skysight-inc/HackerNews huggingface dataset:
That’s simply not true. Mozilla is not sharing DNS queries with Cloudfare by default, nor are they overriding your configured DNS servers per default. This is an experimental opt-in feature, and they are also running an opt-in study. There has been no announcement of an ”on by default” for DOH. If you enable the experimental feature there is no default provided and you have to set your own server, but if you opt in to the study, you’ll get Cloudfare. This is almost pure FUD at this point.
We're under attack 23 Node.js security best practices
What was the reason passport holding US citizens had to be “smuggled” to leave e.g Japan? Was it because US authorities would withdraw their passports as soon as they were discovered to be missing? In those days I’d expect that type of information to travel quite slowly.

Or were soldiers not even allow to keep their own passports when based abroad?
Am I reading this correctly? 25 degrees Celsius is too hot to work?

Just think about all the people who have to actual work, as in manual labour, outside in the full heat, and you're complaining about sitting at a desk at 25 degrees. You should be ashamed of yourself.
The feature is opt-in. Firefox will use your system configured DNS servers unless you explicitly enable DOH. In that case you can still change Cloudfare for some other server if you’d like.
The default is already off[1] though...

Mozilla has stated plans to eventually turn it on by default[2] but I have yet to see any timeline or details of what the default config will actually be. Your article seems to assert that it will be on by default in FF62, where did Mozilla ever say this? Everything I have read seems to indicate that FF62 is just adding support, which is off by default, and requires a change to about:config to enable in the first place.

[1] https://gist.github.com/bagder/5e29101079e9ac78920ba2fc718ac...

[2] https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...
> a significant percentage of the population sweats profusely in anything beyond 70 degrees Fahrenheit

Fat people?
The easiest ballpark conversion I know is:

F -> C: subtract 32, divide by 2. So 76F = 44/2 ~= 22C

C -> F: multiply by 2, add 32. So 15C = 30+32 ~= 62F

The factor of 2 isn’t precise (the actual ratio is closer to 5/9). But it only really diverges at hotter temps: so 95F is actually 35C, whereas this formula will give you 31.5C, which is more like 89F; but 50F will give you 9C (48F), when the correct value is 10C. For most weather purposes it’s close enough - at least to decide what to wear - and it’s easy for most people to calculate.
I misread it, as:

> I then say clearly that I will remove 6 of the other cups. And, to retain the mystery, I will not reveal the prize.

It wasn't a criticism.

I just wanted to draw attention to the point that in the random game (I.e. player marks two, you reveal 6 random unmarked, if no prize is revealed, player decides to switch to one or to keep two) it is the better strategy to never switch.

Do you think it would be an interesting variant to play the game like that?
Can you point me to that discussion you mention? Would be nice to read.
The impression I got from TFA is that the feature will be on by default and you have to dig into about:config to disable it.
Not parent but

https://en.m.wikipedia.org/wiki/Peak_oil
Just to be clear, the authors are wrong? There will not be a September patch that overrides my network DNS settings?

"With the next Mozilla patch in September any DNS change you configure in your network won't have any effect anymore, at least for browsing with Firefox, because Mozilla has partnered up with Cloudflare and will resolve the domain names from the application itself via a DNS server from Cloudflare based in the United States."
Oh yes I forgot about acres!
> I wonder how the HTTP servers deal with DNS amplification attacks.

They don't have to since http(s) is TCP and not UDP?
[video]Password Field Toggle between plain text and password
Have you looked into error reporting solutions? These can automatically capture uncaught Java exceptions within an application and send a crash report with relevant metadata (stacktrace, user actions, request info, etc).

Disclaimer: I work for Bugsnag, who offer such a solution
Here is an example of a large office building that is passively heated/cooled. It uses a dedicated solar chimney for air circulation.

* https://en.wikipedia.org/wiki/Manitoba_Hydro_Place

* https://www.hydro.mb.ca/corporate/history/mh_place_design_an...
Still, 150 miles on foot seems like noting in this context considering the stones are from what 30 miles away? That is hard to fathom.
On my motorbike, I'd comfortably do 95 to 100 mph on the motorway. But you're asking for trouble if you push it to 120, which is what you'd need at least to reliably average 114 mph.

Most cars don't travel above 90mph. I'd say that's the 98th percentile speed, with 100mph somewhere near 99.5 percentile - ie one in 200 cars going faster.

North Wales is a particularly poor choice of place to speed (notorious amongst bikers for harsh enforcement), but that's probably with a focus on rural roads.
Since HTTP(S) basically works everywhere and a new port (DNS over TLS on standard port 853) is guaranteed not to work everywhere.
Imagvue: An image processing component for Vue.js
Fast JavaScript by Default
Cloudflare is an US company, their privacy statement is worth zero to most Firefox users.
I've heard it my entire life too and have come to the same conclusion as you. But I don't think it is argumentum ad antiquitatem though. I think it's the media's version of "publish or perish". Journalists have to constantly publish something and fear sells. Whether it is tv, radio, books, social media, pools, halloween candy, etc, there is something we have to be worried about.
Texas Mom Pulls Gun on Teen While Her Daughter Was Fighting
I conveniently forgot the salt is public ::facepalm::

I also was using the OP numbers, verses trying to do any math or research myself first ::second facepalm::
Most important point from the article

"Let's stop here for the moment and repeat: With Mozilla's change, any (US) government agency can basically trace you down." - with ease I might add.
The usefulness isn’t in the granular steps. It’s in the intuitiveness of 100 being close to as hot as it gets and 0 being close to as cold as it gets, and being able to place any other temperature on that scale.
I've found it difficult to find somewhere to import an Mbox. You've gotta grab a desktop app like Thunderbird that supports it and then upload the data again. Easiest for me has been to just have any email client that supports IMAP on a desktop PC and open it occasionally so that it syncs. This saves you the Takeout delay of packaging up your mail, and ensures you're only downloading the delta since last time. I do have some Takeout snapshots though in case I ever absolutely have to go back.
Do you seriously believe that Mozilla is issuing a patch in September that will somehow force you to use Cloudflare as a DNS provider? That 'any DNS change you configure in your network won't have any effect anymore'? Do you know many setups that would break?

Of course the article is wrong. Classic FUD.
Iterative methods done right (life's too short to write for-loops)
Magical thinking about machine learning
> That’s too hot to work in my opinion.
> in my opinion.
> my opinion.
> opinion
Blacklist owners are fairly reasonable. You do need to have an IP dedicated enough that your Reverse DNS can be set to your domain, and then pretty much all blacklists will honor a request to delist it or whitelist it. I've dealt with a couple of them at work.
I think the wg0 references should be swapped with `%i` as the config is dependent on the filename with that setup. Neat write up however.
How to make $8927 every week working at home using totally automated system?
“Sampling from the uniform distribution on the
N-dimensional Euclidean ball (the
N-ball) and its surface (the
N-sphere) is a tool useful in many diverse research fields, for instance Monte Carlo integration in physics, generating random directions for MCMC sampling on bounded regions, generating random correlation matrices, Monte Carlo analysis of random packing on the sphere, generating random rotations in cryptography as well as various simulation studies in statistics”

https://www.sciencedirect.com/science/article/pii/S0047259X1...
Giant Rogue Planet Discovered Bumbling Around Space
Most Firefox users are absolutely unaffected by this. Literally all people that don’t explicitly enable this. All those who do might want to make up their mind if they want to participate in this and if they want CF to be their provider of trust. Keep in mind that CF will see a substantial chunk of the traffic anyways.

Mozilla seems to be confident in that agreement and I have a certain amount of trust in Mozilla which factors into my decision. Yours might be different, so don’t enable that feature or use a different provider.
"Cloudflare has at least promised not to be evil"

I have a bridge to sell!
VHVya2V5IGhhcyBsZWdhbGlzZWQgY2Vuc29yc2hpcCBvZiBhbGwgcmFkaW8sIFRWIGFuZCBJbnRl
cm5ldCBhcyBhbiAiYWRtaW5pc3RyYXRpdmUgbWVhc3VyZSIgaW4gbWlkIDIwMTcgKGxhd2xpa2Ug
ZGVjcmVlIDY5MCkuIEFsbCByYWRpbyBhbmQgVFYgdHJhbnNtaXR0ZXJzIChldmVuIG9uZXMgdHJh
bnNtaXR0aW5nIHByaXZhdGUgY2hhbm5lbHMpIGFyZSBvd25lZCBieSBhIGdvdmVybm1lbnQtbWFq
b3JpdHkgY29tcGFueSBhbmQgYWxsIG5vbi1MQU4gbmV0d29yayB0cmFmZmljIGdvZXMgdGhyb3Vn
aCBjZW50cmFsIGdhdGV3YXlzLiBFcmRvxJ9hbiBjYW4gZWFzaWx5IHJlcGxhY2Ugb3IgY2Vuc29y
IGNvbW11bmljYXRpb24uCg==
I not only don't find his examples particularly convincing, but in many cases I don't even think they are really examples of loss aversion to begin with. I've always interpreted loss aversion as "It's worse to lose something you've already attained than to miss out on something you never had in the first place."

His example of "Messages that frame an appeal in terms of a loss (eg, “you will lose out by not buying our product”) are no more persuasive than messages that frame an appeal in terms of a gain (eg, “you will gain by buying our product”)" is extremely weak IMO. In both cases the consumer never had the product to begin with. The author is trying to argue FOMO is the same thing as loss aversion, which on the contrary, FOMO is really greed.
I do struggle sometimes to see how one could do proper science in the field of psychology. It always seems like every experiment contains multiple hidden assumptions, a myriad of uncontrolled-for variables and has more alternative hypotheses that fit the data than you could shake a stick at.

Is this me being all Dunning Kruger? Is it my positivist bias obscuring my vision? Have I misunderstood the nature of the scientific method or missed some major aspect of practical epistemology? I sincerely hope so as the alternative explanation regarding the nature and visibility of the emperor's couture is rather upsetting.

I do genuinely think I am probably - at least partially - incorrect on this. But I would like some help in shaking my sense of unease.
Wow.

Firefox, out of the box, is going to be perfectly useless to me.

At home, I have an internal DNS resolver which is used for internal stuff (e.g., Home Assistant, a friendly name for my NAS, etc). This will be broken. Likewise, I've got Pi-Hole set up for my girlfriend, but that's going to stop working as soon as her Firefox updates itself to this version.

At work, we have an internal DNS resolver for obvious reasons. All of the users who use Firefox will suddenly be unable to access internal sites. That's going to be a fun time for the helpdesk as 3000+ staff start receiving updates.

I know it can be turned off, but having to track down a hidden setting to make the browser actually function correctly is insane.
Does anyone know about this website? I am skeptical of a .ch domain criticizing something that would make censorship harder.
Absolutely true.

You should make it easy as possible for users of your software .
While you might have a point, there's no need to gatekeep

Also while physical labor is definitely hard under the heat, intellectual work can grind to a halt depending on the temperature

To the point where I'm really skeptical of places that don't offer any kind of climate control where it is needed (and apparently that's quickly becoming "everywhere")
I was a big fan of Troy until relatively recently. He's turned to bullying and ridiculing people publically who don't agree with his positions on security. I blocked him on Twitter after I realized that I wasn't the only person who noticed, and that I had made at least a couple tweets that could make me a target.

That being said, what I really want to see someone do is make an Active Directory plugin for Pwned Passwords. Corporate networks are both most at risk and most often where you find bad passwords.
Ok, but by being pedantic you’re deliberately ignoring the obviously implied “on earth” of the original statement.
Rails and React Server Side Rendering, with Webpacker and Hypernova
So data is safest in the country with the largest spying budget and the most spies. Not convinced.
What I want is a self-driving golf cart that can take my mother to the doctor and back. It doesn't have to go fast.

I make this point every time I can: kinetic energy is the killer and it goes up with the square of velocity. Half-speed is quarter-deadly.

A golf cart-like machine, limited to a maximum speed not much faster than walking, light-weight, and festooned inside and out with airbags (and other anti-collision/-injury stuff), could be built today, I think it would work just fine, and I bet you could sell a lot of them. ("Baby Boomers" he says under his breath...)

Trying to go straight to robot cars is hubris, it's biting off more than you can chew and then trying to talk past the food in your mouth.

Also, can we please call them "auto-autos"?
CS:GO RCE 0-day – Real World CTF Qualifiers 2018
Bangladesh shuts down mobile internet to tackle teen protests
Show HN: Kickstart – a scaffolding tool to get new projects up and running fast
Take a Vacation from Exercise? Your Body May Not Thank You
What to Pay Attention to in the OpenAI Five Benchmark
I did the same for many years. Until I noticed that some people just never got my emails. Mostly people with business emails - I'd send something job related, and never hear back, just assuming they weren't interested. It took me a while to figure out that some email providers (outlook.com is one example) will just outright block small email hosts, despite following all the best practices like DKIM, DMARC, SPF. It's a lost cause trying to host your own email. I've been on fastmail for the last year or so with my custom domain, and it all seems to work great.
Show HN: Simple habit tracking and gamified reward system
DNS over HTTPS is immune to amplification attacks.

If the alternative to DNS over HTTPS is a DNS-over-TLS resolver being run by a company without a website (???) then I guess that's easier than DNS-over-HTTPS. Are you really going to use a resolver run by a mysterious nobody?

There are probably more than a dozen HTTP stacks being widely used in production. It's not remotely a monoculture.
The US has the largest spying budget and the most spies.

And FF thinks it makes it more secure for me if the transfer all my browsing meta data to the US.

I don't think so.
Yes. If it's opt-in, then I can certainly live with it and I understand why people might use it. I'm just pointing out that features like these, while well intentioned, still add bloat to the browser. Sometimes saying no to feature inclusion is the right thing to do in the long term even if it has a use in the short term. I'm a big believer of the Unix philosophy of do one thing and do it well.
> There's nothing sneaky going on here;

It bloody is. Egregiously so. If they are deviating from expected behaviour[1] they should obtain informed consent and even then it's unethical. Half of Mozilla is screaming decentralisation[2], the other is centralising the web as fast as they can. I still haven't forgiven Linux Mint for similar shenanigans[3].

[1] Users understand instinctively the principle behind reverse dns lookup. If ISPs can resolve at least portion of domain names then it doesn't make sense to then introduce another completely random third party that isn't strictly necessary for the process.

[2] https://hacks.mozilla.org/2018/07/introducing-the-d-web/

[3] https://bugs.launchpad.net/linuxmint/+bug/1133777
From the security perspective, there should NOT be one. It depends on whose security you are safeguarding. That of the people, or a small number of services?

In the world we are moving to online, scuttlebutt and MaidSAFE and others will simply LACK a back end that even knows who’s logging in or what data is being sought. Protection of data would happen via end to end encryption. That is MORE secure than trusting someone to safeguard your data - not less.
Hey all, I realise that neither Webpacker nor Hypernova are brand spanking new tools, but when I went to find a "getting started" tutorial, I found nothing up to date. Even the official Hypernova docs are written for Rails ~3.2 era and don't explain how to set up your JS build to support client + server side rendering. So hopefully this tutorial is helpful to someone else too!
I find myself thinking of the rise of Twitter block scripts, that one aims at a Twitter account and then proceeds to trawl the links between the accounts and add them to a block list for another account. A tool that was conceived and is in heavy use by what one may well call the "alt-left"...
Startup news roundup for week ending 5th Aug 2018
It's a legally binding contract between Cloudflare and Mozilla. If Cloudflare were to violate it, Mozilla could sue and a judge would determine the penalties for Cloudflare. There should be some rough guidelines written into law as well.

And we're definitely not talking about small amounts.
Cloudflare violating it would result in Mozilla violating the privacy of millions, which can be interpreted as significant damages to the citizens. They're also both situated in California, so privacy will be valued by a judge. Given Mozilla's public image as a privacy-friendly organization, they could also push charges for damaging that image.

That penalty + the damage to Cloudflare's own reputation, I cannot imagine they would survive.
The GYB script I linked actually has a restore mode that can make use of the Google Takeout MBox files.
I feel like saying the entire thing was written to direct people towards DO is stretching it just a tad. Possible that they have some affiliate program with DO? Sure. But Algo itself says that DO is the "most user friendly" on their github page.
Sounds like an interesting job

The interviewers on your books who have 5 days a week available for this.

Roughly how much time of that can you fill, and is that likely the same for new interviewers as well?
This is the relevant post from the Mozilla nightly blog: https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr... It confirms that the default is off. It also gives a much more nuanced view of the level of partnership. CF is currently the partner for a study regarding that feature. That study still requires opt-in (and currently nightly) The patch in September will bring the feature to mainline FF, but it’s still default off and hidden behind “about:config”
There are (privacy) pro's and con's to having a small(-ish) ISP. 1: you have a payment relation with your ISP so your identity is 100% known. 2: Operators you know personally might turn against you, as it happens between people.

I use Swisscom (larger ISP here in Switzerland, both for mobile & home connectivity) but damn if I do not encrypt /hide as much traffic (DNS first) as possible to prevent exactly them from being able to see exactly what I do.

I have worked for far larger providers and I have personally investigated 10's of cases where a "roque" operator has fired for "abusing" access to very privacy sensitive data (being it internet access or mobile phone locations etc). As [most of the time|always] in these cases, the offender gets offered a decent exit to prevent (public exposure via) lawsuits so little gets known to the outside world.

In the end it is up to you, but my advice would always be: do not put all your eggs in one basket.
> - you can provide your own server

How do I RUN my own server? A few minutes of Googling hasn't revealed any DNS-over-HTTPS server that appears production-ready.
FF will turn this on for everybody and Cloudflare will be the default 2018? Don't know. 2019? For sure. All FF browsing meta data flows into the US, the country with the most spies and no legal framework to go to court.

So your argument is an obvious straw man and one wonders about your motivations to support getting all the browsing meta data into the US by default.

Moving my data from Germany to the US will not make me more secure in any way.

And talking about repressed countries is like "think about the children!" for the rest of us - a nice lever to sell this massive data vacuuming.
Why not just jump directly to the Google takeout link?

https://takeout.google.com/settings/takeout
git add --interactive?
But why would you do that?
Hot damn, never thought about this!
Many corporations will choose to run their own resolvers for internal services.

Home/small business router vendors already include DNS resolvers on the boxes they sell which work to automatically provide hostnames for addresses that they've served up with DHCP.
Sorry if this is off topic but where does DNS over https leave my pi hole?

Is it possible (in the future) to do dns over https from my router to the pihole and then dns over https from the pihole to Google or Cisco open DNS?

How would it work? Wouldn’t the router need to trust the https certificate that my pihole presents? Thank you!
“The price will rise, but now” is the most tenuous loss aversion I’ve ever heard of.

“You have a $10 credit, it expires in 2 days” would test loss aversion.

That consumers behave rationally in the face of price rises is an interesting finding. But it’s a far cry from testing loss aversion.
I don’t understand. If you’ve rightfully decided not to offer sms as a 2 factor option because of its poor opsec (number porting, sim cloning, etc.) why then offer it as a recovery option. Your 2-Factor is only a secure as the weakest recovery option.
Building an Ultimate Remote Linux Workstation
They use good primitives, but are under some kind of assumption that this makes them invincible. I remember reading a rather serious bug report that was more or less closed with a link to libsodium/nacl.
I'd say it has more to do with the US industry's ability to dominate the imperial standard and use it like Apple uses the "lightning" port... to prevent interoperability and endure a protected market for US manufacturers.
For many it is, but for billions it isn't. For those where it is an improvement they can opt in.
Seems to be a fair amount of desinformation going on.

Why does the soldier in the right part of the picture fall, seemingly handlessly? I'm pretty sure gas explosions in a nearby house don't do that.
Scientist in the article says we could see one in patients as soon as 5 years
Investing 101 – Why and What?
Tech Billionaires Hack Their Taxes with a Philanthropic Loophole
You cannot compare CDN with DNS which does not require high traffic volumes nor expensive servers.

The issue is pervasive laying of trust into "benevolent" third parties, CA's apparently are not enough and we now must have Trusted Recursive Resolvers, too. And it's more and more difficult to set up alternative infrastructure which does not rely on them.