skysight-inc/HackerNews huggingface dataset:
Should Firefox throw a generic warning for a 5 minute expired certificate for Wikipedia?

I think it's time to split encryption protocols. The defacto default of non-encryption instead of encryption due to big browser warnings are preventing web developers from implementing any encryption at all. The browsers are indirectly allowing anyone to snoop on what you view on the non-encrypted websites.

I want to use some basic encryption on my connection rather than no encryption when visiting websites like Wikipedia.
Acquisition? No, not at a $30B price.

but if Microsoft got really bold, they could merge with RIM, and have Nokia build the phones.
I'm in Vietnam right now which is currently a very popular destination spot for Russians. There are far more Russian tourists here in Nha Trang than there are of any other nationality. Yet almost every Vietnamese I've talked to seems indifferent at best to them. Unlike the generally easy-going and jovial Aussies and Brits all over SE Asia, the Russians always seem gruff and taciturn. Maybe it's just a surface difference but it affects the response they get from other cultures.
I already knew this thank to Marko Rodin.
Or the polynomials of 1,000 numeric field sieves.
Pretty much standard. It's nice that it's not in legalese.
It would be interesting if they had a "I lost my device" feature that would allow you to follow/track your device if the app is used after you tell the system your device is lost.
Why are you surprised? RIM wants to retain control of their platform, and having the developer re-sign the app enables that.

This way RIM can decide what does, and does not run on it's phones.
My first Django project was to create a simple variance simulator for poker (http://www.evplusplus.com/poker_tools/variance_simulator/). The amount of luck involved in poker is truly tough to comprehend.

Becoming a successful poker player not only requires you to be quite skilled, but you also need to run well at the beginning of your career.
I like the ideas presented in here.

Summary of what I think the main points are:

- certificate authorities are not trustworthy currently. It is deceptive and potentially dangerous to pretend that they are.

- the solution is actually a shift in what we think security is: rather than saying "this site is trustworthy" or "this site is not", we consider multiple factors to decide whether it is likely to be trustworthy or not.

My thoughts: I think the second point is an excellent idea, and I would take it farther by presenting that information to the user.

It would be great if there were a little meter in my URL bar that was more full (or changed color, or whatever) when a site used more secure practices. It would be even better if I could click on that meter and get a list of things the site did, with a note by each one saying "a trustworthy site would do this" or "a trustworthy site would probably not do that".

This would have the benefit of making the security model transparent to the user, which would let them make better decisions.

It would also allow for experimentation with new security ideas, if we allow many possible factors and not expect each site to use all of them. You could easily add a factor for sneakernet key-signing, for instance - if you happen to have a cert directly from the company (i.e. your bank gave you a USB key), your browser could take that into account.

Edit: it would also allow for a gradual transition from the old model. You could make having a CA-signed key a factor. It just wouldn't be the only factor.
If there is a cognitive universal, I wonder if it is absolute. Does it describe the nature of cognition itself or does it only describe cognition we do it here on earth.

IOW: will sufficiently evolved lifeforms on other planets have similar experiences (and therefore a basis for common ground) or will we be completely unable to understand them? Maybe we're receiving transmissions right now and we just don't see it.

If a cognitive universal exists, then true artificial intelligence must -by definition- "think like us" because that's how thinking works.
I've got extensive notes from last summer of more things to try. I totally believe we can get them counting second-by-second.
Ok I am going to defend the guy somewhat. He clealy can't be talking about C# or any other CLR languages themselves, that would be just plain dumb and I'm going to give him the benefit of the doubt.

I guess he is talking about the various Microsoft supplied frameworks. Within say, Silverlight, it is easy to dip your toe in, get to something like databinding, and go off the rails, trying to bend silverlight to your will to do something that should be easy, and coming away with the impression that what you are doing is totally impossible within silverlight. Then you spend 20 minutes actually thinking instead of in a Microsoft hate fugue state and you see that it actually is easy if you don't fight the framework. So you are like "fuck you .net I want to do it my way!"

But that is the nature of frameworks, not endemic to .net.
"In religion, folk religion and superstition, the correlation posited is between religious ritual, such as prayer, sacrifice or the observance of a taboo, and an expected benefit or recompense."

In Silicon Valley, the correlation posited is between investment ritual and an expected benefit or recompense.
Sorry, i meant to deliver that last line with a superfluous emoticon. =).
> Should Firefox throw a generic warning for a 5 minute
> expired certificate for Wikipedia?

Absolutely.

> I want to use some basic encryption on my connection
> rather than no encryption when visiting websites like
> Wikipedia.

Then use Wikipedia's secure URL at https://secure.wikimedia.org/wikipedia/en/wiki/Main_Page

Encryption without authentication is useless. If mybank.com only supports encryption, I have no idea whether I'm actually connected to mybank.com , or to the guy running tcpdump in the next booth.

Firefox gets a lot of grief (from idiots) for refusing self-signed certificates by default, but it's a huge credit to their security team that they've resisted the pressure to ease up.
At first I thought "The title is bait.... what a waste of time, etc...". Clearly the problem isn't HTTPS, it is the current CA structure. I then went on Chris' site (http://noncombatant.org/) and there he summarizes it well: "The problems are social and economic more than technical. The technical problems are in usability, not in cryptography. In general, security people should start learning about usability."

I still argue that the is no 'usability' problem, but rather 'ignorance'. The fact that https has been hailed as 'secure' to the user (who has no formal understanding of what 'secure' is) is what has led up to the problem he is venting about...
It is C#, thus the talk of .NET.

That was my point. No sane person looks at the output of hex-rays and thinks they have received the original source code (minus comments and variable names). It is rare for me to find it even more readable than the assembly listing/graph view.
MySQL injection used to hack mysql.com
Research Examines Who's Talking, Who's Listening on Twitter
Wow! I must be invisible
True, but what you write is misleading. I just picked up a Macbook Pro at the end of January, and I can identify with many of his complaints.
I would say that some of his complaints are no longer valid, but most are.
What's the point of encrypting HTTP if any man in the middle can decrypt it? The whole point of the deck you (hopefully) read is that HTTPS falls to MITM attacks.

Authentication and confidentiality aren't just two "features" of a protocol. You have to have some degree of both, or you're just wanking.
I’m not sure that usable security is possible. In general, it’s the pattern that security requires less than ideal user experiences. For example, being emailed your password when you forget it would be “nicer” than getting a password-reset link, but requires breach of server-side best practice; not having to use a password at all would of course be the very easiest and least secure “solution” for authentication; the most secure measures require two-factor authentication and are necessarily the most annoying.

The observation of this pattern is perhaps obvious, but important.
That's some serious Miyamoto Musashi rhetoric there. The guy's either a grade A rationalist or a massive douchebag. I put odds at 5/95.
It's really not too unbelievable. Unethical, on the other hand...
Even if people have to pick a number from 1 to 20, 7 would be the second most chosen one.

http://scienceblogs.com/cognitivedaily/2007/02/is_17_the_mos...
> He quotes Apple's legal papers in which they clearly state...

You mean he quotes Apple's attorney's quotation of a New York Times reporter? It's not quite so clear that this is Apple's statement, and reading the quote in context doesn't give the impression that Apple is claiming to have invented the concept.

> Saying that he fails to distinguish trademarks from patents is flat out wrong...

He seems to understand the difference but ignore it. He mostly argues that the concept of an app store pre-dated Apple's trademark filing. This is a patent-type argument in a trademark discussion, hence the confusion.

The only trademark law based argument he makes is that the term "app store" was generic. But without any evidence this conclusion is worthless.
Close. It checks for intersections of circles (with a slight bug) with a few more checks.
It's time to fix ppt-misuse.

Please don't present a complex topic with 87 slides.
"Magical thinking includes all systems of magic, as it includes the idea of mental causation, i.e. the possibility of the mind having an effect on the physical world directly."

We actually already do this. We all believe that our minds will have direct effects on the way we move, for example. Free will is just an instance mental causality. The problem is that while it's easy to not believe in magic, it's just so hard not to believe in free will.
"I’m staying at a hotel right now, there’s no 13th floor because of superstition. But come on man, the people on the 14th floor, you know what floor you’re really on. If you jump out of the 14th floor hoping to kill yourself, you will die earlier." ~Mitch Hedberg

He makes a fair point though--if you're so superstitious that you're uncomfortable with the thirteenth floor, shouldn't you be uncomfortable about it regardless of its nomenclature?
Email Catch-22
How is key continuity any better than PKI against man-in-the-middle attacks? The tradeoff is simple: every first introduction between a browser and a website is insecure, so that subsequent connections might be less insecure.

This doesn't look like a win to me. Browsers are introduced to websites all the time.

To me, this solution looks like "let's accept an ambient loss of ~5-10% of all connections to MITM attacks, because it's politically too hard to configure the PKI-based SSL protocol properly".
The Symphony of Science
I'm not sure the mere occurrence of the same phrase would invalidate someone's attempt to trademark it. I trademarked a two word phrase that has occurred before on the web, but it had no special meaning in the industry.

In other words, no company or process or device came to mind when people in the industry heard the phrase. Nobody had made an investment in it.

As part of the proof that the phrase wasn't special, I actually provided search urls for the phrase and explained how the usage in the top results was generic.
Did anyone apply to TechStars Summer 2011 program?
Notices are sent out this evening. Did you apply?
FREE DRINKS WEB EXPO 2.0
Ok, so its not drinkssss plural, but I will buy you the first round!

I'm new to SF, don't know anyone. Only there for Web Expo 2.0 and for an interview with Singularity University.

Anyways, just looking for people to converse with, and if anyone is going to Expo 2.0 then it'd be nice to walk around, network, etc with others.

I guarantee you I will make for interesting conversation.. How about it? Drink on me?

email me at adam@silicontally.com or just message/comment on here.

BEST!
LOST was a nice ride, but writers failed to make sense of it.
I've known people compensate for their technical shortcomings by playing nice to everyone. Usually Engineers who happened to be Engineers by having a degree but don't have the passion for it and just in for the money. Asshole ones are the type that don't compromise just to be agreeable.
From a 2010 report http://www.jointventure.org/images/stories/pdf/2010%20Index-... a relevant graph http://moskalyuk.name/wp-content/uploads/2010/04/image13.png By number of deals you're right, software is huge, but by dollar amounts Better Place and others certainly raised the bar for cleantech just by attracting nine-digit sums.
Friendly (non-technical) introduction to bitcoins:

http://www.youtube.com/watch?v=Um63OQz3bjo&feature=playe...
Easy fix: simply impose a timer on adding comments. If you're only allowed to make one comment per story per 5-10 minutes, you'll choose more carefully where/when you place comments.

Oh, and even if there is a GreaseMonkey script, displaying reminders is still a good idea.
The extension https everywhere auto-encrypts wikipedia

https://www.eff.org/https-everywhere
Well, they are also a huge credit to preventing encryption from becoming the standard for all websites by ignoring 'idiots' and I'm talking non-banks like Wikipedia.

Are you happy to visit a John Doe blog with no encryption because he didn't want to pay for a certificate?
I think it's important to know that, whether you agree with this deck that key continuity ("tofu/pop") is a better approach than PKI or not, what we're talking about here is a misconfiguration of SSL caused by a political quandary, not a fundamental problem with SSL/HTTPS.

The fact is, if your browser trust roots contain only trustworthy CA's, and you look to make sure you're using a secure site when you expect to, SSL isn't broken. Those sound like two big "ifs", and they may be, but consider: they are both user interface issues:

* There is no collaborative interface for community-rating CA trustworthiness, or even a reasonable interface for pruning CA's out of your browser --- let alone "do I trust certificates delegated from this CA, or just the CA itself". We are still using an interface for this functionality designed in the mid-'90s.

* The "first introduction" problem that key continuity suffers from is, in the SSL case, caused by the fact that the SSL cues in the browser are subtle. But why should that be the case? Is there really no interface anyone can come up with that appropriately signals "this page should be and is secured by SSL"? Because if you have that (or STS), sslstrip doesn't work.

Key continuity's problems, on the other hand, aren't user interface issues. In key continuity schemes, when your browser is first introduced to a new website, you simply are insecure. If at that moment you are MITM'd by an attacker, you might never again be secure. This isn't a UI issue: key continuity protocols don't have the information available to them on first connection to make that decision.

Think to yourself, if you ran the great firewall of China, which system you'd rather have: the flawed one we have now, or the one that explicitly allows your connection on the first and subsequent connections to a new service to be hijacked?

I am our resident SSL/TLS apologist. But let me be clear that this deck is good, and raises a lot of valid concerns. I think SSL/TLS is a good system, but I share the (implied) disgust at the way our PKI has been managed. Some kind of reform is needed. I just don't think it needs to come with additional engineering sacrifices.
> Browsers are introduced to websites all the time.

I care most about a handful of sites, most of which are controlled either by me or by people I trust. My co-located mail server would be one of these sites.
clever affiliate marketing scheme. what % do these sites give you on sales? 5%?
Everyone whose on this "are we still talking about color" thing is starting to get on my nerves. Theres still LOTS of mileage in it - more write ups, VC opinions, yada yada.

Its how the world works. They just raised $41m, one of the largest pre-launch rounds. Expect to hear about them.

Saying "are we still talking about color" doesn't make you cool. Nobody cares if your "over it because your so hooked in to the tech scene".

If you don't want to read about it, don't click on the link.
Ask HN: What is the matter with Blip.TV?
The discoverability of content on Blip.TV is close to zero:

* There's no easy way to extract a URL from an embedded video

* The search looks like something out of a MVP

* The Browse screens are also of little use

I've watched a number of great talks hosted on Blip.TV, but I've never been able to scout the website to find anything meaningful.

Is there something I'm not seeing from Europe that keeps their business afloat?
Read this sentence again: A simple browser plugin that implements TOFU/POP on top of PKI would be an excellent start.

That would - at least to start with - be additional security.
Optimizing Lisp Some More
If you just want to get started on something and see results quickly I recommend making use of an external API so you don't need to have users before it works. For example, use Google maps and some other source of location data (Tweets, Foursquare venues, etc) and mash them together. This will give you plenty of problems to solve and code to write but will also give you results quickly and keep you interested.

Note: I don't recommend building your real app to be reliant on 3rd party API data but its a great way to get a small project started.

Note 2: Regarding ideas to implement, I'm sure someone in your immediate circle of friends complains about something to do with their job so try to fix it. It is actually quite hard to make a useful and usable app to help out people. Hint: it can be ugly as hell as long as it does something useful.
Video of Color in action
How Much Time Do We Spend on Media and How does it Affect Us? (Infograph)
In which case, fuck 'em. They're not the only game in town any more. Maybe they need a few quarters of losses to get off their high horse.
Those people aren't "idiots," they're normal (non-geek) people. They just want to buy stuff on Amazon or whatever and not have their credit card number stolen.
The default standard as it exists is non-encryption. Browsers throw warnings for invalid certificates of a bank, wikipedia, random blog, etc. Not unencrypted connections like a random website like a John Doe blog.

The crux of the issue is privacy in browsing. Some parts of Wikipedia are pseudo-illegal to view in some parts of the world. Viewing it would put the user on the watchlist or more.
best of luck, think this through carefully. I had some software that had some 3-4m downloads for free. We later put out a pay-for version, the conversion rate was quite low (as expected) but netted some okay money for starving kids just out of college.
Slightly off topic, but if you're ever somehow lacking for great reading material, just read yishan wong's other answers on quora. Lots of insight, not just about startups, and often hilariously entertaining.
I really enjoyed Yishans answer if for no other reason than it was positive about Color.

I wish Hacker News members, who have zero vested interest in other people's startups, would be a bit more optimistic when it comes to publishing comments. Between Color, and various YC startup launches here - the place feels rather mean spirited, frankly.
I got everyone in my group to download the app at a restaurant and try out color. It's pretty amazing and is a few UI tweaks away from being a 4-5 star app. If you are trying to build a better color, I would look into the pending patents they have in place. If you can work around the potential legal issues as a user I must say that the idea is brilliant and color is my default method of taking photos already.
It takes a hell of a lot to bore me when the topic relates to startups/tech/silicon valley but all this Bubble Talk seems so silly and pointless.

Why is this topic so damn fascinating to people?
How are you doing your tokenization and stemming? I find it hard to believe that the actual token lookup is slower.
Sure is a lot of ethnocentrism in these comments :)
Mind: "No sire, that right now would be procrastination! Lets just use HTTPS as it is..."
> SSH-style trust model for my HTTPS connections and I will pay good money for an implementation

You can do that now. Note the cert ID first time you login. If it is different the next time you login, then it is a different cert.

This would be an easy browser extension.
How many times do you set up new computers, or install new browsers, or access a site you care about from a friend's computer? And: you're someone particularly careful about which sites you access. But how is this going to work for my mom? If the problems we're concerned about are government wiretapping and fraud, how does creating a guaranteed and predictable flow of insecure connections not make the problem worse?
You can have it today! No money or plugins needed. And it only takes a minute to get started.

Just delete your CA list.

Go into your browser's preferences. Find the "security" section. It should have a button to open up the list of trusted certificate authorities.

Delete them all.

Now, every time you connect to a secure page, one of two things will happen:

1. If you've never visited that page before, your browser will prompt you for instructions. Use whatever means you like (second browser, remote server, call them, etc) to verify the server's SSL fingerprint. If it checks out, mark it as valid (aka "add an exception").

2. If you have visited that site before, its exception will already be present in your browser, and it will work like normal.

After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS.
Sequoia invested in youtube and it turned out very well for them. Color is more likely the next youtube instead of next facebook.

I haven't tried Color yet, but from what I have read it makes it dead easy to share photos and form social groups. Remember the real breakthrough of youtube was you click on a link and the video starts playing, it was and still is the most hassle free way of watch videos, there were no codecs to download, no heavy flash pages to load just fast and easy. People like easy and Color is making it easy to share photos and form social groups.

About $41 million, yes that is high but now the company can go to work instead of worrying about the next round of financing.
How does it help the user to lie to him and tell him his stuff is encrypted, when in fact he'd have absolutely no way to know whether his keys were force-fed to his browser by his government?
For those in Ontario (Canada), our province actually outlines exactly what an EMR should do, the format the input and outputs should be, and defines how data must be imported & exported. It's actually not bad as far as specs go. There are about 16 or so certified EMRs in Ontario that have to meet the requirements to be sold to hospitals and docs.

https://www.ontariomd.ca/portal/server.pt?space=CommunityPag...

For aspiring devs out there who want to build an EMR and aren't sure where to start, implement this spec. I'm sure it'll overlap with many requirements that US health agencies might need. Except for complex billing with an array of insurance companies, but that's for another thread :)
Eye-Tracking Technology for the Masses
Re-read my post -- the idiots are people who believe Firefox should accept self-signed certificates by default. Amazon has nothing to do with this.
Create something you truly want to exist so you can use it. Maybe you already have a hobby that could be helped by a piece of software. Don't worry about how crappy or useless the software is at first. Definitely don't worry about making money off it. Just do it to get your soup-to-nuts programming chops up.
The long-lost art of thoughtfulness in blogging