skysight-inc/HackerNews huggingface dataset:
>HSM modules already have PKCS#11 drivers, because it's a standard, and that means they work readily with existing software and cover the requisite industry use-cases.

The OP isn't talking about using an actual HSM, but using a new software based daemon to do the HSM role just so the crypto calculations (and the key) aren't in the webserver's address space. He confirms that he is indeed trying to write the PKCS#11 driver himself. Just using the existing crypto code in Apache/nginx but moving it into a separate process seems much cleaner to me and has the one feature this suggestion doesn't, it works with existing config files without modification so will be used much more widely. That's all I am saying.
Not everyone has smart phones.

Not everyone that has smart phones keep it on them all the time.

Not everyone that has smart phones that keep it on them all the time have a working (charged) phone all of that time.
Did they reduce the price or is glass still $1,500? I could not find this information on the web site.

I am very curious about what will be the final price for glass and more specifically, if it will be more expensive or cheaper than an iPhone or equivalent Android phone.
Forgot to add /s to my comment.
I don't see that as being financially viable in the way I was referring to, taking care of the elderly. I was thinking of something more like warehousing them, at best.

Their economic system is so broken I'm not sure more robotics would make a qualitative difference in the outcome.
I write my own custom scrapers, I prefer the flexibility and feel safer that the service isn't going to disappear any minute.

If anybody is interested, I wrote a detailed article on scraping not so long back that was well received here: http://jakeaustwick.me/python-web-scraping-resource/
> Everyone is making the assumption here that what the CTO is doing is wrong. It may have been the right thing to do for the company. It is just the wrong thing for the OP.

Barring the question of whether the OP is just lying about what's going on (so taking as given that the concerns raised are technical proficiency and that the CTO is asking the OP to leave the company and not just to lay off doing production coding work), I'm curious if you can explain under what circumstances this would be the right thing to do?

Undermining someone like this strikes me as probably almost never the right thing for the company. It's toxic and destroys trust in all directions.
> The major problem is that anyone over the age of probably 40 would be crippled by a migration to say Ubuntu

I accept that migrating to a new platform would entail an amount of disruption, but I don't see what that has to do with anybody being over 40.
What I find frustrating with an event such as this is the attitude of the school's principal is also taken by the police authority and the justice court of South Fayette. If true, is South Fayette stuck in the 60s where discriminations against anyone not mainstream are bullied, tormented and punished?
Oh come on, the man hour cost to install the update is miniscule to the cost of a Windows license per machine (even if they do get site licenses). And if their problem is budget, switching to Linux is a potentially valid fix for this problem, as the cost (even though there is still a cost) would be dramatically lower. Although again I'm not advocating for the change as there are many other issues that would be caused by this transition.
1. I used to consider the size of Windows a problem, then it occurred to me that I no longer play video games, and my video sources are all streaming. My 1TB hard drive has 800 GB free. Government employees outside of media offices and labs/shops that are heavily dependent on large data sets or large resource files like CAD or GIS data are probably not facing a data crunch on their user workstations with the current cost of hard drives.

2. Didn't like my response to this, may edit later.

3. Now this is reasonable, software installation on Windows sucks by default. However, there are some good tools out there for handling the distribution of software. I recall using some when I worked in IT at a university. Ghost had a way to do it that was essentially taking a snapshot, installing, then another snapshot. The difference was what got installed onto the rest of the computers. There was also a piece of software we used that let us handle on-demand software installation for things with limited keys (like Matlab), I don't remember (a decade ago now) what this one was. Not baked in, but it was more than serviceable as I recall.

4. IRS probably still has a fair number of mainframes. If they're like other federal agencies they'll have a mixture of Solaris, Windows and Linux servers installed depending on the contract at the time the information system was put together. Again, that modularity would be nice, but it's hardly practical unless the fed establishes one organization to be responsible for making, supporting and distributing this OS. Then you'd get a bunch of folks on the right bitching about government interfering with business, and people on both sides bitching about the security/privacy implications.
Getting an error: https://gist.github.com/akshatpradhan/10603374
If you want to share ownership with a community of builders you can post up ideas to https://assemblymade.com
The informal way things worked before is exactly the same as how they work now. There is no "new HN position". The only difference is that we're trying to be more transparent, and that's not a policy change—it's that we have more time to put in to answering questions, and users made clear it was something they wanted.
Some GPL project have added an OpenSSL exception to their licenses specifically allowing OpenSSL to be combined with their project.
How Mark Zuckerberg courts companies
This is along the lines of structured arguments http://en.wikipedia.org/wiki/Argument_map

Doug Engelbart the creator of NLS and famous for Mother of All Demos talks about such systems http://youtu.be/xQx-tuW9A4Q and http://youtu.be/VeSgaJt27PM etc.

The general principle is we won't make much progress discussing complex issues by simply recreating the print world with increased convenience of a computer like we do now. The discussions have to take a fundamentally different form, possible only on computers, such as semantic argument maps, etc.

Of course his perspective comes from 1950's when educated people had civil discussions that solved problems, or at least that's the modern nostalgia. He imagined a new class of "knowledge workers" moderating information. Instead we have voting rings and content farms.

If anything, a structured argument map could shut down much of the attention seeking drivel surrounding every political/complex system issue.
Less Wrong explicitly doesn't talk about politics (or at least tries not to), so it's not the right venue for the sort of thing OP wants.
> Ruby on the other hand is pretty much just Rails[1]

Puppet and chef say hi.
It could work, but can you imagine the extra complexity for the interpreter? It would require extensive type conversions every time an object passes the version barrier, and all the Python3 libraries' classes would have to be backported for compatibility.

And it's not just a matter of sacrificing core dev hours for the greater good, the result would be much slower and full of gotchas.

This is a very creative idea, ingenuously simple, but I don't think it would fly.
Seems important to note that the article doesn't seem to be about capitalism per se, but "business-friendly" capitalism as currently practiced in the U.S. and parts of Europe.

In that regard the conclusion (regarding wealth inequality) really isn't that surprising. If the ROI of having money is really higher than the ROI of earning money (i.e. by wages) then the conclusion over time is as simple as the solution to a binary star system containing a black hole... eventually through the iterative process of the economy any given dollar is likely to fall into the basket of the rich guy, and it is much harder to escape that basket than the basket of the poor guy who needs to spend simply to live.

The article doesn't seem to conclude that capitalism is flawed though (at least to the extent that Marxism is called for), but that our actual capitalist system needs corrections made before revolutionary corrects get imposed by force.
Sure, the panel is getting cheaper. But transportation, installation, and land are not. It is still likely that panels will be more cost effective than more complicated, expensive installations, but probably either oriented to the sun at noon, and make sure there are as many as possible in that orientation in the space available. And anyway, it would just be half a pyramid. no point in orienting them to the north in the northern hemisphere or to the south in the southern hemisphere.
The talk.origins archive (http://www.talkorigins.org) attempts to do this for all of the arguments posed by creationists against modern evolutionary theory.

Unfortunately, there are still creationists. Even when there is overwhelming scientific evidence in support of one position, people will still hold another.
A building that can turn to face the sun
converting to and from mechanical energy is inefficient. But it has been done in some places.

https://en.wikipedia.org/wiki/List_of_energy_storage_project...
You should check out innovantage, halfbakery, or marblar. There are literally 1000s of ideas out there.
Thanks for the heads up on gengo.com. I shall checked them out. Have you dealt with them before?
But be aware he's considered something of a blowhard and not taken very seriously by the expat community in Tokyo.
What if it's not sunny the day before? The glow in the dark paint won't have a chance to recharge.
What I've learned is that complex political issues -- essentially anything that isn't a universal "no-brainer" -- comes down to tradeoffs.

In fact, I've found a good political test to see if the person I'm speaking to can articulate a valid criticism of their own position. I.e., if they're for universal healthcare can they state why one would oppose it, without calling into question the opposition's character.

If they can, you can have a fairly thoughtful discussion/debate on the topic.

If they can't, then there's no point discussing things.
Obviously they are not, but they pay the same amount of taxes regardless how large their spending is.

It's a concept so basic I'm stunned that anybody would be so bold to write a sarcastic comment about it.
> No substantial discussion of invoicing issues, no discussion of how governance could be changed to address these issues, no discussion of how contributors and users could get involved to fix things, no discussion of what the Gnome Foundation has accomplished and whether it could be more efficient about it.

I thought I was pretty clear on this point; the Gnome Foundation board appears to have operated far outside the foundation charter and if so, should be censured and ideally recalled.

Assuming that this assessment is accurate:

To address continuity of the OPW specifically, board members that wish to continue administering the OPW program can resolve governance and accountability issues, while ensuring OPW's continuity, by resigning and founding a distinct organization that has within its charter the administration of OPW.

Any remaining board members should be recalled, reaffirming the board's fiduciary mandate to operate within the Gnome Foundation charter.
Good line! But in reality -- speaking as a former journalist and a founder of a new SF bay area startup that's in the same business -- news organizations have done this kind of thing forever.

One journalistic function is ingesting a tremendous amount of information, then filter it -- so people reading the WSJ's venture capital blog can bookmark it and read only articles that are relevant. A generation ago it might have been highlighting the best news stories in the trade press. Today it's subscribing to the Twitter feeds of dozens or hundreds of VCs (including Marc A.). Highlighting the best ones provides a valuable service.

Of course the HN-relevant question then becomes: can this be better done, or equally well done for less $$$, algorithmically. :)
While the snark is amusing, there's a big difference between running a business with a hard budget and always being able to borrow or demand more money.
Scrapy gets a solid recommendation from me. http://scrapy.org/
> rely on an API that could just vanish the next day

Kind of ironic that you are saying this about web scraping ...
A PKCS#11 driver can simply fork() itself to operate out-of-process, without implementing some sort of heavyweight daemon.

Apache could ship a fall-back PKCS#11 driver implementation that did this, transparently.
I mean, I figured it was worse than a battery, but if you can store it much more cheaply it might have been worth it? EDIT: The link also goes through some of the pros and cons. Thanks!

And cool, my guess at a name wasn't too far off:)
I've also had this on my mind for quite some time.

How would you actually implement things though? After all, you're essentially trying to sell "support contracts" for open source projects via the platform. You could implement these by a) "hiring" the project owner to work on specific bugs/features or b) hiring freelancers to fix requested bugs.

Furthermore, how would you ...

* determine the value of bugs/features?
* react to a project owner abandoning a project?
* handle multiple upstream developers?
They sent me an email:

> This isn't the same Glass you saw last April. In the past year, we've released nine software updates, 42 Glassware apps, iOS support, prescription frames, and more, all largely shaped by feedback from our Explorers. The Explorer bundle costs $1,500 + tax and includes Glass, charger, pouch, mono earbud, and your choice of a shade or a frame for no additional charge.
Just to be clear, I wasn't disagreeing with you, I was disagreeing with the article. Their method over SSL/TLS is just as broken as you say.
(I worked with Willem at Matasano for a couple years, and he knows what he's talking about.)
> With a good community making hotpatches, and explaining their fixes I will install them.

You will have to be reassure that your patch will work and is risk free. If not, get ready for a bill and possibly a congressional hearing.

Good community is great, but you need to shift responsibility whenever possible. Not that there aren't any kernel hackers work in the public service sector, but they have other important things to do than fixing someone else' product if there's a choice.
One thing I've always found bizarre is that ClojureDocs hasn't been updated since 1.3. I know it isn't an official resource so you may not be able to do anything about it, but it's always at the top of Google's results.
Yes I used them to translate some of the text in an app to a bunch of other languages, and it was pretty easy, and a good translation (so I am told, at least). Note that I'm not affiliated with them at all, and have only used it once a year or so ago.
First, I don't like the "random patch" expression. I am talking about patches discussed by the reverse engineering and security community. IRS is already patching their systems in a similar way when they update a Linux distribution.
If you read the article, they have already upgraded some of their computers, so the upgrading user applications has already been done, as the machines that have been upgraded would have needed this. The training required to go from one version of an OS to another version of the same OS, is very miniscule, as (at least for the standard user usage, which the majority of IRS users, they fall under) OS developers go out of their way to make the changes as seemless as possible. And sure upgrading hardware may be a cost, but again this generally a much smaller problem with Linux, as Linux is generally a much lighter weight OS than Windows is.
Glass has become uninteresting enough that I didn't realize this wasn't already the case.
Well, back of a fag packet calculation...

Let's lift 1KG of water up 5 meters.

That will require 50 joules of energy (5 * 9.81).

Suppose I want to store 5kWh of energy (half my usage).

1kWh = 3600000J

5kWh = 18000000J

1KG of water is 1 litre.

I need to store 360,000 litres of water - that's a bit too much did domestic use :-)

Is large here - but I think that's about right.
I think the change would simply require servers to always send a certificate chain (up to at least the cert's most-proximate global-issuer CA) instead of just a cert. Which is pretty much what every web-scale site does already, to short-circuit OSCP lookups on intermediate CAs.

DNSSEC needn't be involved; you aren't determining whether the CA owns the domain it's issuing certs for at runtime. Instead, the parent-CA who issued the CA's signing cert determined that when they issued the cert. As long as each certificate in the sent chain both 1. checks out as signed by its parent, and 2. has a subject hierarchically below its parent's subject, you can be sure each CA in the chain did whatever it considers diligence before issuing certs to its child-CAs.
Lastpass might fit your need.
I'm evaluating these to augment a system I'm building on top of casper. This is the first I've seen of this one, but right out of the gate I think I prefer Kimono.
I'm also too lazy to actually do the calculation, but to a Fermi approximation XKCD has already more or less proven[1] that it's not terribly practical for a homeowner as an energy storage solution.

[1] https://what-if.xkcd.com/91/
This was on the Dutch news a few days ago. They mentioned there'a apparently a way to manually charge the paint as well. No details.
Probably because there's a small market for that? I've met technical people that don't even make their CSRs, they actually have their CA generate private+public keypair so they don't have to figure it out.

Also, CAs make more money if they can issue each leaf cert themselves. Some CAs don't even allow you to get multiple private keys signed (only one active at a time) without paying more.
It's the "using it in strict mode is an error" part that's important. Compilers can automatically refuse to compile deprecated-but-not-broken code. What can automatically refuse to let you start a new project in a deprecated-but-not-broken language?
Of course there is one truth. 1+1=2, Global warming either is or isn't real, gun control either does or doesn't reduce homicide rates, etc.

Aumann's Agreement Theorem suggests that two rational people can not disagree on a subject if they both fully understand all the evidence and arguments. All disagreements stem from some combination of misunderstanding, ignorance, or irrationality.
The purpose of the incredibly high cost is to add a big artificial barrier to entry for a beta product. It limits the users to the people who really care about it and the wearables movement (and have the money!) It also allows Google to provide excellent customer service/support for Glass Explorers, which is important for Glass's image and collecting feedback.

I'd say that this one-day gimmick is a good sign that Google is slowly trying to introduce more Glasses to the public for a full release sometime this Fall (not around now, as many were speculating). The actual BOM cost for the current Glass seems to be around $200, so hopefully the official product will be considerably cheaper. That's what I'm waiting out for.
Unfortunately, Google maps caching works as view-only. There's no offline navigation at all, I imagine that's all done serverside. Only the tiles (or now vectors) are downloaded.
Oh, the joy if every social issue could be communicated along with a nice set of numbers ("This is quite commonplace, as it happens 30% of the time, or 2,235 of 7431 cases").

Unfortunately sometimes citizens have to resort to the old-fashioned and not 100% accurate "judge for yourself, based on the partial information that is available, to figure out what the bigger picture is".
I'm a long time believer that first you must do terrible things, then you can understand how much better it is to use a framework.

In my case, I made a bunch of Flask apps, and while quick easy and fun, in my inexperience things quickly descended into a disorganized mess. Now that I've struggled with that, I understand the purpose of the structure of frameworks like Django or RoR. I have more perspective because I didn't jump in to the high level straight away.

Now, that's not to say this is the only way to learn, or the right way to learn. I just think it was a nice thing to learn, and tangentially related to the topic at hand.
Controlling SSH authentication keys with DNS
In my federal government research lab, we have 15+ years of Excel scripts behind a huge amount of our ongoing analyses. Whether this route was the best or not is a bit moot now (Excel dependence grew by individual choices on the local level); currently the expense of the switch would be very high. Also, in any interaction with the outside world (like Universities), Office is still the de-facto standard. An attempt of mine to lead a co-authored study in a Latex document, with several scientists at universities, caused mass confusion (as opposed to just 'track changes' in word).

We're slowly creeping to R, python, etc., and Linux is allowed as a choice (about 10% of us choose it). That said, my lab made it over to Win 7 about 2 years ago now...

I like the linux alternative, but I like even more that decisions like this are made at a local level, rather than through a massive top-down disruptive push.
If your interest is open source generally, you may find a more open technology/programming meetup rather than something specifically aimed at linux might garner a better response.
Introducing the Radgile Vic 2020 Video Integration Console [video]
This is the same state in which this atrocity happened, with essentially no fanfare upon discovery: https://en.wikipedia.org/wiki/Kids_for_cash_scandal

Based on my reading of the situation, including who got charged with and convicted for what, two judges shut down a state juvenile facility in favor of a couple of new private ones, extorted payments from the people doing that (obviously the balance of bribery/extortion/collusion can be very hard to figure out), and then proceeded to make sure the facilities were stuffed full of "offenders":

"For example, Ciavarella sentenced children to extended stays in juvenile detention for offenses as minimal as mocking a principal on Myspace, trespassing in a vacant building, and shoplifting DVDs from Wal-mart."

I looked at the Myspace incident in detail, it was not criminal in the least.

NOTHING in this realm would surprise me coming out of that state, which I long ago crossed off as a place to step foot on.
Yup, that seems to be exactly what I was thinking about. Thanks for replying!
>A PKCS#11 driver can simply fork() itself to operate out-of-process, without implementing some sort of heavyweight daemon.

The OPs proposal was for a daemon so it could be run as a different user. My suggestion was indeed to fork and figure out how to isolate the process (as forking may not be enough if you have permissions to do things like ptrace processes running under the same user).

>Apache could ship a fall-back PKCS#11 driver implementation that did this, transparently.

What you are proposing then is something different. It's to make the only crypto code path the PKCS#11 one and then make the normal case the special case of that. So you are going Apache->Gnutls/OpenSSL->custom PKCS#11 driver->fork->Gnutls/OpenSSL(to actually do the crypto). Since apache already has working code for the first and last steps you could just do Apache->fork->Gnutls/OpenSSL and be done with it. Your suggestion adds more complexity but improves the support for other more exotic PKCS#11 providers.
It's a very good idea ! Why don't you crowdfund it (kickstarter, indiegogo...) ? This way you could test your idea and get some "free" marketing.
How do you feel about ordering complex numbers?