skysight-inc/HackerNews huggingface dataset:
This is pretty easy.
All of them, if you're on the right team, working on the right project.
Broad generalizations are pretty useless for something so intensely personal.
For your first paragraph, I was trying to teach a little about probability. For the probability of rain, I mentioned that, and my mention implied the good lesson there: We can assume that there really is a probability of rain, that is, it definitely exists. Now, especially for deciding to place a bet, we could get an estimate of that probability. The 50% is a first cut estimate with some curious properties about 'total ignorance' but otherwise poor. So, how the heck to get an estimate? Likely the best practical way was by the student seeing a weather report on the news. Otherwise, for, say, the probability of rain of any day in, say, August "We might, what, class?
Anyone? How might we get an estimate of that? ...?"

Or, "Billy, what company makes iPhones? Billy, you can't get the answer by teasing Sandra. Mary? Right, Apple! Okay, suppose we buy 100 shares of Apple stock today and sell it seven days from now. What is the probability we make over $1000? Assume that this probability exists and we want to estimate it. People especially good at such estimates can become among the richest in the world, fairly quickly. So, how might such an estimate be made? Information? Any ideas? Anyone remember the motorcycle, airport, and airplane in the movie 'Wall Street'? What was the role of 'information' there for an estimate of the probability that the stock of the steel company in Pennsylvania would go up a lot, soon? Anyone? Sandra?"
You'd have to be actually working in the Vatican and have exclusive access to the chapel to do that.
This is the right answer and it's too bad it was way down the page (I upvoted).

For your situation, mark_I_watson, probably get a cert from a CA, the cheap "domain only" variety where you can verify your site to the CA simply by putting a file in the web root directory.

I say this assuming the content is whatever you were already displaying to the world without encryption - therefore low-security. The cert allows you to put meaningful authentication on your site (otherwise passwords go in plaintext, for example).

For a medium security level, sufficient for online money transactions, you would have to get a higher-assurance type of cert - this requires more money, sending business and personal ID documents to verify your business to the CA, etc..

For really secret communications - getting into a degree of NSA-proofing - among other things you have to avoid involving a CA, and preferably make browser certificates for trusted clients, to spare them the warnings that browsers throw up on non-CA server certificates. This is unsuitable for (legal) commerce (commercial payment processors would reject your business), and still vulnerable to metadata collection (unless you put it on TOR or equivalent), and still vulnerable to state coercion of private keys or forced code-trojaning.

Note that the third solution requires that your clients have a means of verifying that the site is yours rather than an imposter - you avoid a CA having the power to enable some other site to impersonate yours, but trusted users must have a basis for trust by a "side channel" such as knowing you personally, you being their employer, or reputation of your digital signature over time.
This is true, but you wouldn't believe the system-as-practiced by most large IT departments.

edit: small IT departments, too. nobody really pays attention as long as the lock icon is green.
In Norway:

http://www.ssb.no/en
Yes, I have one. They are really easier to use. I usually have problems cleaning that top corner, my hands are a bit large so I have trouble cleaning that part. Also, I find pouring a bit more tricky when using the cup. I just asked about it to my wife (she bought it) and she said pretty much the same thing.
Q: How can you tell there is an topologist in the cafeteria?

A: Because they can't tell their coffee cup and donut apart.
Glad I could help you out a bit. If you ever need someone to talk to, you can always email me at brian@spire.me.
I am always surprised by this point of view.

1) There is nothing wrong with taping together CRUD apps if it achieves a goal or makes a big impact for your startup

2) There is a good amount of grads that can't even tap CRUD apps together, let have CS degrees

3) At MegaCorp people are deeply specialized in their roles, its like a assembly line -- you don't get to design the car you screw the bumper on (if that)
I haven't checked any recent Android trust stores, but this might be due to a lack of an intermediate certificate.

The vast majority of modern browsers know how to find intermediate certificates online. Android's browser doesn't, for whatever reason. You have to bundle it on your web server.
One thing that always confuses me is the plethora of options for buying SSL certificates.

I understand the difference between a single domain and wildcard SSL. But, as an example, what's the difference between Positive SSL and Essential SSL (2 types of SSL certs sold by Namecheap) - Essential being about 3x the price.
You're calling your students "broken"? Can we start there?
So... what exactly is this? Could I use it as my main OS? Is it a replacement for TAILS?
NAT traversal, works easily on dynamic IPs without having to use another service, etc.
> Subgraph OS users who install the operating system must have encrypted filesystems. It is not optional in Subgraph OS.

I like that. All "secure" operating systems should have that, and all operating systems should have it if they benefit from hardware encryption, which would make the performance overhead a non-issue.
Which is the one I went for :D
I'm a designer who's hoping to get better at engineering. I already know languages and can make stuff with it. [0] However, I have found that especially on bigger projects, the main hurdle becomes my own architecture, or less-than-perfect engineering hampering future development. I want to improve on that.

In reciprocity I can offer design mentorship, in interaction design, mobile and desktop user interfaces, user experience design and user testing.

[0] http://www.getaether.net
> It's terrible, because Man-In-The-Middle attacks are trivial and automatable.

It's actually both terrible and the best security you can get.

- Terrible because today's browsers participate in a pay-for-insecurity model, where any CA certificate can be used to compromise any website on the internet (except for the tiny number of hard-coded/"pinned" certs that some browsers ship for their company's websites). Certificate Transparency only makes the problem worse [1]. Browsers currently have no way to securely verify either self-signed OR CA-signed certificates.

- It's the best security you can get because unlike certificates based on the aforementioned pay-for-insecurity "X.509 PKI" (public-key infrastructure), the security of a self-signed certificate depends on NO ONE except the issuer (i.e. _you_). Plus, they are 100% free.

I like to refer to today's X.509 PKI as "the internet's oldest backdoor" (about two decades old now [2]), because browser vendors have been aware of this problem for quite some time now and haven so far chosen to either do nothing, or make the problem worse (like with Certificate Transparency [1]).

Aaron Swartz wrote in 2011 that the solution to this problem is to use the blockchain [3]. I spoke with him about this at the time [4] and today am working on a project to bring that vision to life [5].

[1] http://www.ietf.org/mail-archive/web/trans/current/msg00233....

[2] http://lists.randombit.net/pipermail/cryptography/2014-April...

[3] http://www.aaronsw.com/weblog/squarezooko

[4] http://okturtles.com/img/Aaron_Swartz_Email.jpg

[5] https://github.com/okTurtles/dnschain
These conversation and facilitation skills among kids are really great, and I agree the teacher should be encouraging them, but I have some serious questions as to whether this teacher and I have the same definition of "math".

To me, math is a skill involving the manipulation of abstract symbols. It doesn't involve sharing, being nice to other kids, helping each other out, or any of that. Those things are great, but they ain't math.

Now "teaching math in a primary school setting" may involve the combination of all of those things, and that's fine. So I guess we agree. But this essay was terrible. If this teacher came to me with this definition of math as an answer on a test, I'd fail them.
What sphere do you consider? If it is software Development maybe I can help somehow.

Also, "The Passionate Programmer: Creating a Remarkable Career in Software Development" is a great book for people starting a career in software development
On Death Row With Low I.Q., and New Hope for a Reprieve
Could you elaborate on what you find meaningful about the authentication a CA provides?

Another neat trick is creating your own CA, and putting your root into the local trust stores of client nodes that you care about. (Be sure to permanently airgap your root key, and create intermediate signers.)
> For example, they refused to reissue certificates for free after Heartbleed.

Not only that, but I believe they refused to revoke the certificates in the first place without payment. So if you don't pay up, even if you go buy a certificate from someone else or decide to use self-signed certificates, an attacker could still use your old certificate to MITM your website.
Christopher Evan Welch Died Before His Breakout Role in Silicon Valley
We just went through this process at my startup. The gist of it is that if you self sign your certificate the user will get a warning say "do you trust this site? yes or no" -- this will lead to alot of people leaving. The best option is to get a cheap signed SSL certificate, godaddy has them for like 70$ a year. You can probably shop around a get them for cheaper. Moreover, if your using AWS, consider letting ELB (elastic load balancer) handle the HTTPS.
It's an operating system, supposedly built from ground up. I'm really sceptical about security if it was just released and build from ground up.

They shyly mention Grsecurity hardened kernel. So is it a linux distro or not? I don't know, no mention of linux anywhere else.

As someone who might be interested in secure OS but is not an expert in security, this website leaves me very confused.
This was posted earlier this week:

https://news.ycombinator.com/item?id=7805144

What I'm wondering is, if you have a server than supports "both" methods (dynamic page and "fallback"), how do you know which one to serve? And should they be at different addresses? If they weren't, wouldn't this break caching? If they were, how can you redirect from a "noscript" tag if you have um, no script? Etc etc.
Is this really an issue? I mistype my email address regularly but it is never the period that is wrong.

Clearly the author believes it is and they have more experience than I but I just don't see how this can be a significant problem, it is less of a problem than the gmail/googlemail issue that many European people with old enough gmail accounts have (gmail was trademarked at the time and thus they had to use googlemail.com so I still have to use googlemail.com address for certain shitty systems that don't let me update my email address easily).
It used to be pretty easy to install a self-signed certificate from the browser. Now it seems quite a bit harder--e.g., in Chrome you seem to have to export it to a file, I think? And in IE people say they can't even inspect a bad certificate, because the UI hides it entirely.
TLS means Transport Layer Security, and people would do good to remember it was not invented to be used in the HTTPs browser webserver configuration exclusively. For that particular application though, it doesn't make sense to use a self-signed certificate as you can't control the client side and modern browsers will raise hell.

There are however many applications where a self-signed certificate (chain) is perfectly fine and even preferred. Think of mobile apps where you have control over how certificate validation is done on the client-side.
Oh, yes, that's what the SPARK language does. There's also CodePeer, which does a static analysis of your Ada code. GNAT itself also does many static checks.
I'm not a tech savvy person (at least around here) but I used Gandi to purchase my certificate. I paid 12 bucks and it was extremely easy to implement it. To give you an idea, I didn't even know how to enable access to my site without entering "www." in front of my URL. But getting the certificate and implementing it was so easy that I was actually surprised once my SSL was active. I was expecting to run into a couple of problems as I usually do when I deal with these sort of thing.

I'm using SSL for my personal website and it's not a commercial website.
> It's been a while for me, but I thought that that was fifth or sixth grade!

For the seventh grade I remember: "A race track is 2 miles around. A car travels the first half at 30 MPH. How fast does the car need to travel the second mile so that the average speed around the whole track is 60 MPH?"
Because encountering a site with a self-signed certificate likely means that the connection is MITM'd. In any case, with a self-signed cert you can't who you're connecting to.
Who the hell cares about definitions? Oh right, mathematicians, and they manage to make a beautiful subject terribly boring by insisting it's all about manipulating symbols, instead of the underlying structures they represent.

I mean, programming is about typing and manipulating text into a box, right?
Previous discussion: https://news.ycombinator.com/item?id=7790227
I looked all over the site and couldn't find it anywhere, or any mention of it even being available yet.
Show HN: GradCalc, a Android Utility for K12 Admins and Parents
My 2nd Android app is released. GradCalc is a simple utility to find projected gradation years of students based on their current grade. Great for K12 admins or techs that need to make user accounts, but are tired of wasting paper to make a year chart. Also good for parents to see when their child is expected to graduate.

Note: App is based off of 2014-2015 school year to be useful to admins using it over the summer for user accounts.

Please check out, test, rate, and/or review it and offer any insightful feedback. If a problem is found, please include device type and Android OS version. Thank you in advance!

Download your copy at:

https://play.google.com/store/apps/details?id=com.mkelleyjr.k12gradecalc
Not the parent commenter, but:

>Because jesus, if you are, and those tests are consequential to the kids future, that's a pretty damn relevant and reasonable question.

The point of a test isn't to test every single detail of what you were taught, it's to hit a random distribution of topics and examples of what you were taught. This gives a pretty good indicator of how well you learned the subject overall.

Asking "is this going to be on the test" shows that you have no intention of actually learning everything you're taught, which is the point of the class, and instead you're only interested in memorizing the minimum to pass a limited test, which is not the point of the class.
I'm not a Haskell programmer, but I'm having trouble understanding how this is applicable to Heartbleed type bugs. While it's nice to flag invalid constant indexes at compile time, the real problems occur with variable indexes that a potential attacker can control.

And the solution for those seems to be the equivalent of "Don't use 'array[i]', always 'if (i < len) ? array[i] : BOOM'". Or am I misinterpreting we have passed the burden of proof onto users of charAt? I guess the difference is that the check only needs to be done once for each 'i' at the time it is assigned/created? But then how does one guarantee that a given AValidI is used with array for which is intended, and not for a shorter one?
Ever mobile phone carrier makes themselves a root CA on devices they sell and routinely Man-In-The-Middle sites like Youtube.
By sending data in plain text, your users are revealing their intent to retrieve the content hosted on the site, even though that content is public.

That in itself may be considered a breach of privacy, as it exposes your users to passive capture and profiling.

Also, accessing the content you are hosting might be considered legal in some countries but illegal in others, regardless of if it is public or not.
I think at some point I contacted support about that. It generally comes down to one of a few issues:

compatibility (mobile, different browsers, etc)

steps taken to verify (via phone, email, fax, proof of business registration, etc)

insurance (they'll offer various amounts of payment in liability insurance)
REST APIs must be hypertext-driven » Untangled
We have to reference Tom Lehrer and the New Math era of the 60s:

"But in the new approach, as you know, the important thing is to understand what you're doing, rather than to get the right answer."

http://www.lyricsfreak.com/t/tom+lehrer/new+math_20138395.html

I did new math in the 70s and it did prepare me for understanding unix file permissions. chmod 0755 foo.pl!
Machine learning focused CS undergrad in Austin, TX - would love to talk to a data scientist in the industry for 30 mins.

I sense there is a large disconnect between ML research at university and application of ML in industry. I'm most curious how teams work at Netflix, Palantir, etc (at that scale and company size). I perpetually feel the impostor syndrome in this space (even though I performed very well in CS course work and research). If you can give me a glimpse of data science at your company, I would be grateful!

jayshahtx[at]gmail.com
I just installed the Release Candidate earlier this month. Simple but Useful changes as far as I can see.
Works for me - I have a StartSSL personal cert and an Android phone (Nexus 5 / KitKat), and all of Chrome, Chrome Beta, and Firefox load up the site without any sort of warning or other indication. I also dug out a Jelly Bean phone (Galaxy Nexus) to try with the stock Android Browser and didn't have any issues.
IPLANG – an optimization-based language
Like 3pt141597, I remember everything about high school trig. Not only do I remember it, but as it turned out, 10 years after leaving school, I actually started having to use it regularly (graphics programming). I also remember high school level calculus. Sadly I can't say the same for university-level maths, which I regularly have to break out the text books for when I need them (stats and probability, complex numbers being my two regular bugbears).

When I think about it, I struggle to find a single useless class from high school. If anything, I regret mostly that I didn't make enough of the opportunities that my school provided me - I really regret not having put in the effort in art classes for example.
Google has a system [0] whereby their crawler appends a special parameter to the query string to signal that you should serve a static, "indexable" version.

What I get from this announcement is that their crawler is becoming good enough at executing dynamic pages that having to serve a separate static version may soon become unnecessary.

[0] https://developers.google.com/webmasters/ajax-crawling/docs/...
There might be trouble with depth perception there. When I watch baseball, I can't easily tell at what point the ball crosses the plate in the behind-the-mound view. When a pitcher throws a breaking ball, I usually have to look at the non-overlay strike zone they show afterwards to know where the ball was when it passed the batter.
Exactly - I like the idea of trying to get kids to understand the difference between "I can' think of any counterexamples" and "There can't be any counterexamples because I can prove it always works this way". But I think two inches of space on a homework worksheet is probably not enough space for a child of 8 to explain adequately why the latter is true.

My suggestion would be that the child should write "I have an elegant proof of this but this worksheet is too small to contain it" in the space...
Electromechanical punchcard computer
The fact that this machine is still in operation is awesome. What a piece of engineering.
Certificates not just encrypt communication, they also tell that the site is really the one you think.

In that sense self-signed certificates are mainly useful for small amount of people when you have another way to validate that the certificate is valid (i.e. installing it in person in the intended client devices). Else anyone could just create another certificate with the same human readable info.

There are some free or cheap enough certificates around that are already suggested, and other ways to validate certificates that may be useful even for self-signed ones, like http://convergence.io/
Seal Combat Wounds In 15 Seconds
Having worked in an incubator space and constantly overhearing aspiring entrepreneurs' wildly impractical proposals...I've always wondered why it isn't just common sense that you heed the advice mentioned in another article currently on HN's front page:

http://fridriksson.tumblr.com/post/86584610871/a-startup-pos...

> But our biggest self realization was that we were not users of our own product. We didn’t obsess over it and we didn’t love it. We loved the idea of it. That hurt.

In a way, the OP is just another re-phrasing of this...if you know the steps of a process pretty well, it's because you're an active user. You know what steps are worth removing, and as an active user, you can maintain a tight feedback loop informing you whether the cost of removing those steps are worth it. And, as a cherry on top, you're actively making something you already do more enjoyable.
These are the top blogs I follow in the data visualization space:

http://www.edwardtufte.com/tufte/

http://visual.ly/

http://www.thefunctionalart.com/

http://hbr.org/special-collections/insight/visualizing-data

http://chartporn.org/

http://www.excelcharts.com/blog/posts/

http://flowingdata.com/

http://datavisualization.ch/

http://visualization.geblogs.com/

No matter how the tools change with time, I am able to keep up to date with the field.
A little over a week doesn't seem like enough time for the news to get out and people to download all their content.
I love Tom Lehrer dearly, but I don't see how it's appropriate here. Do you think that trying to teach kids to understand what they are doing is wrong? Nowhere am I suggesting that I have the impression that the child writing down "When you add two even numbers you always get 7" would be considered a valid answer on this worksheet - clearly they're trying to get kids to comprehend parity.

Or are you suggesting that the answer would be different if you were missing two thumbs?
CA-signed certificates do not mean that you are not being MITM'd. They are actually worse in that they give everyone (including the browser) a false sense of security that you have to pay for.

See detailed reply here: https://news.ycombinator.com/item?id=7826443
I'm not a Justin.tv user, but it frustrates me when organizations make big decisions like this without much time for their users to react. I can only assume that they're bleeding money and they're trying to quickly cut their operating costs.

Someone should contact the Archive.org and see if they can get copies of all the public archives of these videos.
YOU ARE DESTROYING THE INTERNET

Training users, who have no way to properly asses this risk, to click OK to the SSL error, is like Jim Jones's practice runs drinking the Koolaide.

Firefox had it right when the briefly made it impossible to OK the use of misconfigured SSL.

Most IT people don't understand the risk of self-signed certs. We can't expect users to make good choices here.