skysight-inc/HackerNews huggingface dataset:
The Stack Overflow question I link to offers an interesting point: OAuth would work fine if tokens and secrets were passed out on a per-app, per-install basis. That way you could ban a developer of an app, or an individual, if their token/secret combo becomes compromised. Something like federated key management: http://www.scmagazine.com/federated-key-management-as-the-ba...
That sounds rather like the current hellban system.
US to drive 3,000 Wi-Fi linked vehicles in massive crash avoidance trial
it's worth noting, I think, that Schneier is pretty out of touch when it comes to the whole "open wireless" thing, because he leaves himself open to a bunch of local-only attacks. he's correct that your computer should be able to withstand being on the 'open' internet, since it is every time you take it to work or a coffee shop or something, but, don't be an idiot, just turn WPA2 on at your house.

many access points (I think) now provide a feature where they can run multiple SSIDs. so if you're savvy, you can turn on a guest-only open wifi for when you have visitors, and turn it off when they leave. kind of like a guest key for your spare room!
A friend of mine over here recently discovered that a certain printer manufacturer (very big one) had a complete SNMP service that runs on all the printers - they aren't protected and you can run any command on it. You can even tell the printer to download, load, and reboot with custom firmware. Amongst many other yucky things.

This sounds somewhat similar.
No doubt it has been replaced by device obsolescence, where the screen, camera, wireless radio, etc. are bundled together and improvements in any one component compels the purchase of a whole new unit.
Actually, the last few (brand new and "legacy") printer/scanners I've hooked up have never asked for a driver disc on Windows 7. The driver situation on Windows is far, far better than it used to be.

EDIT: presuming you have an active Internet connection. Which is a fairly safe assumption these days, but by no means guaranteed.
I sure hope we're entitled to free speech.
They offer different authentication mechanisms depending on whether you're writing a client or web app.
This is true. There are a lot of misconceptions about latching on when it comes to newborns. It can be a struggle and very emotional and frustrating process for the mother. Especially if she thinks it should just happen. Someone's it does, but sometimes it can take days of prodding and encouragement. (my daughter is two)
After Microsoft Deal, Yammer Chief Issues Gloomy Forecast
Can you point to anywhere that documents that?

"Instagram’s API uses the OAuth 2.0 protocol for simple, but effective authentication and authorization." seems pretty clear. So's this bit:

> Client-Side (Implicit) Authentication

> If you’re building an app that does not have a server component (a purely javascript app, for instance), you’ll notice that it’s impossible to complete step three above to receive your access_token without also having to ship your client secret. You should never ship your client secret onto devices you don’t control. Then how do you get an access_token? Well the smart folks in charge of the OAuth 2.0 spec anticipated this problem and created the Implicit Authentication Flow.
Explain xkcd wiki
Rerun with "-sV --allports"

--allports (Don't exclude any ports from version detection) .
By default, Nmap version detection skips TCP port 9100 because some
printers simply print anything sent to that port, leading to dozens
of pages of HTTP GET requests, binary SSL session requests, etc.
This behavior can be changed by modifying or removing the Exclude
directive in nmap-service-probes, or you can specify --allports to
scan all ports regardless of any Exclude directive.

PS I think the "-A" and "-T4" is redendant. I think aggressive mode sets the timing to 4 among other things.
There's a lot of back-and-forth in this discussion about whether real-time communication is good or bad, and whether the responsibility for dealing with it lies with the content producer or the end user. I think the optimal solution lies somewhere in the middle: content producers need to be respectful of users' limitations (time, energy, attention, etc.) and users have to understand and communicate those limitations. Real-time communication is merely a tool, and like any other, it can be used well (for things like important events that are occurring now) or poorly (because who really needs to know instantly when an acquaintance listens to a new dubstep remix?).

The concept of the Slow Web is catching on precisely because, as technology has matured, the idea of real-time communications has become the default, and as a result, using nearly any service exposes you to a bombardment of information. Technologically, it's easy: something happens, so you immediately fire off an email or trigger a push notification. Why wait? Why bother implementing a queue or a summary when it's so simple to just do it now?

Yes, users can always opt out, but often doing so means you either have to opt out of the service entirely (thereby losing the ability to benefit from it at all) or that the service falls out of your consciousness because they have no setting between "firehose" and "off", and there are so many other things demanding your attention.

Especially when services are ad-driven, they want to find ways to keep getting your attention. Every time they notify you of an update and you load the page, that's an ad impression. Every time you're prompted to share something and it gets a friend of yours to sign up, that's a new data point for advertisers. They have a vested interest in pulling your attention away from whatever you're doing and back to themselves, and real-time communication makes that easier.

You can choose to ignore notifications or put them off until later, but the fact that they're sitting there with unread information is often difficult to ignore. The fear of missing out drives us to keep checking; the fact that every fifth or eighth or twelfth tweet makes us laugh or think is partial reinforcement that drives us to try to read every one. Opting out through willpower alone is more difficult than it seems for most people.
Right, which is a largely meaningless distinction: if the process runs as you, any successful attacker can simply read it out of the CrashPlan process in memory.

Again, if you're not typing the password in every time, a local compromise is almost certainly game-over. Apple's keychain helps reduce the damage if the data's not actively used but for something like CrashPlan which is always running the attacker is probably going to be lucky.
It was the simplest 30-second way to compare I could think of. If you have a more accurate measure then by all means post your results.
Google wallet subscriptions is out of sandbox
This is something I've been keeping an eye on ever since Google announced that they had implemented subscriptions in Google Wallet. Up until now it has only been available in sandbox, but it seems you're now allowed to implement subscriptions in production. Great for us brits who have somewhat limited (simple to integrate) payment options available to us.
That's rich, because it rather looked like you were the one trolling in that exchange.
Finding Your Tone Of Voice
University of Reddit Entrepreneurship, Session 1: The Art of the Start
The Bozo Event Horizon: http://news.ycombinator.com/item?id=4409760
Very Few Words on Samsung vs. Apple
Richard Stallman interviewed by coked out journalist.
The problem is that to do per-install tokens, one needs a secure side channel between the server and client over which to exchange these tokens, or a secure side channel to some kind of key management/federation server. That's fine and good, but it completely defeats the point of OAuth 1, which was to provide a request signing method that didn't depend on any other secure side-channels to operate.

With OAuth 2, of course, the point is mooted a bit by the decision to go with HTTPS as the secure channel, and such a scheme seems much more plausible.
Your mention of unrealistic comparisons reminded me of the Dove evolution commercial http://www.youtube.com/watch?v=iYhCn0jf46U

The original question asked about whether a person can "play music" or "do ballet". I want to add "being beautiful" to the list because I think it will help me express my point that I want to make.

I believe that most people can improve on most skills, and that improvement is correlated to the time and effort they put into it. I believe that "being beautiful" counts among these skills along with "playing music" and "doing ballet". The reason I added "being beautiful" to the list is because I have found an attitude among many people, even those with a "growther" mindset, that treats beauty as static. I argue that the general expectations (or at least the projected expectations, which to the projecting person is the same thing) is unreasonable, causing many people to think of their improvements as failures because they fall short of those unreasonable expectations.

So if one defines the ability to "play music" as the ability to produce live music that is on par with best-selling recordings, then I argue that no, the average person cannot "play music". Likewise if one defines the ability to "be beautiful" as the ability to look as flawless as the final product in the Dove evolution commercial. I find definitions like these to be unreasonable because these definition/expectations discourage the average person to try to play music or be beautiful when it may bring them and the people around them much joy.

I hope that you are right that people can shed these expectations and do things for the fun of it. I see signs of it in music too.
Show HN: A C library for recommendations using collaborative filtering
1) I doubt you're correct about the complexity.
2) The EULA is at largely about "we take no responsibility for whatever breaks." This would never fly legally for cars because failures kill people. Also, it's less reasonable; since you're unlikely to install arbitrary programs in your car and open it up to the internet for attack, whatever goes wrong likely IS the maker's fault.

Not that I'm a fan of EULAs.
UReddit was painful to look at. They really need to get it together before branding themselves under one of the most popular sites on the web.

As an example, the first course I looked into had zero follow-up courses or suggestions for the students to keep learning past the initial introductory lessons despite comments asking for them (the 'professor' said he had no plans to take it any further). The documentation was overly complicated for the sake of sounding smart and the text was written in some awful thin, monospaced font. I didn't go through it enough to see if it was certifiable, but I'd venture to guess that if the author couldn't even bother to include supplementary resources, they probably aren't suited to teach. There wasn't even a preface about who the professor was, why they were qualified, and links to some stuff they've done.

For a project so ambitious and trusting of the capacities of volunteers, they need to require that these people commit. Outline two or three courses, meet content deadlines before the course is public, have them vetted by people in the appropriate subreddits and then offer a pool those students can wade in afterwards to continue sharing their progress with each other and to act as a promotional tool for the courses/professor.

Is anyone doing truly crowdsourced education?
Thanks very much. Will keep that in mind.
How so? Doesn't it represent that your data is safe, as it is "frozen", and slow to retrieve like a glacier?
Thanks very much. YouTube on mobile is without annotations :( Will note that for the future.
What are some OAuth alternatives that you guys know of or have used in the past? I only know of two-way SSL and SAML.
I'm assuming this because their desktop client is a java app and it it's been made to run on linux, mac and Windows. Is there such a thing as a keychain on Windows? I've only used it on linux and mac.
My guess is he doesn't believe putting illegal drug users in jail has a valid societal purpose - I know I don't. Treatment not incarceration.

However I think his analogy is flawed, and that a system that successfully penalizes poor comments and submissions does have a valid societal purpose here, mainly because posting is nowhere near as addictive as most illegal drugs. And for those whom it is - perhaps we can get a treatment program going :)
Well, at least there will be a broad, diverse menu with new food options being added regularly.
To quote Destroy All Software:

wat.

Instagram uses OAuth2. It's right there in their doc: http://instagram.com/developer/authentication/

Second: OAuth uses access tokens, just like OAuth2. It also imposes request digests including a timestamp parameter, which prevents replays and doesn't permit forged requests if you manage to intercept an unencrypted request.

OAuth2 is arguably less secure than OAuth, because as it's being used by Instagram, the whole kit and kaboodle is wrapped up in the bearer token, which is wholly reliant on TLS for its secrecy.

Corporate network with a custom CA installed? Your account is theirs (seriously, your employer doesn't have to ask for your Facebook password to spy on you, they just have to make sure their proxy's CA is installed on your work-issued machine, and they can crack your Facebook account open like a pinata). Cert issued from a bad CA anywhere between you and the target server? Your account is theirs. Any breach in the host's enforcing of TLS? you've just leaked full access to your account to anyone that's listening. Hell, even an XSS breach can result in a leaked bearer token.

Oh, and guess what? You can still suck an auth token out of memory and use it to forge requests. And you can still suck the OAuth2 keys out of the package or memory or whatever and use them to forge authentication requests. The exact same issue exists for OAuth2 (and Instagram's usage of it) that exists for OAuth. Implicit authentication flow is great, but the core problem of "I can crack open your app, take your client ID, and use it to create authentication requests for my app while masquerading as you" still exists. With OAuth, you also have to steal a client secret in addition to a client ID, but the end result is the same.

OAuth2 is a lot more friendly than OAuth for client developers, I'll grant that, but it's just flat wrong to argue that it has some mystical protections against the problem that aren't present in OAuth.
Looks cool, trying it out now. Awesome that you explained deploying to heroku :)
I wouldn't consider it one. Lifehacker isn't always about lifehacks and they also have good tutorials for things that some people aren't aware of. Many people I know think the only way to make coffee is with a drip coffee maker.
FundersClub has 2 important elements, I believe, (PG correct me if I'm wrong) that probably made it click:

1. It's not dependent on the JOBS Act. It's like Angellist, in that they vet to see if you're a legitimate investor, except you can actually invest right there on the platform. With the proliferation of standard seed docs, this makes a ton of sense.

2. It's curated. It's not a free-for-all, it's going to make impactive differences in targeted companies. That's dope.

3 would be their secret sauce and their plans, which I'm sure are awesome.
Is the US at war with Venezuela, Iran and Cuba? Or, are embargoes and sanctions considered "war"? AFAIK, we're not at war with Afghanistan either, rather, we're warring against the Taleban and others but not the Afghan gov't proper.

"Featured cuisines have included Iranian, Afghan, Cuban and Venezuelan food"
Repeated username/combo requests over HTTPS produce patterns over multiple requests that can make cracking the encryption easier. Additionally, there's the issue of having to store usernames and passwords somewhere in the app (hopefully not plaintext, and hopefully somewhere inaccessible).

As for proxies, I'm talking about someone with physical access to a device and network, which I believe would work for extracting unencrypted HTTP headers from HTTPS requests (that's why an OAuth signature is itself encrypted by the consumer secret and user authentication token). However, I'm not a network security expert, so maybe I am mistaken.
On the one hand, this is competing with resumes, which are possibly the only paper product which looks up to "that thing around the Starbucks coffee cup" and "toilet paper sitting in a broom closet" and thinks "Man, if I try my hardest, I can be as compelling and persuasive as they are!" Resumes are created to be ignored. Even if it is really just a resume in Kickstarter-inspired CSS it shows orders of magnitude more creativity than the traditional resume would.

I struggled with whether I should say the following, because I never want to say "Don't make things." Do make things... but for the next thing, there's improvements that can be made. This site doesn't really show much understanding of the psychology which induces people to share. The pitch is "retweet this to say something about me." Successful virality is generally some variant of "retweet this to say something about you." (Getting added to a thank you page is, probably, not that motivational.) A small part of me wants to say that, if one is pitching one's skill as a digital strategist, being a good digital strategist in the execution of that pitch is probably a good idea.

Your ideal working environment doesn't have a problem putting up websites. They grind out websites all day. Putting up a website is less than impressive to them. Their problem is that they mostly put up websites that nobody other than the client will ever care about. This is why they hire hip twenty-something college grads: for that vision thing that can hang a story around e.g. Coca Cola or Old Spice or some insurance company such that anybody would ever care about what a commodity product's advertising website says about them.

I don't want to say that nobody but the client could care about this website, because clearly that it is not true, but it is very client-centric as opposed to being "customer"-centric, in a way which is directly against the "client"'s economic interests. As the hip kid with the vision, now is a great time to have a heart-to-heart with the client and tell them that in addition to having a clever idea they also need to have a clever idea that motivates disinterested third parties.

Of course, virality is kinda bonkers, so if it goes viral then I'm wrong even if I'm right.
I agree that showing the encryption key in the clear is not a serious security flaw but it's IMHO against best practice.

Passwords and key are usually shown in an obscured form, usually with asterisks, and stored in the user or system keychain. You are absolutely right that the security value of these standard practices should not be overvalued but still … what else within the security framework of CrashPlan is not done in accordance with best practice?

(I assume, BTW, that CrashPlan does not use the system or user keychain on the Mac because it is not a real Mac citizen but a Java-based app. Firefox and Wuala – the latter Java-based too – don't use the user or system keychain either.)
I am absolutely amazed, that picture at the beginning of the article seems to have taken on a life of it's own.

More on topic, quick PC obsolescence was always something of a myth. Parts were only really obsolete if you absolutely had to run the latest shooter at the absolute highest settings known to man. So it wasn't that it was obsolete, it was that the user needed to justify their desire to buy the latest for bragging rights.
I agree totally with the limitations of a technical solution to a social problem.

Furthermore, even if the technical solution work to any extent, it doesn't work as well as it could if it were visible. The attitude of relying on monkey-see monkey-do for establishing your social boundaries is wishful thinking if your approach to unacceptable comments and people are to sweep them under the rug.

That kind of tinkering is bound to create a community where the only people talking are those who most adamantly adhere to the echo-chamber. We already know there are certain opinions on the periphery that we just don't discuss on HN, no matter how politely or clearly articulated they are. They go against the groupthink and are good way to get shadowbanned.

The lack of visible moderation has not served HN well. Community management isn't rocket science, but sometimes it does have to get a bit ugly. The price you pay for letting people disagree is disagreement. You can keep it within bounds, but wall-papering over the bounds every time they are crossed doesn't actually improve anything, it just makes the same wounds happen again and again.
The Best DNS: Performance comparisons of Route 53, Dyn, UltraDNS, easyDNS
I deleted that comment with Noscript click-Del (new feature), but that kills the answers too. The suggestion by jlev (hellbanned) is not working here.
HN vs Reddit: 50 vs 15000 visitors. Shall HN add new channels?
When I posted my project on HN there were 50 visitors.
http://news.ycombinator.com/item?id=4333014

When I posted it on Reddit there were 15000 visitors.
http://www.reddit.com/r/programming/comments/y77hi/so_i_built_a_minimalist_forum_with_some_strange/

The problem is no one reads "new" on HN. Either you are on the frontpage or you are doomed. I have seen many quality submissions in "new" with 1 vote. A number of them are arguably more interesting than some of the blogposts on the frontpage.

Probably HN shall consider adding one separate channel for "Show HN", and another for "Ask HN". Currently there are just too many people competing for the frontpage. And different people are interested in different kinds of submissions.
Octane: Javascript Benchmark Suite for the modern web
Home servers? I've always used incredibly out-of-date machines as home servers. There has never really been a market for powerful home servers.

I had a Pentium 166 with 80MB of EDO ram and a 1GB hard disk (bought new in 1996 as a P120 with 16MB of ram) until the end of 2005 as a home server, running Windows 2000.
> If a post has 50 comments and 25 are "bad" it's a problem, even if the 25 "bad" comments are at the bottom of the page because people will still reply to them and they will still be a part of the discussion.

What is a "bad" comment anyway? Your idea of a bad one is bound to be different from mine, and pg will no doubt have a third view. Would it be possible to present to each user those comments that that user is likely to want to see, based on that user's voting behaviour?
How is that rich? I pointed it out because that is precisely how I felt some would feel.
I know the headline is copied from the article, but I wonder why it differs from the copy. The headline is incorrect and the copy is correct:

"They only sell food from countries the U.S. is in conflict with."

(http://en.wikipedia.org/wiki/Declaration_of_war_by_the_Unite...)
How multiple IP addresses work with a Broadband Bonding multi-WAN firewall?
I'm either missing the reasons being backed up by Instagram's documentation or my sarcasm meter is completely broken this morning.

1) Dissent against OAuth; "OAuth sucks", "Don't use OAuth"

2) Focus on the fact that Instagram doesn't use OAuth

3) Link to Instagram documentation which says they do and it's awesome:

> Instagram’s API uses the OAuth 2.0 protocol for simple, but effective authentication and authorization

> Well the smart folks in charge of the OAuth 2.0 spec anticipated this problem and created the Implicit Authentication Flow

4) ???

What'd I miss?
C&B Panel: Alexandrescu, Meyers, Sutter on Static If, C++11, and Metaprogramming