skysight-inc/HackerNews huggingface dataset:
My understanding of an SSL handshake goes a bit like this...

Everything after the https:// is encrypted. Client does a DNS lookup on the host, but the host name in the request is encrypted. The path is encrypted. The get parameters are encrypted. Everything is encrypted to the server in the request. Everything coming back from the server is encrypted as well.

Team SNI comes along and says, "But we don't really care about security! We want to host multiple domains on the same IP address! How will the server know where to direct the SSL request without the domains?"

And so, in the name of reusing an IP address, security is now compromised for the domain. It is sent outside the SSL request, in the clear.

Is that about right? SNI on TOR? Nice one.
> I wasted my time arguing with a 14 year old

Well, I'm about to turn 50 so you don't have to worry about that. :-)

FWIW, I wrote this:

http://www.flownet.com/ron/QM.pdf

> You sound surprised.

No, I'm not. (How does one "sound surprised" in an on-line conversation?)

> perhaps my definition of what theoretical physicists consider "entangled" is inaccurate

An entangled state is one that can't be factored. See e.g.

http://www.theory.caltech.edu/people/preskill/ph229/notes/bo...

section 2.4.1.

(I am a bit nonplussed by how someone who does graduate research in quantum chemistry can not know this. It's a pretty basic concept.)
Say I encrypt a folder with my own encryption then BitTorrent Sync it, would it then be safe?
According to my experience quite many email address validators on web sites don't consider the address with "+" as valid.
Have carrier attacks from the baseband been seen in the wild?

By comparison, application-based encryption of messages addresses a bunch of real threats. The NSA is not the only threat; malicious wifi operators, for example.
What Wikipedia Taught Me About My Grandfather
Here's the current process:

Generate key, Generate CSR, Send CSR, Receive Certs from CA, Verify ownership, Install certs

Presumably their command line client creates the key, the CSR, sends the CSR, then gets back the certs (at least I'd hope so). I'd be happy to use a vetted command line utility which did that, or even just parts of that process, if I were sure the private key were not transmitted. It's just automating stuff which with current CAs needs to be done manually.
Yes and no. Depends on how the routes are structured in the code. In your example:

/users/
/users/15/
/users/15/photos/

Your router map probably looks like this:

App.Router.map(function() {
this.route('index', { path: '/' });
this.resource('users', { path: '/users' }, function () {
this.route('index', { path: '/' });
this.route('show', { path: '/:user_id' });
this.route('photos', { path: '/:user_id/photos' });
});
});

This translates into a structure like:

ApplicationRoute
IndexRoute
UserRoute
UsersIndexRoute
UserShowRoute
UserShowPhotosRoute

Note how all of those Users*Route classes are all siblings rather than in parent-child relationships. Also note that if you're sharing controllers, they won't pass through Route.setupController on the sibling routes because those routes aren't run.
Strong Types and Their Impact on Testing
> "It's clear you're just another bored, delusional social justice warrior who wants to make a cause out of nothing."

No. Just no. This type of behavior is unacceptable around here - it may be in vogue around /r/TumblrInAction or GamerGate but it has no place here.

If you want to attack the substance of someone's argument fine but personal attacks, especially name calling are completely out of bounds in any sane venue of discussion. And note that Asparagirl has not attacked you personally throughout this entire conversation, much less resort to juvenile name-calling.

Personal side note: the "SJW" insult removes any shred of credibility you may have had.
> which disingenuously begs the question "Does God exist?" by insisting that anything we can't positively and fairly certainly explain by physical causes must be due to the Big Guy in the Sky.

I agree with your position, but in my view your summary of some well-considered theological positions undermines your on-topic points. To be sure, there are people with shallow appreciation of the metaphysical implications of the exploration of nature, but people with more rich views are easy to find and the typical viewpoint is probably more reasonable than you give credit to.

I hope you would consider being more measured and even-handed in your critiques of other viewpoints, especially when any responses would be off-topic.

Thanks.
Why not? If you own the domain you can get a DV cert, whether you use the domain for malicious purposes or not.

The certificate isn't saying "this website won't infect your computer", it's saying "you're talking to the real owner of this domain".
How to Be Customer Support Employee #1
Terminal-notifier: Send User Notifications on Mac OS X from the Command-line
ApplyKit – Find and apply to colleges with ease
Those aren't the same things. A competitor eating into your profits isn't necessarily making fundamental changes to anything.

WestJet no doubt eats into Air Canada's profits. Have either of them distrupted anything?
https://twitter.com/voodooKobra/status/534724855103774721

Comparing /^0e[0-9]{30}$/ with /^[0-9a-f]$/ gives you a chance of about 2.939 x 10^-9 in 1 (or about 0.0000002939%) of occurring. This is a naive probability estimate.

Compared to a birthday collision, we can expect 6.28 * 10^28 0e############################## cases to occur for every hash collision.

Of course, there's also the possibility that 1e would act the same way, which effectively doubles the odds.
If it's a mobile app, people are generally used to it using the mobile number. For the average nontechnical user it reduces barriers to entry as you don't have to create yet another account with username/password, and it can be used for address book import (which I agree isn't very private!)
It wasn't clear what "accessed the profile" meant.

I guess it's talking about the travel logs from 2 paragraphs above?
How does a CA that's formed by a conglomerate of U.S. companies (under the jurisdiction of the NSA) make us any safer than we are currently? It doesn't. The chain of trust chains up all the way to a U.S. company, which can be coerced into giving up the certificate and compromising the security of the entire chain. I'm on the side of the EFF trying to encrypt the web, but this is not the solution.
6 development mistakes that will kill your mobile app
another possibility: Integration effort at that level requires fairly bright bulbs and bright bulbs rather build than integrate.
This doesn't really sound like a feature. Or, at least, not a feature I've ever wished I had.

From a purely pragmatic perspective, it means huge swaths of software have to be rebuilt any time anything gets updated. And, it's become clear now to me that every user is building all their own software (as with ports or Gentoo ebuild, both of which I consider unacceptable package managers for servers for that very reason)...given that, and given that rebuilds now must often span huge piles of software, occasionally with exploding dependency chains, I'm feeling a little queasy imagining trying to administer such a system.

I understand the appeal, from a security perspective (and particularly in a world in which the NSA and other highly capable attackers are willing to exert resources to compromise software at the vendor level), of being able to duplicate a package from source. That's cool. But, why force every user to do so every time they update their software? Am I missing something? Are there also binary packages and being able to verify package builds is optional?
I'm guessing it's primary benefit is for existing Coinbase users - offering them the extension of their accounts.
PagerDuty's DevOps Prep: Avoid a Cyber Monday Fail
We made it easy for people (and potential clients to discover you
We made it easy for people (and potential clients to discover you! Share your portfolio website now. Join enythings.com now and upload your website for the world to see. Let us help you! Enythings.com
Oh god, they have internet fridges now? What on earth for?
Global Slavery Index 2014
AH but yours should send pictures of cash that disappear :-)
Of course there are many factors in North Korea's status as a failed state, but if protectionism is such the brilliant move, then why isn't North Korea more successful.
The Best Survey Ever
$1 per month is an incredibly trivial number. Less trivial is how difficult it is to set up payment in this fashion. If getting payment was as simple as convincing developers that it was worth $1 per month, I'm sure you could get to $1m per year (many would do much better than $1 per month).
> I Noticed spammers have learned the trick and omit the "+..".

If you control your own email,

1. Configure a different character, e.g. ‘-’, as your subaddress separator.

2. Set up ‘joe@example.com’ as a spam trap.

3. Set up ‘joe+from@example.com’ as an email address.

4. Provide ‘joe+from-random-signup@example.com’ externally.
Humorous related story -- I was a customer of GM's OnStar service, and had a login on their web portal that I used for account maintenance and to check on vehicle stuff. Sometime later, the GM team rolled out a new version that blocked periods, but my account name had a period. It would happily send me an account recovery email with my now invalid username that I couldn't use. Nor could I configure a new account as it would happily point me to my old, now invalid account. The version without the period did not work.

This was a pretty fringe service of negligible value to me, so when my CC changed I sent them an email telling them of this problem, and my inability to change my account. No response.

So I let the account expire. Still couldn't believe that a team could make a new presentation that blocked already in place usernames, nor would they do anything about it.
Who will handle abuse complaints and revocations of known bad actors? I'd be curious to see who's abuse department will be handling those issues.
you're optimizing for the pathological case.
I have high hopes for Thalmic Labs, mainly because it is one of the most promising companies in the Waterloo region. Sadly, most ambitious Canadian startups get acquired (e.g. BufferBox) and shut down. We need a few to stick around if we want Waterloo to become the SV of Canada.

With Blackberry's impending demise, we won't have any large safety net companies for people to turn to when their startups fail. We need some companies with enough potential and backbone to grow big and refuse to be acquired.

All the best to Thalmic Labs, I'm rooting for you guys.
Is there any reason why I would want to use https for this use case?

Yes it can help you stop:

ISPs inserting adverts into your content (this has happened)

Governments censoring your content or rewriting it

Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs

People impersonating your website

But if you don't want to use it, that's cool too. I suspect all websites will be encrypted at some point soon though, the disadvantages are getting less and less important.
Cocoapods Stats 2014
Technically, there's no reason why a fridge couldn't have a signed cert tied to some dynamic DNS (e.g. <fridge-serial-number>.<manufacturer>.<tld>).
but late than never. i'm guessing this starts to expand to other cities - but instead of replacing payphones, they will start building new hubs at street corners or other public spots that are currently empty.
http://en.wikipedia.org/wiki/Internet_refrigerator
So, does this mean that users of the Android TextSecure app (and perhaps even Signal for iOS) will be able to communicate with WhatsApp users?
Oh I agree that there's a huge problem in using incentives to manipulate journalists and coverage - but I do think the comparison is a bit stretched.

It's like comparing a hang glider to a jumbo jet. Sure, both are bad behavior and have some common motivations, but the moral gap is gigantic.
That's not really a comparable solution, it requires giving up control of the domain.
Glad I don't work for a CA right now.
I would do this if I lived in the UK but I live in the US where we only have ACH and even that's not really close to BACS.
Jesse Jackson is lobbying the FCC against aggressive net neutrality rules
Ok. I do go a bit overboard sometimes with the rants about closed baseband firmware.

But it needs to be stressed that these kind of things are not the magic fix for mobile phone comms that people think they are.

A lot of use cases in our current world involve state owned telecom entities and Joe-Arab-Spring-Six-Pack should not be confused into thinking this solves that problem.
All the attacker needs to do is target the "CA" of the target.

For example, in an individual user situation, if the "CA" is a mac user, you use a local exploit, and export the private key from the Keychain. Done.
So what... what is it?

I've just spent five minutes clicking around the web site and I still haven't got the foggiest idea.
Microsoft to Release Urgent Out-of-Band Windows Security Patch: MS14-068
Emergency Flat Roof Leak Repairs – LGC Roofing Blog
This is why email is wonderful. It works so well that people are marveling about learning standard features that were deployed before they were born.

If only we stuck to a few good ideas instead of overwhelming ourselves and each other with bad ideas.
.005% of your approximate net worth (1m/19b)
I have always thought that C++ took the wrong route here.
Backward compatibility can be solved via a compiler flag too.
So the language can evolve, and deprecate older sub-awesome solutions, while allowing people to still use that via a "--my-code-still-uses-feature-x-and-i-dont-want-to-update" compiler flag.

You could have deprecated :

- #includes and have a decent mechanism

- std::pair when you introduce std::tuple

- perhaps new when you have make_shared and make_unique

- etc etc.

There's also a gentle push towards the more recent solutions as at one point compiler vendors will not maintain these flags forever because it's no longer part of the language.
I'm sorry, but I've grown to hate this feature. I keep receiving emails from accounts I didn't sign up for, only to discover the person (with a similar name) used an email address like "senor.developez@gmail.com" or "senordevelopez" and the site itself defaults to "gmail.com". These are not off-the-wall websites, I've had long conversations with Netflix and a satellite TV service. You'd be surprised how many website do not authenticate the email account given.
Where is his website?
This is why mail hosts and MX registrars offer spam blocking.
If this is true and has no strings (backdoors) attached this is huge. This means end-to-end encryption for messages from more than half a billion people and an incredible privacy win compared to SMS usage. Brought to you by facebook.
wait, is it on it's side?
In case of Chrome, they wanted to capture the market share for their business interests.
Russia tests 'satellite catcher'
Campaign Monitor Acquires GetFeedback
Dispatch – Powering the on-demand economy
Build your own on-demand marketplace on a scaleable and flexible API platform.
Welcome to A State Of Trance, with Armin Van Buuren.
Poor research produces a poor article, below the standard we should expect here on Hacker News. In one example, the article author writes, "It's also during this time that we begin to see markings that look like writing on pottery. Over a period of just a couple of centuries, these crude marks evolved quickly into an alphabet that we still can't decipher." First of all, "alphabet" is surely the wrong word, as that refers to a specific kind of writing system that the Harappan script most likely was not. Indeed, there is considerable controversy over whether the Harrapan script is writing at all, that is a representation of language, rather than proto-writing, for example markings of ruling families or the like. (Those are stages of development of not-yet-writing attested in other centers of ancient civilization.) As the article correctly notes, there is no evidence of a successor civilization to the Indus Valley civilization, so at the very least we have no sure evidence of any linguistic affiliations of any use of Harappan script for writing. The attested later historical development of writing in India (which flourished at the time of the emperor Ashoka) is based on script forms from the ancient Near East.

AFTER EDIT: As usual, I would be happy to hear a rationale for the disagreement that is evidently being expressed regarding this comment. Please show your capacity to teach me (and onlookers) something. I'll mention here that I have studied a variety of other languages (those are disclosed in my Hacker News user profile), including Chinese, and I have made specialized study of the origins of writing around the world. That's my basis for judging the plausibility of various claims about the ancient Harappan inscriptions. A book on that topic I highly recommend, because it is written by very knowledgeable historical linguists, is The World's Writing Systems, edited by Peter T. Daniels and William Bright. There has been a little bit of new work on Harappan inscriptions since that book was published, with several claims and counterclaims by competing scholars, but no settled demonstration that the Harappan inscriptions are writing at all, and certainly no settled demonstration of what they are writing about, if anything (as the article submitted here acknowledges).

[1] http://www.amazon.com/Worlds-Writing-Systems-Peter-Daniels/d...
Using Fig&Flocker to orchestrate Docker containers
A 2-Trip Review of the iOnRoad Driving Assistant App
Tor Browser 4.5-alpha-1 is released
True. One problem specific to Snapchat is that there are already a ton of 3rd party clients that users trusted with their username and password. That user/pass combo now suddenly has the potential for financial abuse without any new permissions. It's bad to add scope to previously granted authentication, especially when you're talking about finance.
Looks like a managed enterprisey version of Google Inbox/Mailbox app/Evomail. Probably does some natural language processing and keeps track of appointments, due dates, action items, etc.
Comet landing: Organic molecules detected by Philae
Are you saying that wasn't a threat?

Also, if you don't interpret "families" as including children, what do you interpret it as? Her parents? Does that make it better?
Intel's Xeon Phi: After Knights Landing Comes Knights Hill
In my heart, Oracle will forever be a database company that was eaten alive by their sales and service organization.
The most interesting thing to me about all this is that the tech media is probably about 50 percent responsible for pushing out tech start-ups to the wider world. If you go back and look at the beginnings of companies like Twitter (blogged about by prominent bloggers) and Facebook (published by the Harvard student newspaper), the initial snowball effect to get these companies going is largely based on journalists pushing these startups to their readership.

And now we have the case where a company that has successfully navigated the hardest part of the cycle (becoming a big enough snowball to be self-sustaining) that they can turn around and challenge the journalists.

It's like a child who has grown up and now comes back to challenge the parent. Fascinating in an abstract general way.
How can we be notified of your release? Do you have a github that I can follow? Thanks!
> malicious wifi operators

Malicious GSM operators as well.

"Fake cell towers" are rampant across America and operate without warrants. Thats why the police are trying to hard [0] to protect their existence. There is a new project today announced to track all the IMSI catchers around America: https://www.indiegogo.com/p/1016404

These tend to be used to track locations of people but they can also be used to intercept SMS and mobile internet traffic.

[0] http://www.baltimoresun.com/news/maryland/baltimore-city/bs-...
U.S. Gov Insists It Doesn’t Stockpile Zero-Day Exploits to Hack Enemies
It's both. Internally, the company views it as a recruiting tool. The devs think of it as for the community as well has helping their resumes/cvs.
No, it isn't. This culture of "words mean whatever I want them to mean" is ridiculous. His statement does not express hatred of women. So it is not misogynistic. Turning misogyny into a buzzword that everyone ignores because it is never used appropriately is not beneficial.
My concern is that your reach is too far. Asking domain administrators to trust your software to manipulate private keys (and server configurations) is as troubling as asking end users to click past security warnings. The whole purpose of the CSR is to obtain the signed certificate without putting the private key at risk. This decoupling isolates the challenge of identity verification in a reasonable place (nobody is saying it's easy). With your client, you're essentially telling people you accept checks or credit cards, but only if they show you their gold. It sets a bad precedent.

I do want your certs for free! But I also want/need to trust you and know that you're following best practices, not just with me but with everyone.
This Hackathon should be international :)
How easy is it to build your own packages from, say, the tip of the master branch of github repository? How automated is building the dependencies?

Building packages on Debian like systems is a huge pain. Arch is much better but I need Debian/Ubuntu-like reliability.
If the user typed www.mybank.com, let the server redirect to https but don't show the lock icon if it's self-signed. This is no worse than an impostor that just doesn't redirect to https.

If the user typed https://www.mybank.com, show the usual warning for self-signed certificates.
That person in the video is utterly handsome. I'm sure you don't know them, so I thought I'd point it out.
Will Generation Z Disconnect?
At least first timers are learning what they are coming for...
Kind of weird to see a picture introducing the tablet and it has the letter "F" written on it.
This is awesome! I've wanted to build something like this for a while, but never gotten the chance :). Better tools like this are essential for helping users accept and reject the correct edits, and making it easier to investigate when reversions might be unjustified.

The only problem I noticed is that clicking the footnotes does not work, which makes it harder to evaluate the legitimacy of an edit (well, it just means I have to have the current article open as well).
Whoops, apologies. Accidental mobile downvote. Appreciate the link and knowledge.
Solving the future with abstract algebra
To those who have seen the remains of structures exposed to floodwater, this will seem unlikely. The way to deal with floods, if you must live on the floodplain, is to build levees, berms, dikes, etc. Huge piles of rock and dirt, miles long and scores of yards wide, stacked and compacted by hordes of zero-skill labor. Not tiny little stone walls, crafted by masons who would have been among the most skilled artisans a Stone-Age society could have.
And isn't the message encrypted before it gets to the baseband?
This is such a confusing product page. One of the email examples halfway down the page actually has Lorem Ipsum in it.

The first demo video, showing a "Client Meeting" at 10am, doesn't make any sense from a design perspective - a user taps on the meeting, only to receive a modal dialog that has no more information than what was already on screen. Worse yet, the "Options" button opens a nested modal with more options, on which the demo user taps "OK."

If IBM is trying to show their aptitude for designing frustrating user interfaces, they're doing a good job.
Ben Heck's Apple 1 Replica Part 1
3D Printed Robots Teach Themselves to Move
>are we forever doomed to have multiple package managers for the dot product of [operating system]X[development platform]?

Did you, by any chance, mean Cartesian or direct product?