skysight-inc/HackerNews huggingface dataset:
>Linux support is considerably more expensive than Windows support

In my experience running a small business, Linux support was much cheaper than windows support. The Linux professionals seem to charge more but can almost always fix a problem twice as fast as a the support I get from Windows "professionals". I also ended up having less problems with Linux than I did with Windows (after a few initial bumps in the road). I've also talked to quite a few other entrepreneurs and many of them agree that Linux is a fine and much better choice for start-ups simply because you're starting from a clean slate (So there is no legacy code to deal with) and because 90% of small businesses and start-ups consists of a network of 10 or less computers.
Remember when the need which would drive new social network adoption was privacy?
Show HN: Knock to fake an in-come call
I think he's taking as given that he can afford the car. Which is fine, if he can afford the car. A decision model is not necessarily meant for all possible audiences. Sometimes it's particular to a person in a particular situation.
Some related work here:

http://sandstorm.io
http://kentonv.github.io/capnproto/
http://plash.beasts.org/powerbox.html
http://css.csail.mit.edu/mylar/
https://www.meteor.com

For web-based service pipelines under user control:

http://pfraze.github.io
I see the problem, and experience it myself to some extent. Yes, we'd be open to fixing it, as long as whatever we did fit well with HN's design style, which is to be minimal and unobtrusive, text-oriented, and so on.

I've written software to help me manage HN threads for moderation purposes. A lot of it might be useful for non-moderation purposes too, i.e. just reading the site. I'd like to open source it eventually.
Garbage In, Garbage Out: How to Lie with Bad Data
They are only in problem now, because they have released the patch. If no one outside the company saw that patch, they could spot the problem and fix it without anyone noticing and creating a PR disaster.
They probably wouldn't, but they could.
That is one argument someone could use against "participating in open source".

It's a bit to late for saving bacon, patch should be publicly reviewed before it went into production. So no bacon saved, but there is a hope for a smoke detector.
Very useful as a quick memory refresher and to have a short introduction to some of the 4.0 features.
The reason security will drive the adoption of a new OS is that little else will drive people away the current ones. In a future where our current architecture is being constantly exploited, then security will finally matter enough to drive us to something new.
Salesforce leasing half of SF Transbay Tower; tallest building in SF after 2017
courtesy of RDL.
This. People are quick to say "Linux is the best" when in reality, for most use cases, it's not.
Good job. I for one would be _very_ interested in a follow up post on how this turns out. Good luck.
Snapchat is huge right now. Looks like that was true.
Chrome 36.0.1933.0 dev-m correctly complains even though I do not have "Check for server certificate revocation" enabled.
There's a 280MB .webm video from CCC Dec 2013, linked here:

https://twitter.com/jonsolworth/status/451359584376995840
I drive a lot at night on I-70 between Denver and Green River. Visibility of the road is a big issue in the areas of tight curves. When I used to have an older car with weaker headlights having to step on brakes abruptly for not being able to tell which way the road ahead curves used to happen periodically.

Over the mountain passes in spring where the lane markings get worn down sometimes you just can't see anything w/o high beams (and risking to blind the oncoming traffic).
We have them in Texas but I've never heard them called that. Growing up we just called them "city titties" but I doubt that is the technical term.
Er ... yes?

http://imgur.com/omXommu

(Except the "110,000 computers" bit, this is just one.)
Spoonrocket looks the closest (CA only for now, I'm in NYC), so thanks for that. I'll keep watching them. I couldn't find a subscription option for Sprig; the others mentioned upthread were "ingredients only" services. Looks like this model is getting closer, though.

I think that a company like Spoonrocket experimenting with a subscription service would be worth trying - the companies would have steadier income, and customers wouldn't have to think about it unless they didn't want the daily meal.
Number Systems for Implicit Data Structures
>they care about usability and simplicity.

But this is at odds with your previous observation, that BSDs have low adoption. They are vastly more simple than typical linux distros, a fact that linux users complain about when trying out a BSD system.
> Well, the one big reason was that you were going to lose support for Python 2. Guido just took that reason away and now tens of thousands of new Python apps are going to be written in Python 2 because they've got another 6 years to worry about it.

This shows a serious disconnect from reality. Discontinued support for Python 2 was never a major reason to move to python 3 for apps. Library support is WAY more important in the choice to switch. If all of the libraries worked with Python 3, there would be no reason for app writers not to switch.
2013 thesis paper has useful background:

https://www.flyn.org/publications/2013-Petullo-Dissertation....
What's interesting is that I just watched a video that strongly relates to this problem last night (from DJB at CCC):

https://www.youtube.com/watch?v=IuSnY_O8DqQ

http://facthacks.cr.yp.to/

It is only part of the video, but they talk about searching Google and finding partial private keys, e.g. ---- BEGIN PRIVATE KEY ---.

Even with text missing, it is trivial to recover the entire key, because of redundancy that Akamai neglected to take into account. I never really thought about how those ASCII strings are encoded, but it's actually the 6 or so values encoded. If some are missing, you can recover the others.

In retrospect, why shouldn't the private keyh have RFC 822-like key value format so this is obvious? I don't see why it has to be encoded at all; the format is unnecessarily obscure.

The rest of this talk is also great. Most of it is accessible to non-cryptographers (like me), as long as you understand basic arithmetic and have an undergrad-level overview of public key crypto (which they give). They provide very readable and runnable Sage scripts.

I really like the batch GCD attacks. Very elegant and effective.
man, fuck those brain zaps.

i dropped down to 35mg for 4 weeks, then started taking them every 2 days for a week, then every 3 days, then i stopped.

When I dropped to the every two days per week period i was taking nefiracetam and also exercising. I still got the brain zaps but it wasnt the full on 'whats going on in my head, make it stop! ouch! fucccckkk!' zap that came with the 75mg doses. it was doable.

nefiracetam supposedly gives you some seretonin so it may of helped there. Its hard to say, im not exactly going to get back on effexor just to see if i can quit them without the nef :O

GOOD LUCK!!!!
Hurd might have been a better example.
So, I read a few of the papers. I'm hoping the Ethos OS folks are on this forum, since I have a couple questions and concerns.

First, my current understanding of the OS:

Networking TL;DR: Their protocol is called MinimaLT, and it effectively replaces TCP/IP. Traffic sent through a MinmaLT channel is encrypted and MAC'ed by the OS. Each user has a public key, which gets submitted to the remote host for each MinimaLT channel. The public key identifies processes belonging to that user on both endpoints. The user can generate a new public/private key as often as once per connection to allow for anonymity. The OS maintains one channel per host-to-host tunnel, and multiplexes it across applications.

Key management TL;DR: There exists an organization-wide key directory service and ephemeral key upload service. Servers register and re-distribute their ephemeral keys to their local key upload service, which synchronizes them with the directory service. Clients connect to their local directory service to get the ephemeral keys for other servers. The system scales up by piggybacking on DNSSEC--the directory service delivers its local servers' ephemeral keys to other directory services outside the organization by embedding them in short-lived DNS records (which then get cached).

Questions:

* It's not clear to me how a server comes to trust a user's public key. Is it trust-on-first-use? If so, how does a user revoke the public key? For example, if Mal stole Alice's key, now Bob's server thinks Mal's actions are from Alice. What do Bob and Alice do then?

* It's not clear to me how the directory service and key upload service come to trust a local server. Is looks like this is something the local admin has to do manually?

Concerns:

* I'm not sure if this is more secure; in fact, I think it's less secure than SSL. The authenticity and integrity of ephemeral server public keys are backed by DNSSEC's security. So, this scheme effectively replaces a bunch of (presumably) independent TLS CAs with just one: the DNS root. You can bet the NSA has the private key.

* I don't like how the network architecture couples key distribution to name resolution, which I view as orthogonal concerns. This design puts both under the control of the same administative entity, which makes it easy for that administrative entity to trick clients into communicating with the wrong servers.

* MinimaLT isn't amenable to content caching. How does a CDN know that two ciphertexts are really e.g. the same image file? If it can tell, then the CDN can break your end-to-end encryption. If it can't tell, then the origin server can't scale.
'..but don't actually help you do it day-to-day'

Most of the time, but by understanding those core concepts, you're mind looks at programming and solving problems in a different way. Similar to math, you may never use a differential equation, but by understanding it, you look at the physical world and interpret it in a different way.

Not my intent to look down on anyone. My point is simply that software engineering is huge, you don't learn it in 2 months. Done traditionally or independently, my hats off to you. It's no easy task.
I'm sure there's something I'm not getting here. Can you explain?
BTW, speaking of unintended consequences: I just love how on some interstates they put up bright orange lights right near an exit and a tight curve afterwards.

So, you are doing 84mph (speed limit being 75) and go from relatively bright lit area into a dark and a curve. A second of blindness inevitably follows.

Still, I would probably rather just have a higher divider between lanes in different directions, so that high beams can be just used most of the time.
Glowing lines will show even where your headlights are not shining. Curves and intersecting streets come to mind. Even gaps in the line for a driveway would be apparent.

We have some reflectors, but the cost of installing snowplow survivable ones is high enough that they are not justified according to our highway department. (Missouri, USA, 38°N)

If the glow doesn't add too much to the cost of the paint, it could be a winner.
There's a blurry line between 'diagnosed' and 'what kind of person you are' which is increasingly being encroached upon by modern medicine. Certainly there are lots of ways a person can be classified which only become a disorder when they go above a certain magnitude.

Progress will be made into better classifying people so that more and more regular folks can take advantage of strategies and 'treatments' to have a more successful life (whatever that may be). With this comes the risk of discrimination relying too heavily on these classifications, which, though real, will never be fair to judge a person against.
Heh, interesting. Is the knock detected by mic or gyro?
Usability and simplicity are often buzz words to describe familiar.
You mean like the stations that A Better Place was going to build but never did?

Or the ones where Tesla purposes to charge you $100 to swap it out?

The infrastructure doesn't exist and building a "swap garage" is just a pipe dream unless it can service a large market... so having a propriety battery system doesn't lend itself to that...

Its cheaper to fill up my tank...
You can already do this. If you use the estimate fare functionality, I've had drivers already know where I'm going. It doesn't seem like everyone is accustomed to this, though, since I've mentioned it and some drivers have no idea what I'm talking about.
Big defense contractors, horrifying beaurocracy and all, don't even recruit like this anymore. Source: I worked for one a few years ago and have friends who still work there.
I've worked in industry for 20 years. People take the same version of the interpreter, or start with existing scripts, to create new scripts. Even if there's a one rev difference, people often don't bother to upgrade. There will probably be hundreds of thousands, if not millions of Python 2.x scripts written over the next 6 years. Many will be small, of course, but it's code that will have to be checked against 3.x at some point. I threw out the conservative number because I thought it would be obvious to most people that given Python's popularity, a lot of new 2.x code will be written.

Obviously, if people were moving more quickly there wouldn't be a need to push out 2.7 support until 2020.
Yea, I've seen guys literally work themself's to death. They finally get the wife, buy the always buoyed yacht;
and die at 55. The wife gets over the death pretty quickly
because she really never knew the work horse, with all the
brilliant ways to get ahead. "He was a hard worker, and had
so much ambition---too bad he passed." I guess there's a happy medium to work? I'm not sure what's considered menial
these days? I heard people on this site refer to Plumbers and Mechanics as examples of menial occupations, while I
bet most make more money than the average computer programmer. We are in another tech bubble. I saw this in
the nineties. Guy's who threw around the word menial, and
thought their cushy, exciting computer related job would
always be in demand. Well, the crash hit hard. They went
through their savings. Didn't take a menial job, and by the
time the industry started to bubble up again they were just
a little to old, or rusty. They never laughed about the
menial workers of the world again. The party was over. There were no more alcohol fueled pub crawls--debating nuances of programming languages. There life just stopped.
It's kind of sad this industry is so youth oriented, but
then again the barriers of entry to this field are not that
steep--look at Jennifer. She's a Coder!
Enterprise-class cloud-backed storage systems
That's because there is no video. It's a sound fragment to which they added a single photo (not a render) to make it a video (why? no idea).
Pretty sure he was being sarcastic, referencing reddit, subreddits, and the /r/ url schema.
Idea: Biometric Signature Authentication as a service: We all have these incredibly powerful input devices in our pockets (aka smartphones). The idea is to create a powerful algorithm to verify someone using their signature by capturing the form of the signature, speed, pressure, etc... This would be provided as a service to different websites who require user ID on the biometric level.
Gmod Funny Moments – Haunted House, Guy Trapped By A Lamp, Trips By A Table
> I'm a long time believer that first you must do terrible things, then you can understand how much better it is to use a framework.

There was a moment many friends of mine started building their apps on Flask. They loved the freedom it afforded them.

Every app of this series has grown into something that user more or less the full Django feature set. All of those friends of mine ended um having to build their own Django, piece by piece.

There is a valuable lesson here: chances are your app will grow to need a full framework. Unless you can build a better framework, you should stick to one that covers the most common use cases.
Speaking as a security researcher at Akamai, I can say that
tptacek is 100% correct here. We're absolutely better off for having received Willem's report, and I'm pretty sure we're all mature enough to tolerate the jabs that accompanied it.

I didn't have any part in writing this allocator, but I was asked to do a code review prior to publication. I told Rich Salz that it would take me at least two days to do a thorough one, and we both made the decision that it was better that we just get this code out there for public review and discussion than that we wait until we thought it was perfect.

So, with the caveat that we're still evaluating most of Willem's technical claims (and I'm probably going to be in the office all night doing so), the only sentence in Willem's report that I really take exception to is this one:

In either case they should not be sending out non-functional,
bug ridden patches to the OpenSSL community, while claiming
they protected Akamai against the Heartbleed attack.

This statement is self-refuting. If we hadn't published this
patch, we wouldn't be having this discussion, and some of the bugs that Willem and others are finding would have gone
unnoticed. I almost certainly would have caught the issue with the CRT intermediates if Willem hadn't done so first, but I doubt I'd have caught everything that has or will be identified through public scrutiny.
Why would one ever put their enterprise storage in the cloud?
That is exactly the point. The author is proposing we replace one thing with another which doesn't fix the problem. There'll just be some other vulnerability with a passwordless approach we'll have to work around. I don't see the point to be honest. Passwords aren't what make web applications and services insecure, nor are they any more of a risk than say sending a user a temporary code to enter to login.

I am taking him somewhat literally because the author and the sensationalist title saying passwords are obsolete. As you pointed out yourself, passwords are not obsolete because how else are we going to login to our email to get our temporary passcodes (if sent to our email)? Any solution which pitches itself like: well you would use it for everything except for the one thing you most likely would care about protecting over everything else, your email.

My argument against this approach is it doesn't solve the problem. Those generated passcodes are being stored somewhere on the server-side, correct? How is what the author proposing any different to that of a securely hashed password? Replace hashed password with hashed temporary code and you get the same results: they're both passwords when you view this proposed solution on a technical level.

To quote a few parts of the article:

Passwords are obsolete because of email and SMS. Specifically, the ability to send an email or SMS to users reliably and quickly. In theory, we’ve had that ability for a long time.

Sending our a passcode via SMS which the author seems to be a fan of costs money. Unless you're the likes of Google, Facebook or Twitter, implementing a solution that costs real money on an already tight-budgeted service is most likely at the bottom of your priority list, if you have thousands of users logging in daily, that's a lot of cash being spent, even if an SMS is cents on the dollar. Why would I implement a solution that is for people too lazy to use a password manager or use strong passwords for the various web services they use?

Adding in functionality that requires use of a third party service also doesn't sit well with me. I have to trust that Twilio or whomever is sending out these SMS's have a secure service that isn't going to allow the wrong people to get passcodes sent from the website because of some API flaw nobody has discovered yet (or heartbleed like attack).

But the recent Heartbleed bug highlights the fact that hacking password reset flows for convenience is not good enough. We need to convince websites to stop using passwords altogether.

As I pointed out, this temporary passcode approach isn't truly passwordless. A hash is being generated on the server side, stored in a database awaiting a user to login. The difference being the server is generating the passcode for you and you're trusting that passcode is secure enough.
I always like reading historical analysis, but have a few questions:

> We did a bad job of distributing the wealth generated by that.

I'm not sure what you mean here. Do you mean that those that profited did not reinvest in stocks that may have helped companies grow and provide jobs? Or, that the government did not tax enough to pay its own staff and overhead and then redistribute via programs that do not necessarily target the areas that really need it? Or that they should have given that money to churches and other charities to distribute?

The reason I ask is that there are few pure redistribution models. The closest are some churches and charities, but they typically still have some overhead deducted. The next best can be stock investment, as, depending on the companies, that money is in large part repaid in the form of raises or new jobs. The least efficient is ofter government, because accountability is limited to the % wasted in the process of providing services, unlike capitalism where competition provides accountability; if you do poorly, you don't survive, unless a government bails you out.

> What happened to agricultural commodities in the 1920s is happening to nearly all human labor now. And that's pretty terrifying.

Could you expand on that and provide some references?
pocket even provides an rss feed of saved items so you can read and manage them in your reader.

No affiliation to pocket and no idea if other similar products do the same thing.
We've created a big ass list of ecommerce platforms
I totally hear you.

Collapsing comments is something we'll definitely be implementing. Collapsing all comments does sound useful.

The problem of finding new comments on popular threads is tricky. I'll probably always lean towards the most minimal change possible for a community as active as HN.

A light way to do it would be to have some visual indicator that makes new comments easier to find. Another way to do it would be to have a separate view for each thread that's like /newcomments (an RSS feed wouldn't hurt either) I may play with providing sort options that does this dynamically with JS.
wasn't this stickk.com?
This was the path I've tried to take from the beginning ("think of a small project and build it"), and have stuck to it for stretches. However, the last contract stint I did kind of put me off that track, and I think my skills regressed a bit while I was there - I was just banging scripts together basically.

I'm about to start working with a mentor who's far more experienced than me, and who can chat a few times a month around what I'm doing right, wrong, etc.

I'm currently helping out a startup, but for very little money. The experience has been helpful for sure, but I'm not sure it's getting me closer to someone who can handle a feature/application whole hog, start to finish.

Funny you mention the Navy, I was very close to enrolling in officer candidate school about 5 years ago, but couldn't for medical reasons.

You're probably right about focusing on a couple of specific positions/companies. Again, it's something I've thought about and done before, but I guess the panic of not having a job has thrown me off of plan occasionally.
I was just testing OsmAnd, this fits in nicely. So I try the same route...

> Roadli currently only supports trips shorter than 300 km

Okay great. So basically you made something that can do less than Google Maps, TomTom and OsmAnd can? Especially if you include the option to add an N number of waypoints.
Diversity and Dishonesty
Ha ha. That's funny. My comment has been downvoted. So even meta discussions about humor are frowned upon in this establishment.