If anyone is wondering what the actual change was:
It looks like the npm registry used to have a certificate signed by npm's own CA, and existing npm clients only trust that CA by default, not the normal list of verisign, digicert, etc. (Trusting versign et al would defeat the point of using their own CA.) The signing key for that CA is pretty darn important, and maybe there are entities other than npm, inc who might know it (i.e. nodejitsu).
So npm, inc rolled out a new cert that looks to be signed by digicert, but existing clients don't trust Digicert until you explicitly configure them to.
I was thrown off by the SELF_SIGNED_CERT_IN_CHAIN error; I expected some error about an untrusted root CA if the problem was that npm clients didn't trust digicert, but apparently SELF_SIGNED_CERT_IN_CHAIN is what OpenSSL returns when the root CA isn't loaded.
Core dev here -- I've been doing some work here and there on framework security and I'd love to talk about the security problems you're running into, if you wouldn't mind shooting me an email sometime.
So why should the deaths of those in Boston be more prolific to me than those that died in Texas?
I don't think prolific is the word you mean, but I'll assume you meant "meaningful" or "emotional." No one is telling you how much you should care about Boston versus Texas. The point is that for those of us who are personally affected by the Boston incident, we resent being told that we should care more about the Texas incident, because it is natural that we would be more upset about the incident that personally affected us.
You can't change the words he used to misrepresent his argument because you didn't appreciate his bluntness.
The change of wording wasn't relevant to my point, I was simply trying to summarize his view. Insert "let's make an effort not to get... as an excuse for tyranny" (his actual quote) for the paraphrased quote that I used, and the point still stands: the government's supposed tendency towards tyranny should cause us to resist tyranny, not to temper our emotional reactions to the deaths of community members.
This main point is ridiculous. Our response to deaths should scale exactly proportionately to the number? I shouldn't let the death of a friend upset me disproportionately more than the death of a stranger?
A reasonable statement would have been, "Let's not let these deaths be cited as an excuse for tyranny." But what he said was more along the lines of, "Let's not be very upset about these deaths, because then they will be used as an excuse for tyranny." Why should we let the government's supposed tendency towards tyranny influence our emotional reactions to the deaths of friends and colleagues? Instead, let's react however is natural to these deaths, and at the same time ensure that we don't stand for fear-mongering and security theater.
I think you're misinterpreting my comment. I found it odd that we were advised to stay indoors all day and then told that we no longer needed to stay indoors at the exact point at which danger seemed to be more likely. My comment wasn't saying anything about my opinion as to whether or not the stay-indoors request was reasonable.
But I think it's also worth noting that the stay-indoors request was a request, as far as I know. Every notification that I received was something along the lines of people being asked to stay indoors with the doors locked, and I know people who chose to go outdoors before the request was lifted. The city shut down because people chose to honor the request out of confidence in the judgement and good intentions of the police. I personally chose to stay indoors because I thought the suspect was probably wandering around on foot in the Watertown/Cambridge area and I thought the inconvenience of staying inside for a day outweighed the risk of running into him.
I really don't see what this has to do with the Boston bombing or people's reactions to the events of today. I took a different argument to the Holocaust extreme in another comment and it applies just as well here: why should we be "bent out of shape" today about plant safety when genocide kills millions times more people?
I thought it was really odd that they told people they could go about their business after completing the Watertown search without finding him. It seemed to me at that point the probability of us being injured had just gone up. However, lifting the stay-indoors request turned out to be crucial, because a man spotted the blood on the boat only after going outside for the first time all day.
On the other hand, if they had simply expanded the search area block by block without lifting the stay-indoors request, then they probably would have found him quickly with less risk to Watertown residents. In any case, I agree that it's important for the governments involved to evaluate what could have been done better.
Not to mention inconsistent with his own reactions. I don't think rms spent all day today mourning the Holocaust or the fallen soldiers of the Civil War.
Maybe. Also based on a photo of the crime scene that was sent out, it looks the officer was shot right outside Stata, so the robber could have been running through campus.
"There was a shooting at 32 Vassar St... No suspect description... No direction of flight..." MIT officer was shot and weapon stolen, I think they said the weapon was recovered. Officer is at MGH. Witness in lobby of Stata saw man in cowboy hat.
(All that on the police scanner in the last minute or so)
The first is only slightly related to this article; it uses implicit learning to train users to authenticate with secrets that they cannot recall consciously (and therefore can't be coerced into revealing).
The second is about recovering secret information from brain-computer interfaces, and though this seems very relevant to the proposal of authenticating via "passthoughts", neither of these papers seem to cite each other.
Yes, I would hope that the author wouldn't include "sausage party" in a letter to her real niece. :) So let me rephrase: I don't see the point in making broad statements about the presence of discrimination in our field, because these statements will drive away people who might have had perfectly satisfying careers in tech completely unhampered by discrimination. In my experience, constantly being made aware of the gender imbalance has been much more damaging than any actual gender discrimination. (Though of course I'm sure many other members of underrepresented groups have not been as lucky.)
Well said. If I had read something like this when I was eight years old, I probably would have almost immediately backtracked and started looking for something else to do with my life. The author could instead tell her niece that being a game developer sounds like fun, and then help her deal with any discrimination as it comes up, if it comes up at all. But to start off a person's career with the message that she is going to be discriminated against, that she is going to be at a disadvantage, that she should watch out for all those people trying to drag her down... that's just sabotage.
Some research browser architectures like Atlantis (http://research.microsoft.com/pubs/154698/Atlantis-SOSP.pdf) go the opposite extreme, where cookies are never sent unless their domain matches the initiating origin. In the case of Atlantis, the reason they have to go this route is somewhat messy: their microkernel architecture exposes a network interface to webpages, and the network interface has no way to differentiate between a request initiated by XHR or by an img/script/etc., so the network interface cannot send cookies with any cross-origin requests, or else it risks exposing private data via XHR.
I wonder if it would be useful to see something more flexible than the current standard, sameDomain, or disallowing all cross-origin cookies. When you set a cookie, maybe it would be nice to be able to specify which origins are authorized to send requests with that cookie.
It's a good question, discussed a bit in the PETS paper: https://crypto.stanford.edu/flashproxy/flashproxy.pdf (section 6). The short answer is that communicating a small amount of information outside of the censored region to a blocked facilitator is an easier problem than full connectivity.
It looks like the npm registry used to have a certificate signed by npm's own CA, and existing npm clients only trust that CA by default, not the normal list of verisign, digicert, etc. (Trusting versign et al would defeat the point of using their own CA.) The signing key for that CA is pretty darn important, and maybe there are entities other than npm, inc who might know it (i.e. nodejitsu).
So npm, inc rolled out a new cert that looks to be signed by digicert, but existing clients don't trust Digicert until you explicitly configure them to.
I was thrown off by the SELF_SIGNED_CERT_IN_CHAIN error; I expected some error about an untrusted root CA if the problem was that npm clients didn't trust digicert, but apparently SELF_SIGNED_CERT_IN_CHAIN is what OpenSSL returns when the root CA isn't loaded.