skysight-inc/HackerNews huggingface dataset:
Thank you for the link. I find it very explanatory for me and a nice resource to explain to others what TOR and HTTPS can protect from.

I understand that using HTTPS through Tor can provide to NSA your rough location (entry node) and the site you are browsing to. But your user name and password will be safe (assuming that NSA cannot hack HTTPS). Using HTTPS only can provide the same information to NSA as the HTTPS+TOR, so for httpS sites Tor does not provide extra security against NSA?

If my understanding is correct then Tor would provide only value when using Tor services, aka onion sites, but not when using public Internet services?!

I would appreciate if somebody could provide their expertise on this.
Yeah. Just like the previous one. Just like a tornado, supervolcano or asteroid hit or HFT system genarting losses. Non-zero but close to zero for some definitions of close.
I just tried to see if this bug exists in OsmAnd+ but couldn't reproduce it. In general, it is a tight and stable app. Give it a try. There is a free version which is as good as the paid one.

Edit - here is their git repository: https://code.google.com/p/osmand/
Amazon does have certification by said agency.
Next Bond car?
Can someone enlighten me, what is going on with NSA these last days (besides Snowden of course) ? I hear about new leads that they can break mainstream internet encryption methods. Is this true, and if so in what level? What about open source encryption?
The notion that we can secure ourselves from disease through immunization is clearly valid for the subset of known treatable diseases.

With pure untamed conjecture, I suspect, however, that the behavioural and psychological effects of the greater population's immunity to such diseases serve primarily to reinforce the modern 'medical miracle' that may, longer term, in fact leave us in a state of reduced immune performance and an 'immune monoculture', due to unnatural lifestyles and living environments, relaxed psychology, and a lack of exposure within the general population to the range of natural challengers that we once had.
I see. I surely knew about this but I failed to make a connection to it. How is it bad thing?
You have made an implication, without basis, that the immunization policies in the US are "unconditionally pro", or at least that the people here are "unconditionally pro."

This is not the case. Read any of the CDC, NIH, or WHO history of vaccinations and you'll see the reasons for the decisions. You'll see the numbers of how much it costs to vaccinate, how much it costs to treat, the likelihood of disease, the likelihood of death, and the effect of side-effects. You'll see research to reduce those side-effects, like improved treatment methods for those with egg allergies.

You'll see treatment policies change over time. The polio vaccine in the US use to be the more effective Sabin vaccine, which used attenuated vaccine strains that occasionally mutated to a more virulent form that gave 144 known cases of vaccine-associated paralytic polio (VAPP) between 1980 and 1999.

Since polio doesn't exist in the US, we switched to the deactivated form in 2000. This isn't as effective, which is why there's now one more shot in the vaccination series, but the old treatment, if continued, would have been deadlier.

There has always been a policy to allow people to opt out of vaccines, usually for religious reasons. (The last outbreak in the US was among Amish groups. The virus came from the Netherlands.) A reason why is because there will always be resistance to any mandate, and vaccines don't require 100% coverage to be effective in a population. It's better to let a few not be vaccinated than to use the indiscriminate and blunt threat of government intervention against them.

This means the CDC and others have to be very cautions and sensitive. For example, even though there's no evidence that mercury preservatives in vaccines cause side effects, you'll see that the vaccines were reformulated to remove thimerosal. The general policy is to minimize objections to the process, and not to force people to comply.

This is absolutely not an "unconditionally pro" policy, so you are downvoted because you're speaking out of ignorance and a blithe appeal, as jlgreco rightly points out, to an argument to moderation.
Did you participate in YC though?
I don't see your main page (as well as blog) mentioning YC at all.
Question: Is ngingx good for serving APIs as well. I read lots of places thats its best for serving static contents...I got to serve REST API built using JAVA.. response would not exceed 1KB.. Should I put nginx in front.... short, bursty and highly number of concurrent requests.. Is nginx best-fit for API serving....
Sorry, it seems like there was a misunderstanding. It takes this on writelatex.com, not my local machine. There it's a normal 7-8 seconds. Just text and about 50 png/jpg images.
You just dropped bunch of facts like they mean something. Task for you: list 5 top countries by assets owned by their citizens with percents. Show those numbers taking into account population size.
That would be pretty bad proof though. If you ignore the chit-chat, which is just the authors writing style, and the ugly colour scheme, the essential part is here: http://www.apachetutor.org/admin/reverseproxies#d13

That's 26 lines of configuration, compared to the nginx example, which is 54 lines. Both are kind of arcane looking, if you haven't used it before.
Not quite. We don't allow general warrants so a court order to decrypt all internet traffic is not Constitutional. If the NSA was snooping on anything and everything with a warrant, that is no different than what is happening, and it is not Constitutional (particularity requirement not met).

What is the problem is the NSA doing this sort of blanket surveillance where a warrant is normally required but where they make an end-run around the Constitution.

We require warrants because we require magistrates to require particularity in the warrant.

But it gets worse. What will come out of this is a massive market for more secure communications, much of it designed to thwart this sort of surveillance. The NSA by not respecting our rule of law has now encouraged people to do exactly what they are afraid of and in the end, wiretaps will now go dark. The NSA broke their end of the legal bargain and now the entire government will pay a price, and that price will, no doubt, impede legitimate law enforcement efforts as well as this.
Regarding Java, it is not about the language per se, but over-engineered pattern spaghetti frameworks.
I don't recall OsmAnd{,+} ever freezing. On the other hand I have a beefy phone (Galaxy S3) so it's possible that a phone with a less powerful chip would have trouble rendering.

Edit: Just tried it now and I can zoom out to the whole of Tokyo (and in fact wider) no problem.
It's almost like we can predict such things. Except we can't. But he making this claim makes me worry. Maybe he knows something.
Probably not very. The Arduino uses hardware serial and a USB-to-serial chip to communicate with the PC, whereas this has no hardware serial or USB-to-serial at all and is missing various peripherals.
As a minority, and especially as a minority that hikes, I hate these kinds of articles because I feel like their intent is to perpetuate White Guilt. Inequality and racism is bad, but you shouldn't feel guilty about not being poor. (These kinds of articles also conveniently love to forget about poor Whites and instead assume everyone who is White is affluent)

Like most articles, they fail to mention Asians. Once again, it's always Blacks and Latinos… Asians make up 4.8% of the US population, yet make up 8% of hikers. If you're Asian, you're nearly twice as likely to go hiking!

Blacks make up 12.6% of US population and 11% of hiking population. Latinos make up 16.4% of general population, but only 7% of hikers. Lastly, Whites are 63.7% and 70% respectively.

I don't know about you, but these numbers seem to follow general demographic percentages. So why was this article even written?

Every time I use a public city/county park, I always see giant groups of Hispanics and Asians. In fact, I always comment on how it seems like only first generation minorities like to take advantage of these services. (Which is a shame because local parks are awesome) I suspect that second generation minorities are enjoying their large house and fancy grill in the suburbs instead.
Nope, you should still validate your input. The correct thing to do is the validate that the input is semantically valid rather than syntactically valid. If they enter an address, try looking it up. If they enter an email, try sending a confirmation email. If they enter a phone number at least see if you can find it in a phone number DB.

Customers and users do have an interest in getting their shipping details correct. Help them get it right rather than telling them they're wrong.
> The problem is that companies don't exist in a vacuum, and soon as one adopts these marketing techniques, everybody has to adopt to "stay competitive"

I was wondering the same thing, although Searls takes an example of Trader Joe's and tries to illustrate how avoiding marketing actually helps this business. I'm not from the US, so have never heard of Trader Joe's. I can't help but wonder how competitive it is compared to other businesses who do employ those huge marketing / big data operations. I am also curious how the customer experience itself differs between companies in this market.
While this inversion of the usual prescriptivist argument for "GNU/Linux" is amusing and interesting, I feel it's worth stating the more general objection as well:

It's called Linux because we call it Linux. That is how language works. It doesn't matter about the official name or the etymology, if the population typically uses a certain term for something, that is the "correct" term.

Now there are lots of arguments for preferring an atypical term in some situations. Official names in more formal contexts, genderless nouns to avoid excluding people, and indeed "GNU/Linux" to promote the GNU project. But these are choices we make, and are not something to be forced on people who don't necessarily agree with the reasoning behind them.
We're not being very productive here, are we? I could nitpick your comment just now but it wouldn't change your mind either.

You think I'm an idiot. Possibly you think I'm a liar.

I don't think you're an idiot. All I can do is point out that I looked at the numbers, I've tested various strategies or tools (and adopted most of them), I referred the problem to the experts, and this is where I've had to go.

So let's just ignore each other from now on.
The Windows MetaFile Backdoor? [2006]
> And allowing parents to deny their children vaccine that may save their health and life and health and life of other children is all fine?

Well I would say no. I am in favor of giving all children vaccines, with or without the approval of the parents.

As I said, the ethical problems are around the children. If adults want to opt themselves out, then I am perfectly cool with quarantining them in colonies and refusing them medical treatment. However they should not be permitted to drag their children along in such madness.
They do mean something, and are in fact worrying.

I presume that the HN crowd will understand why, otherwise I'll gladly explain.
I think it's south Wales that copped the worst of it. 1,219 cases of measles, 88 hospitalisations and one death.

http://www.bbc.co.uk/news/uk-wales-23168519

National newspapers are very much involved. Journalists like to present two sides of the story as equal rivals for "balance", even when one side is science and the other is paranoid quackery. When it comes to public health, this is a disaster.
I don't think this is a good argument against input validation, though it's a good argument against incorrect input validation, of course.

A few things that seem missing from this critique is the idea that shipping and payment aren't just human mediated processes.

With most ordering systems payments and shipping are directly integrated using external APIs, and if you pass garbage data out to those then you will fall into the trap that professionals call "really fucking everything up", which is undesirable. Processing payments typically requires a name and an address, as does shipping. That's not much of an excuse for not doing proper input validation or accepting non-ascii input but it does help to explain why the problem isn't a trivial one. If users are just sending you cash (or, say, some sort of gift-card code which might as well be digital cash) and you're just hand labeling packages and taking them to the local post office that's one thing, but that's not the way even very tiny businesses work today.
Yes, it's an unethical, poisonous, money-grabbing pattern that should be banned but aren't there enough folks on HN that are actually making money off of something like this? Talk about the many scraping, passive-income, etc. threads.
Ask HN: Feedback for small Python DB
Hey HN,

I've written a small database in pure Python called TinyDB. Could you give me some feedback on it? I'd really appreciate it.

Docs: http://tinydb.readthedocs.org/

GitHub: https://github.com/msiemens/TinyDB
I, for one, really appreciate your work (and anyone else who contributed to docs of course). I remember the days when we had to figure stuff out just by looking at other people's config files. I think I even got some of my earliest SO points just from posting sample nginx configs.
Translation: the probability of another financial crisis is close to one. When I consulted at MS, the quants set the probability of a default at one of their counterparties to be one event in 250 years. Perhaps we witnessed a very low probability event. Or their models and estimates were wrong.
His blog (http://www.badscience.net) is also very good and he writes for the Guardian.
I think part of it is that he's unable to assert himself with "organic" women. I agree that he has control issues, but I see it stemming more from his history of feeling out of control with his previous partners.

He's unable to handle the unpredictability of a relationship with another person or the lack of control over their actions, so he resorts to dolls who can never question him. The fact is that the article scares me a bit, since I can totally see a lot of people being attracted to dolls to escape the maturity, responsibilities, and skills needed to deal with real people.
Pg, Our 4-month-old startup is incorporated in California.
I've heard that most Y Combinator startups are incorporated in Delaware. Is it necessary to reincorporate in
Delaware if selected for the W2014 program? Thanks!
Wow just tried it out in Ubuntu, installed the free calculator and guess where you find the installed app? In the Dash. I did not imagine the integration is so great.

I definitely will look into Firefox apps now more closely.
It body snatched the octopus and is now wearing it like a skin in search of more prey.
And then there's The Black Swan by Taleb.
"...and working weekends."

Why the working weekends bit? Is Yahoo short of people? Can they not plan their projects? Not trolling, just interested.
You’re Invited to Experiment With a Quantum Computer
I think you're unnecessarily combative in the face of advice and sitting comfortably atop your pillar of experience, ready to shoot down anyone that dare take time to offer you advice. You've appealed to your authority on this matter more times than I can count. Look at how you've approached the conversation from the very first reply, which set the tone for the rest:

- I've been using WP Supercache since it was released
- [I've been using] Nginx for I think 4 years at this point
- Basically, I was there
- I saw the numbers and I know why they wound up looking the way they did
- I've been running Wordpress blogs since 2004
- You clearly don't understand what my problem is

Now I've asked you something specific. You've lamented that you identified the issue as on-disk joins, when MySQL has to resort to an on-disk temporary table due to a TEXT column. That's discussed here[1]. I'm assuming, because I didn't assume you are stupid (unlike in the inverse), that you deduced this was the case by inspecting created_tmp_disk_tables. I then asked if you tried removing the disk from the picture by creating a RAM disk, mounting it somewhere, then instructing MySQL to use it for its temporary disk table area by setting tmpdir. I also assume you know that tmpdir defaults to the system /tmp, which might not be on a filesystem that you prefer[2]. Again, I assumed you knew these things, and just asked if you tried them.

How do you respond? "Let's ignore each other." So now I'm left wondering if you genuinely don't know how to scale MySQL, and you've tired yourself of appealing to your own authority in order to prove me wrong. What I'm telling you, is the notion that your blog network creating a workload for MySQL that it is incapable of operating on commodity disk is completely ridiculous, and I'd laugh you out of an interview if I pressed you like this. I think you gave up, but I wasn't saying it, but now that you've gone at me like this, I will. You're basically saying you couldn't make MySQL work with a <50QPS write load (I refuse to believe you're writing more than 50QPS to MySQL) because of some TEXT columns.

I'd have far more respect for you if you'd just say, yeah, I probably could make MySQL keep up with my blog workload, I just didn't put much effort into it and bought SSDs on a provider I don't prefer instead.

(But wait: I don't understand. Username oddly appropriate.)

[1]: http://dev.mysql.com/doc/refman/5.0/en/internal-temporary-ta...

[2]: http://dev.mysql.com/doc/refman/5.0/en/temporary-files.html
If nothing else, Wakefield has been a great example of the cost of scientific fraud. As a science major, I've had Wakefield drilled into me; befrauding a paper for money/fame/whatever leads to public opinion preventing herd immunity many years down the line, and indirectly, loss of lives. It's unbelievable.
Great advice! I might suggest to travel to countries that you are not familiar with, countries that speaks a different language to you, countries that scare you. Get outside of your comfort zone, and things will start to get interesting!
The one that caught my eye is that the macros are disappointing: they merely feel like (not even glorified) syntactic sugar for an eval wrapped in a function.

Hint: if I'm manipulating/interpolating a string, it's an eval, not a (lisp-y) macro.
I agree with the statement that tech people are less concerned with origin and would add another reason being we understand in the open source world there's nothing stopping a Russian programmer, just as an example, from contributing to Apache (which apparently Igor did). But there are plenty of work environments where it is an issue, namely gov't bureaucracies etc. etc.
Please note first that I am pro-vaccination.

Vaccinations are a risk, which are designed to mitigate another (larger) risk.
With this in mind, we shouldn't look at vaccines uncritically.

The article points out that Japanese vaccinations were withdrawn because they were believed to be causing aseptic meningitis - it's a shame that no numbers are mentioned on that side of the coin.

The comparative risk of vaccination ought to be regularly and properly assessed, e.g. https://www.ncbi.nlm.nih.gov/pubmed/8096942
Collection of Great Design Ideas and Inspirational Articles. Daily updated
Most common thing that seems to come out is using string concat for sql queries.
Why I don’t use Backblaze anymore
Echolon is widely known since 1980ies, "spying on everyone" is just question how filters were set. And "all the data on incompetence and failure" you have now are just a few PowerPoint slides and speculations. I would say NSA is actually very competent.

And checking basic facts != conspiracy theories.
I doubt davecat is coming from a life of social abundance.

And "revel in the presence of other people!" probably isn't going to cajole you from the dungeon when social trauma is what mired you in your funk to begin with.

He probably found a coping mechanism for damage done.

Perhaps, at some point, self-medicating with things you pretend are human in a one-bedroom apartment in southeastern Michigan isn't so different than self-medicating with travel.
after ten years, square wheels will suddenly be round?
What hannibal5 says: Trackers are there after you're off of Google's site(they know whether you've been bad or good, so be good for goodness' sake), and Firefox doesn't need to phone home to Mozilla for your browser to enable others to track you.

In other words, neither Google nor Mozilla has to be involved to track you.

Let me lay out a specific scenario.

It's easy enough for insurance companies (or a 3rd party who's willing to sell that data to an insurance company) to run genuinely informative health sites that have good rankings on Google's SERP, and thus get high clickthrough. Such a site can on clickthrough set a cookie on your client for you, and/or fingerprint your browser (c.f., EFF's panopticlick), and/or use an ETag as a 'cookieless cookie'/browser identifier.

Once they've got a way to identify past behavior for a browser (i.e., look up health concerns for an identifier), they have something to sell to insurers.

Okay, well, clicking on an organic result is a weak signal of health risk / pre-existing condition, all you know is they ended up on a page.

Suppose you, as an insurer, want a stronger signal of whether the person using that browser has a health risk/pre-existing condition. Just put out some AdWords. Here's where Google really helps a website build valuable, saleworthy data.

Search for something:
https://www.google.nl/#q=breast+check

Click adwords ad for breastcancer.org

Opens a page to: http://www.breastcancer.org/symptoms/testing/types/self_exam/bse_steps?gclid=CMC0rI74uLkCFQSS3godSSAA_Q

With this value in the HTTP request's Referer header:

http://www.google.nl/aclk?sa=l&ai=CA_XBGe0qUqOhD4e--QbWkoHoBqzGitEBlN6ongr-x6YMCAAQAVCVu9RFYJGEk4X8F6AB7qeO_wPIAQGqBCBP0MOny_HlmSNBJ-QDgpzV0OqbNNjg7FAjv3nX9hy9u4AH-tdx&sig=AOD64_1DSbXWQm-KpW0fMRFiY3lcjn3kQg&rct=j&q=breast+check&ved=0CCwQ0Qw&adurl=http://www.breastcancer.org/symptoms/testing/types/self_exam/bse_steps.jsp

I was logged into my Google account while I did this.

Google empties the Referer for organic results always (if I've read&remembered correctly, for a few years they scrubbed Referer only for logged-in users, as a privacy boon). But they still leave it for their paying advertisers!

So, if you run breastcancer.org and put out some ads and are selling your data to insurers, you now can link search terms to impressions to clickthroughs to a browser identifier. Then you just need to offer a low-latency service that serves the insurer a list of health conditions for which a particular browser seems to be at-risk for.

Note that all of this works end-to-end, so SSL/TLS doesn't prevent the host serving a clickthrough from sharing data.

The part where your browser is identifiable (uses etags, sends cookies, presents a consistent fingerprint) is the weakest link.

Disclaimer: I have no reason to believe breastcancer.org is anything but altruistic, I just needed to find a medical condition for which there was a clickable AdWords ad and which is expensive to treat.
1 is pretty close to zero.
Ask HN: How to secure your "random wifi connections" found whilst traveling
Just wondering how you safely connect to your servers, email, ftps, etc... while connecting from a mcdonalds or cheap motel whilst on the road.<p>Do you create your own VPN? Do you rent a VPN from a service?

I am just about to make a massive cross-continent trip and want to be able to keep my HN and root server passwoworrds safe whilst checking my work for explosions on vacation.