skysight-inc/HackerNews huggingface dataset:
As an SMS replacement that doesn't seem too bad - SMS's themselves are frequently delayed - I've had SMS's delivered more than a day late.
This is awesome! You help other startups and are able to get exposure for them (and yourself) at the same time. I sent mt email and hope to share my experiences with you as well.
This affects every single application using TLS, even when sandboxed. Is that more, or less, exploitable?

How many angels fit on a head of a pin?
Not quite.
iphone enforces sig verification on write to the flash.
A modern iPhone does not allow arbitrary base flash images to be written. Modern Jailbreak relies on kernel and user mode exploitation.
Server auth bypass on SecureTransport TLS cannot lead to RCE via trojanized updates.
The Gen Y approach doesn't apply to many professions,and fewer that pay well. Programming is one of the few, along with athletics and entertainment.
Read closely and you'll see the answers in the link:

Yes. "it is possible to inject some environment
variables into gerve"

Because it's his git hub username. You answered that question yourself:

"And what username is being set - ssh? github account? wouldn't you need to use exactly the username 'git' when ssh'ing in to github to trigger this gerve app anyways?"

So if it's not his ssh username it must be his... 'github username'! it's the only other possibility you could think of right?

...
The iPhone cable that's always with you
From what I remember they were arrogant in the beginning, but in the end they admitted their flaws and fixed them?
This bug of an extra duplicate line looks like a merge issue to me.
Sorry I don't know why this happens, but as far as I can tell they do increment the nightlies (usually a couple weeks after a new Firefox version). I don't know why the version on the plugins site is so out of date though, you'd have to ask one of the developers (irc.oftc.net #pentadactyl).
Join Firebase as a Senior Database Engineer
Do you want to make the process of building, deploying, and operating modern cloud applications radically easier? Join us and change the way software is built. We (Firebase — YC S11) are hiring a senior database engineer in SF.

At Firebase, we're completely reinventing the database. Every database to date has been built using a request / response paradigm, and it has been intended for use only between servers on a local network. Firebase is different. It's built to be accessed directly from client devices, and it uses a real-time synchronization approach that makes building modern applications radically easier. Firebase-powered apps can be written in a fraction of the time, require only client-side code, update in real-time out-of-the-box, and scale automatically.

Over 500,000 devices are connected to Firebase's servers at any given time, and 10s of millions of users use a Firebase-powered app every day.

Our team is serious about computer science as a discipline -- we have folks hailing from Mozilla, Google, Microsoft, Twitter, HP, Adobe, Akamai, and Adroll -- but WE NEED YOU to take Firebase to the next level. We tackle some of the hardest problems in computer science every day: large distributed systems, data merging and conflict resolution, data security, language design, high performance networking, index generation, etc.

If you've previously worked on the internals of databases and you're looking for your next challenge, please drop us an email at jobs@firebase.com.

You can see more about our open positions here: https://www.firebase.com/jobs.html
3D Print Canal House
Did you paste the wrong link? Because that link has nothing to do with continuous integration or nightly builds.
What an awesome app! Few things I missed:
1. Chromecast support.
2. Navigation back/forward?
Is't more like the price you pay for getting to hook up with groupies the rest of your life.
You're the one claiming there's a huge body of research disproving his claims. Your link upthread points to stuff that supports his argument and other stuff that counts as weak evidence against. Nowhere is there anything remotely like disproof. You can also find evidence (e.g. in http://cmdept.unl.edu/drb/Reading/overtime2.htm from the link above) that how you structure your work and rest periods can improve your production. After all, somebody doing office work 60 hours a week with some regular exercise is probably going to outperform somebody like me, who's fat and doesn't exercise. I certainly outperform myself on days that I walk to the office instead of driving. There's clearly some variance involved in individual employees' age, health, height, diet, and attitude, so it should be obvious that you can't just talk about averages over the construction industry and apply them to programming, and to all programmers, with the degree of certainty that you hold.
This Is What's Happening in Venezuela Right Now
I agree with the concept - people cling to bad ideas like they cling to a safety blanket as a kid - BUT - bad ideas can be turned into good ideas if the right parameters are changed. Most ideas aren't "bad" their just poorly executed.

Same thing with the women / man whore wording. A whore of a man(idea) (and I'll use man as I'm a man) can be turned into a good man if the right women (parameters / resources) presents itself. I know a few man whores and once they met the right women, they cleaned up nicely...
If you're going to inexplicably speak directly to the author, and then do so by their first name, at least get the spelling right.
I'm an expat with a relatively large number of stamps on my passport, and I have loads of trouble anytime I try to open a new bank account or do anything remotely 'weird' with international banking.
White hats to the rescue
How raising too much capital can cost you a lucrative exit
Where's the commit that introduced the extra goto? I haven't seen it yet.
In what sense? DMPs are doing fine in online advertising.
Legalizing marijuana won't get rid of drug cartels.
The example provided was an arbitrary code execution in the same TLS library.

Tptacek isnt saying the issue isn't serious, it quite self evidently is, simply that other issues that appear regularly are also of equal or greater exploitability, and this being the bug that gave the NSA the keys to the kingdom is unlikely.
this type of story seems to appear over and over again, i don't know much about facebook advertising, but with so many stories of fake account clicks i would expect facebook to comment at least once on the subject
The second half (or third third?) of that quote states:

> And just as critically, do you step back and stop leading, do you let someone else? Because what’s critical to be an effective leader in this environment is you have to be willing to relinquish power.

Which I think is what the author is trying to focus on. Traditional leadership would be making the decisions and taking risks because it's expected and people are asking you "Hey, what do we do?". Emergent leadership would then be making decisions and taking risks because it needs to happen or equally importantly acknowledging that someone else is more capable of doing so. I would bet that in the interview process they'd focus on the story and trying to determine how you make the decision to either ignore the chain of command or otherwise exert influence on it.

Like you said, that definitely selects more for storytelling skills than leadership skills, but in absence of other more accurate metrics I think that's still better than looking for "President of Chess Club" on a resume.

Unrelated, I'd love to read those narratives. While I can't speak for the community, I feel interviewing is a very hard thing to get right and knowing more about how other people do it AND experience it is important to getting better. Nothing < anecdotes < more anecdotes < data?
11 Ways to Think Outside the Box
It could be depression. Google "depression test" to give you an idea about it's symptoms. If you think you've got depression, get medical help ASAP. There are some treatments that can make a big difference in your quality of life.
> Err, no - MSBuild, is basically a clone of Ant, except that it is meant to be generated by Visual Studio. This is completely backwards from what happens in say Java/Scala with Maven, SBT or Gradle.

MSBuild does not require Visual Studio

> The advantage of having the build process external, as happens with Maven and Maven-like environments, is that you can easily automate things by writing plugins, plus you're not tied to the IDE at all. You need to push your artifacts into a repository? There's a plugin for that. You need to sign your artifacts with a PGP key? There's a plugin for that. You need to automatically increment the version number on releases? There's a plugin for that. Etc, etc... and all of these can be used in continuos integration processes.

The equivalent of plugins for MSBuild is Tasks

> Plus, MSBuild doesn't handle dependency management, which is completely retarded. You've got NuGet now, but again, Microsoft had to over-engineer it, to make it IDE friendly and thus the ease of setting up your own Maven repository is gone.

Yes it does via NuGet, and again NuGet has no dependency on the IDE

> And have you tried building MSBuild projects on top of Mono? Try it. It's fun ;-)

Yes I have, what's your point?

> Basically only a .NET developer that never experienced other environments could claim that MSBuild/VS.NET is satisfactory, but for the rest of us, it's like trying to do software development with early-2000 tools and IMHO, that's where the entire .NET ecosystem is.

Thanks for the personal and professional attack at the end there, nice touch
The article notes that it's possible pot purchases may cut into beer purchases. To a certain extent I think that may happen, but I'm pretty sure there are a lot of people like myself, who smoke a LOT more marijuana than they drink alcohol. I suspect there's a lot more revenue to come from legalizing than there is to lose from people choosing weed over beer.
>So you took a game that used to take a few dozen KB of memory and an 8-bit CPU running at less than 2MHz, and turned it into one requiring many orders of magnitude more memory and CPU speed?

That's what I thought too.

Not sure why it's getting as much attention. Maybe because it's the combination of Python and Super Mario. A very popular language combined with a very popular game and a breeze of nostalgia.

However it's a fun little project but being on the HN frontpage is a little too much attention for something like that.
> do something so incredibly stupid in its most critical security stack.

I disagree. We are human. We are not divine. We do stupid things and we can write stupid infinite loop or off-by-1 and the bug will live for a decade. I am sure you have written a program which can be easily exploited and you know that it is such a trivial bug.
Well we share a ton of interests, have an extremely long common history, his humor isn't too terribly far from my own (I laugh more than he does, but then he'll surprise me and enjoy some extremely low-brow stuff), and most of all we put up with each other's quirks/bullshit without too much hassle.
Good points. Could it simply be that someone working on this code at apple have had their computer backdoored, and the attacker snuck in the double goto in their working source dir, just waiting for it to be picked up on the next commit?

I remember reading an article some time ago how facebook played out this exact scenario, even going to such lengths as acquiring a 0day to keep the simulation even more real.
Ask HN: How does Knock to unlock work?
It's been bothering me for a few weeks now: how does Knock to unlock app work on the OS X side?

I read about authorization plugins like this NameAndPassword example: https://developer.apple.com/library/mac/samplecode/NameAndPassword/Introduction/Intro.html

After I managed to build and install it (which wasn't so easy: http://stackoverflow.com/questions/21582995/custom-login-lock-screen-in-os-x-mavericks) it won't log me in (more discussion here: http://stackoverflow.com/questions/21056322/customize-login-screen-mac-osx-sfauthorizationpluginview#comment33224960_21056322). With this happening and the documentation with examples being outdated, I think it's not the proper way to modify the lock screen today. Also, I guess it only works on the login/fast-user-switch screen, but not on the wake from sleep one. So basically my question is: how exactly does Knock modify the lock screen, and how is it possible to recreate this behavior with some other plugin? (I'm currently working on something like fingerprint scanner)

One user on SO wrote about some login agents: http://stackoverflow.com/a/21835312/2113110 - I've tried pre login agents, but I guess it's not the same thing.
And is cheaper and less people go to prison for Prohibition like laws.
One weird PDF trick
From the article:

> NSA itself planted it surreptitiously.

> Apple, complicit with the NSA, added it.

Neither seems very likely given how visible the goto is. Something just a little more subtle like a semicolon at the end of the if() clause might look better.

Of course given how glaring it is, it could be a case of plausible deniability: would we do something to stupid, so unsubtle.
It's "tasteful" porn. Passionate, intimate etc. X-art and Joymii produce a lot of them.
Did you research him before writing this comment? :3
Man what a great title
The problem with this approach is most interviewers are not willing to be convinced that they are wrong. I've had a high-level engineer from Apple argue fervently in an interview that the Boyer-Moore string search algorithm 'can't possibly work' and a high-level engineer from Google argue fervently that linked lists are superior to arrays (despite me clearly explaining the problems with pointer-chasing and locality).

Some interviewers just come in with their own preconceptions and outdated/incomplete information, and I very rarely encounter interviewers that actually appreciate learning something new from a candidate. They do exist, but in practice you're better off just shutting up and waiting for them to move on. Pretending to agree doesn't help anyone, of course.
As outsiders we can't see commits, but the next best thing is a diff between the public source code releases: https://gist.github.com/alexyakoubian/9151610/revisions
Why even title a post on a blog if it conveys zero information?
> the option in IExplorer doesn't work.

That's very odd, just tested on my lumia with Google set as default and it searched using google in IE. Not being able to set the search provider for the search button does annoy me a bit though.
Code execution requires active compromise of target hosts. MITM'ing on the NSA scale can be done without risking any noticeable intrusion on the target hosts.

So what's "greater"?
Yes, the programmer is only human. But the vp of engineering should have had a budget and process that would not let this slip through.
> That's why modern languages are copying JavaScript's killer features, like anonymous functions and closures.

LOOOL. You're joking, right? On which planet do you live?
Line 631 in the second column for anyone wondering.
26 hours for 26 startups... Gets 26 hours each or 1 hour per startup? Because if it's the later, I don't see how they could code together in 60 minutes... I mean even you are Linus Torvalds it takes some time to read the code-base if your project is not vapor-ware.
"I've had enough Fords as rental cars to know that that software is utter garbage" Same here. Last one I rented, I really, really struggled just to tune to a radio station. I eventually got it tuned but several minutes later it decided to change all on its own. I never got it tuned again in the two days I had the car.
Then again… Why didn't you ship all your hotfixes to everyone?
No I don't think that works. Many people buy lottery tickets and really think they are going to win. Movie tickets to entice people with false hopes of riches. They also don't involve gambling addiction.
When we interviewed for the current cohort, we were asked to show up early for the interview, so I travelled to Mountain View each of the 6 interview days to talk to other startups. As a canuck in the valley for the first time, it was an eye-opening experience.

It's really interesting to hear what everyone is working on, and it's a rare look at the YC investment thesis. Also interesting to see what these companies have gone on to achieve, YC or not. I was most inspired by the stories of everyone who had travelled from foreign countries to pitch.
Even you really believe that, you should have the decency to express your feeling in a polite way.
I guess you should define your key objectives to reach your goal and start to measure them in daily basis..
I have interviewed with Google before and I'm currently going through the process of getting an internship with them. Let me tell you I've had very disparate and different experiences in these months.

I was contacted exactly one year ago for a fulltime position and my contact/recruiter was really excellent, very friendly, helpful and informal, we also talked a lot about non-Google related stuff, a definite great guy. Then I was moved to onsite interviews and I failed.

Fast forward to last October, I was contacted for an internship, I said I was interested and the recruiter said my application was forwarded. I never heard from them again (even after pinging the guy again). Then I talked to an engineer at Google and I was told that since I had already done the required interviews with them a year before (I failed for fulltime but they apparently qualified me for internship), I didn't have to do them again so the process should have been faster.

With that in mind I managed to get in touch with another recruiter and explained my situation, she decided to give me a chance and we had a phone screening (although it shouldn't have been necessary, but no big deal). After that she told me I'd have to go through all the interviews again although that's not what I was told. She passed on my application and nobody contacted me again.

That was beginning of January. I pinged her a few weeks ago and luckily I was told that my application had been magically forwarded to another recruiter again (aka she forgot, probably). This time I was told that I qualified to skip the interviews so now I'm at a later stage (project matching for internship) so I can't complain, although I was told there's not much choice because I am "applying late" even though it's been going since October.

Tl;dr - it really depends on the recruiter, it's a shame because that can really reflect negatively on the whole company.

Ps: sorry for the lengthy post, I needed to vent
Other metrics reporting ~100-150k vs Facebook reporting 600k+ clicks seems well beyond the level of error that would be produced by not tracking things in the exact same way.

Coincidentally, FB metrics reporting 2-5x what the target site's metrics show would be very easily explained by bots generating traffic to FB's servers without actually redirecting over to the target site...
So even though this bug is easy to exploit and deployed on hundreds of millions of devices, it's not a big deal because it doesn't give you root?
Ok I'll bite.

I interviewed with Google about 2 years ago. First technical phone interview, the guy sounds really grumpy and irritated, and starts off with "I see that you have a Master's in CS. Are you an expert?". I replied something to the effect of "well I think it'd be pretentious for me to call myself an expert, I like to let my work speak for itself.". He responded "well we only hire experts at google".

The interview went downhill from there; several times he told me my solution to his question was incorrect, and I stepped through the code with him and showed him that he was mistaken and my solution was valid. He was just super grumpy the whole time.

Who knows, maybe my name reminded me of his ex wife or something. Regardless, it was a terrible experience.

I don't think that I sucked that hard because 2 weeks later I interviewed with apple, made it all the way to the onsite, and their questions felt harder. Their process was much more pleasant and efficient overall.
I attended one of Jim's many presentations, came to know that he created Rake. RIP.
I am not sure if such post has any value to add to our current state of affair. If this is not the bug they use to exploit iOS users, there are other bugs. So what is the point of this article? Are we going to do a witch hunt and blame the developers who either overlooked at the diff, or the developer who happened to be an NSA mule?

I get it. NSA is behind everything. And at the end of the article, OP says "[so] if this bug, now closed,2 is not what the NSA was exploiting, it means there might exist some other vulnerability that remains open." So why are we writing this article if there are other bugs?

Okay. I will give the credit and think about it: anyone could be NSA mule. Anyone can contribute to your OSS and inject some clever code into your OSS codebase. And we usually overlook security and just accept anyone's PR as long as the code makes sense. Yeah, think about someone cleverly injecting a line into your docker release or your openstack release last month.

So, the point is: be alert? Be aware of spy everywhere? This reminds me of a scene in movie Eden. Bob, the corrupted federal Marshall, who was actually a PIMP, once said to other marshals: "So who are you [looking for human trafficking mules] looking for? The answer is everyone."

Hence, the main point is: trust is destroyed.
Titles are required for nearly all blogging software.
Are you under the impression that attempts to cut education budgets, especially direct ones, always fail?
I question your code comprehension. This is not easy to test for at all, and Chrome doesn't do it either. Do you understand how to exploit this issue?
As a current student, I don't buy what they're saying one bit. If this is the case, why do they ask for your GPA when you apply online for a programming role? More anecdotally, everyone I know who made it to the interview process had a stellar GPA. Most were members of the CS honor society on campus.

I don't have any hard proof, but it's clear to me that at least for new hires, GPA is a big requirement for Google.
It could have been merge between public releases.

My money would be on a copy & paste error, but there is no more evidence for that than the merge error theory.
I think he's referring to app updates, not iOS updates. Also, desktop Mac OS X.
Comodo support Down
Bitcoinbuilder Mtgox and all the forgotten hopes
Pretty yak-shavy. Looks like some symbols were renamed and many of the APIs were (probably pointlessly) mutated. In total, unreviewable.

But as you say, this may not have been the internal diff seen by someone at Apple. They may have seen individual, focussed patches that did single things like changing from the 2-argument to the 1-argument SSLFreeBuffer, another patch for changing selectedCipherSpec to selectedCipherSpecParams (hello, yak shaving), renaming noErr to errSecSuccess, and so forth.

The question is, in any of those changes, the extra "goto fail;" line would have stuck out as irrelevant. In a gigantic 500-line delta the reviewer's eyes may have been glazed over by the time they got to that one.

Assuming anyone reviews code at Apple, of course.
Benedict Evans InContext Keynote
What is your concern exactly? If it's privacy, from state level organizations like NSA you shouldn't be using mainstream IMs anyway. If it's just Zuckerberg then Telegram is fine and WhatsUp is not (anymore). If it's none of the above, then you're fine.
For anyone having trouble to run this on OS X Mavericks, you need this pygame binary:

http://www.pygame.org/ftp/pygame-1.9.2pre-py2.7-macosx10.7.m...
https://github.com/justinmeister/Mario-Level-1/blob/master/d...
Line 134 & 135.
Lol?
Hey,
which is the right way to respond to you. Because I am hereby reaching out.
Public Service Announcement from SNAPCHAT (Video)(NSFW)