skysight-inc/HackerNews huggingface dataset:
They do actually give you the ability to make this totally secure. They mentioned in the post that they will provide instructions on how to install a CloudFlare certificate on your server - this will allow CloudFlare to communicate securely with your server as it attempts to cache your content.

Then when the user makes the request to CloudFlare, they return the content that they received over SSL, on an SSL connection. It's like magic.

CloudFlare just made a HGUE impact on the internet, IMO.
I once had an interview with an "architect" who was, in fact a trained architect (someone who designs buildings, he probably got into IT with the .COM bubble), who had zero training in DB theory.

We were chatting about database design, and he said the same line about normalization being about saving space in the old days.

Naturally, I declined the job offer. In fact, I made that one of my litmus tests for job hunting, along with "do your databases have referential integrity?", and "what's your opinion of primary keys?",
Mutable structs in c# are rare, rarely useful and often dangerous, but in some perf critical scenarios that hack is needed. Most notably the standard List<T>.Enumerator is a mutable struct because othrrwise an object would have to be created on the heap for the sole purpose of iterating a list.

Not sure whether this was actually one of the reasons for allowing mutable structs to begin with, the use case is critical enough that it might well have been.
If they are using Chrome they should be OK since that is still supported and is a "modern" browser, however IE under XP would show an error.
Slower growth does not necessarily imply smaller or less successful if you extend the time horizon beyond a few years. Data on this is probably hard to come by, but I'd guess also that this is especially true if you consider all the VC backed firms that simply die because they were not a raging success, and burned through all their cash.
SNI isn't the only problem either. Apparently they're using ECDSA-based certificates which aren't generally used and aren't supported by older browsers.
This'll be amazing for phishers and spear phishers - just use CloudFlare, and every user you're targeting will have the green padlock.
Just a normal SSL error, or would they be able to see another site?

I had an issue like this with SNI where a client reported being able to see another site that was on the same IP. The issue was that she was using IE on Windows XP, and SNI didn't work.
My website that is behind Cloudflare on the free plan, has suddenly started giving me an error in Google Chrome. The error is as follows:

You cannot visit mysite.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.

The website has been running for over a year with no problems behind Cloudflare, so I'm assuming this new rollout is the cause. Anybody got any idea how long this will last?

Edit: Chrome 38.0.2125.77 on OS X 10.9.4
If your target audience is in the west, it's more like 5-10%, and the problem there is going away. XP and Android 2.x are dropping off pretty quickly.
Tor will be amazing for child pornography and terrorists!

Come on, vertex-four, every single thing in the universe you do can be turned upside down. TV == violence, telephone == annoying calls, etc.

Please have a faith in humanity and give us some optimism. I'm sure SSL can be used for good as well!
Structure and Efficiency of Computer Programs by Robert Harper
Given that ssl certificates are free nowadays (e.g. https://www.startssl.com/), how was this not an issue before?
I think that is not so much because of the fact that people do not want to use search, just that by experience they've learned that it is usually next to useless on most sites. At least that is my experience.
I love this article especially when I'm thinking about the premature optimization.
Having a good full text-search with adding zero components to the platform is great.
When postgres search will be not enought, happy to add elasticsearch, sorl, and so on.
It is a word in German. Went to check if the author might be German - and he is.
http://dict.leo.org/#/search=performant&searchLoc=0&resultOr...
You can in C#. You can also do tricks like allocating large struct arrays for stuff that 100% isn't going to need to be garbage collected.
Related: I use Incognito Mode in Chrome for browsing any sites that I'm not logged into. Also, I run Ghostery. Do either of these things actually work?
CloudFlare now has the most sophisticated MITM attack in the world, where they tell you what they are doing and make you sign up for it.

Does CloudFlare have a direct pipe to the NSA already, or is that only going to happen next week?
In the evolutionary sense languages, I agree. But there's also a lot of people who strictly disagree with slang, "verbing" and other colloquialisms - instead believing language should be applied strictly (people otherwise known as "language Nazis").

My "performant" footnote was just an attempt to pre-empt such attacks; though ironically including the footnote has now sparked the tangent itself.
Reverse Engineering Wireless Pro Studio Lighting
CloudFlare doesn't act as the RA, they serve a validation file for the CA's bot to see before issuance.
Becoming a Remote Worker
How to Hack Twitter Custom Audiences
It sure reads as they genereated 2mio+ certs - that's probably why they thank GlobalSign and Comodo in the blog post.

I'm not sure how I should feel, if company x (where I am a registered but non-paying customer in their free tier) gets a cert in my name withouth asking before.
I Want to Contribute to Open-Source: Where Do I Begin?
I don't know if it's possible, but I do think it would be irresponsible, unless you have the equivalent of several years' worth of physics already. Even regular astronomers tend to be limited in what they can do by their limited knowledge of modern physics; in cosmology, the top ones tend to have a background in particle theory, not astronomy. If your only expertise is in computing, you will end up being a technician.
A: I used to have more. When you work and you have family, it’s tough. When I was younger I used to watch a lot anime and play computer games and so forth, but I have no time for these things anymore.

He taught in Australia for a little while. I was in one of his classes and I watched some Roruoni Kenshin with him. He was probably the best math lecturer I've had. But I was a poor student.
Does cloudflare have the ability to issue certificates that are trusted by major browsers?

Or will the cloudflare issued certificates simply give users an untrusted CA warning?
Growling by Comcast May Bring Tighter Leash
How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner?

Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.
Nope, that's not something anything we did would cause. We're not adding HSTS (yet).
Edit Edit: I can still access the site using the really long aws URL as my site is hosted on S3, so it really does seem the problem is with Cloudflare. (Not a network specialist, so I could be totally wrong about this)
I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network.

On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting. If this catches on big time, seeing the padlock will only tell you that you have an encrypted connection to Cloudflare's network, and no way of knowing if the traffic is still encrypted beyond that, or that it's flowing in plaintext between Cloudflare and the actual target server. Worse, you will have absolutely no way of knowing if the content you're seeing is what the target server originally sent, or that it has been manipulated (or wiretapped) by Cloudflare itself or any of the other hops while en route.

If you are going to use this, just keep in mind that you're giving Cloudflare - a US company subject to the Patriot Act and the whole shebang of 3-letter agencies - the ability to collect, intercept, store, and manipulate every single byte of traffic sent between your users and your servers.
Yes, we've partnered with multiple CAs that allow us to issue certs trusted by virtually every browser.
I think it's a bit of a stretch to say the opening credits are "always a bit different". I can think of quite a few shows display the episode directors and any guest stars after the intro (ie during the first scene of the main episode). I presume they do this to save editing time and cost changing the intro - though there's also the convenient side effect of still having the credited names appear on screen even when viewers fast-forward through the intro.
Certain things cannot be gamed, or even if they're gamed, they're still good, like your IQ score.
But it's way easier to set up than Scala (for Android), at least out of my experience. It works well and nearly out of the box in Android Studio; after all, it comes from the same company that does IntelliJ, which AS is based on. Not such a bad support in terms of tooling.

I wouldn't advocate it for production yet, I agree. I started using it for personal projects, though, and so far its lack of maturity mostly shows in documentation and harmless quirks. Not outright bugs.

It's 100% interop ensures that you can only implement bits and pieces in Kotlin, not necessarily the entire app. So you don't have to jump into it head first and commit yourself entirely.

Personally I would use it for bussines logic where the lack of LINQ / Streams / lambdas is hurting code readability. It is also very useful for plain data objects, since it removes so much of Java's verbosity.

Scala has got more things that Kotlin, there is a comparison of features: http://confluence.jetbrains.com/display/Kotlin/Comparison+to...

But I'm already happy with the advantages Kotlin has over old Java, Android's Java. It's fancy enough.
Strange, I went to bed last night and everything was working and it was just a plain HTTP site sitting behind Cloudflare. Then I get up this morning and I'm getting SSL errors, I'm not sure where to go from here then.
I only wish "western" releases were already packed with subtitles. Especially now that opensubtitles tries to sell ad space directly in the subtitles.
Yes, we partnered with multiple CAs that are trusted by virtually every browser.
It's complicated, and I'm not Taiwanese, but briefly -- Taiwanese politics is split into two camps, "pan-blue" (pro-Chinese) and "pan-green" (pro-independence). Taiwan's economy relies very heavily on good relations with China, so the pan-blues do the best they can to butter up China, while the pan-greens try to swim in the opposite direction as fast as they can without incurring an outright invasion. 3 of Taiwan's 4 biggest newspapers are controlled by the pan-blues, so they self-censor (to varying degrees) things that reflect negatively on China, like teargassing peaceful protesters in HK.
At the least, those of us who actually care, but don't have infinite amounts of time to admin a LAMP stack, email server, XMPP server, and whatever else, will eventually be able to run Sandstorm[0] on a home server and be done with it. (I'm working on an appliance distro which will set this up more-or-less automatically.)

[0] https://sandstorm.io/
A cert in your domain name. Something they could always do. As can anyone you've given control of your domain to. Domain validation is how most certificates are issued.
is this supposed to be some kind of incentive?
Trivia: It used to be one of the main links at the top of the page about 2+ years ago.

I set a goal several years back of getting into the top 100, then top 50, and so on, and was commenting and posting loads. I guess they didn't like that too much and it disappeared onto the Lists page ;-) I don't post as much now but that's probably a good thing for me.
Advertising Week 2014: Exploring the Future of Television
> people are still using MySQL search sometimes which is IMHO an horrible search solution

Some probably use "text LIKE '%foo%'" SQL queries on any database.

MySQL supports several database engines, especially ISAM and InnoDB come with full text search support. You can also install Sphinx Search as MySQL DB engine. So your statement is not true in general. If you meant the old ISAM engine the newer InnoDB is default and usually the preferred solution.
I wish the title of this post on Hacker News could be the context-providing "Uber allegedly revealed well-known rider's location without consent for promotional purposes".
When you get the chance, check out [Bonjournal](https://bonjourn.al)!

[Bonjournal](https://bonjourn.al) is the simple way to record and share your travel adventures. The app helps you easily collect all the beautiful moments, stories and pictures from your journey into a single narrative.

- Create beautiful travel journals, even without internet connection.
- Share your travel journals via Facebook, Twitter and email.
- Export your journals to PDFs, to enjoy them forever.
- Follow your friends along their journeys.
- Explore the experiences of fellow travel enthusiasts.

[Bonjournal](https://bonjourn.al)
I think you missed the point. He's saying we won't the goals of AI because: "it’s a moving target"

For example: "In the seventies, someone might ask “what are the goals of AI?” And you might say, “Oh, we want a computer who can beat a chess master, or who can understand actual language speech, or who can search a whole database very quickly.” We do all that now, like face recognition. All these things that we thought were AI, we can do them."

This is very true.
The Single Best Thing You Can Do for Yourself and Your Company
Isn't provisioning certs without at least a simple human interaction from the domain holder against CA rules?
Could we please not have naked developers running around the office BEFORE 10pm?
Yes and you do things in Java like create an MyIntCollection to get around the shortcomings of generics wrt. primitives, but the point is that it is just that: workarounds.

What I really want is for perf to be good while the code is still clean/readable/expressive/idiomatic. In Java/C# you must usually write idiomatic+slow and then refactor into fast kludges.
Domain validation has been available from multiple CAs by placing a root-level file on your webserver for years. If your domain points to a server controlled by a third party, they have always been able to pass domain validation.
They could have done that by MITM the validation email you mean?

EDIT: Ah, there are more options than email validation - my CA didn't offer those. Learned something, thanks.
Yes, DivX.

The original hacked codec appeared in 1998. It got boost in popularity when the movie The Matrix came out (1999).

This happened in Windows 98 timeframe. Windows 2000 was in early beta, not yet on sale and XP was unheard of yet. The current linux were Redhat 5, 5.1 and 6; BeOS 4 and 4.5.
What sort of time period are the certificates issued for?
Building a product without a designer? You’re doing it wrong…
Just tested using the WinXP+IE6 virtual machine from https://www.modern.ie/en-gb/virtualization-tools

Tested against: https://www.buro9.com/ , which is my own domain running behind CloudFlare using their SSL cert (it's a Pro account - my free accounts have not yet been enabled with the free SSL).

IE6 on WinXP accesses this without warning providing CloudFlare Apps are disabled.

If CloudFlare Apps are enabled, then IE6 gives a mixed-content warning but is fine with the SSL cert.

Caveat: This WinXP+IE6 version might not be precisely the same as whatever is in the wild and has never been updated. For reference WinXP is Service Pack 3, and IE6 is 6.0.2900.5512
Since videos from the iTunes Store are encrypted, it seems like the individual files should look like random noise to the filesystem anyway. Unless there is something I don't understand happening.
What they should do is require that the server has at least a self-signed certificate. They already support that but don't require it.
Londoners give up eldest children in public Wi-Fi security horror show
No. Email is not the only supported method of domain validation.

See, for example, Comodo's documentation: https://support.comodo.com/index.php?/Default/Knowledgebase/...
nice idea - but I could not access the TOC of the book yesterday (some problem with packtpub). Is there a book website? Or any other pointers to projects that can be realized?
@Communitivity, you said "With everyone having access to information what will matter will be your curation of that information, and your commentary". The problem with this view is the curation of the curators that is occuring in our reputation based economy. When popularity is the main arbiter of quality the cult of unfair celebrity runs wild, just like in the non-internet world. You need to assign fairness to content, otherwise its like what rustyconover has said, its just another system of social inequality that benefits only a small minority.
There's basically no way to make this work because, as has been mentioned, in compressed formats there's every chance that title sequences will occur at different times in the show, so will occur at different points in the group-of-pictures sequences in compressed media.

And especially for rips from an already-compressed signal source (like TV), the odds are well against a sequence, although identical visually, encoding into exactly the same sequence of bits digitally, as there are so many factors that can vary the datastream you receive, even before it's ripped and re-encoded.

To stand any chance of this working, you'd really need to be storing and comparing uncompressed frames direct from the master, before ANY kind of variable encoding or compression. But if you have enough storage to be working with files on that scale, deduplication is probably not your biggest concern. :)
It can be used for good - I never said it couldn't. I have no doubt that this will be used for much good. It's simply that it'll also be used for a fairly significant amount of bad, and it's worth pointing that out so that we can know that we might have to retrain users that "green padlock" does not necessarily equal "safe" (not that it ever did, but it was often a close enough approximation).
Does cloudflare require A records or NS records to point to them before issuing the cert? I guess maybe that could work. I'm still a little skeptical about the whole no-interaction-required part.

Is there no way this is open to abuse? Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? Maybe it's no different than regular automatic domain validation though.

Hopefully the backend that requests and retrieves new SSL certificates from the CA cannot be compromised.
Qubit Bags $26M to Grow Its Ecommerce Personalization Platform
You can improve your IQ score by taking lots of IQ tests (your "IQ" will slowly improve), and I don't consider IQ to be a good thing by itself.
It's not necessarily a business book. His thesis is the one he articulates on his speeches: that we need a more deterministic, less statistically-oriented world. I found it to be very concise and interesting reading.
I have helped a little bit with checking their compliance to the standards.

I modified the compiler that is in stepcode many years ago to generate ASN.1 definitions for the STEP models, the idea was to define some RPC operations to allow the kind of thing that ChuckMcM describes but I couldn't find anybody interested in it at the time. It would have been easy enough to write another compiler back end to generate XDR.

I guess I would prefer to be paid to work on STEP, there is a fair bit of politics involved in it and I'm already involved with several opensource projects that are more fun.

Also, if I'm looking for an opensource project to contribute to then I wouldn't pick one that used C++ and git, sorry.

I have got some diffs to Express Engine [1] that I need to send in though.

[1] http://sourceforge.net/projects/exp-engine/
Yeah, but that code still sits in memory, occupies space and takes non-zero time to load. It also takes free memory from the fragments of code that are on the critical path. Sometimes it doesn't matter (most desktop apps), sometimes it does (embedded software or system-level programming). Also, RAM usage of quite a lot of kinds of software is determined mostly by code size, not data size (e.g. word processors, spreadsheets, CAD software, IDEs, compilers) and startup-time is also determined typically by loading and dynamic linking time.
I agree, but a big part of Cloudflare's business is to manipulate the content between the origin server and the client. There is an element of trust when using Cloudflare.
There's a balance between the value that comes from having experienced it yourself and the value from being able to step back and generalise the experience of other people.

First-hand accounts always run the risk of generalising the particular but academic accounts run the risk of being too general. In both cases the problem comes from falling in love with your own model and not paying enough attention to inconvenient data.
> this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting

It does nothing of the kind, it has always been the case that seeing the SSL padlock only informed you that the connection to whichever server you are communicating with is encrypted and nothing more.

Do you not recall the age of customer feedback pages hosted behind SSL that actually just sent plain text emails over the internet to the customer service email? SSL was never a guarantee that end-to-end communication was encrypted, and usually it was barely that.

What CF have done is to say that the jump to their servers can now be secured by SSL and that this works even for those who would not configure SSL (for either cost or complexity reasons). It's nothing more than that, it remains the case with SSL that you are trusting the site to support end-to-end encryption for sensitive data.

But what it does allow CF to do is partner with companies like Linode, Digital Ocean and so on, so that in effect when a user connects to CF via an SSL connection the entirety of the communication could occur within the trusted CF+Partner network and none of the traffic would be plain text over the internet. It's a foundation to build upon.
> They did not say it means less, they said that it was more understandable

"teenage suicide is especially tragic"?
I was trying to give you quick summaried, multiple points of targeted advertising in my reply. Others who replied have taken the fishing example and pointed out how detailed targeting could go for that specific case.

And the particular case that you are now picking on could be argued as a corner case that captures both segmentation and individualisation at same time.

Anyway, the point has been made about why individualisation could be a tricky curve by me and the others. Choose whichever example(s) gives you the best rationale.
Camus quote has nothing to do with 'rationalizing suicide'. It's in fact about how to rationalize the opposite.
> Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks?

You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.
Java Calculator with JSP and Java Servlets
Okay, really seems like it is something to do with Cloudflare. When I pause Cloudflare the site loads really quickly every single time, then when I resume using Cloudflare I get the same error in Chrome. In Firefox I'm told by an Cloudflare error page my web server is down, when it's demonstrably not.

This is really not my area of expertise, but does it seem to anybody else like this is something to do with the Cloudflare SSL rollout?