skysight-inc/HackerNews huggingface dataset:
Yes, because everyone that uses Gmail has been doing so for 10 years. /s

While we value the knowledge you have to share with us, there are words you can choose to convey that knowledge that won't leave you coming off so brashly.
Let’s Encrypt: Delivering SSL/TLS Everywhere
Seconded. I like reading and learning here. There is a lot I don't know. And that's cool. Most folks are in the same boat. Thanks for the comment.
This is not corporate culture it's politics. Personal destruction has been near the front page of the playbook since about forever.
I trust Moxie more than governments or companies, so this really makes me happy. If you've read things on his website (http://www.thoughtcrime.org) you'll know how important remaining secure from the government is to him. This is a huge step in the right direction. I'd also like to congratulate WhatsApp on their decision, I have a lot more respect for them now.

Congrats Moxie and team. You guys are doing a great thing for humanity.
Slavery is not actually very economically efficient. This is one of the main reasons the north had a much better developed economy. The problem is it’s limited to steady state production but you miss out on the increases in efficiency that drives compound economic growth.

EX: The first cotton gin was patented in 1793 which is 68 years before the American civil war. But, with cheap labor there is little pressure to improve it. http://en.wikipedia.org/wiki/Cotton_gin Sadly, it ended up increasing slavery in the south by making it more profitable, where a modern farm uses far less labor the south simply doubled down on cheap labor.

PS: There is actually a fair amount of evidence that Slavery significantly reduced US economic growth over time. Paid workers keep more of their output which is a non-issue from an overall economic standpoint, but they need far less supervision which is a large boon. There also more mobile and easier to fire and higher as needs change.
For me it was less about the data for beer (which in and of itself was brilliant) and more about them using government (and their own) money to set up small positive projects for local people.
This seems like a really great step toward an HTTPS web. It will be an immediately deployable solution that can hopefully TLS encryption normal and expected.

However, it doesn't do anything about the very serious problems with the CA system, which is fundamentally unsound because it requires trust and end users do not meaningfully have the authority to revoke that trust. And there's a bigger problem: if EFF's CA becomes the standard CA, there is now another single point of failure for a huge portion of the web. While I personally have a strong faith in the EFF, in the long term I shouldn't have to.
The monitoring was already there from the start (it's just being displayed differently), and this application is not part of Wikipedia's model, it's a third-party tool.

If you're complaining that edits are recorded and displayed publicly, you're thirteen years late. That was always the model of any Wiki.
This certificate industry has been such a racket. It's not even tacit that there are two completely separate issues that certificates and encryption solve. They get conflated and non technical users rightly get confused about which thing is trying to solve a problem they aren't sure why they have.

The certificate authorities are quite in love that the self-signed certificate errors are turning redder, bolder, and bigger. A self signed certificate warning means "Warning! The admin on the site you're connecting to wants this conversation to be private but it hasn't been proven that he has 200 bucks for us to say he's cool".

But so what if he's cool? Yeah I like my banking website to be "cool" but for 200 bucks I can be just as "cool". A few years back the browsers started putting extra bling on the URL bar if the coolness factor was high enough - if a bank pays 10,000 bucks for a really cool verification, they get a giant green pulsating URL badge. And they should, that means someone had to fax over vials of blood with the governor's seal that it's a legitimate institute in that state or province. But my little 200 dollar, not pulsating but still green certificate means "yeah digitalsushi definitely had 200 bucks and a fax machine, or at least was hostmaster@digitalsushi.com for damned sure".

And that is good enough for users. No errors? It's legit.

What's the difference between me coughing up 200 bucks to make that URL bar green, and then bright red with klaxons cause I didn't cough up the 200 bucks to be sure I am the owner of a personal domain? Like I said, a racket. The certificate authorities love causing a panic. But don't tell me users are any safer just 'cause I had 200 bucks. They're not.

The cert is just for warm and fuzzies. The encryption is to keep snoops out. If I made a browser, I would have 200 dollar "hostmaster" verification be some orange, cautious URL bar - "this person has a site that we have verified to the laziest extent possible without getting sued for not even doing anything at all". But then I probably wouldn't be getting any tips in my jar from the CAs at the end of the day.
I hope they do wildcard certs as well.
Let’s Encrypt: One More Step on the Road to TLS Everywhere
Yep. a bit more digging and I found out they do this: http://n1.nokia.com/ but without a 3g card, at least until their contract with MS runs out.
Hi all

I've been developing this app for a few months. This iPhone app (also Android app) allows you to send private video messages to your friends if you have their numbers in the phone book. To send a message, hold the profile picture of your friend (start recording), and then release it (stop recording and send the message). To watch a received video message, tap the profile picture of your friend.

This app is particular useful in the following situations:
- You have some close friends/boyfriend/girlfriend that you really want to "talk" to each other
- You have some friends who live very far away, maybe oversea, and you want to see and hear each other. Facetime doesn't suit because you are in different timezone
- You are lazy to type :-p

The app requires signup with username and password (this will be used when you move to another phone) and SMS phone verification (this is to make sure you can find your friends and vice versa via phone numbers). Of course, you need to tell at least one friend (boyfriend/girlfriend? :-p) to install the app so that you can send message to each other.

I keep improving it and make it more useful. I appreciate your feedback. Any bug reports and feature requests are welcome.
Most backups have very large areas of duplication. If a small file has changed, chances are that the small files around it have changed also. So de-duplicating with a larger chunk size seems to work fine in practice.
They should probably strip it from the login form, then.

As a mediocre web dev, that'd be my next step.
Great points tjradcliffe.

The basis for which to draw non-war status is the absence of ash, suggesting burning to the ground. That is a large leap. Applying this same standard, we could technically say the Egyptians never engaged in war as there are no ashen layers. Also, the Romans would be said to have engaged in war because of Nero's folly. The correct conclusion would be the simpler: The town/civilization was strong enough to avoid being sacked or designed well enough to avoid complete burning.

Walls are used to reduce the success of surprise attacks, provide a fortified position to defenders, and provide a means of access regulation; if there is no war, what is their purpose. This echos what Zeto says.
Mattermark Is Hiring an Engineering Manager
For my previous use cases, it's ideal for dynamically created subdomains of a web application. If I know ahead of time, it's easy to grab a cert for any subdomain. However if a user is creating subdomains for a custom site or something similar, it's much nicer/easier to have the wildcard cert.
It's not common, yes. Spirit and Opportunity come to mind.

Mars Express and Venus express were based on similar hardware.
Protectionism works like this. People in business worried that they're not making enough dough convinces fellow citizens that the way for the nation to prosper is by wasting additional money to produce those goods and services on one side of a line instead of on another. These local businessmen makes extra cash, tout their high-visibility success. Individuals and families who pay for this and spend less on other things (harming every other sector of the economy) are conveniently ignored.
> I'm running a 2560x1600 display on VESA

How does that work? For long I've lamented the fact that VESA/VBE caps at some not-particularly-high 4:3 resolution. Also, the lack of DMA & vsync...

Having a simple way to drive modern displays at a reasonable speed would be nice. The complexity of the accelerated graphics stack is depressing... and I don't really want or need it. Hell, I didn't need it ten or twenty years ago, so why now.
iOS 8.1.1 jailbreak and cydia download using pangu 8
I used the older uC-libc, not the newer uClibc (no dash in the name). You're right. There's a tiny leak in this version of setenv(), when you set a value for an environment var that already exists. It leaks the old value, which seems to be an intentional design choice, in case anything was holding on to a pointer to it.
I'm writing this as a throwaway because this feels like mob and pitchforks. I'm a regular here and have no ties to Uber except using it.

This whole story feels like they took a frustrated guy venting at dinner and making it into a conspiracy.

Meanwhile, Sarah Lacey comments publicly and insultingly on people's political positions, emotions, and dating life.

What the man said was very stupid. But it feels a lot like, "She wants to attack our sex lives, politics, and call us terrible people? We should dig in to what she's done."

That's still unacceptable, but seems like blowing off steam and being frustrated at someone who makes money off of being mean and generating outrage.

Again, the behavior is totally unacceptable. But making this out to be a conspiracy rather than a frustrated executive ranting at someone who is known to be rude and very personal about the rudeness and who gets paid on pageviews and outrage is a little much.
> "your families" = "your children"

I don't think that's a reasonable assumption to make. "Your family" could just as easily be referring to adult family members only (spouses, siblings, parents, etc.).

It seems like you're jumping to that conclusion solely because it makes his comments more inflammatory.
Works fine on my Oneplus one.
Thanks for the feedback! Yes an API is definitely on the roadmap.

The difference with bitcoin enabled micropayments and every other attempt at micropayments in the history of the internet is that Bitcoin is an open, interoperable network. Flattr, Beenz, Flooz, TipJoy, and others that have come before have been closed loop networks where there was significant friction and fees associated with getting onto and off of the network. When on the network, these has also only been one behavior possible-- tipping.

Bitcoin is an open, interoperable network where any amount of money can be sent frictionlessly anywhere on the internet. Perfect for micropayments, we think!
I don't get why they are releasing a command line, instead of just giving us a cert that we can install by ourselves.
InternetOfThings.com Domain Name Goes Up for Sale
I don't see how this actually keeps the CA PKI from being a scam. While I personally trust the EFF & Mozilla right now, as long as I can't meaningfully revoke that trust, it's not really trust and the system is still broken.
Get her an open source-y gadget
Brain Training – Learnist
Atlas and the Crane Kick
Not only is this huge by itself (600 million users with E2E encrypted messages by default), but I'm hoping this will put a big pressure on Google, Microsoft and others to adopt TextSecure's protocol (or something very similar), too.

This is how you deliver strong security to the masses. Not by convincing all your friends to adopt some weird and obscure chat app with the only benefit that it's "more secure" (most won't care), but by getting large service providers to adopt it and push it to hundreds of million of users without them even noticing.

Oh, and I assume that if Whatsapp adopted it, Facebook Chat isn't too far behind...right?
Uber and the Spirit of American Capitalism
Tips for improving app monetisation
Did it pop on with a warrant canary and reappear without one?
Is Apache slow in some obvious manner?

If so, wouldn't time be better invested in improving that?

Since the bulk of the web runs apache, that'd be the best way to improve the speed of the web, no?
I have found a few sites reject the + in gmail addresses. I also suspect most DB (or wannabe spammners) would know about this and remove anything after the + sign. Same goes for the "." trick. Still good to know though.

I'm now using Blur (https://www.abine.com/index.html). Very effective so far at creating aliases pointing to my real email. Only worried on how they'll fund their operations long term.
Three components:

1. Object recognition (there's dog and frisbee in the photo)
2. Object localization (Dog and frisbee's ROI in the photo)
3. Relation estimation (Based on X factors, the dog might be chasing the frisbee).

Not sure what you meant by spatial relations (localization?) but recognizing (what) and localizing (where) would be key to drawing relationships between objects.

Really impressive work but definitely not a leap.
But wait... Didn't Facebook Inc; Buy whats app for 19 billion? So does this mean Whisper Systems is working with 'facebook' on this...? Maybe i'm wrong...
Working link: https://whispersystems.org/blog/whatsapp/
Two things:

1. I really hope this is hosted in a non-FVEY territory.

2. Why can't we set a date (say, 5 years?) when all browsers default to https, or some other encrypted protocol, and force you to type "http://" to access old, unencrypted servers?
8-bit MacBook stickers – I'll donate all income of november to childrens hospice
Anyone along the way (like an ISP) could inject things into your webpage. Like ads https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-...
Some I have enjoyed:

The Left Hand of God Trilogy
The Bad Company series
Iain M Banks Sci-Fi
Philip Jose Farmer Riverworld
I'm using the '+' for automating email tests - using that and Gmail's API I can set up asynchronous tests against unique email addresses, and test them as they arrive. This is a crucial part of integration testing with partner companies.
You can revoke your trust in any CA at any time, you don't even need to see any errors! Just click the little padlock each time you visit a secure website and see if the CA is in your good books. If it's not, pretend the padlock isn't there!

OK, that's a little awkward. A browser extension could automate this. But in practice, nobody wants to do this, because hardly anyone has opinions on particular CAs. It's a sort of meta-opinion - some people feel strongly they should be able to feel strongly about CAs, but hardly anyone actually does. So nobody uses such browser extensions.
The warning pages are really ridiculous. Why doesn't every HTTP page show a warning you have to click through?

But it's not like MITM attacks are not real. CAs don't realistically do a thing about them, but it is true that you can't trust that your connection is private based on TLS alone. (unless you're doing certificate pinning or you have some other solution).
Can you give me an example of a research project that couldn't be used to make the world worse?
IBM livestream of their new email app
You can add your own CA to browsers.
HN has always been moderated at the post level, from the beginnings of the site. If it wasn't, the site would be flooded with fluffy recaps of whatever current event story was making people angriest right now, and there would be no place for stories about Linux on solderless breadboards and Latex-like math programming languages; instead, we'd get HuffPo, Buzzfeed, Pando, and ValleyWag's take on whatever the controversy-du-jour was, day after day.
I totally agree that CAs are a racket. There's zero competition in that market and the gate-keepers (Microsoft, Mozilla, Apple, and Google) keep it that way (mostly Microsoft however).

That being said: Identity verification is important as the encryption is worthless if you can be trivially man-in-the-middled. All encryption assures is that two end points can only read communications between one another, it makes no assurances that the two end points are who they claim to be.

So verification is a legitimate requirement and it does have a legitimate cost. The problem is the LOWEST barriers to entry are set too high, this has become a particular problem when insecure WiFi is so common and even "basic" web-sites really need HTTPS (e.g. this one).
Looks like the URL changed slightly. This works:
http://www.theverge.com/2014/11/18/7241011/whatsapp-rolls-ou...
The thing is, without a chain of trust, the self-signed certificate might be from you or it might be from the "snoops" themselves. Certificates that don't contain any identifying information are vulnerable to man-in-the-middle attacks.
It doesn't seem as magical when you drill down. And if you roll your own nginx or whatever, it'll be less transparent still. But yeah, someone like Ubuntu or Red Hat could enable this on their product that simply.

Domain validation is done through a challenge (issued by a CA) to sign arbitrary data and put on a URL (covered by the domain) the CA can then query. This seems pretty solid. Better then email.
Copyright for APIs is going to be a disaster, only the Supreme Court can stop it
Why? It is a new product (though based on the existing technology), a new model (cloud-based vs traditional Coverity on-premise), it is in free and unlimited beta, and we are soliciting feedback. Seems like a reasonable "Show HN", no?
Can we see some type of analytic; something that shows these stories are actually getting more than 5,000 views?
So, one CA to rule then all?

There's a scenario (simplified for illustration, but entirely possible) that's normally not a huge risk because there are many CAs, and they are private, for-profit companies that have an economic incentive to protect you and your certificate's ability to assure end users that a conversation's privacy won't be compromised.

1) browser requests site via SSL

2) MITM says, "let's chat - here's my cert"

3) browser asks, "is this cert legit for this domain?"

4) MITM says, "yes, CA gave us this, because of FISA, to give to you as proof"

5) browser says, "ok, let's chat"

I'm not trying to spread FUD, but if you're NSA and you've been asking CAs for their master keys for years, doesn't a single CA sound great (free and easy == market consolidation), and doesn't EFF seem like the perfect vector for a Trojan horse like this, given its popularity and trust among hacker types gained in recent years?
Since this doesn't seem to be ready to be fully announced yet, I checked last week and Open WhisperSystems is still looking for iOS developers to help. Moxie mentioned on twitter that security and crypto experience is not required, but they are looking for f/t devs not just p/t help.

Also they have a browser extension that could use some help from front-end devs:

https://github.com/WhisperSystems/TextSecure-Browser

It is still pretty early but the project has Bithub as well. From my understanding, this is their planned desktop version.
Finally, University Grads get opportunity to show their potential to employers
>Do they specify the build dependencies down to some sort of file-based checksum level?

Yes, Emacs 24.4 built with X support has a different hash than Emacs 24.4 built without X support. They are completey different in the eyes on Nix/Guix.

>So, what do you mean when you say "reproducible"? Is it really specific and unforgiving of new versions of things? Or, does it allow for newer versions easily?

In Nix/Guix, you have to specify the exact dependencies, nothing is implicit. Packages are built as a pure function. A package's identity is the hash of all its build inputs: source code, build system, and other dependencies. Bumping the version of a dependency triggers rebuilds of packages that depend on it.

I know of no other package management systems that treat package builds in this manner.
Closing SolarList: a cleantech post mortem
That wouldn't be safe, because then they would have access to your private key and impersonate you. Having you (indirectly via their script) generate the key and submit the public key for signing means your private key never leaves the premises.
Clubs and Societies: Connect and Organise Better with Huudle
Additionally, loose typing can be one of JavaScript's best features if used correctly.

For me, this is by far the worst feature of JavaScript.
So both works out to something that looks like an exponent value, and then the non-strct comparison evaluates them both as 0. The simple solution is ===.

A lot of luck having a hash with an 0e############ result.
This certificate industry has been such a racket. It's not even tacit that there are two completely separate issues that certificates and encryption solve. They get conflated and non technical users rightly get confused about which thing is trying to solve a problem they aren't sure why they have.

But a man-in-the-middle attack will remove any secrecy encryption provides and to prevent that, we require certificate authorities to perform some minimal checks that public keys delivered to your browser are indeed the correct ones.

You've got a point about how warnings are pushing incentives towards more verification, but they serve a purpose that aligns with secrecy of communication.
This makes sense but I think the same comment could have been applied to Firefox. But instead of improving Firefox(or in addition to) Google created Chrome.

Does Google typically improve open source projects or do they just rewrite them from scratch?
You can and I can but 99.999% of normal users cannot and will not.
please fix article grammar
Telegram should be considered insecure. See this post for a nice summary: http://security.stackexchange.com/a/49802
Nice, can you add your own workout or only use the predefined ones?
Music Hardware Startup ROLI Acquires JUCE, a Key C++ Music Framework
> Uber explicitly talked about going after reporters' families.

> The obvious implication is that they were going after her kids.

Obvious implication? I think it's more of a convenient assumption you're making to suit your own personal grudge against Uber.

The comments he made were clearly idiotic, but your eagerness to interpret them in the most extreme and sensational way possible is no better.
You can run on a hosted continuous integration service, such as Travis CI. The documentation is a little thin right now, but we will add this to the docs soon.
Because HTTP does not imply security, HTTPS does. Without proper certificates, these guarantees are diluted; hence the warnings.
High-Engagement Hashtag Discovery on Instagram
This is only when searching for WiFi... once you connect the access point will know your true MAC address.
Won't people need to have LetsEncrypt CA certificate installed on their computers to not get that red SSL incorrect certificate thing? Other than that, this is awesome.
We should get a beer. Can't remember your email address...
Note the wording here: agile, adapt. So you develop a copy of a "western" product/service, then block the original from the west and "market locally". Great, genius. To me this is the totalitarian equivalent of import tax.
Mosaic plots: responsive, flexbox-based parts-to-whole visualizations
Updated Data Platforms Landscape Map – October 2014 (451group)