skysight-inc/HackerNews huggingface dataset:
Even EV certs don't really matter. Case in point: https://stripe.ian.sh/

Let's Encrypt isn't the problem here. Expecting all CAs to properly verify what is and isn't a phishing website is unreasonable IMO. It just won't happen. Smaller CAs have hundreds of thousands of certs... it's just not possible.

The real issue is that a cert only says "Your communication between this site is encrypted, and you're speaking to the owner of this certificate" (Assuming it hadn't been compromised.) Certs don't make any guarantee that the person you are talking to is a good guy, nor that they aren't trying to trick you into giving your password to them.
I don't have a problem with surveillance either as long as the laws are fair, they are deterministically enforced and the judicial system is willing to let minor mishaps slide.

I don't think we'll be able to stop the surveillance state, but we should push for the right legal and judicial culture.
> This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert

Replacing a cert doesn't get around cert pinning. That is the exact use case that cert pinning protects against.
Please help us make the internet safer: $250k Hyper-v bug bounty
You don't have to "save yourself" if your winning...
Even now it doesn't inspire much confidence :)
Austin tech workers saw the biggest jump in salary last year
"…many of which have been posted on HN"

It's easy to get into a bubble.

Apple, Google, Microsoft, Coca Cola, Amazon. Top 5 brands of 2017, according to

http://interbrand.com/best-brands/best-global-brands/2017/ra...

(And #8 is Facebook.)
That’s interesting. How is editing an image of someone and not even showing them disrespectful.

Do you imagine others naked? Is that disrespectful?

It’s really interesting hearing about other people’s mora systems.
People who cheer for tons of stupid fucking HTTP warnings all over the place really bug me to be honest. Anyone who uses the web needs to be taught the difference between a secure and insecure connection and told where to look for signs (this assumes we burn stupid shit browsers that look to mangle URL bar by removing data from it).

The grandma will not make better decision if you put in another dumb warning like this one https://i.imgur.com/rxmyWtF.png to waste more and more of my time when I enter my password on the same website over and over. I KNOW IT'S INSECURE, JUST STFU already.

I'm at the point where I will look to build my browsers from source after removing that shit (along with removing inability to add certificate exceptions for certain situations). Good thing they're open source.
> https is about two big things in my mind.

Three things not two. Confidentiality, Integrity, and Authentication.
Anarchist hacker Amir Taaki says Bitcoin’s boom means it’s on verge of collapse
> The existence of vulnerabilities doesn’t negate the bullshit security theatre of certificate authorities.

I agree that the current CA system has flaws, but there are efforts such as Certificate Transparency[1] and DANE[2] attempting to improve or bypass the CA system. That said, just having encryption defeats passive eavesdropping, and even the current CA system of authentication raises the bar for active eavesdropping.

> Banning http is a great example of tossing the baby with the bathwater.

I'm not sure what you mean by that.

> Https is better, but there are still valuable use cases for unencrypted web traffic.

Like what?

[1] https://en.wikipedia.org/wiki/Certificate_Transparency

[2] https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
'Spectacular' finding: New 3-D vision discovered in praying mantis
If the legal standard finds they are employees the added cost is just more incentive to automate the jobs away completely. Soon enough all these terrible horrible jobs you speak of (which every driver I’ve spoken to is happy to have, usually having quit some other full-time employment to do gig work instead), soon enough all these jobs simply won’t exist at all.
We are hypnotized by a few key beliefs which contradict our nature and reality:

- that we are separate/isolated from the rest of humanity

- that we need to be self-sufficient in order to survive

- that money has real value

- that without money we don’t have value

- that almost everything can measured in money

- that making more money is better

- that exploitation is ok and doesn’t influence us

I disagree that the trillions buy luxury. I’d argue that they expose addiction. We are burning our environment, and our personal lifetimes, faster and faster, to add numbers to wealthy peopke’s Accounts. It’s like redirecting to Dev/null.

It is a flow which creates enormous confusion, grasping, suffering, on all scales.

I visualize it as the grey tornado thing from stranger things, on planetary level, but especially intense in the US, a country with institutionalized government corruption and the most barbaric industrialized commercial healthcare in the world.

On the other hand, money can be used to support and express gratitude.

So it’s not really the money, but the hypnosis and the addiction.
There are plenty of instances where websites do not need to use HTTPS

No there aren't.

like simple static websites for small businesses that do not collect personal user information

Until the connection gets MITMed to return a fake login page.
DriveTime | Lead Software Engineer | ONSITE | Tempe, Arizona

C#, RESTful services, Angular 2/4, TypeScript, Node, Azure

DriveTime is ranked 12th nationally as the “best place to work” for IT employees. With over 145 dealerships across the country, DriveTime is nation’s largest integrated used car retailer.

* Competitive Salary + Full Benefits: Medical, Dental, and Vision

* 401K, life, Long-term Disability Insurance

* Continuous Learning: Tuition Reimbursement Program & Technical Training

* Company outings including Golfing, Spring Training Game, and Habitat for Humanity

* An AMAZING, fun, progressive work environment featuring a gym, pool table, foosball, horse shoes, electronic gaming, Virtual Reality Room, a large outdoor turf for tossing frisbees and footballs, gas BBQs, etc.

https://jobs.drivetime.com/Openings/Details/jobid/22378/lead...

Feel free to email me if you have any questions.
> Except that antibiotic resistance also goes away very quickly unless the bacteria are kept in an environment conducive to it. Antibiotic resistance is expensive evolutionarily.

This is the first time I've heard this. Can you recommend some references with more info on it?
I sincerely hope you know this very far fetched to achieve.
Some are self-inflicting wounds, and for the most part untenable. And finally some way more harm than good (sabotage and revolution demand heavy prices, larger than the debt you're trying to get out from under).
> Edit: Guess the Uber shills don’t like it and downvoting is easier than admitting you’re wrong

This breaks not one but two of the site guidelines. Would you please (re-)read them and not do that? https://news.ycombinator.com/newsguidelines.html
The Evolution of Petface
Well, what's a quicker way for them to learn? I guarantee if they did something incorrectly people like you will point it out :)
the gps could also be just a warning. same effect

also we know how these things go. first a warning, then a ban, then extinction from history
Access to the current row was improved in the SQL:2011 standard. See section "8.2 Navigation within a window" in this paper: https://sigmodrecord.org/publications/sigmodRecord/1203/pdfs...
Sensor to be installed to prevent lonely death
The complexity of the web platform is at least party to blame for this. The specifications for HTTP, HTML, DOM, CSS, JavaScript together are gargantuan and growing even further every year. This makes the development of Chrome's new competitors and the maintenance of already existing browsers extremely expensive, and it also hinders cross-browser compatibility of web applications as every browser fails to implement the monstrous specs flawlessly in its own unique ways.
Yes, the magazine for NeXT machine users. NeXT capitalization I think was later changed to NEXTSTEP the operation system and OPENSTEP the cross-platform environment.
Could you please not post snarky dismissals to this site? We're trying for better than that here.

https://news.ycombinator.com/newsguidelines.html

https://news.ycombinator.com/newswelcome.html
Future of Chinese Solar Module Imports in India Likely to Be Decided Soon
Larastream – It's Like Twitch, but for Laravel
There are proposed standards to serve a URL for a captive portal via DHCP.

But hopefully, many captive portals will just die off.
It is called market making the news. Easy to attribute to recent events like you said.
> log in with some criteria more than just a username/password

The problem there is that captive portals don't add any extra link-layer security. The network is open, so literally anyone can sniff packets.

It's uncommon, but a network using WPA2-Enterprise and user/pass uses different keys for each person (not sure if per device or per user), so you don't have to trust everyone in the room.
I have a mild stutter, I generally just call it a "vocal catch" because it's usually getting stuck and not being able to produce a sound instead of repeating a syllable. Usually only happens a couple times a day during normal conversation. More so when emotional.

IM is awesome. Very glad that's a thing.

I have a penchant for looking up a new word's synonyms. Which usually results in having a couple of "escape hatches" if I feel myself getting caught up. Sometimes, however, that's not the case and I just have to accept that I'm getting tripped up. At that point I'll audibly sigh, which usually un-sticks me enough to proceed.

When I give presentations, they are usually to my team. I've explained to everyone and they are understanding (I also asked them to not fill in the word they think I'm trying to say). There's mutual respect and they all patiently wait when it happens. Having that understanding really reduces the stress and makes presenting not painful.
Maybe, but that's no reason to post unsubstantive comments or uncivil swipes to Hacker News, thereby making this place worse.

If you know more, the way to reply to a wrong comment is to share some of what you know so the rest of us can learn something.
You can trust a person you choose, perhaps. What about that person's successors? Data is forever, people change, people are coerced or bribed, and stuff gets stolen or compromised (or subpeonaed). Over time, databases are leaky.

Take the long view. I guarantee that the people collecting the data do.
Yes, and that is an argument for https with certificates...
I'll agree that it's as intuitive as using a mouse. I'll strongly disagree that the cursor positioning was perfect or that "you just point the remote at an enemy and shoot".

Point the Wiimote generally at the screen, waggle it around a while to figure out when the sensor bar is in view, and then use mouse-style relative motion to get it pointed where you want. If I just point it at the TV, I don't know where the cursor will be, but it won't be exactly where I pointed.

A CRT with a lightgun is much more of a point and click situation.
Probably earlier that that. I purchased the mustang set in the early 90's for a late 80's mustang. It definitely had a lot of special service tools usage.

(fox body, had no idea when I sold it for $500 in the late 90's they would be considered so cool today).
Spelling mistake: "real bse of"
I feel like this would be a bad idea seeing as their employers are in the business of watching your internet traffic and catching such shenanigans.
Let's not start the whole slippery slope logic, please.
I think you are overestimating their importance. The credit agencies have already pretty much proven to us that they can't accurately rate risk when their fees are on the line.
I know when I was told to go home at 31.5 hours every week it wasn't by my choice. The months it took to scrape together enough money to get a car and interview at non retail jobs also wasn't really a choice unless you count "give up and be homeless" as a reasonable option
> I don't think we've seen the end of non-Amazon retail yet.

Amazon is less than 3% of US retail. Walmart's retail business is three times the size of Amazon's retail business. And that's before we count the fact that half of Amazon's retail business, isn't Amazon at all.

Amazon is not going to actually dominate all of retail. Amazon is not going to become a retail monopoly. Amazon is not going to build a retail business dramatically larger than Walmart's retail business. The shrieks to the contrary are strictly emotionalism rather than fact-based, just as they were 12 or 15 years ago when Walmart was going to destroy everything in retail and monopolize everything. It's just as silly and absurd to pretend Amazon is going to do the same thing. What Amazon has is an early lead in online retail, because they were an aggressive first mover. Only ~10-12% of US retail has moved online. As that percentage dramatically increases in the next 20 years, Amazon's total share of online commerce will fall accordingly. They're not going to be doing $3 trillion in annual sales in 15 years. It'll be extremely impressive if they can manage to one day catch up to Walmart's retail size.

> Neither media or public sentiment towards Amazon is great right now

Public sentiment towards Amazon is extraordinarily high. They typically have the highest, or one of the highest rated brands and consumer experiences. Their customer service is routinely voted as among the best of any company.

What opinion pieces in the NY Times say about Amazon, are not at all representative of how the majority of people feel about Amazon. That's a classic echo chamber premise.
These numbers in a computational model (or even Jupyter notebooks) would be useful.

We may indeed need fractional satoshis ('naks').

With terabyte blocks, lightning network would be unnecessary: at least for TPS.

There will need to be changes to account for quantum computing capabilities somewhere in the future timeline of Bitcoin (and everything else in banking and value-producing industry). Probably maybe a different hash function instead of just a routine difficulty increase (and definitely something other than ECDSA, which isn't a primary cost). $1.3m/400k a year to operate a terabyte mining rig with 50Gbps bandwidth would affect decentralization; though maybe not any more than it already is affected now.

https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_... (51%)

Confidence intervals for these numbers would be useful.

Casper PoS and beyond may also affect future Bitcoin volume estimates.
Epic Games Fortnite – Postmortem of Service Outage at 3.4M CCU
“The effects of lifelong exposure to a perverse contingency” (2002)
https://www.theatlantic.com/entertainment/archive/2017/11/i-...
also off topic:
on William F. Buckley and his understanding of the spanish language: for context start at minute 14
https://www.youtube.com/watch?v=bNxzQSheCkc
I agree. It's only as a potential employer that they lose their luster.
It's not just javascript though, we've seen ISP (or other malicious actors in the network) inject ads, of even place the entire HTML content of the site into an iframe.
>In Golang, dependencies are minimised. Everyone tries to stick to the standard library as much as possible.

i don't understand this. yes net/http is nice but there's no router, there's no orm (yes i know that's not really possible at all because of strong typing), yes database/sql exists but you know most everyone uses at least sqlx and e.g. lib/pq. yes html/template is nice but we're all doing SPAs now anyway. okay there's logging but e.g. no websockets. so in what sense is the stl really complete? what modern web app could you write with just the stl?
You are incentivized to hurt people and steal their money if you reasonably think you can get away with it. That fact being true does not mean that actually hurting people for your benefit isn't evil. There are lots of actions that you are theoretically incentived to take, but it _is_ evil to do so.
There's no need to pay a publisher £2000. The authors can self-publish.
"...not reducing regulatory overhead."

AKA "incumbency protection."
Over the last couple of years I’ve been shopping at Whole Foods less as the quality of their produce has gone downhill. As
one who cooks almost every night I like to personally select the produce I’ll be using. Delivery drivers on a tight timeline will never be able to meet the expectations of others like myself. I simply don’t see driving to the store as a problem, I see it as an enjoyable experience(and I have small kids). All of the free delivery in the world won’t keep me from driving to my local organic Co-op to choose the best vegetables, fruit and cuts of meat.

Point being that Amazon’s impact on the grocery business will likely be far short of transformational.
This hasn’t been true for at least a year. There is zero difference in ad revenue for HTTP vs HTTPS now. Join any major online community for publishers and ask anyone if you don’t believe me.
They just engaged in an action that substantially increases their monopoly over access to user information, which is their golden goose. And this action is going to result in some degree of backlash. People hosting information only static sites aren't going to be thrilled that Google is effectively coercing them into, at the minimum, setting up let's encrypt when they have no reason to do so. And of course, this can be seen through some lens as benefiting the public good. Do you really think Occam's Razor points to the second reason as the primary incentive?

Another example from Google would be them preventing you from running plugins on Chrome that were not from the Google store. Yeah, it can be spun to be about protecting users from malicious plugins but it also enhances their control over their users. Incidentally, they decided to ban evil things like Youtube Downloaders from their store as well, which is a far more impactful given their increased level of control 'for your safety.'
> this assumes we burn stupid shit browsers that look to mangle URL bar by removing data from it

That's just about every browser now. I think that full URLs are only available in Firefox, and only if you set `browser.urlbar.trimURLs` to `false` in about:config. Hiding URL information is a very bad trend.
Here are two studies from the first page of a Google search on "losing antibiotic resistance",

Long-term starvation-induced loss of antibiotic resistance in bacteria

https://www.ncbi.nlm.nih.gov/pubmed/24196362

Loss of Antibiotic Resistance in Staphylococcus aureus Resulting from Growth at High Temperature

http://www.microbiologyresearch.org/docserver/fulltext/micro...

And here's a more high level answer from the Biology StackExchange on the mechanism by which this happens with a link to 3 other papers on the underlying subject https://biology.stackexchange.com/a/15930
> Yes, Qt is the only pure C++ cross platform GUI with high quality tooling

Sure. But what about, e.g., gtk?
They have a staff of 150 to publish 20 articles each month. That seems quite top-heavy. Remember that authors and reviewers of the articles are not paid.
That wouldn't solve any problem, just shift the paywall to someone else.
> We found evidence that neurogenesis and myelination—as well as genes expressed in the synapse, and those involved in the regulation of the nervous system—may explain some of the biological differences in intelligence.

re: nurture, hippocampal plasticity and hippocampal neurogenesis also appear to be affected by dancing and omega-3,6 (which are transformed into endocannabinoids by the body):
https://news.ycombinator.com/item?id=15109698
Private browsing is working fine for me.
Lack of contacts and embassy are the minimal measures to maintain the charade.
Mixed-use developments may actually reduce housing affordability
I built a web app in Go recently, and while it was enjoyable, progress was pretty slow. I eventually decided to change gears and rebuild it in Elixir, and so far I have no regrets. Phoenix is pretty fast, awesome, and powerful. There are a few concepts you have to learn, but overall it's been a much simpler experience and way faster to prototype with.
The Evolution of Bacteria on a “Mega-Plate” Petri Dish (Kishony Lab) -- Harvard University

https://www.youtube.com/watch?v=plVk4NVIUh8
Indeed. I saw his work at an exhibit in Seattle years ago. It is a mind-bender, for sure.
Maybe someone could answer this for me, this discussion made me curious:

I have an old (2005) Mac, and my fav browser on it can't show https sites at all 90%+ of the time - "Cannot Load, Secure Connection Failed". (like the usual https sites linked to in HN stories) But it works fine with some https sites, e.g. github https, youtube, this page.

What is it about those 'working' https sites that makes them different? Hopefully that's enough info to answer that.
Link to paper: http://www.tandfonline.com/doi/full/10.1080/01944363.2017.14...
Myetherwallet forked to mycrypto
The launch news: https://medium.com/mycrypto/mycrypto-launch-6a066bf41093

https://www.myetherwallet.com/ https://mycrypto.com/
The problem is solved, save for entrenched incumbents.

Open Access: PLoS https://www.plos.org/

Closed Access: (P)PNAS https://www.google.com/search?q=ppnas http://andrewgelman.com/2017/10/04/breaking-pnas-changes-slo...

Closed Access journals DO NOT serve as a quality filter. The unpaid peer-reviewers serve as a quality filter (and often a poot one anyway).
"We are creating a world where anyone, anywhere may express his or her beliefs, no matter how singular, without fear of being coerced into silence or conformity."

It's why I spit (virtually) upon posters who defend Google's actions towards Damore, and Twitter and YouTube's actions to deplatform people.
I used to use Instacart, but it was a hassle to manage the people doing the shopping. They would get bad produce. They would mistake zucchini for cucumber. They would make nonsensical replacements. Constant screw-ups. Sure if you're buying toilet paper or some other generic commodity then it's fine, but you can already do that with Amazon.
Yeah I don't think you can.

The only way to resist is to watch the watchers.

Keep a camera/phone on you at all times.
Distribute secret cameras near Govt buildings.
Good is _really_ subjective.
While its definitely better than JS/Node it has some warts.
For example, I find the "time" builtin package to be pretty terrible. Specifically how it does formatting[0]. This method makes the format look like a magic string rather than being an obvious template like other languages would use.

I've found some legitimate bugs[1] in simple functions that don't give me a ton of confidence in it either.

Personally I find the standard libraries in the likes of Python and .NET Core much more comprehensive, intuitive, and reliable.

[0]: https://golang.org/pkg/time/#Time.Format
[1]: https://github.com/golang/go/issues/15852
I would have trouble following security advice from a company that was serving mining ads directly from its websites last week.

Main argument in favor of http would be it's making browser fingerprinting harder from a privacy standpoint. Https by itself let the server identifies its clients individualy without cookies.
https://github.com/postgres/postgres/commit/0a459cec96d3856f...
Potentially, but it would be easy for drone manufacturers to defend against, and you would likely need to make the target area so dense with the particulate that it probably wouldn't stay in the air long and the drone could potentially wait you out.

The other direction you could possibly go is a super-fine, but conductive powder (would carbon powder work?) that could get in the motors and potentially cause a short. Particulates that fine would probably be a health risk though.