skysight-inc/HackerNews huggingface dataset:
Yes. That's not perfect. But it raises the bar for forgery to "can sign certificates as a root authority", which is still fairly high. (e.g. I can't do it, and neither can you.) It stops coffee shop/hotel wifi operators and mobile providers from injecting content into your session.

If we encourage users to blindly accept self-signed certificates (giving us end-to-end encryption but sacrificing identification), nothing would stop those actors from altering your HTTPS sessions as easily as they alter your HTTP sessions today. It's throwing the baby out with the bathwater.
I just downloaded it to support them. The more absurd the PC bullshit gets, the more the rest of us will push back just to spite you. I can't wait for my new shirt to arrive.
Putting someone's credentials into question is not necessarily an ad hominem.

But in any case, you seem to have missed this bit: "The protocol they invented is flawed. Here is a nice blog post explaining why."
Vitamin for your phone – extend battery life
Oh, our software does NOT send the private key to the CA. Never never never never. The point of having it manage the keys is not to give us access to them, it's to be convenient for the end-user, on the end-user's own system, under the end-user's control.

You can tell because our software is open source, written in Python.

https://github.com/letsencrypt/lets-encrypt-preview

We expect the users to get this software from their operating system repos, like from the Debian package repository -- the very same place they get their Apache or Nginx packages. We are not asking people to get the software directly from us, or to use it without being able to read it and check that it's safe and does what they want.

Edit: And if you want to implement your own client, we encourage you to do that -- the more clients the merrier!
Unlikely. Yet they will share the same level of secrecy and encryption for their communications now.
Sh*t developers say to recruiters
Threema doesn't.

https://threema.ch/en/faq/identity_expl
I don't think the comment was made to threaten her children, but any parent who hears those words is going to think about their kids first, and become very defensive.
Yet there are tons of obnoxious people who didn't. It's not a misconception. It's a reality.
I suspect that the information pulled form the journalist's profile was pretty innocuous, or else they would have made more of a big deal about it.

But at the same time, the point isn't that "the Uber GM found some hideously private information about the journalist," the point is that regardless of what their "information policy" is, the GM could access the account of the journalist, and was apparently comfortable doing so based on his own discretion and sense of propriety rather than explicit permission. If his sense of propriety was fine, and the information was innocuous, then that particular event wasn't a big deal. But it kind of makes lie of the idea that another high-level individual at Uber who may have, shall we say, different ideas about propiety could not abuse the information that Uber is entrusted with.
Eventually maybe the browsers will do that. Currently far too many websites are HTTP-only to allow for that behavior, but if that changes and the vast majority of the web is over SSL it would make sense to start warning for HTTP connections. That would further reduce the practicality of SSL stripping attacks.
The most interesting question to me would be, does this means that the server administrators now have a "get out of jail free card" due to the "fruit of the poisoned tree" doctrine or similar?

That would require the defendant's rights to have been violated. I'm no doctor of law, but even if they were slipshod enough to violate rights in investigation regarding the datacenters, I'd be surprised if the defendants rights were the ones violated (3rd party doctrine and all).
I literally have no idea what you mean by this. Are you trying to imply there are people who write bug free code? If so please point me in their direction.

People make mistakes. Systems should be designed for this expectation. If mistakes are extremely costly it implies you should use certain tools and development methodologies, if not you can use others.
I've not used coinbase yet so forgive the question, from what I remember the smallest bitcoin transaction fee is 5430 satoshis, or about 2 USD cents today. That's 20% of a 10c tip, who "pays" it? (the tipper, coinbase, or the recipient?)
The definition of slavery according to them:

Modern slavery involves one person possessing or controlling a person in such as a way as to significantly deprive that person of their individual liberty, with the intention of exploiting that person through their use, management, profit, transfer or disposal.

I would like to know what significantly means. Were African slaves in America "significantly deprived" or just "deprived".
Haha, thanks! I mean, I'm sure they'd thank you.
The lets-encrypt demo makes it look like you could easily script cert acquisition for new subdomains. And the CA domain validation appears to be totally automated (and fast).
Thanks!

Hadn't noticed that footnotes issue, but I'll add an issue to the GitHub repo: https://github.com/twg/wikiwash.
It's on a slope I believe.
iOS 8.1.1 Brings Bug Fixes, Hope for iPhone 4S and iPad 2 Device Owners
If you can make microsoft.com serve up the correct challenge response, you'll be able to get a cert for them issued by the this project. This isn't a pure rubber-stamping service.
That assertion is what the parent questions. Repeating the assertion as if it were fact does not actually prove anything.
I would suggest impersonating other encrypted protocols with heavy traffic like encrypted BitTorrent or P2P Skype (is it still P2P or MS centralized it already?). On the other hand, systems administrators are frequently blocking BitTorrent and Skype traffic so the "TLS" traffic on port 443 has more chances to pass.
We hearing that hopefully when it warms up and gets closer to the sun it will wake up and start transmitting again.

Do they have an estimate of when it will be destroyed because it's too close to the sun?
I think your theory might be chicken-and-egg. Without access to the website easily, companies don't have a real reason to invest in Chinese language versions of their service.
Great news, WhatsApp needs all the help it can get on security matters.

https://www.eff.org/secure-messaging-scorecard
http://www.thoughtcrime.org
I'm hoping that one day soon, I'll be able to remove this line from my nginx config:

ssl_certificate /path/to/file.crt;

My web server will notice that I want SSL, but haven't specified a path to a cert. It will then go off and generate one and get it signed automatically using an API like the one being discussed. It will also handle renewing automatically when the time comes.
Japan Tests Its Own Hover Train
Personally I think the idea that life/prebiotic soup came to earth on a comet is suspect, for the reasons explained in these blog posts and the links therein:

http://sandwalk.blogspot.ca/2011/11/nasa-confusion-about-ori...

http://sandwalk.blogspot.com/2009/04/can-watery-asteroids-ex...

Two problems with the 'organic asteroid' theory are the 'racemization problem' (how to explain why life only uses L isomers rather than both the L and D isomers present in meteorites), and the fact that the amount of organic matter in meteors is tiny. Compare that to the opportunities for life to arise on earth in its diverse chemical environments.

See the calculations by Jeffrey Bada discussed in the second link.
Show HN: Taiga.io + GitHub = Love?
Taiga.io now integrates with GitHub! If your code lives on GitHub, you'll love how Taiga's Free, Open Source, Agile Project Management sits over your code. Enjoy!

https://blog.taiga.io/taiga-dryas-hookeriana-release-v130.html
In the same story that they talk about digging up dirt on reporters' families, Uber revealed details of a different reporter's movements to her, without her consent, and supposedly an impossible thing to do. Is it such a stretch to think that revealing details about your family + revealing details about your movements and location could also = revealing details about the movements and location of your family?

Again, read Sarah Lacey's rebuttal piece in PandoDaily. Her first thought after hearing about the threats (by phone) is for the safety of her kids, who are not with her at that moment.
First thing I thought when I read the description of the name. Ironic much?
GNU emacs as mail client with multiply accounts
Ask HN: What router do you recommend for DD-WRT
I'm looking for a high end AC+N Router (B/G would be nice as I have some older devices but worst case I run my older router just for them). I saw the new Linksys [0] router that generated a fair amount of buzz but it doesn't support DD-WRT (yet) and there is no guarantee that it will [1]. I'd love to hear what HN users are using.

[0] http://store.linksys.com/Linksys-WRT1900AC-Open-Source-Wireless-Router_stcVVproductId158014980VVcatId551966VVviewprod.htm

[1] http://www.dd-wrt.com/site/content/dd-wrt-linksys-wrt-1900ac
I don't feel obligated to spend time defending my position.

If you're interested, I recommend you check out the EFF's press releases about CISPA, and then compare it to what's on Wikipedia. They just make a number of legal leaps that aren't founded in any kind of law, amounting to a fearmongering argument no more valid than screaming, "BUT FREEDOM!!!!" too loudly for anyone else to object.
Users do not need to build everything for themselves. They can download binaries from the build farm, just as if they were using a binary-based distro. The system is transparent: If a binary is available from an authorized remote machine, Guix will pull from it. If not, Guix will build it locally.

To respond to security updates to core packages a lot faster, we are using a technique called 'grafting' that doesn't involve full rebuilds.
This article is specified in the post as the origin of the disadvantages of include mechanism.
The language you use makes it seem like this guy threatened to physically hurt people's children. That's quite manipulative, especially your choice of emotional words such as "vile" and "terrifying".
> A senior executive at Uber suggested that the company should consider hiring a team of opposition researchers to dig up dirt on its critics in the media — and specifically to spread details of the personal life of a female journalist who has criticized the company.

Is it at all relevant that the journalist is female?
Guix is based on / inspired by Nix, but using Scheme instead of a custom DSL.
Chinese students who study abroad are "oriented" in official programs before they go abroad. Some may be more influenced by those orientations than others, but that's a much more comprehensive program in China than anything like that elsewhere. When I left the United States to study abroad, I had no government-sponsored program to get me ready for that experience at all.
It would be nice to have support for ECDSA certificates. I've not found a CA yet who'll provide one of these, despite the fact that many clients to already support them. Unfortunately, after a brief look through client.py I can't see any support for this.
Is there any good way of filing an RFE or contributing a patch?

ECDSA certs are much cheaper to decrypt, and there's still some places (especially mobile) where TLS is a noticeable overhead - it'd be great to have a CA that provides them.
Trades internal to Coinbase don't have to happen on the blockchain.

Source: http://blog.coinbase.com/post/57483182558/you-can-now-send-m...

If decentralized microtransactions could be done at sufficiently-negligible (sub $0.01? ) cost, I think it could have a major impact on the web. Nobody's yet figured out how to make it effortless, though. This implementation from Coinbase doesn't appear to be different from Flattr, which hasn't yet taken off.

Edit: With further thought, Coinbase may have more users than Flattr, and they already have real money in their accounts. Those differences alone could be significant.
can't find any official statement from WhatsApp anywhere. Most of the sources just cite Marlinspike.
An issue with problems like this, that are obviously bad, is that only positive examples are tested, or only examples that would increase the estimate of the scope of the problem. I doubt the 'Walk Free Foundation' has tested equally for negative examples, and would look for ways to lower their estimates (as one has to do to fit reality).
> curl https://nixos.org/nix/install | sh

Installation instructions for nix. Although I'm not sure that arbitrarily running shell scripts from the internet is a good thing. When I install an OS X app from the internet, at least it's signed.
WebTrust audits are the bulk of the cost. We got quoted $150k for our first audit. This is a yearly thing too.

You also have to pay for your own cage in a datacenter, the HSM, validation staff, etc...
But still no clue if this is a web based application or a desktop ( aka Windows ) version?

It does look like it may have a mobile companion,either on smartphones or tablets, but other than this, is really low in details.
>You'll find that many people are very reluctant to give up that sort of information about themselves though

Erm. I suspect you don't realise that WhatsApp has over half a billion users. It's as large as the major webmail services and nearly as large as Facebook itself. Society has reached consensus on this issue very fast - phone numbers as your identity work well, and any app that wants to be accepted by the market has to work this way exclusively.
Impossible manufactured 1M instant film packs in 2014
YOUTUBERS ! LET'S GROW TOGHETER !
Hey guys , i'm a new youtuber
I want to grow up , by saying that , if is any youtuber heres share your channels so i can learn more !
Also , i want to get better at talking english so it will be very helpfull !
In the beggin of my videos i allways explain what my video is going to be about
It is in portuguese , so just skip it to the gameplay part if you want too
https://www.youtube.com/RepxzTV
2x : share your youtube channels so we can talk and subscribe to each other ! :)
Whatever happened to http://www.cacert.org/?
So this means that GoDaddy, Namecheap, Verisign and other sellers/resellers of SSL certificates will need to lower their prices soon, right? Because in a short time many websites won't need to purchase one since they can get it free.

Also, have they built this system with a completely scalable distributed architecture? For it to be practical it needs to be performant.

Also, does the NSA have access to the core of this system?
Care to elaborate, or are we just going to trade claims of logical fallacies all day (please kill me first)? Pinker is the prime exponent of a field (evolutionary psychology) widely regarded by other scientists as a pseudo-science. When I had him as a lecturer, his own TAs would ridicule the shoddy claims he made in lecture behind his back (e.g. that old one about how men prefer blondes because it reminds them of the savannah, I kid you not) and encouraged us to think critically about them.

Pinker is a great writer, and he's exposed a lot of people to new ideas. Many of those ideas are extremely bad and have little basis in evidence. He's also in dangerous territory alongside assholes like Charles Murray and the Thornhills.
"according to the German agency" I was under the impression it's a European agency...
“Pay What You Want” Experiment Results for Mattermark Startup Traction Report
Why I Hate Post-Internet Art
> Nothing can be man-in-the-middled passively, that makes no sense. That isn't what a MitM is. It requires active involvement by its very nature.

By this I mean record all form submissions done through HTTP.

>> In order for HTTPS self signed certs to be effectively man-in-the-middled the attacker needs to be careful to only selectively MITM because if the attacker does it indiscriminately clients can record what public key was used.

> I genuinely don't understand what you're trying to say.

The default thing we're trying to prevent is someone close to the server MITMing every request, recording each post, and reenacting them so that they are not discovered.

> If the MitM originates from a specific location (e.g. a single Starbucks, a single hotel, an airport, etc) it would never be detected by that method.

That is true for the example I gave which is just a proof-of-concept, but not true for a better method, like decentralization + public key signing.

What I'm fundamentally saying is that Cert + HTTPS is more secure, but it is not fully secure, since you have to trust the cert provider. Just in the same way, HTTPS without cert is not fully secure, but it is (much) more secure than HTTP.
KILL ALL THE MUTANTS (and make your code better)
roughly comes down to GDP per capita.
It's tricky as RAM was a lot slower, most of those were single core with hyper threading wheras these are quad core. Definitely interested in the same thing.
I see. How is it different from what students in 6828 have access to? Do they (you?) have access to skeleton code that boots?
Code that is bug-free and code that is free of security-affecting bugs are not the same thing.

For an example of an application that is currently free of application-layer security bugs, see my blog. It's not a CMS, I wrote it myself. Go ahead and try to hack it. :P
Agree. In contrast, when I worked at Amazon, customer privacy was pretty religiously protected.

To access detailed customer information required getting a one-time-use key, which is generated from a request that references other documentation (bug reports, customer support requests, etc) as well as a justification.

This key would only work against a single customer, and expires after some time.

The requests themselves are regularly audited internally to prevent abuse.

This is the level of internal privacy guarantees a company like Uber needs. No employee should have unmonitored, carte blanche access to customer data.
Your App Is Good and You Should Feel Good
A highly favorited comment on the io9 page says:

Mainstream archaeology's inability to accept these are proto
Hindu/vedic people is staggering. So much evidence, so much
conjecture... of course a culture followed it - it's called
"India". The colonial biases in Indology need to stop. The seals,
the standard measurements, the maths, etc - all are now present
in India today.

Most of Indology was written by colonial brits and germans in the
1800s who had a vested interest in suppressing's India's
knowledge and heritage. It has to stop.[1]

Let me preface this by saying that I do not know the quality of comments on io9 nor am I familiar with the quality of the content and authorship, there.

Having said that, let me ask the following:

1) Historically, have there been systemic pro-European biases in Indology research and scholarship?

2) Is this bias unique to Indology and not found in say Egyptology or Oriental studies or the study of other great civilizations of yester era?

3) Is there a generally well studied consensus among Indologists, about the origin of Indic peoples and the emergence of their society & culture?

4) I know Indo-European languages are generally well studied. So do linguists and phonologists generally agree on which proto-language(s) gave rise to the rest?

5) What is a good introductory text (or tome) that all students of Indology are assigned in universities across the world, the authority & veracity of which is generally uncontested?

[1] http://io9.com/mainstream-archaeologys-inability-to-accept-t...
is there a reason they don't use it on their own site (https://cacert.org/)?
2nd EDITION WORLD NEWS?FRACKING KILLS BABY'S
But you still base it on one example -- Maya. We were confused about it and assumed they didn't have wars but then we discovered they were violent.

I think the best way to proceed is to do neither (assuming they were peaceful or liked war) but just explore what is there.

There is also a confusion between war and violence. I presume "war" could be fighting with neighbours (other tribes, cultures) but violence could be internal -- brutal sacrifices, punishments, infanticide, and so on.

Another flaw or rather double standard I see in the argument is that you claim we/others imbue or fill the gaps of unknowns with "Gods" -- "Oh those irrational people believing Higgs boson is God" before we discovered that it isn't. But then you do the same -- you assume there were wars even though you admit there is lack of proof that there was any (understanding writings, discovering sacked cities) .
It's not enough to keep the snoops out - you need to KNOW you're keeping the snoops out. That's what SSL helps with. A certificate is just a key issued by a public (aka trusted) authority. Sites can also choose to verify the certificate: if this is done, even if a 3rd party can procure a fake cert, if they don't have the same cert the web server uses, they can't snoop the traffic.

Site: Here's my public key. Use it to verify that anything I sent you came from me. But don't take my word for it, verify it against a set of trusted authorities pre-installed on your machine.

Browser: Ok, your cert checks out. Here's my public key. You can use it for the same.

Site: Ok, now I need you to reply this message with the entire certificate chain you have for me to make sure a 3rd party didn't install a root cert and inject keys between us. Encrypt it with both your private key and my public key.

Browser: Ok, here it is: ASDSDFDFSDFDSFSD.

Site: That checks out. Ok, now you can talk to me.

This is what certificates help with. There are verification standards that apply, and all the certificate authorities have to agree to follow these standards when issuing certain types of SSL certificates. The most stringent, the "Green bar" with the entity name, often require verification through multiple means, including bank accounts. Certificate authorities that fail to verify properly can have their issuing privileges revoked (though this is hard to do in practice, it can be done).
truth be told, it doesn't make anyone safer. it's a big fat placebo, especially once the NSA realizes that this project is entirely under their jurisdiction.

Now, if there was a project in Iceland or Seychelles that was doing something similar, I would be much more apt to participate.
tjradcliffe's comment may have summarily dismissed some "well-considered theological positions" without explanation, but your defense of them with no evidence given is exactly the same but in the opposite direction. Rather than admonish, why don't you engage? If there are well-considered theological positions he's dismissing, I would like to hear them, and I'm sure others here would as well.
Who Killed Wikipedia?
Ban meetings: 4 practical alternatives to your normal meetings
I pointed this out in a comment a few days ago, but the era in handset design when basebands were unilaterally trusted is over. I believe modern Qualcomm basebands are firewalled off from the rest of the device using MMUs, they do not have the ability to do DMA and their firmware is significantly hardened using techniques like ASLR, stack canaries and even using a proprietary VLIW instruction set that is barely documented.

Handset makers and carriers all have strong financial incentives to harden the basebands against hacks because they don't want people unlocking their phones, which was often being done by exploiting bugs in basebands. Also, they need the airwaves to have integrity and mobile protocols are all based on the assumption of trusted endpoints that don't violate the rules. Now that DIY GSM base stations have become a reality, carriers face a nightmare scenario of someone running a buggy or malicoius "tower" that infects basebands of any phones that enters into range and starts them doing some kind of horrible attack against the carrier infrastructure. E.g. you can imagine an extortion attempt that works this way. It's in their best interests for their devices to behave predictably and be controlled only be themselves.