skysight-inc/HackerNews huggingface dataset:
> The data is decrypted at Cloudflare, and retransmitted in the clear to the destination site.
> The user thinks they have security, and they have a little, but less than they think.

That is true. But it the user's main concern is the legs of network from their location out of a local untrusted network (such as communal wireless) or country, that is definitely better than nothing.

> XP still has 19% market share

I don't worry about the security of XP+IE users any more. Anyone still there has chosen against good advice to remain insecure. It is their choice when there are other options available (both browsers that support modern standards on XP, and alternate OSs), it is their choice to have the certificate warning and more iffy security when they hit a site that needs SNI.
You have to have at least Vista to get SNI in IE. IIRC both Firefox and Chrome support SNI on XP.
I would think that the applicant pool would be limited to those who hadn't heard of (what they did to) Sergey Aleynikov.

http://en.m.wikipedia.org/wiki/Sergey_Aleynikov
.
The situation is actually tighter than that. We don't give the "only visible to you and us" data to Firebase (or anyone else), precisely so it won't matter if somebody else goes digging or screws up. You're protected from all of that. What you're not protected from, unfortunately, is us screwing up. We'll try our best not to do that again.
That's an interesting perspective - what's a slow startup time in this context?

A quick back-of-the-envelope test on my machine for both node and python suggest similar (around 100 ms) start up times for the bare environments.

Do you just mean that you'd prefer to use node for smaller
jobs anyway?
State of HighDPI support in KDE applications
Google Launches First Underwater 'Street View' of Great Barrier Reef
> it seems more likely that we didn't visit the moon than that Sam is manipulative in a "I'm telling real lies that people would care about if discovered" sort of way

All the best manipulators seem that way; most people vastly overestimate their own ability to judge character.

(I don't have a viewpoint on the larger question, but "seemed decent when I personally met him" is not at all convincing)
Top 5 Tips for Your Business Website
Excellent summary of the UK situation, although I'd say most people are paying quite a bit less than £30/m for their broadband service (or are you including line-rental in that?)

The other part of the regulatory environment here that's worth mentioning is the "MAC-code" system which makes it relatively straightforward to switch ISPs. The ease with which customers can vote with their feet is a major part of what keeps (most) retail ISPs competitive.
In Defence of the 'Hashtag Startup Communities'
One thing you need to be aware of if you're thinking about using direct debit is that customers can get their money refunded, no questions asked, by simply telling their bank that there has been an error.
How much research has been done/published in self-aware programs like this? Even on a smaller scale, it'd would seem particularly useful to have programs watch themselves for attack and self-repair.

Depending on how A3 works, or something like it would work, I wonder at the level of increased complexity in not only building the "EMT" services in a way to notice something is wrong and to fix it, but building it in a way where those services compare the intent of the program against the actual program and identify ways to improve it.
I kind of understand what you mean, but this is a little unfair to Latvia.

Completely agree, it'd be just as possible to perform such a scam with bank accounts in e.g. the UK or the US.

It doesn't take much. Here's a 16-year-old complaining about his bank's conduct after he was basically caught processing fraudulent payments via his bank account:

http://www.theguardian.com/money/2012/jul/07/strange-bank-ac...
There are countless git frontends (easygit and git legit) that come to mind, and yet they all see negligible use.

I think the cognitive load of using git is overrated. Yes, it could probably be simpler. No, you probably can't make simple and intuitive for everyone while retaining all the features.

Given that it's also easy to work with e.g. subversion or mercurial and a git bridge, so you can use the client of your choice with a git server, and yet no one seems to do that is an indication that git is sufficiently simple to use.
The cut-off isn't 2016-01-01. I have a cert using a SHA1 fingerprint which expires in June 2016 (see https://random.spillett.net/) and Chrome is not currently complaining about that.
Twitter's debt assigned 'junk' status
Legitimate funds like that do exist. I took a look at one of the biggest banks on my country, and found five "protected principal funds" (if you can read Portuguese, it's at http://www.bb.com.br/portalbb/page3,116,2198,1,1,1,1.bb?codi...).

There are several caveats. According to what I read on that page, these funds use a combination of derivatives and fixed income to protect the principal. On the "risk factors" part, it says the principal cannot be guaranteed if you get out of the fund early; even if you wait until the end and get back the principal, it won't be adjusted for the inflation (6.5%/year and growing); and you always have to pay for the fund administration (1.5%/year for the fund I'm looking at).

Of course, the average return for these kinds of funds will be less than the return for funds which do not guarantee the principal. A quick search found an article (http://www.valor.com.br/valor-investe/o-consultor-financeiro...) with a comparison between one of these protected capital funds and a balanced stock/fixed income fund (last graph in the article). Most of the time, the balanced fund won.

So, guaranteeing the principal is not a red flag. What should have been a red flag is the return rate: 1%/month is too high, even more it they are guaranteeing the principal (which should decrease the expected return). High return rates tend to be correlated with higher risk.
So these folks have been duped, and the publication is exposing it as the scam that it is.

And then, under the article, "UK public snaps up bargains using bizarre online trick - madbid.com" and "How new iPads are selling for under £30".

I'm getting mixed messages here.
Not until the baseband processor is proprietary. And even then nothing prevents feds from just giving the towers new ids or just manipulating the blacklists.
To be clear after having read several replies, I do not personally consider awards given by the aristocracy to be more prestigious. However, a lot of 'regular' people do.

The proposal above simply aims to leverage the brand recognition of the British Crown and its still considerable prestige among millions of people to bolster the award's position, since we're talking about competing with the Nobel. (If the Turing Award were in fact the Nobel Prize's equal, there would not be this many 'Computer Science's Nobel prize' used in the popular press.)

Current computer scientists of course do not really need this kind of endorsements, but if the aim is to attract more young bright minds to the field, it may help.

I am aware of the cause of Dr.Turing's death. It was not instigated by the British Crown, but by the government, which was prejudiced by the law of its time. The fact that there was effort to obtain the royal 'pardon' for him suggests that, at least in Britain, the monarch's prestige meant something.

In time, the award may well become prestigious enough that this is not useful anymore. Then, we could just ignore the tradition or even change the entity handing it out, perhaps to be an AI robot which passes the Turing test for the first time in history.
Menuitems.js – easily navigatable websites
While there is clearly a sensor gap, this actually sounds like a huge and valuable application problem. DSLRs are not conventionally software extensible, while phones are...
And shutter lag. There is nothing worse than missing every single shot (or having them all blurry) because the shutter took too long.
>Because Secure had no real headquarters and existed on the Internet only, an investigation would be challenging.

This is where they lost me. How can a company involved in billions of dollars' worth of transfers be hard to trace? It's not like they can make a cash withdrawal and close down their account. Ordinarily, there is an enormous amount of official scrutiny around large international capital movements. This lack of enthusiasm in following the paper trail suggests governments are involved at some level.
NOYBE – cutest game ever
U.S. Authorities Are Reportedly Gathering Data Using Fake Celltowers on Planes
would like to trial. can i have a token?
Best practices in web development
The only way you could move such a thing to Daly City is if you could somehow pitch as a cool place to be. But as the poster below says, yeah, it's a compromise, which makes it a non-starter.
It's not a question of education. I've seen very intelligent people fall for these scams. It's a question of greed. Once your eyes light up with dollar signs, there's no convincing you that it's a bad idea.
Reddit Chief Executive Resigns
Show HN: Zoomable vector drawings on the web
I really wanted to show off vector drawings on the internet and was confounded that there's no place do that.

I built a very basic implementation of what I hope exists in the near future: http://www.longsection.com/drawings/18 (drawing of the ICA in Boston, MA).

Open sourced the basics of what I think can push the medium of vector drawing: https://github.com/moeamaya/zoomable
Doctors are known for being terrible with money. There are a bunch of investment services especially catered to doctors to help them invest their money. Of course, these are generally rip offs compared to paying $100 a year for a fee based investment plan. But they are better than nothing.
What Is the “Race to Zero” and Why Does It Make Tech Companies Nervous?
Facebook Security Loophole Reported a Year Ago Still Open
It's 2014. Latvia is part of SEPA, EU, and euro zone. This implies decent regulatory oversight.

The severe economic depression that hit Latvia in 2008/2009 forced the worst problems in the banking sector to the surface. In that way, the Latvian part of the EU banking system might be even more stable than that in other EU areas.
Or any of the large number of Eastern philosophies that Tolle has taken most of his stuff from, many of which manage to present it in far less pseudo-mystical packaging than Tolle.
Ask HN: Suggestions on Open Source Photos?
I have created the website http://opensourcephotos.wordpress.com/ which I hope to become a collection of beautiful photographs provided for free at high resolution.
I was wondering if you have any suggestions on what could be the best way to promote the site to let everybody know about this new free resource and to see if anyone is interested in submitting some of their images.
Thanks,
FG
Well, it also matters that this was a black-box "trading strategy" in foreign exchange markets. Investing money into stocks and bonds, and then buying protection on the principal (the fund administration fee is what compensates the bank for guaranteeing the principal, after all) from a bank with low default risk is quite a different thing altogether. Good point, though.
Not really - Steve Jobs sold devices to hundreds of millions of people, helped spin off possibly -the- premium movie studio, and regularly appeared on stage in high profile events watched by millions.

Also had an easier name to spell.
This was obviously a ponzi-esque scam. That's just old fashioned financial crime. There was something that umped out at my though, now that we're in a time where we've thought about long tail or black swan risk quite a lot.

"Secure Investment said it offered something safer: It made trading decisions for investors and guaranteed their principal."

Ultimately the long tail perverse incentive (I don't know if there's a name for it, but it's the same perverse incentive that performance bonuses create) is a tricky one and I think it permeates a lot of things. Say, these guys came out with a more credible claim. They guarantee 80% of your principle and target 10%-20% returns. There probably are trading strategies that produce nice results in the -20% - 20% range with a long tail risk of 100% loss.

Over twenty years, they might average over 10% returns with nice fees or bonuses (regardless of how this is set up) with an occasional cost to honoring the guarantee. One year out of twenty, they wipe out all investors and the game is up. The company takes home whatever it's made up until that point and investors lose their entire principle.

This kind of risk is difficult for us to understand. Regulation chokes on it. Investors choke on it. A 43 year old fund manager looking at his competitors' successful 17 year run is very likely to choke on it.
Yeager famously survived an accident with a modified F-104 that was in some ways quite similar to the SpaceX craft (i.e. a plane with a rocket that can fly an arc up out of the atmosphere). Quite a few of these rocket-plane flights were considered spaceflight at the time, though they don't meet the modern (100km) definition.
already cited but valgrind, gcc, gdb, git, tig, vim. (rlwrap, not only for C dev, just all terminal thingy)
High returns with no loss is a massive red flag. Principal protected notes do exist but they are financially engineered to provide you with the smallest return possible while charging a hefty fee for the bank which creates them.
> Not even close. A 1% daily return is science-fiction.

Not really. In 1990, the most common kind of "savings account" used here (caderneta de poupança) had one month with over 80% returns. That's a bit more than 1% daily return, for an investment almost everyone could (and did) have.

Of course, that year the inflation was over 1000%/year...
'Time for risks' with comet lander
+1. In Spain BBVA, one of the biggest banks in the world [0], offers a principal-guaranteed fund that tracks 3 major stock symbols in different industries.

Of course, ROI is capped at 2% with a minimum 1yr commitment.

[0]: https://www.gfmag.com/awards-rankings/best-banks-and-financi...
Atom text editor – repository for official .deb Linux builds
> If you just put a static "Hello World" webpage on a server and try to benchmark it with something generic like `ab`, yes, HTTPS appears to be several times slower than HTTP.

Can you suggest a benchmark tool that can be used to give a more realistic figure than `ab`? I know jmeter can do session caching, but I find its interface baffling and I can't find a pre-made configuration.

I recently compared performance of my home ARM server when serving my blog through HTTP and HTTPS:

https://www.tablix.org/~avian/blog/archives/2014/11/cubietru...
In the general case, if you have deployed software which has to work in the face of an arbitrary, integrity damaging attack, you're going to lose.

That's because the attackers get to test their arbitrary code execution against your widely deployed countermeasure (e.g. AV with heuristics, EMET, whatever) until they win. You are the Maginot Line, and they are XYZ.

Funnily enough though, security through obscurity / unusual security measures do beat a lot of canned attacks.

Regehr does cool work on software validation though - it might do what it says. I hope he jumps into this thread and tells us what's actually up :)
Atom Linux builds must be manually downloaded from the website or from Github, and don't get automatic updates.

I was annoyed by this, and I couldn't find an official repository (there was a rebuild by webupd8 but I found some issues with that), so I built my own repository; it contains the official binaries, downloaded from Github Releases. I hope this can be useful to somebody.

The deb should work fine on Ubuntu & Debian.
Is this still an issue? I can't recall using a camera made in the last 6 years that didn't take the picture near-instantly so long as you did the normal half-press prefocus, or used manual focus.
Wow, that's mesmerizingly bad! That uploader has "business presentations" from many similarly obvious scams, including Empire Finance[1], Royal Fund[2], Sixa.biz[3] and Avan Fund[4]. (Note to self: don't invest in funds advertised with synthetic speech!)

[1] https://www.youtube.com/watch?v=zQZMtMLrykM

[2] https://www.youtube.com/watch?v=yOb9y7cUH2Q

[3] https://www.youtube.com/watch?v=5xRnLFdPT8s

[4] https://www.youtube.com/watch?v=VryexnFw13M
MySQL, please give me my data
Isn't that because DSLR manufacturers don't want people with an entry level phone getting the same software as the pro-sumer phone, or the pro-sumers upgrading software to the pro version?
There are many ways to tell an incomplete, partial truth. It's still truth. It just isn't the whole story.
Not sure if it's what you meant by computational, but some pocket cameras already apply software correction to known lens distortions. The Sony RX100, for instance, which is presumably how they can have a 1" sensor and very bright lens in a really small camera.
For every rule there is an exception. Grandparent could be restated as a 'return that is more than a certain percentage over inflation' and it would hold water against your exception.

Cue the next exception and so on. The point is that such high returns are a huge red flags and absent any explanation for them you should be extremely wary and probably just assume that it is a scam until you've proven otherwise.
Maybe like the awesome foundation? http://www.awesomefoundation.org/
That likely wouldn't work though. IMO the reason these people were so successful in deceiving so many "investors" is selection bias, much like Nigerian-scams using Nigeria as the country of origin to only engage very gullible people. If they were to "only" guarantee 80% of the principal most victims would have gone away.
Reddit CEO Yishan Wong Resigns
Sure the tiny sensors of gadgets have come a long way, but looking at it from the other perspective: what are the trends in enthusiast "big" cameras? Basically it's sensor growing. This is of course mainly driven by shrinking costs of manufacturing sensors, but there is still a huge cost in terms of bulk and weight to carry a camera with a 35mm sensor. Yet this is still something people want to do.

Sadly photography is still very much a physics game, and while there is some room for improvement in sensor tech, and cheating e.g with multiple exposures, even a ten-fold increase in dynamic range and sensitivity wouldn't make large sensors obsolete.
Build Your Own Web Framework in Go
Doesn't Wildcard Remind You of Rockmelt and Flock?
Interesting. Personal experience from a business owner point of view or as user?
Well, sure there is. Have you seen http://ziteboard.com ? Drop me a message and I'll show how real-time visual collaboration works - and yes, we're talking vectors.
If you have any female friends, ask them how they feel about the shirt.
> People are questioning the real reason because they can't accept that a CEO of a hugely popular site has chosen to resign on good terms instead of being involuntarily ousted

They're probably questioning those terms because the New York Times is also questioning it..

http://bits.blogs.nytimes.com/2014/11/13/reddit-chief-execut...

> But things have been tumultuous at Reddit in recent months. After the company raised a major investment round, Reddit management requested that the company’s global employees relocate to San Francisco or leave the company, according to tweets sent by Mr. Wong. Mr. Wong also recently had a public argument with a former employee of the site in which he laid out the terms of his former employee’s termination in excruciating detail. That incident, according to people close to the company, made some of Reddit’s current employees uncomfortable.

There are many ways to tell a partial, incomplete truth. You don't talk about certain parts. Doesn't make what you said any less true, but it is not the complete story.
Man, you folks are cynical. Having done a stint in a people management role at a tech company I can attest that things aren't always this straightforward.

- PIPs are definitely the tool you use when you want to fire someone, but they're also the tool you want to use to get someone's attention when all else has failed. I had to give a PIP to an employee who just could not get his head in the game. I had absolutely no desire to fire him.

- I have definitely witnessed HR stand up to managers and push back on plans to fire employees who haven't had adequate time to fix their conduct and turn things around. You can argue that they're protecting the company from wrongful termination liability, but I know at least one of the HRfolk involved and that was definitely not his primary motivation.

I get thinking that big corporations are only driven by profits and are therefore always going to be selfish/evil (though I don't really believe it) but I don't get thinking that blanket statements/accusations about individual people in these organizations could possibly be true. There are well-meaning HRpeople in the world, and managers who mean what they say. Maybe not as many as there should be, but still lots.
Hmm, that is pretty ugly compared to its APL derived cousins in Q/K/KDB...

/first n+2 numbers of fibonacci sequence

fibonacci:{{x,sum -2#x}/[x;0 1]};

And then...

q) fibonacci[10]

0 1 1 2 3 5 8 13 21 34 55 89

I haven't seen much J before, is that really the best implementation?
While these active MitM attacks are important (the methods seem to be similar to ARP-poisioning), we shouldn't leave out the passive capabilities. These may not even be listed as a feature, if it is a different tool that parses the already-captured traffic as a deferred job.

As we see mentioned here on HN all the time, there is a massive amount interesting data that can be pulled out of large datasets. The original WP publication[1] about COTRAVELER gives a very nice example of the power in just knowing very-inaccurate (cell-sized) location data. You probably don't even need any particular cell-network identifying number, given how easy it is to correlate this kind of data to other identifiers.

[1] http://apps.washingtonpost.com/g/page/world/how-the-nsa-is-t...
Just, wow. TLS is NOT hard to setup for a website administrator.

It really is – you might just be living in a bubble of competence!

I've got years of experience as a developer and sysadmin, and I still sometimes struggle to get SSL working correctly on a site. Sure, getting and installing a cert is fine – but the mess of making sure that third-party services don't break, and that redirects aren't messed up, and that other virtual hosts don't break… it can be a time-consuming effort, and probably difficult for someone with less experience.

Cloudflare have been pretty transparent with the service they're offering, so I find it hard to see this as a bad thing.
Governments hav limited funds to investigate and prosecute fraud.

Lack of government action doesn't mean that governments are complicit! It might just mean that they don't have the reseources to track criminals across several different jurisdictions.

See "carousel fraud" for an example of a fraud that used to be difficult to tackle.
http://uk.reuters.com/article/2009/08/20/uk-carousel-fraud-b...
We consistently choose the overwhelmingly more likely one. That's the reasonable thing to do, and it shows in the fact that these illusions take considerable effort to construct.
There is a bug in your implementation. If the tweet goes out automatically every day instead of sending you a gag order they could simply jail you. Your tweets will continue to go out just fine.
The processing of dslr photos usually takes place outside the camera (raw conversion etc.), so my requirements for in-camera processing are quite small for a dslr. For my smartphone on the other hand I need pictures usable directly (typically).
Reddit CEO Yishan Wong has resigned from the company
Surely its more about the fact that lenses have to be a certain size.
I have at least another 25 years in me (I hope!) and I'll take that bet.