skysight-inc/HackerNews huggingface dataset:
A point to note is that only those who were born in India/China have to deal with this long lead time. If you weren't born in any of these countries that have high immigration rates into America, you should have < 3-4 years path to a Green Card.
Commit introducing the bug:

https://www.gitorious.org/gnutls/gnutls/commit/0fba2d908da6d...
Resolved: GIFs Are Actually Important
The guys over at http://startuphouse.com/ have short term stay options in the heart of SF (It's not publically stated, yet, but I think ~$35/night, so $1k/month). Might be a good option for people doing YC for a summer and want to keep things extra lean.
Reading your original reply, I walk away with these four points from your four paragraphs, now with the knowledge that wherever you typed "TDD" you could mean "testing" as well.

- Testing distributed cryptography is difficult.
- Read a book.
- You're a web developer and don't know the first thing about
testing TLS stacks, clearly.
- Testing does not improve systems security, as evidenced by
Ruby on Rails: Rails uses testing and it's insecure.

Seriously, re-read your comment. More than half of it is just unnecessary and dilutes what little point you've made into something unrecognizable in the snark.
Disclaimer: My understanding of the goto fail bug is based on agl's writeup, and my understanding of the GnuTLS bug is limited to this article.

In both of these cases, it seems the code starts with the assumption that the cert is valid and then tries to find various conditions to invalidate it. Isn't that backwards? Why not start with an assumption that the cert is untrusted until you've proven otherwise?
Building Distributed Systems with Go and Mesos
It made perfect sense. I think the reader might be the problem.
This case is going to follow the legal principle of what the government wants the government gets.

For example shopping malls and corporate headquarters are a public use of land, while growing a plant in your closet and consuming it in your home is interstate commerce.
It's not just that, it also doesn't have automatic destruction of objects, so any local array or structure containing a pointer needs to be laboriously freed by hand.

And in other words, nobody should be writing anything in C. Ever. The need to be compatible with programs written in C violates my rule against writing anything in C and is therefore not a valid reason to write crypto stacks in C.
Cable companies pay them a lot of money to retransmit network TV. If Aereo is legal, that means that cable companies could use same trick destroying a large portion of their revenue.
Quotes Of Technology
I've always been fascinated with the juxtaposition of technology in music, not only in recording, but in the keyboard. It's amazing the way you can apply technology to an art form.

Read more at:http://www.hallofquotes.com/quote/2420.html
You are falling into a predictable fallacy. Predictable in that this comes up all the time when people talk about the government. The fact that the government provides a service does not imply that the service would not exist if the government did not do it. We could absolutely have cabs without the TB problem without the government. In fact, in areas where the government does not enforce its own monopoly, you see competition with government-provided services flourishing. UPS, FedEX, and DHL versus USPS. Private college loan providers. Private universities. Private schools. On and on. The idea that without the government doing it, we are going to have rampant TB-infested taxi drivers is just silly. No one wants to use such a taxi and they do not need the government to tell them that.

> "This is the big problem I have with the libertarian free market ideal: it's fundamentally reactive, not proactive."

I do not know if I should take that statement seriously. I expect if you think over that statement for even 30 seconds you can see why it is both a complete non sequitur and insane.

1) Laws are obviously reactive. I would bet all the money in my pockets against all the money in your pockets that TB testing was put in effect as a reaction to an event in which a taxi, bus, or train driver was spreading TB.

2) The free market is exactly as reactive or proactive as people are. This is its virtue. People providing other people what they want is the whole point, both of markets and, it is claimed by those who believe in the State, the government. No organization, government or otherwise, can get away from being reactive to human needs unless it provides things people do not want or need, and in what way would so doing be good?

3) It does not matter anyway. The point of all this is that people should be free to pursue their desires, regardless of the considerations of people who think they know better and are worried about things being "reactive" or "proactive". These concerns are simply petty against the moral position of freedom.

Look, I enjoy a good discussion on the internet as much as anyone. I have learned a lot from reading comments on HN. But I get the impression that you have not read any of the good arguments against your position. I am a poor substitute for any of the major thinkers in the libertarian tradition. If you want to save yourself reading, you can even watch videos of Ayn Rand, Milton Friedman, or Thomas Sowell on YouTube. I recommend Stefan Molyneux's show, Free Domain Radio. He discusses these issues often. You could even call into his show and have a long discussion with him on the topic. He entertains such calls often.
Harvesting renewable energy from Earth’s mid-infrared emissions
There are some hard, unforgiving physical limits on resolution of photographs from orbit, even with digital correction of the images. For one thing, the camera is necessarily far away, and moving fast at the same time.[1] I was able to follow the specific link just kindly submitted here, which of course shows a rather large object (a commercial airliner). The satellite company's image gallery[2] compares quite favorably in resolution to an earlier company's image gallery we discussed here on HN about three years ago. But it will be quite a while--perhaps never--before some of the statements about satellite imagery that were already being made for propaganda purposes in the 1960s will be anything close to reality, even for classified military intelligence satellites. We won't be reading people's mobile phone screens from orbit ever, probably. Unmanned drone aircraft are at nearer distance and travel at slower speed, and provide a much better platform than earth-orbiting satellites for high-resolution spying.

[1] http://books.google.com/books?id=6DBnS2g-KrQC&pg=PA204&lpg=P...

http://www.kmc63.com/phy1000/worksheet-licenseplates.pdf

[2] http://www.firstimagery.skybox.com/
There's short-term accessible savings, and your retirement.

Part of those "subsistence wages" are the funds which cover your expenses when you aren't working. Whether due to disability, between gigs (part of Smith's detailed discussion of the basis of wages in Book I, Ch. VIII of Wealth of Nations, I recommend it strongly), or in old age.

Your 401k funds are not generally available to you to meet pre-retirement expense needs. There are some exceptions, but in almost all cases, you're very strongly advised not to make use of them: you can borrow against 401k funds, but this 1) costs you the earnings on those funds (part of the basis of the whole concept) and 2) the loan must be repaid (though without interest) if you terminate a relationship with a loan sponsor. Which is to say: at the very time you're most likely to have a cash crunch (you're transitioning employment), you have to repay the loan.

Early distribution is also possible, but with very significant financial penalties.

Your comment is juvenile and specious.
This doesn't impact every single Linux server online right now, the Apple bug impacted every iOS device which was in use.

Orders of magnitude different degrees of harm.
Apache can (and maybe should) use gnuTLS
Ask HN: Is $100k for 50% just a terrible idea?
My cofounder and I were looking at accelerators, especially the ones around Chicago and came across Lightbank. They have a program called Lightbank Start http://www.lightbankstart.com/ where they give you an 100k seed in exchange for 50% of your company.

We're new, have half of an idea, and no track record. Should we consider applying to them? (We are, of course, applying to the famous accelerators).
Nelson Mandela Freedom Quotes
For to be free is not merely to cast off one's chains, but to live in a way that respects and enhances the freedom of others.

Read more at: http://www.hallofquotes.com/quote/18608.html
Why do you think building new houses is bad for the environment?

Indeed: per Edward Glaeser's book The Triumph of the City, denser cities are much more environmentally friendly than suburbs, exurbs, or rural areas.

Everyone has to live somewhere.
No. CreateFile returns INVALID_HANDLE_VALUE which is -1. Compare this to CreateSemaphore which also returns a HANDLE, but returns NULL[1] on failure.

Returning int(0) as a failure is often done in C if the return value is a boolean since C lacks a true boolean type.

[1] NULL should never be used in actual code because it is ambiguous.
Raymond's quip may be somewhat hyperbolic for effect, but I think it's harder to argue with the assertion that "with many eyes, many bugs are shallow". True, there are some things that are esoteric and which only a few very specially trained persons would notice, but in many cases, it's not that way. The fact that a random person will show up on the mailing lists of open-source projects, even minor ones, and have a bugfix patch validates the theory that an open codebase contributes significantly to software quality, and particularly a greater degree of software buglessness.

I think that people who argue over Raymond's quip are just being pedants. It's true that not all bugs will be shallow, no matter how many eyes are on software, but I don't think the expression was meant to be taken literally.
For to be free is not merely to cast off one's chains, but to live in a way that respects and enhances the freedom of others.

Read more at http://www.hallofquotes.com/quote/18608.html#OiEf9RybEMiL0J0...
Can we all finally accept the fact that what is most needed now is not a new whizbang but a comprehensive review of all of the core pieces of software that we depend on as a base for making new whizbangs?

How many critical and ancient bugs still remain undiscovered?

Everyday there is a new Telegram, Cryptocat, etc. all presumably being constructed on top of insecure libraries. What progress can we make with such shaky foundations?

There has been word that the Linux kernel devs are considering slowing new feature adoption for a time while focusing on bug discovery and elimination.

PLEASE, EVERYONE ELSE CONSIDER DOING THE SAME.
TV and film distribution are dying industries grasping at straws.

It's an end cycle game like aggressive stage 4 cancer treatment for the elderly, you blow all your money on a strategy that might buy 5 years of hell.
This is going from amusing-scam to transparent-scam really quickly.
I liked Venture Deals: Be Smarter than your Lawyer and VC.

Amazon affiliate link: http://www.amazon.com/gp/product/1118443616/ref=as_li_ss_tl?...

Amazon non-affiliate link: http://www.amazon.com/Venture-Deals-Smarter-Lawyer-Capitalis...

(Choose whichever you prefer.)
Do you travel much?
Recently launched an Expedia-like online travel marketplace for charter planes. Would love to interview some folks for your thoughts and feedback.

www.zigair.com
These are great, both for the career advice and for the glimpses into the cultural side of Google. Thanks!
The article compares PHP now to PHP in the past. But programmers should not do this, they should compare PHP to other languages and their ecosystems, and conclude that it is not fit for a greenfield project.

The new libs'n'tools are nice; good to see them showcased. But the bottom line for any developer should be to avoid it --like Perl-- for any from-scratch code. This is a legacy language now.
Living in conditions which are acceptable for a given cost in India would be prejudicial to hiring consideration in the US.

The question isn't "absolute standard of living", but "what is a necessary income to provide for a supply of labor".
Yeah, I remember that. It seems like the best evidence that this is for a new BttF movie.
7 proven secrets of high converting checkouts
Updating dynamic fields and nested arrays in MongoDB
>What I read him as saying (and agree with) is that he's surprised that GnuTLS isn't tested against known-bad certificates in a simple integration test that doesn't require a Ph.D. to set up, as you imply.

Define "known-bad" in a general enough way that a specific test can be created to cover the entire range of "bad" certs. That's quite difficult, and, probably isn't realistically possible to go through all the "known-bad" if you want your tests to run quickly.

Realistically, all you can do is have regression tests to make sure that the found bugs aren't repeated in future releases.
goto is just a tool and not to blame here. I don't know what you could call the root case of this one. Incomplete testing maybe?

In Apple's case "goto" made it possible for the bug to occur, but there's no reason a different statement (or other typo) could cause equivalent damage.

I think a common thread with both of these bugs is testing the failure cases, but to be fair to both validating software by finding bugs and/or validating functionality is affirming the consequent and you eventually need to ship.
Is this really another problem will poorly written goto's?
Fair enough. :)

Out of curiosity, what is your target customer? People running their own dedis probably are alright to grudgingly setup a monitoring solution, and people who are just using the ~=cloud=~ probably don't care.

What's your ideal customer?
Aptitude tells me there are 179 packages dependent on libgnutls26 - about 20 are installed including: chromium-browser, cups-daemon, libldap, librtmp, libvncserver0, libwireshark3, telepathy (KDE), vlc-nox.

The only thing I really know I use TLS for is email server connections via Thunderbird however.
I've been there. As far as testing goes, my vote is that, when you're at the beginner level for a framework/language/technology, put off testing until later. Get it to work normally first, and then write your automated tests later.

You already have a hard problem on your hands, figuring out how to get something to work normally in this new environment. Don't compound that right off the bat by trying to learn a new testing system too. In addition, reality is the ultimate test. By getting it working normally first, you know that it actually works, so if you write a test against it, and the test fails, then the test is probably wrong.

Once you get good with it, you should be able to reverse it and go to a more TDD-like workflow - write tests and code first, then manually test, and have confidence that if the tests work, then the app will work for the users too.
No @2x image? Seems like it would be helpful if you're trying to highlight a clear, readable typeface. Looks kinda blurry on my retina MBP.
Interestingly enough, there was a student at Harvard in the 1960's (recounted in the Varieties of Psychedelic Experience), who did a placebo-controlled study of psilocybin (see: http://en.wikipedia.org/wiki/Marsh_Chapel_Experiment).

Long term follow-ups seem to indicate that the differences (in terms of a self-report questionnaire, at least) were maintained over 25 years.

In the book at least, it was concluded (by the primary researcher) that the blinding was completely ineffective (though I don't think that this was confirmed with a manipulation check).

I would say that placebo-controlled studies of psychedelics, for similar reasons that placebo-controlled studies of other drugs (cigarettes, coffee, alcohol) will be difficult. Namely that a placebo should be identical to the treatment in every respect except for the active ingrediant, and what's the active ingrediant?

Its really well-worth checking out the Varieties for some good pointers to research in the 50's and 60's, there was quite a lot of it, and although some of it was methodologically unsound, and there are very few RCT's, the sheer amount of studies should probably carry some weight.
(See Edit) Count me in the "me too" category. Pretty sketchy process. I've revoked their permission to my Facebook account and pray my cc info is not being sold on the Russian black market. Edit: Trevor at TinkerCoin cleared up the issue and the BTC are in my Coinbase wallet. So Kudos to them.
No, this is the one written by a guy that just wanted to make "secure chat" accessible. And went on to have plenty of flaws. (And no, Telegram is another one, where they came up with their own scheme and brushed off all criticism by saying they had some math PhDs so that's that.) IIRC the web version does JS crypto and tries to sell that as more secure.

Cryptocat and Telegram seem to be very popular though, proving again that technical superiority isn't really a good indicator of product success. (WhatsApp had terrible security too, at least for a while, but they never went on about how secure they were.)
That and it mimics a similar prank that Zemeckis back when BttF 2 came out.
I think the counter to Eric's claim is this:

If it is open source, as in a Debian release, an end user's recourse is to fix it themselves.

If it is commercial, be it closed source or not, an end user's recourse is to sue the supplier (or something similar).

The commercial supplier has a financial incentive to get it right, the open source developer has an intellectual and street cred incentive to get it right. I'm not sure which one actually works better, I know that the popular opinion is the ESR eyeballs claim but it's not clear to me which gets it more correct. Seems like they both fail at times.
It's actually not horrific IMHO in the context of C when you use it explicitly in this fashion, as a "poor man's exceptions with resource cleanup". And it's not simply a method to avoid typing, it helps with the very common design pattern of:

acquire A
acquire B
acquire C

do_work

release C
release B
release A

It has all the benefit of "common return path" (since it is a common return path) without the 8 levels of indentation and random subsidiary conditional checks that obscure the code logic and add their own confusion. Instead you fail as fast as possible.

Like any other design pattern (C or otherwise) it's easy to misuse or abuse and it's not suited to every combination of library usage.
I hesitate to even bother in this environment, where anything other than studies that meet the standards of rigor of Hacker News are dismissed, however:

A lot of people have a lot of idea about it, because a lot of psychiatrists and psychotherapists used LSD on their patients (and themselves) before it was outlawed.
I'd be okay with a few hundred too. The issue for me is that for web use prices are easily available. For programatic use, it suddenly becomes a conversation about licensing with a salesman, and I don't have time for a long conversation.
Feminine Winter Layers
Thanks for that line of code. I liked the writing too. It would be nice if there was a compressed mode where you could see the statements and planets without scrolling through space but that would defeat the purpose of showing you the scale of the solar system.
"I don't care if people use cannabis (and I am strongly in favour of legalisation) but I fucking hate the refusal of many cannabis users to even contemplate any negative effects of cannabis."

Don't get me wrong; I don't refuse to contemplate the negative effects of cannabis, of which quite a few have been hypothesized, some observed. When I said "alcohol is probably much worse than weed," I didn't say "weed is a free lunch." Just want to make sure I'm clear on that.

There are cannabinoid receptors in the brain (and other organs). Our current understanding of them is far from complete, and we know that smoking weed habitually will reregulate them, and not necessarily for the better. I'm not one of those hippy-dippy types who thinks there are no ramifications involved in smoking weed.
The people promoting psychedelics back then were also being quite irresponsible. Dosing people without consent or knowledge and whatnot. All the "science" done then was terribly flawed.

Not that they should be responsible or that I'm blaming them for the backlash, but a bit more tact may have helped the movement in the long-term.
You realize that most lower things are written in or base on C, right.
In short, it's not a bad practice in all cases and, like most issues, it depends.

The "goto considered harmful" article by Dijkstra is more nuanced (and that wasn't even its intended title) and doesn't really address the way the goto you are seeing are used.

They are a very common pattern in C, for error checking and cleanup in case of error. It's much more readable than to nest conditional statements.

if (some_parameter > max_valid_value)
goto error;
if (some_function() <= )
goto error;
...
...
if (some_alloc() == NULL)
goto error;
...
...
...
...
error:
// cleanup what needs to be freed,...

It can also be quite useful to exit nested loops for example. It's commonly used in low-level C.

However, when you start goto'ing backwards instead of always forwards, it becomes terrible for readability, so it is avoided (well, most of the time).

For more reading on the subject, this excerpt from Code Complete by Steve McConnell discusses the subject further :
http://www.stevemcconnell.com/ccgoto.htm
APIs Coming Out Of The Netherlands
My thoughts on this are more about the previous TLS disclosure, not this one, where an integration test that says "this invalid certificate should fail validation" probably would have caught it. But, this isn't my argument to make as I don't know enough about it, I just want to see the actual coherent argument made instead of a side tangent as we're seeing here.
True, but my understanding (which could be wrong; grain of salt and all that) is that the study was designed to determine whether a psychedelic could be used in a therapeutic environment safely. Now that that's been established--none of the subjects deaths were in any way related to the LSD--they will move on to trying to more accurately measure outcomes.
IntelliJ is great, but I personally have found this feature to be minimally helpful and non-intuitive. I hope others benefit more than I have. Perhaps I shouldn't knock it, but I think that the time could have been spent on more worthwhile efficitncy improvements.
Early access to GT Machine Learning course on Udacity 
I helped Dr. Charles Isbell (Georgia Tech) and Dr. Michael Littman (Brown) build this course as a part of the Georgia Tech online MS program. Charles and Michael have different views on how they think about various Machine Learning topics. This course will give you a unique learning experience to learn Machine Learning from both of their viewpoints.

I really enjoyed working on this class with Charles and Michael, and I would like to hear your feedback.

Udacity is releasing this course on 3/17, but wanted to give early access to a limited number of people on HN. If you are interested, sign up here: http://goo.gl/kCiYI9

This will let you view the free version of the course (includes everything except personal project support and certificate). If you miss the cut-off, don't worry, you can see the course for free beginning on 3/17!

Course page: https://www.udacity.com/course/ud675 (watch the trailer!)
UK: Spring like weather at present, an invigorating 5 degrees C this morning at 7am.
It is actually far too fast, several times the speed of light. If you really wanted to realize how vast and empty space is, you should make it scroll slower.
How many of its programs link to gnutls though? And if I'm not misunderstandig only client software is vulnerable to the cited attack.
No, see my link above. Goto is not the bug.