skysight-inc/HackerNews huggingface dataset:
Slightly OT: CDNs basically perform a MITM to do what they do. The destination site's certificate (www.destination.com) is deployed throughout the CDN's servers and when DNS lookups are performed, the end user is directed to the IP address an optimal edge server where the certificate is waiting to greet them warmly. On the other side (first mile), the CDN then connects via a second SSL certificate (say, origin-www.destination.com) to the origin's datacenter(s) to retrieve the necessary data.

When I worked at a CDN company, we frequently got inquiries from customers saying that a security audit they ran threw up a red flag for MITM. And it was my job to tell them why it wasn't anything to worry about.

PS, most origin-www.destination.com origins are extremely vulnerable to DDoS since, at that hostname, there is no CDN to protect them.
I love when action is taken after people write successful blog posts.
Didn't I see a comment in another related thread that said that, for antitrust reasons, Microsoft wasn't able to prevent OEMs from modifying Windows?

Recall that Microsoft tried to keep OEMs from preloading Netscape and consequently got sued by the US government. There's no way Microsoft wants to reopen that can of demons.
Right. They're trying to tell you "you can't do that", but have no good way to do so. As I pointed out when this came up last time, the problem is that current network stacks and browsers don't propagate ICMP Destination Unreachable subcodes (such as "Host Unreachable - Communication Administratively Prohibited") up to the user. That's the proper way to express "you can't do that". Unfortunately, most OSs treat network errors like file errors, hammer them down to some small set of "errno" values, and lose the detail.
Not being the government doesn't give anyone a strong right to build mass surveillance databases to target individuals.
Absolutely. Companies that are afraid of failed candidates badmouthing them on here ought to consider making their candidate experience better.
further to this "bitemyapp" has a very good starting point for haskell newcomers https://github.com/bitemyapp/learnhaskell
I'm confident that many PC manufacturers would be happy to remove the crapware themselves, if they could find customers who would pay extra to offset the revenue they'd lose.

Their margins are so thin that crapware keeps them in business. And since the hardware and (windows) software is commoditized, they compete with very few points of differentiation.

Build quality, fit and finish, battery life? Those customers go to Apple, by and large. And never come back.

And this is why Apple will never license OSX. Why they'll never sell it to you to run on a hackintosh or a non-Apple host VM. They literally cannot afford to.

Consumer Windows will never escape the swamp unless Nadella changes the licensing restrictions, thereby raising the price of all Windows machines across the board. I really hope this happens -- but I'm not sure he's brave enough. There might also be legal fallout.

Windows Signature Edition (seriously?!) is available today, if you are willing to go out of your way, but it is not a mass-market product.
Being able to run old legacy code is one of the most important arguments for C++. Every new feature is add-on (not "upgrade" and not "migration").

At the fast pace things develop for Rust I hope that the language will have a good way to handle Rust 2.0 code together with Rust 1.x code. IMHO providing practical tools for an upgrade path is something that should be thought of before releasing 1.0.
> Thank you for clarifying that.

No problem, it's wrong that your comment was downvoted. Even with my upvote it's still grey.
What's the recommended way of using something like this or prism.js to highlight a simple textarea containing code?

I'm not talking a full-on programming editor, that's a much larger scope. Rather, I have an admin tool with a <textarea> that allows entering short code snippets, and it would be handy to see highlighting as you type. Even at this low level of complexity, is it simpler to just embed something like Ace, or is there an easy way to use a highlighting library?
The Way Things Work by David Macaulay. Especially if we still had mammoths. http://www.amazon.com/The-Things-Work-David-Macaulay/dp/1405...
The amount of all-round bad advice on SO is staggering. It also encourages "copy-paste" coding and systems engineering, without the engineer really understanding the issue.
Interesting speculation. Anecdotally, I've heard that in some H1B situations where real estate is purchased, a % of the sale price is given back to the Chinese government.
I am not sure TechCrunch understands what "eats" means in the context of "software eats _____."
For some reason it connotes comparison to a militant leftist activist, like a Sandinista. That doesn't seem like such an inaccurate connotation with respect to Snowden's supporters.
http://blog.stackoverflow.com/2008/09/what-was-stack-overflo...

I think there might also be a codinghorror blog post that details why they picked .net, but I'm having a hard time finding it.
Making sure you get paid by your clients
SaaS for Pimps?
> I'm confident that many PC manufacturers would be happy to remove the crapware themselves, if they could find customers who would pay extra to offset the revenue they'd lose.

Which is exactly why only Microsoft can solve the problem. When it's up to the OEMs, if even one OEM chooses to keep the crapware, they can undercut the others on price and eat their lunch. So the others are forced by market pressure to bundle crapware too, in order to get their prices down to the same level. If any one OEM tried to break the cycle, they'd just get clobbered by the market for having higher prices. It's a classic race-to-the-bottom scenario.

The only thing that can break the cycle is if the choice is taken away from the OEMs entirely. Then no one bad OEM can start the cycle over again. But only Microsoft (well, Microsoft or the government) is in a position to do that.
My attempt at a tl;dr:

We cannot afford to license all content from all studios (and compete with Comcast/AT&T etc), so instead we will spend 5b trying to create our own content (and compete with HBO instead).

Oh and we will be spending half a billion on marketing.

(did I misread)
If I receive and use/sell stolen property, I've broken the law even if I didn't steal it.

I would think if anyone could work their way through the "standing" restrictions, it could be shown in court that the NSA violated the Constitution by receiving "stolen" surveillance data.

The reason why we have the 4th Amendment is not because the act of spying is feared (as egregious as that is), it's because of what the government might do with the results. So receiving the data violates at least the spirit of the constitution, and I would think the letter also.
All Hell wouldn't break loose, because FarmLogs isn't unique. Deere and Monsanto each have their own "cloud-based" farm management products: Deere with myjohndeere.com, and Monsanto with the Climate Corp umbrella (including Precision Planting, FieldScripts, etc).
World's Top Arms Importers Visualized
Can't tell, makes sense reading it, but while holding the candle I got stuck thinking without electricity I can't even pee.
This is ludicrous and ill informed.

To put someone in jail, typically they need to commit a crime. If someone lies about their income, and borrows money based on that information, the borrower has committed fraud, not the lender.

I'll grant that it is immoral to steer someone into a loan which they probably won't be able to repay. However, unless the lender's agent materially misrepresented the loan, it is not illegal.

The originate-to-sell model does introduce perverse incentives on the part of the lender's agent -- prudence takes a back seat when you don't hold the note. But if a borrower lies, and the lender's agent willfully ignores the lie and then sells the loan, both the agent and the borrower have defrauded the buyer of the loan, and it is that investor who is the victim of the fraud.

No one was making borrowers take out loans. The reason why no one is going to jail, is because no one is wants to talk about 1) the culpability of the borrowers; and 2) the trillions of dollars of lost wealth did not flow into Wall Street bonuses, rather it went into loans to the public which were not repaid.
Did the Torture Report Give the C.I.A. A Bum Rap?
This is an entirely valid point.

The 'natural resources' that enable /easy/ development of civilization aren't anywhere near as common, if they even exist.

What's necessary is a more adaptive approach and possibly some caches of resources that would be necessary to bootstrap once again; also a form of storage which won't degrade in just a few hundred years.
But you might do something wrong. Or something innocent you did today may be illegal tomorrow. And when those days come, the NSA is ready and watching.
While what you explain is correct, willfully giving/deploying your certificates in another server probably doesn't count as MITM
Time to bid a farewell and switch my mindset to Google Play, Vudu, and Amazon Instant Videos. I get less bang for my bucks with Netflix and I'm not into TV shows to justify with their "original" stuff. Why do they want to get into this game when all HBO needs is to open HBO Go to everybody for $7.99/mo?
I hate to collapse the high level of discussion on HN all the way down to the least common denominator "my computer doesn't work" discussion, but ...

There is no such thing as cleaning your PC or removing the malware or removing the virus(es).

You reload the OS, from scratch, with non-OEM (that is, generic) OS media. Otherwise you will lose.

This has been true for 20 years and it only gets more true as OS software becomes more abstracted and tightly coupled to hardware.

Do not remove superfish. Do not "clean" your PC. In fact, don't even upgrade your OS from one major revision to the next. Wipe your system, install from generic media.

Tell everyone you know.
I restore old Teletype machines as a hobby. Only WWII and earlier machines, ones that are much older than I am. The oldest machine I have is from 1926, and it's fully restored. It's currently in my living room, hooked to a Reuters RSS feed via a USB to Teletype converter I built and an old EeePC subnotebook hidden away in a cabinet. Push the button and the current news prints on a long paper tape.

A completed project: http://www.aetherltd.com/refurbishing15.html

A project in progress: http://brassgoggles.co.uk/forum/index.php/topic,43672.0.html

There's a hobbyist community restoring these machines, and full maintenance documentation is available. Restoring them isn't too tough. They were designed to be maintainable. The guys who try to restore minicomputer Teletypes from the 1970s have more trouble than those of us restoriong the 1920s and 1930s designs.
Thankfully, some people already have much more reliable lifestyles on this planet.

Thankfully, some people already sense coming storms (ie ecological, financial, electrical grid dependency collapse, pandemic, etc), and work on adjusting their lives for independence.

Thankfully, some people end their addictions, cut out distractions, tune out mass media lies, etc to focus on what's important and build new lifestyles with beauty and abundance...

Unfortunately, many more people want to stay asleep and enjoy these pretty, blinding lights before they'll notice a wider world changing around them.
Aww, really? This is the first I've heard of this.
Only if the root cert store of the user's machine has been tampered with. If you have a valid cert store, you can detect MITM attacks on HTTPS connections.
For a split second I thought somebody had attempted to put a bee hive on their desk.
It's not at the level of animal husbandry or first aid, but I'd hate to think of the Feynman Lectures being lost.
I think there's about a dozen startups in Australia doing something similar. Sort of makes me wonder why Farm Logs is getting so much press coverage recently - I can only suppose that being in the US and having done YC is a huge boost.
Limelight on Product Hunt
It should be Sarah Harrison, this title is fucking terrible
>Scientists create more wealth than managers

[Citation needed.] While I completely agree that progress in science creates much more value than efficient management, a very small fraction of research efforts actually yields any useful results (as you mention downthread). Abstract value is different from wealth.

Even assuming that value translates proportionally into wealth (a huge assumption, considering that commercialization itself of scientific advances is risky and often far into the future), how can you even try to consistently determine the wealth an average scientist creates?

This is why science is like the startup game that VCs play. Invest a pittance into people who see promising and hope one of them turns out to be the next Google. Of course, despite the immense wealth a Google creates, all the non-Googles get nothing.
That would seem like an odd thing to do.

Most supporters of Snowden, as well as he, present him as a patriot, a defender of the constitution in the face of a spying apparatus which has lost its way. So I would think the last thing they'd want to do is present him and his associations as militant leftists. Therefore, if the assertion to add "a" is a kind of nod to leftist activism, that would seem to betray Snowden's expressed intent.
The HTML doc title is more neutral and accurate. We switched to that.
> Maybe this is a practice that needs to stop. Malware scanners can scan on the local machine after the browser has decrypted the communication and web filtering, I think, is nothing but a sign of mistrust against the users.

It's really kind of a giant security vulnerability. If an attacker can compromise the machine doing the MITM on all the encrypted connections then they get every password and credit card number for every user in your company for every website.
The last thing I would advise any non-technical (and even technical!) person to do is to go to github and download a bunch of executables and see what happens.

Zero kudos Lenovo.
I think the two scariest discoveries with Superfish are that Microsoft allows an OEM to ship a retail Windows computer with additional root certificates, and that Chrome is trusting the root certificates stored by Windows -- Firefox does not.

My proposed actions:

(1) Microsoft should immediately update their OEM agreements to ban all manipulation of root certificates for computers sold at retail. Further, the root certificate store should be cryptographically signed by Microsoft and this signature validated during Windows OOBE.

(2) Google should follow Mozilla's lead and have Chrome securely manage its own root certificate store. (It could be disabled for legitimate corporate deployments, but never with the regular end-user Chrome installer.)
The Zenhacks Challenge
if we're going with the Chinese investors are inflating real estate prices theory - most Chinese people would probably find the cold winters in the rest of Canada a deal breaker, whereas the rain in Vancouver is a mild inconvenience. If you don't want to go to the US, Vancouver Canada and Australia are at the top of the list - Vancouver doubly so because of the large native Chinese population.

Personally I think the foreign investment segment in the Vancouver real estate market is a bit over-reported. A large part of the demand here comes from East-Asian immigrants (30% of the population) who will buy a home despite renting being a better fiscal option. This is reflected in the gap between ownership and rental prices.
The Chinese could bleed $100B/yr into the west coast of North America for years and not blink.

That's cash, not derivatives, in those minivans. They're settling here, unless you think they're going to fall in love with Detroit or Wichita.

This is the new normal.
Another beekeeper here. There's no reason to believe that the bees will uncap the now empty cells to refill them post Flow extraction. I'm with tehchromic and the beekeeper that panic posted - this is a fad/sham. All of the Master Beekeepers I know agree.
From Dot-Com Zero to Hero: One Man’s Story (Reddit Co-Founder Story)
Well, then we both know what we are talking about. Do governments manage currency? Yes and no. On paper they don't, in reality they have a lot to say about a country's monetary policy. However, if you look at the world's second strongest currency, the Euro, it's apparent that the European government doesn't have that much control.
A law of nature? Are you joking?

It absolutely has been set up this way, after having been set up in the opposite way for quite a while.

> Historically, some cultures (e.g., Christianity in much of Medieval Europe, and Islam in many parts of the world today) have regarded charging any interest for loans as sinful.

> The pivotal change in the English-speaking world seems to have come with lawful rights to charge interest on lent money,particularly the 1545 Act, "An Act Against Usurie" (37 H. viii 9) of King Henry VIII of England.

http://en.wikipedia.org/wiki/Usury
No surprise with Russia topping the list. Since 1990 the country's entire economic output has been exploiting what's left of soviet infrastructure and selling natural resources.
For that you'll want the Foxfire series of books. I remember flipping through them when I was a kid -- not sure about the quality of the information from memory, but the topics covered are somewhat complete.
I have only looked at a specific field, but I have noticed similar issues with all the model-based studies I've seen. I don't even bother considering papers that don't involve empirical data and analysis, because at least then they have some solid tie to reality. (Assuming their data, assumptions and hypotheses are reasonable, of course.)
I wonder where this thread might go...

Here are some of my growing fields of interest for this meta-concept, which I feel moves closer and closer with each unpublished (at least in widely circulating media) major event from our gyrating, upside down "systems of betterment" whose impending collapse will provide new opportunities in an all-encompassing global transition:

water purification, rainwater collection and storage, food storage, gardening, replenishable cleaning supplies, essential body care goods, reliable cooking tools, essential clothing articles, healthcare, communication and collaboration tools (low-tech as well), microcomputing, solar electric...

Our society has a twisted certification and license approach to learning, as if you need to ask permission to cross a street, instead of looking both directions... We /can/ take care of ourselves.
it's very exciting to live in a world where "i don't want every action i perform to be logged by government agencies" to be translated to "leftist activist", thanks for participating in that framework
It's training users to ignore the error, and that's bad, but yes, it's not as bad as komodia
Top Programming Languages You Should Learn
Sure, but once you allow local administrator access to your machine, the "guest" can modify your data and software however it wants, so you've already lost.
Agreed. It's only MITM if it's unauthorized IMO. If I deploy my cert to a CDN its just legitimate handshakes so I'm not sure where the man in the middle comes in.
> That seems like a pretty good starting point, no?

Honestly, not at all. I really think the exact opposite is true. The debate in this arena is hellishly toxic. You read into it a little and you quickly find out how disturbing ideas flying around really are -- especially from the prominent voices. Staying away from these debates is probably the best option for now. I really hope in time something happens and the toxicity goes away.
> The best way to start a company is to build interesting projects.

The best way? Lots of successful entrepreneurs would disagree, and did set out to build a business to make money. And outside of the SV bubble people don't imply that is The Wrong Way.
yep. I was referring to superfish's case.
Since people are disagreeing with my comment, I'll add some extra information (apparently I missed the editing time window, but I stand by my original comment). I should note though that I was talking about Chrome (I don't know what the deal is with Firefox).

If you go through the Chrome bug tracker, you can find several instances where Chrome engineers point out that Click-to-Play is not meant to be a security feature, and that the "Block all" setting is what is actually secure. There are several bugs which demonstrate ways around Click-to-Play which are closed as "WontFix". A quick search yields the following quotes from Chrome engineers:

"Yes, this is why click-to-play is designed as a convenience and not a security feature. If you want plugins blocked in a way that cannot be click-jacked, use "Block all," which requires a protected browser interaction (context menu, page action, etc)." [0]

"The "Click to play" setting is not a security measure. If you want to securely block plugins you must use the "Block all" option, which is a bit less convenient than "Click to play," but provides a click-jack resistant, browser mediated interface." [1]

"I'm kicking this out of the security queue because it isn't a security mechanism ... The secure method of blocking plugins is to select "Block all" and right-click to run. Whereas the "Click to play" feature is for convenience and performance." [2]

"It's not a security feature..." [3]

[0]: https://code.google.com/p/chromium/issues/detail?id=176724

[1]: https://code.google.com/p/chromium/issues/detail?id=225636

[2]: https://code.google.com/p/chromium/issues/detail?id=160707

[3]: https://code.google.com/p/chromium/issues/detail?id=414232

I'm sure there are other instances where they talk about it more, these are just the first results I found.
Curious about something: with companies like Heroku we often see open-source alternatives being developed. Is that possible for something like Twilio and is it "FSF-compliant" to use their APIs? Not that that is a requirement for me, but I've never seen people discuss this.
But pekk isn't making that allegation. He's just pointing out the connotation of adding an "a" to the regular "-ist" suffix. So, it's more that Vice is the one you might be upset with. And not quite tongue-in-cheek, but they could very well be doing that knowingly, subversively.
If you don't mind sacrificing some compatibility... make the switch. Flexbox can dramatically simplify some layouts... I've seen some designs that were 10 times smaller when done with flexbox.
Finally, some details about what Magic Leap actually is
Oddly Google's Android team took a different approach; on Android 4.0+ there is no way to install additional certificates without a periodic "Network may be monitored by unknown third party" notification being presented.

Very annoying if you wish to use your own CA or add another and it is also dangerous in that it masks any cert installation by malware.
Most of the fleet here in Brazil runs on dual combustible (ethanol or gas) and ethanol is available at every gas station. Ethanol from sugar cane is way cheaper than ethanol from corn and we have 2 crops a year (no harsh winters).
He is referring to the fact that in Chrome click to play has no security effect at all - pages can click jack you to activate it.

To quote a Chrome developer: "Click to play is not actually a security boundary. In particular, it has always been subject to click-jacking."

https://code.google.com/p/chromium/issues/detail?id=174963
I actually independently discovered Nightmare today while this was open in another tab... very cool!
>Click-to-play prevents Firefox from running any plugin code without explicit user action. I am 99% certain this is also the case for Chromium-based browsers.

Wrong: https://code.google.com/p/chromium/issues/detail?id=174963