skysight-inc/HackerNews huggingface dataset:
It sounds like this is mostly going to be focused on features that require user consent. The article gives the example of media devices (camera and microphone) but there are plenty of others: fullscreen API, geolocation, notifications, large amounts of offline storage, etc.

These capabilities are sensitive enough that you want to give users control over who is granted access. But if pages are being loaded over HTTP, the user can have no way of establishing the authenticity of the Javascript code they're granting permissions to.
I couldn't agree more. My experience exactly.
"Should a parent who allows their child get fat be tried for negligent homicide for knocking years off their life?"

No, but parents who allow their children to become morbidly obese should be investigated for child abuse.

"Stay out of other peoples decision on how they raise their kids."

I do. She didn't raise her kid; she killed her kid.

"Do we really want the government raising our children by rule of law?"

Yes. The rule of law is what distinguishes civilisation from savagery.

Edited: although I'm not sure that's what you meant by 'the rule of law'. If you're against Government intervention in parenting I'm in agreement, by and large, but there is clearly a point at which intervention is reasonable. Consider e.g. infanticide; does your rejection of Government interference in parenting extend that far?

The interesting cases are the grey areas. What about parents who encourage their children to participate in dangerous sports? That seems reasonable to me, although I know some of the wrap-children-in-cotton-wool brigade disagree.

I don't see withholding life-saving medical treatments as a legitimate parenting option, however.

Maybe we should ask the parent in question?

Oh, wait, her bad ideas killed her as well.
SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too:

$9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden.

https://www.namecheap.com/security/ssl-certificates/domain-v...
That's just one project, and it doesn't even exist yet.

The web is moving faster every day, apparently. I sure do hope that project will be all it's chalked up to be.

For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). If letsencrypt doesn't do that... well then I'd have to hope real hard for a competent CA out there who has an automated process available that allows IP-only certs. And whatever their price, if companies start following Mozilla's lead too soon, I'll have to pay up.

The wording in the article is perhaps not so damning yet, but it's still making me uneasy that they put out this press release while there are currently ZERO viable solutions for this.
Some numbers for our game Apples vs. Robots [1]:

- 14% of our users opted in to share their data

- Overall conversion rate is 44% (install/app store page view)

- Conversion rate in USA/Canada is 54%, in Asia 42% (our app description is English only)

- Conversion rate iPhone 49%, iPad 37%

[1] http://applesvsrobots.com/
And when people ask 100 year olds how they did it, the recommendation is always smoking and drinking.
There's very little incentive for any company (even big ones) to deal with the headache of treating foreigners as employees of their company when they do not have a local office.

The simplest way to overcome that is for the companies to "contract" work to you and possibly bundle all your insurance and other needs into that contractual payment.
Let me point you to the critical word, ok?

> For Tor and I2P _hidden services_
Hopefully they put in a whitelist option... (similar to IE's security zones)... so you can whitelist your development domains.. in the case of hostnames, or when you hit a local VM.

I agree with another comment that a red broken lock for HTTP connections would be a better approach.
What part of this proposal made it seem like static sites with non-critical info would be "crippled" over HTTP?
This is a decision that should span out on several year, while there is Let's Encrypt arriving. I don't see the problem.
The .NET community is extremely large, perhaps you run in a small circle.

A job search on indeed.com (a job listing consolidator) within 25 miles of my area, Santa Monica, CA reveals

2,477 jobs for .NET

2,083 jobs for Java

1,284 jobs for python

685 jobs for Ruby

Here are # of questions with following tags on StackOverflow:

Java: 845,330

C#: 786,850

Python: 417,737

Ruby: 132,074

I can't speak for the rest of the world, but I would guess if you looked at 200 of the largest companies in Los Angeles, 90% of them have at least some .NET code running for something. It's pretty ubiquitous.
And what about testing small applications on remote servers like "dev.my-personal-site.com"? I don't want to pay $15 for an SSL certificate and 15 minutes of my time just so I can get my dumb lunch break tetris HTML app running on the machine I SSH into from my tablet.
Ask HN: Open-source license for self-documenting code?
Hi!

I'm about to release my Physics PhD thesis. My thesis is automatically generated from prose, code, and raw data, going from raw data to a complete document without human intervention. The codebase spans thousands of lines of Octave, Gnuplot, LyX, Make, and many other GNU-licensed tools. I'd like to make it freely available, certainly for inspection and most likely under modification and sharing terms similar to the GPL.

The trouble is that the single git repo is both a document and code. The document is meaningless without the code, and the code is meaningless without the document. It seems that GPL-like licensing is inappropriate for documentation, and documentation licensing like the FDL is inappropriate for code.

Are there licenses that treat code on equal footing with documentation?

Thanks!
This makes sense for clearnet stuff. Hidden services are encrypted before transit.
Before the modern system of mass schooling (whether private or public) came into being, in-home education, via tutors, tailored for individual childrens' needs was the norm for the aristocracy and the very wealthy commoners.

Is it a big surprise that we're starting to see inklings of that again, given the growing gulf of inequality in the Bay Area?

I'm sure it's wonderful if you can handle it logistically and financially. I do wonder, though, if hybrid approaches may be more accessible to the middle class.
There was just a piece on NPR claiming thug now means ni__er, at least when white people say it. I'm white and always thought it mean something more along the lines of soccer hooligan or bully. Am I that out of touch?
Encryption and server authentication are built into the Tor hidden services protocol. The destination is the exit node.
Aurproxy – a load balancer manager for Aurora
Olin Shivers' acknowledgements for the Scsh manual
> or a tad obsessive (page after page on the importance of chewing one’s food)

> He reportedly died in the mid-1920s, when he was in his early 80s. It wasn’t age that did him in, but choking on a chicken bone.

Guess he really was onto something with that chewing thing.
This is stupid. There are all kinds of use cases where you don't care who knows what you're looking at, or whether it is authentic.

Say I navigate to some restaurant's web page using HTTP. Even if I used HTTPS, someone spying on my traffic would know what I'm reading, if the IP address is a dedicated server for that web site only. Whether I use HTTP or HTTPS, they could infer that I'm interested in visiting the restaurant.

Secondly, I'm only interested in the opening hours. That is not classified information.

I suppose that a MITM attack could be perpetrated whereby the attackers rewrite the opening hours. I end up going to the place while it is in fact closed (and the area happens to be deserted), making me an easy target for the attackers to rob me.

Okay, okay, please deprecate HTTP; what was I thinking!

And that restaurant better get a properly signed certificate; no "self signed" junk! Moreover, I'm not going to accept it over the air the first time I visit, no siree. DNS could be redirecting me to a fake page which also has a signed certificate. I'm going to physically go the restaurant one time first, and obtain their certificate from them in person, on a flash drive, then install it in my devices. Then I'm going to pretend I was never there and don't know their opening hours, and obtain that info again using a nearly perfectly secured connection!
It doesn't have those either, does it? Just basic conditional flags like C#. Or can you #define FOO bar?
Grooveshark Shuts Down
As long as you bring a book along.
for now: https://www.startssl.com/?app=1

coming soon: https://letsencrypt.org/

I'm sure there are others...
This potentially removes the relative anonymity that the entire non-commercial web offers (and in fact was largely built on, post-DARPA). Free DV certificates may help minimize that negative effect, but this entire scheme still further increases reliance on a badly broken CA system.

This seems like a somewhat rushed idea with good intentions but without sufficient community discussion.. rather than put all our eggs in one basket with LetsEncrypt et al, which are noble efforts to fix a broken system, are there things we can do right now in terms of favoring self-authentication of self-signed certs? This whole thing feels a bit like a witchhunt to punish non-HTTP sites.
This assumes that the future will always be like the present. In the past, the methods of schooling and the number of parents at home has varied. I see no reason whatsoever to assume we have reached a situation which is permanent and will never change.
That's correct but that doesn't invalidate chimeracoder's point. His/her point was to disable the ability to use WebRTC with Javascript served from an unencrypted website. Currently, https://github.com/diafygi/webrtc-ips/blob/master/index.html can work on unencrypted websites. The fact that WebRTC has an encrypted connection is irrelevant.
Allowing some things on http can be a security risk. If you store a cookie, how do I know it's going to the same site next time?
Chrome has been pushing the same thing (deprecating plain-text HTTP and/or visually marking it as non-secure) for quite some time, and they've been very clear that "localhost" will still be considered a secure origin. I don't see any reason to think that Firefox would behave differently.
You might explicitly include "employees of the coffee shop/hotel/library providing wifi" in the list of actors who can intercept your traffic. Honestly, I think that one will get the most attention of the average person.
>being either ports from the Java world, or throwaways that failed as commercial projects

This is blatantly false. Just on my current project I'm using :

* OpenTK - opensource API around OpenGL

* ReactiveUI - opensource MVVM framework using RX for databinding

* Command Line Parser Library - opensource, does what it says

* NLog - logging library

* sqlite-net - micro ORM for sqlite

I excluded :

* RX - opensource but comes from Microsoft so not a community, but also a nice counterexample of porting from .NET to JVM as RX was innovated on .NET and later ported to other platforms

* system.data.sqlite.org - opensource .NET sqlite implementation, arguably a port from a bigger project

And that's just the references I have in my current project, there are a bunch of open source .NET projects that do cool things, for eg. MonoGame, bunch of MVVM frameworks, etc.
Cloudflare's free plan has SSL now, which a 10 year could utilize. While that opens up a potential MITM attack, I don't believe it's worse than having no SSL at all (others argue it is, on the premise that it creates a false sense of security).
> Monsiuer Benjamin

It's Monsieur.

And I don't like this idea. I want to choose the restaurant I'm going to, we have amazing tools now like Trip Advisor to get an idea of the quality, it's pretty easy to find something YOU want.
Ehhhh, it isn't unusual to see private elementary/middle/high- school tuition in NYC rival the tuition at Ivy League colleges, so definitely not limited to the Bay Area.
Simple JavaScript Exploit That Nukes Google’s Password Alert
I can see how you may have missed Visual Studio Community Edition[0] in the recent flood of awesome MS announcements but it's been around for a while. Comments on the extension page suggest it works for this.

[0] https://www.visualstudio.com/en-us/products/visual-studio-co...
I understand what you're saying, requiring SSL doesn't seem like too much of a burden superficially. But it's magnitudes harder and more frustration inducing than simply buying a domain. My website is protected by the cheapest certificate on that list, and it was a gigantic pain to set up. Also, only the root subdomain on my site is protected -- I have things on other subdomains which I can't encrypt because $10 dollars a year quickly adds up.
Yup, we'll be getting around to that feature really soon. In the meantime, just email us to let us know!
I have to say, I actually disagree with this move. While I think the intentions sound noble, and I'm all for a more secure web, I also believe that a web browser has no business dictating that the entire web should be forced in HTTPs.

I don't see any benefit in this type of blanket, all or nothing, type of approach. In fact, I see it doing more damage than good. Encrypting blogs, news websites, etc still makes no sense to me. I'm actually disappointed in Mozilla for looking at doing this. As a developer I respect many of their products and see them as champions of the web in a lot of ways.

HTTPs does not:

- protect a user from malware on their own system with keylogging taking place

- increase security in outdated and insecure websites (eg: old known exploitable code)

- prevent any browser drive-by downloaders or exploits

- increase the security of the web server itself (web stack thats serving requests) - yeah that's you using a private VPS without doing Kernel updates.

These are likely the major factors of why people have security issues.
What is forcing HTTPS on the entire web actually doing? Who is it benefiting?
The government can still snoop your data in-flight. If someone is connected to a fake wifi endpoint there is on the fly SSL decryption out there.....

Do we still need TLS for actual secure transactions that deal with personal data? Yes, of course. That's what it is intended for.

Do we need TLS to read the latest TMZ post about Miley Cyrus?
You decide... (oh and it's http if you were wondering)
I was thinking that was the way to go too for a while, but then I realized that marking http as insecure will just get user used to clicking through security warnings and assuming that they're "normal"
I have homeschooled my kids for four years now, and I think this article does a great job at dispelling common myths. The "socialization" myth is the biggest, but if you look at homeschool teenagers, they are much more well socialized in interacting with adults in the real world. One point I would have liked to have seen: the number of homeschool parents who are former teachers. More than half of our homeschool friends are former teachers. This means these parents worked in the public school system, and when it came time to send there kids decided "nope, I'm not sending my kids through that system".

As for startup ideas: I want MOOC aimed at younger kids. Right now the closest thing we have is Khan Academy, and it's pretty good, but a MOOC on a specific subject, with a series of videos, and questions, and interactive activities would be a big help.
"Backers" is absolutely the right word in this case - I knew "customers" wasn't fully accurate in a Kickstarter context (though it does have wider application to other businesses). Thanks for that.

You're also right that the communication from the ZPM crew seems to have been poor from the very start - a lack of capability and experience, I suspect, not a presence of malice and fraud.
As an aside, I really don't like wildcard certs. If the private key is compromised, the consequences are so much worse than if you lose a regular cert.
By default, the Rust compiler warns you when you use uppercase characters in variable and function identifiers. The community overwhelmingly adheres to this style. Rust is also extremely strongly-typed, so not only would you have to be willfully disabling the style warnings, you would have to have to manage to give them the same types, and furthermore given the nature of Rust code it's rather possible that you'll still get a compilation error due to using a variable in a way that it didn't expect. You also can't "accidentally" introduce new variables in Rust, as you can in Python via typos.
I agree. In fact I think github is doing more to extend and extinguish. They are the ones who just introduced their own proprietary closed method of binary storage while git-annex was already there.
Pgsql: Create an infrastructure for parallel computation in PostgreSQL
My compiler is 20,000 lines of code.

My kernel is 30,000 lines of code.

My compiler can compile 100,000 lines in one second.

I always compiler every line of code.
Despite comments elsewhere in this thread that "the web moves fast", browser changes typically involve very slow, deliberate, careful rollout plans, even for much smaller compatibility issues than this one.

I'm sure the Firefox team (and Chrome, which is pushing in the same direction) will be keeping a close eye on the progress of Let's Encrypt, and using it to set the timeframe for their proposed changes.

(Not to mention that Mozilla is a major sponsor of Let's Encrypt, so it's reasonable to expect a high degree of coordination.)
Is it exploitation though? If that's a prevailing wage in the area, it's not exploitation. It's just lower than they'd pay elsewhere. (if they are making them work for less or in unreasonable conditions, then yes, it's exploitation, but not because it's cheaper than US labor)
After reading William Gibson: yes.
After trying for a while, I finally 'managed' to do it any time I wanted to, now that I stopped it doesn't happen anymore. I'd second the stretched ligament theory.
$70 for a wildcard cert!? Where are you looking at? There's a shitload of AlphaSSL resellers that are much cheaper. I got 2 wildcard certs for $20/yr. Of course, there's really no need for a wildcard certificate, and StartCom gives out free, valid non-wildcard certs right now. On top of that, Lets Encrypt should simplify the process greatly.
Thanks, but I know that. It's just that I want to write a comment, post it, and move on.

I don't want to go back, leave the tab open, and have to remember to try again in 10 minutes, 20 minutes, 30 minutes, and so on.

Today, I actually did the dishes and the laundry, and still could not post the long post I was referring to, so I just closed the tab (gave up). At that point, you either close the tab, or you put it on your todo list, and I am not going to clutter up my todo list with stuff like that.
Kendall Jenner versus a graffiti drone: the age of airborne vandalism begins
Wonderful quote from article:

"And because the NSA didn't do that and other law enforcement agencies didn't do that, you're seeing a vast public reaction to this. Because the NSA, your colleagues, have essentially violated the Fourth Amendment rights of every American citizen for years by seizing all of our phone records, by collecting our Internet traffic, that is now spilling over to other aspects of law enforcement. And if you want to get this fixed, I suggest you write to NSA: the FBI should tell the NSA, stop violating our rights. And then maybe you might have much more of the public on the side of supporting what law enforcement is asking for."
Oh cool, so with increasingly stringent SSL requirements, we're basically entirely phasing out the ability to run a website without a certificate authority's involvement.

So instead of all this bullshit from Chrome, Firefox, et al., can I please just send some huge check to GoDaddy or Verisign or whomever and continue to use the internet as an open platform and not some managed service where we try to hold everyone's hand because we've conditioned them to spew their personal information all over the web all day?
You can also get a certificate with as many as 100 domains in the SAN for free from https://buy.wosign.com/free/FreeSSL.html
LetsEncrypt works with IPv4. I assume it will work with IPv6. LetsEncrypt is a Mozilla project, it's safe to assume they will launch LetsEncrypt before deprecating non-secure websites.
Does anyone have a good sense for how hard it would be to operate a service like this in a vaguely legal way?

I understand that Grooveshark's own employees were instructed to download music and upload it to Grooveshark. If this had not been the case, or if they could not prove that this was the case, would their service be technically legal (safe harbor laws,etc)?
I'd be curious to hear how either "Ulysses" or "Finnegan's Wake" compare to Samuel Delany's "Dhalgren". I've yet to read anything by Joyce, but thanks to the University of Adelaide[1] and European (and Australian) copyright terms, I now have both in epub-format, and in my reading queue.

[1] https://ebooks.adelaide.edu.au/j/joyce/james/
> are there things we can do right now in terms of favoring self-authentication of self-signed certs?

That's a good question, but I've yet to see any justification for thinking the answer is "yes".

If an attacker controls your network connection and/or DNS, what possible information could you obtain to prove the authenticity of a website, without reference to an external source of authority?
I'd say the thesis of the article is that homeschooling will become more popular and have a large impact on the development of instructional methods in public schools in the future. The first may be true, the second is not.

The main factors militating against homeschooling are conformity, money and logistics. As homeschooling becomes ever more mainstream the weirdness hit people take for it will lessen. Money and logistics are the big things. For homeschooling, even unschooling, you need at least one responsible adult nearby and available, usually a SAHM. That means homeschooling is restricted to the upper middle class, people in rural areas with cheap housing or people who are really, really willing to sacrifice for it. If everyone around you is on two incomes and you're on one that better be an excellent income or you will need to sacrifice a lot.

Homeschooling will have no effect on school instruction, none. The things mentioned in the article could almost all have been written any time since the 60's. The only exception is MOOCs, which are mostly equivalent to community college for high school students.

Alfie Kohn and John Taylor Gatto have been beating the drum on how awful the overwhelming majority of schools are for decades to no effect. The Sudbury/Summer hill/democratic schools movement grew and then receded in the middle of last century.

And what's the latest big thing in education? Ability tracking instead of age tracking, the smallest, least disruptive, obviously good change to the current system? No, it's No Child Left Behind.

Just give up hope already. There will be no reform.
No. I can't draw, but if someone asked me to draw a picture of a "thug", it would probably end up being some sort of film noir 1930s small-time hold-up guy.