skysight-inc/HackerNews huggingface dataset:
Trust me zanny, I'm not picking on you, I'd like to examine your three claims in a bit more detail:

1) "certificate authorities are a closed off oligopoly" - This is absolutely not true. Pretty much anyone can start their very own Certificate Authority. The code isn't that complicated (the specs are all available), the math is no longer patented so you don't have to pay tributes to PKP. What you do have to do though is convince three people you're trustable, Mozilla, Microsoft, and Google. If they add you to their trusted root certificate list then you've covered a whole ton of the market. I know of at least one "private" certificate authority which shares its ROOT CA with individuals who want to trust that the sites which have a cert from them is "legit." (for some definition of legitimate).

2) "any state they are located in will just seize their keys ..." - this conflates two things, one is trust and one is seizure. If you live in the US, and have a PGP key that is trusted by the target of an investigation, and law enforcement can convince a judge that using that is the only way for them to get the proof they need, you may find yourself on the receiving end of a subpoena which demands you hand over access to your key. You can refuse of course, and the court can put you in jail for contempt. This issue is completely separate from the Certificate Tree or Web of Trust choice. The purpose of the certificate is to establish trust not privacy. The purpose of the TLS protocol (aka SSL) is to establish privacy. Its necessary (but not sufficient) to be able to trust the other end.

3) "... and read your traffic." - Which is a violation of privacy relates to how you established privacy as opposed to the mechanisms in that protocol. And I suspect that you think that is a splitting semantic hairs but bear with me for a moment. The heartbeat bug is in OpenSSL, not the certificate infrastructure. There are lots of things that used different protocols, and X.509 certificates, that are just as secure today as they were before this bug was disclosed. The key here is that they used a different protocol.

The OPs rant might more properly be leveraged at what is effectively a mono-culture around OpenSSL, and I would agree that is a bad thing, but to not have that be the case you would have to have people write their own TLS libraries. And while that would assure that vulnerabilities were contained, it won't happen because nobody can afford these days to hire a programmer to write TLS libraries that the only 'hire' has been someone coding up some Javascript and CSS.

I can completely relate to the OP's angst over the challenges of keeping things secure in today's world, its something of a life we "chose" relative to using open source.
There's also convergence, which currently can work for the case where the client is undergoing MITM, but not the server. Add support for notaries to cache TACK responses and you are pretty secure.
Not sure why you were getting downvoted. I agree. If they pull messaging out of the mobile app, I'll stop using it.
Yes, that is on the list of things we are planning to develop.
Thank you for creating HUSL! I discovered it as I was midway through my project. I am very glad that this exists! I agree, CIELUV or CIELAB would probably be a better fit. As I mention in my comment above, it wasn't immediately clear to me how I would generate a palette using the space given the holes, especially since I allow the user to choose any color they want.

I am curious, how would you approach generating a palette using these color spaces?
About two years ago, I changed the password on my FB account and stashed it somewhere. I deleted most of my photos and things that appear on my timeline. There were just enough folks I know, that I keep it around ... but I don't use it to communicate on a day-by-day basis.

I certainly don't want it on my phone.

But you know, if there's a separate Messenger app, I'd probably install it. Something that allows people on FB to contact me if they need to ask something, without sucking me into the Feed.
I agree with the idea of motivation. An anecdote for the OP:

In the past when trying to workout it would generally go something like this:

* Immediate motivation, go strong for 1-3 weeks.

* Work or lack of interest interferes with workout regimen.

* Eventually interest dies out and I stop going.

What helped me break this cycle was finding motivation by:

* Doing things I liked to supplement the 'work' part. This meant playing racquetball, ultimate frisbee, and cycling while lifting.

* Learning about the benefits beyond looking physically attractive.

* Going consistently that a habit has formed.

Seriously, I feel different if I miss my gym routine for a day. Hope it helps as you think about your own material to write about.
"Sorry for inconvenience" is pretty much a norm in Japan, be it software or not. You go to a construction site and you'll see tons of signs with manga characters bowing. Also in Japanese it's pretty common to say "excuse me" instead of "thank you."
Because its less convenient than what I have. I tend to respond to messages as a side effect of using the newsfeed feature. I do not use Facebook messaging enough on its own to warrant another messaging app outside gchat and SMS. Removing the feature from the main Facebook app only ensures I'll use Gchat more. Dumb move on Facebook's part, at least for my user profile.

I imagine they are doing this because they don't see the point in supporting both code bases.
I don't know about the other folks ... but I don't want to get sucked into the Feed. I'm with you on this.
Remember when everyone moved from AOL to AIM? Now neither are used at all.
That's not good. I opened an issue on GitHub.

https://github.com/thoughtbot/hound/issues/182
We've always had a full blown web browser in the app -- it's been the only viable way to fill passwords in for years. Literally the first option we added.

We also have an extension into Dolphin, and you can utilize Chrome utilizing our fill method -- if you don't like them there are options to disable them too reducing the perceived extra bulk.
I looked into all this roughly two months ago when a user in the financial industry responded to Elizabeth Warren's proposal for the government to handle payday loans.

Here he outlines why they don't work -
http://www.reddit.com/r/progressive/comments/1wygov/elizabet...

The next reply goes into their cost effectiveness -
http://www.reddit.com/r/progressive/comments/1wygov/elizabet...

Now if you don't want to believe "some user on Reddit", take into account that those "payday loan places that advertise on TV" are also publicly traded companies. Here is EZPAY's public info at Yahoo Finance - http://finance.yahoo.com/q/ks?s=EZPW+Key+Statistics, their return was only 5.60%.

Heres where I got that 6%/30% number:
https://www.qcholdings.com/mythsaboutlending.aspx
Disqus Introduces Sponsored Comments
Box: Berkeley’s first Billion-Dollar IPO?
Proof, I suspect, that humans are still better than computers. Or at least better than my computers. For now.
Unity has a license from Novell for an older version of the software, which is how they can use it in places they can't use the LGPL. Xamarin sells Mono under a commercial license, but Unity apparently doesn't want to pay what Xamarin is asking for a license to the updated code.
Interesting, probably much simpler than my approach:(I have added a few comments to give a brief explanation:

//Math.random = function(){ return false;};
/* my first Idea was to try and redefine Math.random to always return <0.3, but for some reason even though this did effect the dropping of bullets, it didn't stop them completely (if someone could explain this I would really appreciate it*/

map.defineObject('MagicBlock', {

'type' : 'static',
'symbol' : '$',
'color' : 'magenta',
'impassable' : function() { return map.countObjects('boss') >0;}

});

//place a row of MagicBlock's aboove the player's starting position
for(var i =0; i < map.getWidth(); i++)
map.placeObject(i, map.getHeight()-5, 'MagicBlock');

map.defineObject('missile', {
'type'	: 'dynamic',
'symbol'	: '^',
'interval' : 100,
'projectile': true,
'behavior' : function(me) { me.move('up');},
'color'	: 'lime'
});

player = map.getPlayer();

function volley(){
for(var i = 0; i < map.getWidth(); i++)
map.placeObject(i, map.getHeight()-6, 'missile');
map.placeObject(i, map.getHeight()-7, 'missile');
}

map.getPlayer().setPhoneCallback(function(){
volley();
});
You might consider reaching out to the people behind the Perspectives Project. They run 10 public notary servers [0], and chances are good that they have fingerprints for most of the widely-trafficked websites.

For example, here's the Perspectives report on lastpass.com showing the brand-new key as well as the old ones: http://i.imgur.com/hJkFTAy.png

[0]: http://perspectives-project.org/notary-servers/
At some point the Western intellectual canon of rhetorical tropes and logical fallacies will need to be expanded to add the "because Steve Jobs" fallacy which seems to justify anything on the basis of Steve Jobs having done it (without regard to context, or that the party in question is not Steve Jobs)
The only actual legal structure protecting Ive's position at Apple is one in which Cook voluntarily complies with Jobs' stated wishes. That is to say, there is nothing stopping Cook from firing Ive tomorrow, changing his job title or control inside the company. Jobs may have also secured the board's agreement to protect Ive, but that too would rest merely on their voluntary compliance with such. In the corporate world, there's no such thing as a truly untouchable employee. The CEO, the board, or shareholders, someone can always get rid of you.
Wow - this seems really big: It basically means that someone was scanning the Internet for this vulnerability on 23rd March 2014 already. Maybe even before. That's two weeks before the vulnerability was published.

edit: I guess I'll actually have to change all of my passwords.
Sorry, I didn't mean to say that TFA was the solution, but I think login info leak is one of the consequences of heartbleed, right? So my point was just, at least with TFA, the risk of having your accounts stolen is reduced.
I'd say to just get the word out. Around this time last year I was working at a security company and personally pushing for establishing automatic TACK protection for our clients, passively sniffing certs for SMB networks and learning which ones were good, but no one else knew what I was talking about, I couldn't convince them the project wasn't dead, and at the time I couldn't answer the question "how do we deal with a legitimate change in browser cert."

If you can grok TACK better than I do at the moment, start writing patches for web servers.
You might want to contact the maintainers of HTTPS Everywhere at the EFF. They collect and archive certificates for the SSL Observatory project.

https://www.eff.org/observatory
Could you please provide an actual example of a website containing the button, im having a hard time visualising it.
This submission should have a more attention grabbing headline! It's not just another SaaS asking users to change their passwords, this is actual (probable) evidence of the vulnerability being exploited weeks before being published.

Someone must have known about this and kept it secret for quite some time. And proceeded to scan huge parts of the internet.

Not surprising, considering the bug was found and published independently by two entities: Blackhats must also have found this one independently, too.

But now it's all that much harder to dismiss and delay password changes and key revocations.
Thanks for noting that!

I'm a big fan of Foundation, although if I wasn't trying to get this together so quickly I might have used something like Skeleton[1]. But I'm sure that is another discussion thread entirely ;)

[1] http://www.getskeleton.com/
This is one of the best books ever written about this exact subject:

"Crucial Conversations Tools for Talking When Stakes Are High, Second Edition"

http://www.amazon.com/Crucial-Conversations-Talking-Stakes-E...
For me it would have to be the replacement of the universally-known signal strength bar with "5 balls".

Takes more space, conveys no more information, uses a design element that is already used for other purposes (such as breadcrumb nav)
I don't mind portscanning per say if its clear you're doing it but a website should never trip a corporate firewall or IDS. We're going to re-rig this code to check the inbound IP against a local DNSBL or something similar and not something that will cause an IDS to shit itself. Generally, if I access a site on a port, I expect return traffic to come back only on that port (excluding protocols like FTP which are explicately multi-port). We officially support tor (and have our own hidden service) and are looking at connecting posts through SpamAssassin to automoderate crap down to -1 (this feature still fairly far out)

What got me upset was the fact that I respect users privacy, and to find out about this behaviour from a bug report notification pissed me off. In /code's defence, at that point, it was basically /., /.JP and Burrapuento as the last three slash sites on the internet so a lot of slashdot specific functionality has creped in over the years before the code drops stopped in 2009, with the documentation for independent sites being a bit stale.

EDIT: I've written a follow up on my SN journal: http://soylentnews.org/~NCommander/journal/277
Edit: Re your edit, I still think that designing the actual hardware that the user interacts with directly is equally difficult to design as the software at any level.

The fact that the iPhone has 4 buttons and a switch is a huge design decision. The size, shape, texture, reflectiveness, responsiveness, and tactile feedback are parts of the design that need to be considered and are not malleable once released.
I am not a Java programmer but the Java class literal seems like a perfect example. The class literal provides a language mechanism for representing a type of class (in Go's case it would be a type of struct) without the need for an actual instance of the class or another arbitrary data type (like a string or const) that the application is programmed to recognize as a signal for that class.
Regarding vowels: what is the first letter in the Arabic, Aramaic, and Hebrew alphabets?
Slashdot.JP (which is owned by ODSJ), and BurraPuento. At the time this code was added to the repo, macslash was also up.
Well, it seems to have made sense between 1984 and 2012...
This sort of active exploitation, showing up in different teams' logs/honeypots, might help explain the nearly-simultaneous discovery by different researchers (Mehta at Google and others at Codenomicon) just recently.
Thanks, looks like a good lead.
Survata (YC S12) is Hiring an Acquisition Marketing Lead
Well, sure, but in the meantime ... don't want to face M. Guillotin!
backslash (the admin interface) is fragile, during beta testing, we got the site stuck in an infinite loop because the UI for topic creation is not the greatest. I'm not sure I get the 'stores weblogs in mysql' bit as wordpress by default does the same thing.

We've been discussing migrating over to PostgreSQL and rearchitecting the database to run on stored proceedures and views; almost all the DB calls are already abstracted in MySQL.pm, so this is relatively straight forward (if a bit tedious).
Did you mix native and managed code?
Maybe it's just me, but I now have a hard time telling if the shift button is pressed or not now. I'm probably too used to the old colours.
Dropbox Sets Google and Facebook in Its Sights With a Slew of New Apps
Show HN: I built a rapid response service for heartbleed
In the OPs defense, he not only determined the average ping interval but also provided analysis on what the numbers could mean...without the second part, the numbers don't matter.

I would hope the people working this case could do the same but I also support the idea of crowd-sourcing.
>Alternatively, one can join the Marine Corps and let the drill instructors in boot camp motivate you to exercise.

Except weight loss is more about diet than exercise. If you're looking for that motivation (while not strictly necessary for weight loss, exercise can be motivating toward being healthy), a less drastic alternative it to get private instruction at a gym or through an activity such as pilates.

Many people have written about their weight loss / body transformation experiences on reddit.com/r/loseit and reddit.com/r/fitness; do some searches to get an idea about what others have written and the responses they got.
While I was testing on a server and out of a few hundred dumps never got any two with any common byte strings of more than 4 bytes among them.

How this bug actually ends up dumping information really depends a lot on luck.
I'm not that familiar with the bathymetry[1] of the area, but I have been seeing reports that the locations are between 3000m and 6000m deep. At that depth, even a strong persistent current is probably only a few cm/sec. For the precision of TMA, that's effectively stationary; the noise in the bearing rate measurement is going to be greater magnitude than the true bearing rate.

[1] Why is "bathymetry" not in Chrome's spelling dictionary?
You flag a comment every time you think it breaks a community standard? Like, every silly "me, too" comment and one-line meme comment?

If that's the case, I can almost guarantee you that your flags don't carry a lot of weight in HN's algorithmic ratings.
Well, at line 57 you already know which provider you want to use, so why not just initialize the struct from there and skip the factory method altogether.

http://play.golang.org/p/vXJcMJ-j6P

Edit: I think I see what you're trying to do with the factory method. You're trying to enforce the ServiceProvider interface on every provider struct. You don't need to do that yourself, the compiler does that work for you. On line 57, you already know what kind of struct you're dealing with so you can safely call .connect() on the provider.

And if you need to pass on the provider to another method, just make sure the method only accepts structs with a ServiceProvider interface. The compiler will stop you when it's not the case.
They drive a loaner to your house and pick up your car. What more do you want?
Colin Powell was SoS for the 1st term, when we invaded. Rice was National Security Advisor to the president.
After having my Bitcoins stolen, I wrote a service to prevent it happening again
Isn't Roslyn under Apache? Or am I misunderstanding the point here?
Crew Gears Up For Spacecraft Traffic at the Station
Examining the hull once found will dispel a great many theories.
I use Dashlane and its been great! Surprised not seeing too much support for it around here...
CLARIFICATION: I don't get a lot of Facebook messages. Maybe one a week. When I'm using the Facebook app, I take the time to respond to a message if I have one that is unanswered. If it wasn't in the app, I wouldn't switch apps to check the message.
Likely this is part of a strategy to get users to install all kinds of FB apps on their phone and slowly take over the phone experience. Next up, Facebook mobile games?
Yeah, i'm no longer a customer of theirs due to this decision.

I can't think of a worse cadre of people than the Bush administration to involve in my own personal matters of privacy.

While I would never hope for the dissolution of a company just because I dislike their tactics, I do hope that this decision they made affects their bottom line enough to let them notice it as a mistake.
> Dropbox keeps version of _existing_ files. You won't get back the files deleted and synched by mistake/misbehavior of some script

Err, that is exactly what they provide. You do have to use the web interface to see them, and it is trivial to restore directories and files. (A bit painful if you want to only restore some of the files in a directory.)
The man behind the videos of Airbnb, Square and Groupon – Adam Lisagor
My co-founder @8apixel and I co-designed it (we make competing designs then choose/merge the best ideas.) We both shared in coding the front-end.

Coding front-end and animations is just searching google for examples + practice. I didn't find a shortcut, sadly! I fiddle with CSS animations until they match what I imagine them to be. Ceasar (http://matthewlein.com/ceaser/) is really good for getting kinetics right.

It's also a huge help when designers better than you give you feedback and suggestions; because they can picture a different finished product to you. During Red Pen's development I would share Red Pen with other designers who would give me feedback about Red Pen on Red Pen (whoa).

Back-end learning was harder because I came in (a year ago) with little Ruby or Rails knowledge. Why the Lucky Stiff's ebook on Ruby was inspirational (and it had cartoons cats!!). Rails for Zombies was a nice primer to Rails. The rest was Google. Knowing devs was a bonus because I could hire them to cover my arse (security audits and performance optimisation.)
Fill in the blank: 50% of the things being compromised is ______% as bad as all the things being compromised.

Sometimes a partial compromise is easy to deal with, and the number in the blank is way less than 50. Lots of diverse things is good.

Sometimes half the units being compromised is almost as bad as all the units being compromised. Lots of diverse things is a bad thing in this environment.
"it's been the only viable way to fill passwords in for years"

Call me old fashioned, but I'd rather copy/paste than rely on the web browser within the app. The lack of attention for the desktop Firefox extension is what drove me to alternatives. After switching away, I realized I was paying for a payed proprietary system with no real benefits from an open source solution.
Headline really misrepresents the substance of the article. The headline -- and the first line of the article -- refer to the "imperfect messenger" description, but the bulk of the article/speech is about the issues raised by the Snowden revelations, not about Snowden's imperfeections.
The Google Drive sync client is lacking features for business. But third party Google Drive sync clients like Syncdocs http://syncdocs.com make it better than Dropbox.
Microsoft holds 200 patents that are necessary to build an Android smartphone
Apple's human interface boss departing company days after key testimony
I use Dashlane as well, have for about 2 years now, I love the app as an extension in firefox and the mobile app with secure notes.
Andrew congrats and thanks so much for making so many awesome interviews available for free. You are in a way responsible for my own evolution into startupland. I watched Dane Maxwell's two interviews on your site (among many others), which lead me to taking his awesome entrepreneurship course, which lead me to starting my own startup, and here I'm on the verge of going full-time with it. Will be relying on your interviews to continue to build & grow my startup and hopefully be interviewed by you some day :)
Tesla officials, reached for comment, say they can't talk about pending court cases.

From the same article, this line really stands out at me. Especially after reading what Tesla posted on their site.
I use LastPass and definitely recommend it. It will generate a random password for you based on definable criteria, which I like and use almost everywhere. The primary vector of mass attacks these days seems to be one compromised database leaks out, and then they use those cracked passwords to get into other sites where you used the same email/pass combination. Keeping track of hundreds of unique and secure passwords without a manager is untenable.
A lot depends on how many files you are syncing, and how often these files change and need re-syncing.
We're working on it! We'll support both - I think we solve different problems though.
I did read it. The usage is correct and the dictionary entry shows that "fallout" is indeed a noun showing "a bad effect or result of something".

Sorry - I think you need to read it again because you've clearly downvoted my response in error.