skysight-inc/HackerNews huggingface dataset:
First off, if the Pope said that, it wouldn't count.

Therefore, faithfully adhering to the tradition received from the beginning of the Christian faith, to the glory of God our savior, for the exaltation of the Catholic religion and for the salvation of the Christian people, with the approval of the Sacred Council, we teach and define as a divinely revealed dogma that when the Roman Pontiff speaks EX CATHEDRA, that is, when, in the exercise of his office as shepherd and teacher of all Christians, in virtue of his supreme apostolic authority, he defines a doctrine concerning faith or morals to be held by the whole Church, he possesses, by the divine assistance promised to him in blessed Peter, that infallibility which the divine Redeemer willed his Church to enjoy in defining doctrine concerning faith or morals. Therefore, such definitions of the Roman Pontiff are of themselves, and not by the consent of the Church, irreformable.
http://www.ewtn.com/library/COUNCILS/V1.htm#6

Second, we don't have time to become experts in every subject, so we defer some decisions to existing experts.
While DNSSEC certainly deserves a lot of criticism, I think some of the points are unfair.

> Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys.

(DNSSEC's, and thus) DANE's security can break down at every parent DNS zone. For bit.ly the parent zones are the .ly top level domain and the root zone. Each of them (but only these two) can forge valid DNSSEC records. With the current X.509 certificate infrastructure there are more than a hundred root CAs who can issue malicious certificates for use with TLS. Even though I certainly dislike the centralized nature of DNSSEC, it is hard to argue that reducing the attack surface from over a hundred institutions to two or three doesn't constitute a marked improvement. Specifically, domains like tumblr.com whose domain path is completely US hosted will no longer have to worry about "obscure" foreign CAs like "Unizeto Certum".

> In fact, it does nothing for any of the “last mile” of DNS lookups: the link between software and DNS servers. It’s a server-to-server protocol.

DNSSEC is decidedly not a server-to-server protocol. The signatures are created offline and can be verified by any party, even when they come out of a cache. In contrast, DNSCurve is a server-to-server protocol, which only secures the transport layer, but not the data itself. The post refers to the aspect, that stub resolvers (those software parts of your OS that look up the query at your ISP caching DNS server) where not envisioned by the designers of DNSSEC to verify the DNSSEC entries themselves. Nonetheless, there is nothing that hinders them from doing so and I would expect that feature to be included once DNSSEC is spread enough to justify the effort. In fact, you can already check how this would work using the dig request `dig @8.8.8.8 +dnssec example.com` which replies with the A record and the signature on the A record (you still need to get and verify the zone key of example.com though).

> DNSSEC changes all of that. It adds two new failure cases: the requestor could be (but probably isn’t) under attack, or everything is fine with the name except that its configuration has expired. Virtually no network software is equipped to handle those cases. Trouble is, software must handle those cases.

I'm curious about why software would have to handle these cases. For the end-user a binary "lookup went well, here is the result" / "there were some errors during the lookup, sorry I can't or won't give you a result" should be totally sufficient. Firefox should not confuse the user with detailed difference between "I can't verify this record, even though the parent zone says it is DNSSEC enabled" and "I can't resolve the name at all", so why does Firefox need this information?
Hey, that looks nice! kind of reminded me of django-cms a bit (although theyŕe different beasts).

EDIT: It doesn look like it's available for linux though...
The primary danger is that you might end up in jail. You are in a dark alley, someone tries to mug you, you shoot them dead. No witnesses.

Police find a lot of money and some drugs on your assailant. They suggest that foul play was involved. A drug deal gone wrong. Under pressure you misremember certain facts of that night. The police notice a discrepancy in your story and build a case out of it.

A second danger is that you might aim a gun but not be able to pull the trigger. A large percentage of soldiers in WWII found themselves unable to kill someone, even when their life was in immediate danger.

Subsequently, armed forces spend a lot of time on psychological training to turn recruits into killers. You presumably haven't had this training, so I would bet money that you wouldn't be able to kill someone.

A third danger is that your assailant might have a gun too. In this case, the fact that you are carrying a gun cannot help you if they point theirs at you first. It can definitely get you killed if they notice you are armed.

(for the record, I didn't downvote you)
It only takes one call to CPS for things to suddenly go very very wrong.
NFS has many problems but Kerberos support isn't one of them. It was designed from the start to be part of NFSv4, and is the most straightforward way to secure it.
Awesome stuff James :) I've been having a lot of those weird client vs. server realizations myself. Still getting used to thinking about stuff that renders in both places.

I'm particularly interested in hearing about your ansible + docker setup. I've been using both a lot lately, and trying to figure out the best way to use them together.
That's an excellent restatement of my view, yes. Thank you for reading it thoughtfully.
Though the driver's desire for unobstructed travel is just as legitimate as anyone else's, the amount of land area required to cater to that desire is far larger than that of the pedestrian, cyclist, or mass transit user:
http://3.bp.blogspot.com/-JFCIT3QO2IE/UxqPRqcRK7I/AAAAAAAAY3...

Beyond simple use of space, cars moving at high speeds preclude a safe and pleasant experience for those outside of cars. The driver's desire to travel at high speeds is perfectly reasonable, but when we as a society attempt to meet that desire in a dense urban area, the result is unpleasant at best and deadly at worst.
I thought about building a CMS in this way, but it was easier to build it as a normal CMS and stick Cloudfront in f front of it.
I'm confused. C# doesn't even support global functions. In your example, it's a static private member of the AI class. Why is it wrong to generate

var AI = {
GetBestMove: function(....) { ... },
...
};

?

Another thing, I had someone tell me once that according to Erik Meijer (of LINQ and Rx fame), years ago, Microsoft tried a C#-to-JS compiler too. It worked, but they had good reasons to drop the project anyway. Did you ever hear about that, do you know Microsoft's reasons for doing TypeScript instead? Are they still valid?
id be tempted to open the phone up and snip the speaker connections
I'm still working on a generalized system (not OS specific), with ZFS support in there and working. Have begun discussions about open sourcing this with management. In theory it will let people go 'show me this thing on <x> platform and <y> platform, benchmarked'. Platform strengths will then speak for themselves, and platform maintainers will have the same version/build/evaluate loop that regular service developers use. http://stani.sh/walter/pfcts/
Damn it, pedestrians should be able to go anywhere at any time they please.

Airport tarmacs, power stations, water treatment plants, you name it! If I want to step off the train station platform and onto the tracks, it's my god-given right.

"Authorized Personnel" or "Staff Only" be damned, along with "No Tresspassing".

"Sign sign, everywhere a sign / Blocking out the scenery, breakin' my mind ..." goes the song.

It's all just a scheme to repress the people. Or rather, to repress them in a small way so their attention is thwarted from the big ways. Yeah, that's it!
In the rust example error handling is enforced via the type system whereas with Go it depends on your (and others) discipline.
That is definitely a terrible thing to do.
How much more centralized does DNSSEC make the Internet? It's already bad enough that people are calling for mandatory TLS for all websites (though with free certs from the EFF/mozilla that will be a bit less painful) but if I want to have my own DNS root, or play by my own rules on the net, will running my own infrastructure be harder with DNSSEC?
Gmail, Slack, Drive, Audible, and Twitch.tv
I just find them hand holding and limiting.
jaywalking is not a crime in my country, when I'm in the US one of my biggest fear is to spend the remaining days of my life in a US prision for a stupid thing like jaywalking.
You can now get 1 TB SSDs for ~$380, put 8 of these in RAID-10 (or 5 with HW RAID) shared over a 10 GBE NIC with NFS to workstations with 1 GBE / Jumbo frames. Nothing fancy, performance should be good.
Definitely worth another post for that! I'm still an amateur with these server ops tools, but I like what I have so far.
But only those of you Swedes who are QA engineers still look both ways even when crossing a one-way street.
Right. I also love 't' to have insta-search on all filenames in the repo. Hit enter once you find the file you want and there you are.
They'll have to update the acronym DPR to stand for Doughy Pirate Roberts.
This is a bit of a philosophical question, and I don't think you should take it too literally, but here's what I think. If race is one of the variables, then due to correlations created by society, race might be learned to be a negative signal, which is racist. If it isn't one of the variables, it might be still inferred. For example, if your purchasing history is an input, there is probably a correlation between purchase of cosmetics for blacks and chances of incarceration, which, in turn affects your chances of loan repayment. The correlation between being black and buying, say, hair-care products for blacks is direct and causal (and completely non racist -- there is no effect on power), so this could be an almost perfect, and neutral, proxy for race, and, in fact, might be the best and simplest correlation the program could come up with.
Perhaps he is referring to http://dnscurve.org/
Different countries have far different degrees of automobile use. Essentially nobody commutes by automobile in Tokyo or Manhattan, and those cities are organized around major railroad stations as opposed to highway interchanges, with neighborhoods designed to satisfy needs in compact walkable areas rather than distant auto-oriented shopping centers.
I never realized there were people who had to walk across an airport tarmac or a water treatment plant to get from home to the corner store.
5 Reasons the Academy Overlooked ‘The Lego Movie’
Sorry, but this jumped out at me:

> This statement was corroborated by a tweet from Vice reporter Kari Paul, who has been in the courtroom since Ulbricht's trial began on Tuesday

I hope they bring her some food and let her go to the bathroom once in a while!
An early modern color guide
Ask HN: Finding work in another country as Junior Developer
Hey HN, I'm a Junior Developer about to finish my BSc and for various reasons I'm looking to find work in a foreign area.

I'm a Canadian citizen and I am looking towards either working in Germany or California.

I'm fully willing to relocate and I'm primarily looking for positions in Web Development.

I was wondering what sort of hurdles and steps I might need to take in order to achieve this goal beyond simply bolstering my resume. What are the best channels/means of finding companies willing to hire international employees.

I realize this might be an unrealistic goal and I would appreciate peoples perspective on that as well. I could just work in Toronto but I would like to take the opportunity to travel somewhere new and challenging to work while I'm young. Ideally I'd be working in an area where the tech culture is booming.
First, I'd be a little happier if you didn't misquote me for the convenience of your comment. These weren't my subheds. You've rewritten some of them, condensed others, added one, and misread another, which lead you to suggest that I hadn't "allowed for enumeration of zones" when in fact there's a whole subhed dedicated to it. You could just clarify at the top of your comments that your numbered list is your own, not mine. I'd then strike this part of my comment.

Now then:

1. I do not argue that the CA PKI infrastructure is working. In fact, I state explicitly that it is not. The problem is that DANE's replacement for the TLS PKI is controlled by world governments. At a broader level, the problem is that centralized PKIs don't work against nation-state adversaries. The solution for the TLS CA problem is (a) a race to the bottom for CA pricing, led hopefully by EFF, (b) widespread deployment of public key pinning, which serves both to thwart CA attacks and to create a global surveillance system against them, and (c) the eventual deployment of alternate opt-in TLS CA hierarchies, such that users could for instance subscribe to a hypothetical EFF CA hierarchy. DNSSEC accomplishes none of this.

2. Yes, DNSSEC is a government-controlled PKI. Your whole argument here is that if governments abused it, the Internet would "route around it". You can't make that argument without conceding my point.

3. I didn't write "DNSSEC is insecure" (though I think it is). I wrote that it's cryptographically weak, which it is: it's PKCS1v15 RSA-1024. Crawl signatures back to the roots: you'll see RSA-1024 all the way at the top of the hierarchy. TLS has already deployed forward-secure ECC cryptography and will by the middle of this year see widespread deployment of Curve25519 ECDH and Ed25519 deterministic signatures. DNSSEC simply will not: it will be RSA-1024 for the foreseeable future.

4. "DNSSEC is expensive" is not a subhed in my post. "DNSSEC is expensive to adopt" was, and it is: virtually no networking software currently handles soft failures from lookups, which are a universal shared experience among HTTPS users, and will occur just as frequently with DNSSEC (should it ever be deployed). "DNSSEC is expensive to deploy" is another point I made, which is also true: of the top 50 Alexa sites, why not go look how many are DNSSEC-signed?

5. "DNSSEC is hard" isn't something I wrote at all, so I don't know how to respond to it.

6. "DNSSEC makes for DDoS" is something I think is probably true, but also an argument I wasn't willing to go to bat for, because amplification attacks using ANY queries against normal DNS also work. But sure, if you want to add fuel to the fire.

7. "DNSSEC allows for enumeration of zones" is captured under "DNSSEC is unsafe" in my post. If you answer to this is "don't use DNSSEC for important zones", then we agree, modulo that I think you shouldn't use it at all.
I thought "barely profitable" was what a free market will do to any resource.
Jekyll reminded me of Netobjects, I was surprised to find out the software brand is still around and still providing a GUI for static site generation.
The 20-Second Modification I Do with Any Mac
Probably because that's the way the Internet worked before the Big Media companies infested it and started the process of turning into Cable TV 2.0.
>"The F-35 utilizes a "smart helmet" (or whatever the thing is called)"

The Apache helicopter pilots in 1985 had helmet mounted displays (HMDs). I remember being blown away when I first saw a demo. They could select a target by looking at it!

http://en.wikipedia.org/wiki/Helmet-mounted_display
Securing the Network Time Protocol
And (as I previously noted) all Verizon has to do is *check the IP address of the client(!). They know the IPs they own.

Assuming that your adversary is dumb as well as malicious is a mistake.
You can specify a specific version of a plugin in the Gemfile and it will never change, but you'll be able to update everything else.
Yes, that's the current process for importing torrents. Making an automatic import / update is high on my priorities.

It uses a unique key on the infohash, so it skips duplicates at the moment. I've thought about concatenating the categories info when duplicates are found, so a torrent on kickass in Movies and Demonoid in Anime will merge to be 1 torrent with [Movies, Anime], but it isn't too high on my priorities considering I still have to add a UDP tracker scraper.
Looks amazing! Huge fan of Octopress, but I'm looking to turn my blog multi-language and the way Octopress is currently set-up makes it a bit of a pain, but it looks like it will be quite a bit easier for anyone to make an Internationalization plugin for Octopress 3.0. Is anyone working on one currently?
Upcoming Events in the Knowledge Graph
VPS seems to require VIMAGE, which currently is a no-go for me (I experience kernel panic on boot if I compile it in), and the second link… well… the tinfoil hat of the author's blog has to be impressive. I've tried to read this and some other rants (they pop up quite high in search results), and couldn't find any actual content or any sources for the statements.

Capsicum and rctl are definitely on my list of things to look into (especially capsicum, it seems to be enabled in the GENERIC kernel configuration).
This kinda sucks because, even though Radio Shack has always sold kinda cheap quality components, there were always there when you needed an adapter or plug or cable immediately.

It seems like there are a lot of good ideas here about what market radio shack can go after, from the 3D maker crowd, to boutique electronics, etc. I think it would take quite a visionary high up in the RS corporation to make that happen, but it would be cool.
https://www.reddit.com/r/im14andthisisdeep/
The most over-engineered blog that I know of is Casey Muratori's at http://mollyrocket.com/casey/ . "View source" and you'll see a long list of auto-generated variables and function calls, unlike anything else you've probably seen for any website.

Casey attempts to explain what he did in a podcast[1]. Apparently, he was frustrated enough with CSS's margins that he built a layout engine in C that calculates offsets for every piece of text in the page, then generates hundreds of lines of Javascript that apply fixed positioning to arrange the text.

[1] transcript: http://mollyrocket.com/jacs/jacs_0004_0010.html
Vault of Satoshi Is Closing Down, Charging Holding Fees
Yes. If a CA egregiously misbehaves today, Google can kneecap it with an update to Chrome, and end-users can remove it from their configuration entirely (this should be easier to do, by the way, and there's no technical reason it can't be).

If the signers for .LY or .COM misbehave, nobody has any solid recourse. .COM's role in the post-DANE certificate hierarchy is baked into the fabric of the Internet.

DNSSEC represents a massive move towards centralization of Internet trust, which is a baffling thing to get behind in 2015.
Frequent social media users don't have higher levels of stress
the only time glass has felt useful is on my bike. whether it's recording a video (to show off, document in case of accident, etc), getting sms without having to stop, getting directions...

the problem is wearing it and getting in an accident is basically asking to wear an eye patch.
New York's been following what's called a "broken window" policing strategy. The premise is that you go into areas that have high rates of (serious) crime, and do zealous enforcement of even minor crimes (graffiti, jaywalking), and that this sort of enforcement contributes towards the reduction of the crime that matters. It's named for the premise that ostentatious signs of lawlessness and urban decay (like broken windows) invite further, more dangerous, disorder, like gangs staking out turf and assaulting/robbing people passing by.

This sort of policing policy is controversial in New York and is relatively uncommon in the rest of the nation.

For what it's worth, violent crime and murders in most of these predominantly-minority communities has been reduced substantially in the past several years. However, it seems to result in at least some members of the community feeling substantially more oppressed, and it does result in inequal treatment of minorities by police if for no other reason than geographic correlation.

(Disclaimer. The general desirability of this approach is neither endorsed nor condemned herein.)
Let's stop with all the nostalgia for the Radio Shack of old. They haven't been that way for 20 years. Their management has completely misread the market, they abuse their employees, they offer nothing you can't get elsewhere, usually at better prices, and, frankly, they have become like your crazy uncle: prone to doing something odd, smells bad, and is constantly embarrassing the family.

Stick a fork in them, they're done. They won't be missed because there is nothing there to miss.
Not really, I'd say that in either case my original point still stands.
Sounds like you need a scale-out filesystem like Ceph or Gluster.
puts on his compliance hat

Many organizations are mandated (by statutes etc) to use elliptic curve based cryptography already. It is not because RSA is broken, but because the key sizes would have to be uneconomically large.

The key size requirements are picked based on the advancement rate of technology (mathematics, calculation power / price), and the time the data should stay protected. Many security related standards aim for several decades, and for RSA key sizes that does not look so good.

If the system is not already in wide usage, rolling out a major protocol that does not contain support for ECC at this time is a very, very bad choice. Many organizations have simply to disable it already because it violates the requirements. (Oddly I have seen being not encrypted not violate anything, because "that's the way DNS is"... Go figure)
"But you would also see high end stuff you normally cant buy in best buy because its too expensive to have the inventory floated to all their stores."

While I admire what you came up with there are 2 big problems working against this:

First, I can buy nearly all the high end stuff you list at my local Best Buy. Beats by Dre, Bose, Nest, iPads & iPhone 6+'s, Flagship Samsung phones/smart watches, Thinkpad laptops, high end receivers, etc. Some of the pro audio stuff (amps, mics, etc) isn't top-top, but for that honestly you are better off at a music equipment stores. So they would have to go uber high end, and that's just not going to happen with their current brand image. That market is also insanely small and needs a correspondingly small footprint. Even closing 90% of their stores may not be enough.

Second is store size and location. Best Buys are enormous. They can have the high end glam to get people in the door, and still have room for the mid grade consumer stuff most people buy. These stores are larger yes, but rent/square foot are way cheaper than a little 1000 - 1500 sq ft Radio Shack. Street frontage and site location are terrible for radio shack. The closest one to me in Atlanta is sandwiched between a UPS store and a nail salon, at the very end of a strip mall with a grocery store as an anchor. Foot traffic must be terrible.

Boutique might could work, but a huge number of tiny retail shops are a giant albatross around Radio Shack's neck.
If the CA signature means anything, you don't need DNSSEC.

If it doesn't, you've given control over the certificate to Libya.

It is easier to see the problem when you look at the real issue, which is that the NSA controls both the CA hierarchy and .COM.
Coraid is downsizing, laying off 1,700 employees
Talk about bad timing, I just moved from Octopress to vanilla Jekyll yesterday. The only thing I really miss from Octopress is the CLI for generating new posts and it seems I'll be able to use it again, yay. http://prose.io/ is also an interesting project for editing posts.
There's an entire country chock full of low density suburbia in between Cambridge and Silicon Valley.
But is it responsive!? /s
My Male-Centric View of the World (2013)