skysight-inc/HackerNews huggingface dataset:
Unfortunately these days it's either painfully slow or painfully expensive. Individual disks have been able to outpace GigE for years, even ignoring SSDs and modest RAID configurations, and 10GigE isn't exactly sprinting full pelt into the general market, with cards starting at around £300 and the less said about the switches the better.

It's very lame how I can pump out >400MB/s locally on a cheap NAS with some old spare HDs, but can never get more than about 80MB/s out of it over SMB. Thanks for helping make my backups take about 4x longer than they should, Ethernet.

I'm half tempted to give a second hand InfiniBand setup a try, seeing as 10Gbit cards can be had from about £15.
Actually Mobile Safari does not do this. It simply has: double tap on an element, and it zooms such that the element's width matches the width of your screen.

No reflowing is done. It may not be of much use; when I do this on HN, it only zooms in by a few percent because the elements already stretch most of the way across the screen. You are taking a magnifying glass to the page when you do this, NOT changing the layout to fit the screen and reflowing all the text.
You don't have to make fonts larger, just give me a way of increasing the size without either destroying the website layout or making the site that much more unreadable. I would like more flexibility and less rigidity. More times than not I have been plagued by text hiding behind a side-bar, narrow containers constraining the sections like a straw, and/or the layout breaking completely in the process.

I'd like to see less designers make presumptions about their audience. While ignoring a smaller section of their audience is fine when the "fix" is hundreds of man-hours away and many dollars burned, this situation is completely rectifiable within short time-periods in most cases and little money spent. Being responsive to your audience isn't a slippery-slope into dystopian large-textinship; it's a way to treat all of your visitors without leaving any wanting of a good experience.
I agree. It would be nice to know his exact contribution.
"People who are actually from Gangnam never proclaim that they are—it's only the posers and wannabes that put on these airs and say that they are "Gangnam Style"—so this song is actually poking fun at those kinds of people who are trying very hard to be something that they're not."

—PSY (via http://travel.cnn.com/seoul/play/interview-psy-gangnam-style... )

You're completely right. Every culture has this, and such people can be either dangerous or profitable -- depending on whether they're wasting your money, or spending their money in ways that benefit you.
Happy Birthday? Today, the Mac App Store turns 2.
>"Whoa. Why so many on leases?"

Because leasing is a pretty efficient system that can be economically superior to buying an asset that depreciates like mad the instant you sign the papers?

Leasing isn't reserved for people who can't afford to buy a car, just like renting isn't reserved for people who can't afford to buy a home.
I'm wasn't being dismissive. I'm not suggesting what IBM has accomplished is trivial... what I'm saying is, doctors can't use Watson to do their job; it's just another diagnostic resource... As opposed to being a harbinger of the coming robopocalyse (as some people seem to be suggesting)
Rapid Prototyping with the Pages Panel in Fireworks CS6
Adobe Fireworks CS6 is an ideal tool for creating prototypes. I want to share with you in this article is the Pages panel.
Classroom Technology Faces Skeptics At Research Universities
People often underestimate how important the "back office" things are and how much help you get from an incubator. Apart from Kirsty, we've gotten a great amount of help from Jon Levy (YC lawyer) on legal stuff and of course Kirsty who's always sending us e-mail reminding us of taxes etc.
Weak sauce because it's untrue, or weak sauce because the author and/or his cohorts are allegedly part of the same group he's criticizing?

I think the term "ballers on a budget" is often inapplicable to the types of waste and inefficiency I observe in the tech scene. My take is that the author thought this was a clever term and tried to relate it to something he knew about, but it doesn't really fit.

I propose the term "idiots with no idea what they're doing with their investors' money" since that seems to fit better to the types of people the author is trying to talk about.
Thanks! Stupid of me to miss that.
Just to make sure I'm not confused. I can purchase a root certificate from this company? And this certificate will be seen as valid by the major browsers?
My wife was an underwriter in the sub-prime mortgage industry. She worked for three companies, and they were all pretty bad. At least a few times a month if she turned down a loan for not meeting guidelines, she would have a loan officer standing at her desk screaming and swearing at her.

If they couldn't browbeat the underwriter, then half the time the company president would override the guidelines. The guidelines themselves were a sham. They were written in house by people with no particular expertise, then rubber-stamped by investors on Wall Street.

In the trenches, everyone knew there were bad deals. They were just making too much money to care.
Since this comment is pegged to the top of the thread and is strictly inferior to the 'agl comment below it, I think you should downvote this one and upvote his.

I feel like I have to be misunderstanding something about this page and the attached data sheet, because it seems to be promoting a service that directly contravenes Mozilla's policies: you're not allowed to use CA=YES certificates to enable enterprise MITM tools.

Furthermore, minting certificates for a large and growing number of popular web properties --- which is something you end up doing almost immediately when you set up enterprise web proxies --- is a good way to get noticed by Google's SSL/TLS team and shitcanned from Chrome. That's a consequence of Google's certificate pinning regime, which operates incidentally as a kind of surveillance network for certificate forgery.
No issue here; I'm running Chrome 24.0.1312.57 on 64 bit Linux
I seem to recall Elliot Spitzer going after Merrill Lynch over nearly identical doublespeak back in 2002. Old news indeed.
Can you share only the browser tab or even what happens on your desktop? Does it use VNC?
On my 15" retina MBP at 1920x1200 it looks perfect. That said, most people run lower resolutions. I think it would be far too big at anything less than 1920x1200 or on a bigger display. A font size of 20px is too large for most users.
Ha! Will do :)
Some machines use 75 dpi, others use 96 (96? 92?) dpi.

It's hard to get font to be the same size on windows and os x.
Leasing might beat buying new, but if you buy used the depreciation works in your favor.
Depending on the font size, 600px gets you pretty close to the ideal of 50-75 characters per line: http://baymard.com/blog/line-length-readability
Does the 100 miles apply to ocean borders too? If so, that puts entire cities like NYC, SF, LA, etc. right within this exclusion zone.
I would like more flexibility and less rigidity.

I completely agree, and I guess I'm in the clear then... I religiously believed in fluid layouts way before responsive web design and whatnot where even concepts. It's just that I like the default "more tight" than what seems to be the preference of many, reading these posts - but if you're willing to zoom, I'm willing to make that as painless as possible :D
This is the point the author seems to be ignoring. Most users don't have high res displays. Your font size should work well for the majority of your users.
Yeah, I'm reading this the same way you are. I guess Monday is going to be another fun day at the office.

Edit: Apparently this is the enterprise cross-signing use case. So, ideally they're using name constraints and their issuing policy would need to comply with the browser and OS root CA policies.
Even more fun is when you buy a car for $17k cash new, 11 years later it's still "worth" north of $4k, but you own it outright, it's reliable and doesn't break down, and costs you basically gas (money/miles) + oil changes to operate it and statistically for the make and model has about another 80k miles before it's expected to start needed expensive repairs. At my rate that's 8-10 more years.
"I am, at heart, a nice person" and yet you want to kick him out of the company...right.
Something doesn't add up.I just have that feeling that your hiding something.And why can't he find a job if he is as good as you say he is?
I will stop right there cause there are too many holes in the story.
Cool implementations of Fibonacci
@pcwalton

Thanks! quite interesting use case for Rust.

May I ask you - was it your side project or did you actually work on this at the office?
Star Wars Traceroute - How I did it
I would bet that, in 7 days or less, either this link will be dead, or they won't be...
You sound ruefully sarcastic but I have to say that the prospect of a week of political and logistical wrangling to get the most powerful tech company in the world to stomp mightily onto the forehead of a rogue SSL CA would absolutely get me out of bed bright and eager. I sort of envy you!
For that reason, I prefer to explicitly list the ciphers to be used to avoid situations like this or when OpenSSL decides to modify its cipher list.

FWIW, this is what I use:

ECDHE-RSA-AES128-GCM-SHA256:AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-S
HA:RC4-SHA:AES128-SHA:AES256-SHA;
Is this against some sort of rule? They're allowing their clients to run their own delegate CAs, this can be very convenient for sysadmins. I'm not sure what's bad about it, or what new attacks it enables.
I agree with you on pretty much all points, but it's still sad.

Still, though, if we're talking about seeing the world in a realistic manner, a group of people who lost a mascot, one of their own, will not be able to hear your message. And Aaron really was a mascot. Most of the people who feel affected by his death didn't know him and weren't even particularly touched by his work during his life. It doesn't make it less sad, though.

You won't be able to convince them of anything, because they can't hear it right now.

With his death, Aaron became an icon, and anyone can attribute anything they want to him to make his life and death personally meaningful to them. Sadly the complex, troubled individual is mostly lost in this hagiographizing. I thought the Slate piece was the best and most nuanced thing I read about him so far. It jived with what I knew of him personally.
Source on the confirmation?
D.C. Treats Celebrities Better Than Veterans with Gun Laws
It could be one of those bugs actually, as I don't think the manufacturers use the latest version of the reference code. Probably they use whatever version was available when the project was started or whatever version the programmers are comfortable with.
> for issuing SSL Certificates for their own domains

If you can only issue certificates for your domains and subdomains, then it's not an issue. This sounds more like an alternative to setting up a Windows Enterprise CA and then distributing the root cert to all of your non-Windows clients.

e: Think of it like this: instead of just giving you a wildcard cert, they're letting you make individual certs for your subdomains yourself.
I always get a mild wave of depression after reading stuff like this, because of how absolutely much I do not know.
Nope. But I am reading it on a 1280x800 tablet in portrait mode. Or I have two side by side 0n a 2560x1440 monitor (effectively 1280 px wide each). Or even worse, two side by side on a laptop with 1920x1200 (960 px wide each). 600px makes all of the above scenarios doable with reasonable margins and other layout items like a navigation menu and ads.
They should make supreme court justices try to drive across the Mexico border once per year.
Totally deserved article, Kirsty is amazing.

There's a story in the article about Kirsty meeting a founder with a wad of cash at SFO. She did exactly the same for me when I arrived: waiting at the airport with a check so I could pay rent my first day in MV. Except this was on New Year's day, and my flight was delayed two hours. Thanks Kirsty!
I don't own one, but what is it's footprint like with the keyboard and kickstand? Compared to other laptops?
Unless I'm completely mistaken, running a delegate CA means you can MITM any SSL site on the internet.
There is no mechanism in the TLS X.509 PKI that enforces that rule. If a product promises transparent trust for any sort of customer-selected domains, it is either lying or selling the cryptographic equivalent of plutonium.

There have definitely been attempts to build products that use technical controls in the CA product to enforce the restrictions --- ie, the customer gets a locked down box that tries to make sure it isn't misused --- but as I understand it, these are no longer OK to sell.
If you get down to SV I highly recommend connecting with the folks at SiliconHouse http://siliconhouse.us/ It's a great program and they are super connected around SV & SF. Let them know Bradley sent you!
Yes, but that's precisely the definition of what a meritocracy is not.

Here's the thing: do you want to stack the deck so that only your children have such favor, to the extent you are able, or do you want to stack the deck so that all children have such favor, again to the extent of your ability? Yes, of course, if it's an either-or choice then you'd go with your kids. But if you weren't forced to make such a choice, which would you go with?
Yep: http://www.aclu.org/constitution-free-zone-map
C is also pure. After all, C code is just data until it gets compiled and executed. When and how often this happens is irrelevant. You could write a C interpreter in Haskell, and then your C code would be as pure as anything else in Haskell!
Ironic, someone known as being so helpful within YC is known as the Doombringer outside of it
It's a side project.
Looks like a reimplementation of Wouter Swiestra's work on a functional model of IO,

http://www.staff.science.uu.nl/~swier004/Publications/Beauty...

Author = {Wouter Swierstra and Thorsten Altenkirch},
Booktitle = {Haskell '07: Proceedings of the ACM SIGPLAN Workshop on Haskell},
Title = {Beauty in the Beast: A Functional Semantics of the Awkward Squad},
Pages = {25--36},
Location = {Freiburg, Germany},
Year = {2007}}
Well, no, because they don't want to just publish articles, they want to publish peer reviewed articles. And the really pivotal point is that journals don't even pay the review boards.
I don't agree; the core of array paradigm is vectorisation, as started in APL and continuing in Fortran, J, K, lush or R.
The idea that it has something to do with matrix algebra is wrong -- MATrix LABoratory is simply an orthogonal story.
A-m-a-z-i-n-g and they dare not even suggest that what they are doing may break each and every "normal" chain of trust.

Astonished, you would hope this would be sent in covert emails or just suggested to chiefs etc. but man ON THE INTERNET!

Look: we sell these FBI badges for use in your business whenever there are some policy issues... your personnel will trust the wearer!
You got what you deserved. Leaving 200k, or any amount of money in paypal? Have you completely lost your mind?
Aww... I don't understand why this got flagged.
Great news but this entire situation is still a cluster-fuck.
> In short, there are no common non-development desktop applications or task profiles that require Java.

Minecraft.
Greater-fool paradise
First Wasteland 2 gameplay footage released
Looking around San Carlos, there are entire stretches of houses going for $1.5 to 2mil.

This are for houses that in my mind, are the idealization of the American Dream. 3-4 bedroom, nice yard, 2 car garage. Not the McMansions of lore.

Taking that same amount of money and going to say Texas, would likely yield a ridiculously large house.

But more importantly, I keep wondering, are there really that many people around me that make so much money to be able to afford this without blinking an eye or is it more just keeping up with the Joneses....
Yes, and it runs just fine on both the iPad and my iPhone 5. Sorry for the confusing terminology. I remember the time everyone would do that kind of thing in a Java applet.
Oh my God he made it in a simple text editor using copy and paste. Mind blown.
Oh. That makes sense, thanks. Is there no way to restrict a CA cert to only be able to sign certs under a particular domain name/CN?
If you (or any San Franciscan developers/gamers) would like to visit Goodreads, you should come by Tuesday night for our startup game night: http://www.eventbrite.com/event/5047240432/estw
> Rich people can lose wealth far faster, and far more easily than poor, trust me.

I don't know you, so I can't; can you provide numbers, or at least an argument with some intuitive strength, rather than just asserting it?
No, but he is a police officer.
Yes, but then I need a TIN. And a US address to activate the stripe account. Creating a US LLC corporation is a big problem because the legal/tax implications... but probably my only rute right now...
Not that I know of (and tptacek seems to confirm the same elsewhere in this thread)
I've had a Macbook Air for a while now and my problem with the Surface is simply that I've never once desired to have a touchscreen on my little laptop. The large trackpad and keyboard are superior to a touch interface in almost every way for me.

I have an iPad that my parents got for me, and I struggle to force myself to use it because the entire touch interface seems inferior. Every time I lay down in bed with my iPad, I end up regretting it as soon as I have to type anything or use a website that doesn't have a really well-engineered mobile version or iPad app.

The touch interface seems ideal on much smaller devices, like phones, where it's not even remotely feasible to have a keyboard and a trackpad. I personally don't understand the desire to transfer it to larger devices, though.

The one major saving grace of touch-centric devices like the iPad, IMHO, is that it has made computing and the internet more accessible to people who otherwise wouldn't have learned to use traditional interfaces for whatever reason.
What I think most fascinating about SnapChat is that we've always assumed that having a permanent online record was a byproduct of sharing. You know, that drunk tweet or party picture on FB could come back to haunt you years later. But what if SnapChat makes us demand that all posts expire unless we demand they stay?
Video: http://www.youtube.com/watch?v=nPJELwSV1P0
touché ..
https://wiki.mozilla.org/CA:Problematic_Practices#Allowing_e...

And from https://wiki.mozilla.org/CA:SubordinateCA_checklist

"Third-party private (or enterprise) subordinate CAs: This is the case where a commercial CA has enterprise customers who want to operate their own CAs for internal purposes, e.g., to issue SSL server certificates to systems running intranet applications, to issue individual SSL client certificates for employees or contractors for use in authenticating to such applications, to issue SSL certificates for pre-approved domains that are owned/controlled by the customer, and so on.

These sub-CAs are not functioning as public CAs.

For these sub-CAs we need assurance that they are not going to start functioning as public CAs. Currently the only assurances available for this case it to ensure that these third parties are required to follow practices that satisfy the Mozilla CA Certificate Policy, and that these third parties are under an acceptable audit regime.

In Bug #394919 NSS is being updated to apply dNSName constraints to the CN, in addition to the SANs.

We plan to update our policy to require CAs to constrain third-party private (or enterprise) subordinate CAs so they can only issue certificates within a specified domain. See section 4.2.1.10 of RFC 5280."
Should IT recruiters learn how to code? Well, sort of.
LOVE seeing stuff about Rust.

I'm at a junction where I've been using Scala happily, but it falls down for numerical work because it can't call C libraries using large arrays without copying, because of the different memory layout used by the JVM vs. C, which really hurts for large data.
Gotcha, if the technology isn't in place to properly restrict the issued certs to only the customer's domains, that is bad.

I saw this on another site discussing Trusted Root certs:

> What is required to get a Root Signing Certificate?

> Each certificate provider has different requirements for trusted rootsigning certificates. Most will require something similar to the following:

> - Substantial net worth and insurance

> - A Certification Practice Statement (CPS) outlining your exact policies on issuing and managing certificates.

> - A FIPS 140-2 Level 2 compliant device to generate and managing your root certificate keys.

So it sounds like they are handing out the keys and then hoping that auditing/policies/insurance are in place to cover themselves.
You won't be don't much with solidworks or autocad with the crappy intel 4000 graphics card nor will the battery last anywhere near the 10 hours of the iPad. The surface pro is stretch between a laptop and a tablet and ends up as a master of none

EDIT:will we ever see any numbers from Microsoft or will we always be stuck with the amazon style multiplier?
Cold Steel Trench Hawk Axe
Lol, HOWTO ssh.
This seems like the fastest way to become untrusted by every browser.
Kirsty is amazing. I was surprised to learn (when she became a partner) that she wasn't always a partner.
I'm surprised there isn't any answer to this, after seeing the heavy (and undeserved) criticism to Dustin Curtis for his post, The Best: http://news.ycombinator.com/item?id=4755470
My guess is it that, with this service, GlobalSign will create a sub-CA, but retain full control of it (i.e., own the key), issuing all the certificate themselves. Because of that they will be able to ensure that the customer owns all the hostnames.
If you feel uncomfortable about this trust decision made for you by OS
X, I would suggest taking a peek at the entire set of trusted root
certificates in /System/Library/Keychains/ (note that Keychain Viewer
hides one of them from view by default, so run:

open /System/Library/Keychains/*

from a shell).

I don't run OS X anymore, but I was not happy with what I saw at the time.
see https://news.ycombinator.com/item?id=5192990 for a different submission.
see https://news.ycombinator.com/item?id=5193368 for another submission.
(I was just kidding/being sarcastic, I hope you are too, Kirsty is great, never thought of her as a 'doombringer')
Sometimes, when faced with a terrible set of game theory circumstances, the only winning move is not to play.
What is the point of having this "mini-language"?

What would happen to purity if I hit ^D?)
The real problem here is column width--magnifying doesn't help if the column width is screwed, but it seems nobody gets this on the web for some reason. Why, in 2013, don't people understand that really long lines of text are difficult to read?
The data sheet says that the product allows in-house CA's to issue certificates "completely independently" of GlobalSign.
ok, this might be a weird question (as in "hard/impossible to answer"), but how are they possibly going to spend 13.5 million reasonably?
If I am not mistaken, that is exactly what they are claiming (albeit stressing that they are issued to be used for subdomains) but others have pointed out that that limitation is unenforceable (i.e. inexistent).
Its the same old fanboyisms, brand loyalty, hivemind hatred all mixed into one, ie a weakness of human trait to look at things subjectively. Remember when Nexus 4 got sold out? You din't see comments like "ohh look they intentionally put < X units as a marketing strategy".

Never make a hivemind decision the sole reason for buying or avoiding a product. Try them first, be it chromebook, macbook or a windows ultrabook, you will be surprised how reality differs.