skysight-inc/HackerNews huggingface dataset:
> Do current browsers entirely prevent a connection to untrusted certs when HSTS is set?
Yes. HSTS would not do much to prevent active MiTM. HSTS just tells the browser that it should only connect to the site over HTTPS. It does not mention which certificates are trusted.

It seems like you are hinting towards certificate pinning (https://en.wikipedia.org/wiki/Transport_Layer_Security#Certi...). Pinning would prevent rouge CA's from signing bad certificates, but pinning is hard to do on the web. It is mainly used with mobile applications from what I have seen.

Edit: Here is a list of pinned sites in Chrome, if you are curious. (https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...)
Algorithms are not puzzles, they are solutions to puzzles.
Scary to see so many journalists piling onto other journalists who are actually doing their jobs in the public interest (but against corporate interests). Reminds me of the "journalists" who were so fast to criticize Glenn Greenwald for his NSA reporting.
Only puzzles I enjoy are researching a bug and reading through code to find the bug and propose a fix. I enjoy this more than writing new code, even if the codebase is completely foreign to me.
India is a nanny state trying to save its gullible illiterate masses from cyber influences deemed bad in culture. It is not the cyber surveillance capabilities that is the problem (which is coarse anyway), but the condescending attitude of bureaucracy who can send people to jail without bail for a Facebook like or a retweet.
The author should probably at least take a stab at defining his usage of "puzzle." There's a big difference between a jigsaw puzzle and, say, the Portal games. In fact, jigsaw puzzles are a very different endeavor than logic/programming puzzles and many puzzle video games.
I think you're focusing on the wrong things.

VCs (largely) want solid personal relationships with their companies and that's something that's not happening over skype/hangout anytime soon. A few thousand dollars on flights also isn't a big deal when you're investing millions; time is much more important than money.

Your best bet would probably be to:

(1) Get solid local VCs who other (non-local) VCs are happy to co-invest with.

(2) Build thematic clusters, because a partner at a VC who's interested in multiple companies in an area is much more likely to fly out then for an individual company.
So the Guardian was unethical because it exposed Whisper's unethical ways?
Show HN: Real-time remote presence tool built in 48 hours
Unveiling the Microsoft Cloud Platform System
It wasn't until after having a kid and getting very conflicting advice from different doctors for the same issues that I realized doctors are mostly making educated guesses on treatment.

Fortunately, there's a significant placebo effect for nearly any treatment from a doctor, so even when doctors make guesses it often ends up helping.
If you share the same FIDO U2F key between services, does that mean that one service could spoof tokens for a different service?

e.g. foo gets compromised, so attackers can generate codes for google apps.
> but many/most dotfiles reside at the top-level of your home directory, where it wouldn't be a good idea to initialize a VCS repository.

Right. Which is why I use git with a workspace detached from the git directory. The git directory is in ~/dotfiles/.git, with "git config core.worktree ~", and I set an alias "dgit=git --git-dir ~/dotfiles/.git". The advantage of this method is that there are no symlinks to maintain, however initial clone is a bit painful, since you have to move the files and set the config.

It's not perfectly straightforward, but it's as close to it as I could get it.
Math teacher:

* Step 1: Disguise unsolved problem as homework assignment and give it Terry's son to solve.

* Step 2: Muhahahaha
I definitely agree with this sentiment. Recently someone dropped by for a job interview and revealed how much he loved to solve puzzles. Not that this influenced my decision in any way, but it made me reflect how different I felt w.r.t. this.

For me, it is not design either, it is something different.

I hate puzzles that are created by other people, where you have to follow the "hidden variable" which is in that case the brain of the maker of the puzzle. They already know the solution! I feel utterly useless solving a puzzle that has been already solved thousands of times by others. What's the point!? After 3 sudoku games I'm done with them. The same with IQ tests on national television. Why would I feel any reward in being able to crawl into the brain of a television writer concocting questions for a general audience? I think there are many much more interesting people in the world, than these guys. Their "puzzles" suck.

I also have never enjoyed solving mathematical problems in text books. I love math, and I read a lot of text books, although university is years ago. I think for people like me there should be different ways to teach them.

What makes me going is to find new things that haven't been known before. After I get some understanding of a field, I love to make up my own problems and solve these. The boundaries of such a problem are vague, it is not even known if it can be solved, but I am happy. Even if it turns out that I solve something that has been solved in the 13th century, I can't care less.

This is just a personal story, but perhaps someone can relate.
I have none of these objections to systemd. My objection is that it's both pervasive and unauditable. I can accept one or the other.

I don't have to rely on 'many eyes' to tell me what's going on with init scripts, I can just look. systemd is sprawling, has no particular philosophy that I can notice, and all of its internal systems are heavily interconnected; this leads me to expect that very few people will be auditing the code that don't work for redhat, because very few will understand it. I expect it to increase the vulnerability of the entire system to accidental or intentionally inserted bugs by an order of magnitude. Therefore, I'd like to see it in the wild for 5 or so years before personally using it - but it looks as if to continue using many linux applications I have to switch to it while it is being written.

I don't get the point (other than cgroups and boot times), I don't get the hurry, and I don't get the animosity to alternate and legacy init systems, and to alternate Unices.
Testing NLP content screening and summarization platform (pre-release)
I guess I just haven't seen one of these (such specific or probably any Physical Requirements for a job) before and imaging all of it together, there was this comic vision, in my mind, of what will that person actually do on such a job. :)

I definitely didn't want to offend anyone and I hope I didn't.
Apple Releases iOS 8.1 and Free Download iOS 8.1 jailbreak
And for those that still aren't familiar with TLS yet, think of it as simply SSL but newer and better. So, even though SMTP starts unencrypted the STARTTLS command initiates an encrypted session.

Most mail servers these days use TLS. So, there is a good chance that the email you send with your confidential pricing lists is being sent encrypted over the network. Unfortunately, there really isn't a good way to tell if that happened (at best you can view the mail headers which some servers add headers that show a TLS session was used between mail servers).
Why two? As many as people would write. There is already a bunch of em.
I'd be willing to pay money for this, seriously. I've followed you on Twitter - let me know if anything happens.

We were using and enjoying app.io[0] until they decided to pivot and stop serving us.

[0] they didn't support pinch gestures, which made using a map impossible
Scoring sales leads programmatically
there are other countries apart from the uk and spain in europe
I've been seeing a few of these libs pop up on HN lately. Apparently there's some sort of need here that people are trying to fill, it's just not clear to me what it is.

There are legitamite suggestions that blocking UI paradigms are bad, but they're very useful at times. I'm not arguing either, as I think each has their place (although I tend to avoid blocking personally if I can)

My real question is why now?
The Yes side on this comes across as trying to elevate important but minor elaborations into major disagreements, seemingly just to raise the status of their work.
We use Microsoft's MVC stack at work, it is wonderful, particularly combined with Entity Framework.

Off the top of my head the biggest issue with using Microsoft's MVC is not within the framework itself, it is within the wider Microsoft ecosystem.

If you use MVC you now need Microsoft Servers (which cost more), maybe CALs, and you'll eventually need to pay for MSDN (for the latest Visual Studio and tooling, TS Online is wonderful however).

For us it made sense since we're in education so Microsoft gives us tons of stuff for either free or at a massive discount.

If I myself started a small business (with a limited budget) I'd likely look at something which offered a similar experience but without the dependencies (namely Ruby on Rails).

But I'd rate the MVC 5/Entity Framework 6/MS SQL setup alone very favorably. It definitely helps your productivity hugely and if done within the MVC-style will help maintainability somewhat (although you can write anything badly).

It is just the dependencies. That's really the only major downside.

PS - Speed wise it is pretty similar to compiled Java. Faster than [most] PHP (compiled or not).

PPS - If you go this route check out Stack Overflow's wonderful Miniprofiler. Great tool for SQL development (it work with anything Entity Framework can connect to including non-MS SQL servers like Oracle SQL).
Needs landscape! Overall very awesome service.
>>Expressing Nazi ideas is prohibited in Germany because of what following Nazi ideas can lead to, not just to avoid conflict.

Yes. Expressing Nazi ideas can lead to violence, extremism, racial and religious discrimination, anti-democratic activity among other things. That's pretty much what the OP said, and is also the original motivation behind India's censorship laws. I am of the opinion that the case for censorship is more justified in India than in Germany. As the Gujarat 2002 riots and Assam 2012 riots (where Indian govt. temporarily throttled sms traffic to prevent spread of rumours) have pretty much proven - tactless media coverage or the spreading of rumours during tense situations could result in the deaths of thousands.

Of course whether those laws are being abused (in ways including the one you described) is a whole nother question.
Since we are making progress to use secure mail transports, why are we not seeing more use of S/MIME to secure the contents of the message? I set up signing/encrypting on my mail clients, but have yet to see anyone, or any company, use it.
I really despise opening Google Maps nowadays on my phone. There have been so many updates that cripple it and make it worse. Really hope someone comes along and puts a good replacement out. Recently it won't even show results on the map easily.

My search results come up as cards with a tiny sliver of map, then I click on the map and they all disappear, sometimes if I scroll around desperately some will load eventually. But all I wanted in the first place was a full screen map with some icons, not one by one cards to click, also with tiny slivers in them.

Not even an isolated incident. I takes half a dozen clicks when getting directions now as well and several other tasks. I don't think the Google graphics designers are being forced to perform usability studies like they should be. If they were, they would realize some level of 3D actually helps users determine what is clickable or not.
Really? I haven't read the book, but I did look up a book review. Please tell me if the review is inaccurate, because... wow. I thought Freud was a little off his rocker.

Dr. Sarno's theory can be stated simply: Most muscular/ skeletel pain is usually the result of early infantile and childhood trauma which has been repressed. The emotion involved is invariably that of profound anger and rage.

So repressed childhood trauma causes RSI. I'm not saying that body pains can't be psychosomatic, but that's a heck of a conclusion there. It sounds like some serious placebo effect. I'd love to see it tested against a similar but different explanation (a belief in your brainwaves being blocked by the lizardmen who run the government, for example).

http://primal-page.com/sarno.htm
it get get around this: http://www.skatestoppers.com/Images-Photopage/install09.jpg :p
I've gone to FreeBSD for now on my personal dev box, I'm a real sucker for a dead simple /etc/rc.conf like Arch used to have and their system philosophy seems more in line with my own anyways.

Very glad to hear we have a major binary distro like Debian committing to init system flexibility this strongly. I just hope it's true. The people who are hesitant can experiment and stay where they are for now, moving only when it's actually desired rather than forced.
It will be very interesting to see how this all plays out in the long run, though the short term is utterly depressing. My hunch is Lennart will be vindicated, on the basis that systemd as it exists right now is not right, but it can be evolved into something much better, and while that may not have occurred to other projects here the stakes are enormous. There is a definite strand to the resistance that any change to something so fundamental must be resisted.

The bigger side argument about the Unix philosophy is also intriguing. Rob Pike claimed it was dead and Perl delivered the eulogy, which I can half agree with. The problem is shell scripting is archaic nonsense, but our script languages can't do what you can do in shell scripts well enough. The idea of a Unix where you get rid of bash/csh/whatever and just run a lua/python/ruby prompt and have your apps implemented largely in that same language (with shell commands being replaced by functions) may make some people squirm, but would make a lot of sense for reducing the overall learning curve.
This is a feature not a bug-- let me explain:

Recruiting is not necessarily easy. But you can judge a company by how they recruit people. Their hiring process-- given that talent is so critical-- tells you a great deal about the company.

If they do a terrible job, if they are arbitrary or capricious, or if they have discrimination as a policy (e.g.: I was in the room at Startup School when Zuckerberg said "don't hire anyone over 30, they just don't get it" (paraphrased).... then you know it's not a good place to waste your time interviewing.

I'd argue that the company with the puzzle saved you a lot of hassle-- you know they are arbitrary and did not put the effort into producing a competent hiring process, and this likely tells you that they won't respect you once you're on board as an employee either.

There are a great many of these "smells".

As I've gotten more experienced, and more in a position to be picky, here's my current gauntlet:

-- If they locate themselves in a place that guarantees a 2 hour commute for most employees, but don't allow working from home 3 days a week, or remote employees, that's a bad sign. Why pay for downtown office space-- as a startup, no less! -- when there's a lot of cheap offices out in the periphery where most people live? (That's the case in this town, maybe not in others.)

-- Asking for references. First off this is a legal minefield. A reference that isn't glowing is going to open themselves up to liability. Any well run business is only going to say you worked there for some period of time. And who is going to give people they think will give a bad reference? This one shows naivety.

-- Having a preference for ivy league. Google impeaches itself with this one in my mind.
It loves long form writing too... It's designed for article to book length summarization.
Actually I think graph theory is pretty important. For example many programming contexts have to deal with dependencies, and often dependencies form a directed acyclic graph. Understanding that will aid in writing better, more reliable code. Path finding is also pretty important, especially if you want to make a game.
This isn't the only industry this happens.

In restaurants you have line cooks, prep cooks, and then occasionally if you are a "fancy" enough of a place you have a sous chef and an executive chef.

The one common thread here is, they are all cooks.

Now most line cooks will have never have actually "created" a dish, just like most of us have never "created" an algorithm, (having the vision for something new, knowing which ingredients sourced from what region will work the best, knowing how the various intricacies of spices, how they interact with each other, what temperature is optimal for meats, ect), but I am sure they know how to put something new together.
Nope, you can use it lots of other messaging, like marketing, newsletters, and notifications.
Lots of people on HN develop web apps but aren't great designers, and nifty little libraries like this make our work look better than our own design skill would normally allow. I think it's that simple -- they're not being upvoted for any deep reason relating to UX best practices.
Human cloning + surrogacy + suspended animation ( theraputic hypothermia ) + nerve regeneration + microsurgery = immortality. Theoretically this now seems possible.
At least one of each side of the debate. Preferable there should be two, one on each side which implements the good/novel ideas and others where aggressive experimentation takes part.
Just to summarize, I entered because the concern was about cleartext passwords being sent via SMS. This is almost never the case, typically it's a token.

As a mitigation tactic for full MTM, 2FA is basically without teeth. Same applies for the new item Google is trumpeting.

I'm not saying someone couldn't do a MTM with both SMS and full network, I'm saying it's overkill and redundant. There's no advantage. If you're already funneling the data, you have what you want.
Yubico doesn't allow firmware updates. They do, however, support the GlobalPlatform standard for uploading new JavaCard applets, and, if the NFC bindings were designed such that a JavaCard applet could implement it, then a U2F applet could be uploaded to an existing YKNeo.
That's exactly how vcsh works too.
Google Acquires Firebase to Help Developers Build Better Real-Time Apps
Firebase is Joining Google
Microsoft will replace its Nokia brand with ‘Microsoft Lumia’
Agreed. I can write a regex the (very) few times I need one, but it generally entails me looking up a cheat sheet to get the appropriate character classes. If you were to put me in front of a whiteboard I would flub the most simple of tasks (from the original post, "{(.*)}", I think? Did we mean to include whitespace, and does . translate properly? Because that's partly language dependent when it comes to white space, newlines, etc, and how the regex parser works. Did we mean to capture empty cases? Did we intend for it to be greedy?).

Does that mean I can't program? Ha ha ha, no. Does that mean I can't manipulate strings like a boss? Ha ha ha, no. I first reach for the language's tools, before I reach for regular expressions (the OP, I would first reach for doing a string search for {, and then one for }, from the rear if you want it greedy, and substringing what is in the middle; it's far less ambiguous, and any dev will know exactly what it does). Even when something ~technically~ takes a regex, if what I'm looking for is just a literal (as it often is; does this string contain X or not?), I don't need to 'know' regexes. So there's a LOT I can do without knowing regular expressions.

Meanwhile, I -have- needed to be able to recognize that something was running in O(n^2) time, and what I could do to optimize it to O(n). I -have- needed to implement my own search and bucket sort routines.

EDIT: Oh, wait, no, for the regex I'd need to escape the brackets, too. Etc. See? Now I have two problems.
I'm not talking strictly about a PhD, but about PhD level work, some of which can't really be done on your own unless you're a supremely talented individual.

You can look at some of the modern ML algorithms and see what I mean; many people that I know have worked with Latent Dirichlet Allocation, but they have no idea how the model works, and there's no way they could extend to work online or under certain performance or storage constraints without havin spent months and years working on that problem.

That's not a realistic expectation for anyone in the field. Yes, the algorithms you find in Weka and other ML toolkits are useful, but the actual "Big Data" problems have their own performance and algorithmic constraints that are far, far beyond dedicated self-learners.
I had Lyme disease (tested positive, treated.) I've felt "like shit" for probably at least the last year.
You are certainly correct in identifying one of the challenges to implementing this kind of model. But the reality is, that students in most classes are at different stages of understanding. We're just used to a model where everyone is expected to be at the same place all the time, and tend to bore the students who are "ahead" and frustrate the students who are "behind". There are other models, which address this issue of pacing and differentiation effectively.

Sorry to not give a more complete answer at the moment.
This is very similar to the behaviour that Keynes described in the equity markets: http://en.wikipedia.org/wiki/Keynesian_beauty_contest
Google acquires Firebase
Looking Beyond the Blog Entry
There's market here for training corporate users over the internet to use line of business iPad apps.

I'd pay for it, if it actually made training easier...
Flying an unmanned aircraft (Canada)
Hungary to introduce Internet tax
Show HN: Kopy.io – paste solution (encryption, clean, syntax highlighting)
Dumping Oracle for Cassandra
I think the point is that you can't have two competing init systems: the market will eventually need to standardize on one of them or risk forking the entire Linux ecosystem. What you call "modern sysv" would look a lot like systemd depending on your definition of modern. I think that definition of what modern should look like is what's being debated here.

The big features sysvinit are missing require user space applications to be able to interact with [generic launch system]. Those applications must use some sort of standard taxonomy and flow control. As applications are ported to [generic launch system], they cease working on sysvinit systems because sysv either doesn't support those features or supports them in a different manner.

Sysvinit doesn't really do all that much, to be honest. So it's really easy for [generic init system] to emulate most of its functionality. [generic init system] does a lot more, so it's harder to copy. Even more, if you were to "clone" [generic init system], applications make big assumptions as to how [generic init system] functions, so your [generic init system] replacement would need to function nearly identically to [generic init system].

Basically, someone made a call and said "this is how a modern init system should function". There is a vocal group of people who disagree with that definition. But no matter what the definition is, people would disagree because different people have different ideas about what Linux is/should be. You would see the same problem if a sysvinit derivative was the leading candidate instead of systemd.