skysight-inc/HackerNews huggingface dataset:
Your comment made me realize that for instance at ENS (one of the French topmost Grande École) we had professors but the courses were focusing on theory, and for example there is no courses on a programming languages (there is a compiler / programming language course, but it is focused on the theoretical aspects of things, what I mean is that there is no C or C++ or Python course, you are just supposed to pick it up yourself if you need it).

Meanwhile, we also had projects that we had to figure out by ourselves. For instance in the first semester of the first year, there is a course that explains theoretical stuffs that are supposed to have a relation with hardware (like 2-adic numbers [1]). The project for this course consists in programming a watch that displays time. But we have to program the watch in an assembly language that we have designed ourselves. And that asm has to execute on a processor that we have designed ourselves. And we have to write the processor code in a hardware/netlist language that we have to design ourselves. And we have to write ourselves the interpreter we will use for that netlist language.

That was what we were told to do, with no additional instructions. Some students learned C by themselves for that, some other C++, some other OCaml… And all of them learned or reinvented how to design memories, or a CPU (for instance, me and a friend decided to invent a single-instruction processor, just for the fun, we got it working but it was rather slow compared to other who decided for instance to learn how to implement a simplified MIPS).

All this to say that there is absolutely no incompatibility between having professors and teaching (partly) by projects.

[1] https://en.wikipedia.org/wiki/P-adic_number
Abuse of notation
Hosting and Deploying Node.js Apps on CentOS 7
Health Tech Weekly #54
In Brazil, there's something called "mutirão" which loosely translates to "a bunch of people getting together to help build something for a specific person in need". For example, someone in the neighborhood needs a second story on their home (many homes are multi-generational) and so this person or family gets the needed supplies then rallies other people in the neighborhood to help build the second story. It works because at some point, those very others will likely need collective help with something of their own. In the case of a social project, the neighbors might informally crowdfund it, then build whatever it is together. Regardless, the one in need usually offers a BBQ and drinks in exchange for the work.
"Stranger in a Strange Land" was published in 1961, blasting established religion and conventional sexual morality. It wasn't a YA book but it certainly refutes the idea of the cultural censorship you assert.
It may not be ready to be developed into a commercial product but I don't think that makes it pointless.
If you had the capability to deliver a prepared attack that quickly, you could probably already just attack them outright.
Windows security essentials from Microsoft. It's free, kept up to date. and has no interest in telling me what it is doing so I will buy it again.

Commercial antivirus has become mostly a big tracking cookie that comes with a yearly fee and pop up advertising. Microsoft security essentials has a value model of aligned interests: Users don't want carp on users' computers and neither do the users themselves.
Before, there was Crysis (2007) with its Nanosuit (http://en.wikipedia.org/wiki/Crysis) which itself was inspired by real-life US military Future Force Warrior concept (http://en.wikipedia.org/wiki/Future_Force_Warrior)
Even CyanogenMod has something like flux and it helps.
Cool! Why?

(I have also spent the last year working on a homebrew OS kernel, so please trust that my "why" isn't intended as an attack! For me, the answer was simply "to see if I can", and I really enjoyed the project, but I'd love to know what motivated you in particular - especially as you seem to have achieved a very impressive amount)
Additionally,

> HTTPS would hide attacks from existing intrusion detection systems.

is completely wrong. Intrusion detection systems are usually checking traffic between the reverse proxies and the servers where traffic is not encrypted.

There are quite a few problems with his post and it makes it appear that he has an agenda rather that genuine concern.
I graduated from university 2 years ago, but I haven't sent out even a single resume or job application. In a couple of weeks, I (also being 24)

Ugh, same here. I've scraped by on a small-time one-man startup that just barely pays the rent. (as is seeing declining revenues).

Trying to muster up what it takes to apply for a job. I don't know why it's so hard for me. I'm fine dancing at a club or giving a presentation in front of hundreds, I'm not shy in that way, but I'm afraid of picking up a phone and making a call to a recruiter (hell to a store to ask if they're open). And I'm scared of putting myself out there, sending my CV, or hell even worse, getting the job and failing. I've got no clue what the hell is up with me, and I can't find any motivation.

But yeah same here, 24, 2 years out of uni, never sent out an application since. Let me know, if you'd like, how your meeting goes. Good luck!
...especially if that protection involves authorisation by centralised entities. I would be far more supportive of ubiquitous encryption if it was controlled by the users.

Notice how encryption which is under control of the user (mobile device encryption, cryptocurrencies, full-disk encryption, self-signed certificates) is seen as a threat, while systems like the SSL CA model where governments could more easily obtain keys if they wanted to, are not?

"Those who give up freedom for security deserve neither."
It's a service you provide, ask for a higher overall hourly fee during office hours, split the hourly fee between standby time and normal fee so the client knows the difference.
Thanks for the suggestion. I'll have a look at it :)
The cost of the actual signing is pretty much zero, but there were definitely paid devs who built these commercial solutions.
HTTPS doesn't protect much from that either. A third party can figure out what you just downloaded based on the download size, since the size of package files are well known. Even if there is some uncertainty between sets of packages it could be inferred from your other downloads, since decisions on what to download are based on known logic (dependency tree, what the victim likely had installed before, etc).

I suppose in your case the window would be smaller using HTTPS, as the package downloaded could probably be inferred only after the download is complete. But your method would need automation anyway, so I don't think the difference in timing would really matter in practice.

But if you are in the position to automatically attack someone, why wait to see if they are downloading a fix? Why not just try to attack with known recent vulnerabilities anyway?
My personal trick is to position the content absolutely at 50% (both left and top), and then transform the content using a -50% translate in both directions.

Works for dynamically sized content (and statically sized content as well, obviously).
As far as you elaborate your view, I concur. But is there a factor that makes this possible only now but not, say, 10 years ago? Did key components not exist then or were they not efficient enough?
> > The effect on those without computers at home

> The additional bandwidth is not really that big.

It's actually not so much about bandwidth, it's more that if they don't have a computer at home they will have to use a computer at a library that forbids all HTTPS, making the resources unavailable.

> A non-argument. One cannot let things remain the same for ages just because of backwards compatibility.

So you volunteer to migrate and maintain all the software we're talking about here, or to pay the people that will do it over the decades to come ?

Migration doesn't come out of thin air by simply snapping fingers. Yes, the software is old. Yes, it's ugly to see. Yes, it's hard to maintain. But, if you read the article, you would no that there is no funding to maintain it, so they're doing what they can with what they have. Everyone would love to use the cleanest, leanest, UNIXest tech stack, but the realities of the world make it far more difficult than what we're used to see on HN.
Strava Leaderboard Weather Integration
- every now and then I'll edit a photo, upload it somewhere, and then get very confused about why it looks so weird when showing it to somebody on my phone -- it would be great if f.lux shut off when certain user-configurable applications are in focus
> In a big organization, a caching HTTP proxy server would provide the caching benefit, where an HTTPS-only Internet cannot.

Why? HTTPS proxies aren't exactly unheard of, and organizations are already rolling out their own CAs anyway.
Explanation? DOes it just lock the screen for 20 secs?
Another alternative is Melatonin[1] which tries to imitate f.lux for chrome(book) users.

[1] https://giraj.github.io/melatonin
It's definitely ok, and it will probably work out better for you than asking a higher hourly wage. The client may of course be reluctant to accept this if they haven't done any similar arrangements before.

As a side note, having flexible hours is great if you need that kind of flexibility in your life. If you don't, consider billing by day/week.
Pantone Color Institute Announces PANTONE Minion Yellow
You don't actually pay the signing of the certificate, you pay for the trust that the CA should give you.
It is zero. StartSSL has had free certs for years. Let's Encrypt will give another source of free certs. I expect shortly after that basic DV certs will be given out for free from most CA's. But most people don't care about finite or not finite resources. I am starting to suspect that the isse is mostly just the cost (with not everyone yet knowing how to get free certs). If your main objection is that you don't like the StartSSL UI, you can get a paid DV very for $5. That is about half the price of your domain.
I don't know about windows, but a recent-ish update on OSX added the ability to disable per application.

http://i.imgur.com/AwDJYyX.png
[Humor] Are  You a Disruptor?
I agree that there is high probability of 1-2 (more even?) in every 100 hanged being innocent. I also agree that this doesn't make any meaningful difference to the argument for capital punishment.

When the argument against it is simply "we're not good enough at judging when to use it", then you aren't rejecting the concept - simply the execution of it[1]. Which means that some bright spark comes up with the most absurd set of safeguards, appeals systems etc to try and overcome the objection - and the end result is death row.

Does any punishment truly act as a deterrent? Should we instead be upset by the underlying societal issues? What proportion of crime is truly a free choice? Once the damage is done to the perpetrator can you ever truly rehabilitate everyone. Does everyone even deserve a change at rehabilitation? Are the costs of perpetual incarceration acceptable?

I'm not even close to having strong answers for all of my vague questions. I do know that I disagree with the articles key point though - killing a person is wrong as an absolute unquestionable moral position. It doesn't stand up in my opinion.

[1]I'm not even that sorry. I simply couldn't resist.
I'm trying to determine what would have been construed as being critical to the U.S. in that passage.

National Socialism had been voted into power in Germany through legitimate means just a couple of decades prior to the book being released. I doubt it'd be taken as an implicit critique in pointing out that even democracies can be abused. After all, it was this realization during the formative years of the U.S. that lead to measures such as the Bill of Rights.

I don't think there's anything offensive here.
Are you in the UK? If you're freelancing through a limited company (as opposed to being a sole trader) you should check with your accountant to make sure you're not running afoul of IR35 before agreeing to this. On the other hand, if you're a sole trader they need to be careful to make sure that such an arrangement would not count as "deemed employment".
French are in the same case as the Germans: they work less hours but have one of the biggers productivity in the world.
For a couple of years, back in 2008-2009, I had a freelance support gig with a former employer who I'd built a system for when I was a permie. We didn't have any real solid agreement on my availability, and the deal was for £100 a week, paid 4 times a year. I'd moved on to contracting, so I had to juggle my new full-time work with the support phone calls.

I'd stick with keeping it separate, rather than the higher hourly wage. I'd also try and put a limit on the amount they can contact you (perhaps a maximum number of hours per day), as I had occasions when for weeks I'd have no phone calls, and then on one day spend 6-7 hours on the phone to them.
Unused light? What did you mean by that?

Fueling an electric car with gasoline has has nothing to do with self powered ambient harvesting machines. It looks like you're just trying to stretch concepts to suit your initial arguments.
Your second point is valid only for x86 machines (and modern ones).

AES instruction sets implemented in hardware are the main factor in making HTTPS viable. But my toaster (which speaks HTTP), or my ARM based router, or even my high end server iDRAC/iLO does not have a dedicated x86 or AES hardware instruction.

so the point stands, even if it's not relevant to modern laptop users.
It comes up everytime but let's at the very least wait until we see if this is a viable way to easily implement HTTPS: https://letsencrypt.org/

I'd love to see such thing being built in straight into the Nginx/Apache packages of disto's to really make it straightforward.

Personally I have a mail.mydomain.nl, a mydomain.nl and an owncloud instance at cloud.mydomain.nl, it is such a pain to update every year, it requires at least 2, if you do it well 3 long sessions at startssl. If you by any chance don't have postmaster@mydomain.nl set up, you get to do that first too. This problem really, really needs solving.
How about instead you discussu a SLA (Service Level Agreement). For example you agree that emails / calls are to be acknowledged or responded within 1 hour during 9-5 Mon-Fri for £/$XXX per month.

You could go a step further any have different levels, so for a higher monthly rate you'd respond within 30 minutes, etc etc.
The way to handle it is to offer it but don't require that they take it.

"OK we have three options regarding tech support. First is best effort response time which costs you nothing, next option is 3 day response time which costs $X, final option is 365 X 5 days 9-5 on call tech support which costs $300/week plus $100/hour per call out." Which would you like?
I agree wholeheartedly with all of the points you're trying to make but the spoken word / snailmail comparison is broken and detracts from your message.

Saying that spoken word and snail mail are unencrypted and thereby implying that we should be no more worried about unencrypted digital traffic than we are about our real-world conversations is a harmful analogy, because it's evidently superficially true, but it implies that accessing your bank account over HTTP is no more dangerous than saying your credit card number in the street. That analogy would hold if every conversation that we have (or letter we send) could be recorded, filtered and searched at scale by anyone who cared enough to do so. In reality, using encrypted web communication is more analogous to real-world conversation - if somebody is particularly interested in what you, individually, are doing or saying then barring significant efforts on your behalf, they can probably get access to it but encryption, and analogously the security afforded by the difficulty of overhearing people's conversations in real life, prevents widespread, untargeted surveillance that would make, for example, automated harvesting of bank details, or the identification of people interested in a particular political movement trivial.
42 opened in mid/late 2013.
It did start out as a YA book. Only, halfway through, RAH realized that he wanted to publish to a more mature audience. The first third of SiaSL hearkens back to his YA beginnings; the rest of it appeals to the rebellious. That book cemented my enjoyment of the rest of his writings because I bridged from child to adolescent at the time of reading.
It's certainly OK to ask. Think about what you are prepared to negotiate if the client seems inflexible. For example, does your fee really need to be paid upfront? Sometimes if you are dealing with a large/inflexible client it can be hard to get them to do anything outside their 'standard shape' of deal, but of course that depends on your bargaining power and the level of influence of your client within the organisation.
in terms of the changed perspective, you're never going to forget that feeling. it will forever be an "option" that has to be staved off with will. the memory of a feeling like doing heroin is different from, say, the memory of a fact. it forever pulls you towards it in the most primal, low-level way, the human desire to feel good. emotionally trying times, in particular, are the worst because you know you can spend $10 to be yanked into bliss.

a good 30-40% of my friends were addicts and from talking to them i think they'd all agree that it's a long, slow climb back to emotional normalcy. i think it's healed only by time. a lot of time. and i think it's a half-life sort of curve where you get 50% better after the first 5 years, then 25% better after the next 5, then 12% better.. etc. more than anything you're trying to reorient yourself towards a life where the joys are small and fleeting, and waiting for those potent memories of having your bliss-button chemically held down to fade.
> My doctor has insisted that dextroamphetamine is not a resistance-inducing or habit-forming.

I find this very hard to believe, given that amphetamine is known to be quite addictive and tolerance builds quite quickly. Albeit medical doses are small compared to recreational use/abuse, so it may be a manageable issue.
"we gain the power to query: implementations calling a deprecated function, implementations marked TODO, unimplemented cases, animals which eat, functions written by me, with no tests"

I think what you're looking for is a good IDE and Scala or Java
I use Time Out for OS X, works like a charm:

http://www.dejal.com/timeout/
i will love know how did that video get to the internet?!!!
Microsoft's Cortana comes to Android through a hack
> Until there's a free, easy, maintainable, and actually existent solution to SSL certs, enforcing HTTPS-only is just downright extortion.

True - but the second that solution exists, I can't think of anything that should stick with unsecured HTTP, and this article didn't change my mind. I don't think we need a "ban", though. Just flip the way browsers show secured vs unsecured, instead of the green reassuring lock for https, that becomes the expected default and http gets a scary red plaintext indicator.
Rather flawed argument, when you consider that it's comparing general purpose servers to highly specialized asic/fpga miners. I have no doubt that if google really wanted to, they could roll out the same kind of specialized mining hardware and dominate the blockchain, they just have no reason to. Consider, specialized hardware can get up to 1,000 MHash/s/$, which means an investment of $1000 would get you 1,000,000 MHash/s.

Now let's look at google's datacenter expenditure. They spent something like $11 billion of datacenter expenses in 2014, and even considering that part of that is non-server related expenses(real estate and building infrastructure), let's see what happens when we punch $5 billion into hashing hardware. I get a value of around 5,000 PetaHashes/s, which would absolutely swamp the network, as it's only sitting at 35PH/s. Also, consider that that's just their expenditure for 1 year, not the total they've put into their datacenters.

In conclusion, comparing cpus capable of general purpose computation to specialized hardware that can only do one thing is useless. After all, how many search querys per second can the blockchain handle?
Why not agree to let them schedule meetings during office hours instead of you sitting there waiting? Push versus pull is always better.
Why not use a template to create multiple instances of the service e.g. nodeapp@5000.service
Winning the Startup Game: An Awesome Perks Package
First implementation of Material Design by feedly
Raytheon Set to Invest $1.7B into Cyber Venture
adding role="presentation" to a <table> element will tell screenreaders to treat the element and its required children as non-semantic. I still say using a table for layout (of non-tabular data) is should be a last resort but it's easy for me to say since making a layout is rarely my job.
Why not agree to let them schedule meetings at least 24 hours in advance during office hours instead of you sitting there waiting? Pull versus push is always better. Then just bill them the regular rate.
Sorry for the short response, I was on mobile.

The part of 5.2.2 I was referring to is this:

If some form of user authentication is part of the request, or if the response indicates that it should not be shared, then the response is only cacheable by a non-shared cache.

This clearly indicates that returning different versions of the same resource on a per-user basis is valid REST architecture (and I was responding to the comment that Equal GET requests will often have different results based on the user doing them is very non-REST.).

While it is only one phrase, it is the only phrase that deals with user authentication and matches the discussion very well. As such I think your comment about missing 99% of his thesis is incorrect - indeed, I think choosing the correct and relevant part is precisely what "getting the point" is about.

I agree with your points about HTTPS, but that is orthogonal to the user authentication discussion in the sense that transport-layer is separate to the API design.

However, I appreciate that your points about how the transport layer affects the assumptions around API design are correct, and that going to a HTTPS-only transport mechanism may have performance impacts in many cases (especially high-volume ones).
Yeah, I agree with you. I suppose I worded that strangely. I didn't mean cut certs out of the equation, just use fingerprints as fallback, if possible. I wasn't aware of HPKP. According to mozilla docs, it's lacking some browser support. If it got implemented across the board, this would be great. I suppose it also depends on whether or not the browser screams at the user if the fingerprint fallback is necessary.
Isn't HTTPS-only just a financial ploy of root certificate vendors? I'd welcome more security but it shouldn't cost an arm and a leg.