skysight-inc/HackerNews huggingface dataset:
GnuTLS certificate verification vulnerability announced (CVE-2014-0092)
The GnuTLS team has their announcement at http://www.gnutls.org/security.html#GNUTLS-SA-2014-2 but the announcement with details seems to be Red Hat's at https://rhn.redhat.com/errata/RHSA-2014-0247.html

"It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker."
The medical / pharma industry is not interested in cures for diseases; they only want lifelong treatments. True capitalists, seeking maximum profit.
Access to Facebook, that's only thing they really needed in Africa.
Do you think it would be a useful tool even for a more high tech (non dev) audience? Could you imagine a need for a quick and easy splash page in the next 12 months or would you just write the html and use your own web server?
My recommendation is to tackle ambitious projects as an open source programmer. Do things well beyond your comfort zone and expect to fail.

The fact is that you won't get better unless you actually fail and are introspective enough both to realize you did (there are programmers out there who never realize this and I have tried, unsuccessfully, to work with them). So pick something you aren't sure you can succeed at.

The second thing is to be evaluating your development challenges as you go, be introspective, and learn from them. Every development challenge is an opportunity to get better.

The third thing to do is to start reading about cracking software and start working on cracking your own software. If you can get others to crack your software, better yet. You will learn a lot about best practices from this.

The fourth thing to do is to try to work with teams of open source developers and learn from others. I have never learned anything from someone who always agreed with me, and a friend of mine is fond of saying, if a village has two wise men who always agree on everything, the village has one more wise man than it needs.
>Read a social sciences academic paper and see what I mean for a quick example.

I have actually done some graduate-level work in sociology and history, and the papers and books I read were mostly examples of very good statistical work and well-thought-out process analysis. You can put your STEM-master-race badge away.

>Beyond arithmetic, students have almost zero examples of why they should bother learning anything else.

When I say "for no reason," I don't mean "for no day-to-day practical reason." Playing with abstract concepts is and should be its own reward; that was the whole point of TFA. Mechanically memorizing how to take the derivatives of polynomials is neither a fun abstract concept nor a boring-but-necessary practical skill.

>If we can turn Mathematics education into a kind of "game", then fill in the details and formal bits as they age, they'll at least be able to relate to it even if they don't understand the application or relevancy.

"Gamification" as a cynical ploy to get kids to sit still long enough memorize their times tables may or may not work. But even if it does, it's only gotten them to play the game long enough to pass them to the next level; it has deliberately shifted their interest away from the joy of learning for its own sake. That is not what the article is about, and it's not helpful in the long run.

>Approaching it from this sense "two points make a line, we only have one point, so take the limit" is the method today and with all respect, it's been a terrible terrible failure...even if it is "correct".

No... no, it isn't. The approach today, for the majority of students, is to learn the bare basics so that you can plug them into an equation and find out what the marginal cost of widgets will be next year given a certain set of equations. And in any case, it comes so late that kids have been taught that "math" is something that actually is boring and useless.
Would be perfect for my raspberry pi.
Anyone tested?
PowaTag funding - $96M
As the article mentions, Windows revenues have been important to Microsoft's business for quite some time. It's hard to imagine how positively shareholders would react to this type of business decision.
If the text in your PDFs has enough structure (i.e. fixed field names or punctuation) then it should be possible to convert the PDF to text and then pass it to Zapier's parser.
I would think that even if it's boring time spent coding is going to be more beneficial than time spent parking cars. Is there a way to make it less stressful? Could you offer to take a pay cut to work from home and have more freedom?
The zen way - minimal code for a minimal lifestyle
Is implementation really about what you name the functions?

I thought naming functions was "programming style".

And implementation was about the math.

The quality of the latter being measured by profiling and performance.
On a related note, can someone suggest a good textbook optimal stopping?
> Am I the only one that would like to be able to setup a time range when it's allowed to use my bandwidth?

You can. After you setup a target open the Preferences window. Select the target therein and click the "Edit..." button.

The dialog that follows has an option to "Pause between [00:00] and [00:00]", where [00:00] is a drop-down which lets you pick the top of any hour of the day.
In fact, just because Meetup says a criminal says...
> Require FB auth.

This is an instant dealbreaker for me nowadays. I refuse to have a Facebook account for a number of reasons and know a couple of other people that are the same.

However, requiring FB auth may not make a large impact on the number of users registering for the service and/or users like me may not actually be within the range of users who would be interested in the service.

(Personally, I think it's a really nice idea. A bit of positive feedback can go a long way on some rough days.)

I'm actually more curious about how the site could handle multiple people with the same names, or users who don't really think about it and just put in "John" for the name.
Apple’s on a hiring spree in Asia & stealing HTC’s engineers
Why we should all learn a little Code – [Infographic]
What it looks to me like you kind of sort of have is a really basic brochure site service. I could definitely see this doing well with local clients and small businesses.

Looks like it would be ridiculously easy, too. If you can make some money on it than why not?
I am a non dev. I just tried the recipe provided by leobelle using the files provided in gist.github and it works fine. I had to change "matches" to use
"<all_urls>" though. -------------------
Now I get a popup whenever I start Chrome telling me to disable developer mode extensions -- how to get rid of that?
I hope that sometime in the near future, when everything has been locked-down so much in the name of security that the situation becomes the exact opposite, someone will write an article titled "Downloading Software Freely Is Nearly Impossible". Don't get me wrong, I think security is a good thing, but I also think there has to be a balance between that and freedom. One of the most secure places to live in is a prison.

As the saying goes, "Those who sacrifice freedom for security deserve neither."
A newly hatched baby bird and next 36 days
The section on experimental studies touches on it briefly, but it's important to note that costs involved in the selection process are not considered in the standard construction of the problem.

From wikipedia:

> In large part, this work has shown that people tend to stop searching too soon. This may be explained, at least in part, by the cost of evaluating candidates.

and then

> For example, when trying to decide at which gas station to stop for gas, people might not search enough before stopping. If true, then they would tend to pay more for gas than they might had they searched longer.

So you might pay more for gas if you don't use the optimal strategy, but waste more money in fuel costs searching for the cheaper price than you save buy purchasing at that price.

Perhaps most interestingly, there is a formulation of the problem that requires a decision to be made within a certain time period, from an unknown number of candidates who arrive over that time period. If you know (or can estimate) the arrival times of the candidates, you can use a very similar strategy to achieve optimal results.

Essentially, wait until you have seen 1/e of expected candidates in the time frame you have allowed for (based on the arrival density function you know or estimated) then pick the next best option.

This puts a limit on the amount of searching you do, and so provides an optimal strategy with a bounded limit on how long you search for; it provides a bound on the cost involved in the search assuming the cost is related to time taken.

In the searching for gas example, you could use this strategy if you knew roughly how often you pass a gas station, and how long you are willing to search for.
Help me reach 50 backers for a transhumanism writing project
I just launched a project with Beacon about the future of tech and human evolution. Somehow I have to find 50 backers in two weeks to get my writing project funded, and I thought some people here might be interested.

Alos, let me know if there are any topics in particular you'd like to see covered.
Epic Monday - Dressing up like a girl
Constant Task Switching
I built http://hubnotify.com for this exact purpose. Currently it works with GitHub, but I have a roadmap of BitBucket and package managers (npm, packagist, rubygems, etc) as well. It's a free service, hope it helps you.
Oh I insist.

"If they were, the persistence would be handled elsewhere."

Persistance is handled elsewhere, it's handled in the superclass. If you think that's not a good idea, you shouldn't be using ActiveRecord, because that's the way it works.

You could argue there's not enough abstraction from the DB in AR, but that's a different discussion. Here we discussed if the persistance callbacks were an appropriate tool for in the domain model, and I reckon they are.

Also, any fool knows that putting lots of code in a single file is not a good way of scaling complexity, so yeah at some point you're going to need to break your code out in concerns and what not. ActiveRecord most certainly does not stand in the way of that.
If you think this feature is cool, I would encourage you to take a look at my company: Taskflow.io

It's basically a visual drag-and-drop tool to automate business processes.

You can drag-and-drop many different actions together (including email) to automate and track many processes you organization might have.

I would love to hear your feedback as we are just getting off the ground.
> When you are 20 you are pretty much at the height of your mathematical abilities.

Is that really true?

There are many examples of people who came to mathematics late in life and did good things:

http://mathoverflow.net/questions/3591/mathematicians-who-we...

I think you only get better with time if you keep yourself sharp. What has changed for me is that I can't sit still and pound back Redbulls for six-hour coding sessions and then hit the gym. My process is also more methodical.

But mathematics is certainly one area I've only improved in with time.
What about needing to hire M candidates out of N applicants?
I've only been involved in a couple of Rails projects (at least since the wedding list management app I wrote for my own wedding back in the v1 days), I'm in complete agreement with David.

And honestly, Rails already has something that works beautifully for an “interactor” extraction. It's called ActiveModel. Add a bit of other code (include ActiveModel::ForbiddenAttributesProtection, ActiveModel::Validations::Callbacks, and ActiveModel::SerializerSupport; extend ActiveModel::Naming) and you've got an object that acts like an ActiveRecord object but orchestrates changes across multiple models in a clean, constructive way—without introducing an entirely different way of working with your code.

I've done this at both places I've been doing Rails and it works at both cleaning up the models it orchestrates and keeping the business logic in the places where it belongs. I'm working actively to get rid of some of the Rails Fads that have come through and wreaked havoc on the current codebase (we've got Presenters and Commands and all sorts of other stuff that is just making the code harder to understand with little value).

There's a million ways to skin this particular cat, and claiming that “adult” Rails needs this particular gem or that particular way of writing code says a lot more about the person claiming it than the people who aren't following that particular fad.
Here's the diff:

https://www.gitorious.org/gnutls/gnutls/commit/6aa26f78150cc...

Uninitialized "result" variable? Any time the code hits one of those "cleanup" gotos, it's probably returning nonzero unexpectedly?

Later: @filcab on Twitter points out the much dumber issue, which is that if issuer_version is < 0, the function returns issuer_version and not zero. Ow.

(Who uses GnuTLS?)
It sounds similar to what Lotus is trying to do.

http://lotusrb.org/
Mopidy is a fantastic piece of software. I once wrote a Node.js server to provide a public web interface to a single shared playlist, put it on a Pi, and hooked it up to an amplifier.

https://github.com/mplewis/accentor

I might come back to this project later—the docs are pretty lacking, but the software works!
How New York’s Fire Department Uses Data Mining
I remember, they also parsed my AirBnb reservation and rental car receipt from my email. They then showed it in Google Now on my mobile phone. However it wasn't very useful, they had some parsing error, iirc.
> Those 100 line functions wouldn't make it through any half decent code review.

True but I have worked on worse. The codebase we inherited from SQL-Ledger is quite a bit worse and was even more poorly commented when we forked (the only comments, aside from two lines describing the module, and copyright notices, were magic comments which if you delete things, stuff breaks).

And some of the modules were 4-5k lines with 1000-line functions. In a codebase of over 100k lines :-P. As we continue to pull out this logic, our codebase increases in functionality and decreases rather significantly in size.

Oh, and it was Perl which relied on sloppy global scoping and so you couldn't test it.

But hey, we are replacing the code at a pretty good clip.

What is really frustrating with the SQL-Ledger codebase (at least as of 2.6 and 2.8, I haven't looked at 3.0) though and is probably the case in the code you are linking to is that the developer had over 10 years of progress in this and still never seemed to manage to improve:

IS->post_invoice(\%myconfig, \%$form);

Really? That's like pass by reference to dereferenced reference, right?

It's one thing to write crappy software. It's quite another to write it for over a decade and never improve.
It's probably a subjective thing, like with font rendering using antialising/subpixel antialiasing. I personally can't stand "smooth" scrolling either, I'd describe it more as sluggish and blurry instead of snappy and sharp.
The best part of that post was right under the title..

"File under ego"
Securities and Exchange Commission

Is financial regulation important to you? Do you think the SEC could do a better job at it? If so, consider this an invitation to come help out and make algorithmic regulation a reality.

I’m part of the SEC’s Quantitative Analytics Unit (QAU) – a small team of engineers and quants embedded within the SEC’s examination process. We have a dual mandate:

(1) Support the examinations of financial institutions (go to interviews, analyze data, etc…)

(2) Develop tools to for our team, and the SEC at large, to use. These tools can either be for making #1 more efficient or for expanding the reach and capacity of the SEC.

Our first tool to be deployed, the National Exam Analytics Tool, is already in production [1] but we are just getting started & we’ve yet to begin the most interesting challenges.

If you’re a great engineer (or great at machine learning, we are hiring both) that wants a place to grow while making an impact on the public good, I'd love to hear from you at martinow [at] sec [dot] gov.

Title: Software Developer (Senior Science Advisor)

Salary Range: $112,124 - $191,913

Location: (preferred) New York City, San Francisco, or Boston.

Requirements: U.S. Citizens and Permanent Residents (Green Card holders).

What the QAU is like:

- The atmosphere is intellectual and collegial – somewhere between a startup and a research group.

- We take a FOSS approach to our projects and experimentation with new (and old) technology is encouraged.

More official posting: https://drive.google.com/file/d/0B4dtbFvkLjv2c0ZjM1hkVkp4Ql9...
"Google offers free OSes to computer and phone makers as a way of driving the use of its search engine and countless other web services, and now, Microsoft is at least experimenting with the idea of doing much the same thing. According to the report, its free operating system is known as Windows 8.1 With Bing. As the name implies, the OS is meant to feed the use of Microsoft’s own search engine, as well as other Microsoft cloud services and software applications."

That's not even the start of the problem with Microsoft OSes, from my perspective. I bought a Dell machine this month with great specs and Windows 8.1 on it. I Clonezilla'd the drives with Windows on them and paved over with Mint 16 because (1) it's less painful to maintain and (2) I can script the installation of software I need to develop with. I've done battle with UEFI once and now I have a system I like.

So Microsoft OSes are too expensive even if they were free. And I used MS DOS and Windows for 20 years before moving to Linux. No, something huge would have to happen before I go back, and free is not enough.
The standard API for POROs is Object (and Class, etc.). Standardizing a new API necessarily makes them no longer "plain".
I would probably pay $4 for a nice pre-made bootstrap theme (e.g., http://wrapbootstrap.com/preview/WB07T0755 ) and throw it up on one of the servers I have around.
Yeah, let's keep soldiers doing inhumane, abhorrent and traumatizing things... but at least let's give them cats.
Wrt imaginary numbers, just a thought: capacitance and inductance in an AC circuit.

I don't know what age group you're targeting but I found solving problems in this space gave me a great intuition for imaginary numbers; I found it quite interesting too. Heck, AC circuits are great real-world playgrounds for differential and integral equations - Laplace transforms too.

I've been fretting about how to help my kids get a better understanding of math for years. I've been bouncing between too simple and overly complicated for too long. :-(

I think I'm just going to mandate they spend some amount of time per week using Mathematica and going through some introductory book. At least they will taking baby steps in a direction better than youtube. Grumble...

So I've been fretting on which book. Any suggestions? Heh heh...
SAWS Scientific Application Web Server
I just got an Aeropress and it's very nice--smoothest coffee I've ever tasted. Slightly more fiddly preparation compared to a pour-over or press, but worth the effort.
This doesn't do the best job of matching. For example:

match text	aaaabcc
match text	aabbbbc
match text	aacc

I can just type 'a' and it will let me continue. While it's valid, I would assume the point is to match the entire string for each "match text".
"Dhalsim" from Streetfighter 2 crashes the Oscars
Notch was very free with his ideas. He'd often just propose them on Twitter. Sometimes he'd say that a certain feature would be in but later drop it because he thought it wouldn't be good. Also, the game has had a huge community since when it was relatively young and it has evolved in a specific direction (meaning people who started when it was new but expected a different end result were displeased). Notch also seems to have become somewhat bored with the game.

These things combined make some people upset with Notch. Apart from this, nothing really happened with Minecraft. It continues to be a highly successful game and frequently gets new features.

Nothing to be done about it, really. You can't please everyone.
Beware of credit-card hack affecting Chicago taxis, bank tells customers
Hey, wow, you’re right — I totally mixed them up. Now I feel silly.
It's the same price for ~72h retrieval...
As the Supreme Court looms, Justice Department backs broadcasters v. Aereo
On the other side if all possible edge cases break it may be time to rewrite your code.
It's difficult, but not impossible. My university has a spin-off company, which does parsing of documents. One thing that they do is parsing of CVs. You give it a pdf file of any CV in any format and it will convert that into a machine readable format. Obviously that requires domain knowledge, but it's possible.

I don't know how Zapier works, but it is possible that they do some kind of fuzzy matching, that is robust to those things.
The high-tech ‘RFID flat-chip’ tattoo that could replace ALL your passwords
I would prefer flashing or changing colour (slowly); it gets my attention in a rather less irritating way than movement.
Ok, but you hardly represent a majority of the Windows user base. Few people care about scripting installations.
Concerns are just a complicated way of putting lots of code in a single class. The interface is the same if you put everything in the same file or if you break it out into a dozen mixins/concerns.
I find his experience is very fulfilling. In the beginning he had fun times doing stuff which actually delivered some results. Probably gradually became aware of wrong chooses he made and discovered architect side of coding... I kinda feel this is a way to learn it. I think you need this excitement of fast moving to keep engaged - it is hacker part of coding. When you are young it is okey to try something, may be break something and move on.

... Or may be I think like that only because I can see myself almost in every single line author posted :)
Perhaps the free software movement and wisdom of the crowds phenomena such as wikipedia are a counterpoint? While both have big players with more influence, it's not a zero sum game as there is room for people to work on long tail stuff.
Any HNer have any context on this?
As always, we're very happy to see that in addition to S3/Glacier/DreamCloudStartupOfTheWeek, Arq supports plain old SFTP.

This means that, of course, it works perfectly with rsync.net and that we have yet another chance to offer the HN readers discount, which you may email us to find out about.
Windows for many years has given out hundreds of millions of copies for free by intentionally limiting the strength of their DRM and licensing enforcement. This makes perfect competitive sense.
Reminds me of his auditing "joke":
http://www.youtube.com/watch_popup?v=GhQHeQy-xQI

And his predator "joke":
http://www.youtube.com/watch_popup?v=52JVljZW_cw

Par for the Presidential course really.
http://www.youtube.com/watch_popup?v=f_tFKa2_YBQ