skysight-inc/HackerNews huggingface dataset:
It's not PC it's called the free market? If I don't like Uber I have the choice not to use them.

Anyway, watch this :-D

https://www.youtube.com/watch?v=bmsV1TuESrc
A more interesting and relevant thing to study would be how modern Switzerland managed to avoid war in the bloodiest century the world had ever seen.

It's like the miracle no one wants to notice.
https://github.com/syncthing/syncthing
Wow. Flipping through this PDF brings back the excitement I used to have reading the Linux mags from the late 90s/early 00s. Maybe I'll take my tablet down to the last Barnes and Nobel and read it there for the full effect.
You can already get free certificates from startssl today: https://www.startssl.com/?app=1
Build your creative freedom while making good money
This is a neat and natural idea. I'm actually sort of surprised I haven't seen something like this before. It's one of those things that you think "oh I could have thought of that," but then nobody does until now :)
Hey, Luke from ClusterHQ here. We're excited about being able to deploy applications described in fig files across multiple hosts, and even across multiple clouds, critically - including portable data volumes, and then being able to move them around as operational requirements demand.

If you've got any questions about it, please let me know in the comments here.
I doubt that, considering it's lacking the Apple home key.

Anyway, apart from specs, to me it really looks more like a bigger iPhone 6(+) than an iPad mini. I'm not saying it's not influenced by Apple's design, but TBH there's only so many ways you can build a unibody-device from aluminium if you wish not to introduce angles (which annoy me when trying to hold a Surface device, for example).
You don't need a CA system to solve that problem, though. Take, for example, Convergence[0] which uses a notary system in place of the CA system.

[0] http://convergence.io
[iOS Tutorial] How to build a custom (and “designable”) control in Swift
Google Chrome 39 Released
from the ACME spec, it looks like proof of ownership is provided via[0]:

>Put a CA-provided challenge at a specific place on the web server

or

> Put a CA-provided challenge at a DNS location corresponding to the target domain.

Since the server will presumably be plaintext at that point and DNS is UDP, couldn't an attacker like NSA just mitm the proof-of-site-ownership functionality of lets-encrypt to capture ownership at TOFU and then silently re-use it, e.g. via Akamai's infrastructure?

[0] https://github.com/letsencrypt/acme-spec/blob/master/draft-b...
Looking at the spec [0] I'm concerned about the section on 'Recovery Tokens'.

"A recovery token is a fallback authentication mechanism. In the event that a client loses all other state, including authorized key pairs and key pairs bound to certificates, the client can use the recovery token to prove that it was previously authorized for the identifier in question.

This mechanism is necessary because once an ACME server has issued an Authorization Key for a given identifier, that identifier enters a higher-security state, at least with respect the ACME server. That state exists to protect against attacks such as DNS hijacking and router compromise which tend to inherently defeat all forms of Domain Validation. So once a domain has begun using ACME, new DV-only authorization will not be performed without proof of continuity via possession of an Authorized Private Key or potentially a Subject Private Key for that domain."

Does that mean, if for instance, someone used an ACME server to issue a certificate for that domain in the past, but then the domain registration expired, and someone else legitimately bought the domain later, they would be unable to use that ACME server for issuing an SSL certificate?

[0] https://github.com/letsencrypt/acme-spec/blob/master/draft-b...
Static types.

Python is strongly typed, although possibly not as much as we might hope. This fails:

"cat" + 1

with a type error, but it happens at runtime. (Oddly enough, Scala permits it.) Python's type system isn't very expressive-- for example, you have "list" and "dict" types but not "list of int"-- and since you can branch without type congruence (because Python's "if" is a statement, not an expression) you can lose static knowledge pretty quickly, but Python does block type errors. It just does so at runtime, which means that the problem may be hard to reproduce and the error/failure distance can be high.

I agree with most of what's said in the OP. I just want to push back against the use of "strong" and "static" typing as if they were interchangeable. I'm in the same boat-- generally an advocate for compile-time static typing-- but to conflate static/dynamic with strong/weak is to misrepresent the issue, and unfair to the dynamically-typed languages. All of the modern dynlangs (e.g. Python, Ruby, Clojure) enforce type safety. They just do it at runtime, whereas Haskell, Scala and Ocaml do it at compile time.
...and once this is rolled out, they'll add auto-deleting messages, et voila! Snapchat destroyed over night!
How to protect your best “assets” from wifi radiation
Go follows the C tradition of returning errors instead of using exceptions. 'err' is a variable of type "error"[1], which should either be nil or have an error value.

[1] http://golang.org/pkg/builtin/#error
Is there no Ubuntu 14.10 nix package?
3. By using meaningful values and separating side-effecting functions from pure ones, we can more easily reason about our program

I'm not sure how that's something that static typing provides, just seems like good functional programming/referential transparency.
Very good book and the one that got me started on Heinlein. I probably own most of his hard sci-fi books now as a result.
How would you see a baseband attack in the wild without access to the baseband? It is a circular problem. The main issue is "we just don't know," the baseband is unverifiable from a security standpoint.
You are asking a factual question. One place to look for citations of facts on the issue is in the extensive footnotes of the book The Hindus: An Alternative History[1] by Sanskrit scholar Wendy Doniger. The book points out that the Harappan inscriptions depict several animals that are mentioned nowhere in the Vedas, while the Vedas in turn mention (in writing) several animals that appear nowhere in the Harappan inscriptions. In other words, the Vedas were composed in a region of Asia with different animals, because of different climate, from the region where the Indus Valley civilization arose. The Vedas also describe many aspects of an ancient lifestyle that was certainly not centered around cities in a river valley like the valley of the Indus. There are multiple lines of evidence to show that the Vedic culture and the Harappan culture were distinct and arose in different parts of south Asia.

The historiography of India is a very complicated issue, in large part because of lack of written records in key phases of the development of civilization and religion in India, and also because historical claims about India are tightly bound up in political claims about current Indian politics. A Google search on "Indian historiography" (a search I just did) will disclose some of the competing claims.

[1] http://www.amazon.com/Hindus-Alternative-History-Wendy-Donig...
>I think there's a strong case to be made that Uber's toxic culture comes from the top.

Culture always comes from the top, toxic or otherwise, imho.
Why do you say it is a poor replica out of curiosity?
High-end smartphone ownership for sure. But you can buy a craptacular Android phone that runs whatever Android 4.0 is and runs OK, just slow, for under $100. My understanding was that the smaller CPU and memory load of Android 5.0 Lollipop was partly a response to this trend. And of course you can get some sort of netbook for $200, $250. If you have the savvy to buy used (perhaps with the help of a friend) then your options get wider again.
The fact that exciting scientific discoveries like this are being presented on WSJ behind a paywall is absurd. Science on the internet is going to be dramatically different in 10 years than it is right now...
CORS – what the hell is it and why should I care?
Certainly you cannot. However, even the connector receptacle resembles Lightning ports.

There's a perfectly reasonable reason for that, though. The design seems to have avoided most (or any) angles, which makes the receptacle rounded, too.
It's an interesting idea, I'm just not clear on how it works (even when looking at the "How it works" section) - e.g., how do I integrate this with... say, nginx?
> Offputting is the strong focus on libre in the announcement. While I actually like that I often find that projects that emphasize their relation to free/libre software are .. failing in the real world.

It's a GNU project. GNU is run by the FSF. The stated goal of the FSF is the eventual elimination of all proprietary software. None of this should come as a surprise.
So it's about damn time to free them. Then the next country, until we're done.
Thanks a lot for the explanations!
> Google created their own browser in order to embed Google search as your default search engine and homepage. Not because of an altruistic quest to make the web faster.

That's overly simplistic (even the idea that that's the only reason they pay for search placement on Firefox, though that's the direct exchange, is overly simplistic.) For funding Firefox and sponsoring Chrome, their goals included:

(1) avoiding a desktop browser monopoly by MS that could be leveraged to favor the favor certain online properties or extract rents from them (e.g., to prevent Google's core business from being "taxed" by MS), and

(2) (for Chrome more than Firefox) Drive the shape of browsers (both directly by implementing these features in a browser that would gain substantial use, and indirectly by creating pressure on other browser vendors to do the same) toward capabilities to more fully replace desktop/native apps, and thereby commoditize native platforms so that Google's core competence in the web space would have more reach. Making the web faster was part of this, though altruism isn't necessary to explain it.
Facebook Launches Standalone Groups App
So once again, the user is not the customer but the product. When will these scams stop...
10 Hard Lessons I Learned from Starting Precog
They do. You just don't have their root installed so it gives an error. You can install their root here http://www.cacert.org/index.php?id=3
> And CA are not "authorities" at all. They could lie to you, they could be compromised.

Actually just read their terms of service, which may as well be summarised as "we issue certificates for entertainment purposes only".
Tried it in another browser, doesn't work either.
Didn't the parent post already explain? The journalist writes details about people personal lives for a tech gossip site. The Uber person is non seriously (even accordion to the article) musing over what would happen if the company was to do the same thing back. No conspiracy theory needed.
so the return type of this little program is "error" and nil if no error?
Perhaps this is not a case of a barrel full of rotten apples, but a barrel full of durians.
Right but Google also pays for Chrome development. It isn't free either way.
Safari Books Online – iOS App
If you can corrupt both the authority signing the certificate and the authority signing the Certificate Transparency append-only log, you can successfully MITM a connection.

However, if the client is ever subsequently on a non-MITMed connection, it can detect the certificate disappearing from the append-only log - and the signed certificate and signed append-only log constitute irrefutable evidence that the two authorities were compromised.

As all legitimately issued certificates are in the Certificate Transparency logs, browser vendors can grandfather them in so they keep working after they drop the CA certificate from the trust root. This kills the CA.

This would give CAs the power to refuse requests from the NSA, because their hands are tied - no matter what coercion the NSA threatens, the CA can't issue an MITM certificate without getting shut down.

Obviously it remains to be seen whether this will work in practice.
The extent to which this is true depends on browser behavior. With some browser behavior self-signed certs could make some users safer against some threats; with other browser behavior they could make some users more vulnerable to some threats.

An opportunistic privacy solution with no legacy installed base to worry about is tcpcrypt:

http://www.tcpcrypt.org/

So if anyone wants to make progress on opportunistic unauthenticated encryption without having to fight about UA behaviors, tcpcrypt may be more fertile ground than self-signed certificates.
TLS/SSL certificate setup is a pretty mechanical task. I would imagine their program detects common web servers (nginx, apache, etc), puts the private key somewhere, and points the configuration files at it.
It should also be noted that node.js jobs are practically non-existent outside of the startup scene in tech heavy cities.

Best to do market research for the area one actually resides in, at least until you have enough experience to do remote positions.
Facebook Launches Flow, Static Type Checker for JavaScript
Begin developing with Android Auto
> Why this wasn't done a long time ago is beyond me.

While probably not officially scriptable, free certificates have been available since a long time ago: https://www.startssl.com/?app=1

Also, no free wildcard certs. Which I really want.

> What happens if a CA is compromised?

Looking at past compromises, if they have been very irresponsible they are delisted from the browsers' list of trusted roots (see diginotar). If they have not been extremely irresponsible, then they seem to be able to continue to function (see Comodo).

https://en.wikipedia.org/wiki/DigiNotar#Refusal_to_publish_r...
https://blogs.comodo.com/uncategorized/the-recent-ra-comprom...
That would be the worst idea. They should stay far, far away and not say word one. You do not ever get involved in controversy if you can help it. Say a word and get you and yours investigated by those looking for a follow-up story.
A somewhat more controversial 'inability' would be a visa where you must leave the country within 72 hours of your job terminating, although its impossible to sell your house in 72 hours and close the transaction without any preparation and the typical workplace hiring cycle is perhaps two months long. So technically you could quit or get fired and stay in country, if you had preexisting arrangements, but in practice...

This would be an interesting, strange, startup idea for a jobs website. I'll work for you part time, for 1/10th pay or minimum wage whichever is higher, although I donno when, and only until I get a real job. I suppose this is basically the temp industry, in a nutshell, unless a startup could do it much better, somehow.
afaik there will be an api to request just the certificate and you'll have to integrate it manually, or a special program which will automatically add it to nginx for you (presumably only for simple setups)
Which is why tarsnap says about your keys: STORE THIS FILE SOMEWHERE SAFE! Copy it to a different system, put it onto a USB disk, give it to a friend, print it out (it is printable text) and store it in a bank vault — there are lots of ways to keep it safe, but pick one and do it.
Kinda reminds me of this: http://www.penny-arcade.com/comic/2006/01/20
> Does Google typically improve open source projects or do they just rewrite them from scratch?

Google typically takes multi-pronged approaches to similar problem spaces when they have sufficient resources (which, given the size of the cash hoard they have lying around, they usually do) and their is some uncertainty as to which approach will pay off best (as there quite often is.) So its not really inconsistent with Google's general behavior to see them doing both -- improving the existing product and doing a parallel replacement -- for the same product at the same time.
this is why android and other mobile os needs to have read/write permissions
Have one - found it to be an amazing and affordable way to experience VR.
3DS Exploit finally found
Implementing a visual CSS testing framework: Automatic screenshot comparison
> They just use contract manufacturers just like Apple does.

They do more than that; they have outsourced also the business execution (i.e. including selling, warranties, etc.) of the device to Foxconn. They just share in the revenue by licencing the use of their brand and design (and software).
It would appear as though the repo owner is no longer accepting new issues (the "Submit new Issue" button is greyed out). So, in lieu of submitting a new issue, here is the issue that I would have opened (in Markdown):

Looking through the README, the first thing that made me balk was the fact that the limit of `1/x` as `x->0` is not infinity. The limit doesn't exist! However:

* The limit as x goes to zero from the right of `1/x` is infinity, and

* The limit as x goes to zero from the left of `1/x` is negative infinity.

So, to quickly determine whether or not this was just a documentation issue, I installed Hilbert ([and eventually succeeded](https://github.com/gogotanaka/Hilbert/pull/68 )) and tried to discover the syntax for one-sided limits:

```
Enjoy! -> lim[x->0+] 1/x

Enjoy! ->
```

Hmmm...no output. Okay. Does any output work?

```
Enjoy! -> 3+2

5

Enjoy! ->
```

Okay, good, we at least have that much... Hmmm...

```
Enjoy! -> lim[x->0^+] 1/x

Enjoy! ->
```

Nope, that's not it, either. Poking at the source code, [it doesn't seem as though one-sided limits are implemented](https://github.com/gogotanaka/Hilbert/blob/1750822d0577e69ab... ).

Well, okay, how about a simpler limit?

```
Enjoy! -> lim[x->0] x+2

Enjoy! ->
```

Uhhh...okay, how about some differentiation?

```
Enjoy! -> d/dx(cos(x))

I'm so sorry, something wrong. Please feel free to report this.

Enjoy! ->
```

This error message is of no use, and I have no idea what's going on, but this language appears to be broken.
Smealum has also been the first one to unpack Pokemon X/Y data, iirc.

The game (Cubic Ninja) is currently hitting a price peak since the anouncement, and is hardly found anymore on Amazon.

The exploit seems to write homebrew into the savegame, then run it.
You're right. I wasn't precise and conflated those issues. Thank you.
It's inconvenient for us, but I wouldn't necessarily call it "absurd." The Wall Street Journal is not a 501(c). It's either this, or a flurry of intrusive ads. (Or a subscription upsell, but I digress). Different publications pick their poison differently. But someone's gotta pay for something.

Besides, paywalls aren't hard to circumvent. Someone usually posts a redirect within minutes of these articles' being linked here.
The Politics of Names
Show HN: npm spaceship
If the application isn't open-source how can he check though?
They can show a version without the backdoor to him and build the binary with the backdoor.
Or there could be vulnerabilities elsewhere (not in Moxie's) code.
I don't think you can claim no backdoors unless you have the full application under your control, and have it audited.
And apparently a specific rumor about a specific person they wanted to validate.
Does someone seriously think the IOMMUs on Intel CPUs are backdoored?
I agree, it would be good to tighten up the terminology. "Weak typing" should be reserved for stuff where the underlying bits can get reinterpreted at will, e.g.:

printf("%d", 42.0);

Strong typing means the type of each chunk of memory is known and can't be arbitrarily changed, and then static/dynamic refers to how much type information is present at compile time.

Might be a losing battle, though. Strong/weak has been overloaded in this way for a long time.
Honestly, you're probably not going to get a large personal benefit from this. The larger good is that you'll be helping move the Internet toward encrypted-by-default, which is an enormous societal benefit.

Like you, I don't host any private or remotely sensitive information. I'm encrypting my site because I think it's the right thing to do, even though there's little personal return on investment.
Google image recognition resembles human ability
Python's type system isn't very expressive-- for example, you have "list" and "dict" types but not "list of int"

Sure you can.

>> from array import array
>> a = array('i')
>> a.append(3)
>> a
array('i', [3])
>> a.append('Hello')
TypeError: an integer is required

The default "list" type just happens to be an heterogeneous list.
Does this mean that Whatsapp users could send encrypted messages to Textsecure users and viceversa?
As an example, a business can scale a lot faster with a $1M cash infusion than it can with just $50K in the bank.
I'd still be more comfortable if the process never went anywhere near the private key (and I'm concerned that a proprietary competitor or look-alike would prey on naive users by leveraging your example). But I also applaud your effort and transparency. I admit I trust openssl to manage my own keys and certificates, and there is definitely room in this space for improvement and alternative approaches. But it does sadden me that we risk making administrators as trusting and ignorant of the underlying principles as end users already are today.
Text messaging for Signal is not "stalled", just still in development.

https://github.com/WhisperSystems/Signal-iOS/commits/textSec...
Is the app in the iTunes store yet?
To be precise, Microsoft didn't buy Nokia's brand for use in phones, they licenced it, for about a year for smartphones and a decade for the so-called feature phones.
They're vectors for layer-2 attacks. The (valid) implication is that you don't have to assume Verizon is colluding with NSA to be concerned about attacks on the baseband.
What is this written in reply to?
Introducing the Facebook Groups App
Surely someone at WSJ is wondering "Hey, this article is doing really well in organic search. Our numbers are up, great job everyone."
So, blockchain solutions do work, and here is how:

https://github.com/okTurtles/dnschain

You can replace all CAs with a single blockchain.

And we should do this, because this Let's Encrypt CA, while a great step forward, is still vulnerable to man-in-the-middle attacks, explained in this video:

https://vimeo.com/100433057
This is just a hobby project, which I've built in my spare time: http://anvaka.github.io/allnpmviz3d/

It gives you a spaceship to explore the universe of npm, the largest package manager for javascript.

Use WASD keys to move around. Or if you have a smartphone - rotate your device around to control the camera.
Elizabethan Superheroes
Would we be better had we never harnessed electricity, built a computer, or designed a camera? If the social conscience of technology depends on whether or not something can be used for bad intentions, why pursue anything? Farming advances raise armies, should we blight the land? Your response is erudite, elitist, and short-sighted. The poster is not "of course, correct" -- fire fell into the wrong hands as well and yet the world has continued to be an awe-inspiringly amazing place.
Start innovating in 90 days with this step-by-step guide
Well, Nixon used to be equally vindictive with reporters (conplete with typed up master plan), most of whom were men (only one woman made it onto his infamous "Enemies List.")

It's very dangerous when people in power cannot maturely handle conflict and disagreement.
In part, this gist: https://gist.github.com/darrencauthon/0c11c7fd24f82733bd12
a lot of the get rich quick and work from home schemes are illegal in one way or another, pyramid schemes, black market underground parcel shipping networks, etc. seems to me like teespring has a much better business model which can help people make money making something people want.
well we killed pamie.com, (or was it Brian & Steven), so content reposted over at tumblr http://pamiedotcom.tumblr.com/post/102960377050/barbie-fucks...
Flow, a new static type checker for JavaScript