skysight-inc/HackerNews huggingface dataset:
The world will be switching to SHA-256 - Microsoft already decided that last November [1]. This is just Chrome helping out.

Obviously, XP is a problem. We're planning on prompting Chrome users on affected versions to update, both at startup and on the error page. SP3 does exist and one doesn't need to pass the Genuine Windows check to install it[2] so I think we have a good chance to getting users to update once sites stop working. Even if you're going to serve different chains based on signature_algorithms, that gets you at most a year of extra time. Maybe you should be putting effort into getting people to SP3 instead? :)

[1] https://technet.microsoft.com/en-us/library/security/2880823...
[2] http://support.microsoft.com/kb/322389
1) get connected, 2) get traction, 3) get both!
CommonMark
I think it's really crazy that certificates are now declared insecure based on their expiration date. We've deployed several certificates with a three year validity (i.e. valid after 1-Jan-2017), and since our CA could only provide SHA-1, that's what we're using. Now these certificates get marked as insecure. However, if we'd gone for a 2 year validity, we'd be fine until somewhere in 2016.

How does this help security? Why not have us replace these SHA-1 certificates somewhere in 2016?
Yes, that's what we're doing at CloudFlare. However, the patches to do it in major web server platforms are best characterized as "experimental" -- which is spooky for organizations to deploy into production environments. (We plan on open sourcing any work we do to improve them.) But, given how hard it is for most web admins to even manage one certificate, configuring a server to correctly manage two is... daunting. As you suggest, this change is undoubtedly good for our business, but I think it's bad for the web.
Fixed! That's really really nice, awesome layout - great job :)
Where is this data about which area correspond to each subnet? I can't find it. I don't know what to look for.
Right, I mean it makes perfect sense if the dividends have some expected future value. But my parent was saying they don't need to make a profit. If they never turn a profit, the expected future value of the dividends is $0.
Please fix form submissions so it will work without Javascript (and then I will use it from elinks over ssh).
Yup, that's the one. Surprisingly good looking panel for the price, once you change it to a limited color space and tune the color settings a little.
Happy 37th anniversary Voyager; you brought us closer to the stars
The "A Fork!? You Should Improve Scalac!" section is delightful.
Apple denies wrongdoing with iCloud breach
Introducing Win2D – GPU accelerated 2D graphics programming in the WinRT
It's going to go into somebody's cloud whether you like it or not as soon as you send it to somebody else, unless the "private" flag is an end-to-end solution. If I send a private file or photo to someone, it should be encrypted with an ephemeral key which is not stored but sent to another device immediately, so that in rest it's not accessible. Then when the recipient receives the file, it is decrypted and placed immediately into their device's "private" space.
Indeed. PATH and AirTrain are run by the Port Authority, which is a multi-state agency. The subway is run by MTA New York City Transit, which is part of the New York state government.
Exactly. "Design is not just what it looks like and feels like. Design is how it works." said Steve Jobs.
> SHA1 is technically still safe

The linked article to Schneier's blog shows that practical attacks can be afforded as soon as 2018. It's absolutely not safe anymore, at least for that usage.
Salesforce comes to mind.
The rule of thumb is that 20% of a venture fund's investments produce 80% of the returns. Outside of the top performing funds, those returns are generally not eye-popping.

The economics of a seed stage fund differ from a traditional venture fund. Stakes are a lot smaller and the number of portfolio companies is a lot larger. Maintaining a stake can be difficult, even with pro rata rights, because the cost of participating in future financings can be too high.

Valuation is absolutely crucial to successful startup investing at the seed stage. A seed stage fund that hands out $10 million valuations like candy is not likely to be very successful. Based on the percentages, a seed stage fund that has several hundred companies in its portfolio is still unlikely to see a billion dollar exit. According to CB Insights, 45% of exits in 2013 were at valuations under $50 million. Do the math. If you invest at bloated valuations at the seed stage, you're not statistically likely to produce great returns when all is said and done, even if you are better than most at selecting companies that have liquidation events (most don't obviously).
I'm sorry, but since when is itar-tass a remotely reliable source?
Just tell them straight up if they hire her you're out.
Awful for who? Not for the people who might not otherwise have an affordable source of protein (meat and/or eggs) thanks to the economies of commercial chicken farming.
It is weird how frequently the cards expire. I was quite surprised to visit Tokyo and have my Passmo card still working after not being there since 2009. (They expire 10 years after the last use.)

Octopus cards never expire, as far as I can tell.

The US is, not surprisingly, way behind here.
> the costs associated with sending email aren't nonexistent

> Of course infrastructure costs money.

You do realize you're.. well, you're not contradicting yourself, but on the one hand you agree it's obvious and on the other hand you insist it must be pointed out.

My example about money was just that. I could use Western Union or a bank transfer. Those things also have non-nonexistent (sic) costs. If you start pointing out everywhere that "Oh but there's this cost you didn't think about!", you won't be done by next week. You know all those libraries that let you check out books for zero cost? Reading those books requires education, which in turn is no free (No matter how much you wish to contradict that statement, the road you've taken requires you to admit to an unending set of cost upon cost which you don't think about in your day to day life).

You live in a society which expects you to have access to certain things. In the case you can't, there usually is infrastructure in place to help you out at little to no cost.

So again, please, just take this in: You can communicate with people at the other end of the globe. For free. This is not a legal forum and we don't need asterisks everywhere.
This shouldn't need to be said, but don't use -ffast-math if you want reproducibility. Unfortunately, the times when you most want reproducibility tend to be the same sorts of number-crunching where -ffast-math would be most useful.
To be fair, I can see how my original comment could be misread. I wasn't endorsing the behavior being discussed, I was simply trying to convey the idea that investors should accept reality: most founders are going to pick and choose their battles. Realistic investors shouldn't expect founders to go to bat for them unless they have an incentive to.

Example: if you invested $25K in a $250,000 seed round and haven't talked to the founder in six months, don't be surprised if he doesn't fight tooth and nail for your pro rata rights.
I am just pointing out that as a stock holder if the only value of buying AMAZON stock is that you expect that someone else down the line is going to pay you more to buy it than you paid for it then thats similar to how a Ponzi scheme works.

I dont think Amazon is taking a bad approach but, realistically feel Amazon is not going to produce any other return for its investors for the next ten years until it completely dominates the world market. Couple this with the fact that Amazon is not guaranteed to ever actually completely dominate the world market... its just unusual for a company to never return a profit after 20 years of business and investors are still hungry for the stock.
I've been buying more stuff off ebay, mainly on the basis that the site is hugely biased towards the purchaser and not the seller. I've sold stuff as well, but I'm always afraid a purchaser could just say I sold them a fraudulent transaction, trash my rating, and Ebay takes the money back and I'll never get the product back.
The project is no called longer "Common Markdown". It's CommonMark [1].

From Atwood's announcement yesterday:

Edit: after a long and thoughtful email from John Gruber – which is greatly appreciated – he indicated that no form of the word "Markdown" is acceptable to him in this case. We are now using the name CommonMark. [2]

Anyway, the reason the specification is complicated is because creating a regular grammar from a rich irregular grammar requires a lot of work. Things like reading ahead to distinguish between:

paragraph 1
%%%
paragraph 2

and

paragraph 1
---
paragraph 2

The goal is to help companies like StackExchange and Github get out of the markup language business by solving a set problems that aren't really on the radar of individual bloggers using markdown, but that very much impact websites at scale.

The article is a case in point - StackOverflow can't be efficient if it's pushing an entire parser into the browser. It needs to degrade gracefully when javascript is off.

In general, the world will be better off when the canonical markdown documentation is not written with a tiny font on a grey background. Perhaps we'll even see markdown [or CommonMark] begin replacing RTF and BBCode more places.

[1]: http://commonmark.org/

[2]: http://blog.codinghorror.com/standard-markdown-is-now-common...
can you dump out the index and examine if the most important noun phrases and named entities are being extracted, a la lucene?
It would be far from useless for your employer for you to take less money, but fair enough.

Growing the labor pool is far from good when the goal is what passes for leadership in the valley -- pmarca, zuckerberg, larry page, et all -- are really advocating: avoid investing in education, or growing the workforce domestically, in favor of importing cheap foreign-educated labor which can then be exploited via our pseudo-indentured servitude h1b system. Most of these folks already let their ethics show w/ their engineering wage cram-down, along with their tax avoidance schemes which reduce funds to the government which heavily subsidizes their industries via, for example, public support of education of the skilled employees.

There are plenty of good engineers available in the US. You can do any of:

hire remote employees

pay better so that people can afford to live in the valley without making huge financial sacrifices, or use your leadership role to attack any of the things (transport, nimby, lack of housing, lack of dense housing) that make living in the valley so expensive

foster an engineering pipeline and work culture that doesn't systematically exclude women (double your potential employee base alone), plus other minorities

But since they make none of these changes, I oppose any increase in visa allotments.
Dead Hand - Russian Automated Nuclear Launch System
I wrote a simple CUDA based image thumbnailing dongle with OpenCV a while back. https://github.com/NealP/cudathumb It's pretty fast but doesn't expose a good interface via console so if someone would like to contribute that I would be not unpleased. Also you need to have OpenCV compiled with CUDA to use it(which is kind of a nightmare). GraphicsMagick with its multithreaded thing(it should just werk if you enable it) is pretty fast if you run it on a decent CPU, it shouldn't take nearly 115 days. If thats still not fast enough for you you could try to make something with the Intel Performance Primitives package(if you're on Intel CPUs), though the cognitive load imposed by writing it might not be worth whatever speed boost it grants.
This was already announced by Microsoft last year: https://technet.microsoft.com/en-us/library/security/2880823...

Unfortunately, many CAs decided to ignore it, presumably on the assumption that Microsoft would be forced to back down. We've done this dance with MD5 and 1024-bit certificates and we know how it goes. Here's a quick list of CAs that issued more than 2000 certificates extending into 2017 with SHA-1:

GlobalSign nv-sa: 75,312
GoDaddy: 41,606
GeoTrust: 40,429
Comodo: 37,789
Verisign: 34,927
Terena: 9,444
Thawte: 8,735
Internet2: 8,637
Network Solutions: 8,077
Entrust: 5,542
AlphaSSL: 3,458

We would all have liked CAs to have acted either when the Baseline was updated (2011) or when Microsoft laid down dates (Nov 2013) or when Chrome talked about doing this at the CA/B Forum meeting earlier this year. It is unfortunate that that 2016/2017 dates are being ignored.

If you run a site and want to be insulated from this sort you might want to consider getting one year certificates. CAs like to sell multiple years of course but doing renewal once every three (or more) years means that you have a significant risk of loosing the institutional knowledge of how to do it. (E.g. the renewal remainder email goes to someone who left last year and you then have a panic when it expires). Additionally, very long lived certificates are not insulated from from these sorts of changes and you may need to replace them during their lifetime anyway.
you just have to use -d to specify where the data files are, the server can be anywhere. I moved it out of home to my dev environment without problems.
> I think that point of view should be right at home here on HN. I bet most of us believe that measurement, testing, and iterative development are helpful in producing a good product or service

Yeah, until we start trying to measure programmer output and then it's all on about how impossible special snowflakes are to measure.
$8.99 - $12.99 at Whole Foods, depending on the time of day.
Aeroponics
While I'm a huge fan of what you're doing in terms of crypto at Google, it's hard for me to see this decision as anything other than reckless. I think we'll be able to show a number of empirical examples of how, over the coming months, it will make the web a less secure place as sites that we're just now starting to convince to adopt crypto will stop.

I do at least hope that you will make efforts to alert more of the general public of what's coming and how they can prepare ahead of time. While at CloudFlare we follow the crypto lists closely and know there have been discussions for some time, dropping this news quietly for general public consumption on the Google blog on a Friday afternoon was... an odd choice.

And, for the record, for the last two years we've made it one-click simple for any of the millions of sites on CloudFlare to alert their users to move off out-of-date browsers:

https://www.cloudflare.com/apps/abetterbrowser
You know, a 1GHz x86 core is far more powerful than a 1GHz ARM core.

These devices come nowhere close to competing with traditional computers. Not yet...
whoops, you're right! Fixed.
Are these tracking capabilities available on other luxury cars?
I use Simple this way, even though their goals are meant for long term saving more so than budgeting, I use it for my 'envelope budgeting system'
GMail's size and centralization is its competitive advantage. It's not in Google's interests for you to benefit from its data mining efforts without also contributing to them.
No. Only Moto X has this feature.
> > You seem to think psychology is all observation with no attempt at explanation ...

> Wait -- that's not my idea.

Yes, it is.

> That's the reason the NIMH gave for abandoning the DSM -- it's all symptoms (descriptions) and no search for causes (explanations/theories)

"The DSM" is not "psychology". NIMH began a project to create a new framework for research funding (the RDoC) rather than using the DSM categories as a basis for research because the DSM is a clinical tool, not a summary of research. While causes are sometimes addressed specifically in the DSM, "search for causes" -- or search for anything -- is not the focus of the DSM, which aims to summarize for clinicians (and for insurers) the general judgement of the clinical community on appropriate categorization of diagnosis. It ideally ought to be guided by the output of research, but its not meant to be either a general purpose summary of research or a basis for research.

That's certainly recognition of the defects of the DSM when applied to a role for which it is not intended, but its not an indictment of psychology.

> Consider the example of Asperger Syndrome. It was thrown out over a year ago by the editors of DSM-5, described as an unscientific and meaningless term

[citation needed] As far as I understand, the reclassification of developmental disorders was not based on the fact that the DSM-IV diagnoses that were eliminated were "unscientific and meaningless terms", but that the DSM-IV definitions were not clear enough for consistent clinical use, and a single named diagnosis with a well-defined severity scale was more useful and would be more consistently applied.

> but I am still getting emails from parents whose children are being assigned the diagnosis.

The DSM 5 is not a mandate. And, indeed, there are many government (state level, certainly) programs that are mandates, and whose rules are written around DSM-IV diagnostic categories, and which haven't been revised based on DSM 5. Consequently, completely independently of the scientific validity of DSM 5 categories and the scientific acumen of the psychological community, there are reasons why DSM-IV categories may persist in use.

> Consider recovered memory therapy. Many people have been accused of imaginary crimes based on it, and many studies prove the unreliability of this therapy, but it's still offered to anyone foolish enough to ask for it.

Yes, and people willing to by snake oil for physical ailments will find people willing to sell it to them. That doesn't mean that medicine is unscientific.

> Falsifiability is a big issue with respect to psychological theories, for the reason that it doesn't exist.

Falsifiable psychological theories exist. In fact, in your own post you point to a psychological theory being empirically falsified, and then note (as if it invalidated psychology somehow) the fact that people commercially exploit the general public's ignorance of that falsification.
As one of the developers of Thermal API, thank you for allowing us to make your WordPress dev experience a little less crappy ;)
Ok EXPECTIONAL PRICE.

Didn't anyone not see that?
Looks like a decent share of the comments here do complain about the size, I always though I was the exception since the market seems to adjust to bigger sizes every year... I'm happy I'm not alone.

Every few months or so I spend an hour looking for a good and compact android phone to replace my Galaxy S II and the options are always very limited, I'm just hoping the Z3 compact will not have major flaws now...
there is in fact more forking happening:

https://news.ycombinator.com/item?id=8258255

https://news.ycombinator.com/item?id=8261896

_____________________________

Many (most?) of the debates regarding the scalac roadmap (and attendant tooling) happened in public on the internals mailing list. The simplest explanation is that nobody agreed on allocation of resources, which were mostly a few Typesafe employees and some (largely unknown but very talented) EPFL grad students. A sample thread https://groups.google.com/forum/#!msg/scala-internals/9Ts3GL...
Pick Winning Numbers
In the situation you are travelling with a kid who is eligible for free travel, rather than going through the barriers you should've just spoken to the the person on duty. Theres always at least 1 person standing by one of the barriers that would let you through.. takes like 5 seconds longer but doesn't involved getting munched :)
> The problem is the camera can be turned off by the officer.

I never understood even the mindet of this. What can possibly be the point?
The FBI Says How It ‘Legally’ Pinpointed Silk Road’s Server
It turns into a rant about how he'd wish the compiler and the editor and the source control should be all talking with one another.

It's funny, because there's actually a language just like that: Smalltalk. The development environment is the same as the runtime environment, it has its own source control (Monticello), its own editor and a very regular language.
Tangentially related from my rudimentary analysis, BAE Systems comes out on top from the top line item for each county under the 1033 program, that the nytimes added to their wiki for their data dump of the foia [0]. Interesting that A British multinational defense contractor comes out on top for a US Federal Program.

[0] https://github.com/TheUpshot/Military-Surplus-Gear/issues/10
Designer overwhelmed with orders after engagement ring box design goes viral
Buddhist temple seeks brand builders – kung fu skills not essential
Good times for startups.
Only you.
As someone who both uses Wordpress and develops plugins (which I try my best to make secure) this is both annoying and terrifying. I don't know how you could have a plugin architecture in PHP like Wordpress has, and have any real security without some constant diligence.
The spec is still titled the "Standard Markdown spec".
Is Your Homepage Driving Away Visitors?
If you want to write a contract to the effect that the investor retains pro rata rights provided he/she does X, Y, and Z, you can certainly do that. If the contract doesn't say that, then that wasn't your agreement.

-- Ah, I understand. Your comment is addressed to the seed investors, not to the founders. As such, it's a fair point. The question of how the investors should behave is not what we're discussing, though.
Cat Alert (Life Alert Ad Parody)
Agreed. Google is more likely to be the GE of the future: a lot of great technology, hands in many industries. Amazon, in contrast, is like a cross between Wal-Mart and the old AT&T (there is no good previous analogy for what they are doing, but many are doing the same...see Taobao).
Persistent SSH Connections with Context
Yes, it could be a completely bullshit story or not.. who knows http://mashable.com/2014/09/05/google-to-move-personal-data-...
> I'm just pointing out something fairly obivous - that not participating in a market is not a very effective way of changing how that market produces things.

Everyone participates in the market for buying food. There's probably someone out there who has the very narrow goal of changing how meat (and only meat) is produced, but for everyone else this is a strawman argument.

We want to change food production, and overpaying for similar products is obviously going to be less of a signal than larger dietary changes.
Wow, small world. I just finished writing the code to handle LMC items from Amplify o.o
3 BEHEADED IN UK
Where's the data coming from and how are you considering a business as local or not?
Anybody know what the easiest way to determine if your certificate is affected? I looked at my certificate and it says Signature Algorithm is "SHA-1 with RSA Encryption". Is this affected? When I viewed the certificate for google.com it also said "SHA-1 with RSA Encryption".
Right. They can already support UHD, so I think a UHD iMac is imminent. However, I see us quickly moving to QUHD after a bit of time in UHD.