skysight-inc/HackerNews huggingface dataset:
A couple of notes:

* This was not a MITM attempt

* When traveling laptops, it's more secure to use DNSSEC + Unbound

* The author trusts Google with his data, which uses DNSSEC[1], but not DNSSEC because @tptacek said so - fair enough, I trust Dr Bernstein even more than tptacek - but it's a bit contradictory. He should be using OpenDNS which is the only major DNS provider of DNSCurve[2], instead of Google (8.8.8.8 and 8.8.8.4).

Also, note, all major DNS providers are collecting data: OpenDNS (also adds a few suspicious redirects when the URL doesn't exist), Google is the leader of world-data mining, etc. The most trustworthy DNS, according to the a research I did some time ago, was/is OpenNIC.

At home I run a dnsmasq + unbound (DNSSEC) + OpenNIC DNS's. On my laptop I have a similar configuration which uses by default a local unbound installation when joins every other network except mine.

[1] http://googleonlinesecurity.blogspot.cz/2013/03/google-publi...

[2] http://en.wikipedia.org/wiki/DNSCurve#Deployment

[3] http://www.opennicproject.org/
The Curve - Nicholas Lovell
I'm curious about this statement as well. It sounds like the author might be:

- Creating big complex methods instead of breaking code into smaller (testable) ones?

- Nesting callbacks multiple levels deep, instead of using something like Node Async to flatten out code flow?

- Choosing a Coffeescript code style that leads him to put callbacks on their own line, or something like that?

- Something else?

Not implying the author is wrong by any means - there are probably some scenarios where coffeescript isn't the best whitespace-wise. The thing is, readability is one of the huge reasons I use coffeescript, and I feel like it's largely compatible with the whitespace patterns I used in javascript. Even for large NodeJS or Angular projects, I've found that it is consistently easier to read and edit than Javascript.
Haha ... funny to read about people scratching their head over Self. I feel like once you've wrapped your head around the Squeak version of Smalltalk, your about 50% of the way towards understanding Self. It's not a language the way we think of it, with CLI tools and syntax and text editors. It is a mutable environment of programmable objects. Sure there's some writing inside of objects to create methods, but you're not gonna find a "try this in the browser" code.

Self is/was http://noflojs.org/ 's grandfather.

http://www.youtube.com/watch?v=NYEKO7JcmLE

I would also argue that Self is to programming languages what Haiku is to OS development. No on is writing a web framework in self, it's more of a toy and a neat artifact of where programming has been and could go in the future.
> I dunno, I'm ok with anonymous reviews, but not false reviews.

It sounds like you're not OK with anonymous reviews, even true ones, because you support stripping the reviewers anonymity even in the absence of any evidence that the claims are false. If all I need to get your identity is a bald and unsupported claim that you defamed me, then your review doesn't have a right to anonymity whether it's true or not.
I don't completely agree but your point is well-argued.

I'm bootstrapping my startup in NYC. I've spent over a year focused on iterating from intimate feedback of a slowly growing test group. The core product feels ready for a larger public push, but since it's a social network of sorts, I'm planning to play the long game with it. I'll organically grow the userbase on nights and weekends while returning to a day job. This strategy won't work with all kinds of startups, and once I start this I may find that my assumptions are way off and it won't work for my startup either.

Then, I'll adapt (seek angel funding?).
middleclick, perhaps you should read this Scientific American article:

How the CIA’s Fake Vaccination Campaign Endangers Us All

The U.S. was wrong to use health workers to target Osama bin Laden

http://www.scientificamerican.com/article.cfm?id=how-cia-fak...
No, not really. I do like having the length concatenated inside as well, as this provides a unique password for different lengths (useful to quickly visually identify if a password looks 'right').

Is there any reason why HMAC would be better than my current implementation? I have had a read over the article and it seems that straight SHA512 should have similar cryptographic strength.

Thanks for your input!
Sounds reasonable. I'm not sure how you prove that Hadeed is giving them the complete list, though.
...It buys a WaveRunner
It can generate 4096 different slightly useful 32-bit values. For others, you may assemble them using a variety of methods.
Doesn't anyone remember the White House Correspondent Assoc. dinner where he ripped both Bush and the lily-livered press new ones? I for one can't wait to see what he says to these guys.
Check Stanford. 30% of the population reported within poverty.
I would change the track, and do everything within my power to take the person's place in that track, so that I may give up my life so that one person may live.

In the same way, the Father made an incalculable cost in giving up his only begotten son, so that no man shall suffer the second death, but experience eternal life.
The linked discussion is back from mid-December and the extension has been removed from the Chrome Web Store:

https://chrome.google.com/webstore/detail/window-resizer/kke...
> but many people probably think that Twitter is the most active micro-blogging service in the world

It is. Weibo doesn't do well outside of China, it is not international like Twitter is.

> that PayPal is the only really huge payments service

From the perspective of a non-China resident, that is definitely true.

> Amazon and eBay are the major players in ecommerce

Ditto. Though Taobao is trying to become a major international player.

> For any service you can think of in the US, there's one in China that might be even bigger.

Except the services in the US are mostly international. The services in China are almost always limited to just China. The fact that UnionPay is the largest ATM network in the world (by users...almost all in mainland China) doesn't mean diddly when I visit the Netherlands or India where my ATM card is USELESS.

China has decided they can lock out international internet services (via the GFW) and build their own isolated network. Internally, it is huge, but the isolation cuts both ways.
I don't think I've ever heard of Yelp fabricating negative reviews, though there have indeed been numerous allegations of their downplaying positive reviews of businesses that don't pay their Yelp Tax.
Since Chrome auto-updates extensions, users are likely not aware of this change.

I've been using the extension for several months until I noticed the transparent redirection. In fact, the only reason I noticed the redirect is when it failed. I clicked on a Google search result and got stuck on a blank page like this:

http://ecolink3.ecosia.org/?key=3cdcd4dc082e3c7b860abe4608b6925d&out=http%3A%2F%2Fwww.usatoday.com%2Fstory%2Fpopcandy%2F2013%2F01%2F15%2Ffred-armisen-ira-glass-this-american-life%2F1836079%2F&cuid=2
Keep at it, though! F# does take a bit of getting used to if you're coming from C# or Java, but it doesn't take long -- maybe a week of writing it full-time, two at most -- before you're roughly as productive in F# as you are in other languages. From there, the sky's the limit :)
I don't know any worthwhile editor that can't show tabs.
Is it just me or HN users are shitting their pants after knowing that China is bigger than US on some aspects
I'd completely agree.

Django is missing websockets, and little else. All that ode about not repeating code at the client and the server isn't that relevant because the view (client) operates on a completely different environment from the model (server), and does a completely different kind of data manipulation. Very little code repeats, and the little that does is trivial.

Ok, a better way to represent the client code is always welcome, but Django has already a lot of power and flexibility here, and it couples well with Javascript capabilities.
> we have time to prepare for the inevitable changes.

I would argue, having lived in countries that lead automation rates, that we already are at a point were large groups of the population cannot find work with their qualification, and never will: farmers, miners and forest workers had to convert to become factory workers, but most of those are now outsourced or automated; at the moment, there isn’t a job in Western countries for someone who has difficulty learning how to read.

Some people genuinely can’t grasp any abstract concepts: I taught in jail for a while, to people who couldn’t for the life of them generalise “Two apples plus three apples equals five apples; two sheets of paper plus three…” and remained baffled by ‘addition’ as an abstraction. Keep in mind: some of those guys fashioned working radios and distilleries from scratch.

Similarly, I have talked to taxi drivers who couldn’t understand it was in their interest to switch to Uber, how the trust mechanism worked with the app (they thought the dispatcher could better tell on the phone if the client was shifty), to say nothing of choosing a path based on a congestion map. I love my Roomba and my waching-maching, but without the cleaning jobs, what are immigrants to Western country going to do? Take care of elderly people to whom they can’t speak?

I fully agree with your point that automation is good for all, but we might have to face before the end of our careers a point where a vast majority of the population has to be considered handicapped, “mentally” for lack of a better word, out of the workforce and entirely subsidised.

At the moment, even a coder, hard working and of average skill, cannot find a job where I am: I know a handful of guys who can make functional, useful apps all by themselves (say: scanning barcode, interrogate database to tell if a product is ethical, handle shopcart, and all that with a great design; sports tracking). They make a hundred of euros from those on the first month, but that’s it: I tell them to treat those as portfolios to get interviews, and they do. I have no idea what goes wrong during those, but their repeated failures to sign anything is bigger than one HR being in a bad mood.

What I see is a world in 15-20 years where 3% of the population designs things; 12% have menial jobs, mainly manning security and healthcare bot-based systems and 85% cannot work. Spain or even Berlin already have a modern economy with 30% unemployment: subsidies, black-market service jobs, low rents… it looks somewhat stable, if shocking.

Clay Shirky had an interesting point about that, in an essay called “Gin, TV series and Wikipedia” or something like that — where he assumed there is a sacrificed generation, and the next learns. I have a hard time seeing millenials be anything but creatives with a YouTube channel. Maybe that’s worth it.
1000x Faster Spelling Correction: Source Code released
Overstock.com CEO: Amazon Will Be Forced To Start Accepting Bitcoin
Yeah, I get that. And I agree with you. But there has to be a mechanism to maintain anonymity without enabling anonymous defamation. I just can't think of one. Maybe he has to file a lawsuit against individual anonymous users first, before their identities are revealed?

The reverse of this is that by being anonymous, I can make any claim I want in an online review (he touched me in inappropriate ways!) and there are no consequences. Are there?
This is true, but existing Chrome users aren't notified when an extension is removed from the store. I had no idea of this malware until it surfaced when the redirect failed.
> This was not a MITM attempt

I've heard captive portals on here eferred to as MITM attacks, and I think it's an accurate description of what's happening, regardless of the intent of the captor.

In this case, they were hijacking DNS requests that were explicitly being made to another provider (first OpenDNS, then Google), and returning their own results instead of OpenDNS's or Google's.

From a cryptographic perspective, I certainly would say that it fits the description of an MITM: https://en.wikipedia.org/wiki/Man-in-the-middle_attack

> He should be using OpenDNS which is the only major DNS provider of DNSCurve[2], instead of Google (8.8.8.8 and 8.8.8.4).

Actually, I was using OpenDNS initially - I switched to Google because I thought that might be the source of the OpenDNS error I was getting (the very first screenshot - admittedly a bit small to read in the picture).

But it doesn't matter which DNS provider you use if they're hijacking traffic on port 53, which is what was happening here.

> The author trusts Google with his data, which uses DNSSEC[1], but not DNSSEC because @tptacek said so

It's not just "because tptacek says so" - it's because tptacek wrote a detailed critique comparing both services which I found convincing. I updated the post to link to tptackek's post that explains the issue in more detail; that's what I was referring to, but I couldn't find it at first when I wrote the post.
You assume the Chinese market is free, which it is not. The barriers are high, and the government just doesn't want you getting in on the business.
How do you know someone works for Google? They will tell you.
Thrun's criticism was pretty general--it went beyond his product. Thrun was sufficiently critical of his own vision of education for the masses as to cast doubt on Friedman's sweeping implicature that, among all the approaches to poverty that have been and that might be tried, this technology has the greatest potential. Given the 1% retention rate, MOOCs might "unlock a billion more brains" if there were 100 billion of them to unlock.
No you can't, you can use two different projects, but it's a bad solution in most cases.
It's the app developer's responsibility to update and QA their program.

If Apple allowed dynamically loaded libraries across the OS, then subtle issues in an App update could cause that one update to break seemingly unrelated apps. Windows developers call this DLL hell, and even with manifests and SxS, Microsoft still doesn't have an attractive solution to the problem.

Meanwhile, from a security standpoint, the sandbox should prevent apps from interfering with the files of each other and the OS.

And from a performance perspective, the few kilobytes (even entire megabytes!) of duplicated code segments is inconsequential on a phone with 1GB of RAM and very few context switches across apps.
Agreed. We really don't need a repeat of this: https://en.wikipedia.org/wiki/Casey_Serin
It sounds funny, but it is true. Someone who dreams up and implements something like Google Search is worth a lot more than a VP, of which you have twelve in a dozen.
Did you even read the article? All of this is covered.

The question of "what benefit would having a dynamically loaded library give you when each app runs sandboxed" seems to be answered in great detail under "Debugging Info and Consistency" and "Missing Shared Library Features"
The spring theory is really the only theory that answers the 'why' part of the equation. I mean, in the presence of a high pressure spring, it would be natural for people to kind of just stumble upon a building technique like this. People would first make a pool by laying rocks to form walls, then they will start making the walls higher, then realize that they can use buoyancy to lift heavier rocks. Then engineer comes along and realizes that they can make a huge building, and thinks: 'why not?'
It's in other places too. It's just hiding itself very well. For example Unity and the games that are based on it: http://en.wikipedia.org/wiki/List_of_Unity_Engine_games
Smalltalk is still class based. The only strong connection between Self and Squeak is Morphic.
The hardest part about management is not the rote processes of information collection and distribution. It's all the human elements of the team that you're managing. A good manager is a cheerleader, coach, and scorekeeper all in one. This requires individually tailored approaches to each member of the team and doesn't strike me as something easily automated.
To tell you the truth, I don't normaly use real time web apps at all. But I have an urge into turning what I write into real time apps, and no good explanation why, it just feels that they become much easier to use.

Maybe I (and everybody else) only have the wrong impression. It happens, and I don't have enough data to conclude anything.
> If Apple were to add dynamic libs, they would presumably be separate binary files, with their own signatures.

No. That's not how it works on Mac OS X today, where bundled shared libraries are supported.
Hopefully, the future is having multiparadigm developers. At the moment, most developers seem to struggle with their first... most of the time without realizing it.
Why? Someone who programs a real game changer for Google is worth much more than that. It would be a bargain.
For certain areas, you can replace or drastically lower the entry barrier to programming, sure.

Replace it totally? Doubtful. There's still inherent limits to computation that we have not resolved, and if our current hunches are correct, likely won't.

COBOL was meant to make programming a negligible and easily doable task with its rigid English-like syntax, but how did that turn out?

Sloppy code generators have been around for decades that can pop out some generic half-useful spaghetti abomination, but if you want anything just above total crap, you have to do it yourself.

Things like databases? Sure. CRUD apps? Absolutely. Even if you don't have a GUI to generate them, there will likely be some extremely abstracted library where it's a matter of pasting in a few procedures.

Yet a lot of things are still too vast and niche. That, and reaching the bug-free equilibrium. Removing state and side effects will deal with a wide class of bugs, but it obviously does not rid of them entirely. There will still be some just barely competent (or wizardlike by the hypothetical far-future standards) people who will be in charge of maintenance, and those will be our programmers.

While programmers are certainly a peculiarity in that doing your job well means furthering your own extinction, I don't think it will be anywhere near as drastic as it's made out to be. An ever-breaking technological dystopia sounds much more likely than some clockwork ubiquitous computing society.
Intersting, though I think the copyright is with the readable poem, not the integer that can be derived by intepreting the poem as hex.

Has this ever been tested in court?
Thank you, but to be precise it is:

http://officialblog.yelp.com/2014/01/protecting-consumer-fre...
A member of our community is missing, help find him
The easy solution -- take a few of your best C# developers and give them two weeks to learn F# and build a small project with it.

You don't have to hire developers from outside to bring new technologies into a company. In fact, given the scarcity (i.e., demand > supply) of good developers these days, it's almost certainly going to be easier and faster to have your existing development staff learn those new technologies vs. trying to hire new developers with experience in those technologies.
Smooth Gestures (lfkgmnnajiljnolcgolmmgnecgldgeld) has done the same thing for well over a year now. I (and many others) reported the addon to Google, but it still remains.

What does it take to get something like this removed?
Here's the tab completion script:

http://pastebin.com/mR8y1Rks

Note it's the only tab completion script I've written, and it's probably a hack :P
Maybe, but many JS programmers won't touch anything CS.
I wrote (as far as I know) one of the first resilient file systems for flash, for the Apple Newton, back in '92. We supported transactional object stores on NOR flash, which allowed random reads at full bus speed, and random writes as long as you were programming zeros. You could erase whole blocks back to all 1s, of course.

One of the things I had to model was the failure mode of the device. It was simple, I assumed:

- Stuck bits (at 1 or 0) would cause either a data write failure, or a failed attempt to write to a tracking structure. Both recoverable by using other storage.

- Failure to erase would result in a bad block.

- Writes to other memory wouldn't cause disturbance to already committed writes

- ... a few other things as well.

NOR makes it easy, I guess. For the time, and for the quality of flash, it worked pretty well. The Intel flash guys told us we were being too paranoid, even as it was.

NAND flash looks a lot more byzantine, and I can well imagine that survival of your data depends in large part on how much the firmware team understands error recovery and transactions. Having been there, I'm really cautious about SSD brands that I use (no names here, but you can probably guess who I avoid).
Unlike the author, I love significant whitespace and am enjoying nimrod lately with it.

I'd love to see a CoffeeScript variant for TypeScript. TypeScript has the structural things of CoffeeScript and more (OO paradigms, member visibility, modules, typing, etc) but much more verbose. I have tinkered w/ the CoffeeScript grammar/parser adding in a backslash to denote to type (e.g. "(x\int) -> x * x") and the TypeScript AST and compiler are very easy to work with. I just haven't had the enthusiasm to build a complete project. That would be my dream language. Until then I think scala.js is a great fit.
Is this even a problem with Google's certificate pinning? Chrome would prevent the user from accessing Drive if it was MITM'd.
Indian Doctor Looks To The Future Using Google Glass In Operating Room
I did find that odd. Whitespace helps you get away from "a wall of dense text." I'm not clear on how mandatory whitespace could exacerbate the "wall of dense text" problem.

Does the author want to skip the indentation some of the time? I can think of a few marginal cases where that would be preferable. But in the vast majority of cases, you should indent any nested structure that has its own line(s). Indentation is essential for readability.
IIRC, some of the techniques used in the Self VM eventually made it into the JVM.

Ahh yes, the relevant LtU thread. http://lambda-the-ultimate.org/node/1185#comment-12831
Thoughts on this request for comment?
I don't do a ton of js programming, but I did poke around with cs a bit. For me, clean iteration seemed like the biggest win. And then I discovered underscore/lodash. So I don't do as much cs anymore.

Essentially, js isn't all that busted. The busted parts can for the most part be worked around with underscore/lodash and sweet.js (for the really ambitious)

sweet.js

http://sweetjs.org/

pretty neat pattern matching library written with sweet.js

https://github.com/natefaubion/sparkler

I do most of my work in Python, so the above experiences and biases may be a direct result thereof.
It sounds like it would be simpler for Yelp if they demanded the reviewer to upload a photo of the receipt. Not the most practical, but a service being reviewed could ask it to be necessary, or visible, and suffer the lack of reviews if that’s too much. Certified reviews could have priority. Some receipts have the name of the waiter; Yelp could point out, without naming, that bad reviews all match a former employee.
thanks for this, i found a couple of versions of this on iOS. won my first two games against a simple AI!

love learning about new games like this. great find.
They transferred via Sun's acquisition of the Strongtalk team (that also got them Gilad Bracha). Strongtalk was also one of the first hybrid typed languages (like Dart and Typescript).

Much of the innovation in dynamic language run-times today also uses ideas from Self. Most of the Self people are working at Google today in various high positions.
I'd really like further explanation, too. If you're not properly indenting code in large projects — whatever the programming language is — I'd really hate working with you.
Author of the blog post here... Feel free to ask additional questions (I did not post this story, the blog post is from March 2012).