skysight-inc/HackerNews huggingface dataset:
The "How It Works" page, https://letsencrypt.org/howitworks/, has me a bit worried. Anytime I see a __magic__ solution that has you running a single command to solve all your problems I immediately become suspicious at how much thought went into the actual issue.

If I'm running a single web app on a single Ubuntu server using Apache then I'm set! If I'm running multiple web apps across multiple servers using a load balancer, nginx on FreeBSD then...

All the same I'm really looking forward to this coming out, it can be nothing but good that all of these companies are backing this new solution and I'm sure it'll expand and handle these issues as long as a good team is behind it.
No harm to learning Python, especially when you are a student and have the time.

You need to learn multiple languages/platforms, and learn to use the best tool for the problem.
Yahoo Mail down?
As someone that ran nixos for a time I wonder if this might allow me to proceed further - with nix(os) I had some issues grasping the recipes/the language. Scheme looks much more accessible to me.

Offputting is the strong focus on libre in the announcement. While I actually like that I often find that projects that emphasize their relation to free/libre software are .. failing in the real world. Need to figure out if I could actually install useful media codecs, flash if needed, heck - maybe decss or whatever I deem necessary.
http://blog.astrumfutura.com/2010/10/nanosecond-scale-remote...

For cryptographic secrets, password hashes, MACs, digital signatures, etc. use a comparison operator that runs in constant time. Ergo, hash_equals()
Can wait until summer 2015 for a free cert? CloudFlare offers Universal SSL: https://www.cloudflare.com/ssl
ELearning trends to follow in 2015
Write Less Android Software
It frustrates me to read stuff like this because as much as it is technically sound, and will make a hash marginally more difficult to crack, I worry that complex criticisms of hashing algorithms can have the effect of discouraging application developers from using any hashing on passwords at all.

Now I am going to mention something that will be very unpopular, but it is 100% true, so try to open your mind a little before reading.

Let's compare not hashing, the worst hashing algorithm, and the best hashing algorithm. The worst will be something like MD5 with no salt, and the best using the most advanced hashing, random salts, and CPU-heavy calculations. We'll compare the effect of database compromise by a cracker on a user with a weak password (4-character dictionary word) and one with a strong password (15-character random a-Z, 0-9, and symbols)

* No hashing - weak: cracked; strong: cracked

* Worst hashing - weak: cracked; strong: safe

* Best hashing - weak: cracked; strong: safe

The best hash will protect more medium strength passwords than the worst but there is no hashing algorithm strong enough to protect the weakest passwords, and MD5 with no salt still protects the strongest.

But there are other benefits of using any hashing over none: It protects your users from yourself and other admin-level people on your team and guarantees that your application cannot expose plaintext passwords even after you leave the project.

tl;dr The difference between no password hashing and weak password hashing is significant and the difference between weak hashing and strong hashing is small.
Yeah, that annoys me a lot. Always these people who want to reject "fake" email addresses not knowing that there is a lot of weired stuff allowed according to the RFC. Funny thing, mostly these are the big corporations who rejects them, the ones who also mandate secure passwords but please without a special character, only small letters and numbers, and please not more than 10 characters. Wonder what they now do with all those new gTLDs.
Your elitism is noted and disregarded.
For those who are wondering why sschueller is saying such things (when I first read his comment my reaction was "how the f* could this be limited to Apache?", which worried me since I mostly use lighttpd), see the How It Works page [1] of Let's Encrypt.

> I would rather have the client just output the certificate and key in a dir

Could not agree more.

[1] https://letsencrypt.org/howitworks/
Why performant is not a four letter word
Actually, they are as vicious as any animal, just slower:

This is a time lapse video of a vine climbing onto a tree
http://www.youtube.com/watch?v=H9MV5CgPgIQ

I remember another time lapse video of a plant crushing a smaller plant against the floor, but I can't find it now.

Edit: Another video about fig trees killing other trees: http://www.youtube.com/watch?v=UCUtpmwacoE
It is now again online. Very strange.
> Free CA? This is cool. Why this wasn't done a long time ago is beyond me. (Also please support wildcard certs)

There have been previous attempts, e.g. http://www.cacert.org/

AFAIK they failed in the politics front (getting accepted in mainstream browsers). Sounds like EFF might have better leverage.
Actually, Tor has pluggable transports that mimic HTTP as well, though obviously the traffic is encrypted and then stenographed into HTTPish shape.

Take your FUD elsewhere.
Only with https could you be sure that your visitors are viewing the exact information you published, and that the content has not been hijacked.

Over http it could conceivably have malicious or tracking content introduced without your knowledge.
That is extremely speculative. I know you're just asking questions, but let's give her the benefit of the doubt. Most people don't do things like that and it's not nice to imply otherwise absent any evidence.
People could think they are reading an article from your site but actually they're not or the text was tampered with. With https you ensure people are actually reading what you published.
Yes, that's on my wishlist too!
I'm sure they'd support "manual setup". Not many sites would opt into running their software agent (yet). I'm expecting the client to come with a lot more benefits than "simple setup", though.
Aaron Swartz was no criminal
It wasn't done a long time ago because running a CA costs money (which is why they charge for certificates), so whoever signs up to run one is signing up for a money sink with no prospect of direct ROI, potentially for a loooooong time. This new CA is to be run by a non-profit that uses corporate sponsorship rather than being supported by the market; whether that's actually a better model in the long run is I suppose an open question. But lots of other bits of internet infrastructure are funded this way, so perhaps it's no big deal.

There aren't a whole lot of privacy concerns with CA's as long as you use OCSP stapling, so users browsers aren't hitting up the CA each time they visit a website (Chrome never does this but other browsers can do).

Re: CA compromise. One reason running a CA costs money is that the root store policies imposed by the CA/Browser Forum require (I think!) the usage of a hardware security module which holds the signing keys. This means a compromised CA could issue a bunch of certs for as long as the compromise is active, but in theory it should be hard or impossible to steal the key. Once the hackers are booted out of the CA's network, it goes back to being secure. Of course quite some damage can be done during this time, and that's what things like Certificate Transparency are meant to mediate - they let everyone see what CAs are doing.
Last time I paid attention to what the EFF had to say, they were spewing lies and propaganda about CISPA.
True, but this works for more than 10 years. There are things called basics or common sense. (o;
Well, there's a significant difference there. Hilbert seems aimed at computational mathematics more in line with Mathematica rather than the logical foundational work occurring in Coq/Agda/Idris.
Armin Van Buuren is using the Myo armband
I'm ethically opposed to Chick-fil-a's stance, but I like their sandwiches. Most of the time I don't eat them, but every once in a while, the beast takes over and I have to eat.
They want to "give the media a taste of its own medicine"? They already are. It's called marketing and advertising. The press, political parties and private businesses constantly manipulate people's opinions. They both use elements of fantasy and attention grabbing headlines.

Here's the marketing copy on Uber's website right now: "WELCOME TO ANYTHING IS POSSIBLE", "TIME, VALUE, AND CONVENIENCE — YOU CAN HAVE IT ALL", "HAVE MORE FUN WITH THE PEOPLE WHO MATTER MOST", "YOUR SHORTCUT TO EVERYWHERE IS ARRIVING NOW".

Oh really, so you're fine spewing total bullshit but you're gonna have a hissy-fit and act like a toddler when someone writes a sensational article?

Get over yourselves!
Well, tables can and do often "go wrong", but alas the success-case is rarely accounted.

I would warrant that there must be something to them, or else we wouldn't be discussing them as persistent features of a social phenomenon, which is something I think we all take for granted about software language: it is entirely social.

Whereas your extreme case is mathematically derived, our social habits occur because of decisions.
I suppose it's because of the weird footage of a birth by the end. Can't really tell what's going on there.
ACME is a protocol for securely and automatically issuing certificates. Presumably Apache, Nginx, IIS and any other web server could take advantage of it.

They are creating a new CA for this purpose.

I can't imagine this will replace the manual learn-pay-experiment-error-success process we have at the moment, so experts will still be able to control the process manually.

It doesn't address CA MITM attacks but it does significantly reduce non-CA MITM attacks by remove the two primary objections to deploying SSL: cost and complexity. Bravo EFF - this could be the most significant step in SSL adoption ever.
What's in His Kiss? 80M Bacteria
This is awesome! It looks like what CACert.org set out to be, except this time instead of developing the CA first and then seeking certification (which has been a problem due to the insanely expensive audit process), but the EFF got the vendors on board first and then started doing the nuts and bolts.

This is huge if it takes off. The CA PKI will no longer be a scam anymore!!

I'd trust the EFF/Mozilla over a random for profit "security corporation" like VeriSign any day of the week and twice on Sunday to be good stewards of the infrastructure.
Sure! If I trust your site but not my ISP, then https allows me to trust the connection between us. That means that nobody can tamper with the content and inject some malicious JS. Also, the ISP could only tell that I am talking to your server, and not anything beyond that.
I just ask at the counter "Is this hateful message day? I don't want to endorse your hateful message." If they say no, then I order a sandwich.
I highly recommend Sneakemail.com and have been using them for over a decade. They let you set up keywords, like "foo", and then you can mail anything-foo@sneakemail.com (or snkmail.com, since a few sites block the former domain) and it creates an alias. On the Sneakemail web UI you can enable/disable aliases and see recent mail. An alias can forward up to 5 people or so, and when someone sends you mail, if you reply you'll reply through Sneakemail.

Of course it's also worth mentioning Mailinator.com (one-off throwaway aliases, but public) and 10minutemail.com (super-disposable temporary email addresses).
I wish they would just work.
Example: I use LastPass, and everytime when I log in to Twitter, it asks me if I wanna save my password even though I logged in 100 times before and saved it previously. it always does this.

Lastly, it's too time consuming sometimes when I need to login to a critical service in a PC in a public place. I need to install LastPass (and hope I can install it), then login. if I remembered my password I could just login without LastPass. Those precious few mins are critical if I need to login to my host provider if my site goes down for example.
Linux RT: New stable release, but next one depends on more support from industry
> ISRG will be operating a new root CA for this project.

Are you going to be cross-signed by IdenTrust or something? If you're really going to try and create a new root CA from scratch, surely you will be impaled on the spike of low coverage for many years?
I'll respectfully disagree. There's nothing "hypothetical" about it, the guy laid out a budget and a game plan for targeted harassment and intimidation of journalists who dared to write negative press. There were multiple high-profile witnesses, and after it all came to light, he called and then emailed the journalist he threatened, to apologize profusely.

This is just one more event in a long history of Uber being an extremely bad actor. They use dirty tactics to try to run their competitors out of business instead of competing on their merits, they treat their drivers and riders like shit, they gleefully flaunt their ability to track anyone, anywhere, any time and use it against them. Now they've gone on record (his emailed apology puts the entire affair on the record, no matter what he thought during the dinner in question) admitting that they are willing to harass, intimidate, and even threaten the lives of journalists and their families.

In short, this company is ran by a bunch of sociopaths who think they can do no wrong. It's going to bite them in the ass, and I hope sooner than later.
You are right, it's just a weak secondary measure but it does not really make it any more complex for the developer while causing some headache to the attacker :)

In any case, one can seed the hashes table with a couple billion random hashes, making the lookup slower for both parties. It would hurt the attacker more, given the nature of brute force.
If you're not using HTTPS it is trivial for anyone in the middle of the "client to server and back" connection to change any of the content.

If you use HTTPS you prevent alterations to that traffic and people receive exactly what you expect they should receive.

Examples of recent ISP misbehaving on non-https websites just 25 days ago on HN: https://news.ycombinator.com/item?id=8500131

Note that the Verizon issue isn't anything entirely content altering but someone who lives in a country with strict monitoring of traffic could easily change the wording of your website to match their propaganda if you aren't using HTTPS.

So yes, your content is publicly available free stuff and no one is probably sending you user login credentials or credit cards but it still matters.
Find your new ICT related job in Belgium
I'll run a free CA right now. Who wants a cert for microsoft.com?

NB: This is a bit unfair, because the existing for-money CAs haven't always stopped someone from registering microsoft.com.
And use public key auth, exclusively. :)
This. The dumbass in the article doesn't know about packaging and made his life needlessly difficult.
Cheap flexible circuit printing heralds the dawn of disposable electronics
And then, there are carnivorous plants too.
Yeah, I think there is metadata missing from those repositories. Nix uniquely identifies a package by hashing all of the inputs that went into building it.
A day of UK air traffic visualised
Securing Mobile with AeroFS and MobileIron – AeroFS
Not really. Unless it's something static like a website, the owners need someone who they can rely on if something goes wrong.
There's hardly much to gain here.
In Go you define the methods in interfaces but implementors do not have to specify that they implement a given interface.

Instead any object (though Go has no real objects) is considered to be an implementation of an interface iff it implements all define methods.
Microsoft did not buy Nokia, just its mobile division, and the exclusive right to use the Nokia brand to sell mobile phones for some time. This is the actual Nokia corporation licensing its brand for a Foxconn tablet.
The data Tor exchanges are fixed-size encrypted packets. If Tor used plaintext http, these encrypted packets would be visible, making it trivially distinguishable from a common browser or server. The TLS layer hides that difference; due to the TLS encryption, there's no difference between an HTML document, encrypted Tor packets, or a picture of a pony. Therefore, to mimic browser traffic, Tor has to use TLS.

I believe you might be a bit confused with respect to what's in the SNI extension; the domain sent in the clear on Tor connections is not the domain requested by the browser, it is a completely unrelated randomly-generated domain name. Also, even without SNI the same can be found on the opposite direction: the certificate sent in the response also has a randomly-generated domain name.
It depends on the case, but an easy way to emit progress indicators in our system is to make the long-running service a generator. It looks like this:

g = wym('/email') #=> Generator(id=<...>)
g.on('value', (v) ->
...
)

and /email looks like:

function next(inp) { ... }
return generator(next);

Sending values in uses a slightly different syntax, and manually walks the generator through. :)

A more trivial way is to pass in a callback for the service (we call them routes) to send its updates back to, but this requires more code to send values in.

Edit: to be clear, using a Generator as above isn't very microservice-ey and will trigger our framework to start tracking local state to keep the generator around, which it will auto-free when it believes it can. This is a necessary evil with any long-running code, though. Better is to break up the code so that it may be called multiple times to progress state and returning generator('/someRoute') if possible. :P
Be careful browsing while flying Passenger ends up with a $1,171 wi-fi bill
Fastmail also does this. They have hundreds of domains you can use for disposable accounts.
"ISRG will be operating a new root CA for this project."

Does that mean every client/browser will need to be updated to include the new CA? Or will it somehow be signed by other (competing) CAs?

I like the idea of this project, and I think it's a great thing for the Internet - I just worry that it will take a long time for it to be usable in practice.
Physicists Explain Why Coffee Is More Prone to Spills Than Beer
It's always done it seems! Better off posting when Yahoo Mail is up!
"Nix/Guix are source-based distributions. They build packages in an isolated chroot, in which only the explicit dependencies of a package are available. This means that no user must rely on a server to give them binaries. Any user can opt to build any package on their own system instead, and the result will be nearly bit-identical to what's on the build farm."

While the package format RPM lacks insurance of this process, the culture of Fedora/RHEL is that packages are built using mock (as part of the koji build system), which does build everything in a chroot. And, if a package would build differently (such as pulling in different libraries, for instance) for someone using the same tools it is considered a bug and will be fixed by the maintainer.

I don't know how specific guix/nix get in this regard: Do they specify the build dependencies down to some sort of file-based checksum level? Or will they build against any compatible version of a library? If the latter, how is that different from RPM when using mock? One could just as readily end up with a very different build of a package, based on which library version is available in the repo against which the package is being built.

One could lock down the remote repository to create predictable builds (i.e. only use the Fedora version 20 repo, with no updates; or the Guix version whatever repo with no updates), and presumably either would produce very predictable builds (I know the Fedora case would).

So, what do you mean when you say "reproducible"? Is it really specific and unforgiving of new versions of things? Or, does it allow for newer versions easily? RPM allows one to specify things with extreme specificity (down to the exact version and package revision), but one rarely does that if the package will build successfully with a range of versions.

I'm not sure I'm convinced this is a unique feature of Guix/Nix, is what I'm trying to say.
Finally! Man, is getting and managing certificates a pain in the *ss for our small shop that does a great number of small websites.
What about Telegram? I've been fairly pleased with it and its interface is a shameless rip off of WhatsApp. (which isn't a bad thing mind you)
It's speculative, but not extremely so. Most people don't randomly suggest they'd be justified going after other people's families after simple criticism, so let's give everyone the benefit of the doubt.

EDIT: according to other posters, who read the website in question, Sarah Lacy regularly reports on people's personal lives. Which sounds like exactly what the under person was talking about doing back.
I'm relatively new here. While I do run across comments where people seem to be talking down to others, I see that they are mostly in the minority. That is very refreshing, compared to most other sites where intellectual conversations are taking place.

I usually just chalk it up to the difficulty in conveying emotion through strictly text. In the case where it is obviously not so, it's easy enough to ignore the person.

Basically, there's always going to be one or two of that guy in any conversation. I'm just happy that they're seemingly kept to a minimum on HN.
Hrmm, can I cancel my pre-order? A-hats.
Wow, thats horrible. The US needs an organization that goes after the careers of politicians that pass those kinds of laws, thats the only way to stop them.

Still, there must be ways to protect such information as freedom of speech?
Show HN: My iPhone app – Jiffies – Video messaging app with one touch
For Cloudflare customers...
It kinda bugs me when people describe +foo as a "gmail trick". That type of addressing predates gmail, and exists outside of it still. In fact the plus is not the only form of this. qmail uses the dash, and postfix allows you to configure anything as a separator.
Wow, awesome tips! Will check them out and write a follow-up
Because acting on observations such as yours is directly against the spirit of due process and lawful justice. Even if it's "obvious" he could not have obtained those bitcoins legally, that does not change the fact that the law enforcement should not touch it until the verdict.

I don't know how to make it any clearer, either you understand that having a lawful society requires following the law to the letter even if something is painfully obvious, or you don't.
If each domain name can get a non-wildcard cert for free, quickly, why do you need wildcard certs? For multi-subdomain hosting on one server? Just wondering.
Having a detailed knowledge about how google handles permutations of email addresses does not fall within the realm of common sense, nor "basics."

The length of time that it has existed is irrelevant--it's simply not commonly used yet. It's advanced usage, not basic.
Yes, a great deal. Nokia is still an independent company, even though it sold a division of theirs to Microsoft a while back.

Microsoft also bought a license to the Nokia brand on select products for a set period.
I think the issue of whether or not there should be a wide new industry borne on the back of the CA architecture, its all a bit of a red-herring, anyway. This is only security at the web browser: do we trust our OS vendors to be CA's, too? If so, then I think we may see a cascade/avalanche of new CA's being constructed around the notion of the distribution. I know for sure, even if I have all the S's in the HTTP in order, my machine itself is still a real weak point. When, out of the box, the OS is capable of building its own certified binaries and adding/denying capabilities of its build products, inherently, then we'll have an interesting security environment. This browser-centric focus of encryption is but the beachhead for more broader issues to come, methinks; do you really trust your OS vendor? Really?
This looks interesting - is there an option to try a demo version?