skysight-inc/HackerNews huggingface dataset:
If by 'pay for it', you mean 'close the purchase popup subconsciously without even noticing it', then yes, I pay for it.
Android in China is AOSP or 3rd Party forks, NOT google android.

There are no google services in china, so it's definitely an easier stand to take for Google than for its competitors doing business there.
> That's right up there with "unintentionally loaded a gun, drove to the bank, held it up at gunpoint, and left with bags full of cash", and about as believable.

While I'd like it if it that were the case... did you see the PDFs that I linked elsewhere in this discussion thread, that CNNIC originally posted to mozilla.dev.security.policy?

https://pzb-public-files.s3-us-west-2.amazonaws.com/B2.pdf

I can see the following series of incompetences as entirely too plausible:

- MCS happens to have some multi-function Palo Alto devices, because they're reasonable devices to have for a network operator.

- Palo Alto ships real-time SSL MITM capabilities (i.e., loaded guns) in their products, because lots of customers want them for use with internal CAs.

- Palo Alto is also a FIPS-compliant hardware crypto device, because thanks FIPS.

- MCS and CNNIC both vaguely know that intermediate certificates should only be kept on FIPS-compliant hardware crypto devices. They don't know why, they just know it's what people do.

- MCS looks around, sees the Palo Alto device, decides it's the right sort of device to use, and clicks the "Generate a CSR" button and sends it to CNNIC.

In any case I certainly agree that this deserves CNNIC removal, even if everything CNNIC and MCS has said is true (they're both admitting to gross negligence that failed at the most basic tasks of a CA, even if there was no malice in a strict sense). And also deserves MCS or any suspiciously similar organization being blacklisted by all the other CAs if they come asking for an intermediate.

Like, if it weren't for the hardware crypto requirement, it sorta sounds like MCS would have happily run `openssl req` on some developer's machine, and CNNIC would have happily signed it with their globally-trusted CA cert. Which would not have set off Google's tripwires, but would also have been completely unacceptable.
Read the root certificate inclusion policy of your vendors. In the end it comes down to how much you trust the vendor to implement the policy faithfully and whether you agree with the policy itself.

Google https://www.chromium.org/Home/chromium-security/root-ca-poli...

Microsoft http://social.technet.microsoft.com/wiki/contents/articles/3...

Apple http://www.apple.com/certificateauthority/ca_program.html

Mozilla https://www.mozilla.org/en-US/about/governance/policies/secu...

From a cursory look Ubuntu seems to mirror Mozilla cert store.
Non-Paywalled link: http://www.reuters.com/article/2015/04/02/google-eu-idUSL2N0...
There are tons of edge cases here.

Let's assume, and this is not unlikely, that your favourite three-letter agency in is possession of a handful of trusted CA keys, acquired with extralegal methods.

What happens when there is leak? This may be the result of a whistleblower, or some mistake somewhere, which leads us to have a stronger confidence that these keys are out. Do we still blacklist? Only the intermediary, or all the way up to the CA?

I think we've seen from the past years that both root and intermediaries can follow every rule in the book and still get owned by intelligence agencies. We simply cannot pretend this is unacceptable for doing business.
It may be fundamental attribution error. Has that been conclusively demonstrated in this particular case? If so, what proportion of the propensity to commit crime is based on circumstances? Presumably not 100%, considering psychopaths exist and are quite difficult to rehabilitate.

As far as I'm aware, there's not any conclusive data to show that rehabilitative approaches are much better for recidivism. I'm in favor of the state doing whatever it can to make a more peaceful society. But that does not extend to assuming in my personal life that treating felons as if they were not makes them equally safe to people not already known to have committed serious crimes.
Related to their use of SHA1 on the certificate: http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...
I would love to be able to continuous most apps on my computer once I am using one, instead of picking up the phone and drain its battery. Running the apps on computer is the first step.
Please help me understand this better. So HStoreField is not exactly Json field type of postgres but rather a subset of it, i.e just string->string mapping without any nesting. You cant even have key->array mapping?
Us too! Here you go: https://hn.algolia.com/?query=nybooks&sort=byDate&prefix&pag...
What to do when your Peer perception varies greatly from Management perception
I'm relatively new to the programming scene. I taught myself a new-fangled programming language and, as a result, landed my first programming job being taught yet another new-fangled programming language. After a short while (2-3 months) the person who hired me was usurped from their position and my new manager, though infrequently interacting with me, quickly developed what seemed to be an estimation of incompetency in myself. After about 6 months at this job the new manager had me dismissed on grounds of incompetence. The manager who originally fired me, and had been the one mentoring me, and actually working with me in a consistent fashion, was outraged but impotent to change things at that company (he did go out of his way to help me in my job search).

fast forward a couple months and, because of my experience learning two newfangled languages a company decides to take a chance on me and teach me Java.

In this new company my Manager is frequently gone for weeks at a time. I seem to have the same kind of dynamic, the people I work with seem to act and treat me like I'm doing fine, but my manager is convinced that I'm a lost cause.

I feel like I'm growing by leaps and bounds and that, all things considered, I'm doing pretty well. But my view of things isn't what keeps me in a job.

Any suggestions? Like experiences?
Here's how to remove CNNIC from OSX (check two first commands only) https://github.com/logotype/useful-unix-stuff/blob/master/us...

Hope someone finds this useful!
An elegant weapon from a more civilized time, indeed.

Frack Windows, and frack XML :-(
Yahoo Developer Network - nodeJS & mobile hackers - https://developer.yahoo.com/jobs
I can't see Musk trying to build a battery company as his primary focus. That's not exactly a world-changing life goal (well, for him. I'd be happy with that). That's like saying that Apple is a chip company because their chips are central to efficiency.

The battery might currently be the most important single component of an EV, but there is no guarantee that will be true in five/ten/twenty years. The car is more than just a mechanism to increase scale. You don't beat Musk by making a better battery company. You'd better find a way to beat this:

http://www.businessinsider.com/the-tesla-model-s-is-consumer...

(The word 'battery' is not even mentioned in the article. Tesla could have less battery life but still win.)

Again, similar to Apple, Tesla found a point of advantage and will own it. The landscape will change and so will Tesla's efforts at building or maintaining an advantage against some very powerful companies.
"Stop buying unproven hardware just because it looks cool."

Yes. Remember what happened to Detroit when their quality was inferior to Japanese cars. Don't deal with companies whose approach is "shit early, shit often".

And if it doesn't work, return it, demand a refund, and make negative comments on Amazon.

("Internet Thermometer — needs 4 AAA batteries every week". That's incompetent electronic design. I have an outdoor thermometer which transmits to a receiver and display inside. It's been running for seven years now, and it's on its second pair of two AA batteries.)
They aren't really COTS. They were for the Roadster, but for the Model S they use a specialized chemistry as well as removing the protection circuit.

[Source](https://www.youtube.com/watch?feature=player_detailpage&v=9c...)
How far away are we from being able to kill this ridiculous system? I'm sick of trusting a bunch of certs that are deemed acceptable. Forget security concerns, I'm just appalled that to acceptably do encryption today I need to pay some company! That's wrong.

Okay, so the question isn't actually "how we're going to kill it". It's going to die when there's a better alternative. So the question is really, "What can we do to build a strong web-of-trust system while continuing to use the broken one?"

I see no reason we can't make some browser plugins, get some activism going in the tech community, and start building it. Just report back what cert was served to you.

With that being said, there needs to be a selling point other than building a better internet, otherwise no one will use this plugin. I think there is one, though, and that's security. When your browser comes across a cert that differs, alert the user. You might not get grandma to use it, but it's something.

There are issues with this. I want to anonymously report what cert a website serves me, rather than giving anyone curious my entire browsing history. And also poisoning. But the latter is fixed by using this both the existing CA model and the WoT.

So yes, there are some problems. But c'mon, it's 2015, let's fix this already.
This is an Egyptian company. I had many expat friends when I lived there I will tell you beyond the most elite multinational corps no one sees the point.

You should see sandwich menus. I was saying, English correction per word, if people saw the value, would make me a successful small business owner in about 3 years. Haha.
Create better 3D models by waving your smartphone around
Amusingly, for me, there's exactly one app with a web equivalent that's not a preinstalled Google app (a weather app). The rest all are either doing things with hardware that the web doesn't know how to access (accelerometer, microphone, camera, FM radio, SMS, cell, raw network access), or apps for managing data on the phone itself (contacts, image gallery), or services with no web equivalent (Steam, Lyft).

And that's just the thing: if your app can be done on the web, you're already going to do it on the web, because there's not a platform on the planet that won't automatically have it. If the website that you already have doesn't perform well enough, then you make a second app while you wait for the web to reach parity.

You're going to think I'm weird, but I don't use the Facebook app, I use the site. I don't use the Twitter app, I use the site. This isn't some philosophical choice on my part, I really just can't be arsed to take the effort to search for yet another app on the app store, and then fret over the implications of approving yet another set of meaningless permissions, and then resign myself to endure yet another app pestering me to update it for the rest of my days.

I accept that there will always be a place for native apps. The web is slow to pick up on new bits of hardware and new modes of interaction, so native will always be ahead of the pack there (though Mozilla is at least attempting to prepare itself for the Oculus Rift with a big push for VR on the web). It's a conservative platform. But once something is Good Enough for the web, you need a very good reason to dislodge it.
They're also a software company. I was recently shocked to hear that ~60% of Tesla employees are involved in software engineering, versus a normal car company at around 2%.

Source: http://www.businessinsider.com/morgan-stanley-tesla-multiply...
Show HN: Are you paying too much? Price benchmarking for B2B software
We really need to clean up the CAs. Hopefully once the lets encrypt guys gets to be operational we can nuke the rest, in a similar way to how Chrome is sunsetting the old encryption standards.
How to convince an innocent person that they've committed a crime
Some Insights on Slack’s Bug Bounty Program
WordPrax Ltd
It ended up bringing out the pain points in Firefox's "feature" to recover tabs... In this case I really didn't want that to happen!
>The biggest share of the ad dollars is actually coming from brand-building campaings where dollars are spent for impressions that aren't even optimized for KPIs related to clicks.

Huh. That's interesting, because it certainly is my impression that most online advertising is click-based, but I have little experience of the high end.

I know that I spend all my ad dollars on (or what I spent my ad dollars on when I spent ad dollars) are attempts at brand building. The thing is, if you really want to build your brand, you don't want the ads to be about you... you want the content to be about you. And that's kind of a different problem, at least if you are targeting sophisticated customers who won't read publications where the content is obviously bought.
nope trialing it at the moment to replace notepad++ under windows, but I find the price hard to justify.
Without PJ (of Groklaw fame) around to say, "Oh yeah, the usually legally-adroit Google has really stepped in it this time." I'm skeptical this will go anywhere. Microsoft has been buying politicians to hurt Google for years.
Is anyone aware of the reasons for choosing the particular symbols that Make uses i.e. '@' (targets), '^' (list of dependencies) and '<' (first in the list of dependencies)?

I have admittedly limited experience with make and I always seem to forget what symbol stood for what. They don't seem to be particularly intuitive mnemonics to me.

For example, one could argue that '<' for target and '>' for dependencies would be a tad clearer.
[edit]
Let's try this again: https://www.schneier.com/blog/archives/2011/03/comodo_group_...

The above link should work. This will teach me to link to an anchor on Wikipedia.

[original post] It should have been: https://en.wikipedia.org/wiki/Comodo_Group#Certificate_hacki...
Have you reasons to believe the existing x509 certificates handling code handles properly an extension that is seldom used, and will do it in all cases?

Validation of x509 certificates is ridiculously complex, and CA rightfully only use the widely interoperable subset of extensions...
Wordpress Sites at Risk of Pirate Bay Clone Slinging Malware
Try doing that for a decade or two and you will find out it never works. Not only that you start to feel bitter towards a society that continuously labels you as a felon even though you served a full prison sentence and paid your debt to society (the debt they decided you owe). Eventually you realize that you don't owe anyone and just want to continue on with life. So you hide your background because it is the only thing you can do if you want to succeed in society today.

* Do not have a background myself but I have a family member who does and has been through all of this. He has a loving family, is a brilliant man, and it is very unfortunate he still can't get a job (or at least hold on to) worth anything.
Culture Amp - Melbourne, Australia - http://CultureAmp.com - VISA - Full-time Front End Lead Developer (Not considering remote workers for this role)

We're looking for a front end specialist to join our development team in Melbourne, and lead the evolution of the JavaScript and SASS/CSS within our codebase. Our application is built primarily in Ruby on Rails, with a MongoDB back end, and hosted on AWS. We also have a Java component (but we won't subject you to that).

You love crafting beautifully designed and intuitive user experiences, and you believe that creating well tested, clean code is just as important for the front end as the back end. You enjoy being surrounded by talented engineers, learning from others, as well as contributing to their development. To top it all off you've got a passion for culture and changing the world of work for the better.

There are plenty of challenges in the front end code to keep you interested. Our user-friendly survey capture form needs to work across a wide range of browsers and devices, and provide a simple, enjoyable user experience. On the reporting side, we use JavaScript and CSS to visualise and make sense of big data. We use JQuery and some JQuery UI and Bootstrap components, and we know there's a need for other libraries to help streamline the code - that's where you come in.

We're a small development team, using lightweight agile processes and working closely together on the codebase. We use git and an automated CI for builds, and review each others' pull requests. We believe in automation over repetition, and aim to make our code and infrastructure modular and reusable.

We work with some of the worlds most innovative tech companies (Airbnb, Pinterest, Etsy, Uber, Slack, Squarespace, yelp, are just some of our well known clients) to help them better understand and improve their culture. We're located in one of Melbourne's most vibrant co-working spaces, Inspire 9's Foundry9 - a stone's throw from Richmond Station, and the monthly venue of the Melbourne Ruby user group.

We care about who you are and what you've achieved, not what pieces of paper you hold. For this role, we're looking for a front end focused developer with strong technical skills in JavaScript and CSS, leadership experience, a keen interest in learning and an awareness of existing libraries and frameworks.

If you're excited by the opportunity to work in a fast growing start-up, where there's plenty of opportunities to pitch in on anything from shaping the next product feature to influencing our technology stack, and building a global software company from Melbourne, reach out to us.

https://jobs.lever.co/cultureamp/d620e798-5774-42c4-8a41-2b9...
CNNICs users' rights and interests are not being taken into consideration. Make no mistake, they are looking to protect their customers, not you and I.
>Disturbing truth: A fixation on preventing death diminishes life

Define 'fixation'. Total prevention of death obviously does not diminish life.

If there ever comes a day when we truly conquer aging, it is going to be one of sadder days for humanity.
Burglary and fraud would be a big deals to me for anyone I'm considering for a long-term relationship.
I don't remember deleting it, but also can't find one that seems to be from CNNIC.

Does anyone keep a list of ones they personally like to mark as Untrusted, which doesn't break [too many] sites?
Presumably you could use any language that targets the JVM, since the code could be further compiled down to ARC.

That leaves things like Scala, Kotlin, Grovy, etc.
Google is explicitly whitelisting the legitimate end-user certificates CNNIC has issued, and then revoking the root.

Basically they had to hand over a list of all issued certificates, Google reviewed them, and CNNIC can't issue any new ones without asking Google to whitelist it.
Google Bans China’s Website Certificate Authority After Security Breach
Agreed. Alternatively they could try to poach Anders Hejlsberg, the guy behind C#, and have him make an even better language. Google is big enough to provide the initial push behind it and he has shown that he can repeatably build great tools (Delphi, C#, Typescript).
> I think it's ridiculous just because it clearly involved a lot of effort to solve a problem that doesn't really need solving.

Perhaps you don't see the value in it, but that doesn't make it ridiculous. Why not just move along instead of complaining about a new option for those who do happen to appreciate it?

I'd use this. Every time I return from the store, there's always something I forgot to purchase. Yes, I so use a list. The problem is when, say, cooking, I actually focus on what I'm doing. When I'm running low on something, I don't rush to my phone to log it because it's an interruption that takes away from cooking (especially when there's a notification waiting for you). Amazon is providing an extremely low-friction solution that won't take your away from what you're focusing on.
When I doubleclick on the red box, I do see the JSON for the httpinput, but I'm not seeing anything in the command prompt window.

I bet it's my company's firewall. The app itself will be doing the data fetch and won't be getting through the NTLM proxy, because it's not looking for the HTTP_PROXY settings for the command prompt (which tells it to use cntlm to get through the proxy).
> don't want your computers to be used as part of the DDoS like we've seen against GitHub.

Let's not conflate two mostly unrelated things here. Removing this root certificate does nothing to stop this attack against Github.
Does "everywhere" include e.g. Firefox?
Also, no, you don't have to make web applications comparable to native apps. At all. Just make native.
Could you please comment on compensation - is it Romanian/"eastern European" level? Can someone applying for REM0TE hope for North American level?
Quite the contrast to Google's response:

We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place.
http://www.temptingbrands.com/ROUTE_66.html
https://news.ycombinator.com/item?id=8627793
> Experts write stickied posts on linux.org forum in 2007. Everyone reading those posts could also read the kernel config documentation, yet they stickied this.

But what is linux.org, and why is it credible? The domain seems to have changed hands a number of times over the years, and it's not affiliated with a well-known organization like the Linux Foundation.

> Optimally, you want as many inexperienced people to be drawn to your project as possible, because if your documentation is good it will turn them into experienced people who can contribute to the project. Therefore posts like this one, albeit a secondary source by most definitions, benefit the linux ecosystem and are also educational.

"Good documentation" would be great, but these pages are not it. I strongly disagree that it has any kind of "clarity of organization", but that's not even the issue; the issue is that the author has no idea what he's talking about. If you try to learn from it, you are getting a mixture of useful information, useless trivialities, and outright falsehoods that will only confuse you later. Anyone who thinks these statements are clear and accurate:

> NOTE: Not all “.ko” files are modules. Linux also uses “.ko” for Linux's analogy of Window's “.dll” files.

> The Linux kernel is a monolithic kernel. This means that the whole operating system is on the RAM reserved as kernel space. To clarify, the kernel is put on the RAM.

> As many of you know, Linux is written in C/C++ and Assembly.

> [in the context of defining UID, GID, PID, etc.] A Session ID is used for communication purposes so only the authenticated processes can communicate together on that particular session only. This helps to prevent hijackers and malware from intercepting a data transaction.

> Many of you may be unaware of this, but Android is Linux. True, they are not quite the same, but Android is Linux. For example, Ubuntu is "GNU/Linux" while Android is "Dalvik/Linux".

has no business writing technical documentation about the Linux kernel.
Ask HN: How do you do home security?
I recently moved to a new town and am living alone. The neighborhood is decent and my building has security too. However, it just seems like good sense to me to implement an extra layer of home security apart from the usual (locked doors).

I was looking for ideas and was wondering how people on this forum go about securing their houses?
...Those state-owned businesses are always funny.
That doesn't work now either. Playing whacamole with an editor?
MCS Response to Google Regarding CNNIC
That's cool, I didn't know how traceroutes work. Is he planning on releasing the http traceroute tool?
How to Take a Loss and Jump Back in Without Fear
you should comment there to ask them
Related but off topic:

Why can Captain Kirk hear so well?

Because he has three ears: a left ear, a right ear, and a final frontier.

Sorry! Dad joke.
How We Learn to Stop Worrying and Love the Bots – WIRED
Proof please