skysight-inc/HackerNews huggingface dataset:
Things add up, you know... $20 for a cert, plus $10 for a domain, and not even taking into account the server, it's $30. Now imagine you have five or six side-projects, you may not be willing to spend $150 per year to maintain them, especially when you get little to nothing in return.

It's not like every website must have a profitable business plan just to be online and secure...
It is. I'm speaking of fewer programmers for the same output.
This is a pet peeve of mine. I honestly think we should reserve politeness for human-human interactions only.

When the self-checkout machine at the supermarket says things like "Please scan your item, Please place your item in the bag, Please scan your credit card, Please take your receipt" it devalues the word Please. The machine does not give a shit about you, so it should not be using that word.

Edit: I just jumped on a conference call. "Please enter your access code followed by the pound or hash sign. Please say your name and press the pound or hash sign. Thank you. You will now be connected to your conference." UGH!

(Yes I know I have unusually strong feelings about this issue).
What if browsers had dedicated support for infinite scrolling? Just like you trust regular scrolling to the browser or even operating system rather than implementing it yourself in javascript.

You could solve some of these problems, like the browser being able to bookmark or get the url of a specific section, and standardizing the way it's done.
Another great HN joke: Have a character frequently referencing XKCD cartoons and acting as if they said something profound.
Nice! I did something similar. I worked ~20 hours/week for a year, also took an extended 2 month vacation. I'm back to full-time now, but here's how I did it:

1. I had 6 month emergency savings. I figured the worst thing that could happen was having to job hunt and return to normal FTE. The job market felt safe to me.

2. I did this by freelancing. I could not find any ~20 hour part-time job for developers.

3. It's not difficult to start at $50/hour and move your way up as a developer.

4. I eventually moved to a day rate. Instead of working ~4 hour days, I worked 2-3 days per week. This helped deal with my goal lifestyle (only wanted to answer client calls while I was in the office, preferred batched work instead of 1-2 hours here and there, etc...)

5. My living expenses weren't extravagant. Probably low considering I'm in the Bay Area. Even at 20 hours/week, I made sure the math worked out and that I'd still have a solid buffer just in case.

It immediately made me much happier. I started spending afternoons jogging around the local lake, playing video games, spending more time with parents/grandparents, working on side projects. It felt like the opposite of burnout. Of course, there were still problems:

1. Explaining to friends/family. There was a lot of criticism about how I was wasting money, being lazy, or being irresponsible. Worse was the constant "did you find a job yet?" question. At the end of the day, if you're financially sustaining yourself/family and not assuming too much risk -- you're not being irresponsible!

2. From the clients I've had experience with, most preferred full time contracts. It was a little more difficult finding 20 hours or less per week.

3. Droughts suck. I had a ~1 month drought that doubled my vacation length. Saying "No" to a full-time request means they'll find someone else who can work full time.

Hope this helps anyone else considering the jump.
Not going to happen. The WoT is a usability nightmare for the 99.9% of nontechnical users that don't care about things like 'p2p' & 'decentralized'.

Do you really think Granny is going to be happy with the tablet she bought that can't connect to her online banking account out of the box? Have fun explaining to her that she needs to exchange keys with enough trusted intermediaries to have a valid trust path to her bank. I'm sure there plenty of key signing parties happening at the 'ol retirement home.

Or maybe you can explain to Granny why her money was stolen when a scammer managed to compromise one of her trusted keys and then created a compromised subgraph in the WoT leading to a fake certificate to her bank?

The WoT is a usability nightmare. Sure, the PKI isn't too great, but it's what we have, and it is currently more practical than any other solution out there. Security needs to be usable to be useful.

EDIT: for a good rebuttal to the OP, read this blog post by Mike Hearn which covers the issues I raised and more: https://medium.com/bitcoin-security-functionality/b64cf5912a...
StartSSL does provide revocation and regeneration of certificates. They charge for this service, just like other CAs charge for generation of certificates.

I would much rather StartSSL provide free certificates, even knowing that not everyone whose private key was compromised regenerated a certificate, than have StartSSL pulled from trust stores and thus cause fewer future sites to not have SSL because of the associated cost.
Chomsky Q&A at Google
Am I the only one who sees none of this "top notch system"? Last time i used it it felt clunky* , now every time i get a search result to them on a random computer, they ask me to login to read the answer, experts-exchange-style. Thanks, but no thanks.

PS. I guess the people who find this useful live in San Francisco, and enjoy the "insider" feel.

*: Right now, while viewing any question while logged out, the "Continue with facebook" button text wraps outside the button.
Six programming paradigms that will change how you think about coding
It is happening.
How huge? So huge we should stay on OpenSSL!

Here are all the current TLS implementations http://en.wikipedia.org/wiki/Comparison_of_TLS_implementatio...

There is room for one in a secure language.

Completely useless? Go ahead and throw the baby out with the bathwater. At this point OpenSSL is a net negative.

It really smells like you are spreading FUD to keep people on OpenSSL.
What's your threat model? Without loss of generality, China has a) gotten secret keys to a large pool of targets, b) those targets re-key their certs, c) China re-uses old keys to MITM those targets and nobody notices?

If so, great news! We don't have to worry about it because China can also just ask their friendly government-owned CA to generate valid certs for any MITM targets who don't implement certificate pinning in the browser also produced by their company.
The machine didn't write that phrase though - a human did.
My experience with Quora has been pretty bad, but that has mostly to do with my topic selection and network being Indian.

Quora got popular in India because of widespread adoption in IIT circles, who by virtue of being influencers spread it across India. So much so that, I saw a statistic which said that most visits on Quora are from India.

However for me what that has meant is that a rash of new registrants have appeared who have destroyed any topic related to my alma mater and India.

EDIT - Also shouldn't this 'Indian Invasion' have had an effect on the valuation?

EDIT - I am also an Indian and mean no disrespect. But the fact is that one of the side effects of Quora getting popular so fast is that it is often the first Internet forum for many students. I know it because I have talked to them. And that ends up in usual newbie mistakes.
This is a very interesting comment. I'd love to see a followup study addressing the hypothesis that "liberals" place more emphasis on, and are better at, discriminating true threats from the appearance of threat than "conservatives".

Such improved discrimination wouldn't necessarily have been evolutionarily adaptive, it seems to me. First, there's the risk of false negatives: you might incorrectly dismiss a real threat. Second, such discrimination takes time that might be better spent fleeing (or whatever).

I can see that the optimal strategy might be to maintain a dynamic balance in the population between "discriminators" and "reactors". "Reactors" might get killed less often, but without a certain number of "discriminators" in the population, the tribe (or whatever) would fail to maximize its utilization of the environment and thus not compete well against neighboring tribes.
> You believe that you understand ekm2's situation and goals better than ekm2 does?

No, I don't believe that. My suggestion about the graduate schools in the fields ekm2 named comes from having thought of some of those graduate schools myself, but of course ekm2 would know about the specific schools and programs ekm2 is interested in better than I would.

My question to ekm2 about why one would choose to double major vs. single major was sincere, and the answer enlightening: in ekm2's case, the double-major ensured that there wouldn't be scheduling conflicts or prerequisite issues.

> My question to you is, why get a degree at all?

Because the difference between having a degree and not having one is an order of magnitude larger than the difference between graduating with a single major and graduating with a double major, enough to make the utility loss worth it for most people.
Show HN: Cleanboard.io – Whiteboard Photos Cleaned, Organized, Searchable
It's a 44% raise from the previous "Dropbox Team" business pricing. It used to be $125/user/year.

So AWS S3 does a big price drop, and Dropbox Business raises prices by 44%. Sounds good :)
A 50+ person company is burning >$5,000,000 on salary + benefits + office space.
Things taking longer to read and understand is perhaps the central crime of unmaintainable code, no matter how concise otherwise.
There is a benefit to the business if they can keep the price high by staying the market leader. If they lower their prices to compete the type of problems they will have to deal with in inherently different.
What would be the point of that? you might as well write something like "Error 0x000332, program aborted" that's as helpful as an apology to the normal user
Show HN: Hash49.COM : Explore Instagram via hashtags
Right. I wonder if Silicon Valley types will ever be able to move away from the faux-altruistic mindset and just acknowledge that they are interested in making more money than a single person could ever comfortably spend in 10 lifetimes. And that's not a bad thing! And maybe the world becomes a slightly better place in the process, but there's just such a disconnect right now between what they say and what they end up doing.
I find the overwhelming perspective of comments approaching this article to be, fascinating. I also think that Diogenes of Sinope would have a great deal to say concerning the matter.

I would say that it's a fallacy to dwell on why Mr. Smith is living in an RV or what he could have done to prevent himself from landing there. After all, it doesn't answer the question of why the state thinks it ought to so finely dictate the comings and goes of a person or where it is that one should choose to sleep. To seek shelter is as much a natural right as any of the others and to deny someone easy access to readily available public shelter should come with the same level of concern as restricting speech.

I think it's more interesting that we choose to allow those who do own or can afford to rent property to dictate and bully others for the convenience of their avoiding a "nuisance." Since apparently choosing to reside in a house grants you greater worth than choosing to reside in a car.
Ask HN: Freelancer-friendly work-for-hire contracts?
Does anyone have examples they can share or point to of freelance work-for-hire contracts that strike a good balance between being freelancer/maker-friendly and protecting the interests of the company?

We try to be reasonable about these things but are finding a lot of the boilerplate out there is pretty one-sided (one way or the other). Has anyone done the equivalent of a YC Safe or NVCA template for work-for-hire?
Not saying it isn't that is the main bulk of the algorithm, just saying it there is an additional benefit of SVMs in the end.
Good point, but will it be less than all the effort and money about to be expended in the coming months? Who knows. For the record I did say that PGP may not be the solution.

The other great thing is that PGP is not just for sites but for people, so even if all the private keys handled by nginx/apache/whatever were compromised Heartbleed-style, the core person-to-person trust relationships would be unaffected; the core of the web of trust would be intact, only the endpoints would need re-verified.
Thanks! How would the batteries of an helicopter and quadcopter differ?
According to our attorney, they would not.
However, the company gives a shit about their bottom line. It has been proven that their customers - humans - react positively to humanized language and as a result this is just a natural outcome in markets where the bottom line is important (read:all).
I'm asking HN so we can have a discussion about possible threat scenarios.
Amplify Partners Web Performance Fellowship
You can also use linting tools as a build validation step (ours are invoked via things like `make myapp.pep8test`). These can also then be invoked yourself before making a commit. As jwinter says, this really tightens the loop when fixing trivial errors.

Almost all of the tools are very configurable in terms of which warnings/errors you want to ignore (e.g., let our max line length be 120 instead of 80), and give pretty good feedback (line numbers, exact error).

Another great benefit is that you have a neutral arbiter of what's the style for your codebase, which helps avoid ruffled feathers.
You pasted the same gmane.org link twice :)
Why Go is elegant and makes my code elegant
> If you want an identity - generate a keypair. Publish your public key and let others sign it to assert this keypair is genuinely yours.

You're hiding an unbounded amount of work under the word "publish" there. The important part of an identity is the part where people trust that someone using the identity is you. Just posting "hey, this is the public key for John Smith" on a website does nothing to prove that fact. (Key-signing parties prove that fact, but people don't do those.)

What does prove that fact is the background-check a CA does. But they only do it to create a private notion of your identity for themselves, which means that every CA has to do its own redundant background check, which is why certs cost money.

All I'm suggesting, here, is that the "background checking to create an ID number that maps to a specific person" part could be split off into its own business model, and the resulting ID number (in the form of an OpenID, or whatever else) reused by any-and-all organizations that wish to map tokens to real people.

Also:

> I believe, any sane person wants to be a source of their identity (that's asserted by others), not to lease their very identity from a third party.

You're never the source of your identity. For example, your name is only your name because the government you were born under has a law creating an identity, by mapping birth certificates to people, and your name is one aspect of that identity. Change citizenship from the US to China? Suddenly what you were considering "your name" is no more, and your new name is spelled in ideographs. You can certainly get people to call you by your old, alphabetic name--but that is a person-to-token mapping. In any token-to-person mapping--a phonebook, for example--you'll be found by your new government-created identity.
This is a good point that seems to keep being ignored: do revocations even matter? Are browser makers planning on changing their defaults with regard to revocations? Is somebody planning a widespread consumer education campaign regarding revocation? If not, this whole issue seems like a bunch of noise that doesn't have much real impact.
I know enough about Haskell to be excited, but recently, I implemented a few systems with F# and am really happy with the language. If we forget about the .net/MS thing (and all the hatred that comes from that), are there real true advantages of going Haskell for a greenfield project over F# ? (I have a couple heavy algorithm heavy Haskell projects done, but having worked with F# more and more, I feel like it is so much nicer as a modern, not bend over your back to deal with the purity/lazy aspects language than Haskell).
I figured such a tool must exist. Thank you for helping me remain lazy. I agree about having the tighter feedback loop.

I'm hoping to create a git filter that stops the commit from happening if there are style guide violations.
Explain why it is not exploitative, please.
Aside: seems a bug that a [dead] comment can appear higher than any live comments. (It was above iamthepieman's comment a moment ago.)
Traditionally 'please' is way of affirming lower status, the asking party accepts that they are lower status than you but would like you to consider taking an action their behalf. Since the machine cannot scan your items itself (yet) it has to ask you to do that, it can't really order you to do that.

I suppose it could say, "The process will begin when you start scanning items." but it's simpler to use the honorific.

In error messages apologizing is present perhaps because the service requested could normally be performed but due to circumstances it cannot.
PGP would be a problem for high load servers too.

"Why not use public-key encryption for everything?

At face value, it seems that the existence of public-key encryption algorithms obsoletes all our previous secret-key encryption algorithms. We could just use public key encryption for everything, avoiding all the added complexity of having to do key agreement for our symmetric algorithms. By far the most important reason for this is performance. Compared to our speedy stream ciphers (native or otherwise), public-key encryption mechanisms are extremely slow. A single 2048-bit RSA encryption takes 0.29 megacycles, decryption takes a whopping 11.12 megacycles. To put this into comparison, symmetric key algorithms work in order of magnitude 10 or so cycles per byte in either direction. In order to encrypt or decrypt 2048 bytes, that means approximately 20 kilocycles."

https://www.crypto101.io/

EDIT: I suck at copy-pasta
Can't this be solved with some kind of distributed, authenticated, pre-existing protocol? Something like...

DNS?

With the DNSsec extensions it should be possible to publish enough information to authenticate a given site against a certificate. If your DNS has been compromised you've got bigger problems than your SSL cert.
RegExr: learn, build, and test Regular Expressions
Sure, and if I were ever to interact with that human directly, I'd use my politeness. I feel like manners should be something special just for us humans.
What is this, amateur hour?

This is not a competent analysis of the situation. Flagged.
Carousel is a non-starter for me for the sole reason that it doesn't have the ability to set a root folder. I keep a lot of things in Dropbox, including iWork documents, web sites, and iOS projects and I don't need the "photos" from those projects appearing in the app.

I've been using Unbound, which does let me set a root folder, but turns each folder into an Album when I'd prefer to just have the Photos.app/Carousel timeline view.
Note that despite being the crown jewel, OpenSSH's security page lists about two dozen vulnerabilities it has had at some time in the past.
More importantly, they're certainly not the only threat presented by HeartBleed. While this guy drags his feet patching (because his certs still won't be really secure), his servers are likely leaking session cookies, usernames, and passwords by the bucketload.
On the other hand, it is likely that the discoverers of Heartbleed, during their testing, were changing their service configs and restarting the SSH/Apache/other daemons frequently in order to test as many configurations as possible.

It's entirely possible then that the OP's assertion is mostly correct, and that your key is more likely to be leaked if the attack is one of the first few requests to the daemon after it is started and the heap has been barely touched, and is significantly less likely to be leaked if the daemon has been up for some days and served many requests and its heap is more fragmented.

Though I'm skeptical of the final "not possible", and would personally downgrade that to - at most - "very unlikely". It'd be nice to see some kind of study into how frequently the private key data is recoverable from the attack, against how many "normal" requests preceded the attack request.
This is wrong: the compilers distributed by the FSF (as part of GCC) have the linking exception. The ones distributed by AdaCore don't: they exercise their right to transform the modified GPL (with exception) into the GPL before redistribution. But the one in your Linux distribution is likely the FSF one.
I have been doing ok on estimates lately. The trick I use is to break everything into tasks <= 4 hours, ideally 3. In fact, I much prefer 3 because with 4 hour tasks it's too easy to think almost anything will take a half day. That keeps things realistic and errors in your estimates from snowballing. Also, I rarely find any tasks to take less than one hour.
Which tech skills are in demand now?
Post of the Year right here. Prepare to be downvoted relentlessly for commiting Hacker News sacrilege[0].

0 - http://www.paulgraham.com/say.html
I have been trying for years. I fail at everything. The thing is this, just knowing how to program and do DOM manipulation isn't good enough. You need to have a stack/framework or 5 that you know like clockwork and as intuitively as a language. I thought by now I would know enough but its really going to be another year of learning node/express/mongoose/mongo/jade/programming patterns/web apis/authentication and god knows what else before the 'big' $20hr checks come rolling in. Seriously , if you don't have enough 'intuitive' understanding of a stack coming into it then you're dead before you've entered the door. Learning a stack is like learning a new language. I have written in PHP but trying to learn CakePHP or any of the other PHP frameworks is a large time investment. I tried Rails and plopped. I've now finally settled on node with express but learning mongoose, ajax w/mongoose and jade in conjunction with api's and storing dom id's and whatever else takes time as building muscle memory is the only route to employment. When I was younger I use to play with drum machines and electronic music equipment a lot and knew certain pieces of it like the back of my hand. The only way I see myself making any real money is to learn a stack literally as well as I knew that music equipment when I was a kid. That means striving to know every granular piece of it....and that takes time.
This is great. Is it possible to use this as a rake task? I think it would be better to have team members run this locally just like they would run a test suite, make sure everything is up to par, and then open a PR. This would keep the communication stream in the PR nice and clean, focused only on code implementation.
The machine does not need to affirm its lower status. It's a machine.

When it becomes sentient, then it earns the right to talk to me like human would. Until then, don't pretend to be something that you are not.

Edit: Maybe I'm weird, but I would prefer it to say something like "SCAN NOW", in a robot voice. Maybe add an "OK" if you want to soften it up a bit.
It can give unexpected/wrong results when working with Unicode strings.
http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Nam...
My Quora experience has been a sad one. I created an account just to be able to see answers to a question I was interested in. Then I tried to delete my account and their account removal policy stated that you have to send them an email for them to delete your account. Really, who still does that in 2014.