skysight-inc/HackerNews huggingface dataset:
The problem with this is that it's not as convenient as passwords and people hate things that are even slightly inconvenient.

Typing a username and password is very fast assuming that you remember them both (even faster with a password manager).
Now you have to log in to your email every time you want to log into any website. This is especially inconvenient if you are a webmail only user. Or you have to get a code sent to your phone which you have to retype if you want to use the website on a different device.

What happens if your email provider goes down, or your phone isn't working?
POTUS is Commander-in-Chief of the US military. NSA is an organization under the US Department of Defense.

POTUS can fire the head of the NSA. Truman fired Macarthur.

It's an interesting discussion the extent to which reality matches the law, but according to the US Constitution Obama is in command of the NSA.
Maybe I'll actually use Puppet now. Very cool news.
This is a mistake. The Apache foundation doesn't sell $250/hour consulting gigs for its primary source of revenue. Neither does the Linux Foundation, the SQLite Consortium, or other massive, mission-critical open source products.

This is the wrong funding model. It keeps money in OpenSSL developer's pockets, but there is no financial incentive for any OpenSSL developer to work on foundational improvements to OpenSSL. He said himself: there is over $100,000 in open contracts for competent developers to work on non-foundational improvements to the project. If you are an enterprising developer with good C skills and a knack for crypto projects and you apply to work for the OpenSSL foundation, are you going to start servicing that $100,000 pool of contracts or are you going to pretend that money doesn't exist and live on ramen?

If nearly all of OpenSSL's revenue comes from clients that want OpenSSL to meet their particular needs, then none of that money is going to developers to strengthen OpenSSL's foundation. This is why OpenSSL looks like a hodgepodge of hacks upon hacks in order to accomplish narrow goals with limited impact testing. It should be no surprise to anyone else: clients are literally paying OpenSSL developers for this, and nothing else.

Who is paying OpenSSL for developers to clean up the code base and remove ancient #IFDEFs? Who is paying OpenSSL for developers to analyze code paths and do case analysis? Who is paying OpenSSL for developers to write unit tests or even have a test harness at all?

No one will pay an hourly rate to accomplish these tasks. Google is not going to pay by the hour for a developer to stare at a function until they grok it; they want a feature. Joe Company will not pay for developers to write unit tests, they want OpenSSL to handle $QUIRK from a vendor's system, or to know how to make their code handle it.

This model needs to go away. Competent OpenSSL developers time is too valuable to waste on client asks. Their project is too important, and as long as the money is flowing only for novel features and not structural improvement, then that money will dictate that only new features are developed.
Different browsers have different default values, a css reset is there to remove those inconsistencies allowing a fresh and sane starting point.

check this page for more info and an example of a css reset:
http://meyerweb.com/eric/tools/css/reset/
You're using the word "spread" idiosyncratically.

"The" spread is the difference between the best bid and the best ask. A market order "crosses" the spread, requiring the buyer to pay the best ask price or the seller to take the best bid price.

The function of a market maker is to bridge the prices of buy-side investors.†

Without market makers, spreads are much wider, because they depend on which particular long-term investors might be willing to trade today and what their limit prices are.

Market makers are willing to buy or sell in the middle of the spread --- presumably not all the way down at the best investor bid, and presumably not all the way up at the best investor ask. By briefly jumping into the middle of the spread, in effect finding compromise prices, market makers collect what's effectively a small fee in exchange for improving the "resolution" of the market's current price --- from, say, "XYZ costs 10.00 plus/minus a dollar" to "XYZ costs 10.00 plus/minus 2 cents".

In the 1990s, market makers were humans, and they were only required to quote prices to the nearest 1/8th of dollar. The price delta between the true market price for an instrument and the nearest 1/8th was a rent captured by the market makers. In practice, the situation wasn't even that good: market makers colluded to avoid quoting "odd eights", in effect offering only "to the nearest quarter dollar" resolution.

Electronic market makers (a/k/a HFTs), though not operating out of the good of their hearts (nobody in the market does) impose serious, fierce competition on market makers for different instruments. Instead of charging 0.12-0.25 cents for the service of discovering the clearing price of an instrument, they charge pennies. The 10-20 cents the HFTs shave off the spread is money into the pocket of anyone who trades, which very much includes "some dude wishing to invest his money".

In fact: if you read the responses to Lewis' book, the one consistent thing you'll see is the notion that if HFT harms anyone, it is not the retail investor. Even the people making the case that HFT is evil are making that case indirectly, by suggesting that HFTs impose costs on large sophisticated investors that act on behalf of ordinary people. (But then, Vanguard disagrees with that, too).

† The "buy" and "sell" in "buy-side" and "sell-side" refers to the intent to transact in liquidity , not the actual shares; the buy-side isn't "people who want to buy shares", but rather "people who want to trade now", or perhaps more accurately, "people who want to maintain long-term positions". The buy-side is "customers of the public markets" and the sell-side is "people who make the public markets work".
Also, don't listen to the negativity in this thread. The majority of commenters have probably have never done a crowdfunding campaign, and are not likely going to back this because they don't know you.

It's important to have a clear pitch, and easy to follow dialogue, but that isn't going to help you make this goal.
Ask HN: Students unaware/apathetic about Linux group at college; how do we grow?
I attend UT Dallas, which isn't a major college by any means but it is one of the largest public colleges in the DFW metroplex which has a lot of tech talent around it and has potential for even more (both the college and area).

We have a Linux user group (lug.utdallas.edu) and it is a struggle to get people involved. Personally I can't imagine being involved in tech without being interested/involved in open source stuff; it is kind of the whole point to me. But that does not seem to be the case for a lot of the students who are there for the degree and to get out of there (which is fine and dandy on its own). In the last three months we have had a Steam meeting, a cryptocurrency meeting, and Amazon came and presented AWS; each with varying degrees of success, but not overwhelmingly.

I envy colleges like MIT or Stanford that have a proud history of a tech/startup/open source culture on campus. Is there something that our Linux user group can do to foster something similar?

Thanks.
The deprecate-warn-remove pattern seems to work well enough for smaller changes.

So maybe it's only when you want to do something as invasive as switching the default string type that things go so sideways, if that is even the right description for Python 3 (which I think you could argue was really about having a better language available in 2015 or 2016 or so, not just being the Python after 2.7).
Mozilla Persona authenticates you using your email without the need to check your email every time (and without the need to enter your email password if you are already logged in).

Persona is awesome for that, and for the "no central authority" thing. To bad it lost momentum and seems an awesome relict inside of Mozilla.
Obama Lets N.S.A. Exploit Some Internet Flaws
Given the scale of reworking and reorganizing that would be involved, I assumed a fork would be the only viable approach.
There are several softhsm's, they just share the address space with your frontline daemon which (IMHO) defeats the purpose.

While webserver's support for PKCS#11 is annoying, it's well supported by lots and lots of other stuff (usually client side stuff like ssh, browsers etc tho). You can get webservers to do PKCS#11 today, there are docs on how to do it. They usually start with "download the source, and run configure with this pile of options."
Why support GNOME?
Pretty much all of these were "fixed" in Modula 2 and Oberon/Oberon 2/Oberon-07 too, which Wirth designed.

Modula-2 was known from at least 1978, and pretty all commercial Pascal implementations added features that solved all or most of the issues in Kernighans article, so frankly it was a bit of a strawman. Indeed, plain, original Pascal was unsuitable for large scale non-teaching use, but very few people even had access to a Pascal implementation that implemented "just" the original Pascal.

A very few of the issues he raises are intrinsic to Wirth's philosophy of compilers, though. Such as one-pass compilation, which massively simplifies his compilers and speeds up compilation. This is a feature of Wirth languages, which one may certainly disagree with. While I prefer more flexibility, I never felt all that restricted by it, given forward declarations support in every implementation I've seen.
You are correct, but the number of blockers is getting smaller. I sympathize with your situation, boto is a pretty big blocker (PIL was too until I switched to Pillow) and it impacts several of my projects, but thankfully I can work on porting my code to 3.x with six https://pypi.python.org/pypi/six and still deploy on 2.7 until boto gets there.

and Twisted seems to be making good progress:

http://twistedmatrix.com/trac/milestone/Python-3.x
I'm late to this party, but the answer for you is to just not upgrade to Varnish 4.0 yet. Keep using 3.0.5, which is still available and still stable.

The "standard" VCL files for popular apps like Wordpress and Drupal will be updated eventually for Varnish 4.0 by the people who maintain them--which are typically not Varnish staff/volunteers, but people who work with those applications specifically.

When services like Varnish go through major upgrades like this, it is normal for there to be a lag between the main release, and the general availability of updated "recipes" or plugins.
It's not about the language. Languages are easy to learn. I can learn one between breakfast and lunch and be productive by dinnertime.

I use Python 2 because of the massive ecosystem of libraries that have been written, work, and will continue to work.

It's shortsighted and more than a little irresponsible to shame or muscle people into switching. Code that works is valuable. Code that has been tested for a decade is valuable. What's not valuable is forcing an upgrade to a platform that nobody wants to upgrade to while forcing us to abandon third-party code with years of field testing that the authors aren't ever going to port to python 3.
Small ones as Py3, doesn't deserve a major version boost. It simply doesn't have that much to offer.
Yes, the How was the disconnect. It still is.
That would have been a good idea. I just checked ours April 6th and 9th.
Allison Michelle Ernst, Clinton Shoe Assaulter, Under “Mind Control?”
Multi-factor authentication is still required to protect the email.

The only problem I have with two-factor auth on my Gmail is that I sometimes just don't have my phone with me. I don't remember if I could send a confirmation to my backup email address or not. A while ago my Android phone's screen experienced glitch and wouldn't respond. I was in the middle of some important business which required me to access my email. But the screen was dead so I couldn't access either the Google auth nor SMS code on the phone.
Fascinating, thanks for the pointers.

I'll have to look at them further, but what I think they might lack from what I posted is a notion that different users will value some gray area arguments differently. The system should preserve those differing value systems in the arguments constructed and use them to build upon the webs of trust. For example, user bob may find it axiomatic that "healthcare is a right". User jeff will typically downvote arguments that assume that right and not want to build his framework on top of it.
Depending on the content, I would consider even charging less, anywhere down to couple cents, given a practical micro-payment system.
Easy enough: http://www.forbes.com/billionaires/list/#tab:overall

The Sunday Times has one too, these sorts of lists are very popular.
> Why should I use OpenSSL for TLS termination when formally validated alternatives exist?

Oh please do share! (spoiler: alternatives which enable side channels because the pretty compiled-optimized-code (that is generated from source code that itself may feature immutable data etc. with no side effects) is ripe with leaks via cpu branching, caching, etc etc do not count.) This is not a spiteful rhetorical inquiry, by the way!
can't use print x anymore, which also gets rid of "print x,", which printed something without making a newline, for one thing.
Thanks for your reply zasz. Your validation means a lot to me :) and will definitely keep your suggestions in mind.
You can signup so that you can be informed once we launch :).
You're right, this doesn't solve 100% of the problem. If I could solve 100% I'd be creating a startup...

Cookies are remarkably sensitive, but they can be far more easily rotated. I can make sure that every cookie is rotated transparently every day or so and leave that running as a sensible background precaution. If we had infrastructure that let us renew our TLS keys every 24 hours or so, this wouldn't be such a big deal (it would still be a big deal, but not quite as bad as it is today). But TLS keys have an expiry of usually years.
I'd love a "profiling firewall", so to speak. I hate it when tethering when iTunes downloads a 500mb update without telling me.

In general, your Laptop has no idea that it's tethered and therefore data is more scarce than normal. Something that flips between "ok go for it" and "restrict these apps" would be nice, especially if it were automatic.
Front-end dev to build interaction design tool at Pixate (YC S12)
Personally, I think a straight up analysis like the OP here is not particularly cruel, if it can be internalized by the team (which basically means they can listen to it and not take it personally)

Summarizing it seems to be, story is poorly defined, the retro-8-bit art doesn't work, and the lack of previous efforts does not give one confidence that these things will be fixed.

I agree that failures will help define the value of success in the future. (Experiencing overcoming that is the 'reward' for putting in the effort)

Short answer on the feedback, for the author, you are failing because you are not ready yet. This has been a good checkpoint, and you have some good ideas in this list of comments to explore.
Check out virtual smart cards, a very cool feature:
http://www.windowsecurity.com/articles-tutorials/authenticat...
Yeah, I was aware of factotum when I wrote this post. GNOME uses p11-kit (which is a wrapper around PKCS#11) and gnome-keyring to kinda provide similar functionality.
SMS is encrypted on GSM control channels using the broken A5/1 stream cipher which has well-known weaknesses.
Back pain Sufferers Use Twitter to Express Pain
The real problem are password managers. Where you used to have ten keys separately, you now have one key which can access ten keys. But that's not what the user thinks. Convenience over security. If you are using a password manager your attack vector scales horizontally with the amount of registrations you have.

It's not a solution.
thanks this is what I was talking
Well, first of all, debugging while developing an actor is actually easier: you just have to debug an actor in isolation and make sure it does the right thing and sends the right event in response to the incoming event.

In terms of debugging issues when in live, you have to rely on tracing and let something such as Logstash handle search, etc.

The ordering of the workflow is preserved. As I explained, FraudCheck is only ever done after an order's payment has been authorised.

Hope this makes sense.
Startup idea: WiFi hardware that attaches to street lights (for power) and forms a UK-wide mesh network to rival the telcos.
It's a conclusion which cannot be applied to any other situation. That makes it an uninteresting conclusion.

"both products mentioned in the article are of the same complexity". Where does the essay say that, and how is it measured? Since SLOC and number of required programming languages are larger, it's pretty clear to me that they don't have the same complexity.
Definitely sounds like poor communication between founders.

As an aside, I've been the founding CEO of a company that raised money and was acquired. I think my gifts make me really effective in running a company from idea stage to first revenue. I'm likely not the right person to run that company once there are 1000 employees. I'm fine with that

I don't think there's anything wrong with the exec team asking you to scale back your contributions if your skill set no longer matches the needs of the company. It just sounds like your partners chose a shitty way to go about it.
It is absolutely the best existing solution to today's problem which is company databases being hacked. If you yourself as an individual are being targeted then all bets are off, and you'll probably need something a bit more heavy-duty than is available in off-the-shelf software today.
I've explored similar ideas in the past. One possibility I explored was breaking down claims like 'Guantanamo Bay should close' into moral claims plus factual claims, eg 'Guantanamo Bay practices torture' plus 'torture is wrong'. This could be further broken down until you had a set of moral axioms and a set of basic pieces of factual evidence, and a set of syllogisms linking them together.

Different people would indeed have different value systems and also give different degrees of credence to different sources. So the goal would be to end up with a crowdsourced tree of moral & factual claims, and individual users could then decide which claims they agreed or disagreed with to come to their own conclusion on the topic.

(Look up 'argument mapping' for academic exploration of the concept).

My thinking now is that most online political arguments online are really about tribalism, not finding the truth. If you did have users who cared about the truth (and who could consider other viewpoints), you wouldn't need a fancy product: a simple web forum would suffice.

But do drop me an email at isaac@i.saac.me if you'd like to chat more.
It's well and fine that Stephen lives very cheaply, but all of this is an attempt to distract from the OpenSSL project's very real issues by wearing a cilice then bitching about it.

The fundamental facts are these: openssl contains a large quantity of code that, if I where to check into my company's repo, I would have at best a rough conversation with the cto and at worst I'd get fired. Plus a lack of good tests. These combine to create more than hypothetical problems; we've seen some severe security holes and there's almost certainly more to come.

The question that should be discussed is if openssl is, ala sendmail, unsuitable for purpose and, if so, what should it be replaced with.
Have you ever used a functional programming language?
> It's not about the language.

It was for the OP. Can't fault me for my reply not reading on an argument you make after the fact :).

> I use Python 2 because of the massive ecosystem of libraries that have been written, work, and will continue to work.

I too like useful libraries that save me time and effort, and I agree that Python 2 is extremely strong there. I feel like Python 3 is catching up and has a pretty good library story going for it already (my gratitude to those who make that happen through their contributions), in addition to being a language I find more enjoyable and productive to use than Python 2.

> It's shortsighted and more than a little irresponsible to shame or muscle people into switching.

I don't think I've done either, and I think you're being quite rude here. I was merely voicing my opinion that the magnitude of the differences between Python 2 and 3 gets blown out of proportion. Please be mindful of the context.

> that nobody wants to upgrade to

Not so, I've wanted to and have upgraded things to Python 3, and so have others.

As for the whole "forcing" stuff - well, yes, it happens. As a user of a language you're part of a community, and communities can sometimes decide to go into a direction you don't agree with. It's frustrating and difficult, and you can reasonably decide that it's a deal-breaker and leave the community. Often however it's valuable to instead put one's efforts into achieving consensus, and then defending and carrying that consensus, even if it's not what you originally wanted - shit tends to get done faster then, to the benefit of all.
The stuff that should encrypt, should have the keys. That is how easy it is.

Personally I think the web server should do the encryption. As it is the part of the software that contains the sensitive information, AKA the content.
You can get new keys you can't get new content.
I like the train of thought.

"Voting" on the internet definitely added a lot but it created a bunch of hurdles: majoritarian thought, bubbles and averaged opinions.

Review sites like rotten tomatoes are a good example of the last one. The average opinion about a movie is nowhere near as good as asking a single person who shares my tastes in movies. A bubble would be much more useful here. I'm not sure where I'm going with this.

I think letting ideas branch might let controversial discussions get objective. Complicated can be mistaken for subjective. It also sounds like the kind of fun that can draw people in.

I really like the idea.
It runs in process tho, so it would have had the exact same result with heartbleed. Its keys need to be readable to that user, so exploits like http://blog.detectify.com/post/82370846588/how-we-got-read-a... would also still leak your private keys. So no net win here unfortunately.

opencryptoki has a softhsm too, but again, it appears to run in process. Same problems.
That is a new one on me. I guess it makes sense though.. along those same lines, UPS has a trademark on a very specific shade of brown (hex 644117).
Something to help teams rotate passwords on regular intervals. E.g. I want everyone to rotate their Heroku/Google Apps/Github/etc. passwords every 6 months, or maybe after a major security event (like Heartbleed). Right now it means sending out a Google Doc for everyone to check off.

Bonus points if it has some way of verifying that passwords were actually changed and the new password is strong.
This is feasible in the current X509 public CA system, thanks to name and path length constraints. However, I don't know of any CAs which will issue restricted suitable certs for any sensible amount of money.
This is so true. Dealing with time-related development features is one of the most annoying things I deal with.
On a purely technical level, you should avoid images that contain text; they'll never look as good as the real text on all monitors. If you do use images of text though, at least avoid making the image a JPEG; the artifact halo around the characters are horrible. Zoom in a bit on your webpage and you'll see what I mean. Use a PNG instead, or a webfont.