skysight-inc/HackerNews huggingface dataset:
While we may pay lip service to the web as "open" and "international", it's pretty western and particularly US dominated. From basic infrastructure like core domain names, to standards bodies like the W3C and IEEE, to the big companies like Google, Facebook, Ebay, PayPal, Anazon, Apple and co.

Even sites like Wikipedia, supposedly available to anyone to edit, are pretty much dominated by specific points of view and ideas (even if sometimes those who held those like to think that those ideas are or should be universal and/or neutral).

Neither economically, nor culturally does it make sense for a nation the size of China (or even for EU, but I digres) to participate in such a web. They are not some pushover country that was created a century ago. They have their own, millenia old, civilization. It's not like they are isolated by doing the firewall thing either. They get all the good (and the crap) we get in large does anyway, from the Kardasians to Jackson Pollock.

Think experiment: if the internet was mostly run and dominated by USSR, including a "neutral" Commipedia full of USSR points of view and material, would the US adopt it? Or would they build their own counterpart?
Walk This Way: Acting Happy Can Make It So
Oh interesting:

> Once the rechargeable secondary battery has been warmed by sunlight again, Philae will restart and the DLR LCC team will take their places at the control consoles again.

This is the first I've heard that Philae can wake back up. I was under the impression that it had no solar capabilities whatsoever, and that the battery was the only power it had available.
Voting app with realtime results (tutorial)
> Whatsapp requires a telephone number as it uses that for your ID.

I understand that. I'm questioning why they've set such an arbitrary restriction in the first place.
We're putting out a protocol for requesting certs and validating domain control (that our new CA will support -- and we'll be cross-signed to work in all mainstream browsers) and we've already written a client for it that integrates with Apache and can edit your Apache config.

If you're comfortable editing your own Apache configs, then you'll only need to use the client to obtain the cert and not to manage its installation long-term. (The client does need to reconfigure the web server while obtaining the cert as part of the CA validation process.)

The protocol is openly published, so you can write your own client too, or follow the protocol steps manually -- or any web server developer or hosting platform can develop their own alternative client.

There does need to be some client to speak the protocol, but there's no attempt to force you to use it to manage your certs and configs if that's not what you want. The convenience is aimed at people who don't understand how to install a cert, or who think that process is too time-consuming.
At the moment only the predefined ones. I will add custom workouts soon™.
This aptly-timed blog post might help! https://www.thalmic.com/blog/big-data/

tl;dr We're officially releasing raw data to developers, for free.
Cyberwar: Anonymous vs. The Ku Klux Klan
> HTTP can be man-in-the-middled passively, and without detection; making dragnets super easy.

Nothing can be man-in-the-middled passively, that makes no sense. That isn't what a MitM is. It requires active involvement by its very nature.

> In order for HTTPS self signed certs to be effectively man-in-the-middled the attacker needs to be careful to only selectively MITM because if the attacker does it indiscriminately clients can record what public key was used.

I genuinely don't understand what you're trying to say.

> The content provider can have a process that sits on top of a VPN / Tor that periodically requests a resource from the server and if it detects that the service is being MITM then it can shut down the service and a certificate authority can be brought in.

If the MitM originates from a specific location (e.g. a single Starbucks, a single hotel, an airport, etc) it would never be detected by that method.

> Also, all this BS about how HTTPS implies security is besides the grandparent's point: certificates and encryption are currently conflated to the great detriment of security, and they need not be.

Only MitM protections AND encryption provide a secure connection when together. Individually they're insecure.

If someone wants to come up with a security scheme which doesn't depend on certificates that would be fine. You just have to solve the encryption issue (easy) and the identity issue (hard).
Thanks for the clarification! You might want to add that point to your technical how-it-works section[1]. I was wondering how older browsers would accept a new CA's signature.

Also, I really wish AOL would have donated their root certs to y'all[2] so you didn't have to set up a whole new CA.

[1]: https://letsencrypt.org/howitworks/technology/

[2]: https://moderncrypto.org/mail-archive/messaging/2014/000618....
That doesn't even remotely work, who has the private keys to authorize the certificates?
I'm so excited for this. I know both the people working on the team from the University of Michigan, and both are extremely smart people passionate about web encryption.
If you have the time, don't jump into Django right away. Try Python without a framework first, if you have time.
This is behind a paywall, but the story can be summarized with the line: "A recent study found that deliberately walking like a happy person can lift one’s spirits."
>Is that true? I got the impression the US and UK mostly became major economic powers by being ahead on tech in their day

The US did that after several centuries of economony building with huge protectionism and slavery. And remained there by using their army to ensure cheap resources, favorable contracts, lackeys in place in subservient countries, etc. The environment to create the "advanced tech" comes from that.

Similarly the UK and France become major economic powers by enslaving half the globe with their military. Their great "tech" and such come after the colonies, not before.
Six reasons why Heathrow is not the UK's hub airport
Thanks for doing this. It's really great and its something that clearly needs to happen.

The next step will be to replace the CA system with something actually secure, but that comes after we move the web to a place where most websites are at least trying.
It would be interesting if you could find a reputable cryptographer to agree with either of those sentences.
I used to send it at mailing lists and sign-ups.

However, I Noticed spammers have learned the trick and omit the "+..".
NavNav – 80+ Responsive Navigation Examples
What a huge endorsement pull for them. If you don't know already, Armin is one of the biggest, if not the biggest, names in electronic music. He has had an enormously successful career playing trance (though that has changed quite a bit lately) and has the most listened to trance radio show called A State of Trance. His live shows at music festivals are always well received. Myo could not have found a better name to have attached to this product.
Please explain the NON "extreme and sensational" way to interpret comments talking about spending one million dollars to target, intimidate, and smear the press and to dig up dirt on their families.

What's really cute is that even Uber doesn't even deny that this happened. No, that's all on you, dear HN commenter.
Out of curiosity, what if MITM says, "include me in this list for IP <user IP>"? If the check is not done in a way that solves the byzantine generals problem, I don't see how this feature provides any more protection, other than one more hoop to jump through.
I'm not saying I support it, I'm just pointing out that companies manipulate journalists all the time and incentivize them not to "challenge the company's PR" as the GP put it. Uber's threats were extreme and beyond what is tolerated outside of politics. They could have manipulated her much easier by giving her unlimited free Uber "to better evaluate the service".
7 Books for Entrepreneurs
We're working on the latency, but a Kinect actually _can't_ do the same thing in this situation; too much interference from the stage lightning. (They actually tried other solutions, like Kinect, before switching to Myo!)
This article is mostly a copy/paste of http://clang.llvm.org/docs/Modules.html
It's not arbitrary. It simplifies things for users a lot. No usernames or passwords to remember. Many telcos link your phone number to your identity which you cannot really lose, so therefore also no chance of losing your WhatsApp account. Also, more importantly, solves the contact discovery/social network problem by letting you reuse the phones address book.
While this is nice and I'm happy to see such a product coming, I still don't see a free TLS solution for my smaller projects. Heroku will still charge me $20/mo for TLS even if I have my certificate. Cloudflare will also want to charge me to inspect TLS. I could drop both and get a Linode but then that costs too and is a pain to setup a server myself.
I agree that article is thin on technical details, but it does provide arguments against the textual-inclusion technique that C++ (and C) currently use.

However, that points to a Clang implementation of modules for Objective C. And the proposed solution it points to is eight years old. For more details, see the most recent proposal: http://isocpp.org/files/papers/n4214.pdf

It was discussed on HN about a month ago: https://news.ycombinator.com/item?id=8452886
It's primarily because of the interactive challenge to prove that you control the domains you're requesting the cert for.

If you want, the client can just give you the cert at the end instead of installing it. In the common case for a user who's not currently comfortable with the process, the client is automating several things -- generating a private key and CSR, proving control of the domain, and installing the key and cert in the server.
We post links to products that cost money, though, no? Journalists need to eat too. Usually it takes entire milliseconds for someone to post other links, anyway. Or you can always sneak around the paywall.

In this case I don't mind an article that has a bit more science bias rather than 'mainstream', so the DLR link is nice.
Yeah the probe is covered in panels. The main issue is that it did not land where they intended and it is mostly in shadow. I am not a rocket scientist but... it looks like it will be getting closer to the sun as time goes on here so maybe the light it can get later will be more intense and enough to power it?
There was a study done on perception that used "glasses" that inverted the image fed to your eyes. The subject's brain rewired itself so he'd see the images upright again in just a couple of days.

Interestingly, the optics in our eyes provide an inverted image to our retinas, so our perception of the "inputs" is already using signal processing.
They can get US corporations (including many CAs) to cooperate. For example, to obtain a fake (but perfectly working google.com certificate, they can ask Google (more or less) nicely to provide one, or they can go ask any CA instead. It's not likely that compromise is required with so many potential sources, some of which may be paid or coerced to cooperate.

PS. nice (presumably political) downvote further up ...
ACME sounds great. Copying codes from emails is suboptimal at best. Free certificate from command line and free revocation from the same client sound even better.

I just don't know about the automatic configuration tool. Like webpanels for managing a server, it has never worked for me.
Most people aren't Uber.
I took 2 uber rides this morning; I just uninstalled Uber and installed Lyft. They have the same amount of cars down in here in San Jose.
Also try 33mail.com for throwaways. You get a subdomain, so you can do [anything]@foo.33mail.com or [anything]@foo.33m.co
Teespring Announces Series B
Wow, that's one of the most egregious and intricately constructed straw man attacks I've ever seen. It's above and beyond the New Yorker's ordinary standard of belittlement and misrepresentation. Thank you. <Edit>Heh. I just noticed the other commenter who added a link to a description of the tu quoque falacy, which is brilliant. I agree that Pinker can often be a bit facile, and he does tend to caricaturize his opponents (although invariably using their own words to do it). But this takedown piece attributes ideas and attitudes to Pinker that are not only not in evidence, but which are frankly and directly contradicted in the actual text of the book.</edit>
That "tweet from food" thing reminds me of Vessyl.
https://www.myvessyl.com/
I'm running my own email server and use the dash/minus - instead. Works great.
You can revoke the certificates from the command line. It's shown at the end of the video.
I agree. A more common MITM, and that it actually would prevent, comes from a rogue wifi operator.
The hilarious thing is that you'll still end up with code mixing the two idioms, because legacy.
One would hope certificate transparency would help fix this problem.

(for the record, I didn't downvote you)
Quite true and I didn't mean to imply otherwise, thank you for clarifying that. Indeed, the article seems to focus on their high degree of technological and social advancement rather than the speculative headline.

Title aside, I think the book's main point is relevant to claims that any group of people in contact with other groups of people were, to any substantial extent, peaceful. I'm not saying it's "aliens built the pyramids" implausible—I don't want to overstate the case against it—but it's the sort of claim that ought to prompt disbelief by default.

In particular I brought up that book since this civilization sits just on the other side of prehistory (do correct me if I'm wrong), which allows many of the same gaps in knowledge that historically produced this exact sort of speculation—the "god (peaceful, harmonious ancestors) of the gaps" that tjradcliffe mentioned.

My guess is that, to the extent that it's true, it represents a kind of local "Pax Harappan", and that farther from their core territory they fought and killed at what would be, by modern standards, considered shockingly often, though it's possible they were less warlike than many of their contemporaries, which would be a worthwhile find on its own. A prolonged period of low-violence in their core territories could represent remarkable stability, certainly. The linked article doesn't provide much to go on, though, so it's hard to say without more extensive reading.
"This is how you deliver strong security to the masses."

You cannot deliver strong security on a mobile phone platform. The carrier owns you. In fact, the carrier owns you doubly over because it can control "your" computer via two pathways - with the baseband and the SIM card - both of which you have no control over.

You cannot be secure on a device that a third party can interact with at the level of DMA. Further, while I keep adding a caveat about some phones whose SOC involves a baseband that is more akin to a USB modem, in terms of architecture, it turns out that even these "less terrible" SOC designs still have kind-of-sort-of ways to attain full control by the baseband over the AP.

It really is that bad. You gain no protection from the carrier or a state actor that can influence the carrier, and certainly no protection from a rogue cellsite that can instruct your baseband (or your SIM) to manipulate main memory arbitrarily.
Ironically that comic and XKCD in general falls into the category of things that are very widely-known but people still present as new information. (The prime example being cryptography discussions linking to correct horse battery staple.)
This is not an attempt to reduce the CA system to a single CA. The intent here is to provide a simple and free way for anyone to get basic DV certs. If we can also contribute to CA best practices, and help improve the CA system in general, we'd like to do that too.

Let's Encrypt is only planning to issue DV certificates, since that is the only type that can be issued in a fully automated way. Many organizations will want something other than DV, and they'll have to get such certs from other CAs.

Also, our software and protocols are open so that other CAs can make use of them.
Certificate Transparency tries to solve the Byzantine Generals problem (up to high levels of collusion). Take a peek at their design -- it's pretty interesting!

It does rely on the legitimate site owner actively checking the records to notice the misissuance. Maybe that process could be automated somehow.
This is great news and great progress!

One remaining issue: Since the whatsapp binary is closed source, it cannot be verified that it does what it says.
DMT: You Cannot Imagine a Stranger Drug or a Stranger Experience
No. A proper certificate protects against malicious DNS resolver.

What you're talking about is being introduced alongside DNSSEC, and it's called DANE.

https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
List of hotels by criteria “Boats Rental”
Main discussion:

https://news.ycombinator.com/item?id=8624160
Highly unlikely seeing as Facebook uses the content of your messages to market ads to you, build up a profile of you, identify you and identify trends (links, keywords).

The fact that Facebook owns WhatsApp makes this announcement a big surprise as I think they profit far more with unencrypted messages (although WhatsApp was just delivering, not storing them supposedly).
I wish Microsoft would do more with the Kinect and make it cross-platform. The MYO supports iOS, Android, Windows, and Mac: https://developer.thalmic.com
How about more hacker?
Sorry, my bad.

Can you explain "civilization reversion"?
Interesting. So is this incorrect (from the Hackaday post)?

"Anyone wanting to develop for the Myo now needs to submit an application and pay Thalmic ... up to $5000 for academic institutions." (inflammatory language removed)
"browser-trusted certificate" < it is already trusted by them
What authorization is required in this scenario? I'm talking about a novel idea here, one that doesn't fit into the existing CA model. There would be no CA in this scenario; verification would be decentralized, based on shared information, not on knowledge of a secret.
Steve Gibson did a pretty detailed analysis of Telegram on Security Now #444, recorded 25 Feb 2014. He concluded that Telegram's security was inadequate and recommended Threema as an alternative.

http://twit.tv/show/security-now/444

https://threema.ch/en
Self-signed certificates are still better than http plain text. I understand not showing the padlock icon for self-signed certificates, I don't understand why you would warn people away from them when the worst case is that they are just as unsafe as when they use plain http. IMHO this browser behavior is completely nonsensical.
> Self-taught. Why does that matter?

It doesn't. All that matters is that the science is correct (see Ron Maimon for instance; self-taught but far more knowledgable than most physicists). However, I get in far too many discussions involving QM online (mostly Reddit) where I learn that I wasted my time arguing with a 14 year old that watched "Through the wormhole" or something.

> P.S. It turns out you were right about this

You sound surprised. My graduate research is in quantum chemistry (and related areas), so I should have at least a few concepts correct. As someone with more of a QC background, perhaps my definition of what theoretical physicists consider "entangled" is inaccurate, so I am reading up on the matter. But I'm finding their specification of "entangled" to be an unintuitive and unobvious choice of wording.
Anyway, the idiom is "one rotten apple spoils the whole barrel."
All of that work is irrelevant unless we have an open baseband and an open SIM card.

Without that, your carrier owns you at a bit by bit level in the memory of "your" computer.
> Similarly the UK and France become major economic powers by enslaving half the globe with their military. Their great "tech" and such come after the colonies, not before.

It was technological advantages that enabled them to enslave half the globe with their military.
Well, if you want to never write anything that scales yes, those are in fact the correct practices for writing bone-headed APIs for applications that would blow up with 20k concurrent users doing simple GETs.

If for some unknown reason you want to write APIs that don't go down faster than a 15 year old girl faints upon stumbling onto a boy from 1D in a local McDonalds you should:

a) use verbs

b) separate heavy end point from light end points

c) make URL easy to parse by load balancers and proxies
Analyzing my Homescreen
Here we go again, more Uber drama. The only reason why this is a story is the (pardon the term) disruption of a protected industry, and the misplaced attention on the supply-side. Consumers are awash in convenience and choice right now, but the media and the politicos protecting the industry are ignoring that and going after the biggest member of the disruption so that it can be controlled.

I'm sure there are sleazy execs at Uber, but if the media pointed its glare at any other similar-sized company, I'm sure it would find them there, too. Uber may have more because it has grown so fast. It would behoove of them to start cleaning house so that this type of story doesn't kill the golden goose.
You'll find that many people are very reluctant to give up that sort of information about themselves though, whether it be for privacy or because they don't like being incessantly spammed. I understand it existing as an option, maybe even a default, but to make it to the only method of authentication seems insane. Sure, many users will deem that the benefit of using the application overwhelms any negative implications, but it would be nicer if they weren't forced to make that tradeoff in the first place.

I'm not against the option existing, I'm against it being the only option.
They stopped updating GCC precisely when they decided, and announced, they were moving to llvm/clang.

Past that, you literally ignored the main point:
They stopped updating plenty of opensource stuff, you've just picked out the GPLv3 stuff and said "it's all because of this"
The technique is called "optical bonding", where an adhesive is poured on the LCD front glass and then the touchscreen/cover glass is adhered to the LCD. The upside is that the assembly can be thinner and the LCD closer to the user, but the downside is what you said. Impossible to repair.
Top (Mostly Free) Legal Resources for Startups
U.S. aviation safety board says FAA can enforce rules on drones
If I grant you the unrestricted use of my software and grant you the right to further grant all the rights I granted you to others, how can I enforce a patent license without breaking the terms under which I licensed the software in the first place?
> but it may be a pain when you actually want to share data between threads. (Like, say, a shared cache.)

That's the main reason we wanted to make sure it was easy to interface with Akka actors. Assuming you couldn't get away with just using a ConcurrentHashMap or similar, it's very easy to put your shared state into an actor and pass the ActorRef to each event loop, so that all communication between the loops and the actor is through immutable message passing.

Akka's agents (synchronous immediate reads, asynchronous writes) also work really well when you have a read-heavy data-structure like a cache.
Tame Your Data: Segmenting Users and Customer Feedback #FTW
My understanding of the perspective of the authorities on encryption in messaging is that it doesn't matter what you say, it matters who you say it to and when; additionally, it matters whether you're speaking cryptically or not.
And more HN advertisement.
To be honest, i don't expect a useful solution to the latency problem. Kinect, Wii, Sony gyro controllers, Motion Leap, none of these have been able to reduce latency to a non-noticable level, and getting there would be a bit of a holy grail.

Good point about the Kinect though, that is interesting.