skysight-inc/HackerNews huggingface dataset:
I guess I don't think this was one of those situations, given that eliminating the TSA was not the only issue at stake.
People keep talking about px. Mac and Windows use different DPI thus a reasonable size on one will be too small on the other.

Don't set a font size. Set anything that needs to be set relative to that; H1 is 200% bigger etc.

You have no idea what monitors people are using, nor what dpi they have, nor what resolution they're using, nor what fonts are on their machine.

Everyone can scroll. Not everyone can hit ctrl +, or install extensions like readbility, or install client side CSS.
Switching to node.js from lift/scala
Google Checkout closed our account because of suspicious attempted purchases of our JavaScript ebook, and kept our money.

So… nope.
> perhaps it is a sign that american society still feels guilty over the fact that not sixty years ago large swathes were still arguing against the integration of schools

Smaller swaths of American society are still against the integration of schools, for the record. If you survey and abstract the arguments made, you'll find a lot that have the structure, "If this political action (e.g. bill passes; bill is defeated; president elected, etc.) happens, then our children will be forced to learn that apostasy (e.g. gay agenda, lots of sex, non-Biblical whatevers, etc.)." As has been pointed out repeatedly by pro-gay advocates, this is a verbatim, find/replace repetition of arguments against racial integration.
Strictly speaking, the mechanism is there (Name Constraints, see section 4.2.1.10 in the RFC 5280), but it's not practical due to it not being implemented consistently across all major browsers.

EDIT: Changed RFC number from 2459 (obsolete) to 5280.
I wish there was a tool for auditing root certificates. Like point out which certs are owned by governments, reputation of companies, etc.
The design for your phone would have different sizes from the design that is used for the web. After all, the distance between your eyes and the device (monitor or phone) are different when each device is being used. That means the font sizes need to change. The recommendation is 50 to 75 character per line (as mentioned in a previous comment here).
> but if you're willing to zoom,

:p How about you zoom out? That means you can have normal (huge) text for everyone.
Our doctors certainly already do.
There's not, and that's one of the major flaws with the design of the SSL certificate ecosystem.
Its basically just standard tree-based GP. There's no metaGP in this yet, but its a cool idea.

I think the answer to your first questions is that it depends on the problem and the search space.
Is there a good reason to use Lua? Javascript is pretty much the same and Guile is not only lisp, it is also designed to be used as a scripted language.
What coroutines are you talking about? I was under the impression that Python coroutines were when you use the `yield from` and `.send` features nest generators and to communicate values between them...
I took this class in 2011 when it was still in C++ and as others have said, besides the weekly labs, it had significant amounts of reading, two quizzes and a final exam. This is the probably the class I have learned the most from.
Silicon Valley has been filled in recent years by people who've seen movies like "The Social Network" and read TechCrunch with its myth of the heroic entrepreneur, and have come here thinking this is how it is.

They are emulating a simulation of a startup that really isn't anything like the real startup. It as if Baudrillard's Simulacrum of a startup has taken over Silicon Valley. http://en.wikipedia.org/wiki/Simulacra_and_Simulation

These folks feel they have to live some mythical startup lifestyle and - a particularly hated phrase in my book - fake it till they make it.
I double clicked the "SystemCACertificates" and that seems to have added a fifth keychain to keychain access (it used to display four, I think). That didn't seem too bad, a few Geotrust and VISA items, and a bunch of DOD ones? Well, I guess it's a bit weird to have 20+ DOD certificates there.

(I already used keychain access some time ago to untrust CNNIC, Türktrust and Diginotar earlier)
I loved this presentation. Thanks for all the work on Illumos!
Sure. Once they verify one or more root domain names, the customer can have control over their domain space (subdomains). EDIT: The control is enforced by having the customer issue the certificates via a GlobalSign-owned portal. (Disclaimer: I don't have any inside knowledge of what they actually do, but I believe this to be a reasonable assumption.)

If someone wants to be fully independent, the only way is to accept to be treated as a CA in their own right (and undergo all audits, etc).
Low probability events, which are covered by the (properly secured) paper.
They aren't MITM certificates, they are cross-signs for enterprise deployments. If you run a large enterprise you might have lots of foo.corp.example.com and bar.corp.example.com hosts. A cross-sign would allow you to issue certs for these names that would be trusted by default.

It may also give you the power to issue certificates for any name or, hopefully, it will be name constrained([1]). That's up to the CA however. The CA is taking on responsibility for all certificates issued under these cross-signs when they do this. Mozilla is currently in the process of requiring that these enterprise certificates either be name constrained, or be audited at the same level as roots.

I think Symantec will sell you much the same thing: http://www.trustico.com/material/DS_GeoRoot_0205.pdf

This is one of the reasons that we are pushing Certificate Transparency: http://www.imperialviolet.org/2012/11/06/certtrans.html

[1] X.509 Name Constraints allow an intermediate or root, CA certificate to be limited to issuing certificates within a certain scope, i.e. a domain. https://tools.ietf.org/html/rfc5280#section-4.2.1.10
D'oh! I meant to write "effectively enforces" because I knew you'd snipe me with something like this. You win this time, Ristic.
Water surface physics, as a part of game development.
The Ultimate Bash Array Tutorial with 15 Examples (2010)
How would a product allow an in-house CA to issue certificates for subdomains completely independently of GlobalSign without providing a CA=YES certificate?
Yes, my fault. I actually indeed meant Core and Pro. Totally slipped my mind that Arcade was actually an official edition and had 4GB SSD or something.
Report Blizzard 2013 issues with SeeClickFix
How to Handle a Bad Boss - Businessweek
Probably because I don't describe what I buy as "the very best," which implies some kind of universal judgment. And I think some people reading his essay think he sounds self-congratulatory. I don't think that anyone reading my comment would take it as anything other than an entirely personal pursuit.

Ex: back when Dustin was shopping for pans, he tweeted something like "What's the best cookware?" and I responded that he had to answer what "best" meant for him, because there are many "best" pans — some are the easiest to clean (non-stick), some are the most beautiful (copper), some are the most durable (Le Creuset), some are the most versatile (copper pans can't be used with tomato sauce, you know), some are the best at creating even heat dispersal (cast iron). No pan is the best in all categories. IMO there is no such thing as "best". The world is too complex. And even then some people would say that a wok is easier to "clean" than non-stick because you never use soap; some people don't think copper is the most beautiful (although I do), etc., etc. Like I said… complex.

I've got no illusions that I have "the best" of anything. I may say something is "Perfect for the room" (as I did about my new medicine cabinet), but that's deceptive because there are many things that are "perfect" for the room. They create different effects. I swapped sofas because one was sagging and I was shopping for possibilities without something particular in mind and found several totally different sofas that would have been awesome. I picked only one of them. It's perfect for the room. So would have the other one I liked best.

Looking for "the best" sounds like it could eat up your entire life. I'm positive there are better medicine cabinets out there, even for my purposes. But I didn't find one, and it won't keep me up at night. I had a blast and I love the one I found (and negotiated for).

For me, it's about fun and enjoying what I have.
Perhaps they don't give you the actual cert, but merely issue it, keep on their premises and then let you use it for unlimited signing through some sort of API (that enforces the subdomain restriction)?

Because if they indeed are offering CA=yes certs, that's just plain unbelievable.
I think if you used TC mentions as a proxy for valuation you would overvalue consumer facing products versus say back office, network engineering or enterprise.

Apart from TC bias, it's also a reflection of marketing priorities. A "Foursquare" wants to get in front of everyone, a "Meraki" wants to target decision makers for infrastructure purchases.
Many possible reasons:

- still part of current Windows (unsure about specific code, but 32-bit Win7 still has enough code to run Win3x apps, possible Win8 does but haven't confirmed personally)

- third-party code they don't have full rights to

- trade secrets

- pride

- simply don't care
I did the recent new Java update and it did not come with any Ask Toolbar prompts.
Thanks for the clarification. On a related note do you understand where the X.509 Name Constraints effort sits? Which, if any, browsers implement it? If it's not 100%, do you know why browsers are hesitant to deploy it?
Snapchat Lands $13.5 Million in Round Led By Benchmark Capital
Yeah exactly... it escaped me for an embarassingly long time that this is exactly the same scheme used in Lua. In Python you can create a coroutine, then use yield and send(). In Lua you have coroutine.create/yield/resume. They work in exactly the same way.

It was my understanding that implementing "trampolining" as explained by http://dabeaz.com/coroutines/ in Python 2.5 is basically what "yield from" does in Python 3.3. Maybe "yield from" is more efficient. If anyone has any comments on that I'd be interested.

The PIL book has a few interesting examples of things that you can do with coroutines that are not possible with generators (plain yield). Also there is a paper by the Lua authors called "revisiting coroutines" -- although that was published in 2009, they don't acknowledge that Python has coroutines! They talk about Python's "limited" generators.

EDIT: Sorry, "yield from" is for generators. So coroutines are yield/send(). Generators are yield/yield from.

"yield from" is indeed the equivalent of coroutine trampolines, but for generators.

The right way to think about it is that coroutines are a push-based model while generators are a pull-based model. They don't mix, despite using the same keyword! If you want to mix them you would have to introduce a buffer between them or something. This is somewhat explained in Beazley's material.

And coroutines are more powerful than generators, as explained by the "revisiting coroutines" paper (and which should be obvious if you try to transcribe some coroutine patterns into generators.) Even after adding "yield from", which removed one restriction of generators, coroutines are still more powerful.
I think you are misunderstanding.

First off so there is no ambiguity let me say clearly that GlobalSign's policies do not allow the use of certificates that chain to our roots to be used for MiTM purposes (or other malicious use cases for that matter).

That said there are lots of reasons why a company might want or need to operate their own in house PKI and have that PKI trusted; one easy to understand case is google; though they are not our customer they operate their own in house PKI that they use to issue the many many SSL certificates their infrastructure utilizes:
https://sslcheck.x509labs.com/en_US/sslcheck?host=www.google...

But SSL is not the only reason one might want to operate their own internal PKI that is trusted, other cases include business to consumer and business to business communication (for example S/MIME).

As for how we (and other CAs) go about ensuring trusted root deployments are not used for MiTM cases, there is the obvious contractual obligations that are accompanied by audits but we also were the first publicly trusted CA to use Name Constraints to deploy qualified subordination to these deployments (which has become a requirement now – it was not when we started).

This approach technically limits what domains these enterprise trusted root customers are trusted by mainstream clients for - see: http://unmitigatedrisk.com/?p=24

There are also a set of “Trusted Root” customers who are in the process of becoming trusted by browsers (which can take 3-5 years) where we will cross-certify their root enabling them to be trusted while their own key material becomes ubiquitously trusted.

I should also add that Mozila’s root inclusion policy (as well as Microsoft’s and the other root programs) allow for these scenarios.

I hope this helps clarify, please let me now if you have any questions.

Ryan Hurst
CTO, GlobalSign
ryan.hurst@globalsign.com
"Taught by RTM" == "taught by read the manual"?
Don't worry, they'll find a way. Spending money is ridiculously easy, making money, that's hard.
I posted this further up, but the ideal font size for main body text is supposedly between 50-75 characters per line. The first reference I found was this one: http://baymard.com/blog/line-length-readability but this is a very common rule of thumb
But if they give you the power to issue certificates for any name, how are they not "MITM certificates"?

Also, other people in this thread have commented that the 4.2.1.10 name constrained thing isn't really implemented anywhere?
How to Create a Memory Leak in Java
SHOWHN: express-group (Group express routes and middleware)
"Another role Nathoo takes on with founders and startups is an accounting advisor. She’ll ensure that every company incorporates in the state of Delaware, and if they haven’t done this, she’ll help with that process. Y Combinator and most investors will only invest in companies that have been in incorporated in Delaware, and many founders don’t know this. Nathoo says that of the current class of 47 startups at Y Combinator, only one company’s incorporation documents were problem-free when joining the program."

If Kirsty were willing to publicly share any part of her accumulated knowledge in this area, I'm sure I wouldn't be the only one to appreciate it.
there is dNSName constraints but i don't know how well browsers support it. subordinate CAs seem quite problematic because they are invisible Certificate Authorities at least as far as the user is concerned.
Hey, Ryan. Thanks for clarifying. I only have one followup question.

Do any of your offerings provide customers with custody of an X.509 certificate that chains to a GlobalSign certificate that is trusted by any of IE, Mozilla, Chrome, or Safari where that X.509 certificate has CA:TRUE in its Basic Constraints?

By "custody" I mean that the private key corresponding to that certificate is held in some fashion on customer premises, regardless of the technical controls implemented in the device in which it's held.
Review: Q-See QC808-487-2 - 8 Channel HD NVR - Gadgmatic
It may not be, but I think that is the way it is modeled.
Two comments:

1. I agree that type is typically too small. Even Bootstrap's 14px default, while better than the popular 12px and 11px, is inferior to the browser's default of 16px. Funnily enough, on the website for my new business which I'm polishing off now, I include no text below 16px. The result? It's always readable.

2. I personally have complained of text too large: by default, tumblr seems to have this utterly idiotic notion of treating my 10" Android tablet (with Firefox as the browser) as a mobile browser, applying some extremely strange mathematics and winding up displaying massive text, with a line-height of almost an inch. This results in a page that on my laptop fits in one screen (to be fair, at 16px it'd be a page and a half) taking a couple of dozen screenfuls, with my finger needing to work overtime scrolling. All this in spite of the fact that the laptop's viewport's physical size is less than double that of the tablet's. This article's site is one of an extreme minority that don't break on my tablet. Many WordPress blogs are also tedious; I have come to hate WPTouch. (Admittedly, I don't have a phone, so I don't know exactly how it affects the experience there, but far too many sites on the Internet treat a tablet as a third- or even seventy-ninth-class citizen, actively destroying their site for some reason.)
Lua's runtime is small and easy to embed compared to something like V8. It's also written in ANSI C. I don't know about Guile.
RTM = Robert Tappan Morris, http://en.wikipedia.org/wiki/Robert_Tappan_Morris
How to get More LinkedIn Views from (Owner - Top 1% Most Viewed Profiles)
I took this class in 2008, in C++, and the RPC code definitely felt like a mess.
I expect the Go version must be nicer, plus a fresh rewrite probably helps regardless of language.

Enjoy the course, it's a great one!
"MITM certificates" are those used for the purpose of intercepting secure traffic. Many organisations have the certificates to do that, but are under audits, and technical and legal constraints not to.

That's very different from, say, TrustWave, who issued such a certificate with full knowledge of what it would be used for.

I agree that this isn't the best of situations. Certificate Transparency is the best answer that we have, but it's going to take a while to deploy.
Because I have glasses the nearly thickness of coke bottle bottoms and no problems with small text, because I didn't wait decades for high-res displays that don't flicker just to throw the resolution away again, and mostly because I don't really look at individual letters as glance across them when reading a normal text with known words, so for me smaller fonts allow scanning larger chunks more quickly, and parsing words and phrases in chunks as well, while moving the eyes back and forth and scrolling a whole lot hinder me from simply absorbing the text. In short, because it's more efficient for me and there are bound to be people for whom it's the same. Because designing for my own actual eyes strikes me as honest or something.
Well, I rarely have to deal with these things directly because it mostly falls to Langley and Palmer. But anything involving the CAs always feels like far more work than it really should be. Both Mozilla and Chrome have root certificate inclusion policies that clearly outlaw this kind of behavior (assuming I'm reading correctly), but the CAs have operated for so long without any transparency that many of them are less than consistent on compliance. So, when we find violations we make them fix it, but it's a painful process because the mess is usually bigger than it appears on the surface, and you don't want to break all the innocent sites that are relying on the CA.

That said, I feel like our team and Mozilla's are making some real progress here on a path toward a far more transparent and reliable CA system. And things like pinning and reporting are useful both as stopgaps and longterm tools for more security conscious site operators.
[3] http://www.nasa.gov/mission_pages/msl/multimedia/pia16230.ht...
I wonder whether http://csslint.net/ would be receptive to the idea of warning against a font-size declaration on html/body which led to smaller-than-16px text?
MIT Startup Career Fair
Google execs building $82M airport to house their private jets
Can you expand further on the practicality of the Name Constraints extension? My understanding is that not all browsers/libraries enforce them and IIRC, that certs that use them may not work in some browsers?
The point is Java is open source...
Name Constraints support is pretty good in modern certificate libraries. It's certainly in CryptoAPI these days which accounts for the bulk of users.

But there are two ways to use Name Constraints: they can be marked critical or non-critical.

Critical Name Constraints are great, but they will cause anything that doesn't support Name Constraints to reject the certificate. This is obviously a problem because few deployments have much control over their client base.

Non-critical name constraints provide a security benefit to clients that support them without affecting those that do not. Clients that don't support them are vulnerable to misuse of the constrained certificate, of course, but since the alternative is often an unconstrained, CA certificate, it's still a clear win.
Looks pretty clean and concise, yet reasonably readable. Cool to see this kinds of language demos.
Shooter Boys and At-Risk Girls
No home-owners in this thread? I'm thinking roof and gutters.
Kirsty is one of the most amazing people I have met while at YC. Low profile, high impact.
> Exhibit A: Wall Street investment banks.

Then you're thinking of the top 0.01%.

The people right at the 99th percentile are still considered peons by Wall Street investment banking standards. And the kind of money that puts you at 1% (about $500k annually for a household) isn't enough to get you special access to powerful politicians. That costs a lot more.

I agree with you that we have a corrupt elite. But I prefer we use realistic statistics in defining them. The people right at the 99th percentile are not the problem.
(Copying this reply of mine from another part of the thread as you're not the only person to ask.)

Name Constraints support is pretty good in modern certificate libraries. It's certainly in CryptoAPI these days which accounts for the bulk of users.

But there are two ways to use Name Constraints: they can be marked critical or non-critical.

Critical Name Constraints are great, but they will cause anything that doesn't support Name Constraints to reject the certificate. This is obviously a problem because few deployments have much control over their client base.

Non-critical name constraints provide a security benefit to clients that support them without affecting those that do not. Clients that don't support them are vulnerable to misuse of the constrained certificate, of course, but since the alternative is often an unconstrained, CA certificate, it's still a clear win.
so use openjdk?
What about wear and tear charges at the end of the lease?
A simpler solution would be to set the "Minimum Font Size" setting in Firefox's preferences.
But - is there anything inside these certificates that identify to a browser what the "intended purpose" of a given certificate is, and prevents such a CA from being used for MITM attacks? How would a regular browser such as IE or Safari act when presented with a certificate for "bank.example.com" signed by such a CA?
Beauty Reviews, Product Reviews, News from Daily Beauty Reviews
Professor Not Equal to Magician
Cool! using as standalone for now as it evolves no plugins needed (http://hidra.koding.com/ripskimhn/)
The whole list of things you added is a step BACKWARDS from the iPad and Android Tablets.

It means relying on old desktop paradigms and having a sub-par tablet experience. If you want to run Windows and it's software on something portable (which, by the list you provide, you do) get an ultra-portable. Even a MB Air will do.

But if you want a tablet, get a real tablet, that pushes the envelope forward for how to work on that form factor.
Overwhelmed by Startup Life?  There's a bfeld book for that.
No, it'd be like wearing a thin layer of very smooth clothing. The effect is only seen very close to the surface
I have doubts about depreciation playing any significant role here (Edit: in profitability of lease vs buy.) No free lunches - who covers the depreciation when you lease?
the irony of peddling the Ask Toolbar to users without ever asking them if they want it.