skysight-inc/HackerNews huggingface dataset:
I am not fully convinced. Parents try to influence peer groups (by choosing schools and neighborhoods), and no matter what role genetics play, you still want the best outcome the genes allow. Luck is of course a big factor.

I am not advocating "genius training" because I am not sure what it does to the kids. But if they enjoy it, why not.
Also glanced at the load_from_v1 code.

I can't argue with the "deprecated code" bit – if you never need to understand or edit that code again, by all means leave it. There will be no payoff for spending time reducing the complexity.

But "splitting into multiple methods only complicates the logic flow" sounds less like Code Climate being wrong and more like you not having found good refactoring techniques, maybe.

I see several things that I think have a good chance of helping readability: extracting the whole thing to an object, then replacing the inline error handling with an error handling method ("begin" is a smell), extracting (and naming) whatever happens on each iteration of the "data" and so on.
I'm a firm believer in regression tests for complex systems. Sure, this specific case is extremely unlikely to come up again, but in general, it's always good to have that coverage, especially if a large refactor happens later on.
The fact that they want 50% off the bat should tell you something already, don't walk run away! I am really surprised that the people running this would actually put the pics & bios on the about page. This is daylight robbery and shameful. If i had to give half my company away for 100k at inception i rather not start it because you are going to need follow on financing. YC only takes like 6 or 7% and is way more prestigious.
I like what Whisper is doing, and deeply respect the crypto talent that went into building it. Personally, I think the soundness of the cryptography is the most important attribute of a cryptographically secure chat application. Other people think other things.
With that said, the fact that he rips NSA doesn't mean he (or his alter ego) supports Snowden: http://news.cnet.com/8301-1009_3-57619771-83/colbert-turns-h...
It's funny. Their login has:
"We use some data from your facebook account to make sure you're a human, not a robot."

My facebook account is a robot account. It's completely automated. I never log in.

Jokes on them, I guess.

(i know I'm hell-banned, but frankly, the discussion among hell-banned accounts is more interesting than normal yc accounts.)
Aereo isn't retransmitting to the public though, it's allowing you the ability to remotely deploy an antenna in a place where reception is good, and forwarding that signal onto you.
I don't think you can do that. You can not cash out the $100k you just got as investment, it goes into company's account and remains under company's control. With 50% you not only give up equity, but even control. I believe this accelerator may also ask for multiple board seats. The investor here will have the biggest stake and control of the company.
I spent a few minutes replying to your original comment, then you ninja edited in the closing paragraph and invalidated mine, so this is where I end the conversation. I can't reply to an ever-shifting comment with someone who reads what they want to read out of my comments and invokes the NSA for no reason whatsoever.
Terrible.

Just for reference, Kima15 offers $150,000 for 15%.

www.kima15.com
I had the recent disdain of discovering that one of the restrooms at the Louvre museum cost 2 EUR to use. Yeah. This trend should probably die.
Please expound on why you believe Apache 'maybe should' use gnuTLS.
With all due respect I must say that I find that you underestimate how much tests help.

If I implement a network protocol I will make sure to write automated test involving clients and servers. Setting this up on localhost or on a virtual network using TUN/TAP is not that hard. And this has made me find TONS of bug ahead of time.

I hear a lot of arguments as to why testing networked or otherwise distributed things isn't necessary. But just look at Aphyrs complete destruction of well-known distributed systems by using realistic testing.

And don't claim that the kernel network stack isn't tested. It's just tested by hand. Plus, there are projects like autotest. Without testing, I don't think there's any chance that the kernel devs could release any more versions.

Safe languages, formal verification, using proven methodologies and testing are all separate methods of improving code quality. But I don't believe any one precludes the other.

I'll end with a famous quote from Knuth: "Beware of bugs in the above code; I have only proved it correct, not tried it."
Possibly - I wouldn't say my driving patterns are that unusual and I live in a small European country and I wouldn't buy a car that didn't have at least a 450 mile range and I know people (particularly in Germany) who make much longer trips very regularly and who have specifically purchased cars with very high ranges.
Thanks (also thanks to mbesto)!
KitKat hits 2.5% adoption, Jelly Bean 62%, a third still on ICS or Gingerbread
Something can be open source and used commercially. Apparently this bug was found via an audit by RedHat, which obviously is a commercial company that uses GnuTLS.

Don't mistake me as a zealot, though. There is a place for open source and there is a place for closed source. AFAIK, that is also ESR's point, and why he broke ranks with Stallman, who claims that closed source is evil.
"Ms. VALENTINA COSTINA: (Through translator) We are forced to be Ukrainian. I haven't learned the language and I don't want to. I am a Russian. Maybe Russia will take us back somehow."
> It takes discipline to program at a lower level, and understanding.

Why don't we train developers for this instead of constantly telling them they need to learn flash-in-the-pan-framework.js?
What is software if not math executed on a computer?
Vigo - San Francisco, CA

We're Vigo, a wearable device startup building devices to help you stay alert and nudge you when you're drowsy. We just completed a successful Kickstarter campaign: http://kck.st/Jz1Y75. We're looking for the following types of people to join our team:

- Full-stack software engineers to build our iOS/Android/Google Glass/Web platforms using Java, Android SDK, iOS
- Firmware engineers with experience in C/C++ development (we use ARM)
- Electrical engineers with experience in digital circuits design and signal processing
- Data scientists with experience in machine learning and statistics, to work on and refine our drowsiness detection algorithm using Matlab, R
- Designers with experience in app design, interaction design or product design using CAD

We're located in downtown San Francisco and provide free drinks and snacks plus all the other startup benefits you would expect. We're looking for full-time and part-time/interns too. If you're interested, please send an email to jobs@wearvigo.com. Thanks!
This is true if companies are allowed to externalize costs. Down the line, however, someone's gotta pay the externalities. Usually the future generation. One can delay this, but it will catchup eventually. One manifestation is borrowing assets from an unrealizable future.

This is not to say local loops are externality free, but I conjecture they are more information-efficient and likely to get corrected quicker.
Luckily for us hackers, since they use wifi any computer can be that hub. Just give them static IP leases on your router so you don't have to re-discover them after a power/network outage.
I find substituting "compatible with" for "runs on" to actually be less informative and confusing. The title is fine as it properly informs someone what platform a piece of software runs on.
What's necessary is to get at least two experienced cryptographers thinking about every piece of security-critical code, because that's what will prevent bugs. It's also why security audits are so expensive: they work.

The code absolutely should have had clearer comments, since if every step were commented then some of the return value confusion may have been avoided. The style of the code itself probably isn't as terrible as it seems at first glance, though.

It's also not easy to write useful unit tests for a security stack.
Isn't that a coincidence. I just discovered the service about a week ago. I'm toying with it. I'm also discovering Gammu and Asterisk and trying to figure out what to do with all of this.

My major issue is that I'd like to use USSD or Premium Messages, but I'm afraid I might be forced dealing with mobile carriers for this (knowing that they'd never accept the service I'm proposing, because it's against their rigid philosophy).

I figured another way, but for a slight increase in costs. I'm figuring out how I'd use all these things to make what I'm trying to do.
I think what parent means is mini vacation while you figure out your next move, but I am sure tongue in cheek. Seems like a waste of money and time all around.

This loan shark territory.
Poor hinting on Windows 7 / Chrome. The lowercase L is an especially noticeable 2px middle-grey line.
yes, but then you hire a specialist at building ovens and tailor it to your bread.
Paid for with Afghan Heroin.
This is just a nasty and unjust way to bring down ESR, whose intellectual contributions are valuable.

I don't personally know Theo De Raadt but if he spends his time bringing down other people, he's probably not a very happy person himself.
Cat cafe's seem all the rage these days:

http://en.wikipedia.org/wiki/Cat_caf%C3%A9
YC gets you access, the money is for burritos and new macs.
I think that's unfair - both text secure and cryptocat are interested in making secure chat more accessible.

Making security applications accessible is an important problem to try and solve. Security is difficult and I think they were fairly up front with the potential issues with what they were building.

They've also been doing it for a few years now, the code is open source, they've had professional security audits - what more could they possibly be doing?
I'm having trouble understanding the concept. Can you explain it in familiar language?
It's definitely not a rocket science to have the test examples with the crafted certificates that are not supposed to pass the tests and to have such tests run at every build.

Most CPAN Perl modules for almost two decades have such tests for much less critical stuff. There's no excuse for not having such methods for security critical code.

Tptacek is muddying the waters by claiming it's hard. It's not. We have more different implementations of the same protocols so it's even easier to cross-verify.
I love Open Sans and use it as my default font for everything, but... I may soon be trying out this Clear Sans.
Yep. They would. Snowden should be using PGP on an air-gapped machine inside a faraday cage, right? This isn't for him. This is for the rest of us that are at most mildly interesting but don't want to give in to the surveillance state, or just want to send a password without blindly and completely trusting at least one third party. Isn't such a mid-security but easy to use solution valuable? The more PGP-armored messages there are (even if they could be broken with effort), the less suspicious any such use of crypto can be considered.
Yes. For others:

1) consider installing the "unattended-upgrades" tool, to install security updates via cron. https://help.ubuntu.com/community/AutomaticSecurityUpdates

2) specific Ubuntu Security Notice on GnuTLS: http://www.ubuntu.com/usn/usn-2121-1/

3) List specific package affected:

dpkg-query -W libgnutls*

libgnutls-openssl27:amd64	2.12.23-1ubuntu4
libgnutls26:amd64	2.12.23-1ubuntu4

I'm on Linux Mint, and the above seem to show that I'm protected. Yay!
> The effects of LSD in freeing peoples minds or somehow waking them up to reality are exaggerated IMHO.
> I mean, do you need LSD to know the government is wasting your money and making insane legislation?

Nice red herring.

Indeed, you do not need to take LSD to know that the government is wasting money and making insane legislation. It's really pretty obvious and in the midst of a breakthrough LSD trip, you would probably find this to be a trifling, utterly irrelevant matter, and wouldn't waste too much time thinking about it.

The effects of LSD on freeing people's minds lie elsewhere, not in making people aware of the governmental abuses of power.
How do you handle deployments when your URL handling is in Apache? Do you deploy the Apache config at the same time as your code?

Seems messy to say the least.
This. $100k won't even get you two decent programmers for a year.
The goal was not to convince anyone that they needed to use a web framework. Rather, I hoped to explain to novices exactly what a web framework is and what problems it solves.
Join Homejoy's growing data science team 
We're hiring Data Scientists!

Homejoy is a fast growing technology platform revolutionizing the client and service provider experience. We use our platform to provide our clients with on-demand, high quality home services, starting with residential cleaning, at a fraction of the cost of our competitors. In our first year we expanded to more than 30 cities throughout the US and Canada - covering over 100m households. We've delivered double-digit revenue growth every single month, and every new market's growth tracks faster than our first benchmark market.

We're also focused on making homes happier. This includes happy clients and enabling the independent cleaning professionals on our platform the tools to grow their business. This also includes volunteer time and projects by our employees. The Homejoy Foundation takes this one step further through grants for the communities we serve.

We are backed by some of Silicon Valley's best investors — including Google Ventures, Redpoint Ventures, Y Combinator, Andreessen Horowitz, Max Levchin, Paul Buchheit and others.

What does the data scientist do?

You are expected to aggressively mine our vast customer, cleaner, and appointment data, form hypotheses, spar with and win over your peers, deploy tests, and drive metrics every day. You have, at your disposal, millions of data points and dollars -- and millions of households to reach.

Specifically,

Grow our service provider base by identifying and improving recruiting and retention drivers
Improve service reliability & quality by identifying the underlying drivers of issues

Here's what we're looking for:

* 2+ years experience as a Data Scientist
* Proven track record of setting up large data sets, performing statistical analysis, and presenting results
* Experience with statistical software packages and programing environments
* Bachelors in CS, math or science from a top tier school

Bonus points:

* Language and environment fluency: Google App Engine & Python; R or Matlab
* Experienced a Homejoy cleaning and already know how we work as a client

Awesome benefits:

* Very competitive pay, serious equity
* Health insurance (medical, dental, vision), 401K
* New machine and other needed hardware
* Daily catered breakfast, lunch and dinner, plus a break room fully stocked with snacks 24/7!
* Transit pass
* Weekly personal group trainer to help stay fit and healthy
* Fun team outings, including sporting events, happy hours, bowling competitions, BBQ’s and pizza parties
* Relocation expenses (if outside of the Bay Area)
* Relaxed working environment; we won’t judge if you want to come to work in your jammies!
Romain Brasier's 404 page
The comments you perceive to be nastily and unjustly bringing down ESR are presumably being made by people who do not agree with you about the value of his intellectual contributions. In fact, those comments are directly rebutting his best-known intellectual contribution. So your objection begs the question.
Cryptography is uniquely difficult to audit precisely because it is encrypted. It requires more effort to tell what an application is doing if all its input/output are completely incompressible.

Maybe cryptography should be handled exclusively by the OS. Software would communicate through a protocol that can be easily audited (like normal http with special headers). Firewalls could be used to verify what is going on and normal tools could be used to inspect the data. That kind of checking is essential and doesn't require the talent needed for code review.
If you're wondering why there's no information regarding this thing, it seems to be in relation to his appearance at SXSW. I'll only assume that this would make sense if you were actually at the event.
If you download it, the license file is in the root of the zip archive.
I got the impression they were just walking and talking to each other.
Skipping a grade is rare, but it might just save the world
Sorry, seems like Disqus was serving up spammy ads along with the comments. I've disabled the ads.
This is bullshit. You can write tests for TLS libraries just fine. And yes, I'm saying that without ever doing any programming of TLS libraries (just using them).

For certificate verification, you craft various correct and incorrect certificates to cover the various scenarios involved in certificate verification.

For communication related code, you talk to the tested code over TCP or internally as a transport layer implementation (assuming the TLS library supports user defined transport layers). Same as above, you identify the various code paths and attempt to test them all.

> for the same reason that the kernel TCP/IP stack isn't built with TDD

I believe the primary reason why testing kernels is hard is that they are intended to run on real hardware and often with strict timing expectations. This is not the case for TLS libraries, which normally run in user space.
> The memory usage in PHP 5.5 is far less than earlier versions.

Regarding Zend Engine, does anyone have a link for just how much 'less'?
That would be a more compelling argument if any other TLS stack had ever had this particular validation bug in it. As it stands, the test case that you suppose should have existed is specific to exactly the code in GnuTLS, and applies to no other stack.
How much money is your startup making right now?
Unfortunately, it may take 2^1024 eyes on crypto code before the right set looks at the code.
Cool, but the technically similar Adafruit Qualia is already on the market for about the same price as the non-early-bird version of this.

https://www.adafruit.com/qualia
Why Candy Crush Is So Addictive [video]
If you knew every possible incorrect certificate format, or even every possible form a valid certificate could take, your comment would be more compelling. But of course, you don't. Nobody does.
Endurance running and the evolution of Homo [pdf]
I'm curious, what do you propose the industry use?
Seriously, all that's being said is:

- Here's a library that claims to validate certificates.
- Here's a TLS httpd with a forged commonName.
- for ciphersuite in $supported; do

Completing this test is an exercise for the reader, yet we're waxing philosophical about the perils of Ruby on Rails in this thread for some reason. If I'm being told by a security expert that such a framework would not be helpful, that's concerning and makes me wonder how many bugs such a framework would uncover (given that this one remained untouched for a decade).
There is plenty of good advice on this question from ex-Googlers at Quora - What advice would you give to someone who just graduated and is about to join Google that you wish you had when you joined Google? - http://qr.ae/t3Ac8 (does not require login)
If it may seem odd to you that the White House would get involved in this issue, this may uncover the mystery - this is what you get when White House hires former MPAA and RIAA executives in the administration:

http://www.techdirt.com/articles/20140303/17554626416/us-sol...
Ah, nice catch, yeah this looks like the same thing.
I think all that means is that "many users" != "many eyes".
I think ESR's ultimate point is that Open Source, if the security or bugs deeply matter to you, you can independently add your own eyes (or provide resources for the same). It's a very different matter with proprietary software.
You should give Node.js and npm a shot. It's one of the best examples of practical modularization. It's very easy and quick to test a new package, and while the documentation is often rough, the main readme on GitHub almost always has an example to show what you want to do. (Obviously Node.js is only suited for certain applications, and it's not great with graphics in particular).
I thought of exploring that, but TBH, my understanding is that you have to be a "publishing machine" to even stand the chance of being considered and unfortunately I haven't been as productive as I had wished during my PhD in terms of number of papers. Maybe I should investigate this further, but the original article also seems to indicate that an O1 is a long shot.
Why is this news? CarPlay can run on top of any platform (it could run on windows if it was ported there) just as a VNC client can. They are essentially the same concept. Apple is actually playing catch up with the Android centric MirrorLink technology.
I'm definitely not arguing against regression testing, or really even against test suites for TLS (there should be more of them, and better ones). I'm suggesting that the discipline of aggressively testing code for coverage is unlikely to make as much of a dent as moving to a better language would, and since both are extremely costly changes to the way TLS stacks are developed, we might as well adopt the one that will make us safer.
Why does anyone still care about Cryptocat?
Help SO kill the close question queue
I am really surprised that the people running this would actually put the pics & bios on the about page

The founder is no less than Eric Lefkofsky, CEO of Groupon!
Thinking correct things is more valuable than thinking popular things. They'll come around to your point of view in time.
I find this comment confusing. You claim the testing isn't done because the issues are either in state machines or in the math... yet we're looking right now at a case where neither failed and some simple unit testing would catch the issue. Isn't it a false dichotomy to say it's not worth unit testing (not TDD) unless we switch to safer languages? If the code is less secure than RoR because of lack of testing, then what's wrong with getting it to that level first? At least it won't require a rewrite from scratch.
There's absolutely nothing Rube Goldbergian about the business model. Broadcasters generally have a right to control the distribution of their content, with the exception that in return for being able to use the airwaves, they must allow people to receive over the air television freely. That's the bargain. It's a clearly defined benefit coupled to a clearly defined obligation. Obviously, the broadcasters have a legitimate interest in not wanting companies like Aereo to game that loophole for their own profit. The public mandate isn't implicated at all. Nobody is talking about cutting off conventional over the air TV. Streaming service like Aereo was never part of that bargain.
That's really good, thank you!
JetBrains really does an astounding job.

Also it seem Chronon debugger is free with IntelliJ IDEA 13.1 Ultimate http://blog.jetbrains.com/idea/2014/03/try-chronon-debugger-...
Indeed it's free to enter, just make sure you qualify in the case you win. The required qualifications are minimal but worth reading into it so you don't pay any money and not get the visas.

We went through it and it took about half a year for everything to be ready.

Lucky wife :)
I can imagine a dead pixel would be like your spaceship.
I've always wondered about that myself... that's what I meant by "bogus" :-) Thanks!
Two? It won't even get you one depends on geographical locations.