skysight-inc/HackerNews huggingface dataset:
> Certificates are BS.

Pretty much. The whole business model never really made sense: the relying parties have no relationship with the certificate authorities, while the HTTPS servers are the customers of the CAs.

I think it would make a lot more sense for certificates to be issued by domain owners, esp. since the original idea of tying sites to real-world businesses (e.g. with Dun & Bradstreet numbers) has been reduced to just verifying domain-name ownership.

Edit: I think people misunderstand what I am saying here. What I mean is that I think that when one purchases a subdomain of domain, that domain should just issue a certificate — and that domain should only be allowed to issue certificates for its children. So e.g. if one purchases foo.com, then com issues a certificate for foo.com; if one purchases bar.net, then net issues a certificate for bar.net; if one purchases baz.ac.uk then ac.uk issued a certificate for baz.ac.uk. This is essentially what Let's Encrypt and ACME already do: com has the technical ability to reassign any of its subdomains at any time it wants to, and can get a certificate issued for any of them by reassigning & registering a certificate.

And while we're at it, maybe we could kill ASN.1 with fire?

Edit: if you downvoted for this, you have never tried to debug an ASN.1 BER file.
>. Using this we do have many professionals from top firms.
[...] if by any luck a mentor lands on our page he/she can contact us. It is mainly for users.

That's fine if Acoto's main web landing page is tailored for the job seeker audience but it's still important for the candidates to know what the (financial) incentives are for the mentors.

Being secretive instead of transparent about how you plan to attract and reward mentors and how you make money is a negative signal to users to not trust the website. You can state the mentors' benefits in a blog post and/or a deep link sub-page on your website. Users will want to know "what's in it for the mentors?".
Because you can write bad code using a pattern does not make it an anti-pattern.

Thanks to ES6, the async/await keyword for Promises help you get rid of the callback hell that Javascript can easily be.

Python support of asynchronous code is far behind Javascript and it is the basic requirement of frontend development.
I would blame nefarious church leaders who should know better but deliberately misrepresent the scriptures to their own end. The verse structure does facilitate this.

For example: Leviticus 18:22 seems quite popular amongst homophobes, but I don't see many of them killing adulterers (20:10) or burying blood (17:13), plenty of them oppress foreigners (19:33) and hate their gay relatives (19:17). They don't seem to be as keen on burning people who engage in a sportsman's double (18:14) as they are about waving "God hates fags" placards.

I'd be surprised if the same people who picket gay weddings and funerals chain themselves to combine harvesters with Leviticus 19:9 placards, or harass people going to real estate agents' offices with Leviticus 25:23 signs.
> Implying that JavaScript was ever appropriate

Can we please stop doing the 4chan-esque snarky >implying ? It's not discussion in good faith.

> Minifying is highly overrated to begin with

Compression is not magic and minifying has real world performance gains in JS projects at least - I don't see how Python would be different here.

> Lambdas are supported

If you want to write your event handlers - which in UI programming is a lot of your code - in a point-free style, then I think you'll be letting yourself in for a lot of hassle.

> Webpack... What does this even mean?

I don't know Python too well, but I assume this is about the ability of Webpack to overload import semantics with non-code dependencies (e.g. importing stylesheets, icons, bits of JSON). Presumably Brython does not support this.

You seem quite bullish about the strengths of this project. Exactly what problems do you feel it solves? Assuming that we already have tooling like Webpack and are able to write in either ES2020 or TypeScript, what do you think we gain from writing our UI code in Python?
I would choose typescript over either; but if not given such an option, would choose javascript over python.
He misunderstood our whole platform as job portal and said that we are charging money from the user to get a job which was not right so I gave clarification regarding that. As to why I said he is judging because his tone of replying was quite offending (that's how I felt) maybe the English could have been wrong on the website and as a result, you could have taken it as wrong as it is not my first language. If you feel like I have cleared your doubts can you give some other feedback as well it would be helpful?

Thanks :)
> Section 4.9.9 of the BRs requires that OCSP Delegated Responders MUST
include an id-pkix-ocsp-nocheck extension.

>For example, consider a certificate like https://crt.sh/?id=2657658699 .
This certificate, from HARICA, meets Mozilla's definition of "Technically
Constrained" for TLS, in that it lacks the id-kp-serverAuth EKU. However,
because it includes the OCSP Signing EKU, this certificate can be used to
sign arbitrary OCSP messages for HARICA's Root!

>This also applies to non-technically-constrained sub-CAs. For example,
consider this certificate https://crt.sh/?id=21606064 . It was issued by
DigiCert to Microsoft, granting Microsoft the ability to provide OCSP
responses for any certificate issued by Digicert's Baltimore CyberTrust
Root. We know from DigiCert's disclosures that this is independently
operated by Microsoft.

So my understanding is this: The CA's have issued certificates/sub-CA certs without the proper extension (or with too many extensions), causing those to be able to sign a OCSP response. And the Online Certificate Status Protocol (OSCP) is used to check the revocation status of certificates with the CA.

So, this would allow e.g Microsoft to generate a fake OCSP response? That would perhaps be useful in some kind of MITM-attack scenario?

While not good, perhaps not an end of the world problem either? However, I wonder how much problem will come for people needing to replace those soon to be revoked sub-CA certs...
So then I would like your prediction on who would become WDC:

* Hamilton/Verstappen in a Williams?

* Antonio Giovinazzi in a Mercedes?

Don't forget the classic "to finish first, you first have to finish"...a drivers skill is not just better reaction time or better peripheral vision, it's also mental calm, not making stupid mistakes on lap 69 of 70, situational awareness etc.
MX Linux 19.2 KDE Beta 1 available for testing
Can Japanese residents comment on how this works WRT office space in the home? Do people typically have space in their homes to have a proper home office setup?

My wife and I are both WFH right now, and we had to buy a second desk and chair and repurpose what was previously our 2nd bedroom. The 3rd bedroom has always been a home office. If we lived in a downtown apartment, I'm not sure what we'd do, as we're both in management and spend the majority of the day teleconferencing.
I switched to Juce 6 preview branch last week. It's not without problems but getting rid of the Projucer is amazing. Now you can have a clean CMake setup and you are not stuck with Xcode on the mac.
SaaS based in Finland, customers potentially from anywhere. Question about taxes
Hi all!

I am building a SaaS and was thinking of using Stripe's hosted Checkout and the new Customer portal since this would save me a lot of time from building everything myself, and I could launch earlier. However my understanding is that Stripe doesn't do anything about taxes, so I have to take care of that myself. I know that there are some partner services like Octobat that calculate taxes and integrate with Stripe, but if I understood correctly this isn't enough. I have learnt that you have to file and pay taxes to authorities in various countries. Some countries have thresholds, others don't. Countries like India even require to register in the country before doing any business there. It sounds like a mess to me...

I'm based in Finland, so in the EU. What should I do to accept payments from anywhere and be tax-compliant with every country?

I found a few services like Paddle that seem to handle everything for me and act as resellers/merchant of record. They do everything about taxes and I don't have to do anything at all. However my SaaS is a CMS that lets users create their sites and Paddle's AUP (https://paddle.com/support/aup/) says mentions web hosting services as potentially not supported/allowed. I have sent a message asking if my SaaS would be considered hosting but I haven't received any reply.

Are there other options I should be looking into? Generally speaking - for those of you who have a SaaS based in the EU - which payment solution did you go for and how do you manage taxes in the various countries if you don't use something like Paddle?

Thanks a lot in advance for any help!
Show HN: Login with the Vulcan Hand Salute
VTI holds 29,546,017 shares of Uber.

https://investor.vanguard.com/etf/profile/overview/VTI

Anyone investing in the total market via VTI, ITOT, etc will
hold Uber.
At least in my experience this has never been an issue with C programs (or C++ programs after getting the older C++ stdlib). I have a collection of old Linux game demos from late 90s and early 2000s and i tried them a couple of years ago in a modern distro and most of them worked (i had to use the oss-to-alsa bridge though). The games that didn't work were because of missing libraries that the distro didn't include, like -IIRC- Shogo needing Qt1.

Note that glibc also has non-versioned symbols. Versioning was introduced much later than the binaries i've mentioned i compiled with 1998 Red Hat were made. In addition the reason behind versioned symbols is to be backwards compatible so older binaries not working on newer systems because of versioned symbols would defeat the entire point of them existing in the first place.
Deadlines, Feature Requirements, and Contacting the Engineering Department
It could definitely be managed better, to optimize for what they seem to be trying to (sport + performance).

Budget caps seems like a cop-out though, as eventually the budgetary rules inherit all the complexity in the current technical rules.

I think some kind of FRAND forced tech licensing / transfer + shared manufacturing would be an interesting solution. Whereby a hyper-optimized solution by a leading team can be licenses (or is outright open sourced) for the next season. And similarly, where all builders have access to a neutral manufacturing facility (a la TSMC).
A segment of buyers may make that choice, but they don’t have to sell to every buyer. And again, the data backs up the assertion.
Sure I would keep that in mind. Thanks for the feedback.
Apart from that how do you feel about our idea and also about the English text as other comments are mentioning that the text looks fishy or a type of scam?
Partially points of that list:

https://www.privateinternetaccess.com/blog/firefox-hardening...
I'd actually appreciate anyone's opinion or advice on this...

I grew up on computers and the internet (absent, technophile parents made that very easy) and by the age of 13 or 14 my computer really just felt like an extension of myself. When I was in undergrad, I realized that the only way I'd ever actually properly study is if I had someone on my dorm floor take my computer from me and refuse to give it back for some designated period of time.

After undergrad, I "relapsed" a bit in the sense that I would be on my laptop for 14+ hours a day every day, constantly context switching and never really getting any good work done. I'd still accomplish my work but would never really get to the things I wanted to get done, like practicing piano or reading a book.

I started a new job in October and was able to start 'fixing' myself a bit by leaving all my electronics at the office after work, and by December I could actually feel a tangible difference in how I was thinking and making decisions. Unfortunately, after COVID hit, the office closed, and now I've had the least amount of separation between my physical life and digital life, between work and leisure (as I'm sure is the same for all of you).

Do any of you have any systems that work for you in terms of a path towards self-control? I have very little self-control and a very addictive personality and I really don't like the way I spend my time at the moment. At this point I'm even considering finding Adderall or something similar as I don't feel capable of accomplishing this on my own.
I still enjoy watching F1, but something the way the cameras were back in the Senna era were just... raw and guttural. You could feel the speed and the closeness of the drive to the track. Perhaps it was because they were imperfect/shook or whatever
To describe healthcare as a human right misunderstands what a right is. You don't have a right to a doctor's time. You don't have a right to a nurse's time. What you want is a free healthcare plan, calling it a right makes it unworkable.
It's a natural and common extrapolation, but not one that I'd expect to see from a scientist, particularly a biologist. I can't see the original article due to the paywall, but I understand the the German plural is Viruses, as in English. All very odd.
"I know of many exceptions to your evolutionary argument, which makes it entirely worthless"

It's not controversial, but it's missing the point. Nobody is arguing that ever single woman in our history preceding capitalism had to prioritize child care over leadership or labor.

If you're talking about the role of women over time, you're talking about how it applies to averages. It'd be impossible to discuss this with any sort of scale if you had to reconcile every generality with it's various exceptions.
There is: "This place is standardized on X" (what is way more common than it should be.)

And: "X-developers are cheaper" (and then, developers stay stuck there because it's a large market, but shouldn't.)

And there's the real reason why one should want to use the same language everywhere, that is to provide greater integration between frontend and backend on a framework (but then, currently it's mostly React that tries to do that and it doesn't get good results out of it - so much that developers refuse to use that feature).
I would have thought a big part would be people like me who like a good separation between work and home life. When I'm at work I work, when I'm home I don't want to think about work.
no, but he wrote down his ideologie
> Having said that, I do now wonder if you could make the model work by offering very cheap, or even free, delivery on the condition that you place the order a few hours in advance for a pre-selected delivery time.

You're right and you just described how that "Special Offers" section of über ears works. They give you a small selection of restaurants that another user near you has ordered from and a 5min countdown to place an order yourself, if you do you get free delivery and über benefits from the efficiency of a double or triple order for one of their drivers.
For my money they've pushed a fraction too hard on the CPU power. One of the best things for me about the 3 is that you don't need to worry about cooling the way you do with the 4. I get why, there's a huge demand for the 4 to be able to handle proper desktop applications, but I'd love to see a version that has the thermal characteristics of the 3 with the IO updates of the 4.
That either requires you to spend hours building it yourself, or trust random people's builds.
Pink definitely recommends paying above market rate, though. To quote the book:

"Type I behavior does not disdain money or recognition. Both Type X's and Type I care about money. If an employee's compensation doesn't hit the baseline that I described in Chapter 2 — if her organization doesn't pay her an adequate amount, or if her pay isn't equitable compared to others doing similar work - that person's motivation will crater, regardless of whether she leans toward X or toward I. However, once compensation meets that level, money plays a different role for Type I's than for Type X's. Type I's don't turn down raises or refuse to cash paychecks. But one reason fair and adequate pay is so essential is that it takes the issue of money off the table so they can focus on the work itself. By contrast, for many Type X's, money is the table. It's why they do what they do. Recognition is similar."
Shameless plug, but I built a monitoring solution with extensive SSL checks that’ll catch & report these if they’re revoked: https://ohdear.app
New York Times First Said Bot
I remember using workable 3D thanks to VRML, on the web, circa around 1999-2000 to play with a virtual tour of the ISS.

I think it worked remarkably fast even on 56k connection, and definitely worked fast on 512kbit that became available around that time.
OTOH, isn't it pretty customary for any large office (let's say 1k+) to have a cafeteria, with presumably most employees eating there?

Some of these will not want to cook lunch in the middle of work, and at least order takeout instead.
I really dont get why people still throw FUD with this argument. It's been what, 25 years already since this argument lead to the KDE Free Qt agreement?

At this point the biggest concern for the Trolls (or whoever owns Qt nowadays now) should be that the FUD against GPL is starting to slowly evaporate, so even big companies are starting to use GPLd Qt rather than pay licenses. By the time they go Oracle there will not be much they can do.
It's still python; you can overload operators and give them side-effects in any conforming implementation.

It may not be "pythonic", but there's an established tradition of operator methods and there's no requirement that python code conform to any particular tradition.
What is going to cause the next stock market crash?
One thing i find interesting about J++ (i have Visual J++ that came with VS6, though i never used it myself - and i do not think it even works in modern Windows) is that it also had its own relatively big framework that pretty much died with the language. It is like this language was made, existed for one or two versions and then the entire effort was thrown out of the window.
It is more private than Chrome. And full privacy probably doesn't exist.
There are no primary exchanges for targeting content.

You can't 'put your ad near an article for beer' at any real scale.

In the old days, if you were paying $$$ for a spot in a magazine, you might be able to control where your ad was going to be placed, and certainly today, if you want to do that, you can find ways. Certainly you could buy ads on a 'beer blog'.

But by and large, this doesn't exist at any meaningful scale where you can just go out and buy 'a bunch of ad spots in articles about beer'.

Second - it's something, but still arguably not more effective than individual targeting. Most products and service have baseline demo. targets and that's quite important.

If you're L'OREAL you really don't want to be hustling your new eyeliner to middle aged men, that's pretty much a 'first order concern'.

Targeting does mostly work, we should not be in denial about that.
Mostly unrelated, but I did a summer internship for Wycliffe my sophomore year of college. We created an app that allowed non-technical speakers of a more obscure language to review and make suggestions on draft translations of scripture [1]. It would actually tie their native language translation to a "bridge language" (usually english) and then also show the original Hebrew/Aramaic which they could reference through a built in dictionary. As a language nerd it was a really interesting project to work on.

AFAIK the app is still being used in the field and maintained (my internship was over 4 years ago). This was a rare case of hiring interns to build something and it actually working out.

[1] https://www.translationcore.com/
Agreed, C++ for declarative-anything is a bad idea and will make compile times suffer a lot.
Edge synchronization doesn't do end to end encryption for your browsing history or bookmarks (for this reason alone you're actually better off with Chrome). Windows 10 also has a low entropy advertising ID, that via Edge is passed to Bing Ads for ads personalization.

Firefox does not send your unencrypted browsing data to Microsoft and it does not send Windows 10's advertising ID to Bing Ads.

---

You may trust Microsoft enough to run Windows 10, but it does not follow that Microsoft already has that data. And giving even more data to a company that already has plenty on you is always unwise.

If you care about privacy or security for that matter, compartmentalization is key.
Yes, you can temporarily load extensions in firefox, but I certainly won't reload all my extensions manually at every startup :)

I don't think there's really a good browser for both privacy and hacking. I use chromium when I have no choice (not sure what you're referring to concerning the disable modal ; if it's an issue with chromium too, I haven't hit it, and I have 11 extensions loaded from sources).

But my "main browser until it's not enough" is elinks (slightly modified by me to fix ruby support and offer a few more api methods to extensions). I can write extensions as simple ruby scripts, doing things like adding native markdown support, allowing to edit local files, adding proper indentation to HN comments, etc. It's the perfect browser for me (and with cookies disabled and js, css and images not fetch nor executed, it's a good privacy browser as well). But of course, you won't be able to use that to buy something on the web. Still, it's surprising how much I can accomplish with just that.