skysight-inc/HackerNews huggingface dataset:
I'm right there with you, there is quite a bit you can miss by NOT binging on a show stuff that you may forget over the span of a week but when watching them back-to-back you pick up on. Now some people might just say "well if you were half-way intelligent you would remember and get the long-running or episode-spanning jokes/themes/etc" but that's just how my memory works. I distill down to the facts I need and throw away much of the rest knowing I can always get them back if wanted (by re-watching). By binging I don't have time to forget the little things and it makes it more enjoyable to me. That said this doesn't mean I NEVER pick up on jokes/recurring themes just that I pick up on a lot more by binging.

I also agree with the spoilers. The cat is out of the bag and I'm not going to potentially ruin the show by waiting for each to air (and seeing spoilers or "theories") especially after waiting this long for the new season.
I don't think there's anything inherently bad about trusted MITM. If the trust exists, then you can have a local caching proxy that can drastically reduce the load on servers, WAN links, etc, and is a major part of Roy Fielding's original description of the REST architecture. [1]

IMO, I think the majority of use cases that people care about with HTTPS are about integrity (i.e. authentication) rather than confidentiality. We don't need full-on encrypted requests for those use cases, we just need secure MACs[2] (significant performance difference) as part of the standard so that endpoints can verify it hasn't been tampered with, even if it's been cached somewhere along the way.

[1]https://www.ics.uci.edu/~fielding/pubs/dissertation/rest_arc...

[2]http://en.wikipedia.org/wiki/Message_authentication_code
If you enjoyed this, read King's book "On Writing". It's half memoir, half an essay on writing for a living. The memoir part is interesting because he's had an interesting life, and it's closely tied to his writing career.

The writing part should be interesting to anyone who: likes reading fiction and thinking about how it is created; likes writing and has spent time about how to do it well; has spent time thinking about how to a particular thing well.
Managed VM's, PHP and Go on Appengine are all beta as well.

Autoscaler and Instance Groups on compute engine are beta as well.
Offense on principle
People may need to run embedded servers on many different devices, and be able to access them. Forcing them to use not the latest version of the browser simply because they can't use it to connect to a device that costs 100k and will not be replaced every year like your average iDevice will not make anything better or safer.
If we're talking about school computers, they can put whatever self-signed certs they want on them.

Besides, what you described is still domain specific. If you want to block only certain Youtube videos, that's where you'll have a problem.
> It will just make it easier to create walled gardens, and charge companies and individuals for certificates.

letsencrypt.org will solve this problem.

> It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information.

That's something that applies to buying/owning a domain as well. Domain-verified certificates require very little private information, and I suspect letsencrypt.org might be able to provide a way to get trusted certificates without giving up privacy.

> Using self-signed certs will become harder.

How so? The proper way to use self-signed certificates would be to distribute them in a safe way (e.g. deploy them through your Active Directory Domain, provide the fingerprint through a separate channel, etc.) and install them in your trust store. I couldn't find any intended changes to this in their announcement.

> Yes, it's a good idea to use https _almost_ everywhere, but forcing everyone to use it is a terrible, stupid idea.

I agree that it should be a slow process, and I think that's exactly what they're suggesting. Eventually, when the tooling and processes around SSL/TLS catch up with the new "encrypt everything" mentality, it would probably be no big deal to deprecate almost every use-case of HTTP without SSL/TLS.
From where can one get free certificates?

Not everyone has modern hardware. My hosting provider doesn't have AES-NI for example.
Meh - that's not why there are cyber attacks. I mean - if you take the attacks on greatfire and SONY they are retaliations for propaganda operations. 'Information' available around the globe and 'narrative' around the globe are not easily disentangled. The US also faces these challenges, and uses a series of tactics (mostly Sunstein style shilling) of dealing with these issues (but also limited forms of censorship partnerships). Namely these cyber activities are not censorship in the most obvious and indisputable form, as you suggest.

My argument above can be thought of a way to deal with the international problem of cybermilitary attacks. Diplomacy products are another, separate, issue.
There has been horizontal expansion of refineries. I don't think US have substantially lower capacity than before.
Wren: a classy little scripting language
Last I was at the Rio Grande, I was surprised that there were many spots where you could simply walk across without really getting your ankles fully wet.

I wonder what the compounding negative effects of these actions will be. With reservoirs and rivers drying up from over-pumping and drought, non-regenerative aquifers are also being depleted being pumped along with the regenerative ones, which only drys and permits greater thermal load of the ground without a method for heat dissipation, which causes even greater net loss evaporation and also prevents cloud formation and rain. It's really kind of a positive feedback loop with a bad outcome.
If it's inside the organization then they can put in a local cert and run a cache.

It only prevents caches that are in the middle and trusted by neither end. I'm okay with that in almost all cases.
Yes it does. For the umpteenth time, an unencrypted HTTP session allows an attacker to inject arbitrary content into the request/response stream. They can use this to do anything, from asking you to log in, sending them the password, to stealing credit card numbers, to presenting fraudulent content, to giving false information, to tracking you, to hijacking links from the page you are trying to view, to just showing you ads where there should be none, to defrauding the site/domain owner (via serving bogus content instead of your own).
APIMATIC is a great idea. keep up the good work
Not only the US may not lead this but Snowden has shown that they are one of the primary actors weaponizing the internet. Who else would want to "disarm" in these conditions?

I'm not saying states should hack each others but complaining about China is a pretty spectacular "do as I say, not as I do".
Black holes are almost the perfect battery.

Small black holes decay very quickly, a black hole the mass of, let's say a small mountain, would decay almost immediately, releasing it's energy as hard gamma via hawking radiation, whose energy could be captured and used via multiple processes including some sort of sterling engine/photovoltaic mechanism.

If some how you were able to create a small "artificial black hole" you could just feed it mass, any mass, and it would be converted directly in energy, as if it were a matter/anti-matter reaction.

At least, that's what my two semesters of modern physics and latent desire to be eventually be a sci fi author tell me. I am reasonably sure nature has some sort of small print that kills my awesome idea, like requiring 100x to create said black hole than energy released, bleh nature. IANAP.
Evasi0n iOS 8.3 jailbreak
Tableflip Club
Can you point out where I suggested that all users of Apple products are brainwashed?

One look at the Macrumors forum shows you that these people exist in some number (just like one look at a guitar forum shows you that Gibson has some believers). I work with one person who is absolutely insufferable with Apple evangelization.

I didn't make the argument you thought I did, and while your weaving skills are admirable, I don't really need any strawmen.
It feels like there should be a lot more than 10 episodes per season.
> Our latest survey shows that full-time remote devs get paid 40% more than never remote devs

Anecdotally, I would suggest the demographic of employees who work remotely plays a part in this. In my experience, employers are more willing to let senior or "better" developers work remotely than less ambitious, less productive ones who need more day-to-day managing. Since quality developers (senior or otherwise) are generally paid more, I would presume this contributes to a higher average salary for remote workers.
Also: set up a web site on a private network, which works without modifying every browser/OS that needs to access it (e.g. installing a custom root cert), and which doesn't depend on a third-party organization. (e.g. a CA)

This will still be a problem even when you can get free domain-validated certs from Let's Encrypt. That's still an outside dependency for a private system.
Too bad the analysis can't be reproduced.
I can find data about the companies (http://download.companieshouse.gov.uk/en_output.html) but not the directors.

Anyone has had more luck?
> You can only make a website for free if you are OK with your website not having a domain name and running it off your personal laptop with electricity paid for by your roommates/parents.

Many online free hosting sites that give you a subdomain are HTTP only because wildcard HTTPS certs are expensive.

Many of those services would go away or turn paid-only in an HTTPS-only world.

The children of the future have already lost Geocities and dial-in BBSes that we grew up with; how will they manage if their Internet isn't exactly like ours? /s

> If your CPU is really so limited then why are you using HTTP at all? Use a custom binary protocol with or without encryption as appropriate.

I might not want to write the client for said custom binary protocol.

Like it or not, a lot of embedded devices (Arduino, Spark Core) provide libraries for serving JSON over unencrypted HTTP. Restricting yourself to devices that are more powerful (say, Raspberry Pi 2) would require you to use a bigger form factor for the hardware, and/or would cost more.
Let’s Encrypt does not even provide a RPM for Fedora or RHEL yet or at least there's no mention of it on the front page [1].

[1]: https://letsencrypt.org/howitworks/
7 Reasons Why Consumer Videos Are Awesome
Probabilistic programming is way to increase
flexibility of statisticall modelling. You only write the code that generates data and give statistical model and possibly some parameters to fix approximations used in estimation and get out model from that.

For example, Stan-language supports MCMC modelling using Hamiltonian dynamics.

http://mc-stan.org/
Well, we're talking here about very concrete things: days where cyber activity is stopped as a show of good faith, or nations trading their compromised networks like they do today with spies.

This won't in and of itself stop the activity - and it's not intended to. This is intended to foster cooperation and trust. Cooperation and trust are required for international norms development and cooperation on standards, and in addition lessen the incentive for nations to hack one another out of suspicion or hedging bets.
> If your CPU is really so limited then why are you using HTTP at all?

Because it does not require user to install any other software and still have access to the device (PLCs and other embedded controllers)?
> Are you sure?

Yes, I'm sure that the communication between my browser and the test app I'm running on localhost doesn't need to be encrypted.

> It's obvious that governments are systematically weaponising any non-SSLd connections.

Over the public internet, sure.

OTOH, if a government controls a root CA trusted by your target population, TLS doesn't provide any protection at all against them anyway.
It's correct. The signature on the CSR is not used in the actual certificate.
It's the Mortgage Industry's Turn
> It will also pretty much get rid of privacy, since to get the cert you will need to provide someone with your detailed information.

If you're using a self-signed certificate, you don't need to provide information to anyone.

> Using self-signed certs will become harder.

Why?

I haven't given this much thought yet, but these don't sound like convincing arguments against the proposition.
awesome and efficient, keep it up guys
Well you are certainly free to think that but I disagree with you.

When you join the army you are also joining what that army stands for. If you were a communist, certainly joining the US Marines would not be high on your priority list, would it?

Unfortunately having an opinion seems to be met with downvotes here at HN which is unfortunate for such a otherwise pleasant group of people.
That describes pretty much the entire American Southwest. The Mohave was a grasslands when Columbus arrived.
Normally I'm the one complaining about typical HN comments. However given the blog post was titled "Game of Thrones leak and watermark: a stupid tracking system" I felt that leading with "This is a stupid blog post" to be a fair and amusing twist.

“Sadly, it seems the leaked four episodes of the upcoming season of Game of Thrones originated from within a group approved by HBO to receive them,” the spokesperson said. “We’re actively assessing how this breach occurred.”
http://www.buzzfeed.com/jaimieetkin/game-of-thrones-season-5...

They've at least narrowed the leak down to be from inside HBO. They may not have it down to an individual just yet. Their internal process may need some work.
Refresh is acquired by LinkedIn
appreciable
Indeed. Not only this, but the opening credits also gives the names of the actors (which change from one episode to the next), director, writer etc. of the episode, which are unique to each episode.
If he's talking to the people, he IS the project manager.
letsencrypt.org is not even working, and it seems to be Linux only, at least for now. What about other OSs?
That's certainly the right thinking for consumers. In my client's case it was B2B in the entertainment industry where licensing fees were per-day and substantial, so there are no poor students involved. Sorry for being vague as I don't want to link to him here without his permission.

I think he might have made the wrong decision in his case, as adding leak penalties to his contracts would have made his users more careful with his files. Since he was in turn licensing some rights from other parties, leaks in the past had caused him some legal trouble and he didn't want to have that happen again. His solution was to add DRM, but it didn't close the analog hole so there's still the potential for leaks. (I haven't talked to him in a few years so I'm not sure if things have improved.)
Their tractor page include this line: We are interested in a Piston Engine Construction Set – modular, in-line scalable engine that can be adapted to spark ignition, compression ignition, or steam power.

That kind of means petro, diesel, and coal. That's not a hard fuel requirement though.
I am wondering if this will go anywhere. It seems to me that if anyone would be willing to do this it would actually be the Chrome team, not Mozilla. Mozilla currently lacks the market share to pull this off, and lately their moves have been more targeted in a different direction.

Having said that, I am really happy others are thinking along the same lines as I: HTTP should be relegated to a legacy protocol and the warnings need to very similar to what you get when accessing a site secured by a self-signed cert.
Possibilities of IT job with social phobia
At age of twenty eight, I have been diagnosed with social phobia. Until then, I've been doing quite well. I have worked as Unix sysadmin for several years during my twenties and eventually started to work as DB developer later on (Oracle). Now I'm thirty, lost the last job due to my illness and general inability to handle open-space hell and the real-life communication. It's generally very hard for me now to go outside and do the normal things that people usually do, unless I drug myself with benzodiazepines.

Not able to withstand the idleness, I've been eyeing some remote jobs. Although I have basically zero experience with remote work (minus the occasional home-office in the past), but I've decided to at least try something. Several people advised me to not try "IT" job again, as they identify my previous jobs to be the causes of my mental problems. That would mean throwing 10+ years of experience into trash can. I don't consider that to be a rational choice.

Some online research and browsing brought up some question:

1) My field of experience. It seems that most Oracle DB jobs are on-site jobs and usually limited to larger companies (logically). I came to a conclusion, that are barely any sensible remote jobs in that field. Second alternative would be Unix administration, but again, most of these jobs are US-centric and being from Europe, this seems like a poor choice. Should I try and pick up some new technology ?

2) How "remote" these jobs usually are ? Using skype or phone is rather impossible for me (jaw tremor, trembling, etc.). I can live with using email or some project management software to get job assignments, but that's pretty much it.

3) Was someone in similar situation ? How did you handle it ?

I will be grateful for any useful input.

Thank you.
Right. At the top of my post I correct the title to say everyone hacks everyone.

This is a tragedy of the commons type situation. Nobody wants to disarm. However there is historical precedent for cooperation and disarmament under these conditions - even with nuclear arms races.

This is what I'm suggesting - what things do we need to do to deescalate an international cyber arms race.
In practice, some CAs do require certain things in the CSR subject even though they create their own subject when they sign. I've seen the country required, for example.
For a bit more context, the technology that allows the client to communicate to the server which hostname it is attempting to connect to is called Server Name Indication.

https://en.wikipedia.org/wiki/Server_Name_Indication
Anyone work out of a co-working space? Totally recommended?

I been doing the work from home for 2 years now. It's getting a little meh. Love the freedom, but it would be nice to have actual physical co-workers, or something like it.
Oh wow, Google is already on every site with Analytics, imagine if they were also the SSL host/WAF/CDN/DNS host for every major property?

It would fit in well with their silent yet never ending reach across the internet.
How to Master the Pretzel Knot with Your Scarf
Think about Dreaming. "seeing" during a dream state works by experiencing pure data representation of the real world. People fluent in lucid dreaming can tell you something funny happens when you try to thorough examine objects while sleeping. Constructed worlds tend to be skin deep, and fall apart when poked. Everything is build with ideas drawn from your experience.

Its Plato's Allegory of the Cave all the way down.

Imagine "watching" a movie compressed using your very own prior knowledge. Every scene could be described in couple of hundred lines of plaintext. Today we do this by reading a book :) What if we could build an algorithm able to render movies from books?
Problem is that (besides for the brand) Cloudflare really has nothing to offer for Google. Google has spent the last 20 years solving the same problems CF is aiming to solve, they've even got a competing service Google PageSpeed that does exactly what CF does, except better (in my personal experience.).
Because all of the modern browsers already make it harder for users to use them. It will only get worse.
Our SEO Client Consulting Package
Reality vs theory - "Screw it, why bother?" is the real-world top result. Do you see a concerted international effort to regulate away our dependence on fossil fuels? Because right now, the only concerted international effort I see is OPEC dumping oil on the market to underprice new competitors out of existence.

The "options" of which you speak are mostly what wealthy industrial nations impose on poor and underdeveloped countries. International politics and economics is a seriously hardball game. Sure, it could be better, but it won't be.
> For example, how do you run a good consensus meeting? Start from scratch and probably make elementary blunders, leading to sullen participants? Or grab say Starhawk's book and arm oneself with common patterns?

I completely agree.

Where I diverge from the path I see a lot of people take is when you start believing in those books with a fervency, without going through the process on your own. Use them to inform, not instruct.

A great example is the Toyota Production System book. People who go for 'kanban' and 'mura muda muri' and ape the terminology and methods have it all wrong - the whole point is that it's a system they built for themselves. It's great advice on how to build such systems, but if you just take it off the shelf and try to use it as is, again, it'll feel like someone else's underwear since it wasn't built to fit you.
The feature for re-mapping on 32bit systems is available here https://gitorious.org/mdb/mdb/source/69d7cb8d44e04f02d8d0c92...:
Wikipedia has a decent article on this:

http://en.wikipedia.org/wiki/Energy_density

By unit mass, lithium ion batteries have about 1/50th the energy of gasoline.
The point is that HTTP to HTTPS is what telnet is to ssh. There are no use cases for HTTP where HTTPS cannot fill that need. With free certificates available now, and more coming, there is no reason to not use HTTPS because of cost. The only valid reason I can see to continue supporting HTTP in some form is for legacy devices (consumer routers, printers, etc.) that don't yet do HTTPS. My 5 year old printer does HTTPS, so we should be able to get rid of these devices soon.
How do you get the $0.11/hr rate as opposed to the spot rate?
Government A also taxes the carbon emission on goods produced in B on the border ... example Europe VAT.
I tried that too - you can just use any old page that has CORs headers allowing it.
I find your last sentence amusing because I actually prefer editing to writing. It's when I'm editing that I feel like I'm actually applying a craft. I get the same kind of satisfaction from editing my words that I do from refactoring my code. In both cases, it is often only after doing the initial work that I realize how it should be structured, and reworking it into that elegant structure is satisfying.
That an awsome idea (y)
> From where can one get free certificates?

e.g. https://www.startssl.com/?app=1

Also, if HTTPS became a requirement, then demand would increase for free HTTPS certificates in exchange for, say, advertising.
Agreed. "On Writing" is one of the best books on writing better that I have ever read. Highly, highly recommended. I keep having to purchase more because I give my copies away!
Hilariously, that wikipedia page uses an example from Game of Thrones. Tyrion tells different versions of a rumor to the various members of the king's council and successfully identifies who is an informant for Cersei.
The Biggest Localization Catalog
*cues
I'm 43 and had my first hackathon this weekend: lessons learned
Show HN: Spage – Static site generator with search, comments, etc.
Is there terminology to search for, for jobs which are part remote, part on-site? You would've thought companies would be looking for people happy to work on that basis.
The art of fiction – Gunter Grass (1991)
Honestly, I have no problem with plain HTTP support being available but only enabled via about:config. If you are a developer, sure go for it. Having said that, the suggestion of running your own CA for your dev environments takes less time to grok and set up than Python's VirtualEnvWrapper.