skysight-inc/HackerNews huggingface dataset:
Thalmic Labs Shuts Down Free Developer Access Update: It’s Back Again – Hackaday
When you're doing well is often the best time to raise money, as you can get more favorable terms.
As a convention, there ought to be a [paywall] tag appended to the title in these cases. IIRC HN already uses [video] and [PDF].
It's not about "where to direct the SSL request". It's about selecting the correct server certificate.

The handshake goes something like this: the client opens the connection and sends several parameters (in the clear). The server replies with its parameters (in the clear) and its certificate (in the clear, and it includes the domain name). Both sides exchange the key to be used (encrypted), switch to encrypted mode, and verify the handshake.

Notice that, even without SNI, the hostname is already sent by the server, in the clear, within the certificate. That poses a chicken-and-egg dilemma: the hostname is sent to the server after the handshake is finished, but the server has to present the correct certificate before the handshake is finished. The solution was to send the hostname (and only the hostname) at the start of the handshake. It's no big deal because the certificate hostname is already visible in the next handshake step.

For Tor, it's no big issue: it just manufactures a random hostname and presents it. Tor would have to do it (in the certificate) even without SNI. When using Tor, this does not compromise the domains requested by the browser, since they are sent directly to the exits within the triple-encrypted tunnel; only the chosen exits can see them.
GUEST RANT: HAM RADIO – HACKERS’ PARADISE
> The solution is absolutely not to have browsers accept self-signed certificates though. The solution is something nobody hasn't quite come up with.

We do have a solution that does accept self-signed certificates. The remaining pieces need to be finished and the players need to come together though:

https://github.com/okTurtles/dnschain

If you're in San Francisco, come to the SF Bitcoin Meetup, I'll be speaking on this topic tonight:

http://www.meetup.com/San-Francisco-Bitcoin-Social/events/18...

Let's Encrypt seems like the right "next step", but we still need to address the man-in-the-middle problem with HTTPS, and that is something the blockchain will solve.
Why Python Is Slow: Looking Under the Hood
I'm just expecting honesty, is all. I don't feel the EFF is honest in its approach to its stances, and that makes me worry that their positions aren't defensible.
Josh Waitzkin: Recurring Problems Have Both Technical and Psychological Roots
Yes. It's either a value that implements the 'error' interface or nil.
So Nokia sold their worthless Windows Phone part and started making android devices a year later? Their strategy is suddenly making sense.
Flow – A static type checker for JavaScript
I disagree.

While there is no doubt you are correct that a baseband attack is possible, it's a much, much harder task for a Telco to get control of your baseband, start poking around in it and reading your private messages via this channel. Has there been any released code that exploits this?

They easily have the technology now to read all your SMS and capture all the data you send. If you can crypt this, you're much better off from a privacy and security perspective than if you don't.

That's what's important about this announcement.

Your BIOS might be spying on your, or your hard disk, or your wifi card, your video card.

This offers good, strong protection for a lot of the attacks your data can be subject to. Not every attack, but the majority.
McNulty.
Is it really? Finance the most likely aggressor (Germany), don't fight for them. Then be of no strategic importance for any other invading army. No one wants to march their army over the alps to get somewhere.
Figures for Iceland were actually extrapolated from figures for Britain. In all the index is pretty seriously flawed. Some countries are being ranked in the complete absence of any slavery data to justify a ranking.

http://www.economist.com/news/international/21631039-interna...
I'm not a paywall advocate, fwiw. I think it's a suboptimal monetization strategy that often directly conflicts with distribution and UX. That said, I don't think it's ipso facto ridiculous. There are better ways to monetize, but not monetizing is not an option for WSJ.
Facebook Spins “Groups” into Separate App
(Dupe of https://news.ycombinator.com/item?id=8625272.)
You become popular enough, you will attract all kinds of people to your platform/service. Including ones you may not want to be associated with.

But this is great news for Teespring. Congrats to the team.
Four things:

(1) You can do the attack you describe today with existing CAs that are issuing DV certs because posting a file on the web server is an existing DV validation method that's in routine use.

(2) There is another validation method we've developed called dvsni which is stronger in some respects (but yes, it still trusts DNS).

(3) We're expecting to do multipath testing of the proof of site ownership to make MITM attacks harder. (But as with much existing DV in general, someone who can completely compromise DNS can cause misissuance.)

(4) If the community finds solutions that make any step of this process stronger, Let's Encrypt will presumably adopt them.
Can you point to a single reference anywhere dealing with calculus on the reals that is lazy enough to use infinity as "meh, I don't care if it's positive or negative infinity"? Even one? I've never seen it, and I've taught calculus to college students for nine years.
African slaves count as slaves under this definition.

I'm not sure why you brought that up - that's not controversial.

They include significant to cover cases of bonded labour or trafficked workers. In theory a woman traffiked from one country to another and forced to work as a prostitute is free to go the that country's police forces to report the crime but we know that they don't actually have that freedom.

See also people who are transported to another country and have heir passports taken from them.

Here's a gruesome article about bonded labour in India.

http://www.bbc.com/news/magazine-27486450
I didn't say you had to use them. I said that when you come out and say "I'm boycotting X because they violated SOCJUS law" you help them more than you hurt them. Because the number of people who think the PC/SJW nonsense has gotten absurd is much higher than the number of people who think it is cool.
Building the Dropbox “Design Cabin”
There's actually been at least one phone (in the UK) that uses an x86 chipset:

http://www.cnet.com/uk/products/orange-san-diego/
I'm curious as to whether Firefox's sync functionality propagates CA overrides across machines. If not then this is something you'd have to repeat over for every machine you use, making it effectively too tedious to be practical.
Uber is not entitled to investigate by delving into private details of people, though. And just because Uber happens to hold that data doesn't mean they're entitled to grovel through it for whatever purpose they feel like. If a journalist gets into a fight with a hospital, should that hospital be entitled to use the journalists's private health records to fight back? I say, of course not. Uber is in the same position qualitatively. Of course, in the case of the hospital it's actually illegal while for Uber it's probably not, but that's just because the law on privacy is way behind the times.
Something I don't understand about FPI is my sister in law's public school is FULL of FPI stuff although technically they can only sell to the feds. I believe there's a lot of "pass thru" and "non-surplus surplus sales" going on in the prison industrial complex. I suspect there's a lot of "Well, sorry about no federal funds cash this quarter, budget crunch and all that, but here's some nice FPI desks made by prison slave labor". The quality level of the carpentry work, both labor and materials, is usually pretty high compared to Chinese slave labor which always kinda surprises me. I wonder if folks closer to public schools than I am, see as much FPI as I do.
"At least ten, the company says, have become millionaires from the work."

Does this mean they sold a million dollars plus worth of shirts OR that, after all expenses, they netted a million? The phrase millionaire implies the latter but that is a far higher bar to cross.
This page stays white loading until I hit stop. I assume because of the images.

w8.1x64 chrome 38.0.2125.11m x64
Kudos to the EFF for making an easy-to-use tool to generate TLS certs!

Kudos also for creating the second CA to issue free certificates (the first being StartSSL).

The next step needs to be to man-in-the-middle (MITM) proof these certs. We still have to address that problem. We'll be talking about how the blockchain can be used to solve this problem tonight at the SF Bitcoin Meetup, if that interests you, you're welcome to come:

http://www.meetup.com/San-Francisco-Bitcoin-Social/events/18...

A primer can be found here: https://vimeo.com/100433057
As others said - grow faster than your current cash allows. You don't want to have scale just to support your current customers but be able to scale to support your future customers.

One example that was mentioned in the article was building a factory. Obviously that requires a huge chunk of capitol but will allow the business to grow to fill the market that they have confirmed to exist.

edit: typo
This is a possible loophole, yes. However, if the repo author intended to work with functions of a complex variable, then why aren't the integrals in the README contour integrals?
Without some kind of authentication, the encryption TLS offers provides no meaningful security. It might as well be an elaborate compression scheme. The only "security" derived from unauthenticated TLS presumes that attackers can't see the first few packets of a session. But of course, real attackers trivially see all the the traffic for a session, because they snare attackers with routing, DNS, and layer 2 redirection.

What's especially baffling about self-signed certificate advocacy is the implied threat model. Low- and mid-level network attackers and crime syndicates can't compromise a CA. Every nation state can, of course (so long as the site in question isn't public-key-pinned). But nation states are also uniquely capable of MITMing connections!
I had the same thoughts as you while reading the article and I can only imagine you are being downvoted by nationalists who aren't happy at the suggestion that the Harappans weren't writing Sanskrit epics on their pots.
I use this example myself quite a bit, although we've also got to figure out the distinguishability from page sizes issue. Different Wikipedia pages are different sizes, and they're still different sizes when they're encrypted.

One interesting idea I heard from someone recently is tuning compression so that you target a small number of total page sizes -- rather than padding to expand pages to the same sizes, just don't compress them all quite as well as you could have.
it might be fair to say that it's taken longer to release than the devs anticipated or hoped. but the good news is that anyone here can contribute to the code and help to change that!
Ultimate Voice Control Showdown
Ron Gilbert, creator of Monkey Island, kickstarts the “spiritual successor”
That's nuts. All of your code now has to check if err != nil, etc.

Furthermore, the sendEmail and validateEmailForm values are essentially ignored and used only for their possible error values.

Why should I wrote my program as if the thing I'm concerned primarily with is errors? Much better to encode the failure into the type. You could have, for example, some function that returns Either[Error, SendEmailAction] where SendEmailAction is a function that, when called, will perform the effect of sending an email. Now I can deal with the happy path by mapping on the right-biased Either.
Ask HN: Anyone else getting invalid cert for HN?
In Chrome, I'm now getting NET::ERR_CERT_AUTHORITY_INVALID when trying to load https://news.ycombinator.com/.

If I open up Safari or FireFox, it loads fine...
But when you browse over http, you don't know who you're talking to either, so how are self-signed certificates worse than http?

I'm really having trouble figuring out the attack scenario unique to self-signed certificates that you don't have with plain http.
You misunderstand. Domains must not be free, and domain cost isn't the problem. Nonprofit registrar != free domains.

The problem is the horrible user experience of registrars like Godaddy. I'd rather give my money to a nonprofit that isn't confusing non-technical website owners into buying products they don't need.

The registrar landscape is better now with Gandi, but still I'd rather pay a fully transparent nonprofit registrar if one existed.
This is just a typical Prisoners' Dilemma scenario. An individual company can gain an advantage with dirty tricks, but everybody is worse off if all companies try it.

The optimal position (with no dirty tricks) is unstable. We stay there by punishing those who deviate. This is why the pitchforks come out in cases like this.
Modern design for Norway's passports
See this article on this topic:

https://whispersystems.org/blog/contact-discovery/
It's significant that, rather than disclose their cell tracking methods, the police and prosecutors prefer to discard the evidence. This suggests that obtaining evidence is not the primary purpose of the tracking technology.
You are far from the first. Many, many years ago, I made a more embarrassing mistake. I insisted in a job interview that OCaml was dynamically typed because it didn't require explicit typing. (To my naive eye, it "looked" like a dynlang). When I realized that I was interviewing with an expert, I backed off and admitted that I was wrong, not entirely sure why but not about to argue with someone who knew the language in depth. (And, of course, I was wrong.) I still got the job.

I'd actually argue that strong vs. weak is a continuum and somewhat subjective. One of my gripes with Scala is that the type system (as used in the field) isn't strong enough. It will implicitly auto-promote types in ways you might not want (i.e. List[Int] :+ String = List[Any]). It can be a strong type system, but the quality of programmers has a huge influence on your experience with Scala. If you have bad programmers who do things the Enterprise Java Way, you can quickly end up with compile-speed issues. But that's another rant. Scala's great for mid-sized projects or when the developers are strong.
Attic – deduplicated incremental encrypted backup
I just bought a cert on Saturday for $9. It's less than the domain name.
Tony Hawk Rides World's First Overboard
But taxes aren't right?
Very nice. I hope GitHub will integrate it.
Rush Holt, physicist and congressman, to lead AAAS
The NSA can do this, yes. But, any CA that issues a fake CA for Google will be found out rather quickly, and then will get blacklisted and lose business.

So while the NSA can technically do that, they only get a few shots cause each one has a high chance of burning the CA.

For lesser sites and narrow targets, this may not be true.
Try this link: https://itunes.apple.com/app/id931735837
ARM TrustZone. It controls access to various hardware. Other software, including the kernel and baseband isn't supposed to be able to even observe its state. There's a base set of functions which handset vendors can add to. Of course, it has vulnerabilities too.

I haven't heard of any process hardening going on though. Do you have a source for that? I want to learn more about it.
I've never heard of the Barbie franchise not fucking it up. "Math is tough" Barbie was more than two decades ago; the adults designing current Barbie products were likely playing with the Barbie products of that era, yet it seems like nothing was learned.

At this point I think it is safe to say that Mattel honestly does not care how many people Barbie offends. They probably have sales numbers and market research that back up their approach. I can't imagine they would feel comfortable continuing down this path otherwise.
Not just the NSA, but anyone with the motivation and resources to attack cell phones (e.g. organized crime).
> With some browser behavior self-signed certs could make some users safer against some threats

How exactly? Did you read my linked comment?

As far as I can tell, self-signed certs are always a no-no. As soon as one is compromised and has to be revoked the whole system breaks apart.

The only situation where a self-signed certificate makes sense is when you control both ends of the communication and can revoke the cert on the client yourself.

In the age of WiFi, you can't dismiss active attacks.

EDIT: Again, whoever is downvoting can downvote all he wants but I'm still right. If I am not, prove it via comments, not downvotes, and we'll be able to discuss each other's views.

Even parent's Tcpcrypt link says it is vulnerable.

> By default Tcpcrypt is vulnerable to active attacks

> Tcpcrypt, however, is powerful enough to stop active attacks, too, if the application using it performs authentication.

How are you going to perform authentication via insecure channels without CAs?
Yes, and it has been great. I recently had to diagnose a problem in some software and its dependencies, and I needed a quick way to try different build flags and dependency versions. Nix's deterministic builds (and having access to all of the packages definitions in one location) are a huge help here: it only took a couple seconds of configuring between each build, and I quickly isolated responsible library/version out of a couple dozen deps.
Anything that gives Heathcare Triage exposure is worth it in my book. It's great stuff, regardless of Dr. Carroll's personal vendetta against milk. :)
IANAL, but I don't see why the detective shouldn't be held in contempt anyways, along with the prosecutors. It's nothing short of a blatant attempt to deceive the court to present "evidence" in the first place when you're not prepared to observe the defendants' due process right to confront witnesses and have access to evidence. As soon as the so-called evidence was put before the court, the detective and prosecutors should have had but two options: provide all details to the defense or go to jail. It's highly preferable that a murderer go free than the government be allowed to claim private contracts with domestic spying providers, contracts to which the detective and prosecutors aren't even party, are "national security" issues. It's disgusting how the detective on the stand expected those magic words to waive the defendant's rights when told to the judge, if the article is to be believed.
The US government, FBI and NSA don't mind doing that, why should Uber and other companies obey the law if federal agencies refuse to?

/devil's advocate.
Thimbleweed Park: By Ron Gilbert and Gary Winnick
It's not the sort of thing you should have to aprse in the first place. There's a narrow set of circumstances in which some family issues might be legitimate to discuss, eg if a journalist's spouse or other immediate relative was a senior officer or investor in a direct competitor - but then you could just say 'we think X is an unethical journalist because s/he has a major conflict of interest which biases articles s/he writes about our firm' because there's plenty of precedent for dealing with such issues in the world of financial journalism.

Vague talk of investigating 'your families' comes off more as an attempt to intimidate; arguably the vagueness is intended to provoke anxiety and worry to a greater degree than a specific allegation (as above) that could be refuted or debunked.
It's simplicity - CafePress's website is complete chaos whereas TeeSpring is dead simple.

Rudimentary comparison: there are 422 <a> tags on CafePress's home page and only 47 on TeeSpring's

Further, once you're on a TeeSpring product's page, it's the only product there (focused call to action to buy that one product being marketed) compared to CafePress where the product page has a bunch of other "similar" and "recommended" products diluting focus.

May be counter-intuitive but adding more options seems to be to CafePress' detriment.
Pivotal DataScience Looks  Climate Change in Acadia Natl Park: Day 1 Field Rpt
JSON Generator: Create Random, Structured JSON Mock Data with Finesse
This is interesting. I think that natural language generation is a largely overlooked task outside of machine translation -- perhaps because most tasks that might require it can get away with the much stupider, much easier job of filling in templates like a form letter. It's cool to see Google attempting the real thing, on top of the image recognition.

That said, I don't expect particularly high accuracy from the composition of an image recognition system and natural language generation. The first actual demo of this is going to be a source of utter hilarity. I hope they're okay with that.
Something like Certificate Transparency would counter that - where the browser can only accept certificates that have been made public record. So the owners will at least know when their domain has been attacked.
The Science Behind How We Learn New Skills
Very nice. I wonder how hard this would be to throw into Jasmine/QUnit type scenarios.
Android Auto APIs Now Available
There are targeted attacks, and there are dragnet attacks. If the NSA wants to own you specifically, I don't think you can hide.

Moves like this one, though, are fantastic at making mass surveillance much harder, and I applaud them with as many hands as I can borrow.
Automatic unconfigured behavior is bad, but something like a ssl_certificate_auto directive that's in the default config would make a lot of sense.
'Barbie' and 'f...' generate a lot internet traffic.
This is what I wished Typescript was.

Looks really handy.
Cert looks fine in FF: https://i.imgur.com/W7RWBhw.png

Also no issue in chrome (39.0.2171.65 m): https://i.imgur.com/tEQVCP6.png
NEMO-UX Shell Is a Futuristic, Multi-User Wayland Experience
... then Travis is playing right into their hands and feeding the troll.

Personal flame wars on the net are one thing, but involving your company in that shit? The minute you take money and hire other people it's not your personal sandbox. This 4chan crap should at best come with a huge "my opinions are my own" disclaimer and should never involve your company.
> Often times animal predators are detoured by wooden fences

Heck, often they're repelled just by the sight of fire or a solitary guard.

More often than not the less-timid ones just scavenge human scraps, return, and start to hang out. This is how dogs became domesticated many thousands of years ago...
Nope, looks okay here.
Sha1 Thumbprint follows:
‎da 4f f2 2d 77 27 ca 03 7e c4 5a cc e8 0a 8c db 97 c2 32 2f

TLS 1.2
and
AES 128 GCM
ECDHE RSA

What do you get?
Wow that is so lame, I wonder if the author [1] of the book is a real person. Basically the author sends the message that all Barbie will ever be good for is design and sending the 'hard stuff' out to the boys to get done.

[1] http://www.randomhouse.com/kids/catalog/author.pperl?authori...
Chrome's incognito mode is a good solution for this too.
All of the modern dynlangs (e.g. Python, Ruby, Clojure) enforce type safety.

Well, a lot of them. Some are weakly typed, and IMO weak typing is genuinely damaging whereas I'll concede some room for the static/dynamic debate.

Example: What's "1" + 1?

Answer: In JavaScript, it's "11". In PHP, it's 2. Meaning it's possible that it could mean two different things in the same file.
> we can easily shoot ourselves in the foot. We might mistakenly write Email("hello", "jason", "jason@gmail.com", "body of email"), for example.

I would just solve that with keyword arguments. Or, in Javascript, have the constructor take an object whose keys are fromAddress, toAddress, etc. (Pretty much the JS/ES5 version of keyword args.)
Someone in the article's comment thread posted Moxie's reply to that very same question: "Very unlikely".