skysight-inc/HackerNews huggingface dataset:
SAN is the only correct way to write any kind of name for servers on the Internet in a certificate. The "Common Name" was left as a compatibility feature like 20 years ago when SANs were invented and then it rusted into place, but is no longer examined by current Firefox or Chrome browsers for "real" certificates from the public Internet. Chrome shipped releases for a while with a bug where they'd complain the server's cert had the wrong "Common Name" when actually they never checked CN at all, and so it might even have the right Common Name, but they really meant "Your SANs don't match fool" and hadn't updated the error text.

Because crappy software (looking at you here OpenSSL) makes writing SANs into a Certificate Subject Request way harder than it needs to be, a lot of CAs (including Let's Encrypt) will take a CSR that says "My Common Name is foo.example" and sigh, and issue a cert which adds SAN dnsName foo.example, because they know that's what you want. Really somebody should fix the software, one of these days.

In older Windows versions, SChannel (Microsoft's implementation of SSL/TLS) doesn't understand ipAddress, and thinks the correct way to match an ipAddress against a certificate is to turn the address into ASCII text of dotted decimals and compare that to the dnsName entries. This, unsurprisingly, is not standards compliant.

It's good to see a CA not trying to fudge this, but the consequence is probably that if you have older Windows (XP? Maybe even something newer) these certs don't check out as valid for the site. Eh. Upgrade already.
I suspect there maybe less malicious explanation of this specific traffic spike.

Have study been made which other routes experiencing similar correlations around selected dates?
Anycast is not based on latency, so that's normal.
Oh good. It’s my favorite day of the year.
> then try to replicate in our human-scale networks.

Human scale networks are small. Our brains can only handle a few hundred people in our social circle, maybe up to 1,000.
Introducing Data Brick: The Building Block of Unified Analytics Platform
"The data yield evidence that rides from commercial banks directly to the New York Fed and offsite meetings involving insiders of the New York Fed and commercial banks increased around the time of FOMC meetings"

Well, wait a minute. The data is anonymized so how is the author inferring that the trips were taken by insiders ? It could be anyone dropping off at the Federal reserve. There is high likelihood that these are insiders. Did the same insiders have any say in the meetings, were they even present in the meetings is hard to determine.

What can be safely inferred from this analysis is that there is an explosion of physical interactions between the NY Fed officials and the banks once the embargo is lifted. Nothing wrong with that I suppose.
Exactly. I think there are two types of social network users

1. People who want to consensually maintain two-way contact with people they talk to in normal life.

2. People who want to anonymously get life details of classmates they have a crush on, ex's, etc

Building a network to support #1 while maintaining true anonymity and privacy is much more doable. Not being in group #2, I don't worry about it.
And why couldn't you do it in another language? If Go is performant enough, then I'm sure for example Java would be as well.
Does anyone know if it caches beyond the specified TTL like some services do? One of the things I love about Google's is that it honors TTL.
>In terms of how close we are to industrial impact—it’s really a matter of maybe 5 to 10 years.

No matter how old you are when you read that, be prepared to continue to listen that the same technology is "5 to 10 years" away for the rest of your life.
They want fast resolution of names that point to websites hosted by Cloudflare. Cloudflare makes their money selling their network to businesses that use it, and anything that makes that service better for the end-user increases customer stickiness.
TPC-C is much, much harder to do well on than that benchmark, even if you are using special hardware and even if you are using "tricks" like intentionally misreading the TPC-C invariants in order to avoid coordination. It's not directly comparable to what you posted; while TPC-C performs joins, reads, insertions, and updates, including ones that necessarily must cross partition boundaries some percentage of the time, and specifies invariants that must be maintained in order to qualify as a correct run, the benchmark you posted (flexAsynch) does only reads or only writes in the tested configuration--both options can be trivially executed without any coordination at all on as many nodes as you feel like. As such, it's more of a stress test of the overhead of the implementation than it is an indication of the actual performance you will get out of a normal workload on such a cluster.

And while I'd like to say that MySQL Cluster is nonetheless exhibiting very impressive performance, I can't really say that; they are using expensive networking and hardware that most people don't have available, microoptimizing both the client and server sides, and using a low-level API specifically designed for doing well in these sorts of benchmarks, but they still lag far behind the per-core performance of state of the art key / value stores in similar circumstances. For example, MICA can do 80 million key/value requests per second of a comparable size to the ones they listed on a single commodity server, with only regular NiCs and 10GiB ethernet (and in fact can saturate the Ethernet link). Granted, MySQL Cluster is a full-fledged database and MICA just does key/value, but I can pretty much guarantee you that on real requests MySQL Cluster's performance collapses, and in multi-master mode it's known to be inconsistent anyway.

If you really need hundreds of millions of k/v requests per second, you'll pay a lot less buying three servers and hiring all the researchers who wrote the MICA paper to manage your key / value store than you will buying MySQL Cluster :P Or, if you want a real database, you can play the same game with the many, many database systems that do much better than Oracle's cluster on TPC-C; the same person who wrote the MICA paper released one last year about Cicada, which can handle over 2 million serializable TPC-C transactions per second on a single 28-core server. Or you can try Calvin, which can do around 500,000 georeplicated TPC-C transactions per second on a commodity EC2 100-node cluster (2.5 compute units each back in 2014) and can operate on top of any existing key-value store. The database world has advanced a lot in the past ten years, and people who really need performance have no shortfall of options that aren't Oracle.
When I've seen DNS-over-HTTPS in the past I've always thought it odd that it's setup with a DNS name for the HTTPS address, requiring a plain DNS lookup before it starts using HTTPS. I assumed this was done because they didn't have a valid TLS cert for the IP address. But 1.1.1.1 actually has a valid TLS cert, yet their setup instructions say to use the DNS name cloudflare-dns.com instead of the IP.

https://developers.cloudflare.com/1.1.1.1/dns-over-https/

Is there a technical reason the DNS-over-HTTPS resolvers need their upstream resolvers to be looked up by name and not IP?
Explained Simply: P vs. NP
I love the fact that the consortium managed to get 9.9.9.9 (because Google's 8.8.8.8) and named themselves Quad9!
Luckily the Voyager software is not vulnerable (& can be remotely updated).
APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network.

We talked to the APNIC team about how we wanted to create a privacy-first, extremely fast DNS system. They thought it was a laudable goal. We offered Cloudflare's network to receive and study the garbage traffic in exchange for being able to offer a DNS resolver on the memorable IPs. And, with that, 1.1.1.1 was born

https://blog.cloudflare.com/announcing-1111/
It is also an example of a sort of 'combinatorial pump' that inflates the language's complexity, as each new feature needs to work with every existing one. It is my guess that it is C++'s multi-paradigm flexibility that makes this both possible and necessary.
Airport Amsterdam Schiphol starts using 100 electric buses
Mms2text: Let your computer look at your text message pics so you don’t have to
can't find it on netflix usa
Google translate: https://translate.google.nl/translate?sl=auto&tl=en&js=y&pre...
Official now Privacy and Speed are the goals
https://blog.cloudflare.com/dns-resolver-1-1-1-1/
https://blog.cloudflare.com/announcing-1111/
It is explained on the bottom of the page:

Who’s behind this?

1.1.1.1 is a partnership between Cloudflare and APNIC.

Cloudflare runs one of the world’s largest, fastest networks. APNIC is a non-profit organization managing IP address allocation for the Asia Pacific and Oceania regions.

Cloudflare had the network. APNIC had the IP address (1.1.1.1). Both of us were motivated by a mission to help build a better Internet. You can read more about each organization’s motivations on our respective posts: Cloudflare Blog / APNIC Blog.
The DAISY markup spec is a cool project if you’re into the tech of text/audio sync.

Also check out LearningAlly.org- a non-profit that produces audio books with synced text highlights. They are specifically oriented toward students with reading challenges but I believe anyone with some certification of learning difference can join. (They require certification to avoid conflict with copyright protections)
Modern Java EE is actually really simple and lightweight. (My background is mostly php, later Java, all the time with some other languages like python w/flask, javascript etc in between.)
Honestly, anyone with C++ experience should understand that it's a joke just from the title. I'm honestly surprised so many people thought this could be true; even Rust has raw pointers (in unsafe mode).
Interesting, mine is bad too. From singtel:

Host Loss% Snt Last Avg Best Wrst StDev
1. 192.168.1.254 0.0% 75 1.3 1.6 1.1 14.8 1.6
2. bbXXX-XXX-XXX-XX.singnet.com.sg 0.0% 75 3.4 2.8 1.9 18.7 2.5
3. 202.166.123.134 0.0% 75 3.2 3.5 2.7 15.9 2.0
4. 202.166.123.133 0.0% 75 3.0 3.0 2.4 6.6 0.7
5. ae8-0.tp-cr03.singnet.com.sg 0.0% 75 3.1 3.3 2.8 6.9 0.7
6. ae4-0.tp-er03.singnet.com.sg 0.0% 75 2.9 3.1 2.6 6.7 0.5
7. 203.208.191.197 0.0% 75 7.8 4.6 2.9 18.3 3.6
8. 203.208.149.138 0.0% 75 3.0 7.5 2.7 67.2 13.4
9. 203.208.153.126 0.0% 75 182.8 186.9 174.4 327.7 20.5
203.208.172.226
203.208.172.178
203.208.158.50
203.208.152.214
203.208.173.106
203.208.149.58
203.208.149.30
10. ix-xe-0-1-2-0.tcore2.pdi-palo-alto.as6453.net 0.0% 74 201.4 190.5 183.9 210.1 5.9
11. if-ae-5-2.tcore2.sqn-san-jose.as6453.net 0.0% 74 181.4 184.7 179.4 197.9 4.6
12. if-ae-1-2.tcore1.sqn-san-jose.as6453.net 0.0% 74 177.8 177.3 172.0 190.0 4.8
13. 63.243.205.106 0.0% 74 179.2 184.2 179.1 196.2 4.5
14. 1dot1dot1dot1.cloudflare-dns.com 0.0% 74 191.9 184.7 172.4 202.3 6.6

Looks like singtel has some bad routing rules for Cloudflare and it's going through to the USA rather than hitting a local PoP.

Might send CloudFlare a quick email as they'll probably want singtel to correct this.
http://packetlife.net/blog/2010/feb/5/ripe-plays-with-1-0-0-...
This is bad, bad, bad advice. You don't set the DNS on your local machine. That breaks things. The DNS needs to be set at the gateway. If you change your PC/mac's DNS to an external service, you won't be able to resolve any addresses on the local network.

Come on, CloudFlare. You guys know better than that. Please stop breaking the (local) internet.
If you don't nuke things that look vaguely relevant but nevertheless aren't wanted, then they will keep piling up, until your sub is no longer serving its intended purpose at all. Subs dilute easily, and have to be defended from that as well as from fools.
Latham’s quarterly seems to have lots of amusing pages. I suggest readers flip though the site a bit!
Waddy
fgghjfdghndc
waddy
Maybe it should be :)
> but is it garbage-collected?

Nope.
What do all the sane people do?

Good mental health includes things like confidence, self-actualization, self-determination, a true perception of reality, autonomy, and a positive view of ones self and ones ability to effect change.

Not having a PhD, but experience working and living with them is that there was a gap between their self-esteem and their actual self-confidence that caused many of them to suffer.

If good mental health is not something you are directly rewarded for, success in that field is going to be biased toward people who find a way to sacrifice it as leverage. From a base rate perspective, this suggests good mental health in any outlier of success is going to be spotty.

In many cases some fields must create opportunity for people with poor mental health because the sanity barrier in other fields makes these ones more viable. When you look at the stereotypes about the professions (lawyers, doctors, and professors in particular), the ones with low attrition and weak disciplinary systems acquire that worst reputations, where as a counter example, many fiduciaries seem even keeled to the point of dullness.

The solutions are likely about teaching good mental health in undergrad or before, trouble is, the question of what "good," means will likely attract extreme opposition.
fgghjfdghndc
I don't use them (even though I would love to) because it takes approximately 3x as long to reach the server.

To compare the two, together with Google's DNS as a reference, from a fast connection:

64 bytes from 1.1.1.1: icmp_seq=5 ttl=59 time=3.62 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=60 time=3.60 ms
64 bytes from 9.9.9.9: icmp_seq=5 ttl=60 time=9.20 ms

...and from a slower (home) connection:

64 bytes from 1.1.1.1: icmp_seq=5 ttl=58 time=11.1 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=59 time=11.9 ms
64 bytes from 9.9.9.9: icmp_seq=5 ttl=59 time=34.2 ms

Note that I just used the speed of every fifth package instead of the average for five packets in order to keep the comment relatively short and more humanly readable than "rtt min/avg/max/mdev".
I wish this hadn't been raised on April 1.
> Sure you can have access to journals but how do you even know what you should search for? I suppose this is sufficient if what you want to do research in is something that is currently mainstream?

I "research" stuff all the time, do a google search for some term and find an interesting paper then go through the references that seem interesting. Works better than you'd imagine, I was looking up CESK machines and down through the rabbit hole I eventually found the original paper with the non-obvious name of The Calculi of λ-v-CS Conversion: A Syntactic Theory of Control and State in Imperative Higher-Order Programming Languages. Honestly, those math-heavy CS papers tend to make my head hurt though.

Don't think there's a whole lot of people who would claim lambda calculus is mainstream but I can spend hours upon hours finding stuff to read about and most of (or all) the papers are easily downloaded off the author's website.
9.9.9.9

https://quad9.net has been serving me well.
Thanks. Since https://1.1.1.1/ was posted the other day (https://news.ycombinator.com/item?id=16716606), we've changed the URL above to that blog post.
That sounds really weird.

Are you sure you are talking about the same Java?

Because Java, for all its warts, is maybe the language that has done most to pave the way for mainstream typed languages.
The whole point of encrypting DNS traffic is to hide it from the likes of Google.
Fascinating read. For a slightly deeper view of one of the more politicized controversies see: http://www.thehindu.com/sci-tech/science/how-genetics-is-set...!
Ordinary users don't have anything that resolves to local IPs, so this is a non-issue for just about anybody. Plus, many if not most ISP-provided modem-router-AP-boxes don't let you configure the DNS server they use, making your recommendation impossible to follow for most users. Someone who runs services on their local network likely knows enough to do as you say, but for 99% of people, these instructions are exactly what they need.
They could use an old system or emulate.
So first you complain that mods don't give enough effort in their messages, and now you say "chill and keep it best effort"?

"Just get more moderators" isn't easy in many communities.
Using an ip instead of a domain name like this allows the possibility of dns rebinding attacks, right?
I have couple machines in a local network and never cared about them beeing discovarable /sharing between.
This is useful for use cases for which that doesn't matter. Using your computer or devices at home, on your own wifi, where there is no need to resolve local addresses. Or on public wifi, such as in a café, where there is no need to resolve local addresses, and you don't control the gateway.
Perhaps his point is that law and morality are not the same thing.
Looks like I'm not the only one reading Secret History of Mac Gaming.
As an aside, there is a certain kind of mentality that, upon seeing a homeless person with a phone, declares that the person isn't really homeless or doesn't actually need any assistance. Such homeless would have to be careful to keep them hidden, lest other programs get reduced because people see that these homeless people are actually wealthy.

The most extreme example of this I even came across was someone saying that refugees, escaping the Libyan civil war, were clearly fraudulent because they had phones. There's some kind of unconscious assumption that having a phone indicates a high-level of wealth.
How many people have local DNS at home? Not many, I'd wager. How many know how to access their router? Also not many.

Besides, "In your router’s configuration page, locate the DNS server settings."
Apple #macOS issues reveal passwords for #APFS encrypted volumes in plaintext
Where is the technical audit report published? Open access url please.
Facebook Complaints Are a New Kind of 911 Call in the Platform's Hometown
Stop digging for more diamonds, says DeBeers.

Buterin has millions in Eth[0] and the influence to make that digital asset worth more by preventing it's supply from increasing. If it starts increasing, it could even turn into a bubble (as people buy it based on its price increasing).

In short, this man is not an unbiased person to promote such an idea.

[0]https://www.quora.com/How-much-Ethereum-does-Vitalik-Buterin...
The actual reason is that Mark Zuckerberg is colour-blind. Blue is probably the only colour he and the world agree on.
The former. In my view the idea is empty (beyond being a thought experiment/illustration of how badly we've messed things up already), but I'm not suggesting it's empty for lack of conviction, only that he must himself see how unrealistic it is.
Yes yes I'm breaking the HN guidelines but why has this been downvoted? All I see is a logical opinion.
Watch it, I enjoyed it.

Some of the stuff was hilariously blatant.
I'm many years out from my PhD, but still get impostor syndrome even working in the corporate world. Like a constant nagging feeling that I have no idea what I'm doing, and other people definitely know what they're doing. As long as I'm able to portray on the outside that I know what I'm doing, I'm able to achieve most of the objective measures of "success", but I still have the impending fear that at some point, I'm going to be found out...
Parasitism and the Fight for the Wrong Century
Much of the Internet owes Campbell v Acuff-Rose Music a debt of gratitude.
> We will never sell your data or use it to target ads. Period.

Won't sell != Won't collect

> We will never log your IP address (the way other companies identify you)

Never log IP != Never log anything

Bonus: The way other companies identify you ~= There are other ways

Edit: Looks like many people assume I'm nitpicking. So here are more specific questions:

* Is logging a hashcode of the IP considered as "not logging the IP"?

* Can combination of timestamp, packet info other than end IP (latency, hops, etc), geoIP and other factors be used for deep intelligence?
it's right there in the proof; it's just a convenient way of working out the Lipschitz constant for a linear function (i.e. matrix * vector) and the Lipschitz constant bounds the gradient.
PHP was never in fashion. In the beginning it wasn't as powerful as Perl. Then it was looked upon as not serious compared to java or hobbist by the business asp crowd. At one point because of a facebook movie it was in fashion for a year but that created a I hate php backlash. Php has changed so much I'm seeing people rediscover it.

Remember java was cool or mongodb or node or ruby on rails. It feels like go is becoming less cool. I wonder what next year will bring? Perhaps php will be rediscovered when SV changes once again.
Have you tried reading it again?
How are you getting those single digit times? I can never get below 15 ms for both Google and CloudFlare. Any tips to improve this or its beyond my control?
Do you feel "less connected" to the world when you are riding with earplugs in? Does it make it feel more dangerous you might be less aware? It makes sense to wear the plugs, but I've never heard of a street rider doing it.
per rfc5280:

>"4.2.1.6. Subject Alternative Name
The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in addition to or in place of the identity in the subject field of the certificate. Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier(URI). Other options exist, including completely local definitions."[1]

[1] https://tools.ietf.org/html/rfc5280#section-4.2.1.6
Pretty much this. Switching from PHP to Java resulted in dramatic salary increases for me.
Google can't. They use your history of online activity across their services to decide if you're a robot. If you click the checkbox the exact same way as usual, but do so in an incognito window without any established Google cookies, they require you to go through a captcha.
I was referring to this :

> researcher (well supervision of people actually doing the research

You explicitly distinguished the two.

And thank you for your answers.
No need for this data, the Fed is happy to talk about the ways it sometimes coordinates with banks in pursuing economic stability. I was just reading The Power and Independence of the Federal Reserve and that goes into this a bit.

My problem with the system is that we have the same organization charged with regulating the banking system and macroeconomic stabilization. These are obviously related but that means it's very tempting to see the later entirely in terms of the former, which I think is part of the reason for the Fed's misjudgments in the financial crisis.

I go into detail a bit more here:

http://hopefullyintersting.blogspot.com/2015/12/economic-reg...
Check out Kotlin.

String is not nullable
String? Is nullable and the compiler/ide will force you to check for null when you use it.
If A hurts B, then C hurts D, then that is somehow ok if B,C and A,D are in the same country?
Perhaps you missed the sections near the top titled "DNS's Privacy Problem" and "DNS's Censorship Problem" which explain why not everybody can trust their network operator?
How well are your codebases unit tested?

I shiver thinking about trying to add good tests to a project in any language without good di/ioc.
Same problem here. It would be nice if Cloudflare created an alias to 1.1.1.1, because I can't access it at all.

Edit: 1.0.0.1 also takes me to the router configuration screen. And there's no configuration setting for it. :(
We've changed to that above.
Sounds like the Strava heatmap fiasco, but local to New York.