skysight-inc/HackerNews huggingface dataset:
Uh oh, this looks like it kills sslmate.com

Sorry agwa.
Your last 7 tweets were bashing Uber. You completely made up the "threatening to reveal the location of children" part.

It's clear you're just another bored, delusional social justice warrior who wants to make a cause out of nothing.

Sorry I don't share your hatred for Uber or your willingness to distort the truth to serve a personal agenda.
Why More Diversity on Wall Street Might Fight Bubbles
This is so unbelievably awesome.
a journalist's job often involves being "rude". some journalists specialize in "rude" reporting. scrutinizing powerful and wealthy people is one of the legitimate roles of a journalist, even when it comes across as "rude".

powerful and wealthy people NEED to be scrutinized. when we do, we often discover that they are sociopathic scum like several of the executives at Uber have turned out to be.
The Fall of Rome, I'd imagine.
It is a good step in the right direction. I agree though, we need to fix those issues as well.
That's not how Apple Pay works; other than using a proxy CC# and hiding your info from the actual sales clerk, Apple Pay isn't more private than magstripe cards — merchants can still identify you, and it actually adds another party to the transaction: Apple.
" He is not saying "Google will not contribute back to LLVM" per se"

Except for the part where that it was literally said, yeah, ...

"He is not attacking Google and there is no reason to take it "personally" and entering to the "defensive mode" immediately."

Google was specifically called out as "sure to require you to use proprietary modules".I don't know how you can read it any other way.
this is a very positive development in a year full of bad news. kudos NY and congrats New Yorkers.
The warning is designed to let people know that who you're talking to can't be proven, which is important when someone tries to impersonate a bank, or your email provider, or any other number of important sites.
There are lots of different barriers to adoption. With this project we are attacking several of them at the outset, including the cost of obtaining a certificate, and the inconvenience or difficulty of obtaining and installing it for users who don't do that every day.

Because of the open protocol we also aspire to support users with more complex configurations and requirements, who are absolutely welcome and encouraged to write their own implementations of the protocol and integrate with their own existing certificate management and configuration methods. If you think of other barriers to adoption that we can help with, please let us know and we'll try to address them; if you just want our certs for free, please get them and enjoy!
Often times animal predators are detoured by wooden fences just as effectively as 10 foot tall, 3 foot thick stone walls. You only build the later if you enemy is a bit more tenacious then an animal predator.
You don't usually improve the standard for legacy code. You want backward compatibility, sure, but the expectation that a new standard automatically makes old code not suck is just setting you up to be disappointed.

What C++ has allowed us to do is slowly (sometimes wholesale), add the new stuff to old code or just write new code that doesn't suck as much.
Keep in mind that catch-all accounts usually get a lot of random spam. If you're using this domain to signup for various services, at some point, spammers will become aware of it. And, they'll start sending a lot of spam to (random string that spammer comes up with)@your-domain.com.
Show HN: Restaurants – A Native Mac Interface to the Yelp API
Emil was quite specific too. One million dollars, four researchers and four journalists... this isn't an off-the-cuff comment but something he has deliberated over.
Google is first to rent new Times Square billboard
> Well, if you are pulling down a vendor's binary, they can "inject" whatever they want in it :)

Why does this have to be the case? Here are two specific alternative deployment models that protect you from this attack:

1. The update is signed at rest (e.g., PGP), instead of the update traffic being signed in motion (e.g., SSL), and the update and signature are widely mirrored or distributed through a third party. The vendor can still inject malicious code, but everyone has the same code: they can't easily introduce targeted attacks against a specific person.

This is the security model of Chrome or Firefox extensions, and it's one of the reasons there are vague security advantages in distributing an app that way instead of directly via a website. It's also the security model of the Apple App Store, the Play Store, almost all Linux distros (kinda), etc., sometimes with the addition that there's a human reviewer at the third party.

2. Same as 1, but the code is open source and reproducibly built, such that anyone can audit (possibly even automatically!) that the sources match the binaries. Or the code is open source and not in a compiled language. At that point, any injected crap is visible to the world.

(This design has the secondary advantage that it disincentivizes the government from compelling the software author to add a hidden backdoor, but that's for the same reasons it makes it hard for the software author to add a hidden backdoor of their own volition.)

My point is that we shouldn't settle for a bad threat model just because a for-profit vendor tells us it's the threat model.
> "The US needs an organization that goes after the careers of politicians that pass those kinds of laws, thats the only way to stop them."

We have many of them, and we used to have more: journalists and news organizations. The press is supposed to serve as a very wide barrier against gross abuses.

But of course, we - not just politicians, but all of us - have spent the last few decades throwing our wallets at the least journalistic news outlets and away from the ones conducting actual investigation and reporting.

We very much made the bed we are sleeping in right now.
Just one question: how much it takes to run Bumblebee, zsh and Steam on that?
What does the Coinbase service offer over something like a browser plugin that enables one-click dispensation of tips from a small wallet to a bitcoin address on a site?

A lot of Americans use Coinbase, but not everyone has a Coinbase account....
Not to mention the fact that Asparagirl has intentionally interpreted his comments in the most sensational way possible, even going so far as to fabricate threats.

"Look into your personal lives, your families" somehow magically became:

> threatening to reveal details of the location of their children

There's clearly a great deal of stupidity on both sides here.
The anatomy of a Git commit
The main issue I read was that even though it gets some light (something like 1 hour of light per 12 hours) the battery can't recharge when it's cold. So Philae needs light to heat up the battery and only then it can start charging it so it needs a longer exposure to sunlight or it needs to be closer to the sun so it heats up faster.
NSA has NSL (national security letters with gag orders). There are CAs in the US. Mission accomplished.
Speed Up JavaScript Capybara Specs by Blacklisting URLs
I am not very familiar with iOS and Android development workflows, but this seems like a nice integrated set of tools. I also like the UI very much (from what I've seen in the video)
Harm reduction for developers
I just use mailinator. No charge, no hassle, you don't have to set it up first. Half the time I don't even end up checking it. So far I don't really have a use case for plus addressing.
Not yet. I don't know about the other papers but I really like to release code and make as much of my stuff reproducible as possible. I still have to clean a lot of it up (when you're doing research and rapidly iterating things get a bit messy), but it's based on Python and numpy and I plan to make it available sometime in December.
New working link:

http://www.theverge.com/2014/11/18/7241011/whatsapp-rolls-ou...
Well, let's put flash aside. I'm not a fan and Shumway works for most stuff that I need.

Dropbox? BTSync? (I .. don't care about the latter, and try to replace the former with SyncThing atm, but I'm trying to make a point: It's more than just a single binary blob to watch cat movies or porn in a browser)

What I really like to install is Steam.

What I'm trying to say here is: If there's no middle ground, no way to fulfill my needs, the system just isn't for me. I might support the idealistic idea, but I cannot (or, more precise: I don't want to) work with a number of limitations.

I didn't even think about wifi or anything hardware related. If that doesn't "just work" it's again impossible for me to use the project and I need to bury the idea of trying Guix right next to my failed attempt to run nixos as my host system.
What you're seeing today is demos, not the software in its final form. You're also seeing it demo'd with a focus on the most simple usage. There are, and will be, advanced options.

We'll be doing quite a bit of work based on user feedback between now and when we go live. We're well aware that we need to cater to a variety of types of users.
The use case for the CA system is to prevent conventional criminal activity -- not state-level spying or lawful intercept. The $200 is just a paper trail that links the website to either a purchase transaction or some sort of communication detail.

The self-signed cert risk has nothing to do with the NSA... if it's your cert or a known cert, you add it to the trust store, otherwise, you don't.
Agreed-- I haven't seen anywhere else in the news that the probe rotated it primary panel into direct sunlight.
Why would Uber, a company who's entire business is based on location data and the analysis, sign such a deal?
Thalmic Labs annouces free, raw Myo EMG access for all developers
All of that work is not irrelevant.
These Scientists Are Training Computers to Help Farmers Save Their Crops
These maneuvers look strange because Rosetta is too far from the comet at those points for a real orbit. The probe can change course freely without the gravity of the comet affecting it much.

The reason for the maneuvers is to maintain line of sight with the Philae lander so that communications between Earth and Philae can be relayed, hence "relay phase". Then the probe inserts itself back into an orbit.
> The US needs an organization that goes after the careers of politicians that pass those kinds of laws, thats the only way to stop them.

We have them (or have had them -- they are hard to keep together because interest doesn't remain intense) -- formed of the people opposed to the laws.

We also have organizations -- much better-funded, and that stay together better, because the interest is more concentrated and wealthy -- that go after the careers of politicians that refuse to pass those kinds of laws.
>The HN title, which is all I've read so far

So you didn't read the article, which was the original complaint of the root comment. If you can't take 30 seconds to read about legislation that could significantly impact the power of the security state to spy on the American public, you're not doing your duty as a citizen.
You can access Wallstreet journal articles by searching title in google ( because if referal is from google then article is free )
There was no mention of blackmail.

There was no mention of revealing the location of children.

There was no mention of "rifling" through the location metadata of another female journalist.

There was no "implication" about leaking customer data.

As far as I can tell, the article amounts to almost exactly what's in the headline: dirt digging.

If you want to criticize Uber, it's certainly possible to do it without exaggerating or making stuff up, otherwise you risk making legitimate critics look like sensational buffoons.
Telegram doesn't offer end-to-end encryption by default for one, and second, it "can't" offer end-to-end encryption for group chats.
Toyota is subsidizing the construction of hydrogen stations in California
Google redirect without paywall: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...
I couldn't be happier about the news, the EFF and Mozilla always had a special place in my heart. However, the fact that we have to wait for our free certificates until the accompanying command line tool is ready for prime time seems unnecessary. Another thing I'm interested in is whether they provide advanced features like wildcard certificates. This is usually the kind of thing CA's charge somewhat significant amounts of money for.
I don't know why AOL keeps being brought up, but it's highly unlikely they would do this. For one, it's probably used internally for smart cards/SMIME. Secondly, it'd be very hard to get AOL to spend money on doing something for free. Moving a CA to a different company is no small feat, operationally...
OK but if you copy/paste those lines again it might be worth fixing that "Pearl" typo :)

Since we've gone off-topic I thought it might be good to post the same Rebol code from that old thread but updated to use the new R3-GUI dialect:

Rebol [
title: "Feet to Metres"
]

load-gui ;; needed while r3-gui is in beta

convert-to-metres: func [in-feet] [
(round 0.3048 * in-feet * 10000.0) / 10000.0
]

default-feet: 1

stylize [
end-label: label [
facets: [align: 'left]
]
]

view [
hpanel 3 [
pad
feet: field 80 (to-string default-feet)
end-label "feet"

text "is equivalent to"
in-metres: text (to-string convert-to-metres default-feet)
end-label "metres"

pad pad
button "calculate" on-action [
set-face in-metres to-string convert-to-metres to-decimal get-face feet
]
]
]
So a support page is what passes for documentation now?
Angular 2 Bits: Unified Dependency Injection
So there's no place for reasoned discussion on topics that are clearly of interest to many here? That sounds like a poor excuse for improper moderation. Some level of post level moderation I can understand, but to the degree practiced here, you might as well have sanctioned curators instead of moderators for that - at the least, it'd be far more accurate, and far more transparent.

Instead we get a heavyhanded version that allows a few to destroy possible reasoned discussion by squelching it as a side-effect of this rationale, and instead we get lots of topics that don't really foster discussion, are often not interesting or important (even to those intellectually minded) - there are plenty of banal articles on startups that get upvoted and end up on the front page, but no similar policy gets instituted simply because they are "not controversial", and yet they take up the same space, and certainly are less fulfilling. The process is opaque, and I know I'm not the only one here who has questioned this.

There are sometimes situations where flags are deemed inappropriate, and yet the effects don't get raised when moderators even acknowledge when the flags were incorrect.
Finland at Odds with EU on VAT Exempts Status of Bitcoin Services
Show HN: Hackyto – A Swift Open Source Hacker News Reader Using Firebase API
I have catch-all running for a few years now, but no real spam problem. Maybe due to the fact that greylisting still works pretty effective. Most of the spam I receive is on my GMX including the email address I never used for sign-ups of any sort.
From the panorama they released, it's in quite a hairy spot.

Mattias Malmer corrected the perspective [0] and I threw it in my JS pano viewer. [1] It helps to visualize where it's sitting.

[0] http://mattias.malmer.nu/2014/11/philae-final-landing-place/
[1] http://robotrising.org/StratoSphere/index.html?src=images/ph...
When you get an output, is there a measure of certainty? Can you have the algorithm point out images that it's having trouble with? Specifically, I was wondering if you can add the marginal cases to your training set, to increase the amount of training data around edge cases.
How would a browser know that the the self-signed certificate that was just presented for www.mybank.com is intended to be self-signed (show no error, but also show no padlock) or whether it's the result of a MITM attack because www.mybank.com is supposed to present a properly signed certificate (show error)?

How would you inform people going to www.mybank.com which is presenting a self-signed cert in a way that a) they clearly notice but that b) doesn't annoy you when you connect to www.myblog.com which also is presenting a self-signed cert?
That allows cloudflare to read any traffic because you SSL to cloudflare and auth their private key...
CA-signed certificates don't prove you're talking to who you think you are either as any CA trusted by your browser/OS can sign any certificate.
If we aren't going to put any effort into testing, what's the best way to test?
Next Lock Screen for Android by Microsoft
Thanks, but: this is a dead project.

Also, it appears to be tied to Windows (it's delivered as a VS solution).
I guess my point was, a cri de coeur at the end of 2014 probably isn't going to change a policy that has been in place since early 2007. You are effectively arguing with the premise of the site.
Indeed. This 'toy language' has accomplished many millions of strong websites. It has some faults, but all languages has faults.
plus it's much more fun to get all spun up about the most uncharitable interpretation possible. it works for Internet fights, relationship fights, street fights... an amazingly versatile technique for disrupting harmony.
Best SAP Online Training Institute in India, US and UK
> FWIW, (valid) rogue certificates have been found in the wild several times, CAs have been compromised etc. ...

And it's only going to get worse as SHA-1 become more and more affordable to crack.
Well, you do take them out 8 hours of the day then. Here we're talking 24/7 in dry desert heat.
The NSA (or any other agency) only has to coerce any single CA to cooperate. As long as it's in the standard set shipped with browsers, its certificates are accepted.

And pretty much every major government directly or indirectly controls one or multiple CAs that are in the standard set.
There were no threats. Stop making stuff up.

The comments were about "digging up dirt". Sleazy as that is, it doesn't even require personal contact.
I'm not sure if I fully understand, but consider that "a person with backpack" tells you extremely little about the actual positions of those two items in the 2-D coordinate system of the image: It could be an extreme closeup where only the torso/head of the person is visible and a bit of the backpack, or it could be a tiny person anywhere in the image with a small blob sticking out from their back. The backpack could also be large, small, very occluded, etc. So there is less information in those locations than you might think.
"The people truly at fault for the things I fear, should they come to pass at all, are not the late adopters like Google, but the innovators who decided to put their energy into LLVM, knowing full well how dangerous it could be."

You are talking about things that people have been working towards for years. The people you see working on it now have been working on it since almost the beginning of LLVM.

Google is the company that put their energy into LLVM, knowing how dangerous it may turn out.
But you don't have to take my word for it, check the commit logs.

Just because we didn't make a public pronouncement and try to get press for it doesn't mean it didn't happen.

"I do think that Google's decisions to contribute upstream are based on business sense, as opposed to morality, "

Then i'll just say you don't understand me or the folks that work for me.

"The concern I have is that this is possible with LLVM, and it was not possible with GCC."

It is in fact, possible with GCC, despite your claims. In fact, all you would have to do is change the C and C++ runtime libraries (which is entirely doable nowadays). That's it.
The FSF knows you can interpose stuff legally as well.

" with the legal requirement that all such modules be free in any distributed compiler,"

It is probably not possible to make such a license and have it compatible with various GPL versions, etc.

"hopefully, accept that as the canonical GCC."

You also seriously misread what would have occurred in this situation. People tried what you are suggesting. RMS said no for many years, right up until the point it was probably too late.

Forking again was considered, by all the companies and people involved. But it wasn't worth it to any of them to have to have political fights with the FSF over software development every couple years, when they just want to get shit done.
This is really huge, WhatsApp has incredible market penetration in lots of countries. Almost every smartphone user in Brazil uses WhatsApp, and businesses of all kinds (eg. radio stations, pizza deliveries and drug stores) have a WhatsApp number for connecting with their customers.

I also have TextSecure and Telegram installed but almost none of my friends do, and telling non-techie people to install another IM app because it's more secure then WhatsApp is futile.

I'm curious to why WhatsApp is not advertising this collaboration.

Also, I wonder if there's some visual indication that end-to-end encryption is enabled for a given contact/conversation like the padlock icon in TextSecure (which can fallback to SMS).
How Star Trek May Show the Emergence of Human Consciousness
BYOD Personal Privacy and IT Support Help Desk
Interstellar - Original Motion Picture Soundtrack - Hans Zimmer
> This isn't the last word on the topic.

Are you sure about that? Because once such law get effective, replacing it will read like an admission of failure to everybody that helped it pass.
Yep. And Facebook have done other privacy-aware things recently - such as setting up a Tor hidden node: http://arstechnica.com/security/2014/10/facebook-offers-hidd...
According to the article an Uber executive did indeed access a journalist's data without her permission, something the spokesperson said was not possible:

"In fact, the general manager of Uber NYC accessed the profile of a BuzzFeed News reporter, Johana Bhuiyan, to make points in the course of a discussion of Uber policies. At no point in the email exchanges did she give him permission to do so."

Or does "rifling" mean something else to you?
> running a CA is very expensive and I wonder how they plan on recouping the fees for this

Is it? Seems like it should be dirt cheap to me. It's basically just an API for generating and revoking certs.
The semantics are the problem, as they require re-parsing every header transitively every time, and this defines new syntax with new semantics.

Large C++ projects end up with compile time tending towards O(n^2) in the number of files in the project; this will save tens of minutes to hours on every project build.
You don't think that rent seeking is an ethical issue?
Preview Android layouts on 6 devices all at the same time
The Problem with International Development–and a Plan to Fix It
I didn't know BuzzFeed was allowed on HN. What a fucking joke.
Who's auditing the CA's currently trusted by your browser?
Jerry Seinfeld's Apartment for Oculus Rift
There's a difference between accurately representing a statement and being being willfully blind to the statement taken as a whole. It's not fair to take an isolated statement out of context, but it's also not fair to assert that a series of statements taken in context don't mean anything more than they do in isolation.

All of those things are in his statements. He doesn't have to spell it out for you to know what he means.
Browsers shouldn't silently accept self-signed, but there is a class of servers where self-signed is the best we've got: connecting to embedded devices. If I want to talk to the new printer or fridge I got over the web, they have no way of establishing trust besides Tacking my first request to them.
This is true for most sites now, but is being solved gradually, with hard-coded certificate pinning already shipping in Firefox and Chrome, and the HTTP Public Key Pinning extension coming soon.