skysight-inc/HackerNews huggingface dataset:
Can someone explain why HTTPS is necessary for a webpage where I don't log in or submit any information?

For example, take the xkcd homepage. Not only do I not log into it, there's nowhere I _could_ log in. The only input is a search box (which seems to be disabled at the moment anyway). Is it really a security risk if my communication with xkcd's servers is unencrypted? (Yes, xkcd has a store and a forum, and I understand why you'd need HTTPS on those subdomains - but I don't see why the main domain needs it.)

I agree with the parts of their plan to disable browser features that could be a security risk to non-HTTPS pages - that makes total sense. But it seems absurd to prevent static pages from using future CSS layout features just because they're not using HTTPS.
Simple example: Say you're working with an external library. And say you need to work with this function:

def convert_to_int(val):
....

What type should val be? Do you pass the object, or a string representation of the object, or...?

The problem with Python - and non-statically-typed languages in general - is that function signatures don't need to be defined upfront, which leaves it up to the programmer to figure out the inner workings of the functions. This is a huge pain point when working with other people's code.

Python 3 introduced function annotations, which is great. But again, the problem here is that function annotations are opt-in. It's still up to the developer to add the annotations.
I've been writing most of my utility code in F# for the past few months, is there anything that you guys DON'T like about it? I'm really enjoying how terse it is in comparison to C# and haven't really run into anything that's bothered me, besides Xamarin Studio being bloated.
At first, I was apprehensive. As a newer web developer I have never had a secure site. I have a small portfolio and a few tiny side projects I work on, nothing with >10 users. I will have to learn more, do more, and pay more to support HTTPS.

When I look at it from a different lens, I believe the internet should be as private as possible. Encryption is a solution. I think we should all make a push to make things more secure. Hopefully, we can destroy the cottage industry around SSL certs and it will be bundled in as an expected value add with either hosting or DNS purchase. I think that $1 a month is enough rent for a cert, I saw an SSL cert offered for $600 bucks which is quite problematic if it represented the threshold someone would have to cross to get a cert.

Hopefully, mozilla will work to sort out the CA problem, which is the real thing holding back HTTPS adoption.
In truth, neither do I. But Edge/Spartan follows the developers, and sometimes that involves being interoperable with poorly designed sites that have fallen prey to browser-specific prefixes.

From a business sense, it works because if it works in Chrome and fails in Spartan, it's our fault. From a user experience sense, it also works because they deserve to have their sites work.
From the comments section:

> Not all data needs to be secure. Not all websites need to be secure. Requiring HTTPS means additional compute and additional servers securing something may not need to be secured and provides no benefit – only cost. Free and open information should be (optionally) free of encryption as well.

Indeed, there still a portion of the internet that could benefit from being SSL free.
https://www.google.com/search?q=ssl+wildcard+certificate+che...

I can't find anything lower than $60.
Great! Make it simple to implement for all and make it affordable.
This is absurd. Research into HIV and AIDS has been ongoing for decades and remarkable progress has been made with drugs that slow the progression from HIV to AIDS (I have no idea of side effects or strength of the drugs however).

HIV wears down your immune system which leads to AIDS. Whether other causes could lead to AIDS I don't know, but HIV definitely does.
What's Basecamp's profit margin? Obviously they're private, but a public software company like Facebook is operating north of 80% (and a quick quick of Twitter and Google showed 60%+)

https://ycharts.com/companies/FB/gross_profit_margin
"The Evidence That HIV Causes AIDS" - http://www.niaid.nih.gov/topics/hivaids/understanding/howhiv...

Speaking of PCR, it says: "Recently developed sensitive testing methods, including the polymerase chain reaction (PCR) and improved culture techniques, have enabled researchers to find HIV in patients with AIDS with few exceptions."

Linus Pauling thought that megadoses of vitamin C would reduce the duration and severity of the common cold. He was wrong. A Nobel Prize, even in a related field, does not make someone infallible. (This is also the Mullis who believes in astrology, yes?)

I've read of many a young earth creationalist who says there is no evidence of evolution, and can't find a reference which proves that evolution exists. Every argument for evolution is declaimed as insufficient. The problem is, if you can pin them down on what would count as evidence, they demand ridiculous things, like a cat that gave birth to puppies.

What are his requirements, can they be met by other diseases, and can they be evaluated by people who aren't him?
Intermediaries can (and already do) silently cause the content to be tracked, altered or otherwise modified against both your and the site owner's interests.

How would you feel if they inserted javascript to mine bitcoins?
I envy you, citizens of the free world :) You (mostly) can use HTTPS, avoid government surveillance, and use new shiny Mozilla features (for whatever they are going to be).

It's not the same in e.g. Russia (and I'm sure it's not just Russia). In Russia, the Web is now officially being censored by the state. They have a national register of prohibited resources -- basically, a huge list of URLs. Every ISP must block all access to those URLs, or else.

So if a page (perhaps, a comment page?) on your site enters the register, and it is served over unencrypted HTTP, ISPs can use DPI to block the access to just that specific page -- which sucks, but at least your site is still accessible. If, however, you use HTTPS -- then ISPs have no other choice but to block all traffic to your site entirely. Given that choice, many webmasters (myself included) will have to choose plain HTTP.
I've just got this nagging suspicion that, for a non-English-major type, FW is not going to repay the enormous investment of time it would take to get anything out of it. Therefore, I have never bothered, and almost certainly never will.
I guess so. It's too bad.
This was actually a good call and you would've nailed about over 100% returns (in a few days) if you went long on put options on the big tech-social stocks for this quarter.

Twitter and LinkedIn took a hammering, so individually they would've done well for your portfolio.
People always tout StartCom as a free provider (which is really great) but they forget to mention that it's only free for personal use.

StartCom offers the free (for personal use) Class 1 X.509 SSL certificate "StartSSL Free"

http://en.wikipedia.org/wiki/StartCom
but you have to get a dedicated IP as well, which means you can host less sites on a small server - something bad for smaller biz.
Chrome is proposing the same thing as Firefox (deprecating advanced features over HTTP) and additionally wants to visually mark HTTP connections as insecure: https://www.chromium.org/Home/chromium-security/marking-http...
While we're making art style changes, why don't we change the experience for self-signed certs?

When the user first visits an HTTPS page with a self-signed cert, they get the content, and the URL art style has a broken lock or something warning it's not known to be secure. (It's better than raw HTTP but it's not trusted.) With certificate pinning by the browser, the next time the user visits that page, if it's different, then they get the current experience that warns them in big scary text and requires several clicks to get past. There's a question of if it's different in that the server owner upgraded to a paid SSL cert should it show a warning or not, but if there's a way to sign that upgrade with the old cert that the browser can know about there shouldn't be a problem...
They don't have any remote debugging access they wouldn't have... the JS still runs in your browser, sandboxed to the window with their website in it... it can't do anything else that any JS could do... it may be a psychological difference, but it's not a technical one...

I've considered a number of times about actually shipping dom-diffs so that support could see what a user is seeing. This technology has been around for a while.
The friendliness in the mercurial CLI ceased to be an advantage just a few years after git came out, IMHO. git error messages got better. I had to re-use mercurial after leaving it for git at one workplace, and I was cringing most of the time.

The main problem is that mercurial never got real branches, which is git's wheelhouse, forcing gross things like the "forest" extension (which I believe is now unmaintained). Maybe it's gotten better since then, but this was about 3-4 years ago.

The way I see it, git has all the powertools you'd need, and you don't have to use them most of the time, where as mercurial feels generally stripped down to be "easy", and when you want to do the hard things, it's not so good at it.

One of those examples might be something like grafting a repo into another repo at a arbitrary root, or some of the tricks you can do to edit previous commits (say if you mispelled your username all the way down).

My main point of switching originally was when I believe it mixed up a lot of commits in a merge and lost some changes. I also recall hearing about a patch for predictable ordering in diff output being rejected.

git's really gotten TONS better -- way back, I would say mercurial was easier to use, and git really excels at branch based workflows which at this point I can't live without.

Of course, a worse thing from having to work at a mercurial shop after loving git is having to work at a SVN shop :)
Why is compromise of a cert that can sign ".moo.bar.foo.baz.com" so* much worse than compromise of one that can sign "www.moo.bar.foo.baz.com"?
Similar story here. I had been using hg almost exclusively for the past 5 years, not just for personal side projects but also at work with teams using git, thanks to hg-git. Admittedly hg-git had/has its issues, especially slower push/pull performance compared to both standalone hg and git, and occasional friction with the rest team that was using git exclusively. I tried to grok git during this time and gave up more than once out of frustration.

Eventually, just less than a year ago, I bit the bullet and made the switch to git. What did the trick for me was a list of short aliases I copied from somewhere, tweaked and have been maintaining in my ~/.bash_aliases ever since. Some aliases are just shortcuts for super common commands (such as "alias gts='git status'") but others remove the burden of remembering what combination of commands and arguments make sense to me ("do i undo a change with revert, reset, checkout or something else? well it depends.."). I still can't claim I know git in depth but it's good enough for day to day usage.
Wow, was listening to some Sturgill Simpson, went out and came back to a "server is having issues" page. Refreshed it later and this happens!
Yeah, that's why there are so many Christians right now.
Startup Investing: The New Trend in Alternative Assets
Thank god we have technology to serve multiple SSL sites on the same IP!

And yes, while SNI isn't supported on older platforms (namely XP and Android 2.x), those platforms are out of support anyway. Part of this push is for security - people on those platforms won't be any worse off anyway (except for getting warning messages).
Unfortunately not: http://www.dominik-schwarz.net/potpourri/worldmap/#fn4
> Even if I used HTTPS, someone spying on my traffic would
> know what I'm reading, if the IP address is a dedicated
> server for that web site only

How would they know the IP is a dedicated server for that website only, rather than simply a default?
Parsing Stuff in Haskell
staging is wonderful. I'm sure hg must have something similar.

I can't tell you how many times I've shot myself in the foot accidentally committing stuff to svn when I just meant a single file.
To the point where it's almost easiest to say SVN doesn't have branches or tags - it just has directories and conventions.
> How would you feel if they inserted javascript to mine bitcoins?

I couldn't care less. JavaScript to DDoS GitHub, on the other hand...
HTTPS provides authentication, not just confidentiality.

When you visit "blogs, news websites, etc" do you think there's no value in being able to know for sure that the content is exactly what the owner of the site intended? Even though ISPs have proven themselves willing to intercept and modify that content in transit?

http://arstechnica.com/tech-policy/2013/04/07/how-a-banner-a...

http://arstechnica.com/tech-policy/2014/09/08/why-comcasts-j...
Well just look at how quickly we fill up phones with lowest-tiered storage (although this is artificially contained). There is also a technical hurdle of building apps in a way that they can be "lazy loaded" — my phone's 4G is the fastest internet I have access to (in Melbourne, Aus) so it's not inconceivable that the "core" 10MB of Facebook.app would be ready in seconds, with the "full" 77MB installation ready in under a minute.

Personally, my phone is full of photos. Cloud syncing allows for recent photos to be on-device and instant, while there's more than could ever fit on my phone stored just seconds away. Once Photos.app and Facebook.app are on-device, I could sign in with my cloud credentials and they automatically log me in and all my content is "just there" (this is true today). When we can log into any device, display "my" home screen with not-locally-installed YikYak.app (46MB) and run it on-demand we'll see true portability of profiles and portability of devices will begin to take a back seat.
You'd have to declare both of them in the current module. That's why I don't do glob imports.

I would see

use foo::signon;
use bar::signOn;

clearly, if I have to import this in my own file I should be VERY careful about those two functions

or rather, I'd import from foo, but I'd use the namespaced version from bar

so `signon` would be `foo::signon`, but `bar::signOn` would be written out fully to avoid this kind of clash
Amazon does this today, browsing is http.
I wished this worked better in mobile, looks pretty slick!
Former teachers who homeschool their kids are like canaries in the coal mine.

As for socialization: The best line I have heard is, "When we worry about our kids missing out on socialization, we grab them, drag them into the bathroom, and beat them up for their lunch money." That is: Yeah, kids in public school wind up having shared experiences with other such kids. The problem is that so many of those shared experiences are bad.
While this somewhat underscores some complexity in git, here's something I wrote trying to explain to others why and how to avoid those merge commits:

http://michaeldehaan.net/post/116465000577/understanding-whe...
Or one of your browser tabs containing an HTTP-delivered page (any one, really) could arbitrarily be rewritten by the MITM to look the same at first, but carry some injected Javascript such that, a few minutes after it detects you've unfocused the page, it turns itself into a Gmail phishing site[1].

[1] http://www.azarask.in/blog/post/a-new-type-of-phishing-attac...

All that that attack requires, to be successful, is the ability for pages served over HTTP to run Javascript and submit forms.
I run an education startup that has unexpectedly attracted a lot of homeschooled students/parents.

The author asserts, "this is the community where experimentation ... to educational approaches is happening the fastest", and I am finding that to be true. The parents are more open-minded and the students are more self-driven.

In fact, it feels likely to me that any dramatic change to the education system as a whole will start with the homeschool community, if it ever comes at all. So, my advice to other education entrepreneurs is that this is a good market to start with.

The author's big conclusion - an impending unbundling of education - is really interesting to me. It aligns with my own prediction (and the basis for my startup), which is that students/parents will have a stronger say in who the right teacher is for them, for any given subject. And, with tools enabled by tech/internet, the best teachers will be able to scale up what they do and reach many thousands of students.
I don't agree with your characterization of Kickstarter. They've always been quite clear that there is a legal contract between backers and businesses that obligates the business to provide the goods and services they promised. [1]

The company in question broke the terms of their contract. As such, backers are legally entitled to their money back. If the company cannot pay, the company is insolvent and may need to declare bankruptcy. That's life as a business; you need to pay your debts.

[1] As mentioned in the article, that contract changed recently. Businesses can now be absolved from their obligations by being transparent. Basically, backers for new projects are entitled to know what happened if the project fails. https://www.kickstarter.com/terms-of-use#section4
Offers like [1] are all over the web. I think i saw one for $7/yr once, but that disappeared.

[1] http://lowendtalk.com/discussion/39165/vmbox-co-openvz-ssd-c...
Ray Kurzweil is going to live forever because he takes a hundred pills a day, so i don't know why you'd recommend silly things like enjoying a drink and a smoke.
Uau that was a big surprise! I have been using this service for such a long time. Now, what would be the best alternatives available ?
> My favorite was a visiting professor from MGU (Moscow State University) teaching 5th graders how to translate Babylonian Cuneiform, including how to infer meaning of writing that no spoken reference exists for. Not really useful right now, but is the very definition of cool when you are a kid!

I've seen programming situations where something close to that would be useful (maintenance of very old code).
Hi Malcolm,

Good point, I was looking through a bunch of slide deck templates and they had the product description / game overview after the market sections hence the reason I've laid it out that way. To be honest, I prefer it the way you describe as well, I'll switch them over.

Regarding finances, I had a cash flow forecast for the next 3 years but it was based on modest financing and organic growth. I'm working on a scaled up version - to the investors I sent a business plan with the old forecasts with a small addendum of what the scaled up model looked like.
Without a solution to everyone needing to pay for a certificate and identify themselves this seems a bit premature. Maybe browsers will relax the "This is an evil self signed certificate on the site" warning when they do it.
It must be, it's no different than youtube in that regard. This is a sad, sad day. I can't believe it.
Right, and for anything that is commercial, a <$10/yr SSL certificate shouldn't be a huge deal. It's not perfect, it should all be free, but saying cost is a barrier is BS, in my opinion.
Every time I try HG, I find that to do what I want I have to get a bunch of plugins. When I use a VCS, I want to know that I'm using the same commands as everyone else, so that we are all speaking the same language.

Most of the git commands I use are about as straight forward and simple as they could be. If ever I manage to screw something up, the archeology commands I end up using are obtuse, but it's rare that I need them. And I'm glad they are there when I do.
What was your last 'Oh shit!' moment with your tool/package/platform/axe?
Good or bad.

I just dropped the ball, well, a ball. But my manager is like a boss, supporting me and shit. Yay, saturdays again.
This is the problem with ideas like loft. A lot of people think it is a good idea. They give feedback about what they would like to see in a service like this and consider pretty 'neat' at best. Then it pops off the front page and they never consider it again. Making reservations is easy. People will probably not "love" this service, because it isn't even close to essential. ITT a lot of people provide feedback about a product they will never use giving the founders a false sense of feature and product demand.
Not a bad idea, in theory, but... suppose I visit a site on Monday and see certificate A. Then when I return on Tuesday, I see a different certificate B. What reason is there to think that A is likely to be the "true" certificate, and B isn't?

Showing a big scary warning in one case, and not in the user, implies to the user that the browser has some reason to think one is more secure, which is misleading.
I'm reminded of this line from Agents of Shield:

Maria Hill: What does S.H.I.E.L.D. stand for, Agent Ward?

Grant Ward: Strategic Homeland Intervention, Enforcement and Logistics Division.

Maria Hill: And what does that mean to you?

Grant Ward: It means someone really wanted our initials to spell out "shield."
Inside Founder Field Day: Like a Scene Lifted from HBO’s ‘Silicon Valley‘
You certainly work(ed) closer than I do, my experiences are mostly based off of what I see around me. I assume the kernel has changed quite a bit since Vista. I imagine that the POSIX system hasn't been entirely killed off quite yet, given it's already come back twice.
> then ISPs have no other choice but to block all traffic
> to your site entirely. Given that choice, many
> webmasters (myself included) will have to choose plain
> HTTP

At some point, blocking CDNs at IP level becomes too much of an economic burden on a country to be feasible. We've seen an unwillingness by the Chinese to block access to GitHub; presumably this means Fastly (their CDN provider) is safe for a while.
Show HN: WISP – a simple SaaS service to create mobile employee handbooks
IBM creates quantum super-conductor in square formation
No, when this first happened, I was confused and contacted the individual by IM. They hadn't tried to contact my through LinkedIn or any other method, nor even logged into LinkedIn in quite a while. I just checked, and now there exists an account for the other email address, with no contacts. It's possible a bug created a bunch of accounts based on some alternate email settings they had, but I can't imagine them keeping around a bunch of bogus accounts unless it served some useful purpose, such as increasing the user count to show growth...
Damn would I like to live somewhere that has 1284 Python jobs listed, over here in the UK .Net (outside the web) dominates, love me some C# but Python just isn't on the radar at all (yet it's widely used internally).
Fellow Hamden High grad?
EFF has it right. Is this bill perfect? No, but we need to support movement in the right direction.
Projectors aren't limited to displaying static images, but I guess the format is a matter of taste.
Darpa dreams: cortical modems and neural RAMplants for restoring active memory
Paul has been a huge inspiration for me. For a time, I would read printed copies of his papers during the ride home. He was also kind enough to make time for me when I emailed him with a question about his computer music code.

I believe I am better off because of Paul and I am sure many more feel the same way.
LinkedIn cuts revenue forecasts for second quarter