skysight-inc/HackerNews huggingface dataset:
> And Firefox's certificate API is not much better, only passive access without ability to block connections if you detect an unwanted cert.

Nope. Firefox's Addon API lets you do pretty much whatever you want. It might be kind of hard and annoying, but you can certainly block connections that are signed by an untrusted CA. How do you think Convergence [0] worked?

[0] http://convergence.io/
When you download the new browser, does all of your preferences like bookmarks and extensions and stuff transfer over?
I think we deserve cars not crashing into us. It's only in the US that people suggest (implicitly or explicitly) somebody is at fault for his death because he didn't wear a <400g soft shell around his head after a 4 ton truck ran into them from behind (which is the majority in cases where people died).
I'm glad they're considering doing this.

However, it's going to cost a lot more than $500 billion to raise per capita GDP by ~7 fold. It'll cost $500+ billion in the first ten years in just welfare support, security, education, infrastructure, disarmament, healthcare, job training.

$50 billion per year in net drag is perhaps even far too low of a number. There are 24 million people in the north. That's a mere $2,000 per year per person. It's going to cost a lot more than that to start bringing them up to speed. I think you could easily spend $2k per person, just on the person - not counting several expensive things I listed previously.

South Korea should plan for $2 trillion over 20 years. They'll intentionally under-shoot the numbers, to avoid freaking out the tax paying public, and the cost will end up ballooning far beyond the public relations numbers.
I read those numbers. My point is that I don't know how to interpret those numbers.

The Netherlands has a cheaper health care than the US. Do people go to the first-aid department for minor problems more often than they do in the US?

For example, in college I cut my figure once while cutting a loaf of bread with a hard crust. I was on the campus medical plan. I walked to the campus medical center and got a single stitch. Had I had to drive some place, and pay $100 in co-pay, then I would have waited longer and perhaps not gotten it.

The text says "Of the cyclists with serious injury who are admitted to hospital following a crash with motorized traffic, almost half (47%) are diagnosed with head/brain injury". It doesn't say that they only have a head/brain injury. Could be a broken collarbone and facial injury? The relevant Table 1 in the paper says "Annual number of cyclists admitted to hospital with head/brain injuries as main or second diagnosis", emphasis mine.

So no, we cannot, based on the presented data, assume that the head/brain injury is the serious injury.

In the US in 2012, 4,743 pedestrians and 726 bicyclists were killed in crashes with motor vehicles. http://www.pedbikeinfo.org/data/factsheet_crash.cfm . Do those raw numbers mean that bikes are safer than walking, in case of a car crash?

Certainly not. It needs to be scaled by amount of time that people are on a bike, vs. walking. More people walk in the US than cycle. "There are 127 million walking trips and nine million bike trips in the U.S. every day (2009 NHTS)." http://www.pedbikeinfo.org/data/factsheet_general.cfm .

While in the Netherlands, some 25% of trips are by bike, and 20% by foot, and 8% of all distances are covered by bike. See http://books.google.com/books?id=apGsBAAAQBAJ&pg=PA352&lpg=P... .

Tell me how to combine all that data to get a horror story. Because it's proved to be too complicated for me to figure it out based on what I can see.

My own experience in the Netherlands is that biking there is a joy. It feels very safe compared to biking in the US.
It was only on the front page because the mods put it there. Buzzfeed is a penalized site and this story is getting flagged. Normally it would be on page 10 by now. The mods can't hold it up forever, though, so now it's falling.
After all of this effort, they're still limiting passwords to 18 characters? Why would they do that?
I had the exact same issue:

Oddly enough, chrome didn't want to auto-update to this, it was "up-to-date" at 38.x, even quitting and relaunching applied no change. Downloading a fresh `dmg` archive from https://www.google.com/chrome/browser/ applied the 64-bit update.
We used to laugh when our CEO/Head went to extremes to put customers first with things like creating a "Customer Bill or Rights." We thought it was overreaction after some glitch or dumb one-off call center rep violating PC correctness. But now I think Uber should get a transfusion.

All rides free New Years Eve and Halloween.
No ride will ever cost more than $X (should not be hard to figure out - with an * too)
To show good faith, ride once, the next is on us (for x weekend).
Publicly terminate knuckelheads ("Jimmy the Greek") [1]
Establish & Invite consumer, safety and the driver community to form an oversight group to ensure Uber holds itself to community standards.

My Luddite world has no idea what a Uber is, but they sure know how to ask and find out. New things to my Luds come from hearing human voices - asking neighbors/friends is still #1. Nothing out there now says "Uber has cleaned up its act" First impressions have to be disproven and last the longest.

[1] http://www.youtube.com/watch?v=WzB7IsmOegE
> The compiler should be able sift through the code and see that "x=1" is an integer, or converts to a float when "x=x+1.0".

The short version is "no, it shouldn't".

The longer version is that, viewing Python's runtime class memberships as "types", the type system it would represent is not one for which inference without explicit declarations is generally decidable, so an AOT compiler for unmodified, unrestricted Python that is expected to infer types at runtime simply would not be possible.

You could AOT compile it into C code with a lot of runtime metadata and indirections -- but that would probably have worse performance than the existing interpreter.

> Way back when, you could get a BASIC compiler to turn your interpreted BASIC code into assembly.

Well, yeah, BASIC is actually structurally quite close to assembly. Its not a dynamically-typed multiparadigm language like Python.
Add Restart, Sleep, Shut Down, and Log Out Commands to Spotlight
Did you think this through the rest of the way? That isn't enough to make it work... you can't just "duplicate" the hash sitting in the database. What???
It's less true in some modern smartphones (disclaimer: not an expert on the iOS/iDevice architecture in particular), but a shocking amount of code still ends up on the baseband, and the baseband still has as much trust as the kernel. For example, the baseband processor often serves as an offloading engine for power efficiency reasons, to avoid waking up the main processor; thus, the baseband processor might have direct access to the audio hardware, so that phonecall audio doesn't need to wake up the host CPU.
Further upthread, Josh (one of the other people working on the project) explained that Let's Encrypt currently only has plans to issue DV certs, not EV certs.

https://news.ycombinator.com/item?id=8624634

This is because of the automation aspect. EV cert issuance involves a human being looking at offline identity; DV issuance involves proofs of control that can be checked online by a computer, just as existing DV issuance by existing CAs is based on such checks.
It's quite easy to come up with a scheme to manipulate the password client-side. I'd assume an organization with any technology credence whatsoever knows not to store unencrypted passwords by now.
You are lucky to not have had to deal with corporate beuracracy - these things take time :-) At work I'm integrating an API for a mobile operator, it's apparently working and ready to be used however I've been waiting a couple of months to get all the documentation and everything setup.

Even once they have the CA it needs to be added to browsers which will take time. Taking into account release cycles of embedded devices (read phones where the manufacturer hasn't released an update), summer 2015 seems rather optimistic.
Show HN: Revised Minimal Theme for GitHub Pages
Even better, these two quotes from the judge:

"You don't have a nondisclosure agreement with the court"

and

"I mean, this is simple. You can't just stop someone and not give me a reason."
Tony Hawk rides a hoverboard, for real this time
This is the same thing as blackboard, they store every password in plain text, nobody seems to care. I've been trying to bring attention to it.
If Python had the same amount of time and energy put into it that JavaScript does from Google and Mozilla it'd be willing to bet it'd be a lot faster.
Apparently, Mac OS X isn't exactly a priority for them.
I'm not sure, but there may be some hash functions for which H(concat(a, a)) = F(H(a)). I'd worry a little about their security in some contexts - particularly if that generalized beyond just duplication, it seems likely vulnerable to length extension attacks if used for HMAC, &c - but for password hashing it might be fine and would clearly be better than plain text. It's not impossible they were already using a hash for which that's true - just unlikely.

Another possibility would be that they compute and send both H(a) and H(firsthalf(a)), if fisthalf(a) == secondhalf(a). That would work with any hash function, but I think would not appreciably increase security.
Its hard to be worse than an interpreter. 100X slower than compiled code is typical. Whatever 'metadata and indirection' your C target has, it seems likely to be 10X better than interpreted, easily.
Someone else pointed out, if you just had a flag on each user to indicate if the password is doubled, you could just check the hash of the first half of the provided password when the user logs in.
Go is really minimalistic.thus,you either follow its philosophy or you cant use it.That's why I believe this language isnt for everyone.Try to look for alternatives such as D if you want a concurrent "safe" C ,which doesnt eat as much memory as the JVM.
take a look at pearson's blackboard, they store passwords in plain text.
I would probably consider it, but put a really premium price and make clear that they will get substantial discount if they choose SaaS version.
I can also recommend martial arts fall training, which saved my head in a similar situation.

I got my handlebars hooked on a rail going downhill and flew over the handlebars; my training allowed me to take the whole impact with my hip and butt. Light graze on the forehead, I'm lucky my reflexes told me to tuck in the head. (However, I couldn't walk that day. Cycling was fine.)

I'm wearing a helmet now, but I'm not sure the situation would have ended as well if I had been wearing it then, because of the bigger head radius.

edit: spelling
The numerous Common Lisp implementations out there would agree with you.
Hipsters go to hipster bike shops to get hipster bikes?
"An (increasingly long) while back" is more grammatically correct because the paranthesis is not a separate sentence; it's part of the grammar structure of the sentence as a whole.
$$$: Free Advertising Academy – Free Advertising Academy Blackhat
nasa almost used up the last bits of our reserves of it for the last mars lander.

Thankfully it appears that the united states department of energy is re-visiting generating plutonium-238 for NASA:

http://en.wikipedia.org/wiki/Plutonium-238#United_States_sup...
Amazon Unable to Fulfill New Fire TV Stick Orders Until After Christmas
LOL This is shameful it took this long.
Hah. Whoops. Well, search for duplicate:yes and you'll get a list of questions closed as dupes. :)
Lyft only exists because Uber cleared the way. They also continue to benefit from Uber doing the hard work of fighting the taxi industry and regulators. If you don't want to be a hypocrite you will have to walk.
RIP Security.
You are kidding, right? What non-serious brain injury do you suppose they are diagnosing?
And even if they do (impossibly) increase GDP/capita to 10,000 with that amount of money, North Korea would still be way, way, way poorer than South Korea. I wonder at this point whether reunification as was done in Germany is even possible, given the dramatic (and growing) difference between the two states. Perhaps some sort of confederation will be done.
China steps up web censorship and blocks HSBC
" cost a lot more than $500 billion to raise per capita GDP by ~7 fold."

That's a good point, but remember that North Korea, in spite of being the most backward and poor nation on Earth, is full of Koreans. A strong creative drive and high levels intellectual life and potential talent and a flair for protest and organizing reform will do a lot for a nation. Most nations would be lucky to unify with 15 MM Koreans, no matter how poor. Within a generation of getting freedom, I expect them to be doing well.

Remember that it only took RoK twenty years to go from a brutal dictatorship among the poorest in the world to the 1st world nation it is.
Theoretically, they could have HAD the password in plaintext, then doubled it, salted it and hashed it in the new DB.
Has the experiment in [1], where cars pass closer, ever been replicated? Admittedly, I'm skeptical. Is it correlated to the rider being more reckless, and riding closer to traffic?
Unless you are being specifically targeted (ie. the attacker knows that you have to repeat the password twice), you mitigate the easiest possible attack: user/password combination from a stolen database.

Although I suppose this was done to force the users to change their password.
I'd really rather not. Blackboard has a reputation among students and faculty alike for being nigh-impossible to understand.
damurdock$ file /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome
/Applications/Google Chrome.app/Contents/MacOS/Google Chrome: Mach-O executable i386
damurdock$ file /Volumes/Google\ Chrome/Google\ Chrome.app/Contents/MacOS/Google\ Chrome
/Volumes/Google Chrome/Google Chrome.app/Contents/MacOS/Google Chrome: Mach-O 64-bit executable x86_64

Top is my currently installed Chrome, bottom is freshly downloaded from Google. Looks like it's time to update!
Reviewing Mobile Apps from a Software Testers Perspective
I would buy this watch, but I'm completely convinced that Android Wear is more spot-on for the watch UX with their card based user interface. It does have all these features, the glaces, the actionable notification, extension apps, but from UI standpoint it is just a card. Also, the UI on Android Wear is prettier. I'm not sure why Apple is using black ugly buttons that remind me on very first Nokia multimedia color phones.
I need convincing. Facebook can't monetize end-to-end encryption, and WhatsApp doesn't ask before uploading my contacts. Encryption from the client to the server is a start, but there's not enough here to make me use it.
I thought about this a lot when trying to come up with a very secure open source email service. Is there perhaps a way to show hashes for the coded binaries/etc that are used that could actually be trusted to be correct?

It just seems like such a chicken/egg problem. Where does the actual trust come from (like holy crap web certificates seems unbelievably broken).

Ultimately it seems like it's just impossible to be 100% for sure what is running on another persons server without having access to it. Which is unfortunate.
They can put a flag on the database and check that the cleartext you send them when logging in is doubled before hashing half of it.

I can't count how many times I've seen something that could easily be done at login time and people conclude that the service must be storing plaintext or multiple hashes.

This isn't even a direct security measure in the first place. This is to annoy people into updating their passwords.
We'll if it is utilized for the web client, one could probably use the same urls calls twitter does in the background to get possibly get better real time tweets compared to the api, but I haven't tested it out yet to see if that is true, but probably one may have more flexibility doing that anyways with being able to make calls from multiple ip address and not having to worry about rate limiting by api key.
The fact that Verizon hates their copper customers is nothing new - I had a VZ tech tell me in 2008 that they were effectively abandoning their copper network in my neighborhood and they wouldn't be fixing my line in any way that would increase reliability. Only bubble gum and bailing wire for the squeakiest wheels. Nothing has changed since then.
That the FCC lets Verizon get away with this abandonment of the copper network that they have to share in favor of a fiber network they can keep to themselves should be a crime punishable by having to use VZ DSL at the limit of the CO's range.
I read a similar article on the BBC which stated that Abenomics rejuvenated the Japanese stock market and improved the country's exports, so the government was expecting that companies which generated additional income thanks to their import would increase their employees' salaries, which seems not to have been the case.

Is there any way the government could have predicted that the windfall from stock market rise and exports would not trickle down to the general public?
Messaging App Vibers New Public Chats Feature
> Since when do social norms and expectations involve getting journalists' work for free?

That's a false dichotomy. Websites for major news outlets have always been overwhelming "free" (as in, not behind a paywall, but they obviously try to monetize through ads).
If you ever change your mind in the future, I think you would have a more positive experience with N,N-DMT. DMT is very similar to serotonin and trytophan so perhaps that's why it's well tolerated by the body.

With a breakthrough dose (e.g. 4 hits), you simply cannot believe what is happening as it's happening. It feels like you are in a dimension of hyperspace with a sensation of intelligent forces communicating with you; laughing at you in a ultra high definition resolution of colors, geometric shapes and positivity. It feels more real than reality. Whatever it is, it is certainly a grand mystery of life.
You talk about cooking meat, but we still have enzymes in our stomachs (e.g. pepsinogen) that only digest L-peptide chains. As a predator, you do not digest D-peptide chains.

- It is analagous to eating raw grass.

- It is not analgous to eating processed/cooked grains, hence it is non-sequitur.

- It is a matter of biochemistry, not culinary arts.

I gave the original speculation as an example of there being too much speculation around abiogenesis and evolution. This discussion proves it.
I love Hosain's story.

Until Startup School, I had no idea that the ideas for Jawbone date back to 1997, the company launched in '99, and over the last 15 years their team have endured some pretty crazy highs and lows - including Jawbone getting shut down and the team being locked out of their own offices by the board in the mid 2000s.

Video here:

https://www.youtube.com/watch?v=ZpINPjfSlZc
The online global leader in cosmetics, fragrance, and skincare products
> Our algorithm to hash folders produces hashes 160bits long. Which means that 2^160 -1 different folders can be securely hashed!

Except that's even more wrong. Collisions are expected long before 2^160 - 1 hashes.
There should be scholarships for a phalanx of Korean economists to go to Germany and study the world's best example. Maybe we'd get some new answers about what's going on with the old DDR's economic malaise, too.
Doubling the password is cute, but it would be even more effective to change the password for you by appending constant text to it.

The only challenge then becomes what constant text to add.

I would suggest something like, ishouldlistentosecurity. :-)
Although highly suspect and troubling, this does not necessarily require that they have all users original passwords stored in plain text. If they had originally used a hashing function that obeyed the following:

Hash(pw) + Hash(pw) := Hash(pw + pw)

(NB: Where '+' above is really just a stand-in for any pair of combining functions, not necessarily arithmetic addition or string concatenation.)

But, I agree with many others here that the likelihood of stored plain text passwords is very high.
When I was 18 I crashed riding home from the gym at night. I was jumping off of a curb and my shitty front-wheel collapsed under the weight, bringing the bike to a sudden halt and sending me over the handlebars. Wasn't wearing a helmet. Landed face first and slid into San Pablo avenue. Concussion and Ripped most of the skin on the right side of my face off. I was pretty grotesque for awhile. Half my face was just an open wound.

If I had been wearing a helmet the cushion around my head would have lifted most of my face off the ground. Probably would have ended up with nothing but a chin scrape.
Pearson does this in all of their services.
The problem is that these passwords are used on everything from printer services to cisco vpn access to federated network ("eduroam") where "client-side" isn't somethin McGill controls.

McGill does some beautiful IT admin stuff. And then it does some scary-ass shit like this.
"the helmet is a political device invoked to get rid of cyclists on public streets"

What?
Because it annoys the holdout users into changing their passwords.
I think 2014 should be the year we finally retire the millions of eyeballs meme. Open sourcing something does not magically cause people to review it.
I picked the 32 bit version of the benchmarks, since the demo program didn't need multiple GB worth of memory, FWIW.

I thought that single vs multi-core was comparable on either 32 or 64 bit.

Otherwise, I thought I was pretty clear why I picked binary tree over, say, mandelbrot set. Wanted to favor "data structure" usage over number crunching.
But that doesn't make sense - if it's true that they will not be providing a 32bit version for Mac from now on. Then most people will be stuck on version 38.
USA would happily pay $50B/year for 10 years to end this North Korea madness.
Uber's vast trove of customer data is ripe for abuse
Hopefully now they can resolve the issues that lead to Chrome having significantly less smooth scrolling than Safari and reducing the battery life of my MBP from ~8 hours to ~5 hours.
Respectfully, I'm not sure I follow the analogy. A restaurant's core business is serving food, and a restaurant charges for food. The Journal's core business is journalism, and it charges for journalism. Content isn't the "restroom" of the WSJ's business model.

As I've stated in a comment further down this tree, I don't like paywalls. I think they're an inefficient and suboptimal means of monetizing content. A paywall is basically a tax on readers who aren't savvy enough to bypass it. If you look at the economics of a paywall, it's basically monetizing the intersection of two sets of people: 1) the set of all people who really want to read the WSJ, and 2) the set of all people who can't get around a paywall when they encounter one. This intersection cohort -- call it "People who like WSJ and can't navigate paywalls" -- is probably a decent size, but it leaves a lot of would-be customers on the table. At the same time, the paywall hampers distribution and creates a bad user experience. It's an unsophisticated way to monetize content. That said, I don't find it "absurd." Bad, sure. Annoying, absolutely. "Absurd," no. Nor do I find absurdity in the premise that the WSJ should attempt to monetize its content.
Not really. A lot of people at Google are on Macs. I think it's more that the Chrome team doesn't prioritize Java support, which I think shows their priorities are pretty much in order.
The big payoff is the image at http://www.codeproject.com/KB/database/Visual_SQL_Joins/Visu...