skysight-inc/HackerNews huggingface dataset:
The world is increasingly composed of computing devices that stay on 24 hours a day. Long gone are the days when only servers used to do this. Now most desktops have ~90% uptime while mobile devices are almost at 100%. Combine that with ever increasing, cheap bandwidth, I think the time is ripe more than ever for hosting your own simple, low traffic services including websites. The only obstacle here is that there still no simple setup wizard that can make them painless to host and take down, with a few clicks. A package that combines a simple, secured web server with a site builder.
Mozilla will ship the Webauthn API in Firefox 60 (May 9):

https://hacks.mozilla.org/2018/01/using-hardware-token-based...
that's why you bury some treasure and keep the location locked away in your brain!
You can now use Arduino to program Linux IoT devices
As a pilot and engineer, I think there are good reasons to be skeptical. Here's some of my questions.

1) Can it autorotate? Or in an emergency does it have to glide?

1.5) What's its glide distance? Cruising altitude? There's a lot of drag from those propellers so I imagine its best glide speed isn't great.

2) How are you going to get it in a city? Seems like you're going to have to go to the local GA airport (which are fairly frequent, but you'll still need a normal taxi).

3) There is a really limited range (100km or 60mi) and only goes 150kph (90mph) (I'm guessing max cruising speed, so real world you'll see it going slower, plus you have to consider TO and LND). That's not very far and not very fast.

4) GA is dangerous. How is it communicating with ATC? Can ATC divert it? Will it integrate into the standards (N1234 fly one niner zero). What happens when someone doesn't use the standard (this WILL happen)? So can it fly in class B airspace? I even have questions about class C and D. And how is it going to handle GA aircraft? And if it is in class G how does it deal with that person that isn't using the radio? Does the computer know when its own radio isn't working? And does it know ATC light signals?

5) Who is doing the inspection? In GA we check everything before we fly. Sure you can automate fuel levels, oil, etc. But how are you checking things like propeller or airframe cracks? And is it doing runups? How often?

6) Is it VFR? IFR? What altitude is it flying at? How does it handle cross wind? Which is going to be a big pain if you are flying in cities.

And as to why pilots not only choose, but are required (in the US), to do TO and LND is because that's BY FAR the most dangerous part. I can even tell you I'm thinking a lot more during TO. As a pilot you're constantly thinking about what you're going to do if there is an engine failure. During TO you're under 1000ft and the runway is behind you (you can't turn around). LND, well at least you got the runway ahead of you. Cruising? You got plenty of time to figure out where you're going to go. Pilots aren't just required because liability and federal law, they are required because automation isn't there yet. I can tell you that it is hard to see aircraft in flight. Especially in conditions like sunrises and sunsets. Many accidents happen on clear and sunny days.

There's a lot of things I like about it, but there is legitimately a lot of reason for concern. But it is a prototype after all.
Oh look it's happening again. The people who think this article might not be "drivel" are being grayed within minutes.

And by the way, this censorship happens on tech stories too. This article from three months ago wasn't even flagged, just didn't show up until page 3 or 4 despite being new and having tons of comments - https://news.ycombinator.com/item?id=15745363.
Minimizes the time employees are willing to spend evaluating the return.
This is great news! Let's Encrypt has helped me secure many of my own boxes without having to maintain my own CA, very happy to see them grow.
For me it's EdgeWise, Session Manager, DownThemAll, Status-4-Evar.
Guetzli: Script in Python to convert all the jpeg of a folder recursively
First, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them.

> It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet.

Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lot of us are also using custom v1 code for various reasons that may not be easy to change.

The preferable end-of-life date for ACMEv1 (sparing any existential security issues) should be never. Otherwise you will be executing a Geocities-sized web meltdown every time you phase out a version of the API.
Different sectors of the industry use StackOverflow in varying amounts. Systems programmers on the whole probably use SO a lot less than JavaScript programmers, for example. More senior engineers use it less than more junior engineers. And so on.
I feel ashamed that these people live in the same country as I do. The article certainly does explain a lot about why our country is the way it is. What a nasty, disgusting culture. Yet somehow, I'm supposed to have something in common with these people? I shouldn't just dismiss them as hateful idiots? That notion is beyond ridiculous.
Nice non-sequitur. Somehow the limiting factor on the ability of someone to judge professionalism is the number of papers they've written?
This type of behavior should have been expected from the day HN announced they weren't allowing political news on their site, just over a year ago.

It's pretty irresponsible: Primary news outlet for an industry that is already noticeably lacking in social and political responsibility decides to put up another set of blinders.

Low EQ Silicon Valley refuses to use its influence to affect political change in any meaningful way. Or even just political awareness. Ironic when you consider this political/social passiveness enables the same surveillance capitalism that this community is constantly complaining about.
also useful for incorporating noisy GPS sensor readings! I tried to do this in an undergrad autonomous vehicle but failed at the time :(
“What if we told you we can backup your mind?” ...and never restore it.

As someone who has lived through many backup formats that stop being supported, don’t work, or decay with time this seems monumentally stupid as anything other than basic research.

I applaud their goal, digital sentience, but sorry for any of their customers. They need a pitch that works on the recently dead (eg, current cryo companies) as I don’t think there are any countries that allow euthenasia for life extension purposes.
> My comment on it is permanently compressed (even when the thread is opened in an entirely different browser) and has been stuck on 11 points.

You pointed an inconvenient fact about Obama and a lot of people are not going to like that. They could discuss it or flag and run away quickly. Flag and run away is too easy, so that's what ends up happening.

One time I criticized the obsession with Russians. A user went and start digging through my comments to determine that I speak Russian (which I do) and that meant proof I was a Russian shill, paid by Putin presumably to subvert Democracy right here on HN. Which is doubly creepy given that the Russian government deported and persecuted members of my family in the past.
No, but somehow I get the feeling we're talking about entirely different levels of "slower" here.

You're talking about GPU-accelerating complicated page renders.

I'm talking about things like regularly seeing flashes of unstyled content on page load, which I thought we'd left behind somewhere in the last millennium.
Customer LTV applied to Retail. Amazon can already do it, so this is just catch up.
Yeah, I think that if someone hacked your DNS provider, they could add secure-payments.yourbusiness.com and start spamming people with "late payment! enter your credit card!" notices or something.

So I guess, make sure you trust your DNS provider if you're using wildcards. Or is there another exploit I'm missing?
The Workers runtime fully supports streaming requests/responses. If you're just passing the response through, it does not get buffered in the worker, and it is not subject to the Worker's memory limit. You can absolutely download multi-gigabyte files through a Worker.
Uploaded a one liner package to NPM = contributed to OSS.
We also do the opposite, and we use our IMU to better estimate the position of those features/clues. This is exactly what SLAM does, at its core it is just a Kalman filter with the twist that each time it finds a reliable visual clue it treats it as a sensor and makes it part of its state, a thing that allow us to tell our position much better and build a map.

Some nitpicking here: There are some SLAM systems and flavors that use a Kalman filter as the main estimator under the hood but most are either hybrids or separate the tracking and map optimization (using batch / bundle adjustment methods).

Digging a little deeper here I think it's important to mention that a Kalman filter is just a recursive least squares estimator, and is in fact equivalent to an Information Filter (which, IMO, is much easier to understand if you're already familiar with linear regression / LS systems).

In fact a Kalman filter is just a fancy mathematical reformulation of an Information Filter that allows you to save quite a bit of computation time in case each observations is low-dimensional compared to your state.
Would probably start out as being prohibitively expensive and trend towards relatively cheap if it's possible and there's demand. If it's possible then it's hard to imagine there not being demand.
It's not even about edge cases - it's just good security practice to isolate credentials as much as possible and limit their scope.
Go fuck yourself.

There are plenty of ways to be outraged by the actions of these "independent reseachers." How about 1. Irresponsible disclosure affecting end users. 2. Shady trading practices of their hedge fund CFO. Just to name 2.

You are a fucking retard, and your obvious anti-AMD bias is showing.
I'm in full support of net neutrality (as it seems everyone but the telecom companies is yet here we are, but I digress) but I like to think if this "doomsday" scenario were to happen then the outcry would finally be swift and effective in tearing that down for good. People won't accept it because they have already experienced what the open web can be.
On the face of it wildcard certs seem easy to implement - just match anything in place of the * - but clearly that's not the case as it took years to complete, anyone mind sharing some of the subtle challenges and complexities involved
https://news.ycombinator.com/item?id=15745363

This story from 3 months ago is as tech-related (Google changing their algorithm) as you can get. It wasn't visibly flagged, but was almost certainly de-ranked, and it wasn't just me who commented about it.

Even if you can buy the excuse that this isn't related to tech or start-ups, and ignore the very active commenting on it, you're still left with the utter refusal to allow any transparency about what is flagged and de-ranked. Why shouldn't we demand better?
Apple Announces WWDC 2018 June 4-8 in San Jose
It could also be that more experienced developers don’t have time to take surveys.
> I don't have whatever regional equivalent there is there

I imagine you would install it if Uber is not very common in that market; waiting for an Uber to come might take much longer than for you to install that regional equivalent.
> 1-day notice? Such aggressive wording without even the chance for AMD to address the concerns?

Are the reporting parties under any obligation to give AMD notice?

Behaving according to AMD's wishes is not an obligation. Businesses will be the first to tell you that agreements and laws form obligations, not what someone perceives as a nice thing to do.

If not, then you're reacting to a distraction, a detail that doesn't matter: how the corporate-friendly tech press is trying to shift blame away from the party that either sold CPUs with bugs in them (mistakes happen, and this is unfortunate) or distributed nonfree (proprietary, user-subjugating) software which also happens to contain insecurities (a malicious and unjust way to distribute software).
No, I'm just noticing again that people who don't don't do a lot of vulnerability research have a lot of interesting opinions about the professional norms of people who do that work. But you never know --- maybe they do a lot of research, in which case, yes, their opinion on security research norms is a lot more interesting to me.
Why does combining mean multiplying? I got lost there. I get that you want to average/weight the two values.
You memorize the bitcoin private key before preservation. In a way that requires consciousness to reconstruct.

Public key verifies the value and there’s a smart contract with some percentage to the successful recoverer.

Depending on the recoverer’s profit margin they will restore whenever there’s enough value to make it worthwhile.

Whether bitcoin will exist and whether it will appreciate is a different story. But assuming bitcoin exists, resurrection is a certainty.
Off topic, but I'm curious: Why do you call Go a subset of Pascal? Go seems to me to be rather different, both in spirit (much less restrictive and nanny-like) and in syntax.
for all the posts on firefox bugs, on firefox 61 everything seems to be functioning properly btw
Exactly!
What might not be immediately obvious is that CSP works OK for concurrency, but not for distributed systems.
For more details, see 2.1.3 (page 28) of https://eprints.illc.uva.nl/943/1/MoL-2015-02.text.pdf
Top sites tiles on the new tab page in Firefox.

https://www.mozilla.org/media/img/firefox/home/new-tab.a1c9f...
Yes. Wildcard certificates are useful primarily as an alternative to manually managing many certificates. But in the age of automation (now), LE wildcard certificates are only really useful to avoid rate limits, which is 20 certificates per week per set of names.

Key compromise for a single site is much less disruptive than losing control of a key that protects hundreds or thousands of sites. Generally you want to keep your scope smaller, it's safer. Rather than blanket-verify everything. Wildcards also makes it more difficult for you to see what of your names is going through CT logs.

Caddy will support wildcard certificates, but most users will not need them, because already Caddy can obtain certificates "on demand" - dynamically, during the TLS handshake. Again, the main reason for using wildcards at this point would be to reduce pressure against LE rate limits.
IANAL, but I thought modern contracts just give the company it, and thus avoid the step where a bureaucrat can decline.
To expand on that, when you invoke fetch() and get a Response object back, that object is returned as soon as response headers have been received; it does not wait for the body. The Response object contains a ReadableStream from which you can read the body, but if you instead pass the response directly to event.respondWith(), then it will stream right back out to the client.
Depends only on how much different v2 is from v1.
To echo a sentiment I posted in another thread.

"I don't mean to 'complain about points' but it's rather absurd to look at the wild swings from +8 to -8 and back again for any of my posts on this topic. It speaks to me that there are at least two 'factions' with very polarizing opinions on this, and the context has turned less from discussion into silencing vs vouching. I certainly don't remember seeing these patterns as strongly 5+ years ago."

I've become increasingly unhappy with the quality of discourse over the last few years, especially on these "fringe" topics. It's doubly sad because I haven't found comparably good levels of discussion that HN sometimes generates, but for these other topics. (Ignoring the additional sadness that I fear by sticking our heads in the sand about anything that smells like politics we're in for a "Very fun" next few decades, I've historically been a strong advocate that to draw a hard line in the sand between "this is tech" and "this is politics" is to abscond a lot of responsibility _every_ expert community should have for the political space they operate in)
It’s a feature not a bug.
Via what method? Iirc, there are many economical methods of transportation between those two cities... Also, that $100 per hour is pure cost with no markups to provide for revenue or growth.

I could easily be wrong, but the aircraft they were displaying looked like a 2 seater, not 4.
>> branch misprediction: 5 nanosec

Turns out it was a lot more than just "5 nanosec".
No, disclosing vulnerabilities without disclosure does not in fact make you a "grey hat", much as vendors would like that to be so.
I feel the same way. There's a scene in the book Old Man's War by John Scalzi which drives this point home in a way that has really stuck with me.
Do tech incubators work? NYU Tandon's answer: 3,200 jobs and $4B
Definitely. Lately I see more vehicles in my area with both Uber and Lyft decals than with only one or the other.

It seems there's even a market catering to these people now: https://www.amazon.com/Driver-Light-Removable-Suction-Ridesh...
I don't have an example handy, but when FF 57 was first released, I actually took the effort to check what are the prospects of extensions I use in future FF versions. I found at least one extension which required a feature that FF developers refused to fix because it would expose APIs they didn't want to expose, end of story. So it's not just a matter of "scratching your own itch", a lot of it is politics.
Irish music is tough that way. I play a bit of bluegrass and Irish, but I find it easier to join a bluegrass jam. You do need to learn to improvise for bluegrass, but once you can (and you can follow the chord changes), you can improvise during a break and, especially, play backup. Jazz musicians can also do this with chord charts, as long as someone knows the lead.

Irish music is both easier and harder in this regard. You can get away with not improvising at all, but I find the tunes are complex, played in unison, and often at high speeds. There's no moment where all eyes are on you and you have to improvise, but there's nowhere to hide if you don't know the tune, either. Adding additional challenge is the minor variances in tunes that occur between regions and jam sessions. You really do need to build up a very substantial repertoire of music to be able to drop into an Irish jam and be able to play along for most of the session.

(Yeah, I know, I'm responding to a minor point, and going off on a tangent, I just like the subject).
> I'm talking about things like regularly seeing flashes of unstyled content on page load

Never seen on my end for quiet some time, maybe worth a bug report: https://bugzilla.mozilla.org
Exactly, I would expect this to be a 100% legit chargeback case, which is going to hurt them in the long run.
> I recon some of these providers are going under soon?

I really hope so.

The cost to providers is exactly the same for a wildcard and a standard certificate, and yet they costs hundreds of dollars. It's unbelievable it's lasted this long
I’d love to understand how this relates to the work that Improbable are doing in supporting massive scale online game environments.

Is this an open source competitor? How do they compare?
> The preferable end-of-life date for ACMEv1 should be never.

As would be the preferable end-of-life date for SSLv3 and HTTP.
My description of my personal experience at this incubator is here:

"The New York University startup incubator at Varick Street is awesome"

http://www.smashcompany.com/business/the-new-york-university...
It looks like most people stay at a job for just a year or 2. But, it would have been interesting to see a question as to why they left: were they forced out due to something the company did, or did they leave of their own accord for a higher salary (that was top ranked for how they assess a job)?
Kindness. It's an endangered species nowadays but it used to increase with time and wealth, and perhaps when wealth rises again the trend will return.

Or I'll do it myself if I can.
Tor Browser 7.5.1 is released
Keeping Open Source/Community Governance Simple and Uncomplicated
IMO HN should stick to tech. And even if there is an argument over between Python or GO, I am fine with it.

Politics shouldn't be discussed at all.

It has been understood that thing don't go as smooth as in a community like these. I personally think that the story about Trump and Broadcom or endless parade of bitcoin at $x price shouldn't be voted up at all. But, somehow people feel value in those. I tend to skip those stories.
Also maximizes the time to discovery if there are real issues
I imagine so, too. If you have N machines each serving a different site, better to have each only have a key valid for its site so there's less impact from one of them being compromised.

btw, in that scenario, even if the sites all share an IP address, you can use a TCP-level proxy that supports doing the TLS SNI exchange to determine where to send the connection on, so the proxy doesn't need any of the keys and the encryption is end-to-end.
DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)
I like the idea, but it has still some problems. Such as: what if competitors start gaming the system? Will this not result in enormous bureaucracy? How do you control that developers do not swap/sell their certificates?

Perhaps it's best to keep things straightforward at first (?)
It's not unheard of in the sense of never having happened, but it is a clear breach of ethics for a security researcher. (The term for not doing what these guys did is "responsible disclosure").
It sure seems that way. It wouldn't be the first; look, for instance, at Justine Bone's MedSec.
Though : would that lunch be as expensive as $10 per month or would it be almost free like $0.1 per year ? I consider that to be pretty much free :)
Then they threaten to resurrect you 1000x and torture each of your resurrected selves for 1000 years unless you tell them the private key.

Roko's basilisk meets bitcoin.
From the CA's perspective or the subscriber's perspective?
I'm not sure I'd want to be the one to test the MVP.
And the penalties for doing so are draconian and applied by a different judge and historically judges frown on attempts to subvert the judiciary.
Not sure how the availability of wildcard certs changes that scenario, if I can set the DNS record for secure-payments.yourbusiness.com then I can get a non-wildcard cert for it and get on with the spamming straight away
There were plenty of active commenters, most of them considering this a very serious issue.

And no one has been able to offer any explanation why my comment is permanently collapsed even when opened on a different browser, despite no obvious flag and a healthy amount of positive votes.

Finally, as I've said elsewhere here, there appears to be evidence of "silent de-ranking" where stories like the one about Google's censorship are not flagged in any way but won't show up on the front pages.

As a community HN deserves better, by far. Normalising this behaviour will lead to dark and bad places.
The US Military is a logistics organization that happens to fight wars.
No, this is a first. Even MedSec was more coy than this.
How Conservative Activists Catfished Twitter
Private equity? Both of the companies are publicly listed in the US.
Carbon Copy Cloner 2017 Serial Crack for Mac OS X Full Download – Crack4Mac