skysight-inc/HackerNews huggingface dataset:
i doubt you need one for a non-business venture. just like you don't need one to run a website with forums or something.

but if you decide to host any user generated content or something it might be a good idea to throw some kinda disclaimer up
I down-voted your description to register my disapproval of marking down someone's post for a single, non-offensive word. That's obnoxious and pedantic.
If you think "the encryption part of the certificate" is still there, you don't really understand how SSL works. Without a secure certificate, you can't trust your SSL session keys. See:

http://news.ycombinator.com/item?id=277284
Please read http://ycombinator.com/newsguidelines.html
Accidentally Introducing Side Effects into Purely Functional Code
Interesting stuff, but I'm surprised by the observation that number of children correlates positively with income.

I would have guessed the opposite. Does anyone have the data?
Why Ubuntu users should care about Debian
Erlang Web Development Frameworks
The dead person isn't being taxed. Being deceased and presumably having no use for wealth past that point, he or she doesn't care.

That's not true. Estate tax rules affect gifts during one's own lifetime as well.
If it's hitting mainstream media, the answer to "Time to quit your day job?" (no matter the subject) is most likely no longer "yes".
Capsule summary:

They created an MD5 collision to get RapidSSL to sign a certificate whose signature also verifies a CA=YES certificate. In other words, they used an MD5 collision to synthesize a new CA. Your browser will trust an Amazon.com certificate signed by their rogue CA.

They were able to do this because:

(1) RapidSSL, FreeSSL, TC TrustCenter, RSA, Thawte, and Verisign Japan will sign certs with MD5.

(2) They worked with Arjen Lenstra and Marc Stevens and obtained a method to generate pairs of plaintexts with arbitrary chosen prefixes within 72 hours on a cluster of 200 PS3 game consoles.

(3) Even though the prefix of a signed certificate contains fields the attacker doesn't control --- the serial number and validity period (which is effectively a timestamp of when the cert was signed at the CA), RapidSSL fucked up and used a monotonically increasing serial number (!), so they could predict the CA's fields and build them into their collision.

(4) Even though generating the MD5 collision requires the certificates to include a large amount of random-looking data, there's a place in the "real" certificate and a different place in the "rogue" certificate to stash that data: the collision material in the "real" cert is hidden the the RSA modulus, which is random anyways, and the corresponding location in the "rogue" certificate is masked as a "Netscape Comment Field" (a "tumor") which browsers ignore.

All 4 of these things had to happen at the same time to make this doable:

(1) There's no practical break for SHA-1, which is what most CAs use.

(2) You have to be able to generate the collision within a short window of time to get the resulting product signed properly by the CA, so you need the new academic result (and the PS3s).

(3) If RapidSSL and FreeSSL had simply randomized the serial number, like everyone else, there'd be no way to predict the signed product of the request, and your collision wouldn't mean anything.

(4) You obviously have to play ASN.1 games to make the random collision fit into a semantically valid certificate.

They spent $700 generating certificate requests to pull this off; because RapidSSL allows requestors to reissue certs 20 times, each attempt costs $2.50.

You want to read:

http://www.win.tue.nl/hashclash/rogue-ca/

In particular, section 5.3.4 has the clearest description of MD5 collisions I've ever read, with a really excellent series of graphics.

IS THIS THE WORST THING THAT HAS EVER HAPPENED TO THE INTERNET EVER EVER?

No. Two years ago, Daniel Bleichenbacher demonstrated a pencil and paper attack on the RSA validation procedure used by OpenSSL. That attack required a mass software update. This one will hopefully just put RapidSSL out of business.
Except for pollution the cheaper one really is better for the environment.

This is actually a great heuristic, but pollution is only part of the story. A more general (and correct) statement would be "excluding externalities (including pollution) the cheaper one really is better for the environment".

Externalities are basically costs or benefits (to society, the environment, etc.) that aren't reflected in the price paid for an item. One really important thing to note is that externalities extend far beyond pollution and can be both positive and negative.

Pollution is one of the more visible negative externalities that get discussed, but there are plenty of others (for example, driving a car involves a host of negative externalities in addition to pollution such as increased road congestion (longer commute times, more fuel burned in traffic, more accidents)).

There are also plenty of positive externalities that often get ignored. Take windmills, solar panels and hybrid cars. The positive externalities associated with manufacturing these items include lower future manufacturing costs for such items (and lower prices and environmental costs as a result) and investment in R&D aimed at making electricity and/or transportation cheaper (both in terms of environmental and financial costs). So even though solar panels may currently be losing proposition environmentally, there are positive externalities that make buying solar panels today (and thereby moving the industry forward) a Good Thing for the environment.
SvN: Design Decisions: The new Highrise signup chart
Yes, but prior discovery is a real problem. If Jake and Alex hadn't told us that they had successfully pulled this off we would never have otherwise known. In that case they would be in silent and permanent possession of something like the master keys to the whole SSL certificate system.
http://wordpress.com/tos/

Just a warning - Wordpress.com is using a 90s-inspired snow effect on the entire site. Why they chose to do so is beyond me. I seriously thought I was going blind at first, before I realized what was happening.
or "my primer on studying computer science the right way"
You make a good point. I just have a knee-jerk negative response to phrases like "death tax" when not used with bitter irony. (I have Republican relatives.) I probably deserve my -5 for being obnoxious.

Rash, knee-jerk reactions are often a social liability, which reminds me of a funny bar anecdote:

Guy: So, you're waiting for someone?

Girl: Yeah, some college friends. They're an hour late. Oh my... Boy, friends can be really rude sometimes.

Guy: Tell me about your sister. How old is she?

Girl: What?

Guy: Sorry, I heard the words "my boyfriend" and--

(Girl walks away.)
I shared my unedited notes on this book a few months ago. I felt the book had a few really cool findings and a lot of fluff, so I redid it as bullet-points:
http://blog.kiwitobes.com/?p=49
Is the TechCrunch crew still planning on releasing a tablet?
Bobby Fischer's "Game of the Century"
Lua Programming Gems (finally) Published
Yellow pages paid $3.85 million for yp.com domain name
YouTube Doesn't Change The Way We Think - It Matches the Way We Think
Agreed. However, wouldn't an operational review of certificate issuance activity of the impacted CAs provide another level of assurance that the researchers were the only ones who successfully exploited this vulnerability? I would imagine their activity (when inspected as a series of requests) would look rather anomalous.
Nuke (microwave) a sweet potato. The trick is to let is stand for a few minutes after nuking, so that it finishes cooking / cooks evenly.

Very nutritious, very quick and easy, and inexpensive.

Put a little brown sugar on top, maybe some cinnamon. You're good to go.
Business: The best way to make money?
This is pseudo-science, and I don't mean that as an insult. It takes general scientific principles and expounds on them in a "suppose X is linked to Y" manner.

The problem, of course, is that X can be linked to Y, Z, and Theta. Nobody knows for sure. But you can use general theories and general statements to connect the dots to make a pretty picture. It's speculative.

It was a good, entertaining read. I liked it. I would just caution to take it as it was meant: fun.
One thing you can do about it is to tax a commodity that acts as a proxy for the negative externality in question. For example, we could tax fuel sources relative to the amount of pollution and/or greenhouse gases that are produced, on average, when they are burned. So coal would have a given tax rate and gas would have another and propane another... this would capture the environmental cost of consuming those fuels in the price.

Unfortunately, such a simple and effective solution is politically very unpopular, which is why we have yet to see it passed into law. People want to take care of the environment, as long as it doesn't cost them anything. Well, most people anyway.
Text Messaging & Chat Abbreviations, Acronyms and Shorthand
White snow effect..... on a white background. Genius.
You're right - I've never implemented SSL, and as such don't know the minutia of the algorithm.

I didn't gather a lot of information from the link you posted, but this doc on the SSL handshake ( http://docs.sun.com/source/816-6156-10/contents.htm ) to my eyes doesn't show why you wouldn't be able to trust your session keys.

Could you explain how session keys can be compromised?
Am I reading your output correctly, or are you saying that Verisign US is vulnerable? Or is this just humor?

The reality seems to be that only RapidSSL and FreeSSL are practically vulnerable; of the small subset of CAs that will sign with MD5, they're the two that will sign predictably; the others randomize the serial number field.

Moreover, this is an exceedingly hard vulnerability to exploit. Sotirov's team not only had a cluster of PS3s running custom code optimized to quickly find MD5 collisions, but were also working with a new academic result on collision-finding that has not yet been published.
This isn't surprising at all. Let's lump [iphone, facebook, desktop, etc] apps into three categories: business useful, casual useful, and entertainment.

Business useful: These apps are profitable on platforms that business users are already on. They make money based on any combination of: high margins, long customer lifetime, or volume. The cost and time of changing platforms is high.

Casual useful: These can be profitable on any platform where costs are super low or volume is super high.

Entertainment: These apps are HIT DRIVEN. That means: very low success rate, very very high margins & volume. That being said, entertainment apps thrive on almost every platform.
I have been thinking about this very problem myself recently.

To add to this question, would it make sense to setup a limited liability company to release a side project under? If something really goes wrong, and some big company or rich individual decides to sue you (for whatever reason), you probably don't want your personal assets to be up for grabs. As I understand it, if you are operating as a limited liability company, someone can sue your company out of existence and basically shut you down, but at least they cannot have your house or personal savings!
I live in ontario, my blockbuster runs off nuclear/hydroelectric power. I somehow think it beats out the mail trucks Netflix would be using if they expand into Canada. So for me Blockbuster's energy costs are effectively zero to begin with except possibly the minute increase in heat created by the accelerated decay of nuclear isotopes.
If this model of selling software is so successful for the iPhone why don't they have an app store for the Mac? I mean maybe if more desktop applications cost 99 cents they'd be selling more of them.
I guess the corollary from this article is that "shit just got real" and thousands of joe blows with the "next big thing" will start making iphone apps. That's typically what happens when big media starts churning out articles like this, at least.
It's an overview of sociobiology in a popular magazine. That it doesn't provide proofs for its assertions doesn't make the whole thing "pseudo-science".

The fact that wolves hunt in packs and that falcons hunt alone is probably not due to different styles of elementary schooling. It's probably due to evolutionary forces, and studying such things in an appropriate manner is scientific, even if it's in political defiance of your own (and my own) elementary schooling.
Was thinking the same thing. Tells a lot about the kind of minds that are at Automattic.
Yes. Moreover, this is cited in the author's paper as a countermeasure against the attack. The attack required them to make a series of requests to probe and then prime the serial number to the value they picked for their "colliding machine", which takes days to run.
I thought about this myself too.

But, if this is the case, releasing these side projects suddenly becomes a whole lot less fun (never mind desirable).

It even costs more.

If there were some kind of trustworthy company, that could act as an umbrella for side projects - i.e. standard T&C / privacy policy let the developer maintain some kind of ownership rights etc.

does this sound ridiculous?
I'm not real clear on why a 1997 article from a routinely discredited right-wing think-tank on this issue is Hacker News....but since we seem to be playing "cite old biased articles", here's the sordid history of how unregulated landlord greed drives out affordable housing:

http://www.tenant.net/Community/history/hist-toc.html
likely because it takes time for something to get into the Google index.
When I first read the title, I thought this was a deck from years ago. To me discovery seemed so 2006.
But after looking through the slide-deck I'm reconsidering my stance on this.
Though I'm hoping there is a better descriptor for this than 'discovery'.
I know for myself that my writing style changes in response to what (and how much) I am reading for the given period (which lasts on the order of a many months/few years).
For more information on this, look up Edward Bernays, "The Engineering of Consent"

From Wikipedia:

The Engineering of Consent" is an essay by Edward Bernays first published in 1947.[citation needed] He defines "engineering consent" as the art of manipulation of people; specifically, American citizen, who are described as "fundamentally irrational people... who could not be trusted." It maintained that entire populations, which were undisciplined or lacking in intellectual or definite moral principles, were vulnerable to unconscious influence so as make them want things that they do not need. This was achieved by linking those products and ideas to their unconscious desires. Ernest Dichter, who is widely considered to be the "father of motivational research," referred to this as "the secret-self of the American consumer."
You aren't the only one. I can't use a netbook, even a macbook (11" keyboard) is uncomfortable (my shoulders are 24"). I barely notice the weight of a macbook, however.

I recently met a girl who can fit both of her hands into one of mine. Her 12-13" shoulders probably fit an 8" keyboard very nicely. Her first thought about my macbook was "heavy". Netbooks are made for her, not us.

When you see ads for a netbook emphasizing cuteness, buy shares in whoever is selling them.
OK, if you're right about the serial number part that is great. All I did was export the CA certs in my Firefox install and then ran a quick program on all the files to extract the signature algorithm.
Ben Laurie is (un)impressed:

http://www.links.org/?p=477
I would do it, it'll take you like 5 extra minutes to copy paste something, and you'll avoid a lot of troubles.

I would still release it under a LLC you own, just to protect yourself. But if not, at least spend a few bucks to hide your whois info.
The price point isn't the core of the success of these apps, it's the distribution. Imagine for a moment that when you searched "mac applications" on the internet, only ONE website came up. Imagine as well that this ONE website gave away free front page advertising to apps with the highest volume.

In that scenario, your only source of new users for your app is the ONE webste, and the best way to get positioning is to maximize volume. Thus you price your app for volume and you target your audience for volume.
What about prior discovery that occurred before all the other certificate authorities began to harden against theoretical attacks like this? MD5 based signatures and monotonically increasing certificate serial numbers used to be the rule, not the exception.

I have root certificates in my browser that are valid from 1998 to 2018. It's not so easy to verify that this attack didn't already happen 5 or even 10 years ago.

Personally I think it's extremely unlikely, especially since the chosen prefix collision attack they used has only been public for less than two years, but how could you know for sure?
I think 37S is only able to generate revenue because of their huge time investment in PR. Really profitable, small web companies are based on niche markets. 37S has no niche market, other than innovators that love rails and similar stuff. As you say, their offer has been mostly eclipsed by Google, Zoho, and other web outfits. So, they need to keep the PR strategy to continue making decent money.

Companies that have a well defined niche, on the other hand, don't need to spend much time or money on PR. And many of them are more successful than 37S.
Documentation is for computers to read (or: Commenting Code is Evil)
Never confuse marginal rates with average rates.

I didn't... I clearly stated that those were the top marginal rates and further down in my comment, I noted the difference between what someone making 400K would pay marginally and on average.

When folks don't spend their money, they buy dumb.

I don't understand this comment at all... please explain.

If it's so patriotic [to pay taxes], why do you want to exclude people from it?

I, like Buffet, Gates and many others, believe that those of us who are in a position to pay 40% of our income and still live in extraordinary comfort should do so. Those who aren't in such a position shouldn't be expected to do so. I don't have rich parents and I started out relatively poor... if it wasn't for low tax rates when I was broke and not making much, it would have been much, much harder for me to make a success of myself. Now that I'm doing better, I'm happy to pay it forward to the next generation struggling to make something of themselves and make everyone in the country better off a result. Even from a purely selfish viewpoint, graduated tax brackets make sense.
This is a very frequent discussion in my circle of hackers - to comment or not to comment. I'm on the "not to comment" side of things; either your tests or your code should speak for itself, if it's so complex that you need to leave a comment - you're doing it wrong.

I haven't seen this discussion on HN yet - so I wanted to get the opinion of so many people that write code day in and day out and may be responsible for maintaining code they haven't written themselves.
I've given Linux a go, it's a bag of crap even ubuntu. I'll stick with a real product like Windows or OS X where I don't have to do BS I haven't needed to do since DOS.

I'm glad you're happy with Linux, but I believe the rest of the world just doesn't care about it and never will.
Ben Laurie is demagoguing, poorly:

(1) The attack is extremely difficult to pull off.

(2) Critical details required to carry it out --- an academic breakthrough in MD5 collision-finding --- were actually withheld, meaning that no "zero-day" occurred.

(3) The "fix" for this attack is for RapidSSL to randomize serials and stop using MD5, both of which will happen; if you believe certificates from before today are vulnerable, that's an even stronger argument for publishing.

(4) The product of the attack was deliberately backdated to 2004 to prevent real-world exploitation.

(5) I may be wrong about this, but --- Ben Laurie himself helped zero-day the RSA signature validation flaw two years ago.

(6) Laurie is calling Arjen Lenstra a moron.
Sourceforge? Google code?
Routinely discredited? Right-wing? Cato is clearly libertarian. I suppose that tends to the right, but it's not "right wing" in the traditional sense.
Then nothing in that list is relevant, either.

Anyhow, the program you want to check this out is Firefox itself: Preferences -> Advanced -> Encryption -> View Certificates -> Authorities -> "View" -> Details.
This whole "shop around for bananas" kind of reporting is really the sort of thing the nytimes needs to nix if they want to avoid bankruptcy.
Venus Ushers in the New Year | TechJaws
Business Technology News
socially liberal & fiscally conservative != right wing
that's a good point that I had not thought of. But are these not just for open source stuff?

What if I don't want to go the open source route?
They're also using an unpublished variant of the chosen-prefix attack, which presumably is what allows them to win the weekend race to generate a collision with a predicted timestamp/serial pair.

We're also focusing on the algorithm, but not really accounting for the fact that simply owning a cluster of PS3s doesn't give you the optimized math code that generates the birthday bits during the weekend window. That code is itself presumably harder to write than any zero-day exploit.
Sorry, but I don't buy the whole "if it's so complex that you need to leave a comment - you're doing it wrong."

Take, as a counter-example, any of Knuth's literate programs. Do you really want to say he's doing it wrong?

Some things are that complex. And sometimes, the best way to make sure that the code is understandable is to add some human-readable text.

It's naive to think that humans and compilers should both be able to parse and comprehend the same text with the same ease.
I have thought chemical engineering would be interesting. I know there is some cross-pollination between the chemical engineering and software industries (chemical engineers becoming programmers or testers and vice-versa). I love science for one thing, and also seems like the sort of "engineering mindset" - eye for quality and processes, and just sort of logical thinking skills in general, that one needs in software one could also apply to chemical engineering. Doubt I'd ever make this move, unless the bottom just totally fell out in the software industry, but I think it is an area I could probably pick up quickly if push came to shove.
I'd always hire a person for his passion.
Wouldn't the all nighters be a maximum of 46? That is not countless...

I am a fan of the idea (family sharing and communication online is something I am interested in since I moved across the country from my family) but the design of the site is not the best, and I don't think I'd use it regularly.

I am very partial to well designed web apps, though, since I am more of a front end coder / designer than a hacker.
> To replicate a computer game is trivial, but when buying a computer game, one is not so much paying for the replicated copy of the software as one is paying for the time and expenses that went into producing it in the first place.

Y'know, I always thought it would be interesting to sell the first X copies of software for a $Y, where $XY is cost of expenses and time you needed to put into it, plus a Z% profit. Any additional feature requests/etc. to that particular software would be developed and sold using the same model.
Not sure if you were looking for feedback or what Andrew,
but I took a look, and I'm wondering what CherryPeel has in comparison to the competitors out there (there are lots).
thesixtyone - specifically has a very clean and nice interface. much easier to look at than cherrypeel.