skysight-inc/HackerNews huggingface dataset:
Given the amount of information on the bushi.do homepage vs. the description in Jacques' article, I'd wager that would be inappropriate in this case.
Could you post a screenshot of what v2.0 actually looks like? Maybe an example of the 'activity stream'?

It looks interesting, but I don't like signing up for something without getting seeing a sample.
Stronger types for Python
> First off vendors by decrypting the content of the researcher's submission are basically giving up vulnerabilities to the bad guys that want to target unpatched systems

They already do this. After a vulnerability is patched and fixed they release what it did.

> Second thing I see no reasons why the vulnerability disclosure process should change and migrate to SSL based encryption

It's a proposed first step, and makes sure that no vendor can avoid the system by simply not publishing a key. I envision in the future their GPG key would also be on the site and could be used.

> vendors can already expose "lies" if they feel like it with PGP encryption and honestly having a "middle-man" in between that can potentially have sensible data looks like a bad idea.

Uh, not sure what the "middle-man" is, but if you mean vulnarb.com then no, the point is that it's industry standard asymmetric crypto so I wouldn't know anything. In fact, I'd have incentive to not know anything so that I'm not getting sued.

Finally, your proposed karma points system doesn't seem to solve anything. If everything is encrypted so that the receiver is only able to decrypt (not even the sender can do that), then there's no point in preventing people from publishing.

Are you afraid that someone would slander a company? Couldn't the company simply decrypt and publish their lies then sue them for slander?
Although LLVM existed and was fairly well known, it was a middle/backend-only project until mid-2007 or so, and used gcc as the language frontend. Clang's first source release wasn't until July 2007, and I don't think it got much traction until 2008, and a 1.0 release in late 2009. So it seems plausible that a September 2007 discussion wouldn't have it on the radar.
Ask HN: Web Services to enable users to sell digital goods on your website?
Hey all, I'm curious if any of you know of a web app or service online that enables users to sell digital goods via your website and split the revenue?

For example: say I own a big photo sharing website and I want to allow my users to offer to sell photos from their portfolios like SmugMug or others do. Basically, I want a piece of software that manages that transaction from beginning to end and is easily integrated into my site (the download, collects income, manages the revenue split between content owner and community, etc.).

My niche is different than this, but it certainly seems like a needed service. Perhaps it's a startup idea in and of itself?

Any feedback appreciated - Thanks!

Lucas
What kind of qualifications are necessary to join this community?
Thought people might find this amusing / interesting (wish I had written it for April 1... although it does work). It's a spin-off from the use of type annotations to guide the interpretation of JSON data (Pytyp will marshal JSON/YAML data into Python classes, which is useful if you're using JSON to talk to some kind of service).

[Edit: Optional, product and sum types are supported, along with simple polymorphism. There's currently no type variables and no dispatch by type - although I think both could be added]
I use Unity with two monitors and unmaximized windows, and it works fine. In the window is on the second screen, the menu bar follows.

Try it.
I don't see any reason to assume the distribution of outcomes for financiers is flatter than that for entrepreneurs. Is there something about finance that should make that so?
I suspect it has something to do with what is locally defined by the culture as the 'successful' person.

In the Bay area (not the 'west coast') the local culture embraces the 'millionaire nerd.' Part of the archetype for this person is they are a 'kid at heart' and may dress poorly, have star wars action figures on their mantle, and spend hours discussing the finer points of some new videogame.

In NYC (not the East Coast) the local culture embraces the successful banker. The archetype of this person is a wizard with finance who understands how to convert a concept into a 35% margin. They court 'high net worth' individuals and corporations who, to a large degree, manage their outward facing image as part of their brand. They are acutely conscious of being at the 'right' charity events, wearing the 'right' clothes, and hanging out with the 'right' people.

People who want to be successful in New York don't do April Fools pranks because it wouldn't project the serious 'brand' they want to build, people who are successful don't do them because the realize just how much they depend on their brand as part of their success and it makes no financial sense to risk that with some goofy prank.

People in the Bay Area have seen billionaires hanging out with people in clothes they bought at Sears, seeing if they can use a mentos-coke fountain to knock over a trash can. Clearly the meme for them is "I don't care how stupid this makes me look, I'm all about the fun." For them doing an April Fools prank is just another way to have fun.

If you look around at who is successful in an area and their image in the general media you can probably guess if they will have any interest in participating in an April Fools prank.
This wikipedia article shed some light, http://en.wikipedia.org/wiki/Geoid, but yes that seems to be a more accurate depiction of the physical Earth.

Pictures of planets taken from outter space, usually also capture the gases trapped by their gravity (athmosphere). It gives you a nice round shape.
How would this differ from a site like the Zero Day Initiative? (aside from that it looks like there's much less hassle to use this system; or maybe that's actually the point).

I think this is interesting, but the two "types of vendors" I see this being useful for are:

1.) Vendors who don't have an already established method for communicating vulnerabilities (and therefore the researcher doesn't have a good way to interact with them).

and 2.) Vendors who chose not to work with researchers (of which there used to be a lot, and are still a few).

I see type 1 quickly instating a policy to deal with vulnerabilities after something of there's get posted to the site (so they can more quickly deal with future issues), and I see type 2 continuing to ignore vulnerabilities (and possibly being hostile to the researcher and the site for posting things). So maybe the benefit is shaming "type 2" vendors?
Excellent recent essay on this topic:

http://jonathanherzog.com/node/139
Even if there was a bubble, Entrepreneurs are the ones vending so it makes sense to sell in an overpriced market.

If you're looking at selling your company when you retire or handing the large majority of it to your heirs then the bubble is irrelevant and you should focus on profit. (There could possibly be some tax benefits to transferring to heirs during a period of low valuations)

If you're looking to increase your liquid assets in the next 3 years it may be an idea to sell now (during a purported bubble) and diversify into more liquid assets.

Asset bubbles in the tech startup sector are primarily detrimental to VCs and their LPs. It could also be detrimental to startups with exits in the next 3 years (assuming the 'bubble' exists, and 'pops' with in the next 3 years) if your founding a company focused on profits it's irrelevant and if you're founding a company that will take VC you will benefit greatly from a bubble.

The only people that a bubble affects negatively are those planning an exit in the next 3 years and those buying tech startup stock. As a founder most of the bubble effects are positive if you can take advantage of them today.

If there is an asset bubble in VC funded tech startups it comes from VCs raising too much from their LPs and then having to spend it somehow and taking the easy route of spending more per startup rather than hiring more analysts to fund more companies. The herd mentality doesn't help reduce the bubble and I think that the perception of a bubble comes from the valuations reached by companies that every VC wants a piece of the action, thankfully this behavior leaves lots of really great investments at low prices, so there should be some great opportunities out there for VCs willing to stray from the herd. (I'm channeling buffet here 'be cautious when everyone else is greedy and be greedy when everyone else is cautious')

I think a large part of the increase in valuations that VCs see is due to incubators weeding out the pets.com and the VCs seeing companies at a more mature stage due to decreased capital requirements for a tech startup. Honestly, a shitty desktop PC with an SSD will run circles around a $100,000 DB server from 1999. If you can turn a profit with one server EC2 will let you scale infinitely with out needing any VC, hence Entrepreneurs don't NEED to take VC, hence they are in a much better position to negotiate an increased valuation.

Note: I don't think a bubble exists in the sector as a whole and is limited to the companies that every VC wants a piece of. Due to VC being a private market with private financials it's hard to evaluate these bubble claims independently. I'd love to look at the 10Q equivalents of the portfolio companies of people claiming a bubble.
Hmm, is your blog set up to auto-submit to HN? Not that there's anything wrong with this post, but I was sort of surprised by it being submitted here, since it seems more of a "personal photos" than "submit to HN" type of post.
Facebook acount
That shell script does that already. Go ahead and run it for multiple sites with the same file:

sh encrypt.sh www.google.com mysecret.txt
sh encrypt.sh www.apple.com mysecret.txt
sh encrypt.sh www.microsoft.com mysecret.txt

It then will make a directory for each in results using different passwords and their respective keys.
Proper mouse acceleration is a poor poor solution for the parents problem. I can't (physically can't) use a mouse that moves faster than a certain speed.
I am still wondering about some verification on identities. [edit: I guess zwischenzug found the hoax link]

Ronald Reagan was probably the last President who wrote long form letters often. There are several collections of his speeches and letters in various places. The writings tell a much different story than the media soundbites.

The speech that probably got him the Presidency was one he did for Barry Goldwater's Presidential campaign. The speech was called "A Time for Choosing" text: http://www.nationalcenter.org/ReaganChoosing1964.html

This was a refined version of the speech he had been giving for a number of years.

I dearly wished the Presidents after him wrote as much (from a historical record), but it seems like we will have to wait for someone with a blogger's mentality to win.
Not sure, my cofounder is a bit of a fashionista so she's always wearing something colorful. I do my part to encourage her by dying my hair blue and not wearing so many ugly conference T-shirts.
Interesting idea. However, If TippingPoint will pay me for my vuln, why would I want to use you as an another place to "secretly" disclose my vuln?

In addition, as someone who manages vulnerability disclosures for a Fortune 500, I would have a hard time getting the SSL private key for my company.
With regards to use of the SSL-is-PGP trick discussed earlier, I think you may run into a problem in the real world of megacorps: the peons in charge of appsec may be several fiefdoms away from the peons who could actually access the private key for the SSL certificate.

Suppose you report a SQL injection in X university's website. I would have been responsible for getting that fixed at my old job. I know what campus the guy with root on our web tier works at, but working on memory of our org chart, I can only narrow it down to a thousand people, literally. Extraneous copies of that private key aren't floating around internally. Indeed, I rather suspect that if there exists a process by which I can learn it, we just failed ISOSomething. How am I supposed to figure out what your cypher text telling me what is wrong actually says?
First, thanks for the careful response. You and I argue in much the same manner as pure sodium argues with water. You're being nicer than I am this time.

Second, the point of posting a catalog of vulnerabilities encrypted under the RSA keys of vendor SSL certificates is that the vendor can authenticate a posting; the vendor, after all, is the only party that can decrypt them. I think we're clear on who the actors are here.

You appear to be trying to build a system that exerts pressure on vendors to fix and publish security findings by allowing researchers to safely claim publicly that they have findings.

But researchers already have several tools for doing this. One of those tools (my least favorite) is things like the ZDI, where you are paid hundreds or thousands of dollars to let a big company handle the problem for you. Another popular solution that has the virtue of simplicity is, again, simply posting a SHA-1 hash of your finding, like, "ad1ad1ccb6da145406edef884e0595b4b1f5c4ae IE8".

The latter solution is exactly as amenable to pressuring vendors as "vulnarb.com" is. You can even help. Just collect and aggregate those reports. No public key cleverness is required.

My read on you --- and please take this as a compliment --- is that you are a cleverness junkie. The trick of sending encrypted messages using SSL certs instead PGP or S/MIME is indeed clever. But not every clever solution serves a real problem.
Why are you interested in doing a PhD? Do you know that you like research?

PhD programs are very different from undergraduate (and most masters) programs. I wouldn't bother with one unless you are sure that you want an academic position, or a job in an industry research lab.

That said, research can be very fun! Just be sure that you know what you are getting yourself into. If you decide to apply, you may be interested in a series of blog posts I'm starting on the grad school application process:

http://blog.ethanjfast.com/2011/03/state-your-purpose/
When I saw this, I thought, "Wow! A better nailgun?!"

But alas, it's built on top of nailgun -- which presumably means that it inherits all the security problems of that older, apparently moribund project.
"Never quit the problem, but don’t worry about quitting the product. Some entrepreneurs are afraid of pivoting if something isn’t working. It becomes more about protecting their own egos and being portrayed as quitters, than about solving the problem. Focus on the problem you’re solving and everything will fall into place." - Brilliant
What if this turned into an open source client combined with a standardized API for reporting vulnerabilities directly to vendors and similar escrow services?

Ultimately, yes, it's meant to be easier and more open than current initiatives.
Email Provider Epsilon Responsible For Gigantic Security Breach
العاب طبخ 2011 
العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011 العاب طبخ 2011
I would like to see a cube like thumbnail map with a highlight showing you where you currently are / or perhaps subtly hints at where you can go next. Currently it might qualify as mystery meat navigation; yes I think presentations/slideshows should have the ability to know where its going and or a promised end time.
The person in charge of appsec is guaranteed to be many fiefdoms away from the sysadmins. In a lot of very large famous companies, you'd be wise to put money on the notion that the appsec guy hates the guys that manage the websites.
No, read my paragraph, I'm aware of the registry and it is lacking.

Package management is nowhere near 'only necessary if apps share dependencies'. Compare:

1) Search google for software.
2) Search software website for download link.
3) Download.
4) Go to folder it was downloaded to.
5) Run installer.
6) Click next five times.

The same situation, but with package management:
1) Type in a single command and watch it install exactly what you want, quickly. eg: `pacman -S firefox`
The article seems to state that switching to classic still forces you to use the single menu bar.
There are actually 5 parties, you missed the Employer and that's the part of health insurance that we're trying to solve.

Currently in America, if you're not on medicare/medicaid, the vast majority of people get their health insurance through their employer (this is called a Defined Benefit). Providing this benefit to employees is a huge burden on employers for something that has nothing to do with their core business model.

What my company is doing is moving this to a Defined Contribution, where an employer gives $X/year to each employee and the employees can use that money to purchase whatever kind of health insurance fits their situation best.

Employer benefits:

- known, controllable costs

- get out of health insurance negotiation/shopping for their employees

- better awareness of employees in how much employer is contributing

Employee benefits:

- more plan choice to fit needs (ex: mental health, substance abuse, pregnancy coverage as options)

- many times cheaper for healthy individuals (encourages more responsibility for employees staying healthy)

- more transparency into total compensation by employers

The same transformation happened in the 80's with pensions moving to 401k. The move from Defined Benefit to Defined Contribution is coming, and there's a huge market out there to make that transition happen.

Pension : 401k :: Defined Health Benefit : Defined Health Contribution

There's also a HUGE opportunity coming up with Health Reform where companies that didn't previously provide health insurance to their employees will now be mandated to (or pay a big penalty). Going with a Defined Contribution model is their easiest route to satisfying the mandate. Simply fork over a pile of money and you're done. No other screwing around with health insurance companies/brokers every year to do something new.
What we expect from MS in Windows 8:

#1. Price: Make it something around $50 to $100

#2. Seriously nobody cares Home basic, Home premium editions. Just discontinue these kind of editions.

#2.1 Make it sharp Windows 8 lite ($30), Windows 8 Pro($50), Windows 8 Ultimate($100)

#3. Try to have "Software Installer". Ubuntu has a perfect one. That would be great, If we have 100s of latest setup files packed with installation media (Skype, Pidgin, Firefox, MS Office, Putty, Apache, PHP, Python, Flash Player, Adobe Reader, Filezilla, Dropbox)

#4. We need a stable firewall in windows. Try to buy companies like "Outpost" and please improve your WIndows one care. (If it still exists)

#5. Spywares, Keyloggers, Viruses, Trojans .. We are installing almost 2-3 tools to protect us from these.. Please invest some money to make a stable "Security Software"

#6. Please make IE9 avail in cross platform. If ActiveX is the only problem.. Then do it cross platform first.

#7. Respect Opensource packages.

#8. Password protected directories...

#9. Support MORE local languages (See any linux distro)
...
This will be a good thing to set up anyway since the government has needed for some time an efficient way to eliminate web sites from the internet that have any forbidden, threatening, inappropriate or questionable material, without having to resort to long drawn judicial processes requiring probable cause.

I also like his advocacy of deep packet inspection, meaning corporations searching 3rd party internet traffic that happens to pass through their routers, without needing warrants or being liable to wiretapping laws. That will definitely come in handy.
Compared to The Carter, Ford, Nixon sequence; Reagan was a lot better for America. At least they stopped writing those "Do we need a new form of government / Is the Presidency obsolete" editorials.
I'm not worked up. I'm seeking clarity for those applying to Project Skyway. They're new, naive and easily taken advantage of. I'm asking the questions I would hope they would ask.

If you haven't made enough on your exits to angel invest, then you built lifestyle companies which I understand Project Skyway doesn't want. Additionally, you're providing advice to entrepreneurs on how to create something which you haven't done yourself. That would give me pause if I was applying. Maybe your just providing your network to entrepreneurs for a fee (the equity stake Project Skyway takes). In that case, your price is much too large compared to Angel List and your value is significantly less.
The benefit of co-op is not just the money, it is the variety of experience. You can graduate having worked six different jobs at six different companies. Seeing such a huge variety of work environments, cultures, practices, even cities or different countries, is hugely valuable.

In my co-op terms, I've worked in enterprise software, gaming hardware, two start-ups and one very hot valley company. Each one has taught me different things, even if it was "I never want to work in enterprise software".
I agree with microarchitect and gcb. You are focusing more on the means than the ends. What would you enjoy doing? What will it take for you to get into a position doing that? Just speculating, I would imagine that any barrier (if any exists) to you being qualified for your desired position if based on skill level, not academic credentials. Of course, if you are looking to do literally cutting-edge research involving highly advanced algorithms, a PhD might be the way to go. However, first you have to know what you really want to do. Like the earlier posters said, you also need to know people who know when valuable positions open up. Most of these good jobs never get posted because the hiring manager will first ask his/her contacts for leads on candidates, since relationships have credibility at risk and lead to higher quality leads. You need to be the person that gets the e-mail saying, "Hi, my company XYZ Corp. is looking for an excellent developer to do... Know any awesome devs who can do it?"
As one of the maintainers of a small open source project (http://getontracks.org/), I see a huge opportunity with Bushido. The project has really struggled with making it easy for new users to start up, but even a tutorial doesn't help non-technical users. A few people have set up hosted versions of Tracks, but getting them to stay up-to-date with progress on trunk is a challenge.

With Bushido, projects like Tracks finally have a clear route into the hands of non-technical users. Sure, I can go set up a hosted version of Tracks, but then I'm taking responsibility that, as a part-time maintainer, I have no interest in. This rocks!