skysight-inc/HackerNews huggingface dataset:
What's encryption without authentication?

Encryption ensures that only the entity you are sending the message to can read it. If you can't be sure of the entity you are sending the message to, then what's the point of encrypting it in the first place?

Why does the article pick out Mozilla in particular? Are they suggesting that FireFox makes it overly complex to ignore the warning and continue on?
If you don't know who you're talking to, then there is no point in encrypting the data, because you're probably talking to the attacker. ("Man In The Middle")

Now, the idea of "I'm talking to the same person I talked to last time" is useful, but if the users are all conditioned to accept random certificates without understanding, then when they go back a second time (and the attacker is waiting), they'll agree to the new cert, just like they did the first time.
> I wouldn't be so sure about that.

Umm, I would. Running Wireshark or tcpdump to sniff traffic over the wire is easy, and analysis can be done offline at the attacker's leisure.

Hijacking DNS and phsishing for users' login credentials to other sites requires a lot more preparation, and in most cases, prior selection of the desired target sites.
Please dont. :)
REST presentation
My phallic symbol is bigger than yours (Dubai...)
Caching is a poor argument for REST, as is it's provably false.

Experience has shown that you cannot make a useful HTTP cache without replicating some custom per-app business logic into it. Paul's example below is a simple case where you HTTP cache would need to support triggers to invalidate one "resource" when another one is updated.

Worse yet, you only get one set of cache headers in your response, and you really need two, one to control the reverse proxy and one for the browser. So any reasonable reverse proxy will (configurably) ignore all caching instructions in the headers.

In general the whole multi-tiered cache framework envisioned in rfc 2616 was a failure. It's just not powerful enough to do anything useful, and it gets in the way.
First Google Android phone sighting
Cheering
How is an honest mime supposed to compete against a guy who really is trapped in a box but then edits the box out later?
It seems like most of the complaint in the first half (before the author starts talking about redundancy technologies) isn't actually about redundancy at all. It's a complaint that they have these XP laptops that they can't actually develop on and need access to their linux desktops.

Isn't the solution, y'know, simply to give the developers linux laptops and put the non-essential junk on windows boxes under their desks? Or inside a vmware instance? I'll admit I was shocked that they're using Outlook. I actually interviewed there many years back and was impressed at how sane the whole environment seemed. Maybe things have changed.
Doesn't change the fact that it pops up a scary unintelligible message and makes you jump through hoops whenever someone tries to visit a site with a self-signed certificate. It's very much a "break the web" situation.

As suggested by the original article, the correct behaviour would be to treat it as though there's no security whatsoever. After all, logically, how is being encrypted but unauthenticated worse than being unencrypted and unauthenticated?
The way I see it is that these people have a set of data that one could say is a line on an xy axis. This line goes up, down, etc, and there does not seem to be any pattern. So they come up with a bunch of algorithms that go as near to the line as possible -> they approximate the line with an algorithm. So from that, they can predict how the next step of the function is going to look like.

Metadata is like placing some dots on this line and saying "this spot is horror", "this spot is comedy". It becomes irrelevant, because you are already near enough to the line, and that dot does not help you any.

If I were dealing with this problem, what I would do is break free of these constraints and concentrate on taking the data as an abstract blob of random, then splitting the individual data (i.e, move data into separate 'dimensions') till I had hundreds of straight lines, and then using those for prediction. But I'm sure they must have tested this already :)

I'm rooting for the team with the two jewish guys and the black guy, afterwards they could get together and make a sitcom. Or a joke.
so really it's in their interests to make it simpler and easier.

It's more subtle than that. RH (et al) need to maintain a reputation for complexity amongst the people who make purchasing decisions, and they also need to discourange the users (e.g. sysadmins, developers, etc) from doing things that would make support difficult. So if you have RHEL you can install a certain limited number of packages on it and connect it to a certain limited number of devices (etc etc) or you're outside the support arrangement anyway.

If you follow the rules, you might as well be using CentOS because you won't need support, and if you step outside the lines you might as well be using CentOS because you won't be supported anyway.
So the fact that 96% of the characters you are sending are markup is not a downside?

S-expressions solved this problem a long time ago. (a b c) is only 57% markup. I don't think you can get much more succinct than that and still express the idea of a list.
@ #28 One of the easiest ways to deal with email is to tag the emails. If you're in a project-based org, put the project title as the start of the subject.
Firefox 2 behaved similar to other browsers, giving one warning dialog for self-signed certs. People are complaining because Firefox 3 changed that to an annoying 4-step process.
A couple relevant links:

http://science.nasa.gov/headlines/y2008/11jul_solarcycleupda...

NASA solar physicist David Hathaway thinks that this is mostly alarmist nonsense, and after looking at his solar cycle graph, I'm inclined to agree with him. The Maunder Minimum was a huge departure from the cycle, and it's far too early to extrapolate and assume a similar departure.

http://www.spaceweather.com

Space Weather tracks daily sunspot activity, as well as lots of other cool tidbits of current astronomy.
What good is verified communication when you can buy an SSL cert with pretty much any fake information you want.
The future of enterprise software.
haproxy is looking better by the minute.
In most cases where you can run Wireshark to sniff someone's traffic you're probably just steps away from performing a man in the middle attack.
The main point of the purchase was the land, not the house. We needed at least 10 acres and this was the place that best met our requirements. Actually compared to a lot of our neighbors, our house is pretty small.
Cricket Balls
Cricket Equipment Sale | CRICKET BALLS Morrant Sports, the DISCOUNT Team Sports Equipment mailorder specialists. One Stop Shop for all your CRICKET, RUGBY, HOCKEY, FOOTBALL, NETBALL, LEISUREWEAR AND TRAINING EQUIPMENT needs...
Call for Votes: Top 100 Software Engineering Blogs
If you've ever run an e-commerce site, you'll know that payments drop off significantly when browsers start throwing up warning signs.
It's quite a naive implementation, nice to blog about but from practical point of view it's just noise.
Facebook Events API enhanced: adds create, modify, cancel, rsvp
It's already arrived. The "I don't care what OS you have, as long as you have a reasonable browser" era.
The browser is the new windows.
I'm not yet convinced that all of the various climatic processes on Earth are well-enough understood to say definitively, "x is causing y".

The Earth doesn't even quite count as a black body because of its varying albedo; but regardless of its astronomical thermal reflectiveness, there are all of these really complex interactions in its own climate, where possibly a small change in initial state (the sun's temperature) could result in a large change in effect.

At the moment, the best that anybody has is correlative evidence, and I haven't seen a large enough change in human activity planet-wide to account for a .7 degree change either.
Amazon Redundancy: prioritize this feature. Next.
If you create an account on happykittens.com, you don't really care if the cert happykittens.com is sending you is signed by a trusted CA. What you care about is that the second time you visit the site, when you log in with your brand new account, that the cert the site sends you is the same you received when you created the account (the site is the same you created the account on). This has nothing to do with the fact that the cert is signed from a trusted CA or not, and thus, making it difficult for the user to accept a SS cert is not the right solution IMHO.
I disagree. Dogma/religion fits REST very well. It's also a very useful way to describe it, and the concept of religion is very rich and carries a lot of information in it.

Religion is a set of beliefs based on some core principles which cannot be experimentally tested. The beliefs system itself it resilient to refutation, and can "self-heal" if any of its predictions are proven false. While core principles cannot be proven false, they may require some suspension of disbelief from a reasonable person. By their very nature such sets of beliefs are very powerful, and tend to spread and persist. The flip side is that religion has proven to be an inefficient way to generate progress (while, say, science has proven to be efficient).

REST relies on base belief of "resources" and "neglected HTTP verbs", and, by reference, "religion of HTTP." It has its scripture of Roy Fielding dissertation. It's also hard to pin to anything (try to figure out what REST actually is from it's wikipedia article).

A relevant snippet from Richard Feynman was posted here a while back:
http://www.collectedthoughts.com/quote.aspx?id=11302

Btw, REST certainly does have some useful beliefs in. It is a nice convention for pretty urls, for example. This does not require a suspension of disbelief.
You must not be working with JavaScript or Master Pages (or if you are, you're using Microsoft AJAX). Create a master page, then create a placeholder or panel in a content area, then put a textbox in it and refer to it by its generated HTML ID attribute (it's probably something like ctl00_MainContent_Panel1_MyTextBox at this point) in a javascript. Then if you move it to another panel, the ID changes. That's the mangling he's describing and it is by far the biggest issue I have with an otherwise solid framework.
Valve's Steam network distribution has been around for awhile. Though, from what I've seen, that was used largely as a way to republish old games. (I have Steam on my laptop.) In any case, this has been coming down the pike awhile.
The crux of the argument though, is that if you have a strong CF model with many many ratings, you don't seem to get much benefit with their approach (linear combination of models). That doesn't mean that metadata can't be useful with a different approach. It also doesn't mean that metadata isn't useful for sparse data: in fact, it's incredibly useful, because you don't have much of anything else.
Erlang may be fine, for some things, but notice that parallel computation isn't one of them yet. It is nice for concurrency, but the interpreter is pretty slow. Running the pmap example on my machine takes 80 seconds. A naively implemented Ocaml version takes 7.

This tells you that Erlang currently has a performance-gap of about 10 in speedup before it begins being viable. The next problem is that not all things are MapReducible. Note that the current problem is trivially parallelizable. Hence it gives you some of the best speedup you might expect in a program. In general, you won't be this lucky.

Erlang is mostly interesting because of its concurrent abilities, not for its abilities with parallel computation.
Here's the big item to note:

All of the sites he notes that are running ASP.net are, as he says "big traditional businesses". They can afford the licensing costs of MSDN, Windows servers, a batallion of Microsoft "experts" to help them scale and support contracts. Oh, and Myspace is not an application I'd ever hold up as a good examlpe of anything, but I'll admit that it's my own biased opinion (The site is wildly successful, something I can't deny, but incredibly ugly and has crappy usability).

I'm not saying it doesn't happen, but can someone show me some small startups using ASP.net successfully? Because to me it appears it only is used by big monolithic business setups - which would be exactly why it gets a bad rap. If it's not accessible to the potential entrepeneur, it's going to be difficult to justify. And when I can setup a Linux server using LAMP for a grand total of $0, why would I pay thousands of dollars in licensing fees to Microsoft, for a toolset that I'm not going to be able to find people to develop on?
Using Light, Color and Contrast Effectively in UI Design
I feel only a small fraction of them are actually smart... the entire K-12 education in India is little more that an exercise in rote memorization. College education isn't that great either, even in the elite universities.
Erlang [...] is already very mature and reliability is a feature built into the runtime over years of practical experience.

According to wikipedia, it didn't support scaling to multiple physical CPU/cores until 2006. I'm sure it's reliable. I just think you might be overstating the case here.
a great article. the OS is a thing of the past. Our 4 year old Windows PC takes about 2-3 minutes to boot up and allow Firefox to browse. It's too long. I'm NOT willing to re-load everything, that would take an entire DAY. My Mac takes half the time to boot. Interesting that they say Apple is the one to beat, I agree. Having an "instant-on" computer would be a great thing, even waking up my MacBook when I get home takes maybe 15-20 seconds to browse. But Windows is a dinosaur these days. It's just been drug into the ground and bled dry of it's useful life.
Cheats of Strength: 10 Next-Gen Olympic Doping Methods
Are you referring to Chinese immigrants? Because if China is anything like India, kids would actually be discouraged to play the piano, as it would prove to be a "distraction from their studies."
Or just use Vimperator (firefox addon), and get keyboard shortcuts for the whole web.
That's not the bug though. The bug is that the error message a user sees when visiting a self-signed site using HTTPS is much more scary than simply visiting that site on an unencrypted connection, even though by all reasonable standards this is a safer, more private, and more secure action.

If we're not going to warn folks about unencrypted links where every proxy in the way is a man-in-the-middle attack waiting to happen, why are we going through such contortions to warn them about the same attacks in a situation where they are much harder to accomplish?

I've never understood this warning at all.
Why We're Failing in Math and Science
i agree. i wish there was some way i could unsubscribe to the f5 feed that they push through here. HN should, at a minimum, collect money for allowing them to use this site as a distribution channel for their shamelessly self-promoting posts (minus this one, which is just plain baffling).
You actually think someone who went through "the rigour of a full college education" is any less likely to screw up than someone who passed a certification exam? I know plenty of people who coasted through a CS&E degree (Computer Science and Engineering) at my school, and I'm not sure I'd want them writing the software for "airplanes and cars and powerplants".

The point is that a degree doesn't prove much, and a certification can prove approximately as much at a significantly lower cost.
It is a downside, but most of the time I don't care.

If I am sending some big list many times and speed really matters, then I care, but usually I am not. Size and speed are cheap nowadays.
That's very insightful, thank you very much.
going to the site now, the 'Top Chat Rooms' is empty, and I don't see any other directory of chat rooms, and the tags is also empty.
Makes it pretty difficult to give you any feedback.

I think having the 'my settings' so prominently focused on the bottom of the page is a bit of overkill. Better to have that link to another page.

But without any content, it is difficult to give a review.
The All American Touchdown Derby '08 Video
China raises taxes on big cars to 40%
In this case I disagree. The web is not all corporate, and there is a confusion between encryption and authentication.

A certificate, signed or no, is a means to establish a secure connection between Alice & Bob. This ensures no one is snooping or modifying the data passing between them. this is a good thing that should be encouraged in an age when your ISP injects ads and the government keeps tabs on what sites you visit.

A signed certificate is a means of authenticating the identity of the presenter of that certificate, to give some reassurance and trust about the other party.

These two things can and should be kept separate. What Mozilla is doing is making it much more difficult to have a secure-by-default Web.

Imagine if your mail program suddenly stopped receiving email unless each sender either paid 100 bucks per year to VeriSign, or faxed a copy of their passport to Microsoft, or you went through a scary, four-step process to "enable" them.
The presidential election isn't the only election occurring in November.
And then somebody could extort you to vote in certain way and remain at your side to make sure you comply... or steal your mail and vote for you.

How is this any different from voting using an absentee ballot? Those can be stolen, bought, etc. And I would imagine are less secure than your average secure website. The difference comes when an exploit is found. The worst case for internet voting is very very bad and could scale. The worst case with abseentee ballots - a mailman or election official steals some.

And then somebody could extort you to vote in certain way and remain at your side to make sure you comply...

Extortion and pressure can and is applied at voting locations all over today. My voting location is literally across the street from the Democratic local offices. It makes me very uncomfortable. They always have pollsters doing exit polls and the people in line are almost all Democrats. They are loud, argumentative... It's an all around bad experience. I think voting online would be great assuming someone solves the security problem (OTP through mail, etc, etc).

And for the record I'm currently libertarian. I disagree with this sort of thing happening in neighborhood churches just as much as the VA across the from democratic headquarters. Though personally I've had no problems at churches. Maybe a bit uncomfortable but people were not speaking out and attacking people taking a non-democrat ballot (primaries).
It's not just about the amount of markup, though, it's about the unnecessary complexity of the markup. The software that generates and parses S-expressions is much simpler than that which generates and parses XML. Of course, in Lisp, it's just

(let ((list (read data)))
...)

But even in Python, you could easily hack together (not recommended) something like

list = ", ".join(data.split())
...

Of course, that's not robust, but the library which is robust is much simpler than the one that requires the use of a C sax parser just to be usably fast.

If the argument is that XML is more human-readable, that is implying that it's being human-modified, and then XML creates more work since it's so verbose. If the verbosity is not an issue because it's auto-generated, that implies that it's not being read/modified by humans, and the whole point of using XML in the first place is lost. I just can't see any problem that XML solves that S-expressions didn't already solve in a simpler way.
Encryption without authentication is just that: encryption. The point of encryption is to make sure no one else is listening OR modifying the data in transit. Like, say, your cash-starved ISP, or the government.
I think that you should take your position to it's logical conclusion. You may find a contradiction.
The imminent Facebook spam problem.
RH = the windows of linux, stay away.
That's my point, ironically.
First time I upgraded to FF3, I couldn't figure out the right combination of clicks to get to my (self-signed) site, and I just wanted to get some work done. So I gave up and used Safari instead.

It's one thing to force users to confirm something whose security can't be guaranteed. It's another to make it so hard they stop using your app. FF3 has other nice security features I can't benefit from at all if I'm not using it.

And StartSSL may be free, but it's not easier than "click the Safari icon".
The article is very fun to read, despite the sad contents.

But it misses one big point: the image of a scientist. When I reply to "what do you do for a living?" and I say "I'm a neuroscientist", people smile condescendingly and pat me on the back. Because I'm not a lawyer, medical doctor or businessman (i.e. in my way to big money) and thus I can only be either stupid or a fool.
XML have redundancy by design. It's a deliberate trade-off to make it easier to read and write by hand, at the cost of size.

If message size is an issue then gzip the data. Or if you have very specific needs for processing speed, look into something like Googles protocol buffers.

You are optimizing at the wrong level if you are concerned about a few extra characters in a human-readable data exchange format.
I didn't know how to swim efficiently: if you threw me in the pool, I wouldn't drown, and I could maybe do one continuous lap (50m) if I pushed myself.
Article, if taken seriously, might explain something about chemistry. But maths?
CouchSurfing Deletes Itself, Shuts Down - Old, yet relevant
Mainly it means that your employer/ISP/someone else using same lan/wifi etc can't sniff your packets.

Encryption is useful, and separate to identity verification.
XML is like Java. The language isn't friendly, but the platform has so many man-years invested into it that it may be the best tool for the job.

Maybe my "taste" is to have a solid platform at the expense of some syntactic niceties. Any any case, saying that anyone who disagrees with you is certainly ignorant just makes you come off as foolish.
He also said this (I don't think he's much of an XML fan):

"Structure is _nothing_ if it is all you got. Skeletons _spook_ people if they try to walk around on their own. I really wonder why XML does not."
Regardless, it's still better than straight HTTP.

HTTP < Encrypted HTTP < Encrypted,signed HTTP
"I hate my laptop mouse. "

Clitmouse FTW!

(Not a big fan of Web site ad-hoc shortcuts, as they often interfere with the default browser shortcuts. Much prefer the "use Greasemonkey of you want site shortcuts" approach.)
10 Worst Web glitches of 2008 (so far)
Ran into this old story on TC, just reinforced the point that disaster recovery is not just about careful planning but also about experience. Make sure you periodically, test your backup disaster recovery plan too.
If there are no compelling apps for Android, nobody will buy the phones.

This is just wrong. It's personal computer thinking from the 80's, and it just doesn't hold in the consumer electronics space. The phone is the killer app. Developers want it to be a "platform" because they want to be the next killer app vendor. But there are very, very few cases I can think of where we've seen 3rd party applications drive significant phone sales. It's certainly not true for the iPhone, which was selling like hotcakes for months before a (non-jailbreak) SDK was even available. The "killer app" is the browser, screen size, and touch interface.

I'm not saying people will never buy 3rd party apps, or that a great one won't arrive. But the idea that you have to have developer buy-in to have a successful phone product is just silly, and disproved by pretty much every successful phone over the past decade of consumer experience.