skysight-inc/HackerNews huggingface dataset:
I'm not Moxie, but one attractive thing about TACK is that it standardizes something browser vendors already do: if you're on a short list of sites trusted or taken seriously by Google, for instance, your certificates can be "pinned" in Chrome; essentially, Chrome builds in a notion of what your certificate is supposed to be. As a result, no matter which CAs have been compromised by which foreign governments, Chrome isn't going to believe that a pinned site, like MAIL.GOOGLE.COM, is represented by a Diginotar or Comodo certificate.

The obvious problem with that is that you have to call in a favor from Google to get that level of security. TACK is a mechanism that allows any site to get something comparable.

Another attractive thing about TACK is that it follows a model that other security features in the browser already use. For instance, the HSTS header is a widely-supported feature that allows websites to instruct browsers to remember that a site is intended to be reached only via HTTPS. TACK does something similar, but with a much more useful assertion.
Sorry for thread-jacking: I have a strange feeling seeing CC-entry form on blurity.com without any indication who processes payments. Yeah, it's https and all, but I don't know blurity. I know PayPal and maybe a few other payment processors, or there could be some badges of third-party security monitors (McAffee, VeriSign, etc.) that could reassure me that the page is safe.

Just my 2c.
I'm staring at the page and wondering "WTF is NFC"? And it's not till 1/3 down the page.

And then the possibilities opened up by this magical NFC aren't listed for another 2/3's down the page (Launch your favorite iOS Apps, Open URLs, Play YouTube videos).

Ugh, horrible sales pitch. Sell me immediately on the possibilities of NFC upfront.
ماي مور | برامج كاملة - اخبار متنوعة - قنوات فضائية
The Free-To-Play Triangle [Game Economics]
Academic papers are certainly not stingy with references.
nice, but what's the arc for down the right hand side of the globe?
I disagree on the question of credibility and motives.
How ironic. Even these guys hosting a paper about SSL can't host their stuff securely on an HTTPS server.

<base href="http://crypto.stanford.edu/~dabo/pubs/pubs.html>;

This causes the page to throw an HTTPS warning: "this page loads insecure content" due to the css loaded over HTTP.
python+iMacros
Just run the dex2jar tool on any android .apk and view the results in jd-gui. I've looked at a few apk's and weirdness like the one noted above is quite common. The code is being reverse engineered from a .smali file and the reverse engineering process appears imperfect. Of course any const names would be stripped away from the decompiled code leaving hardcoded integers (such as the 0 in paramArrayOfX509Certificate[0].checkValidity() ).

I'm not saying that the conclusion of the article is wrong, I'm merely trying to explain why the code blob above looks so weird.
So... that should be fixed by making only a single JSONP request. The downside is that it now may miss a few quakes that are over the 5.5 threshold but USGS has not rated as significant (e.g., some offshore quakes I believe).

Let me know -- and I'd love to hear if anybody has suggestions for better catching JSONP callback-related errors.
That was my point, thank you.

My point was more that I don't know how you can call someone poor who can't afford to buy the album or the book or the movie, but can somehow afford the device that they can play it on. That doesn't sound like my idea of "poor", it sounds more like "I don't feel like parting with my $15 right now".
For a prototype, it really shouldn't make a difference. People mock up UI's in Photoshop, after all.
Sassquatch: TDD for SASS
Aesthetics?
Ask HN: How do I go from Admin to Dev?
I went to school,studied CS and graduated. I really enjoyed school and since my graduation in the spring of 2009 I have had a Linux Admin job for the last two years. When I graduated jobs, even dev jobs were hard to find. I applied for a while but the common trend was that you needed 3-5 years of experience for entry level positions and my personal finance prohibited me from doing an internship.

I am not a great programmer but think I am pretty good. As a Linux admin I come into contact with developers of various degrees and would say without a doubt that my programming knowledge exceeds some of theirs at times. It's odd to say that but meeting a senior web developer who has no idea what GET or POST are does cause concern. Or one who when you mention rest looks at you with a blank stare even though their rails is architected on rest.

My problem is I have been a linux admin for the past two years and whenever I apply, no matter what I do I am instantly pushed aside due to that. I asked this question some time ago on another site and was told to put up personal projects on github. I did and it looks great. The problem now is HR at many of these companies presumes that admins can't code so why would he have a github. It's an odd association because most of the admins I know also have CS degree's and can code. They may not understand/remember the specifics of OO or how to create a socket in C but they can program. If you asked them to do something they would look up what they don't know like anybody else and get it done.

I could say that I am a Python programmer but the truth is it doesn't really matter what language it is. Whether it be Java or SML, in a week or two I can write and test decent code. The first time I was asked to do a fizzbuzz I had no issues and did it quickly.
I agree that complicated edge cases are hard.

My case was not an edge case. WPEngine explicitly mention that they support Multisite, which has been part of the Wordpress mainline since 3.0. I haven't modified it at all.

Otherwise, I agree with your post. Support is hard.
I agree. My first impression when I saw this was : Tooltip for 3$/mth ? Anyone who's capable to do good web design can do it themselves in 30 minutes max. Maintenance ? I personally don't think 5 minute CSS adjustments worth monthly pay. If you want to charge for that make obvious to customers what backend service you would charge for.
Writing as an individual is much more potent than programming as an individual. In fact writing as an individual is often the best way to do it. Programming as an individual is often the worst way to do it, your projects are often bound in scope of what they can do. Yes amazing programmers in the past have written beautiful and feature-rich software. But the matter of the fact is, more programmers == bigger problems become solvable.

Why is Google Maps so good? Because thousands of people work on it. The amount of impact any one coder has on Google Maps is tiny. That's why I don't want to be a coder when I'm 50. I want to solve large problems that require large human efforts. The bandwidth code gives me is simply too little.
ah, well, i guess that's valid. i was thinking it must be something to do with sunrise or time or something... (you can tell how appreciative i am of aesthetics, in that i prefered the previous usgs site to the recent update)

[edit, since i can't reply directly, and probably shouldn't string out a long thread anyway: i do agree with your choice, it looks good as it is. i just assumed it meant something. not sure how you avoid that.]
I'll take it off your hands if you'd like...
You would have to read the docs to find the parameter you wish to overwrite would you not? I don't see how the curl behaviour can be faulted. If you are overwriting a default you are responsible. And you are reading the docs anyway.
Can you talk about the times you've seen it done. Because I haven't, and I'd love to hear more.
The reason that a user has to enter his password for a free app is to train him to enter his password for a paid app.

If Apple didn't do this, their users would forget their passwords and stop buying apps.
This is apparently some kind of online-radio program where people are discussing some articles they read; the articles they read are listed at the bottom, and are probably more directly useful... in this case:

http://www.businessinsider.com/ifa-apples-iphone-tracking-in...
Why is there no live stream of the World Series game?
It's 2012. Why hasn't FOX found a way to make money from live streaming a sports event that they broadcast for free on TV?

They could load it up with ads, or charge me $10 per game. Instead, they black it out, asking me to tune into their free, non-trackable live TV broadcast that shows the same ads to me as to my dad and to my sister.

Am I missing something?
Good point. The payment processor for Blurity is Stripe, but that's not apparent unless you inspect the page's source. I suppose that might explain why some people bail to the PayPal option. Regardless, I'll look into adding something to reassure potential customers of their payment security. Thanks!
I conceptualize Convergence as providing trust agility for situations where a client needs third party verification. TACK is about reducing the number of situations where we even need to trust a third party at all.

The latter helps the former by making it easier to deploy. If TACK were the norm, then the only purpose CAs would serve is to introduce clients to websites they have never seen before (rather than authenticating every single connection to a website during every page load to that website).

By taking a bite out of the problem, we feel the remainder will be easier to solve. And yeah, hopefully we can position convergence as that solution.

It's also easier to get TACK done with browser vendors, simply because it's well encapsulated as a TLS extension, is fairly uncontroversial, and requires them to write less code. Basically, we feel it's a good first step.
> what they are actually asking is, "Do people want to hire a 50 year old programmer?"

Is that really true? When I was a hiring manager, we went out of our way to try and attract and hire very senior, experienced people, especially those who had managed to avoid the lure of management and just played a CTO/chief architect role. (managers were actively rewarded for making such hires and penalized if those hires swiftly left, for good or bad attrition reasons) I personally hired several, and also had a few who worked for me, some of whom were > 30 years older than I at the time.

It was a truly wonderful experience, as people of that age who haven't checked out bring something great to the team, both in terms of productivity and in mentoring for the young folks.
thanks for feedback aantix. I'm glad you got through the whole page though. man... we went through so many iterations, writes, re-writes, addressed a ton of constructive feedback, and at one point when the haze cleared, a weary finger extended and pressed launch. not dismissing your comment or our hard work. we did good.
Lolcommits - Takes a snapshot with your Mac's webcam every time you commit code
I was in elementary school in the mid-90s, and I remember being rewarded for working well with computers. I would have the chance to use a computer for an assignment when others wouldn't, mainly because I showed interest and progress when using it. I went home and played education computer games as well, it was fun to play with the machine. I wish my teachers went farther, as it would have made more interested in the material because I would have had a chance learn it by using something that really did interest me.
Travis Shrugged
I wouldn't agree that actors and musicians have shorter life on the "market". There is plenty of examples that it is not the case.

As for computing market - I was recently working with a database designer who was in his 70s. He graduated with a mathematics degree a few decades ago and had a really impressive portfolio of companies and people he worked with. Even though he retired a few years earlier, he simply refused to stop building things. We couldn't ask him to work with us until 6am or learn jQuery in one night but he brought a lot of value to the project.
I was wondering when this would happen. The 'about' pages for both showed the exact same team, and news.me development appeared to grind to a halt.

Well, good luck to them with Digg, I'm using it more than I used news.me.
Spying on you guys is so much fun Part 2.
Yep. Mea culpa.

I've learnt this lesson well.
In my experience as an author and reader of such papers, they are. References take up space, and every reference you make is less of your own work that you can discuss. So I think very carefully about who I'm going to give my precious paper-space to.

Don't confuse a paper having 30+ references as being generous. If they could have supported and justified their own work with less citations, they would have.
Only skimmed, but this seems like a very verbose way to say that you should get your dependencies right.

But Go has the most important part almost automatically, because it doesn't allow cyclic dependencies. If package A depends on package B (directly or indirectly), B cannot depend on A. So when reorganizing, you have to decide which package is higher in the stack.
How sure are you that the performance cost from template-heavy code outweighs the performance cost of the virtual function calls you'd undoubtedly be doing instead?
just clipping the circles with the outer ring might help. when i did this - http://www.acooke.org/arms.html - i tried to make the ellipses the correct shape, but it's non-trivial for extended ellipses on a curved surface (although yours are small so perhaps that's not an issue). anyway, the big breakthrough in making it look natural was to simply clip at the edge of the globe.
I'm 51. Here's how I keep up.

I read code. I read /lots/ of code.

I'm an ACM member. I go through recent publications and try to read at least a paper a week, in whatever area interests me.

I write designs, using english and diagrams and stuff. I explain APIs and establish contracts with the folks who use my code. Written communication to /people/ is a powerful skill, and you should practice it continually.

I like to learn new languages (though my brain appears to be impervious to Haskell and Prolog). Also, learning idioms of the languages I currently use is fun.

I write code. The frequency of this ebbs and flows; lately I've spent more time going between groups and establishing common ground that writing actual code, but then I can spend a couple months getting the code done, and it's a ton of fun seeing the groups able to use it effectively.

Finally, I have fun. I can't imagine coming to work every day to a drudgery of kicking around a bunch of crap I'm not proud of. Have fun, or you're dead in this industry.
I think you can download Android apps directly from the web to whatever device you select. Yet, I use an iPhone.
I think the main issue here is generational. The first generation to grow up with computers permeating many aspects of their lives has left college and entered the workforce in full swing. The internet generation is just about to get there. The "iPad generation" (not comfortable removing the quotes yet) will follow in less time than you think. So, despite the fact that, yes, there are currently 50-year-olds who have been programming and advancing the art for their whole adult lives, it's not really a sizable chunk of the population. This isn't a problem for them so much as it is for the new generations that are starting to call the shots in this fast-paced, blogging hacker world. They can't possibly relate to the experience of being around to see and learn from everything that led up to this.

So, uh. I'm honestly not sure where I was going with this! The future will be pretty cool.
If a human has to search, call and email, the business model won't scale quickly enough to ever fit the Silicon Valley idea of a startup.

Likewise if the business model is addressing unique customer needs one at a time.

There's not much value in leads for chiropractors, either. Their business grows largely by word of mouth or broadcast marketing.

If you're going to leads one at a time, the sales have to be big. The problems have to be non-trivial, and the actual research more valuable than the localized results from Bing.
The eventual problem was just the straw that broke the camel's back.

The weeks of shitty service beforehand are what really did it.
Yeah, I go back and forth on it. It just looks visually unbalanced without some kind of weight in the globe IMO.
Another author here.
With regards to TextSecure specifically, I will quote the code in the paper here:

schemeRegistry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
schemeRegistry.register(new Scheme("https", SSLSocketFactory.getSocketFactory(), 443));
...
HttpHost target = new HttpHost(hostUrl.getHost(),
hostUrl.getPort(), HttpHost.DEFAULT_SCHEME_NAME);
...
HttpResponse response = client.execute(target, request);

Viewing the code sample from the paper it can be seen that an SSLSocket was meant to be used if the connection was over HTTPS. However this use of the API results in a request being sent over HTTP instead of HTTPS. The argument for CAs not having correct certs makes less sense here in conjunction with the use of SSL API.

We clearly qualify in the paper that this is not exploitable directly.
500 Partner here: there wasn't any plugging going on here. I'd bet folks at the other firms mentioned will say the same thing as well.
Return Path acquires Context.io
Yep, it also has benefits to the site. AGL is quite generous with his time in terms of accepting static pin requests, but it can become a difficult situation for large website operators. It's a little nerve-wracking to know that the fastest you can make a change is 10 weeks out (the expiration for Chrome pins post-build), and some of those pin lists get pretty long (CDNs, multiple CAs for whatever reason, multiple SPKIs per CA, etc).

TACK is designed to alleviate that pain for the site owner by providing flexibility, and by eliminating even the CAs the site uses from its scope of exposure.
I use 2 512Mb Linodes. One for nginx/PHP, one for MySQL. Putting these on different servers is by far the biggest leap in performance I ever got.

Monthly cost is about $40 ... unless you count my time.
You're confusing performance and scalability.

You can have a slow-loading site that will scale to hundreds of millions of users.

You can have a very fast site that will die under a thousand users.
Not in my experience. I'm still indulging somewhat in things that are wrong for me, but at the same time I've started doing things that are good for me.
Probably the most important use case for such a device is payments / PayPass - does it support card emulation?
15 things I learned at Startup School
Of course the developers are at fault here, but good API design would be to not invite developers to mess things up.

When designing the Curl API, it should have been obvious that VERIFYHOST is likely be set incorrectly, especially once it's used in languages that coerce true to 1.
This is like saying any API is reasonable as long as it's documented. If you read the example, they found numerous examples of people who clearly weren't intending to disable SSL certificate validation who nonetheless overrode that default.
Finding Your Soul Metric
More generally: "when it comes to API design, a good rule of thumb is that parameters will cause bugs."
They do this for New Zealand school students. A truck with a dental clinic inside it comes to the school and everyone gets a check-up.
Agree with you. Didn't we learn from C++ that multiple inheritance is good in theory but in practice a horrible idea? Ruby already lets you be 'magical' in too many ways.
I didn't understand his use of the word caching to mean the same thing as a local git repository, but rather a simple latency optimization; SVN has a "cache" too. He also states that most if not all real computation takes place off the device, in the server. If that's not the definition of a dumb terminal, what is?

If I misunderstood him, well, good, I'm glad we're not so far apart. But I don't think so.
‘cloak of invisibility’ invented by MIT could lead to new era of electronics
"But once a user has signed up, make sure you take them by the hand along the funnel." A few weeks ago, Danielle Morrill of Refer.ly, blogged about a her company's new user onboarding process (http://bit.ly/QZ9cxt). She was apprehensive at first to "hand-old" first time users, but ultimately the strategy worked for getting people to share their first piece of content.

My question follows: What's the rate of returning users that create more than one piece of content when using a hand-holding on-boarding strategy compared to using a very minimal on-boarding strategy? That might be the next step in Gabor's chart.
The fact that this isn't a "10 things..." kind of list says a lot about its quality in the first place.
"Ruby developers need to stop using EventMachine. It's the wrong direction."
50? I will be coding when I'm 90...if people don't code anymore I'll be doing whatever you do to make things.
funny i was just browsing for a new RSS reader.
I got an email a few days ago from Amazon suggesting that I should upgrade my code if I was using one of their several payment code examples. I'm assuming this is in response to some responsible disclosure having happened.

Sent me to:
https://payments.amazon.com/sdui/sdui/about?nodeId=201033780...
I’m looking forward to checking this out once it’s out of beta, but for now, I’m pretty happy with SparkFun and Tindie, and I can see what they’re selling without handing out my e-mail address.
please would ya?
> Named arguments

yes, though it's basically an optional argument hash. AFAIK, you can't do required named arguments without weird hacks, or specifically checking the arguments. For example:

irb(main):007:0> def foo(bar: bar, baz: Object.new); [bar, baz]; end
=> nil
irb(main):008:0> foo(bar: 1)
=> [1, #<Object:0x007fcaa40db4e0>]
irb(main):009:0> foo(baz: 1)
NameError: undefined local variable or method `bar' for main:Object
from (irb):7:in `foo'
from (irb):9
from /Users/aaron/.local/bin/irb:12:in `<main>'
irb(main):010:0>

This hack makes the "bar" parameter required, but only because the value is evaluated when the method is called, and you get a NameError (rather than an ArgumentError).

> Selector namepaces

yes, but it's called refinements. You can see how they're used here: https://github.com/ruby/ruby/blob/trunk/test/ruby/test_refin... (sorry for the link to a test, I'm feeling lazy ;-) )

> Multiple inheritance

Sorry, there won't be multiple inheritance.

> Incremental performance improvements over 1.9's VM

yes, ko1 has been working on removing / optimizing bytecodes in the VM.

> Better compatibility with non-unix environments and small/constrained devices (embeddable)

I don't know of any work on this other than mruby, which isn't MRI.

> Sandboxed VM's (VM per thread)

nope. https://bugs.ruby-lang.org/issues/7003

Other stuff:

* DTrace probes

* Better within ruby tracing https://bugs.ruby-lang.org/issues/6895

I run edge ruby against rails daily. The main incompatibilities I've hit in Ruby 2.0 are what methods respond_to? searches (I've blogged about that here: http://tenderlovemaking.com/2012/09/07/protected-methods-and... ), and the `Config` constant has been removed (which is sometimes an issue for C extensions).

EDIT

Just thought of this for the required args:

irb(main):001:0> def foo(bar: (raise ArgumentError), foo: Object.new); [bar, foo]; end
=> nil
irb(main):002:0> foo(bar: 1)
=> [1, #<Object:0x007fc65a882f48>]
irb(main):003:0> foo(foo: 1)
ArgumentError: ArgumentError
from (irb):1:in `foo'
from (irb):3
from /Users/aaron/.local/bin/irb:12:in `<main>'
irb(main):004:0>

You could probably define a private method like `required` or some such, like this:

irb(main):001:0> def required(name); raise ArgumentError, "missing param: %s" % name; end
=> nil
irb(main):002:0> def foo(bar: required(:bar), foo: Object.new); [bar, foo]; end
=> nil
irb(main):003:0> foo(bar: 1)
=> [1, #<Object:0x007fcfea143338>]
irb(main):004:0> foo(foo: 1)
ArgumentError: missing param: bar
from (irb):1:in `required'
from (irb):2:in `foo'
from (irb):4
from /Users/aaron/.local/bin/irb:12:in `<main>'
irb(main):005:0>