skysight-inc/HackerNews huggingface dataset:
Its also more secure. Long lived certs risk the possibility that someone who used to own the domain got a certificate on it and it still works after the domain is resold. Once you automate it there is no downside to short lived certs.
> "don't run privileged code from people you don't trust." Is both critically important to understand for anyone using a network connected computer and not at all complicated.

That is absolutely complicated for the vast majority of the world's internet users. No one else is my family would understand what the hell "privileged code" means and shouldn't have to.
But rights don't live in a vacuum. The US has established that fighting words aren't free speech. Everywhere around we've recognized that speech has limits, and unlimited speech can be harassment, an invitation to destroy and much more.

Speech isn't just a debate between intellectuals sitting in a lounge arguing about things in a wholly experimental matter.

And saying that it is inalienable or innate without considering its true limits is merely a thought-terminating cliche that doesn't delve into the deeper considerations.

And as mentioned above, free speech is just one right among many, sometimes in direct conflict with others. Thus, the resolution and primacy of rights is something left to courts, philosophers, and representatives.

Germany has decided that your right to speech isn't higher than spreading hateful ideologies. The limit as to what constitutes a hateful ideology isn't firmly grounded, but so far courts there have acted in a consistent and pragmatic matter. I'd argue that the speech of people whose idea of speech is promoting the end of a race isn't really something we care about, and I can certainly construct a moral framework where their speech is fairly irrelevant and I don't think most of us are going to lose sleep over it.
> In 2010, Cerberus had the holding company borrow $225 million from an undisclosed group of lenders, most likely hedge funds. [...]

ah, thank you for pointing that out.

but then:

> In April 2012, Cerberus did something fateful, which probably seemed smart at the time. It had Remington borrow hundreds of millions of dollars and use it to buy the holding company’s debt

hm so the first set of lenders were paid off. did the second set get similar terms?
I love my privacy too but you’ve got to keep the magnitude of things in mind. Those extensions are making it harder to correlate your interactions with different companies, this fail-closed behavior is protecting you against criminals gaining access to all your online accounts.
>Firefox is an open source project. You're welcome to contribute and make things better.

Well no because they won't accept a patch that lets us plebs turn off the signed extension requirement.
Best thing to happen to American farmers.
I filled out my taxes with evince a couple years ago, it felt pretty neat using only open source software to do it (and seeing the whole form at once was way less stressful for me compared to how turbo tax does it, I know some people are the opposite though.)
There are Git commands that you can massage into calling an arbitrary shell program you specify: I had a fun little challenge once where I constructed a “jail” that let you pass arbitrary arguments to git.
On a slightly different note, is there some curated collection of serious incidents like this somewhere?

Something we could refer to when discussing possible pitfalls?
I guess it depends on if it was an honest mistake or gross negligence. I don’t think people should be fired for mistakes. I also don’t think everyone should be trusted with important tasks.
In what use cases would you think users would prefer paying for this rather than using Apple's notes app, which also syncs to my phone, ipad, etc?
They don't use cryptographic timestamps with their signatures ?
The certificate might now be invalid, but the signatures were done at a time when it was valid...
Thanks, I'm doing a lot better now. I definitely think this is something that has to be learned over time - at my lowest point, if someone gave me this advice I'm not sure I would have been able to use it effectively.
Debt is just other peoples' money. Being poor isn't just about what you own, it's about what you have access to that you don't own.
Advertisements. My eyes, my eyes!
There was no mention of any meeting whatsoever in the Mueller report. There was no mention of any meeting whatsoever in the indictments and trials of Manafort. There is no video footage or picture of Manafort ever being anywhere near the embassy, or even in London, during any of the three times that the Guardian claimed they met. Your tinfoil hat has to be very, very tight to believe that Manafort could have secretly met with the most watched man in the world, in the city with the densest surveillance network in the world, without anyone seeing him, without a single picture being taken, without any evidence at all that he had every been there. Not only did he do supposedly do this, but he supposedly did this three times!! Its been many months since the story was published, and the Guardian has shown absolutely no evidence of any meeting. The fact is that no matter what you think of Assange, Manafort, Trump, or anyone else, this is a stunning journalistic failure. The fact that the Guardian continues to stand by this story (silently) without offering any evidence of its veracity is a terrible stain on what was once a very good paper.
Why does someone need to be fired?

That might seem rather extreme, but the fact that this situation was even possible was a consequence of a series of bad decisions over an extended period of time about the required behaviour of new versions of Firefox, combined with technical failures that betray fundamental weaknesses in the whole system design. Whoever was ultimately responsible for those failings demonstrably isn't competent to run something of this importance and should probably either implement immediate and dramatic changes to the relevant policies and technical details or consider their position. Anything less is surely going to damage trust, which is something Firefox can ill afford when it's already in danger of being reduced to a niche product rather than a mainstream browser.
Gratzi!
If this mistake was due to incompetence then the person should be fired. Incompetence shouldn't be tolerated.

But we're outsiders looking in and don't know what's going on at this point. That's why I used the qualifier "possibly." It's quite possibly it wasn't incompetence.
That’s what I thought you meant, and I think that’s a mischaracterisation of the group in question and of those more generally who say they’re advocates of free markets. Are any of them not against slavery on the basis it’s unfree? (based on your definition)

Small or limited government is usually the given position, vague as that may be, not zero government.
Ah, so I need not to restart Firefox while they're still enabled.
I hope you're correct.
Could you elaborate? How does type erasure relate to HKT?
ll of my add-ons won't install either. I get a message saying download failed check your connection. Nothing is wrong with my connection.

I also can no longer set my new tab feature to go to google.
The thing I don't understand about the Vancouver locations is that 4 years ago they closed down their massive store at Robson and Howe and opened a tiny little store at Granville and Robson a block away, then they go and shut that down to open a massive store again 3 blocks up Robson again.
Short-term certs _are_ a virtue. Not only do you not have a manual event rare enough for people to forget how to do it, you also don't have to worry about which 15 services someone granted a 10 year wildcard cert to early in the company's history.
>I still don’t want to have to understand everything I ever touch

If you don't understand it, don't touch it. The default settings should work for most users. There can even be a warning against touching without understanding, like with Firefox's about:config. The offensive thing is preventing users from touching even if they do understand.
I get the same. All my add-ons don't work. I get a message saying download failed check your connection. Nothing is wrong with my connection.

I also can't set my New Tab to go to google anymore.
GP has shown a long-term tendency to create a naive implementation, in VB.NET even, and then get surly about folks who refuse to acknowledge its sufficiency. No good can come from engaging / trying to educate.

N.b. built-in .NET object serialization is a slow, wasteful, brittle solution, but it could be okay if one doesn't mind the performance or portability issues. Heck why not use XmlSerializer then?
"If you want to imagine we are all born with a 'debt' then you should also assume we are born with an 'asset'. They should be workign to put that on paper faster than the debt."

If you take your salary and divide it by a reasonable interest rate, then you get the value of yourself as an asset, or the equivalent amount of capital you would need not to work. It is a large amount if you choose a realistic interest rate.

So, sure, a few hundred thousand in debt for school or a house is not such a big deal when you consider that an ordinary salary is equivalent to a million or two in capital.

The issue is cash flow, which seems to be what you are acknowledging, so how do you get to a fanatical anti-debt stance?
The author of the first version of Kubernetes. Author as in the person who wrote the code and bootstrapped the project. If memory serves well. Haven’t been at Google for a while, but in early 2010s would have been unrealistic to attempt to externalize Borg/Omega. I still remember a high level architecture diagram of Borg covering a whole wall.
There should be a separation between the things that need to get done and the people that do them. As in, tasks should be created first and then assigned.
Good news for the landowners (hopefully some of the displaced people?) It sounds like the price-run up would be nice.
Which is what like 80% of data leaks?
> I guess I was thinking more of people I've talked to who advocate for dynamic type systems for rapid prototyping, because they don't want to be bothered to stop and think about their types first

Totally! I wish we taught more type directed programming in general. It's a good way of thinking and can guide your process very nicely.

I've slowly come to the conclusion that instead of assuming my friend who doesn't like static type systems is misguided, I should try to figure out what aspects of static type systems need improvement so that a person like him would use them. Even if I don't agree with him, I can still use his point of view as a different perspective.
Print or screen: pick one.

If you want something to print beautifully, you take the time to put the figures and pictures exactly where you think they fit. If you want something to be read with arbitrary text sizes, you hope they'll show up somewhere near the relevant text. Treating a book as an ebook, or vice versa, will always be a compromise.
You mean the 737Max?
I'm in UK, I was informed of my upcoming jury duty about 4 months or more before the actual service.
Couldn’t disagree more. Do you want to fix the conditions that led to the problem? Or do you view a post mortem as a punitive process?
One thing my European friends tend to not understand is just how big the US is. For a huge portion of none-coastline America, driving is the only mode of transport.

"Denmark is approximately 43,094 sq km, while United States is approximately 9,833,517 sq km. Meanwhile, the population of Denmark is ~5.6 million people (321.0 million more people live in United States)" From a quick search.
So having offspring is basically the primary goal of our species?
See also: GPS vs GLONASS time encoding. GPS rolls over every 19 years, so devices, cars and even Boeing aircraft saw their GPS-based clocks turn back to 1999 last month. Meanwhile, GLONASS epochs are only four years long, so every device that uses it as a time reference is built to handle rollover.
Ugh. So much noise. I was going to avoid this but I'll bite once. I'm a professor in condensed matter physics, doing research actively, quite well aware of Lagrangian mechanics and relativistic QFT, path integrals, and I also taught QFT. That's my background.

You're mistakenly equating Legendre transform to Lagrangian, and basically saying "there is Legendre transform in quantum mechanics because there's Lagrangian". No. And no, saying no isn't a "technical mistake". First, when building theories from symmetries, you typically start from a Lagrangian as the fundamental quantity, as opposed to taking the Legendre transform of something. Second, when strictly doing quantum mechanics, Legendre transform itself doesn't make any sense because everything is an operator. It's useful before you do a canonical quantization of a classical theory, because you can only do Legendre transform between classical Hamiltonian or Lagrangian, but that's still something you do when doing classical mechanics, not quantum mechanics. Even then you need to be careful with noncommuting operators --Legendre transform won't magically give you the correct Lagrangian and you need to do some trial and error to find the correct form (which happens even with the QED Lagrangian with derivatives and field tensor terms). Thinking that ordinary Legendre transform will just work in quantum mechanics is naive and plain wrong.

Path integrals don't have anything to do with relativity, they work perfectly fine for non-relativistic QM as well. And no, you don't need path integrals for doing relativistic QM/QFT either.

There are third and fourth and other formulations of mechanics (Louville theorem, Hamilton-Jacobi equation, ...). You're just dismissive about them because they don't serve your narrative.

Hand & Finch reads perfectly fine to me, everything is there, it's not "encoded", you just need to read the equation and the text. There will always be confused students, even if you spell everything out.

And this whole attitude reminds me of Feynman's comment on mathematical physicists or mathematicians doing physics. I personally have better things to do than dwelling on mysteries of Legendre transform, or deep meanings and magical connections of the number pi.
I like it! I wish I could comment from with int app, it's basically everything I'd like out of an HN app
Here is some back of the envelope math that I did:
Assume you have two groups who are each 100% focused on a cause which the other group has no opinion of.

n = people in each group

b = individual vote budget

Each Group Votes Independently: n * sqrt(b) votes

If a group colludes s.t. group A gives (1/2)b votes to group B's issue and vice versa you get: 2 * n * sqrt((1/2)b)) votes which simplifies into Sqrt(2) * n * sqrt(b).

Yet coordinating between these two groups becomes more difficult and costly, growing somewhere between n (perfect coordination) and n^2 (total decentralization). Thus, regardless of how you coordinate it will always be more expensive than the influence you gain which grows at sqrt().

Even in this simple assumption collusion becomes a negative value decision.
Yes, that was stupid. Edit now, thank you.
Chrome, here I come.
How does this compare to PNG? I believe the latter is lossless, so presumably it's just the plain pixels with Huffman or something similar. But I'd be curious to know more details.
I think they should explain this a bit better. That said

For core services like compute and storage a lot of the price to consumers is based on the cost of providing the raw infrastructure. If these path style requests cost more money, everyone else ends up paying. It seems likely any genuine cost saving will be at least partly passed through.

I wouldn't underestimate #1 not just for availability but for scalability. The challenge of building some system that knows about every bucket (as whatever sits behind these requests must) isnt going to get any easier over time.

Makes me wonder when/if dynamodb will do something similar
That doesn't work unless you're on dev or nightly.
Is Tor Browser also affected?
Just solved a first world problem
There's allegedly been a thriving industry of in-person data transfers in Cuba, where people get their portable media loaded up every week with the latest pirated/banned media [1]. I wonder if more isolationist or censorship-oriented embodiments of this sort of policy could lead to that model (and loosely similar ideas like USB/Wi-Fi dead drops [2]) becoming more widespread.

[1] https://www.mcclatchydc.com/news/nation-world/world/article2...

[2] https://www.computerworld.com/article/2597815/dead-drops-off...
Amusingly, my surviving extensions are for WAVE, Print Preview and other accessibility tools. Thank you Mozilla, you really do care!
I cannot even download new extensions to replace the ones that have been disabled, What the heck is going on.
So why is this taking so long to fix? From https://github.com/mozilla/addons/issues/978

> diox commented 2 hours ago

> I'm locking this like I did in #851 because no new information is being added. We're aware and we're working on it.

I mean, two hours? WTF.
Easier said than done when an infant is wailing into your face

Our daughter's crying never bothered me and I could always calm her. Our son's crying shattered my brain and I'd often have to hand him off to his mom.
Updating with an expired cert doesn't automatically result in compromise.
Thanks.

I'd heard of Redis -- it looked like overkill and more work just to understand than what I wrote.

I'd never looked at memcache.

With your mention of these two, I did a little Google search. Google has some of their little nutshell relevant descriptions right away and a also a link to
an informative article:

https://www.linkedin.com/pulse/memcached-vs-redis-which-one-...

This article seems to say that now Redis has the memcache functionality built-in implying that never need to use both.

The article does seem to claim that memcache is multi-threaded and Redis, single.

I've been hoping I could get by with single threaded and the TCP/IP FIFO queue -- IIRC .Net has a multi-threaded version of the collection class.

Or, maybe if want multi-threaded, better just to run that many instances of the software, each single threaded, and f'get about the overhead for the multi-threaded collection classes?

Again it looks like memcache and Redis are more complicated just to use than what I wrote.

"You just wrote a slower memcache with fewer features."

Well, well almost anything will have more features than I included!

What I wrote should be plenty fast internally if the .Net collection classes I used are from AVL trees, Red-Black trees, or something similar. Then what I wrote would be slower because (i) get to it via TCP/IP sockets instead of some addressing more direct that would have to be on the same machine.

But I didn't really want my session state store to have to be on the same machine as the Web server software that is using it. So, that essentially implies that a Web server has to get to the session state key-value store via TCP/IP sockets and stands to be about as fast as anything else with such socket access.

Let's see: For some much heavier loads with lots of Web servers and lots of session state store key-value reads/writes, startup 20 such session state stores and have each key start with a number 1-20 to specify which key-value store. Then do a crude load leveling -- for a new key-value pair, send that to 1 plus the number of the last number used modulo 20, that is, round-robin. So, that would be my approach to something scalable, distributed, IIRC, sharding. Yes, could do more where could have an instance of the session state store start a shutdown be accepting no new key-value pairs and then after the time out value with all its pairs deleted send a message somewhere saying it is shutting down. A Web server trying to sent a new pair to such a shutting down server would receive back
a going out of business message and not bother
that server again until it has received another message. Or when intending a shutdown of a session state server, just send a notification to each Web server that
the particular session state server was
shutting down. So, could have some
system management features for
better continual operation. Maybe Redis has all this already and the details of such features are what I don't want to take time to read just now!

Sounds like if my startup is successful, I'll be converting over to Redis!
Firefox requires extensions installed via their "store" be signed with a certificate to make sure they're actually from there. That certificate has an expiry date. It expired, so now all of its signatures are invalid -- and Firefox no longer trusts the associated extensions.
Alternatively, that person (if they exist) has gotten the best lesson in institutional certificate hygiene rules money can buy. They got their mistake potentially added to hundreds of companies playbooks so it can be caught.

Honestly that's one of the most successful things you can expect out of a failure of this magnitude.
I use this in my office (well, the Korean replication that's still sold). I firmly believe that good chalk on an enameled steel chalkboard is far superior to a whiteboard: it always erases cleanly, the ink never runs out, it writes with high contrast, and it's immensely satisfying to write with. The only downside is chalk dust.

By contrast, the cheap chalk the department buys for us is terrible. It squeaks, it snaps, it refuses to erase cleanly. And our conference room whiteboard markers are always dried up and don't write clearly.

I have yet to turn into an illicit chalk dealer, though.
Plan 9 did a pretty good job.
Gotta love the Linux release team for not disabling this ability.
The kicker is, I cannot even download new extensions either, it asks me to check my internet connection, but it isn't my internet that is the problem. What the heck is going on.
That's silly. Browser security is not one function. It's not even one team.
That only works on Nightly and Developer Edition.
This is highly ungood, of course. The failure to notice an upcoming expiration is terrible in itself, but I suppose we can sort of almost empathize with how such shit may happen. The failure mode is inexcusable. Someone somewhere sometime must once have made a decision, "this will be the right way to fail", or - worse - developed the addon certification system and deciding it didn't need no stinkin' graceful degradation route in case of disaster.

Still, it's no worse a calamity than most everyone else presents to the world from time to time. I shall stick to my Firefox, partly influenced by the complete absense of any viable alternative out there.

By the way: Writing this a few hours after midnight, May the fourth, local time. Every single one of my 33 Firefox addons is active and working just fine. Wating to see. Breaking out my Waterfox, just in case.

[Edit: May fifth -> fourth]
I agree. What can be done to prevent developers from adding a certificate dependency without monitoring during the move-fast-and-break-things days of early development, which then sits for X years as developers come and go, and nobody notices until it fails?
Do you have any sources that talk about these breaking issues? I wouldn't be entirely shocked that Google would be doing this, but I do want to see more than just one anecdote that it's ill intent rather than incompetence.
It's a totally different approach, a bit too much to explain in a HN comment; but generally it involves rearranging the data with a set of filters, and then compressing with what is essentially gzip.
QR codes are also super useful in warehouses
As a manager I am in meetings for 4 hours a day. I bring my laptop and continue to work. It is actually very productive!
So Tesla autopilot is superior to cruise control because it keeps you going in a straight line, and that's totally a feature car consumers need?
Construction Costs in the Nordic Countries
They should just charge a $50 fine on the spot, or take a shoe.*

* Nobody wants to lose a shoe, plus it stimulates the local economy (at least the shoe stores.)