skysight-inc/HackerNews huggingface dataset:
What you describe is exactly the behavior the author calls "Firefox' war on self-signed certificates". The actual proposal calls for a browser that does NOT prompt the user all the time. It would just prompt when something extraordinary happens (such as the server's already known certificate changing).

> After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS

That's not really true. It has simply never been done for browsers, because many people think it's an abomination and, to paraphrase well-known HNers from previous discussions, supposedly useless and little more than obfuscation instead of encryption.

It's not the first time TOFU/POP has been suggested on HN, too. I find it curious this proposal got so many upvotes here today. I don't remember that many people coming to mine and other people's defenses when we suggested the exact same thing a few months back and crypto gurus were rending their hair like we had committed the most stupidly blasphemous act conceivable to modern computer science.
I've been playing music with a two-dimensional grid controller (Monome):
http://dl.dropbox.com/u/1508039/klavir.mp4

It's much easier to play with two dimensional shapes than on a regular keyboard once you get the hang of it, especially if you're a visual thinker.

I'm currently using a layout with horizontal spacing in thirds and vertical spacing in fourths, but I'll see if I can get a clue with the lattice from the paper.
Pi Day: Help yourself to a slice of infinite, transcendental pi
Been going on for years, sometimes referred to as reference agencies. This looks like a pretty poor example IMO.
41m for an app i could rebuild on a weekend. just read the app reviews in the app store and guess how likely it is that anyone tries to do it.
"Landing a job is 70% presentation and 30% actual skills and abilities. In fact, the candidate who gets the job is not always the most qualified; rather, the candidate with the best presentation will get hired."

So true...
I was under the impression that everyone believes these companies are printing money, but don't know how much money they're making relative to their valuations. Although, I'm not sure about Twitter, are they considered to be significantly profitable?
>If a Starbucks barista responded to my question, "How are you?" by saying he's doing poorly I would be happy to listen to his story and offer myself in some kind of emotional-service capacity.

The issue with this is that the relationship is one sided. You cannot be negative to customers as an employee in a professional setting, that is a big no-no as far as customer service goes. Most customer service people have it pounded into them to "leave home life, at home", while inviting on any negativity that "how are you doing" may bring from the customer. You are also under time constraints which you and the customer are usually aware of. If someone really wants to go into the terribly surgery they're recovering from or that they lost their job the other day, you have to cut them short to move on to other customers. No one wants to hear the lonely old mans stories while he holds up the entire line. You will get dinged as an employee for not servicing enough customers if you let this get out of hand.

Additionally "how are you doing?" rarely will get a completely honest answer. It is a ritual for most people. People don't go into the deep personal crises they're having with a barista, cashier or bank teller. Nor does the company they work for really care. You personally may have compassion for the person but even if you heard the actual tragedy in someones life(which some people do go into), you have very little power to affect the situation. I guess you can say "well hope that works out for you", but that doesn't really solve the problem. Worse is when the company you work for is at fault for the problem & the company wants to wash their hands of it while putting all the pressure on you to "smooth things over" with the customer.

I think it's nice to try and be positive, but I also like to be realistic. My beef usually is more with companies who really don't give a shit about the customer, but burden their employees to represent the business as though it really does, meanwhile usually treating the employee like crap as well.
I played quite a bit of poker and blackjack to help pay for college; Some of my "not-really-friends" friends dropped out to play professionally.

Playing 6+ simultaneous tables isn't as romantic (it's a boring way to play) or hard (there's software to help you keep track) as this article makes it out to be, when you're essentially asking the same question every hand, doing the same calculation. It gets to be mind numbing. There are few situations in poker that are truly interesting when you've played tens of thousands of hands.

I'd liken the experience less to Command and Conquer and more to mining for gold in World of Warcraft.

And that was the difference between me and the others in my circle that still play full time: Mental stamina.

Seeing the chips as points and not money is really a defense mechanism to keep you playing rationally. Where many good, but not great, online players lose it is in the grind of constantly calculating pot odds.
Your claims are based on what?
It's related but not the same concept. Plutocracy means government by the rich; the Citigroup article discusses plutonomy, an economy of the rich.

Great point.
Completely agreed. Note under such a system we wouldn't have even had to create separate CAs - it would have been natural for DNS registrars to take on this role, signing a certificate for your domain at the same time that they delegated your name server records. Certificate expiry dates could have been directly linked to domain registration expiry dates.

Under such a system, you'd know that you were only at the mercy of the Chinese government when browsing .cn sites - which is neither unsurprising nor too much of a worry.
Heh it seems out of place cause you quoted it out of context. Sometimes it's so easy to debug these things. :-)
Can anyone name a situation where a company received record funding or major pre-release hype and wasn't heavily criticized for it?

I can see why groups like KickStarter chose to have their funding stay silent while they grew.
they do take a 50% cut, but I think they also do a looooot of advertising.
That plugin already exists - if you run Firefox, install "Certificate Patrol". It will tell you whenever a site's certificate changes, and it'll show the relevant fields of the old and new certificates side-by-side, so that you can decide whether the change looks benign or malignant.
"every first introduction between a browser and a website is insecure, so that subsequent connections might be less insecure."

I think the claim is that this is already the case. There are certificate signing certificates in the hands of people who should not have them and there's no accounting of who has them (beyond the government mentioned) or what they're doing with them. I don't think this presentation is suggesting deleting all your installed CAs, just monitoring whether things are changing under you and coordinating those observations with others you trust. The coordination certainly goes beyond on the SSH model.
You can sometimes get away with admitting ignorance if you promise to follow up with action. As in "I don't know the exact particulars of Y, but I'll look into it later today and get back to you tonight." This is one of the things that students getting their first job who have spent all their lives in school don't get. They are so used to the academic environment and its expectations of always knowing on the spot, that they don't realize it's sometimes permissible not to know -- you just have to state it appropriately.
No one ever got fired for buying Méthode.

http://www.eidosmedia.com/EN/Page/Uuid/1d3be57a-af49-11de-9d...
You can't call it realistic unless you know what the investors know. I have a hard time thinking that Color could be so amazing that it warrants such a huge early investment, but it's not realistic for me to say that Sequoia wasted their money because I don't know what they know.
You don't need all the details to be unimpressed by creepy data mining operations.
"because not every input to every query can be bound as a variable" Can you give me an example?

var sql = "select * from User where UserType=@ut order by ModificationDate " + sort_order;

In this case, if sort_order directly comes from a 'asc'/'desc' radio button then you have an injection attack.

The correct way to do it would be:

var sql = "select * from User where UserType=@ut order by ModificationDate " + (sort_order=="asc"?"asc":"desc");

The point was that there are some parts of sql that can't be parameterized like sort order or limits on the resultant recordset. Although, ideally support for those things should be coming from your database vendor (if it isn't already there).

For example, SqlServer supports using variables in top expressions: select top(@max) * from ....
Apparently Microsoft wants to target WM7 at consumers. They've done very little to integrate WM7 with Windows Server -- in fact WM7 is a big step backwards in this respect compared to WM6. I think you're right that going after the enterprise market would have made a lot more sense but for whatever reason Microsoft is still in denial about losing their death grip on the consumer market and as a result squander opportunities to succeed in markets they already own. As for RIM I think their enterprise credibility isn't what it used to be. Apple in particular, and Android to a lesser degree, have surpassed them in many ways. Not so much on the device management side, which is somewhat trivial on these devices anyway, but more so on pure functionality. There are just so many things you can't do on the latest & greatest BlackBerry. It's great you can manage the hell out of the device but the gap in functionality is massive these days. The only reason RIM hasn't totally imploded is that BlackBerries are dirt cheap which makes up for the lack of functionality. This isn't really sustainable.
I thought this was going to be another post about the bubble or Color Labs.
I think I understand where you're coming from, but I don't think people you are referring to are the mean spirited haters you make it seem. I think people are just curious and are honestly just trying to figure out what is so ridiculously special about Color that they were able to raise that much money.

I don't think it helps anything that they've had tons of press and the only things that have come up are 1) Bill Nguyen is awesome 2) they recreated some technology from the Dark Knight. If Bill's such an awesome leader, and they have 27 awesome people, and $41M, why is the app still horrible (interface, experience, data mining, etc.) at launch?

I'd honestly be happy for them if it takes off and it's the next big thing. And Sequoia usually gets it right, so I think everyone's just curious to know what's so great about this company and this app. But, we just aren't convinced yet.
What is the point of this numerical experiment? (I"m serious)
How well has Microsoft's purchase of Danger worked out for them? Why do you think it would work any better if they bought RIM?
It doesn't help that the redesign looks like a free WordPress theme.
I'm going to make a prediction and say that this kid is flat broke in the next 2-5 years.(if it takes that long) The article seems to gloss over the sickening amounts of variance that poker can have. Just like you can run up from nothing to millions in year, you can go from living in the penthouse to sweeping the lobby over a few bad sessions. Especially at the stakes he's playing at. Ask Mike Matusow about being a pro who's borrowing money to pay bills.
When I wrote this it was for people who are running start-ups or launching a new company with no prior or little sales experience.

I don't believe in lying to people or providing mis-information. As sales person, my goal is always to place all of my cards on the table and let my customer chose what they want.
"eavesdroppers who don't have the ability to modify the stream" are a nice fairytale, but they don't really exist in practice, with current network protocols. DNSSEC might change this, once it becomes universal.
9 People chatting now! Join us
Can you elaborate on this?

Given a properly parameterized query, where none of the parameters are ever evaluated, how do any user inputs remain unseperated from query structure?
Chaussures Nike, Chaussure Nike pas cher, Nike Chaussure sur Morecerts.com
For whom does this article elucidate anything?
There is a strange and powerful drive to be the first person to declare that something has jumped the shark. I don't know exactly what it is about the Internet that has done this, but the time it takes for someone to leap up and declare that something is "over" just keeps going down, to the point that it has now reached somewhat absurd levels. Maybe we're in a bubble, maybe not, but either way the declaration seems to be getting made on awfully scanty evidence... but it's important to be first.

Of course on a long enough time scale a bubble in tech is inevitable almost no matter how you slice it.
Depends? Did you edit the interesting hack answer and say you edited your application late to make it more appealing :)

Show confidence in yourself and your idea. I doubt they are going to disqualify a great investment by being too forceful on their rules.

Good luck :)
I am interested in finding out how many people decided not to choose a number at all, and if that fact could help mitigate the experiment's inherent bias.

As for people making multiple entries into the experiment, a simple IP filter could help reduce overall error.

I think it would be neat to offer an option to not choose a number, but rather a number to help offset selector's bias (in participating in the number choosing experiment knowingly). It's similar to the multiple choosing UIs.

Nonetheless, I can only appreciate simple things like this that lead to a spirited and educated read.

Cheers and can't wait to see "final" results and accompanying analysis.
Tell HN: How I pivoted or: please review my startup redux. 
A while ago I posted on HN [1] about my film/tv show/video game recommendation app called Archfinch [2]. It wasn't received well and it didn't even make it to the front page. I was a little disappointed that fellow HNers didn't care about my app and that no blogs wanted to write about me since I was overshadowed by a similar app a month earlier (which at the time I didn't know about). But such is life and I hacked on.

I tried a few ways to advertise around, but I noticed a common trend: some people naturally bounced, others liked the site enough to rate dozens of things, I got some nice emails from users who liked Archfinch a lot but retention was very low. To my amazement of people who rated anything at all, the average rating count was high:

avg | stddev
---------+----------
60.943 | 68.147

Clearly I was doing something right. But there was no way I could keep people based on movie recommendations alone -- people don't need that kind of service often, and by the time they do, they will have forgotten about Archfinch.

I implemented something I planned to do 'in the future': fresh links, HN/reddit-style, with a twist: you get personalized link recommendations. This seems to work well so far, people are coming back for more. And it has a chance to work -- reddit, Digg, etc. have all succeeded in the past and people need their daily fix of links.

In theory, link recommendations could be the end to the 'eternal september' syndrome that all such websites suffered in the past: the algorithm could recommend cat pictures to the masses and awesome links to people like us. Time will tell however.

Some of you mind find this boring but personally I like reading about people's mistakes and their subsequent analysis so maybe some of you will find this interesting as well.

If you feel like checking out Archfinch [2], feedback is very welcome, either here or at luke@archfinch.com, I read (and try to respond to) all emails.

References:

[1] - http://news.ycombinator.com/item?id=1601930

[2] - http://archfinch.com/
We have a vested interest in their product because we were supposed to be it's users. Our optimism has been replaced with pessimism when they were honest about what their product does and why they created it(data mining). We're not mean spirited. We're frank and honest.

People on HN have no problem being optimistic. I was optimistic when I tried the product. I spent a good hour or so with several people on several devices in different locations using the app. We encountered problems, no instructions, confusing UI, the inability to see photos from users you were sitting next to, and in general we all felt that there was no useful feature in the app. We didn't get the app, then when we heard about the $41M in funding... we REALLY didn't get the app.

Speaking for myself, my comments were based on my experiences of using their product, the information they released to the press and my opinions based on the words of their employees. I don't think anyone could ask for much more from a group like HN.
Oh! I thought it was a sarcastic joke site ;-)
When you find it, could you please confirm whether or not it is peer-reviewed?
Perspectives (mentioned in the slides) goes a couple better: multiple third parties that poll sites and keep a history of what cert they offer.
I highly doubt that real "startup people" are that socialist (ie. we should distribute Seqouia et al.'s $41M among many 2-3 person startups vs. a single team of ~30 people).
Exactly. I'm almost uncomfortable thinking about how many of these things turn into really embarrassing live interviews.

"So, Ms. Jones, I've never heard of the Acme, Inc., perhaps you can tell me more about it?"

"Just call the toll-free number to talk to my supervisor!"

"I'd rather have you tell me about the company, what it does and the specifics of your role there."

"I'll be leaving now."
Thank you. All this negative criticism about Sequoia's investment is kind of like berating a friend for buying a project house. It might need work, it might be a failure, it might be a success. Let's just all sit back and enjoy the ride, whatever it may be.
I think I'd rather go with claiming I just got off a contract for a defense contractor, and an NDA prevents me disclosing who it was or what I worked on, other than to say that it involved the same skills that are listed on my resume for my last non-secret employer.

That seems safer.
Clickables:

[1] - http://news.ycombinator.com/item?id=1601930

[2] - http://archfinch.com/
Thanks for submitting! The number of responses is vastly more than I expected, pushing 100k uniques now. AppEngine has handled it wonderfully. It blew past the free quota, so I did have to enable billing. But, it's still only pennies so far, and a quota reset is coming up soon.

The amount of data has been a challenge, since I have to put together more efficient stats tracking. A good problem to have, of course.

I was expecting to have to spam the crap out of my Twitter feed and leave links everywhere to get even 100 participants. Glad that wasn't the case!
Ask HN: Anyone have a really smart way to organize css?
I'd love to see an example of super organized, tight CSS. Do you organize by location (header, footer, body), by function (typography, position data), or both, with multiple instances of the same selector? Wondering how my css stacks up and where I could improve. Thanks! (:
http://www.beerfortextbooks.com/beer_me?q=0452011876&bra...

"Who is John Malt?"
After reading through all the awesome comments on this thread on Quora, I created a Prezi to summarize it all. I posted it as an answer summary.

But some guy named Richard Henry --- Quora Admin --- deleted it. Said it wasn't a summary and was not useful.

Here it is, if you're interested in the summary: http://prezi.com/l1wuvbaya37o/quora-life-lessons/
Russian Site Smokes Out Corruption
There are multiple hops from you to the server. That scheme would only verify that BOTH your and the third party's initial hops haven't been simultaneously MiTM'ed. It's very possible the routes overlap for several hops.

And even if they didn't, I wouldn't consider hackers getting my bank info-- or governments reading my email-- the server operator's problem.
Simple:

(1) spend 30M acquiring bunch of high-usage apps with lil revenue

(2) collect anon user data

(3) license / sell data to ad firms on ad exchanges and more

Most of HN has no idea how crazy the ad exchange business is because they are pretty tightly controlled and require high minimums to play. I wouldn't know if I didn't have a brother working inside day to day.

Suffice to say, there is a flourishing market where anon user data is bought and sold for millions to improve ad targeting.

One great example is rapleaf. When they launched, I was like "meh, another reputation management co." Turns out they are doing alright doing what I describe here. Yet if you simply judged them when they launched or from their consumer front they put up, you'd never know.
See also: http://en.wikipedia.org/wiki/Teleology

The fact is that only a tiny portion of the population of the world today do not espouse some form of magical or teleological thinking. It's extremely important to recognize and understand such phenomena.
This particular writeup said a lot about the strategies Sequoia could be using to protect themselves which I hadn't seen in previous discussions.
Ruby syntax is already really similar to Python syntax. Significant indentation is the biggest difference. I actually made a prototype Ruby with significant indentation a la Python and I think most people would have mistaken it for Python at a glance.
You can do Single Premium Life insurance that mitigates all your issues.

But I will agree that trusts are worth a look.
Well the real life references aren't 100% beivable either. I have been asked more than once by my colleagues to speak refer them regarding the work that they have not done. Or role that they have never played and this is not just for the referrals but for public sites such as linkedin.

The Philosophy that I always recommend s hire slow fire fast. You take time interviewng the person, probing them if you feel something sounds fishy. Give them a chance to prove themselves and if it doesnt work out don't hesitate to fire in the first year. A few months is a good time to understand how a person works and what their calibre is.
What about Firesheep users? Surely there are many people who find it a lot easier to just capture some WiFi traffic via libpcap, WireShark or the like than to set up a fake WiFi access point, poison a DNS cache or mount other such attacks that would allow them to actually modify traffic.