skysight-inc/HackerNews huggingface dataset:
First, let me say that the aggressive approach to actually making encryption happen that CloudFlare has been pushing recently is very commendable. The hard part about finally retiring the old plaintext protocols we currently are stuck with is critical mass - nobody sees the point when plaintext seems to "work just fine". The various steps CloudFlare has taken to encourage SSL will go a long way towards reversing that attitude.

That said, I worry about the future we are creating by entrusting so much security and traffic to a single point of failure.[1]

It seems to me that CloudFlare is positioning themselves as another Google or Facebook, where a key feature of their business is that they get to track the web history of a large portion of internet users. Much like Google gets to have a lot of my email when other party is @gmail.com, CloudFlare gets click histories by people using their CDN and caching/filtering servers.

While I don't really know anything about the motives and personalities behind the company, I can give them the benefit of the doubt for now. Unfortunately, their motives don't matter - in a world where "national security letters" Prism, XKeyscore, and the like exist, CloudFlare's motives may not matter.

Even more concerning is that while it my hard to avoid Google's tracking, it is at least theoretically possible. With CloudFlare (or any similar service) we are stuck with a situation similar to tinyurl/t.co/bit.ly [2] where content is hidden behind serves from which you have to request the real URL (or in this case, the content itself).

Don't get me wrong - SSL becoming significantly more common is good regardless of what else is going on, and CloudFlare still deserves a lot of praise for advancing a problem that has been so resistant to progress in the past. I would even agree that CloudFlare's caching services and security protections are (very) good engineering techniques that we should be using. It just seems like everybody is (yet again) setting up a single point of failure that will suddenly have very significant consequences the minute somebody with real power decides they want those very-revealing server logs.

[1] I'd be the first to admit I don't have the best understanding of how CloudFlare works; corrections to any misunderstandings I may have about their business or tech would be greatly appreciated.

[2] http://preview.tinyurl.com/feckless-imbroglio
I'm taking this more as contextual advice depending on the state of the market you're addressing.

It could be argued that this is less relevant (at first) in an extremely small SaaS businesses that's targeted at a niche screaming out for a solution to a problem.
It's a similar state over here in the UK, can't wait for our next trip to Thailand.
The files are not encrypted. I mention the aspect of doing it with files that are already compressed and that I never expected it to work for that very reason. I just wanted to to for once actually do it and I don't see why you need to get so mad about that.
Organizing your app routes with the Express 4 Router
Yep, it does. http://arstechnica.com/information-technology/2014/01/bitrot... has a pretty nice overview.
The semantic problem I see with "performant", which is sharpened by the word transformation, is that there almost always multiple dimensions of performance.

For instance, "performance" in terms of time is relevant to all IT systems, but there is usually some other dimension, for instance, compression ratio or accuracy, that matters too.

Thus, "fast" is a better adjective when it applies because it is more clear.
More likely got out of architecture with the S&L crisis (or more fully the Regan tax reforms that reduced the attraction of passive losses on real estate that triggered it). May have come into IT from CAD management which was somewhat on the cutting edge for small businesses in the early 1990's [e.g. Novell networks, megs of RAM, 80387's and multiple monitors...Acad with an nthengine and Herculese card was better than can't touch this baggie pants.]
It's not the simplification - it's that they do it for all their clients at once - no opt-in.
I challenge you to record 30 seconds of a fixed test pattern from TV on two separate occasions and have it encode to identical bits. I don't think it can be done.

Many media formats (including all digital TV formats) encode a rolling hardware timestamp of 33 bits (or more) which won't be the same for two separate segments by random chance. Audio, video, subtitles and other metadata will be ordered differently in the stream because they all comes from sources that have their own separate clocks. Synchronization between clocks at different stages in the media pipeline will cause different frames in the sequence to be dropped, padded, made into keyframes, etc, which then affects every bit in subsequent frames. TV stations use time-based watermarks. TV stations use digital compositing software that may retain bits from previous frames on an ongoing basis. Many studio media pipelines still involve analog steps.

The list of complications goes on.

Unless your pipeline is lossless, uses only digital sources and uses totally synchronized clocks for all stages, you're about as likely to get an MD5 hash collision by accident as you are to get any two non-trivial sequences of compressed video to be bit-identical.
The question is even bigger: should we trust startups that claim "no evil" when they are small, and quickly forget it when they grow?
Here is another example: http://blog.garrytan.com/infanticide-how-anti-competitive-la...
That can't be correct, I get lots of traffic from China, and use Cloudflare. Unfortunately, the traffic is often SQL injection type garbage, so I'm going to be upgrading to Cloudflare Pro as it seems they block such traffic.
That's an extremely short sighted and uninformed viewpoint. Just because you might not hold the person or context in high regard does not mean nothing learned from his viewpoint / experience...
Sorry, I deleted my comment since I thought the issue was better explained/covered downthread: https://news.ycombinator.com/item?id=8382419

As for spoofing the DNS record, I was under the impression that you switched your domain's nameservers to point at Cloudflare and that's what's used to verify that you control the domain.
I guess you missed the part where I say almost the exact same thing as you just did, i.e. that I did never expect it to work?
I just wonder how many actual physical human users those "99.44%" of the traffic from Antarctica represent. It's not exactly a population density hotspot, is it? :)

Juggling the number around a bit it seems to correspond to 1/179th, but Wikipedia says that the population of Antarctica varies with the season between 1,000 and 5,000.
I like the philosophy behind Markdown: you write a simple text file and this is your article. If you want, you can fire up `pandoc` and convert it to HTML to make a nice website. Then, make it a PDF for constant rendering.

I personally started using Markdown as well for my website. I have a simple Makefile that finds `*.md` files and convert them to HTML using pandoc with some custom options. I can edit files very simply with vim instead of an online editor bloated with Javascript.
> So there were no computers at MIT in 1967

You cpmpletely misunderstood that paragraph. He said that MIT would still have its own computer in 20 years because knowledge is its core business, but that other institutions would, instead of owning their own computers, use rented ones remotely.

He was basically predicting cloud computing.
Happen quite often especially when I study something new, I wake up with the voice in my brain that repeats commands like "dot controller" and stuff like that..
Uh, CloudFlare controls all the traffic between your site and the world. They can automatically put whatever they want wherever they want on your site.
This is a very impressive achievement by CloudFront, but I wonder how many "this page includes other resources which are not secure" warnings I will notice today from websites that weren't prepared for this.
It seems to me that CloudFlare is positioning themselves as another Google or Facebook, where a key feature of their business is that they get to track the web history of a large portion of internet users.

CloudFlare's business model is not offering a free service and figure out how to make money. It's getting people to pay us money and those people are our actual customers who run web sites: https://www.cloudflare.com/plans

Unfortunately, their motives don't matter - in a world where "national security letters" Prism, XKeyscore, and the like exist, CloudFlare's motives may not matter.

https://www.cloudflare.com/transparency
On the other hand I find these results fascinating. They are like a microcosm of experimental science. Numerical coincidences like these can be found by any high school student with a calculator, but only some deep theory can tell us whether they really are coincidences, in the statistical sense, or whether they are a manifestation of some precise underlying structure.

The Ulam spiral is one of my favourite examples of this kind of thing.
http://en.wikipedia.org/wiki/Ulam_spiral
Not for points but I believe there is for karma.
Severe depression is a kind of "extreme chronic pain".
I tend to agree with you, but the article wasn't supposed to be very technical in the first place, and: both those GIFs are from Dexter, the show of which I used a season in my tests. It's not completely unrelated.
This won't work because you don't control example.com. If you sign up for CloudFlare and tell us you do your site will be in an 'unverified' state until you move DNS to us. You won't be able to move DNS to us and so the CA process won't be able to issue a certificate.
I suggest looking into Computational Science programs - almost every reputable engineering school offers this as either a minor or major track.

Astrophysics/Cosmology has a large and important computational simulation component, and knowledge of numerical methods, systems programming and distributed computing is very valuable.
I've always kind of found the total points to be a bit irrelevant. But I do take karma into account when posting which probably would prevent me from ever breaking into the top 100 of total points but does prevent me from posting every silly thing that comes into my head[1]. It seems karma's a more relevant metric for value then total.

1. Like this :-) https://news.ycombinator.com/item?id=8362307
Build a drone using ArduPilot - on top of 3DRobotics hardware. Write an AI that combines input from Twitter sentiment analysis and OpenCV to autonomously fly around the world looking for sad tweeters - drop a burrito on them.

Check, check, and check.
I did a very thorough Google search. I haven't found this app anywhere else. :( I think it is lost forever.
Indeed: they were early adopters of many things: Ogg, Vorbis, Matroska (and the advanced features like linked ordered chapters which is designed for the use-case in OP's scenario), h.264 High10 Profile, advanced animated subtitles formats...

I think the long answer has something to do with what they do benefitting from it more than other things, and the short answer is "because they're geeks"; so they perhaps care less about slow hardware adoption of things like 10-bit than other encoders.
I hope he has another account to post mildly relevant/interesting stuff.
On the hunt for the right open source project?
What the heck is the big deal with Ello, anyway? It's just another social network by a private company, and one that isn't even complete.
The presentation just before the "3D" one demonstrated a purely functional SNES-inspired engine, with sprites of Megaman, etc.

Relevant HN thread: https://news.ycombinator.com/item?id=8381274
I have to admit that I had not checked that, but I think Dexter's intro is really the same and the changing cast lists appear during the first scenes afterwards. But for most shows you're right, that would be another reason why it could never work.
The player would have to be able to reference a huge number of sparsely-positioned reference frames.

The seeking might make it impractical.
Exactly. The engine is able to make excellent use of the GPU while sporting a purely functional API in Racket, a dialect of Lisp.
Looks like you're describing reddit + subreddits :)
Except that the the yellow cab leaks are unintentional and based on ignorance, and these are (allegedly) based on intentional disregard for privacy. So I don't agree that the two are the same at all.
> I wouldn't hesitate before recommending Erlang and warning -- quite strongly, in fact -- against choosing Haskell

That's a very unequivocal conclusion but you didn't say anything about the reason for such a decision. Could you say a few words about that?
Thanks for the response. So this validation is required before you issue certificates? I was concerned there because non-https traffic seems to be able to use cloudflare before verification.
How to Connect to Twitter with Python
That is the truth that I unfortunately learned too late, at least, way after I spent way too much time ruminating about concepts of free will and determinism. Now, I have a very dispiriting view of humanity (the fact that we evolved from primates who'd fight a lot, rape a lot, etc.), it does much to take away 'meaning' from my life. I wish I'd never spent the time I did thinking so much about all of these things alone in the late night. If I'd been more outgoing, more social, I think I would not have this negative and sorrowful outlook in life.

I strongly suspect that others pondering the Camus question of suicide are similarly alone or asocial. I encourage everyone to get busy in social doings -- it does a lot to take this off your mind and let you live life normally.
Tastes vary, and what one finds offensive another might find hilarious. As long as we all get along in public, it shouldn't matter too much what makes us laugh when among friends.
Not to speak for Peter, but some people like to set goals because the effort to achieve them might reveal interesting bits about the mechanics or psychologies involved, including their own.

Some of us tend toward the product side, some the process side, and some the people side. The people side is the most visible and most likely to arouse suspicion among geeks, but it's not inherently worthless.

And, of course, self-branding and promotion is a thing that people do.
Not sure about cloudflare, as I never used them, but typically such services will ask you to create some subdomain (ie. cf1234.example.com).
I've always dreamed that subbers would just provide one version of the credits in their season packs and provide a bash/mencoder/whatever script to glue the bits together after download. We're wasting so much bandwidth on opening and closing credits that people end up skipping anyway, it's crazy...
I didn't realise they were from Dexter, though I stand by what I said. Clearly the masses on HN agree with your choices, though, since I'm getting down-voted!

I'm writing some technical documentation for a project right now - perhaps I'll put in a few tasteful images from Baywatch to make sure the project managers who have to read it will make it to the end.
Tibco Software to Be Acquired by Vista Equity for $4.3B
I set a goal several years back of getting into the top 100, then top 50

Why? Oh, why? I look at my own HN posting as a personal weakness that does nothing to advance my career, general happiness, or sense of personal development. The really successful people I've known in my life don't get caught up in tussling in Internet forums. They stay focused like a laser on goals that are much more recognizable as "success".

And that reminds me to close my browser and think about what I really want to accomplish today!
Ask HN: Hacker News Do's and Don'ts?
I'm new to Hacker News. I read the Guidelines and the FAQ.

Does anyone have any do's and don'ts for posting, commenting, and participating on Hacker News?

# Example

1) Do ask great questions

Witty and intelligent musings.

2) Don't just post links to your website

Witty and intelligent musings.
It defines the leadership of the Council of Terra, who will be the new global overlords after the Great Forgetting Event of 2018.
> Why does life have to be "worth" living?

Why do you get to impose your values on someone else about a thing you literally can't know?

Murder is illegal because you're depriving someone else from their right to life. The person who does the killing is the criminal and the person being killed is the victim.

But I can't steal money from myself can I? So in that regard, neither can I murder myself. Every person has the moral right to end their own lives even if we don't like it and don't understand it.

Of course it's illegal to kill yourself, but not because the justice system has any ability to prosecute a corpse. It's so that people who try to kill themselves and fail badly at it can be temporarily restrained and given medical attention.
Can't find many reviews (1) of the service provided, and for some reason I'm wary of the responsibility of selling my own data. Has anyone tried this service?

1. http://www.technologyreview.com/news/524621/sell-your-person...
Millennials Increasingly Turning to Mobile Pictures to Communicate
> Why does life have to be "worth" living?

Because life requires effort which some people might not like to spend.

> What is the yardstick of value you're judging life against?

Against not living.

If value/effort < 1 suicide seems like a pretty logical decision.
I dont know the person, so I don't want to judge him. And I also agree, that it can be possible to learn from everybodys viewpoint. That is a pretty general statement though. The possibilities to learn something valuable certainly vary by the source.

I hope you agree, that skype, that was a great software, has been systematically wrecked by microsoft. It has not only become unusable, it gathers more and more bugs (don't start to talk about the MS classics).

So MS did not get it in 40 years. You are still in good mood, that they have something valuable to tell about software development? Certainly, there are always new developers. But the culture did not change. Good luck with your hope to still learn something valuable from MS. The chance is just not too high, I guess.
Yes, the author is not the company. But he takes his experience from MS as an example.

And, btw., my viewpoint is neither uninformed nor shortsighted. It is pure anger about 40 years of bad software and especially about ruining skype.

You one the other hand, assume things of me from 2 lines of comment. How can you believe, this is less shortsighted than you think my comment is?
Giving Away Software to Make It More Valuable
Facebook SEO – SEO – WEB DESIGN
Prediksi-skor-cska-moscow-vs-bayern-munchen
CVS was difficult but there were non distributed vcs that had easy branching.
https://news.ycombinator.com/classic

Not really what you describe, but it's along the lines of "give me an alternative to the frontpage or /new." I don't know precisely how it works. I think it gives more weight to votes from older accounts, but that's just a guess. It does seem to be a slightly higher quality frontpage, but that might just be confirmation bias. After all, if it were truly better, then /classic would be the actual frontpage.

There's also http://hckrnews.com/ which shows a time-ordered list of all submissions that reach the frontpage each day. I prefer it to HN's frontpage, both because you can scroll back over the past few days and because there aren't that many submissions that reach the front page each day, so it's easy to quickly scroll through a list of all of them to pick out anything of interest.
Further flaws render Shellshock patches ineffective
Yes, performant. The article shows how a tinhole-based get-in is significantly faster than the default get-in.

(The methodology could be a bit nicer; it's a simple timed doseq, but it does show some performance gains.)
Best music to code to?
What music does every body enjoy coding to? I am about to start a project where i need to headphones on and to be left alone for a few days. I need some good music to go with it. Thoughts?
Actually with Bootstrap it's possible to create complex interfaces (I had written from scratch the Play Music interface with almost 1/3 of the markup needed by Google)... By the way I don't think google must release an implementation of their guidelines on every framework on the web.
Shellshock attacks per second
The first wearable camera that can fly
Is that new? Zfs has supported block deduplication for a few years but I'm unaware if it supporting byte level deduplication.
Being a simpler and easier to write/read language is also a feature, and a lot of people find value in such qualities. That's why golang is becoming more and more popular.
For knocking up a site quickly with a search button I wonder how this compares with using Google custom search? I guess with Postgres you can cover stuff that Google has not indexed?
Yes, but that's an SSL "design flaw" that's been known literally for decades. Go take a look at your browser's trusted root certificates some time.

Everyone here likely knows on a cognitive level that SSL is pretty damn broken, but being reminded of the fact still feels rather disconcerting.
Shellshock in the Wild
Interestingly, within the top 100 there is a weak positive correlation between the total karma, and the average karma per comment, implying that the people at the top of the leaderboard are actually posting quality content, and not just making up for it with quantity.

The closest power law fit is

predicted average score = 0.27 * (total score) ^ 0.25

which has a correlation of about 20% with the actual average scores.
I think this is a good idea as well. In their blog post they discuss how "Full SSL" is much better security than "Flexible SSL", but by not making it a requirement a lot of people won't bother with it.
Both the article and all the comments here, so far, assume decisions about suicide are in the mind. In fact, the decision not to commit suicide is driven by the fact we contain information that wants to propagate, and that drive is not extinguished when the odds of us causing that information to propagate decline. That's why we are still here.

Whether the drive to continue living exists in what you think of as "your" mind, whether it exists in mental processes inaccessible to introspection that have predetermined what you think are thoughts within your control, whether the physical substrate of those inaccessible mental processes predisposes them to a drive to live, and so on down the hierarchy of your physical being, what you think you "think" doesn't matter. It's what the genetic information in you wants.

One commenter here remarked on how much more tragic the suicide of a young person and that we should mind our own business about suicides of people who have lived a fuller life. Even that rationalization is a product of our physical beings. We just "think" that is a rational argument. It "feels" right-ish. Or rational-ish. Give up. Your genes have you by the balls.
This was indeed a pleasant surprise when I logged into my CloudFlare account.

What intrigues me is that CloudFlare missed an opportunity to allow secure self-signed certificates.

The new CloudFlare SSL setup allows the origin server to present to CloudFlare's servers either (i) an unverified self-signed certificates; or (ii) a certificate signed by a CA. Neither provides great security. In the former case, a MITM can trivially generate a new self-signed certificate. History has shown the latter case is also problematic, as there have been several events where CAs have generated invalid keys [1].

What would be nice is if I could generate a self-signed certificate and upload the fingerprint(s) to CloudFlare. CloudFlare would could then verify the fingerprint when connecting to my origin server, without needing to trust a CA.

Am I missing anything obvious as to why this wouldn't be as secure (or more secure) than the two options CloudFlare has introduced?

[1]: For instance: http://googleonlinesecurity.blogspot.com.au/2013/12/further-...