skysight-inc/HackerNews huggingface dataset:
Plex uses a combination of wildcard certificates and a custom DNS resolver to offer HTTPS on local networks, but it does require a working internet connection to work. [1]

You can also get a certificate through the Let's Encrypt DNS challenge without having to expose a server to the Internet, but you'll still need ownership of a domain name and either an internet connection or a local DNS server to support HTTPS using that certificate.

There is always the option of creating a local certificate authority for your devices, but this is kind of a pain. There are some new applications that aim to make this easier [2], but there is no easy way around having to install the root certificate on each device.

[1] https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...
[2] https://github.com/smallstep/certificates
The power source was a fairly random 2014-era usb hub which I had done a number of test runs with, attached to the cottage's 1940's-era electric grid.

I actually set up two pi's side-by-side in case one of them failed, but both did fine.

There's a bunch of write-ups on my timelapse experiments here:

https://inventingsituations.net/category/technical/raspberry...
Why are you better than your competition?
If you're in sales or marketing, one classic question you might often encounter is, "Why is your product better than your competition?"

In this post, I've shared my thoughts on how to answer this question and why starting with 'feature differences' isn't a great idea.

Let me know what you think. :)
> you don't deserve external users. Full stop.

It’s shit attitudes like this that killed the old internet we all loved
I feel like you're trying to look at this from a very abstract place where it is impossible to come to some all encompassing grand unifying theory and it feels like without that we shouldn't act until we have an answer to that question.

I'm asking a question that says in spite of not having a perfect answer when you are in a situation and you watch a friend do a racist act, what response if any do you think is appropriate? What if it's not a single act that might be considered racist but a whole string of them?

Do you think there is any kind of moral or social obligation to do anything or is ignoring it ok?
How to analyze the unbalancing scenarios during red-black tree insertions?
A dedicated server is a one month commitment, possibly with a setup fee, Hetzner also charges to do things like replace failed drives.

You also don’t get the benefits of a virtualized instance like live migration for host maintenance. You can run your own hypervisor - but you’ll probably want extra hardware like 10Gb switches and the appropriate cross connects and as well as paying the one-time server move fee.
Just because short videos aren't all technically GIFs, doesn't mean that people don't commonly understand "gif" to mean short video.
It is absolutely not true on many (most?) operating systems; Linux is actually an outlier, and we mostly forget that it's the odd one out because it's so popular. Off the top of my head, I believe both NT and Solaris define libc as the stable interface that userspace uses; I don't recall exactly what the BSDs do, but I suspect that they at least strongly encourage using libc and not trying to talk to the kernel yourself (IIRC OpenBSD does this because some of their security measures are managed by libc). Go has hit this a few times because they don't want to depend on libc if they can avoid it, but on a lot of systems they really can't avoid it.

Ah, here we go: https://github.com/golang/go/issues/36435

> Upcoming changes to the OpenBSD kernel will prevent system calls from being made unless they are coming from libc.so (with some exceptions, for example, a static binary). There are also likely to be changes to the APIs used for system calls. As such, the Go runtime (and other packages) need to stop using direct syscalls, rather calling into libc functions instead (as has always been done for Solaris and now also for macOS).

(and the "with some exceptions" is why I say "strongly encouraged")
That's unclear to me. By running DoH, Comcast gets to spy Comcast customers. But Comcast of course can already see what IP addresses talk with Comcast customers, so what changes really? That the spying might become marginally easier maybe?
Unsurprisingly meandering for a moral panic piece. Lots of words about how corporations and universities have become too wishy-washy and how Trump refuses to play that game, but nothing said of his mostly successful attempt to normalize bold-faced lying.
>Or when they collected the wrong passwords you entered and used then to try to access your other web accounts to collect data?

...what?! Do you have a source on that I can read? I thought my opinion of facebook couldn't go lower...
Emojis in Email Subject Lines: Advantage or Impediment?
I agree, I think of function call as the time it takes to copy the stack frame, setup variables, and move the program counter. I'm not sure that adding a decorator slows this down, but I suspect it does. A better title would just be 'add memoization in one line in python' or something.
It's 90 days, and they renew it when there are 30 days left.
If you just want the green lock to show up, the device can get a certificate from Let's Encrypt. The manufacturer would need to provide an API that lets the device pass the DNS challenge.

For example, you could have serialnumber.manufactuerer-homedevices.net, and each device would get a cert for its serial's host name. Ideally, you should properly secure that API with some form of attestation key included on the device. Alternatively, the host name could be e.g. the hash of the devices' generated key (that way you could ship the devices without placing individual keys on them, but the host name would change after a factory reset).

Making this actually secure is hard, though, because you need the user to visit the URL for his device. If an attacker can simply get a cert for differentserial.manufacturer-homedevices.net and direct the victim there, you don't win much actual security.
Store – Transactional Model Layer for SwiftUI
I suppose I just fundamentally don't agree with you about the confusion existing in the first place. Here's my understanding. All of those things are fine, in moderation, unless you have a specific medical condition against something. Except for alcohol: that's just bad for you in proportion to the amount you drink. And that's already with existing research, as far as I know, I might not like it but I don't get overwhelmed.
Disengagement is a right, just as is engagement. Silence does not necessarily imply disagreement, but can serve to damp overshooting reactions.

Order is not orthogonal to justice.

Disagreement with methods should be fine, so long as a useful alternate path to the goal is offered.
Summary:

Our research shows that emojis in subject lines increase negative sentiment toward an email and do not increase the likelihood of an email being opened.
I'm someone who isn't at all knowledgeable about game development nor its industry, so forgive my ignorance, but what are you waiting for specifically?
Is it naive to assume that the advertising ID, etc. are left out of plain Chromium?
You need to get your calories below your BMR in order to lose weight. Even on Atkins or any low carb diet, if you're consuming 3000 calories a day, you will not lose weight. Simple calorie counting could be deciding not eat a 36oz steak for dinner because of the high calories or skipping the 3rd piece of bacon for breakfast.
"Encrypt" !== "Protect"
I think it was Nassim Taleb[1] that made a case for that engineering and tinkering drives science rather than the other way around, and that most of the knowledge gained comes from the practitioners rather than the scientists, who swoop in to claim credit after the fact (he uses the jet-engine as an example of this). That's not to say fundamental science is unimportant, just that it's getting too much of the credit for all the stuff that's been built.

There's a tremendous amount of know-how required to successfully build an airplane, a jet-engine, a processor, or to successfully train a large neural network. And while theoretical physics no doubt can explain it all, it's not sufficient to build something that works. I think the fact that we're seeing so much progress in deep learning without any theoretical basis is another example of this.

[1] Antifragile, Chapter: History Written By the Losers
As I said the last time you made this observation: we wrote cryptopals originally to train consultants to break cryptography as it exists in the real world, not to teach them to build new cryptography.

Since this is the second time you've critiqued them this way, I'd like to ask: what crypto-breaking challenges do you think it's missing? Is there a practical NewHope attack that actually appears in some deployed system on the Internet that cryptopals should walk people through? We don't have a set on signing crypto (none of the people who worked on it are blockchain people) so maybe that's an area to beef up.
Pre-windows 95, EDIT.COM was actually QBASIC.EXE running with the command line switch /EDIT.

Really annoying, as it meant that if you wanted a native TUI editor on an MS-DOS book disk, you had to shoe-horn the larger QBASIC.EXE on to it somehow just to be able to edit config files.
I get the feeling you have no real experience either running a company network or dealing with end users and home networks. Any of these solutions work fine for a majority of people who just use their laptop in Starbucks, but they really break down when you need to start doing anything more complicated than that.
Clarifications on AWS auto-scaling lifecycle and cool down time
> specifically in the federal government...unfortunately that is not likely to be the source of the next great tech innovator

The federal government helps build and fund innovative research projects and private businesses. Notable examples include the Manhattan project, GPS, SpaceX, and the Internet. I’d bet the US government will continue to be a source, and assist other sources, of innovation.

Edit: The following happens to be on the front page at the time of this edit - “Why does DARPA work?” https://benjaminreinhardt.com/wddw
> I follow the Patio11 school of thought. Charge more. Then charge more again. You should be doing that for your own services and you should be using services which do this.

Good luck with that. Many, many companies have learned the hard way that it's easy to price yourself into bankruptcy. Especially in extremely competitive sectors.
Did you try Firefox-Wayland lately? I use both chromium-freeworld and firefox-wayland on Wayland, and no problems so far. Also, hardware acceleration is meant to land in Firefox 76[0]

0: https://bugzilla.mozilla.org/show_bug.cgi?id=1619258
I can’t stop thinking that ideas like GP is explaining is just a modernized racial segregation
>Compared to the good old time, like traditional pc software installation, where it was you, the user that was free to decide the websites that you wanted to trust: google.com vs myshaddyfraudyweb.com

People can barely tell whether it's really microsoft calling them saying their computer is infected. What makes you think they'll be able to tell the difference between google.com and google-secure-login.com, or whether they should download the "codec pack" that their shady streaming site is offering?
Also a good idea, but the details don't work out. Specifically, early on the Fourier components of the matter density distribution grow independently. Light neutrino DM would suppress the small scale clumping too much. Making the whole process last longer would fix this, but it would also enhance large scale clumping, contrary to observation.

It might be possible to make it all work out by adding a third effect (and maybe somebody has already done that!), but there's also a danger of constructing a Rube Goldberg machine -- if there are too many gadgets needed to get the structure right it starts looking like epicycles. The great thing about traditional dark matter is that it doesn't require any cosmological complications, it just works.
You are right. Some of the sibling replies argue the contrary by using a sleight of hand; stating the desire to associate from only one of the two parties.

Take for example the relationship between a man and woman.

If both want to live with each other, everything is fine.

What if the man wants to associate with the woman, but she doesn't? Do we force her to accept the man? Does he have a right to access her?

Obviously that's silly. We all know that the relationship is only valid if BOTH parties consent.

And yet in regards to neighborhoods the sibling replies act as if only the man's opinion mattered. "That Jew wanted to come in but was refused! People were not free to associate!" They ignore that refusing someone is also part of the freedom of association.
You mean the good old days of IE 5.5?
So I discovered that Knowfox can be used on the main website by registering an account there.

I did so. One thing that is noted is that everything is private by default. What does that actually mean? Even on the github, I couldn't find any kind of description of what "private" means? Is it e2e encrypted? The keys are saved somewhere on my device?

When I create a new concept, I see it has a relations config at the bottom of the concept creation page. How do I use the relations that I define there?
It’s disgusting. It’s not up to them to decide how long a certificate should be valid. Especially when they’re so expensive to buy and complicated to replace.
> Yes, we can think that shorter certificates are a little bit better to trust for the user, but that should be the choice of the website that you visit.

That sounds like a disagreement; it benefits the user, so let the website opt out? Because websites are known to have users' well-being in mind?
From a study conducted by Douglas J Leith from the School of Computer Science & Statistics at Trinity College Dublin, Ireland, they found that the new chromium based Edge is sending hardware UUID's back to Microsoft and there isn't an option to turn it off.

"From a privacy perspective Microsoft Edge and Yandex are much more worrisome than the other browsers studied. Both send identifiers that are linked to the device hardware and so persist across fresh browser installs and can also be used to link different apps running on the same device. Edge sends the hardware UUID of the device to Microsoft, a strong and enduring identifier than cannot be easily changed or deleted. Similarly, Yandex transmits a hash of the hardware serial number and MAC address to back end servers. As far as we can tell this behaviour cannot be disabled by users. In addition to the search autocomplete functionality (which can be disabled by users) that shares details of web pages visited, both transmit web page information to servers that appear unrelated to search autocomplete."

https://bgr.com/2020/03/11/microsoft-edge-browser-privacy-is...
Definitely true for me, anecdotally
Ask HN: Should developers provide time estimates?
We have debate in our company - who should provide the estimation for the duration of a task (usually part of a project). I have seen a few popular options:

- the developer who will implement the task (a somewhat prevailing opinion on the internet)
- senior developers
- project managers

Thinking about it a new option may have emerged: estimates should not really be needed; and I would like to explore this option below.

Let's agree first that estimates are mandated for various business reasons but we won't require greater precision than a day of work.

Now, doing a thought experiment we analyse if there would be any estimate difference for a task requiring one line of code or "Hello World!" and agree that no matter who would provide the estimate the answer will be the same - probably the smallest unit of estimation since the task is trivial and the solution is canonical.

Going forward, however we agree that there is a point where estimates will diverge even between the most seasoned developers and estimators. I would argue that in that point the divergence stems either from a difference in understanding of the problem or different approaches in solving the respective (complex) task. Since both scenarios could cause problems down the line in the project, the team should step back, clarify the requirements & approach to the solution and break it down into further tasks that are trivial enough to be executed in the smallest unit of estimation.

In summary, estimation is the wrong problem to solve, the team should spend the time to thoroughly understand the requirements and truly define the solution approach, leaving the time estimate to be just a matter of counting the generated tasks and multiplying that with the agreed smallest unit of work.

While the above is a hypothetical scenario, what are your thoughts around it? Where do you see its flaws and where do you see its merits? Is anyone doing such a thing or was it tried and failed?
Software teams, and their psychological biases
Having worked on firmware writing to SD cards, I can tell you that the big problem comes from allocating space for writes. That’s when the card disappears on you, as it looks for space it will potentially shuffle data around behind the scenes. Current spec I believe says max latency is 200ms. This is the operation that will abuse this part of the spec. If you want to see an SD card flail, just try to write one byte at a time. This will cause headaches no matter how wear leveling is implemented in the SD card. And will likely significantly shorten the lifespan of the card. If you can make sure you only ever write multiples of 4096 (probably card dependent) you’ll be much happier using SD cards. But even then, you might have a 200ms window where you can lose or corrupt data if your power to the card fluctuates significantly.
There is a secondary discussion if developers should be accountable for sticking to estimates, and my opinion is that they shouldn't - developers should be accountable for the quality and maintainability of the produced code, documentation and tests, not timelines - that's the job of the PM. A good PM will be able to observe that on average the unit of estimation takes 20% longer or shorter and adjust the project timelines accordingly. Also, if someone is worried about developer productivity, it can always evaluate it in relative terms, i.e. how many tasks generated with the above method does one developer execute vs another developer in the same unit of time.
It's not for lack of demand. Mitch Kapor (Agenda) and Mozilla talent tried an OSS reboot, Chandler. It was so well funded and failed so spectacularly, that there's a book about it.

https://www.amazon.com/Dreaming-Code-Programmers-Transcenden...

https://www.chandlerproject.org/vision/

> cards can not only have multiple parents but can have different parents for different users. This aspect might be novel

Very nice.
I have a nasty habit of requesting revocation of such compromised keys whenever I find them. CAs are required to revoke within 24 hours, I think, though unfortunately revocation is surprisingly ineffective.
I think it may be worth breaking this article into multiple articles. To be honest, I saw "85 minute read" at the top and backed out, because I don't have 85 minutes available at this moment. If I didn't know it was that long I might have started to read, realized it was long, but already have gotten interested.
That's a big lie, it's extremely rare for big projects outside of wartime to create downstream tech that is generally usable. The big ones that are often claimed (Velcro for NASA and MRIs for the supercollider) are definitely lies.

Usually big projects tend to need to be conservative and use off the shelf available materials (just in clever ways).

Sabine's big point is not that we shouldn't do basic science, it's that we shouldn't do bad basic science; that is science that isn't driven by hypotheses. Historically in science you would create a new model that agrees with current facts, but makes an prediction that some unobserved event X would be observable. You build your apparatus or design an experiment to observe X, and then confirm of reject the model.

In the case of a bigger collider, what is X?
Neat! Thanks so much for the run down!
This is it, what those statements are implicitly saying is you can't be black and work in tech. They place an extra barrier in a already difficult situation.(job interviews)
Downvote to oblivion, but highfalutin essays in neocon journals keep showing up here on HN with some regularity, particularly on the weekends. I can’t remember the last time I saw something from Jacobin or Mother Jones, and certainly not an essay this overtly political.

It’s all too easy to nod along as you read this sort of thing, but then to become more cynical when you consider the source, the underlying motivations, and the larger body of work into which it fits and associates.
>Especially when they’re so expensive to buy and complicated to replace.

Letsencrypt is free and easy to replace (it's automatic, and takes maybe 5 minutes to set up on a new server). EV certificates might be harder, but I've heard good things about certsimple.
YNAB is the budget software I was referring to. I just never upgraded to the SAAS version and it still works fine.
On top of that I also have privacy badger.
To follow up: the solution is that the localhost server needs to make sure each API call is authorized (if you aren't already). This means there must be a login/setup step.

An API call can't be considered authorized just because it came from localhost :)
Mostly, because all that would do is cause is random inflation and inequity.

When donating money, you are reallocating resources. That can lead to improved economic growth, if for example you are allowing people to go to school, start businesses, or otherwise helping build such bridges.

More times than not, donations cause long-term harm. Look at oil in Nigeria to see how a massive simple influx of cash was not good for the population.

If you really want to help in Nigeria, you can help mentor a university student there. Your time will count for a lot more than your money. Or if you are willing to spend money too, hire a university student from there as an intern (likely remotely). That helps align a lot of incentives.
What's the particle energy range needed to make an observation about axions?
This only applies if they want to access internal services without cert warnings, so asking them to install a cert seems reasonable?
Why enforce the second factor authentication?

The main reason that I wouldn’t want to be using an email address is because I want the account to be disposable.

Just make it that if I don’t have a second factor for recovery, there is no recovery.
I can understand this can cause pain for existing deployments, but I don't see any reason not to use something like Let's Encrypt to issue 90-day certificates for new services/deployments. With certbot, renewals are automatic and with something like Caddy, the certificates can be managed across load balancers. I'm only talking about the web service here and not IoT or any use case that makes this sort of frequent renewals difficult.
Is there somewhere a list of insecure patterns in versions of popular frameworks? This is how I'd organize results. Instead of treating each implementation separately, work on finding insecurities of sites that do have white-hat-friendly policies. Any findings can be reported, patched, and documented against the software/version that was mis/used.

Every implementor then only has to review/subscribe to the versions of the software they use. Any custom software would still have to be handled differently but I presume that patterns of use of frameworks and libraries either makes up a larger portion, or will trend in this direction.