skysight-inc/HackerNews huggingface dataset:
Everything that you mentioned is supposed to make things easier, safer and more importantly faster to change.

However it seems like developers everywhere are just adding these things because they heard that facebook or whoever was doing it without actually stopping to think if it makes sense for their team and their product. Before you know it you're left with a ball of tool/process mud where every little change requires passing a resolution at the UN to implement and deploy.
Cannot Mozilla reasonably say that currently there's only one acceptable DoH provider; it hopes to vet more soon and once there are more than one it will select the default provider through some reasonable algorithm (random, perhaps).
What's your actual odds of being struck if you wander out into an active thunderstorm and decide to play in the rain for an hour?

Is it actually more dangerous than driving a car for that same amount of time?
> Does that not require a system-level root CA to be installed and trusted?

No, happily :-)

The trick is that it starts the application to be intercepted for you, so it can control it a little. It then does some magic to get that specific instance of the application to trust the certificate. There's a lot going on there, but as an example: Chrome has a --ignore-certificate-errors-spki-list to inject the hashes of extra CAs that can be trusted in this specific Chrome instance. When HTTP Toolkit starts a Chrome process, it adds that command line option, with the hash of your locally generated CA.

There's nothing here with a lasting effect, and other running apps on your machine won't trust HTTP Toolkit unless you specifically configure them to. Only the processes spawned by HTTP Toolkit trust your CA, which avoids a lot of the downside of other similar tools like this.
70% of a cherry picked subset of the market that excludes vape shops and online.
Huh, didn't know about SNI, thanks for the info. Seems like a relatively small risk though.
> If you don't like the fact that DoH is centralized in the hands of Cloudflare, all you have to do is offer a competing service.

You seem to be presuming that a single "service" is necessary. "Alternative" centralized services are still a centralized service. The solution to Cloudflare being able to log everything isn't to hand that same power to someone else.

I run my own recursive resolver. Only the first request for a domain's NS record goes to a centralized service; every other request goes to the domain specific nameserver. Asking ns.example.com for the A/AAAA record for www.example.com doesn't tell example.com (collectively) much more than they will learn from the HTTPS request that usually follows.

Yes, ".com" can log that I asked for the authoritative nameserver for "example.com", but this is usually cached. The centralized nameservice doesn't see most of the DNS traffic.

Yes, the communication with each domain's authoritative nameserver is often unencrypted. This is unfortunate, and I strongly support an encrypted replacement protocol for all communication with nameservers.

Using DoH sends all of the above to one entity... which then likely sends it unencrypted to the authoritative nameservers. The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS.

> for a lot of people in a lot of countries, a choice to use any resolver that isn't controlled by their ISP/government is a step in the right direction

Providing this as an option for people in those situations is great. That doesn't mean it will be a benefit for everyone. For many people, DoH is a significant loss of privacy.

> So please stop trying to drag down other people who are doing their best to make progress.

Please stop using this cheap appeal to emotion that presumes one solution will help everyone.

> Show us the code or GTFO.

We don't need to when the existing DNS situation was already a better option. Please learn about the diverse way that DNS is actually used in practice. Also, please consider the damage that is done by encouraging apps to bypass OS-control of DNS. This takes a lot of control away from the user, and will piss off a lot of people that use DNS-based adblocking.
Themstates – a succicnt but expessive state machine lib
Death by a thousand cuts sounds more believable. I concur with your position: instead of it being black-and-white, it could simply lead to less demand for engineers as the "building blocks" -- really common open source technologies with nearly omniscient presence -- are essentially commoditized.

On the other hand, I could also see a reality where, since many low-level problems are solved for you, management expects more out of you, so the number of engineers stays about the same, but you get a higher level of productivity.
They are paying for your cheap rides.
Oh, yeah, that too - for me, after Snowden, Stallman went from "crank"-ey to "prophet"-ey !

(Well, and GAFAM's behavior in the recent years certainly didn't help either...)

P.S.: Got Stallman to sign my The Snowden Files book after he introduced his speech with asking the public to give "three cheers for Snowden"...
Arango is doing so much right now--their SaaS version "Oasis" coming out this year, SmartJoins for faster multi-cluster joins and now ML.

I admit I liked Mongo for it's document storage. But I didn't like Postgres due to my irrational dislike of SQL Then I challenged myself to try out a graph database.

ArangoDB presents things like Mongo (as documents), has a much nicer query language than SQL (or just use GaphQL) and does graph stuff; all while being amongst the top 3 or so in benchmarks that are designed to test only specific types of databases. If databases did triathlons, ArangoDB would be unbeatable.

Only two issues that I struggled with are/were Kubernetes cluster stuff, like sharding, but this is common to cluster DBs I think.
It would allow other players to raise prices and make a profit.
You can change a lot of things before the market moves underground. You increase cigarette taxes and smoking rates go down [0]. It could have moved underground, since it doesn't take a rocket scientist to roll one, but it didn't because that's not the dominant factor. If the flavor really really matters to people maybe what you said will happen, but I'd bet against that.
As a UI desktop app, not really, although it depends what you're trying to do. However, the internals are all open-source too, so you can use them standalone and automate HTTP & HTTPS with that. Take a look at https://github.com/httptoolkit/mockttp
My point is less a knock on mathematicians and more that folks underestimate the expertise and time spent by fiction writers. And there is less support for writers along the way. And the emphasis on "more" here illustrations that. People tend to discount fiction writers because they write outside of institutions and because popular books distract and detract.

Expertise: Take the most recent 4 Fields medalists. All 4 have PhDs (all of which were completed in less then 5 years, though that's more a testament to them) and worked in academia/research since undergrad. Compare them to the two MacArthur Genius grant winners who are writers (announced today), only one has a PhD, the other an MFA. So does that mean that the Fields winners have more training? Maybe, but there are very few creative writing PhDs in the world (maybe 100 PhD spots across all programs vs. what 5,000 math PhD students?). MFAs are considered terminal degrees, last 2-4 years, and many require you to pay for them vs. Math PhDs mostly are fully funded. So what's a fiction writer to do? Get a PhD in something else (Valeria) or string together fellowships and jobs for (4-5) years (in Ocean's case) before you can get an academic appointment. Does that mean Ocean's 2 year MFA + 4-5 years on his own is less expertise than a math PhD? Maybe, but there isn't the same support. After this, mathematicians and writers start looking the same (have academic jobs, teach part-time, work part-time). Except both writers produced at least two books on their own before they could get academic appointments whereas none of the Fields folks have left academia since undergrad. That's years the writers had to support themselves while also writing.

Time: Hard to tell on this one. But Alessio Figalli (Fields) has produced 125 papers that seem to be about 20 pages in length in 12 years of publishing, so that's ~2500 pages, or ~200 pages a year. And Valeria Luiselli (MacArthur) has published ~1000 pages in books in 8 years, or ~125 pages a year. If they both spent the same amount of time working and each page was unique (may not be the case for Alessio), then Valeria spent more time per page. If Valeria had less time because they had a full time job versus part time teaching or Alessio's papers repeat some of his work, them maybe it's similar amounts of time per page. And if a student leaves their MFA with half a book and a few small publications, keeps writing the book for a few years before publishing it (Ocean Veong's Night Sky With Exit Wounds) vs. a math PhD publishes their thesis plus 2 short papers out of their PhD (Akshay Venkatesh's thesis + 2 short papers from 2002) isn't that roughly the same output in the same amount of time?

Admittedly one can't use isolated examples to deduce general truths, but it's illustrative. And when you start comparing, say Donald Knuth to Toni Morrison, both have decades of expertise and spent hours laboring over each page, so it starts to seem moot. And fiction books tend to sell more copies so can be priced less because of scale.
Slightly related to this, the Lock Picking Lawyer on Youtube has number of videos where he tries a Ramset gun [1] against different padlocks. For example:

https://youtu.be/Wimo09WV-rY

This was interesting as it was an attack that certainly would not have crossed my mind.
Would be interesting to see how other types of locks would do against this kind of tool.

[1] https://www.homedepot.com/p/Ramset-MasterShot-0-22-Caliber-P...
It's interesting, a while back I searched early HN comments about Theranos' announcement and they were mostly glowing and positive.

Edit: here's the thread - not 100% positive but close: https://news.ycombinator.com/item?id=6349349
This is like asserting that because Usain Bolt exists nobody needs to drive a car.
This would only be true if your ISP couldn't otherwise violate your privacy. Which they can. That they don't see your DNS requests is an extremely low barrier. They see all the subsequent traffic.

Using DoH increases your privacy attack surface, not reduces it.
Job Market for Autonomous Vehicle Engineers Slow, but Job-Seekers Have the Edge
The best thing I could do is to book a flight over to Europe so I can see it before it's gone forever.
When I smoked, I was addicted to (Korean) menthols while normal cigarettes would make me puke. So there is definitely something going on there.

I don’t vape, but if they banned flavored liquids, they better ban menthol cigarettes as well.
> Nunavut’s rate is 100 per 100,000, ten times higher than the rest of Canada and seven times higher than the US.

Ok, that's bad.

But we can connect that to the US: white males with no college, aged 45-54, have a suicide rate of 38.8 and a poisoning (overdose) rate of 58.0[0]. Put those together and that's pushing 100 per 100,000. That's enough to start asking some cultural questions.

However, "During 1999–2003, the suicide rate among Nunavut males aged 15 to 19 was estimated to exceed 800 per 100,000 population, compared to around 14 for the general Canadian male population in that age group."[1]

800 per 100,000? This statistic is staggering for a couple of reasons: its magnitude and the age range.

The graphs in [3] show just how young and male the suicides among the Inuit are. It's no surprise that it's primarily male, because it almost always is, but it is surprising to see an 8:1 ratio and that it's affecting the youth so heavily. For comparison, in the United States the 15-24 age range is near the bottom of the suicide statistics[4].

These are boys born in the 1980's. As bad as the crimes against the Inuits may have been in the 1950's it's a strange territory to wander into where an effect of an atrocity shows up 50 years late in a population that wasn't alive yet. From wikipedia[2]: "...to about 170 in 2002. Some of the reasons given include adverse childhood experiences involving emotional neglect and abuse, family violence and substance abuse, as well as social inequalities brought on by government intervention." (referencing [3]) I can see the argument the author is making here but I don't have the time to address it.

The article is giving the "white guilt" narrative and for whatever reason is dancing around the massive gender disparity in suicide rates. When I see articles like this I wonder how much the author cares about suicide and how much they see it as a platform to write about anti-colonialism.

[0] - Table 1 https://www.pnas.org/content/112/49/15078
[1] - https://en.wikipedia.org/wiki/Suicide_in_Canada
[2] - https://en.wikipedia.org/wiki/Suicide_in_Canada#Among_the_In...
[3] - https://www.iwgia.org/images/publications//IA_4_07.pdf#page=...
[4] - https://en.wikipedia.org/wiki/File:Crude_US_suicide_rate_by_...
You are part of the same system that vilifies assault / harassment victims by saying accusations are "too old" / "he / she isn't remembering correctly". You have the gall to call anyone who does care SJWs, I guess I didn't expect anything more from you.
>I'd much rather trust Cloudflare than my ISP.

And I'd prefer a solution that does not rely on trusting any single entity, irrelevant of how "trustworthy" that entity is.
Spiders go ballooning on electric fields
I hope they also censor the white nationalist and sexist content that I see all the time on TikTok. Especially annoying are the ones that imply a woman's role belongs in the kitchen.
I think you meant to say Domain Name System (DNS) over Hypertext Transport Protocol with Secure Socket Layer (SSL) (HTTPS) (DoH)
Growing 3D vocal cords in a dish
“We recently discovered that a Chrome update may have shipped with a bug that damages the file system on MacOS machines,”

My first thought was “if applications can damage file systems, something is wrong with the system (driver buggy or a leaky kernel boundary)”.

Reading https://support.google.com/chrome/thread/15235262?hl=en, it seems Google is a bit sloppy in the way they formulate this. Their code accidentally overwrote /var on systems with System Integrity Disabled or absent.
I love fancy/zany new HCI stuff, and I have been waiting for the CTRL-Labs product to come out for a LONG time.

In my head, the compromises CTRL-Labs are making is brilliant and I believe it can create a compelling product.

This could FINALLY be the keyboard killer. I would love something I can walk and use easily, use from a reclining position, and avoid having to use my hands for typing while programming.

I have bad wrist pain from typing all day, so I am sure to use only ergonomic keyboards and mice and take frequent brakes. Not having to deal with that would be great.
Just remembered, you now work at cloudflare! I remember reading your blog post about joining cloudflare, so how's it going so far?
What is the deal with limiting T-shirts to first 50 000 participants? (And first what exactly, first to sign up or first to get four PRs done?)

It can't be to combat spam PRs, because that would seem to instead just encourage people who intend to spam to just sign up quicker.
If I understand it right, the current rollout is US only.

I know some folks outside the US trust their ISP more than a US company. Right now it appears the rollout isn't hitting you unless you opt in. Mozilla recently clarified this to politicians in Britain [1]

US ISPs are all subject to NSL and the US gov the same way Cloudflare is.

What's different is privacy. When I'm at a coffee shop or some other place my DNS traffic is normally unencrypted. ISPs have gotten a reputation for doing shady monitoring. This doesn't stop all of it but removes a method to watch things.

For US folks the question becomes, do you trust Cloudflare under a special agreement negotiated with Mozilla with a goal of protecting privacy or do you trust your ISP and the ISPs of all the places you connect?

For folks outside the US I'd wonder if or when this would come to me.

If I'm incorrect on something please let me know. I'm just now learning about the reach and implications.

[1] https://www.theregister.co.uk/2019/09/24/mozilla_backtracks_...
I suppose its good that DoH is addressing the privacy issues with DNS, but I think I agree with the point this article is making overall. If its only one vector of privacy, making it a default this early on (less than a year old?) seems a bit presumptuous. If someone is looking for your DNS traffic, but you're using DoH; they'll likely find what they're looking for using another method.

In my opinion, this kind of goes against what I would expect a browser to do as well. I don't like the idea that it just bypasses the OS settings. I understand that there are guidelines for enterprise users, and people who want to disable it; but I feel that a prompt when they globally enable the setting isn't enough. Most average users will probably just click "Yes" on the dialog that asks if they want it enabled.

The idea of DoH seems like a good one, but I would prefer if they figured out a better way to implement it. Probably a huge majority of people are just using their ISP's DNS servers, but I don't know that pointing them to Cloudflare's DoH implementation is necessarily better.
I am not sure how the parent comment has received so many upvotes. OP has some fundamental misunderstanding of mutexes and the purpose of async io.

Locking primitives are completely unnecessary in any single threaded program. Also mutexes in C or otherwise are way older than 1990. They go back to the 1950s.

When your program is single threaded, a simple boolean flag variable can act as a mutex, you don't need a mutex primitive for this.
Mutexes are for situations where flag variables can change state between your instructions to check and set a flag. This can only happen in multithreaded or interrupt driven code.

Infact, the entire purpose of async programming is to stop the use of mutexes and multiple threads to perform concurrent io, which is something that can be performed by a single thread. This is the foundational premise of nodejs.
I don't even know where to start with this. The idea of using sed or awk instead of the DOM is ridiculous in both theory and practice.

All I'm saying is how things are in reality is more important than how things are in theory. I'm curious if you can find an instance where that's not true, but regardless it's a good rule of thumb.
Absolutely not! I'm firmly in the camp that browsers should do this until OS support arrives.

However, the "centralization problem" isn't solved by more competitors existing because widely deployed applications will still have to choose a single option for all but a tiny segment of users that will change it.

If the default comes from the OS vendor then we're in a slightly better place since the default for macOS and iOS will be Apple's servers, Windows will be MS, Android will be Amazon or Google. Competition in this space comes from the people who decide what DNS service to use, not the people standing up the service.
RetroArch 3DS: Full-Speed PlayStation1 Emulation Now Possible on New 3DS
The tar and burning sensation were probably just as important as nicotine in building an addiction. This is why nicotine gum doesn’t do it for many people, and why vaping is more effective for smoking cessation (the steam effect brings back some of the burning tar feel, while you have something to hold...).
To clarify the principles behind the law it might be useful to perform a thought experiment. Imagine that there existed people with extraordinary abilities to absorb and recall knowledge -- think Kim Peek. These people could conceivably read the newspaper archives with near-perfect recall -- essentially becoming a walking search engine. Would it then be desired to restrict these people from offering research services to other people?
Enhancing Istio service mesh security with a CNI plugin
I do not think a full local resolver is necessary. E.g. stubby [0] can be set up to use a remote resolver via DNS over TLS (simpler than DoH, less of a hack, all the same crypto guarantees). That remote resolver can be CloudFlare, Quad 9/101, or self-hosted unbound instance. Then only the remote resolver has to worry about caching and DNSSEC, etc.

[0] https://github.com/getdnsapi/stubby/blob/develop/README.md
In a hypothetical Internet of the future where almost all websites and web-apps are also served from a handful of huge cloud providers, would DoH not increase privacy since now ISPs (and potentially some govts) will have a very hard time figuring out which site or app you are visiting?
After reading about the actions he took (depositing employees 401k contributions to his account, setting up fake workstations, etc) I'm surprised it was only 7 years.

The workers paid their own H1B fees which should have been a red flag to them.
There's also no trust with ISPs. They've already all lobbied at the Congressional level to legally sell our data. The NSA already captures/stores everything that comes out of any of their datacenters. So whose DNS do we use? A shitty company's, or another shitty company's?
Effects of 13 commonly consumed drinks on hydration
One further thought. I am in mathematics, which is not the same as psychology or sociology, so take this with a grain of salt. That said ---

I think your pricing plan is wrong. Don't price based on a subscription model. Instead, sell your software outright, perhaps include more licenses (e.g. for all students and postdocs under the PI's direct supervision), and charge closer to $3-5K for it.

Here is why. First I recommend this entertaining article by Joel Spolsky on how to price software:

https://www.joelonsoftware.com/2004/12/15/camels-and-rubber-...

The idea is the same, and the details are totally different. In academia, funding tends to be feast or famine.

I would never buy software that cost $480 per year. I'd be too scared that my funding source would dry up. Granting agencies and deans are way too capricious. If I got used to it and came to rely on it, I might end up needing to pay out of pocket. Which I'd probably do for $100, but not for $480.

Conversely, when funding does come, it tends to come in larger chunks. For example, my dean has a "small equipment purchase support" program, where I can apply for funding to buy equipment. Never mind the details (I'm not sure if software is covered, and apparently there is a minimum of $5,000, but let's pretend otherwise). If I were going to apply for $500, then I may as well apply for $5,000 instead. It's same amount of work, my chances are roughly as good. Looks the same to me, puts 10x as much food on your table.

An even better source of money is expiring grants. Often, if you haven't spent a source of grant money by a certain date, it goes away. So researchers will say to themselves "Shit. I have $7,000 I need to spend within the next three weeks. Is there anything I can justify spending it on?" If you're in the right room at the right time, then you will get $X, where X is the price of your software, as long as it is less than however much money they have left. At least in my field, somewhere in the low to mid four figures would probably maximize your expected value.

Good luck!
At any time any analytics package or update can just read whats stored client side and send it to Facebooks servers.

Is everyone intentionally ignoring this or actually unaware?

Things stored in plain text client side, can be read in plain text client side and resyndicated.

All this focus on the first transmission being encrypted while in flight and server side is just a bit negligent.

Its a system ripe for abuse and thats it.
Yeah, how can we get more experts from various fields.
> so you can have peace of mind about it

You can have peace of mind about it, but I can't.