skysight-inc/HackerNews huggingface dataset:
"any time the user is using a new browser they have to go through extra authentication steps"

And one wonders why no one wants to do this stuff.

This is poor analysis. You're arguing from an incomplete position. The choice isn't between "some security" (mobile certs) and "best security" (forced reauthentication). It's between "bad security" (multiple accounts with shared passwords) and "better security" (single cloud account with escrowed access to the cert).
I'm so glad to see you wrote that, seriously. It is absurd how it has become pop-cultural to use "exponentially".
False Warning of a “Nuclear Missile Attack on the United States”
It's the classic chicken and egg problem. Few sites use them because they correctly believe that the browser configuration is too painful for most people. The browser configuration remains painful because users aren't pressuring browser makers, and they're not pressuring browser makers because they don't use any sites that make such configuration necessary. It won't change until (a) enough sites require client certs despite the painful configuration or (b) browser makers take some initiative to make configuring them less painful. Neither seems very likely.
These are all perfectly valid critiques of the notion that "my data is protected by Path's privacy policy", and they are excellent reasons why Path was right to apologize and correct a genuine problem with their app's behaviour.

But they aren't really relevant to the parent comment's point, which is that, even with these (potential) holes giving your address book to Path is fundamentally different than posting it publicly. In one instance, your data is public, immediately and unconditionally. In the other, there is potential for abuse that could result in your data becoming public if an arguably unlikely sequence of events were to occur.

So it doesn't make any sense at all for Winer to be challenging PD to engage in a behavior that is simply not analogous to the issue at hand. All that Winer's post does is distort the issue, intentionally or not, and distract from the important debate/conversation that Path's policies initiated. I honestly don't see how that's helpful at all.

[UPDATED: Minor correct for clearer syntax]
The point is that the public wouldn't support unnecessary wars if they or their children would be drafted to fight.
The process for installing client certs is wonky. We setup a PKI to authenticate computers and allow us to use SCCM inside or outside of the firewall -- it works great.

I tried to get other folks to use it, but people equate cert with complexity and money and their eyes roll back into their heads if you mention PKI.
Zepto doesn't support IE at all. I'm all for not spending much effort getting stuff to work in IE, but it seems like a bad idea to take it so far as to use Zepto.
Caching assets in localStorage definitely isn't a "best practice," and seems like something that should only be done when necessary.

One of the best uses for localStorage though, is caching client-side templates. If you're building an app that's got a ton of different models and templates for each one, it makes your application a lot more efficient to lazy-load them as needed and cache them in localStorage for later use with versioning and cache invalidation.
I'm the author of this, now quite dated, article and by now I really don't agree with its contents any more - at least not fully:

1) this is not truly two-factor authentication as the certificate is stored right there on the machine I'm using for authentication. If this would ever get widespread use, we'd have issues with malware extracting the key from the browser. Not even password-protecting the key (giving you something comparable to SSH authentication) would help much as malware presumably has access to your memory anyways.

2) With the problems inherent to the SSL protocol in conjunction with renegotiation (http://www.kb.cert.org/vuls/id/120541), this becomes a bit annoying because you can't safely have resources for which you check a client certificate on the same server as resources where you don't. Remember: The article predates the vulnerability by a year.

3) More and more people are beginning to have multiple devices they use. There's not even a "main" machine any more. Not having access to the client-side certificate is annoying though with the various browser syncing solutions out there, this might become a non-issue over time.

None the less. My personal complaint about the overly complicated UI still stands - heck, this is even annoying for me and I would (aside of point 2 above) have good use for this at times - but clicking through this jungle of dialog boxes remains annoying to this date.
Facebook Brand Timelines? Meh.
Any interest in a Barcelona meetup?
You sound angry.
Trying to bring back manufacturing to US seems a short sighted move. As 3D printing improves, is there really a future for manufacturing?
Future Generations are not going to buy manufactured products from China, they are gonna print at local mall.
Then Best Buy bought them, and started letting in-store management run the show.

I was a Geek Squad Supervisor during college (and worked part-time for a few years after). The guys who wrote all the Geek Squad software and standard practices from the corporate HQ were great. However, over time the store management began to run Geek Squad like just another department.

Sales managers don't know anything about technical service, so eventually we began to focus on new PC customers (upgrades, software installs) instead of the PCs that were in the back waiting on repair. Eventually Geek Squad just became an extension of the PC sales department at most stores.
No joke, I've seen a guy buy a $50 bottle of water in Vancouver, BC (yaletown).
Isn't 1/2 million jobs better than one at all? You sound like you want Apple to disappear from the face of the earth.
Apple: We’re responsible for over 500,000 American jobs
JavaScript as an Embedded DSL
I agree with this post - asking customers what they'll pay isn't always the best way to price your product.

However, if you do ever find yourself asking a customer what they would hypothetically pay for your product, never ask them "What would you pay for a solution like this?"

Instead, ask them "What do you think a 'fair and reasonable' price would be for this product?" It's a variation on the "what would you pay" question that tends to get a much more thoughtful, honest response.

Just a tip for HN from someone who has been in consumer insights and research for 10 years and has done hundreds of customer interviews around new products and pricing...
Node.js 0.6.12 released
Yeah especially a lot of what would be considered racist humor in the real world is... much more acceptable. :P
Churches are also non-profit. As is Scientology. Just being a non-profit isn't insurance against evil.
Thanks for the response. I want to clarify that my quest isn't to run anyone through the gauntlet. To quote myself:

A scarier but more tractable solution is educating and arming first-time founders with the lessons and toughness they need to succeed against the tremendous odds facing them in this territory. It demands a brutal honesty that risks discouraging young recruits, but this is how the best of the best operate.

As a founder born and raised in South Florida that’s had some measure of success (insofar as survival is a major component), this is my plan. To tell people of the dangers in no uncertain terms, to take a chainsaw to their ideas, and to inspire them to find ways to collect money from customers first, so they can collect it from opportunistic investors second, and on their terms.

I realize that this is mostly about teaching (and not acts of kindness, money or otherwise), but I do believe that it fits under your suggestion to "mentor and give guidance". It definitely isn't about just getting them to "realize some sort of truth." On the contrary, I welcome engagement in a very practical way. Hope that makes it a little more clear.
If your target is Android and iOS why wouldn't you go with the fastest and slimmest library you can find?
Would this be able to handle multiple accounts for the same website? Or would you use a separate browser for each account?
I downvoted because the post was misleading (although admittedly the bgr.com article is as well)

>Apple's patents were worthless. They invented nothing; everything they claimed was prior art.

I posted the link to the San Francisco Canyon Company wiki article earlier. Apple had won injuctions in the courts and there's no reason to believe that there wasn't a big payday at the end of the line. http://findarticles.com/p/articles/mi_m0CGN/is_1999_Jan_26/a...

>The real story is Microsoft bailed Apple out.

In Politifact terms, "half true" - the money meant nothing (see the 10-K link I posted below) but the gesture meant that investors felt better about Apple. Let's not forget that Mac Office was one of the most profitable products for MS back then and MS avoided potentially paying out a lot of money for patent infringement. There was also the patent cross-license agreement (which I think was renewed in the early 2000's and answers the question of why Apple didn't go after MS for the same things it went after Android vendors for).
Couple of days ago USA Government was trying to pass a bill in Senate named SOPA and PIPA bills.And now Danish Police has been censoring Google,Face book and 8000 sites?So what about freedom of information,communication and the freedom of press?My question is "Is this was just an accident or they were just obeying the order of their government?" If yes then it is surely a stupid thing.
Summit Series Raised $40 Million to Buy A Mountain
Can anyone recommend a good smart card device that works with openssl and firefox?
There is certainly a propaganda campaign being run to encourage Americans to support war. It is being run by powerful people with vested political and financial interests who spend millions of dollars to project their message across all forms of news media.

If you think video games are anything more than a sideshow to this, you're delusional.
Is Readability Just an Instapaper Ripoff?
The user you are talking to is "qwe123_troll"

qwe123[4] is a troll account name with a storied history:
http://www.reddit.com/user/qwe1234
> This touches on what I think is one of the more interesting technological problems that we have to worry about right now. As a disclosure, most of the reason I think that is because I'm a PhD student doing research on hardware security.

If you are a PhD student and aren't working on something you consider 'one of the more interesting ... problems' then you are doing it wrong. In my opinion. You seem to be doing it right.

> perhaps because it's not in their best interest to accuse the people designing their ICs of attacking them.

Would you agree that there is some value in having the capability to detect these attacks? Whether you trust the vendors or not, you need them to be aware than you can check their work, at least to encourage them to follow good security practices internally.
It's a very valid criticism, and it's the main reason that DSSID is not quite ready for prime time. I'm participating in a W3C working group trying to develop new browser standards that would allow secure client-side crypto with a better UI than client certificates. It's a very hard problem.

But even in its present state I would argue that DSSID is at least as secure, and probably a great deal more secure, than any other extant authentication scheme out there. If you trust SSL, trust the DSSID server to be secure against write attacks (i.e. attacks that allow a hacker to change the content being served), and pay attention to the URL in your browser bar before entering your pass phrase, then DSSID is secure. (There's actually one other vulnerability, and that is malicious plug-ins, but no software-based security scheme can possibly be secure against that.)

By way of contrast, with passwords, you have to trust EVERY SINGLE SITE that you log in to. You have to trust the certificate chain for every single site that you log in to. (With DSSID you only have to trust the certificate chain for your DSSID server.) You have to trust that every single site that you log in to has not had malicious Javascript injected. You have to pay attention to the URL of every single site you log in to, not just one.

Most problematically, many HTTPS sites do not have valid certificates, which trains users to ignore warnings about invalid certificates, which essentially undermines ALL of the security of SSL. So having to only ever trust one certificate (which will always be valid) is a huge win.

If DSSID were be broadly adopted it would become more secure. Once the code is stable enough, I am going to open-source the DSSID server code so that anyone can run their own DSSID server if they don't trust mine. The Javascript that is served from the DSSID server is static (except for the nonce) so it can be independently audited and verified. The DSSID protocol doesn't have to implemented in Javascript. You could write a plugin that implemented it, or build the capability into a browser. It's a lot easier to plug the holes in DSSID than anything else out there.
Yes, exactly. You set up a CNAME record that points to us, which is one of the DNS records in your Mailgun control panel.
Please stop posting this to HN.
Hey Man,
Thanks for writing this. Depression is tough, and putting it out there for the world to see makes it even tougher. Hang in there. You have been through this, so you know things will get better. It just takes time. Keep pushin, keep fighting.

The best advice I had ever heard is to not make happiness a goal. Happiness is a state of mind. If you make happiness a goal you will spend so much effort looking for it that you will never actually find it.

Best of luck.
Encoding conversions at the FFI layer would be very nice. How do the Haskell interfaces know which encodings to expect?
I was under the impression that not specifying a device modifier would allow the image to be used on both devices. From Apple's documentation:

Applications running in iOS 4 should now include two separate files for each image resource. One file provides a standard-resolution version of a given image, and the second provides a high-resolution version of the same image. The naming conventions for each pair of image files is as follows:

Standard: <ImageName><device_modifier>.<filename_extension>
High resolution: <ImageName>@2x<device_modifier>.<filename_extension>
The <ImageName> and <filename_extension> portions of each name specify the usual name and extension for the file. The <device_modifier> portion is optional and contains either the string ~ipad or ~iphone. You include one of these modifiers when you want to specify different versions of an image for iPad and iPhone. The inclusion of the @2x modifier for the high-resolution image is new and lets the system know that the image is the high-resolution variant of the standard image.

That said, it would be cool if Apple produced four different variants of an app and would send you the proper one depending on the device you download it on. When downloading with iTunes, your machine would download and store all four versions.
> I just stated fact that the numbers are falling

Except Google says they are climbing and Alexa says they are about the same, and as Raldi pointed in his link for stats of Reddit (a somewhat similar site) the numbers these services report are essentially fiction.

> representative consumers in US that use hackerNews website declined

According to Quantcast they are climbing (almost 50% increase).

The only people who know the actual traffic figures are the admins. Why not ask them for the real numbers instead of considering one cherry picked report as a fact?
Quick math on the iOS app economy:

> The app revolution has added more than 210,000 iOS jobs to the U.S. economy since the introduction of iPhone in 2007

> Apple has paid more than $4 billion in royalties to developers through the App Store

The app store has been around since summer '08, so let's say it's been around for 3.5 years.

$4B / 210,000 / 3.5 = $5442.17 per annum

Converted to an hourly wage, that's $2.62/hr (or $454 monthly). Way below minimum wage. Either Apple has some funky math going on here, or they've created 210k very crappy jobs.

Note: I'm ignoring Advertising and B2B revenue here, so when you factor that in I'm sure the gross product jumps quite a bit. Still, Apple ignores that part of the market as well, so either they should publish a gross product for the iOS economy, or they're leading me to the conclusion above.
What is a Closure and the JavaScript module pattern
Five Best Online IDE’s – Making the switch to a Chromebook
When you’re looking to move your coding to the web, do give the following five IDE’s a bit of your time. Try them out. I’m sure that one of them will be of your liking.
Doesn't the government already make use of IBM's manufacturing capabilities for Top Secret+ chips to try and mitigate the risk of this scenario?
Dating Guru David Deangelo Finally Marries...
You may have some luck asking on: http://webmasters.stackexchange.com/
We're huge Mailgun fans at AppFog and LOVE the new analytics!! Nice work.
just to be clear, this not an affiliate link. Just happy for the man!
Would make an excellent start-up idea. :-) Please do it, someone. I don't have the time, but need a burrito. For pure zeitgeist win, add grilled cheese to the menu, too.
I live in Arizona. I don't know of anyone buying $2-$3 water because of the quality, mostly we buy it due to convenience. In short, because it's 116 F and they want water right now.

Sure, maybe there's Evian or whatever, but at least for me, it's well outside of my normal experience. Most of the expensive water we buy is pure convenience, because we'll buy from the guy with $2 water instead of $3 without thinking, given the chance and all the common brands are blurred together (Evian is really the only one that sticks out).

So... yeah. I'll agree that it's a proper example, it's just not something where quality is a major consideration, at least in these parts. YMMV.
I think you might be one of the only people in this thread who knows what he's talking about. Certainly your comment squares well with everything I heard growing up from my dad, who fought in three wars and was never shy about telling me stories, ranging from funny to grisly, about what he did.
glad you like it
Kind of. We're suggesting that people link to the javascript shim on Mozilla's servers, while we refine the API, but we hope to support self-hosting by autumn. The entire system is designed to transparently drop away as identity providers and user agents implement native support for the BrowserID protocol, but for now we're supplying a shim implementation for the browsers and are acting as a trusted third party for identity providers.

For how this plays out, imagine the following combinations of native support for the BrowserID protocol:

1) BROWSER AND IDENTITY PROVIDER: Mozilla's services are left completely out of the loop.

2) BROWSER ONLY: Mozilla's services step in as a trusted third party to handle validating control over an identity and signing assertions for that user.

3) IDENTITY PROVIDER ONLY: Mozilla's shim and services step in to provide a surrogate implementation of the BrowserID protocol.

4) NEITHER: Mozilla's services step in as a trusted third party to handle validating control over an identity and signing assertions for that user, and to provide a shimmed implementation of the BrowserID protocol.

Again, the protocol was designed to be distributed from the very start, so nothing is locking it down to using Mozilla's shim and services, but they're there for you if you want to use them.

Disclaimer: I do not currently work for Mozilla, but I will be joining the Identity team later this month.
Yeah, the viewing distances are cack. There's no way I sit 4" further away from a 17" MBP than I do from a 13" MBA.
You may imagine that to be true, but more likely than not, you don't know what you are talking about. For one thing, Ferarri's aren't known for comfort...
It'd be neat if the jobs could go to Californian robots, rather than Chinese ones. Remember when Jobs built a fully automated robotic assembly line in Fremont for the Next computer.
Yeah, it is actually.

https://github.com/brack3t/django-braces is the Github repo, or you can ``pip install django-braces`` into your project. All the mixins are then imported from the ``braces`` package.
why not include the farmers who raised the cattle that fed the hamburger to the truck driver.

seriously, this is PR out of control, yet there are those who will look at this and say 'Apple employs 1/2 million americans'.

Note, they include the people who 'build the planes and trucks' (I didn't realize the page scrolled at first).
He never said he was doing code and math for his employment. He may be coding on his own projects. I guess this could still be considered as "improving their skillset"
Well, to start we could just send signals to nearby stars with planets. Obviously planets within 20 light years are the low hanging fruit. Since we know there's life on Earth, nearby stars might have a greater than average chance of harboring life as well.

http://en.wikipedia.org/wiki/List_of_nearest_stars
In my late teens and early 20's I had a lot of book & observation based business information contained in my brain. The most jarring thing about running a real business early on was all the ... bullshit. Most of which is unavoidable. The myriad of issues and red tape, that have nothing to directly do with creating or selling or product or marketing or managing.

The best thing to come out of those early experiences in my opinion, is the automation you properly build up that makes it possible to fly a lot faster through it all with each iteration. That part of experience is priceless. I waste a lot less time now, and know a lot better what to focus on.

I don't think any business school can teach you the kind of fast reflex adaption you acquire with experience. No two scenarios are ever the same, but with enough experience you'll find a lot of cross over similarities, things you learned over there that apply well over here. It becomes personal data that you can call upon instantly, bend, manipulate, adjust to solve new problems fast.

Data from experience is more easily available for manipulation to new problems than mentally distant 'book based' knowledge.
Totally agree. Going through the motions of selling something will teach you so much more. A few years back, I wrote a similar blog post, except I was recommending that MBA students drop out and launch an app on the App Store instead.

The funny thing is that ever since, Google sends me traffic for everyone googling "cheap MBAs". I'm sure I get unhappy visitors :-)
http://blog.foundrs.com/2009/08/12/the-cheapest-mba-program-...
Amazing work from the Penn GRASP lab! This is ground breaking!
I said detect our planet not detect our civilization.

For all we know there is some civilization out there which periodically cycles through all the known possibly habitable planets they've detected and beams radio messages at them.
Nice, I totally agree with the fact that pricing of product is an art to attract the customer before your product is being released.
Copyright, Internet Television, and the Aereo Lawsuit
I was 'Rookie Agent #63' from 1998 - 2000 when I was in high school (see photo link below), and the company was still about 35 employees. It's a pity that the quality of the service has seemingly declined so greatly. I remember when Robert would mock Best Buy's seeming incompetence and declare unequivocally that the Geek Squad would never own a fleet of vans. So much for that.

https://twitter.com/aaronbrethorst/status/175695256233324544...