skysight-inc/HackerNews huggingface dataset:
I think this applies if the definition of "markets" includes dishonest and corrupt behavior, which may well be a something you cannot remove easily. In the case of rent control, corruption occurs in both the market and the social engineering.
And this isn't even the first blog post to mention the fact that a CA gave out a cert to unauthorized person...

Mike Zusman tested a group of CA issuers and received a cert for Microsoft's live.com and talked about it at Blackhat this year: http://schmoil.blogspot.com/2008/08/domain-validated-ssl-cer...

Additional information at: http://www.law.com/jsp/legaltechnology/pubArticleLT.jsp?id=1...
Wikirage tracks what's hot on Wikipedia
How does Club Penguin not fit the startup mythos? Started by a couple of guys to solve a problem they had and figured other people must have (not enough for small children to do online). Made the product themselves based on some Flash stuff one of them had been building. Huge viral growth, big acquisition. Sounds like a classic startup success to me.
Let me ask some basic questions, that I might someday know what I'm talking about on this topic.

I can self-sign certs. The problem is that no browser recognizes my self-signed certs, so they put up dialog boxes filled with warnings. (Which many users will just dismiss without a second thought, since they are very used to their machines crying wolf. But let's ignore that big problem for now.)

So the problem is that some of the CAs whose credentials are pre-installed and pre-trusted in various browsers or clients turn out to have shoddy verification practices. Does the answer to this involve Mozilla, Webkit, Microsoft et al. decertifying these CAs, which would turn them into the equivalent of someone like me, signing certificates in his basement?

I guess the problem with that is that all the existing paying customers of these CAs would wake up one day to find that their certs don't work anymore and that their money was wasted.

What is the answer to this problem? What kind of contract do you have to sign to become a CA, and with whom?
A Comprehensive Overview of the Video Game Industry in 2008
The scenario under discussion (at least I as understood it from this particular thread of comments) is if we don't revoke all the compromisable certs. The scenario is NOT that I am connected to an attacker who has successfully used this attack against me.

Under that scenario, then you've already lost your data (although I'd still hold it's better to have your CC stolen by one person, rather than two), so yes, that's bad. However, that's not the scenario that I've been discussing here. This thread came under the debate about the risks and issues with revoking all those certs immediately, versus not.
I meant social engineering in the form of manipulating markets.
I'd say if it's directly related to startups, it's probably ok. This article isn't about startups at all. Neither are most other economics articles. Some are, and the ones that are are pretty evident.

Also, "technical fluff"? I enjoy articles like this one:

http://news.ycombinator.com/item?id=413047

And it doesn't seem like "fluff".

Furthermore, it really wouldn't hurt if there were actually fewer articles.
Wow, I never expected as many people would be open minded towards gedit. Sometimes in Unix, it's hard to convince anyone that something with easier, more discoverable customization is better than vim.

Wish it had a tabbed terminal, and code folding though.
In 1849, some guy discovered gold in California...

When the word "lottery" is mentioned in the article, I thought it was a pretty accurate description of what is happening.

There are 10,000+ apps in AppStore and only 10 that can occupy the top 10 slots. That gives the average developer a whopping .1% chance at any given time to be in the golden goose category.

Keep building your continuity businesses folks, the old boring 37Signals model. It'll keep pumping money into your bank account, month-after-month, and if you have some moola left over -- hire a iPhone hacker to put something together for you.

Maybe you will get lucky and you'll have a flash in the pan for a few weeks.

Moving forward, the winners are going to be the people who can market the hell out of their applications. If you aren't marketing-savvy, you are leaving it up to the gods to get yourself into the big money list.
Import tariffs and subsidies are direct market manipulation, and the market doesn't really route around them. Rather, they tend to wreck markets, which is one reason many developing countries continue to press the US and Europe to end farm subsidies - it's wrecking their export markets and hurting their farmers.

Governments, when they want to, are perfectly capable of interfering with markets and even destroying them. I am not a libertarian and do not believe that all intervention is harmful, but disagree with your thesis that markets are able to route around governments. Yes, in some cases, but I think that governments have the upper hand: they have guns and police and stuff, like the libertarians love to say.

I think the "law of unintended consequences" is perhaps more solid ground with regards to governments and market manipulation.
I agree with your points, but your points depend on the context. If I have some wine sipping Kafka reading man in a top hat telling me that the things he likes are the definition of quality, he's no more right than the surfer dude who swears by fart films.

The problem with a lot of modern society is that people tell us what we're supposed to regard as high brow - because a film is made by fox searchlight does not mean it's qualitatively better than a nollywood film.

Intellectualism - our constant attempt to break through the limits of human thinking - seems nowadays to have built a fence around itself and defined what belongs in and what does not. That's what I dislike.

To give an example, those wine sippers will overwhelmingly tell say that Jazz is a more intellectual musical form than country music. Utter bullshit, they are intellectually equal, one just happens to be inside the intellectual box and the other is not.
Well known and utterly practical? You have been commenting about how difficult this attack is and how the MD5 collision breakthrough is still secret.

You're not interested in the risk of or protection against provided by SSL encryption for a simple and probably relatively common passive attack? Because those people are lazy or dumb, we can write them off entirely and say SSL provides no security if there's a potential CA related exploit? I get that it's not as interesting a situation to think about, but I think that logically you can prove that SSL provides an increased security over http to the end user, even if some certs could be compromised.

"
(2) You have to be able to generate the collision within a short window of time to get the resulting product signed properly by the CA, so you need the new academic result (and the PS3s).

(1) The attack is extremely difficult to pull off.

(2) Critical details required to carry it out --- an academic breakthrough in MD5 collision-finding --- were actually withheld, meaning that no "zero-day" occurred.
(3) The "fix" for this attack is for RapidSSL to randomize serials and stop using MD5, both of which will happen; if you believe certificates from before today are vulnerable, that's an even stronger argument for publishing.
"
you are correct sir, if you have two variables, you get a whole plane of possibilities, not just a line ;) I guess its too late to teach basic math to the masses though.
Developers are blinded by the light
Oh my. Two minutes of web search:

http://www.accuracy.org/article.php?articleId=51

http://www.cato-unbound.org/2008/11/12/matthew-yglesias/poli...

http://davidbrin.blogspot.com/2006/05/cato-hypocrisy.html

http://www.socsec.org/publications.asp?pubid=325

http://www.sierraclub.org/sierra/200207/thinktank.asp

http://www.acsh.org/publications/pubID.498/pub_detail.asp

http://www.no-smoke.org/pdf/catoinstitute.pdf

http://www.fair.org/index.php?page=1409

http://www.iwpr.org/pdf/CATORIB.PDF

http://www.exxonsecrets.org/html/orgfactsheet.php?id=21

http://www.allacademic.com/meta/p_mla_apa_research_citation/...

http://yglesias.typepad.com/matthew/2005/01/im_friends_with....

http://www.businessweek.com/bwdaily/dnflash/dec2005/nf200512...

http://legacy.library.ucsf.edu/tid/vdh56a00

http://www.nationalreview.com/comment/comment-fonte050902.as...

http://www.skepdic.com/refuge/junkscience.html

http://en.wikipedia.org/wiki/Steven_Milloy

http://web.archive.org/web/20011122034255/http://www.tnea.or...

http://www.pkarchive.org/global/swedenomics.html

http://www.atimes.com/atimes/Asian_Economy/EG12Dk01.html

Trying to pretend that Cato in practice is anything but a shill for big business (including, in particular, the fucking tobacco industry) and the greedy is moronic.
This could be quite interesting in connection with some of the algorithms for doctored photo detection. There was a post of them here a long while back:

http://news.ycombinator.com/item?id=242861
Ask HN: why doesn't Google use EV certs?
Does anyone know why e.g. gmail https is not backed by extended validation certs?

I'm trying to understand if they just don't want to pay for it (seems unlikely) or if there is a good social or technical reason.

Thanks
If you want to be a CA, you need to get Microsoft and Mozilla (among others) to include you in their list. I can't find Microsoft's policy, but Mozilla's CA Certificate Policy is here: http://www.mozilla.org/projects/security/certs/policy/

There are operational requirements and management attestations that must be made such as "WebTrust Principles and Criteria for Certification Authorities".
your domain registrar should provide that option
Everybody fails. The only ones who succeed are those who pick themselves up and go at it again.
"Fail fast, fail often" that's a recipe for success.
I forget who said it.

And really, you haven't failed at anything yet. Your only failure would be if you refused to learn from your mistakes.

I truly believe that you must be passionate about what you are doing in order to make it work, and as you've said, the two of you had discussed many ideas, so clearly you see there is lots of opportunity.

Yes, it is supposed to be hard, like trudging through 5 feet of snow. But it's like trudging through 5 feet of SNOW!! Like when you where a kid and you'd willingly trudge through that snow because you knew at the top of the hill you would get to ride down.
If you are trudging through 5 feet of snow and don't see a hill (or anything else fun about it). then maybe it's time to head back inside and warm up and replan.

Just so you know, I started my company with only an ad model, but later found that there were other revenue opportunities. This was after launching the site once with a completely different model, than relaunching it and getting a bit of traction, and then customers (or potential customers) seeing the potential of what I had built and them asking me to build what they want. It's about what your customers want you to do.

I'd suggest re-examining your previous ideas and thinking about other possible revenue streams. The ad model is going to be very difficult over the next year.
I lived for a long time on homemade burritos. You can make good tortillas with flour, water, salt, little yeast if you want them more bready (which I do). A can of refried beans makes three burritos. A little cheese goes a long way (I like extra sharp cheddar, as the strong flavor means you need less of it for the taste). You can make 3 at a time, and keep them in the fridge. Microwave for 1 min, and you're good for lunch or dinner.
Maybe I just read the wrong blogs, but I've been waiting for someone to say this for a long time. Aside from my techie friends, I know absolutely nobody who uses Twitter, and it's been up for a long time now.
I am a fan of simple designs, my goal in any project is to never do something that "looks nice" for the sake of looking nice. But parts of the app just appear somewhat disjointed to my eye - it feels like a decent design, but not one that is completely pulled together.

Also, my reason for not using it is not entirely based on the design - I realize my initial comment sounded like that. I also think getting my less-than-tech-savvy immediate and extended family to use a website to keep in touch would fall on deaf ears. They think Geni is a crazy idea, I think it rocks. There is a disconnect there.
Yes, that's just about the nut of it.

If you ask me, the biggest problem is that we've acclimated the whole user population of the Internet to ignorance and a cavalier attitude towards security. Companies like Comodo "get away" with stuff like this because people see certificates as a nuisance --- they're a pain to request, a pain to install, and they make browsers complain.

The fact is that SSL simply doesn't work without the PKI component. The PKI component is most of the actual security in SSL. But because technical people get away with saying "even if you're not authenticated, you're at least encrypted", it isn't the end of the world when Comodo (or RapidSSL) screws up.

As for "what kind of contract do you need to sign", what you need to do is convince Microsoft and Mozilla to add you to their root CA store; both organizations have standards and practices, and both incur an audit, and neither are particularly inclined to add more CA's (there's a bit of grandfathering that appears to happen here).
Indeed. I live in a rent-controlled apartment in San Francisco, and it is not squalid, the landlord is not crooked, and neither I, nor the other tenants, are politically powerful.

I heard a lot of horror stories about rent control before I moved here, but so far the stories haven't approximated the reality. Perhaps the problem lies the details of the rent control policies in question, and not with the concept of rent control itself.
There's an Israeli human rights group that's given out video cameras for specifically that purpose:

http://www.btselem.org/English/Video/CDP_Background.asp
When the squares actually visit LineLand though, who do they hold their noses and vote for? My guess is that they generally vote Republican (like, for instance, Milton Friedman), or did at one time. Perhaps that's changing?
Join a hedge fund! My day job employs a bunch of pure maths and physics gents to create algorithms for predicting market movements. It's all done in an open source statistical programming language called R. We have 68 billion dollars too - you can have some!
MD5 considered harmful as of today
"It has nothing to do with NYC being an island and SF being a peninsula."

It's not just that. NYC is not built up the way it should be, and most of the buildup of recent years is condos. For many years, there was a ridiculous incongruity in NYC: sky high rents and abandoned buildings. Why renovate when you can't charge rents commensurately? These days it's mostly a Harlem/Inwood phenomenon.

By the way, why is "allowing" people to stay in "their" homes (fine print: homes which are not really theirs) a good thing? Are unskilled workers somehow more deserving of a house in Manhattan than skilled workers? Do retirees deserve to live close to young workers jobs more than the young workers do?

A guy with a family has a very good reason to pay more for a house close to his job.
Ten15: A Capability-based Operating System.
"Flex was a capability architecture and operating system with a graphical user interface, unlike any other computer system I've ever heard of! The capability architecture meant that programs did not run in a flat memory space, as we take for granted these days. Instead a program consisted of a number of memory objects, which in Flex could range in size from one integer, to the whole of physical memory. The memory objects are referred to by "pointers", and it is these pointers that are called capabilities. However capabilities were much more than just pointers. It is impossible to create (or forge) a capability without asking the system for a new object, and it is impossible to access memory that was not pointed to by one of the capabilities currently 'owned' by the program... ...In Flex, capabilities were visible in the user interface, and could be mixed freely with normal text stored in a "text object", or "Edfile". In fact, a "text object" was simply a capability to an array of lines; each line was an array of "glyphs"; and each "glyph" was either an array of characters..."
I didn't think of that!

But it appears not to be true; Royalty Trusts (e.g. http://finance.google.com/finance?q=pbt) list very few executive officers.

Edit

And here's a non-Royalty Trust with fewer executive offices than Sun Hydraulics:

http://finance.google.com/finance?q=AMEX:SOC

But it does seem that they have fewer executives than any operating company of a similar size.
Architect. As in buildings.

Or a creative for an Ad Agency.
Cool. Now integrate it into the developer toolbar that I am more likely to have installed.
"Capability-Based Computer Systems" - The definitive book on the subject, now free online.
Same here... But from the story's votes I guess we're in minority in YC :)
Why It's Time for Steve Jobs and Apple to Split
Rent control does more in New York. It means that if you are in a rent controlled apt they will increase your rent to the maximum allowed! Always! And they reject people if they don't earn enough money to actually have their rent go up by the maximum amount (rent cannot exceed 20% of your annual income).. And poof In fact I've been hearing that in non-rent-controlled apartments in NY the inflation rate for rent is smaller than for rent controlled apartments.
The customers that bought certificates should be getting an SHA1 certificate from the CAs. Why shouldn't there be a sweeping revocation? Any web apps that are dependent on rapid response to problems like this will be able to respond quickly. If things are handled properly, we should see abandonment of MD5 certs in a matter of days. Taking more time just gives time to the exploiters.
I find it hard to believe that consulting firms would rank so high. Also US Army at no.43?
IIRC this is the second submission on HN that is a submarine SPAM article touting the Balsamiq software for
developers.
The attack you are talking about it completely trivial. It relies on you being too dumb to even care if you have a real certificate. The attack Sotirov, et al have discovered is extremely hard. It works even if you check certificates.
Do you have an Icelandic startup that needs funding? Talk to Bjork
Rice and beans is a cheap source of protein that I enjoy eating. Use brown rice and it's even healthier. BTW: brown rice cooked in a pressure cooker is as fast as white rice in a regular pot (or rice cooker).
If you're saying, "we shouldn't do anything rash to mitigate an attack that requires Arjen Lenstra and a specially tuned cluster of PS3s to accomplish", then that makes sense.

If you're saying, "we shouldn't do anything rash because certificates don't break encryption, only authentication", then you are perpetuating a really dangerous myth about SSL security.
I remember walking up to the Tesco in Ennis. (I think it was Ennis.) From the narrow little street I was on, there was just the glass doors visible, squeezed in between some typical shops. I go inside, and it's this entire sprawling supermarket. It was like the freaking T.A.R.D.I.S.

(Not big by American standards, but I'd been in Ireland for a week, and had readjusted my sense of scale.)
Hey! jm4! Missed you. Thanks for checking in.
Antonio is a reputable blogger, and this article isn't spam. Besides that, he barely mentions what Balsamiq does and doesn't even recommend anyone, much less developers, use it. You could hardly say that he's "touting" the software by mentioning it to support his point.
RapidSSL is owned by GeoTrust, which is owned by Verisign.

You can read all about GeoTrust's certificate practices here: http://www.geotrust.com/resources/cps/pdfs/GeoTrustCPS-Versi...

The results of their KPMG audit here:
https://cert.webtrust.org/SealFile?seal=650&file=pdf

And their entry into Mozilla here:
https://bugzilla.mozilla.org/show_bug.cgi?id=409236
This is great information.

The first one, in Influence but I never connected it with market positioning until I read that.

The one about Cost of Zero is interesting in light of Web 2.0 Freemium.
It isn't hard to think of many solid, rational reasons to oppose rent control. That is, until the wealthy bid up the cost of living in your neighborhood.
The supermarket and department store situation in Chicago is somewhat interesting. In addition to the two major supermarket chains (Jewel and Dominick's), we have six Whole Foods, three Trader Joe's, four Targets, five Kmarts and exactly one Wal-Mart.

The sole Wal-Mart was only approved about four years ago and is far out on the west side. Another Wal-Mart location was denied.
If the additional energy gained over the lifetime of the equipment outweighs the additional energy required to build in a generator, and the copper, rare earth magnets, etc. built in couldn't be put to better use anywhere else, that's a marvelous idea. Otherwise it's a feel-good placebo.
Apple's surge over the past couple of years, with the iPhone defining the mobile phone market, and the Mac continuing to pick up pace with respect to windows, shows that for there to be a major shakeup now could be misguided. I would compare it to the Union winning the battle of Gettysburg, but then not taking the opportunity to chase the retreating Confederate army and finish off the Confederacy then and there. If Apple continues on like it has been over the next couple of years, once the economy gets back on track, they will be a dominant position such as they have not been since perhaps the days of the early Macintosh. So, no, I don't think Jobs should quit now. He should hang in there at least a few more years until the recession is over, and really leave Apple in a dominating position, if he wants to then retire. If he quits now, despite the iPhone's success, there are too many vultures out there for there to be a continued guarantee of market dominance. Macworld events aside, Jobs needs to stay at the helm for the good of Apple. The PC Wars may be over, but the phone wars are just beginning. Jobs needs to stay in there and give 'em hell.
A bit of an aside, but it used to be damn near impossible to get a root cert in IE (think mid to late '90s). I would love to know how Thawte managed the hat truck of getting approved so long ago when it was clear the big boys wouldn't let anyone else in.

Shuttleworth deserves credit for creating a good company; lots of hard work, for sure. But it couldn't have happened without getting approved my Microsoft. How a young man from Cape Town pulled this off seems to be an untold part of his success story.
DaringFireball?
I don't know about other people, but I certainly did this in high school.
Web series = Startups