skysight-inc/HackerNews huggingface dataset:
I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair.

This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and have provably done a horrible job of it in the past (websocket over SPDY, anyone? Yeah, I'm not even sure which version combination of SPDY and websocket I'm talking about either - pick one of the hundred)

There are strong arguments for not enabling privacy by default - not least since it prevents any kind of decentralization or caching of content. At a time when OpenSSL just suffered one of its worst bugs in history, forcing small sites to assume the risk of running code like this, which they inevitably will get wrong, materially worsens security for all, it doesn't improve it.
I'd still play it
The NSA and other state actors can use non-secure pages to inject code to exploit the browser and compromise your visitors.

http://en.wikipedia.org/wiki/FOXACID#QUANTUM_attacks
I never actually run JS code on Chrome console :-p that's really awesome ... Need to find some friends to poke now! :-)
??? This isn't an American taste thing: such yogurt styles are directly from Europe. Switzerland, Italy, France, UK, and Ireland all produce yogurt in a form immediately recognizable to Americans. For example, just yesterday I was in a grocery store in Italy buying yogurt, and had two options: exactly like Yoplait, or greek style (Fage etc.)
Thanks, this was exactly the initial idea which turned out to be a 'in-the-future' release. Before spending more significant time on backend adapters, I would like to be 100% sure that the framework part is working smoothly. Things you said are definitely way to go, cheers.
This is great, but it should also be a reminder that SSL is currently not possible for custom domains hosted on GitHub: https://konklone.com/post/github-pages-now-supports-https-so....

I hope a solution materializes eventually.
Yeah, SRP of one of those rare Good Ideas which has never taken off as it should.
http://security.stackexchange.com/questions/19473/understand...

TL;DR: 2048bit is for the RSA keys, 128/256bit is the the key used in the SSL connection.
For one the fact that (the author of NaCL) Daniel Bernstein is backing it.
So let's pretend the effects can be measured accurately. If they are positive (and they will be), then it's simply an I told you so situation.

If the results are negative (zomg, more kids are smoking pot and failing to graduate), then to take that data and say that ending prohibition was a mistake without taking the data about the damage caused by prohibition (funding drug cartels, taxpayer funded SWAT teams that assault citizens/property and not always the "legal" target, arresting citizens for the crime of using an intoxicant that is not on the approved list, etc), then that shows that the person asking the question isn't interested in the real question: is it worth it?

There's too much evidence on the origins of this prohibition (racism and a tool of oppression of "dirty hippy anti-war protesters") and evidence supporting repealing of this (Nixon's drug commission report which was ignored, as well as Portugal's decriminalization of drugs, etc) to support any drug prohibition. It's an abysmal failure and goes far beyond depriving some stoner of getting high -- it's killing people.

Sorry to be so strident, but this discussion is like arguing with Jenny McCarthy and giving her equal time about how vaccines cause autism. Maybe we should just stop doing them and wait and see how that turns out too?
Messages like "your connection is encrypted with 256-bit encryption" don't tell you anything about the size of the RSA keys in use.

During the TLS handshake, your browser and the server do public-key crypto to authenticate each other and share private information without a previously-known shared secret. Because public-key crypto is really, really slow, they then share a small secret (say, 128 or 256 bits), and use that secret as the key for a traditional symmetric encryption algorithm like AES. That's the number you're seeing.

Take a look at https://en.wikipedia.org/wiki/Transport_Layer_Security
Inside the Military's Secretive Smartphone Program
The vast majority of controls on any Windows screen in 2014 is created with CreateWindow calls with that parameter set to some value that was added on by RegisterWindowClass though.

I still agree with you that it's silly to say that Windows hardly has 'native' controls.
Britons spend more time on tech than asleep, study suggests
To further specify: The GPL states that the recipient of the software has a right to also get the source. The public is simply not a recipient of the software.
Sure they would benefit. They could check whatever is on your site without anyone in between noticing (WLAN e.g. at starbucks, corporate LANs and the proxies used etc etc). There are companies out there, who buy surf-habits (read: browsing logs of URLs visited) and mine it for valuable data.

Encrypt.
Lol, they are not using HTTPS to serve that content. Look who's talking...
Nanu – free calls with 2g
A lot of work routers might flag that site url as "GAMING" and with too much use could potentially contribute to someone losing their job.

Also some isps have been caught injecting ads into plain text web sites [1]. Do you want more ads on your site that you didn't put there?

[1] http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injec...
Link to the actual Communications Market report from Ofcom: http://stakeholders.ofcom.org.uk/market-data-research/market...
thank you both, that really makes sense. I thought it was a little peculiar that Google decided to mention the whole 2048 bit thing, I couldn't have been the only one that was thrown off by that a bit.
The best solution to the Israel-Gaza conflict – The Gaza Dome
Oh that's right, I always write markdown almost like a reflex... But the links are there so I guess it's okay this way.
2048 is the RSA key size. 128 or 256 is the AES key size (or more generally the key size for the symmetric cipher). Nowadays the latter doesn't depend on the cert, but in the 90s it artificially did thanks to U.S. export policy. CAs still advertise as if we were stuck in the 90s.
Well... now it is ;)
This is really cool and somehow reminds me of the intricate and successively more powerful methods developed over the years to sequence DNA.
If this change is here to stay they should update their Adsense SSL advice... https://support.google.com/adsense/answer/10528?hl=en-GB
The American people gave exactly 4,377 f***s for net neutrality
Now you can contact Github with this announcement and voice your concerns. Now they have more incentive to change it (if people actively voice their issues to Github).
22 machine learning datasets you must know
I'm curious.. let me know good or bad (or wrong) what you guys think of this.

Quick background. My understanding of how a mobile phone works: There is a primary CPU, running Android, which does the majority of the work on the phone. Meanwhile, there is a second CPU attached to the radio running an RTOS. This RTOS interprets the signals from the antenna and makes nice packets for Android. The RTOS and secondary processing unit can then be optimized for just that one task, and Android can be optimized for reading, writing and processing data packets.

Similarly, what if we made more parts of our infrastructure "smarter"? Take for example the monitor. Currently, it has a frame buffer, we fill it through a DVI cord and the lights change. Is there some abstraction at which we could make a monitor work "smarter". Can we put a GPU in the monitor? Then just move memory and call OpenGL commands. Is that a better abstraction for monitors? Can we also put a CPU on the monitor and embed an RTOS/rendering engine? Would that make a better abstraction? Could we then optimize the "smarter" monitor / integration with the game logic, better than we could have if the monitor just has a frame buffer?

I don't have much domain knowledge and so I don't know what the correct abstraction for a "smarter" monitor should be. However, I do think its a good question to be asking (and not just about monitors). I'm curious if you guys can think of such an abstraction. What would that be?
Beanstalkd 1.10 released
Another citybuilding game in the browser:
https://www.youtube.com/watch?v=POTnQtJ8jcM
The SSL CA model is deeply flawed, so it bothers me that I have to pay into this broken cartel.

An effective social network for website trust, combining cryptographic assurances with trust networks that already exist, is my dream.

(Edit: Clarify that the SSL CA model is flawed for the Internet at large, but has many useful applications elsewhere.)
Mint is popular, but it's popularity is largely because it's basically a skinned, traditional-desktop version of Ubuntu - it's binary compatible, so the various .debs advertised with Ubuntu also work for Mint. So in terms of resources available, the two use the same resources (ubuntu PPAs work fine in mint, for example).

But in terms of user experience? Depends on what you want. I prefer a traditional desktop (debian/kde myself) so I'm not fond of Unity and loathe guh-nome 3. But for a naive just learning about how to deal with computers, unity might be good for them - it's pretty simple, and works the same on touchscreens or with a mouse. That would be something worth testing, actually - do the kids using these laptops work better with a Unity-style interface or a traditional desktop? Which one allows them to use their computers more effectively?
SIGGRAPH 2014 papers on the web
So, "as somebody who tried to use ETW", you think that the author, who did in fact actually use ETW, didn't do his homework?

Read the criticisms. They are not shallow.
Just doing a little more research. It appears as though many of these EV certs require you to verify your company information, domain registration, phone number and even address. With Google using however many hundred or thousand ranking signals, this makes sense. It is essentially another layer of trust and really great for UX as well. Online shoppers trust a site with the "green location bar" much more than ones without it, and I could definitely see how Google might reward this type of website.
Ha! You do have a point. I suppose this is where private enterprise would be better. :)
This is great, it's just a fact that ssl will not have major adoption unless there's a clear UI or business reason for it.

I hope google takes it one step further and updates chrome to show an insecure warning when it detects a password field on the page and it is sent plain over http.
Oh sweets, needs sign-in.. ctrl-w
I don't have the best experience with submitting feedback to GitHub and getting good responses, so hopefully someone like @konklone can make that case to them - again.
FireEye and Fox-IT Announce New Service to Help CryptoLocker Victims
The problems exposed show that being a distributor is harder than it seems;

> The “developer mode” boot screen is scary and unhelpful.

Then put your own bootloader ? You can do this by accessing the hardware: http://www.chromium.org/_/rsrc/1381990807648/chromium-os/dev... and removing the write-protect screw.
Of course the chromeOS team is making sure it's not easy to bypass their security features, and it has the (desired?) side effect of preventing this kind of mass-scale re-purposing.

> Kernel updates wipe out the custom kernel modules.

Then put your own kernel. Being a distributor means taking responsibility about what's running on your hardware. Make your own repositories, recompile the kernel(you can even automate it), and while you're at it, add all those packages you're installing in the script(hello .deb package downloaded over http), and VERIFY THEIR SIGNATURES with apt.

About the kernel, you could also make sure the upstream kernel supports the trackpad, and then make sure the (intermediary) distributors pick up the associated patches, so it's a burden off your plate in the mid/long term. You could also probably pay Canonical (or anyone else) to do this job.
LinkedIn API, yet another issue
CryptoLocker ransomware intelligence report
THE BEST OF THE WEEK IN CHANGE
Considering the importance of HTTPS to, in Google's words, "[making the] Internet safer more broadly", this seems like a good time to again suggest that Google enable HTTPS for Google Analytics by default[1].

Google Analytics is on 50.8% of the top million domains on the Internet, and on 26.96% of a randomly selected 48.5 million domains[1]. Of the 42 billion links analyzed in my research, over 48% of them had Google Analytics on either the start or the end. That's a lot of information leakage.

Anyone who is eavesdropping on HTTP connections to the Google Analytics endpoints can observe a web user's traffic history trivially. This enables simple mass surveillance by specifically looking for these connections and recording them. HTTPS would prevent that.

I should note, whilst there is an option to specifically force SSL in the new Google Analytics[2], it must be enabled by default in order to have a positive impact. We can't rely on the owners of millions of domains to upgrade to ensure an end user's privacy.

[1]: http://smerity.com/articles/2013/google_analytics_and_nsa.ht...

[2]: https://developers.google.com/analytics/devguides/collection...
Best of the Week in CS
Doing all storage and computation in UTC does not work if you are dealing with events in the future that need a fixed local time even if time zone offsets change.

http://fanf.livejournal.com/104586.html
I thought this was going to be link-bait crap until I actually read through the damn thing. My god. He could be right.
I'm surprised by the amount of negative comments. Independently of what do you think about HTTPS and CAs in general. Given there the alternative currently is plain text, I'm actually surprised that it wasn't a signal before.
upside: security, further migration to HTTP/2 easier (when it's ready)

downside: HTTPS negotiation time overhead (slower website) (as long as we use HTTP 1.1), costs (certificate, technical migration)

all in all i think it's a great move by google, thx
I think your description of the situation is rather overblown. Having HTTPS support will only get you a very minor boost in rankings.

Additionally, discussing things in a forum usually doesn't get things moving. It's coming out with actual advancements like the original Chrome beta with V8 that drives innovation.

I think that the solution to harmful dictatorship should be good alternatives, not more laws to shackle progress to humongous councils.
Freshbooks is great.. I think the account is free as long as you only have 1 client at a time in the system
the wikipedia doesn't seem to have that one:

http://www.smithsonianmag.com/smart-news/dolphins-seem-to-us...

"Footage from a new BBC documentary series, "Spy in the Pod," reveals what appears to be dolphins getting high off of pufferfish. Pufferfish produce a potent defensive chemical, which they eject when threatened. In small enough doses, however, the toxin seems to induce "a trance-like state" in dolphins that come into contact with it, the Daily News reports:

The dolphins were filmed gently playing with the puffer, passing it between each other for 20 to 30 minutes at a time, unlike the fish they had caught as prey which were swiftly torn apart.
"
Agreed - nothing more annoying than a product that wants my credentials before I can even try it out, see a screenshot, or anything else that might make me want it. le sigh
Well, except CERN Webfest - http://webfest.web.cern.ch/
Switching over to HTTPS in and of itself shouldn't stop much data leakage given that the hostname - at least at current - isn't difficult to obtain (and really gives the game away for the content you're visiting as far as my site is concerned), but I suppose it's a step in the right direction and will stop primitive tracking attempts.

Protecting against code injection is actually a fair point though.
this has to be one of the most ironic pages on wikipedia.
Fish Plays Pokémon
Not only that but it also requires email activation. At least some sites that ask to register allow you to login without activating for a little bit.
M2M software papers
Google Now Factoring HTTPS Into Ranking; CloudFlare On Track to Make it Free
This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works

I don't see how is this any different from any other signal that Google uses to prioritize sites. Forcing small businesses to buy certificates doesn't seem any different than forcing them to have faster websites, for example.

There's an argument for more diversity in search engines, but I don't see how is that specific to this signal.

There are strong arguments for not enabling privacy by default - not least since it prevents any kind of decentralization or caching of content.

How does it prevent decentralization?

At a time when OpenSSL just suffered one of its worst bugs in history, forcing small sites to assume the risk of running code like this, which they inevitably will get wrong, materially worsens security for all, it doesn't improve it.

How many people could exploit Heartbleed before it was publicly announced compared to how could sniff traffic on open networks, as countless tutorials explain how to do?

Heartbleed was bad, and OpenSSL is a mess, but let's pretend that unencrypted logins are somehow less bad.
I think it has to be the sheer number of APIs that Microsoft has developed: they just don't have the resources to care about very many of them. It stems from Microsoft's extremely insular culture in the 1990s and 2000s, where being a "Microsoft developer" meant that you just didn't read code for open-source projects, didn't look at competing APIs, just did everything your own way. Apple had its own bad APIs, and blew a bunch of them away when OS X came along. So you want TLS/SSL on OS X, the typical way to do it was to just use OpenSSL. OpenSSL has tons of problems, but at least they're well-understood problems, with source code and documentation.
Evasion7 1.0.8 download
Looks to me like a bug -- they do a

value -= policeStationMap.worldGet(x, y);

when they probably meant to do

value -= policeStationEffectMap.worldGet(x, y);

otherwise, crime is reduced only if there's a police station right there. That's just a guess based on a cursory look, though.
Bug in example "Interactivity 1":

In function "mousePressed", distance is checked from (360, 240) when the ellipse is actually placed at (360, 200).

Can anyone suggest how to read back the actual center location of the eclipse programmatically inside the "mousePressed" function so that the center coordinates are not duplicated? (Note: I am new to JavaScript.)
Yelp is good enough for this, especially for stuff like "open now".
> I don't see how is this any different from any other signal that Google uses to prioritize sites.
«Oh, they're screwing up before, too? Then I guess it's alright»

> How does it prevent decentralization?
Because only a handful of companies can issue certificates.
State actors are probably irrelevant in this discussion; few of them won't be able to get a certificate to any website they want, in my opinion.
You should try to add an open demo, and only request an email sign up when the user try to save or export the file (or a prompt after X minutes of use). I am not sure people are ready to sign up just to try a text editor.
I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere.

Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner:

1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How many times have you accessed a site on an open network or from a hotel and got unexpected ads? This is a very visible manifestation of the issue, but it can be much more subtle.

2. Authentication: How can users trust that the site is really the one it says it is? Imagine you're a content site that gives financial or medical advice. If I operated such a site, I'd really want to tell my readers that the advice they're reading is genuinely mine and not someone else pretending to be me.

On top of these, your users get obvious (and not-so-obvious) benefits. Myself and fellow Googler and HNer Ilya Grigorik did a talk at Google I/O a few weeks ago that talks about these and a lot more in great detail:

https://www.youtube.com/watch?v=cBhZ6S0PFCY
Interesting. I would actually consider something like this for my current writing project, provided there is:

1. Some means of account recovery. I didn't notice a forgot password link.

2. Way to bulk import and export files. I will have my own primary storage.

3. Save the font, color, background and border settings as my own presets

4. Change the background without changing (3). A graphical writing prompt for each different scene is useful, but having to change the rest of the formatting each time is an inconvenience.

5. Make it HTTPS
Learn the new JavaScript features coming in EcmaScript 6
If someone is going to try this, be sceptical of the results. We do not know for sure they're a member of /r/Anarchism. If you run the analysis only on the members of that subreddit, you'll only get "the member that writes most like the leaker".
Is that a real risk? I mean, we aren't talking about breaking a leg. In my experience, as a father, the husband of a wife that works at a kindergarten and as an ex-child ... the best thing about being a kid is the courage you have in exploring new things. Take the opportunity of exploration away, in the name of safety and the effect may be the opposite of what you want.

And actually, for better or worse, many of us as kids learned programming in "unsafe" environments. So the onus is on you to prove that the alternative is better. Surely a study could be made.
It probably bugs me the way it does, because this "signal" has nothing to do with the contents or the usability of the web site (unlike speed, validity of HTML or, well, content itself), but is purely a "we just think you should do X" situation.
500 Internal Server Error ?
Is there any cached version out there?
Software outsourcing company
A couple of questions:

1. Was it a conscious choice to only offer up monospaced fonts?

2. I can't find a way to close the "cabinet" after I open it to access my list of notes: is this a bug, or am I missing something obvious?

3. Any change you have the source code up somewhere?

Thanks btw, looks nice!
Yes, I was initially excited expecting to see something awesome for Google NaCl, but it turned out to be yet another script written in a legacy language... Well, he did add .js to the name though.
That's actually an interesting reply. Do you actually get paid to do, say, computer vision? If so, what's the ratio of enjoyable to menial work (please be honest)?

Also how do you manage to find jobs like this? I found that hiring managers tend to, like, lie about the jobs. What I mean is there's no shortage of interestingly-sounding job descriptions out there that have nothing in common with what the hired person actually supposed to do. And you can't know the day-to-day reality of any job before you'll actually get it and then it's too late. How do you work around this situation?
CM tools are not supposed to do the deployment but configuration and management of environment. You should do deployments with a tool like Jenkins.
Show HN: Open source hardware platform for Bluetooth hacking