skysight-inc/HackerNews huggingface dataset:
Trying to secure everything weakly leads to weaker security on important data. If you're using HTTPS for everything, it's so tempting to run everything through a CDN such as Cloudflare, which lets them look at your most critical data. This over-centralization creates a convenient point for central wiretapping. If you run the important stuff like credit card data through your own secured server, and serve the cat videos through the CDN unencrypted, you're be more secure than if you run everything through the CDN. HTTPS Everywere discourages this, which is why it's a form of security theater.

Then there's the EFF's own backdoor, the HTTPS Everywhere plug-in. Compromise the EFF's "rules" servers, and you can redirect user traffic anywhere. Their "rules" are regular expressions which can rewrite domain names. Here's an HTTPS Everywhere rule, from their examples:

<rule from="^http://([\w-]+\.)?dezeen\.com/"
to="https://$1dezeen.com/" />

That's a third party using a regular expression to rewrite a second level domain. This rule always rewrites it to the same second level domain. But do all of the thousands of rules in the EFF's database? Here's an dangerous looking one that doesn't:[1]

<rule from="^http://(?:g-images\.|(?:ec[5x]|g-ecx)\.images-)amazon\.com/"
to="https://d1ge0kk1l5kms0.cloudfront.net/"/>

That redirects some Amazon subdomains to the domain "d1ge0kk1l5kms0.cloudfront.net". Seems legit. The EFF wouldn't let someone redirect Amazon traffic to a hostile site hosted on Cloudfront, would they? If someone set up an instance on Cloudfront which faked the Amazon site, and got a rule like that into the EFF's database, they have a working MITM attack. That site is "secured" by a "*.cloudfront.net" wildcard SSL cert, so all we know is that it's hosted on Cloudfront. Does the EFF must have some way to check that "d1ge0kk1l5kms0.cloudfront.net" string? Nothing in their documentation indicates they do.

Welcome to "EFF Backdoors Everywhere".

[1] https://www.eff.org/https-everywhere/atlas/domains/amazonaws...
Certainly Rubygems+Bundler in Ruby does it, as well as Mix in Elixir. npm in node.js may even do it due to its weird require system but I am not sure.
Treating OCD with Gamma Rays Is Really Hard
>For some reason the only place to get good earbuds is from someone who is selling something else

Or you buy quality stand-alones from Shure, Sennheiser, Beyer Dynamic, or Sony (and many more probably)? I always throw into my e-waste bin the Apple earbuds since they're both really low quality. The Shure SE215s are so much better than any bundled earbuds it's barely an opinion.
The Most Popular Programming Languages in GitHub Since 2012
Why would somebody need a TCP load balancer in a web server ?

Is there a use-case where the TCP load balancer being with the web-server made a lot of sense ?

Integrating too many features into a single software can be risky as it may compromise simplicity and the UNIX way, 1 tool for 1 job..
The Humanness of Death
Like six orders of magnitude matters...
Scientific Proof That Americans Are Completely Addicted to Trucks
While I totally applaud this effort, how does it not lie? It inserts code into the actual source claiming it is on a line in the original file, but it is in a different line in the compiled version. That seems like it could be a problem at some point, and despite the serious utility in this, I'm not 100% convinced it is the right tool for the job.
The Chinese Hackers Who Are Actually Not Trying to Hack You
Any time someone says "will never do that online," I have an almost Pavlovian response of "sounds like doing that online is a good startup idea." In pretty much every case where people have shown an interest in doing offline, once the experience has been replicated closely enough online, it's ended up working well. The first company I worked at out of school, BuildASign, started as a software to design signs online (incredibly, the founders were the first people to build an online sign designer, at least that they've found). They intended to sell it for a few grand to a local sign shop, as they were all in grad school. All the sign shops they approached said "No one wants to design a sign online! They want to come in and see samples and get help from a person." So the founders threw up a site, planning to do all their fulfillment at a store to demonstrate why they should buy their software. The response was so strong that they quickly decided not to sell, and bought a printer. Today, they have a 100K sq ft manufacturing facility and have had at least 5 straight years of high growth revenue in the high 8 figures (and have been profitable since year 2, plus - until a very recent PE investment - were entirely owned by 3 people).

Point being, once something can be done well enough online, people will do/buy/use it.
Microsoft first developer preview of Service Fabric
Nothing to Fear from New Technologies If the Market Is Free
I wonder if these management classes Google implemented are online somewhere. It would be nice to be able to view them.
Hmm, that is a way I did not think about. Documenting hardware limitations for compilers gives competitors leverage for saying theirs is better because it does not suffer from X.

I understand that open source is not particularly important to you, but I am a bit more skeptical about the verifiability of a product that is all secret sauce and promises than I am about something with open check-able code and test suites. Open source software very rarely tries to hide its flaws to prevent a PR issue and then lazily fixed in the future because it is 'low priority', instead they are fixed by whoever can, verified, etc. There are always counter examples, but I thing the verifiability of the tool is in the same world and of similar importance to the verifiability of the output.

You do make a point in the catastrophic cost of a screw up when casting an ASIC though.
Just a few days ago I had someone from Cox call me up out of the blue to ask me how I liked their service and to tell me about some of their other services. But first they wanted to verify they were speaking to the correct person.

I refused, told the woman flat out she called me, I didn't call her, therefore she was getting no information from me. I also told her I was happy with my Cox account and had no interest in whatever it was she was trying to sell. To her credit, she thanked me and ended the call amicably which is exactly what should have happened imo.

I understand the need for it from the company's perspective, but for me it was strange, uncommon, and I'm just too damned cynical. Even if I were interested I would have insisted on calling back through Cox's number before speaking with someone.

There was a time when it was relatively safe to speak with someone who calls you like that, but it's been years since I've felt comfortable doing so.
Harvard economist Edward Glaeser; author of the book Triumph of the City: How Our Greatest Invention Makes Us Richer, Smarter, Greener, Healthier, and Happier; has written about this as well as many others such as Economics Nobelist Paul Krugman who cites Glaeser).

The problems with the high rents in today's cities is through the use of politics to artificially increase the value of land through zoning density restrictions and overuse of historic landmark status. These laws that increase the cost of land serve as a hidden tax on the poorer segments of society to subsidize the wealthy.

See: NYPost Build Big Bill (de Blasio -- Mayor of NYC)
http://www.nydailynews.com/opinion/build-big-bill-article-1....
does this include the dynamic reconfiguration feature?

http://nginx.com/resources/admin-guide/tcp-load-balancing/#u...
I bought a bed from Casper a few months back, and the experience has been nothing short of spectacular. When I tell friends who don't work in startups or are older, they are baffled until I explain it. Buying a bed has to be up there on the list of "I see why someone would hesitate to do it online, without trying it out first," and Casper has figured it out.
How to download an archive that shows what Google knows about you
So devoid of the culture you want, not devoid of all culture.

Seems like you confused your personal desires with something meaningful, then decided to drop a backdoor condescension on those of us who don't share your personal desires.

Not a super compelling argument from my point of view.
It makes you feel like the most special snowflake there ever was! And when you wake up, there's a trophy under your pillow.
as i expected the blog author is Russian - his site name is a pretty offensive phrase to Russian ear. A kind of phrase one utters when heavy hummer falls on the one's foot or when one's server crashes unexpectedly in the middle of multi-hour job. It is kind of a joke in Russian - "an American asks his Russian officemate why the Russian constantly mentions 'Your Bunny'"
How misleading. It saddens me that the WP can fall so low.

Here is the most important point:

> Whistleblowers who avoid the new authority (CNCTR) and send their information directly to the media would still commit an illegal act.

Whistleblowers will be able to report misconducts to this authority only. Speaking to the press will still be illegal.

> If American whistleblower Edward Snowden were French, he would have had a good chance of remaining a free man.

Not a chance. Edward Snowden also expressed concerns, which did not translate into anything. The only moment things started to move was when Edward Snowden started speaking with the press.
The trouble with audiophile gear is that it is really a scam to separate people from their money. I've found that, for me at least, the best deals for music fidelity are in studio-type equipment. A good pair of powered mid-field studio monitors and a Focusrite FireWire audio interface gets me sound that would cost $thousands if I bought audiophile-market gear.

Also, there are some interesting audio cards for the Raspberry Pi that are quite reasonable and offer great sound. I've set up an old Model B with the Wolfson card and RuneAudio, and plugged in my monitors. Outstanding sound from a box that cost less than $100.

Audio is engineering, not magic. Sure, people can spend big bucks on AudioQuest cables with Extra Bling, but I'm not one of them. I even consider Monster to be a ripoff.
The thing I've always loved about games like these is that they have a perfect balance of being complex enough to be fun and interesting to investigate, but not so complex that you have layer upon layer of stuff to get through to figure out what's going on.
This is such an awesome, anachronistic mix of the shiny new and the internet of yore.

It's a shame MUDs expect you to be constantly interacting, I keep being slow and having them time out on me (then having to ;;reset to revive the session ...)
No, the point is that they are outside the normal repositories, which require testing by the Ubuntu developers, bureaucracy, etc
Twitter Now Allows Users to Receive Direct Messages from Any User
read title as "Korean shoplifter uses exosuit..."
Yeah, T&N was definitely first. (Though not so first that they conclusively proved the market, IMO -- whether the mass market will take to ordering mattresses direct is still something of an open question.)

The biggest distinction between T&N and Casper seems to be on the types of materials they use. There's some interesting technical details (some provided by the Casper founders) in this thread from last year at Mattress Underground: http://www.themattressunderground.com/mattress-forum/general...
I wonder how they are able to legally prevent new development just because it will decrease their land value.. Can such an argument hold up in courts? If it was because of safety or congestion issues, it makes sense. But how is maintaining existing land prices a valid reason for preventing new developments..
This was obviously written by someone who doesn't understand the "React" part of React Native.

Can someone downvote this or get this garbage out of the feed. It's stupid that it is even listed. Unless it's there to be made fun of as an example of bad journalism?
Managing Heroku dynos to optimize concurrency and memory use
What about Mt. Gox?
Actually, RMS recently reported that he's updated to using Tor with a browser.
So you write the business logic and layout in Javascript, but the platform's native GUI elements are used.

That's what a web browser does. Is this basically a mini-browser that looks like an "app"?
exactly. It's a well understood problem which means you can focus on other things.
On another note, you argue 'few good insights ever come of the form "You have $difficult_problem, you just need to do X to solve it"', but right before that you say "getting on medication to fix their broken neurochemistry." Is that not an example of "you have $difficult_problem, do X to solve?" You sound young and confused. It will pass.
Examhack for Android-Predict Questions of Indian CBSE Exams
Honestly the only notifications I care about are email, text messages and phone calls. The rest can all go to hell. Again, this is just my personal taste.
Examhack app predicts questions of your next Indian CBSE exam by trawling past question papers according to marking scheme and lets you solve important questions what you want from over 1000 question papers.
>In reality it's under the control of the lead developers

Only because they've done nothing wrong (thus far). If there was any hint of foul play, they would be out.

The people that run the mining pools don't "control" bitcoin to any substantial degree. And, again, if they seriously abused their power, a trivial software fix would be to change the proof-of-work algorithm, instantly obsoleting the miners' equipment.
If Record Store Day Is Dead, Maybe We Can Celebrate Music
> You can't spend 5 minutes to google for Tor because of your "pay grade"?

Do you think that kind of decision was up to the actual guy/gal you were interacting with? Genuine question, not rhetorical. I just ask because sometimes you get asked to do stuff at work that's silly, but it's easy and makes the guy/gal paying you happy, so you do it.

If it was a lawyer, they probably charged for the whole hour, right? Heh.
Of course on the other hand FPGAs are not a great fit for mobile devices, which are one of the main consumers of wireless communication (radio) technology.
I've been tempted to send a "look" or "inv(entory)" command to keep-alive a session. Hmm...
Yale University’s youngest professor of the 20th century, died
I liked some of those tricks a lot. Others made me slightly anxious. Very strange
140K, SF Bay Area, Analytics/BI/Data Science
5 year timeline:
Dropped out of PhD Program (STEM program- not CS)...
year 1) Terrible economy, took non-paying internship, did sporadic contract work. At one point took home a job application to work as a barista.
year 2) 40k a year. Full time job at crappy company doing random, interesting work- mostly non-technical.
year 3) started working with "big data", really developed my technical skills. 80k
year 4) Continued big data work, with more experience, started making a real impact on product 90-105k base
year 5) Moved companies, now at 140k base
How to stabilize and tune a Spark Streaming app
Android Wear: You can now draw emojis as replies right on the watch
If we would all just have used Lisp from the get-go, then none of this would have even been necessary. ;)

> Don't you rather be learning new concepts rather than new syntax/APIs?

I ran out of new things to learn in Ruby, around the time I wrote a fizzbuzz implementation using pure functionals without any conditionals. And the mutability issue was bothering me in a very real way (I spent a month, A MONTH, tracking down a dropped-session issue which ended up being a stray mutation of the gigantic ENV variable in the middleware stack... That class of bug would not exist in Elixir/Erlang). Elixir/Erlang provided very brand-new things to learn... pattern-matching instead of complicated nested logic, explicitly passing around state instead of holding it everywhere, macros, OTP, I mean pretty much everything underneath is different except for the syntax. ;)

You can't learn something like macros in Ruby, at all. If certain things aren't core language features, it's just difficult to learn them, period.
I remember those days - I used to download mixes, albums, tracks over ISDN, which was basically an all-night affair. Getting up in the morning in anticipation of listening to a new Global Underground compilation is something that just rarely happens these days.
Not having everything readily available made me appreciate the smaller, but carefully selected collection I maintained.

I still buy lots of music, since I prefer to own my collection and don't want to rely on a streaming service. However these days I find myself to be much quicker to hit the skip button and enjoying a new album is more often than not a short lived pleasure. The downside of modern conveniences I guess.
Yeah, that's why I emphasized letting them talk about their lives. But...there will always be those out of touch "why don't you just do x and then y and then have a house??" people.
I'm a serial low-volume costco shopper (<5 items) and don't really care if they put in express lanes or not -- I just wish costco would go to the single-queue model for checkout.
Not attractive but functional?

Yep, they are running Drupal 7.
For those of us who don't know React, what is the key misconception/misinformation here, which would allow us to recognize similar articles as stupid?
Yeah, the title mangling really changed the sense of what the title was trying to convey.
Great to see functionality migrating from Plus to FOSS!
Wiki of Oktay Sinanoğlu
http://en.wikipedia.org/wiki/Oktay_Sinano%C4%9Flu
are there any examples? i couldn't find any on the site. what about some kind of support for dot/graphviz?
So do you think federal subpoenas from the US to Romania would get honored, then? Like, if the FBI subpoenas for this same information, would the Romanian federal government enforce it?

Or would they not even bother to subpoena, and just get the information through back channels (i.e. not documented, not official)?
I can't stop giggling at the red hand-circled bit in the subpoena.

( IP? ) <-- This is the one we need
>There was a time when it was relatively safe to speak with someone who calls you like that, but it's been years since I've felt comfortable doing so.

I'm not so sure about that, I think it existed for all my life, just wasn't very common until now.

I remember over 20 years ago getting a phishing call trying to get personal information about me.
Oner of my recent favourite things has been watching people do these tricks live. Here's another AGDQ video, the guy executes an elaborate buffer overflow in mario 3 by hand to make it skip to the credits. It's called a 'wrong warp' or a 'credits skip' and it's completely ridiculous.

https://youtu.be/c-bkDz0wPsI?t=3774
C++ comes up pretty well there...
Indeed, its an "Artist concept of Ganymede and Jupiter"[1], which only further highlights the pointlessness of having an collection of space images without any metadata.

[1]:http://www.nasa.gov/press/2015/march/nasa-s-hubble-observati...
Oscar Raises $145M at $1.5B Valuation to Build a New Healthcare, Insurance Giant
Importing 101 for Crowdfunding Campaigns
I think the April Fool's joke was around HAProxy being completely rewritten in Lua: http://www.haproxy.org/news.html
Ask HN: How to improve my chess skills?
Hey HNers,

I have always wanted to learn a bit more about playing chess and improve my skills in this sport. I have no idea how, though. I mean, I am sure that if I play more, I will gradually improve, but this could take too long time. My desire is to be better than, let's say 80% of the players.

I know the game and the rules of the game, I have been playing the game for years and was teached by grandpa, when I was around 9-10, so yeah I can play it, to some degree. But I want to improve and it seems like in the next few months I will have an opening and would be able to spend a few hours being able to play the game online or in some cases offline, as there is a park around here, which is often used by other people to play chess.

I am looking for a website/engine, which would allow me to play games online with other people and another(might be the same as the first one), which would allow me to check and analyze my game. I am looking for a free or reasonably priced service so I can do that. Any recommendations or advice will be appreciated. Thanks in advance!
http://en.wikipedia.org/wiki/WebSocket are a completely legitimate use.
DIFM = the "whole product" as described by Geoffrey Moore in "Crossing the Chasm." He suggests that you partner with third-parties so that your customers get a complete use case, usually your technology only solves part of the problem and leaves the customer coming up with the rest.
I haven't been able to get chvideomode to work under Virtualbox. The OS itself is rather cool, I think I will try to write a simple graphical demo to try it out.
I wish a LOT of places had this, it really shortens how long I'm standing in the line, and it also vastly increases the efficiency of the operation.
Publication list
http://www.quantum-chemistry-history.com/Sina_Dat/Public/Pub...
They run a credit check on you beforehand, that's what the SSN is for. I'm sure you can ask to opt out of the credit check as long as you are willing to give them a hefty down payment.

Many times you can avoid the SSN by asking and being willing to jump though a couple extra hoops.
Classic vs. Mockist Testing
This post got hit by a spam filter on noob accounts. We marked your account legit so it won't happen again. You're welcome to repost it, since it's probably too late for it to get much discussion.
There are something like six of these boutique foam mattress startups, of which Casper is one of the newest, cutest, hipster-i-est versions. I've had a Keetsa mattress for about five years now. It's fine -- it was about 20% cheaper than a TempurPedic when I bought it, and the fact that it came vacuum-packed was a gimmick that made it possible to get it into my apartment. It's a little on the firm side, but that's what you get when you have no choice.

(As an aside, nearly twenty years ago, I bought a mattress from the Denver Mattress Company, who were (and are) selling and manufacturing great mattresses for a fraction of the price of the big players. You want to talk about innovation? Talk about those guys, not three hipsters in Brooklyn who got some VC money last year and used it to buy generic foam mattresses from a Chinese supplier.)

That said, there's no way in the world that this market is big enough to support this many startups. Mattresses weren't sold in stores because the companies didn't think people would buy them online; mattresses are/were sold that way because they're like cars -- people buy a new one once a decade. It's hard to build a big business unless you're extracting maximum margin per item sold. It's even harder when five other identical "scrappy insurgencies" are competing on price in the low end of the market.

But hey, cheap VC dollars means cheap mattresses for you. Everyone is thinking about gross revenue and "disruption", but nobody is thinking about business models.
And there is where you nail it. They get away with it due to the threat. It would be expensive, but they know full well they'd stand no chance should they put up a serious blockade. That is also why US Navy Carrier Strike Groups 3 and 10 are always within business distance of that area. Mutually assured threats.

It is a sad world that we live in.
Needs a legend; I'm not sure what a few of the little icons represent.
5 Organizations Shaping Austin's Startup Ecosystem