skysight-inc/HackerNews huggingface dataset:
How to spend my summer improving my programming skills?
Hi there,

I am a belgian computer science student and will finish my bachelor next year. I would love to spend my summer in California to expand my knowledge of computer science and to experience the atmosphere of Silicon Valley.

The biggest project I co-created untill now is an Android app equivalent to Blackboard Mobile. We worked on that with six people, as a task for the university. So I'm not a very experienced programmer yet. But because I follow all the tech news everyday, my knowledge of the market is up to date.

Most of the university summer courses seem to be for high school kids, but after two years of study I think that won't be challenging enough. There is one course at Stanford ('Client-Side internet technologies') that seems perfect for me, but it already starts in June, when I still have exams in Belgium. I will be able to stay in California from mid July untill mid August. I would also be glad to take some language courses, in preparation for my GRE. Do you guys know of any courses that might suit me?

As mentioned before, I'm not very experienced yet. But if you know of a stage at a company or a research project that might suit me, that would be very interesting as well.

Thanks a lot!

Lucas
As other have stated, this is actually "correct" typographic practice. I have absolutely no clue why this is the case; to me it looks absolutely atrocious.

Why not indent instead?
That is exactly what I don't want. :-)

I want the same random key sent to multiple recipients. That way they can all verify that they are seeing the same thing.

Edit: Just to clarify, without using the same random key for all recipients, the reports are not verifiably the same until everyone shows their random keys. If you use the same random key for all recipients, you don't have this problem.
Those are three mega-corporations, and not small businesses though. Most places I've worked with outsource the software, web server administration, and SSL administration all to a single client, and don't necessarily pay for a security team to maintain GPG keys, but just for maintenance and ongoing development.

Allowing the web team to securely receive a vulnerability report using infrastructure they've already built opens up a secure reporting process to thousands of smaller businesses.
Here you go: http://i.imgur.com/ZCzU3.png :)
The top tech companies (Google, Facebook, MS, etc.) see internships as the best way to recruit the top talent as they graduate from college. For this reason they will often pay engineering interns anywhere from $5000-$7000 a month.

Internships are also a much better way to screen a potential full-time employee. The company gets 3 months to interview the candidate in a real work environment, instead of a few hours in front of a white board.
Considering I've got a crappy, bottom of the range laptop at home and the latency of all actions is much, much lower (on ubuntu), I'm sticking to "7's fault" rather than buying more equipment. The other laptop has a 7200 rpm disk with 16GB ram to use for (pre)caching and I'm complaining about latency of basic action like work with Outlook or using explorer to look through folders - how hard can it be to display emails/files?

Thanks for the info about the firewall - I can't find anything advanced however. Have you got some links / screens? I can see only the same old on / off / per-application thing.
Do you call Google for help on Google Analytics?
Absolutely, and the script almost has a sort of story arc as they await the arrival of Jane Fonda. It feels play-like.
Doesn't seem to be a problem and Niagara (2.5GW) or Snoqualmie (54MW). Both are still popular with tourists (obviously, Snoqualmie is not on Niagara's scale in either power or tourism, but I include it because I imagine there are a lot of Snoqualmie-sized waterfalls yet untapped, and probably no Niagara-sized).
For countries that require work experience to certify as a professional engineer this is a good deal.

You graduate as a profesional engineer (or provisional grade) whereas a straight 3year degree you have to find some sort of intro level job in the field that you can count as experience - these sort of jobs have you over a barrel.
Bah! I was hoping to download the source (from here: http://info.ee.surrey.ac.uk/Personal/Z.Kalal/tld.html) and check out his algorithm, but he requires you to email him with his project. If anyone knows how the algorithm works, or where it is described in detail, I'd love to read that!

Absolutely amazing stuff!
> They already do this. After a vulnerability is patched and fixed they release what it did.

Usually researchers' submissions are way more detailed than the advisories you see from vendors. Meaning that you cannot just decrypt the content of what the research submitted. It's true that oftentimes you can find the bug by reading the advisory and using tools to diff the patch but it's a long shot compared to just publishing the original researcher's submission imo.

>Uh, not sure what the "middle-man" is, but if you mean vulnarb.com then no, the point is that it's industry standard asymmetric crypto so I wouldn't know anything. In fact, I'd have incentive to not know anything so that I'm not getting sued.

yep I meant vulnarb.com. I'm not saying that you have anything decrypted and ready to use, I'm saying that it's pointless to have another recipient for sensible data. Cause in the extreme scenario where the private key is stolen than it's just more attack surface to get to the submissions.
If we assume that no leak of this sort happens, still what's the reason for a third party to have this sort of data compared to say sha-1 hash of the Poc?

Actually my point about the karma system is that you can achieve the same goal you have in mind without needing any sort of data from the researcher other than "product X is vulnerable" and then the karma points will determine whether the researcher is reliable or not.
Ubuntu 10.10, Windows XP on VirtualBox when needed
No need to get outside funding for any of this. It can all be done on the cheap.

I agree though, how can it take months to reset up a server? Late last year I had both of our supposedly redundant webservers fail at the same time - never happens, right? ;) We were able to get two entirely separate boxes setup with the same static addresses in under an hour due to maintaining all possible configuration in svn.

Worse, this was on windows servers where we couldn't use something like puppet or one of the other 20 solutions to script your configuration.
The only complaint I've ever had with Unity is that the dock consumes the super key for shortcuts. The only reason I've been unable to stick with Unity is that I can't assign gnome-do to the super-based hotkey I'm used to. I could learn to use the Unity Launcher, but it never seemed to be anywhere near as easy to use as gnome-do.
Technical details here, with links to relevant papers at the bottom.
http://info.ee.surrey.ac.uk/Personal/Z.Kalal/tld.html
I'm curious about your use of the iPad for pair programming. Have you written that up anywhere?
If you want to compare security track records, you have any of several huge vulnerability databases to consult; Secunia is the one that seems to have done the best job of SEO.

But there are two huge problems with this approach.

First, nobody cares. Nobody really evaluates products based on "security track records". If I did a "Month of Cisco Bugs", do you think any company in the world with more than 500 employees would switch to Juniper or Astaro? No, they would not.

Second, vulnerability track records don't directly measure product security, or even product security team responsiveness. They measure researcher interest and researcher effectiveness. Microsoft, Adobe, and Apple are deluged with reports, because researchers are incented to target them. It also tends to take (say) Microsoft longer to fix things than J-Random-Vendor; QA is harder, releases are more expensive, and more security issues are on the plate to begin with.
With something like this we could have truly “Minority Report” style human-computer interface.

Actually, the guy who invented the Minority Report interface commercialized it and has been selling it for years. Product website: http://oblong.com Edit better video: http://www.ted.com/talks/john_underkoffler_drive_3d_data_wit...
Well, I figure you first have to know what the "do" keyword does, what problem it fixes, before you'll be inclined to actually use it, so people diving in without a lack of knowledge shouldn't really be an issue.
Yep, you know way more about this than I do. I've wanted to solve this problem for a while so any feedback helps.

The only thing you seem to be missing in the above is the consumers. It's not about getting the vulnerabilities transmitted to them, it's about posting that they exist, who did them, how severe they are, and in a way that can be verified by all three parties.

AFAIK, I can't currently go do that with ZDI right? They're sort of paid to keep this secret.

As for gathering existing SHA1 hashes, I'll look into that. Could be a way to seed the database ahead of time.

And no, I'm not a cleverness junkie. I mean, it's a shell script that's like 8 lines long. I just saw a problem in getting a vendor's "public key" and then realized I could do it this way.
>You've gotta keep in mind though that's not a finished product yet.

If it's in the beta you'd think it probably should be a finished product.

Nonetheless, I think it's good that Ubuntu is pushing this if it'll result in a more competitive desktop offering (and diehards can simply change to GNOME).
With all due respect, consider that I am a tech guy with business sense, trying to get seed level funding solo in the Midwest.

LinkedIn represents all the bullshit I wish I could skip in the startup scene. LinkedIn is all the corporate politics and multi-tiered organizational madness I am trying to escape from by launching a startup.

So on the one hand, I feel like I am the prime demographic you should be trying to attract and recruit, but that LinkedIn requirement, combined with the "you don't need a tech guy" stance; it smells like a bullshit factory.
Colin, is the problem more a decrease in the quality of the stories on the frontpage, or a decrease in the quality of the comment threads?
Ask HN: Good digital watches for hackers?
I've always been a big fan of digital watches. Mine is getting old, and I'm considering an upgrade. Does anybody have a "really cool/useful" watch that they would recommend (ideally, that can be ordered online)?

Sorry if it's a little off topic!
Now, I use a browser that's done whole-page zoom since ever, so I'm probably biased, but I actually really like it. I just want things to be larger. Whole-page zoom does that without breaking layouts.

/currently reading HN on 150% zoom on a 105 dpi screen, single key shortcut to set the 150%
We are seeing the downside of the "get version 1.0 out in front of users as quickly as possible" mentality.

Fine, get the first version in front of users sooner rather than later. But if you are not in a position to recover from an intrusion, disk failure, fire in the server room, etc. you are not ready to have users. You really need to address all those concerns before the first line of code is written, as without it all your investment in development is at risk.
IBM's Tiny Technology Rips Up Drug-Resistant Germ Cells
Why wouldn't they just put the old code base and fix the security hole? Why go to a new code base? Now you have two problems!
Vendors who don't provide some secure channel to send findings to are already subject to vigilante-style disincentives: if you don't provide a key, researchers will drop zero day on you publicly. Remember, public drops used to be the primary way things got disclosed.

You appear to think we need to worry about vendors gaming the system. But on the researcher side, the standard definition of "responsible disclosure" is, "I wait 60 days after I send you something and then I go public whether you say OK or not". That isn't just my take on the situation; it's what actually happens.
You're absolutely right - we also need to explain why apps stick around for 24 hours, how to keep them permanently, etc.

Once the ruckus dies down here later today, we'll circle around to that.
You might be interested in Google's Summer of Code.

Also check http://news.ycombinator.com/jobs, and http://news.ycombinator.com/item?id=2396027.
Your own version of the Barbara Streisand song
I guess the best way to view CoffeeScript is to treat it as a form of shorthand for JavaScript. A more convenient syntax, but you still need to understand the underlying JavaScript for the purposes of troubleshooting and performance optimising.
So you recreated a Facebook Group outside of Facebook?
> All the CO2 currently sequestered in fossil fuels used to be part of our atmosphere.

That's an interesting assertion. I'm not a biologist, but I suspect quite a lot of the carbon in hydrocarbons was locked into other carbon compounds before being taken up by plants and animals.

Consider: the carbonaceous compounds in the shells of mollusks do not come from C02 but from other disolved carbon compounds in the water.

You could just as easily argue that all the carbon in limestone used to be in the atmosphere.
Noisy market hypothesis
Free Bingo
> Actually my point about the karma system is that you can achieve the same goal you have in mind without needing any sort of data from the researcher other than "product X is vulnerable" and then the karma points will determine whether the researcher is reliable or not.

No, that doesn't actually solve this problem because then it just turns into a he-said-she-said.

Also, you seem to leave out that the company can decide to decrypt it or not. Hell, they might come to an agreement with the researcher to just have the researcher assert it's fixed and never decrypt it. Although, I think that it should be fully exposed so people can see how it's really done and there's incentive to really fix it, not half-ass fix it.
Introducing PrimaryWall – Simply fast sticky notes
This is a lot to read, so you might get more advice if you find a way to shorten it a lot.

I think the best way to improve your programming skills over the summer is to program a LOT; just work on open source projects that you find interesting, and maybe start a few of your own. Learn some new technology you've been curious about (languages, operating systems, version control systems, and so on).

The advantages of being in Silicon Valley are going to be marginal, compared to the advantages of getting more practice/experience and learning more. Maybe someday it'll be worth heading out there, but I'd guess it wouldn't be worth it right now. (But don't let this advice stop you if that's your dream, or something.)
Of course, the problem is that LTS releases are horribly outdated (the packages in the repos), that it becomes hard to be productive. I needed a new version of a library (actually not THAT new) to compile something, and it just wasn't there! LTS for the lose.
I wouldn't ignore it. There is the real possibility that there is too much capital being pumped into early-stage companies, and when they fail, there will be too little available to all. The best way to insulate your business from bubble economics is to find a profitable business model that is not reliant on the exuberance of others, and not easily replicated by someone else.

Someone likened Google's other businesses as the moat around their search castle in another thread. I would recommend that everyone think about how to build their own castle that repels competitors as well as the effects of economic externalities that are outside your control.
Lets value a company if.,

Best: A company is making revenue

Better: A company made revenue

Good: A company may make revenue if we do this x,y,z..

Bad: This company looks catchy & I think thats cool.

Worst: Ahh.. This founder!!! He is a big deal.. His 4th startup? (If they see WHO alone and not WHAT) then.. Thats gonna help to burst a Bubble (Just for that deal alone).

The problem is.. When media yells Bubble , Bubble.. The share holders gets in to hype & mass hysteria.

Aol made very awful deals in past. MySpace is moving to dead pool. That color & Quora is 100% of HYPE.

Tell me., Will you go and sell your MS, Google, FB, Groupon, Amazon, Paypal stocks if any one of above company fails? Then you deserve a loss.

Investors must be logical & analytic. If you think X failed, Y also looks like #failing .. Then you are just stupid.
Sometimes Tests Have to Fail
I should have been clearer. Researchers post SHA-1 hashes publicly (if they care). They send the actual details directly to the vendor. The vendors you care about publish PGP keys. The ones who don't can't really be trusted to handle security advisories anyways. No, really: they really do put them in their public bug databases!

What made the vulnarb.com idea interesting is that by combining the two actions: a safe public notice and a secure vendor communiation --- you could create a public clearinghouse that consumers can consult to see if (say) Google is holding back on disclosures.

The issue here is, you don't need an elaborate crypto scheme to do this. Tavis Ormandy doesn't have to post an encrypted bundle anywhere to notify the public that he has a new Microsoft bug. He can just say "I have a new Microsoft bug" on Twitter. Reputation is so compelling that really, nobody bothers even posting SHA-1 hashes anymore. If you work for a credible vuln research shop and you post a message saying you have a finding in Adobe Reader, you have it. Case closed.

Zed could build the aggregator for these reports if he wanted to. It would be valuable. But that's just data entry. Zed programs. I don't blame him. I program too. I wouldn't want to build that site either.
SEEKING WORK - REMOTE WORK ONLY

Boca Raton, FL

Mainly Ruby on Rails.

I've done work with HAML/HTML/ERB, CSS, some jQuery, and a multitude of gems to build fully functional websites and web apps.

Available immediately and able to communicate through IM, Skype, Phone and email.

My Github: https://github.com/gduplessy

My Resume: http://gduplessy.com/about.html

My Blog: http://gduplessy.com/about.html
Zed Shaw is a very clever man. However, I've read the site time and time again and I'm not sure what problem this is supposed to solve.

There are already services that pay you to disclose your vulnerabilities to them and project manage the whole thing with the vendor for you, such as Tipping Point, The Zero Day Initiative and iDefense.

The whole SSL thing is a clever little hack, but is more of a solution in search of a problem. For a security researcher, secure comms with a vendor is hardly a problem that hasn't already been solved (and if the vendor wants to communicate over unencrypted SMTP and they're aware of the risks that come with it, then it's their own fault if somehow the comms are compromised).

I'm sure it'll be another very smart and funky thing from Zed, but I don't see why people would use it over something that pays them for bugs.
It depends a lot on the politics of the country you live.

In my case (italy) hardly anyone will pay you a cent for your interniship even if you are an engineering, CS or math student.

Often companies (expecially if they are little) here see internship like a way to have free manpower.
Gimp Screen capture and print.
http://www.secunia.com/ does this already. There's heaps of other sites too that do this.
Sorry I deleted my comment just as you posted. Thanks for the explanation.

Here is the deleted comment:

How does a vendor go from said SHA-1 hash to what the vulnerability is?
I saw this as a rough draft for a way to easily publish vulnerabilities without letting the public view them but still letting the vendor have all the information.
Could be an option, although I'm not sure what's better given that most vendors wouldn't want to have other vendors know they're vulnerable until they fix it.

Also, I'm pretty sure that if adobe and microsoft both have a vulnerability then they'll talk to each other.
Thanks, very useful. I gonna try it in my next dev.
For the Akamai thing, compare what certs you get for say www.oracle.com and www.akamai.com (I see the same cert).

The CN doesn't match there so that case is a bit different to a third party hosting a valid cert. You probably would want to check for things like this somehow though.
I think that could be interesting then.

One thing that can make it more useful than ZDI is that you lower the barrier of acceptance for a bug. In ZDI, you send them the bug, they decide if they want to buy it from you, and if you accept, they work with the vendor to get it resolved.

I can see numerous examples of bugs that they wouldn't necessarily be interested in buying from you, that a system like this could still provide for.

I happen to be in the camp who thinks the biggest problem with vulnerability reporting is the lack of response from vendors. A system like this, if it were to become popular, could serve as another way to keep them honest. But in order for it to be ubiquitous, you'd pretty much have to handle dealing with the "biggies", which I think would mean submitting vulnerabilities in the way they advertise.

I agree that it shouldn't ideally be up to the vendor how they deal with vulns, but I think you'd have to have tremendous momentum to shift that burden from you to them.
Zed will act as a clearing house? There's no danger scale (CVSS or whatever) for customers and no comp for, ahh, researchers. I don't understand how this will work.

Also clearly demonstrated that it's easy to submit reports. So...

1. Spam vulnarb.com with vulns in my competitor's software.

2. Spam vulnarb.com with vulns in my own company (maybe I can spin this... "1239801211 vuln reports against us... vulnarb clearly not to be trusted... our robust and mature security team always available...". Any press is good press right?)

3. Spam anybody I like in there, bury my product's issues. How exactly does Joe Customer realistically compare software using this? ("I want to view PDFs, should I use Acrobat, Foxit, evince, xpdf?").

3b. Spam vulnarb.com with faux vulnarb.com vulns :-p
What's the major vendor that won't accept vulnerability reports from researchers?

Remember: literally the one and only responsibility a vendor has here is "provide a secure way to send us findings". They don't have to provide a mechanism to post things publicly. If you sit on a finding for 60 days, nobody† will blame a researcher for going public with it.

† At least nobody with any influence over your reputation or hirability
How is he strong arming them by sending an encrypted blob around that only the vendor can see? The vendor can still choose to ignore the issue or sue the researcher.
Minority Report style remote conferencing and collaboration
> Castro: If you accept the fact that piracy is a problem, government needs to do something.

Piracy is not a problem. There are numerous studies proving piracy increases popularity of games, artists and software. If you can't monetize piracy, don't go to the government asking for help. Update your businessmodels so piracy has a positive effect on your business.
That's a really good point. I'd be competing with companies that pay people to give them defects, which is really hard to go against. I sure don't have the money to do it, so maybe this would just be for open source projects at first.
"Castro: If you accept the fact that piracy is a problem, government needs to do something. You have to start from that premise."

Castro immediately sets up a false dichotomy and proceeds to argue from that perspective. I'm not convinced that the government needs to be involved any more than it currently is at this point.