skysight-inc/HackerNews huggingface dataset:
Although I'm an AGL fanboy (I have his rookie card) I have to agree with Matthew here. Pushing the transition this fast, just when the world is on the verge of accepting HTTPS as the default, is reckless and will overall reduce the safety of the Internet.

FYI, we are deploying in the same manner as Cloudflare, with RSA/SHA1 and ECDSA/SHA256 side-by-side. We are committing our changes to the public ATS repository and hopefully those changes are useful to other projects. Unfortunately this is dependent on OpenSSL 1.0.2, so we might have to deploy beta code into production if the OpenSSL project can't beat Chrome's arbitrary deadline.
It kind of drives me nuts that I've read a lot of this research elsewhere, and all of my experiences have either flew in the face of them, or there were major asterisks. It makes me wonder, who were the people being studied, because I can see all of this being true in the general population, and you can even see it in most of the valley.

There is something about the results that I don't trust, much like the way that I don't trust anything I read about what's good or bad for you. Years ago, they said fat was bad for you. Turns out, it's complicated. Then they said carbs were bad. All I can tell is that my parent's immigrant diet was healthier in ways that could not be assessed by "research."
I'd say newspaper articles and speeches would tend to be US centric but classical books and literature would expose student to views from outside the US.
Toy language with the Python, LLVM
I get the "link-bait" virtues of your title(and it worked on me), but the title contradicts itself, literally.

If you want to start a start up, start a start up.

The body of your text also contradicts itself. One of your premises speaks to the luck nature of success. Conceding your premise, the supporting text that follows amounts to advising people to study to win the lottery.

A more interesting treatment would consider time cost, iterative or serial entrepreneurship vs. whatever your win condition is, etc.
It's my understanding that most OpSec failures are real basic OpSec 101 failures. Not because, faced with the question, it's hard to get it right - but because faced with so many questions it is hard to get all of them right, and screwing one up is frequently enough.
I don't know. Trying a series of passwords until I get it right is basically my standard login procedure. Guess I have to get to three felonies a day somehow.
As I read more and more articles regarding studies or companies (usually startups) experimenting with four day work weeks I wonder when/if a large company would ever move in that direction. It seems something a lot of people (not just developers) would be attracted to.

Might be incredibly beneficial in attracting higher quality candidates - particularly for large enterprises not as "desirable" as places like Google, Apple, Twitter, etc.
>My favorite statistic was the 18% of entrepreneurs succeed the first time, and only 20% succeed the second time.

This is a potentially misleading stat. The second cohort only includes the failures. So clearly at least some of them learned something.

It's a 36% total success rate for entrepreneurs who try twice.

(Though I guess that number is missing those that try once and don't try again)
I don't have as much knowledge to impart however I will piggyback. In my experience working for companies of different sizes and stages of growth can be eye opening. Seeing teams work through problems from different perspectives has given me great confidence when figuring out how to address new challenges and uncertainty.
The perfect testbed for a p2p or federated social network to supplant Facebook. Or any other thing where we need to cut our dangerous dependencies on Big Internet (e.g. Google, Facebook).

Imagine a p2p social network that worked more like messaging. Your posts, instead of going to and having to trust a central keeper (e.g. Facebook), would go directly to recipients.

At most we'd need generic store-and-forward services if we want to assume users won't be running computers that are up most of the time. We could just piggy-back on the email network, broadcasting posts to your friends via PGP encrypted email, with some special subject prefix or header, so your mailbox rules can keep them from cluttering you normal inbox, and so your social network client can pull, decrypt and display them in your "news feed".

Or we could use the BitTorrent protocol or similar for distribution. Again, PGP encrypted so other nodes that aren't the recipient of your post could still act to store and forward.
There are occasional discussions on sbcl-devel about it, but I'm not aware of anyone committing serious resources to it (it's not really a weekend-project, or even single-GSoC-student, amount of work). There is also some skepticism about whether it's worth doing at all, because of worries that it will be difficult to get good GC performance out of LLVM: http://marc.info/?l=sbcl-devel&m=136219729420475&w=2

(Reference [1] in that email points to: https://github.com/elliottslaughter/rust-gc-notes, which documents difficulties trying to build a precise GC for Rust on top of LLVM.)
Reading the Krebs story on this same topic (http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...), it occurs to me that FBI may not have needed to try to authenticate at all.

Basically all the analyst said he did was to load the SR website far enough until the captcha popped up, and notice in the wireshark (or equivalent) logs that a non-Tor IP address was reached from the SR website.

If the analyst tooled around on the website after that, then even if the court were to call foul on that subsequent access, the public IP address wasn't derived from tooling around so it (and the evidence derived from that) wouldn't be at risk either.
My point is that both entities are drug marketplaces, thus they should not be treated differently when it comes to warrants and other legalities.
Rust has the same problem described in the article.
LinkedIn Creates Features to Protect User Accounts
Couldn't find too good articles, but basically he did everything he could to annoy the judge.
http://www.vice.com/read/lulz-and-leg-irons-in-the-courtroom...
http://www.nbcnews.com/id/51232207/ns/technology_and_science...
FYI, your url in your HN profile doesn't load (wanted to checkout what your new startup is).
> Many modern high-level languages use some kind of VM

I don't think this is a good approach and it's very nice to see projects like yours that try to shift the paradigm. LLVM can provide many of the benefits of bytecode based VMs, yet give efficient native code in the end.

How did you go about the GC? Did you grab a GC from somewhere else or build your own? Did you use LLVM shadow stacks and/or GC annotations? I guess Lisp is a lot easier to build a GC for than other languages.

There are many promises VMs should give, performance, safety and security but in practice not a lot of those promises were ever fulfilled. Performance can be on-par with native code in the best case but usually 2-10x behind, safety may be a bit better but we still get crashes because of incorrect memory use and the Oracle JVM has had more zero day vulnerabilities than any other software I can name. I think it's time to move on.
My view changed a few months ago. I think SPI (Single Page Application) is here to stay and is fast subsuming the web landscape:

http://en.wikipedia.org/wiki/Single-page_application

My tool of choice is jQuery Mobile. If it weren't for that I'd probably do AngularJS; whatever it takes to shift the processing to the client and make my life easier by not having to muck around in too much JavaScript code.

The point being that this approach works just fine for document centric sites.
there is no contradiction. what you want to do and what this article suggests you do instead are not mutually exclusive.

consider the (perhaps poorly guided) advice "if you want to go to Florida [i think you should] go to Hawaii [instead]".
Duda DST-2: Development Updates
Torbrowser doesn't even sanbox tabs[0], let alone virtualize.

Checkout Qubes which was a project that virtualized each app:

https://qubes-os.org/

Doing that today with Docker containers would be interesting.

[0] This is one of the main reasons why there are efforts to move it to Chromium
Funny fail
Your explanation would require resolution of the mind-body problem --

http://en.wikipedia.org/wiki/Mind%E2%80%93body_problem

-- which doesn't have a widely accepted resolution. The tl;dr: arguing that another hypothetical person is present by reference to the mind, is a non-starter, except among psychologists.
I pretty sure in one of the essays PG says you should finish collage and go work for 2-3 years (or maybe it wasn't him)

I think there is no simple answer. Try defaulting to work for a few years, but if you are hacking a project while you are studying and you are convinced that you are on to something, take a year break to try it.
I seemed to have read that in such contradictions, these ambiguities are resolved in the favor of the one who didn't draft the documents ie the employee in this case. But i'm also surprised HR wouldn't discuss with their legal counsel.
Ramnode has been treating me extremely well considering the price. Their plans are a steal
> It's unclear whether the average person learns anything from a startup.

> Entrepreneurs don't seem to learn much from their failures

There is a difference between not learning anything at all and not learning something from failures that will help in a future startup venture. I have learned a tremendous amount working at startups. I am closer to everything, nothing is in a silo and I have gotten exposure to all parts of the architecture whereas at an employer I would have been barred from infrastructure and operation tasks. There is also much more freedom to use whatever technology you want to try out, and thus you learn a lot about new programming languages and new libraries and new ways of doing things without having to get approval from layers of management and architects. You learn about your self too, your limits, you have to become independent, and self-reliant.

> Our most important finding is that the reward to the entrepreneurs who provide the ideas and long hours of hard work in these startups is zero.

Maybe if you only consider money. If you are into startups for the money alone, I feel like I would agree, stay away. If you're in a start up for the small team size, for controlling your own destiny, for being close to the customer, close to the product, and don't want to see your life's days waste away in meetings and products that never see the light of day then the value is actually immeasurable.
Each is regulated state-by-state. You could add banking to the mix.
Motorola Launches Android Wear Smartwatch
I might have not explained clearly: you can use standard Makefiles and scripts without issue.
Yes and no. It can help with different target backends (including JavaScript, not sure about JVM or .NET) but you still have to do work to make sure that the calling conventions of your language and the target's match.
TV is increasingly for old people
Python 3 was never "in limbo".

From the very start its goals were clear. Yes, it took some time to implement them, but this was done rather efficiently and quickly.

Unless you were using one of a handful of libraries that didn't put forth the effort to be compatible with Python 3, it was very easily to adopt Python 3 early on, and to use it effectively.

I worked with a group that adopted Python 3 relatively soon after its official release. This would've been around early 2009. We developed a number of large systems using Python 3, without any major problems. Sure, we ran into bugs now and then, but we reported them and they were fixed soon enough. We helped port some libraries to Python 3.

We didn't regret the decision to go with Python 3 then, and the last I talked to people still involved with those projects, they don't regret the choice now. They're glad that their millions of lines of code are targeting Python 3, which is without doubt the future of the Python language at this point.

I don't know why people such as yourself continue to portray Python 3 as a "disaster", when all of the evidence and much of the experience with it shows the complete opposite to be true.

It was a smooth transition for Python 2 users who didn't want to or need to upgrade. It was a smooth transition for Python 3 early adopters. It's a rather smooth transition now for Python 2 users who want to use Python 3. "Disaster" just isn't the sort of term to describe a transition that goes well for all involved.
This seems functionally equivalent to a vhosts+cgi-bin.
Tails has an 'unsafe browser' so you can log into wifi gateways then start the regular browser. If I'm a federal agent in need to decloak Tails users I would probably target that script that disables the firewall that any unprivileged user can run. If you don't need the script probably a good idea to build Tails without it
Good point! I'll add a way to toggle the code on or off.
Well, I was just trying to explain why that might not need to be the case. You can be contrarian and focus on the Bay Area. And that in fact might be smarter.
Nobody is arguing that reading the news critically isn't an important skill and that it shouldn't be taught in school. But when you declare that it's unambiguously more important than Shakespeare, you're moving onto thin ice. The reason we're reading and loving Shakespeare rather than whatever 17th century equivalent of Time magazine we might be able to get our hands on, is that the former teaches us deep, profound and timeless lessons on human nature, especially the dark sides. Few things will teach you more about reading the news than Macbeth, but reading the news alone won't even begin to do the opposite.
Y'know, given the conflicts of interest of auto salespeople, examining the merchandise from someone who doesn't have a vested interest in the sale, but does want to convey accurate information, would be a Good Thing.

When I bought my most recent vehicle (a purchase I'm largely happy with), I asked the (young and apparently inexperienced) salesman about a couple of features and he gave answers which were clearly bullshit. He'd have done far better to state that he didn't know.

One was mis-identifying the front-bumper transport tiedown hook cover as a sensor. Not a big deal, but so obviously bogus, after the fact, that it left a negative impression on the overall experience.
You've listed a whole bunch of other reasons as to why your company is going great, inpite of the name. I'm presuming the name's not the most important thing?
Sucks that money will be wasted on marketing and branding...but it's better surely, to change that then risk loosing more?
It's not fair.
It's shit.
But it could be better to do now than 2 years down the line when the name is more recognisable.
Give it a fight if you can but I assume but the most important thing is protecting the entire company, not a name :).
Paul Graham's website/DNS down
If you read further into the thread, a pilot says that the high fuel consumption during takeoff was a consequence of the aircraft's weight being higher, and higher air density at lower altitudes -- the engines were not more efficient at higher speeds as an earlier post suggested.

Note that the idle fuel consumption (1t/hour; not sure whether that figure was per engine or for the entire plane) was not higher than cruising (4-6t/hour) -- it was just high in absolute terms.
Yeah, but then there is good research and bad research. Hey should have done a bayesian analysis and iterated through all the people who've been successful with startups. What percentage of them were likely successful because of previous employment and those that weren't. How many of these guys are your zucks and gates and andreesens of the world?
Many, you really are your own self-parody, aren't you.

Have you even read Smith?
But look at Clojure. It's imperative yet quite FP, but much of the language rests on OO polymorphism. Clojure certainly isn't an OO language (in fact, it is decisively "anti-OOP"), but it does mix an essential OO idea, and that actually helps keep the language simple.
Dynamic language notwithstanding, the transition was badly designed, in terms of being supportable by automation and providing a cost/benefit motivation for upgrade. With something like that, pretty good = disastrously inadequate.
Given that you're misunderstanding free markets and reality, I'd say it's quite likely you're misunderstanding the post you're replying to as well, yes.
Actually, airport security -- at least for international flights -- in the late 60s and early 70s was not more relaxed. Having traveled quite a bit as a child in those days, most international travel involved having all your bags searched by hand in front of you. The difference was that air traffic volumes were much lower, you spent less time in queues, and Concorde passengers were first class and got preferential treatment.

The lightest airport security in my experience was in the mid-to-late 90s following deregulation. I flew from Sydney to Zurich in 1998 without breaking stride at either end (literally waved through every checkpoint).
If you really mess things up, there is Reflog
>it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite.

Unless Ulbricht's lawyers successfully argue that fuzzing constitutes an illegal search. The law respects precedent, and there is more precedent which finds that fuzzing leads to illegal access.
Comparing to Hong Kong, the Wall Street is much more flexible and is very willing to suck in as many IPO possible.

http://blogs.wsj.com/moneybeat/2014/05/12/hong-kong-right-to...
Ask HN: My app is being bullied on Google webstore, What to do?
My latest free webstore app (Link given below) is being attacked by group of cyber bullies from past 2 days. Here are the details:

Day 0:
- I had almost 100 reviews on my app. Most of them were 5/5. And chrome webstore was showing full five stars for this app.

Day 1:
- A guy (with empty profile) posted a 1/5 rating, claiming that my app is not safe to use. And interestingly only the same day, I got more than 20 new 1-out-of-5 ratings, and none of them had any text reviews. Generally I rarely get less than 5/5 rating, you can check from the below link.

Day 2:
At Day 1's end, I posted a reply on the guy's review that my app is safe, and you can contact me on the given ID. Next day I woke up and saw, his 1/5 review starting with "Avoid this app" is on the top, and my reply was completely removed. Which can only happen when lot of people click on mark-as-spam.

So, I need help from you guys. I do not have any contact at Google, and even if there was not sure how much they can help. Any suggestions what should I do next?

Note: We can discuss this later/seperately, but my app is 100% safe and I am an ethical developer.

https://chrome.google.com/webstore/detail/sticky-notes-just-popped/plpdjbappofmfbgdmhoaabefbobddchk/
You can clear the CPU state. But how is the CPU to know when it's safe to clear unless the software tells it?
It has a unique texture, and provides healthy nutrients.
BOSE QuietComfort 25, Amazing Noise Cancelling Headphones
I'd say it's even less capable. Shared hosting providers typically allow the use of Perl, Python, PHP, Tcl, Lua and sometimes other languages for CGI scripts. From what I can tell, this service limits you to Lua only.
The self-employment study says that when people who are self-employed switch to dependent employment their wages are at least as high as their dependent employment counterparts.

From an earnings perspective, that makes start ups more appealing. You can take a shot at starting your own company. If it fails, you can still make at least as much money as if you had not started your own company.

The other thing is this blog post is looking at the average outcome. If you are starting a company, you are already starting from the assumption that you are not average.
Haven't used it yet, but I'm intrigued by WealthFront.
I come from marketing and working on my product all by myself now. Very well said. The journey to experience and learn is very personal. Even it can not always be monetized and is less possible to be fully got by others, it's still worth it.
The existing LTE version is now strangely listed as the "Gen 1" on the Motorola site.
There is nothing to suggest that the second cohort only includes failures, and bear in mind that many people -- having failed -- won't try a second time -- and if they've learned anything, it will be the people who figure out they're never going to succeed who drop out. Without knowing the probability that someone who succeeds vs. fails will try again there's simply no way to tell.

Anecdotally, it's very common for entrepreneurs to start a business, wait until it's up and running, sell it, and start over. This applies both in high-tech and more prosaic areas like restaurants and gas stations. I imagine that first-time successes are very likely to try again.
RubyMine!
Let brands fight for your every purchase – Wrapp Reboots Shopping
Sweden vies as hi-tech hub
> Unless you were using one of a handful of libraries that didn't put forth the effort to be compatible with Python 3, it was very easily to adopt Python 3 early on, and to use it effectively.

You're speaking in the past tense about a present problem. Many large projects that would like to migrate to Python 3 cannot because the library support isn't there.

This is in no way meant to disparage the motivations that led to Python 3, because it's better in every way than its predecessor. Only that the transition problems are still present, and the larger the project, the more difficult the transition.

Sage (http://www.sagemath.org/), a project I'm involved in, is just one example -- a large, complex project, it relies on dozens of mathematical and other libraries, and to transition to Python 3, all the libraries would have to be available in Python 3 versions -- even one exception would prevent the transition.

It's safe to say that everyone involved would like to see a transition to Python 3. But it's not possible, and for the foreseeable future it's not even likely.
Great tool for young interns! :D

I think there is a small mistake though, for the "I accidentally commited something": the answers yes and no for "Has anyone else seen it?" are inverted.
According to the author:
- 18% success rate for time founders
- 20% success rate after that

Implying previous experience almost doesn't matter that much... so just trying 5 times should assure 1 success.

In that view, starting your company as soon as you can would still be the best way to get to your first success faster.
This is always good to remember. HR exists to protect the company, not as charity to employees.
> choice between "HTTPS being secure" and "supporting insanely old/insecure software",

I think there are really three outcomes:

1. HTTPS is widely used, it's secure, insanely old/insecure software is not supported. (Ideal outcome)

2. HTTPS is widely used, but using SHA1 certs for a little longer so that insanely old/insecure software is supported.

3. HTTPS is less widely used, but is secure with SHA2 certs, and insanely old/insecure software is still supported.

My concern (and Matthew's too I think) is that the aggressive deprecation of SHA1 will put us on a trajectory to outcome 3. We're at a unique point in history right now: there is incredible momentum behind converting sites to HTTPS, even sites that traditionally would not have used HTTPS (such as all static sites). The SHA1 deprecation might throw a wrench into this and cause site operators to reconsider switching to HTTPS. If not for this momentum, I'd agree that aggressively deprecating SHA1 would be the clearly correct course of action, but at this moment in history I'm deeply ambivalent. Disrupting the HTTPS momentum would be very sad, especially since switching to HTTPS provides an immediate defense against mass passive eavesdropping.