storm’s dirty little secret: the entire demo was a pre-rendered movie, and the people who showed the “demo” were just pretending to play the game! It would be an understatement to say that we were gobsmacked; we had been duped into a rebooting StarCraft, which ultimately led it to be considered “the defining game of its genre. It is the standard by which all real-time strategy games are judged”
...and apparently a British TV Mini-Series http://www.imdb.com/title/tt0124256/
ObamaNet – Photo-realistic lip-sync from text