skysight-inc/HackerNews huggingface dataset:
I am long past confused and heading toward awed, at this point, that it's not a common-sense practice for every web developer to generate a personal self-signed root-CA cert, and install it on all of their machines. It's as basic as having an SSH or PGP key.

Setting up a new box? Put your CA-cert in its trust roots. Then use your CA to generate a server cert for it; plop that in /etc/nginx and wherever else. Now it's secure!

This is exactly the original use-case for X.509 certificate authorities: pairing devices on a private network without having to give each of them a set of of their peers' keys in advance. You have a private network that you run services on? You're a CA.

And really, in the dev-environment case, you actually want client-auth, too, because then you get "clients who don't have a CA-issued client cert can't connect" for free.

In proper X.509, the server auths the client just like the client auths the server—it's really more of an equal-peers "we're both trusted by the CA—the network owner—so we should both trust each-other" kind of thing. The public Internet centralized X.509 model—where the client has a huge list of CAs that the user doesn't even know the contents of, and the server doesn't check anything—is a very strange and non-idiomatic implementation of the premise.
Agreed. That's why it was a question. :) I'm trying to get people to start thinking in that direction, rather than in a central source of authority (which also means DNSSEC or DNS TXT's are out)
There's an alternative story of Russian relations we're not hearing
Thanks for your input and I take on board your closing note because I'm coming to the same conclusion myself.

My initial plan was to quit my job and go full time on this in conjunction with my freelancing/contracting but the latter is almost a full-time position in itself and I haven't been able to save enough to invest into the game hence the reason why I started to look into raising finance.

I've been contemplating changing my plan and maybe finding a stable job and using my salary to fund myself to MVP stage.
bummer. There goes allll my playlists.
If you want your ISP to be able to intercept your traffic and see which URLs you're accessing, you could always let them install their own CA certificate on your machine. Then they could proxy and filter to their heart's desire, even over HTTPS.

(only half-joking...)
About that:
- Testing:
Yes, for sure there is a lack of understandment in testing specially in frontend, here i have seen that a lot of the test depends on the framework that you are using, also testing in front is relatively new, and not really standarized.

- Devops, well if you are not seeing test, very hardly you would see the value of continuos integration, and tipiclly this process involves a lot of backend and even some server configuration, and as many say in here most frontends right now come from design backgrounds.

- Project management. This is more like a "company culture" issue, the way the do this mostly depends on how the rest of the company values this in frontend development.
What a silly comment. If using git is suffering to you, then don't. You know what? I hate peas. You know what else? I don't eat them.

You know why git won? HG was slow as molasses when they both showed up on the scene. That and git's branches are a dream come true. I think back then, an HG branch was a clone of the repo.

I can't figure out what sort of suffering people are talking about.
> When the user first visits an HTTPS page with a self-signed cert, they get the content, and the URL art style has a broken lock or something warning it's not known to be secure.

Do we assume the user is going to notice that URL art style, and actually heed it? Because if the answer is "no" (and I think in reality, the answer would be "no"), then pick a high value site, and MitM it with a self-signed cert. The user misses the indicator, and proceeds to interact with the site; does JS work? (let's steal the user's cookies) do forms work? (please log in!)
I had to check, but apparently that'll work for utf8 on posix (windows not so much) with unicode literals and std=c++11 (or higher presumably). Nim assumes utf8. For c++:

puts(u8"World is not spelled 'wørld'");
"As a part of a settlement agreement with the major record companies, we have agreed to cease operations immediately, wipe clean all of the record companies' copyrighted works and hand over ownership of this website, our mobile apps and intellectual property, including our patents and copyrights."

Ouch. Sounds harsh. Wonder if they had to turn over the user data as well...
How 13 Successful Companies Fought for Their First Customers
I'm not suggesting it's a good idea, I'm just mildly questioning this recurring "truth" that you can't be productive working <x> hours per week. It's very commonly repeated and seemingly accepted as an indisputable fact here on HN, but then we also read stories from people (often who have families and often kids) who built their startup working evenings & weekends while holding down a full time job. Both of these cannot be true.
Let's Encrypt does exist.

I watched a demo where they went from a vanilla apache install to an A scoring HTTPS site in sub 5 minutes at Libreplanet. It's a good idea to publicize the upcoming LARGE change.
Terms like "thug" "lynch" etc have always felt weird to me when people insist that they are racialized, but in the media the last several years I've heard it in higher correlation to a black purported criminal than a white one. But when I was a kid, I grew up in a town where there was a single black family. "lynch" was something that happened to cattle rustlers, and "thug" meant an italian gangster.
You'd have thought they'ed be smarter than that. They go to all this trouble to get around the DMCA and then they get busted because they told the employees to upload music, from work computers no less.
Care to elaborate?

I use Git on a daily basis, but I never understood it.

If I just want to commit a specific part of my changes, I just do it. It's nice to see which files are staged for a commit, but I also see them in the commit msg comments.
Thanks, really interesting to read bearing in mind your involvement in the industry. I've heard of a few of the players you mentioned - didn't get around to contacting London Venture Partners because I didn't have any connection to them and to be honest I'd never heard of EGG who look very interesting! :)

I'll look into this more in the next few days - would you mind if I reached out to you? Is it your first name @ riddle.com?
All modern browsers support SNI [1]. I guess if you need to support IE8 on WinXP you'll have problems. And IIRC, wget on Ubuntu 12.04 doesn't support it (while curl does). But it's picked up a lot in recent years, which thankfully eases the dedicated IP requirement in many cases.

[1] -- http://en.wikipedia.org/wiki/Server_Name_Indication
Parse now running MongoDB on RocksDB
Love the final sentence, and thanks for the fresh viewpoint. On the bullets, we differ in opinion on some (maybe I truly am a stick in the mud):

- React/Flux: It IS super new, I just assumed if a company choose/moved to it and are actively coding with it that they would know the basics of it. Certainly wasn't expecting core contributor knowledge by any means, just that fellow devs have read the docs and avoid plainly stated bad patterns in said documentation.

- Functional Programming: Again, I only mentioned FP because they are core concepts for React/Flux. They are also highly encouraged/required in certain scenarios: https://facebook.github.io/react/docs/advanced-performance.h...

- Security: There is no reason security needs to slow down a project dramatically, if done right. End-user security should be taken seriously and not be something to be tossed aside because it is "hard". Basics get you a long way.

- CS: Good idea on the premium. Though it is often beyond a simple conversation when the concepts of recursion and basic data structure performance/usage is an exotic topic.

- Devops: Solid points, however I wouldn't say it is anything close to a bankrupt concept. Ansible and Salt for a day or two and you have completely manageable, repeatable, and solid approach to your infrastructure.

We agree on what the biggest concerns are. Oddly, I often see nearly everything missing, those being of the most concern.
"hosting package" =/= "cert[ificate]"
Given that the article is specifically talking about the Bay Area, I thought it was appropriate
Or unemployed factory workers!
From my personal experience, people who go the java route get stuck in more corporate jobs where things are slow and boring.

Java is just not that great for web dev. Dynamic languages offer much more flexibility. Although, at the end of the day, most web apps are REST APIs with Angular or another front-end framework.

I'd say learn Rails, as there are a lot of jobs in that area of expertise. Once you get good with Rails, learn Django, and then .NET MVC

Don't stick with one. Learn multiple frameworks so you can see the pros and cons of each.

Some will integrate better with certain technologies because of community support.
Static sites or non-critical info! "Gradually phasing out access to browser features for non-secure websites, especially features that pose risks to users’ security and privacy" could affect sites that don't expose critical info.
Ulysses is definitely doable, but it marks a point when high-brow literature stopped being something every reasonable, intelligent, and educated person enjoys reading. It's a chore (less so than FW, of course), and of questionable value — yeah, it's cool to get all the references to Homer, etc., but I don't think anyone puts down Ulysses with anything other than a sense of relief of having scaled it as an obstacle. (Yes, I studied Ulysses. Voluntarily and on my own time. I don't mean to belittle Joyce's talent. Ulysses is obviously a huge accomplishment, beyond nearly all writers.)

Compare that with, say, Dickens. People would drop what they were doing to read the next installment of Little Dorrit.
Only for more money.
Same here. I've kind of dreaded this day and thought why is there no standardized 'playlist protocol' or playlist format that music services could share. This is like the 4th time I've had an old music service shut down and lost all my playlists with no migration path.
Perhaps any of the alternatives they listed on their site?
Yeah, I think they used the December 2014 numbers.
Here's two relevant Bugzilla bugs:

Self-signed certificates are treated as errors: https://bugzilla.mozilla.org/show_bug.cgi?id=431386

Switch generic icon to negative feedback for non-https sites: https://bugzilla.mozilla.org/show_bug.cgi?id=1041087

Here's a proposed way of phasing this plan in over time:

1. Mid-2015: Start treating self signed certificates as unencrypted connections (i.e. stop showing a warning, but the UI would just show the globe icon, not the lock icon). This would allow website owners to choose to block passive surveillance without causing any cost to them or any problems for their users.

2. Late-2015: Switch the globe icon for http sites to a gray unlocked lock. The self signed certs would still be the globe icon. The would incentivize website owners to at least start blocking passive surveillance if they want to keep the same user experience as previous. Also, this new icon wouldn't be loud or intrusive to the user.

3. Late-2016: Change the unlocked icon for http sites to a yellow icon. Hopefully, by the end of 2016, Let's Encrypt has taken off and has a lot of frameworks like wordpress including tutorials on how to use it. This increased uptake of free authenticated https, plus the ability to still use self-signed certs for unauthenticated https (remember, this still blocks passive adversaries), would allow website owners enough alternative options to start switching to https. The yellow icon would push most over the edge.

4. Late-2017: Switch the unlocked icon for http to red. After a year of yellow, most websites should already have switched to https (authenticated or self-signed), so now it's time to drive the nail in the coffin and kill http on any production site with a red icon.

5. Late-2018: Show a warning for http sites. This experience would be similar to the self-signed cert experience now, where users have to manually choose to continue. Developers building websites would still be able to choose to continue to load their dev sites, but no production website would in their right mind choose to use http only.
I use git every day, all day at work. It is absolutely integral to my workflow, and the only thing I know about its internals comes from people posting about them here.

Needing to know anything about git's internals to be able to use git is FUD.
Absolutely no need for a dedicated IP unless you want to support very old versions of Windows or very old versions of Android. I haven't allocated a dedicated IP solely for SSL in years.
Can we customize the color bars to match our company branding?
It can work well, but I bet the folks who have to handle the propellant would still say it's a massive pain.
If anyone needs help or has questions about SSL, please ask! I work at a company that provides SSL and would also be happy to give out discounts to anyone here.
I found it interesting that they omitted two very obvious alternatives (Pandora and Slacker Radio). An overt snub, or simply no point in naming two of the most well known services?
I think you're overstating how bad things are. Dreamhost, for example, no longer requires a dedicated IP for SSL, though they do still recommend it for e-commerce. They are charging $15/year for a CA-signed certificate. Granted, that's for a single-site cert and they don't support wildcards under this scenario, but the vacation blogger isn't likely to need that anyway.
The site is just an image with small text, so I've transcribed it here;

---

Dear music fans,

Today we are shutting down Grooveshark.

We started out nearly ten years ago with the goal of helping fans share and discover music. But despite the best of intentions, we made very serious mistakes. We failed to secure licenses from rights holders for the vast amount of music on the service.

That was wrong. We apologize.
Without reservation.

As part of the settlement agreement with the major record companies, we have agreed to cease operations immediately, wipe clean all of the record companies’ copyrighted works and hand over ownership of this website, our mobile apps and intellectual property, including our patents and copyrights.

At the time of our launch, few music services provided the experience we wanted to offer - and think you deserve. Fortunately, that’s not longer the case. There are now hundreds of fan friendly, affordable services available for you to choose from, including Spotify, Deezer, Google Play, Beats Music, Rhapsody and Rdio, among many others.

If you love music and respect the artists, songwriters and everyone else who makes great music possible, use a licensed service that compensates artists and other rights holders. You can find out more about the many great services available where you live here:
http://whymusicmatters.com/find-music.

It has been a privilege getting to know so many of you and enjoying music together. Thank you for being such passionate fans.

Yours in music,
Your friends at Grooveshark
April 30, 2015

--

Source at https://denpa.moe/~syrup/grooveshark-notice.txt
I'm sooooo glad I was paying a yearly fee for a VIP membership... and now I can't even get a copy of my playlists. All of those obscure songs I fell in love with are gone. I wonder if the information they turned over included my credit card billing data...

<sigh>

Is it time to build a personal, private, self-hosted, open-source grooveshark clone?
Anyone know what patents they held? I wonder if music industry will leverage them to take down other sites who are acting within the law via patent suits.
What in your life must have happened for you to actually believe such nonsense? Or do you have a financial incentive of sorts to try to make other people believe it?
There is a standard (more-or-less) playlist format: m3u. The trick is convincing services to implement export of that information.
Why embed the message in an image, instead of text?
I don't even think they need go that far: only the bits that would form some sort of stable API would need to not be obfuscated. They could still do whatever with anything internal.
>Of course, the farmer himself is not worth $10M, large mortgages and operating loans are usually required.

While probably not clear, this was my point. I know in U.S. for instance, policy makers used to argue that repealing the estate/inheritance ("death ") tax would help keep family farms in their respective families. In actual fact, it is very hard to find lots of individual farmers in the U.S. w estate tax exposure.
Hopefully you're feeling better after this venting session. Now, take a breather, step back, and look at career options.

It could be a win-win. The sad reality of finding your "ideal" career is process of elimination: you will run into horrible jobs, but that'll at least get you closer to finding that one that will provide satisfaction.

One of two things will happen. 1) You'll find a new, more satisfying career route, or 2) you'll discover that you have not yet examined every potential possibility within software development, and there are still options. This second one may sound horrible, but you never know - the grass is often greener!

Worst case, you're currently in one of the BEST (employment rate, compensation, prestige) careers ever. So it could be worse. Not to downplay it, but perspective never hurts :)
I can spend hours and hours to explain why Zeppelin is good and what is different feature compare to the other.

for example, Zeppelin has pluggable architecture so it does support not only scala but also python with built in Spark integration. Zeppelin not only support data exchange between scala and python environment but also SparkContext sharing for spark cluster resource utilization. It's got ability create rich interactive analytics GUI inside of notebook. It's got customizable layout system, and so on..

But I wanted to address more fundamental difference.
Most competitors are opensource project. And as a opensource project, how community works and project direction are the most important things. That'll make huge difference in the end. And i think i explained and compared them.
Show HN: Amiibo Crowd Deal
There was no affiliate code, the link only contained a bunch of query parameters to match the size and material of OP's map.
Did you know that Russians had github blocked for several days? Anyway, you're talking about counter-censorship warfare. Yes, some of those measures will be somewhat effective sometimes, but the costs (not necessarily even monetary) are actually quite substantial, and it's definitely not for everyone.
I've thought about this too many times and I'm surprised the approach taken here is the most naive one. Replacement for addresses is long due but this is not it. People don't use addresses because they are short but because they are readable and memorizable. I can't even expect someone to remember their own address as "CWC8+R9" let alone their friends. My idea was to assign fun names and possibly relevant to near by geography, weather patterns and history to every 6ftX6ft square in the world. In essence you machine generate the address as if you would have asked human standing there on that spot based on what they would see/feel there. If someone would want to steal this area, let me know by email :).
"The fact that Mercurial is written in Python has a big impact on its performance, and git is running rings around it as a result. When you run tens of commands every day, it adds up."

No, it doesn't.
For those that are interested in doing the PCT and want to learn more I highly recommend the trail journal of Carrot Quinn on her 2013[1] hike. She gives an entertaining and real view of the trail.

I hiked the trail in 2014 and found it to be one of the hardest and most rewarding things I've ever done.

1. http://carrotquinn.com/pct-2013/
I hope playlist data wasn't part of the settlement, and that we will be able to recover it.

It would be detrimental to the artists to have some of their fans not be able to find them again, right? Perhaps record companies care less about the artists which are forgettable in the first place.
Although it is not a direct replacement I've been honestly impressed by the app 6 seconds. It's by the same guy who created mp3.com and his team indexed radio station playlists in real time, something Google thought impossible.

http://www.forbes.com/sites/hughmcintyre/2015/04/17/6seconds...
I don't use hg much these days but you can just pass the file(s) you want to commit to 'hg commit'; no need for staging. Even better, hg (or its shell integration at any rate) has tab completion so it's easy to go though the modified files and pick those you wanted to commit. I kinda miss this now I'm working with git mostly.
"That was wrong. We apologize"... After what, 3-4 years of mainly illegal content? Wow :) if only every crime was that easy to deal with. It's very Wall Street of them.
I think Pandora is US only, certainly not available in the UK. Which is a shame, because it was brilliant about 10 years ago when I was allowed to listen to it. Maybe that's one of the reasons it wasn't listed?
Out of curiosity, which one?
You're oversimplifying and being dismissive without cause.

>a web browser has no business dictating that the entire web should be forced in HTTPs.

1. that isn't what is happening as per the article. They are going to begin picking features that shouldn't be allowed over HTTP (like, say, geo location, web camera access, etc).

2. a browser is precisely the actor that should push for these things. If not browser vendors, who?

>What is forcing HTTPS on the entire web actually doing?

Encrypting streams of data that were previously unencrypted.

>Who is it benefiting?

Users.

>The government can still snoop your data in-flight.

So your argument is 'this isn't perfect for all attack vectors, so it isn't useful at all'?

>Do we need TLS to read the latest TMZ post about Miley Cyrus?

Yes. See how easy that is?
There won't be any policy-driven change in the education system of the kind that TED speakers would love to see.

The system won't change meaningfully until the world around it changes first. That is to say, until private sector alternatives/supplements start making an impact in education without the help of the state. But that's entirely possible.

The issue is that nobody has really built anything all that special for the education sector yet. The best we have are MOOCs, which are, for all their production values, just static resources and not a new way for a child to learn.
OpenBSD also makes it pretty easy to compile drivers into a custom kernel:

http://www.openbsd.org/faq//faq5.html#Why

And to configure an already compiled kernel with UKC:

http://www.openbsd.org/faq//faq5.html#BootConfig

So most of the time there's little need for kernel modules.
Envato have there own comment spam team?
Pandora doesn't provide the same service. They purely do "radio" and don't let you make playlists or play specific songs.

I can't explain Slacker's omission though.