skysight-inc/HackerNews huggingface dataset:
I searched a bit and found patches that I think help to explain what was going on and how severe things worse. I'd appreciate if anyone could confirm I found the correct stuff and if anyone could help explain what happened (in particular, I don't understand why the timing attack bug would lead to a remote code execution)

-----------

The first bug seems to be in some function that checks if you can find a file in a folder. Currently the funtion counts the number of ".."s to make sure you don't go out of the folder you started the search in (emitting an error if the depth becomes less than 0) however, this does not take into account the possibility of one of the intermediate folders in the pathbeing a symlink, meaning that the `./symlink/../bar` is not the same as `./bar` and therefore ruining the logic. The fix seems to be a hack to transform `./xxx/../b`s into `./b` by hand, without passing it to the fylesystem.

https://github.com/rack/rack/commit/6f237e4c9fab649d37504825...

The second bug seems to have to do with `==` not being safe and them having to do a "secure compare":

https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d6...

edit: apparently the problem here is the time that `==` takes to run depends on the inputs. This means an attacker can do multiple carefully crafted requests and use this timing information to guess your secret key stuff. I still don't know why guessing the secret stuff would lead to remote code execution though.
I literally just started going through Project Euler with Python now to get comfortable with the language.

I'll play with that and see. I can't think of any other language where this might matter.

Should I look for anything in particular or simply tabs vs space in indentation on any code?

# Problems from ProjectEuler.net

# http://projecteuler.net/problem=1
def problem_1():
return sum([n for n in range(1000) if (n%3 == 0) or (n%5 == 0)])

def problem_1a():
return sum(set(range(3,1000,3) + range(5,1000,5)))

# http://projecteuler.net/problem=2
def problem_2():
sequence = [1,2]
while sequence[-1] < 4000000:
sequence.append(sum(sequence[-2:]))
if sequence[-1] > 4000000:
sequence.pop()
return sum([n for n in sequence if (n%2 == 0)])

I did say I was just getting started!

I'll try the above and other code I wrote with a mixture of tabs and spaced and see what happens. Interesting. If Python actually breaks because of that it's a shame. I really like the language. Is it a matter of IDE interpreter (type code and execute interactively) vs. command-line interpreter (same as previous) vs. module execution (i.e.: "python my_module.py" from the command prompt)?
You're asking for actionable specifics from an abstract discussion of philosophy. To take it back into our domain, it's a bit like reading an article on design patterns and saying, "Yes but can I have teh codez?"

(Or, to be flippant, the advice might be 'persuade George Soros to take you as a client.)
landmines are useful for combat too. Oh yeah, the US refuses to sign that one too, right?

If it wasn't useful for combat, nobody would use it, right? You only need international law to try and prevent things that _are_ useful in military objectives, but are so dangerous to humanity that we wish to prevent their use.
Oh come on. That's like asking "is there any evidence this particular bear shat in these particular woods?"

The path to success for prosecutors is successful high-profile prosecutions. Everybody knows that.

I don't actually know that Heymann's career had been fading, but the rest of this quote seems pretty reasonable based on what we know.
I have to ask, what is your age that you think you only have 20 years of brain power left? For sure, there are ages for which this is true, but given the age distribution of HN readers, seeing this post makes me curious.

Perhaps the plasticity of our brains is reduced, but that alone doesn't mean you have no brain power.

If you think of learning as "leveling up", you may stop increasing in level at some point, but you are still very powerful and productive.

I do agree with the sentiment of your last sentence however. We should endeavor to make our "leveling up" years count, and who knows, maybe you level up for the rest of your years.
I'm curious about the wording. Is "bought or sold $1M" equivalent to saying $500k changed hands?
Important Conversion Metrics You Should Watch
"The bottom line is that a person who wants to remain ignorant of the money-making side of business will never hold power. Employment is the opposite of freedom."

The truth will set you free indeed.
What Are Roots of Unity?
No one needs a CDN to serve text quickly; that is massive overkill.

CDNs in general are massive overkill for most sites. What a CDN does is reduce latency due to lightspeed. Is lightspeed really why it takes a site 10 seconds to show text? No.

As you point out, caching and proper javascript management is the key to a site that shows text quickly. CDNs do provide caching, but are a complicated and expensive way to do so.
A lot of faith in the process, there.

For some reason, whenever there's a lot of public anger, the process just so happens to disproportionately end up going the way of public anger. Not all the time, but a lot of the time. Cf. healthcare law and its route through the judicial process.
I just realize that my comment came across wrong. I am very interested in Bitcoin - I just want coinbase to come clean before I put my money and trust in them
While barrels benefit from quality (and even things like titanium firing pins, $200 special wooden grips, $3000 optics, etc.), I am confident I could show a minimally literate 8th grader how to make a serviceable open-bolt fully automatic weapon (say a 9mm SMG I guess) with a random high school machine shop in 3 days, capable of firing <4 MOA, >900fps muzzle velocity, >95% reliability with Wolf 9mm ammunition for 500 rounds.

Basically the same thing was done in WW2.
Well Bitcoin is not a fiat currency since it being defined as money is not dictated by fiat. It isn't attached to a physical good which is interesting. I'm guessing that its' value is being helped by the increasing amount of inflation in fiat currencies around the world and that the newly created money doesn't have a better home. Many people are scared of stocks and real estate so other assets become more attractive. I'm not sure I have any use for Bitcoin in my life and in this financial environment I wouldn't be involved in Bitcoin at this or any price.
Why should I use this private platform instead of email?
I recommend reading Jack Horner's "How to build a Dinosaur", he talks about this sort of thing, namely that you can take an existing flightless bird, give it teeth, a tail, and flip the arms around and you've basically got a dinosaur.

The creepy part is people are actually messing around with chicken genes and can turn on things like "grow teeth" and "grow a tail".

- http://www.ted.com/talks/jack_horner_building_a_dinosaur_fro...

You'd think the guy who was the dinosaur adviser for Jurassic Park would actually learn the lesson from the movie, so if we all get eaten to death by chickens, here's your guy.
He's using TextMate, and apparently wrote the appropriate plugin/bundle himself:
https://github.com/jashkenas/coffee-script-tmbundle

Command to show the JS equivalent:
https://github.com/jashkenas/coffee-script-tmbundle/blob/mas...

Actual work is done via `coffee -scp -bare`, then the output is massaged and formatted for the editor popup.
World's First Web Page
Well for those people holding bitcoins might be worthwhile to them. The bitcoins never go anywhere in the same way that physical money never goes anywhere unless you bury it.
New startup shared workspace called "Runway"
Aaron and his lawyers also interacted with him on a regular basis. Although you can never be absolutely certain of things, it's certainly possible in general to infer people's mental state through their actions.

In this particular case, if you think Aaron and his lawyers were disingenuously misrepresenting what was happening, or Taren is lying in a deeply emotional state about what he related to her, just say so. Not cloaked in clucking about mind reading.
The problem is inconsistency[0]:

> (April 17th) We are currently testing a sample of 40 4GB microSD cards from Sandisk to failure

> Its May now and still no cards have failed.

> we were testing a card from a customer yesterday on a TS-7553 and it failed the DoubleStore stress tests within the day. [...] The test failed at approximately 13 GB of raw data written

> The ATP card failed a 3rd time after 65GB of data written.

> Another, separate ATP card failed after 877 GB of write activity

If the card is MLC and there's no or limited wear leveling, repeated local writes will shut the card dead quickly ("limited" as in wear leveling being applied only among e.g a 4MB group of cells, Sandisk happens to do that). I've also heard of some controllers implementing wear leveling, muddling the test results.

Some cards are truly reliable, others are craptastic, and everything in between is possible. The problem is you can't trust a brand and go for it, and getting the technical details, if at all possible, involves digging into cryptic and hard to find documentations.

I can't find the link again to a test of someone who tested various card brands and had them die semi-reliably within 15 minutes.

[0]: http://forum.embeddedarm.com/showthread.php?3-SD-card-endura...
The Uptime Project - The world's longest running computers
Facebook is down in oslo, 500 internal server error.
You can also send emails from Moped. i.e. @schuyler@mopedlabs.com... and send your message
For plain text, see "par", a much nicer version of "fmt".

http://www.nicemice.net/par/
I've Got 10 Invites for SETT. Who Wants One?
In my opinion that is AWESOME that lazy startups are defaulting to basic bootstrap theme. 1) It is WAY better than the crap that a non-design oriented engineer would come up with and 2) it lays an awesome foundation for a designer to come in and make improvements. Usually engineers write the first 10,000 lines of code on a project so give them a dead simple UI framework so they don't create something horrible in it's place.
You should take a look at blockchain.info. It is pretty straight forward and works with UK bank accounts (takes a couple minutes).
How to Maximize the Shareability of Your Blog Posts With Multiple Entry Points
Stop Before You Add That Feature, Do You Know The Real Cost?
A portable chicken coop for urban farmers
"I can state the core idea in two relatively simple propositions. One is that in situations that have thinking participants, the participants’ view of the world is always partial and distorted. That is the principle of fallibility. The other is that these distorted views can influence the situation to which they relate because false views lead to inappropriate actions. That is the principle of reflexivity."

Or: People don't know sh*t, but they can still buy/sell stocks, which then affects the price.
It is confusing. Because of course rack is used by more than just rails, the rack team's responsibility isn't reallyto say "If you're using Rails with it's default signature verification, you're not vulnerable" -- they don't even have the background to be sure that's true (even rails team might not, security is hard).

The announcement also implies that the timing vulnerability _might_ only be exposed to people on the same local network who have sufficient timing granularity -- BUT that this applies to anything in the cloud, since people on the same cloud are essentially in same local network. So if you're not in the cloud...

On the other hand, I've [fucked up before](http://news.ycombinator.com/item?id=5003132) _thinking_ I understood the vulnerability and that it was unlikely to effect me, when in fact I was operating without full information and misunderstanding the true extent of the vulnerability. So now I figure, if the maintainers say "Todays releases are important. All users should upgrade ASAP!", I better just act as if they are right. Even though sometimes they won't be and are being over alarmist, I'm not qualified to know when.
Elevate: a RubyMotion gem that isolates your app logic
Absolutely. An alternative for longer journeys would be multiple small "pods" docking together as a bigger unit for increased efficiency, or boarding some sort of platform for long-range travel.
Stuff The Internet Says On Scalability For February 8, 2013
Even in your screenshot it looks perfectly readable for me.
Rack is not Rails.
I'm not convinced the defined track function is fixing what's described. If following Google's instruction for "installing" ga.js [0], there shouldn't be any sites breaking that block ga.js from loading. That is, Google suggests var _gaq = _gaq || []; at the start of the script installation. If ga.js never loads, _gaq is still an array and can be pushed onto to your heart's content. If you're concerned with an ever growing array of garbage, the suggestion in the comments is great:

__gaq = __gaq || {push: function(){return 0}}

[0] https://developers.google.com/analytics/devguides/collection...
Not investing the money at a risk-adjusted profitable return is the same thing as taking money from shareholders. Think about it this way. If there was one owner in the company, and the CEO just couldn't figure out a way to invest the company's cash at a profitable rate (again, risk-adjusted), what would the owner do? He'd take it out of the company and invest it elsewhere or just buy something - because he owns the company and it's his money.

When you have multiple shareholders, the concept is the same, it's just harder to hold management's feet to the fire.

This is different than "sitting on cash" as a strategic decision. It is wise to do so - there might be investment opportunities or hard times down the road. But we are talking about excess cash - cash beyond the level that is reasonable to sit on for strategic purposes. To sit on excess cash (which is admittedly a judgement call) is to hold your shareholders' money hostage in an unprofitable manner. Given how much cash Apple has, I don't think it's unreasonable for shareholders to grumble a bit.
Of course. The real challenge is making it look good with pinch-to-zoom.
Don't Teach the Rule, Show the Map
Couldn't agree more. I read somewhere (I forget where): "You don't need to learn Category Theory in order to learn Haskell. Learn Haskell, and you'll develop an intuition for Category Theory as a side-effect."

I think the best "Monad tutorial" is Learn You A Haskell For Great Good[1], in its entirety.

[1]: http://learnyouahaskell.com/
And my point is that setting out to make a million dollars is a perfectly legitimate goal. Making something people find useful can be a way to achieve that goal.
Probably, because I use the account a lot. Just not the devices (I probably have...12?) I use the DXes a fair bit, and use kindles when I'm outdoors, but I prefer to remain indoors generally.
And my point is that setting out to make a million dollars is a perfectly legitimate goal. Making something people find useful is one way to achieve that goal.
3D printers, build and reclaim fleetcars on the fly?
I used it for a while and found it to be terribly annoying. The breaks tended to come up right in the middle of my flow periods and interrupt everything, costing me a ton of productivity.
The second one is a timing issue. You need to have an equality method that takes an equal amount of time on success or failure.

Heres a good read on timing attacks in general:
http://codahale.com/a-lesson-in-timing-attacks/
Should be conceptually simple to resolve that question empirically. Has anyone done studies on whether people who sign a petition are more or less likely to engage in future actions (and if so, of what types)?
File Your Patent Applications Before March 16, 2013
Frequent asteroid impacts lend credence to the Doomsday Argument [1], which, simply put, argues that it is unlikely that the human race will be long lived, simply because it is growing so fast. According to the DA, there is a 95% chance of extinction within 9,120 years.

[1] http://en.wikipedia.org/wiki/Doomsday_argument
I think he means ruby.

I'd agree that, in the ruby community in general, or at least the English-speaking ruby community, general cultural values seem to be "dev early, release early, security hole early". Valuing innovation and release-often over stability/reliability. There are certainly some projects/developers that go against this cultural norm, but we are certainly not the first to recognize it as a general cultural norm in rubydom (and it's got benefits as well as disadvantages).
With no driver and a quarter the size or less for smaller (1-seat) units.
Did you stop reading after that paragraph? The next paragraph says, "I believe that Heymann is guilty of prosecutorial misconduct on several levels, but I can’t prove it until we have a proper investigation."
Great circles are not straight lines on the Mercator projection. Rhumb lines are straight, but not great circles.

If you want great circles to be straight lines, use the Gnomonic projection.

http://demonstrations.wolfram.com/GreatCirclesOnMercatorsCha...

http://en.wikipedia.org/wiki/Gnomonic_projection
Precisely. So many things went extinct that is probably better to ask "why did this group survive?" instead of "why did this group go extinct?".
Drugs, gambling...get hookers in there, and you'll have a legit currency. ;)

No, seriously, once a currency gets to the point hookers accept it, it's indisputable that it's real.
I feel like you must have stopped reading my comment before the last paragraph, where I point out Google has learned to deal with this as Go has gained popularity and now it's not so much of a problem in practice.
Email = lots of noise, lots of messages from companies. Moped is just for people.
BSD wikipedia says. I thought it was linux too!

>>The native operating system of the PlayStation 3 is called CellOS, which is believed to be a branch from the FreeBSD project
Because two is not enough.
Have you checked out TimeOut http://www.dejal.com/timeout/
FYI the petition link is here https://petitions.whitehouse.gov/petition/fire-assistant-us-...

To me signing the petition is simply to let others know my attitude, and to let those who hold the same stand know that they are not alone.
The point of the analogy is that recovering and locating stolen property is the responsibility of law enforcement, not manufacturers & retailers.
Read The Fine Manual
Guess this answers my question :p
I wondering how much of this is comprised of auto-renewed subscriptions that people don't even realize they're paying for.
Samsung released a smart camera running Android. You might have enough influence to be able to partner with them.
SpaceX software engineers hosting a Reddit AMA starting at 10AM PT
This sounds like one of those "just-so" evolutionary stories without much evidence to back it up.
They also serve a very important function of reaffirming a belief you want to behave consistently with.
Git -r done
Amazon Coins: Jeff Bezos's 2013 Stimulus Bill For Kindle Fire App Developers
Your analysis of the first bug is correct.
I started on a TI-89, writing quizzes and quadratic equation solvers. When I got to college and found that other kids in the class had written racing games on theirs I felt like I was out of my depth - I can't imagine how the kids who'd never programmed felt.
So, what measures were taken?

The problem is not sending packets fast enough. It's not about bandwidth. The problem is sending them just fast enough, which is impossible if you're scanning statelessly with just ICMP echoes.

Let's say you're on a 100 mbit ethernet, your uplink is only 8 mbit. If you send packets at a rate of 10 mbits, packet loss will happen. And you're not the only one using the network either, so this can happen way earlier. And that's only the part of the network that you control. There might be a lot of hops between you and the host you're sending packets to. And with your approach (the way I understand it) you're not gonna notice packet loss.

I might make too many assumptions here, but ten hours is just too short of a time period for a network of that size for a reliable result. I'm very sceptical. But please prove me wrong, because it will def. make my job easier.

I guess you could publish the code, so I could test it myself.
How to make a blog go semi-viral
http://asserttrue.blogspot.com/2013/02/how-to-get-blog-to-go-semi-viral.html
Let's see how long that one stays open! :-)

From one of the answers:

"results indicate a significant improvement in time and lower visual effort with the underscore style. The interaction of Experience with Style indicates that novices benefit twice as much with respect to time, with the underscore style."

Having said what I said, I'll program in any language and abide by any convention if required. That's just what you have to do as a programmer. No issues there. If a client requires camelCase, so be it, it's not like it is crippling.

If I have the freedom to do so, I tend to be very pragmatic about my own projects. I don't subscribe to fads both in my personal life and in software development. Camel case and Hungarian notation are just fads that, when surfaced, may or may not survive the test of time. The second, for the most part, did not. We'll see what happens with Camel case. None of this crap is necessary to write good code, or code that is bug-free, or code that makes you money.

Life goes on. Those who love to camelCase, hey, it's OK, not the end of the world.
I think Soros is kind of glossing over his wartime history a bit there.
This is a 2008 project; Turk's marketplace was a bit different 5 years ago.

One problem with open marketplaces is that there's always someone who will do the work badly and unhappily, no matter how low you price it (usually a new or disgruntled entrant).
While we might all be disappointed that man has not left earth for the last 40 years, I am reasonably confident we will be able to get our act together within the next 9,119.

Reasonably.
The guy is also incredibly nice. I started using QEMU in 2003 and it was a huge relief in my work; so one of my colleague decided to send a "thank you" email to Bellard. Bellard replied very nicely on how happy he was that we found QEMU useful, and even gave us his phone number.
TPB AFK: Watch and Download The Pirate Bay Documentary NOW
Can Amazon somehow avoid taxes buy creating their own virtual coins?
To be fair, knowledge of everything else was also expanding dramatically... And the impact theory only really solidified in the 90s after they found the crater.
Newell reveals major PC flaw, the future business of games, and fear of Apple
You simply swap out all your memory. There's no technical difference between a hibernated page and a swapped out page - the only difference is that the OS normally prevents certain pages (e.g. kernel pages) from being swapped out to preserve performance.
Note: if you put in a time in hours higher than http://alrt.io/80063993375h
(such as http://alrt.io/80063993376h ), your timer may go off a second early, as it skips the first :59 on Mac OS X Safari/Chrome, going straight from :00 to :58.

I don't imagine this bug would cause much misfortune, though.
My Website is Responsive, Why Isn't Yours?
The bang for the buck is pretty good though.

Most people don't own an Atlas anymore. In the public consciousness Google Maps is the world map. If choice of map projection is important anywhere (which is debatable), it's important on Google Maps.

And remember: you can always fail over to Mercator.
I think you missed the point of this. Try again.
'Newry Maghaberry prisoner Stephen Murney: The reality of strip-searching'
she mentions 11k signatures but the current count is 2,737. What happened? Did they remove duplicates?
https://petitions.whitehouse.gov/petition/fire-assistant-us-...
Hopefully it's just growing pains. But transparency is critical for running a Bitcoin operation these days.